ML20205P861
| ML20205P861 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 04/15/1986 |
| From: | Reznicek B OMAHA PUBLIC POWER DISTRICT |
| To: | Taylor J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE) |
| References | |
| GL-81-14, IEB-79-14, IEB-81-14, IEIN-85-084, IEIN-85-84, LIC-86-106, NUDOCS 8605220141 | |
| Download: ML20205P861 (86) | |
Text
-
Bern:rd W. Remecek Omaha Public Power District i
P'"*"
(n.er i m unse o' rn< "
1623 Harney Ornaha. Nebraska 68102 2247 402,536 4000 LIC-86-106 April 15, 1986 Mr. James M. Taylor, Director Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission Washington, D.C. 20555
References:
(1) Docket No. 50-285 (2) Letter dated January 21, 1986, from J. M. Taylor to B. W. Reznicek - Safety _ System Outage Modification Inspection (Designl 50-285/85-22 (3) Letter dated March 19, 1986, from J. M. Taylor to B. W.
Reznicek -SafetyJstem Outage Modification Inspection 1 Installation & Testing). 50-285/85-29
Dear Mr. Taylor:
Safety Systems Outage Modification Inspection (Design) 50-285/85-22 Your letter (Reference 2) transmitted the subject Safety Systems Inspection Report, which documented the results of a pilot inspection program conduct-ed by a team comprised of NRC headquarters Inspection and Enforcement (I&E) and contractor personnel.
The purpose of this inspection was to examine the adequacy of OPPD's management and control of modifications performed during the 1985 refueling outage.
The design portion of this review by the NRC was conducted between September 16, and October 8, 1985.
Reference (2) acknowledged that during the installation portion of this inspection, the NRC performed a preliminary review of OPPD's planned correc-tive actions for more significant findings of the design inspection which were identified at an interim status briefing on October 8,1985.
Both short term (prior to restart), and long term corrective actions were included.
During the preliminary review of OPPD's corrective action, the NRC indicated that the proposed actions appeared to be timely and correct.
This letter provides details relative to OPPD's long term corrective actions.
Additionally, your letter requested that OPPD respond in writing to the U< M deficiencies and unresolved items within 60 days after receipt of Reference g 4 l (i (2).
Reference (2) was received by 0 PPD on January 27, 1986.
Reference g gaAl Sch ML (3), relating to the installation and testing portion of this pilot 8605220141 060415 goa aoocxOsoo=s 1
.9 1
mm
,,. _ _ ~ _ _ _ -
James M. Taylor LIC-86-106 Page 2 inspection, was received by OPPD on March 21, 1986.
Preliminary review by OPPD of the installation and testing report indicated that some modifica-tion to the responses prepared for the Design report were warranted. OPPD requested and obtained an extension for responding to Reference (2) from March 28, 1986 to April 15, 1986.
In the detailed attachment, OPPD has (for the deficiencies identified) addressed: (1) the cause, (2) the extent to which the condition may be reflected in the unreviewed portion of the design, (3) the action taken or planned to correct the existing condition, (4) the action planned to pre-vent recurrence, and (5) where appropriate any other information considered by 0 PPD to be relevant. Also, for unresolved items, OPPD's response provides information needed to reach conclusions concerning acceptability of the specific feature or practice involved.
Discussions between OPPD and the NRC determined that none of the findings were sufficient to prevent return to power operations nor were the findings of an immediate safety concern. OPPD's review and evaluation of the subject inspection report has resulted in the following major observations and actions to improve management and control of the modification process:
1.
Systematic Review of Design Change / Modification Program OPPD has established a Special Committee to review the Design Change /
Modification program in a systematic way with intent to improve the overall program. This Committee consists of cognizant management personnel with high level involvement by upper level management at OPPD. This Committee, will review the overall modification program and provide a report to Senior Management regarding specific recommenda-tions by June 30, 1986. This multi-disciplinary Committee consists of licensing, plant operations and maintenance, design engineering, quality assurance, and technical support engineering personnel.
The review wi!! include such items as:
a.
Control and use of Design Inputs b.
Maintenance and use of design basis information c.
Post-modification testing d.
Safety evaluations required by 10 CFR 50.59 e.
Emergency modifications f.
Engineering judgement - proper use and how to document g.
Surveillance / Performance testing.
James M. Taylor LIC-86-106 Page 3 This review will assure that pertinent information is factored into a modification package and will provide additional assurance that the modifications will function as designed. Any necessary corrective actions will be tracked to implementation.
Since the overall review of the Design Change / Modification Program and the improvements resulting from this review will take some time to con-duct and implement, OPPD has taken the following interim actions:
a.
Appropriate department heads have discussed results of the NRC's inspection report with personnel involved in the Design Change /
Modification Program.
b.
A-letter has been sent to personnel involved in the Design Change / Modification Program, identifying the NRC's areas of con-cern to ensure personnel are aware of those concerns to help prevent recurrence.
c.
Appropriate supervision and management personnel have been alert-ed to the findings of this report. Special emphasis has been exercised to help ensure that weaknesses already identified are addressed in design modification packages which are in progress.
This will ensure that the results of the findings are factored into the design process during the time interval necessary to implement longer term corrective actions.
2.
Pre-Outage Planning Consideration of the overall inspection report has revealed a fundamental weakness in pre-outage planning. Pre-outage planning that emphasizes com-pletion of design work before the outage will prevent recurrence of most of the deficiencies identified by this inspection.
Pre-positioning of design packages, materials, and procedures prior to the outage will prevent com-pression of activities and enhance the serification and review process.
Proper planning will limit concurrent task activity such as design comple-tion and procedure preparation during the installation and testing phases of the modification process.
We would also like to note that over the last few years, pre-outage plan-ning has been adversely impacted due to the large number of modifications required by new regulatory requirements in the post-TMI era. These modifi-cations had to be accomplished in a relatively short time period. As many of these modifications have already been implemented, a considerable improvement in this situation is expected.
We have already begun corrective action to improve pre-outage planning.
- 3. Deficiencies and Unresolved Items Attachment A provides an item-by-item response to the deficiencies and unresolved items.
4 provides a response to generic areas of concern relating to the deficiencies and unresolved items and referenced in Attachment A for individual responses.
James M. Taylor LIC-86-106 Page 4 As a separate item, although Reference (3) required no reply by 0 PPD at this time, we will provide a written response to NRC Region IV by May 15, 1986.
I assure you that our corrective action plan will be properly and promptly completed.
Sincerely,
-)
B. W. R cc: LeBoeuf, Lamb, Leiby & MacRae 1333 New Hampshire Ave., N.W.
Washington, DC 20036 R. D. Martin, NRC Regional Administrator E. G. Tourigny, NRC Project Manager P. H. Harrell, NRC Senior Resident Inspector
AA PO 5C "A
P l
1 l
l l
y --
R ATTACHMENT A 1
l
D2.1 Deficiency - Lack of Design Analysis to Support Sizing of Air Accumulators for Valves YCV 1045 A/B DESCRIPTION: Steam supply to the Auxiliary Feedwater turbine pump is supplied from a steam header fed by two steam branch lines, one from each steam generator. The steam header is normally pressurized up to isolation valve YCV-1045 through normally open isolation valves YCV-1045A and YCV-1045B in the branch lines. These isolation valves are pneumatically oper-ated and can be remote manually operated from the control room.
In the original system design, valves YCV-1045 A and B were designed to fail open on loss of instrument air, and valve YCV-1045 was designed to fail close.
A modification request, MR-FC-78-43 was initiated on an emergency basis in 1979 to redesign the valve operator for YCV-1045 and replace it with a fail open operator. This modification request was initiated in September,1978 after the turbine pump failed to start during operability testing because of inadvertent closure of an instrument air supply valve to YCV-1045 ac-tuator (LER-78-030).
To enable remote manual isolation in the event of a steam generator tube rupture with a concomitant loss of non-safety-related instrument air, air accumulators were to be added to the valve actuators for YCV-1045 A and B; however, these accumulators were not installed prior to returning the plant to power operation. During closecut of FC-78-43, a new engineering evalu-ation and assistance request, EEAR FC-83-158, was initiated to install the air accumulators.
In a January 15, 1985 memorandum, MR-FC-83-158 was scheduled for completion during the Fall-1985 planned outage.
The Final Design Description states that each accumulator will be sized to provide air to the valve for one hour. To assess the implementation of the design process for modifications, the team reviewed the sizing calcu-lations.
Design analysis does not exist to confirm sizing of the air accumulators.
The team found that a calculation does not exist which demonstrates that a sufficient stored volume of pressurized air will be available to close YCV-1045A and B assuming a loss of instrument air and minimum initial accum-ulator pressure. The valve is spring actuated to open, and sufficient air pressure must be provided to overcome spring pressure and approximately 1100 psi differential pressure across the globe valve during closure.
The team was informed that a sizing calculation was not performed for this modification package. The design engineer indicated that he referred to calculations in a completed modification and used engineering judgement to conclude that the current design was adequate. The team found no documen-tation of the engineering judgement and requested for review the sizing calculations referred to by the design engineer.
These calculations were not available during the inspection.
Basis: The licensee committed to implement ANSI N45.2.11 for design activ-ities associated with modifications of safety-related structures, systems, and components. Contrary to the requirements of this standard, a design analysis was not performed in a planned, con-trolled, and correct manner.
In addition, the design activity was not traceable from design input through to design output.
A-1
D2.1-1 Deficiency (Continued)
OPPD'S RESPONSE Cause of Deficiency -
Failure to emphasize the importance of documenting engineering decisions has been identified as the cause of this deficiency. The sizing of the accumulator was determined by an engineering evaluation which compared the requirements of this modification to prior calculations.
Based on this comparison the design was concluded to be adequate. This. engineering evaluation was not, however, documented.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
OPPD's position on the lack of documentation of engineering decisions is presented in Attachment B, Items 1 and 4.
Action to Correct the Existing Condition -
The modification has been installed and has been functionally tested. The functional test confirmed that OPPD's engineering decision was correct and that the size of the accumulator was adequate.
Action to Prevent Recurrence -
OPPD's position on lack of documentation of engineering decision is presented in Attachment B, Item 1.
A-2
D2.1 Deficiency - Seismic Requirements Not Specified in MR-FC-83-158 Procurement Documents DESCRIPTION: The team examined the procurement documents for MR-FC-83-158 to determine if appropriate requirements had been included.
The air accumulators and associated tubing and valves serve a post-accident function to~close YCV-1045 A and B.
These control valves are classified as seismic Class I in accordance with Appendix F of the USAR; therefore, the air accaulators and associated valves and tubing are considered seismic Class I.
The procurement specifications for isolation and check valves do not specify seismic requirements. The team noted that third party design verifications of these two specifications' concluded that the design inputs were correctly selected and incorporated into the design.
Basis: Omaha Public Power District has committed to implement the guidance of ANSI N45.2.11. ANSI N45.2.11 requires that the applicable codes, standards and regulatory requirements be properly identified and properly addressed.
Contrary to this requirement, the design veri-fier did not ensure that the seismic requirements were included in the procurement documents.
OPPD's RESPONSE Cause of Deficiency -
The seismic requirements for the manual and check valves for this modifi-cation were omitted from the procurement documents. The engineering decision to not include seismic requirements was based on the following analysis:
These type of manual and check valves are rigid bodies and do not exhibit natural frequencies below 33Hz.
They are not subject to seis.
mically induced vibrations which may cause internal damage. OPPD has calculations that confirm that valve bodies (control or manual) can be subjected to as much as 100 g's of acceleration without being over stressed.
However, this analysis was not documented as a reference in the design package. The analysis was correct but the' determination of the non-appli-cability of seismic requirements in this instance was not adequately documented.
A-3
D2.1 Deficiency (Continued)
OPPD's Response (Continued)
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
OPPD's position on the lack of documentation of engineering decision is discussed in Attachment B, Item 1.
Action to Correct the Existing Condition -
The system has been seismically restrained, and as discussed above, the valves are rigid bodies. The system, as installed, is seismically quali fied.
Action to Prevent Recurrence -
OPPD's position on the lack of documentation of engineering decisions is presented in Attachment 8, Item 1.
I A-4 y
a m --
w ene
-m
D2.1 Deficiency - Failure to Follow Procedural Requirements for A Normal Modification Resulting In lack of Required Design Verification Review DESCRIPTION: The Generating Station Engineering (GSE) Procedures Manual describes the responsibilities of Generating Station Engineering personnel, the types of modification requests, the information to be included in prep-aration of a modification package, and steps to document field changes and closecut. Three types of modifications are described.
These are normal, emergency, and minor. A minor modification does not involve any Critical Quality Element (CQE) components. A normal modification involves the prep-aration of a preliminary design package (optional), a final design package including third-party review, and a construction package with third-party review.
For an emergency modification request, the same procedure is ap-plied except that certain approvals may be accomplished by telephone and the completion of the documentation may be accomplished following comple-tion of the modification.
For emergency and normal modifications, the preliminary design package is normally waived. After an emergency modifi-cation is installed, preparation of an "after-the-fact" (ATF) final design package and subsequent reviews in accordance with the normal modification are performed.
Modification request, MR-FC-83-158, is a normal modification to install an accumulator on valves YCV-1045 A/B. This modification was initiated in 1983 to correct partial completion of another modification accomplished on an emergency basis in 1980. On February 19, 1985, the final design package for this modification was sent for third-party review. On February 26, 1985, the third-party reviewer completed his review and determined that the final design package was not in compliance as documented on a design doc-ument verification record. On June 10, 1985, the construction package was sent to the Plant Manager for approval.
MR-FC-83-158 was not treated as required for a normal modification in accor-dance with Design Procedure B-2.
The team found that a construction package was prepared even though the design verification of the final de-sign package had not been completed.
For a normal modification, the team was informed that the preparation of a construction package prior to comple-tion of the final design package is an accepted practice.
From interviews, the team determined that is sas not uncommon for design verifications to be
. completed after normal modifications had been installed.
It appears that this practice is similar to that used for emergency modifications.
This situation was further aggravated by the Design Engineer who made a determination that the construction package did not require third-party review and who signed a memorandum for the Department Manager stating that a third-party review was not required.
~
Basis: Contrary to Generating Station Engineering Design Procedure B-2 Item 2.5.3, which states that after approval of the final design package, for normal modificatibns only, the Design Engineer will prepare the Construction Package;. a construction package for a normal modifi-cation was prepared and completed prior to approval of the final design package. A Construction Package Design Verification was not A-5 Y
D2.1-6 Deficiency (Continued) performed, contrary to procedure item 2.7.3, which states that a design verification review was required if the construction package involved the installation of Critical Quality Element components.
OPPD's RESPONSE Cause of Deficiency -
The Final Design Package was submitted for third-party review and found to be "not in compliance" as stated in the report. The Construction Package was issued to the Plant Manager for approval prior to resubmittal of the Final Design for third-party review. This is allowed by procedure. GSE Design Procedure B-2, Item 2.5.3 refers to approval by the Plant Review Committee of the Final Design prior to issuance of the Construction Package. There is no requirement that the Final Design be verified to be "In-Compliance" by the third-party reviewer prior to issuance of the Construction Package.
Procedure B-2, Item 2.5.3 also requires design verification review of the Construction Package if CQE are involved, but also does not indicate a specific time constraint.
(Note:
Reference to procedure item 2.7.3 in the NRC report seems to be a typographical error).
ANSI N45.2.11, Section 6, Design Verification also does not specify a time constraint for completion of verifications.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
On a generic basis, it is permissible for a Final Design Package or a Construction Package to be issued prior to completion of design verifica-tion (as "In Compliance"). Most often the Final Design will be third-party reviewed and the reviewer's comments incorporated in the design prior to issuance of the Construction Package. When not "In Compliance" the Final Design then is resubmitted for third-party review.
If the installation is expected to result in substantial field changes, the Construction Package sometimes is not submitted for third-party review un-til after the as-built configuration is known or at a point where it is unlikely to undergo further changes. This may not be until after construc-tion and testing are complete. Also, certain documentation such as qualifi-cation reports may not be received prior to start of construction. Modifi-cations involving seismic supports normally require redesign / reanalysis of as-built conditions because it is difficult and often impractical to fit pre-engineered seismic supports around existing plant equipment.
In cer-tain cases, design verification can be done by testing, as allowed by ANSI N.45.2.II.
Obviously, this cannoc be done until completion of installation.
A-6
~
l D2.1 Deficiency (Continued)
OPPD's Response (Continued)
Action to Correct the Existing Condition -
The Form "J" in Standing Order G-21 was revised to specifically require completion of third-party review of the design and construction prior to acceptance of a modification for operation by the System Acceptance Com-mittee (SAC).
GSE Procedure A-2 was revised to define in more detail for the engineer what would constitute an acceptable third-party review for purposes of SAC. The required third party reviews were completed in accordance with procedures prior to system acceptance for operation.
Action to Prevent Recurrence -
OPPD recognizes the economic and schedular advantages of completing design verifications as soon possible in the life of a modification.
It is not in OPPD's best interest to install a modification and then have to rework or remove it because of a design verification problem.
However, it is also not efficient utilization of engineering resources to perform design re-views before all the information is available, as explained previously.
The requirement in the procedures to complete third-party reviews prior to System Acceptance is adequate as far as plant safety is concerned. OPPD will continue to emphasize earliest reasonable completions of design veri-fications to reduce any potential pressures on reviewers or resource constraints near the completion of outages.
Other Relevant Information -
For normal modifications the design verification required per OPPD's.
procedures is in addition to the checking and approval process which is required to be completed prior to the modification being installed.
A-7
D2.1 Deficiency - Incomplete Installation / Testing Procedure in Construction Package for MR-FC-83-158 DESCRIPTION: Modification request MR-FC-83-158 is a normal modification to install an accumulator on each of two valves YCV-1045 A and B.
These in-strument air accumulators were to be installed to permit the remote manual isolation in the event of a steam generator tube rupture with a concomitant loss of non-safety-related instrument air.
YCV-1045 A and B are normally closed steam admission valves located in steam branch lines feeding the auxiliary feedwater turbine pump, and they fail open on loss of instrument air. These control valves are classified as seismic Class I and as Crit-ical Quality Elements (i.e., safety-related).
YCV-1045 A and B are 2-inch globe valves which may be required to shut against a differential pressure of approximately 1000 psig.
The post-modification testing procedure does not test this design function. During the installation, YCV-1045 A and B are closed; therefore, the valves are closed prior to commencing post-modification testing. The first step of the test, Step 6.6, pressurizes the installation with normal instrument air supply causing the actuator above the diaphragm to be filled.
Step 6.7 opens the valve handwheels of valves YCV-1045A and YCV-1045B; however, the valves remain in the closed position because air has not been vented from above the diaphragm.
Step 6.8 directs that the installation be isolated from the normal instrument air header using the root valve and that the actuator should be monitored for one hour to ensure the valves remain shut with air supplied by the accumulators alone. As a consequence, the test procedure does not use the pressurized volume of the accumulator to shut the valves.
In addition, no testing adjustment is made to test the capabil-ity of the 2-inch globe valves to shut against high differential pressures, nor is an acceptance criterion provided for acceptable air leakage. The only acceptance criterion is that the valves must remain shut for one hour.
The team also noted that Step 6.8 requires the pressure of air in the accumulator to be noted if the valve does not open.
However, there is no pressure gauge on the accumulator or intervening piping.
Basis:
Omaha Public Power District has committed to Regulatory Guide 1.33 which endorses ANSI N18.7.
This standard required that modifications which affect functioning of safety-related struc-tures, systems, or components be inspected and tested to confirm that the modifications or changes reasonably produce expected restilts and that the change does not reduce safety of opera-tions.
These tests procedures are to include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished.
Contrary to these requirements, the test procedure would not have confirmed that the modification produced expected results and did not have an acceptance criterion for acceptable air leakage.
A-8
l l
l D2.1 Deficiency (Continued) l OPPD's RESPONSE Cause of Deficiency -
The reason a functional test was not originally specified is because a functional test would have required the feedwater system to be pressurized.
This could only be accomplished during operation.
It was OPPD's opinion that the static test originally specified was adequate.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
Post-modification testing for modifications which require special plant conditions such as full power plant conditions (i.e., safety and relief valve testing, the above valve), and certain accident conditions (i.e.,
safety systems that require accident conditions for an operability test) has been an industry concern since TMI. OPPD's position on post-modifica-l tion performance testing is discussed in Attachment B, Item 3 and 4.
Action to Correct the Existing Condition -
i Subsequent to the NRC audit, a functional test was performed. The system performed as required.
Action to Prevent Recurrence -
l OPPD's position on post-modification testing is presented in Attachment 8, Item 3.
l A-9 1
L.
02.1 Deficiency - Incorrect Information On Flow Diagram For Main Steam System DESCRIPTION:
During the course of the inspection, the team reviewed design aspects of various modifications with respect to the information contained on system flow diagrams. The following inconsistencies and errors were identified during the team's review of the steam system flow diagram.
System Description III-2, steam system description, states that the main steam isolation bypass valves, HCV-1041C and HCV-1042C, are horizontally mounted,. motor-operated, 2-inch globe valves. These valves are piped into the valve body of their respective main steam isolation valves. Review of the valve drawings shows that steam passes through the bypass line upstream of the disc associated with the main steam isolation valves, flows through HCV-1041C and back into the valve body of the main steam isolation valve downstream of the valve's disc, HCV-1041C is cracked open and steam flows through the non-return valve (HCV-10418) and when pressures and tempera-tures have equalized, the main steam isolation valve is opened. The main steam isolation valves and the non-return valves are within the Class 2 boundary.
Flow Diagram 11405-M-252 incorrectly represents the piping arrangement associated with the bypass valves and the auxiliary feedwater steam warmup lines.
The drawing indicates that the piping to the bypass valves taps off the upstream side of the disc and returns to the upstream side, versus the correct return to the area between the main steam isolation valve and its associated reverse flow check valve.
In addition, the piping connected downstream of the bypass valve is indicated as non-safety by a flag. This piping also supplies the warmup line for the auxiliary feedwater steam headers, which is also incorrectly indicated as non-safety. These lines tap off the downstream side of the bypass valves and are piped to the down-stream side of YCV-1045 A and 8 through normally open isolation valves MS-336 or MS-337. The portion of the piping from the main steam isolation bypass isolation valves to either MS-336 or MS-337 and the associated branch line to the main steam isolation valve body is incorrectly depicted as non-safety.
The team noted that Omaha Public Power District's Critical Quality Elements (CQE) List is a system level Q-Lists which relies in part on the correct classification on system flow diagrams.
During the inspection, Omaha Public Power District acknowledged the error and committed to correct the flow diagram.
Basis: Omaha Public Power District committed to Regulatory Guide 1.64, which endorses ANSI N45.2.11. This standard requires that personnel use proper and current drawings and design inputs. Contrary to this requirement, the steam system flow diagram was not correct or cur-rent with the as-installed arrangement in the plant.
A-10
D2.1 Deficiency-(Continued)
OPPD's RESPONSE Cause of Deficiency -
i
' Subsequent to the NRC finding, OPPD engineers walked down the area in question. The apparent cause of this above drawing error was that the surrounding area was very congested. Due to this congestion, previous walkdowns had overlooked this line.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
1 OPPD is committed to the drawing update process. Numerous physical system walkdowns have been performed to confirm and update the documents when necessary. A complete and comprehensive drawing verification program which updated controlled drawings for the plant was completed in 1984. OPPD feels that due to our commitment and attention to the document updating and the above walkdowns, this is an isolated occurrence. The subject information is shown correctly on other drawings. No evidence could be found that the incorrect information on the drawing affected any other modifications, f
Action to Correct the Existing Condition -
T The flow diagram has been revised. The error would not have caused a j
safety concern as it only involved a warm-up line on the main steam system.
j Action to Prevent Recurrence -
OPPD believes that no further action is necessary as this item is considered to be an isolated occurrence.
I i
A-11
02.1 Deficiency - Incorrect System Description Statements DESCRIPTION: During the team's review of various modification packages, OPPD's system descriptions were examined to confirm system design bases.
The following errors or inconsistencies were identified in the system descriptions reviewed:
a.
Auxiliary Feedwater System Description III-4 states that steam admis-sion valves, YCV-1045 A and B, each have 3/8 inch unvalved bypass lines that serve to maintain warm steam lines up to FW-10 isolation valve YCV-1045. Contrary to this description, the team determined that the source of warming steam to the auxiliary feedwater turbine line down-stream of YCV-1045 A and B passes through normally open manual valves MS-336 and MS-337, respectively.
These valves are shown on Steam Sys-tem Flow Diagram and related physical piping diagrams.
b.
Modification MR-FC-21B changed valves HCV-4388 and HCV-438D (outside containment component cooling water isolation valves for the reactor coolant pump lube oil coolers and seals) from failed closed to fail open and added air accumulators to permit the valve operator to keep the valves closed until action could be taken to isolate the lines man-ually. The Station System Acceptance form for this modification indicates that the system description had been updated. Contrary to this indication, Compressed Air System Description III-10 does not include valves HCV-438 8 and D on the list of valves equipped with instrument air accumulators. The team noted that site acceptance of this modification was completed in May 1983 and that the Compressed Air System Description was most recently revised in April 1985.
c.
Modification MR-FC-81-21 developed a component cooling water pressure low signal and added it to the control circuits for valves HCV-438 8 and D, such that these valves remain open except when a containment isolation signal and a component cooling water pressure low signal are simultaneously present. The Station System Acceptance form indicates that the system description had been updated.
Contrary to this indi-cation, Component Cooling Water System Description I-7 omits the low pressure signal and states the "CIAS closes containment isolation valves HCV-483 A/8/C/D, thus isolating CCW flow to the reactor coolant pumps." The team noted that site acceptance for this modification was completed in May 1983 and that the system description had not been updated since December 1981.
The team determined that system descriptions are maintained by site engine-ering personnel, and during a site inspection the team was informed by site engineering personnel that the descriptions had numerous errors.
Basis: Omaha Public Power District's Quality Assurance Plan 5.1 requires that those organizations participating in activities affecting safety shall be made aware of, and use, proper and current instruc-tions, procedures, drawings, and engineering requirements for performing the activity.
Contrary to this requirement, design de-scriptions, available for use as design input, were incorrect or not updated following completion of modifications.
A-12
D2.1-9 Deficiency (Continued)
OPPD's RESPONSE Cause of Deficiency -
OPPD does not believe " incorrect system description statements" form the basis for any deficiency. The system descriptions are not maintained as a
" controlled document"; however they are for the most part a reliable source of reference information. The decision to use information contained within the system descriptions is left to the discretion of the design engineer.
Each design engineer is cognizant that the system descriptions are not
" controlled" and that information gained via the system descriptions should be used as reference material only.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the i
Design -
System descriptions may sometimes be reviewed by the design engineer when preparing a design. However, design information is available in other controlled documents. The checks and balances which are present in the review process provides adequate assurance that design inputs are appropriate.
Action to Correct the Existing Condition -
The use and/or control of system descriptions will be included as part of the total generic review of the Design Change / Modification program discussed in the cover letter.
Action to Prevent Recurrence -
Volumes of System Descriptions will be stamped " Uncontrolled Document, For Information Only" until the review discussed in " Action to Correct the Existing Condition" has determined the appropr' ate long term controls for the System Descriptions.
A-13
U2.1 Unresolved Item - Use of Fluorocarbon-Elastomer Material in High Radiation Environments DESCRIPTION:- During the team's examination of modification packages, the material compatibility with expected environments was reviewed for modifica-tion packages MR-FC-84-144 and MR-FC-83-158.
The first modification package involves the replacement of solenoid valves for YCV-1045 A and B.
The Final Design package states that the existing solenoid valves are acceptable for the application but have Viton material as elastomer seals. Viton is an E.E. DuPont de Nemours trade name.
It is 4
i often described as a fluorocarbon elastomer and has the chemical desig-nation as vinylidene fluoride and hexafluoro-propylene. The Final Design package indicated that Viton is not recommended for application in radia-tion areas; therefore, all solenoid valves containing this material are to be removed from service.
Likewise, the Engineering Evaluation and Assis-tance Request indicates that the solenoid seals should be changed to avoid stocking Viton. OPPD's Technical Services organization concurred with the
' modification, indicating this modification will ensure no Viton parts are
. stored, since these parts are not to be installed in a radiation area.
Modification package MR-FC-83-158 is a normal modific'ation to install air accumulators on the same valves YCV-1045 A and B, auxiliary feedwater tur-bine steam admission valves. These instrument air accumulators were to be installed to permit the remote manual isolation of a steam generator in the event of a tube rupture with a concomitant loss of non-safety-related in-strument air. This modification includes the installation of instrument air check valves to isolate the safety-related instrument air accumulators from the non-safety-related instrument air lieaders. The team examined the 4
procurement specifications for MR-FC-83-158 and determined that Viton was being used as a seating material in the safety-related instrument air check valve.
The procurement specification for the safety-related instrument air check valves permits the use of Viton as a seat material. The team noted that 4
the original specification specified Buna "N" as a seat material; however, the valve's supplier took exception to this seat material and stated in a letter that Viton would be supplied instead.
Based upon this exception the specification was revised to include Viton as an acceptable seat material.
During the inspection, the licensee was unable to explain the disparity be-tween the two modifications except to indicate that the radiation dose at the location of the solenoids and the safety-related check valves was suf-i ficiently low that Viton would be an acceptable seating material.
The licensee pointed out that the' procurement specification for the instrument air check valves was prepared based upon a specification previously used in another application. The licensee stated that environmental conditions were not revised downward because the values specified were conservative.
Therefore, the specification identifies the radiation environment as 3.0 E6 rads even though the expected condition is apparently lower.
A-14 1
U2.1 Unresolved Item (Continued)
Description (Continued)
During the inspection, the team did not determine if Viton had been used in other instrument air applications or other safety-related applications. The team requested a listing of all modifications which installed air accum-ulators.
In response to this request and at the end of the inspection, the licensee produced a short list of possible modifications apparently gener-ated upon the recollection of various engineers.
Independently, the team identified a modification where air accumulators and instrument air check valves had been added; however, the team could not determine the seat mat-erial used in the check valves because the procurement specification was not included in the modification file (See Deficiency D2.2-4).
Basis: Criterion III of 10 CFR 50 Appendix B requires that design control measures be applied to insure compatibility of materials. Omaha Public Power District has committed to Regulatory Guide 1.64 which endorses ANSI N45.2.11. The standard requires verifiers to confirm that the specified parts are suitable for the required application and that specified materials are compatible with the design environ-mental conditions to which the material will be exposed.
Contrary to these requirements, an unacceptable material may have been used in a high radiation environment.
OPPD's RESPONSE OPPD agrees that Viton is not recommended for application in high radiation areas and that the OPPD's standard procurement specifications state that the expected radiation environment is 3.0 x 106 rads. However, in those cases where the environment is much less it would be acceptable to use Viton.
In this specific modification, the vendor indicated that he could not supply the specified material in the time frame desired. The vendor could, how-ever, supply "Viton". The design engineer then reviewed the actual expected radiation environment and found it to be significantly less than that spec-ified. Viton was considered acceptable for this specific application. The standard specification was modified for this specific modification to permit the use of Viton.
It was not considered to be necessary to revise the radia-tion environment shown in the specification.
However, OPPD did not document this engineering decision. OPPD's position on the lack of documentation of engineering decisions is presented in Attachment B, Item 1.
Preparation of specifications require that the design engineer determine the radiation environment for each cgmponent and select suitable materials.
For radiation en"ironments of 3 x 100 Rads, Buna "N" material will be speci-fled for ser material.
However, for this specific application the use of Viton was apropriate because of the lower radiation environment.
Based on the additional information provided and the procedures in effect for preparation of specification, OPPD believes this item has been resolved.
A-15
D2.2 Deficiency - Incorrect Design Input in Calculation Associated With MR-FC-81-21B DESCRIPTION: Modification MR-FC-81-218 is a completed modification which replaced fail close pneumatic actuators with actuators that fail open. The replacement actuators were installed on valves HCV-4388 and HCV-4380.
These valves are containment isolation valves located outside containment in the component cooling water supply and return lines associated with the reactor coolant pump lube oil coolers and seals.
This completed modifica-tion added instrument air accumulators to these valves to permit the valve operator to maintain the valves closed until operator action could be taken to manually close the valves.
Because this modification is similar to a modification planned for the 1985 outage (i.e., MR-FC-83-158), the team re-viewed modification MR-FC-81-21B to determine if errors and discrepancies found during the review of n:odification MR-FC-83-158 were systematic.
The modification file contained a calculation sheet which concluded that the air accumulator had sufficient volume. This calculation was reviewed L
and the following discrepancies noted:
a.
The calculation states that the accumulator is a 20 pound propane tank and that the volume is 4423 cubic inches. The source of this informa-tion is not referenced. A 20 pound propane tank, typically, has a volume of approximately 1320 cubic inches.
The team believes that the volume of stored air used in the calculation is overestimated by 335 percent.
b.
The calculation assumes that the air pressure is at 100 psig. The reference for this assumption and justification for its use is not documented. The instrument air system pressure will range between 80 and 100 psig per the compressed air systen fescription.
The assumption that the air accumulator is fully charged at maximum instrument air pressure is not conservative and inappropriate for an air accumulator sizing calculation.
c.
The calculation does not consider system leakage or the period of time that the valve must remain shut. The valves operated by these accumu-lators are fail open containment isolation valves.
In the event of a need to close these valves, they would have to remain shut for the duration of the accident or until operator action is taken to manually shut the valve. The implicit assumption of zero leakage is not con-servative and unrealistic. The team noted that the air accumulator installation was not properly tested after modification (See Deficiency D2.2-3) and that surveillance testing is not performed to demonstrate the capability of the Critical Quality Element (i.e., safety-related) portion of the instrurrent air system to close these valves and maintain them closed for a predetermined period of time without loss of function.
d.
The calculation sheet is not signed by a checker.
Instead reference is made to see a B-2-2 Form. However, the B-2-2 form is not attached or included in the modification file.
A-16
D2.2 Deficiency (Continued)
Basis: Omaha Public Power District committed to Regulatory Guide 1.64, which endorses ANSI N45.2.11. This standard requires that calcu-lations include defined objectives, identification of design inputs and their sources, and documentation of assumptions and identifica-tion of those assumptions which need confirmation at a later date.
Contrary to these requirements, the calculation contained incorrect and inappropriate assumptions without identification of their sources or justification for their use.
OPPD's RESPONSE Cause of Deficiency -
a.
OPPD agrees with the NRC that the volume in the tank was overestimated and that the correct volume is 1325 cubic inches.
b.
OPPD also agrees that, for conservatism, the minimum air pressure of 80 psig should have been used in the calculation.
A prelirtinary calculation has been made with the above correct para-meters. This calculation has verified the adequacy of the design.
This preliminary calculation will be finalized, checked and verified, and placed in the file.
c.
Although the system leakage was not quantified in the original calculaticn, the amount of allowable leakage can be inferred from the margin between the minimum pressure required and the system pressure following actuation of the accumulator. The amount of margin in the Original calculation was such that system leakage was a moot point. The revised preliminary calculation, using the correct parameters, indi-cates that the margin is approximately 40%
d.
Engineering procedures do not require that the checker sign every sheet providing the cover sheet (B-2-2 form) is signed.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
Items a) and b) were both due to errors of both the design engineer and the checker. The nature of the design review process ensures that this is a low probability event and should not constitute a programatic problem.
Item c) Post-modification testing is discussed in Attachment B, Items 3 and 4.
Item d) is in conformance with good engineering practice and OPPD procedures.
A-17
D2.2 Deficiency (Continued)
OPPD's Response (Continued)
Action to Correct the Existing Condition -
Items a), b), and c) will be corrected in the new revised calculation which will be placed in the file.
Item d) requires no corrective action Action to Prevent Recurrence -
OPPD is developing a special training session for the departments respons-ible for the preparing and checking calculations. This training session will stress the need for following exactly the appropriate design procedures.
f 0
4 A-18
D2.2 Deficiency - Incomplete Consideration of CQE And Seismic Class I Requirements for Portions of MR-FC-81-21B DESCRIPTION: Modification MR-FC-81-21B is a completed modification which replaced fail close pneumatic actuators with actuators that fail open. The replacement actuators were installed on valves HCV-438B and HCV-438D.
These valves are containment isolation valves located outside containment in the component cooling water supply and return lines associated with the reactor coolant pump lube oil coolers and seals.
This completed modifica-tion added instrument air accumulators to these valves to permit the opera-tor to maintain the valves closed until operator action could be taken locally to manually close the valves. This modification was completed in 1983 and was similar to modification planned for the 1985 outage (i.e.,
MR-FC-83-158).
In USAR Appendix F, the component cooling water system is classified as a seismic Class I system.
In the Critical Quality Elements List, air accumu-lators and associated piping and valves that supply air to valves that must function following an accident are identified Critical Quality Elements based upon the classification and operating requirements of the valves that they supply. HCV-4388 and D are valves which are open following an acci-dent and must have the capability to be closed throughout the course of the accident. As a consequence, the air accumulators and associated piping and valves are seismic Class I and Critical Quality Elements because they must remain functional during and following an accident to shut HCV-4388 and D.
The team reviewed the seismic qualification of components installed during this modification, lhe team found that seismic requirements were not properly addressed in the modification package. The following discrepancies were identified:
a.
Purchase Order No. 56600 was issued to an engineering organization to confirm that the valve and operator assembly supplied by a manufacturer was seismically qualifidd without invoking the requirements of 10 CFR Part 50 Appendix B.
In, addition, the purchase order did not invoke tLa requirements of 10 CFR Part 21 and was not identified as applicable to critical quality elements. As a consequence, the engineering organiza-tion did not complete the computer analysis in accordance with their Quality Assurance Manual and identified this to OPPD in an August,1983 letter.
Because the procurement was not considered to involve services for a Critical Quality Element, a Quality Assurance representative did not review the purchase order.
b.
The installation / test procedure did not reference Fort Calhoun criteria for routing and support of seismic instrument tubing.
c.
No calculation existed at the time the modification was completed to confirm that the as-constFucted air accumulator, including base plate and Hilti bolts, was adeq'uately sized to withstand expected seismic loadings. A 1983 calculation in the completed modification file does not address seismic considerations. A subsequent generic analysis performed in 1985 appears to confirm the configuration is adequate; however, confirmation is required to verify that the installed config-uration is the f,ame or is bounded by that analyzed.
A-19
D2.2 Deficiency (Continued)
Description (Continued)
During the site visit the team conversed with a site engineer regarding seismic requirements for the instrument air system. The engineer, who stated he was responsible for installation of air accumulators, erroneously stated that no portion of the instrument air system was required following an accident, and therefore that there was no need for seismic installation.
Basis: Contrary to 10 CFR 50 Appendix B Criterion IV, the licensee did not assure that applicable regulatory requirements, design bases, and other requirements which are necessary to assure adequate quality are suitably included or referenced in documents for procurement of services.
Omaha Public Power District committed to Regulatory Guide 1.33, which endorses ANSI N18.7 for quality assurance program requirements for operating reactors.
This standard requires that each procedure contain instructions in the degree necessary for performing a re-quired task by a qualified individual without direct supervision and that they contain appropriate references. Contrary to these require-ments the procedure did not address the installation requirements for seismic tubing.
Omaha Public Power District has committed to implement ANSI N45.2.11 for design activities associated with modification of safety-related structures, systems and components. Contrary to the requirements of this standard, a design analysis was not performed in a planned, con-trolled, and correct manner.
OPPD's RESPONSE Cause of Deficiency -
a.
The new actuator is approximately the same weight and geometry (new ac-tuator is actually 77 lbs. heavier) as the existing operator.
Based on the similarity of the new to the old actuator, an engineering decision was made that a seismic re-analysis was not necessary. OPPD requested an outside vendor perform an analysis to seismically qualify the new valve / actuator combination because OPPD desired to perform an addition-al check to confirm the new actuator / valve combination would perform as required during a seismic event.
It was not intended that this vendor analysis would be utilized as the basis for the seismic design and hence 10 CFR Part 50 Appendix B requirements were not placed on the vendor. The basis for the design was the above similarity argument.
b.
The instrument tubing runs in question were extremely short (less than 3 ft.) with sufficient anchors provided at the air accumulator tank and valve. OPPD's engineer utilized engineering judgment and decided that no additional supports were necessary.
This engineering decision was noted on the accumulator sizing calculation sheet.
A-20
-(
g r
' y 3
~-
D2.2-2-Deficiency (Continued)
OPPD's R.esponse (Continmi)
~
_,-c 1
c An ehaluation was performed to verify that the baseplate, Hilti anchor, c.
and welds were adequate. The allowable loads for the baseplate, anchors, and welds were in excess of the expected seismic responses basr,d on previous design experience. This evaluation was noted in the calculation sheets. This was done after the modification was
" completed Anengineeringdecisionwasutilizedtodeterminethatthe modification was adequate prior to installation. This was not documented.
Extent' to Which Condition May Be Reflected in the Unreviesed Portion of the Design -
a.
In those situations where vendor calculations will be used as the basis for CQE modifications, OPPD procedures require that vendor calculations to be performed in accordance with 10CFR50, Appendix B.
b.
The installation requirements for CQE instr'ument tubing is specified in the Fort Calhoun criteria for routing and support of seismic instrument tubing.
'g c.
The installation of CQE air systems is also discussed under Deficiency D3.2-2.
In modification MR-FC-83-158, an accumulator seismic calcula-tion was also prepared.
This shows that' seismic accumulators are being supported adequately when they are required for modifications.
Action to Correct the Existing Condition -
a.
OPPD has retained the vendor that performed the original analysis to re-perform the analysis in accordance with 10CFR50, Apgepdix B.
The analysis has been completed with satisfactory results.
b.
No action is required.
c.
OPPD's discussion of the lack of documentation of engineering decisions is presented in Attachrsent B, Item 1.
Action to Prevent Recurrence -
a.
The OPPD procurement procedures will be reviewed as part of the Design Change / Modification Program review'as discussed in the cover letter.
b.
OPPD is developing a s'pecial training session for thd: hpplicable design groups to re-erphasize the necessity to.use of the Fort Calhoun cri-teria for routing and support of seismic., instrument tubing.
f 4
,e
~
A-21 y e
.i.
t,
D2.2 Deficiency (Continued)
DPPD's Response (Continued) c.
OPPD is developing a special training session for the applicable design groups to reemphasize the importance of adequately calculating and documenting the anchorage of CQE air accumulators.
Other Relevant Information b.
The seismic supporting of original CQE instrument tubing for air systems will be addressed under the OPPD's evaluation of IE Infor-mation Notice 85-84.
c.
The seismic supporting of original CQE air accumulators will be addressed under the OPPD's evaluation of IE Information Notice 85-84.
A-22
D2.2 Deficiency - Incomplete Installation / Testing Procedure Performed For MR-FC-81-21B DESCRIPTION: Modification, MR-FC-81-21B is a completed modification which replaced fail close pneumatic actuators with actuators that fail open. The replacement actuators were installed on valves HCV-438B and HCV-4380.
Those valves are containment isolation valves located outside containment j
i in the component cooling water supply and return lines associated with the j
reactor coolant pump lube oil coolers and seals. This completed modifi-cation added instrument air accumulators to these valves to permit the operator to maintain the valves closed until operator action could be taken locally to manually close the valves. This modification was completed in 1983 and was similar to modification planned for the 1985 outage (i.e.,
MR-FC-83-158).
The team reviewed the post-modification testing accom-plished in view of the team's concerns expressed in Deficiency D2.1-7.
The post-modification test procedure did not require the use of the pres-surized volume of the accumulator to shut the valves. The installation and test procedure closed HCV-438B and D, then isolated air from the instrument l
air header by closing valves IA-174 and IA-175.
In this configuration, only a static test was conducted. The test procedure did not require the use of the pressurized volume of the accumulator to shut the valves. The acceptance criteria was to ensure that the valves remained shut for twenty minutes; however, the team found no documented basis that twenty minutes was a sufficient period of time to identify the need to manually close these valves and to physically have a plant operator perform the required action locally at the valves.
Basis: Omaha Public Power District has committed to Regulatory Guide 1.33, which endorses ANSI N18.7. This standard requires that modifi-cations which affect functioning of safety-related structures, systems, or components be inspected and tested to confirm that the modifications or changes reasonably produce expected results and the change does not reduce safety of operations. These test procedures are to include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satis-factorily accomplished. Contrary to these requirements, the test procedure would not have confirmed that the modification produced expected results and did not have acceptance criteria for acceptable air leakage.
OPPD's RESPONSE Cause of Deficiency -
D2.2-3a.
Functional testin~g..of this modification was discussed by the engi-neer and plant operations. The reason a functional test was not performed under 81-21B is because the shift supervisor and the design engineer were concerned that valve cycliny during system operation would cause unaccept-able transients in the system.
A-23
D2.2 Deficiency (Continued)
OPPD's Response (Continued)
D2.2-3b.
Performance testing to demonstrate the capability of the CQE portion of the instrument air system to perform its safety function will be addressed in the Design Change / Modification review program discussed in the cover letter.
D2.2-3c. OPPD operating and engineering staff have reviewed and have de-termined that the 20 minute period was chosen after discussion with plant personnel. During these discussions it was determined that because of the close proximity of Room 13 to AI-100, 20 minutes would be ample time for operator action. This was not documented.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
a & b. Post-modification testing to confirm operability of equipment is discussed in Attachment B, Items 3 & 4.
c.
Documentation of the basis for operator action is related to documen-tation of engineering decisions. OPPD's response to lack of documen-tation of engineering decisions is included in Attachment B, Items 1
& 4.
Action to Correct the Existing Condition -
a.
See response in Action to Prevent Recurrence below b.
See response in Cause of Deficiency above.
c.
See response in Action to Prevent Recurrence below Action to Prevent Recurrence -
a.
OPPD is developing a training session to address the preparation of air accumulator calculations. (see D.2.2-1) b.
See response in Cause of Deficiency c.
OPPD is of the opinion that 20 minutes is adequate time for operator action. However, for an added assurance, OPPD will make provisions to have an operator simulate manually isolating the valves in question.
1 A-24
D2.2 Deficiency - Incorrect Information On Instrument Air Diagram DESCRIPTION: The team reviewed the portions of the instrument air system while evaluating post-modification testing requirements for planned modi-fication MR-FC-83-158 and completed modification MR-FC-81-218.
Instrument air header isolation valves, IA-175 and IA-176, were used during the installation and testing of modification MR-FC-81-218. However, these valves do not appear on OPPD drawing 11405-M-264.
It appears that these valves were overlooked when preparing the drawing or incorrectly deleted.
During a field inspection the team confirmed that the valves are installed in the plant.
Basis: Omaha Public Power District has committed to Regulatory Guide 1.64, which endorses ANSI N45.2:11. This standard requires that docu-ments, including changes, be reviewed for adequacy and approved for release by authorized personnel. Contrary to this requirement, a document was released which did not depict the as-installed piping /
valving arrangement in the plant.
OPPD's RESPONSE Cause of Deficiency -
The valves (IA-175 & IA-176) are small instrument isolation valves which are in the non-CQE portion of the instrument air system. Although these valves were used to isolate the CQE portion from the remainder of the instrument air system during the static test, no credit is taken for these valves under accident conditions. Note that CQE valves that serve to sep-arate the non-CQE and CQE portions of the instrument air system are shown on the drawing. Considering these are small non-CQE valves and it was not mandatory to show these valves on the P&ID. The fact that these are not shown does not justify a deficiency classification of this item.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
It is OPPD's practice to show this type of non-CQE valve at the option of the design engineer and his supervisor.
Action to Correct the Existing Condition -
None required A-25
' 5
D2.2 Deficiency (Continued)
OPPD's Response (Continued)
Action to Prevent Reciarrence -
OPPD will review the option of not showing these valves on the instrument air flow diagram to determine if specific guidance on this topic is re-quired.
l f
l l
l t
i
.s A-26
D2.2 Deficiency - 10 CFR 50.59 Safety Evaluation Based Upon An Incorrect Assumption and Analysis Methodology DESCRIPTION:
Modification MR-FC-81-21B is a completed modification which replaced fail close pneumatic actuators with actuators that fail open. The replacement actuators were installed on valves HCV-438B and HCV-4380.
These valves are containment isolation valves located outside containment in the component cooling water supply and return lines associated with the reactor coolant pump lube oil coolers and seals. This completed modifica-tion added instrument air accumulators to these valves to permit the valve operator to maintain the valves closed until operator action could be taken to manually close the valves.
In addition, the modification added a com-ponent cooling water pressure low signal in series with a containment isolation actuation signal such that the presence of both signals is neces-sary to close the valves. As a resu heat load was increased by 3.15 x 10gt of this modification, the post-LOCA BTU / hour which corresponds to the heat !oad from the reactor coolant pump seal and lube oil coolers.
A safety evaluation was included in the Final Design Description for the modification.
This evaluation concluded that (a) the modification would not increase the probability of an occurrence or the consequences of an accident from the analysis previously done in Volume 4, Section 9.7 of the Fort Calhoun USAR, (b) the modification would not create the possibility of an accident or malfunction other than those analyzed in Volume 4, Section 9.7 of the Fort Calhoun USAR, and (c) the modification would not reduce the margin of safety as defined in the basis for technical specifications since this is not a basis for a technical specification.
This modification was completed and site accepted in May of 1983.
Based upon the team's review of this safety analysis the following conclusions were made:
o The safety analysis performed by an OPPD Design Engineer did not refer to original design calculations. The lack of original design analyses or their unavailability did not result in the performance of new calculations, instead the Design Engineer used a qualitative argu-ment based upon USAR statements.
o The qualitative arguinent used by the OPPD Design Engineer does not reflect a correct understanding of the heat transfer phenomenon between heat removal systems.
Specifically, the team found that the quali-tative argument implicitly assumed that the design heat removal capacities of equipment coolers and heat exchangers are independent of each other and therefore can be added and subtracted to determine heat removal capacity between systems.
o The safety evaluation contains an unsubstantiated and inappro-priate assumption concerning operator action to secure heat loads under certain accident conditions.
o The basis of technical specification 2.4 contains incorrect infor-mation concerning the heat removal capacity of the component cooling water heat exchangers.
A-27
Y t
f D2.2 Deficiency (Continued)
Description (Continued)
?
?
Although the Design Engineer stated that the margin of safety as defined in the basis for a technical specification was not reduced, it appears that he recognized that the basis of technical specification 2.4 contained informa-tion which was incorrect and required revision regardless of the proposed modification. This is evident by comments made in the safety analysis of i
the Final Design Description. The basis of technical specification states i
that three component cooling heat exchangers have sufficient capacity (with ample reserve);to remove 420 x 106 BTU / hour following a loss-of-coolant accident. However, the safety analysis in the modification file indicates l
that the heat removal value of.420 x 106 BTU / hour corresponds to the capacity of the containment air coolers (two units rated at 140 x 106 BTU / hour / unit), not the component cooling water heat exchangers. The i
safety evaluation states that thg heat removal capacity of the component cooling water system.is 402 x 100 BTU / hour assuming three of four heat exchangers and two of three pumps are available.
To address the addition of 3.15 x 106 BTV/ hour from the reactor coolant pump seal and lube oil coolers and the apparent existing error in the basis of the technical specification, the design engineer presented the following j.
rationale for concluging no safety impact.
First, he noted that the USAR states that 280 x 10 BTU / hour of heat reraoval capacity is assumed in the containment pressure and temperature analysis and that both the containment spray system and the containment air cooling system are each designed to remove heat in excess of this value during post-LOCA conditions. Second, he states that the containment spray system is indepencant of the contain-ment air cooler system (i.e., as long as either system is available the containment heat removal function will be satisfied). Third, he eliminates from further consideration heat loads from the containment spray system to the component cooling water system by noting that component cooling water is.only supplied to the shutdown cooling heat exchangers to remove contain-ment spray system heat loads upon receipt of a recirculation actuation signal which occurs later in the accident, when air cooling loads are sig-nificantly reduced.
Based upon the foregoing, the design engineer appears to have concluded that the post-LOCA heat load geen by the component cooling water system can be as high as 425 x 100 BTU / hour immediately following an accgdent if all containment air cooling coils perform as de-signed (425 x-10 BTU / hour based upon the sum of 420 x 100 BTU / hour fra containment air cooling coils, 3.15 x 106 coolant pump seal and lybe oil coolers, 0.3010gTU/ hour from the reactor BTU / hour from charging pump coolers, 1.05 x 100 BTU / hour from the safety injection and contain-i ment spray pump coolers, and.0.30 x 106 BTU / hour from the control room air conditioning).
Because this value exc>eds the designed heat removal capacity of the componcnt cooling water heat exchangers, the design engi-neer assumed in the safety eviluation that if all containment air cooling i
system units operated as gesigned that the operator would select one cool-ing unit rated at 70 x 10 BTU / hour and isolate it to reduce the post-LOCA heat load to 355 x 106 BTU / hour.
This value is then within the heat removal capacity of the component cooling water system.
I h
t l
L A-28 t
k l
02.2 Deficiency (Continued)
Description (Continued)
Based upon the documentation in the modification file and the lack of any reference to design analysis in the safety analysis, it appears that no comparison was made to original design calculations. The team determined that design calculations are not controlled by 0 PPD as living design docu-ments but are filed when performed with the modification package. The team was informed that original calculations performed by the architect-engineer during construction may or may not be available because the original design was performed in the late 1960's and that the information that is available is in storage. The team found that some original architect-engineering in-formation was located in files within Generating Station Engineering's document control area and some information was located outside the building in commercial storage. However, the team determined that these files were not organized into a workable source of original design information for as-sessing the original design basis. As a consequence, the team found that this information was not generally used by design engineers working on modi-fication packages.
It appears that the OPPD Design Engineer resorted to using information contained in the USAR without confirming its accuracy and also used qualitative judgements to conclude that the modification was adequate.
To implement this safety evaluation, the Design Engineer prepared proposed revisions to the basis of technical specification 2.4 and USAR sections 1.4, 6.3, 6.4, and 9.7.
The team determined that all of the USAR sections were revised in accordance with the Design Enginee's ircot,ect safety analysis.
In spite of the Dasign Engineer's asstmptic. of operator action, the emergency operating procedure for a LOCA was not revised. The emerg-ency procedure does not instruct or caution the operator to secure one containment air cooling unit if all cooling units start as designed and off-site power is available. As a consequence, the USAR does not agree with the emergency operating _ procedure. A Document Update Checklist com-pleted by the Design Engineer indicates that operating instructions and emergency procedures do not require revision even though his safety evalu-ation and USAR revisions require such action.
The team found that controlled copies of the Technical Specifications in the control room and in Generating Station Engineering's reference library still contained an unrevised basis for technical specification 2.4.
Spec-ifically, the heat removal capacity of the component cooling water heat exchangers is described as 420 x 106 BTU / hour instead of 402 x 106 BTV/ hour.
Basis:
Omaha Public Power District has committed to Regulatory Guide 1.64, which endorse ANSI N45.2.11. This standard requires that design changes be reviewed and approved by the same groups or organizations which reviewed and approved the original design documents. When an organization which originally was responsible for approving a particular design document is no longer available, A-29
D2.2 Deficiency (Continued)
Basis (Continued) the ANSI N45.2.11 Standard states that the plant owner shall desig-nate a new responsible design organization which may be the owner's own engineering organization and that the designated organization shall have access to pertinent background information, have demon-strated competence in the specific design area of interest and have an adequate understanding of the requirements and intent of the original design.
Contrary to these requirements, Omaha Public Power District's Generating Station Engineering organization did not have access to original design analyses nor did not prepare comparable design analyses in the absence of such design analyses.
Instead, a qual-itative argument was employed based upon an incorrect understanding of the heat transfer phenomenon between heat removal systems.
10 CFR 50.59 permits licensees to make changes, conduct testing or experiments as described in the safety analysis report without Commission approval, unless such action involves a change in the technical specif.ations or an unreviewed safety question. An un-resolved safety question is defined, in part, to occur if the margin' of safety as defined in the basis for any technical specification is reduced.
Contrary to this requirement the licensee did not identify that the basis of a technical specification was incorrect.
OPPD's RESPONSE:
Cause of Deficiency -
OPPD has reviewed the safety evaluation and accompanying documentation in detail.
Each of the bullets detailing the NRC inspection teams conclusions are discussed below:
It is OPPD's conclusion that the Design Engineer properly utilized the information contained in the USAR concerning the heat loads and capacities of the containment air cooling system, the containment spray system, and the component cooling water system (CCW). The use of the USAR as a source document is correct unless there is evidence that the information is no longer valid.
OPPD can find no evidence that the Design Engineer did not have a correct understanding of,the heat transfer phenomenon as stated by the NRC inspection team. The following is a summary of what OPPD considers the intent of the safety evaluation performed by the Design Engineer:
The maximum heat load requirgd to be removed from the containment following a LOCA is 280 x 100 BTV/ hour to maintain the containment pressure and temperature hithin design limits. Thus, the maximum A-30
D2.2 Deficiency (Continued)
OPPD's Response (Continued) 6 design load on the CCW system following a g0CA is 280 x 10 BTU / Hour plus miscelganeous heat loads of 1.65 x 10 BTU / hour for a total of 281.65 x 10 BTV/ hour. Allowing the reactor coolant pumps to operate withcoolingwatertothelubeoilcoolersandseals, post-L0gAadds another 3.15 x 106 BTU / hour for a revised total of 284.8 x 10 BTU / hour as a heat load on the CCW system.
The heat removal capacity of the CCW system is 402 x 106 BTU / hour (incorrectly stated in the Technical Specification basis as 420 x 106 BTU / hour, apparently due to a typo). Thus, the conclusion drawn by the Design Engineer was that there was ample capacity in the CCW system without affecting the margin of safety in the Technical Specifications.
Operator action following a LOCA is not required for the containment air cooling or CCW systems in order to maintain containment temperature and pressure within design limits.
The Design Engineer noted that since the system has a larger capacity than required, it would increase efficiency if the operator shut down one of the units. Thus, his recommendation to revise the emergency procedures was based on normal engineering practice and was not necessary to assure the Technical Specification margin of safety.
The recommendation to shutdown one of the units was not adopted following discussions with the pl:nt operations staff. Since the recommendation was not accepted, the plant procedures EP-5 & EP-5A were changed to require the operators to monitor CCW pressure and isolate CCW to RCP seal coolers if CCW pressure drops.
TheUSARchangeproposedbythgDesignEngineerwasgochangetheCCW system heat load from 420 x 100 BTU / hour to 355 x 10 BTU / hour It was not, as far as OPPD can determine, to correct the 420 x 108 BTU / hour number to the 402 x 106 BTU / hour figure which is the CCW system capacity as defined in the Technical Specifications.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the
-Design -
The lack of design basis documentation is discussed in Attachment B, Items 2 & 4.
Action to Correct the Existing Condition -
OPPD will submit to the NRC _a6 Application for Amendment to Technical Spgcification to incorporats the correct CCW system heat capacity of 402 x 100 BTU / hour and review the USAR during the 1986 update.
A-31
~ D2.2 Deficiency (Continued)
OPPD's Response (Continued)
Action to Prevent Recurrence -
OPPD will review the Design Change / Modification Program as discussed in the cover letter.
'E J
h l
A-32
D3.1-1 Deficiency - Plant Design Specification DESCRIPTION: Section "H" of OPPD Contract No. 763 contains 46 design spec-ifications which governed the analysis, design, fabrication and testing of balance-of-plant piping systems and equipment procedure for Unit No.1, Fort Calhoun Station.
The design specifications contained in OPPD Contract No. 763 do not con-stitute a controlled design document. These specifications have not been revised or distributed to the design staff. The corresponding specifica-tions issued by the architect-engineer, Gibbs, Hill, Durham and Richardson, which derived from the specifications detailed in Contract No. 763; have also not been revised or distributed to the engineering staff in a control-led manner. These latter specifications were design input for piping at the plant. As an example, OPPD's Piping and Instrumentation Diagram 11405-MECK-1 notes that:
"All piping shall be in accordance with the re-quirements of the latest issue of Gibbs & Hill Piping Specification H-1."
However, OPPD could not access this document during the inspection.
In the absence of the design specifications issued by the architect-engi-neer, the design specifications contained on Contract No. 763 appear to be used as the defining design document for much of the plant piping and equipment.
Basis: The Omaha Public Power District Quality Assurance Manual (which implements Omaha Public Power District commitments to ANSI N45.2.ll) requires that:
- 1. " Applicable design inputs, such as design bases, regulatory require-ments codes and standard, shall be identified, documented and their selection reviewed and approved. Changes from specified design in-puts, including the reasons for the changes, shall be identified, approved, documented and controlled," (Chapter 5.1 of Plant Design and Modifications, Section 4.2, Design Inputs, Subsection 4.2.1.),
and:
- 2. " Methods shall provide for relating the final design back to the source of design input. This traceability shall be documented."
(Chapter 5.1, Section 4.2, Subsection 4.3.3)
Contrary to these requirements, plant design specifications are not being controlled.
OPPD's RESPONSE Cause of Deficiency -
Contract No. 763 is not a controlled document. The lack of design basis documents is addressed in Attachment B, Item 2.
A-33
l l
D3.1 Deficiency (Continued)
OPPD Response (Continued)
The G&H piping specification H-1 as referenced on P&ID 11405-Mech-1 is exactly the same as specification H-1 in Contract 763 (Mech-1 was issued and was part of Contract 763).
It is true that the OPPD's engineers use Contract 763 as a reference document, and it is not a controlled document. However, the information in Contract 763 is contained in other documents that are controlled (such as piping isometrics, P&ID's, Quality Assurance inspection documentation, technical specifications, USAR, etc.).
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
The use of uncontrolled documents as design basis documents is addressed in OPPD's cover letter. The extent of this condition is discussed in Attachment B, Item 4.
Action to Correct the Existing Condition -
See the cover letter for the discussion of the design change / modification program review.
Action to Prevent Recurrence -
OPPD will review the Design Change / Modification process as described in the cover letter.
A-34
D3.1 Deficiency - Design Temperatures for Safety-Related Piping DESCRIPTION:
In order to qualify a piping system, either by explicit or generic analysis, the imposed loads, which include consideration of operat-ing and accident temperature, must be defined.
In 1980, OPPD provided temperature data to Gilbert / Commonwealth to re-analyze a number of safety-related piping systems in the Ft. Calhoun plant in response to Bulletin 79-14. Generating Station Engineering (GSE) verb-ally requested that Technical Services (TS) collate the operating and accident temperatures for the safety-related piping in Ft. Calhoun. Tech-nical Services subsequently transmitted this data to Generating Station Engineering on a marked-up set of piping and instrumentation diagrams.
Technical Services compiled this temperature data from the FSAR, and from analytical and operating data. OPPD subsequently transmitted the set of marked-up piping and instrumentation diagrams to Gilbert / Commonwealth for use in their reanalysis. The marked-up set of piping and instrumentation diagrams is not a controlled document.
The original analysis temperatures which the architect-engineer (Gibbs, Hill, Durham and Richardson) originally used to perform piping analysis was not accessed in preparing the transmittal of information to Gilbert / Commonwealth. Neither the licensee nor the team could determir.e if the operating and accident temperatures which Gilbert / Commonwealth used to reanalyze a number of safety-related piping systems were consistent with the temperature data originally used to qualify these piping systems.
The operating and accident temperatures detailed on the marked-up piping and instrumentation diagrams were used for all reanalysis work performed by Gilbert / Commonwealth, and may have been used subsequently by OPPD for modifications to the installed piping.
Basis: The transmittal and use of uncontrolled temperature data is con-trary to the following requirements of the Omaha Public Power District Quality Assurance Manual:
1.
Chapter 3.1, Document Control, Section 4.0, Requirements and Controls, Subsection 4.1.1, which notes, in part, that:
"The preparation, issue and change of documents that specify quality requirements or prescribe activities affecting quality shall be controlled to assure that correct documents are being employed";
2.
Chapter 5.1, Control of Plant Design and Modifications, Section 4.2, Design Inputs,; Subsection 4.2.1, which notes that:
" Applicable design 16 puts, such as design bases, regulatory re-quirements, codes add standards, shall be identified, documented and their selection reviewed and approved.
Changes from specified design inputs, including the reasons for the changes, shall be identified, approved documented and controlled";
3.
Chapter 5.1, Section 4.3, Design Process, Subsection 4.3.3, which back to the source of,shall provide for relating the final design notes that: " Methods design input. This traceability shall be documented";
A-35
D3.1 Deficiency (Continued)
Basis (Continued) 4.
Chapter 5.1, Section 4.4, Interface Control, Subsection 4.4.4, which notes that: " Procedures shall be established to control the flow of design information between Divisions / Departments.
Design basis information transmitted from one Division / Department to another, shall be documented and controlled. Transmittals shall identify the status of the design basis information or documents provided and, where necessary, identify incomplete items which require further evaluation, review, or approval. Where it is necessary to initially transmit design basis information orally or by other informal means, the transmittal shall be confirmed by a controlled document," and; 5.
Chapter 5.2, Calculational Analysis, Section 4.0, Requirements and Controls, Subsection 4.1.1, which notes, in part, that:
" Refer-ences and calculation inputs shall be identified, and shall be traceable to their source documents to permit subsequent verifica-tion."
OPPD's RESPONSE Cause of Deficiency -
This issue occurred because of lack of emphasis on documenting the commun-ication of design information between OPPD departments.
Extent to Which Condition May be Reflected in the Unreviewed Portin of the Design -
The cover letter discusses OPPD's plans to perform an overall review of the Design Change / Modification Program. The methods to adequately docu-ment design information and the extent to which this condition may be re-flected in the Unreviewed Portion of the Design is discussed in Attachment B, Items 2 and 4.
Action to Correct the Existing Condition -
As a result of the NRC inspection finding, Technical Services has reviewed and updated the operating. temperatures given to GSE in 1980. GSE and Tech-nical Services are evaluating the updated information. After completion of current investigations into conservatisms associated with the analysis process, GSE will incorporate the updated information into an overall up-date of piping analysis.
A-36
D3.1 Deficiency (Continued)
OPPD Response (Continued)
Action to Prevent Recurrence -
A method of ensuring documentation of design data exists. That method is the development of an Operations Support Analysis Report (0SAR) to support any design assistance requests. OSAR's are documented per Technical Services procedure N-TSAP-5 and developed per procedure N-TSAP-6.
These documents meet the requirements of OPPD QA Manual 3.1 and 5.1 as cited under deficiency D3.1.2.
Performance of an overall review of the Design Change / Modification program will include the methods of adequately documenting and controlling design information.
l A-37
U3.1 Unresolved Item - Small Bore Pipe Support Spacing DESCRIPTION:
Piping two inches and smaller was field routed for Unit No.
1, Ft. Calhoun Station. Peter Kiewit Sons' Co., the contractor performing the field routing, based restraint spacing and type on the technical criter-la detailed in " Recommended Procedure for the Support & Seismic Restraint of Piping 2 Inch and Smaller." This procedure was developed by the contrac-tor on the basis of technical data developed by the architect-engineer, Gibbs, Hill, Durham and Richardson, Inc.
The contractor's support spacing criteria differ from the seismic criteria detailed in the USAR for piping penetrating the containment.
As noted in the procedure under the heading entitled, SEISMIC DESIGN CRITER-IA:
"The calculation method used in determining seismic forces is based on the premise that the piping as restrained falls within the rigid range which precludes the possibility of the piping going into resonance with the imposed and/or building response frequency, thereby allowing the use of con-servative seismic acceleration design factors.
The minimum natural frequen-cy as designated by the engineers is 20 cycles per second in the horizontal direction and 60 cycles per second in the vertical direction for the Intake Structure, and 6 cps horizontal,18 cps vertical for the Auxiliary Building and Containment."
USAR Appendix F, subsection F.2.2.2, notes that:
"The first step in seis-mic analysis of piping was to position seismic restraints closely enough to ensure that the natural frequency of piping in the auxiliary building and containment building was 6 hertz horizontally and 18 hertz in the vertical direction."
However, USAR subsection F.2.5 specifies a more stringent criterion of 12 (rather than 6) hertz in the horizontal direction:
"Therefore, for those piping runs which penetrate the containment shell or are otherwise connec-ted to it, the spacing of restraints was such as to assure a lowest domi-nant natural frequency of 12 Hz horizontally and 18 Hz vertically for the pipe run up to the first point of full fixity."
Basis: Based on the available documentation small-bore Class I pipe con-nected to or penetrating the containment may not meet USAR seismic criteria, considering the discrepancy between the contractor's sup-port spacing criteria and the seismic criteria detailed in the USAR for small-bore (Class I) pipe penetrating or connected to the con-tainment shell.
No additional field routing procedures or analyses were available which address increased horizontal rigidity for these piping systems.
OPPD's RESPONSE f
The significance of the finding can be better understood by referring to the USAR and noting that the difference in design "G" forces between a piping system at 6 Hz and one at 12 Hz is approximately 19 What this A-38
U3.1 Unresolved (Continued)
OPPD's Response (Continued) basically means is that if a piping system was installed with a natural frequency of 6 Hz it must be designed to withstand roughly 1 more "g" of acceleration force (or ioughly double the restraint loading) than a system installed with a natural frequency of 12 Hz.
However, to add additional conservatism to the curves, the original A/E assumed that mass 2, containment shell, had structural damping of 2%. (in comparison to the 5% assumed for the auxiliary building). This is the ma-jor reason for relatively greater magnitude of the indicated response for mass 2.
The actual damping would be closer to 5%. This would have the effect of lowering the " blip" in the response curve at 6 Hz to the value derived for the auxiliary building, (i.e., would effectively resolve the issue in question).
There is a significant amount of evidence which indicates that pipe damping values should be increased. This can result in a reduction in forces (and therefore stresses) of approximately 50%.
It can be shown for the Fort Calhoun Station specific response that if a 5% equipment damping (pipe damping) is assumed, the "g" force for a system at 6 Hz is approximately 1.0 "g".
The difference in "g" forces is not significant between 6 Hz system and a 12 Hz system.
Increasing equipment damping has the effect of reducing the "g" forces significantly. Based on the above, OPPD believes there is no safety concern and the information above should resolve this item.
i A-39
4 5
U3.2 Unresolved Item - MR-FC-84-61 Design Input Source and Use.
DESCRIPTION: The team reviewed modification request FC-84-61, which j
installed unions to facilitate the periodic removal of safety injection relief valves SI 209, 213, 217, and 221 for setpoint testing.
USAR Appen-dix F defines the safety injection system as a Class I system.
The Final Design for MR-FC-84-61 (Reference 1) does not reference:
I
- 1. 'The source of analysis temperatures and pressures used as calculation input for the portion of the safety injection system to be modified; 2.
The governing load combinations detailed in USAR Appendix F, Table F-1;.
3.
The vendor drawing for the safety injection tank relief valves;
'4.
The design basis for the seismic qualification of the safety injection system, and; I
5.
Existing support locations and types for the portion of the safety injection system to be modified.
With respect to item 1, only the rated oressure at maximum operating temp-erature is specified for the safety injection tank / relief valve system; the pressure is specified as 265 psig in Section 6.0 of the Final Design, and as 275 psig in Section 7.0 of the Final Design. With respect to items 2-5, the team found that the engineer did not analyze seismic effects and did not document his judgement that such analysis was not required.
4 i
Basis: The Omaha Public Power District Quality Assurance Manual which im-plements the licensee's commitments to ANSI N45.2.11, requires that:
- 1. " Applicable design inputs, such as design bases, regulatory require-ments, codes and standards, shall be identified, documented and their selection revie' ed and approved", (Chapter 5.1, Control of w
Plant Design and Modifications, Section 4.2, Design Inputs, Subsec-tion 4.2.1);
- 2. " Analyses shall be sufficiently detailed as to purpose, method, assumption, design input, references and units such that a person i
. technically qualified in the subject can review and understand the analyses and verify the adequacy of the results without recourse to the originator," (Chapter 5.1,- Section 4.3, Subsection 4.3.5).
4 Contrary to these requirements, the licensee has not identified the source of design input and sufficiently documented analyses includ-ing engineering judgements.
4 A-40 1
.. s
U3.2 Unresolved (Continued)
OPPD's RESPONSE The modification in question involved adding a small increase in mass (a union) to small diameter piping system attached to the SI tanks.
Since the mass increase was small it was determined by OPPD's engineers that there would be no effect on the SI tank by the addition of the small mass. OPPD engineers also determined that the performance of a rigorous analysis would involve the following:
- 1) complete field verification of all connected small piping and support placement, 2) piping analysis of all piping to de-termine movements and stresses, 3) seismic analysis of the SI tank to deter-mine its movements.
This amount of effort was not deemed necessary by the design engineer, checker, and independent review 9r, because it was consid-ered obvious that the nodification would have negligible effect on the system. OPPD considers that the decision of its engineers was appropriate and that no further action is necessary. This engineering decision was not documented.
The lack of documentation of engineering decisions is covered in Attachment 8, Item 1.
The lack of design basis documentation is alsc~ covered in Attachment B, Item 2.
A-41
D3.2 Deficiency - MR-FC-83-158 Installation Procedure DESCRIPTION: Support design for tubing and small-bore piping, which ad-dresses the governing seismic criteria, is normally performed on a generic basis.
Support spacing is then accomplished in accordance with generic de-sign guidelines, instead of a detailed physical or isometric drawing.
The installation procedure for modification request FC-83-158 does not address support spacing requirement for tubing.
Modification request FC-83-158 provides air accumulators with check valves for valves YCV-10545 A & B.
These valves are on the steam feed to the tur-bine auxiliary feedwater pump FW-10, and are fail open valves. The Final Design provides a sketch which schematically locates the new tubing, valver and air accumulator with respect to the existing air set and root valve.
However, the installation procedure does not reference a generic support spacing procedure. The team notes that Stone & Webster prepared such a guideline for 0 PPD in 1982, which provides generic routing support criteria for seismic instrument piping.
The team also notes that the radial loca-tion of the Hilti bolts which restrain the air accumulator was not definec in Section 6.3 of the installation procedure.
Subsequent to the preparation of the installation procedure OPPD performed a calculation which seismically qualifies the air. accumulator support cor -
figuration. That calculation specifies a 9 inch radial location of the Hilti bolts with respect to the centerline of the air accumulator.
Basis: The licensee committed to ANSI N18.7, which requires that each ptoce-dure contain instructions to the degree necessary for performing a required task by a qualified individual without direct supervisian, and that the procedure contained appropriate references.
Contr ry to this requirement, the procedure did not address the installat ion requirements for seismic tubing.
OPPD's RESPONSE Cause of Deficiency -
The standard support spacing was not originally specified because thn origi-nal placement of the accumulator was very close to the valve and the htand-ard support spacing was not applicable.
f Extent to WF;eh Condition May Be Reflected in the Unreviewed Portionl,of the Design -
The installation requirements of CQE instrument tubing is specified fn the Fort Calhoun criteria for routing and support of seismic instrument tubing.
This document provides adequate controls that CQE tubing required for mod-ifications is installed correctly.
A-42
D3.2 Deficiency (Continued) 6 PPD's Response (Continued)
Action to Correct-the Existing Condition -
Since field conditions required the movement of the accumulator farther from the valve than originally intended, the standard support. spacing be-came applicable and was utilized (added to the procedure via procedure change).
It was necessary to alter the standard spacing criteria. This was justified by alternate calculations. The tubing is seismically supported.
Action to Prevent Recurrence -
OPPD is developing a special training session for the applicable design groups to re-emphasize the necessity to use the Fort Calhoun criteria for routing and support of seismic instrument tubing.
l 4
4 J
A-43
D3.2 Deficiency - MR-FC-84-162 Calculation DESCRIPTION: A calculation prepared to qualify a modification to an exist-ing ventilation duct support must consider the specified design and opera-ting conditions, as well as the applicable seismic provisions of the USAR Appendix F.
The team reviewed modification request FC-84-162, which rede-signs two containment ventilation duct supports to improve personnel and equipment access. The containment heating, ventilation, air conditianing ductwork is categorized as Class I equipment. Team review of the calcula-tions filed with the modification indicates that:
1.
Thermal loads were not considered. Specification No. 21 specifies a design basis accident temperature of 288* F.
I 2.
The naturai frequency of the duct is computed on the basis of linear beam theory, which is unconservative for the intent of this calculation which is to establish that the duct has a fundamental frequency in the rigid range; i.e., greater than 33 Hz.
l l
'3.
The 4 in. x 4 in. x 1 in. horizontal support angle is sized on the l
basis.of a bending moment which is half the magnitude of the critical bending moment.in the angle (4954 vs. 10710 in-lb).
i 4.
The combination of vertical seismic and horizontal seismic loads in the transverse direction of the horizontal angle was not considered. There are no supporting calculations which justify this assumption.
5.
The new supplementary steel is to be painted; however, Specification No. 20 requires that supplementary steel be galvanized. There was no documentation addressing this deviation from the specification.
l Basis: The Omaha Public Power District Quality Assurance Manual which im-plements the licensee's commitment to ANSI N45.2.11 requires that:
- 1. " Applicable design inputs, such as design bases, regulatory require-ments, codes arid standards, shall be identified, documented and their selection reviewed and approved", (Chapter 5.1, Control of Plant Design and Modifications, Section 4.2 0.
Design Inputs, Sub-section 4.2.1).
- 2. " Methods shall provide for relating the final design back to the source of design input. This traceability shall be documented",
(Chapter 5.1, Section 4.3, Design Process, Subsection 4.3.3).
Contrary to its commitments, the licensee did not control design inputs nor relate the final design back to the source of design inputs.
t A-44
D3.2 Deficiency (Continued)
OPPD's RESPONSE Cause of Deficiency -
The NRC concern can be shortened by stating the design calculations were not complete. The following is a summary:
1.
Thermal loads were not considered.
2.
Natural frequency of duct was calculated unconservatively.
3.
Combination of vertical and horizontal loads in the transverse direc-tion was not considered.
4.
Painting was specified rather than using galvanized metal (as original-ly specified on contract document).
These parameters were considered by the Design Engineer during the design process. Because of the mass of the ventilitation ducting, the engineer decided that these items would have negligible affect on the design. This engineering evaluation was not documented.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
Calculations performed subsequent to the NRC audit have determined that OPPD's engineering decision was adequate. No further occurrences are ex-pected in the unreviewed portion of the design.
Lack of documentation of engineering decisions and the extent to which the condition may be reflect-ed in the unreviewed portion of the design are discussed in Attachment B, Items 1 and 4.
Action to Correct the Existing Condition -
OPPD has revised the calculations to take into account items 1, 2, and 3 above. They are complete, checked and verified. The modification design was not modified as a result of the revised calculations.
The revised cal-culations confirmed the original engineering judgment was appropriate.
In lieu of galvanized material; galvanized paint was utilized. This is consid-ered adequate.
Action to Prevent Recurrenc' -
e OPPD has obtained additional reference material containing supplemental cal-culational methods for the dhtermination of the natural frequency of duct-work. OPPD will initiate a special training session to inform applicable design groups of the new reference material.
A-45
D3.2 Deficiency - Junction Box Supports DESCRIPTION: The team inspected valve YCV-1045B, which is on the steam feed to turbine auxil'ary feedwater pump FW-10, during a plant walkdown conducted on September EO, 1985.
The team noted that junction box JB-432A, which supplies power to the opera-tor for valve YCV-10458, is restrained by a pair of unistrut supports, which are in turn supported by conduits EB-4943, EB-9494 and EB-9127.
The team questioned the support configuration for this junction box, in that unistrut supports are normally used to support conduit and conduit are generally not used as supporting members. OPPD could not produce a seismic analysis which qualifies this configuration.
Basis: USAR Appendix F requires that appurtenances to Class I systems be seismically qualified to the Class I standards detailed therein. As noted in Subsection F.1.3 of USAR Appendix F; "All supports assoc-iated with Class I equipment are to be designed to Class I stardards i.e., in accordance with the seismic criteria detailed in USAR Appen-dix F".
Centrary to USAR commitments, the licensee has not denon-strated seismic qualifications of the above equipment.
OPPD's RESPONSE Cause of Deficiency -
The cause of this deficiency was an inability to retrieve the original plant design basis calculations, (either within OPPD or from the original vendors), to justify the seismic qualifications of the existing conduit and junction box supports. The lack of design basis records is addressed in Attachment B, Item 2.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
A discussion of the lack of design basis documents and the extent to which the condition may be reflected in the unreviewed portion of the design are provided in Attachment B, Items 2 and 4.
Action to Correct thr: Existing Condition -
A separate seismic support for the junction box for YCV-1045B was designed, analyzed, and installed during the 1985 refueling outage per modification MR-FC-85-201.
Action to Prevent Recurrence -
See above responses A-46
D3.2 Deficiency - Steam Generator Nozzle Dams DESCRIPTION: OPPD' contracted for the fabrication of removable pipe plugs (dams) for the hot and cold leg pipes of the steam generator (MR-FC-84-92) to enable refueling to proceed concurrently with primary head work such as eddy current examinations. As such, these dams are the boundary of the re-actor coolant system during such refueling operations.
The steam generator nozzle dams are designated as critical quality elements on Purchase Order No. 7234, and are therefore subject to the seismic provi-sions detailed in USAR Appendix F for Class I equipment.
However, OPPD Con-tract No. 1453, to Nuclear Energy Services (NES) did not perform a seismic analysis.
Basis: The Omaha Public Power District failed to ensure that the steam gen-erator nozzle dams were qualified to the governing seismic provi-sions. USAR Appendix F, Section F.1.3, lists the reactor coolant system as a Class I System.
OPPD's RESPONSE Cause of Deficiency The deficiency was due to the lack of specific procedures or guidance for specifying requirements for CQE materials within the Nuclear Production Division.
Extent to Which Condition May be Reflected in the Unreviewed Portion of the Design 7
Normally, the Nuclear Production Division procures CQE cor,iponents such as tools and replacement components for which engineering < and design require-ments have been previously specified.
Consequently, there are no other known conditions similar to this finding in the unreviewed portion of the plant.
Action to Correct the Episting Condition A seismic analysis was herformed on the nozzle dams, therefore, the speci-fic deficiency was resci procedure that will pro;ived. Nuclear Production Division is developing a vide guidelines for the purchasing of CQE materials and services.
l Action to Prevent Recur ence The procedure being devtloped will provide guidance to preclude this co:idition.
A-47
a D3.2 Deficiency - YCV 1045B Valve Restraint DESCRIPTION: During the inspection, the team toured the plant to examine various equipment scheduled for modification during the upcoming outage.
The team examined auxilhry feedwater steam feed valve YCV-1045B, an air operated valve scheduled to have an accumulator added to ensure the valve operator's ability to close the valve following a steam generator tube rup-ture with concomitant loss of the non-safety instrument air system. The team noted that the valve's operator was ouestionably restrained by a thin rod attached to a stair post, and therefore examined the seismic qualifica-tion of the piping subsystem containing YCV-1045B.
In response to NRC Generic Letter No. 81-14, " Seismic Qualification of Aux-iliary Feedwater Systems," 0 PPD engaged Gilbert / Commonwealth to perform an t
evaluation of the auxiliary feedwater system at Ft. Calhoun Station. OPPD actions taken to bring the system into compliance with IE Bulletin No. 81-14 are contained in OPPD Modification Request No. FC-81-127.
MR-FC-81-127 summarizes the four major seismic deficiencies identified by Gilbert / Commonwealth. One of these, Item 2 of Form B states: " Valve Opera-i tors on Small Bore Piping. The current operator supports were found to be unstable. Modification work will involve removing the existing support j
rods and replacing them with a more stable support by the end of 1981.
Gilbert / Commonwealth specifically noted that the valve operator for valve YCV-1045B is unstable in the transverse direction, and recommended that the existing rod restraint be replaced with a strut in the transverse di-rection. Gilbert / Commonwealth recommended the addition of a number of supports for the steam drive and condensate portions of the auxiliary feed-water piping associated with pump FW-10. Gilbert / Commonwealth also recom-mended that a detailed stress analysis be performed to assure that the ad-ditional supports do not have a detrimental thermal impact on the system.
OPPD elected to perform the required analysis, using computer codes TPIPE and NUPIPE.
1 The licensee's response to Generic Letter 81-14 identified the four major i -
seismic deficiencies and included as attachments the Gilbert / Commonwealth Inspection Evaluation Report.and the calculation tabulating support dis-crepancies.
The licensee letter specifically committed to removing the existing support rods on the unstable valve operators and replacing them with more stable supports by the end of 1981. The attachments indicated support number AFW-15 was unstable. This is the support for YCV-10458, which the team questioned during their walkdown. The NRC letter forward-ing the safety evaluation for Generic Letter 81-14 concluded that the seis-mic qualification of the auxiliary feedwater system was acceptable provi-
)
ded that the four corrective actions committed to by the licensee were taken. One of these actions. (Item B) was to replace existing support rods for valve operators with more stable supports. Apparently, because the committed completion date was before issuance of the NRC letter, a tele-i phone call was made to the licensee to verify completion of these actions.
4 The letter documented the NRC's understanding that these actions have been completed. Notwithstanding these commitments and attempts at verifica-tion, the team noted the following:
A-48
- ~~
t Y
a r
3=
w e
D3.2-7'- Deficiency (continued)
Description (Continued) 1.
The-valve operator for valve YCV-1045B is currently restrained by a rod which is affixed to a stairpost; the strut substitution com-mitted to by OPPD was not implemented.
2.
The OPPD as-built drawing does not show either the valve operator or the existing rod restraint.
3.
The vendor drawing for valve YCV-1045B could not be obtained to verify the valve and operator weights, and operator offset dimen-sion with respect to the valve centerline; 4.
The valve operator restraint was not modeled in the stress analyses; 5.
There are no calculations which combine deadload, thermal and seismic stresses in the vicinity of the valve to confirm the structural adequacy of the. adjacent pipe; 6.
There are no calculations which combine deadload, thermal and seismic loads for the adjacent supports; based on cursory exami-nation of the computer output by the team, the supports appear to be overloaded, and; 7.
The TPIPE and NUPIPE computer runs are not referenced and are therefore not adequately controlled.
Basis: The primary basis for this deficiency is USAR Appendix F, which requires that Class I piping systems and equipment be seismically qualified to the Class I standards detailed therein.
In addition, the licencee's commitments in response to Generic Letter 81-14 were not implemented.
P A-49
D3.2 Deficiency (Continued)
OPPD's RESPONSE Cause of Deficiency -
The NRC inspection team findings are discussed in the same sequence as presented by the NRC.
1.
The strut substitution has not been implemented. The restraint in question (AFW-15) was one of those identified by Gilbert / Commonwealth as requiring a detailed thermal analysis prior to installation to de-termine if such a restraint would have a detrimental thermal impact.
This thermal, deadweight, and seismic analysis was performed and the result indicated that a rigid restraint at AFW-15 was not required.
The decision was then made not to install a new restraint at this point since the seismic loads without this new restraint are within allowable limits. Since the existing restraint offered no seismic advantage it was also decided to remove it. This was overlooked.
Note, however, that the existence of this restraint has no safety significance.
The results of the AFW seismic analysis were communicated to the NRC in a telephone conversation. A record of this telephone conversation between OPPD and the NRC is not available. However, the NRC SER (dated 2/10/82) already states that seismic restraints should be in-stalled provided that these supports will not have a detrimental impact on the AFW system.
In light of the above, OPPD considers that it has met its commitments to the NRC regarding the AFW seismic analysis.
2.
The as-built drawing does not show the rod restraint since it was sup-posed to have been removed. The original analysis did not model the actuator correctly. A new analysis was performed with the actuator modeled correctly and produced results not significantly different than the original analysis.
3.
The normal manner in which OPPD obtains valve weights and dimensions is to call the vendor and obtain this information directly.
4.
The existing valve operator restraint was not modeled in the original stress analysis. As described in Other Relevant Information, new stress analyses have bedn performed. These were run with and without the restraint in place. The analysis with a restraint indicated in-creased ' thermal stresses. The analysis without restraint produced stresses not significantly different than the original analysis (with-out a restraint).
5.
Both the original (perfohned on 8/7/82 and 2/17/82) and revised (per-formed in 1985) calculations combine the deadweight, thermal and seis-mic loads in the vicinitj of the valve to confirm the structural ade-quacy of the pipe. These calculations are available for review.
A-50
D3.2 Deficiency (Continued)
OPPD's Response (Continued) 6.
There are no detailea pipe support calculations. The small bore pi-ping issue is discussed under U3.1-3.
Small bore pipe restraints were not originally analyzed by rigorous calculational methods.
In general (AFW system is an exception), OPPD does not have design basis informa-tion on small diameter piping supports, support loading, or placement.
In this particular case, the combined loads (deadweight + thermal +
seismic) were tabulated and an engineering evaluation was performed to determine support adequacy. This evaluation was not documented.
Docu-mentation of engineering evaluation is discussed in Attachment B, Item 1.
Also, NRC Generic Letter (GL) 81-14 did not require rigorous analy-sis and evaluation of small piping supports in the AFW system.
GL 81-14 states that " Based upon the consideration of past performance of nuclear and fossil power plants, and other non-nuclear facilities sub-ject to large earthquakes, we (NRC) note that well engineered struc-tures, equipment, components and piping possesses a substantial amount of inherent seismic resistance, even without the rigorous seismic qual-ification performed for safety-grade portions of nuclear facilities.
Of the failures........noted in these past earthquakes, a large frac-tion have been due to.... lack of restraint, large displacements, or some other obvious deficiency which would have been easily identified before the failure caused by the seismic event.
Such identified defic-iencies could have been corrected....'.without detailed seismic analy-sis but by exercising careful engineerfng judgement."
7.
OPPD recognizes that the computer calculations were not easily access-ible.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
There is no evidence that this condition is reflected in the unreviewed portion of the design.
Action to Correct the Existing Condition -
The results of the revised analysis indicate that no actions are now necessary. The rod restraint will be left in place since the analysis indicated that it is not a safety concern.
Action to Prevent Recurrence -
OPPD is developing a training program for modeling techniques for piping analysis. OPPD will also review its computer analysis documentation pro-cedures to determine what actions must be instituted to improve the access-ibility of computer program analyses.
A-51
D3.2 Deficiency (Continued)
OPPD's Response (Continued)
Other Relevant Information -
Subsequent to the NRC inspection OPPD ran a new analysis since it was determined that there were modeling errors and incorrect weights used in the original analysis. The results of the revised analysis are:
a.
The analysis that included an actuator restraint included the seismic loads. The seismic loads on the surrounding supports were decreased. However, the thermal stress and thermal loads on the surrounding supports were increased.
b.
With no actuator restraint, the seismic loads on the surrounding supports are not significantly different from the original analysis.
i A-52
1 6
D4.3 Deficiency - Limit Switch Circuit Protection by Fusing, MR-FC-84-74A DESCRIPTION:
Subject to postulated submergence, nine safety-related valves had their solenoids relocated to higher elevations during the previous refueling outage. The valve position limit switches were also discovered to have not been qualified for submergence during third prty review. However, they were not relocated at the time to avoid additicnal mechanical complexity. OPPD decided to provide 1cw-current fast-acting fuses in the-indicator light' portion of the valve control circuits to re-tain operability of the solenoid, even though position indication may be lost or may become ambiguous to the operator.
For the selected design, a technical assumption that the indicator light fuse (shown as 0.25 amperes in the final design modification package and as 0.50 amperes in the construction design modification package) would i
. interrupt a fault current before the solenoid fuse (10 or 15 amperes) was not justified, particularly since the expected range of circuit current interruption is outside the range of values specified in the manufacture's catalog. The design engineer did not provide fuse coordination data.in either of the design packages; however, the first design package checker's
. checklist had a notation to " verify fuse curves" and the subsequently revised design package checker's checklist required that a calculation of fuse coordination be provided in the design package. 'The design package j
did not provide any indication the the coordination had been confirmed or that it was appropriate.
The. team's review of this catalog data indicated that the circuit interruption time differential between the two fuses may be only 10 milli-seconds. Unintended circuit interruption by the larger valued fuse would prevent electrical cperation of the solenoids for these nine valves, and would impair the control room operator's capability to remotely close HCV-238 and HCV-239 valves _ for long term core cooling.
On September 17, OPPD requested BUSSMANN to confirm the fuse coordination of the selected fuses,. and a favorable response has been received. A demonstration test is planned by BUSSMANN to confirm their analysis assessment.
Basis: An identified technisal assumption had not been verified during 3
the preparation, review, and approval of the final design modi-4 fication package in violation of a design evaluation requirement 4
on page B-2.6 of Omaha Public Power District Procedure B-2 and -
Omaha Public Power District's commitment to section 4.2 of ANSI N45.2.11-1974.
i OPPD's RESPONSE Cause of Deficiency -
l The cause of this finding is a lack of emphasis in OPPD's procedures
. requiring design engineers to document and justify all assumptions and engineering decisions.
A-53
D4.3 Deficiency (Continued)
OPPD's Response (Continued)
Extent to Which Condition May Be Reflected in the Unreviewed Portion of l
the Design -
A discussion of the lack of documentation of assumptions and engineering judgements is provided in Attachment 8, Item 1.
The extent to which the condition may be reflected in the unreviewed portion of the design is discussed in Attachment B, Item 4.
Action to Correct the Existing Condition -
The fuse vendor was requested to perform a test to verify that the assump-l tion (i.e.,1 amp fuse will blow before 10 amp fuse) made by the design engineer was justified. This testing was completed prior to the end of I
the 1985 refueling outage and confirmed the validity of the assumption l
made by the design engineer.
1 Action to Prevent Recurrence -
OPPD has implemented a design progran review which will provide a system-
)
atic evaluation of all aspects of the design / modification program. A l
discussion of the design program review is provided in the cover letter.
Other Relevant Information Subsequent to the completion of this modification, the primary fuses (10-amp) in the valve circuits were changed to provide proper protection for newly installed electrical panetrations.
Consequently, the as-in-stalled configuration now consirts of a 7 amp KTK fuse followed by 1/2 amp KTK fuse. Since both of these fuses are from the same family, they pro-vide proper coordination.
~
J A-54
U4.3 Unresolved Item - ESF Bypass Switch Keylock Provision, MR-FC-81-102-DESCRIPTION:
To simplify the means for bypassing specific engineered safety feature channels, keylock bypass switches are being implemented into the trip channels, keylock bypass switches are being implemented into the trip channels for pressurizer low pressure and steam generator low pressure Elec-tro Switch Series 20 switches and Hoffman NEMA enclosures with cylinder locks have been selected for this purpose.
The purchase order for metal enclosures to house these bypass switches re-quested that cylinder locks and keys be_ provided, but did not specify the lock combinations needed to assure that only one channel would be bypassed at any given time. An OPPD Form B had requested that different keys be used for the individual trip and bypass functions.
Relevant design guidance was provided in the reactor protective system description for keylock bypasses in that, "...each trip bypass has a different lock cylinder combination; however, corresponding trips in each of the four protective channels have the same cylinder combination...with one key provided for each trip type."
Thus, for the reactor protective system, administrative controls on keylock switches were enhanced by an engineering thought process and hardware dif-ferences in the keylocks.
The final design modification package contained no requirement for keylock cylinder combinations and the number of keys needed to control bypassing of individual trip channels.
Basis: The above configuration appears to violate Omaha Public Power District procedure B-2 pages B-2.5 and B-2.6 in that the technical description and design evaluation did not contain all of the equip-ment requirements necessary to establish an unambiguous design configuration.
OPPD'dRESPONSE The cause of this unresolved item is the lack of an agreement between OPPD and the NRC reviewer on the interpretations of certain regulatory require-ments.
In accordance with the Fort Calhoun USAR section 7.2.2(a), Fort Calhoun is committed to IEEE 279-1968.
Section 4.14 of this IEEE standard requires that "the design shall permit the administrative control of the means for manually bypassing channels or protective functions." To comply with this requirement, OPPD decided to use a combination of hardware'and administrative controls to ensure that use of the bypass switches will be under direct control of the lhift supervisor.
Consequently, when the design package was prepared, use of different key combinations wa.s not considered necessary to comply with applicable requirments. These seitches were to be located inside junction boxes which were to be locked.
The key was to be available only from '.he Shift Supervisor. Also, the bypass condition was to s
be annunciated. The second item of NRC concern, Reference (4) Fort Calhoun A-55
U4.3 Unresolved Item (Continued)
OPPD's Response (Continued)
RPS System Description, Rev. 4, 1984, is not considered to " provide relevant design guidance" in this particular case, as this document refers to the reactor protective system and not to the engineered safeguards functions.
We believe the design complies with the requirements of IEEE 279-1968, para.
4.14, and believe that, in view of the above, this unresolved item should be closed.
For other reasons OPPD is re-evaluating this modification and may determine not to do this modification. OPPD believes the above information will resolve this item.
The concerns expressed in this unresolved item are not applicable to the un-reviewed portion of this or other design packages.
A-56
U4.4 Unresolved Item - Design Basis Physical Separation Within Panels DESCRIPTION: The team has reviewed both current and previously imple-mented design modifications that involved the physical separation of safety-related cables outside of control room panels and the separation of safety-related and non-safety-related wiring within these panels. The re-quirement for separation was qualitatively stated in the " Independence" section of IEEE Std. 279-1968. The Ft. Calhoun plant has committed to meet IEEE Std. 279-1968.
For recent plant modifications, a definitive quantitative design basis for physical separation of redundant safety-related internal panel wiring harn-esses is stated as six inches or a physical barrier by an OPPD wire list form. During construction, the plant had a requirement for separation within pnels and a separation requirement between safety and non-safety cables. A commitment for separate and segregated routing of each engine-ered safeguard control channel has been made. The Ft. Calhoun design basis for physical separation is stated in a qualitative (i.e., function-al) manner on design documents and in the USAR. However, a quantitative design basis needed to provide measurable acceptance criteria does not appear to be stated in a complete and unambiguous manner leading to cer-tain potential deficiencies.
For example:
1.
Separation of original wiring within panels is defined only to field interface terminal blocks; redundant safety wiring separation for plant modifications has been specified, but separation of safety to non-safety internal panel wiring or the installation of barriers has not been imposed. A Final Safety Analysis Report Appendix G commitment made in 1970 stated that physical separation of individual channel components and wiring is maintained wherever practicable; 2.
Achievement of internal wiring separation within panels was a General Electric responsibility; however, the criteria used to accomplish this separation could not be located during the inspection. Original wir-ing within the panels appears to be Vulkene 600 volt insulation over multi-strand conductors.
Visual inspection of control room panels by the team indicated that separation appeared to have been incorporated in the original design; 3.
For recent modifications, internal panel wiring uses single conductor wiring covered with an 85% coverage braid. The equivalence of this wiring to meet an acceptable distance or barrier criterion has been assumed; however, it has not been demonstrated; 4.
While redundant Engineered Safety Features components implemented for undervoltage protection were mounted within separated barrier com-partments, their wiring external to these compartments is in direct contact within control room panel CB-4, and; 5.
The proposed addition of trip bypass switches has safety-related wir-ing on three wafers of each switch and non-safety related wiring to an annunciator on the fourth wafer. An analysis to confirm that Class lE circuits would not be degraded below an acceptable level due to their proximity to non-Class IE circuits was not provided in the design package.
A-57
U4.4 Unresolved (Continued)
Basis: The routing of redundant safety-related wiring in direct contact from an internal panel compartment barrier configuration violates the wiring harness separation requirement imposed by the Omaha Public Power District wire list form. No analysis has been pro-vided to justify the lack of separation for this wiring. This is a violation of the USAR commitment for separation of engineered safeguard features controls.
A quantitative criterion for separation of safety-related and non-safety-related internal panel wiring could not be located.
For the ESF bypass switch modification, no separation criteria for safety to non-safety internal panel wiring have been applied, and no analysis has been performed in lieu of quantitative separation criteria to assure that Class IE circuits have not been degraded below an acceptable level. Since the non-safety wiring provides a potential common link among redundant channels, this is a vio-lation of the USAR commitment for segregation of engineered safeguard features controls.
OPPD's RESPONSE CPPD has evaluated the concerns expressed in this unresolved item with regard to separation criteria and believe that it will be best to cate-gorize these concerns into the following three categories for the purpose of discussion:
1.
Separation criteria applicable to internal panel wiring at the time of original construction (Items 1, 2, 3 above).
2.
Separation criteria applicable to internal panel wiring for the modif' cations which were installed prior to the 1985 refueling outage (Item 4 above).
3.
Separation criteria applicable to internal panel wiring for the mod-ifications which were scheduled for installation during the 1985 refueling outage (Item 5 above).
Category 1. - In accordance with Fort Calhoun USAR sections 7.2.2(a) and 7.3.1 (b), Fort Calhoun is committed to IEEE 279-1968. With regard to separation criteria, no specific quantitative requirements are specified in this document. The Fort Calhoun USAR section 8.5 details the separa-tion requir.ements for cables external to pan-1s. Also section 7.2.9 of the USAR provides separation requirements f;. various safeguard compo-nents.
No quantitative internal panel separation requirements are stated in the USAR. OPPD believes this is because no such requirements existed at the time of Fort Calhoun original construction. Documents which provide quantitative separation criteria (i.e., IEEE 384-1974 and Reg.
Guide 1.75) were issued subsequent to issuance of the Fort Calhoun Station operating license. A review of the Fort Calhoun construction specifica-i A-58 1
N
k U4.4 Unresolved (Continued)
DPPD's Response (Continued)
I tions (Contract 762) also confirms.that no quantitative separation require-ments were specified.
Instead, the. wiring frem " safety" circuit terminal blocks ~(boxes) to instruments was required to be via metallic-shielded, in-sulated conductors. We believe the use of this wire in lieu of a quantita-1 tive separation criteria (as defined in IEEE 384-1974) was found accept-able.by the A/E (Gibbs & Hill) and the AEC.
I The panels under discussion are located in the control room. The only credible common cause failure which could degrade the redundant safety systems in this area is a fire.
The probability of such an event is 1
-extremely low because of the measures such as fire detection system, fire suppression system, administrative control, and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> fire watch which are provided for this area. ~ All control panels are provided with fire
+
detectors and,- in addition, the walk-in control panels (CB-1 through 20) t' are provided with an automatic Halon fire suppression system. Addition-ally, in accordance with the requirements of 10 CFR 50 Appendix R, an alternate shutdown capability has been provided which is independent of i
.the control room and the cable spreading room.
In view of the. foregoing, we believe that the separation measures as pro-vided at.the time of original construction (as discussed in of the USAR) and use of metal braid wire are adequate to comply with the requirements
' applicable at the time of original construction, i.e.,
1 Category 2. - MR-FC-77-40, noted in Item 4, was installed in 1978. Redun-dant components which are parts of the OPLS circuits are' located in separ-ate enclosures which is consistent with the practice followed at the time of original construction.
The redundant internal wiring consists of metal i-braided wires which are not physically separated. We believe this is con-sistent with the requirements of the original construction and is of no safety concern.
s Category 3. - Item 5 of the unresolved item discusses the separation cri-teria. requirements for MR-FC-81-102 (Bypass Switches). These requirements were based on IEEE 384-1981. Which represents the latest industry consen-sus and is a significant improvement over our original separation criter-l ia. The concern regarding the landing of safety-related wiring on three wafers of each switch and non safety-related wiring to an annunciator on the fourth wafer ~is not justified since the practice followed in this case is consistent with the original Fort Calhoun design and Section 7.2.2.1,
-para.'3 of IEEE 384-1981.
+
4 In view of the foregoing, OPPD believes that it is justified in using IEEE
]
384-1981 separation criteria for future modifications involving new con-l trol panels.
In addition, OPPD will continue to comply with the cable sep-aration requirements of 10 CFR 50 Appendix R.
In summary, for any future modifications involving new safety related panels, IEEE 384-1981 will be followed. Also, any modifications within existing panels will comply with 2
the original separation criteria as discussed above and IEEE 384-1981 to the extent practicable within the constraints of the existing panels.
OPPD believes that the above information should be adequate to resolve this item.
A-59
D4.5 Deficiency - Drawing Changes by Procedure A-9, MR-FC-82-178 DESCRIPTION: Generating Station Engineering Procedure A-9 specifies that when an existing drawing needs revision during preparation of a modifi-cation request, the design engineer is to request a sepia of the drawing.
This requirement provides control of the drawing during consideration of the design modification, assists in documentation of the as-built status, and alerts other users to coordinate any desired changes with other drawing 4
(facility) changes under consideration.
Drawings 11405-M-1 and 11405-M-2 were modified to incorporate air filter differential pressure switches without use of the sepia control process specified by procedure A-9.
The drawings were directly modified based on engineering sketches provided with the final design modification request package.
Basis: Compliance with the provisions of engineering procedure A-9 was not provided during the development and implementation of a final design modification package.
OPPD's RESPONSE Cause of Deficiency -
There are two reasons why sepias are issued for those drawings that must be changed for construction:
- 1) The sepia provides a document to show the pro-posed design change so it can be installed without modifying the document of record (i.e., tracing) until the modification is installed. This insures that the document of record is changed only after the modification is "as-built", and 2) The sepia tracking system informs all who utilize the docu-ment of record that a pending modification (or modifications) may affect it. Many times drawings that are not necessary to install the modification (and therefore not changed) are affected by the modification.
Sepias are not made for those drawings. Thus, it is not necessary to make a sepia of those drawings.
GSE Procedure A-9, Par. 3.2 states "when an existing draw-ing needs revision during the preparation of an MR, a request for a sepia of that drawing is made." The phrase "during the preparation of an MR," is intended to limit sepia production to only those drawings that need revi-sion to install the modification, not all drawings that may eventually need to be revised.
In the particular case of MR-FC-82-178, it was decided that no drawings would need to be revised during the preparation of the design package, rather, sketches were utilized to construct the modification.
The reason a sepia was not requested was because the modification was simple and did not have significant impact on the P&ID.
A-60
U4.5 Unresolved Item - Battery Room Fire Hazard Analysis DESCRIPTION: Approximately five years ago, an extensive fire hazard analy-sis was performed at the Ft. Calhoun Station.
For each of the two battery rooms, the significant combustibles were identified as the plastic battery cases, polystyrene separators between the battery cases, and a small amount of electrical cable insulation.
During a plant walkdown the team identified a fuse block enclosure con-structed of masonite with a fiber board cover in each of these rooms (Bat-tery room arrangement drawings.
Basis: The existence of a wooden fuse block enclosure was not identified in the fire iiazard analysis of the battery rooms (fire areas 37 and 38). The team could not locate a description of the test for signif-icance determination for combustible materials used by Omaha Public Power District in the fire hazard analysis.
It is indeterminate whether this material is a significant combustible with respect to the published fire hazards analysis.
OPPD's RESPONSE The Fire Hazard Analysis discussed in this unresolved item was prepared for OPPD by an outside consultant in response to the requirements of Branch Technical Position 9.5-1.
Only significant fire hazards were listed in this report.
This report was reviewed and approved in the NRC Safety Eval-uation Report dated August 23, 1978.
A quantitative definition of the term "Significant Fire Hazard" is not in-cluded in the above report or BTP 9.5.1.
It has, however, been determined that the masonite fuse block enclosures were provided as a part of the original plant construction and existed when the fire hazard analysis was done. The enclosures were coated with a clear fire retardant paint which could have been the reason for considering these boxes as an insignificant fire hazard. The exact specifications for the fire retardant paint were, however, not traceable. Consequently, OPPD has repainted these boxes with a fire retardant paint to reduce its fire spreading, smoke and fuel contri-bution rating to the non-combustible range per BTP 9.5-1.
This work was done by the plant staff under a maintenance order and was completed prior to plant start-up following the 1985 refueling outage. OPPD believes the above information will be adequate to resolve this item.
A-61
D5.1 Deficiency - Battery Sizing Calculation DESCRIPTION: The battery must be sized to provide sufficient capacity to supply the direct current loads under all operating conditions without its voltage dropping below a specified minimum value. Battery voltage under discharge conditions is determined by the state of charge remaining in the cells, the number of cells which make up the battery, and the rate of dis-charge.
Battery voltage under charge conditions is based upon the number of cells and the battery charger setting in volts per cell.
In order to reduce the maximum voltage of the battery under charge conditions, OPPD removed 2 cells from the 60 cell battery. Removing cells from the battery reduces the battery's capability to supply the required load current with-out the battery voltage falling below the minimum acceptable voltage. The battery size must be checked under this lower capacity condition.
The battery size was checked by OPPD using the calculation method recom-mended by IEEE 485.
The battery cell data was correctly used at the lower permissible discharge rate to limit the cell discharge voltage to 1.81 volts per cell (or 105 volts for 58 cells). However, the team noted that the battery current discharge profile was the same profile used in the 1979 sizing calculation that was originally used to purchase replacement batter-ies.
This profile had not been updated even though increased de loading was responsible for planned replacement of the 200 ampere battery chargers with 400 ampere units.
In an attempt to determine the adequacy of the 1979 profile, the team found:
- The load table used to construct the discharge profile was composed of general loads without supporting references to substantiate de-tailed loads.
No justification was documented for failing to include major loads such as switchgear control power or diesel generator field flashing.
- The 1979 calculation did not contain any documented check or verifi-cation of the required discharge profile.
Basis: Generating Station Engineering procedure B-9 requires the checker to confirm that assumptions have been justified. Generating Station Engineering procedure B-11 also requires the third party reviewer to confirm that the calculation assumptions have been justified. The inputs and assumptions used in the latest battery sizing calculation were not verified.
OPPD's RESPONSE Cause of Deficiency -
The cause of this finding is a lack of emphasis in OPPD's procedures requir-ing the design engineers to document and justify all assumptions and engi-neering decisions.
Therefo're, the assumptions and engineering decisions A-62
D5.1-1 -' Deficiency (Continued)
OPPD's Response (Continued) which are considered obvious in the design engineer's judgment are some times not explained and justified. OPPD, however, recognizes the need for this documentation to ensure auditability of design records.
In this par-ticular case, the batteries were replaced in 1979. Approximately 25% mar-gin was provided in these batteries to allow for load growth and battery
-degradation.
In the design engineer's judgment this 25% margin was ade-
' quate to allow for any load growth over the last six years and any degrada-tion due to removal of two cells and aging. This engineering decision was considered acceptable by the reviewer and the persons approving it, how-ever, no detailed justification was provided in the design package. The original plans were to run a test after the two cells were removed to deter-mine the exact battery capacity and justify the load profiles as they exist now. This has since been done and it has been confirmed that the batteries are adequately sized to n.eet the station needs in the event of total-loss of AC power (worst case) and under all operating conditions.
The verification of the design, which was provided by test results and was originally planned as an integral part of the. design, validated that all assumptions and decisions of the design engineer were sound. Therefore, it is OPPD's belief that this item is not a deficiency.
Extent to Which Condition May Be Reflected in the Unrevieved Portion of the Design -
A discussion of the lack of documentation of assumptions and engineering decisions is provided in the Attachment B, Items 1 and 4.
Action to Correct the Existing Condition -
The revised load profiles were developed, checked and independently re-viewed by an outside consultant prior to the end of the 1985 refueling out-age. The battery sizing calculations were also revised to confirm adequacy of the batteries for this fuel cycle under all operating conditions and total loss of AC' power. The load profiles will be further fine-tuned to reflect more exact conditions which may exist following a total loss of AC power. OPPD's consultant has completed a revised analysis and it is pre-sently being reviewed by 0 PPD.
Action to Prevent Recurrence -
OPPD has implemented a design program review which will provide a system-atic evaluation of all aspects of the design / modification program. A discussion of the design program review is provided in the cover letter.
Other Relevant Information l
With regard to the three concerns regarding the 1979 load profiles, the following information is provided to help resolve these issues:
A-63
05.1 Deficiency (Continued)
OPPD's Response (Continued) 1.
The load tables used for constructing the load profiles were developed based on extensive discussions between OPPD's Technical Services and Generating Station Engineering (GSE) departments. The sizing criteria are discussed and documented in the design package. The major loads are also discussed. This was considered adequate at that time.
2.
The load profiles were developed based on the assumptions that all AC power was lost and restart of the Diesel Generators was not feasible.
The circuit breakers were assumed to have tripped prior to time zero.
This was consistent with the original FSAR load profiles. These loads have now been factored into the analysis to validate this assumption It has been concluded that they do not represent any significant contribution.
3.
The load profile developed by GSE was checked by OPPD's Technical Ser-vices Department. A letter confirming this is included in the design file. The battery sizing calculations were redone by Exide (the bat-tery manufacturer) using their in-house computer program. Also, the calculations prepared by 0 PPD were checked, reviewed and approved as part of the original design package. Additionally, the batteries were load tested which further verified the accuracy of battery sizing cal-culations.
GSE procedures have since been revised to require proper documentation of checking and verification activities.
1 A-64
US.1 Unresolved Item - Battery Charger /DC BUS Coordination DESCRIPTION: Battery chargers are provided to maintain the battery in a fully charged condition and to recharge the battery following a discharge.
The battery chargers are also the source of the steady state DC power re-quired for normal plant operation. Because of load growth, the original battery chargers were operating in their overload region. OPPD decided to replace the existing 200 ampere Exide battery chargers with 400 ampere bat-tery chargers from Power Conversion Products. The original battery charger would provide a current limit at 110% (220 Amperes).
As part of the modification to replace the battery chargers, OPPD also planned to replace the existing 225 ampere breakers at the DC switchboard with 400 ampere breakers.
OPPD stated that the 400 ampere breaker was the largest breaker size that would fit in the existing switchboard. OPPD failed to demonstrate that the new breaker was compatible with the new battery charger. OPPD made the as-sumption that the battery chargers would limit'the charging current to less than 400 amperes based upon the nominal charger voltage and required steady state load.
The team noted that the instruction manual provided with the battery charg-er stated that the battery charger would go into current limit in the range of 110 to 125% of rated full load.
This would mean that in attempting to recharge a discharged battery, the battery charger would attempt to provide up to 500 amperes. This amount of current would trip the 400 ampere break-er located at the DC switchboard. OPPD could not produce any evidence at the time of the inspection to demonstrate that the current limit feature of the battery charger could be adjusted to limit the current to below the 400 ampere breaker trip point.
Basis: Omaha Public Power District procedure GSE-8-2 was prepared consis-tent with commitments to ANSI N45.2.11 requirements for design change control.
Procedure section 2.5.2 requires that when specific setpoints or limitations are imposed by other systems or components, such setpoints or limitations are to be clearly stated.
Neither the checker or the third party reviewer questioned the compatibility of the new battery charger with the existing switchboard, including the new larger circuit breaker.
OPPD's RESPONSE The installation and test procedures for this modification were not pre-pared at the time of the NRC's visit and, therefore, were not available for review.
i A-65
US.1 Unresolved Item (Continued)
OPPD's Response (Continued)
The following information is provided to help clarify this unresolved item:
1.
Test procedures and surveillance test ST-DC-1 were used to test the battery chargers after installation of the modification.
2.
The concern expressed by the NRC's Review Team has been resolved. The current-limit setting was adjusted to ensure that the battery chargers will current-limit below 400 amps, thereby assuring that the input breaker to the DC bus will not trip while charging a fully discharged battery.
3.
The current-limit capability of the battery chargers was verified dur-ing testing to be 380 amps.
i L
d 1
4 A-66
D5.2 Deficiency - Fire Wrap Protection for Cable Raceways DESCRIPTION:
Cables for redundant systems are separated from their redun-dant counterparts to meet the fire protection requirements of 10 CFR Part 50 Appendix R.
Where the required separation distance cannot be maintain-ed, fire barriers may be used. During a previous NRC inspection, a lack of sufficient separation was noted for the pressurizer heater power cables.
In response to the previous inspection finding, OPPD prepared modification package MR-FC-85-25 to move the feeder cables to three Bus 3 motor control centers (pcwer source for the pressurizer heaters) from cable trays and reroute these cables in conduit.
These conduits were to be protected with a 3M fire wrapping system.
Because fire wrap reduces the heat transfer from the cable through the conduit, OPPD requested 3M to provide cable derating factors for the OPPD application. 3M responded with derating factors developed using a heat transfer computer program developed by 3M for this type of application.
Based upon these derating factors, and the general cable ampacity design margins describad in the Updated Safety Ana-lysis Report, OPPD did not determine the actual loads on the motor control center feeder cables in this analysis, nor did they attempt to justify the 3M computer generated derating factors.
In an attempt to verify the 3M program, the team independently estimated 1
the derating factor required for the 3M fire wrap by using the heat trans-fer method developed by Neher and McGrath. This method was the basis for the Insulated Cable Engineers Association cable ampacity standard refer-enced in the USAR.
The team's estimate for required cable derating was higher than that suggested by 3M.
OPPD was not able to explain the computer inputs and outputs used and/or developed by 3M.
In response to the team's questions, OPPD requested from 3M a verification of their computer program.
3M supplied a report, based upon test data to justify the required derating factors.
The 3M test data indicated a required derating factor almost twice that determined by the 3M computer program and subsequently used by 0 PPD in the design modifica-tion analysis.
Basis: Generating Station Engineering procedure B-9 requires that com-puter calculations be checked.
Generating Station Engineering procedure B-11 checklist 8-ll-lG requires that computer calcula-tions be verified.
The checker failed to question the need to know the actual load current on the motor control center feeder cables.
Both the checker and the third party reviewer failed to verify the computer program developed by 3M or confirm that it had been verified.
a A-67
D5.2 Deficiency (Continued)
OPPD's RESPONSE Cause of Deficiency -
. The material.in question was procurred under the requirements of OPPD's
" Fire Protection QA Program" and was not designated as CQE. The design engineer used the derating factors supplied by 3-M in preliminary calcula-tions to determine cable ampacities and to find out if the derating factor because of the fire wrap was comparable to derating factors because of other restraints. At the time the team _was reviewing this modification file, separate calculations were being performed by OPPD to determine the actual load currents on the motor control center feeder cables. Analysis of the cable derating effect of the firewrap material was performed in accordance with GSE procedures for CQE calculations. These calculations were being performed to provide the basis for further heat transfer cal-culations to determine the actual derating factors of the fire wrap, inde-pendent of 3-M's computer calculations.
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
-This condition does not impact any of the unreviewed portions of the de-sign. The final, official calculations utilized for this modification have been generated, checked and verified by 0 PPD in accordance with GSE procedures. The computer calculations received from the vendor were used for preliminary analysis only and are not the basis of any design inputs or conclusions regarding adequacy of the fire wrap material.
No generic implications exist. No GSE or OPPD procedures were violated, and these calculations were performed and applied correctly.
The referenc-ed vendor calculations were used in unofficial, preliminary calculations only,.and were not relied upon for any safety-related conclusions.
Action to Correct the Existing Condition -
As discussed above, OPPD performed, checked and verified calculations to determine (a) actual load currents on the MCC feeder cables, and (b) actual derated ampacity of the fire-wrapped cables. These calculations and verifications were completed in accordance with GSE procedures B-2, B-9, B-11 and Fort Calhoun Station Standing Order G-21.
The results of these conventional heat-transfer calculations indicate, independently of the vendor supplied computer calculations, that the derating factors to be used as a result of the application of the fire-wrap material do not adversely affect the power cables.
In accordance with S.0.-G-21, inde-pendent verification of these calculations was completed prior to system acceptance.
A-68 i
i
i D5.2 Deficiency (Continued)
OPPD's Response (Continued)
Action to Prevent Recurrence -
No action is deemed necessary as no deficiency exists. At the time the team was reviewing the design file, OPPD was in the process, in accordance with all applicable GSE procedures, of performing its own, independent calculations of ampacity. As stated above, the vendor's computer cal-culations were used in a preliminary analysis only, and were not intended to be the basis of any design inputs or safety decisions. All official calculations forming the basis for the determination of ampacity were per-formed, checked and verified in accordance with OPPD procedures.
Other Relevant Information Calculations referenced above are in the modification file.
Dates and revisions to these calculations reflect changes due to field changes made to directly wrap the cables as opposed to wrapping conduits.
4 4
r A-69
D6.1 Deficiency - Safety Evaluations for Non-Safety-Related Systems Described in the USAR DESCRIPTION: Non-safety-related final design packages were reviewed in conjunction with the USAR to determine if safety evaluations as required by 10 CFR 50.59 were required, and if so, were properly accomplished and documented in the final design packages.
Each of the final design pack-ages in this review were evaluated against the USAR descriptions to determine if changes to USAR test, drawings and figures would be required as a result of these modifications.
If so, as required by 10 CFR 50.59, a safety evaluation of the design change would be required to determine if an unreviewed safety question existed even though these were non-safe-ty-related systems.
10 CFR 50.59 does not differentiate between safety and non-safety-related systems.
OPPD procedure Standing Order G-21, Station Modification Control, dis-cusses safety evaluations for both final design packages and construction packages. This procedure only requires the preparation of a safety anal-ysis in a Final Design Package if safety-related equipment is involved or impacted. By virtue of G-21 procedure requirements for the Planner, a construction package safety evaluation should always get accomplished, however, the team considers that a construction package Fafety evaluation isforconstructionrelatedactivitiesanddoesnotfulfill10CFR50.59 requirements for a safety analysis of the design asre,s of design changes unless those design attributes are specifically addressed.
G-21 also indi-cates that the final safety analysis of the design is to be part of the final design package.
Review of non-safety-related final design packages revealed that five modi-fications planned for completion during this outage did not have safety evaluations in the final design packages.
Each of the affected systems or equipment were described in the USAR and it appeared that completion of the modifications would require changes to USAR text, drawings or tables to accurately represent the newly changed systems or equipment. The modi-fication packages and af fected areas of the USAR are discussed as follows:
MR 83-17F Feedwater Regulating System Instrumentation Replacement
(
This modification will replace the existing Feedwater RegulatorykSys-tem (FWRS) with an entirely new system.
The new system will use two separate controllers, o' e for downcomer level and one for flow error.
n It will also have automatic control above 5% power.
At the time of inspection, USAR section 7.4.3 specified use of a three element controller using stean flow, feed flow and downcomer level.
USAR Figure 7.4-5 depicted a three element controller. USAR section 7.4.3 specified manual control below 15% power.
A-70
06.1 Deficiency (Continued)
Description (Continued)
MR 485-008 Boric Acid Addition System This modification will modify the phosphate addition system to add boric acid for control of intergranular stress corrosion cracking and steam generator tube denting.
At the time of this inspection, USAR section 10.2.2 specified that,
" Chemicals are added to the feedwater upstream of SG feedwater pumps for oxygen scavenging and ph control." The team noted that this modi-fication will be adding more chemicals for other reasons.
USAR P&ID M-253 showed piping entry points for " phosphate feed see P&ID M-265."
The team noted that this modification will be adding boric acid at these entry points and not phosphate treatment.
In addition, the new concept of use of boric acid as a chemical control agent in the steam generators did not undergo a safety analysis by engineering.
ME 4748-057 Power System Stabilizer
\\
This modification will add a stabilizer to the main generator Alterex Exciter to stabilize generator power in case of fluctuations To the Mid-Continent Area Power Pool (MAPP)
At the time of this inspection, USAR section 8.2.1 had a network sta-bility analysis. The team noted that this modification will ennance Fort Calhoun Station' ability to handle network fluctuations.
USAR' section 10.2.4 discussed generator field excitation by the Alterex Excitation System. The team noted that this modification will add a power system stabilizer to the Alterex Exciter.
MR 483-174 Reactor Regulating System Steam Dump and Bypass Alarm This modification will make wiring changes and additions within the main control boards to provide operators with status of system con-ditions for dissipating excess NSSS stored energy following a turbine trip.
At the time of this inspection, USAR section 7.4.4.2 discussed system design with a list of what the system consisted of as well as system inputs and system outputs. The team noted that this modification will change wiring and add indicators to the control room.
MR 483-90 Replace LP Feedwater Heaters This modification will replace existing CuNi low pressure feedwater heaters and drain cooler tube bundles with stainless steel units.
A-71
D6.1 Deficiency (Continued)
Description (Continued)
At the time of this inspection, USAR Figure 10.2-6 depicted flow, temp-erature and heat transfer data based on the existing CuNi units. The team noted that this modification will introduce changer, to this data.
Basis:
10 CFR 50.59, in part, allows changes to facility as described in the Safety Analysis Report (SAR), without prior NRC approval, if the modifications do not introduce an unreviewed safety question.
The Omaha Public Power District procedure for 10 CFR 50.59 re-j views for unreviewed safety questions is Standing Order (50)
G-46, Evaluation of Procedures, Procedure Changes, Tests, and Experiments for Safety Evaluations and Status as an Unreviewed i
Safety Question. The result of such reviews is a written safety i
evaluation addressing the three question criteria presented by 10 CFR 50.59.
Safety evaluatior.s are required by 10 CFR 50.59 when l
USAR test, drawings or tables are changed by facility modifica-l tions.
Each of the modifications discussed above were described i
in the USAR in sufficient detail that changes to the USAR would be warranted. Accordingly, safety evaluations should have been accomplished in the final design packages.
OR D's RESPONSE l
Cause of Deficiency -
i GSE procedures in. place at the time did not require the preparation of a design safety evaluation in the case of non-CQE related modifications i
l whose failure would not impact Critical Quality Elements. This finding was due to inadequate design control procedures.
l Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
[
OPPD has implemented a design program review which will provide a system-atic evaluation of the design / modification program. A discussion of the design program review is provided in the cover letter.
Action to Correct the Existing Condition -
The applicable procedure for the preparation of design packages has been revised to require a design safety evaluation any time a modification may impact USAR text, drawings, or. tables. The appropriate USAR changes to reflect the modifications cited in the report will be made during the 1986 annual USAR update if the modification was installed and accepted.
A-72
D6.1 Deficiency (Continued)
UPi>D's Response (Continued)
Action to Prevent Recurrence:
/
The applicable procedure has been changed as described above. The design c'1ange process review will also consider this deficiency and determine any appropriate programmatic revisions.
g/
A-73
l U6.1 Unresolved Item - Safety Analyses for Emergency Modifications DESCRIPTION: OPPD procedure Standing Order G-21 allowed emergency modifi-cations to be accomplished by plant personnel with telephone approvals and also allowed issue of final design packages after completion of the modifi-cations. The team reviewed emergency modifications to determine if design safety evaluations had been accomplished prior to operation of the modi-fied systems. Generating Station Engineering (GSE) procedure B-2 requires that a safety evaluation be accomplished for all critical quality element (CQE) equipment, and, as discussed in deficiency D6.1-1,10 CFR 50.59 re-quires a safety evaluation for design changes to facilities as described in the USAR.
Review of emergency modifications revealed that the following CQE emerg-ency modifications had been accomplished and the affected systems relied upon for operation without a final design safety evaluation.
MR 484 DC Grounds on Critical Quality Element (Safety Injection)
Valves MR 483-129 - Diesel Generator Speed Sensing Power Supply MR 483-152 - Diesel Generator Speed Sensing Power Supply The modifications were completed in May 1984, September 1983, and October 1983, respectively.
Presence of construction package safety evaluations was not looked for in each of these cases since, as discussed in defic-iercy D6.1-1, construction package safety evaluations do not necessarily satisfy design aspect requirements for final design package safety evalu-ations. The design process followed for emergency modificatians was a simplified process performed by the plant engineers and not the respon-sible design organization. The team considers that a period of time between system modification and completion of the design safety evaluation was acceptable provided a safety evaluation by the responsible design organization was completed prior to relying on the system for plant operation.
Basis:
These modifications all involved critical quality element equip-ment.
In accordance with Generating Station Engineering pro-cedure B-2, a safety evaluation of the design is required for all critical quality element structures, systems or comaonents.
10 CFR 50.59 requires that safety evaluations be perfo med for pro-posed changes to the facility as described in the F3AR.
OPPD's RESPONSE A construction safety analysis was performed for nodificatioas MR-FC-84-84, MR-FC-83-129 and MR-FC-83-152. However, these ;onstruction reviews tended to concentrate on installation of the modifichtion as opposed to the design characteristics of the modification.
}
A-74
a l
U6.1-2 Unresolved'(Continutd)
OPPD's Response (Continued)
\\
OPPD's procedures require that emergency modifications < receive the same technical attention as normal modifications. The primary differences in the two ~ classifications of modifications are the provision to acquire approvals by documented telephone conversations and the after-the-fact design package completion for emergency modifications. A design engineer from GSE and an engineer from Technical Services is assigned to each emer-gency modification as soon as the need for modification is identified.
Their participation includes the consideration of safety considerations pertaining to the design and installation of the modification.
While.it is believed that design safety issues were inherently considered
. by Technical Services 'and Generating Station Engineering personnel when their telecon approvals cf hiodifications MR-FC-84-84, MR-FC-83-129 and MR-FC-83-152 were.givca, nq documentation of the design safety analysis is evident. The design safety ana13ses for MR-FC-84-84, MR-FC-B3-129 and MR-FC-83-152 wil? be performed and documented.
Standing Order G-21 has been revised to assure a safety analysis (per 10 CFR 50.69) covering both the const'uction and desigt. ;cpects of the modification is completed prior to the installation of an emergency l
modification. This revision was effective as of January 1, 1986.. '
x<
i e
s W
q i
'.k A-75
D6.2 Deficiency - Modifications to AFW Turbine Steam Supply Valves DESCRIPTION: While performing an operability check on the steam driven auxiliary feedwater pump (FW-10) in September,1978, it was found that an instrument air supply valve to the YCV-1045 operator had been inadver-tently closed with the result being that YCV-1045 was in its failed closed position and FW-10 was inoperable.
Subsequently, EEAR FC-78-43 was pro-cessed which recommended that the YCV-1045 valve operator be redesigned to fail open, assuring maximum auxiliary feedwater availability upon loss of air. The memorandum later additionally recommended the addition of air accumulators to the YCV-1045A/B valve operators, which have always been fail open valves.
This would enable remote manual isolation of a tube-ruptured steam generator upon loss of instrument air as per Criterion 57, App. A, 10 CFR 50, which requires the ability to remote manually isolate a closed system penetrating containment.
The original proposed modification changed the failure mode of the air operated AFW turbine steam admit valve (YCV-1045) to fail open from fail closed. Generation Station Engineering evaluated the emergency status of the modification in June 1979 and determined that the proposed modifica-tion would violate containment isolation requirements. MR 78-43 was revised to required addition of safety-related accumulators to the steam supply valves (YCV-1045A/B). On March 21, 1980, work was actually com-pleted on YCV-1045 on an emergency basis making the valve fail open; however, no accumulators were installed on YCV-1045 A and B.
In October 1983, during GSE review of the "after-the-fact" Final Design package for emergency MR 78-43, they discovered that the accumulators had not been installed on YCV-1045A and B.
GSE recommended that the plant make arrangements to install accumulators as soon as possible as the op-eration of these valves would be required during a steam generator tube rupture. The station initiated a low priority (priority 4) request for a
" minor" modification on December 27, 1983.
During November 1983, GSE completed the "after-the-fact" Final Design package for MR 78-43. This package, dated November 8, 1983, noted that air accumulators were to be installed in the future under a new MR 83-158. The safety analysis in-cluded in the Final Design Package discusses the need to isolate the steam supply following a steam generator tube rupture and for containment isola-tion provisions, and notes the ability of YCV-1045 A and B to accomplish this with accumulators. The unreviewed safety question evaluation ad-dressed whether the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously eval-uated in the Safety Analysis Report may be increased.
The evaluation concluded that since this modification changed the failure position of valve YCV-1045 and added air accumulators to valves YCV-1045 A and B, this will not affect the results of the main steam line break analysis.
However, the team noted (as acknowledged in the Final Design Package for MR 78-43) that the accumulators had not been added and it was improper to conclude that no unreviewed safety question existed based upon work to be performed at some future date.
A-76
D6.2 Deficiency (Continued)
Description (Continued)
During the review of the Station's Engineering Evaluation and Assistance Request in December 1984, Technical Services identified the improper
" minor" classification of the modification request and recommended up-graded priority from 4 to priority 1.
The Technical Services review also resulted in discussions between Technical Services, Licensing, Generating J
Station Engineering and Plant personnel' addressing these concerns.
As a result of these discussions the licensee decided to install the ac-cumulators at the next refueling outage, or the next (earlier) outage of sufficient duration. The licensee also evaluated operation of the plant during the previous six years in light of the requirements of General De-sign Criterion 57. The licensee concluded:
"From 1979 until the present, the requirement of Criterion 57, App. A, 10 CFR 50 has been met under normal plant operation, or in the event of a steam generator tube rupture.
It is only when the postulated tube rupture occurs in conjunction with a loss of air that the requirement for remote manual isolation of the affected steam generator cannot be met. However, during this six-year interval, local manual isolation of the two-inch steam line has always been possible and this operator action would have been performed in the event of a tube rupture coupled with loss of air as per Emergency Procedure EP-30, Step D.8.d.
The plant has determined that i
time required for this operator manual action is not excessive and will insert an appropriate statement regarding this requirement in EP-30, to reinforce operator's awareness of this required action to isolate the potential radionuclide leakage path via FW-10 steam feed."
The licensee further determined that the operation of the plant with the described configuration did not constitute an unreviewed safety question and was not reportaole. The team verified that the emergency procedures had been revised as recommended.
The team determined that the following design control inadequacies re-lating to failure to incorporate a portion of an approved modification, excessive length of time to process a completed emergency modification, and basing a 10 CFR 50.59 safety evaluation for a completed facility change on work yet to be performed were a deficient condition. The team also considers that operation of the facility as described was an un-reviewed safety question in that the possibility had been created wherein remote manual isolation of the AFW steam supply might not be possible fol-lowing a steam generator tube rupture if offsite power was lost or the non-safety-related instrument air system was otherwise unavailable.
The team also noted that the USAR does not accurately reflect the as-built configuration for the containment penetrations which are associated with YCV-1045 A and B.
USAR Table 5.9-1 shows these penetrations (M-94 and M-95) as Type IVD, containing a single power operated valve whose normal A-77 i
D6.2 Deficiency (Continued)
Description (Continued) position is open, fails closed, and accident position is closed.
The team noted that although this depicticn is correct for the main steam isolation valves, the AFW steam supply taps off on the upstream (containment) side of the main steam isolation valves, and that these valves are normally closed, fail open, and accident position is open.
In addition, the main steam isolation valve bypass valves are not shown. The USAR errors had apparently not been identified and corrected during licensee reviews of these modifications, notwithstanding the licensee's concerns for compli-ance with General Des'ign Criterion 57.
Basis:
10 CFR 50.59 requires evaluations of proposed changes to the facil-ity to be made without prior NRC approval, to ensure an unreviewed safety question does not exist. A proposed change involves an unreviewed safety question if the consequences of an accident pre-viously analyzed in the FSAR is increased or if a malfunction of a different type than evaluated previously in the Safety Analysis report may be created.
10 CFR 50, Appendix A, Criterion 57 - Closed system isolation valves, requires that, "Each line that penetrates primary reactor containment and is neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere shall have at least containment isolation valve which shall be either automatic, or locked closed, or apable of remote manual 4
operation."
OPPD's RESPONSE Cause of the Deficiency -
The findings identified in the description were caused by weaknesses in the design control procedures. OPPD agrees that timeliness of closing out the design package was a contributing factor, but OPPD does not believe that operation of the facility as described in the discussion constituted an unreviewed safety qunstion. This decision was made in January, 1985, and is still believed to be valid.
In assessing the omitted accumulators from a safety standpoint, the follow-ing determinations were made.
It was determined that with or without the accumulators, plant safety was enhanced in that loss of offsite power or loss of instrument air.would not result in the inability to use the steam driven auxiliary feedwater pump.
Further, the lack of the accumulators did not create the possibility of an accident more severe than what was already analyzed for the Steam Generator Tube Rupture Incident.
Thus, the margin of safety was not decreased in that availability of auxiliary feed-water was provided for, and the consequences of a Tube Rupture were not increased. Therefore, no unreviewed safety question existed.
A-78 T
T w-w--
a--e eT mmv ww--T i-w
-r---
+
y-gum
,--fTv-y
--='=*-v--
wi w
D6.2 Deficiency (Continued)
OPPD's Response (Continued)
Extent to Which Condition May Be Reflected in the Unreviewed Portion of the Design -
The condition in question has been corrected. lhe potential for other sim-ilar conditions will be assessed as discussed in Attachment B, Item 4 and as a part of the overall review of the design change process.
Action to Correct the Existing Condition -
During the 1985 refueling outage, the modification to install the air ac-cumulators was ccmpleted. The design control inadequacies will be ad-dressed as a part of OPPD's design process review.
Information presented in the USAR will be updated to reflect accurate information in the 1986 annual update.
Action to Prevent Recurrence -
The action to be taken to prevent recurrence will be determined as a part of the design process review as discussed in the cover letter.
i A-79
9 ATTACHMENT B This attachment provides a response to some generic: areas of concern relat-ing to the deficiencies and unresolved items.
When applicable, the def t-ciencies and unresolved items in Attachment A will refer to these generic responses.
1.
Lack of Documentation of Engineering Judgements and Decisions Lack of proper documeatation of engineering judgerrent has been identified as a generic concern in OPPD's Design Change / Modification Program. Engi-neering judgement considerations, appropriate times for their use, and the importance of detailed documentation of such judgements has not been proper-ly emphasized in the past. The quantitative conclusion of technical accur-acy in the past has been based primarily upon testing and review by tech-nically qualified individuals.
It is also noted that design packages have, in recent years, been written to seek review and approval of personnel with-in OPPD having equivalent knowledge of Fort Calhoun Stations design and operation as the engineer preparing the design. Therefore, information which was considered common knowledge for persons involved in the design was often omitted from design documentation. Additionally, items which are considered not applicable are often not noted as being "not applicable".
Thus, subsequent reviews of design documentations cannot verify whether a given requirement was considered and dismissed. or was not addressed.
OPPD recognizes the importance of proper docurrentation of engineering judge-ment to ensure traceability and auditability. OPPD will place a stronger emphasis in the design process on documentation of the basis and use of engineering judgement and proper documentation of references. M PD will factor this area of concern into the overall review of the Design Change /
Modification Program. The improvements made as a result of this review will help preclude the traceability /auditability problems identified during this inspection.
2.
Lack of Design Basis Records Lack of Design Basis Records was identified by 0 PPD as a generic concern prior to this inspection. OPPD has perforated extensive updating of draw-ings as a result of this concern. Many of the records used to document the Fort Calhoun Station design basis were not turned over or retained by the original architect-engineer. This condition was aggravated by the termin-ation of the client / engineer agreements between OPPD and the original arch-itect-engineer following cancellation of a second nuclear unit.
OPPD has attempted to locate original architect / engineer design records on specific issues such as seismic design calculations. These efforts have not been very successful to date and have resulted in recreating certain design records. Approximately six hundred boxes of information from the A/E and Contractors have been retreived, inventoried, and cataloged.
OPPD has completed a comprehensive review of documentation commitments made as a condition for the construction permit.
Records were categorized to identify potentially missing records. The safety significance of these missing records has been evaluated.
Renewed efforts to search archived storage areas within CPPO have also been initiated.
The search for
r Attachment B (Continued) original design records will be expanded to include other sources such as the NSSS vendor and vendors of other components.
OPPD has factored the concern of Design Basis Records into the overall review of the Design Change / Modification Program described in the cover letter. The Design Change / Modification Program review and the improve-ments to be made as a result of this review will help ensure more ade-quate and complete design basis records.
3.
Post Modification Testing -
OPPD's practice has been to perform post modification functional test-ing, if possible, to confirm adequacy of design. However, testing is not performed if there is a possibility of introducing transients during normal plant operation. The need to adequately function test modifica-tions will be further emphasized to those engineers responsible for de-sign and testing.
4.
Evaluation of Extent to Which Condition May be Reflected in the Unreviewed Portion of the Design -
Although there is no specific evidence that past practices have adverse-ly affected the unreviewed portion of the design, this generic problem will be the subject of comprehensive review as part of the Design Change / Modification program.
B-2
-.