ML20151Q680
| ML20151Q680 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 04/20/1988 |
| From: | Gridley R TENNESSEE VALLEY AUTHORITY |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| NUDOCS 8804270108 | |
| Download: ML20151Q680 (31) | |
Text
=,*s TENNESSEE VALLEY AUTHORITY CH ATTANOOGA, TENNESSEE 37401 SN 1578 Lookout Place APR 201988 U.S. Nuclear Regulatory Commission ATTN:
Document Control Desk Washington, D.C.
20555 Gentlemen:
In the Matter of
)
Docket Nos. 50-259 Tennessee Valley Authority
)
50-260 50-296 BROWNS FERRY NUCLEAR PLANT (BFN) - RESPONSE TO NRC INSPECTION 50-259/87-36, 50-260/87-36, and 50-296/87-36 The purpose of this letter is to transmit BFN's response to Inspection Report 87-36 conducted at Browns Ferry during October 1987 on the Design Baseline and Verification Program (DBVP).
The inspection report which was issued January 21, 1988 contained no audit findings; however, it did identify weaknesses in tha program.
TVA has reviewed the inspection report and has responded to each weakness.
Please note that certain items identified by the inspection team were already being addressed by TVA, as they had been previously identified by an independent Engineering Assurance Oversight Review Team-(EA ORT).
TVA, as part of the DBVP program, has the EA ORT:
1.
Confirm and validate that the engineering activities are being conducted in accordance with the approved program plan and established procedures.
2.
Confirm functional and technical adequacy of system evaluations and completeness / correctness of supporting documentation.
3.
Verify that corrective actions resulting from these evaluations have been l
documented and properly implemented.
l Additionally, TVA believes that certain of the identified items address more l
than the DBVP and the response explains how these items are dispositioned.
Should you have any questions, please telephone A. C. Alford at (205) 729-2855.
l Very truly yours, TENN SEV Y AUTHORITY R. G idley, Di ector Nuclear Licen ing and Regulatory Affairs f
Enclosures cc:
See page 2
\\i 9
An Equal Opportunity Employer DCD
?,.
-2 U.S. Nuclear Regulatory Commission APR 201988 cc (Enclosures):
Mr. K. P. Barr, Acting Assistant Director for Inspection Programs TVA Projects Division U.S. Nuclear Regulatory Commission Region II 101 Marietta Street, NW, Suite 2900 Atlanta, Georgia 30323 Mr. G. G. Zech. Assistant Director for Projects TVA Projects Division U.S. Nuclear Regulatory Commission One White Flint, North 11555 Rockville Pike Rockville, Maryland 20852 Browns Ferry Resident Inspector Browns Ferry Nuclear Plant Route 12, P.O. Box 637 Athens,-Alabama 35611 i
)
_a
s
-l CONCERN: Per* Reach 4 (8) and Peranreph 5.1.1. subveregraph 1 The licensee has made no commitment to perform the essential civil / structural calculations, including those for major building structures.
This is a program weakness siace some calculations may be incomplete, missing, or may not be meeting current licensing commitments.
RESPONSE
The licensee has made significant commitments to the NRC regarding the performance of technical reviews and generation of calculations as documented in Volume 3 of the Nuclear Performance Plan (NPP), Sections III 3.0 and III 4.4.
Specific civil essential calculation generation efforts are described in Volume 3 of the NPP,Section III 3, Seismic Design Program. The programs are:
1.
Torus Modifications 2.
Piping and Supports (IE Bulletins 79-02 and 79-14) 3.
Cable Tray Supports -
4.
Conduit Supports 5.
HVAC Ductwork 6.
CRD Insert and Withdrawal Piping 7.
Safety-Related Small Bore Piping Supporte 8.
Drywell Steel Platforms 9.
Miscellaneous Steel Evaluation 10.
Class II Features Over Class I Features.
11.
Secondary Containment Program 12.
Miscellaneoua Civil Issues 13.
DBVP Calculation Effort (Volume 3 of the NPP,Section III 4.C)
The scope of the Civil calculation effort covers each type of essential civil / structural calculation, including those for major building structures.
l The Civil calculation effort identifies required calculations, establishes the l
technical adequacy of each type of civil calculation, generates those calculations necessary to couplete required calculations, assures completeness i
and consistency of the seismic design, and assures the retrievability of the calculations.
The actions that follow will be completed prior to restart.
1
.s A review is performed for each typs of esssntiel calculation. This esvitw determines whether potential generic condition evaluations (PGCEs) exist, or whether there are other concerns or conditions which would require a closer evaluation of the family of calculations.
These later concerns could stem from internal TVA reviews, previous commitments, design changes or findings from other agencies external to DNE (e.g., INPO, etc.).
Based upon the review of each calculation type, the civil discipline determines whether a further review is warranted.
In all cases, technical justifications are documented for the extent of review required for each type of calculation.
Calculations which are determined to be missing are being generated or supplemented with appropriate test results or other bounding calculations, or a justification is being prepared showing that the calculation regeneration is not ecquired.
The culmination'of the seismic design program coupled with the civil calculation effort will provide documented evidence that essential calculations within the ' civil scope are technically adequate and support the design basic, licensing commitments, and other NPP Volume 3 commitments.
6 _.____________ ___
J
..s CONCERN: Paragraph 4 (4). Paragraph 5.1.1. subparagraph 3 and Paragraph 5.2.1. subparagraph 2 The team found that general design criteria for structural analysis and qualification of mechanical systems and for design of supports contained direct excerpts from several previously published TVA design criteria This attributed to the poor organization of the documents.
documents.
Criteria related to older licensing commitments were included in the general The criteria also design criteria without regard to technical adequacy.
contained discussions and references to design codes that were incorrect and confusing.
RESPONSE
TVA's R0 version of the civil General Design Criteria Documents (GDCD),
BFN-50-C-7100 R0 - Design of Civil Structures BFN-50-C-7101 RO - Protection from Wind, Tornado Wind, Tornado Depressurization, Tornado Generated Missiles, and External Flooding BFN-50-C-7102 RO - Seismic Design BFN-50-C-7103 RO - Structural Analysis and Qualification of Mechanical and Electrical Systems BFN-50-C-7104 RO - Design of Supports BFN-50-C-7105 RO - Pipe Rupture, Internal Missiles, Internal Flooding and Seismic Equipment Qualification form the design basis for the civil features and structures at Browns Ferry These criteria documents incorporate the results of a review Nuclear Plant.
of the FSAR, the commitments / requirements data base, and the 22 previously existing civil design criteria.
TVA has previously reviewed these criteria, and is having an independent technical review performed.
The reviews assure the incorporation of the applicable C/Rs from the C/R data base, identify and resolve conflicting This task requirements, and assure completeness for the BFEP civil efforts.The effects will be completed and revised criteria issued prior to restart.
of any criteria revisions (R0 to R1 of the civil GDCDs) will be addressed prior to restart..
s';.
CONCERN:
Paragraph 4 (4) and Paragraph S.2.1. subparagraph 3 The design criteria should clearly identify the appropriate codes to be applied for evaluation of existing designs and for performing evaluations of new or modified designs for the lifetime of the plant.
The correlation between design rules provided in the codes and the level of quality provided by the related requirements for material certification, testing, fabrication, and inservice inspection also should be included.
RESPONSE
Engineering assurance had identified this design criteria concern. To rectify the finding a review was performed on system design criteria documents and references to specific codes or standards.
A standard paragraph was added to system design criteria documents to direct the user to Section 4.0 paragraph 2 of BFl*-50-736 and Section 4.5 of BFN-50-739 for guidance in determining which code or standard is applicable for the systems, structures and components.
The standard paragraph directs the user to Bills of Material for the system, to General Electric Design Specifications and any other commitment / requirement that refers to codes and standards. This standard paragraph indicates if a commitment / requirement has been changed to the code of record. The change is described in BFN 50-739.
l l
{
1 1
I l
(
l
CONCERN: Paragraph 4.(3) and Paragraph S.2.1. subparagraphs 5 and 6 One of the major goals of 'the DBVP is the verification of the functional adequacy of the plant configuration.
TVA had conducted walkdowns to verify several hundred functional design configuration drawings (DCD). However, these drawings do not show the physical as-built configuration of the plant.
TVA needs to assess the physical drawings of the plant to determine what effect the alleged loss of configuration control has had on the adequacy of essential calculations that were performed.
The physical drawings of the plant should be categorized by function or type and should be evaluated.
Drawing categories that require a high degree of conformity to the as-designed configuration to support essential calculations might then be independently assessed to determine the conformity of these drawings with the as-built configuration.
If necessary, certain drawing categories can then be recommended as requiring complete configuration control and added to the list of DCDs.
For the other drawings, not brought to the DCD level, there will, at least, exist an' assessment report that details the type, frequency, and trends of configuration discrepancies to be expected.
Specifically, the DBVP is performing essential calculations required to ensuro functionality on the basis of (1) as-built system functional drawings and (2) as-designed physical configuration drawings. However, the team is concerned that the essential calculations for the piping systems may be performed using inappropriate phfsical configurations of the system because the as-designed and as-built drawings are sometimes quite different.
The DBVP does not contain program requirements to address this issue and TVA needs to revise DBVP to address this potential problem area. This concern is resolved by (1) obtaining as-built physical configuration drawings of a system prior to performing the calculations and (2) by establishing design controls to ensure that the essential calculations are reviewed to determine the effect of es-designed to as-built configuration changes on the calculation results and conclusions.
RESPONSE
1 l
The DBVP does emphasize functional drawings which provide a means to confirm l
that the functional configuration of each system is up-to-date, documented, and in compliance with appropriate criteria. Also, functional drawings provide input for the BFNP Calculation effort.
This input is complemented by physical and drawing information from the walkdown programs or from other l
changes as follows:
l l
1.
Restart Design Criteria Documents (latest revision issued) l 2.
Configuration Control Drawings (with reconciliation sheets) 3.
Unit 2 Cycle 5 ECN Design Information l
f 4.
Component Nameplate Data Sheets (CNDS) 5.
TVA As-Constructed Drawings and Supplemental Information which is available from the walkdown efforts associated with many j
ongoing programs such as the 79-14 walkdown data.
6.
TVA as-designed drawings when TVA as-constructed drawings are l
not required.
l l i
1
If varifisd physical information is raquirad but not available, althar supplemental.walkdowns ars parformed to obtain tha nsadad data, or ths calculation will be reconciled prior to restart.
As an added measure of assurance, the DBVP is defining requirements for performing restart tests for the process systems which will verify system performance as appropriate.
e 1 l
CONCERN:
paragraph 4 (7) and paragraph 5.2.1.
subparagraph 7 The NRC team could not find specific design requirements for safety / relief valves contained in FSAR Appendix C in the Commitments / Requirements data base listing for safety / relief valves. These data may be completaly missing from the data base or these data may be categorized only by the main steam system and not by the component category.
In either case, this program is not functioning as required because the FSAR requirements could not be found in the data base listing for safety / relief valves.
TVA needs to ensure that the specific design requirements of FSAR Appendix C for safety / relief valves and other components be included in the commitments / requirements data base listing.
Furthermore, the esuse for this missing data should be investigated by EA Oversight group to ascertain if it is an isolated incident or a generic problem.
RESPONSE
TVA's Engineering Assurance issued an action item H-032 based on this URC finding.
The purpose of Table C.0-7 of Appendix C was not to define loading criteria, design requirements or to delineate the code requirements TVA has committed to for particular components, but to present the results of analytical calculations as compared to code allowable values and demonstrate that code allowable values are met.
Table C.0-7, therefore, contains the results of analyses, or design output, which does not constitute a C/R.
TVA commitments to particular design codes and design requirements are found elsewhere in the FSAR and in other documents used to prepare the Restart Design Criteria Documents. The applicable design codes from Table C.0-7 were reviewed and determined to have been referenced in the system design criteria documents.
The design requirements for the safety / relief valves were properly captured in the C/R data base by references to FSAR text, letters outlining the design, etc.
Appendix C contains Civil-related information since structural loading calculationc are the responsibility of the Civil Engineering Branch. The para-graphs in Appendix C for which no C/Rs were written were either considered to be too general to constitute a C/R or contained design output which is not a C/R.
Appendix C of the FSAR was reviewed in its entirety by the Civil Engineering Branch of TVA in the preparation of C/Rs.
Thirty-six C/Rs were generated as a result of this review will be closed by restart.
The appendix was also completely reviewed again by Gilbert / Commonwealth as part of their effort in preparing Civil design critoria.
l The NRC inspection raised the specific question as to why certain information in Table C.0-7 of Appendix C was not ecptured in the C/R database. Table C.0-7 contains a listing of equipment / components which were designed to typical code standards.
The list contains the code allowable stress or dimension values and calculated stress or dimension values based on simple stress analysis techniques.
The answer to the NRC question lies in the purpose and scope of the criteria.
The scope of Appendix C is outlined in parager.phs C.1.1 and C.1.2 of the appendix. Paragraph C.1.1 states that the criteria set forth in the appendix apply to ductile metallic structures or components that are normally designed using stress analysis techniques such as pressure vessels, reactor internal components and power piping. Paragraph C.1.2 states that there are many important safety-related components or equipment that are not normally designed or sized directly by stress analysis techniques.
These components, such as valves, pumps, and electrical equipment and mechanisms, are designed by tests and empirical data.
Simple stress analyses are sometimes used to augment the design of these_ components but the primary design work depends on tests and field experience.
Table C.0-7 is referred to in paragraph C.4.9 primary System Components Stress Analysis. The paragraph pertains.to compcnents of the nature referred to in paragraph C.1.2 of the appendix and again points out that these types of components and equipment are designed based on extensive testing and experience.
The paragraphs stated that TVA did perform stress analysis on selected components considered to have possible higher than code allowable primary stress as a result of rare events or a combination of rare events.
The paragraph then refers to Table C.0-7 that contains the results of the analyses, comparing code calculated values vs. stress cnalysis calculated values.
The table demonstrates that code calculated values are adequate for the design of the components.
The component fields were included on the C/R data sheet to identify information that could be used in a "design criteria for a given type of component." A review of the data sheet reveals that general component names are used rather than specific components, cuch as main steam isolation valves or main steam safety relief valves.
The component field was intended for use in preparation of design specifications, etc. for a component, not to cross reference a particular component C/R to its system.
For information on a component relevant l
to a system thu user requests a analysis report and reviews it for pertinent information, l
I l
. 1
CONCERN: Paragraph 9.2.1. subparagraph 8 The NRC team identified the following two inconsistencies between the system design criteria and the BEN FSAR: (1) The design code listed for the main steam safety / relief valves in Paragraph 6.1 of the System Requirements for the rain steam system is dif ferent from that listed in Paragraph 3.7.2.2.6 of the hain Steam System Design Criteria and Section 4.4 of the FSAR.
(2) Table C.0-7 of the FSAR specifies the corrosion allowance for the main steam isolation valve to be 0.12 inch; whereas, the Main Steam System Design Criteria, Attachment 2, Part B, page 5, specifies the corrosion allowance to be 0.088 inch.
While these particular inconsistencies may not have a major consequence, it does point out that inconsistencies exist between various documents associated with the DBVP. Because many of the DBVP documents have been prepared in parallel, rather than in sequence, TVA should review such inconsistencies to determine whether there is a potential problem area of document inconsistencies in the DBVP.
RES P0 tis E The specific inconsistencies identified by the NRC wero (1) between two DBVP documents and (2) between a DBVP document and the FSAR.
The referenced System Requirements erroneously included a reference to the design code for the main steam safety / relief valves.
This reference has been removed. The purpose of the System Requirements is to identify the functional modes of operation to support plant shutdown from Design Basis Events and not to define design criteria.
The preparer of revision 0 of the Main Steam System Design Criteria was aware of the inconsistencies among documents but specified the 0.088 inch corrosion allowance because that was actually whac the MSIVs were purchased to and installed, i.e., reflected the present "as-built" design configuration. The enclosure of a letter from TVA to the AEC dated 10/11/72 (captured in the C/R data base as C/R BFNMEBLWB1001) explains the discrepancy between corrosion allowances.
It stated that even though the MSIVs purchased used a corrosion allowance smaller than the final design requirement (.12 inch), they were also purchased to preliminary design pressure (1250 psig) and design temperature (575 degrees F) which was higher than the final design pressure (1146 psig) and the design temperature (560 degrees F) of the Hain Steam System. The resulting wall thickness of the installed valve is thus thicker than the required for the ultimate design requirements of the system.
i Revision 1 of the Main Steam System Design Criteria has been clarified. It contains the design corrosion allowance (.12 inch) with a notice of an exception taken to the requirement which references the letter to the AEC.
l
' l l
7 N'
An additional review has been performed between system design criteria and the I.
FSAR/ Technical Specifications.
Any contradictions identified between the design criteria and these documents will be resolved.
In addition, the C/R data base has been updated and reviewed for each revision of the design criteria.
TVA's Engineering Assurance audited a number of original design criteria, system requirements calculations and testing requirement documents and has identified several problem areas. These have been identified as individual EA Action Items and have been collected into CAQR BFT870842. For EA Action Items, corrective actions are generated to correct the identified deficiencies.
These EA Action Items have been addressed in the revision of each design criteria document.
e W
6 l..
o CONCERN: Paragraph 5.3.1.
subparagraph 2 In its review of the system requirements calculations (SRC) for the residual heat removal (RHR) and the RHR service water systems, the team noted that both of these system requirement calculation packages follows the same format and perform the same function for their respective systems. Neither package stated which procedures were used to prepare the calculation.
Furthermore,
the calculation package for the RHR system does not reference the Browns Ferry Updated FSAR, Technical Specifications, or the operating instructions.
If a calculation package is to determine what system is required under what plant conditions and how it will respond to changing plant conditions, it would seem appropriate that the package references these documents.
RESPONSE
Division of Nuclear Engineering Calculations are prepared in accordance with one procedure - Nuclear Engineering Procedure (NF?) 3.1 "Calculations." The methodology or process of how the-System Requiremt it Calculations (SRCs) were prepared, is described in section 6.2 "Methodoloty" of each SRC.
The major source of input to the System Requirement Calculations is the Safe Shutdown Analysis (SSA) - calculation BFN-OSG3-048. Both the FSAR and the Updated Browns Ferry FSAR, through the review of tha licensing Commitment / Requirement Data Base, were utilized in the preparation of the SSA.
Since the SSA is referenced in each SRC, it seemed redundant to include another specific reference to the FSAR.
l Systems required under what plant conditions and how it will respond to l
changing plant conditions are defined by plant operating instructions or emergency procedures. The purpose of the SRC is to address the limiting or mitigation functions of a particular system for any event within the design basis.
The purpose of the Design Baseline and Verific.ation Program is to reestablish the Design Basis by evaluating the plant functional configuration with respect to the Design Basis.
The Technical Specifications and operating instructions are prepared to insure that the plant systems are maintainod within the analyzed Safety Design Dasis limits.
Therefore, these documents should not be considered as a source of input to the SSA or SRCs.
Some examples of input into the SSA are the FSAR and the BFNP Reload Licensing Report. The balance are delineated in section 4.0 of the calculation.
Technical Specifications are being reviewed against the design basis as an integral part of DBVP system evaluations.
l l l
l f
~
F-CONCERN: Paragraph 4 (1), 4 (2). Paragraph 5.3.1. subparagraph 4 and Paragraph 5.4.1, subparagraph 8 The DBVP uses accident conditions for the system test acceptance criteria.
The NRC team is concerned that the use of accident conditions for the test acceptance criteria, without considering the system design limits, could result in masking precursors of common-mode failures.
RESPONSE
The concern regarding end of life accident conditions of (1) degraded modes such as undervoltage, (2) adverse environmental conditions, and (3) system degradation should not only be focused on the restart test program -
specifically on the test acceptance criteria.
These conditions are aspects of design considerations which are incorporated into the design of components and systems.
The followint. information explains how these conditions are factored into the design of sono selected components.
Adverse voltage conditions can occur due to system undervoltage and overvoltage on AC & DC systems with frequency fluctuations also being a concern on AC systems. These conditions can have different effects on mechanical systems in the area of motor performance and instrumentation and control systems.
For motor performance, the concern would be at degraded conditions, the motors would not provide adequate horsepower in the form of torque to the pumps and valves they support; thereby, causing the mechanical system to fail its performance requirements when necescary. However, the design of the system was performed by requiring a certain horsepower be delivered to the mechanical system.
A motor is then purchased that is required to deliver the horsepower required under varying voltage and frequency conditions. These conditions are then factored into the essential electrical calculations that are performed to set limits for plant operation during degraded conditions as applicable.
In addition, the environmental qualification program verifies the performance of the component under degraded conditions due to harsh environments.
l --
'.q.
For instrumentation and controls associated with set points, the electrical essential calculation program provides set point scaling and accuracy calculations to ensure the limit meets the setpoint required under adverse conditions - degraded voltage, harsh environments, etc.
Relays and control logic are designed similar to motors and calculations ensure the range of voltage and frequency does not adversely affect system performance. Again, the equipment qualification program verifies the performance of the component under degraded conditions due to harsh environments.
Instrumentation degradation is also monitored by the performance of surveillance testing to the technical specification requirements.
System Degradation as it relates to mechanical components is covered by the MEB Essential Calculation program which verifies the as-built conditions.
This includes items like wall thickness, pump flow rates, valve closure times, etc.
System Degradation is also reviewed via the implementation of BFNP Surveillance testing programs and by the ASME Section XI Inservice Inspections required by 10CFR50.55(g).
The surveillance testing program is established to ensure Technical Specification requirements such as minimum pump flow, valve closure timing, containment isolations, etc., are within their design parameters.
ASME Section XI inspections consisting of non-destructive examinations of welds and bolting materials, visual inspections of components, pipe systems, and supports, and hydrostatic tests of systems, ensures that degradation over the plant design life, if it occurs, is identified and reported for corrective action.
This response indicates how the design considerations of (1) Degraded Modes such as Undervoltage, (2) Adverse Environmental Conditions, and (3) System Degradation are factored into the Design Basis as part of the DBVP program or resolved as corrective action from the deficiencies identified by testing and/or inspection programs.
i l
l l
l l
CONCERN: Paragraph 4 (1) and 5.3.1. subparagraph 5 Although system restart testing is currently underway, some systems are being tested without the benefit of essential calculations, which could create potential problems; for example, the need to repeat certain tests.
Furthermore, the team could not determine whether a mechanism has been established to keep DBVP personnel apprised of the restart test experience.
This is a serious drawback in the progress of the DBVP and might result in substantial rework, resulting in delays.
RESPONSE
Due to the considerable length of both the Restart Test Program and the Calculation Effort, these programs were conducted in parallel instead of in series.
The testing program was started on a risk basis not only to the calculation effort, but also to the SYSTER effort, the electrical configuration control program, and many other ongoing programs.
The risk of retest due to these ongoing programs is thought to be minor, however, with relation to the duration of the overall testing program.
We, therefore, decided to run the restart test program in parallel with the other major ongoing programs and fully realize that there probably would be additional testing required before the restart of Browns Ferry.
A representative of the Division of Nuclear Engineering (DNE) is required to be part of the Joint Test Group (JTG). Restart test results are presented to the JTG for acceptance and is therefore reviewed by engineering. Test l
exceptions established against a Restart Test Procedure (RTP) are required to be approved by DNE.
Refer to Site Directors Standard Practice 12.1 and 12.2 for the details of processing Restart Test Procedurer.
In addition, Project Instruction PI 86-21 requires during the preparation of the SYSTER that the system engineer ensure; 1) that no test exceptions have been written against the Baseline Test Requirement Document and 2) that the Baseline tests have been performed.
If a test exception has been ostablished against the Baseline Test Requirement Document or if baseline tests are not performed at the time of the SYSTER, a punchlist item is established per PI 86-53 to track the item to an acceptable closure by the Baseline organization.
I I
l l
l l
l 1 I
i l
t CONCERN: Paragraph 4 (2) and Paragraph 5.3.1. subparagraph 6 The Systems Mode Requirements for the DBVP Restart Plan identifies various events and actions defined in the Safety Shutdown Analysis (SSA). The review of this document revealed that the containment purge valve (CPV) operational capability is assigned as a Phase 2 priority item. The CPV should be assigned as a Phase 1 priority item.
RESPONSE
The licensing design basis for the Containment Atmospheric Dilution (CAD)
System is described in section 5.2.6.1 of the BFN FSAR.
The major aspects of the design basis'for the vent path states:
"The CAD system shal'1 include means for releasing gas from either the drywell or the supprescion chamber in a controlled manner. The gas shall be released via the Standby Cas Treatment System."
"The containment pressure shall not exceed 30 psig as a result of CAD system operation."
BFN met these design bases by providing a CAD system conforming to the United States Atomic Energy Commission (USAEC), Safety Cuides for Water-Cooled Nuclear Power Plants, revised March 10, 1971, Safety Guide No. 7. "Control of Combustible Cas Concentration in containment Following a Loss-of-Coolant Accident."
Additional information about the design of the CAD system is contained in the FSAR section 5.2.6.
DBVP is committed to verifying the functional configuration of the plant meets its design bases.
This analysis by DBVP does not supersede the commitment for the systems required, but provides an additional level of confidence that the l
system will perform its required functions when needed.
For the containment vent mode of the CAD system, the mode is included in the program to be evaluated for acceptability. However, each mode of operation for the system was reviewed to determine its importance relative to safe shutdown in accordance with BFNs licensing design bases.
The decision to defer the Containment Vent Mode to post restart, as delineated in 6.3.24 of calculation BFN-BFS3-050 Rev.1 (System Mode Requirements for DBVP Restart Plan), was based upon the following aspects of the function to be performed.
1 l ~
Safety Guide 7 requires assumptions be made for H2 and 02 generation rates following a desi'gn basis LOCA.
The curves associated with these rates are presented in figuro 5.2-13 in the FSAR and shown in attachment 1.
However, a more realistic analysis made during the timo of licensing shows a lesser rate of H2 and 02 generation (see attachment 1).
In addition to the H2 and 02 generation rates being conservative, once nitrogen was added to the containment for reducing the concentration, a zero percent leakage was applied to the containment atmosphere. However, the actual leakage from containment at BFN can be up to 2 percent of free volume por day and meet its own licensing basis (see section 5.2.5.1 of FSAR).
This analysis in the FSAR during licensing pointed out the extra conservatism for the mode of operation.
In addition to this analysis, a technical analysis performed by General Electric in document NEDO-22155, the title of which is "Generation and Mitigation of Combustible Gas Mixtures in Inerted Mark I Containments" was l
reviewed for additional information.
1 To summarize the contents of the document, General Electric performed analyses of oxygen generation in inerted boiling water reactor Mark I containments for a range of transient and accident. conditions to evaluate existing combustible gas control capability.
The results of the analysis shows that, for all BWRs with Mark I containments (Browns Ferry included), peak containment oxygen concentrations are maintained below the combustible gas limits at all times without requiring containment venting at hydrogen combiners.
The analysis was performed based on the worst-case scenario of a LOCA and included many conservative assumptions (see report).
In section 5.0, one of the conclusions of the report states that containment venting would not be required until six years after the event. This was based on a very conservative assumption that there was zero leakage from the containment.
Using the results of this analysis in conjunction with the licensing basis for BFN and the knowledge that the containment actually does leak, the DBVP analysis of the mode for CAD containment venting was deferred to post restart.
The rationale being that the containment vent valves would not be required to open and any pressure build-up in the containment would be depressurized through the containment leakage path into the Stand-by Gas Treatment System. Therefore, the containment vent mode is considered post restart.
f
/"\\/
20 s
N O
8 SAFETY GUIDE 7 ASSUMPTIONS y
/
/
d g
f MORE REALISTIC ASSUMPTIONS (GH22.2, 5 /03 AB,.10 /o M W)
O 1
.2
.5 1.0 2.0 5.0 10 20 50 10 0 TIME A FT ER LO C A./t D AYS 30 1
N SAFETY GUIDE 7 Y
I 20 ASSUMPTIONS
_/
g s
V w
D MORE REALISTIC ASSUMPTIC NS d10
-(GH =. 2, 5 /o 3 A B,. l O /o M W )
2 4 /o H b2 i
~~~~ ~
O
.2
.5 1.0 2.0
- 5. 0 10 20 50 10 0 TIM E AFT ER LOC A./\\. DAYS BROWNS FERRY NUCLEAR PLANT FINAL SAFETY ANALYSIS REPORT H2AND Oy CONCENTRATIONS FOLLOWING A LOCA WITHOUT DILUTION NO CONTAINMEN T LEAKAGE FIGURE 5.2-13 Attachment I
s CONCERN: Paragraph 5.4.1.
subparagraph 1 The NRC team reviewed TVA's records of the original electrical walkdowns and found that these walkdowns were conducted under such loose documentation and quality assurance proceduces that severe doubt exists concerning the validity of the walkdown results:
(1) the walkdowns were completed before approved performance procedures were issued and (2) the original documentation (e.g.,
marked up design drawings) was not traceable and retrievable. The Engineering fsssurance Oversight Review Team discovered that condition during an internal audit and issued a Condition Adverse to Quality Report (CAQR). TVA plans to perform a sample reverification of the least documented 10 percent of the walkdown infermation under full quality assurance control.
If the 10 percent sample contains any deficiencies, TVA will perform a 100 percent reverifica-tion.
The NRC team considers this approach to be acceptable because of the limited scope and objectives of the electrical walkdown portion of the DBVP and because detailed electrical walkdowns under full quality assurance control are in progress under several other programs.
RESPONSE
No response required..-
__)
l a
CONCERN: Paragraph 4 (6) and Paragraph 5.4.1. subparagraph 6)
TVA has established a baseline for BFN electrical power systems primarily through a program of "functional" electrical walkdowns, in which point-to-point connections of safety-related auxiliary power circuits (including control and protection circuits associated with the power systems) were confirmed through functional tests rather than circuit tracing. The NRC team considers this procedure in principle technically acceptable only for the limited purpose of establishing configuration control single line drawings.
RESPONSE
The configuration control drawings for the electrical power systems are comprised of single line drawings and schematics associated with the circuits bounded by the DBVP.
The procedure for establishing a sch::ntic CCD is similar to that for the single line CCD with the exception that functional walkdowns were not made using schematics. Functional tes?.ing as well as walkdowns made for the single lines are used to verify functional correctness of the associated schematics.
If it is not possible to verify functional correctness by this method, revisions to the existing test procedures for additional testing is punchlisted to ensure functional schematic verification.
[
CONCERN: Paragraph 4 (6) and ParaReaph 5.4.1.
subparagraph 7 Functional tests are the basis for the walkdown procedures.
However, the procedures do not appear to specify that separate tests should be performed for each redundant control channel, or that physical and electrical separation of redundant control channels should be verified.
Additionally, the point-to-point check appears te rely on the judgment of the person (s) performing the walkdowns.
TVA should provide its rationale of the acceptability of this approach when functional tests are to be used in lieu of physical tracing of circuits.
RESPONSE
The DBVP relies on both physical walkdowns and functional testing to demonstrate that systems and individual components can perform their safe chutdcwn function.
BFEP Project Instruction PI 86-26 "Baseline Test Requirements" requires that the question of testing redundant channels or trains be considered when preparing the Baseline Test Requirement Document (BTRD).
This document is prepared by the Baseline organization to insure that the systems can perform its minimum safe shutdown functions as specified in the System Requirement Calculation and the Safe Shutdown Analysis.
The following Baseline Test Requirement Documents are only a few of the examples that contain redundant train or instrument channel testing:
SYSTEM BTRD NO.
RIMS NO.
RRR Service Water BFN-BTRD-009 B30 870731 003 Core Spray BFN-BTRD-034 B30 870731 400 Neutron Monitoring BFN-BTRD-043 B30 870721 405 At the time of Browns Ferry licensing, the FSAR concluded that the design of the plant satisfied Criteria 22 concerning electrical and physical separation of systems important to safe shutdown. Since that time sufficient evidence to warrant a physical trace of circuits due to violations of that criteria has not been uncovered. Ongoing trend analysis of Conditions Adverse to Quality (CAQs) and other problem reports have not identified a significant separation problem.
In addition, two major evaluation programs (Equipment Qualification and Appendix R) have not identified significant electrical separation problems.
l' t
Essential circuits on single line drawings within the safe shutdown boundaries are being walked down to establish the circuit's functional configuration.
The problem of relying on the judgment of the person (s) performing walkdowns for point to point checks has previously been identified in CAQR BFT870349.
As a result, revised procedurcs and a sample re-walkdown will resolve this issue.
The NRC has accepted this approach to the resolution of the problem -
refer to finding Paragraph 5.4.1, subparagraph 1, for further information.
As an additional integrated system test to verify independence and redundance of circuitry and controls, over and beyond the individual and system teste previously described. TVA has committed to performing a LOP /LOCA test prior to restart. These tests will demonstrate functional independence of redundant circuits by simulating worst case single failures in conjunction with LOP /LOCA and verifying proper system operation is achieved.
{ l l
l. - - -
~~
s L
CONCERN: Paranroph 5.4.1.
subparagraph 9 TVA Restart Design Criteria Document BFN-50-7200C, Rev. O, "250 VDC Power Distribution System (Units 1, 2, and 3) covers the design and performance requirements of the 250-V vital de power system. The NRC team found that these design criteria and related documents lack a number of critical details on the design basis of the vital de power system.
Consultations with TVA engineers on this subject failed to identify the process by which essential system performance parameters, which should be defined by the design criteria and derived by calculations, are factored into test requirement documents (TRDs). The design criteria document does not address the inclusion of end of life conditions and the effects of approved maintenance actions (such as jumpered cells) in the calculations to determine or verify system final discharge voltage.
This type of verification is needed to ensure that centrol components, such as relays and motcr-generator speed regulators are capable of satisfactory operation under system final voltago conditions to support the safe shutdown function of the 250-DC power distribution systems. Therefore, the team believes that (1) TVA should provide its rationale on the acceptabillLy of this approach and (2) the DBVp should have procedures for the inclusion of calculation results as test parameters in TRDs and end-of-life and maintenance conditions in calculations and test acceptance criteria.
RESPONSE
The finding addresses two separate concerns:
1)
End of life conditions for the batteries and their relationship to the the acceptance criteria in the Test Requirements Documents (TRD),
calculations, and the DCD.
2)
Maintenance actions and their effect on the TRD, the calculations, and the DCD.
Cell removal is a specific concern.
l The DCD specifies the following:
1.
The design criteria for the system specifies that 250-V DC system must maintain the voltage between 210-V DC for battery end of discharge and 277.8 i 1.8-V DC for battery equalizing charge.
2.
Battery sizing is to be performed in accordance with IEEE Standard 485-1983.
Periodic battery performance discharge tests of the unit batteries and 3.
shutdown batteries are made in accordance with IEEE Standard 450-1987 to determine the condition of the batteries.
Analysis of the tests determines when batteries should be replaced.
In the case of jumpered cells, a calculation is performed to evaluate the sizing of the battery relative to the loading requirements for the distribution system.
The calculation takes into consideration the 80 percent capacity factor for the system at the end of its useful life.
Strapping out a t l
l
..- =.
- s.
t:
e cell requires a TACF and an associated USQD.
The USQD requires a calculation by design to approve the adequacy of the temporary configuration. Therefore, procedures are in place to handle thie example.
j Moreover the essential calculations are being redone as part of the DBVP.
If a calculation does not support the DCD, then a CAQR is written.
System operability will.be verified by tests in acccordance with IEEZ Standard.
450-1987.
l n
4 j
i 4
i p
t e
E F
i l
h O
CONCERN: Paragraph 5.5.1. subpararraph 3 The overall DBVP is intended to establish the configuration baseline, and TVA has an EA Oversight Review Team to help ensure compliance with the overall DBVP objectives. However, the NRC team noted that none of the I&C syctems are listed in FSAR Chapter 14 safe shutdown systems for walkdowns and functional t'
'ng, they are designated via the establishment of a boundary transfer c
.w.ng, which defines system boundaries and identifies components required by the Safe Shutdown Analysis (SSA). As a result of this practice, certain portions of an I&C system (for examplo, certain elements of the reactor protection system) are repeatedly included in walkdowns or functional testing, but the entire system never receives a comprehensive system-wide walkdown or fur.ctional tust on its own merit, i
RESPONSE
Browns Ferry does not define systems on a ' oasis of purely mechanical or purely I&C.
Instrument and control components are identified per DNES 8.31 in accordance with the system designation for which they perform a function.
The Reactor Protection System (RPS) is no different in this matter. The nature of this system is to function as a processor of data and then in turn take specific actions.
The components associated with a processing type system are composed of relays, circuits and breakers.
These components were below the level of detail that Baseline program deemed necessary to walkdown to establish functional configuration.
The demonstration of the system's capability to perform its safe shutdown function is done by testing of the lo5ic. A i
l Baseline Test Requirement Document was prepared for the RPS (refer to l
BFN-BTRD-045. RIMS B30 870723 009).
The RPS receives inputs from the various systems which it monitors, and provides cutputs tc the systems it controls in the form of contact eferations.
The RPS system is tasted by simulating contact operations at the input, and verifying the appropriate output contact operations. This input / output testing confirms fully the operation of the RPS.
(The RPS function is one of strict logic, i.e., performing logic and/or operations on the inputs to provide an appropriate output.)
The contact inputs to the RPS are provided by various temperature, pressure, flow, etc., instruments from mechanical process systems.
These instruments are tested by simulating an input (temperature, pressure, etc.) and monitoring I
the output. --
6 The devices which operate as a result of an RPS output (scraln discharge solenoids, etc.) are tested by simulating an output from the RPS and verifying that the devices perform as required.
Similarly, certain mechanical process systems perform functions upon receipt of contact operations from process monitoring i.istruments on other systems.
These interfaces are tested in the same manner as the RPS interfaces.
Therefore, car 5 system, mechanical or I&C, is tested fully to verify that it-performs its required functions, providing output and/or tr.echanical operations, based upon conditions within itself, or on receipt of signals from other systems.
i e
l l L
=
~.
..n.
CONCERN: Paranraph 5.5.1. subparagraph 4 BFEP PI 87-59, paragraph 4.3.4, states that either wa1Kdowns or functional testing may be used for mechanical flow and control drawings and for the 4
electrical one-line drawings. BFEP PI 67-44 paragraph 4.2 and FI 87-27, paragraph 4.2.9, similarly states that walkdowns or functional testing may be used for electrical schematic and elementary drawings.
TVA informed the KRC team that when an I&C system, or a portion of an I&C system, is selected for walkdown and functional testing, on!y the mechanical flow and control portion would be functionally tested. A functional test in this case involves activating the initiating devics to trigger tho end device and watching for confirmation of the end device actuation without verification of the intermediate components.
Although the functional test can prove the safe-shut-Jown capability of the I&C system, it neither provides a good check for actual plant configuration nor reconciles differences between as-designed and as-built drawings.
The NRC team believes that without the establishment of a true configuration baseline, there can be no assurance that future changes would be adequately controlled.
RESPONSE
The scope of the DBVP is to provide functional verification of the schematic and elementary diagrams. This is provided by functional testing.
Each system is reviewed to ensure that the testing provides this functional verification.
This functional verification is adequate to prove safe shutdown capability of the plant.
Differences betwecn the as-designed and as-built single line and schematic /
elementary drawings are determined and documented under BFEP p1 87-27.
This procedure provides for the production of Configuration Control Drawings (CCDs). Thess CCDs replace the as-designed and as-constructed drawings and are to be the only drawingr in existence in the future.
Discrepancies between as-designed and as-constructed drawings are evaluated, and corrective action teken as required.
Future changes will be controlled under procedural control which requires a physical walkdown verification of the system, or portions of systems, affected by the changes before the change is implemented.
CONCERN: Paragraph 4 (6) and Paragraph 5.5.1. subparagraph 5 The NRC team noted that the reactor protection system is made up of two 4
independent trip systems. There are usually four channels provided to monitor each critical parameter, with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic module so that either channol trip will trigger that trip system.
The simultaneous tripping of both systems will produce a reactor scram. The trip systems require a miniani number of operable instrumentation channels per trip system.
These parallel redundant systems and channels are commonly employed in other I&C systems, where two, three, or four redundant channels run in parallel.
Since each channel can be made up of several components, including instruments and wiring, the possibilities exist that there can be cross-wiring between these corre.1ponding components. Where two corresponding components are erroneously double cross-wired, the likelihood of its detection is beyond the realm of a functional test.
The NRC team believes that only a point-to-point check of the configuration will detect such a miswiring scheme.
A point-to-point check also will identify the components, wiring size, and confirm termination integrity.
RESPONSE
The trend analysis of CAQR's has not identified any double cross-wiring at BFN.
Functional testing will not detect "where two corresponding components are erroneously double cross-wired." However, in the unlikely event that this would occur, functional testing would provide the assurance that the system would perform the required function.
f 1
l I
i i
),'
e CONCERN: Paragraph 5.5.1. eubparagraph 6 The NRC team noted that the EA oversight Review Team has uncovered a variety of minor programmatic as well as implementation discrepancies in the I&C area.
Some of these discrepancies involve numerous incidents whero the tags and/or the information on tags do not agree with design documentation. The NRC team believes that because of numerous discrepancies, the configuration baseline of I&C components should be established by functional test as well as by physical verification, where practicable.
RESPONSE
In addition to establishment of baseline configuration for I&C components by testing, a physical walkdown was performed for the I&C control diagrams and instrument tabulations. This walkdown provides name plate data verification for I&C components. Additionally, for all I&C components which have a setpoint, or for indicators which are required for restart, calculations are performed to determine the demonstrated accuracy of the instruments, and the suitability of the setpoints.
Ea:h I&C component involved in these calculations have the appropriate data field verified prior to issuance of the calculation.
i t
f
c:;
i CONCERN:
paragraphs 4 (9): 5.1.1 (4). 5.1.2 (1). 5.2.1 (4). 5.2.2 (1).
5.3.1 (3). S.4.2 (1). 5.5.1 (2), and 5.5.2 There are many ongoing programs that interface with the DBVP.
The team could not identify the method used to coordinate these programs and the means of communication between the personnel involved with each program. TVA needs to establish this methodology.
Furthermore, since programs other than the DBVP are used to verify important facets of design, TVA must revise the DBVP tc explicitly identify these programs and provide clear cross-references between the DBVP and the other programs on a system-by-system basis.
ERSPONSE TVA has initiated a review effort to enhance coordination and communication between personnel involved with BFN programs.
The objectives of this effort are to:
(1) develop mhtrices to provide a "roadmap" to show input / output documentation relationships between BFN Special Programs identified in Section III of the Nuclear Performance Plan (NPP) Volume 3 and those operations and maintenance related programs defined in Section II of the NPP; (2i use these matrices as trois to enhance coordination and communication between respcnsibic program managers; and (3) determine how the Sequoyah Nuclear Plant Integrated Design Inupection FJndings are being addressed by BFN.
One of these programs is the Design Baseline and Verification Program.
The program impicmentation is as follows: (1) identify programs for which data input / output information will be gathered (2) compile data and generate matrix that depicts input / output relationships. (3) present results to responsible management, and (4) issue results in a summary report format.
Emphasis is being placed upon showing the interrelationships that exist I
between the Design Baseline and Verification Program and other BFN programs.
l It is noted that some program interfaces ruch as the interface between the DBVP and the restart test progra.o require more detailed procedural controls than program interfaces where the importance of the interface is primarily a l
mutual understanding of respective interfacing program responsibilities.
The l
DBVP has review jurisdiction over programs and processes required to establish and maintain functional configurational control of Baseline Safety Systems. A multidiscipline DBVP team is reviewing programs interfacing with the DBVP.
This review verifies that required safety issues are being appropriately addressed and that adequate interface communication and controls are in place.
If specific weaknesses are identified that affect functional configuration of DBVP safety features they will be addressed before rad'. art.