ML20247A694

Safety Insp Rept 50-341/89-06 on 890203-0412.Violations Noted Re Failure to Properly Design Railcar Door Seals for Flood Protection & Containment Integrity.Major Areas Inspected:Reactor Bldg Railcar Door Designs

ML20247A694
Person / Time
Site:	Fermi
Issue date:	05/15/1989
From:	Ring M NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20247A671	List: ML20247A668 ML20247A694
References
50-341-89-06, 50-341-89-6, NUDOCS 8905230245
Download: ML20247A694 (15)

See also: IR 05000341/1989006

Text

- .

- - - . .-. .. .

.-

• f .

.; 1 U. S. NUCLEAR REGULATORY. COMMISSION.

REGION III

i

Report No. 50-341/89006(DRP)

Docket ~No. 50-341 Operating License No. NPF-43

y

License ~e: Detroit Edison Company

2000 Second Avenue

Detroit, MI 48226

Facility Name: - Fermi l2.

Inspection At: Fermi Site, Newport, Michigan

Inspection Conducted: February-3 through April 12, 1989

s

Inspectors: W. Rogers

p

S. Stasek

K.'Ridgway .

j? Y Eg-/

Approved By: , Mark A. Ring, Chief.. /

p Reactor Projects Section 3B Date

-Inspection' Summary

-Inspection on February 3 through April 12, 1989 (Report No. 50-341/89006(DRP))

Areas Inspected: Special safety inspection associated with reactor building

railcar-door design deficiencies.

Results: Two' apparent violations'were identified for failure to properly

u design the.railcar door seals for flood protection and secondary containment

1 integrity requirements. These will be the subject of-an enforcement conference.

L A third apparent violation concerning the evaluation of the railcar door design

deficiencies:as they relate to flood protection will be the subject of further

inspection ~in' conjunction with other safety evaluation matters under consideration

by the inspectors (Paragraph-7).

89052302A5 99051g

{DR :ADOCK 05000341 PDC

--_= _ _ _ . _ _ _ _ _ _

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

'

. .

.,

- DETAILS

1. Persons Contacted

a. Detroit Edison Company

+A. Alchalabi, Nuclear Engineering

+*P. Anthony, Compliance Engineer

+*S. Catola, Vice President, Nuclear Engineering and Services

+J. Contoni, Nuclear Engineering

• G. Cranston, Director, Nuclear Engineering

+L. Fron, Nuclear Engineering

+*D. Gipson, Plant Manager

+*L. Goodman, Licensing

K. Howard, Principle Engineer, Plant Systems

+*R. McKeon, Superintendent, Operations

R. Matthews, I&C Supervisor

+W. Orser, Vice President, Nuclear Operations

T. Riley, Supervisor, Compliance

+A. Settles, Technical Engineer

+F. Svetkovich, Assistant to Plant Manager ,

'

+B. Sylvia, Senior Vice President

• F. Swartz, Principle Engineer, Quality Assurance

• G. Trahey, Assistant to the Senior Vice-President

+J. Walker, Nuclear Engineering

b. U. S. Nuclear Regulatory Commission

+*W. Rogers, Senior Resident Inspector

+*S. Stasek, Resident Inspector

K. Ridgway, Senior Resident Inspector, Dresden Station

• Denotes those attending the exit meeting on March 17, 1989.

l + Denotes those attending the exit meeting on April 12, 1989.

2. Design Deficiencies Identified at Pilgrim Station

On August 8, 1988, the NRC issued Generic Letter 88-14, " Instrument Air

Supply System Problems Affecting Safety-Related Equipment," to all

! operating license holders. The generic letter requested each licensee

to verify that the design of their instrument air system, including

actuated components, was in accordance with its intended function and

safety-related components would perform as expected during all

design-basis events. During this review the Boston Edison Company

discovered two design inadequacies at their Pilgrim Station. Pilgrim

Station is a BWR 4; the same as Fermi 2.

The first design deficiency dealt with the torus-to-reactor building

vacuum breakers. These valves are required to open to prevent

l excessive vacuum inside the primary containment and close for primary

2

- _ _ _ - _ _ _ _ _ - _ _ - _ .

___

1

i

'. *

i

'

containment integrity. Accumulators were installed to provide air to

the pneumatically controlled torus-to-reactor building vacuum breaker

valves to assure valve closing capability. However, these accumulators 4

were undersized and would not provide closing capability for the

requisite length of time.  !

The second design deficiency dealt with two in-series reactor building i

railcar airlock doors which form a part of the secondary containment

boundary. The design of the railcar door included pneumatically

inflated seals which also formed part of the secondary containment

boundary. However, the air supply for the seals was determined not to

be seismically qualified. Subsequently, the Pilgrim Station installed

flexible flaps on the inner railroad door and verified secondary

containment integrity through testing with the pneumatic seals

deflated.

3. Torus-to-Reactor Building Vicuum Breaker Deficiency

The torus-to-reactor building design deficiency came to light first.

This design deficiency was determined not to be applicable to Fermi as

documented in Inspection Report 89004.

.

4. Secondary Containment Deficiency

a. Secondary Containment Description / Requirements i

10 CFR 50, Appendix A, Criterion 16, requires a reactor containment

and associated systems capable of providing an essentially leaktight

barrier against the uncontrolled release of radioactivity to the

environment. Updated Final Safety Analysis Report (UFSAR)

Section 3.1.2.2.7 describes the licensee's conformance to Criterion 16.

In that description it states, "The secondary containment, a building

that contains the primary containment as well as portions of the

reactor process systems and refueling facilities, is maintained at a

negative pressure under accident conditions to ensure against leakage.

The interior atmosphere is processed to control emissions to the

environs so that offsite dose levels are maintained well below the

requirements of 10 CFR 100."

At Fermi the reactor building is the secondary containment and

was designed and constructed as a Category I structure. UFSAR

Section 6.2.1.2.2.1 discusses secondary containment penetrations.

That section states that access openings into the reactor building

are equipped with weather-strip-type seals for airtightness and

one of these access openings is the railcar entry. All access

openings have a vestibule with double doors to maintain secondary

containment integrity. The double doors are either interlocked to

prevent the opening of one door until the other door is closed or

one of the doors is keylocked closed. In the case of the railcar

entry doors the interlock feature was utilized.

3

_. _ - _ _ . -_. - __

_. . - - _ - _ _ _ _ _ _ - _ _ - _ _ _ - - _ _ _

y

• *

. .

'

'

To have secondary containment integrity requires an intact

secondary contain~ ment / associated penetrations and a Technical

Specification designated negative pressure within secondary

containment. During normal operations a negative pressure of at

least 0.125 inches vacuum is maintained by the reactor building

ventilation system. During accident conditions a negative

pressure of at.least 0.250. inches vacuum is maintained by

one, Standby Gas Treatment System (SGTS). These negative pressure

requirements are delineated in the surveillance requirements of

Technical Specification 4.6.5.1.

Secondary containment integrity is a safety-related protection

system and as such must conform to 10 CFR 50, Appendix A,

Criterions 20, 21 and 22. These criteria require protection ~

systems to be able to operate after an operational occurrence

(loss of offsite power), be redundant and independent to assure

that no single failure results in loss of the protection function

.and be~able to withstand the effects of natural phenomena without

loss of the protection function.

UFSAR Sections 3.1.2.3.1, 3.1.2.3.2 and 3.1.2.3.3 explicitly state

conformance to these criteria.

UFSAR Section l'.2.1.3.7. states in part, " Essential safety actions

are. carried out by equipment in sufficient redundancy and

independence so that a single failure of active components will

not prevent.the required actions... Nuclear safety systems and

ESFs are designed to maintain operability under all plant-related

and site-related events (e.g., earthquakes, tornadoes, floods,

' fires)... Features-of the plant essential to the mitigation of

accident consequences are designed for fabrication and erection

to quality standards that reflect the importance of the safety

function to be performed...The plant is designed, fabricated,

erected, and will be operated in such a way that under accident

L conditions the release of radioactive materials to the

l' environment is within the requirements of 10 CFR 100."

b. Licensee Response ~ to Pilgrim Deficiency

In late January 1989 DECO senior management received information

from the NRC Region III Division Director discussing the railcar

door problem at the Pilgrim site. DECO senior management provided

this information to the engineering director on January 30, 1989,

who had the information distributed to his applicable supervisors.

On February 1, 1989, the information was given to the engineer

responsible for reviewing Generic Letter 88-14. Earlier that same

day a resident inspector made inquiries about Fermi's railcar door

configuration in response to Region III inquiries which were directed

to-the same responsible engineer. The engineer reviewing Generic

j By the

Letter 88-14 performed an initial review of the situation.

l next day the engineer determined that the pneumatic supply to the

l railroad door seals wu not safety-related or able to withstand an

4

_ - _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ - _ _ _ .

, ..

• '

. .

, .

'

earthquake. Following'a meeting on February 3,1989, the matter was-

,

' turned over to' Deco civil engineering personnel for further evaluation.

Civil engineering had been the department responsible for the original

purchase / design requirements for the doors during initial

construction. During these initial . reviews it was noted that an

external flexible weather seal was installed on the outside

< railroad door. Personnel felt that this weather seal probably

'

was capable of maintaining secondary containment integrity since

.

l

it appeared to be similar to the successful design modification

applied by the. Pilgrim station. During the early afternoon on.

'.

L . February 3, ~1989, DECO management me t and informed the resident

- staff that the air supply to the rsilcar door saals was'not

qualified but there was reason to believe that the secondary

containment-function could be met with the seal deflated. DECO

proposed a special secondary-containment test to verify secondary'

containment integrity without.the pneumatic seals inflated. In

, .

parallel, Deco engineering began preparing an engineering design

change (EDP), EDP 9963, to install additional weather stripping

around the external railcar door should the test fail.

. On February 8,1989, the test was performed. The test indicated

that one Standby Gas Treatment System (SGTS) could not maintain

an adequate negative pressure with both railroad airlock doors

closed and their seals deflated. Upon conclusion of the

unsuccessful test, maintenance personnel installed weather

- stripping in the external cracks of the outer railroad door in

accordance with EDP 9963, and a draw down/ leak rate test was

. satisfactorily performed with the doors in the above status.

Administrative controls were put in place to prevent the opening

of the railroad coors until further testing could be carried out.

During the February 8, 1989, secondary containment test,

extremely high winds were experienced which caused doubt as to

the validity of the test. Therefore, on March 10, 1989, the

licensee repaated the secondary containment test in low wind

conditions with both railroad doors closed, the weather stripping

of EDP 9963 removed from the outer railroad door and the

pneumatic seals deflated. One SGTS was unable to maintain a

negative pressure in the reactor building. The weather stripping

was reinstalled and a sut.:essful secondary containment test

performed.

c. Inspector Followup

(1) Initial Actions and Test Witnessing

When the second Pilgrim design deficiency came to light in

late January 1989, Region III directed the resident

inspector staff to contact the licensee about this matter.

Contact was made on February 1,1989, with DECO engineering.

5

- - _ _ _ _ _ - _ _ _ _ ._______ - _ -

.. . _ _ _ _ _ _ _ _ _ _ _ _ _ _ - -

I

y. -

.

l

. DECO management informed the resident staff on February 3,

1989, that the railroad airlock pneumatic door seal air supply-

was not seismically qualified but there was an installed

external flexible weather seal (a part of the original design)

-on.the outer railroad door.- The licensee felt that secondary

' containment probably could be maintained without the pneumatic

seals'being infloted. This flexible weather seal appeared to

be equivalent to Pilgrim's flexi' ole flaps. However, testing

would be perftrmed to confirm this.-

Three inspectors witnessed the test conducted on February 8,

1989, installation of the weather stripping under EDP 9963, and

the subsequent secondary containment integrity verif* cation.

Two inspectors witnessed the March 10, 1989 test, reinsta11ation

of the weather stripping, and subsequent secondary containment

integrity verification. During.the testing sequences the

inspectors verified that approved procedures were used, the

procedures were followed, appropriate Limiting Conditions for

Operation were met and the NRC notified via the ENS in the

appropriate time frames. : Finally, following instellatMa of

the.veather stripping on February 8th and March 10th, Q e

inspectors-confirmed that secondary containment was restored.

(2) Evaluation of Wind Conditions

l

Extremely high winds, approximately 18 mph at the 10 meter

level, were experienced during the February 8,1989,

secondary containment integrity test. Such wind' conditions

negatively bias this type of testing. This is due to the

acceptance criteria utilized for determining a successful

test. Part of Technical Specification 4.6.5.1 requirements

for secondary containment integrity is the ability of one SGTS

to maintain greater than or equal to 0.25 inches of vacuum.

The 0.25 inch of vacuum is derived from NRC Standard Review

Plan, Branch Technical Position CSB G-3, " Determination of

Bypass Leakage Paths in Dual Containment Plants," which states

in part, "...a positive pressure is defined as any pressure

greater than -0.25 inches water gauge to account for wind loads

and the uncertainty in the pressure measurements. Whenever the

pressure in the secondm y containment volume exceeds -0.25 inches

water gauge, the leakage prevention function of the seccndary

containment is assumed to be negated." The wind loads of

CSB 6-3 are only applicable up to the maximum wind speed

utilized in the atmospheric dispersion model for radioactive

releases when a positive pressure exists. Therefore, the

inspector concluded (as did the licensee) on the date of the i

test the wind speed appeared to be in excess of the

atmospheric dispersion model speed and, therefore, the validity

of the results was questionable.

6

_ _ _ _- _ _ _ _ _ _ .___--_ __- _ __ - _ -

p'~

(. ". .

~(3) Instrumentation Utilized to Verify Secondary Containment

' Integrity-

L

b< -(a) Instrumentation Description

,

Section 6.2.1.5.2 of the UFSAR states in part,_ " Secondary

containment pressure is normally controlled by the

reactor / auxiliary building ventilation system.

Pressure sensors outside the building are arranged so  ;

that the lowest pressure on the building (due to wind)

is compared with the bui_1 ding internal pressure which

is maintained at 0.25 inches of water below the lowest

,

outside pressure...."

There are four differential pressure sensors utilized

to control reactor building pressure by the HVAC system.

The sensors are located on the fifth floor of the reactor

building with one sensor mounted on the North, South, l

East and West walls. An~auctioneering circuit. selects

the most positive sensor reading to input into the HVAC

system, select control room annunciators and provide

' indication in the centrol room.on recorder T41-R800A.  :

This comprises Division 1 of_the differential pressure  !

indication system.  ;

There_is another set of four differential pressure i

sensors located on the fifth floor of the reactor i

building. These sensors feed into an auctioneering.

circuit which'also selects the.most positive sensor  :

'

reading. This high auctioneered signal inputs into

select control room annunciators and control room

recorder T41-R800B. This comprises, Division 2 of the

differential pressure indication system and performs no

s control function.

Drawing 5I721-2613-54 schematically describes the ,

Division 1 and 2 pressure sensor / circuit configuration.  :

(b) Instrumentation Accuracy I

The inspector reviewed the instrument specification  :

sheets of both differential pressure sensing loops to

determine the accuracy of the instrument loops. In

both cases the loop accuracy was 0.1125 inches of

vacuum. Therefore, the inspector' concluded that the ,

instrumentation was adequate for confirming Technical  !

Specification Limiting Conditions for Operation and

Surveillance Requirements.  ;

l

ll

'

!

I

7

)

__ ___ __

• *

. .

(c) Use of an Averaging Technique

Following the February 8, 1989, secondary containment

integrity test certain licensee personnel began considering

use of an averaging technique to determine the 0.25 inches

of vacuum acceptance criteria. Specifically, the secondary

containment wall readings would be added together and

divided by the number of readings. The result would be

compered to the 0.25 inches of vacuum to determine whether

'

an acceptabie test had been accomplished. That day the

inspector contacted appropriate Nuclear Reactor Regulation

personnel to ascertain whether this would be an adequate

means of meeting the Technical Specification negative

pressure requirement. The final conclusion was averaging

is not adequate. The negative pressure requirement is not

based upon an average but every sectica of the building

must meet the 0.25 inches of vacuum. This information was

i conveyed to the licensee the next day.

l

(d) Actual Configuration

During the test witnessing it came to the inspectors'

attention that the Division 2 south wall sensor was out

of service and was jumpered out of the auctioneering

circuit. Temporary modification 88-0048, Rev. A, of

August 2, 1988, authorized the removal of this sensor

from the circuit. Under Section 4.7 of the temporary

modification evaluation form the question, "Are all

affected Critical Plant Drawings, Procedures, Technical

Specification identified correctly?" was answered

"yes." However, Procedure 24.405.03, " Secondary

Containment Integrity Test," was not identified. In

Section 5.2.9 of that test, recorder T41-R800B is used

i

exclusively to verify that 0.25 inches vacuum is

i maintained when SGTS Division 2 is used to perform the

secondary containment verification test. Due to wind

direction during the testing the unmonitored wall could

be experiencing the most positive differential

pressure. Therefore, an unacceptable t"st could be

performed and yet the acceptance criteria met.

Utilization of recorder T41-R800B for surveillance

i testing is inappropriate without compensation for the

unmonitored wall.

(4) Evaluation of Design / Testing Documents for Railcar Door as

a Secondary Containment Boundary

Numerous design documents pertaining to the railcar door and

secondary containment were reviewed. The main document for

procurement of the railcar door was a bill of material.

This bill of material clearly stated that the door was to be

Quality Level I, pressure tight with a filtration rate not

8

. _ _ _ _ _ . __ __ . _ _ _ - _ _ _ _ _ _ _ _ _ _ -

- . - --

', . .

.h.

I- '

to exceed 250 cfm/ door. The bill of materials required air

tightness testing under the performance testing section.

The only thing not stated in the bill of materials was that

the filtration rate was with the seals inflated. However,

in reviewing the operating sequence provided by the vendor

on door operation it is clear that the seal would inflate

upon door closure. The inspector reviewed the equipment

,

qualification sheet on the pneumatic seal to assure.that the

I material was qualified to the harsh accident environment.

The information was appropriate. The-inspector reviewed the

preoperational testing performed for secondary containment

integrity and noted that under the prerequisite section the

railcar doors were. required to'be operational. Also, given

p

the testing sequence of the preoperational tests the '

pneumatic supplies for the railcar doors had to be in

service.

5. Flood Protection Deficiency

a. UFSAR Description

Section'2.4.2.2.2 of the UFSAR discusses the reactor / auxiliary

building flood criteria. A portion of this section states, "The

Category I reactor / auxiliary building, which houses

safety-related systems and components, is designed against

flooding to Elevation 588.0 feet, or 1.1 feet above the PMME

stillwater flood elevation of 586.9. All doors and penetrations

i- through the'outside walls below the design flood elevation are of

watertight design, All safety-related systems and equipment

located inside this Category I structure are protected from the

l

PMME flood." Later in this section it states, "The south wall of

the reactor / auxiliary building has two large openings and several

waterproofed pipe-sleeved openings. These large openings are in

an air-locked railcar door and an air-locked personnel door.

Both of these doors, hoyaver, will be air-locked and completely

water proofed to preclude wave runup flooding."

Section 3.4.4.1_of the UFSAR discusses the reactor building

structure as it relates to flood design. A portion of this

section states, "All doors and penetrations through the outside

walls below the design flood elevation are of watertight design."

Later in this section it states, "The south wall of the

reactor / auxiliary building has two large openings and several

waterproofed pipe-sleeved openings. The large openings are an

air-locked railcar door and an air-locked personnel door. Both

,

_of these air-locked doors are completely waterproofed to preclude

wave runup flooding."

9

. - - _------__________________a

_ - _ - _ _ - _

' *

. ,

,

'

b. Licensee Response

Upon turning the railcar door issue over to the civil engineering

personnel on February 3, 1989, it became apparent that the

railcar door seals provided a flood protection function. On

February 4, 1989, civil engineering personnel documented an

evaluation of the consequences of n.t having a qualified air

compressor for the railcar door as it relates to the flood

protection requirements.

The evaluation was in the form of a letter to file, NE-PJ-89-0076,

from civil engineering. The evaluation was a probabilistic risk

assessment (PRA) of the probable maximum petrological event (PMME)

and pneumatic supply to the rat: car door seals failing simultaneously.

The total probability of this occurrence was calculated at 5.5E-08.

This probability was derived by multiplying the PMME probability,

2.05E-05, by an assumed pneumatic railcar door seal system failure of

one c'ay per year, 2.7E-03. The assessment went on to state,

" Regulatory documents and general accepted industry experience rules

do not require considering an event as a design basis as long as its

probability is less than about 1.0E-097. Events with such small

probability are considered highly improbable and therefore need

not be considered." Finally, the assessment states, "This

evaluation concludes that a single failure of the air supply

system does not have to be considered concurrently with a site

flooding condition."

On February 8, 1989, deviation event report (DER) 89-0219 was

initiated by Deco civil engineering. An attachment to the DER

response was memorandum NE-PJ-89-0076.

On February 10, 1989, another memorandum was generated by DECO

civil engineering. This memorandum, NE-89-0013, was from the

General Director of Nuclear Engineering to the Operations

Superintendent. The subject of the memorandum dealt with

recommendations for the acquisition, staging and use of sand

bags at the railcar door in the event of a flood. The memorandum

identified the appropriate procedures that would need to be

changed to implement sand bag use. The memorandum was

considered as an enhancement to the licensee's ability to deal

with a flood and not mandated actions required by any regulatory

requirements.

Operations superintendent staff began actions to implement the

recommendations of memorandum NE-89-0013. The time frame for

these actions were not on an expedited base: since these

recommendations were not viewed as requirements but enhancements.

Finally, when civil engineering became aware that the railcar

door seals were not inflated after installation of the weather

stripping under EDP 9963 a request was made to inflate the seals. i

On March 24, 1989, the seals were successfully inflated without

impact upon the integrity of the weather stripping.

I

10

l - _ _ _ _ _ _ _ _ _ _ ____ _____-_______ _ ___________ _ _

_ . _ _ _ _ _ _ _ _ _ -

• *

. .

,

c. Inspector Followup

(1) Initial Actions

During the afternoon of February 3, 196 , after review of

the railcar drawings the resident staff noted that the

external railcar door appeared to provide flood protection

capability. Late in the afternoon of February 3, 1989, the

resident inspector informed DECO engineering management of

the matter. DECO engineering management stated that the

same matter had been identified by their engineers and the

situation would be addressed.

(2) Identification of the PRA/ Sand Bag Memorandum

'

On Marct. 16, 1989, while performing follow up activities

associated with this report, it came to the attention of the

inspector that a memorandum had been sent to the Operations

Superintendent from engineering to acquire sand bags and

change abnormal operating procedures (A0Ps) to use the sand

bags at the railcar outer door. Later that day the

inspector contacted the civil engineering personnel

responsible for EDP 9963 to confirm that the weather

stripping met appropriate flood protection criteria. The

personnel stated that the weather stripping did not perform

a flood protection function. The inspector reviewed the A0P

discussed in the sand bag memorandum and noted that the

procedure had not been revised. Subsequently, the inspector

i contacted the Operations Superintendent to determine whether

any sand bags were staged for use at the railcar door. The

response was negative but direction was given to acquire and

j stage the sand bags. The required number of sand bags

stated in the memorandum were located between the cooling

I

l

towers and action was initiated to bring the sand bags into the

'

protected area. By the evening of March 16th the sand bags

were staged outside the railcar door. Also, on March 16th

the inspector acquired the disposition of DER 89-0219

incluJing the PRA done oh the compressor / design bases flood

coincident failure.

(3) PRA Challenge

On the morning of March 17, 1989, the inspector requested

DECO engineering answer what assumptions went into the

design bases flood (DBF). Specifically:

(a) Can offsite power be maintained during the flood?

(b) Since the shore barrier is designed to withstand

an operating bases earthquake and a flood, were

any other structures required to meet this

assumption?

11

._-__ --_-_______ - _ _ _

_ _ ._.

- _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

p

• * .. .

,

.

(c) Since there is an external flooding analysis

'

associated with a single failure of an in plant

'

L drain pipe, was this the most limiting single  ;

failure postulated during the' DBF or is it an

'

!

unique analysis?'

The initial response of DECO engineering was.that nothing I

was assumed to occur except the DBF. DECO engineering did

agree to review the assumptions associated with the DBF.

On March 20,1989,. DECO ene;ineering acknowledged that

'

offsite power would be lost as a consequence of the flood.

With the loss of offsite power the electrical supply to the

railcar door compressor would be lost. DECO personnel

stated that the compressor could be loaded onto an emergency

diesel generator bus. Further discussion revealed that no

procedure was available to direct operators on how to

establish that electrical alignment.

The shore barrier appeared to be a unique structure to meet

simultaneous seismic and flood events.

(4) Design Document Review

The inspector reviewed the vendor information qualifying the

door seal to withstand the design bases flood. This

information is clearly based on inflated door seals'and the

inspector noted no problems with the information.

> 1

6. Licensee Event Report (LER) Review

On March.10,=1989, the licensee submitted LER 89-005-00 to the K9C.

'This LER discussed.the nonsafety-related air system for the railcar

door seals. The report did not include the results of the March 10th

test due to the time constraints associated with issuing the LER.

However, the LER indicated that a revision to the LER would be issued.

In the analysis section of the LER the watertight function of the

airlock was considered not to be a concern. This statement was

incorrect.

On April 10, 1989, Revision 1 to the LER was submitted to the NRC. In

this report the watertight, function of the railcar door seal was

appropriately discussed with the potential ramifications properly

addres sed.' The revised report discussed the results of the March 10th

secondary containment integrity test. With the issuance of the

1

revised LER the inspector had no further questions on the factual

content of the'LER.

7. Conclusion

a. . Technical' Specification 1.36(e) states, " SECONDARY CONTAINMENT

INTEGRITY shall exist when the sealing mechanism associated with

each secondary containment penetration, e.g., welds, bellow or

12

_ _ _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ -_

. _ . . _ _ _ _ _ . _ _ _ _ _ - - _ _ _ _ _ _ _

. .

,

_

Y,

T 0-rings, is OPERABLE." Inclusive in the definition of

operability _as stated in Technical Specification 1.25 is the

-capability of necessary attendant support systems to perform

their safety functions. These attendant support systems for-

SECONDARY CONTAINMENT INTEGRITY must perform their safety

functions'under numerous design bases conditions including a loss

L of offsite power, earthquake and single failure as discussed in

10'CFR.50, Appendix A, Criteria 20,.21 and 22 and numerous UFSAR

n sections. . To assure that the protective function of secondary

. containment integrity is maintained in these design bases

conditions 10 CFR 50,. Appendix B, Criterion 111, " Design Control,"

states.in part, " Measures shall be established to assure that

applicable regulatory requirements and the design basis are

correctly translated into specifications, drawings, procedures,

and. instructions...."

The design of the railcar door pneumatic supply was inadequate to

'

meet the applicable regulatory requirements or to support the

definition of SECONDARY CONTAINMENT INTEGRITY. Technical

Specification 3.6.5.1 requires SECONDARY CONTAINMENT INTEGRITY in

OPERATIONAL CONDITIONS 1, 2 and 3 and Technical Specification 3.0.4

,c forbids ascension into these operational modes without secondary

containment integrity operable. The licensee ascended into

f -

operational conditions 1, 2 or 3 forty-four times without secondary

containment integrity. The installation of the weather stripping on

the outer railroad car doors placed the licensee in conformance with

all secondary containment integrity requirements.

This is considered to be an apparent violation (341/89006-01A) of

10 CFR 50, Appendix B, Criterion III. The root cause of the

violation was failure to properly construct the support system for

secondary containment in accordance with the applicable regulatory

requirements pric~ to issuance of the operating license.

b. 10 CFR 50, Appendix A, Criterion 1, states in part, "Str9ctures,

systems, and components important to safety shall be designed,

fabricated, erected, and tested to quality standards commensurate

with the importance of the safety functions to be performed."

10 CFR 50, Appendix A, Criterion 2, "Dasign bases for protection

against natural phenomena," states in part, " Structures, systems,

and components important to safety shall be designed to withstand

the effects of natural phenomena such as earthquakes, ... floods,

...without loss of capability to perform their safety

functions...."

UFSAR Sections 3.1.2.1.1 and 3.1.2.1.2 state compliance with these

criteria. Also, UFSAR Section 2.4.2 states that Fermi 2,

Category 1 structures and components are designed against

flooding to a minimum elevation of 588 feet (Fermi 2 grade leve:

is 583 feet, six inches) and Section 3.4.4.1 states all doors and

J

13 j

t

- - - _ _ _ - _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _

,- _-- -_ _ _ _ _ _ _ . _- _ _ _ _ _ - _ . - . _ - _ _ - -

. .

,

F

k penetrations 'of the Reactor Building outside walls below design

flood elevation are of water tight design. Without the pneumatic

~

seals functioning the airlock doors were not water tight.

As discussed above these design measures are required to be

translated into the drawir:gs and specifications per 10 CFR 50,

Appendix B,. Criterion III. This was not'the case with the

pneumatic railcar door seals which utilized a nonsafety-related

compressor /sexiliaries from a power' source which would be lost as

a consequence of a natural phenomena (flood).

'This'is considered an apparent v dolation (341/89006-01B) of

.

10 CFR 50, Appenc:lx B, Criterion III. The root cause of the

violation was failure to properly construct the support system for

flood protection in accordance with the applicable regulatory

requirements prior to issuance of the operating license.

c. 10 CFR 50, Appendix B, Criterion XVI, " Corrective Action," states

in part, " Measures shall be established to assure that conditions

adverse to quality...are promptly identified and corrected." "he

licensee instituted the DER system to promptly identify and

correct conditions adverre to quality. The unqualified railcar

< door seal pneumatic supply was identified on a DER but adequate

correction of the condition adverse to quality was not'

established.

The PRA performed by the licensee and documented in the DER in

response to the flood protection aspect of the railcar door seal

design way technically incorred, First the licensee

inappropriately took credit fo: 4 aonsafety-related system, the

,

railcar door seal pneumatic sumy, in performing a saf9ty-related

function. This premise was inconsistent with 10 CFR 50,~

Appendix A, Criterion 1 which states in part, " Structures, systems,

and components important to safety shall be designed, fabricated,

erected, and tested to quality standards commensurate with the

importance of the safety functions to be performed." Second, the j

multiplication of the PMMC probability and pneumatic supply i

failure probability was flawed. If a PMME should occur a

required assumption of this event would be a loss of offsite

power resulting in failure of the railcar door seal compressor

and depressurization of the railcar door seals. Therefore, a

PMME and deflation of the railcar door seals are not independent

of each other. As such, the two probabilities should not have been

multiplied together.

Through the PRA the licensee changed the facility as described in

the UFSAR. ine original flood protection design feature was the

supposedly fully qualified (watertight) airlocked (inflated

door seals) railcar door. With the PRA on February 4, 1989, the

licensee accepted something less than the fully qualified

inflated door seals as the flood protection design feature.

Also, upon completing the installation of the weather stripping

14

__M________________________ ____z______._. __ _ _ _ . _ _ _ . . _ _ .)

_ _ _ - _ - - - - - - - - _ _ - - - - _ - _ _ _ _ . - - - - - - - - _ _ - - _ . - _ _ _ _ _ . - - _ - _ _ _ _ _ . _ . - -

,

y 1. , ,

" under EDP 9963 on February 8,1989, the licensee left the railcar

,

door seals deflated until March 21, 1989. Therefore,

regardless of the qualification of the railcar door seals

pneumatic supply e railcar door was incapable of. performing its

UFSAR watertight iction during this time period. i

10 CFR 50.59(a) allows the licensee to make changes in the

facility as described in the safety analysis report provided the

change does not increase.the probability or consequences of an

accident or malfunction of equipment important to safety

previously evaluated in the safety analysis report.

Clearly, the original consequences of the DBF or PMME would not

impact upon safety related equipment. The bases for this

conclusion was in part due to watertight airlocked railcar doors.

With the loss of qualified watertight railcar doors a DBF or PMME

could impact safety-related equipment within the reactor

building.

The PRA to the DER was in fact an inadequate safety evaluation.

Had the.li m see utilized the DECO administrative process for

,

L

10 CFR 50.59 reviews the same technical expertise would have been

used to provide the evaluation and the conclusions drawn would

f have been the same and an unreviewed safety question would not

( have been identified.

The inadequate PRA to the DER is considered an apparent violation l

(341/89006-02) of 10 CFR 50, Appendix B, Criterion XVI and

L 10 CFR 50.59. This apparent violatiot: will be addressed with other i

10'CFR 50.59 safety evaluation concert;s in a subsequent' inspection

report. The root cause of this viole. tion is considered a significant

lack of understanding by engineering personnel of the technical bases  ;

for flood protection of safety related systems and components.

i

d. ~ The improper evaluation of tunport y modification 88-0048 is

another facet of previously identified deficiencies in the ,

temporary modification program. Therefore, this deficiency will  !

be incorporated into unresolved item 341/88035-01. The root i

..

cause of this matter is considered a lack of complete

I

understanding by technical / engineering persennel of Technical

Specification surveillance requirement 4.6.5.1.

8. Exit Interview

!

l The inspectors met with licensee representatives (denoted in Paragraph 1)

on February 3 and April 14, 1989, and informally throughout the inspection

L

' period and summarized the scope and findings of the inspection attivities.

I' The inspectors also discussed the likely informational content of the

inspection report with regard to documents or processes reviewed by the

inspectors during the inspection. The licensee did not identify any such

documents / processes as proprietary. The licensee acknowledged the

findings of the inspection. j

i

j

l ,

15

l- j

'

-

I

t - -- - - - - - _ _ _ __