NUREG-1117, Forwards Draft NUREG-1117, SER Re Restart of Davis-Besse Nuclear Power Station, Per Response to NRC & Info Submitted W/Course of Action.Schedule for Resolution of Open Issues Listed in Section 1 Requested

Forwards Draft NUREG-1117, SER Re Restart of Davis-Besse Nuclear Power Station, Per Response to NRC & Info Submitted W/Course of Action.Schedule for Resolution of Open Issues Listed in Section 1 Requested

ML20151X489
Person / Time
Site:	Davis Besse
Issue date:	01/29/1986
From:	Miraglia F Office of Nuclear Reactor Regulation
To:	Williams J TOLEDO EDISON CO.
Shared Package
ML20151L350	List: ML20151L345 NUREG-1117, Forwards Draft NUREG-1117, SER Re Restart of Davis-Besse Nuclear Power Station, Per Response to NRC & Info Submitted W/Course of Action.Schedule for Resolution of Open Issues Listed in Section 1 Requested
References
RTR-NUREG-0737, RTR-NUREG-1117, RTR-NUREG-737 NUDOCS 8602120425
Download: ML20151X489 (116)

Text

January 29, 1986 DISTRIBUTION Docket No. 50-346 (NFcketltlP JPartlow im. PDR RIngram L PDR Gray File PBD#6 Rdg ADeAgazio Mr. Joe Williams, Jr.

Senior Vice President, Nuclear f!1iraglia GDick Toledo Edison Company OELD GEdison ACRS-10 WPaulson Edison Plaza - Stop 71?

300 Madison Avenue EJordan DCrutchfield BGrimes WRussell Toledo, Ohio 43652 JKeppler, R:III CricCracken

SUBJECT:

SAFETY EVALVATION REPORT; TOLEDO EDISON COMPANY RESPONSE TO NRC LETTER OF AUGUST 14, 1985 Enclosed is the staff's Draf t Safety Evaluation Report relating to Toledo Edison Company's response to the NRC's letter of August 14, 1985 and other i

information submitted with the Davis-Besse Course of Action.

Your attention is drawn to Section I which summarizes open issues which must i be resolved. These issues are classified into two groups depending upon l whether the issue must be resolved prior to obtaining approval for startup or can l

be resolved in a later time frame. Section 1 also directs you to the appropriate location of the Draf t SER where the issues are discussed in more detail.

Please review the report and provide the necessary responses to resolve those l issues upon which a restart decision depends. For the remaining issues,

! please provide a schedule for resciution. Provide your response within 15 1

days of the date of this letter.

The staff has also made certain recommendations which it believes would improve overall performance and/or safety of the facility. While these recommendations are not open items, in the sense that they must be resolved, we request that you provide us your views regarding these recommendations so that their desposition can be clearly defined in the final Safety Evaluation Report. Please provide this information also within 15 days of this letter.

Upon satisfactory resolution of the restart issues and our review of those issues for which our review is not yet complete a final Safety Evaluation Report will be issued as a NUREG report.

Sincerely, "0MdIl D.MDf Frank J. Miraalia, Director Division of PWR Licene.ing-R

Enclosure:

As Stated cc w/ enclosure: PDH ^D j o346 0602120y[*Ohp9 PDH :D 4

n' See next pago P 0 Ilia 1g M ?dtMI [i M u y v. 'V#,

I PBD-6 AD:PtIR-B DD:DHFS' R:!II ~ NA/pg POD- I9 -

ADeAga ;cf CMcC OS 01 - DCPutchfield WPussell JKeppler 1/29/06 1/ /86 1/y//86 1/ /86 1/ /86 1/ /86

Mr. J. Williams Davi3-8 esse Nuclear Power Station Toledo Edison Company Unit No. 1 CC:

Donald H. Hauser, Esq. Ohio Department of Health The Cleveland Electric ATTN: Radiological Health Illuminating Company Program Director P. O. Box 5000 P. O. Box 118 Cleveland, Ohio 44101 Columbus, Ohio 43216 Mr. Robert F. Peters Attorney General Manager, Nuclear Licensing Department of Attorney Toledo Edison Company General l

Edison Plaza 30 East Broad Street 300 Madison Avenue Columbus, Ohio 43215 Toledo, Ohio 43652 Mr. James W. Harris Director Gerald Charnoff, Esq. (Addressee Only)

Shaw, Pittman, Potts l Division of Power Generation '

and Trowbridge Ohio Department of industrial Relations 1800 M Street, N.W. 2323 West 5th Avenue Washington, D.C. 20036 P. O. Box 825 Columbus, Ohio 43216 Mr. Paul M. Smart, President Mr. Harold Kohn, Staff Scientist The Toledo Edison Company Power Siting Commission 300 Madison Avenue 361 East Broad Street Toledo, Ohio 43652 Columbus, Ohio 43216 Mr. Robert B. Borsum President, Board of Babcock & Wilcox County Commissinners of Nuclear Power Generation Ottawa County Division Port Clinton, Ohio 43452 Suite 200, 7910 Woodmont Avenue Bethesda, Maryland 20814 Resident inspector U.S. Nuclear Regulatory Commission 5503 N. State Route 2 l Oak Harbor, Ohio 43449 l Regional Administrator, Region III U.S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn Illinois 60137 j

_ _ _ _ _ _ _ _ . . - . _ ________m_ _ _ _ - _ . _ - - _ _ _ _ _ - - _ _ .

0 NUREG-1177 DRAFT I

L i

L l

t l SAFETY EVALUATION R.EPORT RELATED TO  ;

} THE RESTART OF DAVIS-8 ESSE NUCLEAR POWER STATION i l <

l I i l i i

t es .

h

Document Name

DAVIS-BESSE RESTART SER TC l

l Requestor's ID:

NORMA i

l Author's Name:

l DeAgazio/Harwell l

l Document Comments:

I/28/86 KEEP THIS SEET WITH DOCUMENT C

I l

l

\

\}

ABSTRACT

[to come]

f Q

E 01/ 8/86 lil DAVIS-BESSE RESTART SER TC

TABLE OF CONTENTS

.P.ag.e.

ABSTRACT ................................................................

1 INTRODUCTION .........................................................

2 BACKGROUND DISCUSSION ................................................

2.1 Brie f Description o f the Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

i 2.2 S umma ry o f N RC Ac ti o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.3 Summary of Toledo Edison Company Response . . . . . . . . . . . . . . . . . . . . . . .

3 EVALUATION OF TOLEDO EDISON COMPANY ACTIONS ..........................

3.1 Management and Programmatic Aspects .............................

3.1.1 Management Restructuring .................................

3.1.2 Maintenance ..............................................

i 3.1.3 Procedures and Training ..................................

i 3.1.3.1 Plant Operating and Emergency Procedures ........

3.1.3.2 R o l e o f STA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.1.3.3 Reporting of Events .............................

3.1.3.4 Security ........................................

3.1.3.5 Training ........................................

3.1.4 Operating Experience Feedback and Pcst-Trip Review .......

3.2 Plant Review ................................................... -

3.2.1 Event-Specific Investigations ...........................

3.2.1.1 Aux.fliary Feedpump Turbine Overspeed and Control ....................................

(

3.2.1.2 Auxiliary Feedpump Turbine Trip Throttle Valve .

3.2.1.3 Spurious Steam and Feedwater Rupture Control System Actuation and Spurious Main Steam Isolation Valve Closure ........................

3.2.1.4 Main Feedpump Turbine and Control Failure ......

01/28/86 v DAVIS-BESSE RESTART SER TC

TABLE OF CONTENTS (Continued)

P, age 3.2.1.5' Turbine Bypass Valve, SP 13A2, Actuator Failure ........................................

3. 2.1. 6 Power-Operated Relief Valve Malfunction During the Event on June 9, 1985 ......................

3.2.1.7 Moter-Operated Valve Operator Malfunction . . . . . .

3.2.1.8 Sourt.e I!ange Nuclear Instruments . . . . . . . . . . . . . . .

3. 2.1. 9 Maia Steam Header Pressure .....................

3.2.1.10 Starting Feedwater Valve, SP-7A ................

3.2.1.11 Spurious Transfer of Auxiliary Feedwater Suction to Service Water ...............................

3.2.2 Thermal Transient Effects on Reactor Coolant System Componer.is ..............................................

3.2.2.1 Reactor Vessel .................................

3.2.2.2 Pressurized Thermal Shock ......................

3.2.2.3 Once-Through Steam Generator ...................

3.3 Improvement Programs and System Modifications ..................

3.3.1 Evaluation of Facility Modifications ....................

3.3.1.1 Steam and Feedwater Rupture Control System .........................................

3.3.1.2 Auxiliary Feedwater System .....................

I 3.3.1.3 Mo to r- D r i v e n P ump s . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.3.1.4 Safety Features Actuation System ...............

3.3.1.5 Balance-of-Plant Improvements ..................

3.3.2 Ongoing Improvement Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . .

i 3.3.3 Control Room Review and Improvement .....................

3.4 System Reviews and Test Procedures .............................

3.4.1 Component and System Testing Before Restart .............

3.4.2 Integrated Systems Testing at Power (input from contractors assistance also being considered) ...........

01/28/86 vi DAVIS-BESSE RESTART SER TC

.___- ,_n

TABLE OF CONTENTS (Continued)

Page 4 EVALUATION OF DECAY HEAT REMOVAL RELIABILITY AND CAPABILITY . . . . . . . . . .

4.1 Auxilia ry Feedwater System Before June 9, 1985 . . . . . . . . . . . . . . . . . .

4.2 Auxiliary Feedwater System Before Restart After the Event on June 9, 1985 ...........................................

4.3 Power-0perated Relief Valve /High-Pressure Injection / Makeup System for Makeup /High-Pressure Injection (MU/HPI) Cooling .. . . . .

5 CONCLUSIONS ..........................................................

APPENDIX A LETTER FROM W. DIRCKS (NRC) TO TEC REQUESTING INFORMATION DATED AUGUST 14, 1985........................................

APPENDIX B MEMORANDUM FROM W. DIRCKS TO STAFF WITH ASSIGNMENTS TO NRR, IE, AEOD, AND REGION III DATED AUGUST 5, 1985 ..........

APPENDIX C SUPPLEMENT TO THE TECHNICAL EVALUATION REPORT OF THE DETAILED CONTROL ROOM DESIGN REVIEW FOR THE DAVIS-BESSE NUCLEAR POWER STATION .....................................................

01/28/86 vii DAVIS-BESSE RESTART SER TC

ACRONYMS AND INITIALISMS AFW auxiliary feedwater AFWS auxiliary feedwater system APT action planning team ASME American Society of Mechanical Engineers ATOG abnormal transient operating guideline BTP branch technical position B&W Babcock and Wilcox Company CST condensate storage tank DA decision analysis DCRDR detailed control room design review DSA Disaster Services Agency EDO Executive Director for Operations EI emergency implementing E0P emergency operating procedure FCR facility change request GDC general design criterion (a) -

2 HED human engineering discrepancy HPI high pressure injection I&C instrument and control IE Office of Inspection and Enforcement IIT Incident Investigation Team ,

l ISEG Independent Safety Engineering Group j l

I 01/28/86 fx DAVIS-BESSE RESTART SER TC j 4

Document N:me:

DAVIS-BESSE RESTART SER SEC 1 ,

Requestor's ID:

NORMA Author's Name:

DeAgazio/Harwell Document Comments:

1/28/86 KEEP THIS SHEET WITH DOCUMENT i

1 1

i

1 INTRODUCTION By letter dated August 14, 1985 (Appendix A), NRC requested the Toledo Edison Company (hereafter also referred to as the licensee) and The Cleveland Electric Illuminating Company, pursuant to 10 CFR 50.54(f), to provide under oath or affirmation their plans and programs to resolve a number of concerns directly and indirectly related to the event on June 9, 1985. These concerns were grouped into the following general areas:

(1) completion of the investigation of the event on June 9, 1985, including analysis of the equipment failures, determination of the fundamental cause for failure, implications for other equipment, and corrective actions (2) the plant-specific findings regarding the event (3) the programmatic and management issues that contributed to the event and the performance of Davis-Besse The staff's evaluation of the licensee's response is given in this safety eval-uation. In performing this evaluation, the staff has used and relied on the information in Toledo Edison Company's Course of Action report, submitted on September 9, 1985, and revised by additional submittals dated October 1, October 16, October 31, November 16, December 13, 1985, and January 3, 1986.

The licensee submitted related information on November 30, December 2, Decem- ,

ber 5, December 9, and December 16, 1985, and January 2, 1986.

Additionally, a team of NRC specialists assisted by contractor personnel has conducted an onsite assessment of the licensee's maintenance program. To gain further assurance that the licensee is making progress with maintenance, the team will make another onsite assessment in February 1986. I 01/28/86 1-1 DAVIS-BESSE RESTART SER SEC 1 1

ti The August 14, 1985, letter to Toledo Edison Company and this safety evaluation are organized differently. This resulted, in part, because the licensee ini-tiatedthepreparationoftheDavis-BesseCourseofActionbeforetheAugft14, V 1985, staff letter was issued and, because the two documents were developed independently, they did not have a common strut?ure. The licensee did, how-ever, assure that all the issues raised by the staff letter are addressed in the Course of Action. Additionally, the staff review of the licensee's sub-mittal was organized by systems or disciplines rather than along the narrower specific concerns of the staff letter. Table 1.1 is a cross reference between the two documents.

The staff evaluation of Toledo Edison Company actions and responses to NRC's letter dated August 14, 1985, concludes that several issues related to the event are not yet satisfactorily resolved. Certain of these issues must be re-solved before the NRC will approve resumption of operation of Davis-Besse.

The remainder of the unresolved issues may be resolved following restart, but must be resolved satisfactorily before the start of Cycle 6. Table 1.2 lists the unresolved issues and directs the reader to the appropriate location in this report.

In several instances, the staff has used the Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants (NUREG-0800) in its evaluations to determine the acceptability of programs or systems. It is important to note that meeting the SRP is not a requirement for the Davis-Besse Nuclear Power Station, since at the time the licensee's application for an operating license was reviewed, the SRP was not applied as a basis for licensing.

The SRP is a valid basis for gauging acceptability because it is used to deter-mine the minimum requirements for plants currently being licensed; however, not meeting the SRP requirements does not necessarily indicate unacceptability.

A number of potential generic issues were identified on the basis of the re-view of the Davis-Besse Incident Investigation Team's findings (NUREG-1154) and during the staff's ongoing review of the Davis-Besse event. Restart of the Davis-Besse plant is not dependent on the processing of these potential generic issues. Generic issues include possible deficiencies in the design, 01/28/86 1-2 DAVIS-BESSE RESTART SER SEC 1

construction, or operation of several or a class of nuclear power plan'ts. The review, evaluation, prioritization, and resolution of potential generic issues '

4

by the staff is usually managed on a schedule separate from plant-specific licensing actions. In the case of the Davis-Besse event, the staff did not identify a need for immediate' staff actions of a generic nature. Accordingly, the generic issues identified resulting from the Davis-Besse event will be resolved in the longer term.

i 1

Although the staff identified no generic issues requiring immediate action, 3 issues for short-term generic action and 22 potential issues for long-term generic action were identified. Preliminary staff evaluation and prioritization of the 3 short-term issues has been completed. The staff's preliminary conclu-l sions and required resource commitments are currently under review by NRC management.

The staff review of the long-term issues is under way. Present plans include l an initial screening to identify the more significant issues for early evalua-tion because the overall effort is expected to require approximately 1 year to complete.

1 o

i i,

t i

i 01/28/86 1-3 DAVIS-BESSE RESTART SER SEC 1

Table 1.1 Safety evaluation cross referenced to 10 CFR 50.54(f) letter items SER 10 CFR 50.54(f) section letter item 3.1.1 IIIA, IIID 3.1.2- IIIA, IIIB 3.1. 3.1 IIA 6, IIA 12, IIB 1 3.1.3.2 IIA 4 3.1.3.3 IIA 6 3.1.3.4 IIA 3, IIA 10 3.1.3.5 IIB 1, IIB 2, IIIA 3.1.4 IIIA 3.2.1 IA, IB, IC, IIAS, IIA 11 3.3.1.1 IIA 2, IIAS, IIB 2 3.3.1.2 IIA 5, IIA 7, IIB 2 3.3.1.3 IIA 7, IIB 3 3.3.1.4 IIB 4 3.3.2 IIIC 3.3.3 IIA 9, IIB 2 3.4 IIA 13 4.1 IIAS, IIA 7, IIA 10 4.2 IIAS, IIA 7 4.3 IIA 1, IIAS l

l i

01/28/86 1-4 DAVIS-BESSE RESTART SER SEC 1

i Table 1.2 Unresolved issues A. Resolution Required Before Restart Authorization

1. Provide justification for not correcting those outstanding safety significant human engineering discrepancies (HEDs) and for those that will be only partially corrected (Section 3.3.3).

2. Confirm compliance with the concerns identified in IE Bulletin 85-01 with respect to steam binding of the motor-driven feed pump (Sec-tion 3.3.1.2).

3. The staff will conduct another survey at the site before restart to judge the effectiveness of modifications to maintenance programs and organization, and to determine if maintenance is improving (Section 3.1.2).

4. [ Potential open issues on MOVs]

5. [There may be some issues for restart from the system review and test program.]

B. Resolution Not Required for Restart Authorization

, 1. Submit training program descriptions of critical and difficult tasks for review by the staff, when completed (Section 3.1.4).

2. Submit, within 60 days after restart, proposed technical specifica-tions for the motor-driven feed pump similar to those applicable to the auxiliary feedwater pumps (Section 3.3.1.2).

3. Submit for review a comprehensive reliability study of the AFW system to determine if further improvement is required (Sections 3.3.1.2 and 4.2).

4. Submit outstanding information related to the Detailed Control Room Design Review (DCRDR) to enable the staff to complete its review as a separate licensing action. ,

5. Complete power supply modifications to the Safety Features Actuation System (SFAS) to ensure redundant channel independence (Section 3.3.1.4).

l l

01/28/86 1-5 DAVIS-BESSE RESTART SER SEC 1 l

Document Name:

DAVIS-BESSE RESTART SER SEC 2 Requestor's ID:

NORMA i

Author's Name:

, DeAgazio/Harwell Document Comments:

01/28/86 KEEP THIS SHEET WITH DOCUMENT i

6 F

l 6:

l i

1

)

I

2 BACKGROUND 2.1 Brief Description of the Event During the early morning on June 9,1985, one of the two main feedwater pumps at the Davis-Besse Nuclear Power Station tripped on overspeed while the plant was operating at 90% power. Approximately 30 sec later, the reactor and tur-bine were tripped automatically on high reactor coolant pressure. Shortly after the reactor tripped, a spurious steam and feedwater rupture control sys-tem (SFRCS) trip cause' the main steam isolation valvos to close, which re-sulted in interruption of steam to the remaining feedwater pump causing it to trip within several minutes. Subsequent to this loss of all main feedwater, an operator error, malfunctions of one safety-related valve in each auxiliary feedwater (AFW) discharge line, and overspeed trips of both safety-related auxiliary feedwater system (AFWS) pump turbines resulted in a loss of all -

sources of feedwater to the steam generators for a period of about 12 min.

Within about 12 min, feedwater was restored; however, separate actions by the operators were required to correct the operator error, open the valves that had malfunctioned, reset the overspeed trips on the AFWS pump turbines, and restart and control the turbine-driven AFWS pumps. Actions from outside the control room were necessary to open the valves and restart the pumps. While operators acted to restore AFW flow, other operator actions, also from outside the control room, were taken to place a non-safety-related motor-driven startup feedwater pump into service. Before any feedwater could be restored, the once-through steam generators essentially had boiled dry. Further, a number of additional equipment problems complicated the event. Nevertheless, the opera-tors were successful in restoring AFW flow and stabilizing the plant without any abnormal radioactivity release, any core damage, or any major damage to the plant. Details of the event and the findings of a special NRC investigation' team are reported in NUREG-1154.

i l I

l 01/28/86 2-1 DAVIS-BESSE RESTART SER SEC 2  :

1 2.2 Summary of NRC Actions 4

On June 10, 1985, Region III issued a confirmatory action letter that confirmed  ;

that the licensee would take certain actions to establish the causes of the

, malfunctions and determine the corrective actions to be taken, to perform evaluations with respect to the reactor vessel and steam generators, and to perform confirmatory testing. The letter also confirmed that the licensee

would obtain Region III concurrence before restarting the unit.

On the same day, the NRC Executive Director for Operations sent a team of tech-nical experts to the site to find out what happened, to identify the probable

cause of the event, and to make appropriate findings and conclusions to form the basis for possible follow-on actions.

I The report of the investigation team and a memorandum to the NRC staff from the Executive Director for Operations identifying actions to be taken were released on August 5, 1985 (Appendix B). The memorandum established the framework for a j letter dated August 14, 1985 (Appendix A), to Toledo Edison Company requesting information on subsequent findings regarding the cause of the equipment fail-

! ures and the corrective actions to be taken by Toledo Edison Company. This letter also superseded the June 10, 1985, Confirmatory Action Letter issued by l Region III.

2.3 Summary of Toledo Edison Company Response l

j Toledo Edison Company responded to the NRC request for information with the j submittal of a document entitled " Davis-Besse Course of Action" on Septem- _

ber 10, 1985. This document has been revised periodically in response to NRC requests for additional information and with additional supporting information as it has become available.

The Course of Action report describes (1) the programmatic actions Toledo Edf-l son Company has taken to improve its management structure, particularly with l respect to plant maintenance; (2) the results of investigations into the causes of malfunctions of equipment and the corrective actions to be taken; (3) other i

i j 01/28/86 2-2 DAVIS-BESSE RESTART SER SEC 2

procedural and system modifications and improvements made to minimize the possi-bility of a recurrence of a similar loss of feedwater; and (4) the results of a review of 33 systems important to safety to uncover problems that could poten-tially interfere with the ability of the systems to perform their intended functions and to identify the corrective actions necessary to remedy any problems, i

r M

01/28/86 2-3 DAVIS-BESSE RESTART SER SEC 2

I Document Name:

DAVIS-BESSE RESTART SER SEC 3 Requestor's ID:

LINDA-Author's Name:

DeAgazio/Harwell Document Comments:

1/28/86 KEEP THIS SHEET WITH DOCUMENT

-l I

e t

{

. l k

l i 1 J -

i J

l  :

l l

1 1

I

'l r

l ll l

j 3 EVALUATION OF TOLED0 EDISON COMPANY ACTIONS 3.1 Management and Programmatic Aspects l Over the past several years of operation at Davis-Besse, the staff has iden-tified deficiencies through enforcement actions, a Performance Appraisal Team I

(PAT) inspection, and Systematic Appraisal of Licensee Performance (SALP) eval-uations, as well as through more routine inspection and licensing contacts.

In late 1983, Toledo Edison Company, in response to a request from the NRC i

Region III Administrator, initiated the Performance Enhancement Program (PEP) to improve regulatory performance. Modifications to this program were made in response to the latest SALP (January 1984) and, before the event on June 9,1985, f Toledo Edison Company had initiated efforts to strengthen the organization and

) ensure improved performance.

, The Incident Investigation Team identified eighteen principal findings and con-clusions (NUREG-1154). Most of these findings and conclusions relate directly or indirectly to the weak performance of the nuclear mission management and to the overall quality maintenance and training--some of the same programmatic

{ aspects identified by the SALP, PAT, and other regulatory programs. Accord-I ingly, the August 14, 1985, letter requested Toledo Edison Company to address f ...the programmatic and management issues that have contributed to this event f and more generally to the recent performance of Davis-Besse." The specific areas of concern were as follows:

i j (1) adequacy of management practices including control of maintenance programs, e

use of operational experience, degree of engineering involvement, testing, root cause determination of equipment misoperation, licensed and non-i licensed operator training, and post-trip reviews (2) adequacy of maintenance program, including maintenance backlog, maintenance 4

procedures and training, vendor interface, and correction of identified deficiencies 4

01/29/86 3-1 DAVIS-BESSE RESTART SER SEC 3

(3) adequacy of the resources committed to the Davis-Besse facility for investi-gating of the event, resolutions of the findings and conclusions before

. restart, and implementation of longer term measures to improve overall performance (4) adequacy of procedures, equipment, and training for quickly and efficiently starting or restarting equipment for loss of feedwater mitigation i

(5) adequacy of programs to minimize the likelihood or inadvertent isolation

f am ta hoth steam generators (including training of the plant opera- "

{ tors and human rectors aspects of the SFRCS control room equipment) D I

~.

(6) adequacy of plant operating procedures including verification that plant

procedures involving " drastic" action are sufficiently precise and clear

! to ensure timely implementation

! (7) adequacy of Toledo Edison Company's procedures and training for reporting events to the NRC Operations Center -

I 3.1.1 Management Restructuring J

i Toledo Edison Company has restructured the organization that has responsibility for the Davis-Besse Nuclear Power Station. This organization is called the Nuclear Mission. The Nuclear Mission is under the direction of the Senior Vice President-Nuclear, who previously reported to the Chairman and Chief l Executive Officer of Toledo Edison Company. However, a subsequent change that

j. -became effective on January 1, 1986, has the Senior Vice President-Nuclear re- -

t j porting to the President and Chief Operating Officer of Toledo Edison Company.

f A proposed merger of Toledo Edison Company and Cleveland Electric Illuminating

! Company, when effected, will alter the organization with respect to the chain

,! of authority through which the Senior Vice President-Nuclear reports and finan-cial resources are allocated. The merger, however, will not alter the organiza-tional structure below the Senior Vice President-Nuclear.

01/29/86 3-2 DAVIS-BESSE RESTART SER SEC 3 1

.- _ _ . _ _ . -. _ _ _ . _ -_ _ _ _ _ _ . _ . . _ _ - - , _ _ _ _ _ . . _, . . _ _ _ , . - , . . _ , . , _ . ~

Toledo Edison Company has retained the services of Mr. J. Williams, Jr. , as Senior Vice President-Nuclear effective July 1, 1985. Mr. Williams is a .re-tired Vice Admiral who served 37 years in the Navy. He has commanded two I i nuclear powered submarines and held the position of Commander of the U.S. Sub-

, marine Force Atlantic Fleet. After leaving the Navy, he became Director of l Nuclear Construction and Testing for the Electric Boat Division of General

, Dynamics Company. Before joining Toledo Edison Company, Mr. Willias served as Senior Vice President-Nuclear Operations for Cincinnati Gas and Electric Com-

, pany during 1983 and 1984.

Six functional organizations of the Nuclear Mission report directly to I the Senior Vice President. These are Nuclear Projects, Nuclear Engineering, Nuclear Training, Nuclear Safety and Licensing, Quality Assurance, and the j Plant Manager. In addition, an Assistant Vice President, who is responsible j for providing support services, nuclear fael, emergency preparedness, environ-l t

mental monitoring, and information services, reports to the Senior Vice j President-Nuclear. This management structure is shown in Figure 3.1.

}

} The Nuclear Projects Division manages the facility modification effort by l assisting in planning and scheduling as well as implementing modifications to

{ the nuclear facilities, and provides contract administration services for the l Nuclear Mission.

j The Nuclear Safety and Licensing Division provides regulatory management and independently reviews Davis-Besse activities of other Nuclear Mission Divisions that could affect nuclear safety, i

The Nuclear Training Division provides training to station personnel. This includes the training of licensed and nonlicensed operators and maintenance

, personnel for the Davis-Besse station. Toledo Edison Company has expanded the  !

training staff for Davis-Besse and is constructing an expanded training facility. l The licensee also has contracted for a plant-specific simulator.

i The Quality Assurance Division develops and implements a quality assurance pro-gram for the Davis-Besse station. Additionally, it implements the station In-

! service Inspection Program. *

! 01/29/86 3-3 DAVIS-BESSE RESTART SER SEC 3

I 4

The Nuclear Engineering Group provides engineering support for operation, main-tenance, and facility changes, and for evaluation and resolution of regulatory, operation, and maintenance problems. The Nuclear Engineering Group has b'een expanded from a single division to four separate and expanded departments.

These are the Nuclear Facilities Engineering, Operations Engineering, Nuclear Plant Systems, and Engineering Service Departments.

The Operations Engineering Department provides direct day-to-day e.ngineering support to the Davis-Besse station. The former station Technical Section is included in the Operations Engineering Department. The Nuclear Facilities Engineering Department provides design engineering services to support addi-tions and modifications. The Nuclear Plant Systems Department provides systems i engineering support and services for problem resolution and for ensuring proper I

installation, operation, maintenance, and testing for optimum system perform-ance and reliability. The Nuclear Engineering Services Department provides engineering services in the areas of design document control, design drafting, configuration management, and engineering change control administration.

The organization under the Plant Manager has been reorganized. Those indi-viduals who report to the Plant Manager include a Chemistry and Health Physics Superintendent, Technical Support Manager, Assistant Plant Manager-Maintenance, Assistant Plant Manager-Operations, and a Planning Superintendent. The func-tions formerly performed by the Technical Support Section were transferred to the Operations Engineering Department of the Nuclear Engineering Division. The new Technical Support Section ensures compliance with applicable codes and regulations and provides a station review for design changes to ensure that they address station needs and concerns. o Toledo Edison has retained the services of Mr. L. Storz as Plant Manager.

Mr. Storz has worked since 1983 as Assistant Plant Manager at the Waterford Nuclear Steam Electric Station, Unit 3. Before that, he was Assistant Plant Manager, Operations, at the V.C. Summer Nuclear Station for 3 years. From 1972 to 1979, Mr. Storz held various positions at the Point Beach Nuclear Plant, including that of Superintendent of Operations. He has held senior reactor I

] operator licenses for the Point Beach and Summer plants.

01/29/86 3-4 DAVIS-BESSE RESTART SER SEC 3 1

1 1

__v___ . _ . . _ __ __. __ _ . ._. _ .__ _ _

3 (4l 4

i The staffing for the Nuclear. Mission is being increased from 699 individuals

to approximately 930; most of these individuals will be located at the site.

The staff has reviewed the organizational structure and finds that it meets the

~

acceptance criteria of Section 13.1 of the Standard Review Plan (NUREG-0800).

)

l The Standard Review Plan (SRP) is used to establish minimum acceptable require-j ments for plants currently being licensed, but it is not a requirement for older, previously licensed plants such as Davis-Besse. However, because the SRP re- t quirements are met, the staff concludes that the revised Davis-Besse organiza- '

tion is acceptable. However, the staff recommends that Toledo Edison Company

consider the establishment of an Independent Safety Engineering Group at the l Davis-Besse station. This group, as described in Item I.B.1.2 of NUREG-0737 (Task Action Plan), would supply additional resources for the safe operation of Davis-Besse.

l 3.1.2 Maintenance The Incident Investigation Team (IIT) concluded in NUREG-1154 that the licensee's

)

lack of attention to detail in the care of plant equipment was the underlying '

cause of the loss both of main and auxiliary feedwater. The team also concluded j that the licensee has a history of performing troubleshooting, maintenance, and j testing of equipment, and of evaluating operating experience related to equip-I ment in a superficial manner and, as a result, the root cause of problems are j not always found and corrected.

i As a result of thekIIT[ conclusion and other past indications of poor mainten- x 1 ance practices, the staff identified a need to take a systematic look into the -

conduct of maintenance at Davis-Besse. A tool that could be of assistance in conducting this review was the approach used in the Maintenance and Surveillance e

! Program Plan (MSPP) being implemented by the Division of Human Factors Safety.

) One element of the MSPP consists of site visits to various plants to obtain s

4 information about maintenance practices that currently exist and to determine j maintenance program effectiveness. Consequently, during the week of Septem-l ber 16-20, 1985, the staff conducted a maintenance survey at Davis-Besse con-

! sistent with the MSPP previously used at two sites, i

l 01/29/86 3-5 DAVIS-BESSE RESTART SER SEC 3

l l

The purposes of the maintenance survey at Davis-Besse were ,

I (1) to obtain information regarding past maintenance practices consistent with the MSPP (2) to obtain information about changes affecting the conduct of maintenance that have been or will be implemented subsequent to the event on June 9, 1985 (3) to highlight any identified omissions or weaknesses in the maintenance program that have been or will be implemented after the event on June 9, 1985 The NRC team observed that weaknesses impeding the conduct of maintenance had existed in the following areas:

(1) corporate commitment (2) spare parts / material readiness (3) supervision (4) preventive maintenance (5) maintenance backlog (6) maintenance procedures (7) communications (8) defined responsibilities (9) training Subsequent to the event on June 9, 1985, the licensee independently identified -

weaknesses in the maintenance program at Davis-Besse and undertook measures to rectify those weaknesses. The weaknesses and proposed corrective actions are described in the licensee's submittal dated September 10, 1985. These correc-tive measures were in the process of being implemented at the time the staff conducted the survey. The staff concluded from that survey that modifications to the maintenance program being implemented by the licensee are addressing these weaknesses; however, because the modifications were in the early stages of development, the staff found that it was too early to judge the effective-ness of the modifications, although the initiatives by the licensee to improve 01/29/86 3-6 DAVIS-BESSE RESTART SER SEC 3

i l l

l l l l

4 the conduct and control of maintenance appear to be appropriate based on field '

4 observations provided by Region III. Full implementation of the licensee's program has not been achieved. However, certain aspects of the program have

! led to improvements. For example, spare parts availability and material control

has shown marked improvement, maintenance staff accountability for assigned activities has been appropriately defined, and management personnel have a j greater sense of personal responsibility for accomplishing assigned tasks. The j staff recommended that the ability of the new maintenance organization to func-tion as designed be demonstrated before restart and that another survey be con-t ducted after the changes had been in effect for a reasonable period of time.

{ However, the staff requested the licensee to identify clearly the actions and associated subtasks to be completed before restart and the long-term activities

to be completed after restart. The licensee was requested to provide estimated

completion dates for all long-term subtasks.

I j The licensee provided additional information to update the schedule as well as l

clarify and delineate actions previously identified. The submittal also addressed the implementation schedule and the preventive maintenance program.

The licensee provided further information regarding the improvement of manage-ment practices, which include position descriptions and details of a Configura-

tion Management Program, and maintenance personnel were trained on the require-I ments of their position.

The Assistant Plant Manager of Maintenance has developed a procedure entitled l " Conduct of Maintenance" to formally establish management policies concerning I duties and responsibilities of all Maintenance Department personnel and to --

! give guidance regarding Maintenance Department goals and objectives.

i

! As of mid-November 1985, all new positions, except for three in the area of J

, mechanical maintenance, had been filled. The goal was to have all Maintenance Department staff positions filled by January 1,1986.

L l The licensee intends to revise Maintenance Department administrative procedures in conjunction with other station administrative procedures. The licensee has estimated the revisions will be completed by February 28, 1986. Administrative i

I 01/29/86 3-7 DAVIS-BESSE RESTART SER SEC 3 i

-- .-m-.- , . . , , _ . , , _ . , , , , _ . - - _ , , _ _ . _ . , , , , . . , _ _ _ , . . - , , . _ , ~ , , . _ _ _ , _ _ , , . - . _-- -

_ - . ~ . _ _ - , , _ _ , - - , -

1 procedures crucial to the implementation of new programs, or improvement of existing programs, are to be completed before startup.

4

] The licensee's plan to improve the preventive maintenance program ' includes l (1) implementing the administrative controls of the preventive maintenance pro-j gram, (2) upgrading equipment quality and reliability, and (3) reducing the preventive maintenance backlog. The controlling procedure for preventive main-tenance is being implemented.

The licensee has stated that all maintenance work orders (MW0s) that may affect j plant performance will be completed before restart or scheduled for completion I

commensurate with their significance. The licensee's summary of MWO status is

! given in Table 3.1.

1 Approximately 150 work orders have been completed per week. At this completion rate, the number remaining as of November 7, 1985, would represent an 18-week backlog. However, the Systems Review and Test Program along with other plant

readiness efforts are resulting in the generation of new work orders at a rate i nearly equal to the completion rate.

l In the area of spare parts and materials management, the licensee has completed the inventory of parts in the warehouse. A computerized material management system is scheduled to be fully operational by July 1, 1987. Before restart,

- the licensee intends to have a program for identifying and ordering spare and

repair parts. Parts reviews for 33 systems identified in the Course of Action f

4 are currently under way and are scheduled for completion by December 31, 1986.

A new procedure to provide identification, formal approval for procurement, and -

l specific instructions for control and usage of all consumable materials is to l be implemented by February 1, 1986.

i I

The licensee intends to complete the construction of the new maintenance facil-l fty by November 1986. Construction is currently progressing on schedule.

1 Because the staff was unable to judge the effectiveness of the modifications, I a followup site survey will be conducted before restart. The survey is scheduled to be conducted in mid-February 1986.

l 01/29/86 3-8 DAVIS-BESSE RESTART SER SEC 3 i

1 i

1 During the survey, the staff will specifically examine the changes implemented by the licensee that address the weaknesses perceived by the staff to have existed before the event on June 9, 1985. The staff will determine the degree of implementation of these programs and review schedules for completion.

During the followup site survey, the staff will attempt to verify that progress 4

is being made in the licensee's maintenance improvement program. Of particular l interest to the team will be the disposition of MW0s for systems that are j important to safety. The licensee has not identified to the staff which MW0s l will be outstanding at restart.- The licensee has prioritized MW0s on systems

! important to safety as to whether or not they are required to be completed be-

! fore restart. The licensee has stated that the following criteria are applied

! to determine which MW0s are to be completed before restart:

1 l (1) required for restart from the System Review and Test Program (SRTP) (refer to Section~3.4 for a description of the SRTP)

(2) required by the Action Plans for the event on June 9, 1985

. (3) required to ensure the operability of the systems reviewed by the SRTP l

l (4) necessary to ensure containment integrity i

i j (5) necessary for safe operation of systems required for plant operation

MW0s that do not meet the above criteria fall into the category of "not re-l quired for restart," although some MW0s in this category will receive considera- -

tion for completion before restart. The staff will audit this prioritization i

j process to judge if the backlog of MW0s is acceptable.

l

] 3.1.3 Procedures and Training

)

The Incident Investigation Team found that the operators, licensed and non-1 j licensed, performed well during the event to restore decay heat removal, sta-bilize the plant, and bring the plant to a safe condition without any major j damage to equipment or release of radioactivity. The operators were found to i

! 01/29/86 3-9 DAVIS-BESSE RESTART SER SEC 3 I , .-_ _ - - , - _ _ - _ .-_--- . ..-.-_- - -_ _ - -

i I

1 have performed well as a. coordinated group and provided timely corrective ac-tions from outside the control room. These actions, which prevented a potentially l more serious event, indicate that the operators generally were aware of plant j conditions and responded to them in a deliberate manner. However, this note-j worthy performance was not without problems. Operator errors occurred, proce-l dures were not strictly complied with, and man-machine interface considerations I were revealed.

The licensee has reviewed the operational significance of the event. The follow-ing sections present the staff's evaluation of the licensee's actions taken  ;

relative to operating procedures and training.

j 3.1.3.1 Plant Operating and Emergency Procedures '

i

! Premature Actions To Control Steam Header Pressure on Reactor Trip I

l At Davis-Besse, it has been routine practice by some operators to reduce the I steam header pressure after a reactor trip to reduce the likelihood of challenges l to steam side safety valves. This practice has developed because of a history I

of safety valves sticking open. Premature reduction in steam system pressure j can result in excessive reactor coolant system " shrink" and reduction of pres-

! surizer level. Toledo Edison Company stated that it will provide additional l training for its operators before startup from the current outage to discourage premature steam system pressure reduction. The training will cover calculations j of the effects of premature steam side pressure reduction on the reactor coolant j system. The training also will reinforce the necessity to take specific correc-f tive action if a safety valve is malfunctioning. -

The licensee has stated that manual reduction of steam header pressure after

.l reactor trip is called for only when there has been an equipment malfunction such as a stuck-open steam system safety valve, and that the existing proce-i dures provide for the identification and mitigation of these malfunctions. The

. licensee has cited actions taken to improve the steam system safety valves and i thereby increase operator confidence in their reliability. Although operator i

concern for avoiding safety valve challenges would seem valid because of pre-I vious valve performance, the licensee has justified the acceptability of the 1

01/29/86 3-10 DAVIS-BESSE RESTART SER SEC 3 i

l 4

Davis-Besse design and procedures so that manual steam header pressure control should not be needed to avoid delayed reseating of the valves. In addition, pro-cedures are available to address malfunctions. On the basis of its judgment that a reasonable balance is being achieved by the Ifcensee, the staff finds the present procedures acceptable.

Recognition of Steam Generator Dryout Conditions During the event on June 9, 1985, plant conditions were reached for which emer-gency procedures required taking actions to mitigate a lack of heat transfer and initiation of makeup /high-pressure injection (MU/HPI) cooling; however, these actions were not taken. At the time the conditions occurred, the personnel re-sponsible for reading and directing emergency procedures were distracted from that task by other tasks required to be performed from outside the control room.

This delayed recognition of plant conditions. In addition, control room instru-mentation needed to apply the decision criteria specified in the guidelines to determine steam generator dryout were not adequate.

The licensee stated that the emergency procedure will be modified to include specific criteria to indicate lack of heat transfer, requiring the initiation of MU/HPI cooling. These criteria are a hot-leg temperature greater than or equal to 600 F when there is reactor coolant system flow or a core exit thermo-couple temperature equal to or greater than 600'F in the event of no flow. The bases for this change are Babcock & Wilcox (B&W) loss-of-feedwater analyses l

that indicate that if feed and bleed is initiated within 20 min after reactor trip that is approximately 17 min after experiencing 600 F, the core will not be uncovered. The B&W analyses indicate that the 600 F criterion will not -

result in spurious initiation of MU/HPI. On the basis of these analyses, the staff finds the new criteria for initiation of MU/HPI cooling and the licensee's proposed program to ensure compliance with procedures acceptable.

Steam and Feedwater Rupture Control System i

A review of Emergency Procedure EP-1202.01, "RPS, SFAS, SFRCS Trip or Steam

, Generator Tube Rupture Emergency Procedure," that was used during the event on June 9,1985, uncovered an error in one of the tables in the procedure. This 01/29/86 3-11 DAVIS-BESSE RESTART SER SEC 3

4 i 4

l table is used by the operators to verify proper SFRCS response following a trip co.ndition. The table did not properly designate the steam generator drain valves and startup feedwater valves' positions under full trip conditions. The errors will be corrected in a revision to EP-1202.01 before restart. The staff finds f this acceptable.

i In addition, the staff is reviewing the licensee's procedures generation pack-

age that describes the program for upgrading the emergency operating proce-dures in accordance with the requirements of Generic Letter 82-33, " Require-l ments for Emergency Response Capability (Supplement I to NUREG-0737)." The 3 verification and validation of the emergency operating procedures and changes thereto, as described in the procedure generation package, should provide assurance that this sort of error will not be repeated.

l Adequacy of Control Room Instruments To Support Decision Steps in EP-1202.01 1

During the event on June 9, 1985, operators failed to recognize steam generator dryout conditions when they occurred. Although this is partly attributable to

)j the senior reactor operators leaving the control room to accomplish other neces-I sary tasks to regain feedwater flow and, thus, interrupting the reading of the

procedure in which dryout conditions are defined, it is questionable whether l the steam generator level stated in the procedures could be read with suffi-j cient accuracy using control room instrumentation to determine with precision when the dryout criterion had been reached. The licensee stated that EP-1202.01 .

and all abnormal procedures will be reviewed before restart with regard to the adequacy of existing control room instruments. If necessary, instruments will be color coded to denote important parameters to support significant actions of

! EP-1202.01 and other abnormal procedures.

The ifcensee concluded that instruments for recording steam generator pressure, 4

condensate flow, and steam generator level require finer graduation and that l labeling could be improved in some instances. The licensee indicated that the adequacy of instrument sensitivity was considered during the review and no deficiencies were discovered other than to apply feed and bleed initiation criteria. This staff concludes that the licensee's review with regard to j instrumentation adequacy to support EP-1202.01 is acceptable.

i

! 01/29/86 3-12 DAVIS-BESSE RESTART SER SEC 3 4

- , _ - _ _ _ , , _ _ _ _ _ _ _ _ - _ , _ _ - - _ _ _ _ _ , . , ,,,___.mm_. 4. _ _ , _ _ ..__,.m_,. , _,_,_.....--.,-m____.

Operation of AF-599/608 Not in System Procedures During the event on June 9,1985, the operators experienced difficulty reopening valves AF-599/608 that had failed to open automatically when the operator cor-rected the erroneous SFRCS low pressure manual actuation. They were not famil-iar with the circuitry and control logic for these valves, and gu'idance on the operation of these valves was not available in the appropriate system operating procedure, SP-1106.06. The licensee stated that it will add this guidance to SP-1106.06, including any modifications resulting from followup of the event.

The staff finds this acceptable. The licensee's measures to increase operator familiarity with the circuitry and control logic for AF-599/608 and the NRC staff's review of those measures are discussed in Section 3.1.4.7 of this SER.

Realignment of Auxiliary Feedpump Miniflow Recirculation Flowpath e During the event on June 9, 1985, a considerable amount of condansate storage tank inventory was lost via a minimum flow recirculation flow path to the floor drains. The loss of a large amount of water by this path would require a t'rans-fer of auxiliary feedwater suction to the service water system (a less preferred source because of water quality, but a safety grade supply). The licensee has added a step to the emergency procedure to realign the auxiliary feedwater re-circulation path to the condensate storage tank to conserve the preferred source.

The staff finds no safety implication with this modification and finds it acceptable.

Auxiliary Feedpump Suction Transfer to Service Water c

At Davis-Besse, low auxiliary feedpump suction pressure results in an automatic transfer of pump suction from the condensate storage tank (preferred source) to the service water system. No procedural guidance exists for transferring the suction source back to the condensate storage tank, if appropriate.

The licensee has stated that procedural changes will be made to provide spe-cific criteria for deciding if and when to transfer AFW pump suction back.to the condensate storage tank. The licensee stated that this transfer back to the condensate storage tank as a suction source does not involve disabling the 01/29/86 3-13 DAVIS-BESSE RESTART SER SEC 3

automatic transfer to service water. Therefore, since continued availability of auxiliary feedwater is therefore assured, the staff finds this acceptable.

Main Steam Isolation Valve (MSIV) Status During the event on June 9, 1985, operators did not recogniz'e the closure of the MSIVs until several minutes into the event. The licensee will add MSIV 4 status verification to the Supplementary Actions in the emargency procedure.

The staff finds this addition acceptable.

Manual Versus Automatic Safety System Actuation During the event on June 9, 1985, operators anticipated the automatic operation of the SFRCS and manually actuated the system. However, an operator error in actuating the system resulted in an incorrect system configuration and contribu-ted directly to subsequent events.

The licensee considered the desirability of anticipatory action to manually" initiate safety functions and concluded that it is neither desirable to preclude such anticipatory operator action nor to require the reactor operator (RO) to obtain specific permission from the control room senior reactor operator (SRO) before acting. However, the licensee did clarify control room protocol so.that when the SR0 is in the control room, the R0 will inform the SR0 of his intent to take anticipatory action. The SR0 may direct that the action not be taken.

The licensee has reinforced its simulator training program to reflect this policy.

The staff notes that the staff SER on the B&W generic guidelines (Generic Letter 83-31) on which Davis-Besse emergency procedures are based states that "since each (operator) error of importance will manifest itself as an abnormal system or plant response and will be treated accordingly, operator error is adequately covered." Hence, Davis-Besse guidelines already provide some measure of compen-sation for random operator error. The staff finds the licensee's measures acceptable.

01/29/86 3-14 DAVIS-BESSE RESTART SER SEC 3

Operator Performance of Significant Actions Following the event on June 9,1985, a concern arose at to whether plant procedures requiring significant action are sufficiently unambiguous to ensure timely im-plementation. The significant action of concern during the event was initiation of MU/HPI cooling. This mode of cooling is required on entry into the section of emergency procedures for treating lack of heat transfer. The licensee has indicated that the Operations Superintendent will stress to all plant operators that emergency procedures must be followed without question for situations in which the procedures prescribe specific immediate actions based on engineering analyses and/or procedure development techniques. However, the licensee also indicated that operators must rely on their training and judgment in plant operation and transient response, particularly where procedures do not dictate specific and/or immediate actions. In addition, the emergency procedures will be reviewed before restart to ensure clarity and explicitness where significant actions are required.

The staff finds that the above measures can ensure adherence to emergency pro-cedures and are acceptable.

3.1.3.2 Role of Shift Technical Advisor The licensee has changed the work schedule for shift technical advisors (STAS) so that the duty is now carried out in 12-hour shifts rather than 24-hour shifts.

The STA now spends the entire shift within t h protected area and has an office within 1 to 2 min walking distance of tM cc : tral room. The STA, by procedure, is required to respond to the contr'.1 v p < thin 10 min when called. The -

acministrative procedure that assigns the responsibilities and authority of the STA has been revised to instruct the STA to participate in each shift turnover with the shift supervisors. The STA will also be kept abreast of significant events that affect plant safety or performance.

For the long term, additional STAS are being trained so that on completion of their training there will be enough STAS to be assigned to operating shifts '

and to rotate on the same schedule as that shift. STAS will be SR0 licensed.

Training of these additional STAS will be completed by January 1, 1987.

01/29/86 3-15 -DAVIS-BESSE RESTART SER SEC 3 l.

The staff has reviewed the changes, both short and long term, and finds that they provide for increased awareness of plant status and increased STA avail-ability to the control room, meet Item I.A.1.1 of NUREG-0737, and, therefore, are acceptable.

3.1.3.3 Reporting of Events Guidance on reporting events to the NRC Operations Center was contained in sections of administrative procedure AD 1839.00, " Station Operations." This comprehensive procedure contained the administrative controls established for the various duties of the onshift crew.

Regarding notifications associated with Emergency Plan activations, the proce-dure correctly stated that the NRC Operations Center was to be called following the initial notification of local governmental authorities, but not later than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after any emergency declaration. The procedure also stated that, al-though the shift supervisor was responsible for making initial incident reports, the shift supervisor has the prerogative of selecting a knowledgeable person to maintain an open line with the Operations Center until released by NRC person-nel. The procedure indicated that-all conversations with persons in the Opera-tions Center would probably be recorded by the NRC and that the shift supervisor need only record in the unit log the fact that the NRC had been contacted.

Since the event on June 9, 1985, the licensee has initiated actions to refine procedural guidance on contacting the NRC Operations Center. The licensee concluded that, in conversations.with the NRC on the early morning of June 9, the STA did not adequately convey specific plant conditions, the reason for the -

notification, and the severity of the transient. The licensee also concluded that onshift personnel were not sufficiently prepared to answer the NRC duty officer's specific questions. The licensee determined that the procedural guidance on providing information to the NRC was inadequate. Consequently, the licensee revised procedure AD 1839.00 to ensure that onshift personnel will be prepared to anticipate the NRC's information needs and questions. The licensee has committed to complete training of all licensed personnel and STAS on the revised procedure before restart. The staff considers the licensee's correc-tive action and schedule acceptable.

01/29/86 3-16 DAVIS-BESSE RESTART SER SEC 3

t j A Severity Level IV Notice of Violation was issued to the licensee because the State of Ohio's Disaster Services Agency (DSA) was not notified of the Unusual j Event on June 9, 1985, until after it had been terminated, or at least 6-hours after it had been declared. As stated in Inspection Report No. 50-346/85023(DRSS),  ;

the licensee had already completed corrective measures designed to ensure prompt notification of state and county officials of any Emergency Plan activation.

! On June 9, 1985, the licensee's emergency implementing (EI-series) procedures, referenced in Procedure AD 1839.00, required its personnel to contact Ottawa County Sheriff's dispatcher, who is on duty 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day, within 15 min of any emergency declaration. The dispatcher was procedurally required to contact-the Ohio DSA, as well as various local officials. However, the dispatcher's procedure was flawed in that it contained different guidance on how to notify state officials, dependent on which of the four emergency classes had been declared. For any Unusual Event declaration, the dispatcher was to contact a local representative (Resident Radiological Analyst) of the Ohio DSA who, in turn, would contact the agency's 24-hour duty officer in Columbus, Ohio. For any of the other three emergency classifications, the dispatcher was procedur-l ally required to contact the Ohio DSA's duty officer, who would then notify the agency's local analyst.

In mid-June 1985, the licensee revised relevant EI-series procedures to require that its personnel notify both the County Sheriff's dispatcher and the Ohio DSA's

24-hour duty officer following any emergency declaration at the Davis-Besse station. These revisions were made at the request of the Governor of Ohio. In July 1985, representatives of the Ohio and Ottawa County DSAs informed.the staff that the dispatcher's procedures would be revised so that the dispatcher would

] call the state's 24-hour duty officer also after any emergency declaration-at Davis-Besse. These measures should prevent occurrence of a failure to promptly

notify state and county officials of any Emergency Plan activation.

3.1.3.4 Security J

During the event on June 9, 1985, operations personnel were dispatched to >

4 several locations within the plant to reset, recover, and locally operate equip-ment. In getting to and operating the equipment, personnel had to pass through j 01/29/86- 3-17 DAVIS-BESSE RESTART SER SEC 3

security doors controlled by key card access systems, pass through a locked hatchway, and operate locked valves. Although all doors and locks were opened, there is concern for the potential of not being able to operate necessary equipment because of access problems.

Availability of Keys During the event, the shift supervisor had to leave the control room to obtain keys. The licensee has installed an emergency key locker in the control room panel area containing keys necessary for emergency operations. The staff con-siders this an adequate resolution to the problem of availability of keys pro-vided the locker is not itself inaccessible because of a lock for which the key is not held by the operating crew.

Locked Valves Numerous valves throughout the piant are locked in their desired position by chains and padlocks and their operation is under administrative control. This system was implemented to fulfill a TMI Action Plan commitment to prevent unauthorized operations that could render necessary systems unavailable. The event on June 9, 1985, caused the licensee to recognize the need to balance security requirements against the possibility that the valves may have to be manually repositioned quickly in emergency situations. The licensee has pro-posed to improve the availability of locked-valve keys for emergency use. Each of the four plant zone operators will be provided with an emergency-use-only key ring that contains a locked-valve key. The key ring will be turned over to the oncoming operator as part of the shift relief. The staff finds this pro- "

posal an acceptable balancing of the conflicting needs. 1 Security Door Access to Vital Areas

Vital areas within the plant are secured using a key card system controlled by a central security computer. Because of problems with access experienced in the past and the concern for quick access during emergencies, the if censee has eval-uated several alternatives and implemented a system to address the balancing of these concerns. Evaluation of this item has been addressed in accordance with 01/29/86 3-18 OAVIS-BESSE RESTART SER SEC 3

applicable safeguards procedures. The licensee's system was determined to be acceptable.

l 3.1.3.5 Training i Absence of SR0s from the Control Room During Emergency Procedure Use For a period during the event, both SR0s left the control room to perform necessary activities elsewhere in the plant. This interrupted the reading of emergency procedure EP-1202.01 leading to a delay in deciding the course of action.

The licensee has revised procedures to require that once actions required by EP-1202.01 have begun and the SRO has assumed the duties of procedure director, that SR0 will remain in the control room until relieved by another SRO. To ensure adherence to these requirements, Administrative Procedure AD 1839.00, which governs the conduct of shift operations, will be revised to reflect this requirement before restart. To ensure-SR0 awareness of this requirement, train-ing will be conducted on this revision before startup. In addition, this requirement will be covered by the biennial Licensed Operator Requalification Program.

The staff concludes that the revised procedure and training should ensure SR0 awareness of and adherence to the requirements. By regulation 10 CFR 50.54(m)

(2)(iii), an SRO must be present in the control room at all times other than when the reactor is in cold shutdown or refueling. The licensee has been advised by the NRC (letter from J. Stolz to R. Crouse, dated June 14, 1984) o that this requirement is met if there is an SR0 in the control room the majority of the time and whenever his presence is not required by duties elsewhere in

, the plant. Therefore, even though there was no SR0 in the control room for a short period during the event, the provisions of 10 CFR 50.54(m)(2)(iii) were not violated.

i Role of Interim Emergency Duty Officer Whenever emergency situations exist, the shift supervisor must assume the responsibilities of the emergency duty officer (EDO). During the event on 01/29/86 3-19 DAVIS-BESSE RESTART SER SEC 3

June 9, 1985, the shift supervisor became overburdened and had to prioritize his duties consistent with guidance and training provided in the Emergency Plan. The licensee has revised its training program for STAS to prepare them to assume the role of ED0 during the time that the shift supervisor is unavail-able. This will assist the shift supervisor, who maintains ultimate responsi-bility. The appropriate EI 1300 series Emergency Plan Implementing Procedures have been modified to indicate this responsibility. The licensee has provided training to the STAS that included the delegation procedure. This training emphasized the necessity for the STA to remain aware of plant conditions as they pertain to emergency action levels so that the interim E00 duties can be assumed when delegated by the shift supervisor. The Nuclear Training Division #

will educate shift supervisors and assistant shift supervisors on this process through normal licensed operator training on procedure revisions. The staff concludes that the procedures and training will ensure understanding of the delegation process and the role of the STA when serving as EDO.

Other Infrequent, Difficult, or Critical Operator Actions ,

I In performing the actions required during the event on June 9, 1985, the opera- [

tors experienced some difficulties. As part of the training systematic develop-ment (TSD) process, Toledo Edison has conducted a job analysis to identify those ,

critical and difficult tasks that require additional training. In conjunction  ;

with these task lists, the Operations Department conducted a review of EP-1202.01 and all abnormal procedures. The licensee has provided a description of how tasks were identified for additional training as well as a summary of the re-sults of the review. If further review verifies the tasks are appropriate, they will be incorporated into restart training. Classroom training will include -

complete review of selected abnormal procedures. On-the-job training will be i provided for tasks for which training in the job setting is best.

Conducting a job analysis to generate task lists for training on and reviewing of abnormal procedures can ensure the appropriate training for infrequent, dif-ficult, and critical tasks. The programs, however, are not yet completely de-veloped. When completed, the training program descriptions should be submitted to the NRC for review.

01/29/86 3-20 DAVIS-BESSE RESTART SER SEC 3

Lack of Complete Understandina of the Loss-of-Feedwater-Event Analyses ,

Interviews with operators following the event on June 9, 1985, revealed ques-tions regarding the understanding of the loss-of-feedwater-event analyses, l particularly with regard to assumed specific timeframes and equipment configura-l tions. All licensee operators will receive training relative to the results  ;

l of specific loss-of-feedwater analyses and revised procedures relating to lack I of heat transfer before startup. The licensee states that the training program being developed will ensure that all licensed and nonlicensed operators under-stand the loss-of-feedwater-event analysis. The program will include at least the following:

(1) A comparison of the event on June 9, 1985, with the analysis, assuming l feedwater was not restarted and operator action to commence feed-and-bleed cooling began at 30 min.

j (2) A discussion of nine cases of a complete loss-of-feedwater transient at

! 102% full power. These cases will consider different combinations of operator action times, relief capacities, and equipment availability.

(3) A discussion of the engineering basis for MU/HPI cooling. This discussion ,

will include parameter selection criteria, setpoint criteria, and plant j responses consideration to determine when MU/HPI cooling should be initiated.

l The assumptions used in the analysis, the specific results of the analysis, and how the assumptions and specific results of the analysis relate to EP-1202.01 -

will be included in the discussions. Revisions made to EP-1202.01 resulting l from the loss-of-feedwater analysis will be incorporated into this training 1

, program.

4 A written examination will be taken by all licensed individuals and shift tech-nical advisors to ensure a complete understanding of the loss of-feedwater f-analysis and the relationship of this analysis to EP-1202.01. The staff con-1 cludes that the training program described by the licensee is adequate and i

\

l 01/29/86 3-21 DAVIS-BESSE RESTART SER SEC 3 i l

. . _ _ . ., , -.,..y.- _ . , ,_m , . .,m. .,.,.w. .- my. . , - . - , m , _ _ . . . . -,_ - - - . , . -y .,m,

should ensure that operators will acquire satisfactory understanding of loss-of-feedwater-event analyses.

l Performance of Manual Pressure-Temperature Plotting When Safety Parameter i

Display System Is Not Functioning l

During the event on June 9, 1985, with the safety parameter display system (SPDS) out of service, the operators did not manually plot reactor coolant sys-tem pressure and temperature as they were trained to do. To facilitate manual pressure-temperature (P-T) plotting, when appropriate, the licensee has stated that the following actions have been taken:

(1) During the 1985 annual simulator requalification training, at least 1 of the 5 days of training was conducted with an inoperable SPDS. It was observed that operators performed manual P-T plotting during appropriate transients. This will be a requirement in all future annual simulator requalification training.

(2) A plastic-covered P-T graph and writing device has been provided on the operator console in the control room to be used if the SPDS is unavailable.

The staff finds these actions acceptable.

Resetting of Auxiliary Feedpump Turbine Trip Throttle Valve Because operators were not familiar with. resetting the overspeed trip mechanism, they experienced difficulty restarting and controlling the auxiliary feedwater -

turbines after overspeed trips during the event on June 9, 1985. The licensee now requires hands-on training for all plant operators and licensed personnel

, on resetting the trip throttle valve and turbine overspeed mechanism from a i

tripped condition during a simulated accident. The staff finds that this mea-sure addresses the specific problem and is acceptable.

4 i

AF-599/608, Auxiliary Feedwater Containment Isolation Valves' Operating Logic I

During the event on June 9, 1985, operators experienced difficulty reopening valves AF-599 and -608 from the control room. Operator actions reflected some l 01/29/86 3-22 DAVIS-BESSE RESTART SER SEC 3

Y i

i confusion about the circuitry and control room switches for these valves. The '

licensee will train all operators on the functioning of these valves, including any physical modifications that may result from followup of the event. The staff finds this measure appropriate and acceptable provided the tr:ining includes testing on all aspects of these valve functions.

Improper Manual Steam and Feedwater Rupture Control System Actuation The principal cause for loss of feedwater during the event on June 9, 1985, was improper manual actuation of the steam and feedwater rupture control system (SFRCS). The licensee stated that it will train, before startup from the current outage, all licensed personnel on proper actuation of the SFRCS for all combinations of actuations, including any changes made to the SFRCS as a result of followup of the event. Training will include simulator exercises and will identify potential negative consequences of improper actuation. The staff finds this training acceptable.

3.1. 4 Operating Experience Feedback and Post-Trip Review The licensee's program for the feedback of operating experience is currently described in Section 6 of Administrative Procedure AD 1839.04, Shift Technical Advisor, under the title of Operating Experience Assessment Program. The STA receives information on in-house LERs and Davis-Besse Transient Assessment Pro-gram (TAP), and from external sources such as other B&W TAP Reports, INP0 Sig-nificant Operating Event Reports, Nuclear Network Reports, and NRC IE Bulletins, Circulars, and Information Nptices. Significant information is sent to appro-priate section or department heads and the Training Manager for inclusion into o training programs. Important items are sent to the Station Commitment Tracking Clerk. The licensee's Quality Assurance Section periodically audits the STA Operating Experience Assessment Program Duties.

The staff finds this program meets the acceptance criteria for the feedback of operating experience of SRP Section 13.5.1.

1 01/29/86 3-23 DAVIS-BESSE RESTART SER SEC 3

l The licensee reviewed its management practices for post-trip reviews in re-sponse to Generic Letter 83-28, Item 1.1 (Post-Trip Review). The staff has reviewed (1) the licensee's criteria for determining the acceptability of re-start, (2) the chain of command for responsibilities for post-trip review and evaluation, (3) the methods and criteria for comparing the event information with known or expected plant behavior, and (4) the criteria 'for determining the need for an independent assessment of the event. The staff found these manage-ment practices acceptable.

3.2 Plant Review 3.2.1 Event-Specific Investigations On June 10, 1985, the day following the loss-of-feedwater event at Davis-Besse, the NRC Region III office issued a Confirmatory Action Letter indicating, among other things, that Toledo Edison Company was not to perform any activities on equipment that malfunctioned during the event until the fact finding team was able to review the proposed activities. The team met with Toledo Edison Company representatives to ensure agreement on which equipment should be placed on the

" freeze list" (Table 3.2) and to establish a plan of action for determining the fundamental causes for equipment malfunctions. The licensee set about develop-ing troubleshooting plans to ensure that these activities would be conducted in a controlled, systematic manner and to ensure that adequate records of the as-found condition of the equipment were maintained.

General guidelines to follow in conducting investigations into the causes of failures of equipment were developed by the licensee; these guidelines are c contained in Appendix B of NUREG-1154. For each of the twelve items on the freeze list, the licensee has prepared a " Findings, Corrective Actions, and Generic Issues Report," which are included in the licensee's Course of Action report. In general, these reports present the results of troubleshooting on the equipment, a review of past problems with the equipment, hypotheses of possible failure causes and an evaluation of each hypothesized cause, and a i determination of the most likely cause for the failure experienced. When appropriate, any generic concerns with regard to other plant equipment were l l

01/29/86 3-24 DAVIS-BESSE RESTART SER SEC 3

l identified. Actions to correct the problems and prevent recurrence are also identified. This section presents the results of the staff's evaluation of the ifcensee's investigations relating to equipment that failed during the event.

The staff's conclusions with regard to the adequacy of the investigations and the appropriateness of corrective actions are discussed.

3.2.1.1 Auxiliary Fcedpump Turbt..> Overspeed and Control The staff has reviewed the licensee's findings, corrective actions, and generic

, implications report entitled "Overspeed Trips of the Auxiliary Feed Pump Tur-bines on June 9, 1985 at Toledo Edison's Davis-Besse Nuclear Power Station" concerning the problems associated with an overspeed trip of the two auxiliary feedpump turbines (AFPTs). The AFPT is a steam-driven turbine that drives the auxiliary feedwater pump. Both of the auxiliary feedwater pumps (AFPs), includ-ing the turbine and overspeed trip mechanism (OTM), are identical except for the model of the governors.

Each AFPT is fed from its respective steam generator (SG); that is, steam gen-erator No. 1 feeds AFPT No. 1 and steam generator No. 2 feeds AFPT No. 2. In addition, there is a cross connection so that each steam generator can feed the redundant AFPT; that is, steam generator No. 1 can feed AFPT No. 2 and steam generator No. 2 can feed AFPT No. 1. These cross-connected lines at the time of the event on June 9, 1985, were normally closed. During the event, a low level signal from steam generator No. 1 opened the steamline to AFPT No. 1.

When the operator tripped (5 sec later) both channels on low SG pressure, the normal steamlines were isolated and the cross-connected steamlines were opened.

The licensee has determined by analysis that a large quantity of condensate -

could have been formed when steam was admitted to the cold cross-connect lines.

The condensation in the steamlines formed water slugs at the AFPTs and could have caused the overspeed of the AFPTs.

The licensee has proposed three different scenarios to explain how this water l l slug could have caused the AFPT to trip on overspeed. In the first scenario, the water slug in the governor valve caused the valve to open too far in an attempt to maintain turbine speed. When the water cleared the valve, the valve admitted too much steam and the AFPT tripped on overspeed. In the second 01/29/86 3-25 DAVIS-BESSE RESTART SER SEC 3

scenario, the water flashed as it entered the turbine and thereby accelerated the turbine until it tripped because of the sudden expansion. The third scenario was hypothesized to be similar to the first scenario except the water slowed down the turbine and the governor valve opened to maintain speed. When the water cleared the turbine, the governor valve was open too far and the turbine tripped on overspeed. To support this hypothesis, the licensee also calculated the quantity of condensate that could be formed in the normal lines used to power the AFPTs. When compared, the quantity of condensate formed in the line from steam generator No. I to AFPT No. I was almost as much,as from steam generator No. 2 to AFPT No. 1. The ifcensee could not explain why AFPT No. I had never tripped on overspeed when fed from steam generator No. 1. In addition, the licensee has not determined how or why the condensate resulted in the overspeed tripping of the AFPTs. The identification of the root cause.was done hypothetically and the licensee does not propose to perform any verifica-tion tests.

The licensee has proposed maintaining all steamlines from the steam generators to the AFPTs at full pressure and temperature up to the turbine inlet isolation valves, which are approximately 10 ft from the turbines, by keeping open the cross-connect steamline isolation valves. The turbine inlet isolation valves are to be replaced with pneumatically operated control valves. Thus, on an initiation signal, the new valves will be required to open. The isolation valve from each steam generator to its respective AFPT would be normally closed and, therefore, would also be automatically opened. The failure to open the isolation valves will not prevent the AFPTs from getting steam because the cross-connect isolation valves are open. This valve lineup has been tested by the licensee using auxiliary steam, as indicated in a meeting on September 25 -

1985. The AFPTs can only achieve a speed of 3200 rpm using auxiliary steam and, therefore, no testing for overspeed conditions has been performed.

On the basis of its review of the licensee's findings, corrective actions, and generic implications report, the staff believes that the licensee has identified the most probable cause of the overspeed trips of the AFPTs and has taken the appropriate corrective action.

01/29/86 3-26 DAVIS-BESSE RESTART SER SEC 3

3.2.1.2 Auxiliary Feedpump Turbine Trip Throttle Valve The staff has reviewed the licensee's corrective actions and generic implemen-tations report entitled "AFPT Overspeed Trip Throttle Valve Problem" concerning the problems associated with resetting the trip throttle (T&T) valve during the June 9, 1985, event at Davis-Besse. The T&T valve is a steam admission valve to the Terry turbine that drives the AFW pump. Both of the AFW pumps, including the turbine, T&T valves, and overspeed trip mechanism (OTM), are identical at Davis-Besse. However, at the time of the event, the turbine governor systems were not alike.

The OTM consists of a spring-loaded poppet in the turbine casing. The poppet is struck by spring-loaded weights when the weights are pulled sufficiently away from the turbine shaft by centrifugal force. Once the poppet is struck, it moves away from the turbine shaft and releases the spring-loaded trip linkage.

The linkage releases the latch on the T&T valve, thereby allowing the spring in the T&T valve to close the valve. Resetting the AFPT overspeed trip involves manually moving the linkage, resetting the OTM, resetting the latch on the T&T valve, and re-engaging the valve operator to the valve internals. If the linkage is not moved far enough, the OTM will not reset and, if the T&T valve latches, the latch will hold only because of the friction between the parts of the linkage.

The problem, as identified in the licensee's report, involves three areas:

(1) improper procedures, (2) inadequate training, and (3) insufficient trip status indication at the AFW pumps. On the basis of its review of the li-censee's submittal, the staff finds that the licensee has adequately identified -

the root causes of the equipment operator's inability to reset the AFW pump after being tripped on overspeed. In general, NUREG-1154 indicates that the equipment operators performed their tasks associated with resetting the AFW pump trips as well as possible with the information and training available. It is the staff's opinion that if any one of the above areas had not been defi-cient, the equipment operators probably would have been successful in resetting the AFW pumps.

01/29/86 3-27 DAVIS-BESSE RESTART SER SEC 3

The licensee has proposed the following corrective actions:

(1) modify the appropriate procedures to reflect the proper reset sequence for the OTM (2) modify the testing procedures to ensure that the T&T valve and OTM are reset after testing (3) provide operator training on the theory of operation for the OTM and T&T valve (4) provide operator hands on training in the proper reset of the OTM and opening of the T&T valve with a minimum steam pressure of 800 psi (5) design and install local position indication of the OTMs ar.d position indication of the T&T valves (6) post near the T&T valves, simplified operating instructions (7) paint the yoke of the T&T valve, the latch-up lever, trip yoke, and con-necting rod (for both AFPTs) in yellow to distinguish this equipment as important in the operation of the overspeed trip (in addition, the manual trip level will be painted red)

(8) provide enhanced communication for the equipment operators between both pump rooms and with the operators in the control room o

All of these corrective actions are to be completed before restart, except for Item 4, which will be completed before leaving Mode 3. The licensee identified additional planned actions to correct discrepancies noted during the course of i their investigations. These actions include additional surveillance tests, preventive maintenance, and replacement of some components. '

On the basis of its review of the licensee's submittal, the staff believes that the licensee has identified the root causes of the operators' inability to reset l

01/29/86 3-28 DAVIS-BESSE RESTART SER SEC 3

1!

I j the AFPTs. On the basis of the identified root causes, the staff believes that j the licensee has proposed reasonable corrective actions.

3.2.1.3 Spurious Steam and Feedwater Rupture Control System Actuation and Spurious Main Steam Isolation Valve Closure l

The steam and feedwater rupture control system (SFRCS) at Davis-Besse is de-j signed as an engineered safety features system to monitor plant parameters

(steam generator level and pressure, differential pressure between the steam I line and main feedwater line for each steam generator, and the loss of all j four reactor coolant pumps), initiate auxiliary feedwater (AFW) flow, and isolate a ruptured steam generator and redirect AFW flow to the intact steam generator (s). Valves controlled by the SFRCS to isolate a ruptured steam l generator include the main steam isolation valves (MSIVs).

i j

l During the event on June 9, 1985, main feedwater (MFW) flow was lost as a result of a trip of the MFW pump No. I and spurious closure of both MSIVs resulting in j loss of steam to the MFW pump turbine No. 2. The NRC investigation conducted j following the event indicates that the operators believed that either a partial or full actuation of the SFRCS may have closed the MSIVs. However, the control j room annunciater panels did not indicate that an SFRCS actuation had occurred,

! and other equipment that normally would have responded to an SFRCS full trip l did not actuate. A review of the computer alarm l e after the event revealed l that an SFRCS actuation channel No. 2 full trip on steam ,'enerator low levei

) had occurred. The SFRCS actuation occurred immediately following a reactor j trip and turbine trip on high reactor coolant system pressure. At the time of j the SFRCS low level actuation, the water level in both steam generators was -

] above the SFRCS low level trip setpoint. The licensee has performed an analysis

] to determine the root causes for the spurious SFRCS actuation and MSIV closures.

j The SFRCS at Davis-Besse consists of two actuation channels. In general, actua-l tion channel No. 1 provides output signals to actuate equipment associated with i

j loop No. 1 (i.e., valves in lines associated with steam generator No. 1, AFWS j train No. 1, etc.), and, similarly, actuation channel No. 2 actuates equipment I associated with loop No. 2. Each actuation channel consists of two redundant i

l 01/29/86 3-29 DAVIS-BESSE RESTART SER SEC 3

l l

l 1, i

! logic channels, one of which is ac powered and the other de powered. Most SFRCS

{ actuated equipment requires both logic halves of its associated actuation channel to t"ip for the equipment to actuate. This is referred to as a full q trip. The trip of a single logic channel is referred to as a half trip. The

! MSIVs require full trips to isolate. However, unlike most SFRCS equipment, a

) trip of either actuation channel will close both MSIVs. The SFRCS uses a de-energize to actuate trip logic (i.e., a logic channel will trip on loss or failure of its power supply).

I 1

Eight Rosemount 1153 differential pressure (dp) transmitters are used to

! monitor steam generator level for the SFRCS. Each logic channel receives f inputs from two steam generator level instrument channels, one channel asso-ciated with each steam generator. For a given logic channel to trip, either of f its two associated instrument channels must sense that steam generator level is below the SFRCS low level setpoint.

P I

t Thus, both MSIVs will close on an SFRCS j low level trip by either actuation channel when each of its two logic channels senses low level in either steam generator.

i j The licensee's analysis to determine the root cause for the spurious SFRCS actuation and closure of the MSIVs included testing to determine SFRCS steam

generator level instrument channel response times, actuated equipment response j times, and actuation and reset times of the SFRCS trip alarms. The analysis also included visual inspections of SFRCS components, and tests to determine j whether electrical interconnections or interference existed between redundant j SFRCS logic circuits, or between the turbine trip circuits and the SFRCS.

Tests were also performed to determine whether the steam generator level trans-j mitters were in calibration. The results of this testing and an analysis of -:

l data available from the event on June 9, 1985, has led the licensee to the

following hypotheses for the root cause of the spurious SFRCS actuation and 1

l MSIV closures. -The licensee believes that pressure pulses in the main steam-i lines caused by rapid closure of the turbine stop valves (TSVs) induced oscilla-j tions in the steam generator level instrumentation that caused a momentary full l trip of SFRCS actuation channel No. 2 on low level, and that the full trip

} remained long enough to initiate MSIV closure, but automatically reset before

• i other SFRCS equipment could be actuated. The SFRCS does not include logic or 1

j 01/29/86 3-30 DAVIS-8 ESSE RESTART SER SEC 3 ,

i i

actuation channel seal in circuits that require manual reset to clear the pro-tective action signals and restore the SFRCS to its normal (non-trip) condition.

The licensee has reviewed data available from Davis-Besst and from other nuclear plants to determine the effects of sudden TSV closure on steam genera-tor level-sensing instrumentation. Data recorded during a pre-operational turbine trip test from 75% power at Davis-Besse show that oscillations occurred in the sensed / indicated steam generator level (by the startup range level trans-mitters that provide inputs to the SFRCS). The oscillations caused indicated levels to be 50 in. or more below the actual level immediately following tur-bine trip. The oscillations were of short duration, less than 200 milliseconds (msec), and the amplitude of the oscillations decreased significantly after several cycles. The licensee reviewed transient reports from three other nuclear plants that revealed oscillatory behavior in the level transmitter out-puts following reactor / turbine trips, apparently caused by pressure oscillations in the main steamlines caused by TSV closure. Bailey BY le.e1 transmitters were installed during the Davis-Besse turbine trip test. During the fourth (1984) refueling outage, these transmitters were replaced with'Rosemount 1153 transmitters. Because the Rosemount transmitters are considerably more respon-sive and sensitive than the Bailsy transmitters, the licensee believes that the-amplitude of the transmitter output oscillations would be greater than exhibited by the Bailey transmitters during the test. The licensee believes the oscilla-tions in the Rosemount 1153 transmitter outputs, caused by steamline pressure oscillations from TSV closure on turbine trip, were the root cause for the spurious SFRCS actuation during the event on June 9, 1985.

A review of Figures 3.2 and 3.3 of NUREG-1154 (plots of steam generator level -

as a function of time during the event) indicates that the transmitter output oscillations would have to be approximately 70 to 90 in, in amplitude, only slightly greater than the oscillations exhibited by the Bailey transmitters, to cause the spurious SFRCS low level actuation. An analysis performed for the ifcensee by MPR Associates has estimated that the apparent level swing shown by the Rosemount transmitters following turbine trip from 100% power could be several times greater than that shown by the Bailey transmitters. This.is caused by the increased sensitivity of the Rosemount transmitters and the 01/29/86 3-31 DAVIS-BESSE RESTART SER SEC 3

t) u change in the instrument sensing line hydraulic configuration required for installation of the Rosemount transmitters. It was estimated that the effects for the SFRCS actuation channel No. 2 would be more pronounced because of the level transmitter configuration. The licensee believes that the SFRCS full trip control room annunciator point did actuate at the time of the trip, but that, because the trip was present for only a short duration and because the j annunciator circuit does not seal in, the annunciator had returned to normal by l the time the operators looked to see if an SFRCS trip had occurred. On the i

basis of a review of the licensee's analysis, the staff concurs with the i licensee's determination of the root cause for the spurious SFRCS actuation.

The SFRCS equipment is actuated by several different types of components, in-cluding ac and de motor-operated valve starters, solenoid valves for air-operated valves, and solenoid valves for pneumatic pilot valves that are used to initiate MSIV closure. The Ifcensee has performed tests to determine the minimum time required for an SFRCS low level trip signals to exist to cause the

{ various types of SFRCS components to actuate. The test results show that the MSIVs have the fastest actuation times. MSIV closure will' occur 7.5 msec fol-lowing an SFRCS actuation signal. Air.-operated valves have the second fastest actuation time at 12.9 msec. The de motor starter actuated valves were slowest

to actuate at 66 msec following an SFRCS trip. On the basis of these component actuation times, the licensee has concluded that the root cause for the closure of the MSIVs during the event on June 9, 1985, was pressure oscillations in the main steamlines caused by rapid TSV closure. This caused multiple short-duration oscillations in the steam generator level instrumentation that, in turn, caused a momentary full trip of SFRCS actuation channel No. 2. The trip was of sufficient duration to close only the MSIVs. Because the SFRCS actuation -

signals do not seal in, the SFRCS low level signal automatically reset (cleared) as the level oscillations subsided and before other SFRCS equipment could actuate. The staff concludes that the licensee's determination of the root cause for the MSIV closures during the event on June 9,1985, appears to be valid.

The licensee has performed tests and analyses to determine the validity of other hypotheses for the spurious SFRCS actuation and MSIV closures. It was hypothesized that inadvertent interactions (cross-talk) between redundant SFRCS 01/29/86 3-32 DAVIS-BESSE RESTART SER SEC 3

4 I

logic channels may have caused a partial spurious SFRCS trip of the MSIVs and generated the computer alarms. The hypothesis has been discounted because one logic half of an SFRCS actuation channel is ac powered, the other half is de powered, and the power supplies are electrically independent (shared power j supply returns are not used). Additionally, the licensee has performed tests l verifying that there is no interference or cross-channeling between the main

] turbine trip circuits powered from non-Class IE supplies and the SFRCS circuits l powered from separate Class IE supplies. Another hypothesis proposed that

circuit malfunctions / anomalies resulting from the changeover to the Rosemount transmitters during the 1984 refueling outage caused the spurious SFRCS/MSIV actuations. This hypothesis has also been discounted because the integrated j

SFRCS test performed following the modifications verified proper operation of

, both the system logic and the SFRCS functions associated with low level in either steam generator. It was also hypothesized that the MSIV closures were caused by failures within the MSIV circuits independent of the SFRCS. The

licensee has discounted this hypothesis because testing performed on the MSIVs '

j subsequent to the event verified proper operation of the MSIV closure circuitry, i

] the MSIV solenoid valves, and the pneumatic-operated pilot valves. On the basis j of the preceding, the licensee has determined that oscillations'in the steam generator level instrumentation is the most likely root cause for the spurious SFRCS/MSIV actuations.

3 The planned corrective action to be implemented by the licensee before restart

) is to filter the induced oscillations in the steam generator level instrumenta-a tion following a turbine trip to avoid spurious actuation of SFRCS equipment.

! The licensee has estimated the frequency of the pressure disturbance caused by f TSV closure to be 1.25 Hertz (Hz). The licensee has determined that a filter ,

having a band pass from 0 Hz to 0.1 Hz (f.e., the transmitters will not respond i to oscillations with frequencies greater than 0.1 Hz) will provide the necessary j

filtering and still provide the system response necessary to meet the require-  !

ments of the Davis-Besse technical specifications. The licensee has stated that an adjustable filter exists on the amplifier boards in the steam generator j level transmitters. A new filter setting will be established to accomplish the necessary signal attenuation (filtering), and the transmitters will be tested l to ensure proper calibration and response time. This modification does not

! involve any SFCRS hardware or circuit modifications, and is considered sufficient 4

^

f 01/29/86 3-33 DAVIS-8 ESSE RESTART SER SEC 3

,,-..-...,--,~._..__..m . . _ , _ , _ . _ , , , _ _ . , _ _ _ . . _ _ , , . , , _y,. . . __m.,,..._,y~y -, ,. , ,,,,-. . _ _ _ . - _ . ,.,_..,_c_% . . , _ . ,

6 to prevent spurious SFRCS/MSIV actuations caused by system-induced oscillations in the steam generator level instrumentation from TSV closure. The staff j concludes that there is reasonable assurance that the licensee has successfully identified the root cause for the spurious SFRCS/MSIV actuations and has taken appropriate corrective action to prevent recurrence. Additional corrective actions to be taken by the licensee will be to develop surveillance procedures to periodically (quarterly) verify proper operation of the SFRCS logic channel power supplies, and provide a seal-in feature for the SFRCS full trip control l room annunciator point that requires the operator to acknowledge the full trip condition to clear (reset) the annunciator.

Before and during Mode 1 operation, the licensee will perform testing on the steam generator startup range level instrumentation supplying signals to the l SFRCS to determine the magnitude and frequency of hydraulic and/or electronic 1

noise as sensed by this instrumentation. This monitoring will remain in place I

until the adequacy of the corrective actions has been verified. The licensee is also performing tests, to be completed before entering Mode 1, that will determine the effects of the increased sensitivity of the Rosemount transmitters used to monitor reactor coolant system (RCS) flow. These transmitters provide inputs to the reactor protection system, and are the only other Rosemount 1153 transmitters used to provide control or trip functions at Davis-Besse. The licensee has concluded that, with the possible exception of the RCS flow trans-mitters, there are no generic implications from the spurious SFRCS/MSIV actua-j tions applicable to other systems at Davis-Besse. The short-duration oscillations that caused momentary actuation of the SFRCS should not cause similar responses in other systems because the SFRCS is the only safety-related j system using the Rosemount transmitters in which operator action is not -

required to reset the trip condition. The staff agrees that the root causes for the spurious SFRCS/MSIV actuations do not appear to have generic implica-tions for other systems at Davis-Besse.

1 On the basis of the results of the licensee's root cause analysis, the staff has concluded that there is reasonable assurance that the licensee has success-fully identified the root cause of the spurious SFRCS low level actuation and i

spurious closure of the HSIVs that occurred during the event on June.9,1985, and that the ifcensee has taken appropriate corrective actions to prevent its 01/29/86 3-34 DAVIS-BESSE RESTART SER SEC 3

recurrence. The staff will evaluate the results of the tests discussed above to be performed by the licensee before and during Mode 1 operation when the tests have been completed.

3.2.1.4 Main Feedpump Turbine and Control Failure The main feedpump turbine (MFPT) No.1, which was the initiating failure of the event on June 9,1985, is a steam-driven turbine that drives the feedwater pump.

Both main feedwater pumps (MFPs), including the turbine, speed control system, and overspeed trip mechanism (OTM) are identical.

The MFPT speed is controlled by an electronic-hydraulic control system consist-ing of the following subsystems:

(1) signal converter circuitry (2) speed pickup feedback circuitry (3) speed summation and valve lift reference circuitry (4) operator / pilot valve position feedback and servo amplifier circuitry The signal converter circuitry accepts a speed setpoint signal and produces a reference signal that corresponds to the demand feedwater flow requirement.

The speed pickup feedback circuitry provides the signal that corresponds to the speed of the MFPT. This signal is determined by automatic selection of one of two redundant signals. Each signal is generated by a pickup that monitors the passing of a toothed wheel mounted on the shaft of the MFPT.

The reference speed signal and the actual MFPT speed are summed and compared by -

the speed summation and valve lift reference circuitry. This circuitry produces a speed error signal and a valve lift reference signal. This reference signal is summed with the valve position feedback signals from the pilot valve and the operating cylinder by the operator / pilot valve position feedback and servo amplifier circuitry that produces a valve position error signal. This error signal drives the servo valve to change the position of the pilot valve and operating cylinder. Thus, the steam admission valve opens or closes to develop a zero error signal and thereby maintains the turbine speed at its predetermined value.

01/29/86 3-35 DAVIS-BESSE RESTART SER SEC 3

The problem, as identified in the licensee's report, is the result of the fail-ure of the frequency to voltage converter in the speed summation circuitry.

This failure, which resulted in a fixed output of 0.0 volts, has been attrib-uted by the licensee to a failed-open capacitor.

On the basis of its review of the licensee's findings report, the staff believes that the licensee has identified the root causes of the overspeed tripping of the MFPT. On the basis of the identified root causes, the staff believes that the licensee has proposed reasonable corrective actions.

3.2.1.5 Turbine Bypass Valve, SP 13A2, Actuator Failure The turbine bypass valves are part of the turbine bypass system and are used to control the flow of steam entering the condenser from the bypass header. Their purpose is to minimize loss of condensate to the atmosphere by directing steam I flow to the condenser. These valves themselves are not important to safety nor are safety related in terms of fulfilling their function in the plant.

The safety related or important-to-safety implications of this failure are as follows:

(1) The valve disk and stem were separated before the event for an unknown period of time. This indicates that planned maintenance and/or inspection was deficient. A waterhammer occurred in the piping upstream of the valve and, coupled with the impact from the loose disk on the valve stem, damaged the valve actuator. The valve was not operational before the event and the licensee's maintenance plan did not discover it. -

(2) The common drain and isolation valve was closed although it should have been open. This valve and its associated header serve the turbine bypass valves and are intended to drain condensate from the lines to help prevent a waterhammer event. The procedures have been revised to ensure that this I valve is open during normal operation for proper drainage of the turbine bypass valve header.

01/29/86 3-36 DAVIS-BESSE RESTART SER SEC 3

i (3) Steam traps are provided in the lines from the steam generators for the purpose of draining condensate from the lines to minimize a potential waterhammer. One steam trap was blocked with debris and thus improperly maintained. This indicates that planned maintenance and/or inspection procedures were deficient for these items. Revised procedures and improved preventive maintenance should prevent recurrence.

(4) There are missing loose parts in the system. The potential effects on safety-related or important-to-safety equipment or systems have been assessed by the licensee. It has been determined that there is no damage to safety-related equipment because the loose parts would either be re-tained in the sparger, through which the valves discharge, or would likely not be carried from the main condenser if the parts passed through the sparger.

(5) The cause of separation of the valve seat from the stem was the loss of a cotter pin locking device that allowed the connecting nut to back off.

The licensee has modified preventive maintenance procedures to require more inspections during the next two refueling outages to ensure proper valve assembly. Subsequent inspection periods will be determined based on the results of these inspections.

3.2.1.6 Power-Operated Relief Valve Malfunction During the Event on June 9, 1985 During the event on June 9,1985, the pressurizer power-operated relief valve (PORV) opened three times to relieve pressure. The third time the PORV opened, -

it did not reseat as it should have when power was removed from the actuating solenoid at the low pressure setpoint. By the time the operator closed the block valve, the pressure had dropped approximately 300 psi below this setpoint.

When the block valve was subsequently reopened, the PORV was found to be closed.

l The Davis-Besse PORV is a Crosby style HPV-SN pilot-operated valve with a solenoid actuator. The solenoid moves to open the pilot valve when electri-cally energized and returns to close the pilot valve when electrical power is 01/29/86 3-37 DAVIS-BESSE RESTART SER SEC 3

removed. The pilot valve, when open, provides a vent path to the main valve disk that is then opened by the inlet system pressure. The main valve disk should reseat when the pilot valve recloses to seal off this vent path.

The licensee conducted an investigation to determine the causes of the PORV failure. The PORV has been removed from the pressurizer, dismantled, and inspected. The PORV vendor, Crosby, also participated in the valve inspection and found several abnormalities:

(1) Three of eight inlet flange nuts are found loose.

(2) The adjusting bolt locking nut in the pilot valve linkage was found loose, and only a cotter pin was in place to operate the adjusting bolt.

(3) There was minor steam cutting on the pilot seat and disk.

(4) A brown substance, speculated by the licensee to be boric acid, was found on the valve body in the vicinity of the pilot valve.

(5) A sliver of metal from the bellows housing flexitallic gasket and a small gouge in the outside edge of the gasket surface were found.

Foreign material found in the pilot-sensing tube caused the pilot disk to leak during leak testing performed after the transient. The licensee indicates the material was a liquid lubricant and would not affect the ability of the valve to open and close.

The licensee has concluded that none of these abnormalities could have caused the failure on June 9, 1985. Several other failure modes have been hypothesized by the licensee, including *

(1) differential thermal expansion between the main disk and the valve body caused by nonuniform heating upon actuation (calculations by the licensee show that clearances are more than adequate to preclude this type of bind-ing action) 01/29/86 3-38 DAVIS-BESSE RESTART SER SEC 3

(2) other mechanical malfunctions, such as loose or misaligned internal parts (3) broken solenoid coil linkage (4) control system malfunction The ifcensee has determined that none of these failure modes is very ifkely, and has determined that a more probable failure mode is that of foreign mate-rial lodging in the pilot disk and seat.

The staff agrees that this could have been a probable cause of failure, espe-cially considering the long period of time during which foreign material could have collected since the last PORV actuation. Before the event on June 9, 1985, the licensee had not stroked the PORV since September 1, 1982. The valve is required to be stroked, according to the plant inservice testing (IST) program for pumps and valves, at each cold shutdown. Therefore, the licensee has not met the plant IST requirements for the PORV since September 1,1982.

The long period of time without actuation of the PORV may have contributed to the degradation of the valve operability and the lack of knowledge thereof.

Before the next restart, the ifcensee proposes to stroke the valve eight times at reduced pressure (nominally 700 psig) and three times at full pressure (nominally 2155 psig) during the plant restart to ensure that the valve is operable. Additionally, the licensee has proposed to stroke test the PORV at each shutdown to ensure its reliability during future plant operation.

The licensee's commitment to stroke test the PORV in accordance with the plant -

IST program requirements is acceptable to the staff. Further, the staff finds the ifcensee's proposed startup stroke testing to be acceptable for ensuring initial operability. Routine periodic testing during cold shutdown is likely to uncover problems with opening or closing the PORV. As required by Sec-tion XI of the ASME Code, the PORV must be repaired and retested if the valve fails a test.

The licensee is also investigating whether an alternative PORV design would be more appropriate. This could involve a future plant modification should such a 01/29/86 3-39 DAVIS-BESSE RESTART SER SEC 3

change be deemed necessary. Any PORV design that has not already been qualified by full flow testing as required by h0 REG-0737, Item II.D.1, must be so quali-fied. In addition, any changes to the plant PORV inlet and discharge piping configuration must also be analyzed as required by Item II.D.1.

Although the licensee has not been able to identify positively the cause of the PORV failure, the staff has concluded that the post event evaluation was thorough. This evaluation identified a number of valve installation def t-ciencies, degradation mechanisms, and IST deviations that together are clear evidence of at least a lax attitude before the event on the part of the licensee relative to PORV operability. The staff has concluded that the test-ing to be performed by the licensee, both during startup and inservice, com-plemented by the additional PORY investigative effort yet to be performed, should provide increased assurance of PORV operability for the Davis-Besse plant.

3. 2.1. 7 Motor-Operated Valve Operator Malfunctions (To be supplied]

3.2.1.8 Source Range Nuclear Instruments Source range nuclear instrument channel NI-1 (referred to also as channel No. 2) was inoperable before and throughout the June 9,1985, incident, in that it read full downscale (less than 10 1 counts /sec). During the event, when the neutron level, as indicated by the intermediate range nuclear channels, fell to a predetermined level, the source range nuclear channels were activated. How- c ever, the redundant NI-2 (referred to also as channel No.1) remained at less than 10 1 counts /sec rather than indicating about 10s counts /sec. This loss of both nuclear channels was an unnecessary problem that the reactor operator had to cope with in that he was required to verify shutdown margin requirements, which included initiating emergency boration.

Problems with this instrumentation have been chronic with some problems present since initial construction of the plant.

01/29/86 3-40 DAVIS-BESSE RESTART SER SEC 3 P

On the basis of a review of the licensee's Ffndings and Corrective Action Reports for NI-1 and NI-2, the staff has prepared Tables 3.3 and 3.4 to list the many anomalies that were discovered via the systematic troubleshooting plans for NI-1 and NI-2, respectively. The number of anomalies for NI-1 and for NI-2 constitute evidence of lack of proper maintenance of this nuclear safety related equipment. Furthermore, many of the anomalies originated from installation errors during the construction of the plant and went uncorrected for 8 years of plant operation.

This long list of ano.nalies is clearly sufficient to have caused the malfunc-tions related to the event on June 9, 1985. The staff notes that the lists have some general characteristics:

?

(1) A large number of the anomalies were related to the preamplifier assembly.

(2) A large number of the anomalies were related to triaxial connectors, both mounted on bulkhead and on cables.

(3) The NI-2 channel ccntainment penetration, which is generally considered i to be a relatively passive component and hence not as likely to fail as more active components, had serious anomalies (see Item 3 of Table 3.4).

These characteristics suggest that components that are either difficult to get to or not very likely to fail cannot be neglected. Further, the characteristics suggest a generalized problem with triaxial connectors. The staff notes that the licensee is addressing the generalized connector problem with improved procedures and training. -

The licensee identified the following root causes for the failures of NI-1 and NI-2, respectively.

NI-1 high resistance connections in the bulkhead connectors on the preamplifier, caused by mounting on painted surfaces (Item 2.3 of Table 3.3) s 01/29/86 / 3-41 DAVIS-BESSE RESTART SER SEC 3 s

l-s i

[

improper assembly of the triaxial connector at the detector interface j' (Item 1.1 of Table 3.3)

NI-2 high-resistance and intermittent connections related to the containment i penetration assembly (Items 3.1 and 3.4 of Table 3.4) f -

generalized poor condition of connectors, caused by improper assembly, j lack of proper cleaning, and poor maintenance (Item 5.2 of Table 3.4)

I '

The staff views these items as the licensee's determination of the most signifi-j cant of the anomalies discovered. In the staff's experience, a single factor  !

j is rarely the cause of problems in pulse-type nuclear instrumentation. Most i often many factors contribute to the problem in varying degrees of severity.

I Subsequent to corrective actions that have already been completed, the channels  :

l have been monitored continuously for substantial periods of time, with no  !

I further instances of problems. For NI-1 this period was 6 weeks, for NI-2, i f 8 weeks. On the basis of its review and field observations subsequent to l corrective actions, the staff concludes that there is reasonable assurance that I most, if not all, significant contributors have been identified.

1 i

The licensee's findings and corrective action report states that although most ,

! corrective actions will be completed before plant restart, certain corrective f actions are not major contributors to the problems and thus are planned to be I

1 completed after plant restart. The staff has reviewed the specific basis --

1 i i provided for these deferrals. In view of the substantial periods of proper j operation of the instrumentation channels without problems, the staff finds the t j defer n1 of additional corrective actions to be acceptable.

1 1

The staff concludes that the systematic and thorough troubleshooting for the source range nuclear instrumentation channels has revealed a substantial number l of causes. The most significant causes appear to be improper installation of triaxial connectors on the preamplifier (for NI-1), intermittent high-resistance 1

connections in a containment penetration assembly (for NI-2), and a generalized l

01/29/86 3-42 DAVIS-BESSE RESTART SER SEC 3

I t

poor condition of triaxial connectors. After reviewing the licensee's findings reports, thr staff' concludes that the significant contributors to the problems have now been identified and that the corrective actions have been effective in improving the performance of these instrumentation channels.

3.2.1.9 Main Steam Header Pressure

[To be supplied]

l 3.2.1.10 Startup Feedwater Valve, SP-7A 1

The staff has reviewed the licensee's findings and corrective actions report 3

I regarding the apparent failure of the startup feedwater valve, SP-7A, during

the event on June 9, 1985. The licensee states that the results of the tests and analysis indicate that (1) the failed SFRCS channel No. 4 indication for SP-7A resulted from a random or normal end-of-service-life indicating light bulb failure, and not from a system anomaly; (2) SP-7A was capable of providing

, a tight shutoff and responded in accordance with design during the June 9,

! 1985, transient; (3) the indicated flow through SP-7A resulted from out-of-

} , calibration and ambient temperature offacts on the flow transmitter; and (4) there were no significant findings regarding generic implications. The j reports do not include the raw event data and test data cited and the detailed design information necessary to enable the staff to independently verify the specific step-by-step results of the analysis and test program. However, on the basis of its review of the methodology employed and on the reported results of the program, the staff concludes that there is reasonable assurance that the conclusions reached in regard to the root cause and generic implications of the -

indicated malfunctions of valve SP-7A and its controls are valid, and provide an acceptable basis for the corrective actions taken with respect to valve SP-7A and its controls. -

3.2.1.11' Spurious Transfer of Auxiliary Feedwater Suction to Service Water I The staff has reviewed the fi.ndings, corrective actions, and generic implica-tions report concerning the spurious transfer of the auxiliary feedwater (AFW) 01/29/86 3-43 DAVI5-BESSE RESTART SER SEC 3

pump No. 1 suction from the condensate storage tank to the service water system (SWS). The condensate storage tank is the non-safety-related primary source of water for the AFW system. When the AFW system is needed and either the conden-sate storage tank is not available or has been emptied by the AFW system, a safety-related transfer system transfers the suction from the condensate storage tank to the SWS. The SWS is the safety-related secondary source of water. The transfer is initiated upon a low suction pressure signal and is designed to transfer the suction to the alternate source of water without damaging the AFW pumps.

During the event on June 9, 1985, the suction for AFW pump No. 1 transferred to the SWS while there was ample water in the condensate storage tank. AFW pump No. 2 did not experience any transfer. The licensee indicated that the pres-sure drop across the suction strainers in conjunction with the piping losses and load changes on pump No.1 resulted in the low suction pressure. Although the pressure drop across the strainers in the suction line of pump No. 2 and the effects:of loads changes would be similar to that experienced by pump No.1, the piping losses would be less for pump No. 2 and thereby would not result in the transfer to the SWS. The licensee's proposed solution is to remove the strainers immediately ahead of each pump and to increase the mesh size of the strainer in the common suction line from the condensate storage tanks. In addition, the licensee has changed the low suction pressure setpoint to provide greater margin and added a 10-sec time delay to reduce spurious transfers to the SWS resulting from rapid AFW pump speed changes. The licensee has stated that the maraufacturer has indicated that the pumps can operate for several minutes with inadequate suction pressure without damaging the pumps. Therefore, the addition of the 10-sec transfer delay is acceptable. -

In its SER input dated August 29, 1983, concerning the TMI Task Action Plan (TAP) Item II.E.1.1, the staff stated that the licensee met Recommendation GS-4 by having an automatic transfer of the AFW suction to the alternate source of water and by having an automatic isolation of the AFW turbine steam inlet lines at a suction pressure of 1 psig. These two features provide protection of the pumps for cavitation. In response to the additional short-term recommendation 01/29/86 3-44 DAVIS-BESSE RESTART SER SEC 3

No. 1, the licensee identified that the low level alarm setpoint on the conden-sate storage tank corresponds to approximately 200,000 gallons of water in the tank, which is more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />'s worth of water.

Because of the automatic transfer of the AFW pump No. 1 suction on June 9, 1985, it is not clear whether the required technical specification volume in the condensate storage tanks could actually have been pumped by the AFWS. The modified transfer setpoint should provide greater assurance that the entire condensate storage tank (CST) volume can be used. The licensee has proposed

, additional testing to verify the new transfer setpoint.

For the review of Item II.E.1.1, the staff considered the need to lock open single or multiple valves in series which could interrupt flow from the water source (s) to the pumps and from the pumps to the steam generators. Where strainers were present, the staff recommended their removal. Strainers are usually installed during construction and used during system preoperational testing where there is the possibility of items entering the suction of the pumps. After preoperational testing, the strainers are usually removed.

Clogging of strainers has caused two events of loss of all AFW in the TMI precursor study. Davis-Besse was one of the plants that experienced one event.

Therefore, the staff continues to recommend removal of the strainer in the common suction line, eliminating a possible common mode failure.

On the basis of this review, the staff believes that the licensee has identified the root causes of the spurious transfer of the AFW pump No. 1 to the SWS.

3.2.2 Thermal Transient Effects on Reactor Coolant System Components o After the reactor trip event on June 9, 1985, the reactor coolant hot and cold leg temperatures generally followed the normal post-trip pattern for about 6 min. At this time, the water levels in both steam generators began to fall from the normal post-trip levels because of the lack of any feedwater. Hot and cold leg temperatures began to increase from approximately 550*F, and within 12 min they reached 595 F. By that time, the feedwater had been restored and  !

the reactor coolant began cooling again. The temperature had reached 545 F within the next 6 min. During the vessel cooldown, the peak pressure was approx-imately 2400 psi. After evaluating the transient, the licensee concluded that 01/29/86 3-45 DAVIS-BESSE RESTART SER SEC 3 1

i i

i the transient did not impair the structural integrity of the reactor vessel.

l The staff has reviewed the analyses submitted by the licensee to confirm the ifcensee's conclusions.

l l

During the transient, large differential temperatures were produced across cer-tain components of the once-through steam generators (OTSG) as a result of cold  !

feedwater contacting the auxiliary feedwater nozzles, main feedwater nozzle, and tubes. The licensee has submitted analyses of the most highly stressed components of the OTSGs resulting from the transients to determine if any ad-I verse effects may have been produced. The staff has reviewed the analyses to i

confirm the licensee's conclusions.

3.2.2.1 Reactor Vessel The staff utilized the computer code VISA to evaluate the effect of this tran-sient on reactor vessel integrity. This code is documented in NUREG/CR-3384.

This code performs a fracture mechanics analysis, which can be used to deter-mine the crack size required to initiate a brittle fracture of the reactor i

vessel. The amount of neutron irradiation damage is dependent on the neutron fluence and chemical composition (percentage of copper and nickel) in the limit- t

ing beltline weld. The neutron fluence at the peak flux location and percent-  ;

! ages of copper and nickel for the limiting beltline material in the D=vis-Besse

! reactor vessel were determined from the material and neutron fluence data provided in Babcock and Wilcox Report BAW-1543, Rev. 2, " Integrated Reactor Vessel Material Surveillance Program," May 1985.

I 1 For this transient, the VISA code calculated that the crack required to initiate ,

brittle fracture would have to be at least 3.75 in, deep. Volumetric inspec-tion of the limiting weld in the Davis-Besse reactor vessel was last performed in 1975, before putting the plant in commercial operation, and no significant indications were reported. Since this inspection, the reactor vessel has operated for only 3.59 effective full power years. On the basis of the methods used to fabricate and inspect the beltline welds and the small amount of operat- l ing time at Davis-Besse, the staff considers it unlikely that a 3.75-in.-deep l crack would be preexisting in the Davis-Besse beltline during this transient.

l l

01/29/86 3-46 DAVIS-BESSE RESTART SER SEC 3 4

Hence, initiation of a crack, which would cause brittle fracture, is unlikely.

On the basis of this analysis, the staff concludes that this transient did not cause structural damage to the reactor vessel, which would preclude future operation of the facility.

3.2.2.2 Pressurized Thermal Shock The staff's evaluation of pressurized thermal shock (PTS) is documented in SECY82-465, " Pressurized Thermal Shock." This report propodes a screening cri-teria and provides analysis of various PTS events. The screening criteria indicate that the risk from PTS events is acceptable when the RT value is NDT less than 270 F for longitudinal welds and less than 300*F for circumferential welds. The limiting weld in the Davis-Besse reactor vessel is the upper to lower shell circumferential weld. Hence, the RTNDT for this weld must be less than 300 F to satisfy the screening criteria.

The staff's most current method of predicting the increase in RT resulting NDT from neutron irradiation damage is documented in proposed Regulatory Guide (RG) 1.99, Rev. 2, " Radiation Damage to Reactor Vessel Materials." Using the method documented in RG 1.99, Rev. 2, the RT at the inside surface of the limiting NDT weld when the Davis-Besse transient occurred was 168 F. This value of RTNDT is substantially less than the value required by screening criteria.

Figure D-9 in SECY82-465 provides a generic evaluation of the effect of PTS transients on the critical values of RTNDT, final water temperature, Tf ,

pressure and the cooldown rate to cause crack initiation in a reactor vessel.

The cooldown rate is expressed as p, the reciprocal time constant. For the Davis-Besse transient, the most rapid cooldown occurred during the first 5 min.

This results in a p of approximately .04 min 1 Figure D-9 indicates for the transient the final water temperature must be below the RT f r the weld NDT metal to cause crack initiation. Because the RTNDT f r the limiting weld is 168*F and the lowest water temperature during the transient was 545 F, the water temperature in the vessel would have had to drop an additional 377*F to cause crack initiation and to be a significant PTS event.

i 01/29/86 3-47 DAVIS-BESSE RESTART SER SEC 3

3.2.2.3 Once-Through Steam Generator ,

In the ifcensee's evaluation, the following components of the once-through steam generator (OTSG) were considered to be the most highly stressed during this event and were evaluated for the critical loads experienced during the transient as shown:

(1) auxiliary feedwater nozzle (2) main feedwater nozzle (3) auxiliary feedwater jet impingement on tubes (4) axial compressive load in tubes resulting from shell to tube thermal mismatch (5) thermal shock on the lower tubesheet The stresses in the auxiliary feedwater (AFW) nozzle were reviewed because of the large temperature difference imposed on the nozzle by cold AFW. A re-view of this stress and fatigue analysis of the nozzle shows that the analyzed transient in the original design of these nozzles is more severe (AT between shell and AFW = 530 F) than the transient experienced on June 9, 1985 (AT = 501 F).

The fatigue usage factor in the design analysis is based on 875 AFW initiations and is determined to be 0.55 (versus an allowable value of 1.0). This covers all specified design transients, but is, in fact, solely because of AFW initia-tion with the high stresses that result from the injection of cold AFW into the hot nozzle. The effect of the transient experienced on June 9, 1985, on the fatigue usage factor of the AFW nozzle is, therefore, considered to be acceptable.

The stresses in the main feedwater (MFW) nozzle were reviewed because of the large temperature difference imposed on the nozzle by shutdown feedwater acti-

.vation. In the original stress report, a case was considered in which 90 F feedwater was injected into a nozzle at 535*F; therefore, AT = 445*F. The fatigue usage factor for the nozzle was 0.4, which is ic s than the allowable value of 1.0.

01/29/86 3-48 DAVIS-BESSE RESTART SER SEC 3

On the basis of data from the event on June 9, 1985, the shell temperature before MFW initiation conservatively is assumed to be 572.5"F; the nozzle tem-perature is assumed to be equal to the shell temperature. The feedwater tem-perature at initiation is 411*F. The AT for this case is then AT = 162*F.

Because the analyzed AT (445*F) is greater than the actual AT (162*F), it is concluded that the event on June 9, 1985, is bounded by the stress report.

2 The effect of this transient on the fatigue usage factor of the MFW nozzle is negligible.  :

t An evaluation of bolting stresses and fatigue on the auxiliary and main feed-

, water nozzle bolts submitted by the licensee indicates that the event on June 9,  !

1985, did not have significant effects on the fatigue life of the bolts that '

attach the nozzles to the steam generator shc11.

The stresses resulting from impingement of cold AFW on hot OTSG tubes was re-viewed because of the large AT involved. In the original design calculations,

! it was assumed that 40*F auxiliary feedwater impinges on a tube at 626*F.

Using 29,400 cycles as a basis, a fatigue usage factor equal to 0.33 was cal-culated for AFW impingement alone. The combined usage factor for all tran-sients was 0.39, which is well below the allowable value of 1.0.

i During the event on June 9, 1985, the reactor coolant temperature before AFW initiation was 592.5"F. On the basis of thermocouple data, the AFW temperature was about 70*F. Therefore, AT = 522.5*F, which is less than the AT analyzed, and the event is bounded by the original design calculations. ,

A temperature difference between the tubes and the shell induces an axial load in the tubes because of the axial restraint imposed on the OTSG tubes by the two tubesheets. This load is tensile when the shell temperature is greater  ;

than the tube temperature and compressive when the tubes are hotter than the shell. A AP across the tubesheet and tubes also induces axial loads in the tubes. Both AT and AP must be considered when evaluating the final tube load, i

Temperature data from the event of the June 9, 1985, shows that in this case,

, the tube temperature (assumed equal to the average reactor coolant temperature) 01/29/86 3-49 DAVIS-BESSE RESTART SER SEC 3

,,..-...,,.n-.- e,, , . - - - , . --- a - n.-,, ,.

is higher than the average shell temperature (based on thermocouple readings).

The shell and tube temperatures for the two generators were as follows:

Temperature Component SG 1 SG 2 Shell 533 F 521*F Tube 593*F 593.5*F On the basis of these temperatures and the corresponding pressures, the compressive tube loads for SG 1 and SG 2 are 751 lb and 994 6 respectively.

The effect of these loads on the natural frequencies of the tubes and lateral tube deflections has been determined to be acceptable on the basis of test data. A single occurrence of this load cycle during the. transient has been shown to have a negligible effect on the fatigue usage factor of the tubes.

A review of the stress analysis of the tubesheet relative to the thermal shock from the transient indicates that the increase in the fatigue usage factor resulting from the transient will be negligible. The calculated fatigue usage factor in the original design of the tubesheet was determined to be 0.15, which indicates that a large margin was available. The temperature differential during the single stress cycle imposed during the transient resulted in a negligible increase in the fatigue usage factor for the tubesheet. It is, therefore, concluded that the structural integrity of the tubesheet remains unaffected by the transient of June 9, 1985. -

On the basis of a review of the results of the stress analysis of OTSG compo-nents, the staff concludes that the structural integrity of the OTSGs was not impaired as a result of this event.

3.3 Improvement Programs and Plant Modifications 1

This section evaluates the facility improvements that have been undertaken following the event on June 9, 1985. These improvements nearly all focus on 01/29/86 3-50 DAVIS-BESSE RESTART SER SEC 3

improving the reliability of the auxiliary feedwater system and the steam and feedwater rupture control system that initiates the auxiliary feedwater system j and controls isolation of a steam generator when required. Improving the reli- I ability of these two systems increases the confidence that continued decay heat removal will be available.

l One important facility modification undertaken by the licensee is the addition of a pump that, although not safety grade, can function as a 100% capacity auxiliary feedwater pump. This new addition, which is electric motor driven, provides diversity to the auxiliary feedwater system that has been totally de-c pendent on steam for pump drive.

Improvements have been made in the control room to enhance the ability of the

~

operators to perform their duties; that is, improve the human factors design aspects to the safety features actuation system to improve channel separation and to the balance-of plant to minimize the challenges to safety systems.

i In addition to the program to improve the physical plant, the licensee also has a program under way to improve the nuclear mission's regulatory performance.

This program has been in effect for several years and was undertaken at the

request of the NRC.

3.3.1 Evaluation of Facility Modifications 3.3.1.1 Steam and Feedwater Repture Control System 4

The steam and feedwater rupture control system (SFRCS) is designed as an engi- ,

neered safety features system to monitor plant parameters (steam generator water level and pressure, differential pressure between the steamline and main. feed-water line for each steam generator, and the loss of all four reactor coolant

pumps), and under plant conditions indicative of a main steamline break, main feedwater line break, or loss of heat sink to initiate appropriate actions to isolate a ruptured steam generator and initiate auxiliary feedwater system (AFWS)

! flow to the intact steam generator (s). . Valves controlled by the SFRCS to iso-late a ruptured steam generator include the main steam isolation valves (MSIVs),

l l

01/29/86 3-51 DAVIS-BESSE RESTART SER SEC 3 l

1 . _ . -

b the main feedwater regulating and startup valves, and the AFWS containment iso-lation valves. The SFRCS also controls the AFWS steam admission and pump dis-charge valves.

The FSAR Chapter 15 analysis of a double-ended main steamline break upstream of 1

an MSIV (Section 15.4.4.2.3) states that both steam generators will blow down re-sulting in SFRCS isolation of the main steamlines and main feedwater and auxil-f ary feedwater lines to both steam generators. Following isolation, the intact steam generator will repressurize to above the low steam generator pressure SFRCS actuation setpoint of 600 psig causing the associated AFWS containment isolation valve to reopen allowing AFWS flow to be initiated. A single failure of the AFWS containment isolation valve to reopen would prevent AFWS flow to the intact steam generator resulting in loss of the preferred method of decay ,

heat removal from the primary system. The Incident Investigation Team concluded that neither the SFRCS nor the AFWS met the single-failure criterion for all design-basis accidents. The staff's review of the SFRCS design following the event on June 9, 1985, concluded that the SFRCS was unacceptable because it was not capable of performing its required safety functions (providing AFWS flow to

~

the intact steam generator) following a design-basis event and a single active failure. Furthermore, the staff raised concerns regarding the SFRCS's capabil-ity to cut off all sources of feedwater to both steam generators, requiring operator intervention and successful operation of several active components to reestablish core cooling.

The licensee formed a Decay Heat Removal Task Force, which evaluated and recom-mended improvements to the AFWS and SFRCS. These are discussed in Section II.C.2 1 of the Course of Action report. The licensee has performed a single-failure

~

analysis of the SFRCS to ensure that, for each analyzed event, given any

. credible active single failure, auxiliary feedwater would be available to the J

intact steam generator. This analysis included a review of SFRCS electrical schematic diagrams of all actuated components to verify that single failures could not affect both trains of SFRCS-actuated equipment, and a review of the Class 1E electrical power system to verify electrical independence between SFRCS trains.

l 01/29/86 3-5?. DAVIS-BESSE RESTART SER SEC 3

i

'The short-term recommendation proposed by the licensee for implementation i before restart to resolve the staff's single-failure concerns is to modify the SFRCS logic to prevent isolation of AFWS flow to both steam generators if ,

steam generator low pressure conditions were to be sensed in each steam genera-tor; only the first steam generator with a low pressure condition will be isolated.

Additional modifications to the SFRCS to be implemented before restart to improve system performance and reliability include

(1) modifying the SFRCS logic to prevent the unneeded isolation of the main steamlines and main feedwater lines when steam generator low level condi-tions are sensed (2) filtering of the steam generator low level SFRCS actuation signals to prevent spurious actuations caused by pressure transients (e.g., turbine

~

stop valve or MSIV closures) which are not indicative of changes in steam generator inventory (3) providing a seal-in feature for the SFRCS full trip control room annuncia-tor point, which requires the operator to acknowledge the full trip con-dition in order to clear (reset) the annunciator (4) providing additional cooling capability for the cabinets housing the SFRCS electronic power supplies For low pressure in one steam generator, the SFRCS will continue to isolate the o associated main steamline, main feedwater line, and auxiliary feedwater line to that steam generator, and align AFWS flow to the other steam generator.

However, with the modified SFRCS logic, if pressure in the second steam genera-tor should fall below the trip setpoint value, AFWS flow will continue to be provided to the second steam generator. Upon isolation of the first steam generator, a signal is generated to block (prevent) isolation of the second steam generator. Therefore, only one steam generator may be isolated at a time by the SFRCS in response to steam generator low pressure conditions ensuring i

01/29/86 3-53 DAVIS-BESSE RESTART SER SEC 3

6 that one steam generator is available for decay heat removal. The normally open AFWS containment isolation valve associated with the intact steam genera-tor will remain open, thus resolving staff single failure concern regarding failure of the valve to reopen following isolation. Because the remaining SFRCS initiation signals do not actuate the AFWS containment isolation valves (closure of these valves can only be initiated by a SFRCS low pressure trip),

the staff concludes that the modifications discussed above are sufficient to resolve the concern identified in NUREG-1154 regarding SFRCS and AFWS compli-ance with the single-failure criterion with respect to opening an AFWS contain-ment isolation valve to feed an intact steam generator.

In addition to the SFRCS logic modifications, the licensee has performed a re-analysis of a main steamline break event upstream of an MSIV that shows that the pressure in the intact steam generator would remain above the 600 psig SFRCS low pressure initiation setpoint, as sensed at the SFRCS low pressure tap loca-tion just upstream of the associated MSIV. In addition to closing the MSIVs, an SFRCS steam generator low pressure signal will initiate closure of the two associated turbine stop valves (TSVs). The licensee has stated that the TSVs are designed as safety-related isolation valves. The TSVs are designed to close within 1 sec of an SFRCS low pressure trip, as compared with the MSIVs, which require approximately 6 see to close. The results of the analysis show that the pressure in the intact steam generator will remain above 730 psig, assuming the TSVs close. If a TSV fails to close, the analysis shows that pressure in the intact steam generator could fall as low as 580 psig causing SFRCS low pres-sure isolation of the AFWS containment isolation valve. The licensee claims that, for this case, the NUREG-1154 SFRCS single-failure concerns regarding failure of the AFWS containment isolation valve to reopen are not valid because -

failure of this valve would constitute a second failure, which is beyond the single-failure criteria. However, the FSAR Chapter 15 analyses, which were used as the licensing basis for Davis-Besse, do not take credit for TSV closure in response to a main steam break. The licensee has stated that no common fail-ure exists that could prevent a TSV.from closing and also prevent the reopening of the AFWS containment isolation valve. The licensee has also stated that the effects of an open turbine bypass valve would be terminated by MSIV closure in the steamline associated with the intact steam generator.

01/29/86 3-54 DAVIS-BESSE RESTART SER SEC 3

The staff's review of the remaining changes proposed for the SFRCS before plant restart has concluded that these changes will result in increased SFRCS relia-bility. The SFRCS logic modification to prevent main steamline and main feed-water line isolation on steam generator low level will permit continued main feedwater flow to the steam generators and decay heat removal via the main con-denser. The licensee is performing confirmatory analyses to ensure compliance with accident analyses acceptance criteria for loss-of-feedwater and loss-of-offsite power events following this modification. The SFRCS main steamline and main feedwater line isolation circuitry on steam generator low level will be disabled if the results of the analyses verify that this modification is acceptable.

The proposed SFRCS modifications to provide filtering of the steam generator low level actuation signals and to provide a seal-in feature for the SFRCS full trip alarm are designed to prevent the undesirable conditions (i.e., spurious SFRCS actuation on steam generator low level and operator confusion regarding whether an SFRCS actuation has occurred) that occurred during the event on June 9, 1985. These modifications are an overall improvement to the SFRCS and are acceptable. The proposed modification to provide additional cooling for the SFRCS electronic power supplies is designed to eliminate problems caused by overheating of the supplies and is acceptable.

On the basis of the results of the licensee's analyses and the short-term modi-fications to the SFRCS to resolve the single-failure concerns identified in '

NUREG-1154 with respect to reopening an AFWS containment isolation valve to feed an intact steam generator, the staff concludes that the design of the SFRCS is acceptable to allow plant restart. The staff also concludes that the short- -

term modifications tc the SFRCS are sufficient to resolve staff concerns regard-ing SFRCS isolation of all sources of feedwater to both steam generators.

3.3.1.2 Auxiliary Feedwater System The AFWS was reviewed in accordance with Section 10.4.9 of the Standard Review Plan (SRP), NUREG-0800. Although the SRP is directed toward the review of plants before they are licensed, it may also be used for operating plants, keeping in mind that deviations from the SRP do not necessarily constitute 01/29/86 3-55 DAVIS-BESSE RESTART SER SEC 3

h unacceptability. Deviations may be reviewed further on a case-by-case basis for operating plants. An audit review of each of the areas listed in the

. " Areas of Review" portion of the SRP section was performed according to the guidelines provided in the " Review Procedures" portion of the SRP section.

Conformance with the acceptance criteria formed the basis for the evaluation

', with respect to the applicable regulations of 10 CFR 50.

The staff reviewed the AFWS against the acceptance criteria of SRP Sec-tion 10.4.9 as follows:

(1) General Design Criterion (GDC) 2, " Design Bases for Protection Against Natural Phenomena," as related to structures housing the system and the j system itself being capable of withstanding the effects of earthquakes.

i Acceptability is based on meeting Position C.1 of Regulatory Guide

, (RG) 1.29 for safety-related portions and Position C.2 for non-safety-related portions, i

! (2) GDC 4, " Environmental and Missile Design Bases," with respect to structures housing the system and the system itself being capable of withstanding the i effects of externally generated missiles and internally generated missiles, pipe whip, and jet impingement forces associated with pipe breaks. The basis for acceptance for this criterion is set forth in SRP Sections 3.5 I

and 3.6.

(3) GDC 19, " Control Room," as related to the design capability of system  ;

instrumentation and controls for prompt hot shutdown of the reactor and potential capability for subsequent cold shutdown. Acceptance is based -

on meeting Branch Technical Position (BTP) RSB 5-1 with regard to cold

, shutdown from the control room using only safety-related equipment.

! (4) GDC 34, " Decay Heat Removal," and 44, " Cooling Water," to ensure i

1 i

(a) the capability to transfer heat loads from the reactor system to a heat sink under both normal operating and accident conditions 01/29/86 3-56 DAVIS-BESSE RESTART SER SEC 3

(b) redundancy of ce;iponents so that, under accident conditions, the safety function an be performed assuming a single active component failure (this may be coincident with the loss of offsite power for certain events)

(c) the capability to isolate components, subsystems, or piping, if required, so that the system safety function will be maintained In meeting these criteria, the recommendations of NUREG-0737, "Clarifica-tion of TMI Action Plan Requirements," shall also be met. An acceptable AFWS should have an unreliability in the range of 10 4 to 10.s per demand based on an analysis using the methods and data in NUREG-0611.

(5) GDC 45, " Inspection of Cooling Water System," as related to design provi-sions made to permit periodic inservice inspection of systems, components, and equipment.

(6) GDC 46, " Testing of Cooling Water System," as relateu to design provisions made to permit appropriate functional testing of the system and components to ensure structural integrity and leaktightness, operability and perform-ance of active components, and capability of the integrated system to function as intended during normal, shutdown, and accident conditions.

l The following evaluation discusses the implementation of these acceptance criteria and follows the order of the Review Procedures of SRP Section 10.4.9.

This evaluation also incorporates the results of the staff's review of the licensee's response to Item II.E.1.1, " Auxiliary Feedwater System Reliability," o I

of NUREG-0737 that includes (1) an evaluation against the deterministic criteria of the SRP (2) an evaluation against the generic recommendations of NUREG-0737 (3) an evaluation of system reliability based on the licensee's reliability study 01/29/86 3-57 DAVIS-BESSE RESTART SER SEC 3

Description of the AFWS The AFWS is designed to supply an independent source of feedwater to the steam generators when the normal feedwater system is not available, to maintain the heat sink capabilities of the steam generators. The AFW system is an engineered safety feature system that is relied on to aid in preventing core damage in the event of transients such as loss of normal feedwater, a steam system pipe rupture, or small-break loss of-coolant accident. The system consists of two redundant safety-related essential trains, each with its own steam-driven turbine, pump, associated valves, piping, controls, and instrumentation. A non-safety-related motor-driven feedpump (MDFP), associated valves, piping, controls, and instrumentation is able also to provide flow equivalent to one AFW pump to either or both steam generator. Each AFWS pump is capable of supplying water to either or both steam generators. Each pump has a design flow of 1050 gpm at 1050 psig. The controls for one turbine-driven AFWS pump are powered completely independent of ac power. Each of the auxiliary feed-water (AFW) supply paths (including the MDFP) to the steam generator contains two check valves and a motor-operated isolation valve. The flow path from ~

the MDFP includes a flow control valve. During normal plant operation, steam to the AFW pump turbines will be provided up to the steam admission valves, which are within approximately 10 ft of the turbines, via the cross-connect lines from the opposite steam generator. On initiation of the AFWS, the isolation valve in the steamline to its respective steam generator will be automatically opened. Steam flow to the steam turbine is limited by a 2.5-in.-diameter orifice in each steamline. MDFP runout is prevented by pre-setting the motor-operated flow control valve on the discharge of the pump.

The primary sources of water for the AFW system are the two non-safety-related condensate storage tanks (CSTs). The two tanks are hydraulically connected by an interconnecting line with two manual, locked-open valves. The secondary source of water for the turbine-driven AFW pumps is the safety grade service water system (SWS) with an automatic switchover from the CST on low suction pressure at the pumps. The licensee has committed to provide a connection to the SWS for the MDFP before Cycle 6 operation. The transfer to the SWS for the MDFP will be performed manually from the control room. i 01/29/86 3-58 DAVIS-BESSE RESTART SER SEC 3

GDC 2 The only interfaces between safety-related components and non-safety-related components for the two turbine-driven pump trains are the suction line from the CST and the injection from the MDFP to the AFW lines to the steam generators.

In both cases a seismic Category I check valve and motor-operated isolation valve are in the seismic Category I portion of the piping which provide ade-quate separation. The safety related portion of the AFW system is located in the safety-related seismic Category I auxiliary building and inside containment.

The MDFP is not safety related and is located in the basement of the non-safety-related non-seismic Category I turbine building adjacent to the auxiliary building wall. The licensee has provided the results of an analysis of the turbine building for a 0.2g earthquake using the guidelines of RGs 1.60 and 1.61. The results indicate that the turbine building will not collapse on any of the AFWS pumps. The MDFP may be damaged from some falling debris, but the roof of the auxiliary building, which is inside the turbine building, is capa-ble of withstanding the effect: of the falling debris. Because the MDFP is in the basement of the turbine building, it is prutected from high winds, tornadoes (up to a windspeed of approximately 200 mph), most externally generated floods, and most trajectories for tornado generated missiles. The safety-related portions of the AFW system are protected from earthquakes, external floods, high winds, tornadoes, and most tornado generated missiles.

The suction line from the CST to the AFWS passes through the turbine building and, therefore, could fail as a result of a safe shutdown earthquake. The licensee has stated that the pump manufacturer had indicated that the AFW pumps could be operated for several minutes with inadequate suction pressure without -

sustaining damage. The loss of the suction line would result in low AFW pump suction pressure, which would cause automatic transfer of suction to the SWS following a 10-sec delay. Because the transfer could be expected to occur in less than half a minute and several minutes would be required before the pumps are damaged, the unprotected suction line and the 10-sec delay in automatic transfer to the SWS are acceptable.

01/29/86 3-59 DAVIS-BESSE RESTART SER SEC 3

i On the basis of its review of the information submitted, the staff concludes that the requirements of GDC 2 and the guidelines of RG 1.29, Positions C.1 and C.2, concerning protection from natural phenomena and seismic qualification are satisfied.

GDC 4 The MDFP and safety-related portions of the AFWS are protected from most tornado generated missiles because they are in the basement of the turbine building and the seismic Category I auxiliary building and inside containment.

The only areas that would permit tornado generated missiles to damage safety-related equipment are several small openings in the auxiliary building roof that are covered with louvered grating. The licensee has provided the results of a probabilistic assessment that indicates that the probability of a tornado missile entering these openings is less than 10 7 per plant year. Although not as well protected, the MDFP is surrounded by 12-in.-thick reinforced concrete walls on two sides, a 10-in.-thick turbine deck above, and the concrete turbine-pedestal and turbine generator. These objects limit the possible trajectories for tornado generated missiles.

Separate cubicles are provided for each AFW pump to prevent possible internally generated missiles from damaging more than one pump. The separate cubicle enclosures for the turbine-driven pumps protect each turbine-driven AFW pump from each other and the MDFP from potential missiles. originating from the turbine-driven pumps. The MDFP is not protected from internally generated missiles that could be generated by the main feedwater pump or the booster pump. -

The AFWS trains are not used during startup and shutdown; therefore, they are not designed as high energy lines as prescribed in the criteria of SRP Sections 3.6.1 and 3.6.2, except for the steamlines to the turbines, which are maintained hot and pressurized up to within 10 ft of the turbines. The licensee has pro-vided the results of a new high energy line break analysis and has verified that no safety-related equipment will be adversely affected by pipe whip and jet impingement. New subcompartment environmental analyses were performed to deter-mine the maximum temperatures and pressures developed as the result of a high 01/29/86 3-60 DAVIS-BESSE RESTART SER SEC 3

energy line break. The methods used by the licensee and the results of the analysis are reasonable. The licensee has identified some instrumentation and equipment that are not qualified for this harsh environment and has committed to replace all of the unqualified components with qualified components before restart. A pipe break in one turbine-driven AFW pump room will result in a harsh environment that will pass from the room through the openings in the roof. The licensee has performed an analysis that demonstrates that the effluent from one AFWS compartment will not adversely affect the environmental conditions in the second compartment.

On the basis of the above, the staff concludes that the requirements of GDC 2 and 44 and the guidelines of RG 1.29, Positions C.1 and C.2, concerning protec-tion from natural phenomena, seismic qualification, and the ability to provide adequate cooling water are satisfied.

The staff concludes that the safety-related portions of the AFWS satisfy the requirements of GDC 4 regarding protection against missiles and pipe breaks.

GDC 19 The turbine-driven AFW pumps are initiated on low steam generator level, low steam generator pressure, loss of the four reactor coolant pumps, high steam generator level, and high steam generator to main feedwater differential pressure. Manual initiation is accomplished by simulating one of these condi-tions by operator action in the control room. The control and instrumentation for the turbine-driven AFW pumps are safety grade. The operation of the MDFP is from the control room with non-safety grade controls and instrumentation. -

The MDFP and associated equipment are normally aligned to receive power from 4

one diesel generator. Operating this equipment with power from the other diesel generator requires some operator action from outside the control room. ,

The licensee has committed to make the necessary modifications that would permit aligning all necessary MDFP associated equipment to either diesel l generator from within the control. room before Cycle 6. Therefore, the staff concludes that the AFWS provides adequate instrumentation and control for prompt initiation of a shutdown using safety-related equipment in accordance with the requirements of GDC 19 and the guidelines of BTP RSB 5-1. I l

01/29/86 3-61 DAVIS-BESSE RESTART SER SEC 3

GDC 34 and 44 t

Each AFWS pump is designed to provide' sufficient flow necessary for residual i

heat removal over the entire range of emergencies requiring AFWS function in I

accordance with the conservatisms assumed in the accident analysis. These emergencies include the following accident / transient conditions:

(1) loss of main feedwater ,

(2) loss of offsite power

(3) secondary system pipe rupture (4) cooldown following steam generator tube rupture (5) small-break loss-of-coolant accident i The safety-related portion of the AFWS functions automatically as required in the event of a loss of offsite power. _The decay heat transfer path from the steam generators under this condition is to the atmosphere via the atmospheric vent valves. One of the turbine-driven AFW trains functions independently of any ac power and thus is not affected by a loss,of all ac power. Power to the i

redundant turbine-driven AFW system pump is provided by an emergency diesel

generator. Power for the MDFP is normally provided by either of the two emer-i gency diesel generators. Driving steam for the turbine-driven pumps is provided j from either of the main steamlines upstream of the main steam isolation valves and is discharged to the atmosphere. Each steam-driven AFW pump is provided with an air-operated flow control valve that opens on a signal to start the pumps. Any power or air failure will result in the valve failing open. A i check valve is provided in each steam supply-to prevent flow reversal. Each l AFW pump discharge is provided with a normally open motor-operated isolation '

l valve and two check valves in the feedlines to each steam generator. The I discharge from each AFW pump also has a full-flow pump testing return line to l the CST. Therefore, the staff concludes that the requirements of GDC 34 and 44

,! with respect to the ability of the AFWS to transfer decay heat from the reactor I coolant system under a loss of offsite power are satisfied.

i, The AFWS is designed to accommodate a single failure in any active system com-l ponent without loss of function. AFW can be supplied from three redundant i

01/29/86 3-62 DAVIS-BESSE RESTART SER SEC.3

I trains, two 100% capacity turbine-driven trains and one 100% capacity motor- ,

driven train, each capable of supplying both steam generators. Each AFW pump l is supplied by a common suction line from the CST through locked-open manual valves. The safety-related turbine-driven AFW pumps have an automatic trans-fer to the secondary safety grade service water supply, the SWS. The licensee has committed to provide a manually initiated transfer system to the SWS for the MDFP before Cycle 6 operation. The licensee has proposed retaining strainer S-257 in the common suction line to the turbine-driven AFW pumps. This strainer could result in the loss of CST water from the safety grade AFWS and, therefore, its removal is recommended by the staff. Strainer removal should provide additional assurance for adequate feedwater to an intact steam generator in the event of a postulated design-basis accident concurrent with a single failure.

Adequate isolation is provided for the AFW system from nonessential systems.

Therefore, the staff concludes that the AFWS meets the requirements of GDC 34 and 44 with respect to single failure. .

Adequate AFW flow is ensured to the steam generators in the event of the loss of offsite and emergency onsite ac power by relying on the safety-related turbine-driven pump train (AFP-1), which can perform its safety function inde-pendent of ac power for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Loss of all ac power will not affect the positioning of motor-operated valves in the AFP-1 subsystem. Because Davis-Besse has a very short dryout time, potentially less than 5 min, a third source of the AFW flow is from the 100% capacity MDFP. This pump and its auxiliaries can be manually loaded onto either emergency onsite diesel generator and manually initiated. Therefore, the staff concludes that the AFWS meets the requirements of GDC 34 and 44 and the guidelines of BTP ASB 10-1, with regard to AFWS power diversity. o The licensee has described the design of the AFWS to prevent feeding a faulted

- steam generator and to maintain at least minimum flow to the intact steam generator. Normally one turbine-driven AFW pump is aligned to each steam generator. Upon identification of a faulted steam generator, the safety grade control system isolates the faulted steam generator from its respective turbine-driven AFWS pump and realigns to the good steam generator. The MDFP does I

not have any automatic isolation but is protected from excessive pump runout by presetting the flow control valve to maintain a minumum discharge pressure on 01/29/86 3-63 DAVIS-BESSE RESTART SER SEC 3

I a

i the pump. The AFW flow is not throttled to avoid the occurrence of water-1 . hammer. The licensee has performed a test of the safety grade portion of the AFWS to determine the potential for waterhammer. The results of the test indicated that no waterhammer had occurred. The addition of the MDFP does not alter significantly the AFWS piping configuration; therefore, no waterhammer is j anticipated as a result of the installation of the MDFP. Therefore, the staff concludes that the AFWS meets the requirements of GDC 34 and 44 with respect to its ability to transfer heat under accident conditions and provide isolation to ensure system function. The AFWS also meets the recommendations of NUREG-0737 4

concerning throttling for waterhammer prevention.

I GDC 45 The AFWS components are located in areas that are accessible during normal l plant operation to permit inservice inspection. A second (independent) opera-

^

tor is provided to verify the proper AFWS valve position following restoration of an AFWS train to service after periodic testing or maintenance. Therefore, the staff concludes that the AFWS meets the requirements of GDC 45 regarding i provisions for inservice inspection.

i GDC 46 i

Provisions for AFWS testing and inspection are included in the design. Each

AFW pump is equipped with a recirculation line to the CST for periodic func-j tional testing. Local manual realignment of valves is required to accomplish this testing, and constant ccmmunication with the control room is provided.

I When one AFWS train is being tested, the other train is available for automatic -

4 operation. The MDFP is not automatically initiated. Periodic surveillance l testing of the essential pumps and their associated flow trains is identified in the Technical Specifications. The licensee has committed to propose a Tech-nical Specification for the MDFP, similar to the existing Technical Specifica-tion for the turbine-driven AFW pump. The MDFP is not covered by the American l Society of nechanical Engineers (ASME) Code,Section XI testing program, and, j therefore, the MDFP Technical Specification should require verification of the

! pump flow rate at least once every 18 months. The licensee shall submit a pro-

posed Technical Specification for staff review within 60 days after restart.

01/29/86 3-64 DAVIS-BESSE RESTART SER SEC 3

Therefore, the staff concludes that the AFWS meets the requirements of GDC 46 with respect to functional testing and surveillance.

The MDFP will use some of the electrical components that were previously used for the lower flow capacity startup feedwater pump (SUFP). The licensee has stated that the SUFP will be returned to operable status before Cycle 6 opera-tion. During the refueling before Cycle 6 operation, the me.nual valves that isolate the high energy line associated with the SUFP will be replaced with remote, manually operated valves which will be controlled from the control room.

Therefore, the staff's evaluation of the SUFP as discussed in its SER support-ing Amendment No. 83 (January 8, 1985) dated November 20, 1984, is still applicable.

Additional Modifications (1) Automatic Transfer of the AFW Suction to an Alternate Source In its SER input dated February 21, 1984, concerning the TMI Task Action Plan (TAP) Item II.E.1.1, the staff stated that the licenree met Recom-mentation GS-4 by having an automatic transfer of the AFW suction to the alternate source of water and by having an automatic isolation of the AFW turbine steam inlet lines when the suction pressure drops to 1 psig.

These two features provide protection of the pumps from cavitation. In response to the additional short-term Recommendation No.1, the licensee stated that the low level alarm setpoint on the condensate storage tank corresponds to approximately 200,000 gal of water in the tank, which is more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />'s supply of water. -

Because of the spurious transfer of AFW pump No. 1 suction on June 9, 1985, it is not clear whether the required technical specification volume in the CSTs could actually be pumped by the AFWS. The licensee has modi-fied the transfer setpoint to provide greater assurance that the specified CST volume can be used. The licensee has proposed additional testing to verify the new transfer setpoint. Subject to acceptable test results, the staff finds this change acceptable.

01/29/86 3-65 DAVIS-BESSE RESTART SER SEC 3

i l

(2) Replacement of Isolation Valves in Steamlines .

l 4

Modifications to the steamlines to the AFW pump turbines include replace- ,

j ment of a manual isolation valve, which is located approximately 10 ft

, upstream of the turbine, with a normally closed, fail-open, air-operated l flow control valve. With this new valve, the steam isolation valves in

,f the cross-connect lines are to be left open to maintain most of the steamlines hot and pressurized.

1 i (3) Other Concerns l

i All discharge valves in from the MDFP discharge line to the steam gener- ,

ators will be left open. The licensee has not provided a response to '

Office of Inspection and Enforcement (IE) Bulletin 85-01 dealing with

! detection of backleakage from the ~ steam generator to the MDFP. This issue

. -should be addressed before the next refueling outage.

The suction valves to the CST will be placed in the open position and will

have their power removed. Removing power from the valves is acceptable, but the licensee must confirm that all the valves also are locked in the j

4 open position or otherwise protected from manual repositioning.

Several other miscellaneous changes were made such as cutting and capping the line from the deaerator, which previously had two locked-closed valves, l and replacing one AFW pump turbine speed governor, which had been planned

before June 9, 1985. The staff has reviewed these changes and has con- .

cluded that they have no adverse effect on the reliability or operability -

of the AFWS.

t l

Although there have been no quantitative analyses to determine the improve-ment in the availability of the AFWS because of these changes, these changes, except for removal of the strainer in the common suction line and I the locked-open suction valves, will tend to provide a more available AFWS l and are, therefore, acceptable.

?

I '

i 01/29/86 3-66 DAVIS-BESSE RESTART SER SEC 3

3.3.1.3 Motor-Driven Pumps On June 9, 1985, there were two full-capacity steam turbine-driven AFWS pumps and one low-capacity, non-safety-related startup feedwater pump (SUFP) at Davis-Besse. The SUFP was designed to deliver feedwater flow at approximately 200 gpm to the main feedwater nozzles of the steam generators. This pump was powered from a 4160-V non-safety-related bus. Tie 4160-V bus can be powered, if necessary, from either diesel generator through manual action from the control room. The operation of the SUFP was previously reviewed by the staff (SER supporting Amendment No. 83, dated January 8,1985) before startup follow-ing the fourth refueling outage. As a result of that review, certain license conditions were imposed on the licensee with respect to the use of the SUFP.

One license condition required the licensee to install a new motor-driven feed pump before startup for Cycle 6. The licensee has completed the installation of a new, full-capacity non-safety-related motor-driven feed pump (MDFP). The MDFP is manually started from the control room and will feed both steam gener-ators. The MOFP is capable of being powered by either onsite emergency diesel generator, as was the SUFP. However, if diesel generator No. 2 is unavailable, transferring to the other requires operator action from outside the control room to transfer a vital lube oil pump to diesel generator No. 1. The CST is the only source of water when the MDFP is operating as an AFWS pump. When not in operational Modes 1, 2, and 3, the pump can be aligned to take suction from the deaerator and discharge into the feedwater system. The electrical switch-gear that previously powered the SUFP is now used to power the M0FP. The licensee has indicated that the SUFP may be returned to an operable status at a later time; thus, the results of the staff's review of the SUFP are still applicable. -

The installation of the MDFP brings Davis-Besse into compliance with the power diversity requirement of BTP ASB 10-1 and is, therefore, acceptable. The issues of automatic initiation and provisions for a safety-related source of water for the M0FP are summarized in Section 4.2 of this SER.

3.1.3.4 Safety Features Actuation System i

[To come later]

01/29/86 3-67 DAVIS-BESSE RESTART SER SEC 3

1 I

3.1.3.5 Balance-of-Plant Improvements

[To come later]

3.3.2 Ongoing Improvement Programs

) Item IIIc of the staff's letter dated August 14, 1985, requested reexamination of the adequacy of the implementation of the Performance Enhancement Program

! (PEP) and any other ongoing corrective action program.

The licensee reexamined incomplete commitments of the PEP and Systematic

Assessment of Licensee Performance (SALP) response for implementation adequacy.

l The results of that review were presented in the licensee's Course of Action report. The Course of Action divided incomplete commitments into three categories. Category 1 includes actions that will receive high management priority for accelerated implementation. Category 2 includes actions near

completion that are not high priority items but that will be completed as

' scheduled in the Course of Action. Category 3 includes actions to be accom-j plished in the normal course of business.

Performance Enhancement Program In the fall of 1983, the NRC Region III Administrator requested Toledo Edison Company to initiate a regulatory improvement program because of declining

! - licensee performance. The program was to determine areas where corrective l actions were warranted, establish the required corrective actions, and implement l those actions. The licensee agreed to develop such a program which it named -

i the Performance Enhancement Program (PEP).

j Initial efforts focused on identifying of the areas to be reviewed, select-ing the conceptual methodology for conducting the reviews and establishing

, corrective actions, and establishing an organization to implement PEP. Sixteen

areas were selected for review:

I t

01/29/86 3-68 DAVIS-BESSE RESTART SER SEC 3

.( . _ . . - .. - . . . - - - - - . .- --

! /

1 (1) personnel policies and staffing (9) licensing * ,

(2) mission staffing capabilities (10) engineering s

)

(3) management oversight (11) configuration management:<

i (4) safety management (12) integrated living schedule plan (5) station operations (13) fire protection i (6) maintenance (14) productivity and quality of work

(7) training, (15) security (8) quality assurance (16) records management The review process selected was the Kepner-Tregoe (K-T) method that uses a number of steps to arrive at a corrective action. Those steps are situation

appraisal (SA), problem analysis (PA), decision analysis (DA), and potential l problem analysis (PPA). SA is used to recognize, separate, and prioritize concerns. PA diagnoses the concern and develops possible causes for it. DA determines the best balanced corrective action to deal with the cause of the concern. PPA analyzes the potential problems associated with the corrective' action to determine the appropriate response to those problems.

The PEP organization encompassed a steering group responsible for making major +

l decisions regarding the design and scheduling for PEP activities, an admin-istrator, sixteen action planning teams (APTs), and a consultant group. The i APTs were responsible for performing a K-T analysis on concerns in their i l designated area and developing an action plan to resolve the concerns.

• i In December 1983, the licensee informed NRC Region III of the areas requiring l corrective action under the PEP. The NRC requested the licensee to identify!

and/or establish interim corrective measures where appropriate until final corrective action under the PEP could be implemented. The licensee determined i that 95 interim corrective actions were ongoing or completed and identified f 40 additional actions. Generally, these interim actions were completed br -

~

integrated into the final PEP. -

t l The PEP was divided into three phases. Phase 1 involved training the APTs on j the K-T method and the performance of SA and PA on the areas of concern.

! Phase 2 included evaluation of probable causes identified from PA and providing i

action plans through DA/ PPA. Phase 3 was to include integration of interim

PEP items into the PEP, establishment of. implementation plans from the action l

l plans phase, and resolution of any outstanding issues from Phases 1 or 2.

l I

01/29/86 3-69 DAVIS-BESSE RESTART SER SEC 3

, v

In Phase 1 which began in March 1984, 121 pas were completed and 336 specific concerns identified for further evaluation. These specific concerns were then categorized into the following six groups in Phase 2:

(1) Management Leadership (2) Human Resources Development (3) Information/ Decision Support Systems (4) Safety / Licensing Management (5) Station Performance (6) Technical Support Systems The sixteen APTs were condensed into six action planning groups (APGs) to l accommodate the new concern categorie.s. DA/ PPA was performed and approximately 45 action plans were generated by the completion of Phase 2 by July 13, 1984.

i Phase 3 began in late July 1984 and was to be complete with the implementation of the approved action plans. At the beginning of Phase 3, steering group I review of the action plans began and DA/ PPA continued on any remaining con-i cerns. Eventually, 54 action plans were approved by the steering group with some type of implementation plan issued. As of July 1985, nine action plans had been completed.

The staff considers the process used to identify items of concern to be a i logical and acceptable method. The K-T methodology was followed and is ade-quate. Action plan generation appears to be specifically directed at correct-ing root causes. However, generation and implementation of some of the imple-i mentation plans was not timely. The original scope of some of the action plans was not maintained in the implementation plans.

I The most recent systematic assessment of licensee performance (SALP) report (NRC, December 6,1984) identified significent deficiencies in the licensee's performance during the assessment period from April 1, 1983, to August 31, l 1984. Therefore, NRC Region III requested the licensee to identify corrective j actions planned to improve performance in plant operations, maintenance, emer-gency preparedness, quality programs, and training. The licensee identified

{

those corrective actions in letters to NRC Region III on February 4, 1985, and i

March 4, 1985. These letters identify a number of PEP action plans and other i.

j 01/29/86 3-70 DAVIS-BESSE RESTART SER SEC 3 J

--.-.,,,,w-- - - - , , , . - -, - ,- , , - . - - - - =~, - - , ,

e 4

corrective actions to improve the licensee's performance. Sixty-six of the

] identified actions remained incomplete in July 1985. j A number of the SALP response actions were also PEP actions. The operations a I section actions resulted in finproved operations department performance, but actions requiring nuclear mission support in other areas were untimely and still incomplete. Specific examples include reduction of jumpers and lifted wires, and system-by-system review of the plant. Maintenance section actions were unsuccessful in controlling vendor manuals'in the field and did not significantly reduce the maintenance work order backlog. Emergency prepared-ness actions were successful in improving performance in this area, as exhibited l in licensee performance in the 1985 summer emergency preparedness exercise.

The quality programs area showed improvements in expanding those areas requir-ing a safety evaluation. The training area had significant actions still incomplete.

't The staff generally concludes that management corrective actions that had been I

implemented failed to promptly and adequately resolve the problems that had j been identified. In the PEP program, the three deficiencies noted exemplify a

) lack of commitment of necessary resources and of the failure of senior manage-i ment to properly overview the progress of PEP.

With regard to the licensee's prioritization of incomplete commitments, the three implementation categories are generally acceptable. Additional priori-tization of these corrective actions is not warranted before restart. Cate-gory 1 items are appropriate and deal with the important issues that will re-quire significant management overview. The final implementation dates appear --

i to be timely. All the Category 2 items are acceptable with no further informa-tion needed. Incorporation of the Category 3 actions into the normal course of business is fundamentally sound because this will provide direct accountability for performance of these actions. The interim PEP and SALP response actions

! have been presented adequately as to how anc when these corrective actions shall I take place. However, the licensee has statec that the PEP implementation plans

originally established may not be the actual corrective action product to deal

~

with the identified problems. No time frame has been provided in which these items will be completed. Continued Region III attention will be required to 01/29/86 3-71 DAVIS-BESSE RESTART SER SEC 3

_ , _ - . = _ _ . , , _ . _ . , . _ _ _ _ -, . . - . . , _ . - , ~ _ , ,

ensure that PEP receives adequate oversight by corporate management and the necessary commitment of resources to implement fully the corrective actions identified.

3.3.3 Control Room Review and Improvement The staff has completed its evaluation of the licensee's responses to the staff's concerns with respect to the adequacy of control room instrumentation and the human factors aspects of control room SFRCS design. The responses have been reviewed with respect to the NRC concerns identified in the report entitled

" Pre-Implementation Audit of the Detailed Control Room Design Review (DCRDR) of the Davis-Besse Nuclear Power Station," which was sent to the licensee by letter dated July 2, 1985. On the basis of this evaluation, the staff has made the following determinations with respect to each of the staff's concerns.

Control Room Instrumentation and Control (I&C) Adequacy Adequacy of control room I&C will be addressed in a separate SER relating to the Control Room Design Review (DCRDR). For the staff to complete this review, the licensee must submit satisfactory responses to the items identified in the following paragraphs and in " Supplement to the Technical Evaluation Report of the Detailed Control Room Design Review for the Davis-Besse Nuclear Power Sta-tion" (reproduced in Appendix C to this SER). This issue need not be resolved before restart but is included in this SER for completeness.

Programs To Reduce the Likelihood of Inadvertent Isolation of Auxiliary Feedwater to Both Steam Generators --

The licensee's proposed work plan, shown in Exhibit 5 of the licensee's sub-mittal dated September 30, 1985, should result in adequate human factors improvements to the steam and feedwater rupture control system panel. These improvements would minimize the likelihood of inadvertent isolation of auxil-iary feedwater to both steam generators; however, the licensee has not specifi-cally addressed the matter of plans for the retraining of control roam operators with respect to these modifications. The licensee shall confirm that all control room operators will be retrained appropriately before restart.

01/29/86 3-72 DAVIS-8 ESSE RESTART SER SEC 3

Detailed Control Room Design Review (DCRDR) '

i The licensee provided satisfactory responses to most of the staff's concerns identified in the pre-implementation audit report. However, additional informa-tion is required for several DCRDR elements so the staff can complete its review in accordance with Supplement I to NUREG-0737. The staff's evaluation of each element is presented below.

(1) Qualifications and Structure of the DCRDR Team The licensee has committed to the involvement of human factors specialists in its Systems Review and Test Program (Section 3.4 of this SER) and in '.

the facility change request (FCR) process during and after completion of tne DCRDR. The licensee's commitment to the human factors element in the DCRDR satisfies the concerns of the staff and will meet this requirement of Supplement 1 to NUREG-0737. The licensee's commitment to human factors involvement after completion of the DCRDR is commendable.

(2) Function and Task Analysis 1

j The licensee has committed to update its systems function and task analysis (SFTA). The SFTA upgrade activities will include the following:

(a) an analysis of operator tasks, information and control requirements, and required characteristics of instruments and controls necessary to monitor and assess the various challenges and failure modes of the radioactivity release critical safety function -:

(b) a reanalysis of cperator actions for steam generator tube rupture to ensure comprehensive identification of information and control requirements 1

(c) an analysis of required characteristics of instruments and controls l for all operator tasks required during emergency operations l

After staff approval of the licensee's SFTA performed to develop upgraded plant specific emergency operating procedures (EOPs), the staff will 01/29/86 3-73 DAVIS-BESSE RESTART SER SEC 3  ;

determine whether the results of the SFTA were satisfactorily applied to the DCRDR to determine instrument and control characteristics.

(3) Comparison of Display and Control Requirements With a Control Room Inventory The staff concluded that because the SFTA was not complete, the comparison or verification of the information and control requirements and required characteristics of instruments and controls with the control room mockup is incomplete.

The licensee has committed to perform a verification of equipment avail-ability and human engineering suitability for the requirements that are developed from the activities necessary to upgrade the SFTA. The licensee's verification approach will satisfy the NRC's previous concerns. However, the adequacy of this verification process will depend on the adequacy of the SFTA relative to upgraded plant-specific E0Ps.

(4) Control Room Survey The staff concluded that the control room survey conducted up to the time of the pre-implementation audit was satisfactory. However, the following aspects of the control room were not evaluated:

4 (a) the new components added to the control room since the survey was performed 1 (b) the annunciator system flash patterns The licensee has committed to complete the control room survey. The licensee should provide for NRC staff review documentation of the assess-ment and resolution of any human engineering discrepancies (HEDs) identi-

fied from the review of new components added to the control room and any l HEDs associated with annunciator system flash patterns. These activities should satisfy the requirements of Supplement 1 to NUREG-0737 for the j conduct of a control room survey.

01/29/86 3-74 DAVIS-BESSE RESTART SER SEC 3 m

l l

l (5) Assessment of HEDs The staff concluded, previously, that there was no systematic review of individual HEDs to determine the presence of cumulative and interactive effects upon the assessment of HEDs. In addition, the licensee did not '

use human factors expertise in downgrading the safety significance of 29 HEDs.

The licensee has proposed an acceptable plan to evaluate the cumulative and interactive effects of individual HEDs and to reevaluate its prioriti-zation of the 29 safety-significant HEDs using a human factors consultant.

The licensee plans to correct a minimum of 12 of the 29 HEDs during the current outage. It is not clear which of the 29 safety-significant HEDs will not be corrected. Although it can be assumed that those HEDs associ-ated with the SFRCS and the event on June 9, 1985, are among those, the licensee should identify by HED number which HEDs are to be corrected during the current outage, and which of these HEDs will be corrected at a later date. In addition, the licensee should provide justification for those safety-significant HEDs that will not be corrected during the current outage and for those HEDs that will only be partially corrected.

These issues should be addressed satisfactorily by the licensee before restart.

(6) Selection of Design Improvements The staff concluded that the following activities were necessary for the licensee to meet this DCRDR requirement: o (a) perform and document a systematic process of selecting design improvements (b) ensure cumulative and interactive effects of individual HEDs that will be corrected, not corrected, or partially corrected on the entire integrated control room improvement program 01/29/86 3-75 DAVIS-BESSE RESTART SER SEC 3

(c) improve HED documentation for completeness, clarity, accuracy, and auditability (d) develop solutions to HEDs and implementation schedules that are acceptable to the NRC staff For the staff to close out this requirement of Supplement 1 to NUREG-0737, the licensee should provide the following documentation:

(a) proposed work plans for the special studies (except for the SFRCS panel)

(b) several sample HEDs that demonstrate the upgrading of HED documentation (c) all the proposed corrections to HEDs, including those to be performed during and after the current outage (d) justification for HEDs not corrected or partially corrected (e) an implementation schedule for each HED correction, including the rationale for schedule delays beyond the sixth refueling outage These items need not be resolved before restart but are included in this SER for completeness.

(7) Verification That Improvements Will Provide the Necessary Corrections

~

Without Introducing New HEDs The licensee has committed to use human factors specialists as active integral members of the DCRDR team to develop and verify human engineering design changes.

The implementation of this verification process should resolve the staff's concerns regarding fulfillment of this requirement of Supplement 1 to NUREG-0737.

01/29/86 3-76 DAVIS-BESSE RESTART SER SEC 3

(8) Coordination of the DCRDR With Other Improvement Programs The licensee did not provide documentation of a systematic plan to coor-dinate all emergency response initiatives. The licensee only described points of integration of the various improvements, which the staff con-cluded was a loosely coordinated program. For the staff to close out this requirement, the licensee is required to provide documentation that explicitly discusses the status and integration of the results of each review with each of the initiatives in Supplement 1 to NUREG-0737. This issue need not be resolved before restart but is included in this SER for completeness.

3.4 System Reviews and Test Procedures

[To be provided]

s 01/29/86 3-77 DAVIS-BESSE RESTART SER SEC 3

,\ llllll, G

N R IEE RCG I EIVA E

NRN EA IGSM N

E R S G OT G M RNC RNLR RER T AmE R ARAE I

EERG ASOT

!EI LED LEEA EYC L

CS E CN CNNN UIP UIEA UTR NGU NO NGGM N NWD I

ER E U G P E

CR YNO T SG IAT LRC NNR

. A UER ORE G I

U SI I TE D SD I AENNA A R EQA PN M D E e

r u

RGR t ANO T ENC c L

CAR E G u WRI RY feR r TD uTNO tuEEC T t I l CCWE R s

UA NFWG t

'D' n e

RSR m

AEO eg ECT S

N I

CMC L

E a UR n G

N I

T, N

T,0 Ni l WSD I a

T TE N

E T

AR RE R0A E

R N0M A1E m

0DEC OSi 1

TSP lNPl f SAOF l IEl NRC I I IERO S e E

R F D EPU S N SPR S s P E E C

AEACI NT s e

I H

C I

V IL VC 0N 1ER N

U TMO A T B

E C -

I MG fAR E

s 0NI i AD NM .

v a

D 1

E A 3 Y

NT EE FC AIIg S

e r

u g

i F

E RSR TO I A CT 1

1IC C

@ e DRE WAI PD @-

R E

R' E

G T GS A

N NAN AN0 I A TAl I M SMAR I

S T STE NP JI i

A AO L L P P R -

EE T GC _

NAN ANA _

TAN _

I SMET STN S

NIA A A LM P

o5N(cc on way S<MTC QI I

3 M = $ ,.>". g x $ n w l ii <

l i > I

w)

Table 3.1 Licensee's summary of the status of maintenance work orders (MW0s)

Number of MW0s Corrective Preventive. . Modifications Existing on June 9, 1985 1339 405 111 Created since June 9, 1985 2754 654 452 Closed since June 9, 1985 (as of November 8, 1985) 2134 805 115 Remaining as of November 7, 1985* 1970 289 460

• The totals do not agree because data were given on two different dates.

Table 3.2 Equipment freeze

1. MFPs turbine and controls

2. SFRCS and associated instrument channels

3. Auxiliary feedpump turbines and controls

4. MSIVs including controis--actuating circuits, pneumatic supplies

5. Starting feedwater valve SP-7A and controls

6. Source range instrument channels

7. Turbine bypass valve (TBV) SP-13A2- any other components for which j there is found an indication of waterhammer damage Traps and drains associated with No. 2 TBV header: MS 2575, MS 737, MS 739, ST 3, ST 3A

8. PORV and controls and actuation system

9. Main steamline safety valves and atmospheric vent valves

10. AF 599 and AF 608 valves, actuators, and controls

11. MS 106 and controls

12. SW valve and controls on AFW alternate supply 0

i l 01/29/86 3-79 DAVIS-BESSE RESTART SER SEC 3

i l

1 l

Table 3.3 Troubleshooting findings for NI-1 (channel No. 2) '

i

1. Detector Assembly (3 Anomalies) 1.1 Improper assembly of triaxial Amphenol connector, which interfaces the integral mineral-insulated detector cable to the triaxial cable to/from the preamplifier.

1.2 Detector location in thimble not a core midplane.

1. 3 Masonite spacers used to block area around detector signal cable in j detector thimble plug were too short (i.e., 5 in. versus 18 in.).

! 2. Preamplifier Assembly (7 Anomalies) 2.1 Detector cable connector had its center pin pushed in approximately 1/4 in. and off center.

2.2 No grounding wire was connected to outer preamplifier box.

i 2.3 Bulkhead connectors on preamplifier inner and outer boxes had high-resistance connections to triaxial shields because connectors were mounted on painted surfaces.

l 2.4 None of the cable connectors at the preamplifier had 0-rings i installed.

j 2.5 Detector cable bushing on outer box had inadequate clearance from detector cable connector, causing a potential ground loop.

f 2.6 Detector and high voltage connectors appear to be nickel instead of

. silver.

l 2.7 Fiber shipping washers had been left in some bulkhead connectors, preventing proper meshing and tightening of connectors.

3. Penetration Assembly (No Anomaly) l

[' 4. RPS Instrument Cabinet (4 Anomalies) 4.1 Loose connection to station safety ground bus.

i

{ 4.2 Output connector for high voltage power supply had a crushed 0-ring.

1 4.3 Fiber shipping washers had been left in some bulkhead connectors, preventing proper meshing and tightening of connectors.

4.4 " Blue Ribbon" connector on high voltage power supply was chipped and cracked.

01/29/86 3-80 DAVIS-BESSE RESTART SER SEC 3 i

. _ - . - --. .~.- -_- _ __

- - -. - . . _ .=. . . _

'l Table 3.3 (Continued)

5. General (3 Anomalies) 5.1 Operation of instrument cabinet door switches (provide annunciator

, indication of open door) for RPS, safety features actuation system (SFAS), and SFRCS cabinets cause high-level spikes at input to count rate amplifier module.

5.2 Every Amphenol connector was tarnished; many Amphenol connectors contained metal flakes.

j S.3 Operation of some SFAS-controlled motor-operated valves caused some spiking observable at the input of the rate-of-change amplifier module.

i t

t I

1 i

i i

l 1

l I

01/29/86 3-81 DAVIS-BESSE RESTART SER SEC 3

- - - . - e- , -,---...,.,-,n, -~-,-,.-...,-n r e - n-- , , , . - - w,-- - - - - - - .

. , - , . . - , .e--,,,-,--.m.,.,-n.--- , , , . . . . , - . - . . - - . . , - - - - . - . - , - - - , -

Table 3.4 Troubleshooting findings for NI-2 (channel No. 1) a

1. Detector Assembly (1 Anomaly) 1.1 Leaking seal plate allowed rust to form at connection box at top of i detector thimble.

1 2. Preamplifer Assembly (9 Anomalies) 2.1 Low voltage cable connector loose on cable.

2.2 High voltage bulkhead connector extremely loose; 0-ring not installed.

2.3 High voltage cable connector did not have 0-ring installed.

2.4 Ground wire to outer box not installed.

2.5 Connectors for high voltage and detector appear to be nickel instead 4 of silver.

4 j 2.6 Bushings not installed where cables enter outer box.

! 2. 7 Bulkhead connectors on outer box for detector and high voltage were loose; i.e. , mounting nuts only finger tight.

2.8 Printed circuit board was not mounted securely inside preamplifier

box.

2.9 Shipping washers were left in some bulkhead connectors, which pre-vented adequate tightening of connectors.

j 3. Penetration Assembly (3 Anomalies) f 3.1 Resistance substantially high for signal cable, i

j 3.2 Signal cable connector loose on cable.

i 3.3 Shipping washers were left in some culkhead connectors, which pre-vented adequate tightening of connectors. ,

i 3.4 Intermittent losses of continuity for center conductor of signal

! cable.

4. RPS Instrument Cabinet (3 Anomalies) i

4.1 Coaxial connector to count rate amplifier not locked.

1 4.2 High voltage cable connector appears to be nickel rather than silver.

i

4.3 High voltage cable connector did not have 0-ring installed.

01/29/86 3-82 DAVIS-BESSE RESTART SER SEC 3

ilo Table 3.4 (Continued) i

5. General (3 Anomalies) 5.1 Cabinet door switches (for annunciator) for RPS, SFAS, and SFRCS cabinets cause high level spikes.

5.2 Every Amphenol connector tarnished; many contained metal flakes.

5.3 Some SFAS-operated motor-operated va1ves cause spiking on input to SUR meter.

i m

01/29/86 3-83 DAVIS-BESSE RESTART SER SEC 3

4 i

Document Name: '

l.

DAVIS-BESSE RESTART SER SEC 4 Requestor's ID:

EVA Author's Name:

DeAgazio/Harwell Document Comments:

1/28/86 KEEP THIS SHEET WITH DOCUMENT l

l 4

i j

i i

L i

1 I

1 4

l

1 l

l 4 DECAY HEAT REMOVAL RELIABILITY AND CAPABILITY l 4.1 Auxiliary Feedwater System Before June 9,1985 At the time of the evqnt on June 9,1985, the auxiliary feedwater system (AFWS) consisted of two turbine-driven auxiliary feedwater pumps and associated valves and piping. Three water sources were available to the AFWS pumps: the conden-sate storage tank (CST), the deaerator storage tanks, and the service water system. The CST was the normal water source for the system; however, if a low suction pressure condition was sensed, the AFW suction would automatically transfer to the service water system. Manual action is required to transfer suction to the deaerator storage tanks.

The AFWS was actuated by the steam and feedwater rupture control system (SFRCS). The SFRCS was provided primarily to prevent the AFWS from providing water to a faulted steam generator. When the AFWS is actuated by the SFRCS on signals other than low steam generator pressure, the steam to drive the tur-i bines of the AFWS pumps and the discharge of each pump are aligned with the associated steam generator. Each of the AFWS pumps is rated at 1050 gpm when pumping against a steam generator pressure of 1050 psig; 250 gpm of the 1050 gpm is used for recirculation flow. However, if the SFRCS is actuated on low steam generator pressure, the flow path of the system is altered to prevent feeding a ruptured steam generator. The isolation of feedwater to the faulted

! steam generator is accomplished by closing the AFWS containment isolation valve.

Feedwater to the intact steam generator is supplied by both pumps through the appropriate cross-connect valve and piping. The steam supply valves for the turbine-driven pumps are also realigned to provide steam for both pumps from the intact steam generator.

After the accident at Three Mile Island, the staff required all pressurized-water-reactor licensees to perform a reliability (unavailability) study of the AFWS. The staff reviewed the submittal by Toledo Edison and also performed an 01/28/86 4-1 DAVIS-BESSE RESTART SER SEC 4

independent analysis. The analysis addressed the following three transient conditions and the results as indicated below.

Transient Unavailability LMFW - loss of main feedwater 1.6 x 10 8 LOOP - loss of offsite power / loss of main feedwater 2.8 x 10 8 LOAC - loss of all ac power / loss of main feedwater 3.4 x 10 2 A comparison of these unavailability figures with those in NUREG-0611 and NUREG-0635 shows that Davis-Besse falls into the low range for the LMFW and LOOP transients.

4.2 Auxiliary Feedwater System Before Restart After the Event on June 9, 1985 Before restart the AFWS will consist of the two safety grade turbine-driven pumps as described previously and the new motor-driven feedpump as described in Section 3.3.1.3. With the additional system modifications discussed in Sections 3.3.1, the staff concludes that the reliability of the overall AFWS has been increased on the basis of a con.parison of the results of a reif ability study for the AFWS before the event on June 9, 1985, and on a reliability study for the AFWS as it will be before restart.

Unavailability Transient Before Restart LMFW 9.1 x 10.s ,

LOOP 1.1 x 10 8 LOAC 3.3 x 10 2 The staff has reviewed the licensee's reliability analysis for the AFWS before restart and concludes that the modifications to be completed before restart

~ have improved AFW system reliability by at least a factor of 5 for the LMFW and LOOP transients. This assessment is based on a combining of the licensee's calculated reliability for these two transients with additional credit that was not included in the licensee's values for recovery actions. The staff 01/29/86 4-2 DAVIS-BESSE RESTART SER SEC 4

l considers the AFW system sufficiently reliable to permit restart. The staff notes that the calculated AFW system unavailability does not meet the 10 s to 10 4 per demand criterion of SRP Section 10.4.9. Although compliance with the  !

requirements and criteria identified in the Standard Review Plan is not a re-quirement for Davis-Besse, the comparison provides a useful measure to deter-mine if reasonable system upgrades should be recommended by the staff.

The licensee has committed to completing and submitting a detailed reliability study for review. Depending on the results of this study, the licensee may conclude that further modifications to improve reliability may be justified.

The staff will review the licensee's detailed reliability study and may make additional recommendations. The licensee's detailed study should be submitted for review within 90 days after restart.

j 4.3 Power-Operated Relief Valve /High-Pressure Injection / Makeup System for Makeup /High-Pressure Infection (MU/HPI) Cooling In response to the staff's concern regarding the adequacy of the Davis-Besse loss-of-feedwater analyses, the licensee provided the results of several best-J estimate analyses for a loss-of-all-feedwater event. These analyses were per-formed by the Babcock and Wilcox Company (B&W) using the RELAP5/ MOD 2 computer code. The licensee stated that the acceptability of the RELAP5/M002 program and the modeling techniques used was established by benchmarking the RELAP5/

MOD 2 code to OTIS test 230299. The purpose of these analyses was to assess the adequacy of the plant emergency (ATOG) procedure as well as to determine the time available for operator response for mitigating the consequences of a loss-of-all-feedwater event. ,

The operator actions modeled in the analyses were based on the current Davis-Besse ATOG procedure. Following the determination that both a lack of heat i

transfer and lack-of-feedwater conditions exist, the procedure requires the operator to (1) open the power-operated relief valve (PORV) and the PORV block valve (2.i open pressurizer and hot-leg high point vent lines (3, actuate both makeup (MU) ptamps (4) align high pressure injection (HPI) pumps in a piggyback mode 01/29/86 4-3 DAVIS-BESSE RESTART SER SEC 4

!}

Y This mode of cooling is defined as the MU/HPI, or alternatively " feed-and-bleed,"

cooling mode.

The licensee performed two sets of calculations. The first set examined the consequences of the event on June 9, 1985, assuming that auxiliary feedwater had never been recovered. Operator action to initiate the MU/HPI cooling mode was modeled. The results demonstrated that core uncovery would not have occurred, given initiation of MU/HPI cooling within the first 30 min of the event.

The second set of calculations examined a loss-of-all-feedwater event assuming full power operation. These analyses all used the following assumptions:

(1) reactor at 102% of full power (2) loss of feedwater initiated by 5-sec ramp down (3) decay heat based on American Nuclear Society Standard ANS 5.1-1979 (4) reactor trip on high pressure of 2300 psig; turbine trip 1 see after reactor trip (5) PORV capacity of 226,000 lb/hr steam and 2500 psia based on Electric Power Research Institute valve test data 1

(6) reactor coolant pump trips on loss of subcooling margin (7) no makeup flow or PORV actuation before assumed time of operator actions Three operator action times when feed-and-bleed cooling would be initiated were studied: (1) 5 min after hot-leg temperature reaches 610*F, (2) 10 min i after hot-leg temperature reaches 610*F, and (3) 20 min after reactor trip.

A temperature of 610*F was calculated to occur at 3.5. min into the transient.

A hot-leg temperature of 600*F is a proposed procedural change for determining when to implement the MU/HPI cooling mode. In all cases, the core remained fully covered with a two phase mixture and was acceptably cooled.

01/28/86 4-4 DAVIS-BESSE RESTART SER SEC 4

On the basis of these analyses, the licensee concluded that, with the use of existing plant equipment and timely operator action, feed-and-bleed (MU/HPI) cooling could be successfully used to prevent core uncovery and thereby maintain core coolirg for a loss-of-all-feedwater event.

The staff has performed independent calculations to examine the response of .

the Davis-Besse plant to a loss-of-all-feedwater event and to confirm the adequacy of the operating procedures. Report LA-UR-85-3083 (Line, Nassersharif, and Boyack, 1985) documents calculations performed at Los Alamos National Laboratory, using the TRAC code, which examine the Davis-Besse transient of June 9, 1985, and possible alternate sequences. The report concludes that even if auxiliary feedwater was never recovered during the June 9 event, operator action to implement MU/HPI cooling as late as 34 min after reactor trip would have prevented core uncovery.

In addition to the TRAC calculations, the staff has performed several calcula-tions, using the RELAP5/M002 code and the nuclear plant analyzer, to examine the time available for the operator to initiate MU/HPI cooling assuming initial full power operation. These calculations confirm that if MU/HPI cooling is implemented within 20 min, the core will remain covered and acceptably cooled.

On the basis of its review of the licensee's calculations, and its own calcula-tions, the staff concludes that MU/HPI cooling could be successfully used for core cooling, following a loss-of-all-feedwater event, if timely operator action is taken.

c 01/28/86 4-5 DAVIS-BESSE RESTART SER SEC 4

Document Name:

2 -

DAVIS-BESSE RESTART SER SEC 5 Requestor's ID:

EVA Author's Name:

1 DeAgazio/Harwell i

Document Comments:

1 1/28/86 return this sheet when submitting corrections l

6 i

i I

1

! =

4 d

1 J

6 l

e*

5 CONCLUSION On the basis of the staff's evaluation of the licensee's responses to the staff's concerns related to the event at Davis-Besse on June 9,1985, the staff concludes that, on faworable resolution of the issues summarized in Table 1.2 and discussed in detafl elsewhere in this SER, the Davis-Besse Nuclear Power Station may resume operation. With these issues resolved, there is reasonable assurance that the health and safety of the public will not be endangered by the resumption of power generation.

+-

+

=

5 W

J 01/28/86 5-1 DAVIS-BESSE RESTART SER SEC 5

Document Name:

DAVIS-BESSE RESTART SER APP A Requestor's ID:

EVA Author's Name:

DeAgazio/Harwell Document Comments:

1/28/86 i

s W

j l

t 0

l l

l i

'i L--_-..--.--_-_.__--__.-__---____-_-_.-__---__

-. . -. .. . - = ..-. .- . .. .. - -. _ . - _ . . . . - ._- -

t

.i .  :

1 APPENDIX A LETTER FROM W. DIRCKS (NRC) TO TEC REQUESTING INFORMATION,

DATED AUGUST 14, 1985  ;

P N

l

.i t

\

e

.j i

F

' I i i l

i  :

i 1

i i

4 1

1 I i

1 4

1 1

i 4

i Davis-Besse Restart SER Appendix A 4

i .

.. . _ , _ _ , . _ _, _ ____._____..-..._..,__._---,.__-_..---.....__.__,__._..___.,,_.._,......____-.m.. -- - . ..__ _.. , - . ~. _

Document Name:

DAVIS-BESSE RESTART SER APP B Requestor's ID:

1 EVA Author's Name:

l DeAgazio/Harwell

! Document Comments:

1/28/86 i

f i

i I

j ,

1 I .

i 1

k up

+

)

_ _ _ _ _ _ _ _ _ _ - _ _ - _ - - _ - _ _ _ - - _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ - _ _ _ _ _ - - _ _ _ - - _ _ - _ _ - _ _ _ - _ - _ - - - - - _ _ .---_--___-_-________--_______-_i

~

l Document Name:

DAVIS-BESSE RESTART SER APP C Requestor's ID:

LINDA l

Author's Name:

DeAgazio/Harwell

• Document Comments:

, 1/29/86 KEEP THIS SHEET WITH DOCUMENT .

1 e

I i

l i

h i

)

i i

)

1 I

1 APPENDIX C

. SUPPLEMENT TO THE TECHNICAL EVALUATION REPORT OF THE DETAILED CONTROL ROOM DESIGN REVIEW FOR THE DAVIS-BESSE NUCLEAR POWER STATION

?

e 4 .

4

)

1 J

l i

l l

l Davis-Besse Restart SER Appendix C

--- . . . . . - . . . . _ . . - . - , . . . . -