ML20151U409
| ML20151U409 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 08/02/1988 |
| From: | Architzel R, Ball J, Rebecca Barr, Bevan R, Jim Melfi, Myers C, Richards S, Russell J, Wang H NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| To: | |
| Shared Package | |
| ML20151U382 | List: |
| References | |
| 50-361-88-10, 50-362-88-10, NUDOCS 8808190072 | |
| Download: ML20151U409 (50) | |
See also: IR 05000361/1988010
Text
s.
,
U. S. NUCLEAR REGULATORY COMMISSION
REGION V
Report T-361/88-10, 50-362/88-10
Docket . .. -361, 50-362
License . rJPF-10, NPF-15
Licensee: Southern California Edison Company
P. O. Box 800
2244 Walnut Grove Avenue
Ro.emead, California 91770
Facility Name: San Onofre Nuclear Generating Station - Units 2 and 3
Inspection at: San Clemente and Rosem ad, California
Inspectors: $O ,_ 7 -3d - BB
J A. Richards, Team Leader Date Signed
4h $ .<.v ]- 3 I- YY
R. ar , ss stan Team Leader, Region V Date Signed
/- i\ /l JAl > % *
~ ~~ W
C. MVe 5 , R id t'. pector, Region V Date Signe
J.
h b~ { fS* $
1Y Resident $nspector, Region V Date Signed
Y
J. Melfi, React 6r Drffpector, Region V
Sf/
Da'te' Signed
ho Y Ahb .82 8fr/P/0
. Russell, Rsdiftiost' Specialist, Region V Dat'e Signed
bt9r bd F'o R. ~~i - % - B B
R. Bevan, Inspector NRR/POS Date Signed
ENbb
R. Architzel, Inspector, NRR/ SIB
F o c. 7 - 31 -W,
Date Signed :
/& ~7 /EWAN fo/2 0 Ei !
gN. Wang, Inspe'ctorf/ NRR/ SIB Date Signed
Consultants: J. Houghton, Parameter Inc.
J. Lievo, Parameter Inc.
J. Haller, Parameter Inc.
Approved by: EO _A-2-5% 1
S. A. Richards, Chief, Engineering Section Dato Signed !
l
l
6808190072 8808o3
gDR ALOCK 05000361
- - . -
__ ._. ..-_
.
. . .
.
-2-
,
,
Summary:
Inspection conducted on May 2-6, May 16-27, and June 6-10, 7.988 (Report Nos.
50-361/88-10, and 50-362/88-10)
Areas Inspected: -This'special, announced team Safety System Functional
Inspection (SSFI) involved the areas of Eni;ineering, Maintenance, Surveillance
Testing, Operations, Health Physics, Quality Assurance and Administration.
During this inspection, inspection modules 30703, 92700, 92701, 92702, 37700,
37701, 37702, 62700, 62702, 62704, 73051, 73055, 71707, 41400, 41701, 83728
83729, 84723, 90701 and 90702 were used. .
-l
.
Results: Three violations and one deviation were identified. The team i
concluded that the licensee does not fully understand the design of the l
systems reviewed; that the licensee does not have ready access to accurate i
design information; and that technical work is not always performed in a l
complete, technically correct manner. Deficiencies were also identified with !
testing, maintenance, and operation aspects of the systems reviewed. !
l
l
1
l
l
l
4
.
--^'-
f " m to- --
m *'r 7
ww -~- ' t-~+-'* t" g N* -7"7-t
. _ ... _
'
l . .
.,
DETAILS
1. Persons Contacted
Southern California Edison (SCE)
- D. Fogarty, Executive Vice President-
- K. Baskin, Vice President, . Nuclear Engineering, Safety, and Licensing
- C. McCarthy, Vice President, Site Manager
- R. Dietch, Vice President, E&C'
- H. Morgan, Station Manager
- R. Rosenblum, QA Manager
- F. Briggs, Supervising Engineer, NSSS Electrical
- T. Herring, NES&L Site Representative
- J. Reilly, Manager, Station Technical
- R. Krieger, Operations Manager
- M. Medford, Manager, Nuclear Engineering & Licensing
- J. McMahan, Assistant Maintenance Manager
- J. Wambold, Project Manager
- M. Short, Manager, Nuclear Training
- B. Katz, OMS Manager
- J. Curran, Nuclear Safety Manager
- M. Wharton, Assistant Technical Manager
- 3. Cox, Nuclear Licensing Supervisor
- D. Fellows, Nuclear Generation Engineering Manager
- G. Shelton, Salt Water Cooling Cognizant Engineer
- M. Schwaebe, Component Cooling Water Cognizant Engineer ,
- D Nunn, Chief Engineer - TF Leader
- C, Couser, Compliance Engineer
R
- M. Zenker, Compliance Engineer
- J. McGaw, Licensing Engineer
- A. Sistos, Mechanicar Engineer, E&C
- T. Vogt, Assistant Plant Superintendent - Operations
- V. Fisher, Plant Superintendent
- B. Carlisle, Project Engineer
- J. Yann, Project Engineer-
- D. Eastman, Engineering Manager, E&C
- R. Plappert, Compliance Engineer
h
USNRC Personnel
In addition to the inspection team, the following NRC Regional Office and
Headquarters personnel participated in the inspection activity red /or
attended the associated management meetings:
- T. Murley, Director, Office of Nuclear Reactor Regulation ;
- J. Martin, Regional Adininistrator, ' RV l
- D. Kirsch, Director, Division of Reactor Safety and Projects, RV
- B. Grimes, Director, Division of Reactor Inspection and Safeguards, NRR
,
- J. Tatum, SONGS 2/3 Resident Inspector l
. .
_,m 3--
.
- ..
. 2
- R. Huey, SONGS Senior Resident Inspector
- M. Joh.1 son, Engineer, Office of the EDO
Other Personnel Attending Exit Meeting
- R. Lacy, SDG&E Nuclear Manager
- M. Hug, PG&E Regulatory Compliance Engineer.
- G. Edwards, Power Resources Project Manager, City of Anaheim
- S. Harris, Power Resources Engineer, City of Riverside
- Denotes those personnel in attendance at an exit meeting on June 10,
1988.
In addition to those individuals listed above, the team interviewed
numerous other licensee personnel,_ including engineers, operators,
maintenance technicians, and administrative personnel.
2. Inspection Objectives'
This team inspection had three main objectives, as follows:
-
To assess the licensee's access to accurate and complete design
information for Units.2 and 3, and to assess the licensee's
understanding of the design.
-
To assess the licensee's engineering capability and their
performance of technical work at both the corporate general office
(GO) and at the San Onofre site.
-
To assess whether-all design requirements are maintained and system
operability is assured through appropriate operations, maintenance,
and testing activities.
3. Basis and Scope of Inspection
In defining the scope of this inspection, the NRC considered generic
probabilstic risA assessment data to identify systems of high safety
significance, which interfaced with multiple components of several safety
systems. Recent NRC findings relating to engineering and quality
assurance problems (e.g., root cause assessment) were also considered, in
addition to equipment failure data from the Nuclear Plant Reliability
Data System (NPRDS). This review process resulted in the selection of
the component cooling water (CCW) system and the salt water cooling (SWC)
system, as the focus of this inspection. Interfacing electrical,
mechanical, and instrumentation / control components and systems were also
reviewed in a less focused manner. ,
1
4. Inspection Approach
A Safety System Functional Inspection (SSFI) was performed on the
selected safety systems. An SSFI type inspection is a design based
inspection process. One of the chief advantages of this type of
,
l
inspection is that it concentrates a comprehensive, multi-discipline I
review into a relatively narrowly defined area. The intent of the j
l
l
l
l
A
s.
, 3
inspection is to define an inspection area that is not only important to-
plant safety or accident mitigation, but to select an area involving a
broad cross-section of activities by the various disciplines in the
licensee organization. This type of approach allows the inspectors to
develop a fairly accurate perspective of how well the liesnsee
organization integrates the various aspects of plant design,-engineering,
operation, maintenance, etc. Recent experience with_this type of
inspection has shown it to be effective at pointing out deficiencies both
in the area of licensee understanding of the design basis f r' '.he plant
and in the area of control of the design process.
An Engineering Sub-Team was organized, consisting of an-Assistant Team
Leader, several NRC inspectors, and Design Consultants experienced in
functional analysis of design changes. The Consultants were contractec"
to select appropriate design changes, and then to provide an indeperdent
engineering analysis of their impact on safety function:;. This included
identification of aspects of the modifications which may be particularly
sensitive to proper implementation, so that those aspects could be
verified by the Site Sub-Team. Such aspects included specifics of
modification quality verification, as-built verification, post
modification testing, and changes in methods and procedures for
operations,. maintenance, and surveillance testing.
The Site Sub-leam was organized with the Team Leader and several
experienced NRC inspectors, who were assigned to examine on-site
implementation of selected design changes and to review, in detail, the
site activities related to the selected systems.
5. Component Cooling Watar System Reevaluation
i
During the team's review of the component cooling water (CCW) system, it
became apparent that the system has created a number of problems for the
licensee over the plant life, basically due to several poor or incorrect i
design decisions made during the construction of Units 2 and 3. TFe CCW l
system was originally designed to be a "zero leakage" system. Because of
the zero leakage design basis, the makeup system to CCW, which is the
nuclear service water system, was not designed to be seismically
qualified or safety related, and is not considered to be available for
most accident analysis scenarios. During the plant licensing process, in
the Question and Response section of the FSAR, the NRC questioned whether
the makeup water source shouldn't be seismically qualified; or requested ,
that a temporary makeup connection be provided and be capab?e of being
activated within 7 days, in conjunction with an analysis that
demonstrates that the CCW system can operate without makeup for 7 days.
The licensee's response in the FSAR was that the calculated system
leakage rate was only 0.008 gpm, based on pump seal and valve seat and
stem leakage, and that the system could therefore operate 122 days
without a makeup supply. The licensee further stated in the FSAR that no
special provisions for additional makeup were required.
The team observed that the licensee's statements in the FSAR apparently
did not consider the response of the system under certain accident
conditions, such as a Safe Shutdown Earthquake (SSE) or a Main Steam Line
Break (MSLB) in the vicinity of a CCW line. During these events, the
-
..
.
4
failure of a CCW line, due to the event itself, would cause an initial
system leakage far in excess of 0.008 gpm. When considered under
acciden, conditions, the need for a seismic, class IE makeup capability
, is much more apparent. With Units 2 and 3 licensed and operating in
i 1983, the licensee began to experience problems with the CCW heat
exchangers. Introduction of marine debris and marine life into the Salt
Water Cooling (SWC) side of the CCW heat exchanger (HX) apparently began
to cause HX tube leakage and tube fouling. The licensee recognized at
this time that the actual CCW system leakage through the HX tubes was at
odds with their statement in the FSAR concerning calculated system
leakage. The licensee then calculated that the system could leak at a
rate of 0.142 gpm and-still operate for 7 days without makeup, however,
in a licensee letter to the Bechtel Corporation dated July 18, 1983, the
licensee noted that the 0.142 gpm was often exceeded. This same letter
authorized Bechtel to design an emergency fire hose connection for the
CCW :, urge tanks to allow for the establishment of a temporary makeup
system using the site fire trucks.
The modifications which installed the fire hose connections to the surge
S.anks took about a year to complete. Apparently, neither the operability
of the system nor the reportability of the situation were considered in
the interim, and the units continued to operate. Again, the system
response during accident scenarios was apparently not considered.
In. late 1987, the licensee began to consider moving spent fuel from Unit
1 to Unit 2/3. To accomplish this, the fire truck located in the Unit
2/3 Fuel Handling Building would need to be relocated. The fire truck
location is important because when not in use, the truck must be
seismically secured. While reviewing the function of the fire truck, the
licensee's corporate office engineers were reportedly surprised to learn
that the fire truck was required to provide a backup makeup water source
for the CCW system, a fact that appears to have been well recognized at
the site. In December 1987, the corporate engineers apparently
recognized that the effect of CCW system leakage on the system
performance during accident conditions could be of significance, and
therefore embarked on a task to review this issue. The review basically
considered the system operation under the following accident conditions:
A Critical Crack Occurrence; a Safe Shutdown Earthquake (SSE); a Loss of
Coolant Accident (LOCA); and a Main Steam Line Break (MSLB). The results
of the licensee's reevaluation were documented in a memorandum dated
March 30, 1988. The reevaluation reached the following conclusions:
Minor system leakage is not a factor for the Critical Crack
Occurrence or a LOCA because one train of the system always remains
operable and makeup to the system is not immediately required.
For a HELB event, the reevaluation calculated a 4550 gpm leak rate
from a CCW non-critical loop (NCL) pipe which was postulated to be
impacted by the HELB. For this event, the CCW surge tank would
isolate on low level if the NCL isolation valves do not close in 15
seconds or less. The technical specifications allow the NCL
isolation valvas to close as slow as 20.9 seconds. If the surge
tank isolates, the associated train of CCW is then in a solid water
condition, a condition in which it is not designed to operate nor
_
..
. 5
had the system's operation in a' solid water condition been analyzed.
Assuming the NCL isolation valves go closed fast enough to keep the
surge tank from isolating, the CCW system external leakage and cross
train leakage become critical, in that a relatively small amount of
leakage-(1-2 gpm) could then cause the surge tank to isolate prior
to the operators taking action to hookup the temporary fire hose ,
connection, which-the analysis assumed would occur after 60 minutes.
It should be noted that the CCW train which is not affected by the
HELB is assumed to be the single failure (failure of its associated
emergency diesel generator) and the remaining train must remain in
continuous service to mitigate the consequences of the HELB.
For the SSE, the reevaluation concluded that due to a postulated
failure of a pipe in the NCL, the critical loop servioing the non-
critical loop will lose water inventory until the surge tank low-low
level is reached and both the NCL isolation valves and the surge
tank isolation valve automatically go closed due to the low-low '
level condition. The critical loop is then assumed to be
non-functional. Considering the occurrence of a single failure in
the opposite train, the result is that neither train of CCW is then
available. The reevaluation went on to determine that the reactor
coolant system could be maintained stable for up to four hours until
the temporary hose connections could be established to refill the
surge tank from the fire truck and return one train of CCW to-
service. The event scenario is complicated by the assumption that a
fire occurs on site following the SSE, and therefore the fire truck
is unavailable until the fire is put out and the fire truck water
tank is replenished.
The corporate office reevaluation was transmitted to the site and
addressed at the site via NCR G-852, dated April 28, 1988. The NCR
interim disposition accepted the system as operable, however a number of
interim actions were required by the NCR. These actions included
prestaging of fire hoses to ensure the capability to establish makeup to
the surge tanks within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />; operator training on the results of the
reevaluation; delineation of actions that must be accomplished following
an SSE with indication of a NCL failure to ensure that room cooling is
adequate; direction to quantify system leakage; and revision of the
inservice testing (IST) program allowable stroke time for the NCL
isolation valves from 19.7 seconds to 14.5 seconds. 'The NCR final
disposition was to provide a permanent, seismic category I makeup
capability for the CCW system.
Following the issuance of the March 30, 1988 reevaluation results, the
licensee continued to refine the reevaluation. The Bechtel Corporation,
who had originally designed the system, had been contracted by the
licensee to perform calculational work to support the reevaluation and
Bechtel continued to reperform calculations related to the CCW system
during the inspection.
On April 29, 1988, the licensee submitted Licensee-Event Report (LER)88-008 for Unit 2. This LER only iaentified that, due to the very low
allowable leakage rates stated in the FSAR Question and Responses
section, Units 2 and 3 may have operated outside the design basis of the !
I
1
l
J
,4 .
o. 6
CCW system prior to the implementation of the design change to allow a
temporary hose connection to the surge tanks. This LER did not report
any other of the conclusions of the reevaluation of the CCW; system. The
licensee did rote in the LER, that the LER was approximately five years
late. The stated cause for the LER being late was that an NCR was
erroneously not written on the issue at the time (1983), and that the NCR
is the mechanism which initiates a reportatility determination.
Members of both the site and engineering inspection-sub-teams reviewed
the reevaluation in detail, interviewed numerous personnel involved in
the reevaluation, and conducted several group meetings with licensee
personnel to discuss the licensee's efforts.
Personnel involved in the preparation of LER 88-008 and personnel who may
have had knowledge of the system problems in 1983 were also interviewed.
The team had the following-observations and findings based on this
review:
Although during the plant initial licensing process, the licensee
-had stated in the FSAR that the system needed no provisions for a
seismic makeup system due to the very low system design leakage rate
(.008 gpm), the licensee had no provisions in place to ensure that
+he leakage rate remained below that stated. No system leakage
tests were conducted during the commercial life'of the facility
until March, 1988.
The original calculation which determined the expected leakage rate
to be 0.008 gpm simply added the vendor listed leakage values for
pump seals, and valve stems and seats. The calculation did not take
into account system component degradation, such as heat exchanger
tube erosion and leakage, excessive pump seal leakoff, valve seat or
disk erosion, and excessive valve stem leakage. These conditions
can normally be called routine and dealt with simply for systems
such as CCW, however in light of the restrictive system leakage
assumed, these types of minor problems can be very significant and
should have been considered.
When CCW system leakage apparently became excessive in 1983, and was
recognized as such, the licensee took action to modify the system to I
address the leakage, however system operability and reportability
were apparently not considered. Team interviews with personnel
involved with the issue at the time indicate that they simply were
unaware of the importance of leakage. By not thoroughly reviewing i
the issue at that time (1983), the licensee missed an-important l
opportunity to resolve the issue early in plant life.
When the corporate engineers began their reevaluation, the various
accident scenarios that were considered during initial plant
licensing were unclear or unavailable to the point that the analysis I
was basically completely redone. This is illustrative of the
licensee's lack of ready access to basic design information. )
1
A CCW system single active failure was erroneously not assumed for l
an SSE event, by the facility's architect engineer. The licensee !
l
,
f
.-
_ _ _ _ _ _ _
o.
s
7
apparently was unaware of this fact. In performing the
reevaluation, the licensee did assume a single failure and only
later determined from the architect engineer what assumptions were
originally made.
During the inspection, the licensee's position on whether a single
active CCW failure is required to be considered for an SSE was
confused. By the close of the inspection, the licensee indicated
their agreement that a single failure was required to be considered.
With regard to the CCW response under a HELB event inside
containment, an analysis to consider this event was apparently not
performed during original licensing. The complete analysis was
first performed in early 1988.
A 8echtel calculation which was performed to support the
reevaluation, concluded that with a CCW train in a solid water
condition, a total leakage of 5 gallons would render the system
inoperable. Although the licensee's engineers repeatedly expressed
doubt concerning this conclusion, and the conclusion had a
significant effect on the overall analysis, the calculation had not
been revised as late as four months after it was performed. The
licensee's engineers were apparently very hesitant to revise the
calculation themselves and chose rather to convince Bechtel that the
result was overly conservative.
The team specifically discussed with the licensee, in detail, what
reportability and operability considerations were made during the
reevaluation. While it is difficult to reconstruct past considerations
made by the licensee, it was clear based on a letter from Bechtel to the
licensee that as early as January the need to document a Justification of
Continued Operation was being considered, and yet the issue was not
formally addressed until the NCR was finally written in late April. It
appears that operability and reportability determination responsibility
lies solely at the site and that the site programmatically need not
consider engineering issues until the final corporate office evaluation
is forwarded to the site. The licensee's staff stated several times that
corporate office engineers do consider these issues, however when
challenged by the team as to whether the corporate office ever considered
the plant to potentially be in an unanalyzed condition while performing
the reevaluation, due to the MSLB event and the SSE event apparently not
having been previously correctly analyzed, a 1Jeensee manager responded
that the corporate office only provides the evaluations they arc directed
to provide and that basically, reportability is not their line of work.
The team found this to be a very narrow and potentially hazardous point
of view. The team concluded that the corporate office responsibilities
in this regard should be made clear and that the responsibility should
not rest solely at the site. The team also concluded that the licensee
should document their operability considerations while analytical work is
in progress under conditions such as this, so that it is clear that the
continued operation of the plant is based on sound thought and logic.
With regard to specific reportable events, the team concluded that the
licensee failed to make a required report for the following conditions:
l.
__ _ _ _ _ _
44
_, 8
HELB event not having been properly analyzed - 50.73(a)(2)(ii) - Any
condition that resulted in the nuclear power plant being in an
unanalyzed condition that significantly compromised plant safety.
The combination of CCW leakage and an erroneousiv high allowable NCL
valve closure time, which could have prevented the CCW system from
functioning during a HELB event, according to the licensee's
reevaluation. - 50.73(a)(2)(v) - Any condition that alone could
have prevented the safety function of a syctem needed to mitigate
'the consequences of an accident.
The late reporting of LER 88-008.
Failure to'make these reports to the NRC within the time allowed is-an
apparent violation (50-361/88-10-01).
With regard to the licensee's failure to ensure that a single active
failure was assumed with an SSE, the licensee maintained that in spite of
this error, their reevaluation found that the CCW system would fulfill
its safety function during an SSE when a single active failure is
considered. The team questioned whether the licensee's procedures and
training had been adequate in the'past to address an SSE with a single
failure. The licensee maintained that the changes required to procedures
by NCR G-852 were enhancements, and that their past procedures were
adequate. The significance of not having considered a single active
failure is an unresolved item (50-361/88-10-02) pending further NRC
review of the licensee's past capability to sustain an SSE with a single
active failure and a more detailed review of the licensee's original
licensing submittals regarding this issue.
6. Engineering and Design Activities
A. General Description l
The design portion of the inspection focused on a ravlew of design 4
change packages and original design basis documentation related to
'
4
the selected safety systems (component cooling water, saltwater
cooling and 1E electric systems that interface with CCW and SWC).
l
Based on the results of the design inspection, the team determined '
the saltwater cooling system was operable. With regard to the CCW I
system, the team found the system to be operable to the degree the !
system was reviewed, however due to the large number of significant l
issues which have recently surfaced regarding the CCW system, and
which have apparently been dealt with by the licensee, the team
concluded that a complete review of the system operation and design,
on a priority basis, would be prudent. As a result, SCE management
at the inspection exit meeting committed to expeditiously assess the
CCW system in a thorough manner.
Based on the engineering and design review, the team concluded SCE
engineering does not fully understand the systems' basic design. It
appears SCE engineering and construction (corporate) engineers do
not, in mcst cases, have detailed knowledge of original design or
._
o.
, 9-
design calculations. Design changes appear to be a lower quality
product due to a lack of understanding the basic design. The FSAR
has not in all-cases been maintained current. The team identified ~
instances where technical work.was not performed in a complete,
technically correct manner. zIn many cases, design calculations had
not been maintained current nor had design assumptions been
verified. To SCE's credit, the design review that was conducted'in
preparation for this safety system functional inspection identified
the same types of concerns-as did the NRC SSFI team inspection. The
team-concluded it is essential for SCE-to review the basic design to
assure a complete and accurate design basis is available for use in
future plant design modifications.
Specific examples of these observations are oescribed-in Section B
below.
B. Design Activities
The team reviewed design documentation related to the CCW and SWC
systems, including design change packages-(DCP's) and their
associated proposed facility change packages (PFC's), system
descriptions, P& ids, and design analyses (calculations), to assess
the capability of these systems to perform their safety functions.
Additionally, the team reviewed the CCW and SWC design reports and
state of the system reports which were recently developed to prepare
for the NRC SSFI. For the electrical ancillary' support systems, the
team reviewed design analyses associated with the Class 1E 4160 VAC,
480 VAC and 125 VDC systems, which included AC and DC voltage
calculations and protective device settings and coordination. The
review focused on the adequacy of the methodology, the accuracy of
the design data, and the validity of the design assumptions utilized
in the calculations.
The team identified a number of observations which indicated
weaknesses in several areas of engineering activities. These
weaknesses included inadequate design analyses and inadequacies in
the verification of design analyses. The team noted a general lack
of awareness by SCE engineers of the specific design assumptions
utilized in calculations.
(1) Inadequate Calculations
a. Adequacy of AC Voltage While Power Is Supplied by
Station Emergency Diesel Generators
The Class IE AC auxiliary power systems for each of Units
2 and 3 consist of two redundant 4.16 KV and 480V systems.
The redundant systems of each unit are completely separate
and independent. The normal or preferred power source for
these systems of each unit is the unit's reserve auxiliary
transformer. The reserve auxiliary transformers are fed
from the Southern California Edison 230 KV System. An
alternate power source for each unit's Class 1E auxiliary
power system can be obtained from the other unit's 4.16 KV
. - _
,_ ,. - - - .
..
, 10
Class 1E system or from its own unit auxiliary
transformer. Connection to the latter requires removing
the isolated phase bus disconnect links to the unit's main
generator so that power can be obtained from the 230 KV
system by back feeding through the unit's main step-up.
transformer. The onsite standby power source for each
unit is from two redundant diesel generator sets. The
diesel generator sets are not shared between the two
units.
The team reviewed the available calculations which were
intended to determine the anticipated starting and steady ,
state running voltages for the various 4.16 KV and 480 V
Class 1E motors. These calculations are E4C-011, Rev 2 -
"Medium Voltage Regulation" and E4C-012, Rev 5 "Low
Voltage Regulation". The methodology used in the
calculations was standard industry practice at the tim'e
Units 2 and 3 were designed and is considered acceptable
by the team.
The 4.16 KV system calculation assumed a condition with
power supplied from the preferred source (230 KV system)
-and with that source assumed to have infinite capacity.
The 480 V system calculation assumed that the 4.16 KV
system, its power source, had a 350 MVA fault capability,
which is equal to the 4.16 KV switchgear's fault duty
rating. Using these assumptions, the calculations yielded
results indicating that motor terminal voltages would be
above 75% of nominal during starting and above 90% of ,
nominal during steady state running conditions. These
values are consistent with the specified characteristics
of the Class 1E motors. However these calculations did
not consider the worst case conditions of limited power
supply, i.e., a degraded 230 KV system or the system
aligned to the standby power supply (EDG). Acceptable
performance of Class 1E motors based on adequate starting
and running voltages under the worst case conditions of
power supply and loading has not been demonstrated by the
design calculations.
SCE stated that they have obtained a computer program
(ASDOP) which will be used to analyze the 4.16KV and 480
VAC Class IE auxiliary electrical power systems. The
program will address auxiliary electrical system loading,
voltage regulation and fault levels.
This issue is considered unresolved pending implementation
of the ASDOP computer program and the obtained results.
This is identified as unresolved item 50-361/88-10-03.
!
!
l
._
. ..
- '11. )
b. Adequacy of DC Voltage Supplied to Class IE DC Motor
Operated Valves
As a result of INP0 SER 80-83, which reported a _ _
potentially generic deficiency where voltage drops could
be unacceptable when class 1E batteries are near
"end-of-life", the, licensee performed calculation DC 2642,
Revision 0. Calculation DC-2642 was performed to verify
the operability of the Class 1E 125 VDC loads when
supplied from the batteries operating at "end-of-life"
conditions during the 90 minute period following a design
basis event. The results determined that less than the
minimum specified starting voltage would be available for
several Class 1E OC motor operated valves under these
conditions. The evaluation criteria of the calculation
states that the minimum starting voltage shall be 75% of
nominal (125 VDC is the nameplate rating), as specified by
the manufacturer. The motor operated valves of concern-
are in the auxiliary feedwater system of both Unit 2 and
3. The valves are control valve 3HV-4705, isolation
valves 2HV-4715, 3HV-4715, 2HV-4730, 3HV-4730, and turbine
stop valves 2HV-4716 and 3HV-4716. Voltage supplied to
valve 2HV-4705 was demonstrated to be acceptable. The
calculation demonstrated that the worst case condition
involved motor operated valve 3HV-4730 with 109.59 volts
at its starter terminals resulting in 43.91 volts across
its motor armature. The licensee included in their
calculation, test results performed on the worst case
motor operated valve, 3HV-4730, which demonstrated that
with no flow through and/or differential pressure'across
the valve, the valve will open and close with 93.45 volts
applied to its starter. Based on the calculation method
used, the licensee stated that the motor armature voltage
in this test case would have been approximately 36 volts.
MOVATS reports for this valve are referenced in
calculation DC-2642, which show that flow and differential
pressure have little impact on notor starting current
magnitude. The calculation goes on to conclude that,
"Since 3HV-4730 is the worst case, by logic all the other
(motor operated) valves should start successfully". The l
team does not agree with this reasoning since the motor j
operated valve assemblies of concern are basically of l
three different categories or types, having different I
valve-sizes, operator sizes and motor sizes. The
extrapolation of the~results of a test on one valve of
only one type would not necessarily be valid for the other
types.
This issue is considered open pending performance of a
detailed safety evaluation that analyzes all variables of l
the different valve applications which do not see adequate
armature voltage. This is identified as unresolved item
50-361/88-10-04.
l
l
I
I
..
o 12.
l
i
c. CCW Surge Tank Relief Valve Sizing
Calculation M26.3, Revision 0, "CCW Surge Tank Pressure',"~ l
does not include a postulated "failed open" nitrogen ;
supply valve in its analysis to assure that Surge _ Tank l
relief valves 2PSV-6356 and 2PSV-6359 capacities are l
adequate. The calculation states the capacity of the l
relief valve as 201 scfm'at 10% accumulation, while SCE i
identified the flow through the postulated "failed open"' l
nitrogen supply valve at a significantly higher. flow rate !
(approximately 603 scfm). I
I
The team review of the ASME Section III, Code NV-1, Code j
Data Report for these relief valves identified the '
capacity as 226 scfm at 39 psig setpoint pressure.
DCP 970.0-J re-rated the relief valves at a 45.5 psig !
setpoint and a capacity (by Manufacturer's Test :
Certification) of 226 scfm at 60 F, with 10% accumulation. '
The re-rating was performed under the SCE ASME Section XI l
Program and was properly documented on an ASME NIS-2 form. l
However, no revision had been made to the calculation to )
assure that the relief valve can accommodate the higher !
flow (i.e. "failed-open" nitrogen supply valve) without !
exceeding the Surge Tank Design Pressure of 150 psig. In i
addition, the Safety Evaluation for DCP 970.0-J did not !
include an evaluation of such a postulated failure. !
1
This issue is considered open pending an analysis that
verifies re-rating of the relief valves could not over
pressurize the CCW surge tank. This is identified as open I
item 50-361/88 10-05.
d. Single Intake Structure Supply of Three Saltwater !
Cooling Pumps
During cold shutdown of one unit, one SWC system train iJ
required for shutdown operation, while two SWC trains are
normally in operation for the other unit, if the other l
unit is in power operation. When these modes of operation l
occur and one unit intake is dewatered, three pumps,
minimum, are required for the two units, with the SWC
pumps supplied only from the operating unit's intake
structure. The water supply required for three pumps at
17,000 gpm each is 51,000 gpm total.
FSAR Sections 9.2.1.2 and 9.2.5.2 identify a Design Basis
intake flow of 34,000 gpm available for all modes of
operation for each unit, including provisions to ensure
this flow during a seismic event. No provision is made in
the FSAR, nor has any analysis been performed to assure
three pump operation (51,000 gpm) during or following a
seismic event, when one unit is dewatered and all
saltwater cooling is from one intake structure. For this
_ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .
4 g
. 13
condition, FSAR 9.2.1.1F presently identified that "4% of
normal circulating water flow is available" (i.e. 34,000
gpm).
Calculation M27.2 provides an analysis for the SWC pumps
with a postulated seismic _ event causing collapse of the
offshore intake and discharge conduits. This calculation
identifies that 4% of normal circulating flow or 34,000
gpm will still be available (the calculation assumption
was not revised When seismically. designed intakes and
emergency discharge were later provided).
The calculation determined a minimum submergence of 2.5
feet for the Saltwater Cooling pumps, with a drawdown of
the intake such that the Circulating Water Pumps would
lose all suction and, therefore, no longer cause further
drawdown. However,'the calculation does not analyze the
three pump drawdown (51,000 gpm vs. 34,000 gpm), which
would result in reduced submergence. Such reduction could
cause all three pumps to become inoperable. In additinn,
if the normal ooeration of four pumps (two per Unit) is to
be continued in this mode, the calculation and Design
Basis must accommodate this quantity of flow.
This issue will remain unresolved pending an analysis that
verifies the Seismic Category I intake can supply.the
three pumps at a flow of 51,000 gpm. A cursory review by
the team indicates that a three pump supply should be
capable of being maintained. This is identified as
unresolved item 50-361/88-10-06.
e. Incomplete' Analysis for Design Change Package 970.0-J
DCP 970.0-J enabled manual opening of the redundant CCW
critical loop / non-critical loop isolation valves, by i
electrically bypassing an interlock such that.during this l
transition time, both critical loops are cross connected. !
The DCP was implemented to allow the transfer of the ,
non-critical loop from one critical loop to the other !
without interrupting CCW flow to the reactor coolant l
pumps.
Neither DCP 970.0-J, nor the safety evaluation in Proposed
Facility Change (PFC) 2/3-83-242 addressed a Critical l
Crack Occurrence in the Loop A/ Loop B supply crossties or
return crossties, whan both supply and/or both return
valves were opened during transfer of non-critical loop
operation (valves 2HV-6212 -6213, -6218, and -6219 are
open at the same time). Prior to the DCP, the interlock
prevented connection of the two critical loops by
preventing opening of one set of supply / return valves
while the other set was open.
_ _ - - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.,
.. 14
The referenced PFC Safety Evaluation ~,Section III.B.
states: "All analysis of failure modes, as described in
FSAR Table 9.2-3 remain as stated and unchanged by this
modification". However, Table 9.2-3 does not include a
piping Critical Crack Occurrence when critical loops are )
cross-connected, nor does the safety evaluation refer to I
the proper FSAR section, Section 3.6 for the Critical l
Crack analysis. !
Therefore, no assurance was provided that a postulated
critical crack in the crosstie between critical loops has
been enveloped by the CCW Critical Crack analysis
previously performed or by design bases included in FSAR
Section 3.6, as such a failtre is common mode and does r.ot I
allow exclusion by redundant trains (loops).
I
SCE stated that they had consi1T-ed the consequences of a ;
critical crack during the shifting of the CC4 NCL between
l critical loops; however, it was not documented. SCE i
- committed to provide an analysis for the postulated
'
Critical Crack when transferring the CCW non-critical loop
between critical loops. This issue will remain open
pending an analysis that verifies system operability will
l be retained throughout the transfer of the non-critical
l loop between the critical loops. The team recognizes the
j the probability of occurrence of the above. event is very
small. This is identified as open item 50-361/88-10-07.
l f. Inadequate CCW/SWC System Preoperational Heat
! Rejection Test Due to Inadequate Instrumentation and
- Engineering Methodology
l
l Calculation M201 was performed in part to verify CCW
l system heat rejection design. The team identified the
l following concerns that appear to invalidate the CCW
system heat rejection test that was performed as part of
the original testing program following completion of
construction activities:
l . The basis for defining cumulative error (accuracy) of
l each test instrument was not identified. Therefore,
i instruments of insufficient accuracy were used during
l the test.
. The basis for determining total error contributed by
all 17struments was not defined. Consequently, the
l
test m,.y have b en invalid without it being
recognized.
1
. A test exception was incorrectly dispositioned which
j contributed to not recognizing that the test was
invalid.
__
..
. 15
While it is clear to the team that the results of this
test were insufficient to verify the heat rejection design
of the CCW/SWC system, the team believes the conservatism
of the design of the SWC system prevents this issue from
being an immediate operational concern. At the exit
interview SCE committed to examine the operability of the
CCW system.
The following is a detailed technical discussion of the
teams concerns with the CCW/SWC Preoperational Heat
Rejection Test.
The basis for the instrument accuracies used in the
calculation was not evident, and appeared to be limited to
the manufacturer's typical specifications for the
individual instruments. Consideration of process effects
(such as temperature stratification and flow approach
conditions) and other sources of uncertainty were not
evident in the calculation. A history of inaccurate
measurements also existed during and after the tests.
Some specific examples of considerations that did not seem
to have been addressed were as follows:
The scale precision for the 50 - 300*F range CCW
bimetallic thermometers would be expected to be +/-
2 F; the 25 - 125 F SWC bimetallic thermometers would
likely have a +/- 1*F precision. Errors due to scale
reading should therefore have been included.
For the venturi flowmeters used in measuring shell
side flow, it was not evident that the +/- 1% overall
error cited in the calculation included
considerations such as flow element errors
(considering flow approach conditions); differential
pressure transmitter errors; square root extractor
errors; and indicator errors.
For the ultrasonic flowmeters used in measuring tube
side flow, it was not evident that the cited +/- 1%
overall error included considerations such as
uncertainties in velocity profile correction factors
(characteristic of the. instrument with its installed
flow approach conditions); errors due to acoustic
short circuit and signal / noise ratio; and errors due
to changes in fluid composition or mechanical changes
that might affect the length of the beam path. It
was also determined that the original flowmeters were
portable clamp-on types, and that permanently
installed flowmeters were later installed, but
subsequently replaced due to insufficient accuracy.
The team noted that the calculation was based on a sample
calculation presented in Appendix 10G of SCE Procedure
2HA-299-02, CCW System Heat Rejection Test, Rev 0, and
. _ __
.. .
. 16
uses the same initial values. To evaluate the irpact on
overall. measurement of the acceptance value (CCW outlet
temperature), successive independent calculations were
made using values for tube side flow, CCW inlet
temperature, CCW outlet' temperature, SWC inlet
temperature, and SWC outlet temperature. For each
calculation, one of these values was decreased by its
assumed instrument error (the other values remain the
same) and an overall result is compared to the result in
the example, and an isolated error contributed by the
degraded value is determined. After this is done for all
of the values, a square-root-of-the sum-of-the-square
(SRSS) method is used to determine the overall error to b'e
assumed for CCW outlet temperature in establishing the-
acceptance criterion (i.e._, the requirement that
measured / extrapolated CCW outlet temperature cannot be
greater than 102*F).
The concern is that this method of determining overall
error does not adequately bound the result of combining
all instrument errors. Compliance to the acceptance
criterion is sensitive to uncertainties in measured values
of the four terminal temperatures of the heat exchanger;
this is because the computation involves terminal
temperature differentials and logarithmic computation of
the log mean temperature difference (tJ1TD) before
determining the extrapolated value (based on worst case
design conditions) for judging acceptable CCW outlet
temperature. Therefore, there is a potential for adding
instrument errors as well as increasing the error effects
logarithmically.
Essentially, small variations in the large or small
terminal temperature differences have a much larger effect
on LMTD, due to the logarithmic relationship of the
values. This is particularly true for the terminal
differential values in the region measured (for example,
"large" terminal differential values around 10*F). The
team's primary co,1cern is that the simplified method cited
above did not properly account for this interactive
sensitivity to temperature measurement errors.
Other problems were noted with the referenced calculation.
The method used in calculating large and small terminal
temperature differences was not correct (incorrect
terminal temperatures were subtracted). In addition, the
team noted that the errors determined for service water l
inlet temperature and CCW inlet temperature were
determined to be 0 F, which appears unrealistic, l
l
particularly since the' acceptance test evaluation (Rev 2) I
attributed significant sources of error to the
installation configuration of the saltwater temperature
measurements; these errors were reported to occur due to
inadequate immersion length of the temg,ature element in
(
l
l .
..
, 17
the saltwater cooling system flow stream, and a DCP was
developed to correct the problem.
Also, if values different from those in the Appendix 10G
sample were used, different overall tolerances could
result. This reinforces the concern that the method does
not adequately bound all reasonable error contributions.
The team has an overall impression that the critical
nature of these temperature measurements was overlooked in
the design and application of the instruments; for
example, it appears that standard range and accuracy
bimetallic thermometers were provided, and the resulting
data was accepted unless obvious anomalies were reported
during the test.
!
For the reasons cited above, it appears to the team that
SCE's acceptance of the CCW heat rejection test results
relied too heavily on measurements that were j
insufficiently accurate to demonstrate heat rejection with 1
adequate margin. We also found the select substitution of
calculated values for measured values to be unsupportable,
based on the information reviewed.
This item will remain open pending licensee action that
confirms the SWC/CCW heat exchanger design capacity. This
is identified as a followup inspection item
(50-361/88-10-08). l
(g) The licensee has developed a graph of SWC flow versus
water temperaturo, to determine SWC system operability. j
The team questioned whether instrument errors were !
considered when the graph was calculated. The licensee
determined that instrument error was not considered. This
remains an unresolved item (50-361/88-10-09) until the
licensee revises the curves and assesses past operations. ;
Due to the large amount of conservatism in the actual SWC '
flow versus that flow required, it appears that this is l
not a direct safety problem. l
(2) Outdated Calculations or Calculations with Unverified
Assumptions
a. Emergency Diesel Generator Acceleration and Loading
l
The standby power source for Unit 2 and Unit 3 consists of
, two redundant tandem diesel engine driven generator sets.
'
Each set is rated at 4700 KW, 0.8 pf, 60 hertz for
l continuous operation. The team reviewed calculation
E4C-014, Rev 6 "Generator Sizing, Diesel Generator",
E4C-016, Rev 5 "ESF Sequencing" and E4C-026, Rev 1 -
"Motor Acceleration," which address the diesel generator
unit sizing and loading sequence. The calculations are
based on unverified assumptions. Calculation E4C-026 had
l
1
I
.,
, 18
been performed to aid in the selection of the diesel
generators and the results were to be used to evaluate
compliance with USNRC Regulatory Guide 1.9 which had been
committed to in the FSAR. Also the calculation results
were intended to evaluate whether the engines would be
sized based on the continuous load rating or for transient
load acceptance and load acceleration. The conclusion to
the calculation states, "When all motor data has been
received from the vendors, an evaluation must be made by
the selected D.G. vendor for frequency and voltage
response to satisfy Regulatory Guide 1.9".
Calculation E4C-026 has not been updated based on data
received from vendors for the various ESF drive motors nor
have later calculations performed by the licensee, his
design agent, or diesel generator supplier been identified
and made available for review. However, the supplier's
(Stewart & Stevenson Services, Inc.) Factory Test Report,
Rev E, was made available for review. The acceptance
criterion given in the test report shows that the
purchased units have voltage and frequency transient
characteristics that do not exceed the limits imposed by
USNRC Regulatory Guide 1.9 when subjected to the loading
sequence specified in the test procedure. The first load
block in that test sequence is 1900 KW applied at 20
seconds after the engine start signal is initiated,
followed by an additional 1910 KW at 30 seconds and
finally, at 40 seconds after the initiation of the start ;
signal, a load equivalent to an 800 HP motor is to be '
applied. The team f.els that the test sequence does not ,
represent the loading sequence in FSAR Table 8.3-1. The '
test sequence loading has not been shown to be i
conservative when considering the required loading and I
thus compliance with Regulatory Guide 1.9 has not been
demonstrated.
This is a potential deviation of the FSAR commitment to l
Regulatory Guide 1.9 and is identified as unresolved item l
50-361/88-10-10. ;
b. Incorrect 4160/480 VAC Transformer Tap Setting
i
When performing the voltage regulation calculations, one
of the design outputs developed is the optimum primary
winding connections to be used with each 480 V load center l
transformer. Calculation E4C-012 assumed incorrectly that
winding taps on these transformers are on the secondary
side rather than on the primary windings. Thus, the wrong
connections using the "plus" 2 1/2% taps rather than the
"minus" 2 1/2% taps were recommended for the Class IE load
'
center transformers. The team was informed by the
licensee that the error had been recognized during
construction and that the "minus" 2 1/2% taps had been
used, as verified by revision 2 of calculation E4C-011,
i
_ _
..
. 19 .
dated 3/26/84. The intended purpose of the revision-
included the verification of transformer tap connections.
The "minus" 2 1/2% tap connections were also indicated in
start-up test procedure 2PE-401-01, Rev 0 "Transformer
.
Voltage Tap Verification". The team noted that it is
recorded in "Start-up Test Exception Report", TER
- 2E-401-01/5, dated 10/16/81, (issued' prior to the date of
E4C-011, Rev 2) that the connections to the Class 1E load
center transformers were found to be connected to the 0%
taps. An evaluation of the "0%" tap connections had been
requested by the "field" in the test exception report.
Disposition by the design ~ agent of the request has been
indicated on_the.TER, reviewed by the team, to be "accept
as is". The team views this anomaly as an isolated case
of failure of the design verification effort by the
licensee and/or his design agent and a possible l
communication failure within the design agent's i
organization.
i The team has a concern that a. setting of 0%, with minimum l
l bus loading, that the bus may exceed maximum voltages for j
the motors (max allowed 506 V) and the hattery charger. l
The test results for Buses B04 and 806 were 540V and 532V
i
respectively. This is an unresolved item
(50-361/88-10-11).
The Licensee committed to revise calculation E4C-012 to j
clarify the Class 1E load center tap transformer l
connection recommendation. However, as a consequence of j
not updating the calculation when the error was l
recognized, Revision 2 (3/26/84) of Calculation E4C-011 l
again indicated the taps were set a - 2 1/2% vice 0%. l
l Only through good fortune did this error not impact the i
I analysis. This, however, exemplifies the importance of I
l maintaining design calculations current. l
l
(3) Final Safety Analysis Report not Updated j
l a. Critical Crack Leakage Rate Not Updated in FSAR
l
Calculation M26.4 establishes the maximum Critical Crack
for a 28 inch diameter CCW pipe as 898 gpm, while the FSAR
Section 9.2.2.3H identifies this value as 42 gpm, with
makeup sized for 100 gpm and thus sufficient.
FSAR Q&R 10.29 indicated 42 gpm Critical Crack with 200
l gpm makeup. This was later amended in response to Q&R
l 10.48 to "approximately 700 gpm" for the 28 inch CCW main
!
! The SSFI Team observed that neither the response to Q&R
10.48, dated 2/79, nor the Calculation M26.4, Rev 2, dated
6/83 were included in the FSAR Update for this applicable
section, dated 2/86. The period of time between the Q&R
1
l
{
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ - _ _ - _ . _ _ _ _ _ _ _ _ _ _ _ - _ _ _ - _ - _ _ _ _ - _ _ _ _ .
..
. 20
or the calculation and the FSAR update, exceeds any normal
update period for proper identification of the critical
crack leakage.
The licensee's cognizant engineer had identified the same
FSAR deficiencies, in addition to many others, in the
"State of the System" report.
In addition, neither the FSAR, the response to the Q&R,
nor the calculation clearly identify whether the . critical
loop would remain operable. With the critical crack flow
of 898 gpm, alarmed at low level, no operator action for
30 minutes (Q&R 10.48), and no makeup water assumed
available (nonseismic source: FSAR 3.6.1.3D, FSAR I
3.68.2.B, and Q&R 10.49), the Surge Tank inventory will
drawdown to the low-low level and result in surge tank
isolation closure, water-sulid condition in the CCW System i
'
critical loop, and potential loss of one critical loop.
The team noted that for a critical crack occurrence, no !
other failures are required to be assumed, unless the l
crack itself causes additional failures. Therefore, one ,
critical loop of CCW would apparently remain operable. '
The team concluded that the FSAR Safety Evaluation is !
presently inaccurate and untimely in its update. In
addition, design basis calculations and other documents do ,
not presently include identification of' loss of a critical l
loop when a critical crack is postulated. No enforcement '
action is proposed because the licensee identified the I
same concerns prior to the inspection. The actions taken
by the licensee to restore accuracy to the FSAR is an open
item (50-361/88-10-12). ,
,
b. Routine Operation of both CCW Critical Loops
1
During the entire commercial operation of Units 2/3, the l
CCW system has been operated in a manner contrary to the '
FSAR. Paragraph 10 of this report discusses this issue in
detail.
(4) Design Change Package Adequacy I
a. htential Common Mode Failure of Both CCW Surge Tank
Isolation Valves during a Seismic Event
Because the control circuits for the surge tank isolation
valves are not safety class or seismically qualified, the
surge tank isolation valve should be postulated to fail
during a seismic event causing spurious simultaneous
closure of the valves for each surge tank. If this were
to happen during a seismically induced break in the
non-critical loop (NCL) piping, each surge tank would be
isolated from its respective loop and each independent
loop would be starved of makeup water. In addition, the
.. ,
c 21
automatic NCL isolation on low level could be disabled,.
since the surge tanks would be isolated early by the
seismically induced spurious actuation. Thus, the CCW.
system is vulnerable to a single failure during a seismic
event.
This is an apparent violation of 10CFR50 Appendix A.
General Design Criteria 2 and 44, which require that
systems and components important to safety be designed to
withstand earthquakes and that the cooling water safety
function not be precluded by a single failure
(50-361/88-10-13).
The licensee' documented this item on NCR 3-2034 dated June
15, 1988. As an interim action, the licensee has removed
the thermal overload devices from the control circuit.
b. Unreliable CCW Surae Tank Level Indication During High
Transient Level
The CCW Surge Tank is a closed pressurized tank using a
differential pressure transmitter to measure level
hydrostatically. For this type of application,' one
connection of the differential pressure (DP) cell is to
the bottom of the tank, and the other equalizing
connection is near the top of the tank via a reference
leg. The reference leg in the SONGS installation uses a
dry reference leg.
The team noted that the dry leg installation could result
in erroneous and potentially misleading indication to the
operators for events leading to large transient surges in
level that could flood and fill the equalizing reference
leg. Subsequent level decreases will als) resul t . in
confusing indication, since the reference leg will remain
full during the level decrease in the tank. This could
lead to incorrect operator actions and responses. Both
the analog indication and the hi/lo alarms could be
affected.
Because the licensee does not have controlled instrument
loop diagrams that present basic and functional
information about the instrument channels in a complete
and integrated fashion,.it was not possible for the
licensee or the team to' determine from design drawings
'-
whether or not the reference leg was wet or dry. When the
team-inquired about the type of reference leg, the
licensee was only able to provide an answer by consulting
the instrument calibration procedures at the site.
This issue is open pending licensee review of the issue.
This is identified as open item 50-361/88-10-14.
- i
I
- - - _ _ _ - . _ - - _ _ _ = _ _ _
. _ _ _ _
..
. 22
c. Adequacy of Design Change to Incorporate Jogging
Control for RCP Seal Cooling Water Return Isolation
Valve (DCP 793.01J)
Each reactor coolant pump (RCP) is cooled by CCW cooling
water. In the original design, a high temperature
interlock was provided such that the return line would
close on high temperature. Because of the risk of
inadvertent isolation of the seal cooling water and
consequential damage to the RCP seals, the licensee
decided to eliminate the automatic isolation feature,
retain the high tempere.ture alarm, and rely on operator
isolation of the seal cooling return lines in response to
the alarm. In addition, jogging control was added to
these valves with the intent of controlling CCW flow in
such a way as to reduce the potential for thermal shock.
Jogging control eliminated the original "seal-in" circuit
feature that had required the valve to continue operating
through its full stroke before stopping. With the new
design, the operator would have the ability to "Jog" the
valve to intermediate positions, and presumably obtain a
throttling capability.
The licensee was unable to retrieve documentation from
their files that the Limitorque valve actuators were
designed and rated for the jogging duty required for this
new service condition. The team was specifically
concerned that the different thermal duty cycle that may
now be imposed on the motor, and the mid-travel operation
of any "hammer blow" features provided with the actuator,
may not have been considered when the change was made; no
such considerations are evident in the DCP. During the
inspection, the licensee reques J and received a letter
from the actuator vendor stating that the MOVs covered by
the purchase order for these valves were acceptable for -
jogging duty provided that no more than 20 starts were l
made for the 15 minute duty rating. THe team requested
that the licensee confirm that operating procedures were
in place to assure that operators were aware of this l
restriction. The licensee retrieved Procedure l
$0123-0-23.1, which' includes a precaution that no more j
than 5 starts be made in one minute for any MOV, and that '
if 5 starts are made in a minute, a fifteen minute cooling j
period must be allowed before attempting another start. '
Further clarification by the vendor was requested by the
team. If the clarification is favorable, the team can l
conclude that the precautions in the licensee's procedure
were sufficiently conservative regarding thermal cycling.
An additional concern exists on the vulnerability of the
control circuit and motor to nid-travel torque switch
bounce and consequent intermittent / erratic operation of
the motor that might result in excessive thermal cycling.
The seal-in circuit provided in the original design
._. _ _ _ _ _ _ _ _ _ _ _ _ _
05
- 23
precluded this concern. THe licensee committed to contact
the vendor and verify the acceptability of the present
valve operation.
This issue is considered unresolved. This is identified
as unresolved item 50-361/88-10-15.
d. Adequacy of Seismic Qualification of Devices Added to
Electrical / Instrumentation Fanels
Addition of control components to a safety-related panel
must be evaluated to verify that the original seismic
design bases'for the panel and the additional components
are not unduly compromised by the modification.
Therefore, engineering controls must be established and
maintained for any modifications to safety related panels
involving the location of additional components. A
seismic evaluation must be provided for all additions to
safety related panels, and the location and installation
of the components must be under engineering controls.
In our review of DCP's, the team noted inconsistent ;
evidence of adequate seismic evaluations in several cases
where equipment was being added to a panel.
DCP 793.3J added a CIAS close signal to the CCW
non-critical loop (NCL) supply and return valves located
inside containment. The original design basis had not i
included credit for automatic containment isolation using
these valves. Providing this automatic feature required
addition of a safety related control relay to each valve
control circuit,~ and verification that the entire circuit
met safety criteria for containment isolation valves.
In review of this DCP and in discussions with the
licensee, the team noted that SCE was unable to retrieve
, documentation demonstrating that a specific seismic
evaluation for the addition of the control relay had been
performed, and that engineering controls had been in
effect regarding the specific location of this relay.
Consequently, the seismic qualification of this circuit
'
was not evident from the DCP. During the inspection, the ,
licensee retrieved design information showing that the
location of the relay and its qualification appeared to be
bounded by previous qualification of similar relays and
the panel.
In the review of DCP 2-6345.0TJ, which added an indicator ,
to the main control board in an area at the top of the ~
panel where no other instrumentation was evident, the OCP
Plant Hazards Requirements form indicated, "No special
requirements" for seismic effects. Again, adequate ;
seismic evaluation was not evident. Subsequent discussion i
!
,
h
. .
, 24
with the licensee indicates that there;is a reasonable-
assurance that the installation is seismically qualified
for reasons similar to those cited in the previous
example. However, the team is concerned that in both
cases there was no evidence of a thorough seismic
evaluation. Although the design in these cases did not
appear deficient, better engineering control is neeoed on
the -location and seismic evaluation of these types of
modifications.
Regarding the licer see's program for assuring that
adequate seismic evaluations are performed for these types
of modifications, the licensee explained that the
procedures in effect at the time of tho DCP were limited
to a simple check-off of the item, "Tornado Missile
Effects," on the DCP Plant Hazards Requirements form;
according to the licensee, this item was understood to
include a seismic evaluation. No justification of the
check-off or reference to supporting analysis was
provided. The team concluded that this practice is
inadequate to assure maintenance of seismic qualification.
Regarding current practice, the licensee explained that
the DCP Plant Hazards Requirements form has been revised
to include a separate check-off for a seismic evaluation.
However, the team noted that no justification is required '
>
if "no" is checked on the list. The team concluded that
this is also a poor practice. The licensee indicated that
a recent licensee QA Audit had reached a similar
conclusion, and issned a CAR requesting that further
documentation be provided for seismic and other
engineering evaluations. The team noted that this CAR
committed to providing a summary of the rationale for
, "yes/no" checkoffs on the Hazards Requirements Form. The
team agrees that this is an acceptable corrective action.
,
1
e. Discrepancy Between the Instrument Isometric and
Calibration Documents for CCW Surae Tank Level i
Instrumentation
4
'
Level setting diagrams establish the calibration and l
installation requirements for the CCW surge tank icvel
transmitters (alarm and indication) and the level switches
(control of outlet isol: tion and NCL isolation valves). l
These diagrams provide e datum to which all level '
instruments for the sdrge tank can be referenced with
respect to both tank elevation and plant eleva+1on. The
,
level setting diagrams are controlled design inputs to the
,
instrument / tubing isometric drawings with the latter i
providing the installation-details. !
In examining the level setting diagram and the
instrument / tubing isometrics, a discrepancy of 1" between
the drawings was noted. The licensee investigated the
!
'
l
- -_.. - - - - - - _ - - _
b
.-
.- 25
l
j
discrepancy and subsequently determined that the !
discrepancy resulted from failing to account for the
correct grout thickness upon which the pad is supported on- ,
elevation 8' -0". As a result, the LSD 56364-4 had an
incorrect 1" offset.
SCE also verified conformance of the isometrics to the
other physical drawings, and confirmed that the level
instruments would function correctly since they were
correctly referenced to the tank in all cases.
.
This appeared to be an isolated problem with minor
l spectfic consequences in this case. Since there was no
! effect on the level measurement, no functional safety
,
significance is directly evident. However, incorrect
j information on the level setting diagram could result in a '
l more significant error on a future modification, if the
i future instruments were improperly located based on the
! incorrect plant elevation provided on the diagram. As
j noted during the licensee's revaluation of the CCW system
l- response to various accident scenarios, the different of
only 1" of water in the CCW surge tanks could have a
significar.t impact due to the apparent sensitivity of the
system to leakage.
At a pre-exit meeting, the licensee committed to correct !
I and revise the level setting diagrams to show the correct
elevations.
7. Operations Activities
The inspector assessed the implementation of selected design parameters
and design parameter changes in the operations area as well as normal
l operation activities. The specific operations attributes examined
included an examination of operator and auxiliary operator training for
the selected systems and design changes to the systems, valve line-up
i controls, knowledge of operating procedures, adequacy of the. normal and j
l abnormal procedures and annunciator response guide lines, auxiliary
l operator round sheet adequacy, and adequacy of observing and reporting l
plant deficiencies by operations personnel. ;
Findings in the areas examined are described below:
(1) Normal Operation of the Component Cooling Water System Contrary to
the FSAR Description.
The Component Cooling Water (CCW) system consists of two
l independent, full capacity, critical cooling loops, and one
j non-critical cooling loop. Cooling water for the non-critical loop
l can be supplied from either Critical loop. A process radiation
monitor is installed to detect leakage of radioactive fluid into the
_
'
CCV system. The radiation monitor receives flow from the supply
header of the non-critical loop, monitors the radiation level of the
cooling water, and returns the flow to the return header of the
L ;
^
l .
.
..
~ 26
non-critical loop. During the inspection, it was determined that
the normal mode of operation of this system by the licensee involves
the circulation of cooling water through both critical loops, with
the non-critical loop aligned to one critical loop of the system and
4 the letdown heat exchanger aligned to the other critical loop. The
licensee had, prior to this inspectior., identified the fact that in
the description of the syst *n's normal mode of operation contained
in the facility FSAR, one critical loop was identified as being
maintained in a wet layup status while the other critical loop was
in operation supplying all non-critical components including the
letdown heat exchanger. The significance of this discrepancy was
however, apparently not recognized by the licensee. The current
mode of operation with both critical loops operating results in a
potential leakage path of radioactive fluid from the letdown heat
exchanger into the CCW system not being continuously monitored.
This condition exists because the system has been operated in a
manner not originally intended by the system design and is
considered a deviation from commitments contained in the licensee's
FSAR. This issue is discussed in detail in paragraph 9 of this
report.
(2) CCW Surge Tank Pressure Not Being Monitored or Maintained.
In the review of calculations supporting operation of the C';W
system, it was found that in some cases it had been assumed that the
CCW surge tank pressure would be maintained at a pressure of 33 plus
or minus 2 psig. During initial system walkdowns by the inspec.tfon
team, the surge tanks in Unit 2 were found to be at a indicated a
pressure of 28 psig and 30 psig. It was also later determined that
the tank pressure is neither alarmed in the control room nor
otherwise monitored by operations personnel during operator tours. ,
Although the licensee's site engineering group determined that the '
identified condition did not affect operability of the system, the
lack of a clearly specified acceptance criteria for tank pressure in j
the normal operating procedure or on auxiliary operator round sheets ;
is considered a weakness in assuring operability of the CCW system. l
(3) Abnormal Operating Procedure Deficiencies.
2
In the course of a review of abnormal operating procedures, the
inspector found that the abnormal operating procedure for the CCW j
system did not contain instructions for connecting the emergency l
makeup water supply, which entails the running of hoses from the i
seismic fire main or fire truck to the CCW surge tanks, nor when j
such action should be taken. Instead, detailed instructions for
performing these connections were found in an Appendix to the
system's normal operating procedure. Additionally, the normal
operating procedure was found to contain a precaution that the
seismic fire truck should be flushed first if it previously was
filled with saltwater. A recent licensee reanalysis of several
accident scenerios determined, in some cases, the need to provide
emergency makeup capability to the CCW surge tanks in less than one
hour. It appeared that the licensee's procedures were written
considering that 7 days were available to esteblish the emergency
. . .
C*
~ 27
makeup supply. In light of the licensee's analysis, it appears the
licensee's current abnormal operating. procedures for the CCW system
are outdated. The licensee committed to issuing an update to the
plant's abnormal operating procedures in response to this concern.
(4) Results of Detaild System Walkdowns - Need For Better Labeling of
System Vents, D. Mins and Instrument Rooc Valves.
The inspector performed a hand over hand walkdown of portions of
both the Saltwater Cooling and CCW systems, using as references both
the system P&ID's and the piping isometrics. The inspector found-
during the course of these walkdowns a number of instances in which
system vent and drain valves and some instrument root valves were
poorly identified. Although no.ie were found te lack identification
tags as such, in some instances the markings on the tags had
deteriorated to the extent they were illegible or located in.such a
manner as to make reading them very difficult. Instances were founi
where plant personnel had found it either necessary or more
convenient to identify some valves by marking the ioentification
numbers on the piping systems themselves with marking pens. No
discrepancios between piping isometerics and the actual installed
configuration of the piping systems were found. Some dit.cr?pancies
however, were found with the system P&ID's. In one instance, a
drain valve in the CCW System was not identified at all on the
P&ID's. Since the presence of vents and drains provide likely
leakage paths from these systems and the CCW system has been found
particularly sensitive to leakage by the licensee's owa analysis,
adequate labeling of these valves appears all that much more
important. In addition, the-misoperation of certain instrument root
valves could render important monitoring instrumentation,
'
interlocks, or permissives inoperable. Thus, it would appear
prudent for the licensee to further assess the need for improved
labeling of these ,) articular kinds of valves.
(5) Operator Training.
The inspector reviewed current training given to operators regarding
operations of ther systems reviewed by the team. This included both
initial qualification and requalification training, and the
metb9dology used tn update operators on current system operating l
characteristics or design changes. The inspec. tor found no problems '
with the initial training given to operators. The inspector found i'
that most updates or design changes were passed on to the operations
staff through shift briefings or required on-shift reading
materials. The licensee has also included in their requalification
training, updated plant system classroom overviews for a selected
number of plant systems during each requalification cycle. The
, inspector considered this a positive aspect of the requalification
program. In particular, during the past requalification cycle, an
updated classroon, lecture or, the Saltwater Cooling system was
caiducted. The inspector noted however, that an overview of 'he CCW
system had not been included in any of the past three
requalification cycles nor since the licensee began to include
specific system reviews in their program. The inspector recommended
. . - .-
_ . .
'
..
I s 28
1
1
1
that the licensee consider including the CCW system as one of the l
selected systems to be reviewed during the next requalificatinn 1
cycle, particularly in view af the recent reanalysis of the system I
response under various accident conditions.
8. Control of Drawings -
,
The team identified several weaknesses relating to drawing control during !
! evaluation of the administrative controls. These concerned the 1
l licensee's ge.1eral process of revising orawings and the use and control .
'
of operational schematics. Additionally, the team was informed that SCE '
l. had decided to void the logic diagrams. These diagrams are use to :
conceptualize the control circuits and form the basis for detailed design
output documents such.as elementary drawings and wiring diagrams. The
licensee indicated that the latter drawings were being maintained.
A. Operational Controlled Drawing Stick File Drawings
The station identifies those drawings which are needed to operate
the plant and designate these as "operational controlled drawing
stick file drawings." These typically include piping and
-
instrumentation drawings (P& ids), electrical one lines, electric :
elementaries, etc. l
Upon turnover of a design change, interim drawing change notices are
placed in front of the applicable drawing by the station CDM group.
These drawings are stamped as "interim as-built" drawings. E&C '
Department QA procedure 24-8-7 defines the time period which is
allowed for revising these drawings following receipt of a
notification that the design change package (DCP) was turned over.
This notification r.cminally takes several days following system
turnover to operations.
1
Thirty calendar days aro allowed to revise all "operations"
drawings, except P& ids, which must be revised in 14 days. 'If the !
change requires a new drawing, these time periods are changed to 60
anu 28 days, respectively. Other drawings are required to be
revised once ten DCNs have accumulated. Selected drawings, such as
equipment lists, setpoint and annunciator listr, require revision in
90 days.
The team was concerned with SCE's method of control for these I
drawings. Although controlled drawings are fr' ovide'd to the
operators, the need to compile the interim changes mentally onto the
drawings may create a problem if the step is either missed or
improperly completed. Accepted industry practiceits to provide
Cohiposite operational drawings at the time of turnover. These can
l be either temporarily drawn, or .sarked up drawings. For major
l changes, common practice is to issue revised drawings which are
pre-drafted for the applicable change. This is in contrast to the
'
licensee's practice, which allows twice the time for complex changes
compared with that allowed for simple redrafting.
B. Operational Schematics
es
' 29
Operational Schematics have been prepared for operator use and are
available in the control room. These drawings typically show the
system on a single sheet, and identify operational information such
as valve numbers, setpoints, and control logics. These drawings are
not controlled in that facility changes are not incorporated on a
real time basis, nor were the drawings prepared as design disclosure i
documents.
4
The stick files containing these drawings contain a disclaimer in 4
'
the front of the file stating:
Operational Schematics are Operational Aids and are for
Reference only
For Current Configuration See Design Document on Control
Room Drawing Stick File
The team's cursory review of Operational Scb .natic 50.1278,
Component Cooling Water System No. 1203, ideitified several errors.
Control Logics 2 and 9 both refer to safety injection actuation
signals which operate selected valves. This signal has been changed
to a containment isolation actuation signal. Control Logic 2 does
not reflec*. changes for DCP 970-0-J, which allowed non critical loop
isolation valves to be open simultaneously while switching the non
critical loop from one critical loop to the other. Other changes
from this DCP, such as revised surge tank float and relief '
pressures, were reflected on the drawings. .
The team considered that uncontrolled drawings should not be used to
operate the plant. The team was informed that the drawings are used
for reference only, and that plant configuration is manipulated
using only controlled drawings. The team remained concerned
regarding potential operator use of schematics to operate the plant.
The team subsequently was informed that widespread operator use of
the schematics, in deference to controlled P&lDs, m s observed
during the recently completed limited scope SSFI. Apparently in
response to this finding, an update of schematics is planned in the
near future. The licensee stated that the new ret:sion of these
drawings will contain a printed message stating "For Information
Only Not a Design Disclosure Document, Shall Not be Used to Operate
the Plant". The licensee is also considering semi-annual updates
for the schematics in the future. ,
The team remained somewhat concerned with this approach. Accepted
industry practice is to not allow uncontrolled drawings such as l
these schematics to be present in the control room. More
fundamentally, the operational schematic drawings appear to fulfill
an operator need for convenient, composite information regarding the i
various systems, as opposed to the P& ids which contain extraneous
'
(to operators) information, lack operational input, and typically l
span several sheets. The team considers that the licensee should -
seriously consider upgrading the schematics and their control to
allow their use for plant operation.
!
!
--____-__-___-__L
..
, 30
9. Maintenance Activities
The inspection team assessed the licensees' corrective, preventative, and
repetitive maintenance activities for the Component Cooling Water (CCW)
and Salt Water Cooling (SWC) systems. This assessment included a review
of the maintenance program, technical manuals, maintenance orders and
maintenance requirements. Work in progress was also observed during the
inspection.
The licensees' maintenance program is described in the San Onofre
maintenance policy guideline, 50123-S-6, "Preventative Maintenance
,
Program Objectives and Responsibilities." The licensee's Preventative
Maintenance (PM) program includes predictive, periodic, and planned
maintenance activities. The predictive maintenance activities that are
used to detect abnormalities in equipment performance include In-Service
Test (IST), vibration and performance monitoring, lube oil-analysis to
detect wear, and Motor Operated Valve (MOV) testing and-sampling. Some
additions to the PM program were being considered at the time of the
inspection and included infrared surveys (to detect hot spots on
electrical equipment), and equipment that can be used to determine wire
degradation. The generation of work plans and maintenance orders (MOs)
is governed by licensee procedure 50123-I-1.9, "Repetitive Maintenance
Implementation and Scheduling," and $0123-I-1.7, "Maintenance Order
Preparation, Use, and Scheduling,
l
The inspector reviewed the Nuclear Plant Reliability Data System (NPRDS) '
data base for SONGS 2 and 3 for the CCW anti SWC cooling systems to
determine historical problems / trends with the CCW and SWC equipment.
This data base documented problems with salt water pump bowl and bearing i
degradation and with fouling of the CCW heat exchanger on the saltwater l
side. The inspector also reviewed the Piping and Instrument Diagrams
(P& ids) to identify several components with which to perform a PM prograia
evaluation. These components included the SWC pump, cyclone separators,
several pressure regulators, and certain valves. The inspector
determined that the licensee was taking action to address the pump bowl
erosion and that a modification had been made to the SWC system to
address the fouling of the CCW heat exchanger. The other components !
identified were on the PM program and no problems were noted with these l
,
components. In discussing the PM program with the licensee, no concerns !
- were noted by the inspector with the program.
The licensee's repetitive maintenance program incorporates periodic l
- calibrations of instruments. The inspector asked for the instrument
calibration records for several flow and temperature elements of the CCW
and SWC systems. The instruments were found to be in calibration or
within the grace period (25% of the time interval for recalibration)
allowed for recalibration. The instruments that were in the 25% time
extension were calibrated during the inspectinn. Several of the
instruments have recently had their recalibration interval shortened to
improve plant reliability.
The inspector also observed maintenance work in progress during the
inspection. This work included cleaning and inspection of the unit 3
CCW/SWC hu; exchanger and the recalibration of level switches for the
_ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _______ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
,.
< 31
CCW surge tank. The inspector noted that the work was done with the
appropriate procedures and maintenance orders and had the appropriate
signoffs. For the work on the heat exchanger, Quality Control (QC)
checks were observed being performed, and foreign material exclusion and
material control was maintained. The inspector also observed work on the >
CCW 1evel switches which' isolate the surge tank on low level (2 feet).
The calibration of the level switches was performed with a calibrated .
test instrument and in accordance with the procedure. No problems were
identified with the observation of maintenance activities or the
procedures used.
10. Radiological Control
The radiological and chemical aspects of the operation, maintenance and
surveillance of the CCW and SWC systems were reviewed. System walkdowns
were performed outside containment at both units 2 and 3 and inside
containment at unit 3. Numerous interviews were held with the cognizant
system engineers, effluent engineers, I & C technicians, operators and
other licensee personnel to determine the status of these systems.
The Unit 2 and 3 CCW systems each have an inline process monitor, 2 &
3RT-7819, which is calibrated after repair, adjustment or component
replacement, and at least every'18 months. Channel functional tests are
required after calibration and at least every 92 days. Select records of
channel calibrations in accordance with procedure S023-II-4.56 and select ;
channel functional tests in accordance with procedure 5023-11-4.57 were <
reviewed for the period 1986 to present and appeared complete. The '
monitors were also sighted during facility tours and their control room ,
readouts observed. It was noted that the monitors prcvide no positive
indication of flow, either at the monitor locations or et the control
room readouts. This was brought to the attention of the cogr. 5 nt system
engineer and it was noted that this particular instrument.model has
previously experienced flow blockage problems in other systems at SONGS,
which have rendered the monitors inoperable for extended periods of time.
Chemical and radiological sampling of the CCW systems is performed in )
accordance with chemistry procedure 50123-111-1.1.23, "Units 2/3 Chemical i
i
Control of Primary Plant and Related Systems." This procedJre as well as l
sampling records from March 1987 and 1988 were reviewed. The procedure I
specifies broad normal ranges for pH, conductivity, nitrite, degassed !
gross beta activity and a recently added parameter for microbiological j
organisms. Most out of range results require no specific corrective j
action and the weekly degassed activity is performed on a 2 milliliter !
'
evaporated sample, which has a significantly higher "lower limit of
detectability" (LLD) than many liquid radioactivity sampling methods
currently in use at SONGS. In the reviewed records, the degassed
activity results indicated "less-than" values in the E-5 microcurie /cc
range. For comparison, one liter liquid gamma spectral analyses
typically achieve LL0s in the E-7 to E-8 microcurie /cc range.
l
The SWC systems require radiological sampling and ane yses in accordance
with Technical Specification (TS) Table 4.11-1 and chemical sampling in-
accordance with the Unit 2 and 3 Environmental Protection Plan, as i
required by the SONGS National Pollutant Discharge Elimination System
l
l
l
l
_ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ - _ _ - _ _ - - _ _ _ _ - _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ . _ _ _ _ - _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ - _
_ ___
O'
s 32
(NPDES) permits with the State of California, and as specified in
procedure 50123-III-2.2.23, "Units 2/3 Support Systems Chemistry Control
and Sampling Frequencies." Select records of the TS radiological
sampling and analyses were reviewed from September 1987 through March
1988. The records were complete and the TS indicated LLDs were achieved
for all analyses. No sample provided a positive indication of plant
related activity for the period reviewed and the cognizant effluent
engineer stated that he could recall no instance where activity has ever
been detected in the samples, even though plant radiological discharges
are routinely made through this system. The SWC system provides
approximately 50 million gallons per day of dilution to any activity
released through this pathway.
Select records of the sampling and analyses of marine debris in
accordence with procedure 50123-VII-8.2.11, "Release of Potentially
Contaminated Liquids, Sludges Slurries, and Sands to Unrestricted
Areas " collected from the SWL system associated "fish baskets" were also
reviewed for the period of January 1988 to date. The analyses
occ3ssionally indicated plant related activity. In these cases the
material was held for decay at the instruction of health physics
engineering, resampled to verify the absence of activity and then
released.
Sodium Hypochlorite is added to the SWC system by an automatic system to
reduce slime fouling in the heat exchangers. Procedure 5023-4-1, "Sodium
Hypochlorinator Operation," and S0-5023-340, "Chlorinator Design
Procedure," were reviewed, system operation was discussed with the
cognizant engineer, and system components were sighted.
Procedures 5023-2-8, "Saltwater Cooling System Operation," and
5023-5.1.1, "Heat Treating the Circulating Water System," were also
reviewed. It was noted that these procedures allow an alternate
discharge path for the SWC system effluent through the seawall across the
beach adjacent to the normal outfall discharge path. The status of the
SONGS application to the State of California for the use of this path was
reviewed. It was found that an application had been made in November
1987 and had not yet been finally accepted. The alternate discharge path
has, however, been used on three occasions this year after appropriate
verbal and followup written notification to the State. The cognizant
system engineer stated that this alternate discharr,e path is normally
used when heat treating the Circulating Water system or when maintenance
or inspection is being performed on the outfall structures, and that it
would be used in emergency situations should the outfall become
unavailable. 5023-5.1.1 was noted to prohibit radiological discharges
and hypochlorite addition during heat treatment, in accordance with the
NPDES application, but no such prohibition was contained in 5023-2-8 to
restrict such activities during maintenance ard inspection activities
when the alternate discharge path is in use. The cognizant engineer
acknowledged this observation and stated that action would be taken to
revise their procedures to add an appropriate prohibition to avoid
possible noncompliance with the NPDES permit application.
The program for ALARA reviews of Design Change Packages (DCPs) was
examined and the ALARA review of DCP 768.5N, "Relocation of Radwaste
.
e
s 33
Discharge Line," associated with the SWC system, was examined. Work on
the SWC system and the CCW heat exchangers was observed during the
inspection and involved maintenance and er.gineering personnel were
interviewed.
Procedures 5023-2-17. "Component Cooling Water Pump and System
Operations," and 50-5023-400, "Component Cooling Water System" (system
description), were reviewed as well as system P&I diagrams. It was noted
that the process monitors, 2 & 3RT-7819, are installed across the
noncritical loop supply and return headers, that the monitors operate due
to the differential pressure between the two and that they sample the
noncritical loop supply flow. The system is normally operated as
specified in paragraph 6.1 of 5023-2-17, which states:
"The CCW system should be lined up with both trains running, the
third of a kind pump lined up, in standby to the loop supplying the
noncritical loop, and the letdown heat exchanger being supplied by
the opposite critical loop...."
The noncritical loop is isolated upon CIAS actuation thus removing the
monitor from the system. SD-5023-400 states in part:
"1.2 The Component Cooling Water System has the following additional
function:
1.2.1 To provide a radioactively monitored intermediate
barrier between the reactor (t'xiliary fluids ard the
Saltwater Cooling System."
The u,tJated SONGS 2&3 FSAR, in section 9.2.2, "Component Ccoling Water
System," paragraph 9.2.2.1, "Design Bases," states in part:
"N, The component cooling water system is designed to provide a
radiation monitored intermedicte barrier between the reactor
auxiliary systems fluid and the saltwater cooling system during
nonaccident conditions."
Paragraph 9.2.2.2.1, "General Description," states in part:
"The system is continuously monitored for radioactivity and all
components can be isolated."
and
"Radioacti ity invels in the noncritical loop return header are
continuout ' v mo- 'tored in the control room to indicate any leakage
of radioac ive ,uid into the component cooling water system."
Paragraph 9.2.2.2.3.2, "Normal Operation," states in part:
"During normal system operation, one redundant loop consisting of
one component cooling water pump, one component cooling water heat
exchanger, and one saltwater purep is in service supplying cooling
__
..
i 34
water to the various components in the. noncritical loop and to I
-critical loop A. Critical loop B is on wet standby...."
The FSAR-was reviewed in accordance with NUREG-0800, "Standard Review
Plan" (SRP), which in section 9.2.1, "Station Service Water System," part
III, "Review Procedures," paragraph 3.d. states in part:
.
"Provisions are made in the system to detect and control leakage of
radioactive contamination into and'out of the system. _It will be
1 acceptable if_the system P& ids show radiation monitors. located on
the system discharge and at components susceptible 1to leakage, and
these components can be isolated by one automatic and one manual
vale) in series."
The inspection revealed _that the CCW process monitors were not installed
in accordance with the statements of the FSAR, in that they sample the r
supply flow of the system rather than the return flow, and that this is
not consistent with the description in the SRP. Also, the normal
- operation of the CCW system in accordance with 5023-2-17, with the
4
noncritical loop supplied from one loop and the letdown heat exchanger
supplied from the other, is contrary to the mode of operation tpecified
,
in the UFSAR. This is an apparent deviation (50-361/88-10-16).
'
Additionally, this mode of operation could provide an unmonitored leakage
path from the letdown heat exchange through a failure in the CCW system ,
to the SWC system. '
This matter was discussed with representatives of the SCE corporate
l engineering office during the course of the inspection. Based on this
discussion, the engineers did not appear to understand the operation of
the system in that they believed that the monitors drew their sampling
flow from the return headers of the noncritical loop and were unaware
that dual loop operation removed the letdown heat exchanger from the l
monitored portion of the system. They also believed that any unmonitored
release to the SWC system would be identified by routine sampling of this
system, thus not recognizing the lack of sensitivity of both the routine
CCW and SWC system sampling procedures as noted above. At the end of !
the discussion, the corporate engineering representatives acknowledged I
that it appeared that the CCW system was being operated outside its
design bases and that corrective action to either implement single loop
operation or install an additional process monitor would be considered.
,
i
.
A review of licensee records indicated that the initial edition of
5023-2-17, dated May 23, 1978, specified single loop operation in
accordance with the requirements of the FSAR.
,
However, revision 2 of I
S023-2-17, dated February 11, 1982, clearly specifies that the normal
mode of operation is with both trains running as indicated above. It was
-
stated by representatives of the Operations department that the CCW {
system has essentially always operated with both loops running, in that
the implementation of revision 2 was very shortly before tha initial
startup of Unit 2. The Procedures Review Committee, meeting number 1
82-014 of February 11, 1982, found that this document did not involve an '
unreviewed safety question as defined in 10 CFR 50.59. This review
appeared to be inadequate in that it failed to recognize the as-built
l
. - _ _ _ - .
__
O'
" 35
4 discrepancy between the installed monitor location and the FSAR
description and the need to update thc FSAR due to the change in normal
system operating configuration as required by 10 CFR 50.71 (e).
The licensee has documented this issue on NCR G-0867 dated June 15, 1988.
Interim action has been taken to align the letdown heat exchanger to the
critical loop supplying the non-critical loop.
In this area, one deviation was f(.antified.
11. Testing /Surveilltnce Activities '
A. The inspector observed the performance of the quarterly component
cooling water (CCW) pump and check valve in-service test (IST)
conducted under the licensee's procedure 5023-V-3.4.2. The
inspector found that the procedure was performed thoroughly by the
system cognizant engineer and included both performance testing of
the equipment and vibration monitoring for trending. The testing
involved operation of the A train CCW pump and verification that its
discharge check valve was functioning open and that the parallel CCW
pump discharge check valve was functioning closed. The testing was
alternately repeated for the parallel CCW pump aligned to the A
train.
During the testing, the inspector observed that proper check valve
position was verified for the various pump operating configurations,
but that active repositioning or exercising of the check valve was
not an explicit requirement of the test procedure. The inspector
discussed his observation with licensee representatives responsible
for IST.
The licensee acknowledged that the check valves were only implicitly
exercised per their procedure when performed in combination with
swing pump testing. The licensee stated that they would review and
change their IST procedures to clarify the intent of the
surveillance in accordance with ASME Section XI check valve testing
requirements.
B. The inspector reviewed records of the post-modification /
pre-operational testing performed per licensee procedure 2/3
PE-232-02 following modification of the CCW heat exchangers to allow
backflush operation under DCP 6204.2SM.
(1) The inspector found that the testing which had been performed
in 1985 consisted solely of flow testing to verify acceptable
specified SWC flow rates. The modification involved reversing
the SWC flow direction through the tube side of the heat
exchanger to dislodge debris from the tubes.
However, when in backflush mode, SWC water flows in the same
direction inside the heat exchanger tubes as the CCW flow
outside the tubes. This reduces the overall heat transfer
coefficient of the heat exchanger requiring higher calculated
SWC flow rates in the back flush mode than in the normal SWC
__
e
4. 36
flow direction to transfer an equivalent amount of heat. '
However, no testing to verify the adequacy of the resulting
heat transfer capacity was performed as part of the post
modification testing. As discussed in paragraph 6.B.(1)f. of l
this report, initial system testing did attempt to verify heat '
transfer capacity, indicating that verification of heat
transfer capacity in the backflush mode following the
s.odification would have been appropriate.
(2) The inspector observed that the flow rates required per the
acceptance criteria of the test were satisfied based on a
calculated flow derived from the measured SWC pump differential
pressure (dp) and the original SWC pump head curve. Redundant
direct measuring flow instrumentation (controlitron ultrasonic
flow detectors) were installed at the time but were considered
to have unreliable accuracy.
The inspector observed that based on the calculated flow, the ,
test acceptance criteria was satisfied. However, based on the
Controlitron indicated flow, the test would not have met the
acceptance criteria. However, no NCR had been initiated based
on this condition due to the opinion at the time that the
controlitron data was less accurate than the data calculated
from the pump head curve.
The inspector noted that the licensee later determined the SWC '
pump curves to be inaccurate due to pump degradation,
therefore, indicating that the controlitron data may have been .
correct and the test acceptance criteria not met.. '
!
Based on his review of the preoperational test results, the '
inspector found that the limited flow testing which was
1 performed appeared to be adequate due to the excess design ,
- margin available in the original design. However, the :
inspector noted that the pre-operational performance testing '
lacked essential baseline data to verify the heat transfer
capacity during backflush mode of operation.
J C. In discussing the IST program, the inspector noted that the
butterfly valves which isolate the.CCW non-critical loop from the
critical loops are classified as category B valves by the licensee's
ASME Section XI IST program. Category B valves are valves in which
seat leakage in the closed position is inconsequential for
fulfillment of their design function. However, when the valves were
originally procured, the system design required the valves to be
2
"zero leakage" valves, and the vendor was required to provide test <
-
documentation to this affect. During initial plant operation, the
licensee apparently lost sight of this design requirement, however
i the maximum acceptable leakage of water out of the CCW system
a
including past these isolation valves, has recently surfaced as a
j concern for system operability. .Therefore these valves may have to
be leak tested to verify operability. At the time of the
inspection, these interface valves were required to close in 15.3
! seconds by analysis to assure system operability. The recent IST
_ _ _ _ _ _ - - _ _ _ - _ - - _ _ _ _ _ _ - . - _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ - - _ _ _ _
. .-. .
4"
.. 37 !
,
'
test on unit 3 showed that one of these valves closed with a time
greater than was allowed by analysis (16.8 seconds) and another
valve closed in 15.0 seconds. The pos Gle incorrect designation of
these interface valves and the long stroke time is an unresolved
item (50-361/88-10-17).
D. The inspector questioned whether SWC valves HV6494 and HV6496 were
contained in the licensee's Inservice Testing (IST) program. These
valves allow lineup of the SWC system directly to the beach in the
event that the circulating water return becomes unavailable. These
valves were not part of the IST program. This is considered an
apparent violation of Technical Specification 4.0.5
(50-361/88-10-18). The team noted that these valves have been
. occasionally cycled during the past year to aid in control of marine
l growth in the circulating water system.
E. The licensee reportedly has an exemption from performing quarterly
'
IST on the CCW non-critical loop isolation valves due to the i
potential to interrupt cooling flow to the Reactor Coolant Pumps
(RQPs). This exemption was apparently requested prior to the
modification which now allows those valves to be cycled without flow
interruption to the RCPs. The team questioned whether the exemption
remains valid in view of the modification. This is open item ,
(50-361/88-10-19).
F. The inspector noted that the CCW surge tank is not periodically
checked for nitrogen leakage with the non-safety nitrogen supply
secured. Additionally, it was not clear if maintenance of some
minimum level of nitrogen pressure is important. This is open item
(50-361/88-10-20).
12. General Oversicht Activities ;
The team examined licensee oversight group activities to assess their
involvement in significant plant problems. The review attempted to
determine the extent of these groups pro-active initiatives and
involvement in activities that would contribute to enhanced plant safety.
Oversight group records were examined to identify the extent of their
review of issues and adequacy of corrective actions.
A. Nuclear Safety Group
The team reviewed the activities and functions of the Nuclear Safety
l Group (NSG). The of/-site safety review committee functions
l normally established by the plant technical specifications are
!
implemented by the staff of the Nuclear Safety Group (Technical
Specification 6.5.3). Because this is a staff-level group, more
time is available to perform reviews of the technical details I
associated with the review items than if the these reviews were
performed by senior facility management. The effects of this
.
'
difference in approach were evident to the team through the team's
review of the documentation of selected reviews conducted by the
NSG.
i
l
._ -.
. __ . - _ _ .
_ _ _ _ _ - _ _ _ _ _ _ _ _ - - _ _ _ _ _ .
.O'
i
o. 38
4
NSG activities are defined in E&C Department Quality Assurance
Procedure 40-9-21, Nuclear Safety Group Review, Evaluation and Audit
Responsibilities for SONGS. This procedure contained appropriate
requirements and guidance to implement technical specification t
requirements. NSG activities were summarized in monthly reports and
various review checklists. The following monthly Nuclear Safety
Reports were reviewed:
Period,' Report Date
March 1988 '4/29/88
February 1968 3/31/88
January 1988 3/15/88
December 1987 1/29/88
November 1987 12/15/87
October 1987 11/30/87
September 1987 10/30/87
August 1987 9/30/87
July 1987 8/31/87
The NSG has initiated probable risk assessment (PRA) analysis on a
limited basis. One pro-active feature of this effort includes the '
monthly tracking of probability of core-melt which is graphically
included in the report attachments, allowing assessment by others,
l including the Nuclear Control Board. Calendar year 1987 showed a ;
l'
dramatic decrease in core-melt probability due to the installation
of a back-flush capability for the sea water side of the component
cooling water heat exchangers. This modification reduced the amount
of time that the heat exchangers were required to be out of service
for mechanical cleaning.
Tha following documents were also reviewed by the team:
Document Title NSG Checklist
a
Audit report SCES-043-87 SONGS 1,2,&3 Corrective Action. 1/12/88
PFC 2-87-6554.12 Rev. 1 Fire Isolation Switch Rewiring 11/23/87
PFC 2/3-87-6554.21, Rev. O Train A Backup Power Source for 1/5/88
Control Room Emergency Lights
PFC 2-87-6554.13, Rev. O Saltwater Cooling Valve Platform 9/24/87 i
PFC 2/3-87-042 Rev. O CCW Chemical Addition Platform / 3/11/88
AFW Pump Bearing Leakoff Drain
Piping ;
PFC 2-87-6554.10 Rev. O Saltwater Cooling Pump Logic 12/15/87 i
PFC 2/3-87-6679, Rev. O Chlorinating System Supply to 10/28/87
l
'
PFC 3-87-6554.13. Rev. O Saltwater Cooling Valve Access 10/15/87 !
Platform i
PFC 2-86-6621.0, Rev. O Modification of MSIV Dump Valves 12/4/86 l
1
The team also reviewed the current (May 1988) month's set of l
orocedure review checklists, which document NSG review of the !
changes to plant procedures to verify that unreviewed safety l
questions were not created. Twenty-four checklists were completed
without comments. Four checklists contained comments ranging from
__ _ - _ - - !
_ _ _ - - _ - _ _ _ - _ _ _ _ _ _ _ _ .
.
...
. 39
suggestions (eg., battery sizing and loading calculations should be
referenced since these determine values used in procedure
attachment); to safety improvements (eg., to prevent testing to
wrong criteria, perforinance test criteria.should be checked against
latest revision of applicable calculations); to safety concerns
(eg., procedure fails to verify that an equalizing charge has been
conducted between three to seven days prior to_the start of the test
per IEEE 450-1980 - examples from procedure review checklist for
.50123-I-2.6, Rev. O, Battery Performance _ Test). Safety improvements
,
and concerns required response from the responsible organization and
were tracked by the NSG.
The Nuclear Safety Group conducts monthly meetings to discuss the
previous month's activities among the members of the group. Persons
in attendance include NSG members and typically a representative
from the Quality Assurance organization. Occasionally other
interested parties attend, such as ISEG members and the Manager of
Nuclear Safety. The team sat in on the June 7, 1988 meeting that
discussed the activities reviewed during May 1988. These meetings
are typically held at the plant site, which affords NSG members a
periodic "forced" opportunity to examine specific plant issues
firsthand and conduct facility tours. The supervisor of the NSG
, indicated that this approach was specifically designed to provide an
opportunity to his staff to pursue issues at the site and to allow
for frequent oversight tours of the units.
Based on these reviews, the team considered that the Nuclear Safety
4
Group was conducting adequte reviews and that adequate I
administrative procedures had been implemented to control NSG j
activities so that technical specification requirements were being '
met.
, 1
,
B. Nuclear Control Board I
A Nuclear Control Board (NCB) has been established to provide for
management oversight of the engineering and operations activities.
This committee functions to verify that administration, maintenance,
and operations are consistent with company policy, rules, approved
procedures and operating license provisions, as related to safety
and environmental efforts. NCB functions include review of
significant safety issues identified by the NSG, OSRC, ISEG or an
NCB member. The following documents were reviewed by the team to
,
assess the activities of the NCB:
(1) SONGS 2&3 NCB Charter, dated January 25, 1988.
.
(2) Minutes and Agenda for NCB Meetings held on April 12, 1988;
October 6,1987; July 7,1987; April 1,1987; and January 6,
1987. ,
Items reviewed included retrofit, OSRC, QA, and nuclear licensing
activities, and reports from the ISEG and NSG. In addition, special
activities were reviewed, such as the results of a limited scope
SSFI and a special presentation on the Chernobyl nuclear accident,
_ _ - - _ - _ _ - - _ - _ _ _ _ _ _ _ . _ _ _ _ _ _ - _ _ _ - - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - - - _ _ - _ - .
.
.-
-*. 40
I
l
The team noted that the NCB did not appear to initiate many (
pro-active efforts, as evidenced by no new NCB open items for all of
1987 and 1988 to-date. The team did verify that a NCB i
recommendation, that site QA forward draft audit plans to the NSG i
for prior review, was being implemented.
Although the NCB is not required by the SONGS Units 2 and 3
Technical Specifications, this board complements NSG activities by
providing a vehicle for senior management oversight of nuclear
safety matters in a collegial environment separate from the line
management role. The NC8 is a commitment established in the FSAR
and does satisfy solected requirements for offsite safety review
activities specified by ANSI N18.7-1976. The combination of i
detailed technical reviews by the NSG, complemented by general
oversight by the NCB, appeared to be an effective method of
implementation of the offsite safety review requirements.
C. Quality Assuran,ce Activities
The team examined recent quality assurance activities that were
designed to examine aspects of the licensee's design and
modification control programs. In June 1987, audit responsibilities >
were rearranged such that the site quality assurance organization ;
conducts all audits of engineering for SONGS, including examination
of the Engineering and Construction (E&C) efforts. Prior to June,
1987, this activity was a shared responsibility of the site and
general office quality assurance groups,
t
The site quality assurance group recently initiated a program that
is intended to conduct detailed technical audits. The program is
designed to perform integrated assessments of functions focused on ,
performance. The initial effort in this area was a design control
audit, SCES-036-87, initiated during September 1987 and completed on
April 8, 1988. This audit was a major undertaking, consisting of
over 5,500 man-hours of effort involving three full-time and eight
part-time auditors. The audit consisted of a detailed vertical
audit of the design change / modification process; from examination of
design development, design procedures and training of engineers
l (both SCE and the principal engineering contractors - Fluor and
Bechtel) through the design change implementation process at the
site; including construction, turnover and testing, and final
documentation. The audit initially planned to examine 3 DCPs,
however the sample size was expanded to twenty due to the nature of
problems identified during the audit.
The results of this audit had not been formalized during the conduct
of the team inspection. However, the team did review available
documentation detailing specific findings and the audit approach.
As an example, the inspection plan detailed a thorough check for
compliance with the design controls required by ANSI N45.2.11.
However the inspectors' completed checklists were not yet available. j
In addition the specific findings of the audit had been translated
into 36 corrective action reports, 32 problem review reports, and 3
nonconformance reports. The team examined the subject forms and the 1
l
!
l
a
i
,a
l
. '41 ,
licensee's proposed corrective actions (if determined). The
findings of the audit appeared to be consistent with those of the
SSFI team for those areas that were common to both efforts.
The. licensee stated that they plan to continue conducting integrated
assessments similar.to SCES-036-87, with at least one such audit
scheduled per year. The licentee. indicated that the next assessment
would examine the maintenance program in depth.
The team also observed that a memorandum addressing the review
process for nuclear safety concerns, from the SCE chairman of the
board to all personnel, was posted throughout the general offices. l
This memorandum established a three tier process for raising ,
l concerns:
(1) through the immediate supervisor
,
(2) through the head of the appropriate safety review
'
organization
(3) through the Nuclear Safety Concerns Program administered by the
quality assurance organization
For general office personnel, the Manager of Nuclear Safety was
designated head of the safety review organization. The team
interviewed this manager regarding activity by employees in raising
concerns. The manager indicated that no such concerns had been
raised through him. He indicated that the normal vehicle for 1
raising such concerns was the Nuclear Safety Concerns Program, which
affords an opportunity to raise concerns anonymously.
D. On-Site Review Committee (OSRC) Activities
Activities of the OSRC were inspected to determine the OSRC
involvement in chronic or significant plant problems and plant s !
modifications, and to assess the performance of its mission as 1
l described in Section 6.5.1 of the Technical Specifications for Units
l 2 and 3. In the course of the inspection, the. inspector reviewed
'
recent reports, reviews, meeting summaries, recommendations for
actions, and other documents associated with or resulting from OSRC .,
action. The inspector attended a regular monthly meeting of OSRC, l
and afterward interviewed some participants and presenters,
including the OSRC chairman (who is the Station Manager). During
l
the meeting, the inspector noted the manner in which OSRC addressed
various agenda items, including a formal review of units operations i
to detect "potential nuclear safety hazards", a review of all
reportable events, technical specifications violations that had been
investigated and reported to the nuclear safety group (NSG), l
licensee event reports, notice of violation responses, and other l
such matters of the past ;nonth. The inspector observed during the
'
meeting that, although there were numerous items considered on the
i
agenda, the Committee chairman pressed vigorously to ensure clarity
I
and completeness on all substantive points. Of particular note was
sharp questioning by the Committee chairman regarding LER-1-88-007
(an improperly discarded sample) and a response to NOV in IR
1
l
l
_ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ . _ _ . _ - _ . _ _ - _ _ _ - _ _ _ _ _ _ _ . __ _ __-____ - _______________ __ ______ ___
...
.. 42 ;
i
50-206/88-3, dated 4/15/88 (a N 2
cylinder leakage and safety
implications) ,
f
In reviewing OSRC documents, the inspector observed that the OSRC
, was much inclined to apply the "50.59 process criteria" to a wide
range of items of possible safety concern (as LERs, NOV responses).
In addition to regular monthly 0SRC meetings, there are special
called meetings where requested by the Station Manager or.the NSG
Supervisor. One such recent meeting on March 10, 1988 was to
consider a detailed review of the unreviewed safety question (USQ):
'
and potential nuclear safety hazard (PNSH) aspects of proposed
transshipment of spent fuel from Unit 1 to Unit 2. (The application
of the 10 CFR 50.59 criteria to parts of this proposed action is
. addressed elsewhere in this report).
,
The inspector discussed the role and activities of OSRC with other
plant personnel (other than OSRC Chairmar,and members of the
Committee), including the resident inspector, other inspection team
members, and the NRR project manager.
.
The broad range of OSRC responsibilities makes it difficult for OSRC
to carefully review all issues that come before it. This situation ,
is largely overcome by the strong direction given by the OSRC
chairman. OSRC appears on the whole to do a good job of fulfilling
4 its responsibilities as defined in Section 6.5.1 of the Unit 2/3
Technical Specifications. ,
'
E. Independent Safety Enoineerina Group'(ISEG) Activities ;
Activities of ISEG were inspected to assess the Group's involvement
in plant problems and its effectiveness in carrying out-its mission
as described in Section 6.2.3 of the Unit 2/3 Technical
Specifications (TS). Although ISEG was originally a subgroup of the
4 Nuclear Safety Group (NSG), an offsite group also described in the
1 TS, ISEG is an independent group, form 611y reporting (as does NSG)
! to the Manager, Nuclear Safety.
1^
The inspector conducted two interviews with the ISEG supervisor with
another ISEG member present, reviewed samples of different kinds of
reports prepared by ISEG, discussed the activities of ISEG with the
ISEG supervisor and with other plant personnel including the Station
Manager, and with a resident inspector, the senior resident
inspector, other team members, and the NRR project manager.
Because of the role of ISEG as described by plant TS, an assessment
of its impa:t on plant safety is more subjective than usual. ISEG
is tasked to review NRC issuances, industry advances, and other
,
sources of plant design and operating information that might
, indicate areas for improving performance and safety at SONGS, and to
! make recommendations based on that information. ISEG has ready
access to early information (as INPO notepad and NRC morning call)
regarding global current plant operating experience. It digests and
-
disseminates this information regularly for possible application of
_ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ . _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ . ._. _ _ _ _ - _______- ____ __ . - _ _ - _ - -
^
,
. 43
,
safety or operationa1' significance for SONGS. The ISEG supervisor
stated that a primary function of ISEG is to "get the word out".
This mission is accomplished by regular issuance of ISEG Operating
Experience Summaries, an "electronic bulletin board" - type
publication that summarizes events and causes, with lessons learned
for SONGS. ISEG also issues Action Requests that result from an
ISEG Field Evaluation of a plant event, and performs other special
studies directed toward betterment of plant operation and safety.
The ISEG supervisor stated that he believes ISEG drives a lot of
work done at the site. The inspector reviewed samples of such ISEG
'
documents and interviewed some of those to whom certain ISEG-
generated reports were directed.
From the above-described inspection activities -including ;
observations, interviews, and reviews of documents information, it '
appears that ISEG is effective in fulfilling its functions as
described in the TS, and in fact exercises some proactive influence
for the betterment of plant operation and safety by early
identification of problem areas.
13. Additional pro-Active Initiatives and Activities
,
A. Desian Control Task Force
The Engineering and Construction Department established a design
control task force in 1988 to sxamine the licensee's design change
process and recommend process improvements. The task force, headed
by a project manager within the Nuclear Generation Engineering i
group, was established following a series of events and reviews
which indicated weaknesses in the licensee's current methods. These
included a notice of violation relating to Unit 1 batteries, an INPO '
review in December, 1987, the design change QA audit, and general
reviews of the results of NRC inspections, such as SSFIs recently
performed at other facilities. The team reviewed the objectives of
this task force and its accomplishments to date.
The task force broke down the design modification process into more i
than 70 discrete steps, in addition to several general asp +. cts ;
related to the design process. These steps were then prioritized
regarding the task force members' perception of implementation
problems associated with each step. The steps that were identified
, as in need of improvement or as problem areas were then sorted and
'
assigned to one of five separate task groups which deal with general
,
'
areas of the design change process. These groups included design l
basis, interoffice communications, work process, document retrieval, j
and training.
An example of a work product emerging from this task force was the i
design basis task group's development of a request for proposal for I
a design basis document and an associated design roadmap document.
This proposal was in response to areas which were considered weak
within the steps of the design / modification process. The request,
which was issued during the inspection, defines'the design basis as
that body of information which identifies the specific functions to
l
l
.-_____J
'
..
l *. 44 i
t
be performed by a structure, system, or component; and the specific ,
values or ranges which constitute controlling parameters as
reference bounds for detailed plant design necessary to ensure
public health and safety. These values are established by plant
safety analysis, regulatory or other pre-approved criteria, codes
and standards, or other commitments which define acceptable safety
margins against which the plant was reviewed and approved by the
NRC. The design roadmap document was envisioned as a tool to aid
the engineer in identifying, locating, and using appropriate .
documents to be considered in the performance of design activities.
A final decision regarding whether or not to develop a design basis-
document and/or a design roadmap had not been made by the licensee, i
These efforts, and similar areas being examined by the design -
control task force, appeared to represent a significant pro-active -
undertaking by the licensee, independent of the initiative of the ,
normal oversight groups. l
! B. San Onofre Pro.iect Review Meetinas
! i
The team discussed the conduct of San Onofre Project review meetings
with staff members that participate in these meetings and in
addition reviewed the agenda of meetings held on July 16, 1987;
January 20, 1988; and March 18, 1988. These meetings are well j
attended by line management, including the Vice Presidents of NES&L, i
E&C, and NGS. These meetings provide an add?tional level of
facility oversight, and in addition form an avenue for the j
initiation of pro-active initiatives. For example, the limited <
scope SSFI performed for NES&L was initiated following the January
1988 meeting. Results of this effort were reviewed by the NCB
during the March meeting. i
C. Limited Scope Safety System Functional Inspection
The licensee had been monitoring NRC and industry experience
i relating to design inspections. As a result, the licensing
! department had been investigating contracting an organization to
l perform an internal SSFI late in 1987. Following notification that
the NRC planned to conduct an SSFI, SCE proceeded with a limited
scope SSFI on an expedited basis to probe for weaknesses in this l
area. The shutdown cooling system was selected for review by a I
contractor with experience in conducting SSFIs.
The team was provided the results'of the initial report of this
limited scope SSFI, dated May 12, 1988. (The licensee indicated
l
that the report was still under review and would be reissued.) The i
effort resulted in 30 requests for information for specific findings i
and, in addition, 4 programmatic concerns: l
(1) Design criteria and inputs were not rigorously specified in the
design change packages, l
(2) Design change packages did not contain supporting calculations.
_ _ _ _ _ - . , _ _ _ ._ ._ _ _ _ _ _ _ - _ - ._ . _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ - _ - _ _
j .*
e, 45 i
,
!
,
(3) Post-modification testing requirements were not specified by
l engineering.
(4) Appropriate documentation was not revised following s
modifications, with a specific example being numerous FSAR ,
errors. '
>
Corrective action to address these' findings had been' slowed due to
the press of activity relate? to outages for Units 1 and 3 and the '
NRC's SSFI.
Although the team did not perform a detailed review of the limited
scope SSFI, it appeared that the results of the review were valid
and consistent with the findings of the NRC team.
D. State of the System Reports
The licensee initiated reviews of selected systems following
discovery that the NRC planned to conduct an SSFI in 1988. The
reports were compiled in anticipation of the SSFI by the respective '
system cognizant engineers. The emphasis of these reviews was on
the functionality of the systems. Specific areas examined included
design / licensing basis, operations and maintenance. Recently drafted
design reports (performed under contract by Bechtel, the
architect / engineer of record) provided a basis for the review. '
The team reviewed these reports (issued in May 1988) for the salt
water cooling system and the component cooling water system. The
reports identified functional problems with the selected systems
typical of those identified during NRC SSFIs. In particular, the
findings appeared consistent with the team's examination of the ;
selected systems. ,
The design reports reviewed were draft documents that had not
received quality assurance and design verification reviews;
nonetheless they appeared to represent an enhanced compilation of '
design basis information, although there were a number of obvious
errors noted, apparently due to the information being drawn from
sources which had not been maintained up-to-date.
I
The team considered initiation of these reviews to be. a significant
pro-active initiative by the licensee that had identified problems
with safety significance for resolution. The licensee was strongly
,
,
encouraged to continue particularly the effort of the cognizant t
engineers, in that their system reviews appeared to provide
significant benefit in gaining a full understanding of the systems
and in identifying problems.
14. 10 CFR 50.59 Activities
l
'
The quality of safety evaluations performed in accordance with 10 CFR f
50.59 was inspected. The inspection was not confined to the application '
of 10 CFR 50.59 to perform safety evaluations for design changes, but
included uses by the licensee in other areas as well, as in the
!
i
. .
<*
2 .," 46
,
'
disposition of some nonconformance reports (NCR), and assessing the ,
i safety implications of technical specification (TS) violations and
reportable plant events (LERs), and responses to notices of violations.
(NOVs).
Samples of specific plant design change items and events (PFCs, NOVs,
NCRs, LERs, TS violations) were chosen-to assess the quality of 10 CFR
50.59 reviews perfomed.. Some design change items and events included in
, the sample are recent and some are not. -The purpose here is not to shed
new light on these design change items or events, but to assess the use
of the 10 CFR 50.59 process in evaluating the safety implications of
proposed plant design changes and plant events. Of the large number of
such items reviewed, the several cited below are meant to be
representative.
PFC No. 2/3-83-242 - This design change was to provide an interlock
'
between closed cooling water cross tie isolation valves to allow the
operator to keep both CCW trains operating during changeover from
i operating train to standby train. This would assure that there would be
no interruption of CCW to RPC seals. To accomplish this it would be ;
necessary to change the setpoint for the CCW surge tank safety relief
valves and the nitrogen regulator valves so as to increase the capacity
of the system,
'
t
- This PFC was completed, implemented, and tested. However, the safety
9 evaluation performed under 10 CFR 50.59 consisted of checkir.g "No" to the
l three criteria questions for an USQ and a one-sentence justification as a
9
basis for the "No" findings.
l
'
Spent Fuel Transshipment from Unit 1 to Units 2/3 - This proposed action
was the subject of a Special Meeting of the Onsite Review Committee
(OSRC) (88-03) on March 10, 1988, reconvened on March 15, 1988. The
Special Meeting of OSRC was called "to discuss the Unreviewed Safety *
, Questions (USQ) determination on the proposed fuel transshipment." l
The review had considered the criteria from an USQ as given in 10 CFR
>
50.59 and applied the criteria to an evaluation of the Unit 1 turbine
'
gantry crane, Unit I transshipment activities, and Units 2/3
transshipment activities. The conclusion reached for each criteria, for .
1 each activity to which it was applied was "No", so the overall conclusion I
was that no USQ was involved. It appeared to the inspector that the
provisions of 10 CFR 50.59 had been excessively narrowly applied in ;
reaching a "no enreviewed safety question" conclusion. '
NCR 2-2404 dated 5/9/88 - A pipe and safety valves 2PSV-8404/8409 were
,
experiencing excessive vibration. An interim repair (shims under pipe) i
) and permanent repair (modify pipe supports) were proposed for disposition
of this NCR,
j A 10 CFR 50.59 safety evaluation was per'/otred that deuribed the
proposed fix in some detail, but did ne ".' to an w the questions
I
'
regarding the probability and conseque - 'iunt , althsc i
previously analyze 1 or different from - '
W and yzed in the ,
i
l
l
,
.,
_
. _ - _ - , n --, , ,,_
.s
4 47
,
FSAR. Howeve*, a failure analys.is of the SRV vibration and a root cause
determination were performed that were complete and acceptable.
NCR-3-1960 dated 5/16/88 - Indicator for containment isolation valve for
, penetration 47 indicated "intermediate" when value is fully closed.
Containment was unable to reach test pressure during LLRT in accordance ,
with 5023-V-3.13. The~ cognizant engineer's "Disposition / Comments i
(including 50.59 aspects)" recommended a disposition of "rework" !
according to detailed disposition instruction. A 10 CFR 50.59 evaluation
is not needed for this choice of disposition, but a root cause analysis
will be performed.
NCR 2-2417 dated 6/7/78 - A SWC pump motor mounting was flawed. This was
found earlier by NDE and reported on WO88050191 dated 6/6/88, the
disposition recommended by the cognizant engineer is "accept-as-is". The ;
'
, inspector questioned the cognizant engineer in detail about the basis for
this disposition. After some clarifying discussion, the inspector agreed
'
that the "accept-as-is" disposition is appropriate. lne 10 CFR 50.59
4 evaluation required for an "accept-as-is" disposition had been performed, l
but did not seem to address the questions of increased consequences of a
previously evaluated accident or the possibility of creating a different t
type of accident.
NCR 2-1912 dated 9/24/86 - A mechanical snubber on a 30-inch salt-water
pipe in a tunnel was found during a 1986 inspection walkdown to have
heavy corrosion on the outer casing. The snubber was functional-tested f
,
and found to be frozen. The disposition by the cognizant engineer was to
1 replace it and send the defective snubber to Station Technical for
evaluation. A written engineering evaluation was performed, which ,
concluded that the component would have performed its safety functic,n had ,
. a DBE occurred. However, the corrosive environment to potentially (or i
actually) degrade pipe supports, snubbers, other structural members, a '
flow meter, and possibly other equipment / components important to safety
had been known since December 1983 and not corrected. Apparently no
safety evaluation had been performed to evaluate the degradation of
important-to-safety equipment in this corrosive environment.
'
While there is extensive use of the three criteria given in 10 CFR 50.59 ,
4
'
to determine USQs associated with plant design changes and to evaluate ~
plant events, there is a need for improved training of station technical i
personnel in the use of 10 CFR 50.59 in performing safety evaluations and .
- a need for improved documentation of the considerations made to reach *
- 50.59 conclusions. The team recognizes that extensive documentation is l
1 normally not necessary, however, a brief statement of considerations made '
would aid in ensuring that all potential problems were considered.
15. Trainina Programs for SCE Corporate Eraineers i
'
Formal training for SCE Corporate engineers is described in Engineering
and Construction (E&C) Procedure 41-1-2. This program is essentially an
- annual review of important E&C internal procedures. The review of
d
procedures includes, but is not limited to training on safety evaluation l
and design change control. A formal tracking system has been implemented i
to ensure all corporate engineers' training remains current. The l
'
1
-
!
/
<>'
o 48 ,
training records were reviewed.and generally, all the engineers training
was current.
SCE had not instituted.a formal training program for newly hired
corporate engineers other than the program addressed. Additionally
corporate engineers receive no specific training on the nuclear plants'
design basis, systems or integrated system operation. SCE corporate
engineering relies heavily on the engineer's previous work experience and
education. Additionally, SCE engineering management noted the turnover
rate of corporate engineers is low.
Based on tnis review and the findings of the team during the SSFI team
inspection, the team concluded that the licensee does not have an-
adequate training program for the corporate engineers. SCE's training
program does not evaluate the individual engineer's knowledge nor does
the program establish a standard knowledge' requirement. The absence of
training on the licensee's nuclear units' design bases and systems is a
fundamental weakness.
16. Manaaement Meetinas !
The Team Leader met routinely with licensee management to discuss the
progress of the inspection, details of preliminary issues, and requests
for additional data. On June 6, 1988 the inspection team and NRC ,
managers met with the licensee staff to summarize the inspection findings
and their relationship to license conditions, performance indicators and
current issues. <
!
r
i
l
i
!
i
j
l