ML19325F394
| ML19325F394 | |
| Person / Time | |
|---|---|
| Site: | Fermi  |
| Issue date: | 11/14/1989 |
| From: | Davis A NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML19325F388 | List: |
| References | |
| 50-341-89-06, 50-341-89-6, EA-89-106, NUDOCS 8911210038 | |
| Download: ML19325F394 (2) | |
Text
e 8.
t 0
e
)
)
NOTICE OF VIOLATION Detroit Edison Company Docket No.
50-341 Fermi 2 License No.
During an NRC special safety inspection conducted February 3 to April 12, 1989, a violation of NRC requirements was identified.
In accordance with the " General Statement of Policy and Procedure for NRC Enforcement Actions " 10 CFR Part 2
. Appendix C-(1989), the Nuclear Regulatory Commission proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205.
The particular violation and associated civil penalty are set forth below:
e 10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established to assure that applicable regulatory require-ments and the design basis for safety-related structures, systems, and i
components are correctly translated into specifications, drawings, procedures, and instructions.
USFAR Section 1.2.1.3.7 states, in part, essential safety actions are carried out by equipment in sufficient redundancy and independence so that a single failure will not prevent the required actions.
Nuclear safety systems and engineered safety features are designed to maintain i
operability under all plant-related and site-telated events (e.g., earth-quakes, tornadoes, floods, fires).
Features of the plant essential to the mitigation of accident consequences are designed for fabrication and erection to quality 3tandards that reflect the importance of the safety function to be performed. The plant is designed, fabricated, erected, and will be operated in such a way that under accident conditions the release of radioactive materials to the environment is within the requirements of 10 CFR Part 100.
UFSAR Section 3.1,2.2.7 states, in part, the secondary containment is maintained at a negative pressure under accident conditions to ensure against leakage.
The Interior atmosphere is. processed to control emissions to the environs so that offsite dose levels are maintained well below the requirements of 10 CFR Part 100.
Contrary to the above, as of February 4, 1989, the design basis was not correctly translated into specifications and drawings in that the pneumatic supply system for the railcar door seals was not designed and installed as a safety-related, seismic system with sufficient redundancy and independence such that a single failure would not prevent the required actions.
This resulted in the railcar doors being incapable of providing the required secondary containment integrity or the required flood protection under certain design basis conditions.
This is a Severity Level 111 violation (Supplement I).
h hk 1
G
Pursuant to the provisions of 10 CFR 2.201, the Detroit Edison Company (Licensee) is hereby required to submit a written statement or explanation to
-the Director Office of Enforcement, U.S. Nuclear Reguletory Commission, within 30 days of the date of this Notice. This reply should be clearly marked as a
" Reply to a Notice of Violation" and should include for each alleged violation:
(1) admission or denial of the alleged violation; (2) the reasons for the violation.if admitted; (3) the corrective' actions that have been taken and the results achieved; (4) the corrective actions that will be taken to avoid further violations; and (5) the date when full compliance will be achieved.
If an adequate reply is not received within the time specified in this Notice, an Order may be issued to show cause why~the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken. Consideration may be given to extending the response time for' good cause shown. Under the authority of Section 182 of the Act 42 U.S.C. 2232, this response shall be submitted under oath or. affirmation.
The responses to the Director, Office of Enforcement, noted above should be addressed to: Director, Office of Enforcement, U.S. Nuclear Regulatory Commission ATTN: Document Control Desk, Washington, D.C. 20555, with a copy to the Regional Administrator, Region III, U.S. Nuclear Regulatory Commission, 799 Roosevelt Road, Glen Ellyn, Illinois 60137 and a copy to the NRC Resident Inspector at Fermi.
FOR THE NUCLEAR REGULATORY COMMISSION 3
.'.. Bert Davis Regional Administrator Dated at Glen Ellyn, Illinois this 14th day of November 1989 P
I
~
4
i
[!
U. S. NUCLEAR REGULATORY COMMISSION REGION III y
Report No. 50-341/89006(DRP)
. Docket No. 50-341 Operating License No. NPF-43 Licensee:
Detroit Edison Company 2000 Second Avenue Detroit, MI 48226 Facility Name:
Fermi 2 Inspection At:
Fermi Site, Newport, Michigan
- Inspection Conducted:- February 3 through April 12, 1989 Inspectors:
W. Rogers S. Stasek K. Ridgway fV glc}
Approved By:
Mark A. Ring, Chief f
Reactor Projects Section 3B Date Inspection Summary L
Inspection on February 3 through April 12, 1989 (Report No. 50-341/89006(ORP))
3 1:
Areas Inspected:
Special safety inspection associated with reactor building l
railcar door design deficiencies.
Results:
Two apparent violations were identified for failure to properly design the railcar door seals for flood protection and secondary containment integrity requirements.
These will be the subject of an enforcement conference.
i l.
A third apparent violation concerning the evaluation of the railcar door design i
I deficiencies as they relate to flood protection will be the subject of further inspection in conjunction with other safety evaluation matters under consideration 11 by the inspectors (Paragraph 7).
1 OO5d3?? 454!sg) e l
o l
E
].
s.:
DETAILS 1,
PersonsContaStj i
a.
Detroit Edison Company f,
+A. A1chalabi, Nuclear Engineering
+*P. Anthony, Compliance Engineer
+*S. Catola, Vice President, Nuclear Engineering and Services
+J. Contoni, Nuclear Engineering
- G. Cranston, Director, Nuclear Engineering
+L. Fron, Nuclear Engineering
+*D. Gipson, Plant Manager-
+*L. Goodman, Licensing K.'Howard, Principle Engincer, Plant Systems
+*R. McKeon, Superintendent, Operations R. Matthews I&C Supervisor
+W. Orser,'Vice President, Nuclear Operations T.. Riley, Supervisor, Compliance
+A. Settles, Technical Engineer
+F. Svetkovich, Assistant to Plant Manager
+B. Sylvia, Senior Vice President
- F. Swartz, Principle Engineer, Quality Assurance
- G. Trahey, Assistant to the Senior Vice-President
+J. Walker, Nuclear Engineering b.
U. S. Nuclear Regulatory Commicsion f
+*W. Rogers, Senior Resident Inspector
+*S. Stasek, Resident Inspector K. Ridgway, Senior Resident Inspector, Dresden Station
- Denotes those attending the exit meeting on March 17, 1989.
1
+ Denotes those attending the exit meeting on April 12, 1989.
1:
2.
Design Deficiencies Identified at Pilgrim Station 1
On August 8, 1988, the NRC issued Generic Letter 88-14, " Instrument Air Supply System Problems Affecting Safety-Related Equipment," to all The generic letter requested each licensee operating license holders.
to verify that the design of their instrument air system, including l'
actuated components, was in accordance with its intended function and L
safety-related components would perform as expected during all During this review the Boston Edison Company design-basis events.
discovered two design inadequacies at their Pilgrim Station.
Pilgrim l
E Station is a BWR 4; the same as fermi 2 The first design deficiency dealt with the torus-to-reactor building These valves are required to open to prevent vacuum breakers.
excessive vacuum inside the primary containment and close for primary l
2 1
1 q
m.
l containment integrity.
Accumulators were installed to provide air to
/
the pneumatically controlled torus-to-reactor building vacuum breaker valves to assure valve closing capability.
However, these accumulators l
were undersized and would not provide closing capability for the requisite length of time.
The second design deficiency dealt with two in-series reactor building railcar airlock doors which form a part of the secondary containment boundary.
The design of the railcar door included pneumatically j
inflated seals which also formed part of the secondary containment boundary.
However, the air supply for the seals was determined not to be seismically qualified.
Subsequently, the Pilgrim Station installed flexible flaps on the inner railroad door and verified secondary containment integrity through testing with the pneumatic seals deflated.
3.
Torus-to-Reactor Building Vacuum Breaker Deficiency The torus-to-reactor building design deficiency came to light first.
This design deficiency was determined not to be applicable to Fermi as documented in Inspection Report 89004.
4.
Secondary Containment Deficiency Secondary Containment Description / Requirements a.
10 CFR 50, Appendix A, Criterion 16, requires a reactor containment and associated systems capable of providing an' essentially leaktight barrier against the uncontrolled release of radioactivity to the environment. Updated Final Safety Analysis Report (UFSAR)
Section 3.1.2.2.7 describes the licensee's conformance to Criterion 16.
In that description it states, "The secondary containment, a building that contains the primary containment as well as portions of the reactor process systems and refueling facilities, is maintained at a l
negative pressure under accident conditions to ensure against leakage.
)
l The interior atmosphere is processed to control emissions to the environs so that offsite dose levels are maintained well below the l
l requirements of 10 CFR 100."
At Fermi the reactor building is the secondary containment and was designed and constructed as a Category I structure.
UFSAR i
Section 6. 2.1. 2. 2.1 discusses secondary containment penetrations.
That section states that access openings into the reactor building l
are equipped with weather-strip-type seals for airtightness and one of thes-access openings is the railcar entry.
All access I
openings have a vestibule with double coors to maintain secondary containment integrity.
The double doors are either interlocked to l
prevent the opening of one door until the other door is closed or one of the doors is keylocked closed.
In the case of the railcar entry doors the interlock feature was utilized.
I l
3
a v
A.
I To have secondary containment integrity requires an intact secondary contninment/ associated penetrations and a Technical Specification designated negative pressure within secondary containment.
During normal operations a negative pressure of at least 0.125 inches vacuum is maintained by the reactor building ventilation system.
During accident conditions a negative pressure of at least 0.250 inches vacuum is maintained by one Standby Gas Treatment System (SGTS)..These negative pressure c
requirements are delineated in the surveillance requirements of Technical Specification 4.6.5.1.
Secondary containment integrity is a safety-related protection f
system,and as such must conform to 10 CFR 50, Appendix A, Criterions 20, 21 and 22.
These criteria require protection systems to be able to operate after an operational occurrence (loss of offsite power), be redundant and independent to assure that no single failure results in loss of the protection function and be able to withstand the effects of natural phenomena without loss of the protection function.
UFSAR Sections 3.1.2.3.1, 3.1.2.3.2 and 3.1.2.3.3 explicitly state-conformance to these criteria.
UFSAR Section 1.2.1.3.7 states in part, " Essential safety actions are carried out by equipment in sufficient redundancy and independence so that a single failure of active components will not prevent the required actions... Nuclear safety systems and ESFs are designed to maintain operability under all plant-related and site-related events (e.g., earthquakes, tornadoes, floods, fires)... Features of the plant essential to the mitigation of l
accident consequences are designed for fabrication and erection to quality standards that reflect the importance of the safety i
function to be performed...The plant is designed, fabricated, erected, and will be operated in such a way that under accident
+
conditions the release of radioactive materials to the environment is within the requirements of 10 CFR 100."
b.
Licensee Response to Pilgrim Deficiency In late January 1989 DECO senior management received information from the NRC Region III Division Director discussing the railcar door problem at the Pilgrim site.
DECO senior management provided l
this information to the engineering director on January 30, 1989, who had the information distributed to his applicable supervisors.
l L
On February 1,1989, the information was given to the engineer L
responsible for reviewing Generic Letter 88-14.
Earlier that same day a resident inspector made inquiries about Fermi's railcar door configuration in response to Region III inquiries which were directed i
to the same responsible engineer.
The engineer reviewing Generic I
Letter 88-14 performed an initial review of the situation.
By the I
next day the engineer determined that the pneumatic supply to the railroad door seals was not safety-related or able to withstand an l
p t
4 L
l'.
n l} '-
q'
((
Following a meeting on February 3, 1989, the matter was I
turned over to~ DECO civil engineering personnel for further evaluation.
Civil engineering had been the department responsible for the original
' purchase / design requirements for the doors during initial construction.
During these initial reviews it was noted that an external flexible weather seal was installed on the outside railroad door.
Personnel felt that this weather seal probably was capable of maintaining secondary containment. integrity since it appeared to be similar to the successful design modification applied by the Pilgrim station.
During the early afternoon on February 3, 1989, Deco management met and informed the resident staff that the air supply to the railcar door seals was not qualified but there was reason to believe that the secondary containment fuaction could be met with the seal-deflated.
DECO proposed a spec:a1 secondary containment test to verify secondary containment integrity without the pneumatic seals inflated.
In parallel, Deco engineering began preparing an engineering design change (EDP), EDP 9963, to install additional weather stripping around the external railcar door should the test fail.
On February 8, 1989, the test was performed.
The test indicated that one Standby Gas Treatment System (SGTS) could not maintain an adequate negative pressure with both railroad airlock doors t
closed and their seals deflated.
Upon conclusion of the unsuccessful test, maintenance personnel installed weather stripping in the external cracks of the outer railroad door in accordance with EDP 9963, and a draw down/ leak rate test was satisfactorily performed with the doors in the above status.
Administrative controls were put in place to prevent the opening of the railroad doors until further testing could be carried out.
During the February 8, 1989, secondary containment test, extremely high winds were experienced which caused doubt as to the validity of the test.
Therefore, on March 10, 1989, the licensee repeated the secondary containment test in low wind conditions with both railroad doors closed, the weather stripping of EDP 9963 removed from the outer railroad door and the pneumatic seals deflated.
One SGTS was unable to maintain a negative pressure in the reactor building.
The weather stripping was reinstalled and a successful secondary containment test performed.
c.
Inspector Followup (1)
Initial Actions and Test Witnessing When the second Pilgrim design deficiency came to light in late January 1989, Region III directed the resident inspector staf f to contact the licensee about this matter.
Contact was made on February 1, 1989, with DECO engineering.
5
.. c I
3
\\
l DECO management informed the resident staff on February 3, 1989, that the railroad airlock pneumatic door seal air supply was not seismically qualified but there was an installed external flexible weather seal (a part of the original design) j on the outer railroad door.
The licensee felt that secondary containment probably could be maintained without the pneumatic seals being inflated..This flexible weather seal appeared to be equivalent to Pilgrim's flexible flaps.
However, testing would be performed to confirm this.
Three inspectors witnessed the test conducted on February 8, 1989, installation of the weather stripping under EDP 9963, and the subsequent' secondary containment integrity verification.
Two inspectors witnessed the March 10, 1989 test, reinstallation of the weather stripping, and subsequent secondary containment integrity verification.
During the testing sequences the inspectors verified that approved procedures were used, the procedures were followed, appropriate Limiting Conditions for Operation were met and the NRC notified via the ENS in the appropriate time frames.
Finally, following installation of the weather stripping on February 8th and March 10th, the inspectors confirmed that secondary containment was restored.
1 (2) Evaluation of Wind Conditions Extremely high winds, approximately 18 mph at the 10 meter level, were experienced during the February 8, 1989, secondary containment integrity test.
Such wind conditions negatively bias this type of testing.
This is due to the acceptance criteria utilized for determining a successful test.
Part of Technical Specification 4.6.5.1 requirements for secondary containment integrity is the ability of one SGTS to maintain greater than or equal to 0.25 inches of vacuum.
The 0.25 inch of-vacuum is derived from NRC Standard Review Plan, Branch Technical Position CSB 6-3, " Determination of Bypass Leakage Paths in Dual Containment Plants," which states in part, "...a positive pressure is defined as any pressure greater than -0.25 inches water gauge to account for wind loads and the uncertainty in the pressure measurements.
Whenever the pressure in the secondary containment volume exceeds -0.25 inches water gauge, the leakage prevention function of the secondary containment is assumed to be negated."
The wind loads of CSB 6-3 are only applicable up to the maximum wind speed utilized in the atmospheric dispersion model for radioactive releases when a positive pressure exists. Therefore, the inspector concluded (as did the licensee) on the date of the test the wind speed appeared to be in excess of the atmospheric dispersion model speed and, therefore, the validity of the results was questionable.
s 6
l-
7 p.^
.T
)
e' 4
J (3)
Instrumentation Utilized to Verify Secondary Containment Integrity i
(a) Instrumentation Description Section 6.2.1.6.2 of the UFSAR states in part, " Secondary j
containment pressure is normally controlled by the reactor / auxiliary building ventilation system.
' Pressure sentors outside the building are arranged so that the lowest pressure on the building (due to wind) is compared with the building internal pressure which 4
is maintained at 0.25 inches of water below the lowest outside' pressure...."
There are four differential pressure sensors utilized
~
to control reactor building pressure by.the HVAC system.
The sensors are located on the fifth floor of the reactor building with one. sensor mounted on the North, South, East and West walls.
An auctioneering circuit selects the most positive sensor reading to input into the HVAC system, select control room annunciators-and provide indication in the control' room on recorder T41-R800A.
This comprises Division 1 of the differential pressure indication system.
There is another set of four differential pressure sensors located on the fifth floor of the reactor building. These sensors feed'into an auctioneering circuit which also selects the'most positive sensor reading.
This high auctioneered signal inputs into select control room annunciators and control room I
recorder T41-R800B.
This comprises Division 2 of the differential pressure indication system and performs no control function.
f Drawing 51721-2613-54 schematically describes the Division 1 and 2 pressure sensor / circuit configuration.
L L
(b)
Instrumentation Accuracy The inspector reviewed the instrument specification sheets of both differential pressure sensing loops to l
determine the accuracy of the instrument loops.
In j.
both cases the loop accuracy was 0.1125 inches of L'
Therefore, the inspector concluded that the vacuum.
l instrumentation was adequate for confirming Technical Specification Limiting Conditions for Operation and l>
Surveillance Requirements.
L 1
l i
e 3
q-E (c) Use of an Averaging Technique Following the February 8,1989, secondary containment integrity test certain licensee personnel began considering use of an averaging technique to determine the 0.25 inches i
of vacuum acceptance criteria.
Specifically, the secondary containment wall readings would be added together and divided by the number of readings.
The result would be compared to the 0.25 inches of vacuum to determine whether an acceptable test had been accomplished.
That day the inspector contacted appropriate Nuclear Reactor Regulation personnel to ascertain whether this would be an adequate means of reeting the Technical Specification negative pressure requirement.
The final conclusion was averaging is not adequate.
The negative pressure requirement is not based upon an average but every section of the building must meet the 0.25 inches of vacuum.
This information was conveyed to the licensee the ner.t day.
(d) Actual Configuration During the test witnessing it came to the in:pectors' attention that the Division 2 south wall sensor was out of service and was jumpered out of the auctioneering circuit.
Temporary modification 88-0048, Rev. A, of August 2, 1988, authorized the removal of this sensor from the circuit.
Under Section 4.7 of the temporary modification evaluation form the question, "Are all affected Critical Plant Drawings, Procedures, Technical Specification identified correctly?" was answered L
"yes,"
However, Procedure 24.405.03, " Secondary Containment Integrity Test," was not identified.
In Section 5.2.9 of that test, recorder T41-R800B is used exclusively to verify that 0.25 inches vacuum is i
maintained when SGTS Division 2 is used to perform the secondary containment verification test.
Due to wind direction during the testing the unmonitored wall could be experiencing the most positive differential pressure.
Therefore, an unacceptable test could be performed and yet the acceptance criteria met.
Utilization of recorder T41-R8008 for surveillance testing is inappropriate without compensation for the unmonitored wall.
(4) Evaluation of Design / Testing Documents for Railcar Door as a Secondary Containment Boundary Numerous design documents pertaining to the railcar door and secondary containment were reviewed.
The main document for procurement of the railcar door was a bill of material.
This bill of material clearly stated that the door was to be Quality Level I, pressure tight with a filtration rate not l
l l
8 a
[9 ? J g-3
.to exceed 250 cfm/ door.
The bill of materials required air j
i tightness testing under the performance testing section.
The only thing not stated in the bill of materials was that the filtration rate was with the seals inflated.
- However, in reviewing the operating sequence provided by the vendor on door operation it is clear that the seal would inflate-upon door closure.
The (nspector reviewed the equipment qualification sheet on the pneumatic seal to~ assure that the material was qualified to the harsh accident environment.
The information was appropriate.
The inspector reviewed the preoperational testing performed for secondary containment integrity and noted that under the prerequisite section the-railcar doors were' required to be operational.
Also, given the testing sequence of the preoperational tests the pneumatic supplies for the railcar doors had to be in service.
5.
Flood Protection Deficiency 1
a.
UFSAR Description Section 2.4.2.2.2 of the UFSAR discusses the reactor / auxiliary building flood criteria.
A portion of this section states, "The Category I reactor /aexiliary building, which houses safety-related systems and components, is designed against flooding to Elevation 588.0 feet, or 1.1 feet above the PMME stillwater flood elevation of 506.9.
All doors and penetrations through the outside walls below the design flood elevation are of watertight design.
All safety-related systems and equipment located inside this Category I structure are protected from the PMME flood." Later in this section it states, "The south wall'of t
the reactor / auxiliary building has two large openings end several waterproofed pipe-sleeved openings.
These large openings are in an air-locked railcar door and an air-locked personnel door.
Both of these doors, however, will be air-locked and completely water proofed to preclude wave runup flooding."
)
Section 3.4.4.1 of the UFSAR discusses the reactor building stracture as it relates to flood design. A portion of this section states, "All doors and penetrations through the outside walls below the design flood elevation are of watertight desirp."
Later in this section it states, "The south wall of the reactor / auxiliary building has two large openings and several L
waterproofed pipe-sleeved openings.
The large openings are an air-locked railcar door and an air-locked personnel door.
Both of these air-lockti doors are completely waterproofed to preclude wave runup flooding."
t i
l i
9 1
1
?. gi d.
() '
)
b..
Licensee Response Upon turning the railcar door issue over to the civil engineering personnel on February 3, 1989, it became apparent that the railcar door seals provided a flood protection function.
On i
February 4, 1989, civil engineering personnel documented an evaluation of the consequences of not having a qualified air i
compressor for the railcar door as it relates to the flood protection requirements.
The evaluation was. in the form of a letter to file, NE-PJ-89-0076, from civil engineering.
The evaluation was a probabilistic risk-assessment (PRA) of the probable maximum metrological event (PMME) and pneumatic supply to the railcar door seals failing simultaneously.
The total probability of this occurrence was calculated at 5.5E-08.
This probability was derived by multiplying the PMME probability, 2.05E-05, by an assumed pneumatic railcar door seal system failure of one day per-year, 2.7E-03..The assessment went on to state,
" Regulatory documents and general accepted industry experience rules do not require considering an event as a design teasis as long as its probability is less than about 1.0E-097.
Events with such small probability are considered highly improbable and therefore need not be considered." Finally, the assessment states, "This evaluation concludes that a single failure of the air supply system does not have to be considered concurrently with a site flooding condition."
On February 8, 1989, deviation event report (DER)89-021.9 was initiated by Deco civil engineering. An attachment to the DER response was memorandum NE-PJ-89-0076.
On February 10, 1989, another memorandum was generated by DECO civil engineering.
This memorandum, NE-89-0013, was from the General Director of Nuclear Engineering to the Operations The subject of the memorandum dealt with Superintendent.
recommendations for the acquisition, staging and use of sand The memorandum l
bags at the railcar door in the event of a flood.
identified the appropriate procedures that would need to be changed to implement sand bag use.
The memorandum was considered as an enhancement to the licensee's ability to deal with a flood and not mandated actions required by any regulatory requirements.
Operations superintendent staff began actions to implement the recommendations of memorandum NE-89-0013.
The time frame for these actions were not on an expedited bases since these recommendations were not viewed as requirements but enhancements.
Finally, when civil engineer'ng became aware that the railcar door seals were not inflated after installation of the weather stripping under EDP 9963 a request was made to inflate the seals.
On March 24, 1999, the seals were successfully inflated without impact upon the integrity of the weather stripping.
x 10
4 J e
w-t
- 1 T
1 c.
Inspector Followup (1)
Initial Actions During the afternoon of February 3, 1989, after review of the railcar drawings the resident staff noted that the external railcar door appeared to provide flood protection capability.
Late in the afternoon of February 3, 1989, the resident-inspector informed DECO engineering management of the matter.
DECO engineering management stated that the same matter had been identified by their engineers and the situation would be addressed.
(2) Identification of the PRA/ Sand Bag Memorandum On March 16, 1989, while performing follow up activities associated with this report, it came to the attention of the inspector that a memorandum had been sent to the Operations Superintendent from engineering to acquire sand bags and change abnormal operating procedures (AOPs) to use the sand i
bags at the railcar outer door.
Later that day the inspector contacted the civil engineering personnel l
responsible for EDP 9963 to confirm that the weather stripping met appropriate flood protection criteria.
The personnel stated that the. weather stripping did not perform a flood protection function.
Tht inspector reviewed the A0P discussed in the sand bag memorandum and noted that the procedure had not been revised.
Subsequently, the inspector contacted the Operations Superintendent to determine whether The i
any sand bags were staged for use at the railcar door.
response was negative but direction was given to acquire and stage the sand bags. The required number of sand bags i
l stated in the memorandum were located between the cooling towers and action was initiated to bring the sand bags into the protected area.
By the evening of March 16th the sand bags l:
l-were staged outside the railcar door.
Also, on March 16th I
the inspector acquired the disposition of DER 89-0219 including the PRA done on the compressor / design bases flood coincident failure.
(3) PRA Challenge On the morning of March 17, 1989, the inspector requested Deco engineering answer what assumptions went into the design bases flood (DBF).
Specifically:
l (a) Can offsite power be maintained during the flood?
(b) Since the shore barrier is designed to withstand an operating bases earthquake and a flood, were l
any other structures required to meet this assumption?
l 11
L s
6 4.', ' *. e m..
1,.
(c) Since there is'an external flooding analysis.
.l associated with a single failure of an in plant drain pipe, was this the most limiting single failure postulated during the DBF or is it an unique analysis?
The initial response of Deco engineering was that nothing was assumed to occur except the DBF.
DECO engineering did agree to review the' assumptions associated with the 08F.
On March 20,-1989, DECO engineering acknowledged that offsite power would be lost as a consequence of the flood.
With the loss of offsite power the electrical supply to the railcar door comptr.ssor would be lost.
Deco personnel stated that the rompressor could be loaded onto an emergency.
-l diesel generator bus.
Further discussion revealed that no
~
procedure was r.vailable to direct operators on how to establish that electrical alignment.
The shore barrier appeared to be a unique structure to meet simultaneous seismic and flood events.
(4) Design Document Review -
The inspector reviewed the vendor information qualifying the door seal to withstand the design bases flood.
This information is clearly based on inflated door seals and the t
inspector noted no problems with the information.
6.
Licensee Event Report (LER) Review On March 10, 1989, the licensee submitted LER 89-005-00 to the NRC.
This LER discussed the nonsafety-related air system for the railcar door seals.
The report did not include the results of the March 10th test due to the time constraints associ.ted with issuing the LER.
However, the LER indicated that a revision to the LER would be issued.
In the analysis section of the LER the watertight function of the airlock was considered not to be a concern.
This statement was incorrect.
On April 10, 1989, Revision 1 to the LER was submitted to the NRC.
In this report the watertight function of the railcar door seal was appropriately discussed with the potential ramifications properly addressed.
The revised report discussed the results of the March 10th i
secondary containment integrity test.
With the issuance of the revised LER the inspector had no further questions on the factual content of the LER.
7.
Conclusion Technical Specification 1.36(e) states, " SECONDARY CONTAINMENT a.
INTEGRITY shall exist when the sealing mechanism associated with each secondary containment penetration, e.g., welds, bellow or 12
.:y,
(
I b
. Inclusive in the definition of 0-rings, is OPERABLE."
operability as stated in Technical Specification 1.25 is the capability of necessary attendant support systems to perform their safety functions.
These attendant support systems for SECONDARY CONTAINMENT INTEGRITY must perform their safety functions under numerous design bases conditions including a loss of offsite power, earthquake and single failure as discussed in 10 CFR 50, Appendix A,' Criteria 20, 21 and 22 and numerous UFSAR sections.
To assure that the protective function of secondary containment integrity is maintained in these design bases conditions 10 CFR 50, Appendix B, Criterlon III, " Design Control,"
states in part, " Measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions...."
The design of the railcar door pneumatic supply was inadequate to meet the applicable regulatory reovirements or to support the definition of SECONDARY CONTAINMENf I'ITEGRITY. Technical Specification 3.6.5.1 requires SECONDARY CONTAINMENT INTEGRITY in OPERATIONAL COND1110NS.1, 2 and 3 and Technical Specification 3.0.4 forbids ascension into these operational modes without secondary conte.inment integrity operable.
The licensee ascended into operational conditions 1, 2 or 3 forty-four times without secondary containment integrity.
The installation of the weather stripping on the outer railroad car doors placed the licensee in conformance with all secondary containment integrity requirements.
This is considered to be an apparent violation (341/89006-01A) of 10 CFR 50, Appendix B, Criterion III. The root cause of the violation was failure to properly construct the support system for secondary containment in accordance with the applicable regulatory requirements prior to issuance of the operating license.
1.
b.
10 CFR 50, Appendix A, Criterion 1, states in part, " Structures, systems, and components important to safety shall be designed, I
L fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed."
L 10 CFR 50, Appendix A, Criterion 2, " Design bases for protection against natural phenomena," states in part, " Structures, systems, L
and components important to safety shall be designed to withstand i
the effects of natural phenomena such as earthquakes,... floods, l.
...without loss of capability to perfora their safety L
P functions...."
UFSAR Sections 3.1.2.1.1 and 3.1.2.1.2 state compliance with these criteria.
Also, UFSAR Section 2.4.2 states that Fermi 2, Category 1 structures and components are designed against flooding to a minimum elevation of 588 feet (Fermi 2 grade level is 583 feet, six inches) and Section 3.4.4.1 states all doors and 13
,x R
penetrations of the Reactor Building outside walls below design o
flood elevation are of water tight design.
Without the pneumatic y'
seals functioning the airlock doors were not water tight.
As discussed above these design measures are required to be translated into the drawings and specifications per 10 CFR 50, Appendix B, Criterion III. This was not tha case with the pneumatic railcar door seals which utilized a nonsafety-related compressor / auxiliaries from a power source which would be lost as a consequence of a natural phenomena (flood).
This is considered an apparent violation (341/89006-018) of 10 CFR 50, Appendix B, Criterion III.
The root cause of the violation was failure to properly construct the support system for flood protection in accordance with the applicable regulatory requirements prior to issuance of the operating license.
10 CFR 50, Appendix B, Criterion XVI, " Corrective Action," states c.
in part, "Heasures shall be established to assure that conditions adverse to quality...are promptly identified-and corrected." The licensee instituted the DER system to promptly identify and correct conditions adverse to quality.
The unqualified railcar door seal pneumatic supply was identified on a DER but adequate i
correction of the condition adverse to quality was not established.
The PRA performed by the licensee and documented in the DER in response to the flood protection aspect of the railcar door seal design was technically incorrect.
First the licensee E
inappropriately took credit for a nonsafety-related system, the railcar door seal pneumatic supply, in performing a safety-related function.
This premise was inconsistent with 10 CFR 50, Appendix A, Criterion 1 which states in part, " Structures, systems, and components important to safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed." Second, the multiplication of the PMME probability and pneumatic supply l
f ailure probability was flawed.
If a PMME should occur a required assumption of this event would be a loss of offsite t
power resulting in failure of the railcar door seal compressor and depressurization of the railcar door seals.
Therefore, a PMME and deflation of the railcar door seals are not independent of each other.
As such, the two probabilities should not have been multiplied together.
Through the PRA the licensee changed the facility as described in the UFSAR. The original flood protection design feature was the supposedly fully qualified (watertight) airlocked (inflated door seals) railcar door. With the PRA on February 4,1989, the licensee accepted something less than the fully qualified z
inflated door seals as the flood protection design feature.
Also, upon completing the installation of the weather stripping 14
L,.
under EDP 9963 on February 8,1989, the licensee lef t the railcar I
X door seals deflated until March 21, 1989.
Therefore, regardless of the qualification of the railcar door seals pneumatic supply the railcar door was incapable of performing its UFSAR watertight function-during this time period.
l' 10 CFR 50.59(a) allows the licensee to make changes in the facility as described in the safety analysis report provided the change does not increase the probability or consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report.
Clearly, the original consequences of the DBF or PMME would not impact upon safety related equipment.
The bases for this i
conclusion was in part due to watertight airlocked railcar doors.
With the loss of qualified watertight railcar doors a DBF or PMME l-(
!'s could impact safety-related equipment within the reactor
~
building.
l The PRA to the DER was in fact an inadequate safety evaluation.
Had the licensee utilized the Deco administrative process for 10 CFR 50.59 reviews the same technical expertise would have been used to provide the evaluation and the conclusions drawn would have been the same and an unreviewed safety question would not L
have been identified.
a The inadequate PRA to the DER is considered an apparent violation i
(341/89006-02) of 10 CFR 50, Appendix B, Criterion XVI and l
This apparent violation will be addressed with other 10 CFR 50.59 safety evaluation concerns in a subsequent inspection 1
report.
The root cause of this violation is considered a significant lack of understanding by engineering personnel of the technical bases t
for flood protection of safety related systems and components.
l d.
The improper evaluation of temporary niodification 88-0048 is l
another facet of previously identified deficiencies in the temporary modification program. Therefore, this deficiency will be incorporated into unresolved item 341/88035-01.
The root cause of this matter is considered a lack of complete understanding by technical / engineering personnel of Technical l
I 1
-Specification surveillance requirement 4.6.5.1.
8.
Exit Interview The inspectors met with licensee representatives (denoted in Paragraph 1)
/-
on February 3 and April 14, 1989, and informally throughout the inspection period and summarized the scope and findings of the inspection activities.
The inspectors also discussed the likely informational content of the inspection report with regard to documents or processes reviewed by the inspectors during the inspection.
The licensee did not identify any such documents / processes as proprietary.
The licensee acknowledged the l
findings of the inspection.
15 1
\\-
- 3 hs) gg \\
I No. of,0utgoing Letter with enclosure:
.$O NOV 2a m No. of Outgoing Letter without enclosure: _[
f'
'No.,of Concurrence Letter with' enclosure:.
Y-No. of Concurrence Letter without enclosure:
1 No. of enclosure only:
O 7
r Ch u,i y
< s bi
.p g N
[
t l'
'F I,
l t
I i
i 1
i l --
.