IR 05000219/1988202

SSOMI Rept 50-219/88-202 on 881017-20 & 1031-1104.Major Areas Inspected:Detailed Design & Engineering Required to Support Mods Implemented During Outage.Weakness Noted Re Design Input for HVAC Sys Heat Loads

ML20235H808
Person / Time
Site:	Oyster Creek
Issue date:	02/01/1989
From:	Gutherie S, Haughney C, Imbro E Office of Nuclear Reactor Regulation
To:
Shared Package
ML20235H802	List: IR 05000219/1988202 ML20235H799
References
50-219-88-202, NUDOCS 8902240058
Download: ML20235H808 (55)

Text

.

-

- - - , - - - . - _ _ _ - - - - - - - _ - . - _- - - - - - - - - - - - - - . . . - _ _ . - - - - - . . - - - - - . - - _ - - - -

. .

'

,

U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION Division of Reactor Inspection and Safeguards Report No.: 50-219/88-202 Docket No.: 50-219

, Licensee: General Public Utilities Nuclear Corporation (GPUN)

Facility: Oyster Creek Nuclear Generating Station (OCNGS)'

Inspection At: GPU Nuclear Engineering Offices Parsippany, New Jersey Inspection Conducted: October 17 through 20 and October 31 through November 4, 1988 Inspection. Team Members:

Team Leader: S.C. Guthrie, RSIB, NRR Mechanical Systems: S.M. Klein, Consultant, WESTEC Services Instrumentation 8: R.L. Gura, Consultant WESTEC Services Control Electrical Power: W.G. Drumond, Consultant, WESTEC Services Mechanical Components: A.V. DuBouchet, Consultant Electrical Power /

Instrumentation and Control S. V. Athavale, NRR, RSIB dc4s thrie, Team Leader jp 27, s ffj Date Sig6ed Stephen Reactor pecial Inspection Branch, NRR  !

Reviewed by: YM #'[7[O D(te Signed E.V. Imbro, Chief Team Inspection Section 2 Special Inspection Branch, NRR Approved by: 9ANf Date ' Signed arles J. Haughney,' Chief Special Inspection Branch, NRR 8902240058 890217 DR ADOCK0500g9

-- -- ____ -

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _

s =

-

. .

.

'

SUMMARY 1.1 Background and Purpose 1.1.1 Background

_

The Nuclear Regulatory Commission (NRC) initiated the Safety System Outage Modification Inspection (SSOMI) Program in 1985. This program generally consists of two team inspection activities (1) an outage design inspection ,

to evaluate planned design changes and modifications against regulatory l requirements and licensee commitments; and (2) a pre-operations readiness inspection to ensure plant readiness for startup through review of licensee

~

controls, inspection of turnover package closecuts, verification walkdowns of installed systems, and witness of selected in-process testin This report describes the activities and findings associated with the first portion of this inspection - the outage design inspection of the Oyster-CreekNuclearGeneratingStation(OCNGS).

Some of .the items identified by the team may be potential enforcement findings. Region I will identify and execute any required enforcement action i 1.1.2 Purpose The purpose of this phase of the SSOMI Program was to examine, on a sampling basis, the detailed design and engineering required to support plant modifi-cations planned during the current (Cycle-12R) refueling outage. This assessment addressed the technical adequacy of modifications to ensure that the' plant has not violated any licensing commitments or regulatory require-ments by installating the modifications. In addition, the assessment addressed the effectiveness of design controls for modifications planned during the outage. Appendix B contains a complete list of all modification packages reviewed by the tea .2 Inspection Effort and Report Organization 1, Inspection Effort NRC personnel conducted the inspection, with contractor assistance, at the licensee's engineering offices in Parsippany, New Jersey, during October 17 through 20 and October 31 through November 4, 198 Inspection team members

-

made site visits to the Oyster Creek facility on October 21 and November 3, 1988. Selected team members provided technical expertise and experience in each of the engineering disciplines evaluated during the inspectio Inspection activities concluded on November 4,1988, with an exit interview held at the licensee's engineering offices, attended by those persons noted in Appendix A.

,

.

-1-

_ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ -

E t

a s

,

.. .

-

>

}

<

The SSOMI design inspection primarily emphasized reviewing the adequacy of (

'

design details or products as a means of measuring how well the design 1 process had functioned in the selected sampling area. In reviewing design j

. details, the team focused on the following items,

' Validity of design inputs and assumptions Validity of design specifications- Validity of analyses Identification of system interface requirements Potential indirect effects of changes Proper classification of components Effectiveness of control and drawing control procedures i Application of design information transferred between organizations Methods of design verification

' The team inspected four engineering disciplines within the scope of the project: mechanical systems, electrical power, mechanical components, and l instrumentation and contro . Report Organization )

This inspection report is organized to present the team's findings in ,!

different forsats for use by different groups of readers with varied inter-ests and responsibilities. Section 1.3 provides an overview of the team's j activities and a sumary of major findings organized by disciplin !

Sections 2 and 3 analyze the effectiveness of the licensee's design effort in terms of strengths and weaknesses, addressing the applicable inspection criteria 1isted in section 1. Three appendices are attached to the body of the report. Appendix A lists personnel contacted during the inspection, and Appendix B lists all modifica-tions reviewed. Appendix C lists specific deficiencies, organized by disci-pline and documented in detail to aid in resolutio .3 Sunnary of Inspections Activities and Findings by Discipline 1.3.1 Mechanical Systems Discipline ,

In the area of mechanical systems, the team reviewed documentation support-ing a number of modifications being implemented during the Cycle 12R refuel-ing outage. Specifically, the team reviewed the following modifications in detai ' Addition of a new independent heating, ventilation, and air conditioning '

(HVAC) system to the-control room envelop Modification of the standby liquid control system (SLCS) to comply with 10 CFR 50.62 (ATWS Rule) by increasing boron B-10 enrichment and the minimum concentration of sodium pentaborat Relocation of the open indication light on a number of motor-operated valves to another switch and rotor, and adjustment to turn off the open indication light when the valve is 97 percent to 99 percent close Replacement of 17 control rods with a new, extended-life control ro l-2-

i a

. .

.

In general, the team found the documentation associated with these modifica-tions to be. comprehensive and detailed. For example, analyses related to the determination of minimum boron-10 enrichment and concentration was clear, detailed, and able to be followed without recourse to the autho In the review of other modifications, however, the team identified a number of weaknesses. The modification to add an additional HVAC system to the control. room envelope, for example, was an extensive modification to address control room habitability requirements in response to NUREG-0737. The team identified a number of design input inadequacies in the design analyses which were performed to support t.he capability of the existing HVAC system to meet design requirements. These design analyses were also applicable to the performance of the new HVAC system. The team found that the development of control room heat loads during a loss of offsite power (L009) was not adequately documented and may not be conservative. These inadequacies engender the possibility that control room temperatures might exceed allow-able equipment and instrumentation qualification limits. The HVAC issue is related to the issue of a fully loaded diesel generator bus, which encompases the need to remove loads from the bus during a simultaneous LOCA and LOOP before adding control room ventilation and air conditioning loads. Other aspects of the HVAC issue include control room habitability effects that arise due to the fact that control room HVAC may not be available during the initial stage of the postulated LOOP /LOCA scenario and procedures require operators to open control room doors on loss of HVA The team also identified a weakness in the control of design changes related to core consumables (including control rods, control rod drives, and new fuel) which were initiatod outside the scope of plant modifications and developed without benefit of procedural control .3.2 Electrical Power Discipline The team reviewed the following outage modification packages related to the electrical distribution syste Diesel maintenance improvements Motor-operated valve rewiring changes GE-AK-2 480-V substation circuit breaker trip unit replacement Relay replacements

. Addition of a new independent control room HVAC system, which involved analysis of:

(1) Diesel generator loading (2) Electrical coordination (3) Emergency bus loading (4) System short circuiting-3-

i *

'

. ..

Each modification package was complete and contained all the necessary documentatio During the team's. inspection of the electrical power aspects of the proposed modifications the team reviewed the diesel generator loading and found that the diesel generator had very little margin for load growth. In fact, the generator was loaded to 98 percent of its 10 percent overload. rating. The-team found that the operators were relied upon to take appropriate action to maintain acceptable diesel loading. Despite that responsibility..the team found that the operating procedures did not provide specific engineering guidance related to loading requirements for manually or automatically started concurrentloads withthat may a loss of be removed offsite power during(a losseffect LOOP). The of coolant accident of random loads(LOCA)

on diesel generator bus voltage had not been thoroughly addressed, and no formal program existed to monitor load growth on the class IE buse The team also found that during the biweekly operability surveillance test, .

the diesel was loaded above the manufacturer's recommended overload rating of 2750 kW. The team was concerned that exceeding the manufacturer's recom-mended overload rating could degrade the capability of the diesel generator .

to perform its safety functio .3.3 Mechanical Components Discipline The objective of the mechanical components inspection was to confirm that the effects of plant modifications on the design of pressure retaining components and equipment supports was properly accounted for in accordance with regulatory requirements and licensee comitments. To accomplish this objective, the team reviewed the following modification packages and one calculation which the licensee prepared to close out a licensee event report (LER). Seismic considerations for pipe support and supplementary steel stress allowables requalified using new seismic criteri Mechanical component replacement in torus-to-drywell vacuum breaker Seismic qualification of buried emergency service water pipe subject to long term monitoring following removal of corrosion-protective linin Validity of seismic criteria for hangers, anchors, and supports associated with the modification to remove corrosion-protective lining

-

from ESW pipin Seismic analysis of a new CRD handling attachment to control rod drives.

l Qualification of piping modification to containment particulate monitor.

l Seismic analysis of containment spray piping found to have documentation deficiencies associated with the 79-14 and 70-02 program which required ,

'

qualification of piping and support ' Adequacy of supports and support spacing for containment spray heat exchangers and small bore piping, and base plate qualification associated with modifications on heat exchangers and related pipin _ _ - _ _ - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _

_ _ _ - - _ _ _ .__ _

i +

,

. .

. Qualification of nuclear safety-related piping potentially subject to harsh environmental temperatures to resolve deficiencies identified in an NRC audit of the licensee's 79-14 progra GPUN used upset stress allowables to requalify some pipe supports and supplementary steel. The team found that these allowables were substantially higher than the upset stress allowables permitted by ANSI /ASME B31.1, " Power Piping, 1983, the piping code of record for DCNGS. In addition, the team found that the licensee's vendor who perfomed the seismic qualification of the buried emergency service water (ESW) yard piping also used an upset stress allowable that was substantially higher than the upset stress allowable specified for the ESW piping in the piping code of recor The team identified inaccuracies or omissions in calculations by the licensee and its vendors that indicated a lack of design interface control and inadequate design verification. Typically, seismic evaluations failed to consider the vertical component of the safe shutdown earthquake, as in the case of a new handling mechanism added to control rod drives. In the case of small bore nuclear safety-related (NSR) piping, supports appear to have been installed to seismic criteria less stringent than that committed to in the Final Safety Analysis Report (FSAR).

From its review of the design attributes associated with modifications in the mechanical components discipline, the team identified several items of potential generic concern at OCNGS. First, the licensee may not have adequately confirmed that NSR small-bore pipe was installed in accordance with the stress requirements of the piping code of record for OCNGS. Second, NSR piping outside the reactor building may originally have been installed to less stringent seismic criteria than current FSAP. seismic criteria. Third, the licensee may not have evaluated the effect of thermal stresses in NSR piping produced by elevated temperatures following an acciden . Instrumentation and Control Discipline The team reviewed the following four instrumentation and control design modification Pressure switch replacement Mechanical pressure switch upgrade to analog loops Upgrade of the torus bulk temperature monitoring system

~ Expansion of the control room HVAC system In the instrumentation and control area, the team found that the licensee's design change process generally resulted in a complete modification packeg Contributing factors appeared to be the thoroughness of modification design descriptions and the effectiveness of preliminary engineering design review The licensee's process for controlling and checking drawings also appeared to be effective. The few discrepancies which the team found in drawings had already been identified by the licensee and were being or had been resolve _ - _ _ _ _ _ _ _ _ _ _ _ _ _ -

_ _ _ _ - _ _ _ _ _ _ _

t- e

'

. ,

e By contrast, the team observed some weaknesses in the design verification of calculations and internal design interface control. For example, in a modification to replace mechanical switches with analog loops, the team found that setpoint overlap due to errors in analog loop accuracy could cause a trip sequence which was contrary to the design basis and which could put the plant in an unanalyzed condition. Moreover, deficiencies in the licensee's approach to setpoint calculation and field calibration practices created the potential for a process variable to exceed the Technical Specification limit without being detecte The team identified discrepancies in adherence to procedural requirements that specified the documents to be revised as a result of recommendations in a technical document report. In addition, the team found a lack of design interface between the engineering and licensing groups. For example, an engineering safety evaluation took credit for revisions to the plant Techni-cal Specifications. However, these changes had not been processed by the licensing group and were not yet approve . INSPECTION FINDINGS INDICATIVE OF LICENSEE WEAKNESSES 2.1 Control of Design Input Design activities should be accomplished to ensure that (1) design inputs are correct and used appropriately, (2) the design is traceable from design input through to design output (i e., sources of design input identified),

and (3) assumptions are documented. The inspection team evaluated the quality of design inputs and assumptions during its review of safety evalua-tions and calculations asrociated with modifications. Through this evalua-tion, the team identified weaknesses including (1) inadequate verification and substantiation of design input. (2) failure to identify the source of ,

design input, (3) failure to justify the use of assumptions, (4) use of nonconservative design basis input, and (5) inadequate design verificatio The following subsections describe examples of these weaknesse .1.1 Weaknesses in Design Input for HVAC System Heat Loads During the Cycle 12R refueling outage, the licensee was implementing the addition of a new independent HVAC system to the control room envelope. The intent of this modification was to fulfill GPUN commitments arising from NUREG-0737, Control Room Habitabil.ity. The team reviewed this modification in detail, and found that the design analysis contained weaknesses in design

,

input used to establish heat loads imposed on the HVAC syste The team found that an inadequate basis was used for heat loads used as input to the design analysis intended to establish control room temperatures during a LOOP. (Reference Appendix C, Deficiency A-2.) Failure to control the design input resulted in conflicting estimates of the rate of temperature rise in the control room, and conflicting estimates of the maximum tempera-tures at which equipment could continue to perform its safety functio Design input did not address test results indicating that actual air flow rates are 15 percent below design estimates, or whether the design outdoor ambient temperature reflects the conservatism necessary to ensure that maximum control room temperatures would not be exceeded during periods of fan-only operatio _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _

i .

,

. .

.

-

Although neither the existing control room HVAC system nor the new system were safety-related, these observations were safety significant. The obserystions contributed to the team's following concerns, The capability of control room electrical equipment and instrumentation required to monitor the course of an accident may be compromised during a coincident LOOP due to elevated temperatures in the control roo GPUN's commitments to NRC requirements arising from NUREG-0737 may not be satisfie The analyses reviewed were performed to substantiate the design of the existing HVAC system. However, since the design requirements were the same for the new system, results were presumed applicable for the modified design and were used in that fashion. It did not appear that GPUN revisited the analyses previously performed for the existing system to ensure that they were adequate to substantiate the design of the modified syste .1.2 Inadequate Seismic Design Criteria GPUN had incorporated into its design specifications (for its own use and that of its vendors) seismic design criteria which did not meet FSAR licens-ing conrnitment (Reference Appendix C, Deficiency D-1.)

Two such design specifications were GPUN Specification No. ES-014. " Piping Design Standard for Three Mile Island Unit I and OCNGS," Revision 0, dated August 15, 1986, and GPUN Specification No. ES-022. " Seismic Criteria,"

Revision 5, dated October 10, 1988. Both of these design spec m cations permit the use of higher damping values than the 0.5 percent damping which FSAR Table 3.7-2 specifies for the analysis of NSR piping. Likewise, as stated previously, the upset stress allowables used by the licensee to requalify some pipe supports and supplementary steel exceeded the allowables permitted by ANSI /ASME B31.1, " Power Piping, 1983, the piping code of record for OCNG .1.3 Inadequate Design Input for NPSH Determir.ation The licensee used inadequate design input to determine net positive suction

,

head (NPSH) available to core spray pump (Reference Appendix C, Deficiency l

.

A-4.)

A recent Safety System Functional Inspection (SSFI) conducted by the NRC at Nine Mile Point 1 Nuclear Generating Station identified weaknesses in the design analysis performed for the core spray system. Since the design of Nine Mile Point 1 is similar to that of OCNGS, the team performed a limited review of the OCNGS's design analysis for the core spray system. The purpose of this ifr/itG review was to determine whether similar weaknesses exist in the design ci lae core spray system at OCNGS. At Nine Mile Point 1, the following weaknesses, among others, were identifie ' No consideration was given to the pressure drop ecross the torus strainers in the determination of available NPSH for the core spray pum f

i

_ - - _ __ __-_ ___._ _ _ _ _ _ - _ _

v .

,

• *

. 1 l The determination of system resistance curves did not account for all !

components in the syste The team found indications that similar weaknesses may exist in analyses performed for the OCNGS core spray system; however, adequate design margins existed to compensate for the unsubstantiated assumptions in the analyse For example, a GPUN calculation completed to detemine NPSH available to the core spray pumps during a postulated LOCA did not provide adequate substan-t1ation for the assuned strainer pressure drop. A second calculation did not provide adequate substantiation of assumed vessel sparger leakage. This calculation deterinined core spray pump performance during an accident, assuming the single failure of the backup booster pump, after tripping the  !

primary booster pump. Additional sparger leakage could result in under-estimating pump runout flow on which NPSH is base Neither of these observations was considered by the team to be safety significan In the first case, the licensee indicated that preliminary calculations suggest that the strainer drop is less than assumed. In the second case, adequate margin exists in the runout flow used to determine NPSH available to the core spray pump . Inadequate Verification of Assumptions The team identified examples in which unverified assumptions contributed to calculational errors, and found that the licensee lacked a program to verify theGPU for assumptions usedAppendix (Reference by architectural engineering)

C, Deficiency E- companies Typical performing unverified work assumptions included accuracy of instrument calibration, validity of arbitrarily assigned values for instrument loop uncertainty used as a safety margin between the allowable upper setpoint limit and the setpuint specified in the Technical Specifications, and the soundness of assumptions related to power supply voltage fluctuatio .2 Design Interface Control Design activities should be such that (1) design information between exter-nal design organizations is documented in specifications, drawings, or other controlled documents; (2) design information between internal design organ-izational units identifies incomplete items which require further action, evaluation, or review; and (3) interface information is reviewed and approved, consistent with its int' ended use, by a responsible design organiza-tion. The team reviewed design details of modification packages in order to

, examine the effectiveness of the licensee's interface control mechanisms and found weaknesses in the implementation of controls associated with internal and external organization The team found that, in some cases, vendor interfaces and internal organiza-tional interfaces were not adequately controlled. The team also identified a weakness in the operating procedure for the emergency diesel generator which ,

arose from a lack of sufficient operator guidance related to adding electri-cal loads to the Class 1E buses following a simultaneous LOCA and LOO The licensee was also deficient in incorporating the results of technical document reports into affected modification design descriptions. Finally, the team discovered that a safety evaluation tock credit for proposed l-s_

- _ _ _ - -

r >

,

. ..

revisions to plant Technical Specifications which had not actually been mad :The following subsections describe representative examples of weaknesses in-design interface contro . Insufficient Operator Guidance for Diesel Generator Loading-The team identified a deficiency related to insufficient guidance provided to reactor operators. A postulated LOCA coincident with a LOOP could poten-tially overload the diesel generator. Operators, however, had no available information or guidance to help avoid this possiblity other than the control room KW mete The inspection team reviewed the licensee's diesel generator loading to assess-the impact on diesel capacity of. adding control room HVAC load The calculations showed that, during a postulated LOCA concurrent with a LOOP, diesel generator No. 2 would be loaded to 2703 KW, and assumed diesel 9enerator No. I would be inoperable. Comparing the calculated diesel loading from automatically started loads with the diesel generator rate capacity demonstrated that the diesel was of adequate capacity, but had almost no margin. The 2703 KW (worst-case loading) was 98 percent of the diesel overload rating, 2750 KW. The calculation did not consider the possible manual addition of electrical loads (e.g., air compressors, battery charger, fire pond pump, or control room HVAC and other ventilation systems) in the load tabulation, nor did it contain a load profile. Therefore, the team could not ascertain when manual loads could be a'dded to the diesel without exceeding its overload ratin ,

The engineering staff conter.ded that manual loads are not added to the diesel during the first half-hour of a LOCA concurrent with a LOOP. However, Station Operating Procedure 341, Revision 26 Section 3.4.6, instructed that, during a postulated LOCA concurrent with a LOOP and one diesel generator inoperable, the operator is permitted to manually add electrical loads after the automatic load sequencing has been completed. The procedure did not provide any guidance related to the load (s) that should be added or secured to ensure that the diesel was not overloaded. The team was concerned that without specific operator guidance on automatically started loads that may be secured and manual loads that may be added, the diesel could become over-loaded. This could degrade the voltage of safety-related buses and prevent safety-related equipment from perfonning their intended function. This lack of guidance reflected a breakdown in the licensee's design interface control process with respect to translation of engineering requirements into plant operating procedure .

The licensee agreed to revise the Emergency Diesel Generator Operating Procedure to include a list of loads that may be removed and manual loads that can be added to avoid overloading the diesel generator. Specific guidance will be provided to ensure that the diesel generator is not over-loade .2.2 Violation of Manufacturer-Recommended Diesel Overload Rating

'

The team found evidence of diesel generator overloading during surveillance testing. (Reference Appendix C, Deficiency C-2.) The team reviewed biweekly Surveillance Testing Procedure No. 636.4.003 (Revision 31) for the diesel generator. Test Numbers 1036 and 1040 showed that the diesel generator was I'

-g-

e .

,

. .

loaded above its 10 percent overload rating of 2750 KW during surveillance testing. The surveillance test was used to demonstrate that the diesel can operate at a load level associated with emergency standby desig The surveillance procedure required the diesel to be tested 50 KW above the overload rating. The acceptance criteria specified any loading above 2700 KW (for one hour), with no restriction on maximum loading. However, the team reviewed a letter from the manufacturer (dated June 26,1985) concerning the diesel loading which states that GPUN must bear the responsibility for operating above the overload rating of 2750 KW. The manufacturer also declined to consider a short time rating of 2850 KW. The manufacturer stated that operation at 2850 KW would require a shortened maintenance interval, but that the power pack life may be shortened by 50 percent. The team expressed concern that exceeding the manufacturer's reconnended overload rating may, over time, degrade the capability of the diesel generator to perform its safety functio .2.3 Discrepant Seismic Qualification Criteria The licensee did not specify the piping code of record for OCNGS to the vendor who performed the seismic qualification of the buried ESW yard pipin (Reference Appendix C, Deficiency D-3.) The vendor's 1979 report summarizing the calculation used in this qualification indicated that the calculation used an upset allowable stress of 48 ksi for the ASTM A-53 grade carbon steel ESW piping, based on ASME Section NB allowables. However, ASME/ ANSI B31.1-1983 Edition, which FSAR Section 3.7.3.2 specified as the piping code of record for OCNGS, only permitted an upset allowable stress of 14.4 ksi (1.2 x 12 ksi) for A-53 carbon steel pipe, less than one-third of the upset allowabic stress used in the vendor calculation. FSAR Section 3.7.3.2, Analytical Procedures for Piping, specified:

"All Class 1 (seismic) piping system configurations must satisfy the design stress requirements and allowables specified by ANSI B31.1-1983 Edition through Winter 1984 Addenda."

2.2.4 Failure to Revise Technical Specifications The team found that the licensee failed to revise Technical Specifications to reflect an upgraded accident monitoring system as specified in a safety evaluation. (Reference Appendix C, Deficiency B-2.) The modification to install a new suppression pool temperature monitoring system was expected to

- permit more accurate calculation of suppression pool bulk temperature and to provide the operator with improved capability to monitor containment integrity. The suppression pool temperature monitoring system was designed to nieet the criteria specified in NUREG-0661, Appendix A, and USNRC Regulatory Guide 1.97, Revision 2. The suppression pool temperature has been designated as a Regulatory Guide 1.97 Type A variable for OCNG The licensee's safety evaluation, SE 402256-003 Revision 0, Suppression Pool temperature Monitoring System, Sections 2.6 and 2.7, stated that an amendment was required to the plant Technical Specification Sections 3.13 and 3.14, concerning accident monitoring instrumentation operating status and surveil-lance requirement Hcwever, the team was informed that an update of the Technical Specification will not be made to reflect this modification,

.

l pending resolution of issues regarding requirements for listing Regulatory-10-

_ _ _ _ - _ - _ - _ _ _ _ -

_ _ - _ _ _ _ _ ___ _ _ _ _ _ _ _ _ _ . _ _ _

. .

,

. .

Guide 1.97,. Type A variables in the Technical Specifications. This is an item of discussion between the Boiling Water Reactor Owners Group (BWROG) and the Office of Nuclear Reactor Regulation. The Safety Evaluation, SE 402256-003, Revision 0, continued to assume that the plant Technical Specification, Sections 3.13 and 3.14 had been update .2.5 Deficient Incorporation of Technical Report Results in Design Description During review of the torus temperature modification, the team detemined that the licensee failed to follow procedures which would ensure that recom-mendations concerning(design would be addresse Reference information Appendix C, developed Deficiency B-3.) in a technical report

' Modification BA 402256 installs a new suppression pool (torus) temperature monitoring system. Algorithms which model the torus temperature distribu-tion use the inputs from resistance temperature detectors (RTDs) to predict the torus bulk temperature. Technical Data Report (TDR) 934 evaluated the effect of RTD thermal lag on the torus temperature monitoring system algo-rithms and concluded that, although the results were acceptable, the algo-rithm under-predicted the bulk temperature by a larger margin than originally calculated. The TDR recomended that, Modification Design Description MDD-0C-644A, Division I and II, be revised to account for this difference when determining allowable setpoint accuracies. According to GPUN procedure EP-001, Technical Function Task Requests should be issued to track recomen-dations made in the TDR, and the follow-up item number assigned must be noted on the cover sheet of the TDR. The Technical Function Task Requests were not issued. This deficiency has potential safety significance in that the wrong setpoints might be developed for the torus temperature high and high-high temperature alarms. The plant Technical Specifications required specific manual operator action when these alarm setpoints were exceede Incorrect setpoints could cause the Technical Specification limits to be exceeded during operatio .3 Design Verification Design verification is the process of reviewing, confirming, or substantial-ing the design by one or more methods. When design reviews are used as the method of verification, the objective is to evaluate whether: (1) the inputs are correctly selected and incorporated in the design; (2) applicable codes, standards, and regulatory requirements are satisfied; (3) an appropriate design method is used; and (4) the design is suitable for the applicatio . During the inspection, the team assessed the quality of design verifications through the review of modification package details. This assessment revealed a weakness in the implementation of the design verification process which suggests a need for greater attention to detail. Errors included: (1)

failure to satisfy licensing commitments; (2) failure to ensure that an appropriate design method was used; (3) computational errors; and (4) failure to ensure that specified parts and equipment are suitable for the required application. The following subsections describe examples which demonstrate areas of weakness in the licensee's design verification proces _ _ _ _ _ _ _ _ _ _ .

. .

,

. .

2. Failure to Satisfy Licensing Comittments The team determined that the licensee had not requalified some surface-mounted base plates to the required NRC IE Bulletin (IEB) 79-02 criteri (Reference Appendix C, Deficiency D-9.) In response to that bulletin, the licensee was recualifying nonsafety-related (NSR) surface-mounted base plates restrained by anchor bolts. However, the team noted that the licensee was not verifying the adequacy of 2-bolt base plates subject to " weak axis" bending in accordance with the requirements of the bulletin and GPUN Specifi-cation No. SP-1302-12-212. "1985 IE Bulletin 79-02/14 Inspection Program Design Input for Piping Support Analysis." The licensee's program included checking the anchor bolt shear loads for these base plates, but not the anchor bolt tension loads or the effects of the interaction between shear tension. ESW system pipe supports SW-2-H2, SW-2-HB, and SW-2-H10 were examples of pipe support configurations with anchor bolts for 2-bolt base plates subject to " weak axis" bending which were not properly qualified to the specified anchor bolt acceptance criteria. The team considers this to be a safety-significant issu .3.2 Failure to Ensure Use of Appropriate Design Method The team determined that instrument setpoints did not meet design criteria in one reviewed modification in which several sets of mechanical pressure switches were replaced with analog loops to monitor reactor vessel pressur (Reference Appendix C, Deficiency B-1.) Analog loops RE03A through RE030 provided inputs to the Reactor Protection System (RPS) relay logic to scram the reactor when their pressure setpoints were exceeded. Similarly, analog loops REISA through RE150 provided inputs to the Engineered Safeguards Actuation System (ESAS) to trip the recirculation pumps and initiate isola-tion condenser operation when their pressure setpoints were exceede Section 4.8.3.3 of the modification design specified that the RE03 analog loop for reactor vessel pressure should actuate before the RE15 analog loo In addition, the Safety Evaluation for the modification also stated that "the existing condition where the RE03 setpoints are set below the RE15 setpoints is continued in the new analog loops."

The team found, however, that, under certain conditions, the RE15 analog loop could actuate before the RE03 analog loop due to overlapping of the set-points. This would occur when the RE15 analog loop has a negative loop accuracy error and the RE03 analog loop has a positive loop accuracy erro A trip of the recirculation pumps and initiation of the isolation condenser operation before a reactor trip would put the plant in an unanalyzed conditio . Failure to Verify Calculations The team found that the licensee failed to verify the calculation which a vendor performed for seismic qualification of the buried ESW yard pipin (Reference Appendix C, Deficiency D-3.) The vendor's report indicated that the calculation used an upset allowable stress of 48 ksi based on ASME Section NB allowables, although ANSI /ASME B31.1-1983, the piping code of record for OChGS, only pennits the use of an upset allowable stress of 1 ksi. Moreover, a review of the totc1 stresses summarized at eight locations for each of the two L-shaped segments of 14-inch diameter ESW pipe indicated-12-i

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .

. .

,

i

. .

,

~

that the piping was consistently overstressed with respect to the permissible upset allowable stress of 14.4 ksi. The total stresses sucinarized in the report varied from a low of 14.56 ksi to a high of 62.52 ks . Inadequate Seismic Oua11fication of Buried ESW Pipe The team determined that nuclear safety-related piping outside of the reactor building was originally installed to less stringent seismic criteria than current FSAR seismic criteria. (Reference Appendix C, Deficiency D-4.) The piping specification which detailed the design and installation criteria for large and small-bore piping outside of the reactor building stipulated a horizontal seismic design load of 0.05 g's and no vertical earthquake loa By contrast, the FSAR specified a maximum ground acceleration of 0.22 g for the safe shutdown earthquake (SSE) and required simultaneous consideration of a vertical SSE component equal to two-thirds of the horizontal componen .3.5 Computational Erro_rs The team identified several calculations prepared either by the licensee or by vendors which were incomplete or which contained inaccuracies. The following par cgraphs provide examples of these error The seismic evaluation of the new control rod drive (CRD) handling mechanism failed to implement the seismic criteria that the licensee provided to the vendor. The seismic evaluation that the vendor per-formed was required to demonstrate the structural integrity of the new CRD handling mechanism during a SSE (Reference Appendix C, Deficiency D-5.) To facilitate the replacement of the Inoperative containment particulate monitor (CPM) panel, the licensee authorized a vendor to modify and requalify the existing valves and piping. However, the vendor's calculation did not requalify the anchor bolts for a typical pipe support to the revised loads. (Reference Appendix C, Deficiency D-6.) The licensee prepared a calculation for functional qualification of a U-bolt and lever arm attached to the torus-to-drywell vacuum breaker valve shaft. The sensing arm initiates an alarm in the control room on valve slarining. However, the calculation contained a number of omis-sions and inaccuracie (Reference Appendix C, Deficiency D-2.) The licensee obtained a vendor calculation to qualify the anchor bolts

'

which restrain containment spray heat exchangers 1-1 and 1-2. However, the team could not confinn the accuracy of the shear and tension stress allowables which the calculation used to qualify the support bolt (Reference Appendix C, Deficiency D-10.) The licensee's calculations failed to account for the effects of pump and motor acceleration time following thermal overload relay replacement on core spray purrp motors. With the possibility of longer accelera-tion tinies and low terminal voltage when fed from the heavily loaded diesel generator, the core spray pump could trip before reaching full rated speed. (Reference Appendix C, Deficiency E-2.)

-13-

_ _ _ _ _ _ - _ _

_ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

\

, ,

. .

,

While each of these issues was of limited imediate safety significance, the observations are indicative of weaknesses in the licens~e's e verification of design analyses performed for OCNG .4 Desion Modification Control The licensee's control of plant design modifications at OCNGS was administered by a series of procedures controlling the design and implementation of modifications affecting plant configuration. Procedural supervision was in effect for modifications initiated and performed by the plant engineering staff as well as by the Technical Functions Division. These supervisory practices also addressed expedited modifications known as " mini-mods."

However, for some design changes initiated by GPUN (Parsippany) that may not fall obviously into the categories of modification or mini-mod, the licensee lacked a governing procedure to control implementatio .e team also identified weaknesses in the control of design changes reiated to core consumaales such as control rods and core reload design changes. The follow-ing sections describe examples of the licensee's design modification control inadequacie . Inadequate Control of Replacement-in-Kind Design Chances The team reviewed documentation related to the replacement of 17 control rods developed by the GPUN corporate engineering staff in Parsippan Through this review, the team identified potential inadequacies in the licensee's control of replacement-in-kind design changes. (Reference Appendix C, Deficiency A-1.) Because the work was conducted as a

• 11ke-for-like" replacement it invoked no formal modification control procedur Although the design configuration of the new D-230 control rods was similar to the er.isting control rods, the team concluded that this replacement represented a substantial design change to the core configuration and was worthy of design control. Likewise, the reload core design and technical specification changes associated with the new GE8X8EB fuel were underway without formal procedural control. The team concluded that the lack of a procedure to control these types of changes represented a weakness in the licensee's design control. Further, the team found that this weakness provided the potential for inadequate control of organizational interfaces and required design documentation for these changes. For example, the licensee lacked a mechanism for input and review by training personnel or for initiation of required drawing changes, although a cursory check indicated

- that drawing changes had been mad Despite the absence of formal procedural control, the team identified no deficiencies in the licensee's review of these modifications. The licensee committed to issue a revised standard (Fuel Standard FS-5) addressing these issues for all core consumables. The licensee committed to use the draft revised standard in reviewing all projects implemented in the current Cycle 12R refueling outage. A final draft was scheduled for issuance by January 31, 198 . .

,

. .

, INSPECTI0h FINDINGS INDICATIVE OF LICENSEE STRENGTHS During the inspection, the team observed many in-process or completed engineering and design activities that were performed in a correct or consistent manne For example, the team found very few drawing errors, and, in all cases, the licensee had already corrected these errors or identified them for correction. The team also found the licensee engineering staff to be technically knowledgeable and experienced with the OCNGS facility. The following sections discuss detailed examples of licensee strength .1 Control of Design Input The team found that the licensee's Modification Design Descriptions (MDD)

contained detailed, comprehensive design requirements. These documents provided considerable design basis data used in the development of plant modifications, and, in general, adequate procedural control existed to ensure thorough preparation, review, and approval. The team found that the licensee issued the documents in two phases. A Division I document defined the criteria and was prepared during the conceptual design phase. A Division II document defined the actual design and was prepared during the detailed design phas In general, the team found that these documents provided a firm basis for developing and documenting the design of plant modifications. During the inspection, for example, the team extensively utilized the MDD (Division I and Division II, Preliminary) prepared for the addition of a new control room HVAC system. The team found that these documents provided considerable detail in identifying the scope; design requirements; modes of operation; specific structural, electrical, and mechanical requirements; and other design criteria essential to the development of the modification. While the team found the licensee's approach to and resolution of problems with control roem HVAC to be deficient in several respects, these documents were found to be detailed, well substantiated, and easily rea .2 Safety Evaluations The team found that Safety Evaluations prepared by the licensee for modifications were generally comprehensive and provided a documented basis for their conclusions. The team reviewed a number of Safety Evaluations prepared to satisfy 10 CFR 50.59 requirements for plant modifications scheduled for implementation during the Cycle 12R refueling outage. The team found these Safety Evaluations to be complete in addressing particular areas

-

of concern. For example, the Safety Evaluation (SE No. 323512-001, Revision 0) performed for relocating the open indication light switch on a number of motoroperatedvalvestoanotherrotorandswitch(Section2.1.4,above)

contained adequate documented basis for the stated conclusions. Detailed rationale and descriptions were provided to ensure that an unreviewed safety question did not exist as a result of the design chang .3 Programmatic Strengths The team concluded that the licensee was generally safety conscious and voluntarily invested in significant efforts to enhance plant safety. The following subsections describe relevant example _ - _ - _ - - - - _ - _ _ - _ _ - _ _ _ - _ .

. _ _ _ _ _ ___

,

.

.

o .

.

3.3.1 Configuration Management Program The team considered the licensee's configuration management program to be a positive step in GPUN's efforts to develop, maintain, and reconstitute design basis documentation for DCNG The team's review of a modification to relocate the open indication switch for a number of motor-operated valves to another rotor and switch illustrated the impact of the configuration manage-ment program. During this review, the team identified weaknesses related to

,

the lack of a documented design basis for maximum valve differential pressures. The licensee demonstrated to the team how efforts directed toward configuration management controls will eventually capture or reconstitute the design basis for these valves and other areas where sufficient documented design basis may be lacking. The team had the opportunity to meet with GPUN staff responsible for elements of this program. A brief review indicated that the program appeared comprehensive and included a number of sources of data including the Quality Classification List, Equipment Data Base, Environmental Qualification List, and Configuration Control List. Future enhancements were described, such as a licensing comitment tracking system which would cross reference other configura-tion nianagement related documents and reference .3.2 Safety System Functional Inspection Program The licensee had an ongoing program to conduct Safety System Functional Inspections (SSFIs). The team noted that GPUN has conducted two SSFIs (Heat ,

Sinks and the Diesel Generators) and has planned to conduct additional SSFIs. Although the team did not evaluate the two SSFIs, the team considered these inspections a positive means to identify potential weaknesses in the plant's safety systems in areas involving design, maintenance, and opera-tion .3.3 Document Retrievability and Drawing Content Considering the age of the facility, the team found that document retrievability was generally efficient. Drawings, in general, were current and contained the required cross references and notations defining safety classifications. As with most facilities of this age the team observed instances where the specific design data was available but the design basis was lackin .4 Design Interface Control Review of a number of modifications led the team to conclude that the licensee's design interface control has been generally effective. Various aspects of successful interface control were evidenced by the following examples, The licensee administered a program to mitigate the initiation and growth of intergranular stress corrosion cracking (IGSCC) through inspection and heat treating of selected reactor coolant system pipin The team found that this program incorporated the requirements of all applicable code and licensee specifications. The review also indicated that the appropriate vendor interface controls had been effectiv ______ -__ _ ___- - _ _ _ _

"

, .

'

. ,

,

'

) A modification to install a new independent control room HVAC system I i

specified the design loads for the roof structure supporting the mechanical equipment. A vendor's analysis confirmed the licensee's suspicion that the roof supports required reinforcement. Appropriate interface controls were evident in the revie During review of a modification to replace reactor head closure studs, nuts, and washers, the team sought to confirm the comparability of the geometry, material, and mechanical properties of the existing and replacement components. A review of purchase documentation for both sets of hardware indicated that the licensee had conducted a thorough ;

compariso The team sought to verify that the licensee had designed an adequate support for a reactor coolant sample line containing a containment isolation valve which was the subject of LER 88-007, dated May 11, 198 A review of the affected piping configuration for the required pressure, seismic loading, and thermal stresses substantiated the licensee's calculated results. The team concluded that the licensee's effort was sufficiently thorough to close the LE .5 Other Modifications Reviewed The team identified several modifications of potential safety significance which were found to have no apparent deficiencies. The team considered the sample group of modifications to represent a valid cross-section of modifica-tion packages prepared by the licensee. The generally high quality of these modification packages was considered a strength. A listing of the group of modification packages with no identified deficiencies, referenced by their individual licensee Budget Activity (EA) numbers for tracking purposes, follow Documentation and analyses supporting the use of enriched sodium pentaborate solution in the standby liquid control system (BA 328232).

Use of enriched baron satisfied the requirements of 10 CFR 50.62, paragraph (C)(4), addressing anticipated transient without scram (ATWS). Documentation and analyses to ensure electrical design basis is satisfied after replacement of circuit breaker trip units on existing GE AK-2 breakers installed on 480 volt substations (BA 32180P3). Replacement of mechanical pressure switches with upgraded pressure

. switches (BA 402879). Reactor Protection System and Emergency Safeguards Instrument Upgrade (BA 402879). HFA Relay Replacement (BA 23397). Replace Diesel Generator Control Relays (BA 23476P3).

l Limitorque Switch Replacement (BA 23512). General Electric Breaker Trip Unit Replacement (BA 328180P3).

-17-t_ __ _ _______

t

.- ..

,

. . < . .. .

.

'

i. Limitorque Operator Replacement (BA 408737).

~

J. Agastat Relay Replacement (BA 323426).

k. Mini-Modification 323543, Elimination of Lifted Lead .

.

I t

i-18-

_ __ _ _ _____- - ._____ _____ .

. .

,

. .

,

APPENDIX A PERSONNEL CONTACTED Name Position

• A. Agrawal Senior Electrical Engineer H. Ahdout Engineer, Technical Functions T. Akor Engineer, Electrical Power and Instruments A. Baig Project Engineer, Technical Functions E. Banua EQ Engineer, Technical Functions

• G. Capodanno Director, Engineering and Design J. Charterina Senior Engineer, Plant Engineering F. Collado Engineer, Plant Engineering J. Correa Manager, P; ping Engineering Technical Functions D. Covill Materials Engineer Technical Functions

• D. Croneberge Director. Engineering and Design

• P. Czaya Licensing Engineer

• D. Distel PWR Licensing Engineer R. C. Ezzo Engineer, Electrical Power and Instruments J. Flynn Engineering Proc. & Standard Manager R. Furia Fuel Design Engineer

• J. Gulati Manager, Oyster Creek Projects D. Holland Engineer Projects, Technical Functions J. Horton Engineer, Technical Functions K. Jasani Manager Mechanical Analysis, Technical Functions D. Jerko Licensing Engineer M. Kapil Senior Engineer, Plant Engineering

• M. Laggart Manager, BWR Licensing J. Logatto Senior Engineer, Technical Functions

• R. Long Director, Planning and Nuclear Safety D. Masiero Building Services Manager D. Miller Project Engineer, Technical Functions

• E. O'Connor Project Manager, Technical Functions

• D. Ranft Manager, Plant Engineering

• H. A. Robinson Electrical Power Manager

• A. Rone Plant Engineering Director

• G. J. Sadauskas Manager, Electric Power and Instruments H. Sharma Electrical Engineer

• M. Sanford Components and Structures Director D. Slear Plant System Director ,

-

R. Stocky Engineer Technical Functions 1

• J. Sullivan Licensing and Regulatory Affairs Director !

J. Szule Engineer, Technical Functions

• K. Tosch Nuclear Engineer

• C Tracy Oyster Creek Engineering Projects Director N. Trikouros Manager, Safety Analysis, Plant Controls S. Tumminelli Manager, Engineering Mechanics

• E. Wallace Engineering Services Director

• R. Wilson Technical Vice President R. Zak Engineer, Technical Functions P. Zanis Chemical Engineer

• Denotes licensee personnel attending exit meeting November 4, 1988 A-1

!

_ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ .

' '

. .

!

l-

-

APPENDIX B MODIFICATIONS REVIEWED BY THE INSPECTION TEAM BY LICENSEE'S BUDGET ACTIVITY (BA) NUMBER BA 402854P2 Addition of new and independent HVAC system to control roo BA 328232 Modification of standby liquid control system to satisfy 10 CFR 50.62 (ATWS rule) by increasing Boron enrichmen BA 323512 Relocation of open indication light switch on motor-operated valve BA 402902 Replacemer' os i7 control rods with new extended life contrc1 rod BA 408741 Replacement d 0 control rod drive mechanism BA 335400 Reload core design and technical specification changes associated with new GE8X8EB fue BA 402896 Replacement of mechanical pressure switches with analog loops to monitor reactor pressur BA 402256 Installation of new suppression pool temperature monitoring l

'

syste BA 402876P3 Qualification of safety-related piping to new seismic criteria. l BA 328195P2 Replacement of internal and external parts for 14 torus-to-drywell vacuum breaker BA 328141P2 Monitoring of emergency service water pipe wall thickness fc11owing removal of corrosion protection linin BA 402724 Authorization for design, installation, and testing of new control rod drive handling mechanis BA 402815 Modification of safety-related piping and valves to i

I facilitate replacenient of new containment particulate monito . BA 402876 Reanalysis of safety-related piping to resolve deficiencies from NRC audit of 79-14 and 70-02 progra BA 328130P5 Requalification of piping system base plates.

l BA 402856 Lowered reactor water level setpoint for feed water control following reactor scram.

l l

B-1

_ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ . -

. .

,

Q A

- BA.402896, Calculated process trip setpoir.ts 402256, 406761

,

BA 32180P3 Documentation and analyses to ensure electrical design basis is satisfied after replacement of circuit breaker trip units on existing GE AK-2 breakers installed on 480 volt substations.,

BA 402879 Replacement of mechanical pressure switches with upgraded pressure switche BA 402879 Reactor Protection System and Emergency Safeguards Instrument Upgrad BA 23397 HFA Relay Replacemen BA 23476P3 Replace Diesel Generator Control Relay BA 23512 Limitorque Switch Replacemen BA 328180P3 General Electric Breaker Trip Unit Replacemen BA 408737 Limitorque Operator Replacemen BA 323426 Agastat Relay Replacemen Mini-Mod Elimination of Lifted Lead Mini-/ Mod 7 Replaced relays on core spray and emergency service water pump NOTE: " Mini-Mods" are modifications originated within the plant's engineering group

.

ll B-2

-

..

, ,

APPENDIX C DEFICIENCIES Deficiency A-1: Potential inadequacies in the control of replacement-in-kind design changes initiated outside the scope of modification control procedure DISCUSSION:

During the Cycle 12R refueling outage, the licensee implemented modifications which affected the reactor core fuel configuration. These included: Replacement of 17 control rods with a new extended life control rods (BA 402902); Replacement of 30 control rod drive mechanisms (BA 408741);and Reload core design and technical specification changes associated with -

new GE0X8EB fuel (BA 335400).

The team reviewed documentation supporting these modifications and identi-fied several concerns related to design control of these changes to the reactor core and its equipmen The documentation associated with replacement of 17 control rods was developed by the GPUN corporate engineering staff in Parsippan Although a Safety Evaluation (not yet approved) had been prepared for the change, this work was conducted as a "like-for-like" replacement and, therefore, invoked no formal modification control procedur In discussions with the team, the licensee stated that no modification control procedure was required since the replacement was not considered a modificatio In their Safety Evaluation, the licensee stated that the hardware for.the replacement (D-230) control rods was the same as that for the conventional control rods (all B C rods, sheath, handle,velocitylimiter,andpins)exceptfortheabsorber and rollers. The Safety Evaluation concluded that the " mechanical and nuclear properties of the D-230 control rods do not differ from those of the original all-B,C assemblies in any manner that might be significant" for normal or accident condition ;

.

'

Although the design configuration of the new D-230 control rods was, in fact, similar to that of the existing control rods, the team concluded '

that this replacement represented a substantial design change to the core configuration and was worthy of design centrol. The team was concerned that the lack of design control for this change could potentially result in inadequate control of organizational interfaces and required documenta-tio For example, the Safety Evaluation provided no mechanism for input and ;

review by training personnel to assess the impact of the change on I personnel training. The licensee stated, however, that training personnel had reviewed the change package since they normally request C-1

_ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

.. ..

,

- *

,

input for these types of changes. In addition, required drawing changes were made, although no formal mechanism existed in the Safety Evaluation to initiate these changes. The team also noted that there was no apparent procedural mechanism for initiating a Safety Evaluation for this change, in spite of the fact that one was prepare In contrast to the inadequacies in the modification described above, the modification to replace 30 existing (BWR/2-5) control rod drive mecha-nisms (CRDs) with BWR/6 type CRDs was developed at the plant under the control of Procedure 124.2, " Control of Plant Engineering Directed Replacements and Modifications." The team found that this procedure adequately provided the necessary checklists and guidance to ensure satisfactory interface controls and completion of required reviews and documentation. Although the replacement of the control rod drives was considered a replacement-in-kind, completion of Form 124.2-2 for this change provided an acceptable mechanism for design control. The documentation package included a Safety Evaluation for the replacement which had been perfonned by General Electric. The team reviewed this document and found it acceptable. However, on Form 125-), " Engineering Calculations and Technical Evaluations," included in the package, GPUN stated that no. safety evaluation was required. In discussions with the team, the licensee indicated that since General Electric had performed a Safety Evaluation, none was required by GPUN. The team concluded that an appropriate Safety Evaluation performed by GPUN was still require During the inspection, a Safety Evaluation (SE No. 000225-006 Revision 0, dated October 25,1988) was issued for the modification to replace the control rod drive mechanisms. The team had no further questions on this issu The reload core design and technical specification changes associated with the new GE8X8EB fuel were initiated in a fashion similar to the control rod replacement, in that no formal modification procedure was utilized. However, a Safety Evaluation (SE No. 335400-025, Revision 0, dated March 21,1988) was prepare This observation has no safety significance since no problems were identi-fied in the review of these modifications. However, the team concluded that the lack of a procedure for this type of change was a weakness in the licensee's design control. Further the team found that this weakness provided the potential for inadeq'uate control of organizational interfaces and required design documentation for these change .

In response to the team's concerns, GPUN comitted to issue a revised standard (Fuel Standard FS-5) addressing these issues for all core consum- '

ables. The draft revised standard will be ready for use in reviewing all projects implerrented in the current Cycle 12R refueling outage by December 21, 1988, and a final draft will be issued by January 31, 1989. This item is considered close REGULATORY BASIS:

Both 10 CFR 50, Appendix B, and ANSI N45.2.11 require that measures be established to ensure that appropriate design controi mechanisms are i provided for the implementation of plant design changes. 10 CFR 50.59 l requires that appropriate safety evaluations be prepared to determine l l

C-2 l

__

._ __- __ _

. .

,

• *

,

whether ari unreviewed safety question exists as the result of changes to the plant configuration or design.

l REFERENCES: Procedure 124, Revision 8, " Plant Modification Control " March 21, 198 Procedure 124.2, Revision 0, " Control of Plant Engineering Directed l

Replacements and Modifications," April 19, 198 CFR 50, Appendix ANSI N45.2.1 CFR 50.59, Fortn 125-1, PETA No.85-137, dated October 18, 198 Fonn 124.2-2, PETA No. 85-13 GPUN Safety Evaluation SE No. 402902-001, Revision 0, October 18, 1988 '

(in process, i.'e., no approval signatures). RDE 01-0188, DRF B13-01319-2, General Electric Safety Evaluation, Control Rod Drive Modification, December 198 ! GPUN Safety Evaluation SE No. 335400-025, Revision 0, March 21, 198 GPUN Safety Evaluation SE No. 000225-006, Revision 0, October 21, 198 Deficiency A-2: Temperatures in the control room may exceed allowable limits during a postulated LOCA concurrent with a Loo DISCUSSION:

During the Cycle 12R refueling outage, the licensee implemented the addition of a new independent HVAC system to the control room envelope. The intent of this modification was to fulfill GPUN commitments to requirements arising from NUREG-0737, Control Room Habitability. The modification (BA 402854P2) consisted of the addition of a new rooftop air-conditioning unit and supply and return duct work which interconnected with the existing system duct work. New isola-tion dampers, controls, and associated instrumentation and power circuits were

also provided. Upon completion of these modifications, the new independent HVAC system (System B) functioned as the lead system, and the existing HVAC system (System A) performed the same functions when required to meet single failure requirements. The new HVAC system and components were classified as

" Regulatory Required" and will be powered from the unit substation IB3 asso-ciated with emergency diesel generator No. The team reviewed this modification in detail, including modification design descriptions, drawings, and a number of calculations performed to substantiate the design and operation of the system. The team identified several concerns, described below, related to the design of the control room HVAC syste C-3

_ _ _ -

.

,

c .

,

a. Section 4.1.3 of modification design description MDD-0C-8268, Division II, stated that, in the event of a postulated LOCA coincident wit loss of offsite power, System B will be " rendered inoperative."

Emergency diesel generator 2 power to HVAC System B loads will be delayed for approximately 30 minutes. The team reviewed several calculations related to the capability of the control room HVAC system to maintain temperatures in the control room within allowable limits during and subsequent to this tim (1) GPUN Calculation 1302-826-5360 was performed to evaluate the maximum steady-state temperature in the control room and cable spreading room, assuming no cooling water to the cooling coils of the previously existing HVAC unit._ This condition corresponded to the worst case scenario of concurrent LOOP and LOCA followed by a 30-minute waiting period when only the HVAC unit fan would be manually loaded onto the diesel. The team identified the following concerns about this calculatio (1) The establishment of individual device heat loads used for electrical equipment in the control room was based on two Burns & Roe calculations and a referenced Burns & Roe design standard. However, the actual heat loads listed in the Burns

& Roe calculation were less than those listed in the guidelines provided by the design standard. For example, the design standard indicated heat loads of 10 watts per indicating light and 25 watts per relay or meter. By contrast, the calcu-1ations used 7 watts per light, 7 watts per relay, and 2 watts per meter. There was no justification given in the calcu-lations for this departure from the design standard. In addition, the design standard did not provide any basis for much of the equipment listed in the calculations, and the calculations did not provide any basis for the heat loads assume (ii) The calculations did not include a transmission load from an adjacent area at a higher temperature than the final calcu-lated temperature in the control roo (iii) There was no basis for the 800 Btu /hr heat load assumed for the occupants of the control roo (iv) Transmission loads from areas adjacent to the lower cable 1

• spreading room at temperatures 135 degrees F higher than I the final calculated temperature were not considere The team also reviewed Calculation 15050-M4-003 performed to size the new cooling unit for System B. In contrast to the loads assumed in the above calculation, this analysis indicated sub-stantially greater equipment heat loads (approximately 20 percent more) and provided a reasonable basis for these loads. In I addition, the heat load assumed for the control room occupants was higher and was based on six peopl [The team noted that the FSAR stated that the normal operating capacity of the control room was C-4

_ _ _ _ _ _ _

__- - ___ - _-_ __

'

.' ,

.

-

seven Calculationpeople and the emergency

_10.000.09, capacity was discossed in-paragraph 15below, a 2), p(eople. . Burns afRoe assumed 10 people were in the control room under the same conditions.)

Recent air flow tests on the existing HVAC system (System A)

indicated air flow rates which were 15 percent lower than the required 14,000-cfm design flow (see Inspection Observation SMK-3).

Thus, calculated temperatures which were based on the 14,000-cf ,

design flow rate will be further increased due to the lower actual

- flows achievable when the existing system operated as a backu The final temperature calculated during the loss of offsite power-

"

with only the cooling unit fan operating was 104 degrees F. This was also the maximum allowable ambient temperature for standard ra.ted electrical equipment, as stated in the'FSAR. The team was concerned that this limit will be exceeded by a significant amount (upwards of several degrees) if the above concerns were considered in determining the control room temperature under these condi--

tions. The licensee stated that the impact of potentially higher temperatures on the control room equipment for this case was not known. However, Control Room Operating Procedure No. 331 indicated that instrumentation may degrade at 90 degrees F and the computer may be damaged at 85 degrees (2) Burns & Roe Calculation 10.000.09 is a room heatup calculation performed to determine the control room temperatures resulting from a loss of all HVAC. Results indicated that a temperature of 96 degrees F could be reached within one hour. However, this calculation was based on the same heat loads questioned in paragrapha(1),above. In. addition, there was no basis given to substantiate the assumption that heat transfer coefficients would be equal on both sides of the control room wallc, ceilings, and floor The team was concerned that control room temperatures for the time period prior to loading the diesel with the HVAC fan (only) may be higher than indicated by these calculations and may exceed the 104 degrees F equipment limit Section 4.1 of modification design description MDD-0C-826B, Division I, indicated the design ambient conditions as 89 degrees F (high) and 10 .

!

degrees'F (low), based on the OCNGS FSAR. These temperatures were not

- expected to be exceeded more than 2.5 percent of the time, and they reflected the original design basis for the plant. The team identified the following in this MD (1) These temperature extremes and their frequency of occurrence niay not be an adequate design basis for a modification made today to a critical plant HVAC system such as that for the control roo (2) Even accepting these temperatures and their frequency of occur-rence as an adequate basis for sizing the control room HVAC system, their use was not conservative as a maximum outdoor temperature to determine control room steady-state temperatures with fan operation onl C-5

- _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _

. .

,

. .

The combined effects of the nonconservative heat loads assumed in the analyses, measured air flows substantially less than required design flows, and the potential for high ambient temperatures exceeding '

original plant design basis temperatures could result in temperatures ,

which exceed control room equipment capabilitie !

Both the existing and the new control room HVAC systems are not safety- I related. However, this observation has some safety significance since the modification to add a new control room HVAC system represents GPUN's i response to connitments arising from NUREG-0737. The team had the following concern j These commitments may not be satisfied in view of the issues raised in this observatio The capability of electrical equipment and instrumentation in the control room required to monitor the course of an accident may be compromised during a coincident loss of offsite powe In addition, the team was unable to determine when the full control room HVAC system equipment could be loaded onto the diesel. The licensee stated that this was " indeterminate" since it was based on operator discretion for the case considered and the prevailing circumstances. (See Inspection Observation C-1 for further details on diesel generator loading and its relationship to control room HVAC.) Consequently, it was not clear that adequate control room temperatures will be maintained during 6 loss of offsite powe In response to the team's concerns, the licensee stated that the heat loads and calculations in question were being reviewed and evaluated. In addition, further testing Iray be conducted to establish actual heat loads during operation. This issue remains ope REGULATORY BASIS:

FSAR Section 9.4.2.1 states that plant HVAC systems are designed to limit temperatures so that the " maximum allowable ambient temperature for standard rated electrical equipment (104 degrees F) is not exceeded."

REFERENCES: Modification Design Description, Division I, MDD-0C-826B. Revision 0,

. * Addition of a New Independent HVAC System to the Control Room ,

t Envelope," October 19, 1987, Modification Design Description, Division II (Preliminary), MDD-0C-826B, Revision 0, " Addition of a New Independent HVAC System to the Control ,

Room Envelope," October 19, 198 ; OCNGS FSAR, Section 9. GPUN Calculation 1302-826-5360-001, Revision 1 " Control Room and Cable Spreading Room Loss of Chilled Cooling Water," December 4, 198 C-6

_ _ _ _ _ _ _ _ - - _ - _

. .

,

. .

,

'

• Stone & Webster Calculation 15050-M4-003, Revision 1, " Control Room Envelope Heating and Cooling Loads," January 28, 198 Burns & Roe Calculation (Frame 107), " Control Room HVAC " September 15, 196 Burns & Roe Calculation 3731-29-E004, Revision 0, " Heat Loss Estimate for Control Room," April 12, 198 Burns & Roe Engineering Standard P160003E1, " Heat losses from Electrical Equipment," November 198 . Stone & Webster Calculation 15050-E6-09, Revision 2. " Heat Release from Electrical Equipment in the Control Room," March 4, 198 Burns & Roe Calculation 10.000.09, Revision 0, " Control Room Temperature Study (With Loss of Ventilation)," June 20, 198 OCNGS Procedure Number 331 Revision 15, " Office Building Heating, Ventilation and Air Conditioning System," March 4, 198 .

Deficiency A-3: The existing control room HVAC system (System A) air flow ciipacity does not meet established design requirement DISCUSSION:

In conjunction with the review of documentation supporting the addition of a new independent HVAC system to the control room envelope, the team reviewed GPUN memorandum MSS-85-383. This memorandum dated July 29, 1985, discussed control room habitability differential pressure and air flow test result ;

The memorandum indicated that measured air flow rates for the existing HVAC system at this time were 11,400 cfm. This was substantially less than the present required design flow rates of 14,000 cfm. Some reasons given for the low flows measured include measurement errors and duct or damper leakag The licensee stated that more recent tests (TP200/0.1, Revision 0, MTX '

26.11.5.5, March 23,1988) indicated air flow rates of 11,909 cfm after maintenance work on the ducts and dampers was completed. This flow was 15 percent less than the 14,000 cfm design flow rate for the HVAC syste This deviation exceeded standard industry practice limitations of 10 percent of design flow rates, including those of ANSI N510 " Testing of Nuclear Air- l Cleaning Systems," 1980. In addition, calculations performed to establish

-

control room temperatures were based on required design flow rates of 14,000 i cfm. Lower actual flow rates will increase these temperature The control room HVAC system is not safety-related. However, this observa-tion has safety significance. The modification to add a new independent HVAC system was performed to meet guidance arising from NUREG-0737. The team was concerned that, assuming a single failure of the new HVAC system, (lead System B), the capacity of the existing control room HVAC system (System A)

n.ay not be adequate to meet design requirements during emergency condition Further, since test results were based on the existing system's duct work, which was shared by the new system, there was no evidence that the new system will be capable of supplying adequate air flow rate C-7

. ,

,

. .

,

-

. REGULATORY BASIS:

IC CFR 50 Appendix B Paragraph III " Design Control" states in part that measures shall be established for the control of design interface ModificaticnDesignDescriptionDivisionII-(Preliminary),MDD-0C-826B, states that the control room HVAC system is capable of providing 14,000 cfm of outside air during a LOCA or main steam line break without exceeding maximum allowable radiological dose rates. The results of a number of design analyses (See Deficiency A-2 Observation,for references)-are based on the design flow rate of 14,000 cfm; however, the measured flow rate is substan-tially less than 14,000 cfm. This issue remains ope REFERENCES: i GPUN Memorandum MSS-85-383, "0CNGS Control Room Habitability Differential Pressure and Air Flow Measurement Test," July 29, 198 ANSI /ASME N510-1980, " Testing of Nuclear Air-Cleaning Systems." Modification Design Description Division II (Preliminary), MDD-0C 826B, Revision 0, October.19, 198 Deficiency A-4: Inadequatedesigninputusedtodetermine(NPSH)available to core spray pump DISCUSSION:

During a recent SSFI conducted at Nine Mile Point 1 Nuclear Generating .

Station, several weaknesses were identified in the design analyses perfonned for the core spray system. Since the design of Nine Mile Point 1 is similar to that of OCNGS, the team conducted a limited review of the OCNGS design analysis to determine if similar weaknesses existed in the design of the core spray system at DCNGS. For example, at Nine Mile Point 1, the following key weaknesses, among others, were identifie a No consideration was given to the pressure drop across the torus-strainers in the determination of available NPSH for the core spray pum The determination of system , resistance curves did not account for all components in the syste In the limited review of calculations performed for the OCNGS core spray system, the team found indications that similar weaknesses may exist in these 1 analyses. Two of these are discussed below, GPUN Calculation C-1302-212-5360-023 was performed to determine the NPSH available to the main pumps of the OCNGS core spray system during a postulated LOCA. The analysis referred to a previous calculation (0C-5360-210-001) for the friction losses used in the calculation of NPSH. The team found that this analysis assumed that the pressure drop across the torus strainers was 0.5 ft. There was no basis given for this assumption other than the following statement contained in a General Electric Plant Description Manual:

C-8

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

. .

,

• . v

,

i

"The strainers are located in quiescent portions of the suppression ,

pool and sized so that one strainer can pass full flow to one core I spray loop and one containment spray loop with negligible pressure drop compared to the required NPSH of the pumps."

GPUN was unable to provide adequate substantiation of the pressure drop l across the strair.ers. GPUN indicated that a calculation would be I I

performed to substantiate the assumed pressure dro GPUN Calculation C-1302-212-5360-013 Revision 1, January 26, 1985, was performed to determine core spray pump performance during an accident, assuming a sincle failure of the backup booster pump after tripping the lead booster pump on low pressure. This calculation was also used to establish maximum pump runout flow in the calculation of NPSH discussed above. The team noted that an assumption made in this analysis was not adequately documented. Specifically, leakage flow out of the System II sparger (due to a crack in the sparger) was assumed to be 240 gpm. This i flow was assumed to vary linearly with total system flow. There was no basis provided for the assumed 240-gpm leakage flow, and no rationale was given to support the assumption that this flow would vary linearly with system flow. Since the crack in the sparger represented an additional resistance flow path, the team detennined that the leakage flow should be modeled accordingly. That is, flow should vary with the square root of the pressure drop across the crac The licensee was unable to provide justification for these assumption The team was concerned that additional crack flow could result in higher runout flows than those used as the basis for evaluating NPSH available to the pumps under these and other conditions. (See Item 1 above.) This item remains open pending revision of the calculation to substantiate these assumption The licensee stated that preliminary calculations perfonned during the inspection indicated that the strainer differential pressure was lower than assumed. In addition, substantial margin existed in the runout flow used in the analysis of NPSH available to the core spray pumps if the leakage flow through the sparger crack was higher than assumed. The team concluded that some weaknesses in design analysis performed for the core spray system similar to those found in the Nine Mile Point 1 SSFI were identified in this revie However, these weaknesses have minimal safety significance. This issue is close REGULATORY BASIS:

ANSI N45.2.11 requires that adequate documentation and substantiation should be provided for assumptions made in design analyse REFERENCES: GPUN Calculation C-1302-212-5360-023 Revision 0, "0CNGS:

.

Main Core Spray Pump NPSHA " January 28, 198 ( GPUN Calculation 0C-5360-210-001, "NPSH of Core Spray Pumps at Torus Water Temperature of 176 degrees F," September 24, 190 C-9 f

- - - - - l

_ _

_ _ _ _ ,

+ *

.

., 7

. '

'GPUN Calculation C-1302-212-5360-013 Revision 1, "00, Core Spray System Hydraulic Analysis," April _ 26, 198 Deficiency A-5: Control room operating procedure directions to open doors on loss of HVAC have not been evaluated for effects on operating personnel resulting from a potential coincident radiological inciden DISCUSSION:

Inspection Observation A-2_ discussed inadequacies identified in design analyses related to the modification which added a new control room HVAC system to the control room envelope. This observation detemihed that control room temperatures may exceed allowable limits in the event of a-loss of offsite power, resulting in a loss of control room HVAC. During this review, the team noted that Operating Procedure 331 provided instruc-tions to "open the three doors to the Control Room and the door to the old cable spreading room to allow air flow from the corridors" in the event of a loss of control room ventilatio The team questioned whether this condition had been evaluated or considered in the analysis of radiation dose to control room operators should a coincident radiological event occur on a loss of offsite power. The licensee stated that the effects of airborne radiation or radiological exposure to operatino person-nel for this condition had not been considered. However,GPUNwasevaluating this cas The team reviewed the results of. Stone & Webster Calculation No. 006, Revision 1, " Post-LOCA Gama & Beta Doses in the Control Room vs. Outside Air Intake Rate," July 27, 1988. Although the analysis did not specifically refer i to the conditions described in this' observation (open control room doors), i results indicated that significant margin existed in meeting required dose limits. Consequently, this observation is probably not safety significan l Fowever, this item remains open pending formal resolution by GPU REGULATORY BASIS: 1 10 CFR 50, Appendix B requires in Paragraph III, " Design Control" that measures i be established to transfer requirements and design basis currently to specifica- 1 tions, procedures drawings and instructions. Stone & Webster Calculation 006 )

invokes radiation dose limits for control room habitability based on NUREG-0800, '

Section 6.4. These limits were not reflected in OCNGS Procedure No. 331 j Revision 15. This issue remains ope t

.

REFERENCES: OCNGS Procedure No. 331 Revision 15. " Office Building Heating, Ventilation and Air Conditioning System," March 4, 198 j Stone & Webster Calculation 006, Revision 1 " Post-LOCA Gamma & Beta Doses in the Control Room vs. Outside Intake Rate," July 27, 198 !

t No documented basis for safety-related motor-operated valve j Deficiency A-_6,:

maximum differential pressure and valve stroke time acceptance criteri C-10

_ - - _ _ _ _

• '

.

, ,

.

l f DISCUSSION:

A modification to a number of safety-related motor-operated valves (MOVs)

consisted of relocating the open indication light contacts from Switch No. 7, Rotor No. 2, to another switch and rotor within the valve operator. The relocated open indication light switch was adjusted to turn off when the valve was 97 percent to 99 percent closed. The modification was performed in response to INP0 50ER No. 86-2 to reduce inaccuracy in MOV position indica-tion and to reduce personnel error and incorrect position indicatio The team reviewed this modification and had no issues with the changes being mad However, the team identified weaknesses in documentation substan-tiating the design basis for these MOVs related to design differential pressures and acceptance criteria for valve stroke time OCNGS Procedure A100-GME-3918.51 provided instructions for testing Limitorque MOVs using Motor-Operated Valve Analyses and Test Systems (MOVATS). As part of this testing, valve stroke time was measured. Acceptance criteria for valve stroke time were based on previously recorded stroke times. In some cases, such as for the main steam isolation valves and containment isolation valves, the acceptable stroke times were based on requirements established in the FSAR. However, only the main steam isolation valve stroke time could be traced to a documented design basis. The stroke time for this valve was based on a requirement established in a General Electric Specificatio Acceptable stroke times for containment isolation valves were established based on the FSAR assumption that significant fission product release to the containment atmosphere was on the order of minutes for the design basis loss of coolant accident. However, this evaluation was not documented. In addition, there was no documented basis to ensure that the stroke times for all other safety-related MOVs were acceptable. These valves may have required opening and closing times which were consistent with system or process requirements and may have been more stringent than those currently use In a letter to the NPC responding to IE Bulletin 85-03, GPUN noted that the bulletin did not apply to OCNGS systems and that a program was being implemented to encompass most of the bulletin's requirements. The NRC subsequently accepted further expansions of this program to include the core spray and isolation condenser systems. GPUN provided a revised response l

that included maximum differential pressure values for safety-related MOVs l in the core spray and isolation condenser systems. The basis for maximum

'

differential pressur;es provided in the response was limited to a brief

-

description of the conditions which establish the maximum pressure However, the licensee was unable to provide documented analyses to substan-tiate these maximum differential pressures. The team was unable to deter-nine, from the brief descriptions provided in the response, whether worst-l case conditions had been evaluated assuming a single active failure of any system component. The team noted that the table upon which the response was based was included in GPUN Calculation C-1302-900-5360-005. However, this calculation merely provided a calculation cover sheet for the table and contained no formal analysis, evaluation, or development of the results presented in the table. There was no basis provided for any parameters or data used in the table to establish maximum differential pressure C-11 i

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

_ _ _ _

. .

'

. .

.

This observation could have some safety significance. There was no docu-mented evidence to ensure that maximum differential pressures have been established for safety-related MOVs_in accordance with the requirements of ;

IE Bulletin 85-03 (such as consideration of worst-case conditions and i assuming a single active failure). This could affect torque switch settings for these valves. Thus, there was no assurance that these valves will be capable of opening or closing against worst-case differential pressures during postulated accidents. In addition, valve stroke time' acceptance criteria applied during MOVATS testing may not be appropriate for some safety-related valve The licensee informed the team that substantiation of these design basis data for MOVs was a continuing effort at GPUN as part of the design basis reconstitution effort. This item remains open pending resolution by the license REGULATORY BASIS:

ANSI N45.2.11 requires design activities to be documented and the final design to be traceable to the source of design inpu REFERENCES:

' OCNGS Procedure A100-GME-3918.51, Revision 0, " Motor Operated Yalve Testing Using MOVATS," October 6, 198 Letter from GPUN to NRC, Subject: Response to IE Bulletin 85-03, May 15, 198 Letter from NRC to GPUN, Subject: IE Bulletin 85-03, Motor Operated Valve (MOV) Improper Switch Settings, October 28, 198 Letter (5000-86-1118) from GPUN to NRC, Subject: IE Bulletin 85-03 Motor Operated Valves, December 23, 198 OCNGS FSAR, Section 4.5 and Table 3. General Electric Specification 21A5467, Revision 0, " Primary Steam Isolation Valves," July 22, 196 GPUN Calculation C-1302-900-5360-005, Revision 0, " Motor Operated Valve Delta P and Basis," January 6,198 .

Deficiency B-1: Instrument setpoints, as specified, do not meet design criteri DISCUSSION:

This modification (BA 402896) replaced several sets of mechanical pressure switches with analog loops to monitor reactor vessel pressure. Analog loops RE03A through RE03D provided inputs to the Reactor Protection System (RPS)

relay logic to scram the reactor when their pressure setpoints were exceede Similarly, analog loops RE15A through RE15D provided inputs to the Engineered C-12

. _ _ _ _ _ _ _ _ -.

.. .

,

. .

,

Safeguards Actuation System (ESAS) to trip the recirculation pumps and initiate isolation condenser operation when their pressure setpoints were exceede The team found that the reactor pressure setpoints as specified for the new analog loops did not meet the design criteria. Section 4.8.3.3 of modifica-tion design description MDD-0C-622A, Division I, specified that the RE03 analog loop for reactor vessel pressure should actuate before the RE15 analog

.

loop. In addition, Safety Evaluation SE-402896-002, Revision A, stated in Section 3.3.1 that the existing condition where the RE03 setpoints are set below the REIS setpoints is continued in the new analog loops. The new setpoints for the RE03 and REIS analog loops were deterv.ined in calculation 4283-12-11-001. The team found that, under certain conditions, the RE15 analog loop would actuate before the RE03 analog loop due to overlapping of the setpoints. This would occur when the RE15 enalog loop had a negative loop accuracy error and the RE03 analog loop had a positive loop accuracy erro A trip of the recirculation pumps and initiation of the isolation condenser operation before a reactor trip would put the plant in an unanalyzed condi-tion. The licensee agreed to reevaluate the calculation of the setpoints and specify new setpoints which would eliminate setpoint overla REGULATORY BASIS:

At:SI N45.2.11, Quality Assurance Requirements for Nuclear Power Plants, Section 6, Design Verification, requires that calculations to be properly reviewed to ensure that the design criteria is me REFERENCES: Modification Design Description, Division I, MDD-0C-622A, Revision 0,

"RE03/RE15 Analog Conversion Modification," June 24, 198 Safety Evaluation, SE No. 402896-002, Revision A "RE03/RE15 Setpoint Change," October 14, 198 Burns & Roe Calculation 4283-12-11-001, Revision 1, "RE03/RE15 Analog Loop Performance," October 14, 198 _ Deficiency B-2: Technical specifications were not revised to reflect an upgraded accident monitoring system as specified in safety evaluatio DISCUSSION:

Modification BA 402256 installed a new suppression pool temperature monitor-ing system to permit more accurate calculation of suppression pool bulk temperature. The new system also provides the operator with improved captLility to menitor containment integrity. It was designed to meet the guidance in NUREG-0061, Appendix A and USNRC Regulatory Guide 1.97, Revision 2. The suppression pool temperature was designated as a Regulatory Guide 1.97, Type A variable fcr OCNG GPUN Safety Evaluation, SE 402256-003, Revision 0. Suppression Pool Tempera-ture Monitoring System, Sections 2.6 and 2.7 stated that an amendment was C-13

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .

- _____ - _ __ _

.- .

,

. ,

,

required to plant Technical Specification Sections 3.13 and 3.14, which apply to accident monitoring instrumentation operating status and surveil-lance requirements. GPUN action item request AT 5123 was assigned to and accepted by the Oyster Creek licensing group with an expected completion date of February 28, 198 The team was told that an update of the Technical Specification will not be made to reflect this modification, pending resolution of issues regarding requirements for listing Regulatory Guide 1.97 Type A variables in the technical specifications. This is an item of discussion between the Boiling Water Reactor Owners Group (BWROG) and the Office of Nuclear Reactor Regulatio Although there was no immediate safety significance, the team felt that plant safety could be enhanced by taking steps to ensure operability of i these instrument .

l The team was also concerned that the safety evaluation, SE 402256-003, Revision 0, continued to reflect that the plant Technical Specification, Sections 3.13 and 3.14 had been update i REGULATORY BASIS:

10 CFR 50, Appendix B requires that measures be established to transfer design basis to specifications, drawings, and instruction '

REFERENCES: , NUREG-0661, Appendix A. " Safety Evaluation Report - Mark I Containment Long-Term Program, July 198 USNRC Regblatory Guide 1.97, Revision 2, " Instrumentation for Light Water Cooled Nuclear Power Flants to Access Plant and Environs Con e ions During and Following an Accident," December 198 GPUN Safety Evaluation SE 402256-003, Revision 0, " Suppression Pool Monitoring System." OCNGS ' bt Technical Specification, Sections 3.5, 3.13 and 4.1 GPUN Technical Function Assigned Action Item Request AT 5123, "Suppres-sion Pool Temperature Monitoring System - Technical Specification

. Changes."

Deficiency B-3: Failure to follow procedures to track recomrrendatiuns in technical report j DISCUSSION:

i Modification BA 402256 installed a new suppression pool (torus) temperature monitoring system. The algorithms that model the torus temperature distri- ,

bution used the inputs from resistance temperature detectors (RTDs) to predict the torus bulk temperatur !

i i

C-14

- - _ _ . - _ _ _ _ _ . - . _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _

l

_ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ .

'

-

.- .

, ,

'

i Technical document report TDR 934 evaluated the effect of RTD thermal lag on the torus temperature monitoring system algorithms. The report showed that the results were acceptable, although the algorithm under-predicted the bulk temperature by a larger margin than originally calculated. The report therefore recommended that Technical Data Report (TDR) 823 and Modification Design Description MDD-0C-644A, Division I and II, be revised to reflect this differenc These documents used this information to determine allow-able setpoint accuracies. According to GPUN procedure.EP-001. Technical Function Task Requests should be issued to track recommendations made in a TD In addition, the follow-up item number assigned must be noted on the cover sheet of the TDR. No Technical Function Task Requests were issued for TDR 93 The team was concerned that, if the present versions of technical document report TDR 823 and modification design description MDD-0C-644A, Division I and II, were used, the wrong setpoints might be developed for the torus temperature high and high-high temperature alarms. The plant Technical Specifications require specific manual operator action when these alarm setpoints are exceeded. Incorrect setpoints could cause the Technical Specification limits to be exceeded during operation. Therefore, this observation has some safety significanc Pursuant to discussions with the team, the licensee issued the required Technical Function Task Requests. This item is close REGULATORY BASIS:

GPUN Procedure EP-001, Revision 2-00, Technical Document Reports, Section 4.3.12, requires that, if a study results in specific recommendations, a technical task request (TFWR/TR) should be initiated to track the recommenda-tions. The TFWR/TR number assigned must be recorded on the cover shee REFERENCES: GPUN Technical Function Procedure 5000-ADM-7316.01 (EP-001), Revision 2-00, " Technical Document Reports," Sect'on 4.3.1 GPUN Technical Data Report TDR 934, Revision 0, "Effect of RTD Thermal Lag on Torus Temperature Monitoring System." GPUN Technical Data Report TDR 823, Revision 2, " Location of Thermo-couples to Monitor Torus Bulk Temperature at Oyster Creek."

'

Deficiency C-1: Insufficient guidance to reactor operators during a postu-lated LOCA and coincident LOOP could potentially overload the diesel generato DISCUSSION:

A review of the licensee's diesel generator load calculation (C-1302-741-5350-001, Revision 1) and Emergency Diesel Generator Operation Procedure No. 341, Revision 26 showed that, during a LOCA concurrent with a LOOP condition, the diesel generator had the potential of being overloade This overload condition could be caused by the addition of manual loads C-15

--___ _ _ _ - _ - _ _ _ - _ _ _ - _ - _ _ _ - _ _ - _ _ _ _ _ _ _ _ .

- _ _______-___-_-__-_ _ _

'

. ..

,

.. .

,

'

(e.g.,aircompressors, batter and other ventilation systems)y charger, during fire andconditio an accident pump, or The control room HVAC calculated worst-case diesel loading (2703 kW) due to automatically started loads demonstrated that the diesel was of adequate capacity, but had only a small margin'before it would exceed its overload rating of 2750 K The engineering staff contended that manual loads were not added to the diesel during the initial phase (first half-hour) of the postulated acciden However, the Emergency Diesel Generator Operation Procedure instructed the operator to add manual loads to the diesel after automatic load sequencing was completed. The. team was concerned that the operators were relied on to take appropriate action to maintain acceptable diesel loading without suffi-cient engineering guidance concerning manual loads that could be added or automatically started loads that could be secured. This lack of guidance could cause the diesel to become overloaded and possibly degrade the voltage of the Class 1 buses and prevent safety-related equipment from performing its intended function The licensee agreed to revise the Emergency Diesel Generator Operating Procedure to show a list of loads that may be removed to avoid overloading

'the diesel generator. This_ item remains ope REGULATORY BASIS:

Appendix B to 10 CFR 50 states in'part that measures shall be established to assure that the applicable regulatory requirements and design bases are correctly translated into procedure REFERENCES: Modification Design Description. Division I, MDD-0C-826B, Revision 0,

" Addition of a New Independent HVAC System to the Control Room Envelope," October' 19, 198 Modification Design Description Division II (Preliminary), MDD-0C-826B, Revision 0, " Addition of a New Independent HVAC System to the Control Room Envelope," October 19, 190 OCNGS FSAR, Section 8.3.1. GPUN Calculation C-1302-74-5350-001, Revision 1, October 31, 190 GPUN Emergency Diesel Generator Operation Procedure Number 341, Pevision 2 General Motors letter from M.J. Fleckenstein to S.D. Swetz, June 26,

- 198 General Motors letter from H.L. Marble to P.F. Wells, March 30, 1978, Modification Package BA 402854P2, " Addition of a New Independent HVAC System to the Control Room Envelope HVAC System."

C-16

_ _ _ _ _

. .

,

. .

,

Deficiency C-2: Overloading the diesel during surveillance testin DISCUSSION:

A review of the diesel generator load test (Surveillance Testing Procedure No. 636.4.003, Revision 31 Serial Nos.1036 and 1040) showed that the diesel generator was loaded above its 10 percent overload rating of 2750 KW during surveillance testing. The surveillance testing was used to demonstrate that the diesel can operate at a load level associated with emergency standby desig )

The calculated diesel load was 2703 KW. The surveillance procedure required the diesel to be tested 50 KW above the overload rating, i.e. , 2800 K The acceptance criteria requirement (Item 7.0, No. 2 of the procedure)

specified any load over 2700 KW (for one hour) with no restriction on maximum loading. Written correspondence (letter from General Motors dated l June 26, 1985) from the manufacturer stated that GPUN must bear the respon- I sibility for operation above the 2750-KW ratin The team was concerned that exceeding the manufacturer's maximum recomended overload rating will degrade the diesel generator and raised questions about its operability and ability to mitigate an accident. This item is ope REGULATORY BASIS:

The manufacturer recommendations that the diesel loading should not exceed the 10 percent overload rating was not accounted for in Surveillance Testing Procedure No. 636.4.003 Rev 31, Appendix B to 10 CFR 50 which states in part that measures shall be in place to assure design bases are correctly translated into procedure REFERENCES: Modification Design Description, Division I, MDD-0C-826B, Revision 0,

" Addition of a New Independent HVAC Systen to the Control Room Envelope," October 19, 198 Modification Design Description Division II (Preliminary), MDD-0C-826B, Revision 0, " Addition of a New Independent HVAC System to the Control Room Envelope," October 19,.198 OCNGS FSAR, Section 8.3.1. . GPUN Calculation C-1302-741-5350-001, Revision GPUN Diesel Generator Loading Test Procedure Number 636.4.003, P,evision 31, Serial Nos. 1036 and 104 Modification Package BA 402854P2, " Addition of a New Independent HVAC System to the Control Room Envelope HVAC System."

i C-17

'

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

_ _ _ _ _ _ _ _ _ _ _ _ _

. .

,

. .

,

Deficiency D-1: Pipe Support and Supplementary Steel Stress Allowables DISCUSSION:

As part of GPUN Budget Activity 402876P3, the licensee separately qualified 11 nuclear safety-related (hSR) piping systems to the Housner seismic response spectre (which form the current seismic licensing basis for OCNGS)

and to the new Blume response spectra and corollary ASME code cases. GPUN provided the NRC with a number of the details of its program to requalify NSR piping to new seismic criteria through meetings and correspondence. However, the team could not confirm that GPUN provided the NRC with details of the relaxed stress allowables which GPUN used to requalify pipe supports and supplementary steel when the pipe support loads predicted by the new Blume response spectra exceeded the pipe support loads predicted by the Housner response spectra of recor The piping code of record for OCNGS, ANSI B31.1-1983, specified an upset allowable stress factor of 1.2 for pipe supports and an upset allowable stress factor of 1.33 for supplementary steel (by reference to the AISC Code). Revision 0 of the GPUN piping specification (Reference B) reiter-ated these upset allowable stress factors. However, GDUN revised the piping specification to pennit the use of the Service Level D stress limit factor of 2.0, which was specified in the ASME Code (Reference C). This represented an increase of 67 percent in the allowable upset. stress for pipe supports and an increase of 50 percent in the allowable upset stress for supplementary steel with respect to the allowable upset stresses which ANSI B31.1-1983, the piping code of record for OCNGS, permitted for these component GPUN licensing did not provide the team with a formal response to this issue during the week of October 31, 1988. GPUN informally confirmed the use of higher upset stress allowables to requalify some pipe supports and supple-mentary steel. This item remains ope REGULATORY BASIS:

The upset stress allowables which GPUN is using to requalify some pipe supports and supplementary steel exceed the allowables pennitted by the piping code of record for OCNGS (B.31.1-1983) as specified in the FSA REFERENCES: ANSI /ASME B31.1, " Power Piping," 1983 Editio . GPUN Specification SP-1302-12-212. "1985 IE Bulletin 79-02/14 Inspec-tion Program Design Input for Piping Support Analysis," revision 1, June 9, 198 ASME Section III B&PV Code, 1986 Edition, Division 1, Subsection NF and Appendice C-18

!

.

..'. .

,

.

'

Deficietcy D-2: U-Bolt and Lever Arm Calculation

. DISCUSSION:

GPUN Budget Activity 328195P2 replaced internal and external parts for 14 torus-to-drywell vacuum breakers to meet NRC Mark I containment program acceptable stress criteria. AGPUNvendor(ReferenceA)qualifiedthe valve replacement parts to the Mark 1 progra- requirements. GPUN qualifie the U-bolt and lever am configuration that 3 attached to each valve shaf These configurations initiate an alarm in the control' room on valve slamming (Reference B). The U-bolt and lever am configuration was shown schemati-cally on the valve drawing (Reference C) and in detail on page 2 of the applicable calculation (Reference B). -

The team reviewed GPUN's calculation to qualify the sensing arm connection to the design torque specified in Reference A, Appendix 1. The team found the Reference B calculation deficient, in part, because of the following factors: The magnitude of the bending stress allowable for the U-bolt material was incorrect. The computed bending stress was compared directly to the material yield stress instead of the lesser allowable stres . The tension stress in the U-bolt due to the fact that static pre-load !

and applied torque were not combined with the computed bending stres I The calculation did not qualify the lever arm to the design torqu GPUN licensing did not provide the team with a formal response to this issue during the week of October 31, 1988. However, GPUN informally indicated that the calculation will be revise The team did not consider this issue to be safety-significant, since the sensing arm will activate the control room alann on initial valve actuation, even if the lever arm is overstressed. This item is open pending revision of the calculatio REGULATORY BASIS:

The calculation does not meet the intent of Section 4.9.5.f. Mechanical Requirements, of the Referenced GPUN specification, which requires that system-specific mechanical functional and design requirements be identified

'

and satisfied. Appendix B to 10 CFR 50 states in part that these measures will be in place to ensure design bases are correctly translated into procedure REFERENCES: P.PR Report Nu. MPR-1090, " Oyster Creek Nuclear Generating Station Mark 1 Containment Long-Term Program Torus to Drywell Vacuum Breaker Struc-tural Evaluation," October 1988.

I GPUN Calculation No. C-1302-243-5320-039, "18-inch Torus-to-Drywell Vacuum Breaker Disc Positioning Arm," Revision 0, January 14, 196 C-19

_ _ - _ _ _ _ _ _ i

.. .

,

. .

,

' . Atwood & Morrill Drawing No. H-20464M, Revision 4. "18-inch-150 l Vacuum Breaker Valve w/Outside Lever & Weights " August 11, 198 GPUN Specification No. EP-005, Revision 3-01 " Modification and System .

Design Descriptions," July 18, 1988, i Deficiency D-3: Seismic Qualification of Buried Emergency Service Water l (E5W) Pipe DISCUSSION:

GPUN Budget. Activity 328141P2 was part of a long-tenn GPUN program to monitor pipe wall thickness in ESW piping following permanent removal of the corrosion-protective lining from portions of the piping. As noted schemati-cally in Figure 3 of the GPUN report (Reference A), portions of the ESW lines were buried. The team asked GPUN to provide the seismic qualification report for these buried lines. The buried ESW piping was shown in detail on the

.relateddrawing(ReferenceB).

On November 3, 1988, GPUN provided the team with the seismic reanalysis report (Reference 3) that sumarized the calculation that seismically qualified the buried ESW piping. Through review of this report, the team noted that the .

piping inaterial stress allowable used in the report (48 ksi) was based upon the H

'

use of ASME Code (Reference d) allowables, and was more than three times the upset allowable which the piping code of record for OCNGS pennitted for grade A-53carbonsteel. pipe (1.2x12ksi=14.4ksi). Moreover, a review of the total stresses (axial + bending) sumarized at eight locations for each of the two L-shaped segments of 14-inch diameter ESW pipe indicated that the piping consistently exceeded the permissible upset stress of 14.4 tsi. The total stresses summarized in the report varied from a low of 14.56 ksi to a high of 62.52 ks On November 7, 1988, the team notified GPUN licensing of the above findin At that time, GPUN indicated that the seismic reanalysis report had been submitted to the NRC for review, but that GPUN had not received a formal response to the submitta The team considered this unresolved item to be safety-significant, since the NSR ESW piping is required to perform a safety function during and after a safeshutdownearthquake(SSE). This item remains ope REGULATORY BASIS:

.

FSAR Section 3.7.3.2, Analytical Procedures for Piping, notes that:

"All Class 1 (seismic) piping system configurations must satisfy the design stre.;s requirements and allowables specified by ANSI B31.1-1983 Editiun through Winter 1984 Addenda."

Appendix B to 10 CFR requires, in part, that measures be established to correctly transfer design bases to procedures, specifications, drawings, and instructions. The design bases specified in the FSAR were not correctly incorporated in the piping specification for 0CNG C-20

__ _ ___ ______ _ _ -

-

l

-

.

.

l

REFERENCES: i GPUN Technical Data Report No. 829, Revision 0, "UT and Visual Inspections of OCNGS Emergency Service Water Piping," January 20, 198 <

, JCP&L Drawing No. BR2192, Revision 12. " Composite Yard Piping Key Plan,"

l May 1983.

1 URS/ John A. Blume & Associates Report, " Seismic Reanalysis of the Buried Emergency Service Water Lines /0yster Creek Nuclear Generating Station," December 19, 197 ; ASME B&PV Code,Section III, Division I, Subsection NB - Class I l Components, New York, 197 Deficiency 0-4: (0 pen)PipingSpecificationSeismicCriteria DISCUSSION:

The team reviewed the piping specification (Reference A) which governed the design and installation of all large- and small-bore piping outside of the Reactor Building. GPUN Budget Activi.ty 328141P2 was part of a long-term GPUN program to monitor pipe wall thickness in ESH piping following the pennanent removal of the corrosion-protective lining from portions of the pipin Section 2.6 of the specification, Hangers, Anchors and Supports, noted that:

"For piping outside of containment vessel under this specification, the magnitude of the horizontal force shall be equal to 0.05 times the operating dead load of the piping. The vertical seismic load shall be considered zero."

The team noted that this seismic design criterion did not agree with the more stringent seismic requirements of FSAR Sections 3.2.1 and 3.7. GPUN licensing did not provide the team with a formal response to this issue during the week of October 31, 1988. However, GPUN informally indicated that all large-bore NSR piping outside of the Reactor Building had been reanalyzed as part of GPUN's 79-14 program to requalify NSR piping and suppoets to installed configurations. Therefore, the team did not consider this issue to be safety-significant for large-bore NSR piping. This program, in part, reanalyzed NSR large-bore piping and supports to the required FSAR seismic criteria. However, some NSR strall-bore piping may have been

'

installed to the less stringent seismic criterion (Reference A). In a separate finding, the team asked GPUN to confirm that NSR small-bore piping and supports were field-routed in accordance with FSAR seismic criteria and the piping code of record for OCNGS (Reference B). This item remains open until the piping specification is corrected to reflect the criteria specified in the FSA EEGULATORY EASIS:

FSAR Section 3.2.1 stipulates, in part. that a safe shutdown could be achieved during a ground motion of 0.22g. FSAR Section 3.7.2.6 requires, in part, that the maximum vertical acceleration be taken as 2/3 of *.he C-21

- _ _ __- - __ ____ ______ _ _

h ;;. ...

,

'

.

maximum horizontal acceleration, and'that the maximum horizontal and verti-

!.' cal accelerations be considered to occur simultaneously. Appendix B t CFR 50 requires in part that measures be established to correctly

!

l transfer: design bases to procedures, specifications, drawings and instructions. The design bases specified in the FSAR were not correctly incorporated in the.6 PUN piping specification for OCNG REFERENCES: Burns & Roe Specification No. S-2299-48. " Turbine Building Piping, Main Mechanical Equipment Installation and Miscellaneous Equipment, includ-ing Addenda 1, 2 and 3." April 29, 196 ANSI /ASME B31.1 " Power Piping," 1983 Editio Deficiency D-5: Control Rod Drive (CRD) Permanent Attachment Seismic Analysis l

DISCUSSION:

GPUN Budget Activity 402724 authorized the design, installation and testing of a new CRD handling mechanism. GPUN classified this equipment as *other,"

but required that the CRD handling mechanism maintain structural integrity during a SSE. 'The team reviewed the seismic analysis which the equipment vendor prepared for GPUN (Reference 1) with respect to the GPUN specification (Reference B). 'The. team found the GPUN a calculation (Reference A) deficient, in part, because of the following factors: ' The CRD handling mechanism was qualified to only one instead of two horizontal components of the SS The calculation did not address the vertical component of the SS During the week of October 31, GPUN provided the team with a revision to the referenced calculation dated October 28, 1988, which addressed the team's concerns. This item is closed REGULATORY BASIS:

Section 5.1.5 of the GPUN specification (Reference B) requires that the vertical SSE acceleration be taken as 2/3 of the horizontal SSE acceler-ation. Section 5.1.6 requires consideration of the square root of the sum of

,

the squares (SRSS) of the vertical and the two horizontal components of the SSE. Appendix B to 10 CFR 50 requires, in part, that measures be established to correctly transfer design bases to procedures, requirements, drawings, and instructions. The design bases specified in the calculation did not reflect design bases transfer REFERENCES: Nuclear Energy Services (NES) Calculation "GPUN CRDHH Permanent Attach-ment," Revision 0, August 31, 198 GPUN Specification No. ES-022, Revision 5 " Seismic Criteria," October 10, 198 C-22

_ _ _ _ _ - - - _ -

- _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . __ _ - - _ _ - _ .

.- .

,

., ,

,

. . .

Deficiency D-6: Containment Particulate Monitor (CPM) Piping Modification Qualification DISCUSSION:

GPUN Budget Activity 402815 modified NSR piping, valves, and conduit to facilitate the replacement of the CPM panel. The modified piping was shown on the CPM system drawing (Reference A). Thevendorcalculation(Reference B) qualified the revised piping configuratio ,

However, the team found the calculation deficient, in part, because it did not qualify the anchor bolt loads for support detail 666-001, which was shown as Detail 1 on the drawin GPUN licensing did not provide the team with a formal response to this issue during the week of October 31, 198 The team did not consider this issue to be safety-significant. GPUN indicated that the existing CPM panel was inoperative. This item is-close REGULATORY BASIS:

The calculation does not meet the intent of Section 4.9.5.f Mechanical Requirements, of the GPUN specification (Reference C) which requires that system-specific mechanical functional and design requirements be identified and satisfied. Appendix B to 10 CFR 50 requires that design requirements be translated into specification REFERENCES: Burns & Roe Drawing No. M0254, Revision 2 " Containment Particulate Monitor System Modification Isometric," September 16, 198 ! Burns.& Roe Calculation No. 4283-06-23-001, Revision 1 "GPUN/0C PASS / CONT. Monitor Modification," July 18, 198 GPUN Specification No. EP-005, Revision 3-01, " Modification and System Design Descriptions," July 18, 198 j Deficiency D-7: Containment Spray Piping Stress Analysis DISCUSSION:

GPUN Budget Activity 402876 anthorized the reanalysis of NSR piping and l supports in response to a 1905 NRC audit which identified documentation i deficiencies in GPUN's 79-14 and 70-02 programs. These NRC programs required the qualification of piping and supports to installed configurations. The team reviewed the piping analysis for a portion of the containment spray system (Reference A). This analysis was one of 50 piping analyses that GPUN performed to requalify 11 NSR system The team could not confirm that GPUN had addressed the following items in (

the related calculatio I C-23

_ _ - _ _ _ - _ - _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ -

- _ _ - - _ _ -

.( +

.'

. A comparison of the magnitudes of the seismic displacements and the as-built gaps at the locations of pipe suppurts 241-64 and 241-65. The piping analysis deleted these restraints due to excessive gap b. - A check of the piping flange joint GPUN licensing did not provide the team with a formal response to these issues during the week of October 31, 1988. However, GPUN informally indicated that the computed seismic displacement at the location of pipe

. support 241-65, which GPUN abandoned in place, exceeded the as-built gap dimension, and thet a' pipe clamp at that location will be removed to increase the gap clearance. GPUN will also document the adequacy of the pipe flange This_ item remains ope REGULATORY BASIS:

GPUN's failure to perform documented checks of pipe support gap clearances with respect to the computed seismic displacements for supports that were abanduned in place'does not meet the intent of IE Bulletin " Seismic Analysis for As-Built Safety-Related Piping Systems," 79-14, which requires that piping and supports.be analyzed to installed configurations. Section 110 Piping Joints, of the piping code of record for OCNGS notes, in part, that the piping joint used shall be selected with consideration of the mechanical strengt REFERENCES: , GPUN Calculation No. C1302-241-5300-024, Appendix E-5, Revision 2 August 9, 198 . ANSI /ASME B31.1, " Power Piping," 1983 Editio Deficiency D-8: Small-Bore Pipe Support Spacing DISCUSSION:

GPUN Budget Activity 402876 authorized the reanalysis of NSR piping and supports in response to a 1985 NRC audit which identified documentation deficiencies in GPUN's 79-14 and 79-02 programs. These NRC programs required the qualification of piping and supports to installed confi Section 2.1 of the GPUN design specification (Reference A)that indicated guration NSR *

small-bore piping (less than 2-1/2 inches in diameter) was originally field-

'

routed to generic spacing criteria (which GPUN cannot retrieve). Appendix B to the specification documents GPUN's regeneration of design span lengths for small-bore piping by extrapolating the large-bore piping support spans shown in FSAR Figure 3.7-14. GPUN compared these extrapolated span lengths with measyred piping spans for the small-bore Liquid Poison System. GPUN also perf wed a detailed piping analysis of the Liquid Poison System. GPUN contraded that the original support spacing criteria used to install small-bore pipe at OCNGS were satisfactory and were implemented.

,

C-24

_ _ _ _ _ _ _ - - ___

,

• *

.

.- .

,

however, the team could not confim that Appendix B of the. specificatio satisfactorily addressed the following concerns: Reduction of allowable pipe support spans for small-bore pipe due to

, the presence of in-line masses such as valve Consideration of piping thermal expansion due to operating temperatures greater than 150 degrees Adequacy of small-bore pipe supports subjected to combined dead, themal and seismic load In a separate finding, the team noted that NSR piping outside of the Reactor Building may have been installed to seismic criteria less stringent than current FSAR licensing commitment GPUN licensing did not provide the team with a formal response to this issue during the week of October 31, 1988. However, GPUN informally indicated that the detailed analysis which GPUN performed to requalify the piping and supports for the Liquid Poison System provided adequate confirmation that -

NSR small-bore piping and supports were properly installed at Oyster Cree This item remains ope The' team considered this issue to be a documentation rather than a safety significant issu .

REGULATORY BASIS:

NSR small-bore piping and supports are required to meet the stress require-ments and allowables of the piping code of record for OCNGS (Reference B).

REFERENCES: GPUN Specification No. SP-1302-12-208, revision 1, "1985 IE Bulletin 79-02/14 Inspection Program Design Input for Piping Stress Analysis,"

November 13, 198 ANSI /ASME B31.1, " Power Piping," 1983 Editio Deficiency D-9: 2-Bolt Base Plate Qualification DISCUSSION:

GPUN requalified base plates with anchor bolts under Budget Activity 328130P5 I in response to a 1985 NRC audit which identified documentation deficiencies l in GPUN's 79-14 and 79-02 programs. These NRC programs required the qualifi-cation of piping and supports to installed configurations. The team reviewed several pipe support configurations which consisted of pipe hangers supported by supplementary steel. The supplementary steel was supported at one end by a 2-bolt base plate which was fixed to a wall. The base plate anchor bolts were aligned horizontally. The GPUH pipe support calculation which qualifies each of these supports modeled the connection between the supplementary steel and the base plate as a pinned rather than a rigid connection. This analytical assumption provided a conservative check of the stresses in the supplementary steel. However, it was unconservative when computing the loads C-25

. ,

.

, .

.

in the base plate anchor bolts, since only the anchor bolt shear force, but not the anchor bolt tension or shear and tension interaction, was computed and checked against allowables. ESW system pipe supports SW-2-H2, SW-2-H8, and SW-2-H]0 were typical examples of such pipe support configuration GPUN did not provide the team with a formal response to this issue during the week of October 31, 198 The team considered this to be a safety-significant issue, since the NSR ESW system was required to perform a safety function during and after a SS This item remains ope REGULATORY BASIS:

Anchor bolts for 2-bolt base plates subject to " weak axis" bending may not be properly qualified to the anchor bolt acceptance criteria which GPUN speci-fies in Reference a. Appendix B to 10 CFR 50 requires design bases to be translated into specification REFERENCES: GPUN Specification No. SP-1302-12-212, Revision 0, "1985 IE Bulletin 79-02/14 Inspection Program Design Input for Piping Support Analysis,"

October 29, 198 Deficiency D-10: Containment Spray (CS) Heat Exchanger Supports DISCUSSION:

CS heat exchangers 1-1 and 1-2 were modeled as anchor points in the Reference 1 piping analysis which GPUN prepared under Budget Activity 402876. The team reviewed the vendor calculation (Reference B) for the heat exchangers to confirm that the A325 anchor bolts which supported the heat exchangers had been qualified to the design nozzle and seismic loads. The calculation referenced the ASME B&PV Code, 1977 Edition, as the source of the allowable bolt stresses. However, the team could not confirm the accuracy of the tension and sheur allowables which the calculation used to qualify the anchor bolts to the imposed load GPUN licensing did not provide the team with a formal response to this issue during the week of October 31, 1988. However, GPUN informally indicated that the method which the vendor used to qualify the anchor bolts did not employ

.

code stress allowables. Consequently, GPUN performed an alternative calcula-tion which used code stress allowables to qualify the heat exchanger anchor bolts. This item is close REGULATORY BASIS:

The team could not confim that the vendor calculation which qualified the CS heat exchanger A325 anchor bolts used the tension and shear bolt stress allowables specified in the ASME B RC Code, 1977 Editio ,

C-26

_ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ . _ . _ _

. - _- - - _ _ _ _ _ _ _ _ - __--__ :. ..

.

..- .

e

'

ANSI N45.2.11 requires that analyses be sufficiently detailed as to purpose, method and assumptions and that a technically qualified person in the subject; j

can review, understand and verify the adequacy of the analyses without recourse to_the originato REFERENCES:- GPUN Calculation ho. C1302-241-5320-024, Appendix'E-5, Revision 2, August 9, 198 Perfex Calculation No. 51-9361, " Heat Exchanger Seismic Analysis,"

October 11, 197 Deficiency E-1: Poor Records Management for Load Changes on IE Power Sources DISCUSSION:

The team reviewed modification package #BA-402856. This modification package was issued to lower the reactor water level setpoint for feed water (FW)

control following reactor scram. The FW pump run out protection logic design was also changed. The purpose of lowering this setpoint was to prevent flooding of the isolation condenser stean line after a reactor scram. The modification provided an automatic means to reduce the magnitude of reactor water level variatior.s during plant shutdown transients not caused by a

' failure in the FW control system. Following a scram, voids collapse and cause a low sensed water level without actual reduction in water inventor Without the mechanism provided by this modification, the low sensed level would provide a higher demand from the FW control system and the resultant excess inventory cddition could result in high water level and possible flooding of the isolation condenser steam line This modification would increase loading on the 120 volt vital power bus and on the class IE station battery system. The team reviewed the licensee's load control program for the 120 volt vital AC bus, 125 volt DC system, and class IE diesel generator system and noted that the licensee did not have adequate procedures to record and track the load additions. Individuals have recorded load additions simply by noting them on a scratch pad. The licensee's load control program was found to be a collection of such scratch pad papers, without signatures or proper verification, stored with individual engineers without being tracke The licensee failed to follow Technical Division procedures for design verification which stipulated that the design verification must be performed as a control measure to verify adequacy of engineering designs which are within scope of GPUN operational QA plan 1000-PLN-7200.01. The team noted that class IE power sources, such as the 120 voit vital power supply, 4160 volt diesel generators and 125 volt station battery systems, were within the scope of the QA pla The team was informed that the licensee was aware of this concern and was in the process of installing a computer-based tracking system. In the future, this system would have the capacity to track all load additions to all .

affected buses. The tracking system would also indicate the remaining margin l of the available capacity of the associated equipment. The licensee expects l

C-27

_--_--__ ,

. .

. ,

to complete this activity in the near future. Until this PC-computer-based j tracking system is installed, the licensee comitted to rearrange all the (

note pad papers showing loading changes and to make these documents official l by signing, verifying, and controlling them. This item remains ope REGULATORY BASIS:

ANSI N-45.2.11, Section 6.1, states, "The results of design verification efforts shall be clearly documented with the identification of verifier clearly indicated thereon, and filed. Documentation of results shall be auditable against the verification methods indicated by the design organiza-tion."

Section 6.2 Design Verification, states that, where changes to previously verified designs have been made, design verification shall be required for the changes, including evaluation of effects of these changes on the overall !

desig REFERENCES: It.C modification package GA-40285 Licensee OA plan 1000-PLN-7200.0 Safety analysis report for requirements of 10 CFR 50.5 Safety analysis report for Appendix "R" requirements Installation instructions, post-modification test results acceptance criteria, drawings, and related calculation ANSI N-45.2.11, 197 Deficiency E-2: Failure to Calculate Acceleration Time of the Pump and Motor Assembly for the Core Spray Pump and Emergency Service Water Pum DISCUSSION:

The team reviewed mini-modification package No. 7. The mini-mod packages were issued by the branch of the design engineering located at the plan The purpose of this modification was to replace the thermal overload and instantaneous relays device numbers 49 and 50 respectively, with new relays having more reliable and predictable operating characteristics, along with

-

a shorter reset tim The team noted that the trip settings of the new relays were established  ;

using calculation No. C-1302-750-5350-001, dated February 10, 1988. The team reviewed this calculation and noted that the settings were justified without accounting for the acceleration time for the pump and motor assembly during startu In a situation where these motors were fed from the diesel genera-tor, it might be possible that, due to block start of ESF loads and random loads, the minimum voltage at the motor terminals may be less than the normal rated voltage. On low tertninal voltage.. motors take a longer time to accelerate, and during acceleration motors draw currents higher than normal C-28

- - _ _ _ _ _ _ _ _

_ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _

,

,,

.. . ,

,

running currents. Therefore, if the acceleration time of the pump and motor assembly is more than the trip time of the over-current relay, the relay will trip before the motor attains its full spee Licensee engineers informed the team that, since information related to the motor torque, load torque, and moment of inertia of pump-motor assembly was not retrievable, it was not possible to compute acceleration timing. The team expressed a concern that without knowing acceleration time, it is not possible to verify that these pumps will not be tripped prematurely during acceleration. This created an indeterminate situation in which it is possible that core spray and essential service pumps disabled by premature trip may not be available to mitigate demands of a concurrent LOCA and LOOP inciden On the last day of the inspection, the licensee revised the calculation and demonstrated that the selected settings were adequate for a terminal voltage I equal to 80 percent of the motor-rated voltage. The calculation inputs were based on test results which in the team's opinion may not be conservativ Testing was done only by establishing recirculation flow, and full flow was not established. The team concluded that for full flow, the acceleration time i will be greater than the value used in the revised calculation. The calcula- l

'

tion also assumed.that the load torque remains constant throughout the acceleration period, which may not be true. The team believes that the load torque value will increase during the early phase of the acceleration period, making net available torque lower than the assumed value in the calculatio Lower values of net torque may result in increased time for acceleration. The calculation also assumes a terminal voltage equal to 80 percent of the motor-rated voltage. This basis has not been substantiated. The testing results did not indicate the accuracy with which acceleration time was measured and does not indicate the range of speeds within which between this time was noted. The team considers this item ope REGULATORY BASIS:

Unavailability of an ESF system for mitigation of a concurrent LOCA and LOOP event is contrary to the Technical Specification requirements which stipulate that these pumps must be available under all plant conditions other than cold shutdow REFERENCES: Calculation C-1302-750-5350-001 dated 2/10/88 and 11/4/8 ~ Safety analysis report for requirements of 10 CFR 50.5 Safety analysis report for Appendix *R" requirements, installation instructions, post-trodification test results acceptance criteria, l drawings, and related calculations, OCNGS Technical Specification j l-

!

l C-29

- __-___ - _ - _ - _ _ _ _ _ _ - _ _ - _ _ _

-)

m 7 o'

p .<' C

'

3'

3 Deficiency E-3: Potential for the Process Variable of the Safety Systems to Exceed the Technical Specification Limit Without Being Noticed by the Plant Operato DISCUSSION:

'The team reviewed three sample calculations for process trip setpoin I These calculations were done for modification packages No. BA-402896,

'BA-402256 and BA-408761 and were performed by Burns & Roe, Ebasco Services, and the in-house staff, respectivel ;

Calculation No. 4283-12-11-001 (modification package BA-402896) for the I reactor pressure trip setpoint showed a margin of 10 psig between the nominal setpoint and the Technical Specification limit. This margin consisted of total loop uncertainty of 8 psig plus an additional allowance of 2 psig. The margin was divided into three zones. . Zone 1, known as the

"AS LEFT" zone, was between the nominal setpoint and a margin of 3 psig above. During calibration, the setpoint could be left up to the upper limit of this zone. Zone 2 began at the upper limit'of Zone 1 and extended to the

"as-found" allowable limit of the setpoint. This upper limit was 2 psig below the technical specification limit. In a situation where a setpoint has been left on the upper limit of the "AS LEFT" zone (i.e., greater than 3 psig above the nominal setpoint), it may be possible for the process variable to exceed the Technical Specification limit although by virtue of loop in-accuracy, the measured value may still appear to.be within the "as-found" allowable limi Licensee engineers were made aware of this situation. During follow-up discussions with the licensee engineers, the team was informed that a similar methodology has been used.for calculation and calibration of other safety-related instrument loops. Consequently, the team was concerned that this may be a generic proble In the latter part of the inspection, the team was informed by the licensee

' hat the in-house review committee had already identified this concern. As d . result, the licensee intended to revisit all potentially affected safety-related instrument loops before the restart of the plant. On the last day of this inspection GPUN informed the team that there are eight such loops which may require revised calculation. This item remains ope REGULATORY BASIS:  ;

The Technical Specification specifies maximum and minimum (as applicable)

- values of the process variables of safety systems. To ensure the safety of the plant and the public, these processes are required to operate within established limits during normal plant operatio REFERENCES:

' Calculation 4283-12-11-001 Rev. 1 Calculation IC-87-001 Rev. 2 Calculation 1302-661-019 Rev. O t

C-30

_ _ ___ _-_____-__-- -_-_ n

,"e ,

, e .

,

e

Deficiency E-4: Calculation Errors, Such as Unverified Assumptions and Failure to Account for Response Time of the System Equipmen DISCUSSION:

The team reviewed three. sample calculations for process trip setpoin These calculations were done for modification packages BA-402896 BA-402256 and BA-408761 and were performed by Burns & Roe, Ebasco Services, and the

! in-house staff.respectively. As a result of this review, the team identified the following concerns.

' The safety margin value used in the reactor pressure setpoint calculation lacked justificatio . Instrument accuracy, as stated by the manufacturer, was assumed to be representative of three standard deviation Power supply voltage variation was assumed to be within +5 percent without proper reference . Instrument field calibration accuracy was assumed to be +0.25 percent of span and setpoint without verification from the plant sit Calculations did not account for the response time of the instrument loop or the equipment which is actuated by the accident signa During discussion with the licensee's engineers, the.teani was infonned that General Electric may have considered this factor. in their calculation for the Technical Specification limit of the proces Therefore, as long as the original values of the Technical Specification limits are used, it may not be necessary to reevaluate response tim The team expressed concern that a modification to the system may change its response time and, therefore, the effects of the changed response time on the trip settings for modified systems should be evaluate The licensee's engineers informed the team that, in the future they will exercise additional caution in verifying the calculations performed by the ,

architect-engineer companies. The team also noted that the licensee lacked a program to track and resolve unverified assumptions in calculations performed for safety-related system The team was informed by licensee that the in-house review committee had already identified the concern related to failure to consider the response times and intended to resolve this concern by revisiting all safety-related setpoint. calculations before the restart of the plant. This item remains ope REGULATORY BASIS:

ANSI-N45.11 requires that procedures shall include requirements for documenta-ting assumptions and identifying those assumptions that must be verified as the design proceeds. Failure to resolve unverified assumptions in the safety-related calculations and to consider the effects of equipment response time changes due to modification may result in incorrect settings for activation of the safety systems. These incorrect settings may compromise safe shutdown i'

capability of the safety systeni and may eventually compromise public safet C-31

)

y..m 4 8 '. g) .,a q

D

@ ,4 t

.

• '

REFERENCES i Calculation 4283-12-11-001 Rev. I Calculation 1C-87-001 Rev. 2 Calculation 1302-661-019 Rev. O ANSI N45.2.11, 197 Deficiency E-5: Failure to Consider Random Loads on the Diesel Generator During LOCA and LOOP Sequences, DISCUSSION:

New thermal and instantaneous over current (device number 49 and 50) relays were installed per mini-modification No. 7. For setpoint calculation of these relays, diesel generator test data was used to establish minimum available voltage during worst-case diesel loading. The team reviewed the test data and ensergency diesel generator's sequenced loading for LOCA and LOOP event Through this review, the team noted that, during the sequencing of required loads, it is possible that random loads may be started along with the sequenced loads. Random loads are those loads which are started automatically by the ,

process signals and are not bypassed by the accident signal. Examples incLded ;

sump level activated pumps, and thermostatically controlled heat tracing. As l a result, the OCNGS generator may be loaded to approximately 10 percent of its rated capacity. The team noted that the licensee failed to perform an analysis of the effects of random load initiation on the diesel generator's voltage and frequency drop and its recovery between loading step The licensee infomed the team that the possibility of starting of such random loads along with the sequenced loads exists, but that the size of individual loads was small. The licensee also contended that randomly started loads would not create an appreciably harmful effect on the voltage and frequency of the diesel generator. The licensee further informed the team that GPNU intended to analyze the condition in the near future. This item remains open pending completion and results of the GPU analysi REGULATORY BASIS:

ANSI N45.2.11 states that procedures shall include requirements for documenting assumptions and identifying assumptions that must be verified as the design

- proceeds. GPUN made a tacit (undocumented) assumption that random loads would not affect the voltage and frequency of the diesel generator. Random loads, if not bypassed by the " sequencer active" signal, may try to start along with a sequenced step load and may trip the diesel generator or impede its voltage and frequency dip within the assigned time. This, in turn, could delay or prevent starting of the subsequent ESF loa REFERENCES: DG test result voltage curve Load tabulations for LOCA and LOOP mitigatio C-32

_ _ _ _ _ _ - -- -- _ _