ML20149H098

Insp Rept 50-302/97-09 on 970602-20.Apparent Violations Being Considered for Escalated Ea.Major Areas Inspected: Engineering of Functional Areas

ML20149H098
Person / Time
Site:	Crystal River
Issue date:	07/14/1997
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20149H091	List: ML20149H088 ML20149H098
References
50-302-97-09, 50-302-97-9, NUDOCS 9707240209
Download: ML20149H098 (7)

See also: IR 05000302/1997009

Text

.

.

U.S. NUCLEAR REGULATORY COMMISSION

REGION 2

.

Docket No: 50-302

License No: DPR-72

.

Report No: 50-302/97-09

Licensee: Florida Power Corporation

Facility: Crystal River 3 Nuclear Station

.

Location: 15760 West Power Line Street

Crystal River, FL 34428-6708

Dates: June 2 through June 20, 1997

Inspectors: R. Schin, Senior Reactor Inspector

M. Miller. Reactor Inspector

Approved by. H. Christensen, Chief Engineering Branch

Division of Reactor Safety

l

l

l

I

Enclosure

]

l

9707240209 970714

PDR ADOCK 05000302

G PDR

)

.

.

EXECUTIVE SUMMARY

Crystal River 3 Nuclear Station

NRC Inspection Report 50-302/97-09

This special inspection addressed the engineering functional area. The

'

purpose of the inspection was to follow up on open item IFI 96-201-14. EDG

Protective Trips Not Bypassed During Emergency Mode of Operation.

Enaineerina

An apparent violation (EEI 50-302/97-09-01) was identified for an inadequate

safety evaluation for a modification that was performed in 1987. The

modification added five protective trips to each emergency diesel generator

(EDG) control circuit, for protection from bus faults and prolonged

overcurrent conditions. The added EDG trips were not bypassed during

emergency operation and were not installed with two out of three coincidence

logic. Thus a single failure in the added circuitry could cause an EDG to

fail ina)propriately. The modification increased the probability of failure

of the E Ms and created an unreviewed safety question (US0). The safety

evaluation for the modification failed to recognize the US0 and the

modification was performed without obtaining the required prior NRC review and

approval. (paragraph E8.1)

A weakness was identified in the licensee's 10 CFR 50.59 safety evaluation

program in that the licensee in 1997 erroneously relied on NSAC-125 guidance,

which the NRC has not endorsed. (paragraph E8.1)

A second ap)arent violation (EEI 50-302/97-09-02) was identified for failure

to update t1e FSAR to describe the added EDG protective trias. This apparent

violation and another recent example of failure to update t1e FSAR. for a 1996

revised small break loss of coolant accident mitigation strategy (see EA 97-

162 and Inspection Report 50-302/97-06). indicate a weakness in control of the

design bases. (paragraph E8.1)

The inspectors assessed the licensee's performance concerning the five areas

of continuing NRC concern in the following paragraph: the assessment is

limited to the specific issue addressed in the respective paragraph.

NRC AREA 0F CONCERN ASSESSMENT PARAGRAPH

E8.1

Management Oversight I

Engineering Effectiveness I

_

Knowledge of Design Basis I

Compliance With Regulations I

Operator Performance

S = Superior G = Good A = Adequate / Acceptable I = Inadequate

Blank = Not Evaluated / Insufficient Information

y oeo bpra on

I

!  !

,

..

.

Report Details

.

L. Epaineerina

.

'

'E8 -Hiscellaneous Engineering Issues -

'

E8.1 -(Closed) IFI 96-201-14. EDG Protective Trios Not Bvoassed Durino

Emeraency Mode of Ooeration

a. Insoection Scoce (92903)

This IFI was-originated during an NRC inspection in July 1996 when an

NRC inspection team identified .that numerous protective trips for the -

emergency diesel generators (EDGs) were not bypassed during the '

emergency mode of operation. Also, the current FSAR (Section 8.2.3.1

and Figure 8-9) did not correctly reflect the installed EDG protective

trip features.

The licensee had implemented a-plant modification in 1987. that increased

the number _ of EDG protective trips. At the time of the modification,

guidance in effect regarding the design of EDG 3rotective trips was #

provided in NRC Regulatory Guide (RG) 1.9 and IEEE Standard 387-1984.

The licensee's modification was not consistent with RG 1.9: however, the

licensee was not committed to RG 1.9. The licensee issued Problem

Report 96-0263 to address this issue.  ;

During this inspection, the inspectors followed up on this IFI by

reviewing Problem Report 96-0263: portions of plant modification MAR 80- '.

09-13-01: RG 1.9 Revision 2. dated December 1979: and FSAR Figure 8-9.

Revisions 1 and 14. Emergency Diesel Generator Control. The inspectors

also discussed the EDG protective trips and related 10 CFR 50.59 safety

evaluations with engineers, the Safety Analysis Group, and plant

management,

b. Dbservations and Findinas

I

The inspectors found that the licensee had implemented plant

modification MAR 80-09-13-01. EDG Relaying Modification, from

February 7. 1987, through December 21, 1987. The modification added ,

five EDG protective trips to the control circuit of each EDG to 3rotect ,

the EDG from bus faults and prolonged overcurrent conditions. T1e five

added trips, which were installed as inputs to the EDG lockout relay.

'

were: overcurrent on the EDG output, ground fault, and overcurrent trip

on any of the three breakers that could supply offsite power to the ES

bus. The MAR description of the modification was that it changed the

original " bus differential" relay from a single relay trip to an "86

lockout" relay that had six relay trip inputs. These inputs to the "86

lockout" relay were from the following relays: 1) existing bus

differential (87 current differential). 2) 51V overcurrent with voltage

restraint, 3) 64 ground fault. 4) 3205 (3206) overcurrent + ground

fault. 5) 3207 (3208) overcurrent + ground fault. 6) 3211 (3212)

overcurrent + ground fault. (The numbers in parentheses 3206. 3208, and

3212 are for the second EDG.)

.. - -, - -- .-. ,

_ _. _ _ _ _ _ ~ _ . _ _ _ __ ___ _ . _ _ . _ ._ __ _ _ _.

.

>

.

.

'

!

2

'

5

The inspectors-reviewed RG l'.9. Rev.2. dated' December.1979 which was in

.

effect during the modification preparation and installation in 1986 and

1 1987. RG 1.9 . stated:' {emergencydieselgenerator engine-overs)eed -

. and generator-differential trips may be implemented}by a single-clannel -

,: trip. All.Other diesel-. generator protective trips should be handled in

5

one of two ways: Either. (1) a trip should be implemented with two or

, more-independent measurements for each trip parameter with coincidental

logic provisions .for. trip actuation, or (2) a trip may be bypassed under

f -

accident conditions. 3rovided the operator has sufficient time to react '

appropriately to an a) normal diesel-generator unit condition.

Modification MAR 80-09-13-01 was not consistent with the guidance of .  :

RG 1.9 in that it added EDG trips that were not bypassed under accident-

conditions and were not installed with coincident logic provisions for.

-trip activation. Thus, a single failure in the added trip circuitry '

could result in an inappropriate failure of the EDG.

,

,

The 10 CFR.50.59 safety evaluation for MAR 80-09-13-01 did not address

i

E

the fact that a single failure of any one of the added protective relays  ;

for an EDG could result in an -inappropriate failure of the EDG. The

.

modification increased the probability of failure of the EDGs and

! represented an unreviewed safety question (US0). The safety evaluation

4 did not recognize the US0 and allowed the modification to be performed

! without the required prior NRC review and a) proval. The inspectors

identified this apparent violation of 10 CFR 50.59 as EEI 50-302/97-09-

01. Unreviewed Safety Question Involving Added EDG Protective Trips. l

The current FSAR (Figure 8-9. Rev. 14) had not been updated to include

the modification as of the date of this inspection, but the licensee had

prepared a draft revised FSAR Figure 8-9 to go in the next FSAR '

revision. The failure to update the FSAR to include MAR 80-09-13-01.  :

within two years after the MAR was installed in 1987, is identified as '

an apparent violation of-10 CFR 50.71: EEI 50-302/97-09-02. Failure to ,

Update the FSAR to Include Added Emergency Diesel Generator Trips.

The EDG protective trips in effect prior to the installation of MAR 90-

09-13-01 were shown in FSAR Figure 8-9. Rev. 1. They included

overspeed. bus differential, and low lube' oil pressure. These same

trips. in addition to the MAR 80-09-13-01 trips, were the EDG trips that

were currently installed. The inspectors found that the overspeed, bus

differential. and low lube oil pressure trips had been installed prior

to initial licensing: thus, they had been reviewed by the NRC. Also. ,

the low lube oil pressure trip included a two out' of three coincident

logic. The inspectors concluded that the overspeed, bus differential. -i

and low lube oil pressure trips were all consistent with RG 1.9. '

The licensee addressed the EDG protective trips modification concern in

'

Problem Report (PR) 96-0263. Corrective action for the PR included a 1

detailed 10 CFR'50.59 safety evaluation dated July 26, 1996. That i

safety evaluation concluded that MAR 80-09-13-01 did not introduce a -)

USQ. The licensee further assessed the potential for a US0 in an  ;

interoffice correspondence from the Manager. Nuclear Licensing dated  ;

April 29,1997: in an interoffice correspondence from the Manager. l

l

'

l

)

,

.

3

Safety Analysis Group, dated May 9. 1997: and in a written statement

provided at the NRC exit for this inspection, dated June 20, 1997. All

of these analyses concluded that the modification introduced no US0.

4

The licensee stated that their analyses were based on industry guidance

in NSAC-125. The inspectors noted that the NRC does not endorse NSAC-

125. NSAC-125 provides that a small increase in the probability of

failure is not considered to involve a US0. However. 10 CFR 50.59

-

requires that a proposed change shall be deemed to involve a US0 if the

probability of occurrence of a malfunction of equipment important to

safety may be increased.

c. Conclusions

The inspectors concluded that the licensee's safety evaluation for a

modification (MAR 80-09-13-01) that was installed in 1987 was

inadequate. The modification added five protective trips to each EDG

control circuit, for protection from bus faults and prolonged

overcurrent conditions. The added EDG trips were not bypassed during

emergency operation and were not installed with two out of three

coincidence logic. Thus a single failure in the added circuitry could

cause an EDG to fail. The modification increased the probability of

failure of the EDGs and created a US0. The safety evaluation for the

modification failed to recognize the US0 and the modification was

performed without obtaining the required prior NRC review and approval.

This ap3arent violation of 10 CFR 50.59 is identified as EEI 50-302/97-

09-01, Jnreviewed Safety Question Involving Added EDG Protective Trips.

The inspectors also noted that in 1997, the licensee erroneously relied

on NSAC-125 guidance, which the NRC does not endorse, to again determine ,

that MAR 80-09-13-01 did not introduce a US0. The inspectors concluded l

that the licensee's reliance on NSAC-125 guidance indicated a weakness '

in their program for performing 10 CFR 50.59 safety evaluations.

In addition, the inspectors noted that the licensee had failed to update I

the FSAR within two years to describe EDG protective trips added in i

1987. This apparent violation of 10 CFR 50.71 is identified as EEI  ;

50-302/97-09-02. Failure to Update the FSAR to Include Added Emergency l

Diesel Generator Trips.

,

The inspectors further concluded that this failure to update the FSAR I

and another more recent failure to update the FSAR, for a 1996 revised  !

small break loss of coolant accident mitigation strategy (see EA 97-162 l

and Inspection Report 50-302/97-06), indicated a weakness in the  ;

licensee's control of the design bases.

The inspectors assessed the licensee's performance, relative to this

issue, in the five areas of continuing NRC concern-

1

e Management Oversight - Inadequate

e Engineering Effectiveness - Inadequate

e Knowledge of the Design Basis - Inadequate

j

. . .

.

.

'1

.

l 4

'

e Compliance with. Regulations - Inadequate

e-~ Operator ~ Performance - N/A

III. Manaaement Meetinas '

!

X1 Exit Meeting Summary

The inspection scope'and findings were summarized in an exit meeting  !

< -

held on June 20. 1997. Proprietary information is not contained in this  ;

report. Dissenting comments were received from the licensee. The '

.

licensee stated that, based on NSAC-125 guidance, they still concluded

that MAR 80-09-13-01 did not introduce a US0. The inspectors noted that

the NRC does not endorse NSAC-125, On June 24 the licensee's Director

of Engineering told'the.NRC's Mr. K. Landis, at a meeting at the NRC .

headquarters. that the licensee decided to withdraw the dissenting.

comments and now agreed that MAR 80-09-13-01 did introduce a US0.

-

PARTIAL LIST OF PERSONS CONTACTED l

Licensees

J. Baumstark, Director Quality Programs  :

J. Cowan Vice President Nuclear Production  ;

,

'

R. Grazio Director, Regulatory Affairs

J. Holden Director Nuclear Engineering and Projects

R. Knoll, Manager, Safety Assessment Group -

C. Pardee, Director Nuclear Plant Operations ,

W. Pike. Manager, Regulatory Assurance

S. Powell, Senior Licensing Engineer

NRC

K. Landis, Branch Chief, Division of Reactor Projects, Region II

S..Cahill, Senior Resident Inspector  ;

INSPECTION PROCEDURES USED

IP.92903: Followup - Engineering

ITEMS OPENED, CLOSED, AND DISCUSSED

5

00ened

Tygg Item Number- Status Rescriotion and Reference

(

.

EEI 50-302/97-09-01 Open Unreviewed Safety Question Involving ,

l Added EDG Protective Trips

(paragraph E8.1) l

,

EEI 50-302/97-09-02 Open -Failure to Update the FSAR to i

'

, Include Added Emergency Diesel

Generator Trips (paragraph E8.1)

o

., ., , ... - . - - -

.

1

.

5

Closed

Iygg Item Number Status Description and Reference

.

IFI 96-201-14 Closed EDG Protective Trips Not Bypassed

During Emergency Mode of Operation

(paragraph E8.1)

-

Discussed

lyng Item Number Status Description and Reference

none

LIST OF ACRONYMS USED

CFR - Code of Federal Regulations

EA- - Enforcement Action

EDG - Emergency Diesel Generator

EEI - Escalation Enforcement Item

FSAR - Final Safety Analysis Report

IEEE - Institute of Electrical and Electronic Engineering

IFI - Inspector Followup Item

MAR - Modification Approval Record

NRC - Nuclear Regulatory Commission

PR - Problem Report

RG - (NRC) Regulatory Guide

USQ - Unreviewed Safety Question

VIO - Violation

l