IR 05000483/1987025

Safety Insp Rept 50-483/87-25 on 870812-21.Violation Noted. Major Areas Inspected:Isolation of Safety Injection Sys Combined Recirculation Valve BN-HV-8813

ML20235C063
Person / Time
Site:	Callaway
Issue date:	09/17/1987
From:	Hinds J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20235C005	List: IR 05000483/1987025 ML20235C004 ML20235C035
References
50-483-87-25, NUDOCS 8709240335
Download: ML20235C063 (9)

Text

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

. .

U. S. NUCLEAR REGULATORY COMMISSION REGION Ill Report No. 50-483/87025(DRP)

Docket No. 50-483 License No. NPF-30 Licensee: Union Electric Company Post Office Box 149 - Mail Code 400 St. Louis, M0 63166 Facility Name: Callaway Plant, Unit 1 Inspection At: Callaway Site, Steedman, M0 Inspection Conducted: August 12 through 21, 1987 Inspectors: B. H. Little Approved B - J }i. Hinds, M f)

Ta' o9. n. 67 Reactor Projects Section 1A Date Inspection Summary Inspection on August 12 through 21, 1987 (Report No. 50-483/87026(DRP))

Area Inspected: A special unannounced safety inspection by the Senior Resident Inspector regarding isolation of the Safety Injection System combined recirculation valve BN-HV-881 i Results: One apparent violation was identified (failure to perform an adequate safety review - Paragraph ?.). There was minimal significance to public health and safet l l

8709240335 870917 PDR ADOCK 05000483 G PDR

_ - - _ _ _ _

..

<

l DETAILS 1. Persons Contacted G. L. Randolph, General Manager, Nuclear Operations

• J. D. Blosser, Manager, Callaway Plant A. P. Neuhalfen, Manager, Quality Assurance J. R. Peevy, Assistant Manager, Technical Services

• W. R. Robinson, Assistant Manager, Operations and Maintenance M. E. Taylor, Superintendent, Operations R. D. Affolter, Superintendent, Systems Engineering J. V. Laux, Superintendent, Quality Assurance Technical Support G. A. Hughes, Supervising Engineer, Independent Safety Engineer Group

• J. C. Gerhart, Superintendent, Quality Assurance Operations Support T. P. Sharkey, Supervisor, Compliance -

i

• B. K. Stanfield, Quality Assurance Engineer

• Denotes those present at one or more exit interview In addition, a number of shift technical advisors, reactor operators, senior reactor operators, and members of operations, and engineering staffs were contacte . Inspection of the Safety Injection System Operability Background On August 4, 1987, the licensee performed an operability evaluation of the Intermediate Head Safety Injection (SI) System. The evaluation was in response to a question of system operability which had been documented on a Request For Resolution (RFR) and Incident Report (IR). The licensee cetermined that on several occasions, the plant had been placed in a condition prohibited by Technical Specifications (T/S) Limiting Conditions for Operation (LCO) 3.5.2,

" Emergency Core Cooling Systems." The T/S violations had occurred when the combined recirculation valve BN-HV-8813 (Safety Injection Pump Recirculation to the Refueling Water Storage Tank (RWST)) was momentarily closed to permit valve stroke timing and pump testing activities. The prohibited conditions existed for durations of approximately 15 seconds to 1 minute 38 second Upon making an '

inoperability determination, the licensee notified NRC of the event using the Emergency Notification System (ENS).

A special safety inspection by the Senior Resident Inspector was performed to assess the licensee's activities associated with the SI system recirculation line isolatio The inspection included the following:

Review of documentation: plant records, Request For Resolution (RFR) No. 04033 Incident Report (IR) No.87-129, Work Requests 2 ...u l'

-( ' )

(WRs) Nos. W-414651 and PM 49488, Operations Surveillance Procedures OSP-EM-P001A and B Temporary Change Notice (TCN)

Nos. 87-0316 and 87-031 Interviews with licensee personnel from the following departments: Compliance, Engineering, Independent Safety Engineering Group (ISEG)/ Shift Technical Advisors (STA), and

_

' Operation Inspection Findings

'(1) Event Chronology October 1984 (Issuance BN-HV-8813 was cycled (closed of Operating License) approximately 15 seconds) twice every through June 1987' three months in accordance with ,

Operations Surveillance Procedure j OSP-EM-P001A and B (Section XI Safety Injection Train Operability).

June 29, 1987 BN-HV-8813 was closed for 35 seconds-to permit stroke timing of valve EJ-HV-8804 Timing test was specified in WR No. W-41465 The operating crew (including STA)

discussed SI system operability with operation supervision. SI system was considered operabl July 15, 1987 BN-HV-8813 was closed for 1 minute 38 seconds to permit stroke timing of valve FJ-HV-8804A. The timing test .

'

was specified in WR No. PM 49488. The STA discussed SI system operability with the operating crew and operations supervision. Operations personnel determined that the activity did not render the SI systen inoperable and that cycling the alve was performed under appropriate supervisory contro July 17, 1987 The STA discussed the question of SI operability with the supervising engineer, ISEG. ISEG issued RFR N to obtain System Engineering Evaluatio July 22, 1987 Based on Compliance Department review and recommendation relating to RFR N , ISEG issued IR No.87-129. The i IR documented the events involving

.______ ___-_ - ___ _ -

- _ _ -__ .-__ _ - _ _ _ _ _ _ _ _ __ _____ _ _ __ -

..

4'

tests of EJ-HV-8804A and B and the question of SI system operabilit The shift supervisor performed the required initial evaluation of the IR and' determined that the event was not reportable (the initial review is for

-

evaluation of "immediate" deportability).

July 29, 1987 TCN Nos. 87-0316 and 87-0317 were issued to revise procedures OSP-EM-P001A and The changes deleted the closing of BN-HV-8813 during SI pump quarterly surveillanc August 4, 1987 Licensee, during an Operability Evaluation Meeting, determined that the previous momentary closing of BN-HV-8813 was prohibited by Technical Specification and therefore a reportable even The licensee made the ENS call to NR The event is documented on Licensee Event Report (LER) 87-017-0 (2) Document Review Safety Reports

'Snupps Final Safety Acalysis Report (FSAR), Chapter 6 provides an SI description. It the event of an accident, the safety injection pumps are earted automatically on receipt of an SI signal; take suction from the RWST via normally open, motor-operated valves and deliver water to the RCS during the injection phase; and take suction from the containment sump via the RHR pumps during the recirculation phas A minimum flow bypass line is provided on each pump discharge ,

to recirculate flow to the RWST in the event that the pumps are -

started with the RCS pressure above pump shutoff hea This line also permits pump testing during normal plant operatio Two parallel valves (EM-HV-8814A and B) in series, with a third valve (BN-HV-8813) located in a downstream common header, are provided in this line. These valves are manually closed from ,

the control room as part of the ECCS realignment from the L injection to the recirculation mod FSAR, Chapter 3 provides the assumption that, "No operator I action is assumed to be taken by plant operators to correct problems during the first 10 minutes following the accident."

I

L_____ _ _ _ _  !

r_____ __

..

E'

This assumption is consistent with FSAR, Chapter 15 " Safety

~ Analysis." Short term operator actions for Loss of Coolant Accidents and Steam Generator Tube Ruptures are listed as

"None."

Procedures Operations Surveillance Procedures OSP-EM-P001A and B Section XI Safety Injection Train A and B Operability Surveillance Procedure OSP-EM-P001 is performed on each SI pump once every three months in accordance with Section XI of the ASME Boiler and Pressure Vessel Code as required by T/S 4. Section 6 of'the Surveillance Procedure specified that valve BN-HV-8813 (combined SI pump recirculation to RWST) be

- throttled closed to establish the pump base line flow rat Section 7 (Restoration) specified that valve BN-HV-8813 be returned'to full open and then cycled closed and ope Specifying that valve BN-HV-8813 be cycled resulted from an oversight-in the initial procedure development process and subsequent implementation oversight The Balance of Plant (B0P) alarm printer logs the position of BN-HV-8813. A sampling (six surveillance) of SI pump tests performed between March 1986 and May 1987 show valve BN-HV-8813 cycle times (full open to full open) ranged from 12 to 17 second On July 29, 1987, in response to the SI pump operability question, Operations issued TCNs Nos. 87-0316 and 87-0317 to OSP-EM-P001A and B which deleted closing of BN-HV-881 Work Requests Nos. W-414651 and PM 49488 Corrective and preventive maintenance was performed on the Residual Heat Removal (RHR) System valves EJ-HV-8804A and B (cross connect to E:aergency Core Cooling System (ECCS) pump suctions). The valves are normally closed but are opened as part of the ECCS realignment from the injection to recirculation mode. Stroke timing of the valves is performed following maintenance to verify valve operability. Because of interlocks associated with the valves, the opening of either EJ-HV-8804 valves requires that both the individual Si pump recirculation valves EM-HV-8814A and B or the combined recirculation valve BN-HV-8813 be closed. The interlock protection is designed to prevent contamination of the RWST during the recirculation mode. Performance of maintenance on valves EJ-HV-8804A and B, while in Mode 1, resulted from an oversight in the work planning process and subsequent erroneous i

operability judgments by operating crews and operations supervisio __ _ _ _ _ _ - _

_ - _ _ ___.

g

. a -- ,

"

(

The stroke test of valve EJ-HV-8804B associated'with WR N W-414651 was performed on June 29, 1987. The B0P alarm printer indicates that valve BN-HV-8813 was closed for a period of_35 seconds (includes stroke time).

The stroke test of valve EJ-HV-8804A associated with WR No. PM 49488 was performed on July 15. 1979. The BOP alarm printer indicates that valve BN-HV-8813 was_ closed for a period of 1 minute 38 seconds (includes stroke time).

10 CFR 10 CFR 50.59 states, in part, that the holder of a license authorizing operation of a utilization facility may conduct tests not described in the safety analysis report without prior commission approval unless the proposed test involves an unreviewed safety question. A proposed test involves an unreviewed' safety question if the margin of safety as_ defined-in the basis for any technical specification is reduced. A safety evaluation shall be performed to determine if an unreviewed safety question' exist The safety evaluation (50.59 review) was performed on Surveillance Procedures OSP-EM-P001A & B and subsequent procedure revision reviews,-however, the reviewers failed to recognize that closing valve BN-HV-8813 in Mode 1 (power operation) put the Emergency Core Cooling Subsystems (ECCS)

in a condition not permitted by the Technical Specification (TS) and the Safety Analysis Report. Had the pumps auto-matically started with RCS pressure above the pump shutoff head, and no recirculation path available, the pumps would have burned up in a matter of minutes. This reduces the margin of safety as defined in the basis of TS 3.5.2 which states "The OPERABILITY of two independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA..."

Callaway Plant Technical Specifications (T/S)

T/S Limiting Conditions for Operation (LCO) 3.5.2 requires that two independent Emergency Core Cooling System (ECCS) subsystems shall be OPERABLE with each subsystem comprised of:

One OPERABLE centrifugal charging pump One OPERABLE Safety Injection pump One OPERABLE RHR heat exchanger One OPERABLE RHR pump

_ - _ _ _ _ - - _ _ _ _ .

- _ _ _ _ _ _ _ - -.

...:

d'

An OPERABLE flow path capable of taking suction from the refueling water restorage tank on a Safety Injection signal _and automatically transferring suction to the containment sump during the-recirculation phase of operatio APPL'ICABILITY: MODES 1, 2, and 3  !

LC0 Action does.not provide for two inoperable ECCS subsystems, and such a condition would require entry into T/S 3. T/S Surveillance Requirements 4.5.2 requires that each ECCS I subsystem shall be demonstrated OPERABLE. At least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> by verifying that the following valves are in the indicated positions with power to the valve operators removed:

Valve Number Valve Function Valve Position BN-HV-8813 ' Safety Injection to Open RWST Isolation V1v Callaway plant records show that the plant operated 11. Mode 1 on June 29, 1987 and July 15, 1987, with the combined S1 recirculation valve BN-HV-8813 closed for periods of 35 seconds and one minute 38 seconds respectively and at various other times for periods of approximately 15 second .The licensee's failure to maintain BN-HV-8813 open while in Mode 1 without prior Commission approval is a violation of 10 CFR 50.5 ,

(No.483/87026-01(DRP)).  ! Interviews Licensee personnel involved in the SI pump surveillance and valve retest activities were interviewed to assess licensees problem resolution process following STA discussions and operational consideration made relating to closing of BH-HV-8813 during periods that SI system operability was require The inspector determined that the operating crew, including operations I supervisory personnel, believed that the momentary closing of the SI pump combined recirculation valve did not render the SI system inoperabl The major considerations being:

All ECCS subsystems were available and would have operated automatically on a Safety Initiation Signa *

The SI pumps would have injected water into the primary plant during a loss of coolant accident. The recirculation valve provided a support function - was closed only for brief periods and under the immediate control of the

{ control room operato _ _ _ - - _ _ - _

- - _ _ -_ _ _

.,

i

!

an i

In the event of SI system initiation, the recirculation valve would l have.been opened from the control room or " local manual" in the j event of loss of powe'r before the SI pumps would over hea j j

The' cycling of' recirculation valve was routinely performed in accordance with an approved SI pump surveillance procedur The'STA observed the momentary closing of the combined SI recirculation i valve on June 29, 1987. The STA discussed SI system operability, but ,

being aware of operations position, the T/S support function (the valve was not in the injection flow) and the short duration, did not pursue the

. matter further. The STA, following-a similar. valve operation on July 15,

. 1987, again_ questioned the operability of the SI system. After further consideration and discussion with the supervising engineer ISEG, a request for' resolution (RFR) was processed to obtain an engineering evaluation. After reviewing the RFR, the supervisor of Compliance, determined that the. matter should be documented on an Incident Report (IR). This was communicated to the STA who issued the I . Licensee's Corrective Action Completed Action The preventive maintenance on EJ-HV-8804A and B has been rescheduled to occur during Modes 5-Cold Shutdown or 6-Refuelin A letter has been issued to the shift supervisors to emphasize the necessity for adequate evaluation of all activities prior to performanc The quarterly pump surveillance procedures were changed to delete the requirement for cycling BN-HV-881 Other surveillance procedures which cycle the valves referenced in T/S 4.5.2 were reviewed to ensure they are not cycled in Modes 1, 2-Startup, or 3-Hot Standby by any other procedures. No other prublems were identifie On August 19, 1987, the plant manager designated a task force that will report to the Onsite Review Committee (0RC). The function of this task force will be to perform a comprehensive review of all T/S surveillance requirements and ensure that the program addresses all conditional surveillance. Human factor considerations will be included in this revie Planned Action Tne licensee's evaluation in this matter is continuing, which includes a review of the procedure revision process and the work planning process to identify deficiencies which may have caused the noted events, and will include an evaluation of the event for potential generic root caus _ - - _ _ _ _ _ _

- _ _ _ _ -_ ._ __ . _ _ _ - . _

_ _ - ._

E, r

'

.

The results of the root cause determination will be documented in a-9 supplement to LER 87-017-0 . Safety Significance A preliminary, conservative engineering evaluation of SI pump operation without pump flow (deadheaded) and with_the pump recirculation valve closed indicated that the pumps could operate 2 to 3 minutes without over heatin Plant records indicate that the SI pumps were not run nor was the SI system called on to operate during.the short durations that the combined recirculation valve BN-HV-8813 was closed. The valve could have been opened by the control room operator in the event of automatic SI system initiation before pump _ damage occurred. However, immediate operator action is not assumed in the safety analysis for accidents involving the SI system nor could operator action to open the valve be assured in all situations; such as, valve failure or operator oversight during response to actual event The' event posed no significant threat to public or plant safety based on the low probability of an event involving the SI system occurring during the short duration the system was in a degraded condition. However, the event is considered significant based on; deficiencies in the initial safety review of the surveillance procedure, deficient planning and scheduling of valve maintenance and operational oversights which place the' plant in a condition prohibited by Callaway Technical Specificatio A violation is ildentified in Paragraph 2.b.(2). Exit Interview The inspector met with licensee representatives (denoted under Persons Contacted) at intervals during the inspection period. The inspector sumarized the scope and findings of the inspection. Tne licensee representatives acknowledged the findings as reported herein. The inspector also discussed the likely informational content of the inspection report with regard to documents or processes reviewed by the inspector during the inspection. The licensee did not identify any such documents / processes as proprietar ..

- _ _ - - _ - _ _