ML20002C342
| ML20002C342 | |
| Person / Time | |
|---|---|
| Site: | Rancho Seco |
| Issue date: | 10/17/1980 |
| From: | Mattimoe J SACRAMENTO MUNICIPAL UTILITY DISTRICT |
| To: | Engelken R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| Shared Package | |
| ML20002C336 | List: |
| References | |
| NUDOCS 8101100090 | |
| Download: ML20002C342 (4) | |
Text
.
' S %lU D SACRAMENTO MUNICIPAL UTILITY DISTR CT O 6201 S Street, Box 15830, Sacramento, Califomia 95813, (916) 452-3211 October 17, 1980
,. h
-c,
t' 7 c
a
, f'.,
Mr. R. H. Engelhen, Director
' ' t --
Region V Office of Inspection and Enforcement
,2
,,a
- y. j.C q's,,. {
U.S. Nuclear Regulatory Correission
'l A"
. J7 1990 North California Boulevard P ;g,_
S)"
tialnut Creek Plaza, Suite 202
/
ifalnut Creek, CA 94936
' " '.'./.EP 1
Re: NRC Inspection 80-26 Operating License DPR-54 Dochet No. 50-312 1
Dear Mr. Engelken:
~
j In reply to your inspection conducted by Messrs. H. Canter and J. O'Brien of your office on August 1 through 29, 1980, we offer the following explanations and corrective actions to assure full compliance with NRC requirements.
Appendix A of your letter notes the following infractions:
A) Technical Specification Table 2.3-1 specifies that the "uclear Power trip setting is 5% of rated maximum when the plant is in the shutdown mode.
i Contrary to the above. at 1353 hours0.0157 days <br />0.376 hours <br />0.00224 weeks <br />5.148165e-4 months <br /> on August 13, 1980, the plant was placed in the shutdown bypass mode, but the Nuclear ?over trip setting of 5% of rated maximum was not instituted until 0G40 hours on August 20, 1980.
SMUD Reolv As reported to your office via LER 80-39,the above infraction i
did occur and was discovered during a routine instrument surveillance on August 20, 1900. The occurrence was attributed tc a misuaderstanding between the on-shift licensed operators. The misunderstanding resulted in the assumption by those involved that the set-point had been lowered to < 5 percent of rated power.
Immediately upon discovery tne set-point was in facc lowered.
{
A temporary change to operating procedure B.4, Plant Shutdown and Cooldown was initiated. The context of the temporary change was a requirement to " dual verify" the lowering of the high flux trip set-point.
This " dual verification" is accomplished by requiring both a licensed operator and the I 5 C Technician who lowered the set-point to initial the appropriate step.in the Procedure. This temporary change was later incorporated permanently into the procedure via revision 17 approved l
September 5, 1980. The requirement for " dual verification" will preclude recurrence of this infraction and assure full compliance with NRC regulations and conditions of the license.
cn en, pq 0
?h 0
1
,s
. w
~
31012 00MO
' I
~
,~.m.-w,
.g
-e--
+
-eg mm,m-
-~,%.e,:-ev re r
r
-v~
Mr. R. H. Engelken October 17, 1980 B) Technical Specification 6.8.1 states in part that written procedures shall be established, implemented, and maintained covering the activities referenced in the applicable procedures recommenedd in Appendix "A" of Regulatory Gui.de 1.33, November 1972.
Appendix "A" of Regulatory Guide 1.33, November 1972 states in part that instructions for energizing, filling, venting, draining, startup, shutdown, and changing modes of operation should be prepared, as appropriate, for twenty-nine separate systems including the reactor coolant and protection system.
Step 5.16 of Station Procedure B.4, Plant Shutdown and Cooldown states *that one is to " Initiate Reactor protection system shutdown bypass and reset the high flux trip to 5%
as per OP A.69, Section 5.2."
Contrary to the requirements stated above, on Augurt 20, 1980 Step 5.16 of Station Procedure 3.4 was not implemented which resulted in the high flux trip not being reset.
SMUD Reply As stated in the response to item A of your letter, operating procedure B.4, Plant Shutdown and Cooldown, was revised. This was done both via a " temporary change" to immediately establish additional controls to assure compliance, and later via a permanent revision to the procedure.
The permanent revision made it a requirement to initial various steps throughout the procedure. The particular step, 5.16, which requires a reset of the high flux trip to 15% rated power was revised to include an additional sign-of f blank. The second blank is to be initialled by the I & C Technician af ter the set-point has been reduced. Essentially this provides " dual verification" that the set-point has in fact been lowered.
The above revision to the operating procedure provides for additional controls to preclude a similar occurrence in the future.
C) 10 CFR Part 50, Appendix A, Criterion 23 states that the protection system shall be designed to fail into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system,-loss of energy (e.g., electric power, instrument air), or postulated adverse environments (E.C. extreme heat or cold, fire, pressure, steam, water, and' radiation) are experienced.
In the FSAR Appendix 1A, Page IA-26 as part of a discussion on Criterion 23, the licensee states, " Safety features equipment can be manually initiated by the operator at any time'even if power is lost to the actuation system."
E e
g-r
--- y e
i i
Mr. R. H. Engelken October 17, 1980 Contrary to the above the reactor building purge inlet i
line valve, SFV 53503, the reactor building purge outlet line valve SFV 53604, and the reactor building pressure equalizing line valve SFV 53210 will apparently fail open on loss of direct current power to the solenoid operator'. s SMUD Reply 10 CFR Part 50, Appendin A, Criterion 23 clearly states "or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system...".
The reactor building purge inlet valve, SFV 53503, the reactor building purge outlet line valve SFV 53604, and the reactor building pressure equalizing line valve SEV 53210 will fail open on loss of direct current power to the solenoid operators.
These valves are not common to any reactor building penetration.
Each valve has a redundant electric motor-operated valve inside the containment that closes on a safety features signal. The power supplies to these motor-operated 3
valves are not from the source described in the infraction. Therefore; the hypothesis stated in the infraction requires more than single failure criteria.
If the outside valve failed as described, the inside valve would sufficiently isolate the reactor building by completing travel to its safety features position. The systems installed at Rancho Seco are designed to the single failure criteria.
The Rancho Secu Technical Specifications were formulated to preserve the single failure cri:erion for systems that are relied upon in the safety analysis report.
By and large, the single failure criterion is preserved by specifying Limiting Conditions for Operation (LCOs) that require all redundant components of safety related systems to be OPERADLE. Uhen the required redundancy is not maintained, either due to equipment failure or maintenance outage, action is required, within a specified time, to change the operating mode of the plant to place it in a safe condition. The specified time to take action, usually called the equipment out-of-service time, is a temporary relaxation of the single failure criterion, which, consistent with overall system reliability considerations, provides a limited time to fix equipment or otherwise make it OPERADLE.
If equipment can be returned to OPERABLE status within the specified time,-plant shutdown is not required.
i LCOs are specified for each safety related system in the plant, and with few exceptions, the ACTION statements address single outages of components, trains or subsystems. For any particular system, the LCO does not address multiple outages of redundant components, nor does it address the effects of outages of any support systems - such as electrical j
power or cooling water - that are relied upon to maintain the OPERABILITY of the particular system. This is because of the large number of combinations l
of these types of outages that are possible.
Instead, the TS employ general specifications and an explicit definition of the term OPERABLE to encompass all such cases. These provisions have been formulated to assure that no set of equipment outages would be allowed to persist that would result in the facility being in an unprotected condition.
a 4
---,7, my,
-.w,,-
r----.,
-.n-
,,-n e
.,n.
w
=
Mr. R. H. Engelke a October 17, 1980 i
For example, should the condition stated involve the outside air-operated valve SFV 53503, 53604, or 53120, the valve would be declared inoperable as defined by Technical Specification 1.3 "0PERABLE".
Immediately, Specification 3.6.6 would be implemented which states:
"If during critical operations, an automatic containment isolation valve is determined to be inoperable, the other containment isolation valve in the line shall be tcsted to I
insure operability.
If the inoperable valve is not restored l
within 48 hqpts,- the reactor shall be brought to the cold shutdown condition within an additional 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or the valve will be placed in a safety features position."
The single failure considerations have been considered and protective measures stated in the license. A postulated condition that involves failures of Class I equipment beyond the single failure is more than required by the NRC design criteria.
The FSAR Table 5.2-2 describes penetration Numbers 34, 35 and 65 which are the isolaticn penetrations in question. Column heading
" Position with Motive Power Failure" clearly states that.the valve will close, i.e. the loss of motive power is air.
The valves operate as described in the FSAR and operate within the accident conditions for the single failure criteria.
Therefore, the District considers the infraction to be based 3
on unjustified assumptions and should be reconsidered.
Sincerely,
, ht.sI.
v
. y vJ. J. Mattimoe sistant General Manager t
atid Chief Engineer I
f JJM:RWC:rs l
l l
l l
l l
I l
l
_. ~..., _ _ _ _
..~
- - ~.