ML20149H098
| ML20149H098 | |
| Person / Time | |
|---|---|
| Site: | Crystal River  |
| Issue date: | 07/14/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20149H091 | List: |
| References | |
| 50-302-97-09, 50-302-97-9, NUDOCS 9707240209 | |
| Download: ML20149H098 (7) | |
See also: IR 05000302/1997009
Text
.
.
U.S. NUCLEAR REGULATORY COMMISSION
REGION 2
.
Docket No:
50-302
License No:
.
Report No:
50-302/97-09
Licensee:
Florida Power Corporation
Facility:
Crystal River 3 Nuclear Station
.
Location:
15760 West Power Line Street
Crystal River, FL 34428-6708
Dates:
June 2 through June 20, 1997
Inspectors:
R. Schin, Senior Reactor Inspector
M. Miller. Reactor Inspector
Approved by.
H. Christensen, Chief Engineering Branch
Division of Reactor Safety
l
Enclosure
]
9707240209 970714
ADOCK 05000302
G
)
.
.
EXECUTIVE SUMMARY
Crystal River 3 Nuclear Station
NRC Inspection Report 50-302/97-09
This special inspection addressed the engineering functional area.
The
'
purpose of the inspection was to follow up on open item IFI 96-201-14. EDG
Protective Trips Not Bypassed During Emergency Mode of Operation.
Enaineerina
An apparent violation (EEI 50-302/97-09-01) was identified for an inadequate
safety evaluation for a modification that was performed in 1987.
The
modification added five protective trips to each emergency diesel generator
(EDG) control circuit, for protection from bus faults and prolonged
overcurrent conditions. The added EDG trips were not bypassed during
emergency operation and were not installed with two out of three coincidence
logic. Thus a single failure in the added circuitry could cause an EDG to
fail ina)propriately.
The modification increased the probability of failure
of the E Ms and created an unreviewed safety question (US0). The safety
evaluation for the modification failed to recognize the US0 and the
modification was performed without obtaining the required prior NRC review and
approval.
(paragraph E8.1)
A weakness was identified in the licensee's 10 CFR 50.59 safety evaluation
program in that the licensee in 1997 erroneously relied on NSAC-125 guidance,
which the NRC has not endorsed.
(paragraph E8.1)
A second ap)arent violation (EEI 50-302/97-09-02) was identified for failure
to update t1e FSAR to describe the added EDG protective trias. This apparent
violation and another recent example of failure to update t1e FSAR. for a 1996
revised small break loss of coolant accident mitigation strategy (see EA 97-
162 and Inspection Report 50-302/97-06). indicate a weakness in control of the
design bases. (paragraph E8.1)
The inspectors assessed the licensee's performance concerning the five areas
of continuing NRC concern in the following paragraph: the assessment is
limited to the specific issue addressed in the respective paragraph.
NRC AREA 0F CONCERN
ASSESSMENT PARAGRAPH
E8.1
Management Oversight
I
Engineering Effectiveness
I
_
Knowledge of Design Basis
I
Compliance With Regulations
I
Operator Performance
S = Superior G = Good A = Adequate / Acceptable I = Inadequate
Blank = Not Evaluated / Insufficient Information
bpra
y oeo
on
!
,
..
.
Report Details
.
L.
Epaineerina
.
'
'E8
-Hiscellaneous Engineering Issues
-
E8.1 -(Closed) IFI 96-201-14. EDG Protective Trios Not Bvoassed Durino
'
Emeraency Mode of Ooeration
a.
Insoection Scoce (92903)
This IFI was-originated during an NRC inspection in July 1996 when an
NRC inspection team identified .that numerous protective trips for the
-
emergency diesel generators (EDGs) were not bypassed during the
'
emergency mode of operation. Also, the current FSAR (Section 8.2.3.1
and Figure 8-9) did not correctly reflect the installed EDG protective
trip features.
The licensee had implemented a-plant modification in 1987. that increased
the number _ of EDG protective trips. At the time of the modification,
guidance in effect regarding the design of EDG 3rotective trips was
provided in NRC Regulatory Guide (RG) 1.9 and IEEE Standard 387-1984.
The licensee's modification was not consistent with RG 1.9: however, the
licensee was not committed to RG 1.9.
The licensee issued Problem
Report 96-0263 to address this issue.
During this inspection, the inspectors followed up on this IFI by
reviewing Problem Report 96-0263: portions of plant modification MAR 80-
09-13-01: RG 1.9 Revision 2. dated December 1979: and FSAR Figure 8-9.
'.
Revisions 1 and 14. Emergency Diesel Generator Control. The inspectors
also discussed the EDG protective trips and related 10 CFR 50.59 safety
evaluations with engineers, the Safety Analysis Group, and plant
management,
b.
Dbservations and Findinas
I
The inspectors found that the licensee had implemented plant
modification MAR 80-09-13-01. EDG Relaying Modification, from
February 7. 1987, through December 21, 1987. The modification added
,
five EDG protective trips to the control circuit of each EDG to 3rotect
,
the EDG from bus faults and prolonged overcurrent conditions. T1e five
added trips, which were installed as inputs to the EDG lockout relay.
'
were:
overcurrent on the EDG output, ground fault, and overcurrent trip
on any of the three breakers that could supply offsite power to the ES
bus. The MAR description of the modification was that it changed the
original " bus differential" relay from a single relay trip to an "86
lockout" relay that had six relay trip inputs.
These inputs to the "86
lockout" relay were from the following relays:
1) existing bus
differential (87 current differential). 2) 51V overcurrent with voltage
restraint, 3) 64 ground fault. 4) 3205 (3206) overcurrent + ground
fault. 5) 3207 (3208) overcurrent + ground fault. 6) 3211 (3212)
overcurrent + ground fault.
(The numbers in parentheses 3206. 3208, and
3212 are for the second EDG.)
.. -
-,
-
--
-
.-.
,
_
_.
_ _ _ _ _
~ _ . _ _ _
__ ___
_
. _ _ . _
._
__ _ _ _.
.
>
.
.
2
!
'
5
'
The inspectors-reviewed RG l'.9. Rev.2. dated' December.1979 which was in
effect during the modification preparation and installation in 1986 and
.
1987.
RG 1.9 . stated:'
{emergencydieselgenerator engine-overs)eed
and generator-differential trips may be implemented}by a single-clannel
-
1
-
.
,:
trip. All.Other diesel-. generator protective trips should be handled in
one of two ways:
Either. (1) a trip should be implemented with two or
5
more-independent measurements for each trip parameter with coincidental
,
logic provisions .for. trip actuation, or (2) a trip may be bypassed under
f
accident conditions. 3rovided the operator has sufficient time to react
-
appropriately to an a) normal diesel-generator unit condition.
'
Modification MAR 80-09-13-01 was not consistent with the guidance of .
RG 1.9 in that it added EDG trips that were not bypassed under accident-
conditions and were not installed with coincident logic provisions for.
-trip activation. Thus, a single failure in the added trip circuitry
'
could result in an inappropriate failure of the EDG.
,
The 10 CFR.50.59 safety evaluation for MAR 80-09-13-01 did not address
,
i
the fact that a single failure of any one of the added protective relays
E
for an EDG could result in an -inappropriate failure of the EDG. The
.
modification increased the probability of failure of the EDGs and
!
represented an unreviewed safety question (US0).
The safety evaluation
4
did not recognize the US0 and allowed the modification to be performed
!
without the required prior NRC review and a) proval.
The inspectors
identified this apparent violation of 10 CFR 50.59 as EEI 50-302/97-09-
01. Unreviewed Safety Question Involving Added EDG Protective Trips.
l
The current FSAR (Figure 8-9. Rev. 14) had not been updated to include
the modification as of the date of this inspection, but the licensee had
prepared a draft revised FSAR Figure 8-9 to go in the next FSAR
'
revision. The failure to update the FSAR to include MAR 80-09-13-01.
within two years after the MAR was installed in 1987, is identified as
'
an apparent violation of-10 CFR 50.71: EEI 50-302/97-09-02. Failure to
,
Update the FSAR to Include Added Emergency Diesel Generator Trips.
The EDG protective trips in effect prior to the installation of MAR 90-
09-13-01 were shown in FSAR Figure 8-9. Rev. 1.
They included
overspeed. bus differential, and low lube' oil pressure. These same
trips. in addition to the MAR 80-09-13-01 trips, were the EDG trips that
were currently installed.
The inspectors found that the overspeed, bus
differential. and low lube oil pressure trips had been installed prior
to initial licensing: thus, they had been reviewed by the NRC. Also.
,
the low lube oil pressure trip included a two out' of three coincident
logic.
The inspectors concluded that the overspeed, bus differential.
-i
and low lube oil pressure trips were all consistent with RG 1.9.
'
The licensee addressed the EDG protective trips modification concern in
'
Problem Report (PR) 96-0263.
Corrective action for the PR included a
1
i
detailed 10 CFR'50.59 safety evaluation dated July 26, 1996.
That
safety evaluation concluded that MAR 80-09-13-01 did not introduce a
-)
USQ.
The licensee further assessed the potential for a US0 in an
interoffice correspondence from the Manager. Nuclear Licensing dated
April 29,1997: in an interoffice correspondence from the Manager.
'
)
,
.
3
Safety Analysis Group, dated May 9. 1997: and in a written statement
provided at the NRC exit for this inspection, dated June 20, 1997.
All
of these analyses concluded that the modification introduced no US0.
4
The licensee stated that their analyses were based on industry guidance
in NSAC-125. The inspectors noted that the NRC does not endorse NSAC-
125.
NSAC-125 provides that a small increase in the probability of
failure is not considered to involve a US0. However. 10 CFR 50.59
requires that a proposed change shall be deemed to involve a US0 if the
-
probability of occurrence of a malfunction of equipment important to
safety may be increased.
c.
Conclusions
The inspectors concluded that the licensee's safety evaluation for a
modification (MAR 80-09-13-01) that was installed in 1987 was
inadequate.
The modification added five protective trips to each EDG
control circuit, for protection from bus faults and prolonged
overcurrent conditions.
The added EDG trips were not bypassed during
emergency operation and were not installed with two out of three
coincidence logic. Thus a single failure in the added circuitry could
cause an EDG to fail. The modification increased the probability of
failure of the EDGs and created a US0. The safety evaluation for the
modification failed to recognize the US0 and the modification was
performed without obtaining the required prior NRC review and approval.
This ap3arent violation of 10 CFR 50.59 is identified as EEI 50-302/97-
09-01,
Jnreviewed Safety Question Involving Added EDG Protective Trips.
The inspectors also noted that in 1997, the licensee erroneously relied
on NSAC-125 guidance, which the NRC does not endorse, to again determine
,
that MAR 80-09-13-01 did not introduce a US0. The inspectors concluded
that the licensee's reliance on NSAC-125 guidance indicated a weakness
in their program for performing 10 CFR 50.59 safety evaluations.
In addition, the inspectors noted that the licensee had failed to update
the FSAR within two years to describe EDG protective trips added in
1987.
This apparent violation of 10 CFR 50.71 is identified as EEI
50-302/97-09-02. Failure to Update the FSAR to Include Added Emergency
Diesel Generator Trips.
,
The inspectors further concluded that this failure to update the FSAR
and another more recent failure to update the FSAR, for a 1996 revised
small break loss of coolant accident mitigation strategy (see EA 97-162
and Inspection Report 50-302/97-06), indicated a weakness in the
licensee's control of the design bases.
The inspectors assessed the licensee's performance, relative to this
issue, in the five areas of continuing NRC concern-
Management Oversight - Inadequate
e
Engineering Effectiveness - Inadequate
e
Knowledge of the Design Basis - Inadequate
e
j
.
.
.
.
.
'1
.
l
4
'
Compliance with. Regulations - Inadequate
e
Operator ~ Performance - N/A
e-~
III.
Manaaement Meetinas
'
!
X1
Exit Meeting Summary
The inspection scope'and findings were summarized in an exit meeting
!
held on June 20. 1997.
Proprietary information is not contained in this
<
-
report.
Dissenting comments were received from the licensee.
The
.
licensee stated that, based on NSAC-125 guidance, they still concluded
'
that MAR 80-09-13-01 did not introduce a US0.
The inspectors noted that
the NRC does not endorse NSAC-125,
On June 24 the licensee's Director
of Engineering told'the.NRC's Mr. K. Landis, at a meeting at the NRC
.
headquarters. that the licensee decided to withdraw the dissenting.
comments and now agreed that MAR 80-09-13-01 did introduce a US0.
PARTIAL LIST OF PERSONS CONTACTED
l
-
Licensees
J. Baumstark, Director Quality Programs
J. Cowan Vice President Nuclear Production
R. Grazio Director, Regulatory Affairs
,
'
J. Holden Director Nuclear Engineering and Projects
R. Knoll, Manager, Safety Assessment Group
-
C. Pardee, Director Nuclear Plant Operations
,
W. Pike. Manager, Regulatory Assurance
S. Powell, Senior Licensing Engineer
NRC
K. Landis, Branch Chief, Division of Reactor Projects, Region II
S..Cahill, Senior Resident Inspector
INSPECTION PROCEDURES USED
IP.92903:
Followup - Engineering
ITEMS OPENED, CLOSED, AND DISCUSSED
5
00ened
(
Tygg Item Number-
Status
Rescriotion and Reference
.
50-302/97-09-01
Open
Unreviewed Safety Question Involving
,
l
Added EDG Protective Trips
(paragraph E8.1)
l
,
50-302/97-09-02
Open
-Failure to Update the FSAR to
i
Include Added Emergency Diesel
'
,
Generator Trips (paragraph E8.1)
o
., .,
,
...
-
. - - -
1
.
.
5
Closed
Iygg Item Number
Status
Description and Reference
.
IFI
96-201-14
Closed
EDG Protective Trips Not Bypassed
During Emergency Mode of Operation
(paragraph E8.1)
-
Discussed
lyng Item Number
Status
Description and Reference
none
LIST OF ACRONYMS USED
CFR
- Code of Federal Regulations
EA-
- Enforcement Action
- Escalation Enforcement Item
- Final Safety Analysis Report
IEEE
- Institute of Electrical and Electronic Engineering
IFI
- Inspector Followup Item
- Modification Approval Record
NRC
- Nuclear Regulatory Commission
PR
- Problem Report
- (NRC) Regulatory Guide
- Unreviewed Safety Question
- Violation