ML20202G726

Responds to NRC Re Violations Noted in Insp Rept 50-483/97-15 & 50-483/97-17.Corrective Actions:Lsels Inhibit & Esx Bypass Protection Relays Should Be Included in Scope of TS to Satisfy Its Intent

ML20202G726
Person / Time
Site:	Callaway
Issue date:	11/14/1997
From:	Randolph G UNION ELECTRIC CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML20202G546	List: ML20202G542 ML20202G726
References
50-483-97-15, 50-483-97-17, ULNRC-3668, NUDOCS 9712100096
Download: ML20202G726 (19)

Text

--- -

4 3

Cony L Ranh%

0\'lON ' " " '

?

ISLECTRIC "

i M November 14,1997 ./

U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop Pl.137 Washington, DC 20555-0001 ULNRC-3668 Gentlemen:

REPLY TO UNRESOLVED ITEM INSPECTION REPORT NO. 50-483/97015 CALLAWAY Pt; ANT This responds to Mr. Thomas P. Gwynn's letter dated September 22,1997, which transmitted an Unresolved item for events discussed in Inspection Report 50-483/97015. A second example of the Unresolved item was identified for events discussed in Inspection Report 50-483/97017. Mr. W. D. Johnson's letter dated November 12,1997, requested that our position on this second ermple be included with our response to Unresolved item 50-483/9715-01. As such, our response to the Unresolved item is presented in Attachment 1. On October 8,1997, Mr. W. D.

Johnson authorized a response duc date of November 14,1997 None of the materialin the response is censidered proprietary by Union Electric.

The unresolved items are not nuclear safety issues but are issues regarding tl.e latitude licensees may use to implement Technical Specification requirements. Nevc;thelen, the resolution of this item may have a substantial adverse effect on the ability to perform maintenance activities and post repair testing without a plant shutdown. This circumstance could impact thousands of components which can be safely tested at power. It should also be noted that the Callaway Plant Technical Specifications are based on the Standard Technical Specification language. We believe concerns regarding application of"at shutdown" Technical Specification surveillance requirements are therefore generic to the indusuy 9712100096 971205 PDR ADOCK 05000483 G PDR Cf@LC63

~

l ULNRC-3668 November 14, i997 Page 2 Due to the generic nature of this Unresolved Item, we are requesting an opportunity be provided to exchaage perspectives on this matter, prior to disposition by the NRC Staff. Please contact us at your convenience so the necessary arrangements can be made. If you have any questions regarding this response, or if additional information is required. please let me know.

Very truly yours, Y% f G. L. Randolph Vice President and Chief Nuclear Officer GLP/ MAR /tmw

Attachment:

1) Response to Unresolved item

Attachment:

2) Applicable Technical Specifications and Bases 1

- _ _ - - _ _ _ _ _ _ _ _ ~ _ _ _ _ _ _ _ - _ _ _ _ _ - _ _ - _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ______ ___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____ _

F  !

ULNRCo3668 November 14,1997 Page 3  ;

cc: Mr. Ellis W. Mersci off Regioaal Administrator U.S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011 8064 Senior Resident inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Barry C. Westreich (2 copies)

Acting Licensing Project Manager, Caliaway Plant Office of Nuclear Reactor Regulation U. T.. Nuclear Regulatory Comrnission Mail Stop 13E16 Washington, DC 20555 2738 Manager, Electric Department Missouri Public Service Commission PO Box 360 Jefferson City, MO 65102 Mr. Tnomas A. Baxter Shaw, Pittman, Potts, & Trowbridge 2300 N. Street N.W.

Washington, DC 20037 Manager, Plant Support Wolf Creek Nuclear Operating Corporation PO Box 411 Burlington, KS 66839 t

y l

Attachment I to ULNRC-3668 ,

November 14,1997 Page1 Statement of Unresolved item l

ht Example: NRC Inspection Report 50-483/97-15 Section M1.3 On September 4,1997, the Licensee discovered that contacts in the load shed and ,

emergerg load shed and emergency load sequencer circuit that inhibit the auto start signals of certain pumps were not being tested. The affected pumps were the component t ooling water, the essential service water, and the motor-driven auxiliary feedwater pomps.

The contacts and associated relays that inhibit tLe autoinatic start of the affected pumps were part of the loading logic for the emergency diesel generators. The inhibit function develops in the load shed and emergency load secuencer logic to prevent out-of sequence loading of the pumps onto the emergency diesel generators.

The Licensee considered the failure to test the inhibit function as a failure to perform certain Technical Specifications surveillances. The ' icensee determined that the surveillances were:

• Technical Specification 4.8.1.1.2.g.2)c)2)- verifies that a loss-of offsite power signal energizes the auto-connected shutdown loads through the shutdown sequencer; a Technical Specification 4.8.1.2.g.3)d)- verifica on a safety injection signal without loss of offsite power that each emergency diesel generator auto starts and the offsite power source energizes the auto connected (accident) loads through the loss-of- '

coolant-accident sequencer; and i

e Technical Specification 4.8.1.1.2.g.4)d)- verifies on a safety injection signal that each emergency diesel generator auto-stans and energizes the emergency busaes with permanently connected loads within 12 seconds; and energizes the auto-connected emergency (accident) loads through the loss-of-coolant-ac-ident sequencer.

The shutdown sequencer activates following the detection of undervoltage on the 4160 Volt Class IE busses. The loss-of coolant accident sequencer activates on a safety injection signal.

Technical Specification 4.8.1.1.2 8 state that the testing be performed "At least once per 18 months, during shutdown." The Licensee determined that testing of the sequencers could be performed at power without any du,% ental effects. Consequently, the Licensee developed a testing plan, wrote a safety evaluation, and issued work authorization L documents / The Licensee justified performing the testing at power because:

i i

4 . _ _ _ _ _ _ . _ ,, , , _ _ , . . _ ,

Attachment I to ULNRC 3668 November 14,1997 Page 2 j

• Technical Spec fication 4.8.1.1.2.g applied to testing of the entire load shed and emergency load sequencer system. Testing would oniv be performed on a small part of the entire load shed and emergency load sequencer q Jtem;

• The basis for Technical Specification 4.8.1.1.2.g stated that the restriction on performing the testing while shutdown was due to perturbations to the electrical distribution systems that could challenge continued steady state operation. This specific testing would not lead to perturbations to the electrical distribution systems that could challenge steady state operation; and

• The same testing would be performed with sequencer relays that happened to fail with the reactor at power.

The Licensee entered Technical Specification 4.0.3 for Emergency Diesel Generators A and B at 9:40 a.m. on September 4,1997. The tests were conducted successfully. The Licensee exited Technical Specification 4.0.3 for Emergency Diesel Generator A at 7:12 p.m. on September 4,1997. The Licensee exited Technical Specification 4.0.3 for Emergency Diesel Generator B at 8:27 p.m. on September 4,1997.

Although the tests results were satisfactory, literal compliance with the Technical Specifications may have required that the Licensee perform this testing while shutdown.

Since this testing was performed with the reactor 6 approximately 70 percent power, it is possible that the Technical Specification requirements were not met. Further regulatory analysis of this matter is required; therefore, it will be considered an Unresolved Item pending further review (483/9715-01).

Second Example: NRC Inspection Report 50-483/97-17, Section M8.1 (0 pen) Unresolved item 50-483/9715-01 failure to test load shed and emergency load sequencer inhibit circuits.

NRC Inspection Report 50-483/97-15, Section M t.3, described the Licensee's failure to test several contacts in the load s!J and emergency load sequencer circuit that inhibit the auto-start signals of certain pumps. Although subsequent testing demonstrated that the contacts would operate satisfactorily, literal compliance with the Technical Specifications may have required that the testing be performed during shutdown conditions. Since this testing was performed with the reactor at power, there was a potential that Technical Specification requirements were violated.

The inspectors identified a similar Technical Specification compliance issue. The Licensee discovered that contacts on emergency diesel generator bypass protection Relay ESX

Attachment I to ULNRC 3668 November 14,1997 Page 3 were not being adequately tested. As with the inhibit circuit testing, the Licensee identified this problem during Generic Letter 96-01," Testing of Safety Related Logic Circuits," reviews.

The inspectors reviewed:

• Final Safety Analysis Report Section 8.3.1.1.3," Standby Power Supply;

• Generic Letter 96-01," Testing of Safety-Related Logic Circuits";

• Preventive Maintenance Procedure MPE-ZZ-QY1 l l(QY128), " Operational Test Sequence of 4.16KV Diesel Generstor NE01(NE02) Air Circuit Breaker 152NB0111(152NE0211)," N evision 7;

• Suggestion Solution Occurrence Report 97-1168;

• Technical Specifications 4.0.3 and 4.8.1.1.2 g.5; and, 4

• Work Authorization R582371C," Perform a Complete Trip Check in Accordance with MPE ZZ-QY111."

On October 16,1997, the Licensee discovered that contacts on emergency diesel generator bypass protection Relay ESX were not being tested. This relay prevents certain automatic trips of the emergency diesel generators during a safety injection signal or loss of offsite power. The affected trips were.

• Reverse Power

• Loss of Field

• Generator OvercuiTent

• Generator Voltage-Restrained Overcurrent e Generator Ground Overcurrent

• Underfrequency Protection The Licensee considered the failure to test Relay ESX contacts as a failure to perform Technical Specification Surveillance 4.8.1.1.2 g.5. This surveillance required that the automatic trip bypass feature be tested once per 18 months, during shutdown. The Licensee has been testing this feature every 18 months during shutdown by verifying that Relay ESX energizes and an amber light illuminates when one set of contacts on the relay closes. Although this verifies that the relay coil and one set of the relay's contacts

[ . .

l Attachment I to i

ULNRC-3668 November 14,1997 Paga 4 )

function properly, i'. does not verify that all the remaining sets of contacts en Relay ESX can perform the required function. j The Licensee had a separate preventive maintenance test activity, performed every 36  ;

months, that verified that contacts on Relay ESX functioned properly. The preventive maintenance test documents were MPE-71-QYll1 and ?.@E-ZZ-QY128.

The Licensee entered Technical Specification 4.0.3 for Emergency Diesel Generator B at 9:50 a.m. on October 16,1997. The Licensee successfully performed the required testing usint,MPE ZZ-QY128. The Licensee exited Technical Specification 4.0.3 for Emergency Diesel Generator B at 4:54 p m. on October 16,1997 Testing of Relay E3X and associated contacts on Emergency Diesel Generator A, using Procedure MPE-ZZ-QY111, was previously performed . . August 6,1997. The Licensee performed Procedure MPE ZZ-QYll t as part of a :- .iodification test (Modification 95-1021) to install a volts per hertz relay in the Em- .tcy Diesel Generator A control panel.

Although testing of the emergency diesel generators were satisfactory, literal compliance with the Technical Specifications may have required that the Licensee perform the testing while shutdown. Since this testing was perfornied on both emergency diesel generators with the plant at power, it is possible that the Technical Specification requirement was not met.

The Licensee has agreed to include in the written response for Unresolved Item 50-483/9715 01 their position on testing of Relay ESX and associated contacts with the plant a! power. The inspectors will review this issue further pending receipt of the Licensee's written response.

UE RESPONSE:

The essence of this issue is whetherjudgment may be exercised during implementation of Technical Specification requirements.

The NRC has stated that," Requirements that are duplicative, unnecessary, or unnecessarily burdensome can actually have a negative safety impact. They also can tend to create an inappropriate NRC and Licensee focus on ' safety versus compliance' debates.

As the Commission states in its Principles of Goou Regulation, 'There should be a clear

l

)

Attachment I to i ULNRC-3668 i November 14,1997 i Page 5 nexus between regulations and agency goals and objectives, whether explicitly or implicitly stat ed'," '

The Techrecal Specification does not explicitly requise the LSELS inhibit contacts be tested. The determination that testing of the LSELS inhibit contacts was required was based on several reference source documents, and exercising conservative judgment.

Based on a review of the guidance documents referenced in the Bases for Technical Specification 3.8.1.1, UE judged that the intent of the surveillance requirements were to test the function of the LSELS lahibit and ESX bypass protection relay contacts. UE believes this was also consistent with the spirit of the Generic Letter 96-01 reviews which were targeted to identify and correct these types ofconcerns related to testing of safety related logic circuits. Thesejudgments are conservative and prudent based on the sigmficance of the circuitry.

In order to understand this issue, it is important to provide further background and description of the Technical Specification requirements involved (Attachment 2), the testing prior to discovery of the event, and action taken to resolve the discrepancy.

During reviews required by NRC Generic Letter 95-01 " Testing of Safety Related Logic Circuits", it was identified that certain Load Shed Emergency Load Sequencer (LSELS) contacts were not in the surveillance program. These contacts serve to:

1) Inhibit the non sequenced start of Component Cooling Water (CCW) and Essential Service Water pumps from automatic start signals generated from sources other than ESFAS.

2) Inhibit an Auxiliary Feedwater Actuation Signal (AFAS) from starting the motor driven auxiliary feedwater pumps prior to their LSELS sequencer step.

As noted, the contacts described inhibit non-sequenced starting of pumps from start signals other than those explicitly described by Technical Specification 4.8.1.1.2.g.2.c.2.

Therefore, it was uncertain whether the LSELS inhibit contacts were required to be tested under these Surveillance Requirements. Eequest for Resolution (RFR) 18377A was initiated to evaluate this concern.

Subsequently it was determined, EDG automatic trip bypass upon a simulated safety injection signal (SIS) and loss of off-site power combined test was not in the surveillance prograrn. Relay ESX provides the protection bypass capability. ESX relay function is tested every 18 menths during shutdown by verifying proper function of the relay coil and l ' NRC Memorandum dated August 25,1997 to L Joseph Callan, from John C. Hoyle, Secretary; Subject

- StafT Requirements - COMSAJ 97-008 Discussion on Safety and Compliance.

i l

Attacianent I to ULNRC-3668 November 14,1997 Page 6 one of the reley's contacts. Ilowever, the remaining ESX relay contacts are tested every three years under the Preventive Maintenance program to verify proper operation. It was determined the remaining contacts should be tested on an 18 mor.th frequeacy during plant shutdown as part of the surveillance requirement.

Pedormance of Technical Specification Surveillances 4.8.1.1.2.g.2.c.2 and 4.8.1.1.2.g.5 is prohibited in Modes I or 2. The Technical Specification Bases for this performance exclusion is, "the performance of certain surveillance requirements during operation with the reactor critical could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems."

This statement was given careful consideration during the evaluation of testing for the LSELS inhibit ard ESX bypass protection relay contacts that had not been included in the surveillance program. The evaluation determined surveil!ance of the LSELS inhibit and ESX bypass protection relay contacts to demonstrate OPERABILITY could be performed without causing any perturbations to the electrical systems. Union Electric's conclusinns are coasistent with the subsequent conclusions of the Notice of Enforcement Discretion fbr Wolf Creek Nuclear Ope ating Corporation (NOED 97-06-13) which stated in part:

"the staff has reviewed the Licensee's request and justification for the issuance of a NOED and agreer that testing of the specific contacts should be conducted to provide assurance that load sequencing will function as designed. The testing proposed to be done at power should not cause any peiturbation to the electrical distribution systems that could challenge steady state operation or unit safety systems. This is consistent with NUREG-1600, which states "... enforcement discretion is intended to minimize the potential safety consequences of unnecessary plant transients (shutdown) with the accompanying operational risks and impacts."

On the basis of the staff s evaluation of your request, including the compensatory measures described above, the staff has concluded that the notice of enforcement discretion is warranted. We are clearly satisfied that this ACTION involves minimal or no safrty impact and has no adverse impact on public health and safety.

Therefore, it is our intention to exercise discretion not to enforce compliance with shutdown requirements of TS Surveillance Requirements 4.8.1.1.2.g.2)c)2, 4.8.1.1.2.g.3)d), and 4.8,1,1.2 g.4)d) and permit one-time testing while the plant is in MODE 1. The evaluation also determined the LSELS inhibit contacts should be included in the scope of the Technical Specification surveillance, even though the Technical Specific $ttion scope does not explicitly include the LSELS inhibit contacts."

i l

i Attachment I to j ULNRC-3668 November 14,1997 i Page 7 i

I It was determined that quarterly slave relay testing performed in accordance with j ~

procedures OSP-SA-0017A," Train A SIS-CSAS Slave Relay Test" and OSP SA-0017B," Train B SIS CSAS Slave Relay Test" per Engineered Safety Features Actuation  :

System Instrumentation Surveillance Requirements contained in Technical Specification  !

' table 4.3 2 Functional Units 1," Safety Injection" and 2, " Containment Spray" exercised  ;

= the LSELS inhibit contacts for the CCW and ESW pump starts, but did not record

- sufficient data to resolve the surveillance testing concern. The rurveillances were

- performed and additional data was recorded during performance to prove the LSELS i

inhibit contacts were OPERABLE. Special test procedures were written to test the '

LSELS inhibit contacts for the Motor Driven AFW pumps. The tests were written and Formal Safety Evaluations were performed in accordance with the requirements of to ,

CFR 50.59 to ensure the testing did not constitute an unreviewed safety question.

I Similarly, once the conclusion'was made that the ESX relay contacts required testing to j i

establish OPERABILITY, plant management declared the 'B' emergency diesel generator -

inoperable in accordance with Technical Specification 4.0.3 and entered the ACTION Statement for Technical Specification 3.S.I.l. The 'A' emergency diesel generator was  !

considered operable since installation of a modification had resulted in adequate testing to establish OPERABILITY.

In the Statement of Unresolved Item I, it was noted that Technical Specification 4.0.3 was exited upon completion of testing both diesels. While this is true, it is incomplete. Upon completion of testing the A diesel generator, the Technical Specification 4.0.3,24-hour allowance was exited and Technical Specification 3.8.1.1 ACTION b was entered. This ,

ACTION requires in part to " restore the inopuable diesel generator to OPERABLE l status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />". Compliance with 4.0.3 was restored upon completion of testing the B diesel generator and Technical Specification 3.8.1.1 ACTION b was exited.

. For both of these circumstances Technical Specification 4.0.3 and 3/4.8.1 are applicable.

The Licensee must perform an evaluation in order to simultaneously meet the intent of both Technical Specifications based on plant conditions. The Technical Specification ACTION Statement clearly requires that OPERABILITY must be established or the plant shut down. The bssis for INOPERABILITY is that reliability of equipment has not been ,

established by testing. To establish OPERABILITY reliability of;he subject components must be established by testing. Technical Specification 4.0.3 provided for this ,

circumstance. The remaining considerations are whether the testing can be done safely and ,.

whether performance "at power" versus "at shutdown", affects test validity. Technical Specification 4.0.3 provides a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowance to permit a delay in implementing the ACTION requirements. This provides an adequate time limit to complete surveillance requirements that have not been performed. The purpose of the allowance is to permit the completion of a surveillance before a shutdown is required to comply with ACTION

• t __ - --

t m= e mee imTJ, n ewy--e-s-8*4

y Attachment 1 to ULNRC.3668 November 14,1997 Page 8 requirements or before other remedial measures would be required that may preclude completion of a surveillance. The Techrucal Specification Bases for this allowance includes consideration for plant conditions, adequate planning, availability of personnel, the time required to perform the surveillance, and the safety significance of the delay in completing the surveillance. The foundation for the Bases of Technical Specification 4.0.3 was established by NRC Generic Letter 87 09.

The intent of Technical Specification 4.0.3 is to allow a Licensee rn meet Technical Specification surveillance commitments in an orderly manner witt uut causing plant perturbations and plant shutdowns when it is identified that a surveillance comotitment has been missed.

The Staff position provided by Generic Letter 87 09 for Problem #2 - Unnecessary Shutdown Caused by inadvertent Surpassing of Surveillance intervals (Specification 4.0 3) states, "It is overly conservative to assume that systems or components are inoperable when a surveillance requirement has not been performed. The opposite is in fact the case; the vast majority of surveillances demonstrate that systems or components in f act are operable. When a surveillance is missed, it is primarily a question of OPERABILITY that has not been verified by the performance of the required surveillance."

The Bases for Technical Speci0 cation 4.03 do not prohibit the partial perfonnance of surveillance testing requirements at power for surveillances that have an "at shutdown" requirement. It is recogniud situations requiring performance of the specific detailed surveillance requirement will have to be performed at shutdown.

A portion of the Bases for the Technical Specification 4.0.3,24-hour allowance, is to consider plant conditions. Specifically, a determination of whether the test can be performed safely at power must be made, as well as if the required conditions for the test can be established. This evaluation was accomplished using the 10 CFR 50.59 safety evaluation process.

Additional considerations are as follows:

. 10 CFR 50.36 c.2 defines limiting condition for operation (LCO) as the lowest functional capability or performance levels of equipment required for safe operation of the facility. It further states that when an LCO is nct met, the Licensee shall shut down the reactor or follow any remedial ACTION permitted.

• 10 CFR 50.36.c 3 defines surveillance requirements as requirements relating to test, calibration, or inspection to assure that necessary quality of systems and components is i

a Attachment I to ULNRC-3568 November 14,1997 Page 9 maintained, that fanl!ty operation will be within urety limits, and that the limiting conditions for operation will be met.

• Part 9900 of the NRC Inspection Manual contains guidance under " OPERABLE /

OPERABILITY: Ensuring the Functional Capability of a System or Component" to be used when evaluating the condition of a structure, system, or component and its effect on plant operation. Section 4.0 " Background" contains guidance that," The process of ensuring OPERABILITY is continuous and consists of the verification of OPERABILITY by surveillances and formal determinations of OPERABILIT f whenever a verification or other indication calls into questions the system's or component's ability to perform its specified function".

Section 6.1 " Scope and Timing of OPERABILITY Determinations" directs that, "The Licensee should examine the full scope of the current licensing basis, including the Tec'nnical Specification and FSAR commitments, to establish the conditions and performance requirements to be met for detennining OPERABILITY. The OPERABILITY decision may be based on analysis, a test or partial test, experier.ce with operating events, engineeringjudgment, or a com3ination of these factors taking into consideration equipment functional requirements."

Section 6.4 " OPERABILITY During Technical Specification Sun'eillar.ce and Prcventive Maintenance" discusses that "In all cases, care should be exercised in removing equipment from senice for PM to avoid accumulating long out-of-senice times in safety trains. The Licensee should reestablish OPERABILITY before equipment is returned to service. The Licensee also may need to .; establish OPERABILITY for systems or components, in whole or in part, that are actively dependent upon equipment undergoing the PM activity. The need for testing to reestablish OPERABILITY shou'd be based on a reasonable judgment about how the inoperable equipment may have been affected. !f retesting to reestablish OPERADILITY is not possible or practicable because of safety concerns, analysis or other means should be used to demonstrate OPERABILITY."

Section 6.6," Missed Technical Specification Surveillance" contains guidance that "The Allowed Outage Time (AOT)in the ACTION requirements spe~ifies a time interval that permits corrective ACTION to be taken to satisfy the LCO. If such a time intervalis specified in the ACTION requirements or if the Licensee has adopted by amendment, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provision of amended Suneillance Requirement 4.0.3 as discussed in Generic Letter 87-09, the completion of a missed surveillance within these time intervals meets the requirements."

V 1 l

l Attachment 1 to f ULNRC-3668 i Movember 14.1997 Page 10 i Using the above guidance, Union Electric was able to comply with the Technical Specifications Limiting Condition for Operations (LCO) ACTION Statement requirements  ;

to establish OPERABILITY for the situations described in the Inspection Reports. l Therefore, it was not necessary to pursue a Notice of Enforcement Discretion (NOED).  !

Amendmerits to tne Technical Specifications were not pursued since no changes were required.  ;

CONCLUSION: -

1

1. Implementation ofTechnical Specification Surveillance Requirements requires l

-judgment as to the scope of components to be tested and plant conditions for test j piformance. Guidance for this determination is provided in Technical Specifications, i

Bases for Technical Specification, Generic Letters, and other sources. Union Electric utilized all these sources to comply with Technical Specifications. Specifically:

- Although not specifically detailed in the Surveillance requirements of Technical Specification 4.8.1, the LSELS inhibit and ESX bypass protection relays should be included in the scope of the Technical Specincation to satisfy its intent. ,

- The Bases for Technical Specifier.An 4.8.1, restricts the allowed Modes for surveillance performance of the m,e arveillance due to the potential for undesirable

[ perturbations to the electrical distribution systems during reactor operations.

Evaluations by our staff concluded that OPERABILITY of the LSELS inhibit and ESX bypass protection relay contacts could be established by performance of a partial surveillance without perturbations to the electrical system. This is the same lede that was applied by the NRC for the NOED granted to Wolf Creek.

' 2, Union Electric entered Technical Specification 4.0.3 when the above situation were encountered. Technical Specification 4.0.3 does not prohibit performance of the  ;

surveillance test at power and according to the Bases, the purpose of 4.0.3 is to

. reference unnecessary plant shutdowns with their attendant risk for missed Technical Specification surveillances.- These considerations provide additional bases that Union ]

Electric complied with Technical Specification. ,

3, . Performing these surveillances at power did not impact Nuclear Safety.

.~

- . + - . . - , - . ai- , ~ e - . . . - . . - , - ., . - - - - . , -.-...: ., . . . . -. --.- - -

Attachment 2 to ULNRC-?668 November 14,1997 PageI Anoticable Technical Specifications and their Bases Technical Specification 3.8.1.1 states, in part:

"3.8.1.1 As a minimum, the following A.C. electrica! power sources shall be OPERABLE:

b. Two separate and independent diesel generators, each with:

1) A separate day tank containing a minimum volume of 510 gallons of fuel,

2) A separate Fuel Oil Sterage System containing a mmimum volume of 80,400 gallons of fuel, and,

3) A separate fuel transfer pump.

APPLICABILITY: MODES 1,2,3, and 4.

ACTION:

b. One Diesel Generator Inoperable:

With one diesel generator of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the offsite A.C.

sources by performing Specification 4.8.1.1.1 within I hour and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter. Demonstrate the OPERABILITY of the remaining OPERABLE diesel generator by performing Specification 4.8.1.1.2a.4) within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

• and restore the inoperable diesel generator to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. In addition, perform ACTION d."

• Unless the following conditions are met:

1) It can be dernonstrated that there is no potential commor. mede failure for the remaining dicsci generator, and

2) The dicsci encrator 3 was declared inoperable due to:

a) an inoperable suppon system, or b) an independently testable component, or c) preplanned preventive maintenance, testing or maintenance to correct a condition which, if left uncorrected, would not affect the OPERABII.lT( of the diesel generator.

, t

Attachment 2 to i t

ULNRC-3668

- November 14,1997- .

Page 2 Technical Specification 3.8.1.1.f states:

"f. Two Diesel Generators inoperable:

I With two of the above required diesel generators inoperable, demonstrate the OPERABILITY of two offsite A.C. circuits by performing Specification ,

4.8.1.1.1 within I hour and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter; restore at least ;

one of the inoperable diesel generators to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or '

be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. Following restoration ofone  ;

4 diesel generator, follow ACTION b. with the time requirement cf the ACTION based on the time ofinitial loss of the remaining inoperable diesel ger:erator. A weessful test of diesel generator OPERABILITY performed in accordance

p.a Specification 4.8.1.1.2a.4) under this ACTION for the OPERABLE diesel l generators, satis 0es the subwquent testing requirement of Specification 3.8.1.1 ACTION b."

i Technical Specification 3.8.1 Bases states, in part:

" 3/4.8.1 A.C. Sources The OPERABILITY of the A.C. and D. C. power sources and associated i distribution systems dunng operation ensures that sufficient power will be

. available te supply the safety-related equipment required for: (1) the safe shutdown of the facility, and (2) the mitigation and control of accident condidons within the facility. The minimum specified independent and redundant A.C. and D. C. power sources and distribution systems satisfy the requirements of General Design Criterion 17 of Appendix A to 10 CFR Part *

' 50.

I The surveillance requirements of Technical Specification 3/4.8.1 are based -

upon, in part, the guidance of Gu;eric Letter 94-01, " Removal of Accelerated Testing and Special Reporting Requirements for Emergency Diesel Generators 4

from Plant Technical Specifications," Generic Letter 93-05,"Line-Item t

Technical Specifications Improvements to Reduce Surveillance Requirements for Testing During Power Operation," Regulatory Guide 1.9, " Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class IE Onsite Electrical Power Systems et Nuclear Power Plants,"

Revision 3, and NUREG 1431, " Standard Technical Specifications -

Westinghow Plants." Also, the guidance of NUMARC 87-00, " Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at . ,

Light Water Reactors," Revision 1, and Regulatory guide 1.160 has been --

a.

Attachment 2 to ULNRC.3668 November 14,1997 Page 3 adopted to formulate a comprehensive Emergency Diesel Generator Reliability Program.

The note that will not allow a surveillance requirement to be performed in MODES 1 or 2 is based on the improved Standard Technical SpeciGcations (NUREG 1431) which recognizes that the performance of certain surveillance requirements during operation with the reactor critical could cause penurbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems."

The Technical Specification surveillance requirements for A.C. Sources of Electrical Power state, in part:

"4.8.1.1.2 Each diesel generator shall be demonstrated OPERABLE:

g. At least once per 18 months, during shutdown, by:

2) Verifying on an actual or simulated loss-of-offsite power signal *:

c) The diesel generator auto stant from standby conditions" and:

2) energizes the auto-connected shutdown loads through the shutdown sequencer,

3) Verifying on an actual or simulated Safety Injection Signal (SIS)*

without loss of-offsite powei that each diesel generator auto-starts from the standby condition" and:

d) the offsite power source energizes the auto-connected (accident) loads through the LOCA sequencer.

4) Verifying c , simulated loss-of-offsite power in conjunction with a simulated Sw' that each of diesel generator auto-starts from standby condition" and:

d) energizes the emergency busses with permanently connected loads within 12 seconds, energizes the auto-connected emergency (accident) loads through the LOCA sequencer;"

Attachment 2 to iJLNRC-3668 November 14,1997 Page 4

5) Verifying each diesel generator's automatic trips are bypassed upon the simulated SIS and loss-of-offsite power combined test "*

except:

a) Ifigh Jacket coolant temperature; b) Engine Overspeed; c) Low lube oil pressure; d) liigh crankcase pressure; e) Start failure relay; f) Generator differential current.

' This surveillance shall not be performed in Modes 1 or 2 and credit may be taken for unplanned events that satisfy this requirement.

This test shall be proccded by an engine prehte period anNor other warm-up procedures recommended by the .nanufacture so that the mechanical stress and wear on the diesel engine is minimited.

• • • This surveillance shall not be performed in Modes I or 2 and credit may be taken for unplanned events that satisfy this requirement.

Technical Specification 4.0.3 states:

"4.0.3 Failure to perform a Surveillance Requirement within the allowed surveillance interval, dermed by Specification 4.0.2, shall consti:ute noncompliance with the OPERABILITY requitements for a Limiting Condition for Operation. The allowable outage time limits of the ACTION requirements are applicable at the time it is identified that a Surveillance Requirement has not been performed. The ACTION requirements may be delayed for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to permit the completion of the surveillance when the allowable outage time limits of the ACTION requirements are less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Surveil!ance Requirements do not have to be performed on inoperable equipment."

Technical Specification 4.0.3 Bases states:

"4.0.3 This specification establishes the failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by the provisions of Specification 4.0.2, as a condition that consti.utes a failure to neet the OPERABILITY requirements for a Limiting Conditions for Operation. Under the provisions of this specification, systems and components are assumed to be OPERABLE when Surveillance Requirements have been satisfactorily performed within the allowed surveillance interval. Ilowever, nothing in this provision is to be construed as implying that systems or components are OPERABLE when they are found or knowri to be inoperable although still meeting the Surveillance Requirements. This specification also clarifies that the ACTION requirements are applicable when Surveillance Requirements have not been completed within the allowed

Attachment 2 to  ;

l ULNRC-3668 November 14,1997 I

Page5 l

surveillance interval and that the time limits of the ACTION requirements apply from the point in time it is identified that a surveillance has not been performed and not at the time  ;

that the allowed surveillance interval was exceeded. Completion of the Surveillance Requirement within the allowable outage time limits of the ACTION requirements restores compliance with the requirements of Specification 4.0.3. Ilowever, this does not negate the fact that the failure to have performed the surveillance within the allowed surveillance interval, defined by the Frovisions of Specification 4.0.2, was a violation of the OPERADILITY requirements of a Limiting Condition for Operation.

If the allowable outage time limits of the ACTION requirements aie less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or a shutdown is required to comply with ACTION requirements, e.g., Specification 3.0.3, a 24-hour allowance is provided to permit a delay in implementing the ACTION requirements. This provides an adequate time limit to complete Surveillan e Requirements that have not br.cn performed. The purpose of this allowance is to permit the completion of a surveillance before a shutdown is required to comply with ACTION requirements or before other remedial measures would be required that may preclude completion of a surveillance. The basis for this allowance includes consideration for plant conditions, adequate planning, availability of personnel, the time required to perform the surveillance, and the safety significance of the delay in completing th required surveillance. If a surveillance is not completed within the 24-hour allowance, the allowable outage time limits of the ACTION requirements are applicabt: at that time.

When a surveillance is performed within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowance and the Surveillance Requirements are not met, the time limits of the ACTION requirements are applicable at the time the surveillance is terminated. Surveillance Requirements do not have to be performed on inoperable equipment, because the ACTION requirements derme the remedial measures that apply. Ilowever, the Surveillance Requirements have to be met to demonstrate that inoperable equipment has been restored to OPERABLE status."

Attachment 2 to ULNRC-3668 November 14,1997 Page 6 bec: J. V. Laux W. B. Bobnar A. C. Passwater/D. E. Shafer (470)

NSRB (G. A. Ilughes/P. L. Reynolds)(470)

M. P. Barrett (100)

S. G. Wideman (WCNOC)

II. D. Bono M. A. Reidmeyer-GLR Chrono Bubetin Bc,ard Posting (13 copies)

A 170.0103 (97015) (QA Record) (CA-460)

A170.0103 (97015 - QA Department Copy)(CA-450)

A160.0761 E210.0001

~ - - . - _ - _ . . . _ _ _