ML20198J804

Integrated Verification Team Rept

ML20198J804
Person / Time
Site:	Crystal River
Issue date:	01/10/1998
From:	Halnon G, Hebb G, Lutz T FLORIDA POWER CORP.
To:
Shared Package
ML20198J675	List: 3F0198-25, Provides Outage Assessment Rept,Which Describes Accomplishments During Current Outage,Which Began in Sept 1996.Rept Includes Broad Restart Readiness Overview & Individual Repts for Listed Functional Areas ML20198J729 ML20198J750 ML20198J756 ML20198J781 ML20198J804 ML20198J818 ML20198J837 ML20198J857 ML20198J862 ML20198J882 ML20198J888 ML20198J899
References
NUDOCS 9801140216
Download: ML20198J804 (26)

Text

._ - - _ _ _ - . - - - - . . _ _ _ . . _ _ - - . - _ -

l i

I i

CRYSTAL RIVER UNIT 3

! 1997 MODIFICATION OUTAGE l

'- l%y

~

g.;. .

Np ,

' ' .-; / .. .

4~ f .

~

,l (g .. .

I T 4

) '# k E INTEGRn FED VERIFICATION i TEAM l l

REPORT

/  !

'A.%m'!AEW '

./ () g /I '

TEAM MEMBERS Greg Halnon Tom Lutz l Garrett Hebb PaulFleming giaurd)

Shawn Tyler l Larry McDougal

. AlFriend Mark Van Sicklen pimited)

, 9001140216 900110 POR ADOCK 05000302 ge t, P PDR

IMTICR ATf.D Vf RIF1 CATION Tf. AM Rf PORT o '

INDEX  :

t

'ECUTIVE

SUMMARY

PAGE 3 DISCUSSION ON CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS PAGE 4 STANDBY SAFEGUARDS ANALYSIS PAGE10 SPECIAL TOPICS PAGEt9 4

CONCLUSION PAGE 24 APPENDIX PAGE 25 PAGE2

INTEGRATED VERIFICATION TE AM REPORT EXECUTIVE

SUMMARY

The Integrated Verification Team (IVT) met to review the FSAR Chapter 14 accidents and events relative to operator actions / burden and safety margins. The safety usessments from all of the Emergency Operating Procedures were reviewed along _with m'odifications which affected the mitigation strategy of the accidents and events. This repon covers each Chapter 14-accident / event in addition to some special areas of emphasis such as boron precipitation and control complex habitability envelope issues. Each discussion identifies the areas of review, overall conclusions reached by the team, and recommendations for follow-up. The goal is to ensure that the modifications to restore safety margins in the plant did not collectively or individually adversely affect the mitigation actions by operators and suppon staffs and to '

ereure cross system and depanment dependencies were adequately considered. Is addition to reviewing safety assessments, several interviews with key issue managers were held. The overall conclusions of the team were that the Chapt r 14 accidents were adequately covered in the modification and emergency operating procedure revisions this outage. No additional dependencies were created and operator burden remains at en acceptable level. Throughout the repon, there are recommendations for funher follow up, although only one immediate ksue wu identified. This issue regarded the Control Complex Chillers and the competing interest of the EOP group and the design analyses regarding the timing of the chiller stan.

Immediate feedback was given to the EOP Project Director and the Manager of Nuclear Operations Engineering Support.

l 1

l l

PAGE3

INTf GR AfrD Vf RificcTioN TE AM RE; ORT ,

DISCUSSION ON CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS I.

The following discussion contains excerpts out of a paper written by Paul Fleming titled,

" Safety Analysis Comparisons to Crystal River Unit 3 Procedures". Each discussion provides a brief description of the accident canditions and procedures used. The IVT used this information to assist in focusing t% review of selected documents and activities UNCOMPENSATED OPERATING REACTIVITY CliANGES This event is a function of reactivity changes that occur over the life of the operating core.

The principle contributors that cause reactivity changes include: fun depletion, burnable po: son depletion and changes in fission product poison concentration. Since these reactivity changes are relatively slow, the Integrated Control System (ICS) and operator action are more than adequate to compensate. During normal operation control rod position is managed by operators in accordance with Operating Procedures OP IO3D (Withdrawal Limit Curves),

OP-304 (Soluble Poison Concentration Control) and OP 204 (Power Operations), while reactor coolant system (RCS) temperature is maintained by the ICS. If left uncompensated, the reactor protect: , system (RPS) setpoints will prevent safety limits from being exceeded.

No modifications or other changes were identified which affect the ability of the operators or SSCs to compensate for this phenomena.

STARTUP ACCIDENT This accident is a function of an uncontrolled reactivity addition by control rod group (CRG) withdrawal from a sub<ritical condition. Two cases were evaluated; one CRG and all CR'is withdrawal. For the one CRG withdrawal case, the transient was terminated by a high RCS pressure RPS trip. For the all CRG case, the transient was terminated by a high flux RPS trip, in both cases operator action at the onset of recognizing inappropriate CRG operation would 'oe to stop rod movement and if unsuccessful, then a reactor trip would be manually initiated in accordance with Abnormal Procedure (AP) 525, Continuous Control Rod Motion.

Upon receipt of a reactor trip operators use Emergency Operating Procedure (EOP)-02, Vital System Status Verification, to ensure post trip reactivity is managed with primary to secondary heat transfer adequate and balanced. Absent any other symptoms or operational challenges EOP- 10, Post Trip Stabilization, is performed to manage plant systems and components after a reactor trip. No modifications were identified which affect the probability of this event, change the effect on the plart, or the mitigation of this accident.

t PAGE4

)

INTEGR ATED VERIFICATION TEQM REPORT ,

4

' ROD WITHDRAWAL AT RATED POWER OPERATION ACCIDENT

- - - . . ~ _ . - - 3 This ' accident is a function of an uncontrolled withdrawal of an entire CRG while' operadag'at rated power. A reactor _ trip occurs on either high RCS_ pressure or high flux  :

1-dependingLon rate of reactivity addition. Once abnormal CRG movement is observed..the

- Loperadng staff would attempt ta stop rod modon and if -mdul, then a reactor trip

- would be manually initiated in accordance with AP 525. Upon receipt of a reactor trip--

operators use EOP 02 to ensure post trip reactivity is managed with primary to secondary heati j t

transfer adec uste and balanced. Absent any other symptoms or operational challenges EOP 10 ~

is performec, to manage plant systems and components after a reactor trip. No modifications .  :

were identified which affect the probability of this event, change the effect on the plant, or the mitigation of this accident.-

MODERATOR DILUTION ACCIDENT

- This accident is a function of an uncontrolled reduction in RCS boron concentration.  :

Procedures such as Operations Instruction (0101), Reactivity Control, which provides high _i level guidance for reactivity management and OP 304 which provides Limits and Precautions - l 4

to prevent inadvenent deboration and design features minimize the probability an'.

^

- inedvenent RCS dilution event. However, should such an event occur operators are trained to r recognize symptoms of a reactivity imbt. lance and take conservative action (s).

- The modification to install MUV-541 in the makeup tank makeup line was reviewed. No additional operator burden or interdependencies were identified. In fact, this modification greatly benefited the operator and maintenance in using this injection path. MUV 103, which was previously used to isolate this flow path, had a long history of seat leaks. The location of

. the valve is such that effective maintenance could not be performed. The installation of the >

new valve addressed these and several other problems, all adding a great deal of reliability to the isolation of this line, and thus lowering the probability of this accident.

One of the symptoms of a moderator dilution accident while at power includes control rod movement into the reactor core. Operators are charged to maintain control rod position within the Regulating Rod Insertion Limits in accordance- with Improved Technical 4

Specification (ITS) Limiting Condition for Operation (LCO) 3.2.1, OP 103D and OP 204.

AP 525 provides guidance to stop rod muion and terminate the dilution. Activities related to

an' inadvertent deboration event would be readily identified by indication of increased RCS inventory as evidenced by a positive _ pressurizer level trend.- A new procedure written to

~

mitigate reactivity excursions is AP-490, Reactor Coolant _ System Boration. If boration is -

requiied by ITS, or if in Modes 3-6 and 'an unacceptable increase in neutron flux exists, mitigative action out of this procedure is used. The procedure essentially initiates flow from a borated source and ensures the sourcefis isolated after the event is terminated. No unacceptable cross dependencies were identified in the new procedure. The team also reviewed the disposition of MUV-64, MUT_ Outlet Isolation Valve. FPC removed the commitment to close this valve within 10 minutes. The technical justification was adequate with no further -

~

comments regarding the operation of the manual operator installed during Refuel 10. g 4 ,

PAGE5~

~

w *,e-w-+-*%,- w w v -- v e e w- - ey., -

..&ww p er 4 -'

er y

, . , . , ._.m-_. _ . . . . _. . . . .. ._- - . ___ .._

l y

' INTEGRATED VERIFICATION TEAu REPORT- 4 q

. tin l the absence of any other symptoms or operatioAal challenges, EOP 10 is performed to manage plant systems and componenu after a reactor trip. No modifications were identifiedi ,

- + which affect the probability of this event, change the effect on the plant, or the mitigation of )

this accident.-

+

. - - , = . - -

COLD TATER ACCIDENT

' This accident i. a function of starting a reactor coolant pump-(RCP) during power  ;

operation. RCP start permissives prevent starting an RCP with reactor power greater than -

30% RTP.L In addition, OP 302, RC Pump Operation, provides guidance to maintain reactor power less than 30% prior to starting an RCP These control measures ensure the accident analysis is preserved. No ".uodifications were identified which affect the probability of this event, change the effect on the plant, or the mitigation of this accident.-  ;

LOSS OF COOLANT FLOW ACCIDENT

- This accident is a function of a loss or reduction in forced RCS flow. Two accidents were '

evaluatedi four pump coast down and locked rotor (1 RCP). Both accidents result in a reactor trip. However, procedures used to mitigate each accident differ based on RCP operating status.

For the four pump coast down accident operators use EOP 02 to ensure post trip reactivity is -

managed with primary to secondary heat transfer adequate and balanced If no RCPs are operating, then operators are instructed to ensure emergency feedwater (EFW) is supplied to the once through steam generators (OTSG). EOP 13, EOP Rules, Rule 3 provides guidance for establishing the required OTSG level. Mitigation guidance is continued in EOP-10 where RCP resta:t is addressed if RCPs are available. If at least one RCP can not be placed in operation, then EOP 10 routes to EOP-9, Natural Circulation Cooldown.

For the locked rotor accident, operators use EOP-2 to ensure post trip reactivity is mamged with primary to secondary heat transfer adequate and balanced. Absent of any other symptoms or operational challenges, EOP-10 is performed to manage plant systems and components after a reactor trip. Componems involved include the RCPs, RCP Power Monitors, and 6.9kV.switchgear. Modifications to FWP 7 backup diesel power were reviewed and no adverse effects t_o the '.oss of RCS flow accident were found. No other modifications or other changes were identified which adversely affect the mitigation of this event or operator

. burden.

STUCK OUT STUCK IN, OR DROPPED CONTROL ROD ACCIDENT-These accidents are a function of' control rod misalignment due to a mechanical or electrical failure. A stuck out control rod is assumed to occur on a reactor trip. Upon receipt of a reactor trip operators use EOP-02 to ensure post trip reactivity is managed with primary

- to secondary heat transfer adequate and balanced. Sufficiem negative reactivity exists post tiip i- -

-PAGE6

'_[--

_4 .._ . -_. - ~ +_ _ _ . - - - .,- - - _ . , _ -m . , . , - -~w # .--,.

. _ _ _ ~ .. . , . . - -,. __ _ _ = . . - _ _ _ _ . . - ~ . . ~ . _ . ._ . __ _ _ - . . . -. -

a = -

l l

, -kNTEGR ATED VERiticQTloN TE AW REPORT--

to tensure 1% shutdown margin (SDM) for hot' shutdown condidons, even with the most

> reactive control rod stuck out. EOP 02 verifies all safety and regulating control rods are fully :

= inserted. No specific action is taken to mitigate the effects of a single stuck-out control rod. if a ~ d cooldown is_ initiated, then~ a combination of procedures (OP:209, Plant Cooldown, SP-421,- _

Reactivity Balance Calculations, and OP 103C, Cycle 11 Reactivity Worth Curves) ensure a - l minimum shutdown margin is maintained in accordance with LCO 3.1.1.

l A stuck in control rod is assumed to occur during the withdrawal of control rods. Once this condition is recogwzed by either observation or annunciator alarm 0 02-o4, event point 1242) operator action to realign'the control rod is performed in acco, dance with OP 502, .

~ Control Rod Drive System. This activity is performed while maintaining'the requirements of LCO 3.1.4. If the control rod is determined to be untrippable, then SDM is. verified in accordance with Required Action 3.1.4.D.1.1 and SP 421, Reactivity Balance Calculations, or a <

plant shutdown ~ to Mode 3 with a boration must be completed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.-

If an asymmetric rod fault occurs, then the ICS will ' runback" the plant to 60% of rated" power. This situation is an entry condition for AP 545, Plant Runback. Operators stabilize the plant and ensure plant parameters are within acceptable limits, specifically for those related to Power Distribution Limits published in ITS.

No- modifications or other changes were identified which adversely affect the mitigation -

of this event or operator burden.-

LOAD REJECTION ACCIDENT This accident is a function of the main turbine generator separating from the transmission system, which can occur by either both output breakers opening or a main turbine trip _

'(resulting in the output breakers opening). The accident analysis describes the original design which included msntaining the reactor operating. Subsequent (current) design moved the pilot operated relief valve (PORV) setpoint above the RPS high pressure trip setpoint. In addition,if the turbine trips with reactor por- > 45%, an anticipatory reactor trip (ART) will occur.

There are two scenarios _of interest, one that results in a reactor trip and one that successfully runs back. Upon receipt of a reactor trip, operators use EOP 02 to ensure post trip reactivity is managed with primary to secondary heat transfer adequate and balanced.

- Absent any other symptoms or operational challenges, EOP-10 is performed to manage' plant -

.-- 1 systems and components after a reactor trip, cif a turbme tnp occurs with reactor power <45%, then AP-660 (Turbine Trip) is used to verify stable plant conditions' post transient. If the main generator output breakers open, even -

with no turbine trip, the ICS goes into TRACK resulting in a plant runback. No specific 6 guidance exists for load rejection based ICS runbacks, yet discussions with the EOP group 4

indicate that existing plant. operating procedures and training provide the necessary guidance for operation of the ICS in track.

. PAGE 7 I - ~ + > , -e u w , :, -- s.-- , ,<w -, --- w -.m r + = ~-4 , -

l INTEGRA7tD VtalFICA7 ton TEAM REPORT ,

t No^ modifications' or other changes were identified which adversely' affect the mitigation oft

- this event or operator burden.-

' STATION Bl.ACK OUT ACCIDENT -

The changes made to this section of the FSAR were to clarify the _ thermal hydraulic plant 4

response which had already been stated in earlier sections. The second change identifies the use -

of VBIT 1A through 1D for coping, which was previously assumed, but_not listed. The fm' al Echange _was for the replacement of Nitrogen Bottles with Breathing Air Bottles for the-operation of the ADVs. There is a pending change due to the EOP-12 revision which lists -

instructions for the Operations staff to verify the status of containment isolation valves in

~

accordance with NUMARC 87 00.

In dealing with this accident, it was found that EOP 12 is the primary procedure used to

- stabilize the plant and cope with the conditions of the accident. This is accomplished through the use of EFW (EFP 2) for removal of Decay Heat, while MSSVs and ADVs transfer energy

- to the environment.

The actions required by Operations during the accident mitigation were found to be consistent with analysis and not overly burdensome.- The actions we as follown 1.- Minimize RCS losses and ensure EFP 2 has started. The modification which returned the auto-reopening of ASV 204 was found to give added assurance that EFW would be  :

. available.i As a method of defens: in-depth should EFW not operate correctly, EOP 14 Enclosure 10 starts AFW from FWP 7 which has had an independent power source installed by MAR 97 03-01 01. There are additional actions required should AFW be needed; however, they are considered to be reasonable and not a heavy burden.

2. Align air supply to ADVs. MAR 9607-09-01 installed new breathing air bottles. The ADVs were analyzed by Framatome (INS-97-4550) to have the equivalent of 7 full stickes during the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO : vent. The IVT determined this to be adequate for dealing with a '

four (4) hour SBO based on ADV air reserve capaity. This was not considered to be an

. increase in operator burden, as the breathing air bottles where a replacement for nitrogen bottles which also required action to put them in servicci

3. Remove non required operating loads powered from the DP System. This is performed within the control room and has remained consistent with no additional operator burdens or. actions. This was found to comply;with all design requirements established in

' calculations to ensure idequate battery capacity for coping with a four hour SBO.

4. L As previously performed, cabinet doors within the EFIC rooms and control rom are 1

opened to reduce the heating effect on electronic systems due to the loss of venttiation.

Additionally, VBIT-1E, the non 1E inverter, is deenergized to eliminate a source of heating. : Modifications to the control room have been reviewed and determined to have

- no adverw effect on previous heat loading assessments.

,..g.

PAGE8

.. . . . - - . - ~ - , , . .- . . . . . . . - . . . . -

'l INTEGK ATs0 VERIFIC ATioN TI AM REPoET--

, c Once the above actions'are completed, AP 770 is performed concurrently in an effort to-  !

rectablish AC power to the ES 4160V Busses. = After this point, with or without the return of

+

EAC power, the plant conditions are being anonitored to ensure consistency with design . _

analysis. These conditions include, but are not limited to,- verifying l adequate subcooling - 4 margin and containment integrity.f .

In conclusion, the review of this accident shows no adverse effects on mitigation strategy;

- or safety margin. The completion times associated with operator actions are considered to be:

reasonable to reach the required condition in an orderly manner without a challenge to'the 1 plant systems.  :

Area ofRecommendedFollow Up

.It has bedome apparent that the AMaspheric Dump Valves are utilized for several plant-

- scenarios.- The IVT determined that much attention should be given to these valves. Tr; the ,

i past, CR 3 has operated with at least one of these valves isolated. NOD-31 should be reviewed-by Operations to ensure the required actions are commensurate with the safety significance of l -!

- the valves. There is a significant difference in Operations relying on the MSSVs versus the -

? ADVs as to the ease of response to transients and control of the secondary plant. -

2 t

4 t

1 -

A PAGE9

- ~ . ... _ _ _ . __m.._ _ _ _ _ - _ _ . - - _ _ _ . . __.-_.__. . _ .

y .

INTECR ATED VERlHCAT1oN TEau Rtront (!

O I

STANDBY SAFEGUARDS ANALYSIS a

The following discussions were developed from the IVT meetings, discussions with key :  ;

- issue managers, and review of modifications and procedures.

i MAIN STEAM LINE FAILURE ACCIDENT -- -

Yhere was an extensive rewrite of the FSAR description based on Restart Issue D 70. With ,

respect to his accident, two cases were discussed-maintaining adequate subcooling n.argin i (SCM) and thelose of SCM. ,

In maintaining adequate SCM, a new action added to the EOPs is to trip the Reactor  :

Coolant Pumps (RCPs) upon loss of controlled bleedoff (CBO) flow from the seals. The

, CBO flow isolates when the 4 psig Reactor Building Isolation ES signal is received. :In

- addition to this action, the make up pump recirculation line isolates and decay heat pumps start as part of the LPI cascading signal within the ESAS. There is no change with the recirculation valves except the HPI Recirculation to the RB Sump modification- allows additional options for MUT water management. The LPI pumps starting was a major burden to the operator prior to this outage. Timely tripping of the pumps after a diagnosis of them not being required was necessary.- Although still important to diagnose the need and shut the pumps down, the increr. sed mission time of the pumps developed during this outage remcves the potential fc. damage which was once believed to exist.

In the case where inadequate SCM exists, EOP 3, Inadequate Subcooling Murin, is entered and a full ES actuation is ensured, either automatically or manually. SCM is quickly restored

. by the HPI flow, yet the RCPs we already tripped per EOP-13 Rule 1. Further into the event, EOP-2, EOP 5, and EOP 10 ue used to stabilize the plant. Control Complex ventilation is restored which is the same as prior to this outage. Overall, operator burden is not adversely affected by the modifications and procedure changes.

Additional Discussion:

PC97 5981 described a situation where a small steam leak occurs and the OTSG pressure -

becomes biased. This in turn causes unequal EFW flows which perpetuates into a continuing '

divergence of the OTSG pressures until the EFIC control circuits catch up to the transient.

Operator actions may be necessary 'due to the hydraulic biasing, but existing procedure controls and training appear adequate to mitigate this event. Additionally, engineering

, analysis proves that the OTSGs will recover and the event is self mitigatmg without operator action.

t.

PAGE 10

!NTEGR ATED VERIFICATloN TEAM REPORT STEAM GENERATCR TUBE RUPTURE Modifications affecting the short term and long term actions from this accident great!y reduce operator burden. Modifications reviewed were:

e HPI Recirculation to the unp

• FST CDT Crosstie e - EFW Cavitating Ventum

. EFW Flow Control Modules e RM-G 26,27 Replacement There were no modifications reviewed which significantly change the mitigation strategy of the SGTR event. The modifications above reduced the operator burden in diagnosis of the event (RMGs), early in the event (EFIC/EFW improvements), and later in the event (FST-CDT Crosstie for cu .aminated water management).

EOP-6 was reviewed and discussions were held with Gary Becker of the EOP group.

Question, were raised about the secondary plant operator (SPO) action to establish blowdown euly in the event. This could conflict with priorities of a rapid plant shutdown which works the SPO quite heavily in maintaining secondary plant stability. The EOP group acknowledged the potential burdea and agreed that priorities from the MCR would be necessary. Additionally, all the steps were field validated with the assumption of only one SPO, which is conservative because two SPOs are required per shift in accordance AI 500. It appeared adequate thought went into this in the writing of the procedure. Another question was raised concerning the increase in the "If at any time" steps which add mental burden to the procedure reader and the control board operators. To help alleviate potential conflicting priorities, the EOPs were better human factored in regards to facing pages and carry forward steps. The pages are easier to read and new consistent standards on the use of the facing pages should add improvement to the training program. A contracted human factors specialist assisted in formatting the new EOPs.

The use of Tuie Rupture Alternate Control Criteria (TRACC) was discussed. Tne use of TRACC limits is in accordance with the FTI Technical Basis Document. In aggregate, the response to the SGTR has not been adversely affected by outage activities, modifications, or procedure changes.

Areas ofRecommended Follow Up

1. The Chapter 14 description of the SGTR should be clarified to ensure initial assumptions of the accident are clear in all cases. Assumptions as to the status of offsite power and single failures are inferred from the discussion but need to be clearly discussed.

2. At some point in the future, an actual test of the use of FST 1 A to accept water from CDT 1 should be run. This new flow path is untested, yet straight forward.

.PAGE 11

INTEGR ATf D Vf RIHCATION TE AM REPORT I l

FUEL IIANDLING ACCIDENT Few modifiestion activities affected this accident scenario. Modifications to the radiation monitors which have been on going for several years have enhanced the ability for operators to diagnose the pathway of a release through rnore reliable monitors. Other modifications were t-viewed.

. 94-04-11-02 Spent Fuel Area Lighting

. 97-04-05-01 AHF-8A Vibration Repair

. 9709-0401 Frimary Gamma Ray Particulate Calibration (RM-A6)

. 97-09-07-01 Code Compliance Modification for Spent Fuel Cooling

. 97 10 11 01 Molded Case Circuit Breakers

. 97 07-05-01 CREVs Improvements FP-203 was verified to contain steps for initial conditions relative to water level, radiation monitoring fuel move planning, and personnel responsibilities. These precautions ensure the initial conditions assumed in the FHA in the FSAR are met. The improvements to the CCHE were noted to be a positive effort to protect the operators, thus relieving burden and adding margin for toxic gas situations and radiological accidents. Overall, there were no adverse effects of the outage activities for this accident.

A reas ofRecommended Follow Up It was noted that FP 203 needs to be updated with the new procedure references for pre-job briefings. A NUPOST entry was made-ROD EJECTION ACCIDENT There were two cases analyzed from a reactivity standpoint, zero power and full power-Operator actions for each revolve around mitigation of the resulting LOC A caused by the open penetration in the reactor vessel head. This operator interface for a LOCA is bounded by the discussion in the LOCA section of this report. There were no modifications or EOP changes which affected the reactivity conditions of this accident.

LOSS OF COOLANT ACCIDENT The mitigation of the LOCA was a major focus of this outage. Accordingly, several activities assessed the overall design margins and operator burden issues. Early in the outage, an expert team was formed to essentially perform and detailed FMEA of the LOCA scenarios.

This team was also charged with development of solution sets to e ;ure the worst case accidents were mitigated. Later, restart issue D-16 performed an aggregate safety assessment of the outage modifications. The conclusions of this assessment were:

l PAGE 12

. . . . . - - . - . - = - - ~ . . - ~ . - - . . . . .

. , , . __.. . . . - - . . .- .~ .. . . _ , . , . . - .

INTsGR ATED VERIFICATION TEau RtroRT

1. ' The installation ! of certain modifications and procedure changes improve accident-management response for the identified scenarios.

2. - Accident . mitigation- improvements can be realized by any of the defensein-depth capabilities discussed.

3. - The sum total of[ operator actions) effect will be determined by a combination of table-top and simulator validations to assess that each action can be accomplished within.the assumed time or condition limit.

Modifications pedormed after this assessment were reviewed for effect on the above conclusions. - Modifications reviewed were:

e 9602-09-01 HPI Flow Upgrade s 96-07 15 EGDG Stand by Keepwarm System (DL & DJ)

= 96-07 17-01  : RCS Pressure Low Range Instrument Upgrade e 97 03-04-01 Main Control Room Noise Reduction a 97-04-03-02 AHF 22 HVAC Appendix R Modification e- 97-05-15-02 EDG Radiator Replacement

. 97 06-20 01 Letdown Lin: Valve Addition e 97 06 21 01 LPI Crossover Flow Instrumentation Upgrade

. 97 07 01 01 AHF-1C EDG Loading Control, MCC 3AB Interlock e 97-07 05-01 Control Complex Emergency Ventilation

. 97 07 10 01- FST/CDT Crosstic e 97 08-01 01- EDG Protective Relaying Reconfiguration

. 97 10 09 01 MU Bypass Flow Measurement

. .97 10 13-01 Appendix R Bypass Switch for MUV- 23,24,25,26 4

s 4

I PAGE 13

, p w - ., , , ,. , . - - , -, - +

1 l

I IN78GRQ1tD ViklficATloN TI ACD RIPoki Thew modifications can be trouped into 3 categories: equipment protation, procen hdication, and safety marl in improvements.

Equipment protection is affordal by maintaining the EDG in a more ready state throuth better control of the Keepwarm systems, better ventilation for both the EDG room and the EDG control room, and more stratesic Protective relay operation. (At the time of this report, NRC approval of the LAR for the addition of the protective relays may not make stan up; therefore, it may be nueuary to remove the modfication which contained a USQ. No .

further iciormation wm available for the decision was not finalimi).

Proceu indication is improved with the addition of more accurate and emier to read digital indiutors for several process flow paths. A quntion was posed to the Supervisor, Simulator 1 Training and a Chief Nuclear Operator if the mined un of di lital and analog indicators cauwd I any problems during fast moving transients. The concern was that tL operator needs to m.ntally make the transition from reading a dyital indicator to analog scale which is sometin.es not linear. Both stated that there was absolutely no indication of caperienced -

operators nalling due to this transition. There wm no information available for t me newer operators since they are not through the clus yet.

Safety margins have been enhanced by modifications to ensure leaks art properly isolated.

EDG load is limbed throush ensuring only the necessary RB cooling is in service, ensuring IIPI injection valve power under all circumstances, and additional options for EFW water supply storage as wel: as contaminated water storage after a SGTR. Even though there is some operator action required to implement thew modifications, the actions allow for a return to normal mitigation strate'gies that were otherwise diabled, or not available due to capacity or inadequata mars:n.

All of these modifications contain no additional operator burden bayond the training spects of new setpoints and protective relay scheme.

4

-In addition in the review of modifications, the 11PI System Engineer participated in a discuuion on modifications and maintenance inues related to the Make Up and Purification System. luues discuma were:

e The 1101 Reci culation Line to RB Sump modification. The modification is not quite complete. The 4 MUVs will have to be powered up prior to ,

4 uw. The IVT reviewed the EOP and determined the guidance to the operators was adequate, e MUV 25 Acoustical Vibration. A modification was installed this outage to ,

continue the acoustical monitoring of the llP!line to determine the origin .  !

of the noiw coming from this line. Thermal sleeve problems were not totally ruled out by the investigation, yet it we de-mined that the sleeve was not loow.

. .The status of MUllE lC regarding the isolation of MUV 505 and the

-instrllation of MUV %7. The C Letdown Cooler can not be put into PAGE 14 o __ --__--_- -_-. - ----------------

INTIGR ATID VIRIFIC ATloN TR AW RIPoRT service from the MCB since MUV.505 has the power removed. Effons are continuing to re. power the valve, yet for this cycle, as in the past, it will be a manual action with a Reactor Building entry to put the cooler in service.

. The limitations on the SW system versus letdown flows. The system engineer had worked hard at relieving the operator burden ort worrying about letdown Dows through the downstream components. Limitations on the SW flow for both letdown cooler vibrational concerns and SW system temperature has caused engineering to propose a series of cunes showing letdown flow limitations.

.  !!PI system how balanci..,,. The use of the stop check valves for both flow balancing of each pump (PT-444) and the primary isolation valve for tagging out the pumps was questioned during the engineering r, elf aswssment. The issue comes down to methods of positioning the valve, both during the flow balance and during tagging operations, and the lidelity and repeatability of the *rumber of turns" method. The IVT determined that adequate planning is going into the issue yet scheduling the test to determine the fidelity and repeatability of the positioning has not yet occurred.

. MUP flow margin. The system engineer reponed that there is approximately 10% flow margin in the MUPs at tl.is time with loss of offsite power. If no LOOP is experienced, thert is much more margin.

Discussions contained in the EOP section of this repon confirm the summary statement 3 of the D-16 Aggregate Safety Assessment dealing with the timing and limitations of operator actions. With the exception of the Control Complex Chiller issue regarding the timing of restan, operator actions appear well connected to the analyses.

None of the modifications affect in an adverse way tl.e summary statements contained in the D-16 Aggregate Safety Assessment. There are a few activities not yet resolved which need follow-up to ensure the assumed staff burden and licensing basis is maintained.

Arc.n ofRwommendalFolloto Up

1. Continue to work on the design basis calculations for the SW temperature issues. Several competing problems dealing with RBCU, CC Chillers, and Letdown Flow have brought the performance of this system to the forefront of operator burden.

2. Make it a priority to perform a stroke on the MUP stop check valves to determine if PT.

444 needs to be run in Mode 3. If it needs to be nm, then the excessive cooldown of the presmrizer needs to be resolved.

3. Install a local MUT pressure gauge tc allow for a proper channel check of the tank pressure. There is no redundant pressure indication and the MCB instrument has had i PAGE 15

INTIGRQTID VitlFICATioN Te cM RIPokY history of drifting Worst cue vo41 ate drifts have shown it is possible to operate with the MUT in the Restricted region of the present curve and not have a computer alarm.

MAKEUP SYSTEM LETDOWN LINE FAILURE ACCIDENT The IVT reviewed the MU System Letdown Line Accident as stated in Section 14.2.2.6, and revised for revision 24 of the FSAR. Discussions were held with Paul Fleming (CDIP/S AG) and Gary llecker (EOPs) to describe the FSAR and EOP changes to support this accident. This accident is a breach in the letdown line outside of the reactor building and downstream of the outboard containment isolation valve, MU%49. Upon receipt of a reactor trip, operatws perform the immediate actions of EOP-02. A loss of subcooling margin occurs which is an entry condition for EOP-03.

As discussed in Chapter 14 and further discussed in Chapter 5 (section 5.4.4.2) of the FSAR and proposed changes for revision 24, a break in the high energy ponion of the Letdown Line outside containment is not considered a credible event. Therefore, this accident is described only to demonstrate that the dose consequences remain below 10 CFR 100 limits.

The Chapter 14 discussion states that Operations will isolate the letdown line following a Loss of Subcooling Margin (LSCM) as directed by Emergency Operating Procedures (EOPs).

This activity will isolate the letdown line prior to the ES actuation signal. The early actuation will result in a higher system pressure resulting in 1800 to Y mid across the letdown line isolation valves. As a consequence, FFC has had to increue t . ve air to MU%49 and add a new isolation valve, MU%567, to replace the function of a.b 7 40,41, and 505. The IVT reviewed EOP-03. Step 3.4 of that procedure requires operators to ensure Letdown isolation valves are closed (MUW49 & MU%567). The analysis assumed operator action would be taken at to minutes from the time that fluid in the hot leg piping becomes saturated. This timing usumption is within the capabilities of the Operations crew and therefore concluded to be acceptable.

There is a slight increase in the dose consequence, but it remains well within the 10 CFR 100 limits. This slight increue is discussed within License Amendn.mt Request (LAR) 218.

FPC has not received a response from the NRC concernmg this issue.

WASTE GAS DECAY TANK RUPTURE The IVT reviewed the Wate Gu Decay Tank Rupture (WGDTR) accident as stated in Section 14.2.2.8, and revised for revision 24 of the FMR. There are only minor changes identified with revision 24, none of which requires procedure changes, decreases Safety Margins, or increases staff burden. This accident is the function of a total failure of waste gas decay tank. The assumed contents of the failed tank include a total RCS degas with 1% failed fuel. The ruptured tank will relene its contents into the auxilisry building. detected by various radiation monitors. AP.250 will be implemented based on the radiation monitor alarms. Affected aren will be evacuated. Fans and dampers that are interlocked with the P AGE 16

INTIGR ATID ViklHc ATioN Tsou RtPoRT radiadon monitors that reached the high alarm setpoint (interlock actuation) are verified for proper alignment. If Rht.A5 gas actaates, then the CC ventilation is placed in the emergency recirculation mode of operation.

There is an outstanding issue associated with the Waste Gu Tank piping, seismic concern.

PC 97 2372 identified a possible discrepancy between the FSAR analysis and the plant configuration. This PC is asociated with the seismic issue since the analysis usumes the loss of one WGDT and that since the piping is non-seismic the loss of integrity of this piping could result in the relene of all three WGDTs. The ITS was revised to limit the amount of radioactivity allowed in one tank such that the loss of all three tanks would be less than usumed in the FSAR analysis.

Additionally, FPC is mrrently initiating plant modifications (hiAR 97100101) to ensure conformance to the seismic requirement. These modifications are ongoing and it is anticipated that the piping upgrades will be in place prior to StardUp. A contingency to the htAR completion is to utilire the DR/jCO process.

LOSS OF PEEDWATER AND MAIN FEEDWATER LINE flREAK ACCIDENT For the loss of htFW accident, the primary mitigation strategies involve operation of the EFW system to riipply feedwater to the OTSG and maintaining the appropriate OTSG level.

For the hiFW line break accident EFIC is required to isolate the affected OTSG. RCS temperature is controlled with the TBVr and the ADVs.

Several modifications were completed to enhance accident mitigation capabilities for these accidents. The IVT reviewed thes.e plant modifications against the following EOPs, used in the process to mitigate these accidents:

EOP-02 Vital System Status Verification EOP-04 Inadequate iteat Transfer EOP-05 Excessive lleat Transfer EOP 10 Post Trip Stabilization

• EOP 13 Rule 3, EFW Control EOP 14 Enclosure 8, hiFW Restoration Key equipment and processes, included in the EOPs listed above, necessary to mitigate these accidents, were compared to modifications and procedure changes. Discussions of these changes follow.

A motor operator was added to EFV 12. '"his valve is normally de-energized closed and is required to be opened within the first hour of EFW initiation to cross connect EFW for certain accidents. Adding the motor operator allows remote operation of this valve from the Control Room, relieving Operations personnel of the unnecessary burden of entering the 95' elevation of the Intermediate Building to complete this task manually (hi AR 96101096101001).

, l' AGE 17 i

i 1

INTi( a ATsD Vf RiflC ATloN TI Au Rt tort l l

The OTSG level control function of the EFIC Control Module was enhanced. The )

objective of this design change is to reduce operator burden due to deficiencies in this control  ;

module. This change will reduce the excessive interaction required during cenain accidert l scenarios to prevent overcooling events and when switching from autonnatic to mantia' control (MAR 940602-01).

' The automatic opening of ASV 204 on an "A" EFIC actuation was restored, in order to restore the load sharing capability of the EFW system. This was done to reduce the load on the "A" EDG, and to suppon the delivery of flow to the RCS Although there is no change in operator burden, this change maintains the Technical Specification margin to safety (MAR 94 21 01 01).

Cavitating ventures were added in the EFW pump discharge piping to prevent excessive pump flow. This will eliminate possible high flow induced failures such as run out and madequate NPSHa that could result from cenain single active failures. This change will reduce operator burden early in the accident, in that it is not required to take manual control of EFW until funher inte the accident (MAR 941042-01).

PC 97 5981 was generated to identify a concern where differential pressure between the two OTSGs can cause EFW to be interrupted to the higher pressure generator and result in the operator having to take manual control of the EFIC control valves in order to meet EOP criteria. An evaluation will be conduced after stanup to upgrade the control system to funher minimize operator intervention during cenain EF actuations. It has been determined that operator action is not required to meet design basis considerations. This will be communicated to the operators prior to entry into Mode 4 per Corrective Action 1 of PC97-

$981.

A standby diesel generator was added for a backup power supply to the Auxiliary Feedwater pump in the event of a Loss of Offsite Power (LOOP). In the event that EFW is not available. AFW will be placed in service. There is no change in operator burden to prepare the AFW pump for operation; however, there is an increase in operator burden to power the AFW pump from the standby diesel generatcr. The AFW pump is non safety related and, therefore, a defense in depth component. The increase in operator burden is offset by the benefit of the backup power source, and is only realized in the unlikely event that EFW is not available.

The nitrogen bottles on the ADVs were replaced with bresthable air bottles. Although this backup supply of operacing air is not required for these accidents, it provides deferee in depth to ensure operation of the ADVa for RCS temperature control (MAR 9607 09-01).

PAGE 18

' INTECROTID tflBlPlCATU)N Tl AM Rt Pok7 SPECIAL TOPICS i l

L BORON PRECIPITATION  :

I The IVT reviewed the boron precipitation issue through intervirws and reviews of safety assessments and procedures. The effects on operator and chem'.stry staffs were studied.

Discussions were held with Paul Fleming (SAG /CDIP) and Ron Faller (Chemistry Manager) j as to the timing of mitigative actions. The resolution of this issue has added burden to both the Chemistry and Operations staff, starting as early as $ houn into the LOCA event. The IVT determined that:

, \

1. Operations pro:edures adequately coves 4 actions required by the analysis  :

2. There was adequate consideration for the Opations/ Chemistry interface j

- 3. Chemistry capabilities ne adequate and staff limitations we factoM into both procedures

• and communications l

The IVT concluded that this activity coordination is adec,uate.

Arsss ofRecommendedFollow Up

1. Increase the reliability of the Boronometer in the PASS system. I resently i it has a 23%  !

down time causing reliance on a backup method of sampling the RB sump. This in turns adds further linutations on Chemistry based on dose and manpower.

2. Continue to work on the Chemistry burden iraposed by all of the EOPs and ensure there is a clear understanding between what Operations expects and where Chemistry can  ;

physically deliver, especially on the timing of sample results.

3. Continue development of the Hot Leg Injection methodology to provide a secc.nd back up -

method from 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> into the 1.OCA event.

4. Evaluate the installation of the RCS blowdown line to eliminate boron precipitation as's i

concern. In addition, thie would eliminate any concern with mission time of LPI, loading on EGDG 1 A (if sind properly), and minimiu the time dependency on EFW for LOCAs.

EMERGENCY OPERATING PROCEDURES 6

A discussion was held with Gary Becker of the EOP group. The EOPs were first issued in 1993 yet contained many inconsistencies which led to enforcement by the NRC in inspection Report 9316. The EOPs were patched up in response to this action, yet were still not made PAGEl9

'y-$-W v y 'g & y uMg

• 4* $l- e e- - y -%---Sr2"W'D' -Mtf* *7t-Wi--E"Ptt'"'W--Tf-l-N-f W t-t= MW t'**"i'- e4 m"' ' - " - - - - -- - " - ' "'d'* ' +-***-* '

!NTICR ATID VIBIFIC ATION Ts AM RIPoRT consistent with the design of the plant. Operators had always written the procedures with little input from the ,'esign staff. In 199 8, the MUT event caused a hud look at the EOPs and the way the plant was dnigned. Guy Becker was put in chuge of the small staff of procedure writers and began to uncover additional areas of concern where the operating practices of the plam diverged from the design. In July of 1995, a team was put together to assess each and every step of the EOP which produced a myriad of comments and needed changes, it was these effom which were the cata'yst for the issuance of the new EOPs this outage.

Some of the additional changes made were to extend the usefulness of the EOPs down to decay heat removal. The old EOPs referred to operating procedures which were often confusing to follow with the accident conditioru. Operators essentially had to usa the normal operating procedures with exceptions to achieve the desired result. Now, the EOPs will bring the plant to a stable completion of the cooldown which is a tremendous enhancement. Other enhancements include:

1. Field validations and time sequencing of 41 steps

7. Staging of EOP tool boxes throughout the plant

3. Speciallabels with reflective tape for easy identification 4 Photographs of the plant equipment for training and precedure development S. Reformatting of the EOP pages relative to NOTES, CAUTIONS, and STATUS.

6. Other more subtle human factors changes in the writing of the procedure such as fold out pages, bullets, reduced clutter on facing pages. Noted that the use of an outside expert for human factors improved the use of the procedures.

7. Independence of the EOP and operating procedures through the use of additional enclosures la aggregate, the IVT was impressed with the completeness and detail of the EOPs. These cleuly provide a better tool for the operators. There were several technical issues discussed and these will be included in the specific accident discussions. The following open items were developed:

1. The burden on the chiller actions had not come to resolution. It was preliminarily stated that the chiller will be taken off of the 480 volt ES lockout to ensure the continued operation of the units for control room cooling. A later issue was discovered where the SW system analysis bued on RBCU cooling concerns was not being adequately integrated with the EOP needs to get the chiller stuted after EDG load management. The RBCU design engineer was not aware that the EOPs had :onsistently achieved chiller start up within 4040 minutes where it was thought that 8) minutes was the limit. The RBCU design engineer was relying on a minimum of 80 minutes so that he could prove that the chiller would not trip on high vapor pressure from the elevated SW temperatures from the RBCU concern. The 80 minutes was needed for the RW system to reject enough of the stored heat from the SW system. The RBCU design engineer was instructed to integrate his activity with the EOP efforts. (See detailed write up in " Service Water Overheating" below.)

PAGE 20

. - -.-- _ . - . _ _ _. - ~-. . _ ~ . - , - . _ - - . ~ _ _ . _ - - - - _ _

INTIGs Af f D VIsiflC ATioN Ts AM RIPos?

1

2. It was suggested that Chemistry look at providing the best quality water that is }

economically feasible for FST 1 A since this water may be used as a source of feedwater in l' the OTSG This may include periodic cleaning or enhanced water chemistry.

! I SERVICE WATER SYSTEM OVERHEATING During the evaluation of Restart Item D48, ' Design Calmistions for SW System Heat Loads,' engineering discovered that the analyses p?rformed in 1987 to support the increase in i design basis ultimate best sink (UHS) temperature from 85 to 95 'F were deficient.  ;

The delraded condition centers around the limited ability of the SWHE to transfer post- .I accident heat loads from the Nuclear Services Closed Cycle Cooling Water system (SW) to the ,

' i Nuclear Services Seawater system (RW). For the limiting Loss of Coolant Accident (LOCA),

SW could remove mo:e heat from containment through the Reactor Building (RB) fan coolers than the RW system can remove from SW. This mismatch in heat removal results in SW  ;

temperature enreeding its design limit of 110 'F. The equipment cooled by SW could fail to  ;

perform its cafety function if the SW design temperature is exceeded.  ;

Previous analyus (including original SW system design and sizing studies) assumed the RB fan coolers operated in the worst case degraded (fouled) condition and the fan coil cooling water (SW) flowrate was at the minimum design point of 1780 gpm. With these assumptions, SW was capable of removing the design heat load and rejecting it to the UHS. These '

assumptions are conservative with respect to the containment peak temperature and pressure analysis but not for the maxirram SW load calculation. Recent analyses have shown the SW  ;

system becoming overloaded due to excessive heat removal from the RB by the RB fan coolers following a postulated LOCA. l After a LOCA, the maximum allowable SW temperature could be exceeded if the ,

~

following conditions exist: the RB fan coolers are actually in a clean, non-degraded condition; two SW pumps are providing greater than 200C spm to each RB fan cooler and one RW pump is in service (the single failure of the wcond RW pump is limiting for this scenario). These conditions result in a considerably greater predicted heat transfer rate from the RB atmosphere into SW via the RB fan coolers. At high UHS temperatures, the additional heat load in the SW system exceeds RW system capacity and causes the SWHE outlet temperature' (returning a to SW loads) to exceed the 110*F limit. _ Exceeding the SW design basis temperature could i cause the failure of the SW cooled loads and lead to unacceptable accident mitigation capability.  !

Analyws have shown for two RB fan coolers with minimum fouling and SWHEs with wro blockage, the maximum allowable UHS temperature is 81.1'F. If only one RB fan cooler i is in wrvice, the allowable UHS temperature increases to 95.4*F due to the decrease:1 heat load.

- However, as the blockage of the SWHE increases, the maximum allowable UMS temperature

- decreases due to the decrease in RW flow. For example, if two RB fan coolers we in service,

- with 20% blockage, the maximum allowable UHS temperature is 76.6*F, With only one RB fan cooler in, service, and the same level of blockage, the maximum allowsble UHS  !

?

PAGE 21  ;

i

, , - ,m e n - ,-gn, -, v,7 4, , - vmc w -v - m + + 0 - ,? . , - - A , - , en , ,- - a im - , - a,A .+-..%- - - - - - - . - - .l-r--.+4- --

a

!8Mf Gaof f D VistflCAfl0N TI AM RIPosT

\i i

temperature is 92.8'F. liigher levels of blockage will result in ever lower acceptable UllS Temperatures.

The original design buis usumed an 85'F UllS temperature that resuhed in a peak SW g temperature of 105'F. UllS temperatures routinely surpus 85*F in the summer, therefore, the license and the analysis needed modification. Licensing Amendment 109 (2/14/89) changed the UllS temperature from 85'F to 95'F. A UllS temperature of 95'F results in a peak SW temperature of 110*F. The maximum UllS temperature of 95'F is verified every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> by improved Technical Specifications (ITS) Surveillance Requirement 3.7.11.2.

Based on a revision to calculation M94-0056, ' Allowable SW11E Tube Blockage vs. UliS Temperature *, the UliS is OPERABLE and two fan operation is acceptable as long a the UllS temperature is below the limits listed in M94-0056, liowever, the system is considered "not fully qualified" since it cannot perform its required function at all licensed plant conditions (up to 95'F). The SW and RW systems are also OPERABLE but not ful.ly qualified since they are not capable of tramferring post accident heat loads to the Ulls under all required conditions.

Surveillance Requirement (SR) 3.7.11.2 requires UliS temperature to be equal to or less than 95'F in order to be OPERABLE. If UllS temperature exceeds 95'F then the UliS is not OPERABLE and the required action is to be in MODE 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />, in the current RB fan cooler ES logic configuration, two fans will start on an ES signal. Even with minimum SWIIE tube blockage, the SWHE outlet temperature could exceed 110'F if the UllS temperature is above 81.1'F. Therefore, plant operation could be within Technical Specification limits but outside the safety analysis. This conditior. is a nonconformance and wm reported in LER 97-025-00.

FPC ha chosen to address this issue in three activities: 1) Prepare an evaluation to allow startup and continued operation,2) Install a RB fan run logic MAR, in the interim, to restoie qualifications of the SW System, and 3) Perform a study to evaluate .he RB fan logic modification and other alternatives to restore full qualification to the RW Systerr. Each is detailed below.

Justi$ cation for Continued Operation The purpose of this JCO is to allow startup and continued operation with SW, RW and Ultimate licat Sink (UliS) that are OPERABLE, but not fully qualified. Operation will be allowed only while UllS temperatures remain below the limits specified in OP 103B, Curve 15 (maximum temperature 81.1'F), until a modification is installai that will permit operation with UliS temperatures up to the current Improved Technical Specifications (ITS) Limit of 95.0*F.

OP.103B, Curve 15 will be revised to account for the reduced allowable UllS temperatures from M94-0056. These reduced administrative limits in OP 103B, Curve 15 (maximum temperature 81.1'F), will remain in effect until modification (MAR 97 09-05-01) is installed to limit operation to one RB fan cooler following a LOCA. After the modification is PAGE 22

INilGRQ1Et) VIRHicQTioN Ti AM R!roRT installed, OP 103B Curve 15 will be revised to the previous limits which correspond to an allowab!c maximum Ulls temperature of 95F (ITS 3.7.11.2 limit).

Another comideration during the interim before MAR 97 09-05-01 is installed is the measurement of UllS temperature. When performing surveillance requirement 3.7.11.2, the UllS temperature is normally taken from RW 19 TI, RW Pump Discharge lleader. During normal operation of the RW system, a portion of the intake water is recirculated to maintain RW temperature above 78'F to prevent thermal shock to equipment (this is not a concern post accident because the recirculation flow is terminated on an ES signal). Due to the elevated ternperatures caused by the recirculation of RW, this indication is not an accurate measure of the true UllS temperature. The elevated RW temperature would not meet the more stringent limits set out in OP 103B Curve 15. Therefore, to get an accurate measurement of the UllS temperature, CR 3 will use the Circulating Water temperature indication which is not preheated.

The SW and RW systems are capable of removing post accident heat loads while UllS temperatures are below the limits specified in M94-0056. Therefore, continued operation below these temperature is acceptable for MODES 1,2,3 and 4. The concern with the UllS temperature is not valid in MODES 5 and 6 since a high-energy LOCA is not possible in these MODES.

Corrective Action to Obtain Full Qualification As an interim method of restoring qualification, a modification (MAR 97-09-05-01, RB Fan Run Logic) will be installed that will allow one and only one RB fan to start on an ES signal.

This change will limit the heat load on the SW systern such that the RW system can reject enough heat to maintain the SW system below 110 F with UHS up to a temperature of 95.0 F.

The proposed change to the RB fan run logic has been determined to constitute an Unreviewed Safety Question (USQ), This also adds a train interdependency which must be carefully reviewed. License Amendment Request #224 was PRC approved (conditionally) on 11/24/97 with several conditions, including ensuring tl.e SW flow balance remains valid under all operating conditions. Therefore, NRC approval is required before implementation of the modification. FPC will request that the NRC approve the USQ by February 13, )998 to allow implementation of the modification before Ulls temperatures rise above the limits set out in OP 103B, Curve 15. UIIS temperatures generally rise to unacceptable levels after mid March.

Due to the complexity of this issue, FPC will perform a study to evaluate the RB fan logic mcdification and other alternatives to restore full qualification to the RW system. This review will be complete in the first quarter 1998.

PAGE 23

jNTIGRQTf D VIRHfC ATloN Tt AM RtPoRT  ;

ProceduralImpact Bued upon the current analysis there is a need to revise OP 103B and SP 300.

OP 103B, Curve 15 will be revised to account for the reduced allowable UllS temperatures from M94-0056. These reduced administrative limits in OP 103B, Curve 15 (maximum temperature 81.1'f-), will remain in effect until modification (hiAR 97-09 05 01) is i istalled to limit operation to one RB fan cooler following a LOCA. After the modification is installed, OP 103B, Curve 15 will be revised to the previous limits which corr (spond to an allowable maximum Uf IS temperature of 95'F (ITS 3.7.11.2 limit).

Additionally, SP 300 needs to be chariged to account for the lower UI-IS tcmperature.

Sequence # 89, on page 9, will have new min and max tolerances and the temperature instrument equipment identification will change.

Overall, the above discussion shows adequate coordination of issues with resolutions planned. No additional aren were recommended by the IVT.

CONCLUSION The team concluded that overall effects of the modifications and procedure changes enhances the ability of the operator to prevent and mitigate accidents. There is also an obvious increme in the knowledge level of the staffe most notably the system engineers, operators, and design engineers. Activities whm deliciencies cristed during normal operation have been repaired or analyzed to relicve the operator burden and ensure stable operation. Emergency response has also been enhanced through thi, gain in knowledge of the design and licensing basis of the plant, and through madifications performed and iu process to the Technical Support Center aad Emergency Operating Facility. The aren needing follow up contained in tl.is report do not constitute a weakness in the ability to rafely operate CR 3, yet are part of the present efforts to resolve potential issues and fine tune the design and licensing basis of the plant.

PAGE 24

INTICRATs0 Vf RIFRAlloN TI AM REPORT APPENDIX Areas ofRecommendedFollow Up

1. It has become apparent the Atmospheric Dump Valves ue utilized for several plant scennios. The IVT determined that much attention should be given to these valves. In the past, CR 3 has operated with at least one of these valves isolated NOD 31 should be reviewed by Operations to ensure the required actions are corr sensurate with the safety significance of the valves. There is a significant difference in c cations relying on the MSSVs versus the ADVs as to the case of response to transiet.. md control of the secondary systems.

2. The Chapter 14 description of the SGTR should be clarified to ensure initial assumptions of the accident are cleu in all cases. Assumptions as to the status of offsite power and single failures are inferred from the discussion but need to be clearly discussed.

3. At some point in the future, an actaal test of the use of FST 1 A to accept water from CDT 1 should be considered. This new flow path is untested, yet straight forward.

4. Continue to work on the design basis calculations for the SW temperature issues. Several competing problems dealing with RBCU, CC Chillers, and Letdown Flow have brought the performance of this system to the forefront of operator burden.

5 Make it a priority to perform a stroke on the MUP stop check valves to determine if PT-44, needs to be run in Mode 3. If it needs to be run, then the excessive cooldown of the pressurirer needs to be resolved.

6. Install a local MUT pressure gauge to allow for a proper channel check of the tank pressure. There is no redundant pressure indication and the MCB instrument has had a history of drifting. Worst case to-date drifts have shown it is possible to operate with the MUT in the Restricted region of the present curve and not have a computer alarm.

7. Increase the seliability of the Boronometer in the PASS system for Boron Precipitation.

Presently it has a 23% down time causing reliance on a backup method of sampling the RB sump. This in turns adds further limitations on Chemistry based on dose and manpower.

8. Continue to work on the Chemistry burden imposed by all of th i EOPs and ensure there is a clear understanding between wb .t Operations expects and where Chemistry can physically deliver, especially on the timing of sample results.

9. Continue development of the Hot Leg injection methodology to pmvide a second back up Boron Precipitation method that would be valid from 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> into the LOCA event.

10. Evaluate the installation of the RCS blowdown line to eliminate boron precipitation as a concern. In addition, this would eliminate any concern with mission time of LPI, load:n;;

PAGE 25

[ -

- - . - -- -- ~ _ -- - . . - - - - - - . - . _ -

lNTsGB ATID VikiFICAftoN TicM RitoRT on EGDG 1 A (if sind properly), and minimiu the time dependency on EIN for LOCAs. ,

11. The burden on the chiller actions had not come to resolution, it was preliminarily stated  :

that the chiller will be taken off of the 480 volt ES lockout to ensure the continued operation of the units for control room cooling. A later issue was discovered where the SW system analysis based on RBCU cooling concerns was not being adequately integrated ,

with the EOP needs to get the chiller started after EDG load management. The RBCU design engineer was not aware that the EOP: had consistently achieved chiller stan up within 4%0 minutes where it was thought that 80 minutes was the limit. The RBCU design engineer was relying on a minimum of 80 minutes so that he could prove that the SW system would not exceed maximum design temperature, yet the chiller trip on high vapor pressure from the elevated SW temperatures had not been considered. The 80 minutes was assumed in the analysis to show the RW system could reject enough of the stored heat from the SW system. The RBCU design engineer was instructed to integrate his activity with the EOP cfforts.

12. It was suggested that Chemistry look at providing the best quality water that is economically feasible for FST.1 A since this water may be used as a source of feedwater in the OTSG. This may include periodic cleaning or enhtnced water chemistry.

13. To relieve the EDG loading issue with EGDG 1 A, it was once considered to provide EFP-1 with a dedicated emergency diesel generator. Although this was discounted for the option to upgrade the existing emergency diesel generators, it may no r be more cost effective and provide more positive margin to provide EFP 1 with dedcated power.

During the existing upgrade efforts, additional limitations on the EDGs have been realized, specifically in the clutch / drive shaft for the radiator fan and in the inlet air temperature.

This option should be re-evaluated based on present knowledge and limitations.

A PAGE'26 4

y.-ya,my .,as.r, -, y-. ,m, y c ,.e- - - - , - - - .-. - ,---,4 c y s - - e. . --,,-.w,w- .- ,- . - - - - - - - . w,= w-r,-,w,v