ML20202D416

Mod Outage Integrated Verification Team Rept

ML20202D416
Person / Time
Site:	Crystal River
Issue date:	11/26/1997
From:	Halnon G, Hebb G, Lutz T FLORIDA POWER CORP.
To:
Shared Package
ML20202D406	List: 3F1297-25, Provides NRC W/Results of Integrated Safety Assessment Performed by multi-disciplined Team to Review Mods & EOPs Changes to Assess Impact on Fsar,Chapter 14 Accidents & Events Relative to Operator Actions,Burden & Safety Margins ML20202D416
References
NUDOCS 9712050020
Download: ML20202D416 (26)

Text

_ _ _ _ _ _ _ _ . . _ . _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ . _ . . . _ _ _ _ _ _ - - _ _ . . _ - __

i .

i *

, j l l l  !

! CRYSTAL RIVER UNIT 3 j 1997 MODIFICATION OUTAGE f l -

i 'I,$'],;I[ ,$ .. [V i

, .: wm y  ; .-

l 4

• M J,

( .

N o-l

. . ... Q__

r.,.-

w4, , Q 2 - ,,. ,

1 INTEGRATED VERIFIC ATION

! TEAM REPORT

=_ 0fAk-1 W t//b4/f7

/ y f fe' TEAM MEMiiERS i

i Greg Halnon i

Tom Lutz

Garrett Hebb Paul Fleming gimited)

Shawn Tyler Larry McDougal AlFriend Mark Van Sicklen gimited)

I 1

9712050020 971203 PDR ADOCK 05000302 F PDR ,

_ ~ _ _ _ _ _ . _ _ . . _ _ _ _ . - _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

.___ ... ._ _..._m_..___- . . . _ __.._ _ _ _ . . _ _ _ _ _ _ _ . _ _ _ . _ . . _.-. . ._ . . _._ . . _ _ _ _ _. ~.___. ._.m..

, l

' I e

IcteotATED Vtatt C4 TION TEAW Rt;ront l INDEX  :

EXECUTIVE SUhlMARY PAGE3 DISCUSSION ON CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS PAGE 4 i

4 s

STANDilY SAFEGUARI)S ANALYSIS 4

PAGE 9 SPECI AL TOPICS PAGE 20 CONCLUSION PAGE 25 i

APPENDIX PAGE 26 PAGE 2

_ =

w 's- e"***e --e-is 'w- vr s*-ewww-- + ---m-- wiese e e '4 -w - '-w'd 1--ew+e ww*+' -rwe w -"r--'-e-v -4 4== m- --w "--~ *=

O INTEORATED VERIFICATION TEAM REroRT EXECUTIVE SUMM ARY ne integrated Verincation Team (IVT) met to review the FSAR Chapter 14 accidents and events relative to operator actions / burden and safety margins. De safety assessments from all of the Emergency Operating Procedures were reviewed along with modifications which effected the mitigation strategy of the accidents and events. His report covers each Chapter 14 accident / event in addition to some special areas of emphais such as boron precipitation and control complex habitability envelope issues. Each discussian identides the areas of review, overall conclusions reached by the team, and recommendations for follow-up. He goal is to assure that the modi 0 cations to restore safety margins in the plant did not collectively or individually adversely effect the mitigation actions by operators and support staffs and to ensure cross system and department dependencies were adequately considered. In addition to reviewing safety assessments, several interviews with key issue managers were held, ne overall conclusions of the tearn were that the Chapter 14 acddents were adequately covered in the modi 0 cation and emergency operstit,g protdure revisions this outage. No additional dependencies were created and operator bur;m remains at an acceptable level. nroughout the report, there are recommendations for further follow-up, although only one imrnediate issue was identi0ed. His issue regarded the Control Complex Cli!11ers and the competing interest of the EOP group and the design analyses regarding the timing of the chiller start. Immediate feedback was given to the EOP Project Director and the Manager of Nuclear Operations Engineering Support.

PAGE 3

+

n INTEOR Ati:D VERIFICATION Tsuu kr.roaf I

DISCUSSION ON CORE AND COOLANT BOUNDARY PROTECTION )

AN ALYSIS The following discussion contains excerpts out of a paper written by Paul Fleming titled,

" Safety Analysis Comparisons to Crystal River 'init 3 Procedures". Each discussion provides a brief description of the accident conditions and procedures used. The IVT used this information to assist in focusing the review of selected documents and activities.

UNCOMI'ENSATED Ol'ER ATING REACTIVITY CIIANGES This event is a function of reactivity changes that occur over the life of the operating core.

The principle contributors that cause reactivity changes include: fuel depletion, burnable poison depletion and changes in Ossion product poison concentration. Since these reactivity changes are relatively slow, the Integrated Contro: System (ICS) and operator action are more than adequate to compensate. During normal operation control rod position is managed by i perators in accordance with Operating Procedures OP 103D (Withdrawal Limit Curves), OP-104 (Soluble Polv.m Concentration Control) and OP 204 (Power Operations), while reactor coolant system (kCS) temperatur .., lintained by the ICS. Ifleft uncompensated, the reactor protection system (RPS) setpoints will prevent safety limits from being exceeded. No modifications os other changes were identified which affect the ability of the operators or SSCs to compensate for this phenomena.

STARTUI' ACCIDENT His accident is a function of an uncontrolled reactivity addition by control rod group (CRG) withdrawal from a suberitical condition. Two cases were evaluated; one CRG and all CRGs withdrawal. For the one CRG withdrawal case, the transient was terminated by a high RCS pressure RPS trip. For the all CRG case, the transient was terminated by a high flux RPS trip. In both cases operator action at the onset of recognizing inappropriate CRG operation wot.ld be to stop rod movement and if 'msuccessful, then a reactor trip would be manually initiated in accordance with Abnormal Procedure (AP)-525, Continuous Control Rod Motion.

Upon receipt of a reactor trip operators use Emergency Operating Procedure (EOP)-02, Vital System Status Verification, to ensure post trip reactivity is managed with primary to secondary hest transfer adequate and balanced. Absent any other symptoms or operational challenges EOP- 10, Post-Trip Stabilization, is performed to manage plant systems and components after a reactoi trip. No modifications were identified which affect the probabilhy of this event, change the affect on the plant, or the mitigation of this accident.

PACE 4

-_ . = .

INTFORATED VIRHICATION TEAM RLroaf ROD WITIIDR AWAl, AT R ATED l'OWER Ol'ER ATION ACCIDENT Dis accident is a function of an uncontrolled wlthdrawal of an entire CRG while operating at rated power. A reactor trip occurs on either high RCS pressure or high flux depending on rate of reactivity addition. Once abnormal CRO movem:nt is observed, the operating staff would attempt to stop tod motion and if unsuccessful, then a reactor trip would be saanually initiated in accordanc) with AP 525. Upon receipt of a reactor trip operators use EOP-02 to ensure post trip reactivity is managed with primary to secondary heat transfer adequale and balanced. Absent any other symptoms or operational cnallenges EOp.10 is performed to  ;

manage plant systems and components after a reactor trip. No imxtifications were ider.tified '

which affect the probability of this event, change the affect on the plant, or the mitigation of this accident. ,

1 MODER ATOR IIII,UTION ACCIDENT His accident is a function of an uncontrolled reduction in RCS boron concentration.

Procedures such as Operations Instruction (01-01), Reactivity Control, which provides high level guidance for reac*ivity management and OP-304 which provides Limits and Precautions to prevent inadvertent deboration, and design features minimize the probability an inadverterit RCS dilution event. However, should such an event occur operators are trained to recognize symptoms of a reae,1vity imbalance and take conservative action (s).

He modification to install MUV 541 in the makeup tank makeup line was reviewed. No additional operator burden or interdependencies were identified. In fact, this modification greatly benefited the operator and maintenance in using this injection path. MUV 103, which was previously used to isolate this flow path, had a long history of seat leaks. He location of the valve is such that effective maintenance could not be performed, ne installation of the new valve addressed these and several other problems, all adding a great deal of reliability to the isolation of this line, and thus lowering the probability of this accident.

One of the symptoms of a moderator dilution accident while at power includes control rod movement mto the reactor core. Operators are charged to maintain control rod position within the Regulating Rod Insertion Limits in accordance with improved Technical Specification (ITS)

Limiting Condition for Operation (LCO) 3.2.1, OP-103D and OP-20.t. AP-525 provides guidance to stop rod motion and terminate the dilution. Activities related to an inadvertent deboration event would be readily identified by indication of increased RCS inventory as evidenced by a positive pressurizer level trend. A new proce e written to mitigate reactivity ex:ursions is AP-490, Reactor Coolant System Boration. If boration is required by ITS, or if in Modes 3-6 and an unacceptable increase in neutron flux exists, mitigative action out of this procedure is used, ne procedure essentially initiates flow from a borated source and er.sures the source is isolated after the event is terminated. No unteceptable cross dependencies were identitled in the new procedure. He team also reviewed the disposition of MUV44, MUT Outlet isolation Valve. FPC removed the commitment to close this valve within 10 minutes.

De technical justhication was adequate with no further comments regarding the operation of the manual operator installed during Refuel 10.

PAGE 5

INTt:ot Af st) VtatHe4 TION TEAu Rtropf Absent any other symptoms or operational challenges, EOP-10 is performed to manage plant systems and components after a reactor trip. No modifications were identified which affect the probability of this evnt, change the affect on the plant, or the mitigation of this accident.

COI.D WATER ACCIDENT This accident is a function of starting a reactor coolant pump (RCP) during power operation. RCP start permissives prevent starting an RCP with reactor power greater 'han 30%

RTP. In addition, OP-302, RC Pump Operation, provides guidance to maintain reactor power less than 30% prior to starting an RCP. These control measures assure the accident analysis is preserved. No modifications were identified which affect the probability of this event, change the affect on the plant, or the mitigation of this accident.

1 OSS OF COOL, ANT Fl.OW ACCIDENT This accident is a function of a loss or reduction in fo.ced RCS flow. Two accidents were evaluated: four pump coast down and locked rotor (1 RCP). Ibth accidents result in s reactor trip. Ilowever, procedures used to mitigate each accident differ based on RCP operating sta'us.

For the four pump coast down accident operators use EOP-02 to ensure post trip reactivity is managed with primary to secondary heat transfer adequate and balanced. If no RCPs are operating, then operators are instructed to ensure emergency feedwater (EFW) is supplied to the once through steam generators (OTSG) EOP-13, EOP Rules, Rule 3 provides guidance for establishing the required OTSG level. Mitigation guidance is continual in EOP-10 where RCP restart is addressed if RCPs are available if at least one RCP can not be placed in operation, then EOP-10 routes to EOP-9, Natural Circulation Cooldown.

For the locked rotor accident, operators use EOP 2 to ensure post trip reactivity is manegal with primary to secondary heat transfer adequate and balanced. Absent of any other symptoms or operational chalunges, EOP-10 is performed to manage plant systems and components after a reactor trip. Components involved include the RCPs, RCP Power Monitors, and 6.9kV switchgear. Modifications to FWP 7 backup diesel power were reviewed and no adverse affects to the loss of RCS flow accident were found. No other modificat;ons or other changes were identified which adversely affect the mitigation of this event or operator burden.

STUCK OUT STUCK IN, OR DROPPED CONTROI, ROD ACCIDENT These accidents are a function of control rod misalignment due to a mechanical or electrical failure. A stuck-out control rod is assumed to occur on a reactor trip. Upon receipt of PAGE 6

INTL 0t Atto VrtlHCAfl0N T&AM atP0tt  !

a reactor trip operators use EOP42 to ensure post trip reactivity is managed with primary to secondary heat transfce adequate and balanecd. Sufficient negative reactivity exists post-trip to ensure 1% shutdown margin (SDM) for hot shutdown conditions, even with the most resetive control rod stuck-out. EOP-02 verifies all safety and regulating control rods are fully inserted.

No specific action is taken to mitigate the effects of a single stock-out control rod. If a.  ;

cooldown is initiated, then a combination of procedures (OP 209, Plant Cooldown, SP-421, Keactivity Balance Calculations, and OP-103C, Cycle 11 Reactivity Worth Curves) assure a L

minirnum shutdown margin is maintained in accordance with LCO 3.1.1.

A stuck in control rod is assumed to occur during the withdrawal of control rods. Once this condition is recognized by either observation or annunciator alarm (J-0244, event point i 1242) operatof action to realign the control rod is performed in accordance with OP 502, l Control Rod Drive System. His activity is performed while maintaining the requirements of LCO 3.1.4. If the control rod is determined to be untrippable, then SDM is verified in accordancs with Required Action 3.1.4.D.l.1 and SP-421, Reactivity Balance Calculations, or a plant shutdown to Mode 3 with a beration must ne completed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

If an asymmetric rod fault occurs, then the ICS will " runback" the plant to 60% of rated power. His situation is an entry condition for AP 545, Plant Runback. Operators stabilize the plant and ensure plant parameters are within acceptable limits, specifically for those related to I

Power Dis'ribution Limits published in ITS.

No modifications or other changes were identlfled which adversely affect the mitigation of this event or operator burden. ,

1 1.OAD REJECTION ACCIDENT nis accident is a function of the main turbine generator separating from the transtr.!ssion system, which can occur by either both output breakers opening or a main turbine trip .

(resulting in the output breakers opening). De accident analysis describes the original design which included maintaining the reactor operating. Subsequent (current) design moved the pilot operated relief valve (PORV) setpoint above the RPS h!gh pressure trip setpoint. In addition, if the turbine trips with reactor power > 45%, an anticipatory reactor trip (ART) will occur.

Here are two scenarios of interest, one that results in a reactor trip and one that successfully runs back. Upon receipt of a reactor trip, operators use EOP-02 to ensure post trip reactivity is managed with primary to secondary heat transfer adequate and balanced. Absent any other symptoms or operational challenges, EOP-10 is performed to manage plant systems and components after a reactor trip.

if a turbine trip occurs with reactor power <45%, then AP-660 (Turbine Trip) is used to verify stable plant conditions post transient, if the main generator output breakers open, even with no turbine trip, the ICS goes _into TRACK resulting in a plant runback. No specific guidance exists for load rejection based ICS runbacks, yet discussions with the EOP group P

PAan 7

___._____m.--_-_.__ _ _ _ _ _ __ _ _____

-__-__.__..__m. m >_.. _ m e =~-_,-_. , _ -- - - - _ - - .- -. v, e -- -- e e,-w. + - , > , = -

l latttonato Vtattercisow TEAM Rtrott l Indicate that existing plant operating procedures and training provide the necessary guidance for operation of the ICS in track.

No moddications er other changes were identified which adversely affect the mitigation of this event or operator burden.

STATION RI,ACK 001 ACCIDI:NT De changes made to this section of the FSAR were to clarify the thermal hydraulic plant response which had already been stated in earlier sections. De second change identifies the use of VillT 1 A through 1D for coping, which was previously assumed, but not listed. He final change was for the replacement of Nitrogen Bottles with Breathing Air llottles for the operation of the ADVs. Here is a pending change due to the EOP 12 revision which lists instructions for the Operations staff to verify the status of containment isolation valves in acco, dance with NUMARC 87-00.

In dealing with this accident, it was found that EOP 12 is the primary procedure used to stabillie the plant and cope with the conditions of the accident. His is accomplished through the use of EFW (EFP 2) for removal of Decay Heat, while MSSVs and ADVs transfer energy to the environment.

De actions required by Operations during the accident mitigation were found to be consistent whh analysis and not overly burdensome. De actions are as follows:

1. Minhnlie RCS losses and ensure EFP 2 has started. De modification which returned the auto-roop.aning of ASV 204 was found to give added assurance that EFW would be available. As a method of defense indepth should EFW not operate correctly, EOP-14 Enclosure 10 starts AFW from FWp-7 which has had an independent power source installed by MAR 97 43-01-01. Here are additional actions required should AFW be neoded; however, they are considered to be reasonable and not a heavy burden.

2. Align air supply to ADVs. MAR 96 07-09 01 installed aew breathing air bottles. He ADVs were analyzed by Framatome (INS-97-4550) to have the equivalent of 7 full strokes duilng t' e 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO event. De IVT de:esmined this to brJadequate for dealing with a four (4) hour S110 based on ADV air reserve capacity. His was not considered to be an increase in operator burden, as the breathing air bottles where a replacement for nitrogen bottles which also required action to put them in service.

3. Remove non requ! red operating loads powered from the DP System. This is performed within the control room and has remained consistent with no additiona! operator burdens or actions. His was found to comply with all design requirements established in calculation

• to assure adequate battery capacity for coping with a four hour SBO.

4. As previously performed, cabinet doors within the EFIC rooms and control room are opened to reduce the heating effect on electronic systems due to the loss of ventilation.

Additionally, VillT lE, the non-lE inverter, is deenergized to climinate a source of PAGE 8

IwtL0kATED VLtillCAflON Tr.Au RLrost i

heating. Modifications to the control room have been reviewed and determined to have no adverse affect on previous heat loading assessments.

]

Once the above actions are completed, AP-770 is performed concurrently in an effort to re-establish AC power to the ES 4160V Busses. After this point, with or without the return of AC power, the plant conditions are being monitored to assure consistency with design analysis.

These conditions include, but are not limited to, verifying adequate subcooling margin and cor,tainment integrity.

1 In conclusion, the review of this accident shows no adverse effects on mitigation strategy or safety margin. The completion times associated with operator actions are considered to be reasonable to reach the required condition in an orderly manner without a challenge to the plant systems.

lrea of Recommended Rdlow Up It has become apparent that the Atmospheric Dump Valves are utilized for several plant scenarios. The IVT determined that much attention should be given to these valves. In the past, CR-3 has operated with at least one of these valves isolated. NOD 31 should be reviewed by Operations to ensure the required actions are commensurate with the safcty significance of the valves. Dere is a significant difference in Operations relying on the MSSVs vice the ADVs as to the case of response to transients and control of the secondary plant.

STANDBY S AFEGUARDS ANALYSIS The following discussions were developed from the IVT meetings, discussions with key issue managers, and review of modifications and procedures.

hlAIN STEAh! 1.INE Fall URE ACCIPENT Dere was an extensive rewrite of the PSAR description based on Restart issue D 70.

With respect to this accident, two cases were discussed-maintaining adequate subcooling margin (SCM) and the loss of SCM.

In maintaining adequate SCM, a new action added to the EOPs is to trip the Reactor Coolant Pumps (RCPs) upon loss of controlled bleedoff (CBO) flow from the seals. HeCBO flow isolates when the 4 psig Reactor Building Isolation ES signal is received, in addition to this action, the make up pump recirculation line isolates and decay heat pumps start as part of the LPI cacading signal within the ESAS. There is no change with the recirculation valves except the I{PI Recirculation to the RB Sump modification allows additional options for MUT PAGE 9

1 nth 0kATLD VLRlHCATION TEAM Rrroat water management. He LPI pu:nps startmg was a major burden to the operator prior to this outage. Timely tripping of the pumps after a diagnosis of them nc'. being required was necessary. Although still important to diagnose the need and shut the pumps down, the increased mission time cf the pumps developed during this outage removes the potential for damage which was once believed to exist.

In the case where inadequate SCM esists, EOP 3, inadequate Subcooling Margin, is entered a.id a full ES actuation is assured, either automatically or manually. SCM is quickly restored by the IIPI flw, yet the RCPs are already tripped per EOP-13, Rule 1. Further luto the event EOP-2, EOP-5, and EOP 10 are used to stabilize the plant. Control Complex ventilation is restored which is the same as prior to this outage. Overall, operator burden is not adversely affected by the modifications and procedure changes.

Additional Discussion:

PCa7-5981 described a situation where a small steam leak occurs and the OTSO pressure becomes biased. %is in turn cautes unequal EFW flows which perpetuates into a continuing divergence of the OrSG pressures until the EFIC control circuits catch up to the transient.

Operator acGons may be necessary due to the hydraulic blasing, but existing procedure controls and training appear adequate to mitigate this event. Additionally, engineering analysis proves that the OTSGs will recover and the event la seh mbigating without operator action.

STEAM GENER ATOR TURE RUPTURE Modl0 cations effecting the short term and long term actions from this accident greatly raluce operator burden. Modifications reviewed were:

. HPI Recirculation to the sump e FST-CDT Crosstie e EFW Cavitating Venturis e EFW F!ow Control Modules e RM C 26,27 Replacement There were no modi 0 cations reviewed which sign 10cantly change the mitigation strategy of the SGTR event. The modifications above reduced the operator burden in diagnosis of the event (RMGs), early in the event (EFIC/EFW improvements), and later in the event (FST-CDT Crosstle for contaminated water management).

EOP4 was reviewed and discussions were held with Gary Becker of the EOP group.

Questions were raised about the secondary plant operator (SPO) action to establish blowdown early in the event. His could conflict with priorities of a rapid plant shutdown which works the SPO quite heavily in maintaining secondary plant stability. The EOP group acknowledged the potential burden and agreed that priorities from the MCR would be necessary.

Additionally, all the steps were field validated with the assumption of only one SPO, which is PAGE 10

..- , . . _ - - . - ._. - . - _ . ~ . . - _ . . - . _ - _ _ . . - . , . ~ ~ - ~ _ - _

, o .

INTEORQTr0 VLRillCATION TBQW REPOkT conservative because two SPOs are required per shift in accordance Al 500. It appeared adequate thought went into this in the writing of the procedure. Another question was raised concerning the increase in the If at any time" steps which add mental burden tc the procedure reader and the control board operators. To help alleviate potential cocflicting priorities, the EOPs were better human factored in regards to facing pages and carry forward steps. He pages are easier to read and new consistent standards on the use of the facing pages should add improvement to the training program. A contractect human factors specialist assisted in formatting the new EOPs.

he use of Tube Rupture Alternate Control Criteria (TRACC) was discussed, ne use of TRACC limits is in accordance with the FTI Technical Basis Document. In aggregate, the response to the SGTR has not been adversely effected by outage activities, modifications, or procedure changes.

Areas ofRecomtaemled Follow Up

1. De Chapter 14 description of the SGTR should be clarified to ensure initial assumptions of the accident are clear in all cases. Assumptions as to the status of offsite power and single failures are inferred from the discussion but need to be clearly discussed.

2. At some point in the future, an actual test of thc use of FST 1 A to accept water from CDT.

I should be run. His new flow path is untested, yet straight forward.

FUEt, ll ANI)t.ING ACCII)ENT Few modification activities effected this cecident scenario. Modifications to the radiation monitors which have been on-going for several years have enhanced the ability for operators to l diagnose the pathway of a release through more reliable monitors. Other modifications were l reviewed.

. 94-04-11-02 Spent Fuel Area Lt.htir.g

. 97-04-05-01 AHF 8A Vibration Repair

. 97-09-06-01 Primary Gamma Ray Particulate Calibration ,

(RM A6) i

= 97-09-07-01 Code Compliance Modification for Spent Fuel

! Cooling

. 97 10 11-01 Molded Case Circuit Breakers

= 97-07-054)! CREVs improvements PAGE1)

innon4nn visieic4 tion Tr:4u miront FP 203 was verified to contain steps for initial conditions relative to water level, radiation monitoring feel move planning, and personnel responsibilities. Rese precautions ensure the initial conditions usumed in the Fila in the FSAR are met, ne improvements to the CCHE were noted to be a positive effort to protect the operators, tims relieving burden and adding margin for toxic gas situations and radiological accidents. Overall, there were no adverse effects of the outage activities for this accident.

Areas ofReconunended Follow Up it was noted that FP 203 needs to be updated with the new precedure references for pre-job briefings. A NUPOST entry was made.

ROD EJECTION ACCIDENT There were two cases analyzed from a reactivity standpoint, zero power and full power.

Operator actions for each revolve around mitigation of the resulting LOCA caused by the open penetration in the reactor vensel head. His operator interface for a LOCA is bounded by the discussion in the LCCA section of this report. There were no modifications or EOP changes which effected the reactivity conditions of this accident.

I,OSS OF CODI. ANT ACCIDENT The mitigation of the LOCA was a major focus of this outage. Accordingly, several activities assessed the overall design margins and operator burden issues, Early in the outage, an expert team was formed ta essentially perform and detailed FMEA of the LOCA scenarios.

His team was also charged with development of solution sets to ensure the worst case accidents were mitigated. Later, restart issue D-16 perfermed an aggregate safety assessment of the outage modifications. The conclusions of this assessment were:

1. The installation of certain modifications and procedure changes improve accident management response for the identified scenarios.

2. Accident mitigation improvements can be realized by any of the defense-in<lepth capabilities discussed.

3. The sum total of [ operator actions] affect will be determined by a combination of table-top and simulator validations to assess that each action can be accomplished within the assumed time or condition limit.

Modifications performed after this assessment were reviewed for effect on the above conclusions. Modifications reviewed were PAGE 12

INT!;0t AttD VLtHieATION Tt Au Rtrott

. 96 0249-01 IIPI Flow Upgrade

. 9647 15 01 EGDG Stand by Keepwarm System (DL & DJ)

. 9647 17-01 RC.S Pressure low Range Instrument Upgrade

. 97-03 44-01 Main Control Room Noise Reduction

. 97-04-03-02 A11F-22 }{VAC Appendix R Mulification

. 97 05 1542 EDG Radiator Replacement

. 97-06-2041 Letdown Line Valve Addition

. 97 06-21 01 LPI Crossover Flow instrumentation Upgrade

. 97-07 01-01 AHF lC EDO leading Control, MCC 3All Interlock

. 97-07-05-01 Contro!, Complex Emergency Ventilation

. 97 07 10 01 FST/CDT Crosstle

. 97-08-01-01 EDG Protective Relaying Reconfiguration

- 97-10-09-01 MU 11ypass Flow Measurement

. 97 10-13-01 Appendix R Bypass Switch for MUV-23,24,25,26 These modifications can be grouped into 3 categories: eqaipment protection, process indication, and safety margin improvements.

Equipment protection is afforded by maintaining the EDO in a more ready state through better control of the Keepwarm systems, better ventilation for both the EDG room and the EDG control room, and more strategic protective relay operation. (At the time of this report, NRC approval of the LAR for the addition of the protective relays may not make stsrt up; therefore, it may be necessary to remove the modification which contained a USQ. No further infortr.ation was available for the decision was not finalized).

Process indication is improved with the addition of more accurate and easier to read digital indicators for several process tiow paths. A question was posed to the Supervisor, Simulator Trainitig and a Chief Nuclear Operator if the mixed use of digital and analog indicators caused any problems during fast moving transients, ne concern was that the operator neals to rnentally make the transition from reading a digital indicator to analog scale which is sometimes not linear. Both stated that there was absolutely no indication of experienced operators stalling due to this transition. There was no information available for the newer operators since they are not through the class yet, i

PAGE 13

'o '

INT 00EMCD v081ticATION TRAu Rt rott I

Safety margins have been enhanced by modifications to ensure leaks are properly isolated, EDG load is limited through en.uring only the necessary RB cooling is in service, ensuring IIPI injection val, power under all circumstances, and additional options for EFW water supply storage as well as contaminated water storage af er a SGTR. Even though there is some operator action required to implement these modifications, the actions allow for a return to normal mitigation strategies that were otherwise disabled, or not available due to capacity or inadequate margin.

All of these modifications contain no additional operator burden beyond the training aspects of new setpoints and protective relay scheme.

In addition to the review of modifications, the llPI System Engineer participated in a discussion on modifications and maintenance issues related to the Make Up and Purification System. Issues discussed were:

. %e llPI Recirculation Line to RB Sump modification. The modification is not quite complete. The 4 h1UVs will have to be powered up prior to use.

The IVT reviewed the EOp and determined the guidance to the operators was adequate.

. htUV 25 Acoustical Vibration. A modification was installed this outage to continue the acoustical monitoring of the llPI ilne to determine the origin of the noise coming fr m this line. Dermal sleeve problerns were not L totally ruled out by the investigation, yet it was determined that the sleeve was not loose.

. The status of h1UllE-lC regarding the isolation of hiUV-505 and the installation of h1UV 567. De C Letdown Cooler can not be put into service from the htCB since h1UV-505 has the power removed. Efforts are continuing to re-power the valve, yet for this cycle, as in the past, it will be a manual action with a Reactor Building entry to put the cooler in service.

. The limitations on the SW systern versus letdown flows. The system engineer had worked hard at relieving the operator burden on worrying about letdown flows through the downstream components. Limitations on the SW flow for both letdown cooler vibrational concerns a'id SW system temperature has caused engineering to propose a series of curves showing letdown flow limitations.

. IIPI system flow balancing. The use of the stop check valves for both flow balancing of each pump (PT-444) ar.d it; primary isolation valve for tagging out the pumps was questioned t'uring the engineering self assessment. The issue comes down to methou of positioning the valve, both during the flow balance and during tagging operations, and the ndelity and repeatability of the " number of turns" method. The IVT determined that adequate planning is going into the issue yet scheduling the test to determine the fidelity and repeatability of the positioning has not yet cccurred.

1 1

PAGE 14 l

_ __. .. __ _ _ _ _ _ _ __ _.~ _ _ _ _ _. _ _ _ _ .___ _ _ _ _ .__ _ _ . _

• l INTBOR ATED VERH lCATION TEAM atPORT e MUP flow margin. The system engineer reported that there is approximately 10% flow margin in the MUPs at this time with loss of  ;

offsite power. If no LOOP is experienced, there is much more margin.

Discussions contained in the EOP section of this report confirm the summary statement 3 of the D 16 Aggrcgate Safety Assessment dealing with the timing and limitations of operator actions. With the exception of the Control Complex Chiller issue regarding the timing of restart, operator actions appear well connected to the analyses.

None of the modifications affect in :m adverse way the summary statements contained in the D 16 Aggregate Safuy Assessment. Here are a few activities not yet resolved which need follow-up to ensure the assumed staff burden and licensing basis is maintained.

Areas ofRecommended Follow Up

1. Continue to work on the design basis calculations for the SW temperature issues.

Several competing problems dealing with RBCU, CC Chillers, and Letdown Flow have brought the performance of this system to the forefront of operator burden.

2. Make it a priority to perform a stroke on the MUP stop check valves to determine if PT-444 needs to be run in Mode 3. If it needs to be run, then the excessive cooldown of the pressuriter needs to be resolved.

3. Install a local MUT pressure gauge to allow for a proper channel chect of the tank pressure. There is no redundant pressure indication and the MCB instrument has had a history of drifting. Worst case to-date drifts have shown it is possible to operate with the MUT in the Restricted region of the present curve and not have a computer alarm.

M AKEUP SYSTEM l ETDOWN 1.INE l'All.URE ACCIDENT The IVT reviewed the MU System Letdown L9e Accident as stated in Section 14.2.2.6, and revised for revision 24 of the FSAR. Discussions were held with Paul Fleming (CDIP/ SAG) and Gary Becker (EOPs) to describe the FSAR and EOP changes to support this accident. This accident is a breach in the letdown line outside of the reactor building and downstream of the outboard containment isolation valce, MUV-49. Upon receipt of a reactor trip, operators perform the immediate actions of EOP-02. A loss of subcooling margin occurs wl.ich is an entry condition for EOP-03.

As discussed in Chapter 14 c.nd further discussed in Chapter 5 (section 5.4.4.2) of the FSAR and proposal changes for revision 24, a break in the high energy portion of the Letdown Line outside containment is not considered a credible event. Therefore, this accident is described only to demonstrate that the dose consequences remain below 10 CFR 100 limits.

The Chapter 14 discussion states that Operations will isolate the letdown line following a Loss of Subcooling Margin (LSCM) as directed by Emergency Operating Procedures (EOPs).

This activity will isolate the letdown line prior to the ES actuation signal. The early actuation PAGE 15

, )

I

]NibOR Af t D vt titleATION IEAh4 ALPORT will result in a higher system pressure resulting in 1800 to 2380 psid across the letdown line isolation valves. As a comequence FPC has had to increase the motive air to MUV-49 and add a new isolation valve, MUV 567, to replace the function of MUV-40,41, and 505. De IVT reviewed EOP03. Step 3.4 of that procedure requires operators to ensure Letdown isolation valves are closed (MUV-49 & MUV 567). He analysis assumed operator action would be taken at 10 minutes from the time that fluid in the hot leg piping becomes saturated.

His timing assumption is within the capabilities of the Operations crew and therefore concluded to be acceptable.

Here is a slight increase in the dose consequence, but it remains well w!$1n the 10 CFR 100 limits, His slight increase is discussed within License Amendment Request (LAR) 218.

FPC has not received a response from the NRC concerning this issue.

WAC'IE GAS DECAY TANK HllPTURE ne IVT reviewed the Waste Gas Decay Tank Rupture (WGDTR) accident as stated in Section 14.2.2.8, and revised for revision 24 of the FSAR. Here are only minor changes identiGed with revision 24, none of which requires procedure changes, decreases Safety Margins, or increases staff burden. His accident is the function of a total failure of waste gas decay tank.

He assumed contents of the failed tank include a total RCS degas with 1% failed fuel. He ruptured tank will release its contents into the auxiliary building, detected by various radiation msmitors. AP-250 will be implemented based on the radiation monitor alarms. Effected areas will be evacuated. Fans and dampers that are interlocked with the radiation monitors that reached the high alarm setpoint (interlock actuation) are verified for proper alignment if RM-A5 gas actuates, then the CC ventilation is placed in the emergency recirculation mode of operation.

Here is an outstanding issue associated with the Waste Gas Tank piping, seismic concern.

PC-97 2372 identined a possible discrepancy between the FSAR analysis and the plant c(m0guration. This PC is associated with the seismic issue since the analysis assumes the loss ef one WGDT and that since the piping is non-seismic the loss of integrity of this piping could result in the release of all three WGDTs. The ITS was revised to limit the amount of radioactivity allowed in one tank such that the loss of all three tanks would be less than assumed in the FS AR analysis.

Additionally, FPC is currently initiating plant modi 0 cations (MAR 9710-01-01) to ensure conformance to the seismic requirement. These modi 0 cations are ongoing and it is anticipated that the piping upgrades will be in place prior to Start-Up. A contingency to the MAR completion is to utilize the DR/JCO process.

l.OSS OF FEEDWATER AND MAIN FEEDWATER I.INE BREAK ACCIDENT For the loss of MFW accident, the primary mitigation strategies involve operation of the EFW system to supply feodwater to the OTSG and maintaining the appropriate OTSG level.

PAGE 16

I o '

. b lNTIOS ATED viktflCOTION Tt;Au RLrokT For the MFW line break accident EFIC is required to isolate the affected OTSG. RCS temperature !s controlled with the TBVs and the ADVs.

Several modifications were completed to enhance accident mitigation capabilities for these accidents. The IVT reviewed these plant modifications against the following EOPs, used in the process to mitigate these accidents:

EOP-02 Vital System Status Verification EOP-04 Inadequate lleat Transfer EOP45 Excessive Heat Transfer EOP-10 Post Trip Stabilization EOP13 Rule 3, EFW Control EOP 14 Enclosure 8, MFW Restoration Key equipment and processes, included in the EOPs listed above, necessary to mitigate these accidents, were compared to modifications and procedure changes. Discussions of these changes follow.

A motor operator was added to EFV 12. This valve is normally de-energized closed and is required to be opened within the first hour of EFW initiatica to cross connect EFW for certain accidents. Adding the motor operator allows remote operation of this valve from the Control Room, relieving Operations personnel of the unnecessary burden of entering the 95' elevation of the intermediate Building to complete this task manually (MAR 9610-10-01).

He OTSG level control function of the EFIC Control Module was enhanced. The objecti ve of thi design change is to reduce operator burden due to deficiencies in this control module. This change will reduce the excessive interaction required during certain accident ,

scenarios to prevent overcooling events and when switching from automatic to manual control.

(MAR 96-06-02-0l) 1 The automatic opening of ASV-204 on an "A" EFIC actuation was restored, in order to restore the load sharing capability of the EFW system. This was done to reduce the load on the "A" EDG, and to support the delivery of flow to the RCS. Although there is no change in operator burden, this change maintains the Technical Specification margin to safety. (MAR 96-11-01 01)

Cavitating ventures were added in the EFW pump discharge piping to prevent excessive pump flow. This will eliminate possible high flow induced failures such as run out and inadequate NPSila that could result from certain single active failures. His change will reduce operator burden early in the accident, in that it is not required to take manual control of EFW until further into the accident. (MAR 96-10-02-01)

PC 97 5981 was generated to identify a concern where differential pressure between the two OTSGs can cause EFW to be interrupted to the higher pressure generator and result in the operator having to take manual control of the EFIC control valves in order to meet EOP criteria. An evaluation will be conduced after startup to upgrade the control system to further minimize operator intervention during certain EF actuations. It has been determined that operator action is not required to meet design basi.e ensiderations. This will be communicated to the operators prior to entry into Mode 4 per Corrective Action 1 of PC97-5981.

PAGE 17

INTEOR ATED VERIFICATION TEAM REPORT A standby diesel generator was ad led for a backup power supply to the Auxiliary FeeJwater pump in the event of a Loss of Offsite Power (LOOP). In the event that EFW is not available, AFW will be placed in service. Tnere is no change in operator buiden to prepare the AFW pump for operation; hawever, there is an increase in operator burden to power the AFW pump from the standby diesel generator. The AFW pump is non-safety related and, thetefore, a defense in depth component. The increase in operator burden is offset by the benefit of the backup power source, and is only realized in the unlikely event that EFW is not avtilable.

The nitrogen bottles on the ADVs wuc replaced with breathable air bottles. Although this backup supply of operating air is not required for these accidents, it provides defense in depth to assure operation of the ADVs for RCS temperature control. (MAR 96-07-09-01)

[:

PAGE 18

[

• l...

l iureoamo vcuncinox Tuu meraar SPECIAL TOPICS BORON PRECIPITATION The IVT reviev,ed the boron precipitation issue through imerviews and reviews of safety assessments and procedures. The effects on operator and chemistry staffs were studied.

Discussions were held with Paul Fleming (SAG /CDIP) and Ron Faller (Chemistry Manager) as to the timing of midgative actiom.. The resolution of this issue has added burden to both the Chemistry and Operations staff, starting as early as 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the LOCA event. De IVT determined that:

1. Operaticns procedures adequately covered actions required by the analysis

2. Here was adequate consideration for the Operations / Chemistry interface

3. Chemistry capabilities are adequate and staff limitations are factored into both procedures and communications The IVT concluded that this activity coordination is adequate.

Areas ofRecommended Fallow Up 1, increase the reliability of the Boronometer in the PASS system. Presently it has a 23%

down time causing reliance on a backup method of sampling the RB sump. This in tums adds further limitations on Chemistry based on dose and manpower.

2. Continue to work on the Chemicry burden imposed by all of the EOPs and ensure there is a clear understanding between what Operations expects and where Chemistry can physically deliver, especially on the timing of sample results.

3. Contit.ue development of the Hot Leg injection methodology to provide a second back up method from 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> into the LOCA event.

4. Evaluate the installation of the RCS blowdown line to eliminate boron precipitation as a concern. In addition, this would eliminate any concern with mission time of LPI, loading on EGDG-1 A (if sized properly), and minimize the tinae dependency on EFW for LOCAs.

l I ___ __ __ - _

PAGE 19

l

)

• i INTE0tATED VEttFleATION TEAu REroRT EMERGENCY OPERATING PROCEDURES A discussion was held with Gary Becker of the EOP group. The EOPs were first issued in 1993 yet contained many inconsistencies which led to enforcement by the NRC in Inspection Report 93-16. De EOPs were patched up in response t9 this action, yet were still not made consistent with the design of the plant. Operators had always written the procedures with little input from the design staff. In 1994, the MUT event caused a hard look at the EOPs and the way the plant we.s designed. Gary Becker was put in charge of the smal: staff of procedure writers and began to uncover additional areas of concern where the operating practices of the plant diverged from the design. !n July of 1995, a team was put together to assess each and every step of the EOP which produced a myriad of comrnents and needed changes. It was these efforts which were the catalyst for the issuance of the new EOPs this outage.

Some of the additional changes made were ,o extena inv usefulness of the EOPs down to decay heat removal. The old EOPs referred to operating procedures which were often confusing to follow with the accident conditions. Operators essentially had to use the normal operating procedures with exceptions to achieve the desired result. Now, the EOPs will bring the plant to a stable completion of the cooldown which is a tremendous enhancement. Other enhancements include:

1. Field validations and time sequencing of all steps

2. Staging of EOP tool boxes throughout the plant

3. Special labels with reflective tape for easy identification

4. Photographs of the plant equipment for training and procedure deveLpment

5. Reformatting of the EOP pages relative to NOTES, CAUTIONS, and STATUS.

6. Other more subtle huraan factors changes in the writing of the procedure such as fold out i

pages, bullets, reduced clutter on facing pages. Nuted that the use of an outs de expert for human factors improved the use of the procedures.

7. Independence of the EOP and operating procedures through t.ie use of additional enclosures In aggregate, the IVT was impressed with the completeness and detail of the EOPs. These clearly provide a better tool for the operators. There were several technical issues discussed and these will be included in the specific accident discussions. We following open items were s develeped:

1. The burden on the chiller actions had not come to resolution. It was preliminarily state.?

that the chiller will be taken off of the 480 volt ES lockout to ensure the continued operation (4 the units for control room cooling. A later issue was discovered where the SW system analysis based on RBCU cooling concerns was not being adequately integrated with the EOP needs to get the chiller started after EDG load management. The RBCU design engineer was not aw:.re

)

1 PAGE 20 m

% V

\ , . , '

INTEOR ATED VLeiflCATION TE AM RETORT that the EOPs had consistently achieved chiller start up within 40-60 minutes where it was thought that 60 minutes was the limit. The RBCU design engineer was relying on a minimum of 80 minutes so that he could prove that the chiller would not trip on high vapor pressure from the elevated SW temperatures from the RBCU concern. The 80 minutes was needed for the RW system to reject enough of the stored heat from the SW system. He RBCU design engineer was instructed to integrate his activity with the EOP efforts (See detailed write up in

" Service Water Overheating" below.)

2. It was suggested that Chemistry look at providing the best quality water that is economically feasible for FST-1 A since this water may be used as a source of feedwater in the OTSG This may include periodic cleaning or enhanced water chemistry.

SFRVICE WATER SYSTEM OVERilEATING During the evaluation of Restart item D-28, " Design Calculations for SW System Heat Loads," engineering discovered that the andyses performed in 1987 to support the increase in design basis ultimate heat sink (UHS) temperature from 85 to 95 'F were deficient.

He degraded condition centers arount the limited ability of the SWHE to transfer post-accident heat loads from the Nuclear Services Closed Cycle Cooling Water system (SW) to the Nuclear Services Seawater rystem (RW). For the limiting Loss of Coolant Accident (LOCA),

SW could remove more heat from containment through the Reactor Building (RB) fan coolers than the RW system can remove from SW. This mismatch in heat removal results in SW temperature exceeding its design limit of !!0 'F. The equipment cooled by SW could fail to perform its safety function if the SW design temperature is exceeded.

Previous an.-Jyses (including original SW system design and sizing studies) assumed the RB fan coolers operated in the worst case degraded (fouled) condition and the fan coil cooling water (SW) flowrate was at the minimum design point of 1780 gpm. With these assumptions, SW was capable of removing the design heat load and rejecting it to the UHS. These assump: ions are conservative with respect to the containment peak tempeiature and pressure analysis but not for the maximum SW load calculation. Recent analyses have shown the SW system becoming overloaded due to excessive heat removal from the RB by the RB fan coolers following a postulated LOCA.

After a LOCA, the maximum allowable SW temperature could be exceeded if the following conditions ext:t: the RB fan coolers are actually in a clean, nondegraded condition; two SW pumps are providing greater than 2000 gpm to each RB fan cooler and one RW pump is in servica (the single failure of the second RW pump is limiting for this scenario). These c(mditions result in a considerably greater predicted heat transfer rate from the RB atmosphere inte SW via the RB fan coolers. At high UHS temperatures, the additional heat load in the SW system exceeds RW system capacity and causes the SWhE outlet temperature (returning to SW loads) to exceed the 110 F limit. Exceeding the SW design basis temperamre could cause the failure of the SW cooled loads and lead to unacceptable accident mitigation capability.

j PAGE 21

INTE0 DATED VERIFICATION TEAM REroRT i Analyses have shown for two RB fan coolers with minimum fouling and SWHEs with zero blockage, the maximum allowable UHS temperature is 81 l'F. If only one P.B fan cooler is in service, the allowable UHS temperature increases to 95.4'F due to the decreased heat load.

However, as the blockage of the SWHE increases, the maximum allowable UHS temperature decreases due to the decrease in RW flow. For example, if two RB fan coolers are in service, with 20% blockage, the maximum allowable UHS temperature is 76.6*F. With anly one RB f cooler in service, and the same level of blockage, the maximum allowable UHS

.nperature is 92.8'F. Higher levels of blockage will result in ever lower acceptable UHS Temperatures.

The original design basis assumed an 85'F UHS temperature dat resulted in a peak SW temperature of 105'F. UHS temperatures routinely surpass 85'F in the summer, therefore, the license and the analysis needed modification. Licensing Amendment 109 (2/14/89) changed the UHS temperature from 85'F to 95'F. A UHS temperature of 95'F results in a peak SW temperature of Il0*F. He maximum UHS temperature of 95 F is verified every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> by improved Technical Snecifications (ITS) Surveillance Requirement 3.7.11.2.

Based on a revision to ceula v.cn hi94-0056, " Allowable SWHE Tube Blockage vs. UHS Temperature", the UHS is -OPERABLE and two fan operation is acceptable as long as the UHS temperature is below the limits listed in M94-0056. However, the system is considered "not fully qualified" since it cannot perform its required function at all licensed plant conditions (up to 95'F). The SW and RW systems are also OPERABLE but not fully qualified since they are not capable of transferring post-accident heat loads to the UHS under all required conditions.

Surveillance Requirement (SR) 3.7.11.2 requires UdS temperature to be equal to or less than 95 F in order to be OPERABLE. If UHS temperature exceeds 95*F then the UHS is not OPERABLE and the required action is to be in MODE 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />, in the current RB fan cooler ES logic configuration, two fans will start on an ES sigul. Even with minimum SWHE tube blockage, the SWHE outlet temperature could exceed 110 F if the UHS temperature is above 81 I'F. Therefore, plant opert could be with;n Technical Specification limits but outside the safety analysis. This cond aun is a nonconformance and was reported in LER 97-025-00.

FFC has chosen to address this issue in three activities: 1) Prepare an evaluation to allow startur and continued operation,2) Install r. RB fan run logic MAR, in the interim, to restore qualifications of the SW System, and 3) Perform a study to evaluate the RB fan logic modification and other alternatives to restore full qualification tc the RW System. Each is detailed below.

Justification for Continued Operation The purpose of this JCO is to allow startup and continued operation with SW, RW and Ultimate Heat Sink (UHS) inat are OPERABLE, but ret fully qualified. Operation will he allowed only while UHS temperatures remain below the limits specified in OP-103B, Curve 15 (maximum temperature 81.1 F), until a modification is installed that will permit operation wi th UHS temperatures up to the current Improved Teclnical Specifications (ITS) Limit of 95.0 F.

PAGE 22

• INTEOR ATED VERIFICATION TEAu REPORT OP 103B, Curve 15 will be revised to account for the reduced allowable UHS temperatures from h194-0056. These reduced administrative limits in OP-103B, Curve 15 (maximum temperature 81.I'F), will remain in effect until modification (MAR 97-09 05-01) is installed to limit operation to one RB fan cooler following a LOCA. After the modification is installed, OP-103B Curve 15 will be revised to the previous limits which correspond to an allowable maximum UHS temperatuie of 95'F (ITS 3.7.11.2 limit).

Another consideration during the interim before htAR 97-09-05-01 is installed is the measurement of UHS temperature. When performing surveillance requirement 3.7.11.2, tic UHS temperature is normally taken from RW-19-TI, RW Pump Discharge Header. During normal operation of the RW system, a portion of the intake water is recirculated to mainNin RW temperature above 78'F to prevent thermal shock to equipment (this is not a concern post-accident because the recirculation flow is terminated on an ES signal). Due to the elevated temperatures caused by the recirculation of RW, this indication is not an accurate neasure of the true UHS temperature. The elevated RW temperature would not meet the more stringent limits set out in OP-103B Curve 15. Therefore, to get an accurate nieasurement of the UHS temperature, CR 3 will use the Circulating Water temperature indication which is not preheated.

The SW and RW systems are capable of removing post-accident heat loads while UHS temperatures are below the limits specified in M94-0056. Therefore, continued operation below these temperature is acceptab'e for MODES 1,2,3 and 4. The concern with the UHS temperature is not valid in MODES 5 and 6 since a high-energy LOCA is not possible in these MODES.

Corrective Action to Obtain Full Qualification As an interim method of restoring qualification, a modification (MAR 97-09-05-01, RB l Fan Run Logic) will be imtalled that will allow one and only one RB fan to start on an ES l signal. This change will ihn:t the heat loM on the SW system such tnat the RW system can reject enough heat to maintain the SW system below 119 F with UHS up to a temperature of l

l 95.0 F.

1 The proposed change to the RB fan run logic ha been determined to constitute an Unreviewed Safety Question (USQ). His also adds a train interdependency which must be carefully reviewed. License Amendment Request #224 was PRC approved (conditionally) on

! 11/24/97 with several conditions, includmg ensuring the SW flow balance remains valid under all operating conditNs. Therefore, NRC approval i3 required be' ore implementation of the j modification. FPC will .equest that the NRC approve the USQ by February 13,1998 to allow

! implementation of the modification before UHS temperatmes rise above the limits set out in OP-103B, Curve 15. UHS temperatures generally rise to unacceptable levels after mid-March.

Due to the complexity of this issue, FPC will perform a study to evaluate the RB fan logic modification and other alternatives to restore full qualification to the RW system. This review will be complete in the first quarter 1998.

PAGE 23

j,,*

f INTtat ATED VERIFICAtlON TEAM REPORT Procedural Impact Based upon the current analysis there is a need to revise OP-103B and SP-300.

OP 103B, Curve 15 will be revised to a. count for the reduced allowable UHS temperatures from M944056. These reduced administ:4tive limits in OP-103B, Curve 15 (maximum temperature 81.l'F), will remain in effect until modification (MAR 97-09-05-01) is installcd to limit operation to one RB fan cooler following a LOCA. After the modification is installed, OP 103B, Curve 15 will be revised to the previous limits which correspond to an allowable maximum UHS temperatute of 95'F (ITS 3.7.11.2 limit).

Additionally, SP-300 needs to be changed to account for the lower UHS temperature.

Sequence # 89, on page 9, will have new min and max tolerances and the temperature instrument equipment identification will change.

Overall, the above discussion shows adequate coordination of issues with resolutions planned. No additional areas were recommended by the IVT.

CONCI,USION The team concluded that overall affects of the modifications and procedure changes enhances the ability of the operator to prevent and mitigate accidents. There is also an obvious increase in the knowledge level et the staff, most notably the system engineers, operators, and design engineers. Activities where deficiencies existed during normal operation have been repaired or analyzed to relieve the operator burden and assure stable operation. Emergency response has also been enhanced through this gain in knowledge of the design ar,d licensing ,

basis of the plant, and through modifications performed and in process to the Technical I Support Center and Emergency Operating Facility. The areas needing follow-up contained in this report do not constitute a weakness in the ability te safely operate CR-3, yet are part of the ,

present efforts to resolve potential issues and fine tune the design and licensing basis of the plant.

PAGE 24

g b,e i o

' INTEGR ATED VERIFICATION TEAu REroar APPENDIX AREAS OF RECOMMENDED FOLIDV UP

1) It has become apparent the Atmospheric D. imp Valves are utilized for several plant scenarios. The IVT determined that much attention should be given to these valves. In the past, CR-3 has operated whh at least one of these valves isolated. NOD-31 should be reviewed by Operations to ensure the required actions are commensurate with the safety significance of the valves. There is a [

.significant difLrence in Operations relying on the MSSVs vice the ADVs as to the case of response to transients and control of the secor:dary systems.

2) The Chapter 14 description of the SGTR should be clarified to ensure initial assumptions of the accident are clear in all cases. Assumptions as to the status of offsite power and single failures are inferred from the discussion but need to be clearly discussed.

3) At some point in the future, an actual test of the use of FST-1 A ta accept water from CDT-1 should be considered. This new flow path is untested, yet straight fotward.

4) Continue to work on the design basis calculations for the SW temperature issues. Several competing problems dealing with RBCU, CC Chillers, and I,etdown Flow have brought the performance of this system to the forefront of operator burden.

5) Make it a priority to peform a stroke on the MUP t. top check velves to .

determine if PT-444 needs to be run in Mode 3. If it needs to be run, then the excessive cooldown of the pressurizer needs to be resolved.

6) Install a local MUT pressure gauge to allow for a proper channel check of the tank pressure. There is no redundant pressure indication and the MCB instrument has had a history of drifting. Worst case to-date drifts have shown it is possible to operate with the MIIT in thc Restricted region of the present curve and not have a computer alarm.

7) Increase the reliability of the Boronometer in the PASS system for Boron Precipitation. Presently it has a 23% down time causing reliance on a backup method of sampling the RB sump. This in turns adds further limitations on Chemistry based on dose and manpower,

8) Continue to work on the Chemistry burden imposed by all of the EOPs and ensure there is a clear understanding between what Operations expects and where Chemistry can physically deliver, especially on the timing of sample results.

PAGE 25

'o '

INTEORATED vERtFICATION TF.AM REPORT

9) Continue development of the Hot Leg Injection methodology to provide a second back up Boron Precipitation method that would be valid from 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> into the LOCA event.

10) Evaluate the installation of the RCS blowdown line to eliminate boron precipitation as a concern. In addition, this would eliminate any concern with mission time of LPI, loading on EGDG 1A (if sized properly), and minimize the time dependency on EFW for LOCM.

II)The burden on the chiller actions had not come to resolution. It was preliminarily stated that the chiller will be taken ofiof the 480 volt ES lockout to ensure the continued operation of the units for control room cooling. A later issue was discovered where the SW system analysis based on RBCU cooling concerns was not being adequately integrated with the EOP needs to get the chiller started after EDG load management. The RBCU design engineer was not aware that the EOPs had consistently achieved chiller start up within 40-60 minutes where it was thought that 80 minutes was the limit. The RBCU design engineer was relying on a minimum of 80 minutes so that he could prove that the SW system would not exceed maximum design temperature, yet the chiller trip on high vapor pressure from the elevated 5 N temparatures had not been considered. The 80 minutes was assumed in the analysis to show the RW system could reject enough of the stored heat from the SW system. The RBCU design engineer was instructed to integrate his activity with the EOP efforts.

12)It was suggested that Chemistry look at providing the best quality water that is economically feasible for FST-1A since this water may be used as a source of feedwater in the OTSG. This may include periodic cleaning or enhanced water chemistry.

13) To relieve the EDG loading issue with EGDG-1 A, it was once considered to provide EFP-l with a dedicated emergency diesel generator. Although this was discounted for the option to upgrade the existing emergency diesel generstors, it may now be more cost effective and provide more positive marA to provide EFP-1 with dedicated power. During the existing upgrade efforts, additional limitations on the EDGs have been realized, specifically in the clutch / drive shaft for the radiator fan and in the inlet air temperature. This option should be re-evaluated based on present knowledge and limitations.

PA A 26

_ _ _ _ _ -