IR 05000255/1986029

Safety Sys Functional Insp Rept 50-255/86-29 on 860922-1024. Potential Enforcement Findings:Lack of seal-in Feature for Recirculation Actuation signal,air-operated Valve Design Deficiencies & Misleading Info to Control Room Operators

ML18052A817
Person / Time
Site:	Palisades
Issue date:	12/05/1986
From:	Darrin Butler, Hasse R, Howell A, Martin T, Mckee P, Pierson R, Sharkey J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III), NRC OFFICE OF INSPECTION & ENFORCEMENT (IE)
To:
Shared Package
ML18052A815	List: IR 05000255/1986029 ML18052A814
References
50-255-86-29, NUDOCS 8612240188
Download: ML18052A817 (30)

Text

r

Report No.:

Licensee:

Docket No.:

License No.:

Facility Name:

OFFICE OF INSPECTION AND ENFORCEMENT DIVISION OF INSPECTION PROGRAMS 50-255/86-29 Consumers Power Company 212 West Michigan Avenue Jackson, MI 49201 50-255 DPR-20 Palisades Nuclear Generating Plant Inspecticin Conducted: September 22 through October 24, 1986 Inspectors:

.

~

'~

"1.0.M~

• D. S. 8Utler,Reactornspector, Region III or, Region III

/.£,..,~-

• A. T. How

2 III, fospect10n.Specialist, IE R. l - tJJvv--

• R. C. Pierson, Inspection Specialist, IE

• ~pection Specialist, IE Accompanying Personnel: *L. J. Callan, *C. W. Hehl 11/-z.Co/gb

!Jate

{ ( /2 r;;,/'(<o 1'ate (

l[2~/?6 D te 12/6/,ft Dffi7 ti(~ (l6 Date

/I ~ill(,,

Date Contractors: *E. T. Dunlap, *S. M. Klein, *G. W. Morris, *G. J. Overbeck Reactor Programs

• Present during the exit interview on October 24, 198 n 12240188 861222 DR ADOCK 05000255 Q

PDR

r

SCOPE:

This special, announced team inspection was performed to provide an in-depth assessment of the operational readiness of the high pressure safety injection (HPSI) system at Palisades. The licensee 1s opera-tional readiness and management controls were reviewed in four func-tional areas, primarily as they re;ated to the HPSI syste The functional areas reviewed were:

0 System Design and Modifications 0 Maintenance 0 Surveillance and Testing 0 Operations RESULTS:

Fifteen potential enforcement findings, identified in this report as unresolved items, and two open items will be followed up by the NRC Region III Office.

..

• INSPECTION OBJECTIVE The objective of the team inspection at Palisades was to.assess the operational readiness of. the high pressure safety injection (HPSI) ~;ystem by determining whether:

(1) The system was capable of performing the safety functions required by its design basi (2) Testing was adequate to demonstrate that the system would perform all of the safety functions require (3) System maintenance (with emphasis on pumps and valves) was adequate to ensure system operability under postulated accident condition (4) Operator and maintenance technician training was adequate to ensure proper operations and maintenance of the syste (5)

Human factors considerations relating to the HPSI system (e.g.,

accessibility and labeling of valves) and the system's supporting procedures were adequate to ensure proper system operation under normal and accident conditions.

..

- l - SUMMARY OF SIGNIFICANT INSPECTION FINDINGS The more significant findings pertaining to the functionality of the Palisades Nuclear Generating Plant safety systems are summarized belo Section 3 pro-vides the detailed findings pertaining to the four major functiona*1 areas evalu-ate The observation numbers appearing in parentheses after the individual items summarized are provided for reference to the corresponding discussions in Section..1 High Pressure Safety Injection System Functional Concerns 2. Lack of Seal-In Feature for Recirculation Actuation Signal The safety injection (SI) system recirculation actuation signal control circuitry was not designed with a seal-in feature.* As a consequence, the water source for the.high pressure safety injection (HPSI), low pressure safety injection (LPSI),

and containment spray pumps may unintentionally shift from a reliable and sufficient source to a nearly empty sourc This deficiency was of particular concern because the realignment of water supplies occurred by the_ positioning of air-operated valves that were provided with a limited amount of air. The air available may not be sufficient to reposition these valves back to the reliable water sourc The result could.be a loss of water supply to the HPSI, LPSI, and containment spray pumps during a loss-of-coolant accident (LOCA).

[3.1.1]

....

2. HPSI Pump Operability Concerns The HPSI pump test results for 1986 revealed that the HPSI pumps may not be developing the minimum recirculation flow required by Technical Specification This recirculation flow is needed to prevent pump damage res.ulting from over-heating when the HPSI pumps are operated against a shutoff head, a probable occurrence during many small-break LOCA scenario The team considered that the uncertainty regarding the adequacy of the HPSI pump recirculation flow made the operability of the HPSI pumps questionable under certain accident condition The team was al so. concerned that the licensee had not taken steps to demonstrate the adequacy of the recirculation flow when confronted with evidence in 1984 and again in March 1986 that the recirculation flow was not sufficient or may have degraded as a result of blockag (3.3.1]

2. Air-Operated Valve Design Deficiencies (1) The common recirculation header from the SI pumps to the safety injection refueling water tank (SIRWT) contained two air-operated valves in serie These air-to-open/air-to-close valves received motive air from a single train of the high pressure air syste As a consequence, these valves may not close on demand if a single failure of the high pressure air system was postulated. The result could be to recirculate highly radioactive water during a LOCA to the SIRWT which is vented to atmosphere. [3.1.2]

(2) HPSI subcooling air-operated isolation valves, CV-3070 and CV-3071, were normally shut and failed shut on a loss of air. Although these valves served a safety-related function, their air supply originated from the non-safety-related instrument ~ir syste These valves were required to be opened during a LOCA after primary system pressure dropped below

- 2 -

(3)

(4)

230 psig to ensure an adequate net positive suction head (NPSH) to the HPSI pump The failure of the air supply to these valves could result in a loss of the HPSI pumps during a LOC [3.1.3(1)]

Containment spray header air-operated isolation valves, CV-3901 and CV-3002, were normally shut and failed open on a loss of air. Although these valves served a safety-related function, their air supply originated from the non-safety-related instrument air syste Under certain conditions during a LOCA, one of these. valves must be shut to prevent a containment spray pump from achieving runout and to ensure adequate NPSH is maintained to the HPSI pumps. [3.1.3(2)]

Iodine removal tank air-operated isolation valves, CV-0347A and CV-03478, were normally shut and failed shut on a loss of air. Although these valves served a safety-related function, their air supply originated from the non-safety-related instrument air syste During a LOCA, these valves must open to provide hydrazine solution to the suction of the SI pumps to improve iodine removal from the containment atmospher The failure of these valves to open would adversely affect the consequences of a LOC [3.1.3(4)]

2. Misleading Information to Control Room Operators Misleading information affecting the operation of the HPSI system was found on two engraved plaques mounted on a control room panel in the control roo The instructi.ons on these plaques were not consistent with other licensee procedures and, if followed, could have resulted in preventing the closure of the valves in the common recirculation header of the SI pumps to the SIRW During a LOCA, this could have resulted in the recirculation of highly radioactive water to the SIRWT that is vented directly to atmospher [3.4.2(1)]

2.2 Other Programmatic and Functional Concerns Potentially Affecting the Operation of Safety Systems 2. Testing of Isolation Check Valves in Air Systems Check valves in air systems that isolate safety-related piping from non-safety-related piping were not periodically tested to ensure their ability to perform their design safety functio Failure of these check valves could prevent the operation of safety-related air-operated valves under accident condition [3.3.2]

2. Battery Surveillance Testing Deficiencies in battery surveillance procedures were found to be similar to previous NRC inspection findings at Palisades, including:

(1) Performing an equalizing charge before conducting the battery service tes (2) Failure to correct battery service test discharge currents to minimum design temperatur (3) Failure to correct specific gravity readings for electrolyte level *

These deficiencies could result in the licensee erroneously assuming that a battery is operabl [3.3.3]

2. Motor-Operated Valve Maintenance Program (1) Until recently (mid-1986), the licensee had no preventive maintenance program to lubricate motor-operated valves (MOVs).

Although procedures had been recently developed for periodic inspection and. lubrication of MOVs, most of these activities were not intended to be accomplished until the next maintenance outage in late 198 Many of the safety-related *

MOVs had not been relubricated in almost 15 years. Additionally, four

_

environmentally qualified MOVs were found to be lubricated with-an unquali-fied lubricant. [3.2.1]

(2) The program for control of MDV torque switch and limit switch setpoints was considered inadequate because of the reliance placed on the skill of the craft to establish switch settings, inadequate procedures, and lack of consideration of expected de*sign differential pressure conditions for establishing and verifying proper switch setting [3.2.2]

2. Failure to Update Controlled Documents Weaknesses were noted regarding the failure to update controlled documents following either the completion of plant modifications or the revision of higher tier document Numerous examples were found where plant drawings, the Q-List, and a plant specific data base were not update In one example the plant load shedding scheme was modified but the safety classification of three breakers was not upgrade The inspection team was concerned that these breakers may have been of a lesser quality or maintained improperly as a result of their inappropriate classification. [3.1.6]

2. Maintenance Training Training for mechanical and electrical maintenance personnel was considered wea No technical training personnel in either of these areas were assigned to the site training organizatio As a result, plant-specific and component-specific training for these technicians was limite [3.2.5]

- 4 - DETAILED INSPECTION FINDINGS 3.1 System Design and Modifications System design and modifications were reviewed in the disciplines Qf mechanical, electrical, and instrumentation and control. This review concentrated on: (1)

the capability of the safety injection (SI) system and the high pressure safety injection (HPSI) system, in particular, to deliver required flow throughout a loss-of-coolant accident (LOCA), (2) the adequacy of instrumentation and control equipment associated with the HPSI system, and (3) the design adequacy of support-ing systems such as the high pressure air system and the electrical power distribution syste *

3. Lack of Seal-In Feature for Recirculation Actuation Signal A review of the SI system control circuitry revealed that the recirculation actuation signal (RAS) was not designed with a seal-in featur As a con-sequence, the water source for the SI pumps may unintentionally shift from a reliable and sufficient source to a nearly empty sourc All SI pumps (HPSI, LPSI, containment spray) take a suction from the safety injection refueling water tank (SIRWT) for about the first 20 minutes following a LOCA until the SIRWT level drops to the low level setpoint at 24 inches (four sensors, using 1-out-of-2-taken-twice logic).

At this level, the RAS shuts two air-operated valves (AOVs) from the SIRWT and opens the two AOVs providing the containment sump as the suction source for the SI pump The air used to operate these AOVs comes from accumulators in the high pressure air system that are sized based on two strokes of the associated safety-related AOV The high pressure air compressors supplying these accumulators are non-safety-related and are load shed following a design basis acciden If, at some time after the shift of suction from the SIRWT to the containment sump, the RAS clears, the system will attempt to realign itself back to the nearly empty SIRW The result will be an almost immediate response by the system to again shift suction to the containment sum This last shift, however, may not be possible because it is beyond the design capacity of the high pressure air accumulator The suction source for the SI pumps could then be stuck on a nearly empty SIRWT resulting in a loss of water supply to the HPSI, LPSI, and containment spray pumps following a LOC The RAS could clear either as a result of the failure of one of the SIRWT level sensors or an operator attempting to refill the SIRWT at some time after the suction has been shifted to the containment sum However, at the Palisades plant, there were apparently no procedural precautions to prevent an operator from refilling the SIRWT during a LOC The lack of RAS seal-in feature will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-01).

3.1. 2 HPSI Recirculation Valves Susceptible to a Single Failure The HPSI system was not single failure proof in that the minimum flow recir-culation valves CV-3027 and CV-3056 were both supplied from the same train of the high pressure air syste This was contrary to FSAR Section 6.1.4.8 which states that the safety injection system, including the fluid and instrument subsystems, were designed to meet the.single-failure criterio The common

- 5 -

recirculation header from the SI pumps contained these two valves in serie On switchover to SI pump suction from the containment sump, these valves close, thereby isolating the HPSI recirculation path to the SIRW Both of these recirculation header isolation valves required air to.either open or clos As a consequence, the.valves may not close on demand if a single failure of the high pressure air system is postulate This design deficiency wtll remain unresolved pending followup by the NRC Region III Office (50-255/86-029-02).

3. Reliance on Non-Safety-Related Air System Some remotely operated valves required to perform a safety-related function did not receive motive power from a safety-related sourc The following are-*

examples of safety-related air-operated valves that relied upon a non-safety-related air system for motive power and the consequences of failure of those valve (1) HPSI subcooling valves, CV-3070 and CV-3071, were air-operated, normally shut, and failed shut on loss of air. These valves were required to be opened following switchover to the containment sump recirculation phase approximately 20 minutes after a LOCA to ensure an adequate net positive suction head (NPSH) for the HPSI pump Although these valves served a safety=related function, the motive power came from the non-safety-related instrument air syste FSAR Section 9.5.3 states that following a design basis accident (OBA), air-operated valves will become inoperable or will assume their failed position in 1.4 minutes following a loss of instrument air. Failure of the HPSI subcooling valves to open upon demand may result in HPSI pump cavitation, pump damage, and degradation of core cooling capabilit *

In spite of another statement in FSAR Section 9.5.3 to the contrary, independent scopi.ng analysis by the inspection team and analysis performed

,by the licensee in 1979 confirmed that HPSI subcooling is required to maintain NPSH under certain accident condition (2) Containment spray header isolation valves, CV-3001 and CV-3002, were air operated, normally shut, and held shut by instrument air. Following a containment high pressure condition, these valves would open by venting the holding ai However, these valves also served a safety function to close if HPSI pump subcooling was r~quired during single train operation of the SI system (one HPSI pump and one containment spray pump).

Also, under certain conditions, one of these air-operated valves was required to be closed by Emergency Operating Procedure (EOP) 8.1, 11Loss-of-Coolant Accident, 11 to prevent a containment spray pump from reaching a runout conditio Runout 11 is a term used to describe a condition of high flow (beyond design capacity) that could result in pump damage caused by vibration and cavitation. If instrument air was lost, then valves CV-3001 and CV-3002 would not close and, if closed, they would not remain shu The resulting multiple flow paths (two spray header branches and one HPSI subcooling branch) may cause failure of the only operating contain-ment spray pump that in turn, may cause cavitation damage to the HPSI pumps as a result of a loss of subcooling flow as explained in observation 3.1. 3(1), above.

(3) Instrument air system containment isolation valve CV-1211 was air-operated normally open, and failed open on loss of motive air. Although instrument air inside containment was nonessential during accident conditions, CV-1211

- 6 -

did not receive an automatic containment isolation signa* Operator action was required to recognize the need to isolate the instrument air line and to shut CV-121 Inadequate procedural guidance in this regard is discussed in observation 3.4.2(4). Given correct and timely operator action,. isolation may not be accomplished because the instrument air system was relied on to provide the motive air to shut the valve and hold it shu Because the instrument air lines were not considered in high energy line break analyses, these lines may not be protected from the effects of high energy line breaks. If a design basis accident were to occur causing the loss of instrument air piping inside containment and a single active failure occurred of the second containment isolation valve, then a vent path from the containment may exis (4) Iodine removal tank isolation valves, CV-0347A and CV-03478, failed shut on loss of instrument air even though these valves must be open to.permit the drawdown of hydrazine solution under accident conditions to enhance the removal of iodine from the containment atmospher These normally shut valves received a signal to open on containment high pressur The failure of these valves to open or remain open adversely affects the consequences of the design basis acciden FSAR Section 14.22.2 assumed that the hydrazine solution would be available a minute after a maximum hypothetical accident to improve the removal rate of the elemental iodin Items (1) and (2) above are examples of valves that provide a safety function in both the open and shut positions for which the licensee had not provided an adequate desi-g Items (3) and (4) above indicate a weakness in the application of original design criteria such that reliability concerns during normal operation may have taken precedence over safety-related concerns during a hypothetical acciden The team was informed that the instrument air system containment isolation valve was designed to assume a position of greater reliability during normal or abnormal operation and, therefore, of greater overall safety. The team was also informed that the consequences of accidentally emitting hydrazine into the suction piping of SI pumps following a safety injection demand may have contributed to designing the iodine removal tank isolation valves to fail shut on a loss of motive ai Relying on the non-safety-related instrument air system for safety-related valves will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-03).

3. Failure of Voltage Study to Address Motor Control Center Loads*

The dynamic voltage regulation studies that were performed in November 1983 and July 1985 to evaluate the ac system during an accident were limited by the number of buses the computer program could handl As a result, the smaller loads fed from the motor control centers (MCCs) were grouped together as a single bus load. This modeling technique apparently resulted in a less thorough review of the individual loads fed from the MCC The inspection team reviewed.the individual effects of some of the larger MCC loads during transient condition The licensee's studies assumed that the HPSI cold leg injection valve M0-3008 would draw 96 amperes on starting based on applying a standard conversion factor to the motor horsepower listed on the single-line diagra However, the applicable vendor drawing indicated that the starting current for this valve would be 140 amperes based on the specified locked rotor curren Independent analysis by the inspection team revealed

- 7-

that because this motor was fed with American Wire Gauge (AWG) No. 12 conductors, the resulting voltage drop, coupled with the voltage transient at the MCC, would produce a voltage less than 70% of the motor rated valu This type of valve actuator would normally produce guaranteed torque at 90% of rated voltag Tht' team was concerned that at the reduced voltage the valve actuator would stall and may not operate after the voltage transien The failure to ade-quately review loads from the MCC will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-04).

3.1. 5 Overcurrent Protection for Motor-Operated Valves At Palisades, the thermal overload relays on safety-related, motor-operated valve circuits were not used to trip on overload but instead were used to alarm an overload conditio A review of the overload heaters installed for seven HPSI motor-operated valves revealed no valid basis for their selectio The inspection team determined that the overload devices selected would not prod"1ce a warning alarm until after the motors were damaged on locked rotor curren This was particularly important for Palisades because the torque switches were bypassed on many safety-related valves for the entire length of the valve strok It is the team's understanding that the selection of thermal overload relay heaters for safety-related motor-operated valves will be included as part of a plant-wide design basis assessment of electrical protection device The resolution of this thermal overload issue as part of the assessment of elect-rical protection devices remains an open item pending followup by the NRC Region III Office (50-255/86-029-01).

3. Controlled Document and Drawing Deficiencies Weaknesses were noted regarding the updating of controlled documents following either the completi~n of plant modifications or the revision of higher tier document In addition, various drawings were found to contain error The following examples pertain:

(1) Facility change FC-441-02, affecting the HPSI system, required the addition of piping, valves, motor-operators, and instrumentation and control equip-ment and, on closeout, should have resulted in additions to the Q-lis This facility change was closed in 1983 without adequate revision of the Q-list in that 23 components were not included in the data base and 28 components entered in the data base had no classification identifie (2) The Q-list identification of the equipment items that are safety related, exposed to a harsh environment, and required to function to mitigate a LOCA or main steam line break did not agree in all cases with the electrical equipment qualification fil Numerous moto~-operated valves, pressure transmitters *and solenoid valves were found to be incorrectly identified in the Q-list as exposed to a harsh environment and qualified for that environment. It appeared that when various changes were implemented into the electrical equipment qualification file, the Q-list was not identified as a document affected by the change (3) Facility change FC-562 modified the load shedding scheme of non-Class lE loads following an accident. This modifkation was required to maintain an acceptable voltage to Class lE loads when fed from the startup transforme *

(4)

In accordance with FSAR Sections a:6.1 and 8.6.2, circuits that are required for load shedding are considered to be Class lE device However, this modification was closed in 1984 without revising the Q-List and the Advanced Mai ntenar,ce Management System (AMMS) data bases to reflect the proper class-ificatio11 of breakers 52-7701, 152-303, and 52-7804 used for.load sheddin The inspection team was concerned that these breakers may have been a lesser quality or maintained improperly as a result of their inappropriate classi-ficatio The failure to correctly classify and treat these breakers as safety-related will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-05).

Facility change FC-441-01 modified the source of power for HPSI-valves MO 3011, MO 3013, MO 3062, and MO 306 The normal operating and failed positions of HPSI valves CV-3036 and CV-3037 was also change These changes were required to ensure sufficient HPSI fl ow fo 11 owing a sma 11 break LOCA concurrent with the failure of a single diesel. This modifi-cation was completed in 1979 and closed in 1980; however, the following controlled documents had not been revised:

(a)

(b)

(c)

(d)

The plant-specific AMMS data base indicated the previous bus assign-ments instead of the new *ssignment Incorrect bus assignments in the AMMS were also found for safety injection isolation valves M0-3041, M0-3045, M0-3049, and M0-305 Schematic E 244, Sheet lA, Rev. 4, dated December 19, 1984, indicated the wrong control cabinet location for valves M0-3011, M0-3013, M0-3062, and M0-306 Although this error was recognized in part by the licensee as evidenced by a drafted note on the drawing (which identified an inconsistency for the control location of valves M0-3062 and M0-3064), the correct location was not identified and the drawing was not revised. A similar note for M0-3011 and M0-3013 did not exist, even though the locations identified were also incorrec Drawing M-311, Sheet 30-6, "Instrument Index," Rev. 11, dated March 12, 1986, incorrectly indicated that CV-3036 required air to open and CV-3037 required air to shut; however, the operation of these valves was changed to air to shut and air to open, respectivel_ Although not significant to calculation results, the ac system load data base had not been updated for valves M0-3013 and M0-306 (5) Drawings M-241, M-241A,.and M-241BC were not updated to include changes made by modification SC-83-19 The modification package identified these drawings as requiring change, but no document change request was issue (6) Twenty-four new flow control valves (FCVs) installed as a part of modif-ication SC-83-190 were not incorporated into the plant Q-lis The modif-ication package erroneously did not identify the Q-list as a document requiring revisio The specification change checklist used to close out the modification incorrectly indicated that the equipment data base, which included the Q-list, had been update *

(7) Drawing M-204, Sheet 18, "P&ID Safety Injection Containment Spray and Shut-down Cooling System, 11 Rev. 7, showed manual valves 3352ES and 3353ES as normally open, but these valves were normally locked ope This drawing also showed one of the level switches associated with the SIRWT identified as LS0323 when it s'1ould have been LS0328~ The correct identification was shown on electrical schematic E-207, Sheet 1. This error appeared to be carried over to the Q-list in that LS0323 was listed, although without classificatio (8) Drawing M-212, Sheet 4, 11Piping and Instrument Diagram Instrument Air Walkdown, 11 Rev. 1, August 13, 1986, showed containment isolation valve CV-1211 as a motor-operated valve when it was actually air operate (9) Drawing M-208, Sheet 18, "Piping and Instrument Diagram Service Water System, 11 Rev. 5, incorrectly showed the service water discharge control valve associated with component cooling water heat exchanger E-548 labelled as CV 082 (10) Drawing M-203, Sheet 2, 11 P&ID Safety Injection, Containment Spray and Cooling System, 11 Re ~ incorrectly showed FI0317A labeled as FT0317 (11) The Q-list identified HPSI flow transmitters FT-0308, -0310, -0312 and-0313 as being safety related by virtue of their operatio However, the flow indicators driven by these transmitters were classified as non-safety related. This was not consistent with the classification of the flow transmitter (12) Drawing E95, Sheet 1, did not show the wiring scheme for the SIRWT temperature element TE-033 (13) Drawing E95, Sheet 4, showed incorrect as-built wiring for temperature

.element TE-0328, terminal block T8WXT; and temperature transmitter TT-032 The inspection team presumed that these instruments were wired correctly based on satisfactory calibration result (14) Temperature transmitter TT-0328 was not shown on section diagram M201-38-27 as referenced in drawing M201-~9-2 (15) Drawing ES, Sheet 1, Rev. 26, indicated that valve M0-3068 had a 1/2 horsepower (hp) motor; however, the motor nameplate data indicated 1 h The document and drawing deficiencies listed above and the related deficiency identified in observation 3.3.5 will remain unresolved pending followup by the NRC Region III (50-255/86-029-06).

3. Control of Design Calculations The inability to identify the design bases of a system or component was con-sidered a weaknes During the inspection, the team had difficulty in locating documents to determine the adequacy of modifications, in spite of extensive

• assistance from the license This difficulty was caused, in part, by not maintaining the original design bases and by not maintaining readily retrievable calculation Because of this lack of consistent design information, other sources including completed modifications and AMMS system files had to be search-ed to arrive at the design bases and requirements for any given syste The lack of available and well-defined design bases may result in incomplete prep-

- 10 -

arations of design modifications or procedure change This condition was aggravated in the mechanical area because design calculations were not main-tained as living document Instead, design calculations were prepared and filed with the modification package or in the AMMS system fil For example, the team found no mechanical calculation file or index to identify calculation storage location with the exception of pipe support calculation Critical design analyses for NPSH of the safeguards pumps could not.be readily foun The lack of a calculation index and the difficulty experienced in retrieving calculations contributed to a concern that previous calculations may not be reviewed by engineers to obtain an understanding of the o~iginal design bases when preparing a modification. This may result in a lack of design traceability from design input through to design output and an inability to determine the design bases of systems and component An inconsistency between a licensee calculation and the FSAR is described in observation 3.1. 3(1).

The team was informed by the licensee that similar difficulty had been experienced during their self-initiated review of the auxiliary feedwater system design and that the need for system design descriptions was being considere *

3. Safety Evaluations The inspection team reviewed the safety evaluations performed pursuant to the requirements 'of 10 CFR 50.59 for eight plant modifications. Three of these evaluations were found to be deficient.

(1) In July 1984, a safety evaluation was issued to justify operation with the motor operator for valve M0-3007 removed and the valve maintained in the open positio M0-3007 is an injection valve for one of the four

• cold-leg injection lines for the HPSI syste With regard to safety injection water assumed not to reach the core in the safety analysis for the HPSI system, FSAR Section 6.1.2.3 states, "Spillage is limited to a maximum of 25% by use of the flowmeters in each injection line and the throttling capability of each safety injection valve.

The safety evaluation for operating with an inoperable injection valve did not address this issue, and the basis for concluding that no unreviewed safety question existed was inadequat In February 1986, the safety evaluation for the inoperable safety injection valve was revised to address the FSAR statement relating to the throttling capability of these valve The revised evaluation concluded that it would not be necessary to throttle these valves to maintain less than 25% spillage and that the discussion in.Section of the FSAR was misleadin The inspection team confirmed this conclusio Although it ultimately was determined that no unreviewed safety question existed, the plant was operated over an 18-month period without addressing the lack of a system capability explicitly addressed i.n the FSAR.

(2) Modification SC-83-190 revised the method for controlling stroke times_

for air-operated control valves (CVs).

The original design utilized a flow control valve (FCV) on the exhaust of the actuating solenoid valve (SV) to control the air exhaust rate from the actuating cylinder of the

- 11 -

-

---

~-----**_---::~----------- ----:* -

C This modification removed these FCVs and placed a flow control check valve between the SV and CV to serve the same purpose.

The safety evaluation for this modificatfon concluded that no*unreviewed safety question existed because the intended design function was unchanged arid a more reliable CV operation would be achieved. It did not address potential new failure modes or changes in overall system reliability introduced by the modificatio A second deficiency in this safety evaluation was also identified. This modification involved approximately 24 individual CV Each installation required a unique piping design.. The safety evaluation stated that seismic considerations would be addressed in the engineering analyses for these installations. The team could find no evidence that these analyses were accomplishe Thus, the safety evaluation was based in part on design intent rather than final desig (3) Phase II of modification FC-516-1, completed in 1982, included the installation of manual valves in the suction line of the auxiliary feed-water pumps and the removal of the internals of a Y-strainer in this lin The portion of the safety evaluation addressing the removal of the Y-strainer internals stated that the removal of the internals would reduce the chances of the Y-strainer plugging and starving flow to both auxiliary feedwater pump The evaluation failed to address the original reason for installing a strainer in this line and why this original basis wirs no longer vali These weaknesses regarding safety evaluations will remain an unresolved item pending followup by the NRC Region III Office (50-255/86-029-07).

3.2 Maintenance The inspection team reviewed maintenance procedures, environmental equipment qualification files, vendor manuals, work orders, and the existing material condition of the high pressure safety injection (HPSI) syste Additionally, interviews and discussions with plant maintenance personnel were conducte To a lesser degree, the team reviewed the existing preventive maintenance acti-vities associated with the low pressure safety injection (LPSI) and auxiliary feedwater (AFW) system. Lubrication Program for Motor-Operated Valves Until recently (mid-1986), the licensee had no viable. preventive maintenance program to lubricate motor~operated valves (MOVs).

Although procedures have been recently developed for periodic inspection and lubrication of MOVs, the team noted that most of these activities were not intended to be accomplished until the next maintenance outage in late 198 Additionally, four environmentally qualified containment MOVs were lubricated with an unqualified lubricant, SUN OIL 50EP.

.These MOVs were purchased with this lubricant as original equipment, but the lubricant specification was changed by the MOV vendor (Limitorque) several years later. The MOVs, however, had never been relubricated since they were installed in the early 1970 **-~-~-_.-.~*-*....... -~--*----~----*-*----*-*--------~----*--.---- --.

(1) The team became concerned about the present ability of MOVs to operate as designe A detailed review of past preventive maintenance activities for Limitorque valve operators-, with emphasis on HPSI and LPSI MOVs, was con-ducte The team noted that there had been no periodic program in the past to-inspect or relubricate MOV actuators even though Limitorque recommends that the main gear case lubricant be inspected on-intervals of approximately 18 months or 500 cycles, whichever occurs first, andthe geared limit switch lubrication be inspected on intervals of approximately 36 months or 1000 cycles, whichever occurs first. Most.of the MOVs were purchased as original equipment and, for the most part, had not been replace This means that many of these MOVs had not been relubricated in almost 15 years. - There was no licensee engineering evaluation avail--*-

able that justified not following the vendor's lubrication recommenda*

tion The licensee addressed this concern partially as a result of one of the action items associated with the May 19, 1986, Trip Material Condition Task Forc Eight valves were sampled for adequacy of lubrication simultaneously with the inspection of approximately 30 other MOVs in preparation for *

rebuilding MOVs during the 1987 maintenance outag The licensee determined that four MOV. operators were not sufficiently lubricate The most notable was M0-1042A, the power operated relief valve (PORV) block valv As noted in Work Order 24606425, the lubricant was "very low and very thick.

Because of the hardness of the grease, a vendor representative who was present for this maintenance activity had to disassemble the Bellville spring pack to remove the hardened greas Bent and misaligned gripper fingers and cams, apparently caused by improper manual operation, were also note As stated in the section entitled 11Summary of Work Performed,

the lubricant's poor condition was caused by age, heat, and lack of adequate preventive main-tenanc Licensee inspection of the main gearbox lubrication for M0-3064 on August 3, 1986, under Work Order 24605718, revealed that the grease had

.broken down to a liquid state and that no grease *Sample could be extracted because there was no grease in the gearbo Additionally, interviews with licensee personnel also revealed at least one instance in which hardened grease in the geared limit switch compartment caused gear failure to the point of preventing proper limit switch operatio (2) A review of licensee records revealed that four Limitorque MOVs inside the containment were lubricated with an unqualified greas The Limitorque vendor manual stated that Nebula EP-0 and EP-1 were the only approved lubricants for MOVs inside the containmen However, licensee records indicated that the main gearboxes of the MOVs, listed below, were filled with SUN OIL 50E.

Valve N Description M0-3009 HPSI to reactor coolant loop, train 1 M0-3013 HPSI to reactor coolant loop, train 1 M0-3062 HPSI to reactor coolant loop, train 2 M0-3068 HPSI to reactor coolant loop, train 2 Based on environmental qualification test reports, the licensee should have been aware of this lubrication deficiency since at least 198 Environmental Equipment Qualification (EEQ) Specification, MOV-1, Revision 5, referenced Limitorque lest Report 80058, dated January 11, 198 *

Appendix A of 80058 provided lubrication dat Appendix A cited that (3)

the standard lubricants for SMB 000 to SMB 4 operators were Nebula EP-0 and Nebula EP-1 for containment units. This was consistent with the recommendations in the Limitorque vendor manua A reference in the surveillance and maint~nance section of MOV-1, Revision 5, st~ted that

"all lubrication options for Nebula EP-0 substitutes shall b~ *ignored.

The inspection team found inconsistent and conflicting guidance regarding the different t~pes of lubricants that the licensee intended to use in MOV (a) The 11Mobil Lubrication Manual, 11 used by the licensee as a general lubrication reference, incorrectly specified the use of Mobil Grease 28 in MOV gearboxe This was contrary to the vendor manual, EEQ

test reports, and other licensee procedure (b)

In May 1986, the licensee changed the grease intended for use in the geared limit switches from Mobil 28 to Beacon 32 Because of an apparent oversight, however, only the 11consumables 11 section of Attach-ment 2 to procedures MSM-M-26, MSM-M-27, and MSM-M-28 was changed from Mobil 28 to Beacon 32 The relubrication step, found in the body of all three procedures, still specified Mobil 2 Additionally, the team reviewed 10 completed work orders (24605712, 24605714, 24605715, 24605717, and 24605719 through 24605724) and noted that the grease specified for the HPSI MOV geared limit switches associated with these work orders was Mobil 28 (Stock Number 37-83818).

Discussions with licensee management personnel revealed, however, that the MOVs were refubricated with Beacon 325, and that Mobil 28 is not currently stocked and has never been stocke The discrepancies in the MOV lubrication program that are described above appear to degrade the environmental equipment qualification and operability of MOV Interviews with plant engineering and maintenance personnel revealed that the licensee had initiated an MOV refurbishment program that would resolve these lubrication problem This program was intended to refurbish all MOVs during the next maintenance outage in 198 The team was concerned that this schedule may not provide for reliable MOV operation during the interim perio The deficiencies in the licensee's program for MOV lubrication will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-08).

3. MOV Torque Switch and Limit Switch Setpoints Weaknesses were identified with the licensee 1s control of MOV torque switch and limit switch setpoint (1)

A review of HPSI system MOV work requests revealed that torque switch set-point values were not usually recorded following MOV switch maintenanc Review of more recently completed work requests indicated noticeable improve-ment in the recording of these values, but the team noted 10 instances (out of approximately 12 work requests reviewed where any settings were recorded)

in which the as-recorded torque switch settings were outside the prescribed range specified on drawing Ml-NA, Sheet 4-1, Revision 1; 11Limitorque Valve Actuator Data Sheet.

Details are provided in the following table.

- 14 -

Recorded Torque Work Order Switch Settings Specified Valve N Number 0Een/Closed Ncirmal/Maximurn M0"'."3009 24605712 1/1 iV2J..i M0-3011 24605714 1/1 1V2J..i M0-3013 24605715 1/1 1V2~

M0-3062 24605717 1/1 1v2~

M0-3066 24605719 1/ V2J..i M0-3068 24605720

.l/1 1Vl1~

M0-3080 24605721 1. 5/1. 5 2/2 -

M0-3081 24605722 1.5/1. 5 2/2 M0-3082 24605723 3/3 1/2~

M0-3083 24605724 3/3 l/~

The torque switches for the HPSI system cold leg injection isolation valves (MS-3009, 3011, 3013, 3062, 3066, 3068) were bypassed in the open direction; however, the HPSI system hot leg injection isolation valves, M0-3080 through M0-3083, were no Interviews with licensee personnel revealed that repair personnel could set the torque switches anywhere in the prescribed band and that there was no method to control any deviations from the normal settin This was of particular concern because MOV torque switches and limit switches were adjusted under static flow conditions and were not tested to determine whether they would operate under design differential pressure Discussions with licensee management representatives revealed that the licensee intended to provide tighter controls over MOV torque switch settings in the futur (2) The present settings of torque switches for safety-related MOV operators did not appear to be based on expected design differential pressure In a letter to Limitorque dated July 24, 1984, the licensee requested minimum

• and maximum torque switch settings and supplied valve information such as the motor operator number, order number, serial number, and model numbe The design differential pressure at which these valves were expected to operate had not been provide Limitorque's response, dated November 8, 1984, provided a tabulation of the torque switch normal and maximum setting No discussion of the bases for these setpoints was include As part of their response to IE Bulletin 85-03, entitled "Motor-Operated Valve Common-Mode Failure During Plant Transients Due to Improper Switch Settings, 11 the licensee had developed a listing of the design differential pressures at which these valves are expected to operat As stated in their response to this bulletin, the licensee plans to determine correct torque switch settings and adjust the valves accordingly by November 198 (3) The team noted that the procedural guidance for setting MOV limit switches was inadequat The open and closed limit switches for Limitorque MOVs were set as described in Procedures MSM-M-26, MSM-M-27, and MSM-M-28, all

.Revision 0, dated August 29, 198 These procedures govern Limitorque valve operator maintenance and direct that closed limit switches be set by fully closing the valve and then opening the valve one-quarter turn by use of the handwheel after the valve stem starts to mov These procedures further direct that the open limit switch be set by fully opening the valve, and then closing the handwheel one-quarter turn after the valve

- 15 -

• ~-*--------_________________,_..

• -*~-~~*-*--*--~ -----****-*-

• ---*-~** *-*-* -..

stem starts to mov A procedural note stated that more than just one-quarter turn may be necessary for larger valve This additional procedural gui9ance was considered weak because it placed too much reliance on the skill of the craft. The inspection team was concerned that setting MOV limit switches one-quarter turn off the shut and open seats may not be sufficient to ensure that the MOVs operate properl Setting the closed limit switch too close to the shut seat may result in a valve tripping on high torque before overcoming unseating force Setting the open limit switch too close to the open seat may result in a valve being stuck on its backsea Discussions with licensee personnel revealed that the MOVs were backseating on occasion using this method of setting limit switche The weaknesses identified above were indicative of inadequate MOV maintenance practice Licensee procedures did not provide adequate guidance for setting or maintaining torque switch and limit switch setpoint The failure to provide such guidance will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-09).

3. Material Deficiencies The inspection team conducted a detailed walkdown of portions of the HPSI system to verify that the system layout was as depicted in the system drawings (P&IDs) and that the system was aligned as required by licensee procedures, and to evaluate the material condition and cleanliness of the syste The team found that the system layout was as depicted in the system drawings and the system was al..igned as required by the procedure Cleanliness in the vicinity of the HPSI components. was considered averag General plant cleanliness was considered below average, especially in various areas of the auxiliary building including the vicinity of the shutdown cooling heat exchangers, the boric acid tanks, and filtered waste monitor tank The following plant material condition deficiencies were noted during the walkdown:

(1) There appeared to be a general weakness in ensuring that oilers in the air lines to air-operated valves were properly maintaine The team was concerned that this weakness may affect the valves* ability to perform their safety function For example, the following deficiencies were noted with safety-related air-operated valves within the HPSI system:

two oilers for CV-3027 and CV-3071 were found empty; dirty oil was ob-served in an oiler for CV-3036; and an oiler for CV-3029 was leaking. *

The inspection team found no procedural guidance to accomplish periodic relubrication of these oiler The resolution of these air line oiler deficiencies will remain unresolved pending followup by NRC Region III Office (50-255/86-029-10).

(2) Numerous manual valves in small process lines and instrumentation components were missing identifying label plate (3) Boric acid precipitate, caused by apparent packing leaks o.r swage fitting leaks, was evident on several valves and instruments, including CV-3018, HPSI redundant supply valve, and CV-3059, HSPI pump P-66B discharge isolation valve.

(4) Debris, materials, and tools were noted in the immediate vicinity of safety-related components, particularly CV-3036, HPSI redundant supply

-.16 -

valve, and CV-3037, HPSI pump P-66A discharge isolation valv This stray material could not be attributed to an in-progress cleanup or maintenance activit. Maintenance Procedure Weaknesses The team reviewed maintenance and calibration activities associated with safety-related switchgear and HPSI system instrumentatio Some procedural weaknesses were note (1) Maintenance procedure MSE-E-10, Revision 1, 11480 Volt Breaker Inspection and Repair, 11 was used to perform maintenance on MCC molded case -breakers-* -

and starter/contactor inspection and repair (Section 5.1) and.load center breaker inspection and repair (Section 5.2).

Thi~ procedure did not follow manufacturer guidelines on contact care. Specifically, Section 5.1 stated, 11Clean up with a fine file or replace with new contacts if badly damaged. 11 Review of ITE MCC Technical Manual (950PB7-E7-SH.67)

stated, 1100 not file starter contacts.

The licensee was unable to provide a satisfactory explanation for this inconsistenc (2) Maintenance procedure SPE-E-6, Revision 1, 11 ITE 480 Volt Breaker Inspection and Repair, 11 did not follow all of the technical manual recommendation *This procedure specified a contact lubricant (Stock Number 37-88502) and moving part grease (Stock Number 37-88510).

The lubricant was different from that specified by the manufacture The licensee was using the lubricant *specified for 4160/2400-volt*switchgea The manufacturer specified NO-OX-ID for the contacts and Anderol L757 grease for the moving parts. There was no licensee engineering evaluation available that justi-fied the use of a different lubricant on the ITE 480-Volt breaker (3) Maintenance procedure SPE-E-4, Revision 3, 11Maintenance for 4160/2400

.Volt Switchgear, 11 contained detailed instructions on lubrication and adjustmen Two items on the General Adjustment Data Sheet did not follow the manufacturer's guideline Item 4.a stated that horizontal alignment should be approximately 0.020 inches, but the vendor recommended a horizontal alignment of no greater than 0.020 inches. Item 4.d (breaker open position adjustment) should have been 3-11/16 inches +/-1/8 inch instead of the present procedure value of 3-11/16 inches minimu (4) Revision 8 of surveillance test RI-18, 11SIRW Tank Temperature Indicator Calibration Procedure, 11 used uncalibrated measuring and test equipment (M&TE) in steps 5.7 and 5.9 to make quantitative measurement Although these measurements were not used directly to satisfy the surveillance test acceptance criteria, the inspection team considered that the instruments used should have been calibrated M&T The resolution of these procedural *deficiencies will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-11).

3. Maintenance Training Training for mechanical and electrical maintenance personnel was considered weak.

No technical training personnel in *either of these areas were assigned to the

- 17 -

site training organizatio As a result, these technicians received no routine plant-specific and component-specific training.

No systematic method existed to ensure that a particular individuai tasked with performing a certain maintenance activity had the necessary plant and component-specific training to perform the activity. This was considered to be a particular problem in.the mechanical maintenance department because of the large number of technicians, approximately 56. *

The licensee was in the process of seeking Institute of Nuclear Power Operations (INPO) accreditation, and a program was being developed to address t~e inspect_i_on team's concern During the course of the inspection, the electrical maintenance department had implemented a program for administering and documenting 11on-the-job11 training,.and the mechanical maintenance department was also in the process of developing a matrix to identify specific repair personnel qualified to perform particular types of maintenance activitie.3. Surveillance and Testing The team reviewed the testing associated with assuring functionality of the high pressure safety injection (HPSI) system, the high pressure air system, safety-related portions of the instrument air system, and the 125 Volt de syste In particular, the team sought to determine that the system components had been adequately tested to demonstrate that they could perform their safety functions under all conditions *

...

3. HPSI Pump Operability Concerns A review of HPSI pump inservice test results for 1986 revealed that the HPSI pumps may not be *developing the minimum recirculation flow. required by Technical Specifications. This recirculation flow is needed to prevent pump damage caused by overheating when the HPSI pumps are operated against a shutoff head, a probable occurrence during many small-break LOCA scenarios. lhe team considered that the uncertainty regarding the adequacy of the HPSI pump recirculation flow made the operability of the HPSI pumps questionable under certain accident condition The team was also concerned that the licensee had not taken steps to demonstrate the adequacy of the recirculation flow when confronted with evidence, in 1984 and again in March 1986, that the recirculation flow was not sufficient or may have degraded as a result of blockag Performance testing of HPSI pumps 66A and 668 was conducted on a periodic basis using surveillance procedure M0-22, 11Inservice Test Procedure-High Pressure Safety Injection Pumps.

The purpose of the surveillance test was to demonstrate pump operability by monitoring pump differential pressure, vibration, and bearing temperature and comparing the results against reference values established in accordance with the American Society of Mechanical Engineers (ASME) Boiler and Pressure Code,Section X The licensee had prev1ously requested relief from the ASME Code requirement to measure flow because the range of the installed instrumentation (FI-0404A) was too wide {0 to 400 gpm) and, consequently, was not responsive to low flow rates (see observation 3.4.2.(2) for further discus-sion on the unsuitability of the installed flow instrumentation).

The vendor manual required a HPSI pump minimum recirculation flow rate of 30 gpr Because the survei 11 ance test was intended to be performed at shutoff head conditions, adequate recirculation flow was required to prevent damage to the pump caused by overheatin *

The ASME Code requires trending test results to detect a decrease in pump perfor-mance before component failur The trending data for both HPSI pumps 66A and 668 had shown an abnormally high pump differential pressure starting in March 198 Because the pump differential pressure values observed during surveillance testing in March 1986 were in the ASME Code alert range, both HPSt pumps were tested at twice the normal periodicity. Before 1986, neither pump had a history of high differential pressur On March 24, 1986, pump 668 was declared inoper-able because the pump differential pressure exceeded the ASME Code,Section XI, required action valu On the basis of an engineering analysis and without performing any physical

__

repairs, HPSI pump 668 was declared operable on March 25, 198 The *engineering analysis stated that the probable cause of the high differential pressure condition observed in both pumps was internal fouling of the recirculation piping but that existing flow was sufficient to safely operate the pump The

• analysis concluded that (1) pump 668 should be declared operable based on no indications of pump degradation and (2) a high pump differential pressure condition was indicative of a hydraulic test circuit abnormality (recirculation line blockage). After the pump was returned to service, it remained on an accelerated test frequenc The high differential pressure condition where pump differential pressure exceeded the ASME Code alert range continued until the plant shutdown in May 198 The inspection team felt that the licensee had not demonstrated the minimum recirculation flow requirement was satisfied before declaring HPSI pump 668 operabl The team's concern regarding the adequacy of HPSI pump recirculation flow increased when it was determined that a special flow test con"'ducted in 1984 estimated individual HPSI pump recirculation flow at only 20 gp This test was conducted in response to licensed operators'

concern that the installed flow instrumentation was not responsive to low flow rates. Operating procedures required stopping the HPSI pumps if 30 gpm recirc-ulation flow could not be obtaine The special test procedure required starting a LPSI pump to obtain recirculation flow in the sensitive range of the installed flow instrumentation that was located in the common recirculation line for the HPSI, LPSI, and containment spray pump A HPSI pump was then started and the resultant increase in recirculation flow was attributed to the HPSI pum The licensee estimated HPSI recirculation flow at approximately 20 gp The HPSI pump vendor was then consulted to determine the acceptability of pump operation with reduced recirculation flo The vendor stated that the surveillance test could be *

safely conducted with reduced flow but advised against continuous pump operation (greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

Apparently, this safety concern had not received plant review committee consideration. Furthermore, the results of the 1984 test were not considered by the.licensee when analyzing the implications of the 1986 ASME Code test result The Technical Specification defini_tion of HPSI pump operability states that,

"Acceptable levels of performance shall be that the pumps start, reach their rated shutoff heads at minimum recirculation flow; and operate for at least fifteen minutes. 11 The trending data for both HPSI pumps indicated that the recirculation piping was possibly obstructed, as documented in the licensee's engineering analysi Consequently, because the licensee failed to demonstrate that the minimum recirculation flow requirement was satisfied, the team considered both HPSI pumps inoperabl The failure to fully demonstrate HPSI pump operability will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-12).

- 19 -

• 3. Testing of Check Valves in Air Systems Periodic testing of some isolation check valves in the instrument air and high pres~ure air systems was found to be inadequate to ensure that the*valves would perf->rm their safety function during abnormal event Proper operation of safety-related valves was dependent on isolation.check valves that were located at various points along the interface with a non-safety-related air syste These isolation check valves were not routinely tested and under normal operating conditions were open or experienced no differential pressur (1) Isolation check valves between the non-safety-related instrument air system and the safety-related high pressure air system were not*periodi- -*-

cally tested to confirm their ability to perform their design safety functio The high pressure air system provides high pressure control air for air-operated valves located in each of two engineered safe-guards rooms and the turbine buildin The team was informed that, for plant reliability reasons, many of the safety-related air loads receive non-safety-related instrument air in addition to safety-related high pressure air. The interface between these two systems typically contains a normally open manual isolation valve and a check valve.

. In general, the* high pressure air system is at a higher pressure than the instrument air system so that the check valves would be normally shut and held shut by system differential pressure However, for some valves supplied by the high pressure air system, the isolation check valves may be normally ope This condition can exist because the instrumE!'nt air supply penetration is downstream of the high pressure air system presssure reducing valves that have setpoints equal to or less than maximum instrument air pressur Consequently, instrument air system pressure would open the interfacing check valve and supply motive air to the affected safety-related air load Unlabeled check valves in the instrument air supply lines for air-operated valves CV-3223, CV-3224, CV-3212, and CV-3213 are examples of such interfacing check valves that were not periodically tested to ensure that they would perform their design functio (2) Isolation check valves between the non-safety-related instrument air system and safety-related air accumulators were not periodically tested to confirm their ability to perform their design safety functio The instrument air system normally provides motive air to shut containment isolation valves CV-0911 and CV-094 These valves are containment isolation valves in the component cooling water (CCW)

return line and automatically shut if a safety injection signal and a CCW system low pressure signal are both presen Because the

. instrument air system is not safety-related, each valve has an air accumulator that is continuously maintained charged by the instrument air syste On loss of instrument air, isolation check valves in the instrument air supply to CV--0911 and CV-0940 are required to seat to prevent the accumulators from depressurizin However, these unlabeled check valves were not periodically teste Surveillance testing of CV-0911 and CV-0940 did not functionally test the ability of either the check valves to seat on demand or the air accumulators to close the containment isolation valves and maintain them shu As a consequence, one or both of these isolation check valves could be in an undetected failed condition so that the containment isolation

- 20 -

• valves may not isolate on an appropriate safety signal or may re-open, once closed, on loss of the non-safety-related instrument air syste (3) Isolation check valves between the non-safety-related instrument air system and safety-related nitrogen bottles were not periodically tested to confirm their ability to perform their design safety functior The instrument air system normally provides air to the T-rings of containment isolation butterfly valves CV-0813 and CV-081 These valvesLare the containment air purge room supply isolation valve Although these valves are normally closed and fail shut on loss of instrument air, the valves require either air or nitrogen to pressurize the T-rings that form the seating surface between the 12-inch diameter disk and valve bod Becaus~

the instrument air system is not safety related, each valve has a nitrogen bottle available to pressurize its sea To prevent the nitrogen bottle from depressurizing following a loss of instrument air, check valves are provided in the instrument air suppl These unlabeled check valves were not periodically tested. Surveillance testing of CV-0813 and CV-0814 does not functionally test the ability of either the check valves to seat on demand or stored nitrogen to pressurize the containment isolation valves T-rings sufficiently to maintain a seating surfac As a consequence, one or both of these isolation check valves could be in an undetected failed condition so that the valves may not remain seated on loss of the non-safety-related instrument air syste The failure to perform periodic testing of isolation check valves will remain an unresolved item pending followup by the NRC Region III Office (50-255/86-029-13).

3. Surveillance Testing of Safety-Related Batteries Surveillance testing of safety-related batteries was found to be wea Of particular concern was the fact that the majority of the battery testing weaknesses identified by the team had been previously identified in NRC Inspection Report 50-255/85-009, yet remained uncorrecte Specific weaknesses are discussed belo (1) A weakness was found in the licensee's preparation for the periodic service test of the 125-volt de safety-related batteries. A service test performed once every 18 months was used to verify that the battery capacity was adequate to supply and maintain all design basis loads for 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> The inspection team determined, however, that the licensee performed an equal-izing charge before the service test instead of testing the battery-in the as-found conditio The team was concerned that performing an equal-izing charge just before a service test would not accurately demonstrate the capability of the battery to provide the design discharge current above minimum voltage and would tend to mask the effects of inadequate maintenanc (2) Failure to correct battery service test discharge currents for minimum expected temperature was considered a weaknes Although the 125-volt-dc batteries were sized based on a minimum electrolyte temperature of 70° F, the service test was only corrected to the manufacturer's cell rating temperature of 77° The team was concerned that

- 21 -

• failure* to correct the service test currents to the minimum design temperatur~ would result in a 4 percent error in the service test result (3) Battery room and cell temperatures were recorded only on a monthly basis and no minimum cell temperature criterion or action statement was con-tained in the surveillance procedure Although design analyses assumed a minimum electrolyte temperature of 70° F, cell temperatures as low as 65° F were observed in the 1986 battery surveillance record Consequently, the team was concerned that an insufficient basis existed for the minimum cell temperatures assumed in battery sizing calculation (4) Failure to correct specific gravity readings for electrolyte level was considered a weaknes Although surveillance procedures required recording the electrolyte level, specific gravity readings did not appear to be corrected for level. This omission could account for an error in specific gravity of as much as 30 points between high and low electrolyte level This could result in up to an approximate 9 percent deficit in battery capicity if the electrolyte level in all cells were at the low level mark, and the specific gravity readings were low but still within specificatio The concerns discussed above regarding the licensee's failure to perform technically adequate battery surveillance tests and to correct testing discrepancies previously identified by the NRC wfll remain unresolved pending followup by the NRC Region III Office (50-255/86-029-14).

3. PoS't-Modification lesting for FC 441-2 The post-modification testing of the HPSI long term cooling modification accomp-lished in 1983 was determined to be weak in that the HPSI system configuration used during the test differed from that expected following a loss-of-coolant acciden Modification FC 441-2 provided a hot-leg injection path by which simultaneous injection of approximately even flow through the hot leg and the cold legs can be initiated to maintain core cooling and prevent boric acid deposits in the core regio Post-modification test procedure 7502-502Q required that cold-leg injection valves be throttled to balance flows among the four cold-leg injection lines. The hot-leg injection valves were then throttled opened to establish a 50 percent flow split between the hot and cold legs. The throttled open position of the hot-leg injection valves were preserved by limit switches, but the throttled position of the cold-leg injection valves were not preserve On an actual safety injection signal, the cold-leg injection valves would be stroked to their full wide-open positio Upon subsequent initiation of hot-leg injection, more flow would be passed by the cold-leg injection valves than was established in the post-modification testin A 50 percent flow split between the hot-and cold-leg flow paths therefore cannot be assured unless further operator action is taken to throttle the *cold-leg injection valve Emergency operating procedures did not specify such action by the operator *

The team was concerned that the licensee's post-modification testing program failed to test this modification in a manner that was consistent with anticipated system operation. It was the team's understanding that testing will be performed to address the above weakness. This issue will remain an open item pending followup by the NRC Region III Office (50-255/86-029-02).

- 22 -

'1

• 3. Surveillance Test and Calibration Procedures Routine surveillance test and calibration procedures were found to.be adequate for demonstrating system functionality, were clearly written in a consistent format, and contained sufficient reference information pertaining.to equipment adjustments that could be necessary, as well as relevant limiting conditions for operations. A weakness was noted, however, with the test basis document for HPSI pump operability testin The basis document for Surveillance Procedure M0-22, 11 Inservice Test Procedure

- High Pressure Safety Injection System, 11 Revision 28, contained out-::of-date __ _

pump differential pressure reference value Major pump maintenance had been performed in 1983/84, which resulted in establishing new reference values for performance monitorin Step 5.3.1 of procedure EM-09-04, 11Inservice Testing of Safety Pumps, 11 Revision 8, required revising the test basis document whenever new reference values were established. Although surveillance test procedure M0-22 arid the pump record were updated with the new reference values, the test basis document had not been revised. This failure to maintain the test document technical data up to date is another example of the failure to update a controlled document (see observation 3.. 1.6, unresolved item 50-255/86-029-06).

3.4 Operations In the area of operations, the inspection team evaluated the adequacy of shift manning; control of ongoing maintenance and operations activities; normal oper-ating, emergency operating, and off normal operating procedures; operator familiarity with the physical location of various electrical and mechanical components; equipment operation in abnormal situations; reactor system status verificatfons; and operator training. This evaluation focused on how each of these elements interfaced with operation of the HPSI system under various normal and abnormal condition.4.1 Conduct of Operations The inspection team observed a number of licensed reactor operators and auxiliary operators perform portions of their shift rounds and shift turnover On th basis of the sample reviewed, the team considered that these operations personnel were knowledgeable of.. plant conditions, electrical and mechanical equipment loca-tions, capabilities of the HPSI system, and plant operations in genera rhe inspection team observed a control room shift turnover on October 9, 1986, and a primary auxiliary operator shift turnover on October 22, 198 These turnovers were accomplished in accordance with administrative requirements and appeared to be effective. During shift monitoring in the control room, operators were observed to be familiar with procedures and drawings and could effectively use both in answering questions related to the conduct of plant operation The overall level of professionalism by the operators was satisfactory and access to the control room was controlled effectivel.4.2 Operations Procedure Weaknesses The team conducted a review of the normal operating and emergency procedures for the HPSI system and other related emergency procedures. Several weaknesses were noted with the operating directions provided to control room personnel.

. - 23 -

• (1) Misleading information affecting the operation of the HPSI system was found on two engraved plaques mounted on a control panel in the control roo Emergency Operating Procedure (EOP) 8.1, "Loss of Coolant Accident, 11 Revision 18, Step 4.14, said to 11Place Handswitches **HS-3027A (**CV-3027) and **HS-3056A (**CV-3056) to ~losed position. 11 These switches provided permissive signals that enabled the safety-injection recirculation valves (CV-3027 and CV-3056) to close following a shift of safety injection pump suction from the safety injection refueling water tank (SIRWT) to the containment sum The purpose of these recirculation valves closing was to ensure that, following a loss-of-coolant accident (LOCA), highly radioactive liquid was not recirculated to the SlRWT, which was vented directly to atmospher Contrary to EOP 8.1, an engraved

-- *

information plaque on.the control room.control panel adjacent to handswitch HS-3027A that enabled operation of CV-3027 stated:

__

For LOCA after PS [Primary System] press is less than 215 psig and prior to recirculation actuation place HS-A in close position to enable closure of CV-302 A similar plaque was adjacent to handswitch HS-3056A that enabled operation of CV-305 This information on these plagues was misleading because during a LOCA primary system pressure could remain above 215 psi In this case, if an operator followed the instructions on these plaques, the SI pump recirculation valves to the SIRWT would remain open after the SI pump suction shifted to the containment sum This could result in venting fission 'l>roducts to atmosphere through the vented SIRW (2)

EOP 8.1, step 4.22, stated that if the recirculation actuation signal is received, verify that, 11Each running HPSI pump has a.minimum flow of at least 30 gpm.

The 0 to 400 gpm flow gauge in the control room that was intended to be used to make this determination could not be read accurately

• at flows this smal Discussions with licensee personnel revealed that the indication of HPSI recirculation flow on this gauge would be a minor deflection of the indicator and essentially nonquantifiabl (See observation 3.3.1.)

(3)

EOP 8.1, Step 4.11, directed the operators to stop the containment spray pumps only on the basis of the containment high pressure signal clearin This procedure was considered weak in that it permitted containment spray to be stopped without confirmation that iodine removal from the containment atmosphere was no longer a consideratio The licensee was in the process of developing symptomatic based emergency procedures using 11Combustion Engineering Emergency Procedures Guidelines, 11 Revision 0 This procedural guidance indicated that the containment spray pumps should be stopped only after the containment high pressure signal had cleared and further evaluation revealed that iodine removal was no longer require (4) Alarm Response Procedure (ARP) No. 7, 11Auxiliary Systems Scheme, 11 was considered weak in that the response to a containment instrument air low pressure alarm did not contain.any provision for shutting valve CV-1211, the instrument air header containment isolation valve. It is possible that during a LOCA non-safety-related instrument air piping inside the contain-ment could be broken resulting in a depressurization of the instrument air header and a potential pathway for leakage from the containment to the environmen Operators would have to manually shut CV-1211 *in this

- 24 -

scenario because it is operated by instrument air and fails open on a loss of this ai (See observation 3.1.3(3))

(5)

EOP 2.1, "Emergency Operating Procedure, Loss of All *immediately Available AC Power," Revision 1, Step 4.9.2, directed the operdtor to ~hed loads when battery discharge current exceeds 150 ampere The second set of loads to be shed, identified in Step 4.9.2.c and Attachment 3(4) of the procedure, was the diesel generator control and start circuits. This load was ident-ified in the procedure as a 96-*ampere 1 oad even though the actua 1 load is almost entirely associated with the field flashing circuit. If required~

this load would be present only for a short duration (that is, a few seconds).

The team considered that shedding the diesel generator circuits*

-*

would have a negligible effect on the total capacity of the de system and would reduce. the potential for returning the diesel generators to servic This procedural weakness was attributed to an error in the battery load stud This study incorrectly assumed the diesel generator field flashing circuit to be a constant 2-hour loa The procedural weaknesses identified above wii'l remain unresolved pending followup by the NRC Region III Office (50-255/86-029-15).

- 25 -

.

'*

4.0 MANAGEMENT EXIT MEETING An exit meeting was conducted on October 24, 1986, at the Palisades Nuclear Generating Plant. The licensee's representatives at this meeting are identified in Appendix The f o 11 owing NRC management representatives were al t*o in attendance:

Mr. A. Bert Davis, Deputy Regional Administrator, Region III; Mr. Brian K. Grimes, Director, Division of Quality Assurance, Vendor, and Technical Training Center Programs, Office of Inspection and Enforcement; and Mr. Carl Paperiello, Director, Division of Reactor Safety, Region III. The scope of the inspection was discussed and the licensee was informed that the inspection would continue with further in-office data review and analysis by team member The licensee was informed that some of the observations could become potential enforcement finding The observations were presented for each area inspected, and team members responded to questions from the licensee's representative *

APPENDIX Persons Contacted The following is a lis~ of persons contacted during this inspectio Other technical and administrative personnel who were also contacte All personnel li*sted are Consumers Power Company employees unless noted otherwis *J. W. Reynolds, Executive Vice President, Energy Supply

• F. W. Buckman, Vice President, Nuclear Operations

• R. B. Dewitt, Vice President, Engineering Support Services

• J. F. Firlit, Plant General Manager

• G. B. Slade, Executive D.i rector Qua 1 i ty.Assurance

• K. W. Berry, Director Nuclear Licensing W. J. Beckius, Executive Engineer

• R. D. Orosz, Engineering Maintenance Manager

• J. D. Alderink, Mechanical Engineering Superintendent

• R. Rice~ Operations Manager

• D. W. Joos, Administration and Planning Manager

• R. A. Vincent, Plant Safety Engineering Administrator

• J. G. Lewis, Palisades Technical Director

• H. M. Esch, Plant Administrative Manager

• K. E. Osbourne, Licensing Engineer B. Johnson, Licensing Engineer M. Wade, Senior Supervisory Engineer, Electrical, Instrumentation and Control R. Gilmore, Project Manager Palisades W. L. Ford, DC Sy-stem Engineer K. Yaeger 3 Staff Engineer, Power Plant Auxiliary Group G. Brock, General Engineer, Power Plant Auxiliary Group W. Waudby, Staff Engineer, Plant Relaying and Control K. A. Toner, Nuclear Projects Supervising Engineer J. Eddy, General Engineer, Safety Analysis G. Pratt Staff Engineer, Safety Analys.is J. Meineke, Administrator, Safety Analysis B. Young, Section Head, PRA Palisades D. A. Bixel, Staff Engineer, Engineering and Maintenance J. Kuemin, Staff Engineer, Palisades Licensing W. J. Axdorff, Inservice Inspection Engineer T. A. Buczwinski, Plant Projects Supervisory Engineer R. J. Corbett, Plant Projects Engineer C. S. Kozup, Plant Projects Engineer S. G. Kupka, Mechanical Engineering Associate Engineer K. J. Rigozzi, Plant Projects Scheduler-R. 0. Torp, Instrumentation and Control Supervisor J. K. Ford, Plant Projects Engineer B. D. Meredith, Plant Projects Technologist

• T. J. Palmisano, Plant Projects Superintendent R. E. McCaleb, Palisades Quality Assurance Director

• G. J. Ashworth, Senior Staff Supervisor

• Attended exit meeting on October 24, 1986

A-1

"'

c*

• .,,

..

<w

..,

-~

---

*-**~*--* ----- *---**

R. A. Fenech, Superintendent of Operations R. J. Frigo, Operations Staff Support Supervisor F. Ruble, Site Specific Training C. M. Grady, Plant Mechanical Supervisor B. A. Low, Engineering Safeguards Section Supervisor Mechanical -

Engineering Department D. W. Laneschwager, Operations Support Coordinator

• H. C. Tawney, Mechanical Maintenance Superintendent P. F. Bruce, Electrical Engineering and Maintenance Supervisor J. J. Buckner, Electrical Supervisor S. R. Oakley, Electrical Engineering Supervisor G. E. Watkins, Electrical Repairman T. J. Campbell, Electrical Repairman J. R. Lewis, Electrical Repairman J~ W. Trantham, Mechanical Supervisor D. C. Hill, Mechanical Repairman/Welder M. C. Sniegowski, Plant Project~ Engineer R. M. Brzezinski, Instrumentation and Controls Maintenance Superintendent M. G. Genrich, Shift Supervisor, Operations Department J. Haumersen, General Engineer, Electrical D. M. Kennedy, Instrumentation and Controls Senior Engineer

• R. W. Taylor, Combustion Engineering Site Services Manager C. McMullin, Combustion Engineering Feriochi~, Combustion Engineering J. Young, Combustion Engineering J. Dotson, Project Manager, Bechtel Power Corporation

• Attended exit meeting on October 24, 1986.

A-2