RBG-44912, Responds to Violations Noted in Insp Rept 50-458/98-13. Corrective Actions:Matls & Training Were Provided to Expedite Implementation of Existing Procedural Guidance to Supply Compressed Air

Responds to Violations Noted in Insp Rept 50-458/98-13. Corrective Actions:Matls & Training Were Provided to Expedite Implementation of Existing Procedural Guidance to Supply Compressed Air

ML20207J213
Person / Time
Site:	River Bend
Issue date:	03/03/1999
From:	King R ENTERGY OPERATIONS, INC.
To:	Lieberman J NRC OFFICE OF ENFORCEMENT (OE)
References
50-458-98-13, EA-98-478, RBF1-99-0058, RBF1-99-58, RBG-44912, NUDOCS 9903160217
Download: ML20207J213 (11)

Text

. . - - _ . - - . _ _ . . .- --- -

- Entergy operations, Inc. Gp

. River Bend Station  %/ J 5485 U. S Highway 61

'O y PO. Box P20 St. Francisvdie. LA 70775 g

Tel 504 336 6225 Fax 504 635 5CE8 Rick J. King Daector Nuclear Safety & Regulatory Aff airs March 3,1999 James Lieberman, Director Office of Enforcement U.S. Nuclear Regulatory Commission One White Flint North 11555 Rockvin!e Pike l Rockville, MD 20852-2738

Subject:

Reply to Notice of Violation in EA 98-478 (IR 50-458/98-13)

River Bend Station - Unit I License No. NPF-47 j Docket No. 50-458 File Nos.: G9.5, G15.4.1 RBG-44912 RBF1-99-0058

Dear Mr. Liebemian,

Entergy Operations, Inc. (EOI), is providing a reply to the Notice of Violations cited in Enforcement Action (EA)98-478 pursuant to the provisions of 10 CFR 2.201, under affirmation. EA 98-478 cites two Severity Level 111 violations associated with River Bend Station's (RBS) Division I and II Emergency Diesel Generators: (1) a violation of 10CFR Part 50, Appendix B, Criteria Ill, on design control; and (2) a violation of 20CFR Part 50, Appendix B, Criteria XVI, on corrective actions. A response to each violation is enclosed. Also endosed is e check in the amount of $55,000 in payment of the  !

associated civil penalty.

EOI compliments the NRC's recognition that identification credit be given for self-identifying the old design error. This reinforces guidance in the NRC's enforcement policy encouraging licensees and their employees to self-identify problems. The NRC ,,

lY  !

~

99d3i[02 5 990303 PDR ADOCK 05000458 G PM n l

_ _ . _ _ . _ _ . _ _ _ _ _ . _ _ . . _ . _ . ~ . _ . . _ _ _ . _ . _ .

l R.eply to Notice of Violation in EA 98-478 j RBG-44912 RBF1-99-0058 Page 2 of 3 j determined that identification credit should not be given for the corrective action violation. However, this position appears to be inconsistent with the spirit of the NRC's i

~ enforcement policy. As part of our thorough investigation of the condition, EOl l identified documentation indicating a potential prior opportunity to discover the condition j in 1990. Accordingly, while not denying the violation, we believe that identification l credit should have been granted. On this premise, EOI requests reconsideration of the i civil penalty. Further details supporting why a penalty should not be imposed are j included in Enclosure 3. ,

)

The condition has been the subject of several communications between the NRC and j EOI. In addition RBS's understanding of the issue became clearer as our investigation  ;

progressed. In light of the above, RBS has identified the need to clarify some parts of the i information the NRC has placed on the docket, including Information Notice 98-41, l

" Spurious Shutdown of Emergency Diesel Generators from Design Oversight," dated i November 20,1998 (See Enclosure 4). The commitments contained in this document are -)

identified on the Commitment Identification Form.  :

In conclusion, RBS does not deny the violations. However, we believe that the civil  !

penalty associated with the corrective action violation is not warranted based on self- i identification credit. Should you have any questions regarding the attached information l discussed hezein, please contact Mr. David Lorfing of my staff at (225) 381-4157. i Sin ly, -  :

b l RmiPO Enclosures r  !

CC:  !

U.S. Nuclear Regulatory Commission NRR Project Manager, Robert Fretz Region IV U.S. Nuclear Regulatory Commission j 611 Ryan Plaza Drive, Suite 400 M/S OWFN 13-H-3  ;

- Arlingto't,TX 76011 Oshington, D.C. 20555 I NRC Sr. Resident inspector U.S. Nuclear Regulatory Commission  !

P.O. Box 1050 Document Control Desk, OPI-37 -

St. Francisville, LA 70775 *Wauington, D.C. 20555 f

Comraitment Identification Form '

, . Replyto Notice of Violation in EA 98-478 RBF1-99-0058 RBG-44912 March 3,1999 Page 3 of 3 COMMITMENT ONE-TIME CONTINUING ACTION

• COMPLIANCE

• Design Engineering has initiated a review of the Division I and 11 diesel X engine electro-pneumatic control logic. The review will determine whether there are other aspects of the control system design that could lead to unexpected opuational transients or trips. The review will include operating procedures. Additional corrective actions, if any, will be identified as a result of the review.

A modification to enhance the diesel generator control and starting air X compressors has been initiated. Completion of the modification is expected by mid-1999, following Refueling Outage 8.

Provisions for manual operator actions to supply makeup air will be X maintained until the above modification is completed.

• Check one only

1 Enclosure 1  !

. 1 4

BEFORE THE I

UNITED STATES NUCLEAR REGULATORY COMMISSION )

i LICENSE NO. NPF-47 DOCKET NO. 50-458 IN THE MATTER OF ENTERGY GULF STATES,INC. ,

ENTERGY OPERATIONS,INC. ,

AFFIRMATION I, Rick J. King, state that I am the Director, Nuclear Safety and Regulatory Affairs, at the l River Bend Station; that I am authorized by Entergy Operations, Inc., to sign and file with the Nuclear Regulatory Commission, this reply to a Notice of Violation; and that l matters set forth herein are true and correct to the best of my knowledge, information, and L belief.

c1  ;

kick J. King /  ;

l l STATE OF LOUISIANA '

! PARISH OF WEST FELICIANA SUBSCRIBED AND SWORN TO before me, a Notary Public, commission in the Parish above named, this 3 M day of /Tbd,_1999.

(SEAL)

, ClauAE A NM Claudia F. Hurst  ;

Notary Public  :

t i

l i

ENCLOSURE 2

- - REPLY TO NOTICE OF VIOLATION EA 98-478 Page lof 2 Violation 01013

" Criterion III of Appendix B to 10 CFR Part 50 states, in part, "The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program."

Section 7.1.2.4.2 in the Updated Safety Analysis Report states, in part, "All safety-related instrumentation and control equipment are designed to remain functional during accident conditions." Section 8.3.1.1.3.6.1.1 states, in part, "All necessary auxiliaries directly associated with each standby diesel-generator unit are powered from their associated standby buses."

Technical Specification 3.8.Ib requires that three diesel generators shall be operable while in Modes 1,2, and 1. Technical Specificatior 1.1 definition of operable requires, in part, that a system, subsystem, component, or device shall be considered operable or have operability when all necessary auxiliary equipment required for the system, subsystem, component, or device to perform its safety function are also capable of performing their related safety functions.

Contrary to the above, since November 1985, design control measures did not adequately provide for verifying or checking, through the performance of design reviews, use of alternate or simplified calculational methods, or performance of testing, that the safety-related diesel generator courol air instrument and controls system remained functional during accident conditions. Specifically, design control measures did not ensure that the system was provided with a long-term supply of safety-related pressurized air, which was necessary for the continued operation of the diesel generators in response to an extended loss of offsite power (i.e., the air compressors were nonsafety-related and were not powered by a safety-related bus). At less than 120 psig, the non-essential diesel generator trips would no longer be bypassed and at less than 45 psig the diesel generators would autommically shutdown. As a result, the Division I and 11 diesel generators were not operable while in Modes 1,2, and 3 during this time period because the control air instrument and controls, a subsystem, were not operable. (01013)"

Admission of Violation River Bend admits the violation.

- _ _ = .- . - -

4 ENCLOSURE 2 Page 2 of 2 Reasons for the Violation The root cause of the condition is that a design error in the logic of the diesel trip system occurred during original design of the control system. The principal adverse affect of this error was that the non-emergency trips that were intended to be bypassed during emergency operations would become enabled as control air pressure decreased below approximately 120 psig. Further, the interacting pneumatic logic functioned such that it would cause a diesel trip if control air pressure decreased to approximately 40 psig. The reason for the design error is unknown, but it is believed to have oc urred because the -

original diesel generator vendor failed to adequately review, verify, and test the diesel trip system logic design.

Corrective Steps That Have Been Taken ar.d the Results Achieved A number of corrective action were taken as identified in the condition report. These corrective actions ensure that ;he diesel generators will continue to operate and perform their safety function. Three of the key corrective actions were as follows:

e Materials and training were provided to expedite implementation of existing procedural guidance to supply compressed air duiing emergency operations.

• Emergency diesel generator control logic was modified to prevent enabling i the non-essential tdps as air pressure decreases below 120 psig.

. One air compressor for each of the effected diesel generators was powered from a safety related power supply.

Corrective Actions to Avoid Further Violations Design Engineering has initiated a review of the Division I and 11 diesel engine electro-pneumatic control logic. The review will determine whether there are other aspects of the control system design that could lead to unexpected operational transients or trips. The review will include operating procedures. Additional corrective actions, if any, will be identified as a result of the review.

Date When Full Compliance was Achieved Compliance was achieved when the control logic modification (see above) on both diesel generators was complete on October 30,1998. A modification to enhance the diesel generator control and starting air compressors has been initiated. Provisions for manual operator actions to supply makeup air will be maintained until the modification is completed. Completion of the modification is expected by mid-1999, following Refueling Outage 8.

l

- - -- =. . . = - _. - .. .- . -- .

ENCLOSURE 3 REPLY TO NOTICE OF VIOLATION EA 98-478 Page1of4 Violation 02013 Criterion XVI of Appendix B to 10 CFR Part 50 states, in part, " Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective  !

action taken to preclude repetition. The identification of the significant condition adverse  ;

to quality, the cause of the condition, and the corrective action taken shall be documented and reported to appropriate levels of management."

Contrary to the above, from 1985 until about June 1998, a significant condition adverse to quality existed related to the Division I and 11 diesel generator control air instrument and controls systems, and the cause of the condition was not determined, and adequate corrective action was not taken throughout this time. Since 1990, licensee staff knew that diesel generator control air instrument and controls systems were not provided with a long-term source of safety-related pressurized air to ensure that the nonessential diesel generator trips would remain bypassed during a loss of offsite power. Although  !

procedures were changed in 1990 to require operators to install nonsafety-related air l bottles as an alternate air source, the acceptability of relying on this operator action, in lieu of automatic action, was not properly evaluated against the licensee's design-basis description in the safety analysis report and the ability to accomplish the manual actions was not fully demonstrated until 1998. Further, the failure to identify the significant  !

condition adverse to quality continued until 1998 and the cause of the condition and the corrective action taken was not documented and reported to appropriate levels of management. (02013)

)

Admission of Violation j i

RBS admits the violation. However, .for the reasons stated under " Credit for Identification of the Condition " reconsideration of the associated civil penalty is I

requested.

Reason for Violation i

The disposition to Condition Report (CR) 1990-0558 documented a portion of the problem that was later discovered in 19!.,. However, the significance of the problem was not recognized in 1990, or at any im.e prior to condition discovery on June 24,1998. The

{'

l ENCLOSURE 3 Page 2 of 4 condition analysis perfor ned in 1990 for the change in the diesel lockout set point recognized the potential kr the trips to be un-bypassed on a loss of air pressure during a  !

diesel start. The review Jid not appear to recognize the impact and significance on a diesel operating in the emergency mode. This secondary etTect was not viewed as significant when cons'.dering the loss of air during standby conditions. Since, under these specific conditions, the primary function of the lockout feature would block the diesel from an emergency start, reinstatement of the diesel trips would not be relevant, as the ,

diesel would have already failed to start. Corrective action was provided in CR 1990-0558 for the evaluated condition; however, it did not completely address the issue of a loss of air paessure after the diesel was started and running in the emergency mode. l According to one of the engineers involved in 1990, he recognized the undesirability of enabling the non-emergency trips as air pressure decreased. However, he was not concerned because he was aware that procedures had been put in place to use a backup air supply (air bottles) that would maintain control air pressure above the point the non-emergency trips would be enabled. Because this additional issue was not recognized as a .

condition adverse to quality, it was not reported on a condition report as a result of the evaluation performed in 1990. Therefore, the condition was not evaluated further in the RB3 corrective action program.

It is concluded that an apparent cause of this non-recognition was the prevalent paradigm that control air pressure was needed to shut down the diesel generator and to provide monitoring of the diesel operating parameters while in operation (but was not needed for continuing operation of the disel). It should be noted that this paradigm is consistent with what is understood to be the design intent of the diesel generators. This design intent was reinforced through training of the operators, through procedure changes, and through the understanding that the original diesel design intent did not require safety-related compressors. ,

Corrective Steps That Have Been Taken and the Results Achieved The following actions were taken as a result of this condition:

• A condition report was written on June 24,1998.

e Lessons learned from this event were presented in Engineering Support Personnel Training in the Fall 1998 session.

• There has been heightened attention and sensitivity to USAR licensing and design  ;

basis issues at River Bend Station in recent years as a result ofindustry experience.

In addition, since 1990, the RUS Corrective Action Program has substantially improved.

Problem identifict. tion and corrective action continue to be a focus of RBS management and personnel.

, -. . . - ~- . - -- - . .-

ENCLOSURE 3

- - Page 3 of 4 These actions ensure that the RBS corrective action program is adequate for identifying and resolving equipment operability issues.

Corrective Actions to Avoid Further Violations No further corrective actions are necessary.

Date When Full Compliance was Achieved Compliance was achieved on June 24,1998, when the condition was identified in accordance with the corrective action program.

Credit for Identification of the Candition As part of our thorough investigation of the condition in 1998, EOI self-identified ,

documentation that indicated a potential prior opportunity to discover the condition in l 1990. This documentation revealed that our engineers were aware of the design feature of the non-essential trips to be "unbypassed" if air pressure fell below 120 psig.

Apparently, the engineers did not recognize the significance of the design condition.

Accordingly, while not denying the violation, we believe that self-identification should have been credited. On this premise, EOI requests reconsideration of the civil penalty.

As discussed with the NRC in the predecisional enforcement conference on November  ;

23,1998, and in a subsequent telephone conference on December 11,1998, EOI believes  !

I that the condition was an original design error in the diesel generator control logic that allowed a diesel trip on loss.of air when operating in the emergency mode. This design is contrary to the original design requirements that the emergency diesel generators would I perform their safety function, once operating, without control air. After our identification i of this old design error, the diesel vendor msued a 10 CFR Part 21 notification and a logic modification was performed at RBS to correct the condition.

In this case, RBS identified the greater significance of the problem during our extensive reviews of the historical aspects of the diesel design and operation. Since 1990, problem identification at RBS has dramatically impmved, especially as a focus area after EOl began operating RBS in 1994. We strongly believe that earlier failures to identify the old design error do not represent the current culture for problem identification at RBS. When j the significance of the design error was identified in 1998, one of the same engineers who was aware of the non-essential trip design feature in 1990 notified supervision and a condition report was promptly initiated. Prior to this point-in-time, he did not recognize the significance of the design feature. RBS initiated a thorough investigation that included an independent assessment of potential prior opportunities to identify the design

._ _. _. ... _ _ .. _ _.--._ __ _ ._.. _ ..--. _ _ ... . _ _.~. . .___ _. _ ... _ ..m. _

ENCLOSURE 3 Page 4 of 4 -

l I .

error. Our assessment discovered that an overwhelming paradigm influenced by training, l design, and procedures, masked the significance of the known design feature. This is l suppcrted by the original diesel design requirement to perform its safety function without support of a safety-related control air makeup supply.

' The condition analysis performed by engineering in 1990, for the change in the diesel lockout setpoint, recognized the potential for the trips to be "unbypassed" upon a loss of air pressure during a diesel start. The secondary effect was not viewed as significant -

l when considering the loss of air during standby conditions. Since the primary function of

j. the lockout feature blocked the diesel from an emergency start, reinstatement of the non-emergency trips would not be relevant to the condition being analyzed in 1990. These various factors contributed to the paradigm from 1990 until discovery of the old design errorin 1998.

l RBS concludes that the failure to document and evaluate the known condition cannot be l separated from the prevalent thinking that existed from 1990 up to discovery of the old j desigr. error in June of 1998. The RBS assessment self-identified the engineering document which stated the engineer's knowledge of the desig- feature and the prevalent l ';

i paradigm which existed regarding this issue. Therefore, self-identification credit should l - be granted and a civil penalty should not be assessed for the corrective action violation.

j Supporting this are the extensive improvements in the corrective action and problem

! identification program since 1990 at RBS. These significant program improvements negate the need for impsition of a civil penalty as delineated in the NRC's enforcement '

policy (NUREG-1600).

i e

5 d

2 T m +1 wt w- -.s r m -

z-

_ _ - -. _. _ __ . _. _ __ _ .m . _ _ _ . _ _ _ _ _

ENCLOSURE 4 Communication Clarifications e The NRC's cover letter for the enforcement action indicates that it believes that its Inspectors encouraged operator dry runs to install bottled air. EOl's information indicates that the dry run was an RBS initiative. (See NRC letter EA 98-478, Feb.1, 1999,pg.2).

. The NOV cover letter used the dry run time of five hours as indicative of how long it would have taken an operator to supply air to the diesel control system in an j emergency. It was not the intention of this dry run to demonstrate how quickly the 1 operator could have installed compressed air bottles in an emergency. Therefore, the time is not reflective of the time that would be required to supply air to a diesel in an j emergency. (See NRC letter EA 98-478, Feb.1,1999, pg. 2). j

• Information Notice 98-41, " Spurious Shutdown of Emergency Diesel Generators l from Design Oversight," dated November 20,1998, was issued just prior to the " pre-decisional" enforcement conference. Issuance following the predecisional  ;

enforcement conference could have ensured a more current description of the condition, the facts, and the lessons learned.

Safety and Risk Considerations ,

i The NRC has acknowledged the low risk significance of the condition because the i initiating event is oflow probability. The following points are provided for clarification:

• Even with no operator action to provide air, the diesel would have functioned for the most significant period of an event. This fact has a substantial effect on minimizing risk significance and also extends the time available to obtain and supply air if l necessary. (See the EOI safety significan<.e evaluation presentation November 23, l 1998). i e Operators are alerted by an annunciator upon a decreasing control air pressure.

• Redundancies exist in both the diesel generators and their a:sociated control air i supply limiting the effect of a single air leak. Each of the two diesel generators is equipped with a forward and a rear starting and control air system.

,