IR 05000259/1987036
| ML20148H218 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 01/15/1988 |
| From: | Georgiev G, Peter Hearn, Liaw B NRC OFFICE OF SPECIAL PROJECTS |
| To: | |
| Shared Package | |
| ML20148H206 | List: |
| References | |
| 50-259-87-36, 50-260-87-36, 50-296-87-36, NUDOCS 8801270170 | |
| Download: ML20148H218 (15) | |
Text
. 1
-
. l l
e
.
l ENCLOSURE UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF SPECIAL PROJECTS TVA PROJECTS O! VISION Report Nos.: 50-259/87-36 and 50-296/87-36 Docket Nos.: 50-259, 50-260 and 50-296 License Nos.: OPR-33, OPR-52 and DPR-68 Licensee: Tennessee Valley Authority
,
Facility Name: Browns Ferry Nuclear Plant Units 1, 2 and 3 Inspection Conducted: October 26-30, 1987 Inspectors: C ' - V- r / /Y/g7 Georie B.Georgiev,'TeamLyr Datd W
P. M rn
~
-
/
^ , J #b ,//v/n Oatef Consultants: S. Traiforos, C. Kimura, R. McFadden, N. Rivera, P. Chan, J. Thomas, S. Refai, O. Mallon, N. Tsai, M. Partridge Approved by: M1L %
BQ.i L' aw,' Assistant Director Date for Technical Programs Division of TVA Projects 8801270170 G80121 9 DR ADOCK OSO
--
.- _-
.. - - ,
e l
.
'
l
t I
NRC TEAM INSPECTION DESIGN BASELINE AND VERIFICATION PROGRAM i BROWNS FERRY NUCLEAR PLANT l 1. INTRODUCTION
.
The Tennessee Valley Authority's (TVA's) Browns Ferry Nuclear Plant (BFN) '
Design Baseline and Verification Program (DBVP) was first submitted to the NRC on August 28, 1986. On March 13, 1987 and July 10, 1987, TVA submitted more l detailed versions of the DBVP, which upgraded the program to (1) reconcile design control issues. (2) re-establish the design basis and (3) evaluate the plant configuration.
This NRC team inspection was performed to review and assess the adequacy of the information contained in the BFN DBVP.
2. BACKGROUND INFORMATION The DBVP was established to resolve several problems related to design control j that had occurred at BFN. These problems included: (1) the original design control progrom allowed an as-built set of drawings to be maintained by plant operations and an as-designed set of drawings to be maintained by engineering, (2) the plant configuration was not reconciled with the design basis because the plant design basis was scattered among many documents thus making them not readily usable, and (3) external reviews and studies have indicated weaknesses l in plant modifications performed after the plant was placed in operation. 1 The objectives of the DBVP are to re-establish the design basis and evaluate the plant configuration to ensure that it satisfies the plant design basis, i The DBVP is being implemented in two phases. Phase 1 will be completed before startup and will include the evaluation of systems and portions of systems required for safe shutdown. These systems will be identified by evaluating the abnormal operational transients, design basis accident and special events ,
addressed in the BFN Chapter 14 of the Final Safety Analysis Report (FSAR) and I by determining the safety actions necessary to mitigate these events. Phsse 2 l will be completed after startup and will include implementation of the remain- l ing modifications of systems not required for startup, ccmpletion and revision ,
of the design criteria documentation, completion of system evaluations, and l implementation of corrective actions to other systems as required.
3. SCOPE I
The NRC team (1) reviewed the information contained in the DBVP and a sample of associated documentation, and (2) interviewed cognizant TVA personnel to obtain pertinent information concerning the DBVP.
4. SUMMARY The NRC team found that the BFN DBVP contained the essential elements needed to achieve its intended goals and objectives. However, the team identified
.
.-, - - --. ,
_ _ _ _ _ _ .
.
'
.
.
-2-
several areas of concern that related to implementation of the program. l Examples of these concerns are listed below:
(1) The.use of accident conditions for test acceptance criteria, without 1 considering the system design limits, may result in masking precursors of l
'
common-mode failures.
(2) The classification of the containrent purge valve operational capability as a Phase 2 priority item is not acceptable. This item should be class- )
ified as a Phase 1 priority item. I l
'
(3) The stated policy of functionally testing a system by using minimum performance levels for safe shutdown is unsatisfactory because it does not provide margins for end-of-life accident conditions.
I (4) The sample review of design criteria documents identified several inconsistencies in definin Moreover, TVA's engineering assurance (EA)g the applicable oversight design review team codes. additional has identified problems; all of which must be addressed by TVA.
(5) The DBVP emphasizes only functional drawings and does not adequately I address physical (dimensional) drawings. The physical drawings are needed to perform some of the required essential calculations and to verify existing essential calculations.
(6) The DBVP generally relies on functional circuit checks in lieu of circuit verification to walkdown electrical and I&C systems. The methods of assuring physical separation and electrical independence of redundant channels are not explicitly addressed.
(7) Some design requirements contained in FSAR Appendix C have not been included in the commitments /reauirements data base listing.
(8) The DBVP does not currently include the essential civil / structural l calculations. l (9) There are many ongoing programs that interface with the DBVP. The team could not identify the method used to coordinate these programs and the means of communication between the personnel involved with each program.
TVA needs to establish this methodology. Furthermore, since programs other than the DBVP are used to verify important facets of design, TVA must revise the DBVP to explicitly identify these programs and provide clear cross-references between the DBVP and the other programs on a system-by-system basis.
5. INSPECTION DETAILS The NRC team divided its review of the DBVP into five areas: civil / structural area, mechanical components, and mechanical, electrical, and instrumentation and control systems. The general scope of this inspection included a review of the information in the DBVP and associated supporting documentation in relation
.
, ,-
F
.
-
.
l
-3-to each specific area as well as interviews with TVA personnel cognizant of a particular area. Any additional inspection activities, specific documents reviewed, findings, and conclusions for each of areas are discussed below.
5.1 Civil / Structural Area The NRC team reviewed the documents listed below during this portion of the i'
inspection:
1. DBVP, Rev. 2 and applicable portions of BFN FSAR. 2. Browns Ferry Nuclear Performance Plan, Rev. 1, June 1987, Sections III and j IV, Vol. 3. l
,
3. BFN-50-C-7100, Rev. 0, July 1,1987, Design of Civil Structures.
4 BFN-50-C-7102, Rev. O, July 1, 1987, Seismic Design.
5. BFN-50-C-7104, Rev. 0, July 1,1987, Design of Supports. l 6. BFN-50-739, Rev. 0, June 5,1987, Classification of Structures, Systems and Components.
I 7. Design Bases Commitments /Peauirements Tracking System, October 23, 1987, l Civil Engineering Branch Discipline.
8. Engineering Assurance Oversight Review Team action items listing.
5.1.1 Findings The NRC team found that the DBVP contains the essential elements needed to adeouately address the civil / structural area and to achieve its intended goals and objectives. However, on the basis of its review of the DBVP and referenced ,
documentation and interviews with cognizant TVA personnel, the team found that l the licensee has made no commitment to perform the essential civil / structural calculations, including those for major building structures. This is a program i weakness since some calculations may be incomplete, missing, or may not be meeting current licensing comitments, j
In addition, TVA has established a separate calculation program to (1) verify !
that essential calculations exist and are retrievable, (2) regenerate essential l calculations if they do not exist, (3) ensure the essential calculations are
'
consistent with licensing commitments and are technically adeouate, (4)
identify and resolve unverified assumptions, and (5) establish a procedure tn maintain the technical adequacy and retrievability of all essential calculations.
The team's preliminary review of the civil / structural design criteria revealed that the criteria have not yet been reviewed by project personnel nor incorporated into the committment/requirerrents data base. In addition, the
!
!
. - _ _ _ - _ _ _____
.
.
.
-4-
.
design criteria used to prepare and evaluate the structural calculations were incomplete.
The NRC tuam observed that some elements of the program are being addressed by other currently ongoing TVA programs. At this time the team could not clearly establish the licensee's method to coordinate the efforts of these programs and to provide a means for personnel involved with these programs to communicate with personnel associated with the DBVP.
5.1.2 Conclusions The NRC team concluded that the DBVP is structurally adequate in the civil /
structural area. However, the NRC team noted that the interface and coor-dination between DBVP and other currently ongoing programs was not clearly defined and there is no provision to perform the essential civil / structural calculations.
5.2 Mechanical Components The NRC team reviewed the documents listed below during this portion of the inspection:
1. DBVP and applicable portions of BFN FSAR, Eev. 2, Browns Ferry Nuclear Performance Plan, Rev. 1. June 1987.
2. Safe Shutdown Analysis.
3. Selected listings from Commitments / Requirements Data Base Tracking System.
4. BFN-50-C-7103 Structural Analysis and Qualification of Mechanical Systems.
5. Engineering Assurance Oversight Review Team action items listing, October 22, 1987.
6. Various Action Item Reports and Response / Resolution Correspondence for Civil / Structure Discipline Action Item Numbers: C-001 through C-019, C-024 through C-032, and C-040 through C-043.
7. Program Plan for the Engineering Assurance Independent Oversight Review for BFNP.
8. Condition Adverse to Quality Report (CAOR) No. BFT870842.
9. BFN-50-C7104, Design of Supports (for Piping).
10. BFN-50-7001, Main Steam System (ADS Function).
11. BFN-BFS3-004, Rev. 1 (ADS Function), DNE Calculation System Requirements for Main Steam System.
..
'
t l
l
.
l-5-12. BFN-BTRD-004, Rev. 1 (ADS Function), Baseline Test Requirements, Main Steam System.
5.2.1 Findinos The NRC team found that the DBVP contains the essential elements needed to adecuately address the area of mechanical components and to achieve its ,
intended goals and objectives. !
The team found that general design criteria for structural analysis and ouali-fication of mechanical systems and for design of supports contained direct .
excerpts from several previously published TVA design criteria documents. This i attributed to the poor organization of the documents. Criteria related to I older licensing commitments were included in the general design criteria without regard to technical adequacy. The criteria also contair.ed discussions and references to design codes that were incorrect and confusing.
The design criteria should clearly identify the appropriate codes to be applied for evaluation of existing designs and for performing evaluations of new or modified designs for the lifetime of the plant. The correlation between design rules provided in the codes and the level of quality provided by the related requirements for material certification, testing, fabrication, and inservice inspection also should be included.
The NRC team could not determine from its review whether TVA's implementing l procedures adequately define the scope and methods necessary for personnel ;
involved in the DBVP and the forty or more other ongoing programs at BFN to l coordinate effectively. TVA needs to develop a single administrative procedure i
,
to define scope, responsibilitics, schedules, and methods of communication l between DBVP and other ongoing programs. l One of the major goals of the DBVP is the verification of the functional I adequacy of the plant configuration. TVA had conducted walkdowns to verify several hundred functional design configuration drawings (DCD). However, these drawings do not show the physical as-built configuration of the plant. TVA needs to assess the physical drawings of the plant to determine what effect the alleged loss of configuration control has had on the adequacy of essential calculations that were performed. The physical drawings of the plant should be categorized by function or type and should be evaluated. Drawing categories that require a high degree of conformity to the as-designed configuration to support essential calculations might then be independently assessed to deter-mine the conformity of these drawings with the as-built configuration. If necessary, certain drawing categories can then be recommended as requiring complete configuration control and added to the list of DCDs. For the other drawings, not brought to the DCD level, there will, at least, exist an assess-rent report that details the type, frequency, and trends of configuration discrepancies to be expected.
Specifically the DBVP will perform essential calculations on the basis of (1)
as-built system functional drawings and (2) as-designed physical configuration drawings. However, the team is concerned that the essential calculations for
.
.
.
-6-the piping systems may be performed using inappropriate physical configurations of the system because the as-designed and as-built drawings are sometimes quite different. The DBVP does not contain program requirements to address this issue and TVA needs to revise DBVP to address this potential problem area.
During interviews and presentations TVA stated that it would resolve this concern (1) by obtaining as-built physical configuration drawings of a system before the calculations are performed and (2) by establishing design controls ,
to ensure that the essential calculations are reviewed to determine the effect j of as-designed to as-built configuration changes on the calculation results and conclusions. ;
The NRC team could not find specific design requirements for safety / relief valves contained in FSAR Appendix C in the Comitments/ Requirements data base l listing for safety / relief valves. These data may be completely missing from j the data base or these data may be categorized only by the main steam system and not by the component category. In either case, this program is not functioning as required because the FSAR requirements could not be found in the l data base listing for safety / relief valves. TVA needs to ensure that the l specific design requirements of FSAR Appendix C for safety / relief valves and other components be included in the commitments / requirements data base listing.
Furthermore, the cause for this missing data should be investigated by the EA Oversight group to ascertain if it is an isolated incident or a generic .
problem. l The designNRC team criteria identified and the BFN the following)two FSAR: inconsistericies (1 The design code listedbetween the system for the main steam safety / relief valves in Paragraph 6.1 of the System Requirements for the main steam system is different from that listed in Paragraph 3.7.2.2.6 of the Main Steam System Design Criteria and Section 4.4 of the FSAR. (2) Table C.0-7 of the FSAR specifies the corrosion allowance for the main steam isolation valve to be 0.12 inch; whereas, the Main Steam System Design Criteria, Attachment 2, Part B, page 5, specifies the corrosion allowance to be 0.088 inch. While these particular inconsistencies may not have a major consequence, it does point out that inconsistencies exist between various documents associ-ated with the DBVP. Because many of the DBVP documents have been prepared in parallel, rather than in sequence, TVA should review such inconsistencies to determine whether there is a potential problem area of document inconsistencies in the DBVP.
5.2.2 Conclusions The NRC team concludes that the DBVP is structurally adequate in the area of mechanical components. However, the NRC team roted that the design criteria contained errors, the method of interface and coordination between DBVP and other ongoing programs is not clearly defined, and the DBVP does not specify the use of as configured physical drawings when performing essential calculations.
5.3 Mechanical Systems The NRC team reviewed the following documents during this inspection:
__ _
.
-
.
.
l l-7-1. DBVP and applicable portions of BFN FSAR. 2. Browns Ferry Nuclear Performance Plan, Rev.1, June 1987.
3. Safe Shutdown Analysis (SSA),
4. BFN-0SG3-048(Branch /Projectidentifier).
5. B22 '86 0628 010 (R0 RIMS Accession No.).
6. 822 '87 0226 251 (R1 RIMS Accession No.).
7. System Reouirements for Residual Feat Removal BFN-BFS3-033, Rev.1 8. System Reouirements for RHR Service Water, BFN-BFS3-009, Rev. 1 9. System Mode Requirements for DB&VP Restart Plan, BFN-BFS3-050, Rev. 1 5.3.1 Findinas The NRC team found that the DBVP contains the essential elements needed to address the area of mechanical systems and to achieve its intended goals and objectives.
However, in its review of the system requirements calculations (SRC) for the residual heat removal (RHR) and the RHR service water systems, the team noted that both of these system requirement calculation packages follows the same format and perform the same function for their respective systems. Neither package stated which procedures were used to prepare the calculation.
Furthermore, the calculation package for the RHR system does not reference the Browns Ferry Updated FSAR, Technical Specifications, or the operating instructions. If a calculation package is to determine what system is reouired under what plant conditions and how it will respond to changing plant conditions, it would seem appropriate that the package references these documents.
The NRC team observed that some elements of the DBVP are being addressed by other currently ongoing programs. Communication and coordination of efforts between personnel involved in the different programs do not appear to be clearly defined; therefore, it is not clearly auditable. Effective coordina-tion and communication between personnel involved in these many programs will be crucial to the implementation of the DBVP. During this inspection, the team substantiated the existence of at least 40 programs.
The DBVP uses accident conditions for the system test acceptance criteria. The NRC team is concerned that the use of accident conditions for the test acceptance criteria, without considering the system design limits, could result in masking precursors of common-mode failures.
Although system restart testing is currently under way, some systems are being tested without the benefit of essential calculations, which could create potential problems; for example, the need to repeat certain tests.
Furthermore, the team could not determine whether a mechanism has been established to keep DBVP personnel apprised of the restart test experience.
This is a serious drawback in the progress of the DBVP and might result in substantial rework, resulting in delays.
The Systems Mode Requirements for the DBVP Restart Plan identifies various events and actions defined in the Safety Shutdown Analysis (SSA). The review
. - . - .
l l 1 a l
' '
l .
i 1 . 1-8- !
l
,
of this document revealed that the containment purge valve (CPV) operational capability is assigned as a Phase 2 priority item. The CPV should be assigned I as a Phase 1 priority item.
5.3.2 Conclusions The NRC team concludes that the CBVP is structurally adequate in the area of the mechanical systems. However, the NRC team noted that the interface and coordination between DBVP and other currently ongoing programs is not clearly l defined, accident conditions instead of design conditions are used for test I acceptance criteria, the CPVs are classified as a Phase 2 priority item instead of Phase 1 priority item, and some of the reviewed system requirement caiculacions dic not reference the FSAR or state which procedure was used to prepare the calculations.
5.4 Electrical Systems In aedition to the general scope of this inspection, the NRC team conducted a plant walkdown of the 250-V dc vital batteries and the emergency diesel generators. Listed below are the documents reviewed by the team during this portion of the inspection:
1. DBVP Rev. 2 and applicable portions of BFN FSAR 2. Browns Ferry Nuclear Performance Plan, Rev. 1, June 1987 3. BFN-50-7200C, 250 VOC Power distribution system, a restart design criteria document 4. Procedure Method (PM) 86-02 (EEB)
5.4.1 Findinas The NRC team reviewed TVA's records of the original electrical walkdowns and found that these walkdowns were conducted under such loose documentation and quality assurance procedures that severe doubt exists concerning the validity of the walkdown results: (1) the walkdowns were completed before approved performance procedures were issued and (2) the original documentation (e.g.,
marked up design drawings) was not traceable and retrievable. The Engineering Assurance Oversight Review Team discovered that condition during an internal audit and issued a Condition Adverse to Quality Report (CAQR). TVA plans to perform a sample reverification of the least documented 10 percent of the walkdown information under full quality assurance control. If the 10 percent sample contains any deficiencies, TVA will perform a 100 percent reverifica-tion. The NRC team considers this approach to be acceptable because of the limited scope and objectives of the electrical walkdown portion of the OBVP and because detailed electrical walkdowns under full quality assurance control are in progress under several other programs.
The NRC team confirmed that TVA has issued Procedure Method (PM) 86-02(EEB),
Rev.1, which provides definitions and selection criteria for "essential" and
. -.
'
.
-
. l l .
l -9-
.
"desirable" electrical design calculations, as well as a minimum list of such calculations for all TVA nuclear power plants, including BFN. "Essential" calculations are those which support the design of safety-related (Class 1E) I systems or features and must be completed for each specific plant before '
restart of plant. "Desirable" calculations address reliability and avail-ability rather than safety issues and must be scheduled, but not necessarily completed, before restart. The procedure allows alternate verification methods j such as design standards or testing to substitute for design calculations under l appropriate quality assurance and administrative centrols. TVA's essential I calculation program was independently reviewed by Sargent and Lundy Engineers.
On the basis of its review of (PM) 86-02(EEB) and interviews with TVA personnel the team considers the BFN essential calculations program to be acceptable from a programatic standpoint.
Although a considerable number of essential electrical power calculations existed for BFN, they were of inconsistent quality and in conflict with one another in important respects. TVA properly elected to discard the existing material and reconstitute all calculations. TVA first performed a 100 percent nameplate-data walkdown of the Class IE electrical power systems; this fully verified information formed the basis of the essential design calculations, i TVA contracted with Bechtel Power Corporation to perform all essential !
electrical power calculations except for the "Appendix R" analysis, which TVA l is performing in-house. The Bechtel calculations which were performed under l Bechtel technical and quality assurance procedures and were essentially completed in June 1987, were reviewed by TVA/EEB. TVA EEB noted several deficiencies in the calculations and issued CAQRs; as soon as these are resolved, the essential calculation set will be formally issued as TVA calculations. The NRC team found the essential electrical ca',culations l component of the DBVP to be progressing well.
'
The NRC team finds that the DBVP contains the essential elements needed to ;
address the area of electrical systems and to achieve its intended goals and I objectives. However, the NRC team observes that some elements of the DBVP are being addressed by other currently ongoing programs. Coordination and communication of efforts between personnel involved in the different programs do not appear to be clearly defined. The DBVP must coordinate with approxi-mately 40 other current BFN programs and depends on most of them for essential information. There appears to be no well established structure for managing these interfaces between programs. This situation is likely to cause delays and may result in duplication of effort and critical gaps in the program.
TVA has established a baseline for BFN electrical power systems primarily through a program of "functional" electrical walkdowns, in which point-to-point connections of safety-related auxiliary power circuits (including control and protection circuits associated with the power systems) were confirmed through functional tests rather than circuit tracing. The NRC team considers this procedure in principle technically acceptable only for the limited purpose of establishing configuration control single line drawings.
O
.
.
- 10 -
Functional tests are the basis for the walkdown procedures. However, the procedures do not appear to specify that separate tests should be performed for each redundant control channel, or that physical and electrical separation of redundant control channels should be verified. Additionally, the point-to-point check appears to rely on the judgment of the person (s) performing the walkdowns. TVA should provide its rationale of the acceptability of this approach when functional tests are to be used in lieu of physical tracing of circuits.
TVA stated that one of the key aspects of its DBVP will be pass / fail criteria that will be used in pre-restart testing of safety-related equipment and systems. According to one of TVA's DBVP program presentations, the basis of these criteria will be the minimum performance requir2d for safe shutdown under
,
nominal conditions as determined by the BFN Safe Shutdown Analysis and the applicable system requirements calculations and system design criteria. TVA presented an illustrative example of a system that must provide a 39-gallon-per-minute flow for safe shutdown. In such a case, the restart test criterion will be 39 gallons per minute even though the design capacit;' of the syster is 50 gallons per minute. However, these tests would not necessarily confirm the existence of the essential margins designed into the systems to allow for normally expected performance degradation (e.g., end of life conditions and effects of approved maintenance actions). Therefore, the NRC team found that restart test criteria that consider only minimum safe-:hutdown requirements under nominal conditions without regard to margins for expected performance degradation, are not acceptable.
TVA Restart Design Criteria Document BFN-50-7200C, Rev. O, "250 VDC Power Distribution System (Units 1, 2, and 3) covers the design and performance requirements of the 250-V vital de power system. The NRC team found that these design criteria and related documents lack a number of critical details on the design basis of the vital dc power system. Consultations with TVA engineers on this subject failed to identify the process by which essential system performance parameters, which should be defined by the design criteria and derived by calculations, are factored into test requirement documents (TRDs).
Tho design criteria document does not address the inclusion of end of life conditions and the effects of approved maintenance actions (such as jumpered cells) in the calculations to determine or verify system final discharge voltage. This type of verification is needed to ensure that control components, such as relays and motor-generator speed regulators are capable of satisfactory operation under system final voltage conditions to support the safe shutdown function of the 250-DC power distribution systems. Therefore, the team believes that.(1) TVA should provide its rationale on the accept-ability of this approach and (2) the DBVP should have procedures for the inclusion of calculation results as test parameters in TRDs and end-of-life and maintenance conditions in calculations and test acceptance criteria.
5.4.2 Conclusion The NRC team concludes that the DBVP is structurally adequate in the area of electrical systems. However the NRC team noted that the interface and coordination between DBVP and other currently ongoing programs is not clearly o
, _ , __ ._ _
, l
,
,
- 11 - ,
defined and the restart test criteria do not include considerations for performance degradation and end-of-life maintenance conditions. i 5.5 instrumentation and Control Systems i
The NRC team reviewed the foliowing documents during this portion of the I inspection: '
1. DBVP and applicable portions of BFN FSAR 2. Browns Ferry Nuclear Performance Plan, Rev. 1. June 1987 Design Bases Commitment /Reouirement Tracking System Analysis Report, October 23, 1987, EEB Discipline 3. Nuclear Plant Electrical Calculation Program Assessment, Browns Ferry ;
Nuclear Plant, July 2, 1986, Sargent and Lundy engineers 4 BFEP PI 86-02, "As-designed to Configuration Control Drawing Comparison Mark-Up," Rev. 2, March 6, 1987 (Design Baseline Program)
5. BFEP PI 86-26, "Baseline Test Requirements," Rev. 1. June 3, 1987 6. BFEP PI 86-28, "Master Equipment List Unique Identifiers," (Design i Baseline Program), Pev. O, September 23, 1986 7. BFEP PI 86-46, "Design Baseline and Verification Program Walkdown ,
Interface Procedure," Rev. O, November 26, 1986 l
!
8. BFEP PI 86-53, "Control of DBVP Action items," Rev.1, July 17,1987 9. BFEP PI 87-27, "Procedure for Origination of Configuration Control Drawings" (CCDs), Rev. O, dated March 18, 1987 10. BFEP PI 87-44, "Preparation of System Boundary (Schematic / Elementary)
Transfer Drawings and Baseline Configuration Drawings Required for Restart of BFN Unit 2." pre-issue copy, not dated 11. BFEP PI 87-59, "Baseline Configuration Evaluation and Identification of Essential Calculations," Rev. O September 4, 1987 12. BFEP PI 87-61, "Procedure for the Design Baseline and Verification Program l Restart Disposition Pecommendation for Unimplemented and Partially Implemented Chance Documents," Rev. O, August 27, 1987 13. Restart Design Criteria, BFN-50-7099, "Reactor Protection System," Rev. O, July 14, 1987 14 Restart Design Criteria, BFN-BFS3-045, DNE Calculations, Baseli m Program System Requirements Calculations, "System Requirernents for Reac'or Protection System" Revision 1, dated March 27, 1987.
__ _ __
.
e
'
12 -
5.5.1 Findings The NRC team finds that the DBVP contains the essential elements needed to address the area of instrumentation and control systems.
However, the NRC team notes that although the DBVP interfaces with several other programs these efforts are not coordinated. For instance, the environmental cualification walkdowns emphasis is on the environmental aspects of the location, and the DBVP walkdowns emphasis is on the functionality aspect of the systems in question.
The overall DBVP is intended to establish the configuration baseline, and TVA has an EA Oversight Review Team to help ensure compliance with the overall DBVP objectives. However, the NRC team noted that none of the I&C systems are listed in FSAR Chapter 14 as safo shutdown systems. Although portions of these systems are regularly designated as ancillary parts of the Chapter 14 safe-shutdown systems for walkdowns and functional testing, they are designated via the establishment of a boundary transfer drawing, which defines system boundaries and identifies components required by the Safe Shutdown Analysis (SSA). As a result of this practice certain portions of an I&C system (for example, certain elements of the reactor protection system) are repeatedly included in walkdowns or functional testing, but the entire system never receives a comprehensive system-wide walkdown or functional test on its own merit.
BFEP PI 87-59, Paragraph 4.3.4, states that either walkdowns or functional testing may be used for techanical flow and control drawings and for the electrical one-line drawings. BFEP PI 87-44 Paragraph 4.2 and PI 87-27, Paragraph 4.2.9, similarly states that walkdowns or functional testing may be used for electrical schematic and elementary drawinos. TVA informed the NRC l team that when an 18C system, or a portion of an I&C system, is selected for walkdown and functional testing, only the mechanical flow and control portion would be functionally tested. A functional test in this case involves activating the initiating device to trigger the end device and watching for confirmation of the end device actuation without verification of the inter- i mediate components. Although the functional test can prove the safe-shutdown l capability of the I&C system, it neither provides a good check for actual plant l configuration or reconciles differences between as-designed and as-built drawings. The NRC team believes that without the establishment of a true configuration baseline, there can be no assurance that future changes would be adecuately controlled.
The NRC team noted that the reactor protoction system is made up of two independent trip systems. There are.usually four channels provided to monitor each critical parameter, with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic module so that either channel trip will trigger that trip system. The simultaneous tripping of both systems will produce a reactor scram. The trip systems require a minimum number of operable instrumentation channels per trip system. These parallel redundant systems and channels are commonly employed in other I&C systems, where two, three, or four redundant channels run in parallel. Since each
. _ , - - _ . . _ , _ , ,.
,
-
.
1 r
- 13 -
l channel can be made up of several components, including instruments and wiring, '
the possibilities exist that there can be cross-wiring between these corres-ponding ccmponents. Where two corresponding components are erroneously double cross-wired, the likelihood of its detection is beyond the realm of a func-tional test. The NRC team believes that only a point-to-point check of the ,
configuration will detect such a miswiring scheme. A point-to-point check also I will identify the components, wiring size, and confirm termination integrity.
The NRC team noted that the EA Oversight Review Team has uncovered a variety of minor programatic as well as implementation discrepancies in the I&C area.
Some of these discrepancies involve numerous incidents where the tags and/or the information on tags do not agree with design documentation. The NRC team believes that because of numerous discrepancies, the configuration baseline of I&C components should be established by functional test as well as by physical verification, where practicable.
5.5.2 Conclusions The NRC team concludes that the DBVP is structurally adeouate in the area of l instrumentation and control systems. However, the NRC team notes that the interface and coordination between DBVP and other currently ongoing programs are not clearly defined, none of the I&C systems are included in FSAR Chapter , 14 as safe shutdown systems and as a result do not receive a comprehensive l walkdown or functional test on their own merit, and functional testing cannot l establish the true configuration because it does not provide for the actual I identification, verification, and reconciliation of intenrediate I&E components I and wiring.
l
,
-
,
, *
! - 14 -
,
6. PERSONS CONTACTED J. Kirkebo, TVA, DNE D. Burrell, TVA, DNE, EA J. Sporks, TVA, BFN G. Ashley, TVA, DBVP D. Wilson, TVA, DBVP J. Walker, TVA, PM J. Stapleton, TVA, BFN M. J. May, TVA, BFN, licensing D. A. Pullen, TVA, ONP J. Savage, TVA, compliance C. Madden, TVA, compliance D. Masters, TVA, BFEP, DBVP D. V. Kehoe, SWEC, EA, BBVP P. Howard, TVA, DNE, DBVP M. Kaminsky, TiA, DBVP W. E. Bezenson, TVA, OA R. A. Martin, TVA, DNE V. D. Schiavone, TVA, DNE D. Walker, TVA, DNE, NEB R. Erickson, TVA, DBVP T. Pagano, TVA, DBVP V. O' Block, TVA BFEP, DBVP G. Nicely TVA, DBVP R. Macintosh, TVA, DBVP G. Chapman, TVA, DNE, BFEP A. Alford, TVA, licensing J. Rupert, TVA, BFEP T. Cureton, TVA, DBVP B. Rossburg, TVA, DBVP R. Baird, TVA, DBVP R. Cantrell, TVA, DNE W. Ford, TVA, DNE, EA G. Palmer, TVA, DNE, EA NRC Resident Inspectors:
G. L. Paulk, Senior Resident Inspector C. Patterson, Resident Inspector
- -. . _ . - _ _
_ - - . . - _ .
\ <
j##%
,:.
UNITED STATES
, .
NUCLEAR REGULATORY COMMISSION 3,
- 4 j WASHING TON, D. C. 20555
i e ,
%,....'/ JAN 21 1988 i
Docket Nos. 50-259/260/296 Tennessee Valley Authority i ATTN: Mr. S. i Manager of Nuclear Power ,
6N 38A Lookout Place l 1101 Market Street 1 Chattanooga, Tennessee 37402-2801
Dear Mr. White:
,
i SUBJECT: REPORT NOS. 50-259/87-36, 50-260/87-36 AND 50-296/87-36 l l
An NRC inspection was conducted October 26 through 30, 1987 at the Browns Ferry Nuclear (BFN) facility. Members of the Office of Special Projects (0SP) staff and ten consultants made up the NRC team. The NRC team reviewed the information '
contained in the TVA's BFN Design Baseline and Verification Program (DBVP) and.
the associated documentation and interviewed a number of cognizant TVA personnel to obtain pertinent infomation concerning the DBVP.
The NRC team generally found that TVA's DBVP contained the essential elements needed to achieve its intended goals and objectives. However, the NRC inspectors identified several weaknesses which TVA needs to address before the staff can approve the DBVP. The enclosed inspection report (Enclosure 1),
details the scope, objectives and findings of the NRC team and identifies the areas examined during the inspection.
The responses directed by this letter and its enclosure are not subject to the clearance procedures of the Office of Management and Budget as required by the Paperwork Reduction Act of 1980, PL 96-511.
In accordance with Section 2.790 of the NRC's "Rules of Practice", Part 2, Title 10, Code of Federal Regulations, a copy of this letter and its enclosure will be placed in the NRC Public Document Room. If there are any questions concerning this inspection, please contact this office.
Sincerely, fE,). da[g Steven D. Richardson, Acting Director TVA Projects Division Office of Special Projects Enclosure: As stated cc w/ enclosure:
see next page-D Nhb
._____ ___ _
s
,
Mr. S. Browns Ferry Nuclear Plant Tennessee Valley Authority . Units 1, 2 and 3 CC:
General Counsel Regieral Administrator, Region II Tennessee Valley Authority U.S. Nuclear Regulatory Commission 400 West Summit Hill Drive 101 Marietta Street, N.W.
E11 833 Atlanta, Georgia 30323 Knoxville, Tennessee 37902 Resident inspector / Browns Ferry NP Mr. R. L. Gridley U.S. Nuclear Regulatory Commission Tennessee Valley Authority Route 12, Box 637 SN 157B Lookout Place Athens, Alabama 35611 Chattanooga, Tennessee 37402-2801 Mr. Richard King Mr. H. P. Pomrehn c/o U.S. GA0 Tennessee Valley Authority 1111 North Shore Drive Browns Ferry Nuclear Plant Suite 225, Box 194 P.O. Box 2000 Knoxville, Tennessee 37919 Decatur, Alabama 35602 Dr. Henry Myers, Science Advisor Mr. M. J. Pay Committee on Interior Tennessee Valley Authority and Insular Affairs Browns Ferry Nuclear Plant U.S. House of Reoresentatives P.O. Box 2000 Washington, D.C. 20515 Decatur, Alabama 35602 Mr. D. L. Williams Tennessee Valley Authority 400 West Summit Hill Drive W10 885 Knoxville, Tennessee 37902 Chairman, Limestone County Commission P.O. Box 188 Athens, Alabama 35611 Claude Earl Fox, M.D.
State Health Officer State Department of Public Health State Office Building Montgomery, Alabama 36130
.
O ENCLOSURE Uf:ITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF SPECIAL PROJECTS TVA PROJECTS DIVISION Report Hos.: 50-259/87-36 and 50-296/87-36 Docket Nos.: 50-259, 50-260 and 50-296 License Nos.: DPR-33, DPR-52 and DPR-68 Licensee: Tenr.essee Valley Authority
, Facility Name: Browns Ferry Nuclear Plant Units 1, 2 and 3 Inspection Conducted: October 26-30, 1987
"
Inspectors: d - V- r -
/!/Y!87 Geor B. Georgiev,' Team Lgr Dat6 W -
^/' P h ihy!n P. W ern ~ /
( Oatef Consultants: S. Traiforos, C. Kimura, R. McFadden, N. Rivera, P. Chan, J. Thomas, S. Refai, O. Mallon, N. Tsai, M. Partridge Z
Approved by: ). &_ %
BQ.' L' aw,' Assistant Director Date for Technical Programs Division of TVA Projects SkN
-
.
l NRC TEAM INSPECTION DESIGN BASELINE AND VERIFICATION PROGRAM l BROWNS FERRY NUCLEAR PLANT l
1. INTRODUCTION The Tennessee Valley Authority's (TVA's) Browns Ferry Nuclear Plant (BFN) l Design Baseline and Verification Program (DBVP) was first submitted to the NRC i on August 28, 1986. On March 13, 1987 and July 10, 1987, TVA submitted more detailed versions of the DBVP, which upgraded the program to (1) reconcile design control issues, (2) re-establish the design basis and (3) evaluate the plant configuration. l l
This NRC team inspection was performed to review and assess the adequacy of the l information contained in the BFN DBVP. l 2. BACKGROUND INFORMATION The DBVP was established to resolve several problems related to design control that had occurred at BFN. These problems included: (1) the original design control program allowed an as-built set of drawings to be maintained by plant operations and an as-designed set of drawings to be maintained by engineering, J (2) the plant configuration was not reconciled with the design basis because :
the plant design basis was scattered among many documents thus making them not l readily usable, and (3) external reviews and studies have indicated weaknesses !
in plant modifications performed after the plant was placed in operation.
The objectives of the DBVP are to re-establish the design basis and evaluate the plant configuration to ensure that it satisfies the plant design basis.
l The DBVP is being implemented in two phases. Phase 1 will be completed before l Etartup and will include the evaluation of systems and portions of systems l required for safe shutdown. These systems will be identified by evaluating the abnormal operational transients, design basis accident and special events addressed in the BFN Chapter 14 of the Final Safety Analysis Report (FSAR) and by determining the safety actions necessary to mitigate these events. Phase 2 will be completed after startup and will include implementation of the remain- )
inq modifications of systems not required for startup, ccmpletion and revision '
of the design criteria documentation, completion of system evaluations, and implementation of corrective actions to other systems as required.
3. SCOPE i
The NRC team (1) reviewed the information contained in the DBVP and a sample of I associated documentation, and (2) interviewed cognizant TVA personnel to obtain pertinent information concerning the DBVP.
4 SUMMARY The NRC team found that the BFN DBVP contained the essential elements needed to achieve its intended goals and objectives. However, the team identified
.
.
+
-2-several areas of concern that related to implementation of the program.
Examples of these concerns are listed below:
(1) The use of accident conditions for test acceptance criteria, without I considering the system design limits, may result in masking precursors of comon-mode failures.
(2) The classification of the containment purge valve operational capability as a Phase 2 priority item is not acceptable. This item should be class- )
ified as a Phase 1 priority item. l (3) The stated policy of functionally testing a system by using minimum l performance levels for safe shutdown is unsatisfactory because it does not '
provide margins for end-of-life accident conditions.
(4) The sample review of design criteria documents identified several inconsistencies in definin Moreover, TVA's engineering assurance (EA)g the applicable oversight design review team codes. additional has identified j problems; all of which must be addressed by TVA. J (5) The DBVP emphasizes only functional drawings and does not adequately address physical (dimensional) drawings. The physical drawings are needed j to perform some of the required essential calculations and to verify i existing essential calculations.
(6) The DBVP generally relies on functional circuit checks in lieu of circuit verification to walkdown electrical and I&C systems. The methods of j assuring physical separation and electrical independence of redundant channels are not explicitly addressed.
(7) Scre design requirements contained in FSAR Appendix C have not been included in the commitments /recuirements data base listing.
(8) The DBVP does not currently include the essential civil / structural calculations.
(9) There are many ongoing programs that interface with the DBVP. The team could not identify the method used to coordinate these programs and the means of communication between the personnel involved with each program. 3 TVA needs to establish this methodology. Furthermore, since programs '
other than the DBVP are used to verify important facets of design, TVA must revise the DBVP to explicitly identify these programs and provide clear cross-references between the DBVP and the other programs on a '
system-by-system basis.
5. INSPECTION DETAILS The NRC team divided its review of the DBVP into five areas: civil / structural area, mechanical components, and mechanical, electrical, and instrumentation and control systems. The general scope of this inspection included a review of the information in the DBVP and associated supporting documentation in relation
.
.
o-3-to each specific area as well as interviews with TVA personnel cognizant of a particular area. Any additional inspection activities, specific documents reviewed, findings, and conclusions for each of areas are discussed below.
5.1 Civil / Structural Area The NRC team reviewed the documents listed below during this portion of the inspection:
1. DBVP, Rev. 2 and applicable portions of BFN FSAR. 2. Browns Ferry Nuclear Performance Plan, Rev.1, June 1987, Sections Ill and IV, Vol. 3.
3. BFN-50-C-7100, Rev. 0, July 1,1987, Design of Civil Structures.
4 BFN-50-C-7102, Rev. O. July 1, 1987, Seismic Design.
5. BFN-50-C-7104, Rev. O, July 1,1987, Design of Supports.
6. BFN-50-739, Rev. O, June 5,1987, Classification of Structures, Systems and Components.
7. Design Bases Commitments /Pecuirements Tracking System, October 23, 1987, Civil Engineering Branch Discipline.
8. Engineering Assurance Oversight Review Team action items listing.
5.1.1 Findings The NRC team found that the DBVP contains the essential elements needed to adeouately address the civil / structural area and to achieve its intended goals and objectives. Powever, on the basis of its review of the DBVP and referenced documentation and interviews with cognizant TVA personnel, the team found that the licensee has made no commitment to perform the essential civil / structural calculations, including those for major building structures. This is a program weakness since some calculations may be incomplete, missing, or may not be meeting current licensing commitments.
In addition, TVA has established a separate calculation pro that essential calculations exist and are retrievable, (2) gram to (1)essential regenerate verify calculations if they do not exist, (3) ensure the essential calculations are consistent with licensing commitments and are technically adeouate (4)
identify and resolve unverified assumptions, and (5) establish a procedure tn maintain the technical adequacy and retrievability of all essential calculations.
The team's preliminary review of the civil / structural design criteria revealed that the criteria have not yet been reviewed by project personnel nor incorporated into the committment/ requirements data base. In addition, the
_ __ ___
_ __
.
r-4-
l design criteria used to prepare and evaluate the structural calculations were incomplete, i The NRC tuam observed that some elements of the program are being addressed by j other currently ongoing TVA programs. At this time the team could not clearly establish the licensee's method to coordinate the efforts of these programs and ,
to provide a means for personnel involved with these programs to communicate i with personnel associated with the DBVP.
5.1.2 Conclusions !
The NRC team concluded that the DBVP is structurally adequate in the civil / l structural area. However, the NRC team noted that the interface and coor- !
dination between DBVP and other currently ongoing programs was not clearly defined and there is no provision to perform the essential civil / structural calculations.
5.2 Mechanical Components The NRC team reviewed the documents listed below during this portion of the l inspection ,
l 1. DBVP and applicable pcrtions of BFN FSAR, Rev. 2, Browns Ferry Nuclear l Performance Plan, Rev. 1. June 1987.
2. Safe Shutdown Analysis, i
3. Selected listings from Ccenitments/ Requirements Data Base Tracking System.
4. BFN-50-C-7103 Structural Analysis and Qualification of Mechanical Systems, i
5. Engineering Assurance Oversight Review Team action items listing, October 22, 1987.
6. Various Action Item Reports and Response / Resolution Correspondence for Civil / Structure Discipline Action Item Numbers: C-001 through C-019, C-024 through C-032, and C-040 through C-043.
i 7. Program Plan for the Engineering Assurance Independent Oversight Review for BFNP.
8. Condition Adverse to Ouality Report (CA0R) No. BFT870842.
9. BFN-50-C7104, Design of Supports (for Piping).
10. BFN-50-7001, Main Steam System (ADS Function).
11. BFN-BFS3-004, Rev.1 (ADS Function) DNE Calculation, System Requirements for Main Steam System.
.. . - .
.
'
-5-12. BFN-BTRD-004, Rev.1 ( ADS Function), Baseline Test Requirements, Main Steam System.
5.2.1 Findings The NRC team found that the DBVP contains the essential eierents needed to I adeauately address the area of mechanical components and to achieve its ;
intended goals and objectives.
'
The team found that general design criteria for structural analysis and ouali-fication of rechanical systems and for design of supports contained direct l excerpts from several previously published TVA design criteria documents. This i attributed to the poor organization of the documents. Criteria related to ,
older licensing commitments were included in the general design criteria I without regard to technical adequacy. The criteria also contained discussions j and references to design codes that were incorrect and confusing.
The design criteria should clearly identify the appropriate codes to be applied for evaluation of existina designs and for performing evaluations of new or i modified designs for the lifetime of the plant. The correlation between design '
rules provided in the codes and the level of quality provided by the related i requirements for material certification, testing, fabrication, and inservice j inspection also should be included. ;
The NRC team could not determine from its review whether TVA's implementing I procedures adequately define the scope and methods necessary for personnel involved in the DBVP and the forty or more other ongoing programs at BFN to coordinate effectively. TVA needs to develop a single administrative procedure to define scope, responsibilitics, schedules, and methods. of communication between DBVP and other ongoing programs.
One of the major goals of the DBVP is the verification of the functional adequacy of the plant configuration. TVA had conducted walkdowns to verify several hundred functional design configuration drawings (DCD). However, these ,
drawings do not show the physical as-built configuration of the plant. TVA needs to atsess the physical drawings of the plant to determine what effect the alleged loss of configuration control has had on the adecuacy of essential calculations that were performed. The physical drawings of the plant should be categorized by function or type and should be evaluated. Drawing categories that require a high degree of conformity to the as-designed configuration to support essential calculations might then be independently assessed to deter-mine the conformity of these drawings with the as-built configuration. If necessary, certain drawing categories can then be recomended as requiring complete configuration control and added to the list of DCDs. For the other drawings, not brought to the DCD level, there will, at least, exist an assess-rent report that details the type, frequency, and trends of configuration discrepancies to be expected.
Specifically the DBVP will perform essential calculations on the basis of (1)
as-huilt system functional drawings and (2) as-designed physical configuration drawings. However, the team is concerned that the essential calculations for
.
-6-l the piping systems may be performed using inappropriate physical configurations l of the system because the as-designed and as-built drawings are sometimes quite i different. The DBVP does not contain program requirements to address this l issue and TVA needs to revise DBVP to address this potential problem area. l During interviews and presentations TVA stated that it would resolve this l concern (1) by obtaining as-built physical configuration drawings of a system i before the calculations are performed and (2) by establishing design controls i
'
to ensure that the essential calculations are reviewed to determine the effect of as-designed to as-built configuration changes on the calculation results and conclusions, j
The NRC team could not find specific design requirements for safety / relief valves contained in FSAR Appendix C in the Commitments /Reouirements data base listing for safety / relief valves. These data may be completely missing from the data base or these data may be categorized only by the main steam system l and not by the component category. In either case, this program is not !
functioning as required because the FSAR requirements could not be found in the data base listing for safety / relief valves. TVA needs to ensure that the specific design requirements of FSAR Appendix C for safety / relief valves and other components be included in the commitments / requirements data base listing.
Furthermore, the cause for this missing data should be investigated by the EA Oversight group to ascertain if it is an isolated incident or a generic problem.
The NRC team identified the followin two inconsistencies between the system l design criteria and the BFN FSAR: ( ) The design code listed for the main steam safety / relief valves in Paragraph 6.1 of the System Requirements for the main steam system is different from that listed in Paragraph 3.7.2.2.6 of the Main Steam System Design Criteria and Section 4.4 of the FSAR. (2) Table C.0-7 .
of the FSAR specifies the corrosion allowance for the main steam isolation l valve to be 0.12 inch; whereas, the Main Steam System Design Criteria, 1 Attachment 2, Part B, page 5, specifies the corrosion allowance to be 0.088 {
inch. While these particular inconsistencies may not have a major consequence, '
it does point out that inconsistencies exist between various documents associ-ated with the DBVP. Because many of the DBVP documents have been prepared in parallel, rather than in secuence, TVA should review such inconsistencies to determine whether there is a potential problem area of document inconsistencies in the DEVP.
5.2.2 Conclusions l The NRC team concludes that the DBVP is structurally adequate in the area of mechanical components. However, the NRC team roted that the design criteria j contained errors, the method of interface and coordination between DBVP and -
other ongoing programs is not clearly defined, and the DBVP does not specify the use of as configured physical drawings when performing essential calculations.
5.3 Pechanical Systems The NRC team reviewed the following documents during this inspection: i l
-
.
'
7-i 1. DBVP and applicable portions of BFN FSAR. 2. Browns Ferry Nuclear Performance Plan, Rev. 1, June 1987 3. Safe Shutdown Analysis (SSA).
4. BFN-0SG3-048(Branch /Projectidentifier).
5. 822 '86 0628 010 (R0 RIMS Accession No.), i 6. B22 '87 0226 251 (R1 RIMS Accession No.). !
7. System Recuirements for Residual Feat Removal, BFN-BFS3-033, Rev. 1 8. System Requirements for RHR Service Water, BFN-BFS3-009, Rev. 1 .
9. System Mode Requirements for DB&VP Restart Plan, BFN-BFS3-050, Rev.1 )
5.3.1 Findinas The NRC team found that the DBVP contains the essential elements needed to address the area of mechanical systems and to achieve its intended goals and objectives. i However, in its review of the system requirements calculations (SRC) for the residual heat removal (RHR) and the RHR service water systems, the team noted that both of these system requirement calculation packages follows the same format and perform the same function for their respective systems. Neither package stated which procedures were used to prepare the calculation.
Furthermore, the calculation package for the RHR system does not reference the I Browns Ferry Updated FSAR, Technical Specifications, or the operating instructions. If a calculation package is to determine what system is recuired under what plant conditions and how it will respond to changing plant conditions, it would seem appropriate that the package references these documents .
The NRC team observed that some elements of the DBVP are being addressed by ,
other currently ongoinq programs. Communication and coordination of efforts I between personnel involved in the different programs do not appear to be I clearly defined; therefore, it is not clearly auditable. Effective coordina- !
tion and communication between personnel involved in these many programs will i t'e crucial to the implementation of the DBVP. During this inspection, the team substantiated the existence of at least 40 programs. ,
i The DBVP uses accident conditions for the system test acceptance criteria. The l NRC team is concerned that the use of accident conditions for the test l acceptance criteria, without considering the system design limits, could result !
in masking precursors of common-mode failures. 1 Although system restart testing is currently under way, some systems are being tested without the benefit of essential calculations, which could create ,
potential problems; for example, the need to repeat certain tests. l Furthermore, the team could not determine whether a mechanism has been i established to keep DBVP personnel apprised of the restart test experience.
This is a serious drawback in the progress of the DBVP and might result in substantial rework, resulting in delays.
The Systems Mode Requirements for the DBVP Restart Plan identifies various '
events and actions defined in the Safety Shutdown Analysis (SSA). The review l
i
,
l
'
-8-of this document revealed that the containment purge valve (CPV) operational l capability is assigned as a Phase 2 priority item. The CPV should be assigned as a Phase 1 priority item, 5.3.2 Conclusions ,
i The NRC team concludes that the CBVP is structurally adequate in the area of l the mechanical systems. However, the NRC team noted that the interface and coordination between DBVP and other currently ongoing programs is not clearly defined, accident conditions instead of design conditions are used for test acceptance criteria, the CPVs are classified as a Phase 2 priority item instead of Phase 1 priority item, and some of the reviewed system requirement calculations did not reference the FSAR cr state which procedure was used to prepare the calculations.
5.4 Electrical Systems i
'
in addition to the general scope of this inspection, the NRC team conducted a plant walkdown of the 250-V ac vital batteries and the emergency diesel generators. Listed below are the documents reviewed by the team during this i portion of the inspection:
l
,
1. DBVP Rev. 2 and applicable portions of BFN FSAR 2. Browns Ferry Nuclear Performance Plan, Rev. 1, June 1987 3. BFN-50-7200C, 250 VDC Power distribution system, a restart design criteria document 4. Procedure Method (PM) 86-02 (EEB)
5.4.1 Findinas The NRC team reviewed TVA's records of the original electrical walkdowns and found that these walkdowns were conducted under such loose documentation and quality assurance procedures that severe doubt exists concerning the validity of the walkdown results: (1) the walkdowns were completed before approved performance procedures were issued and (2) the original documentation (e.g.,
marked up design drawings) was not traceable and retrievable. The Engineering Assurance Oversight Review Team discovered that condition during an internal audit and issued a Condition Adverse to Quality Report (CAQR). TVA plans to perform a sample reverification of the least documented 10 percent of the walkdown information under full quality assurance control. If the 10 percent sample contains any deficiencies, TVA will perform a 100 percent reverifica-tion. The NRC team considers this approach to be acceptable because of the limited scope and objectives of the electrical walkdown portion of the DBVP and because detailed electrical walkdowns under full quality assurance control are in progress under several other programs.
The NRC team confirmed that TVA has issued Procedure Method (PM) 86-02(EEB),
Rev.1, which provides definitions and selectier, criteria for "essential" and
.
E-9-
"desirable" electrical design calculations, as well as a minimum list of such calculations for all TVA nuclear power plants, including BFN. "Essential" calculations are those which support the design of safety-related (Class 1E)
systems or features and must be completed for each specific plant before restart of plant. "Desirable" calculations address reliability and avail-ability rather than safety issues and must be scheduled, but not necessarily ccmpleted, before restart. The procedure allows alternate verification methods such as design standards or testing to substitute for design calculations under appropriate quality assurance and administrative centrols. TVA's essential calculation program was independently reviewed by Sargent and Lundy Engineers.
On the basis of its review of (PM) 86-02(EEB) and interviews with TVA personnel the team considers the BFN essential calculations program to be acceptable from a progrannatic standpoint.
Although a considerable number of essential electrical power calculations existed for BFN, they were of inconsistent quality and in conflict with one another in important respects. TVA properly elected to discard the existing material and reconstitute all calculations. TVA first performed a 100 percent nameplate-data walkdown of the Class IE electrical power systems; this fully verified information formed the basis of the essential design calculations.
TVA contracted with Bechtel Power Corporation to perform all essential electrical power calculations except for the "Appendix R" analysis, which TVA is performing in-house. The Bechtel calculations which were performed under Bechtel technical and quality assurance procedures and were essentially l completed in June 1987, were reviewed by TVA/EEB. TVA EEB noted several deficiencies in the calculations and issued CAQRs; as soon as these are '
resolved, the essential calculation set will be formally issued as TVA calculations. The NRC team found the essential electrical calculations component of the DBVP to be progressing well.
The NRC team finds that the DBVP contains the essential elements needed to address the area of electrical systems and to achieve its intended goals and objectives. However, the NRC team observes that some elements of the DBVP are j being addressed by other currently ongoing programs. Coordination and communication of efforts between personnel involved in the different programs I do not appear to be clearly defined. The DBVP must coordinate with approxi-mately 40 other current BFN programs and depends on most of them for essential informa tion. There appears to be no well established structure for managing these interfaces between programs. This situation is likely to cause delays and may result in duplication of effort and critical gaps in the program.
TVA has established a baseline for BFN electrical power systems primarily l through a program of "functional" electrical walkdowns, in which point-to-point I connections of safety-related auxiliary power circuits (including control and '
protection circuits associated with the power systems) were confirmed through functional tests rather than circuit tracino The NRC team considers this i procedure in principle technically acceptable. only for the limited purpose of i establishing configuration control single line drawings. !
!
'
I l
l
'
- 10 l
Functional tests are the basis for the walkdown procedures. However, the procedures do not appear to specify that separate tes's should be performed for I each redundant control channel, or that physical and electrical sepwation of ;
redundant control channels should be verified. Additionally, the point-to-point check appears to rely on the judgment of the person (s) performing the walkdowns. TVA should provide its rationale of the acceptability of this approach when functional tests cre to be used in liou of physical tracing of circuits.
TVA stated that one of the key aspects of its DBVP will be pass / fail criteria that will be used in pre-restart testing of safety-related equipment and systems. According to one of TVA's DBVP program presentations, the basis of these criteria will be the minimum performance required for safe shutdown under
,
nominal conditions as determined by the BFN Safe Shutdown Analysis and the applicable system requirements calculations and system design criteria. TVA presented an illustrative example of a system that must provide a 39-gallon-per-minute flow for safe shutdown. In such a case, the restart test criterion will be 39 gallons per minute even though the design capacity of the system is 50 gallons per minuto. However, these tests would not necessarily confirm the existence of the essential margins designed into the systems to allow for normally expected performance degradation (e.g., end of life conditions and effects of approved maintenance actions). Therefore, the NRC team found that restart test criteria that consider only minimum safe-shutdown requirements under nominal conditions without regard to margins for expected U- formance degradation, are not acceptable.
TVA Restart Design Criteria Document BFN-50-7200C, Pev. 0, "250 VDC Power DistriDution System (Units 1. 2, and 3) covers the design and performance requirements of the 250-V vital de power system. The Nf,C team found that these design criteria and related documents lack a number of critical details on the design basis of the vital de power system. Consultations with TVA engineers on this subject failed to identify the process by which essential system perfrmance paraneters, which should be defined by the design criteria and derhed by calculations, are factored into test requirement documents (TRDs).
The design criteria document does no'. a"ss the inclusion of end of life conditions and the effects of approh .ntenance actions (such as jumpered -
cells) in the calculations to determin, or verify system final discharge l voltage. This type of verification is needed to ensure that control '
components, such as relays and motor-generator speed regulators are capable of satisfactory operation under system final voltage conditions to support the safe shutdown function of the 250-DC power distribution systems. Therefore, !
the team believes that (1) TVA should provide its rationale on the accept- l ability of this approach and (2) the DBVP should have procedures for the inclusion of calculation results ae test parameters in TRDs and end-of-life and maintenance conditions in calculations and test acceptance criteria.
I 3.4.2 Conclusion The NRC team concludes that the DBVP is structurally adequate in the area of electrical systems. However the NRC team noted that the interface and coordination between DBVP and other currently ongoing programs is not clearly
l
!
l
0
- 11 -
I defined and the restart test criteria do not include considerations for performance degradation and end-of-life maintenance conditions.
5.5 Instrumentation and Control Systems The NRC team reviewed the following documents during this portion of the inspection: )
1. DBVP and applicable portions of BFN FSAR 2. Browns Ferry Nuclear Performance Plan, Rev. 1. June 1987 Design Bases 1 Commitment /Reouirement Tracking System Analysis Report, October 23, 1987, l EEB Discipline l 3. Nuclear Plant Electrical Calculation Program Assessment, Browns Ferry Nuclear Plant, July 2, 1986, Sargent and Lundy engineers l l
A. BFEP PI 86-02, "As-designed to Configuration Control Drawing Comparison l
'
Mark-Up," Rev. 2, March 6, 1987 (Design Baseline Program)
5. BFEP PI 86-26, "Baseline Test Requirements," Rev. 1. June 3, 1987 l 6. BFEP PI 86-28 "Master Equipment List Unique identifiers," (Design Baseline Program), Pev. O, September 23, 1986 7. BFEP PI 86-46, "Design Baseline and Verification Program Walkdown Interface Procedure," Rev. O, November 26, 1986 l
.
8. BFEP Pi 86-53, "Control of DBVP Action items," Pev.1, July 17,1987 l 9. BFEP PI 87-27, "Procedure for Origination of Configuration Control Drawings" (CCDs), Rw . 0, dated March 18, 1987 10. BFEP PI 87 44, "Preparation of System Boundary (Schematic / Elementary)
Transfer Drawings and Baseline Configuration Drawings Required for Restart of BFN Unit 2 " pre-issue copy, not dated 11. BFEP PI 87-59, "Baseline Configuration Evaluation and Identification of Essential Calculations," Rev. O. September 4, 1987 l
12. BFEP PI 87-61, "Procedure for the Design Baseline and Verification Program Restart Disposition Pecommendation for Unimplemented and Partially implemented Chance Documents," Rev. O August 27, 1987 13. Restart Design Criteria, BFN-50-7099, "Reactor Protection System," Rev. O.
July 14, 1987 14 Restart Design Criteria, BFN-BFS3-045, DNE Calculations, Baseline Program System Requirements Calculations, "System Reouirements for Reactor Protection System" Revision 1, dated March 27, 1987
.
i - 12 -
5.5.1 Findings The NRC team finds that the DBVP contains the essential elements r.caced to address the area of instrumentation and control systems.
However, the NRC team notes that although the DBVP interfaces with several other programs these efforts are not coordinated. For instance, the environmental cualification walkdowns emphasis is on the environmental aspects of the location, and the DBVP walkdowns emphasis is on the functionality aspect of the systems in cuestion.
The overall DEVP is intended to establish the configuration baseline, and TVA has an EA Oversight Review Team to help ensure ccmpliance with the overall DBVP objectives. However, the NRC team noted that none of the I&C systems are listed in FSAR Chapter 14 as safe shutdown systems. Although portions of these systems are regularly designated as ancillary parts of the Chapter 14 safe-shutdown systems for walkdowns and functional testing, they are designated via the establishment of a boundary transfer drawing, which defines system
boundaries (SSA). As aand identifies result of thiscomponents required practice certain by the of portions Safe an Shutdown I&C systemAnaly(sis for l example, certain elements of the reactor protection system) are repeatedly i included in walkdowns or functional testing, but the entire system never I receives a comprehensive system-wide walkdcwn or functional test on its own merit.
BFEP PI 87-59, Paragraph 4.3.4, states that either walkdowns or functional testing may be used for mechanical flow and control drawings and for the '
electrical one-line drawings. BFEP PI 87-44 Paragraph 4.2 and PI 87-27, Paragraph 4.2.9, sinilarly states that walkdowns or functional testing may be used for electrical schematic and elementary drawings. TVA informed the NRC !
team that when an I&C system, or a portion of an T&C system, is selected for walkdown and functional testing, only the mechanical flow and control portion would be functionally tested. A functional test in this case involves
.
i activating the initiating device to trigger the end device and watching for confirmation of the end device actuation without verification of the inter-mediate components. Although the functional test can prove the safe-shutdown capability of the I&C system, it neither provides a good check for actual plant configuration or reconciles differences between as-designed and as-built drawings. The NRC team believes that without the establishment of a true configuration baseline, there can be no assurance that future changes would be adecuately controlled.
The NRC team noted that the reactor prctoction system is made up of two independent trip systcms. There are usually four channels provided to monitor each critical parameter, with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic module so that either channel trip will trigger that trip system. The simultaneous tripping of both systems will produce a reactor scram. The trip systems require a minimum number of operable irstrumentation channels per trip system. These parallel redundant systems and channels are comonly employed in other ISC systems, where two, three, or four redundant channels run in parallel. Since each
'
l l
s
- 13 -
l
channel can be made up of several components, including instruments and wiring. l the possibilities exist that there can be cross-wiring between these corres- I ponding ccmponents. Where two corresponding components are erroneously double cross-wired, the likelihood of its detection is beyond the realm of a func-tional test. The NRC team believes that only a point-to-point check of the configuration will detect such a miswiring scheme. A point-to-point check also will identify the comnonents, wiring si:e, and confirm termination integrity.
The NRC team noted that the EA Oversight Review Team has uncovered a variety of minor programatic as well as implementation discrepancies in the I&C area.
Some of these discrepancies involve numerous incidents where the tags and/or l the information on tags do not agree with design documentation. The NRC team l believes that because of numerous discrepancies, the configuration baseline of )
I&C components should be established by functional test as well as by physical
'
verification, where practicable.
5.5.2 Conclusions The NRC team concludes-that the DBVP is structurally adeouate in the area of l instrumentation and control systems. However, the NRC team notes that the interface and coordination between DBVP and other currently ongoing programs i are not clearly defined, none of the ISC systems are included in FSAR Chapter l 14 as safe shutdown systems and as a result do not receive a comprehensive walkdown or functional test on their own merit, and functional testing cannot establish the true configuration because it does not provide for the actual identification, verification, and recenciliation of intenrediate I&E components and wiring. l
!
l l
l
<?
l
,
"
- 14 -
,
6. PERSONS CONTACTED ;
J. Kirkebo, TVA, DNE D. Burrell, TVA, DNE, EA J. Sporks, TVA, BFN G. Ashley, TVA, DBVP D. Wilson, TVA, DBVP l
J. Walker, TVA, PM J. Stapleton, TVA, BFN M. J. May, TVA, BFN, licensing D. A. Pullen, TVA, ONP J. Savage TVA, compliance C. Hadden, TVA, compliance D. Masters, TVA, BFEP, DBVP D. V. Kehoe, SWEC, EA, BBVP P. Howard, TVA, DNE, DBVP M. Kaminsky, TVA, DBVP W. E. Bezenson, TVA, CA R. A. Martin, TVA, DNE V. D. Schiavone. TVA, DNE D. Walker, TVA, DNE, NEB R. Erickson, TVA, DBVP T. Pagano, TVA, DBVP V. O' Block, TVA BFEP, DBVP G. Nicely, TVA, DBVP R. Macintosh, TVA, DBVP G. Chapman, TVA, DNE, BFEP A. Alford, TVA, licensing J. Rupert, TVA, BFEP T. Cureton, TVA, DBVP .
B. Rossburg, TVA, DBVP '
R. Baird, TVA, DBVP l R. Cantrell, TVA, DNE l W. Ford, TVA, DNE EA G. Palmer, TVA, DNE, EA NRC Resident Inspectors, G. L. Paulk, Senior Resident Inspector i
C. Petterson, Resident Inspector l
.
l l
l l
l