ML20153F901

Responds to NRC Re Violations Noted in Insp Repts 50-361/88-10 & 50-362/88-10.Corrective Actions:Availability of Nonconformance Rept Process to Document Design Related Problems Emphasized to Offsite Personnel

ML20153F901
Person / Time
Site:	San Onofre
Issue date:	09/02/1988
From:	Baskin K SOUTHERN CALIFORNIA EDISON CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM), NRC OFFICE OF ENFORCEMENT (OE)
References
NUDOCS 8809070537
Download: ML20153F901 (11)

Text

.

a (.y" p

Southem Califomia Edison Company P. O. B O X 8 0 0 i

2244 WALNUT QRO !E AVENUE ROS EM EAD, CALIFORNIA 91770 MENNETH R BASMIN September 2,1983 Director. Office of Enforcement U. S. Nuclear Regulatory Commission Attention: Document Control Desk Hashington, D. C. 20555 Gentlemen:

j

Subject:

Docket Nos. 50-361 and 50-362 Reply to a Notice of Violation and Notice of Deviation 1 San Onofre Nuclear Generating Station Units 2 and 3

Reference:

Letter from Mr. John B. Hartin (USNRC) to Mr. Kenneth P. Baskin (SCE), dated August 3, 1988 The referenced letter fcrwarded Notices of Violation and a Notice of Deviation resulting from the Safety System Functional Inspection (SSFI) conducted between May 2 and June 10, 1988, of activities authorized by NRC Licenses NPF-10 and NPF-15. The SSFI assesud the operational readiness of the Component Cooling Water (CCH) n.d Salt Water Cooling (SHC) systems under normal and analyzed accident conditions. This inspection is documented in NRC Inspection Report Nos. 50461/88-10 and 50-362/80-10, included with the referenced letter. In accordance with 10 CFR 2.201, Enclosure I to this letter provides the Southern California Edison (SCE) reply to the Notices of Violation. SCE's response to the Notice of Deviation is provided by Enclosure 2.

The referenced letter requested that a written description of SCE's action plan to address the basic issues identified by the SSFI team be provided within 60 days. SCE's response to this request will be forwarded under ,

separate cover by October 3, 1988.

At the $$FI exit meeting, SCE was encouraged to perform a prompt, thorough reassessment of the entire CCH System because of the number of questions and concerns raised by both the NRC and SCE. The results of the initial phase of this effort were forwarded by SCE's letter dated June 24, 1988, receipt of which was acknowledged by the referenced letter. SCE's June 24, 1988 letter m"lBanB%!!Y

• r6oi ljp

f%G?

Document Control Desk September 2, 1988 indicated that the second phase would be completed by the end of September.

Because our initial reassessment concluded that no unreviewed safety questions were involved, and that the CCH System remains operable under the identified conditions, and in the interest of providing a thorough and complete reassessment, SCE finds it necessary to delay the completion of this effort until November 30, 1988.

If you have any questions regarding SCE's response to th6 Notices of Violation and Deviation or require additional information, please cal! me. '

Respectfully submitted, Enclosures I cc: J. B. Hartin, Regional Administrator, NRC Region V

)

i F. R. Huey, NRC Senior Resident Inspector, San Onofre Units 1, 2 and 3 D. E. Hickman, Project Manager, Project Directorate V NRR l

l

ENCLOSURE 1 REPLY TO A NOTICE OF VIOLATION Appendix A to Mr. Hartin's letter dated August 3,1988 states in part: i A. 10 CFR 50.73 requires, in part, that licensees shall report any event or condition that resulted in the condition of the nuclear power plant, 7 1

including-its principle safety barriers, being seriously degraded; that resulted in the nuclear power plant being in an unanalyzed condition that

• significantly compromised plant safety; that resulted in the nuclear power plant being in a condition that was outside the design basis of the plant; or any event or condition that'alone could have prevented the fulfillment of the safety function of systems needed to mitigate the consequences of an accident.

t:

Contrary to the above, as of June 10, 1988, the licensee failed to report the following conditions:

(1) The High Energy Li.1e Break Accident (HELBA) analysis not having been adequately performed for the CCH system during plant licensing.

(2) The combination of CCH leakage and valve closure time which could have prevented the CCH system from functioning during a HELBA.

(3) The CCM system had leakage in excess of the design leakage and had no capability for seismically qualified makeup to the system prior to 1984, as reported in delinquent Licensee Event Report 88-008.

This is a severity level IV violation (Supplement I). l l

RESPONSE

REASON FOR THE VIOLATION t A.(1) SCE's failure to report that the HELBA analysis had not been adequately performed for the CCH system during plant licensing results from insufficient programmatic requirements for offsite organizations (Nuclear Engineering, Safety and Licensing; Engineering and Construction) to assess the implications of their i offsite activities from a reportability standpoint.  !

Reportability determination is generally the responsibility of the onsite (Nuclear Generation Site) Station Compliance group.  ;

Effective procedural mechanisms are well established onsite for the ident1fication and evaluation of potentially reportable occurrences. Although offsite personnel recognize their 3

obligation to report safety problems, inadequate programmatic mechanisms have been established offsite for the identification and evaluation of potentially reportable occurrences related to offsite activities. l l

l l

l l

)

In December 1987 SCE commenceo a limited review of CCH system performance. This activity was conducted by offsite engineers.

During the course of this' review, it became apparent that the impact of HELRA on the CCH System had not been adequately considered by the original HELBA analysis. This discovery was not considered Nm a reportability standpoint .nor identified to Station Compliance as being potentially reportable because of a lack of well established programmatic requirements for the offsite personnel who were conducting the review to consider reportability.

A.(2) License Event Report 88-008, dated April 29, 1988 reported that the CCH System had leakage in excess of design leakage and had no provision for seismically qualified make-up to the system prior to 1984. During the development of LER 88-008, a significant amount of information contained in a reevaluation of CCH System operability was evaluated for reportability pursuant to 10 CFR 50.73. This reportability evaluation considered the interim corrective actions being taken, including the reduction of the inservice testing (IST) program allowable stroke time of the CCH non-critical loop (NCL) isolation valves. While the CCH System operability reevaluation was being refined, interim corrective action to reduce the IST allowable stroke time was considered necessary in order to ensure sufficient CCH Surge Tank inventory to preclude solid system operation following a HELBA.

As part of the evaluation, SCE researched IST records for Units 2 and 3 and determined that the measured stroke times of the subject valves had remained below the newly prescribed value subsequent to the discovery of the leakage problem in 1983. Since SCE's research resulted in the conclusion that both Units 2 and 3 continued to meet the non-critical loop isolation requirements, the reportability requirements pursuant to 10 CFR 50.73 were  ;

judged not to be applicable. Although it was realized that '

excessive CCH leakage together with excessive NCL isolation valve stroke times could prevent fulfillment of the safety function, it was judged that, with satisfactory stroke times, the condition "alone" was not reportable pursuant to 10 CFR 50.73(a)(2)(v).

As acknowledged by the NRC in Inspection R9 port Nos. 50- 361/88-10 and 50-362/88-10, which forwarded the Notice of Violation, and in NUREG 1022, Licensee Event Report System, engineering judgment is sometimes required in evaluating plant events pursuant to certain paragraphs of 10 CFR 50.73. As such, there will continue to be opportunities in which licensee's make decisions based on judgment which are later challenged and found to differ from the NRC's judgment of the reporting requirements for a given circumstance.

A.(3) Licensee Event Report 88-008, dated April 29, 1988, reported that the CCH System had leakage in excess of the design leakage and had no provision for seismically qualified makeup to.the system prior to 1984. Excessive CCH System leakage was recognized in late 1982. However, the personnel who identified that actual CCH System leakage exceeded the system leakage criteria, failed to initiate a Nonconformance Report (NCR) as required by procedure.

The NCR process is the mechanism by which a reportability evaluation would have been made for such conditions. A Startup Problem Report (SPR) which addressed the issue was initiated. The existence of an SPR on the subject may have contributed to the reason an NCR was not initiated.

Because an NCR was not initiated for excessive CCH system leakage, the situation would not have been formally evaluated for reportability. Additionally, in the 1982/83 time frame, the NCR process was being enhanced and was in transition with regard to the inclusion of operability /reportability assessments as part of the NCR form. The NCR transition period is evident by the review of NCR's written on Reactor Trip Breakers (RTB) in the 1982/83 time frame. Some RTB-NCR's written during the trial period of this enhancement to the NCR program included operability /reportability assessment while others did not.

CORRECTIVE ACTIONS THAT HAVE BEEN TAKEN AND RESULTS ACHIEVED A.(1) The availability of the NCR process to document design related problems has been emphasized to offsite engineering personnel.

A.(2) Station Compliance personnel taking part in the reportability evaluation process have been provided augmented guidance for such determinations. Included in this guidance is reference to the use of engineering judgment and examples of the use of such judgment in reporting determinations.

A.(3) Since 1983, the NCR process has matured, reducing ths ?otential for conditions, such as those reported by the delinquent LER, not being properly assessed for reportability.  :

CORRECTIVE ACTIONS THAT HILL BE TAKEN TO AVOID FURTHER VIOLATIONS A.(1) SCE will expand the use of the NCR process by offsite organizations. Training on this process will be administered to appropriate offsite supervisory personnel, and will include guidance necessary to adequately evaluate findings to ensure that NRC reporting requirements are properly considered. This training i

l

l

. 1

-4 will be implemented by October 30, 1988 and it is anticipated that 4 the training will be completed by November 18, 1988. Additional I future corrective actions will be discussed in SCE's action plan  ;

to address the basic issues identified by the SSFI team, which is l to be submitted by October 3, 1988.

A.(2) This event will be reviewed with (plant) personnel involved with making reportability evaluations with emphasis on the use of engineering judpent in the process. This will be complete by September 15, 1988.

A.(3) The above corrective actions that have been taken are sufficient to prevent recurrence.

DATE HHEN FULL COMPLIANCE HILL BE ACHIEVED A.(1) Aspects addressed by the Notice of Violation will be reported in an LER by September 30, 1988.

A.(2) Aspects addressed by the Notice of Violation will be reported in an LER by September 30, 1988.

A.(3) Full compliance was achieved with the submittal of LER 88-008 on April 29, 1988.

B. 10 CFR 50, Appendix A, Criterion 2 and 44, requires, in part, that systems important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, and further requires that the design bases for these systems reflect appropriate combinations of the effects of accident conditions with the effects of the natural phenomena.

Contrary to the above, at the time of the inspection, (1) the design of the valve motor operator controi circuits for the surge tank outlet valve of the Component Cooling Hater (CCH) system did not include analyses of adverse effects of earthquakes; and (2) the design bases of the CCH system did not reflect the combination of the effects of the surge tank outlet valves for both trains spuriously closing in conjunction with a l safe shutdown earthquake.  ;

This is a severity lavel IV violation (Supplement I).

l

RESPONSE

REASON FOR THE VIOLATION SCE agrees that 1) the design of the component cooling water (CCH) system surge tanks outlet valves' motor operator control circuits did not include analyses of adverse effects of postulated earthquakes and

2) the design of the CCH system did not reflect the combination of the effects of the CCH surge tanks outlet valves for both trains spuriously closing in conjunction with a safe shutdown earthquake, i

J l

F The automatic closure of the CCH surge tanks motor operated valves (H0V) on low low surge tank level is not required to be a safety function. The function of the automatic closure of the MOV's is to prevent potential nitrogen ingress into the CCH system in the event of a significant water inventory loss. Because this function was not considered to be a safety function, the associated power and control circuits were not designed to Class 1E requirements. Additionally, the remote possibility of a common mode failure (earthquake) of control relays in the HCC resulting in valve closure was not identified when the system was designed. Consequently, no evaluation of the occurrence was performed and the relays were not required to be seismically qualified.

CORRECTIVE STEPS THAT HAVE BEEN TAKEN AND RESULTS' ACHIEVED The power supplies have been disconnected from CCH surge tanks outlet valves' motor operators by removing the thermal overloads from the HOV breakers. Automatic, remote manual, and inadvertent actuation of the MOV's are thereby prevented. The potential common mode failure of the circuitry causing both valves to be closed has been eliminated.

CORRECTIVE STEPS THAT HILL BE TAKEN TO AVOID FURTHER VIOLATION The CCH system will be reviewed and analyzed in detail and appropriate action, if any, will be taken to comply with the requirements of 10CFR50, Appendix A, Criterion 2 and 44. This evaluation will occur concurrently with the completion of the second phase of SCE's CCH operability assessment discussed in our June 24, 1988 letter. This activity is expected to be completed by November 30, 1988. In addition to this near term review which is focused on the CCH System, SCE will undertake a broader review of non seismic controls for potential adverse impact on other safety functions.

DATE HHEN FULL COMPLIANCE HILL BE ACHIEVE 0 t

Full compliance was achieved for both Units 2 and 3 on June 17, 1988 when the power supplies were disconnected from the motor operators as described above.

C. San Onofre Nuclear Generating Station (SONGS) Technical Specification .

4.0.5 requires in part that inservice testing of ASHE Code Class 1, 2, '

and 3 components shall be performed in accordance with Section XI of the l ASHE Boiler and Pressure Vessel Code (Code).

The ASHE Code Section XI requires, in part, that Category B valves be exercised every 3 months and that a record of test results be maintained.

Contrary to the above, as of June 10, 1988, Salt Water Cooling system valves HV6494 and HV6496 were not included in the Unit 2/3 inservice testing program.

I This is a severity level IV violation (Supplement I).

i 1

l l

RESPONSE

REASONS FOR THE VIOLATION SCE admits that the saltwater overboard valves (from the component cooling water heat exchangers), HV6494 and HV6496 were not included in the ASME Section XI, Inservice Testing (IST) Program. In the development of the IST Program, valves HV6454 and HV6496 were originally considered passive, rather than active type valves, based on the fact that they have no automatic function and receive no signal from the Engineered Safety Features Actuation System. Category B passive valves are exempted from inservice testing under the provisions of ASME Boller and Pressure Vessel Code,Section XI, Table IHV-3700-1.

He nave reexamined our original evaluation of HV6494 and HV6496 with regard to ASME Section XI criteria. A more conservative interpretation of what constitutes an active or passive valve would require that these valves be included in the IST program as Code Class 3, Category B, active valves. This determination is based on the requirement for the valves to be manually opened following a seismic event that disables the normal salt water cooling system discharge path from the component cooling water heat exchangers.

CORRECTIVE STEPS THAT HAVE BEEN TAKEN AND THE RESULTS ACHIEVED HV6494 and HV6496 have been added to the IST program and will be manually cycled on a quarterly bases. In addition, a Position Indication Test will be performed at each refueling outage as required by the code.

The procedure entitled '.. service Testing of Valves Program SO23-V-3.5, was revised to include hV6494 and HV6496 on August 18, 1988. Operations procedure, Inservice Valve Testing, Quarterly, S023-3-3.30, was revised on August 19, 1988, to include the valves.

Inservice Testing of the Saltwater Overboard Valves was satisfactorily accomplished on August 20, 1988 for both Units 2 and 3.

CORRECTIVE STEPS TAKEN TO AVOID FURTHER VIOLATIONS SCE will perform a review to determine if additional manually operated valves, required to bring the plant to cold shutdown, were inadvertently omitted from the IST Program. This review will be completed by December 31, 1988.

DATE WHEN FULL COMPLIANCE HAS ACHIEVED Full compliance was achieved on August 20, 1988 when HV6494 and HV6496 were incorporated into SCE's IST program and satisfactorily tested.  !

I ENCLOSURE 2 REPLY TO A NOTICE OF DEVIATION Appendix B to Mr. Martin's letter dated August 3, 1988 states in part:

A. The updated San Onofre 2&3 FSAR, section 9.2.2, Component Cooling Hater System, paragraph 9.2.2.1, Design Bases, states in part:

"N. The component cooling water system is designed to provide a radiation monitored intermediate barrier between the reactor auxiliary systems fluid and the saltwater cooling system during nonaccident conditions.

Paragraph 9.2.2.2.1 states in part:

"The system is continuously monitored for radioactivity and all components can be isolated."

and "Radioactivity levels in the noncritical loop return header are continuously monitored in the control room to indicate any leakage of radioactive fluid into the component cooling water system.

Paragraph 9.2.2.2.3.2, Normal Operation, states in part:

"During normal system operation, one redundant loop consisting of one component cooling water pump, one component cooling water heat exchanger, and one saltwater pump is in service supplying cooling water to the various components in the noncritical loop and to critical loop A. Critical loop B is in wet standby...."

Contrary to the above, the Component Cooling Hater systems are currently and have, since the startup of Unit 2, been operated in accordance with S023-2-17, Component Cooling Hater Pump and System Operation, with both loops running. The monitored noncritical loop being supplied from Jne loop and the letdown heat exchanger being supplied from the other. This mode of operation provides no monitoring for the loop containing the letdown heat exchanger and an improperly located sampling point for the loop that is monitored.

This is a deviation, i

RESPONSE

REASON FOR THE DEVIATION 1

The deviation initially resulted from a failure to adequately evaluato FSAR requirements during procedure development and was eerpetuated by the failure of existing mechanisms to identify and capture ci;riges to the FSAR. Although CCH operating philosophy was examined on at least three separate occasions prior to the SSFI, either the deviation was not identified or was identified and not resolved.

During startup testing in 1981, both CCH loops were operated to facilitate the scheduling of testing of equipment supported by each loop and to avoid potential damage to equipment which could occur if it was started and the associated CCH loop was not operating. After startup, this operating philosophy was adopted from the startup procedures and continued by operating procedure S023-2-17. The deviation from the FSAR was not recognized when the startup procedure was adopted and the FSAR was not changed accordingly.

In late 1982, an operator error rendered the train A emergency chiller inoperable due to the chiller being aligned to an inoperable CCH train.

In response to an Onsite Review Committee (OSRC) request related to this incident, the Nuclear Safety Group (NSG) evaluated the capability of the emergency chillers to function during transients at one unit while aligned to the other unit. This evaluation resulted in a recommendation for strict adherence to the then normal CCH System operating practice of two loop CCH operation to maintain high reliability for automatic start of the Emergency Chilled Water System (ECHS), and a design chang 6 to provide for starting of all CCH pumps in both units upon actuation of the emergency chillers, which would allow a return to one train CCH operation, consistent with the FSAR. The deviation of two loop CCH System operation from FSAR was recognized but action was not taken to update the FSAR. The design change was not implemented because it was obviated by the established CCH System two loop operating practice.

Although SCE had identified the general need for FSAR changes for two loop CCH operation, the design changes proposed would have made the FSAR changes unnecessary. There was no mechanism to ensure that the FSAR changes would have been made following cancellation of the design change. In addition, the radiation monitoring deviation was not recognized as such, at this time, since the NSG considered routine sampling of the CCH System to be consistent with the FSAR.

In 1986, as a result of a productivity improven nt program suggestion to operate the CCH system in accordance with the original design to avoid excessive equipment wear, an analysis was conducted to compare two loop operation versus one loop operation for the CCH system. The analysis  !

identified the radiation monitoring deficiency with two loops operating, for the first time. The radiation monitoring deficiency was noted but no action was initiated to resolve the deviation from the FSAR.

I As a result of the SSFI, NCR-G-0867 was issued which identified the discrepancy between the single loop operating design basis and the actual ,

two loop normal operation as well as the deficiency in the radiation l monitoring alignment.

CORRECTIVE STEPS TAKEN TO AVOID FURTHER DEVIATIONS The operating procedure was revised on June 17, 1988 to align the letdown  !

heat exchanger on the same CCH loop as the non-critical loop, resolving the radiation monitoring problem. The FSAR will be revised to reflect j

o the current operating practice. This will be completed when the next annual FSAR update is submitted which is due by February 16, 1989. .

Further corrective actions will be identified with SCE's action plan to address the basic issues identified by the-SSFI team which will be j forwarded by October 3, 1988.

i I

l l

i i

)

l I

l l