IR 05000266/1990201
| ML20043C800 | |
| Person / Time | |
|---|---|
| Site: | Point Beach  |
| Issue date: | 05/24/1990 |
| From: | Guthrie S, Lanning W, Stein S Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20043C797 | List: |
| References | |
| 50-266-90-201, 50-301-90-201, NUDOCS 9006060192 | |
| Download: ML20043C800 (87) | |
Text
.
-
_
,
c i-U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION Division of Reactor Inspection and Safeguards NRC Inspection S port: 50-266/90-201 License Nos: DPR-24 50-301/90-201 DPR-27
.
ber.kets:
50-266 Y
50-301 Licensee: Wisconsin Electric Power Company Facility Name:
Point Beach Nuclear Plant Inspection Conducted: March 12 through 16 and March 26 through April 6, 1990 Inspection Team: Steven R. Stein, Team Leader, NRR Jeffrey B. Jacobson, Assistant Team Leader, NRR Gary E. Garten, NRR Rolf A. Westberg, Rill NRC Consultants:
C. J. Crane, Electrical Design Review J.- M. Leivo, Instrumentation and Control Design Review S. Traiforos, Mechanical Design Review D. C. Ford -Installation Configuration, Surveillance Review J
rrey, Installat n Configuration, Surveillance Review
-
Y8@/fo Approved by:.
~ Steven R. Stein, Team Leader Date Team Inspection Section C-Special Inspection Branch Division of Reactor Insyection and Safeguards Office of Nuclear Reactor Regulation
'
Approved by:
S
/
Stephef C. Guthrie, Chief Sat (
Team Inspection Section C Special Inspection Branch Division of Reactor Inspection and Safeguards Office of Nuc ear Reactor Regulation Approved by:
7m4u
/m
$
Y!70
'
UCJnp D. LE ning, Chief Dgte ' '
Special Inspection Branch Division of Reactor Inspect on and Safeguards Office of Nuclear Reactor Regulation-9006060192 900601 ADOCK0500g6 FDR
.
-__.
-.- __ -..
- -
-
-_
_. -
- _ - -.
s
'
w EXECUTIVE SUMMARY INSPECTION REPORT 50-266/90-201 AND 50-301/90-201 WISCONSIN ELECTRIC POWER COMPANY POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 l
During the periods of March 12 through 16 and March 26 through April 6, 1990, the Special Inspection Branch of NRR conducted an electrical distribution systemfunctionalinspection(EDSF1)atthePointBeachNuclearPlant(PBNP)
and the Wisconsin Electric Power Company (WEPCO) Nuclear Power Department offices in Milwaukee, Wisconsin. An exit meeting was conducted on April 17, 1990, at WEPC0's Milwaukee offices. The inspection was performed to determine whether the electrical distribution system as d2 signed, installed,
,
and modified at PBNP Units 1 and 2 would be capable of performing its intended safety functions. During the inspection, the team reviewed available calcula-tions and related documents, surveillance testing and other testing data, and performed system walkdown inspections to verify system and component configurations.
!
At the conclusion of the inspection, the team was unable to determine that the systems that form the electrical distribution system at Point Beach would function under all design conditions. This indeterminate status was based on the number and significance of the technical issues the team identified. The
,
three major issues that raised the most concern were -
t
emergency diesel generator (EDG) loading that potentially could exceed the EDG ratings,
the nonseismic design of port, ions of the EDG fuel oil system, and
!
O safety-related cables that were routed in the same raceway as cables of
!
the redundant division.
Based on the potential inability of the EDS to perform its safety function, the l
I=
team questioned the operability of the system. WEPCO alleviated the team's l-immediate operability concerns for the above issues by actions it took imedi-ately following the inspection and presented at the exit meeting.
As a result of the inspection, the team identified more than 27 specific deficiencies. Each deficiency is discussed in the report and the deficiencies and issues that require additional review or evaluation are discussed in detail in Appendix A of the report. The team also identified general weaknesses in the following areas:
(1) design and modification deficiencies in the EDG and 125-Vde systems, (2) lack of available design and engineering information, (3) design features where a single failure can disable redundant equipment, and i
(4) engineering support that did not fully evaluate design or changes to l-design. The first area of weakness involved deficiencies in the emergency diesel generators and fuel systems, and in the batteries and 125-Vdc system.
Because of PBNP's design (only two EDGs and two safety-related batteries shared by both units), these two systems have great safety significance. Within the EDG system, the team found the steady-state loading of the diesels to be l
marginal with the potential to be exceeded.
In addition, no transient analysis i
. -
.
_.
-.
. -
..
.
. - -
. -
.-
- - - -
-
_ -. -
_
s
.
existed for the dynamic loading of the EDG. The fuel oil system between the seismic energency storage tank and the seismic day tanks was not seismically designed and installed, and the fuel oil quality did not meet the appropriate
,
requirements.
Finally, a voltage level interlock described in the Final Safety
,
Analysis Report (FSAR) and in system logic diagrams was not part of the EDG design or installed configuration.
The team's findings in the 125-Ydc system included a nonconservative calcula-tion for sizing replacement batteries. The float voltage for the batteries exceeded the manufacturer's recommendation and component ratings.
The proce-dure for measuring ground resistances on the system did not include acceptance criteria or limits, and the safety significance of the results of measurements taken was not evaluated.
The maximum available short-circuit current was not determined when circuit breakers were replaced because of a recently disclosed problem (the de breakers did not have a maximum fault-interrupting capability).
The licensee was evaluating its final resolution for the main dc bus breakers.
The team's second identified area of weakness involved a lack of design
,
documents and information. The team's review of the adequacy of the electrical distribution system was complicated by the lack of adequate and complete
,
calculations and analyses. The team could not confirm ratings of certain equipment or determine fault currents to equipment. A steady-state load calculation for the EDGs did not exist untti the inspection, and a transient analysis had not been performed.
In addition, calculations for many device setpoints did not exist. The team recognized that WEPC0 had several existing programs that would address these concerns. However, the programs were prelim-
.
inary efforts iniplemented too recently to be evaluated.
The team identified a third area of weakness involving a number of conditions that, given a single failure, could jeopardize redundant equipment required for safe operation of the plant. Thre't examples of these conditions were the result of original design and two conditions were the result of plant modifica-tions. These conditions included (1) routing of redundant safety-related cables in the same raceway, (2) single failure of the tie breaker between the redundant safety-related 480-V busses, (3) potential seismic failure of devices caused by the tie-breakers between the safety-related 4160-V busses, and (4) potential loss of redundant trains from an automatic shutoff feature on new l
inverters.
'.
l The fourth area of weakness was WEPC0's engineering support program. Several of the team's findings indicated that WEPC0 did not evaluate design adequacy or establish adequate bases for certain changes or modifications to the plant.
The findings also indicated that when WEPC0 identified a problem with the original design, it did not address the full extent of the problem or the possibility of other similar problems in all cases. Examples included:
(1)a full load profile for sizing replacement batteries was not developed, (2) the l
maximum available short-circuit current for replacing dc system circuit i
breakers and batteries was not determined, (3) the effects of excessively high battery float voltages was not fully evaluated, and (4) the effects of fuel oil that did not meet quality requirements was not evaluated. Other examples of weaknesses in the engineering support program included (1) performing some modifications without considering industry-standard practices, (2) adding
,
.
.. - -
.
..
.
-
-
-
-... -..
.-
-
.,,
g.
'
incorrect information into emergency operating procedures, (3) upgrading
. safety-)related status of systems without a controlling program or procedure,psrmittin and_(4-The team concluded that a lack of design basis documents-and information contributed to the engineering program weaknesses it found. The team also
<
!
believed that the limitad size of the engineering workforce contributed to the engineering support weaknesses.
!
,
l l
L l
.
\\
l l.
,
'
.
S
-
t i
i iii
..
.
...
.
.-. - -.-
-
-
.
.=
.
TABLE OF CONTENTS
-
Pagg EXECVilVE SUMMARY.......................................................
1.0 BACKGR0VND.........................................................
2.0 OBJECTIVES AND METHODOLOGY.........................................
3.0 ELECTRICAL SYSTEM DESIGN REVIEW....................................
3.1 Electrical Loading............................................
3.1.1 Emergen cy Diesel Generator Loading.....................
3.1.1.1 Steady-State..................................
3.1.1.2 Transient....................................
3.1.1.3 Operational Considerations....................
3.1.2 12 5 -Vd c Sy s tem Lo a di ng.................................
3.1.3 Electrical Cable Ampacity and Cable Tray Fill..........
3.2 Protection and Coordination...................................
3.2.1 416 0 -V a c Sy s tem.......................................
3.2.2 4 6 0 - V a c Sy s t e m........................................
3.2.3 125-Vdc System Short-Circui t Current..................
'
.
3.3 Electrical Distribution System Interlocks and Load Sequencing Logic.........................................................
3.3.1 Potential Common-Mode Failures.........................
~
3.3.1.1 Bus Tie-Breakers for Safety-Related Busses....
.
3.3.1.2 Component Cooling Water Pumps.................
l 3.3.1.3 DC Control Power Switches.....................
!
3.3.1.4 Diesel Generator Output Interlocks............
3.3.2 Drawing Discrepancies..................................
3.4 Saf ety-Related 120-Vac Instrument Power System................
t l
3.5 Voltage Regulation............................................
3.6 Conclusion....................................................
4.0 MECHANICAL DESIGN REVIEW...........................................
4.1 Emergency Diesel Generator Fuel Oil System....................
l l
l l
.
.
.
-..
-. -
_.
. -.. ~
.
-. - - -.
- _
. -.
,
t'
o On Eas!
-
4.1.1 Seismic Condition......................................
."
4.1.2 Quality of Fuel 011....................................
4.1.3 Upgrade to Safety-Related and QA Status................
4.1.4 Fuel Oil Delivery Under Emergency Conditions............
,
i 4.2 Heating, Ventilating, and Air Conditioning Systems............
4. 2.1 - Ba ttery Room Hea ti ng...................................
4.2.2 EDG Room Heating, Ventilating, and Air Conditioning....
!
4.3 Conclusion....................................................
j
,
5.0 SYSTEM CONFIGURATION AND TESTING REVIEWS...........................
5.1 Equipment Wa l kdown Inspections................................
,,
5.1.1 Separation of Redundant Division Cables.....,..........
L 5.1.2 ' Cable Damage...........................................
l 5.1.3 Switchgear.............................................
5.1.4 Transformers and Tap Settings..........................
5.1.5 Motor-0perated Va1ves..................................
5.1.6 Pump Motors............................................
!
5.1.7 Emergency Diesel Generators............................
5.2 Equipment Testing.............................................
1
.
5.2.1 Ci rcu i t-Brea ker Testi ng................................
5.2.2 Relay Calibration.....................................
5.2.3 120-Vac Inverter Surve111ance..........................-
5.2.4 Emergency Diesel Generator Testing.....................
5.2.5 Ba t te ry T e s t i ng........................................
5.3 Equipment Modifications.......................................
5.3.1 Modification of Circuit Breakers.......................
5.3.2 Cable Modificationsl...................................
,
5.4 Conclusion....................................................
l 6.0 ENGINEERING AND TECHNICAL SUPPORT REVIEW...........................
6.1 Programs and Procedures.......................................
l 6.1.1 Engineering Interfaces.................................
6.1.2 Design Procedures.......................................
6.1.3 Procedures for Upgrading System Status.................
.
6.1.4 Maintenance History....................................
l 6.1.5 Trending...............................................
_
.,._
_ _. __ _ _ _ _
.... _.. _. __.
._
_
,-
.
,
ESSS 6.2 WEPC0 Action on Commitments and Concerns......................
6.2.1 In-Service Testing Program for EDG Fuel Oil System.....
6.2.2 Responses to NRC Bulletins and Information Notices.....
6.2.3 Responses to Other Concerns............................
l 6.3 Conclusion....................................................
7.0 OVERALL C0hCLUSIONS................................................
8.0 EXIT MEETING.......................................................
-APPENDIX A - Unresolved Deficiencies APPENDlX B - Personnel Cor.tacted
.
e
-
4
<
__ _
_
_..
.. _ _
_ _ __ _ _
_
.
_ _ _.
. _ _..
I
!
.
l'. 0 BACKGROUND
'During previous inspections of nuclear power plants, NRC teams observed that the required functional capability of certain safety-related systems was compromised by inadequate engineering and technical support. As a result of
,
this lack of support, various design deficiencies had been introduced during L
i design modifications, particularly of the station electrical distribution system.
In response to the observed design deficiencies, the Reactor Special Inspection Branch (RSIB) of NRC's Office of Nuclear Reactor Regulation (NRR)
developed a draft temporary instruction for the NRC Inspection Manual, which describes how teams from the NRC regions are to conduct electrical distribution system functional inspections (EDSFls).
l The EDSFI performed by RSIB at the Point Beach Nuclear Plant (PBNP) was one of several pilot inspections to be conducted before the NRC issues the temporary instruction. The inspection was conducted at Wisconsin Electric Power Company's (WEPCO's) Nuclear Power Department's offices in Milwaukee, Wisconsin, during the period March 12-16, 1990, and at the PBNP site during the period March 26 - April 6, 1990. The team consisted of NRC employees and consultants.
2.0 OBJECTIVES AND METHODOLOGY The primary objective of this inspection was to assess the functional capa-bility of the electrical distribution system at PBNP. A secondary objective was to assess how well WEPCO's engineering organization provided engineering and technical support to site organizations. The inspection team was conoosed of two groups:
electrical and mechanical design engineers who reviewed tie
,
l original design and changes to that. design, and installation engineers who verified the configuration, condition, and test results of installed equipment.
The methodology used included reviewing calculations, analyses, drawings, l
procedures, and tests for selected equipment, devices, and components of the electrical distribution system and by extensive walkdown inspections of plant electrical wiring and components.
nificance of identified deficiencies are The areas reviewed and the safety sig'of this report. Conclusions are given at described in Sections 3, 4, 5, and 6 the end of each of these sections. The conclusions and weaknesses are then sumarized in Section 7 of this report.
Each deficiency addressed in the report that remains unresolved is discussed in Appendix A. each deficiency is numbered, and the section of this report in which it is discussed is cited.
Personnel contacted are listed in Appendix B and persons attending the exit meeting on April 17, 1990, are indicated there, too.
3.0 ELECTRICAL SYSTEM DESIGN REVIEW The team evaluated portions of the safety-related electrical systems at P8NP, Units 1 and 2, by examining and assessing the technical adequacy of the design as defined by various design documents. The team reviewed the design and l_
design control process for compliance with (1) the General Design Criterion (GDC) to which WEPC0 comitted in its FSAR, (2) the Criterion of Appendix B to the current 10 CFR Part 50, and (3) the station's Final Safety Analysis Report (FSAR). To obtain additional understanding of the design, the team interviewed responsible WEPC0 personnel and inspected selected safety-related electrical equipment.
-
.-
-
-
._
. _ _..
_ _ _ _... _ _
_
-
__
__
- _
_ _ _ _ _.
__
.
.
The tea::: reviewed the limited available design documentation, including a number of calculations that WEPC0 was able to retrieve, design changes, one-line diagrams, elementary wiring diagrams, schematics, logic diagrams, and equipment specifications. The team conducted specific reviews of (1) emergency i
fill, (generator loading, (2) the 125-Vdc system, (3) cable ampacity and tray 4) prot diesel
sequence and safeguards bus interlocks, and (6) the 120-Vac vital instrument bus system.
3.1 Electrical Loading The team reviewed and evaluated the design of the PBNP emergency diesel genera-ter (EDG) system and the 125-Vdc supply and distribution system to determine whether electrical loading had exceeded the ratings for the systems and system
components.
Electrical cable routing, tray fill, and ampacity were also
'
reviewed.
3.1.1 Emergency Diesel Generator Loading Two EDGs (G-01 and G-02) supplied emergency power for the engineered safeguards system electrical busses for both units. Each EDG was designed to be of sufficient size to start and carry the engineered safety features loads follow-ing a loss-of-coolant accident in one unit and a shutdown of the other unit concurrent with a loss of offsite power. The team reviewed the steady-state loading on the EDGs and attempted to review the dynamic loading.
Each of these
'
issues is presented below.
3.1.1.1 Steady-State
,
The team reviewed the FSAR loading, description and Calculation 0870-103-011, which determined the steady-state loading on each EDG. This calculation was recently prepared by a contractor for WEPCO. Before the calculation was issued, there was no comprehensive listing of loads for the EDGs. The calcula-tion identified that the worst-case loading scenario was the loading on EDG G-02.
For this case, the loading was calculateo to be:
97.8percentofthe2000-hour (cbntinuous)ratingduringtheinjection
phase
-
94.1 percent of the 200-hour rating during the injection phase
103.1 percent of the 2000-hour rating during the recirculation phase
99.2 percent of the 200-hour rating during the recirculation phase The team found that the steady-state loading calculation was nonconservative because it assumed that a containment accident fan for the non-f aulted unit was not operating during the injection and recirculation phases of the accident scenarb.
E/clusion of the fan load from the EDG calculation was inconsistent with the FSAR, which required one containment fan to be manually started in the
.
.
-
.. _
.
..
non-faulted unit. The team also found that the plant emergency operating procedures for the non-faulted unit did not exclude starting a single contain-mentaccidentfan(seeSection3.1.1.3,below). Using the actual run current amperes under normal operation, the team determined that the containment fan represented a 61.3 kW load. The addition of this load onto diesel generator G-02 during the recirculation phase would increase the loading to 101.27 percent of the 200-hour rating.
The team concluded that the EDGs, under design basis accident conditions, would be operating with little or no marg 1n with respect to steady-state loading.
This was considered significant because it appeared that the plant emergency operating procedures were not completely correlated with the steady-state loading calculation. Therefore, additional loads on the EDG could be added by the operators, resulting in overloading the EDG and reducing plant safety. The team concluded the.t the safety significance of this issue warranted WEPC0's prompt ano thorough evaluation. This is considered an unresolved item (see Appendix A, Deficiency 90-201-01).
3.1.1.2 Transient i
The team found that WEPC0 had not analyzed the EDGs' capacity to handle starting loads and sequencing intervals under dynamic conditions. Therefore,
'
in-rush currents, starting load (kW) under low-voltage conditions, acceleration time of large motors, loads due to motor-operated valves, and allowable tolerance of load sequence timing relays had not been analyzed.
Since there appeared to be little or no margin for the steady-state loading of the EDGs in both the injection phase and the recirculation phase, the team considered the lack of a transient analysis for diesel generator loading to be l
a significant deficiency.
In support of this conclusion, the team found that WEPCO did not have data on the tolerance and accuracy of the EDG load sequence timing relays based on seismic testing.
Because a seismic event could l
potentially shif t the relay accuracy, there was no basis for establishing the l
tolerance to which these relays were checked. Possible shif ts in accuracy l
could impair EDG transient loading. Also, the team found that protective overcurrent relays on the safety injection pumps were set based on assumed motor acceleration time with no basis"for this assumption. Pending further review by the licensee and NRC of diesel generating loading, this is considered an unresolved item (see Appendix A, Deficiency 90-201-02).
3.1.1.3 Operational Considerations l
l As a result of the team's concerns regarding EDG loading, the team reviewed loading from an operational perspective using the load requirements of the
'
emergency operating procedures (EOPs) as a starting point. The team reviewed E0P-0, E0P-1, E0P-1.3, E0P-1.4, and Emergency Contingency Action (ECA) 0.0 in detail with WEPC0 senior operating staff to determine what EDG loads would be required by the E0Ps to safely mitigate the consequences of a design basis accident (DBA) scenario concurrent with a single failure of one EDG. The team l
listed the loads the operator stated would be added onto the EDG in accordance with the E0Ps, the timing of these loads, and whether or not the senior operating staff felt these loads were necessary to safely mitigate the
3
_
,
.
_.
. _
.
_ _ _ _ _ _ _.
_ __ _ _ _ _ _
.
r
consequences of the DBA scenario. After progressing through the required E0Ps, the-team noted the following concerns. The safety significance of the team's concerns were heightened because both units share two EDGs; therefore, the i
assumed failure for one EDG train affects both units.
O The E0Ps did not coordinate the accident unit and the non-accident unit with respect to EDG loading. The team was concerned that if additional loads were required by the non-accident unit to maintain safe shutdown, or if loads were added withuut coordination with the necessary accident loads, the potential existed for overloading the EDG.
In response to an overload, the EDG could fail, losing its ability to perform its intended safety function.
f O
The only method available to the operator for monitoring EDG loading was a single kilowatt meter and related annunciator that was calibrated on a 6-year interval. The team noted that the margin for EDG loading was small and no allowance had been included in existing EDG load profiles for the noter tolerance. Since the noter and its associated window annunciator
'
were the primary method for monitoring EDG loading, the team also ques-tioned the 6-year calibration interval. WEPC0 provided no basis for the calibration interval including vendor recommended intervals. Furthermore, the annunciator alarm could activate at the EDG's 2000-hour rating and WEPC0 stated that, in certain scenarios, the 2000-hour rating may be exceeded to handle the required accident loads.
In those scenarios, the annunciator indication would give the operator no useful information and the operator would be forced to rely only on the kilowatt meter. Meter inaccuracies or meter f ailure would impair the operator's ability to determine EDG loading and could contribute to operator actions that could overload the EDG.
,
,
The E0Ps required specific equipment to mitigate the consequences of the DBA. The team analyzed the kilowatt ratings of the E0P-required equip-ment, the FSAR-required loads, and the loads that were not shed with a loss of offsite power and safety injection signal. The team found that the EDG exceeded its 200-hour rating of 2963 kW. The severity of this situation was further heightened since the EDG 4-hour rating was only 37 kW above the 200-hour rating. The team was concerned about the load level, since it was unclear if the EDG ratings were conservative and whether or not the EDG could, in' f act, perform its intended safety func-tion in this challenged condition.
Furthermore, such limited load margins did not allow for possible deviations in equipment load characteristics, tolerances in the kilowatt meter, or the addition of other safe shutdown loads for the non-accident unit. Also, there were other loads that the team felt may be needed that were not considered in the FSAR EDG load profile and the E0Ps.
For example, control room air conditioning may be required to both ensure the operability of control instrumentation and for control room habitability concerns. At the time of the team's review, control room air conditioning.was not considered as part of the EDG load profile.
If the control room air conditioning were loaded onto the EDG l
with the E0P-designated loads, the EDG would then exceed its 4-hour. rating (in the case of G-02, it would exceed its half-hour rating) during the DBA.
1'
-
- -
_ _ _.........
...
.
.
.
.-
The team questioned what operator actions would be expected once the EDG loading capacities stated in the E0Ps had been exceeded. The team was told that the operator would probably remove certain loads to reduce the EDG load level. However, the team found that the E0Ps provided no guid-ance to the operator concerning the choice and timing of loads to De removed. The team could not determine that the correct loads would be terminated such that the ability of the plant to mitigate the consequences of the accident in the one unit and maintain the safe-shutdown condition of the other unit would not be compromised.
Furthermore, the team could not determine which of the loads could be terminated based on the current plant oper6tional needs and still provide a reasonable assurance that the consequences of the DBA could be safely mitigated while maintaining the second unit in a safe shutdown condition.
Within the E0Ps that the team reviewed, were reference notes that gave the EDG capacity ratings, cautioned against overloading the EDG, and referred the operator to an appendix table that listed the load ratings of critical equipment. The E0P instructed the operator to refer to these lists'before loading the equipment on to the EDG. The team reviewed two appendix tables and found the equipment load ratings were incorrect and non-conservative with respect to both the FSAR and a recent EDG load analysis (Calculation 0870-103-011) performed by a contractor for WEPCO. The incorrect load ratings could cause operator actions that would overload the EDGs and could result in EDG failure. The team concluded that WEPC0 failed to translate applicable design bases into plant procedures. The applicable requirement is found in 10 CFR Part 50, Appendix B, Criterion III. Thisitemremainsunresolved(seeAppendixA, Deficiency 90-201-03).
,
Based on its findings and observations, the team expressed concerns about the EDG loading and its affect on the &bility of the EDGs to perform their intended safety function. Because of the team's concerns and findings, WEPC0 performed an indepth review of the E0Ps immediately following the inspection. As a result of performing this review, WEPC0 made temporary changes to the E0Ps to provide additional guidance to the operators in managing loads during an accident. The team did not review these corrective measures or other measures taken to addrtss the other concerns discussed above. Pending additional review byWEPC0andtheNRC}.thisitemisconsideredunresolved(seeAppendixA, Deficiency 90-201-04 3.1.2 125-Vdc System Loading The 125-Vdc system consisted of four main battery distribution busses, each powered by a battery charger and each having a station battery as a backup power source. Two swing chargers were also available. The FSAR required the station batteries to be of sufficient size to carry shutdown loads on both units for a period of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following a plant trip and loss of all ac power.
Station battery D-05 had been replaced previously under Modification Package 88-074. The team reviewed Calculation N-89-025, which determined the cell size and capacity for the replacement of D-05. The team found that 21 de loads, such.as diesel generator field flashing, were not included in the battery sizing calculation, and that minor random loads were not addressed as required
-
-
_
_ _ _ _ _ _ _ _ _
._______ ______- _______ - _ -
_ _
_
_
_ - -
.
. - _ - - -..--
-
.
__
.
.
,
e
,
by the Institute of Electrical and Electronics Engineers (IEEE) Standard 485-1983.
In sizing the battery, WEPC0 used this standard and the original duty cycle diagram and load table provided as the design basis by Bechtel in i
1985. However, the load tabulation provided by Bechtel was not detailed in a manner that would allow independent verification of all loads. Only major loads were identified, while other loads were simply grouped.
In sizing the battery, WEPCO correctly modified the original loao table because it found several discrepancies between the original design loads and the actual loads.
In response to the team's concerns, WEPC0 performed a preliminary assessment which showed that the bettery was sized to accommocate these 21 additional loads. WEPC0 stated that it would revise the calculation to address the team's concerns in this area. The team also determined that the battery test h6d sufficient margin to ensure the adequacy of the battery. The team concluded that the incomplete battery sizing calculation constituted a weakness in WEPCO's engineering support program.
3.1.3 Electrical Cable Ampacity and Cable Tray Fill
,
The team reviewed the FSAR to determine the ccble tray fill and cable ampacity derating criteria used in the design. The team also randomly selected cables connected to safety-related equipment to cetermine cable type, ampacity
,
!
derating, routing, and associated tray fill. The team observed that Section l
7.2 of the FSAR required that system cables be derated in accordance with the
>
requirements of the National Electrical Code (NEC). Cable derating is the process of limiting the maximum current a cable will carry in a given ambient temperature to prevent exceeding the cable insulation's temperature rating.
Section 7.2 of the FSAR also limited the fill for power and control cable trays l
to less than 30 percent and instrumentation cable trays to less than
'
40 percent. The team also noted that Section 8.2 of the FSAR provided a conflicting requirement which specified cable cerating in accordance with Institute of Power Cable Engineers Association (IPCEA, currently ICEA)
l_
guidelines. Section 8.2 of the FSAR provided a conflicting requirement which limits the fill to 40-percent for all cable trays. WEPC0 showed the team that
'
the true basis for cable ampacity ratjng and derating criteria was the 1965 National Electrical Code.
Based on the team's review, WEPC0 identified 210 power and control cable tray l
sections and 15 instrument cable tray sections that did not conform to the FSAR
'
and the original design criteria with respect to tray fill and ampacity derating. WEPC0 analyzed all cables contained in one tray, FK07, which demonstrated that those cables had adequate current-carrying capability and
would not exceed their maximum operating conductor insulation temperature.
This determination was made using the methodology for ampacities in open top cable trays from ICEA Publication P-54-440, which is the currently accepted industry standard for cable ampacities. However, use of this standard was contrary to the FSAR comitment and original design basis. WEPC0 stated that all remaining cable tray sections which exceed the FSAR and original design l
criteria would be fully analyzed. Pending additional evaluations by WEPC0 and review by NRC, this item is considered unresolved (see Appendix A, Deficiency 90-201-05).
L
_.
-
-
-
- -
-
-
.
__ _
._
_ _ _
_. _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _ _. __
.
L
..
3.,2 Protection and Coordination
Contractors for WEPC0 had performed circuit breaker coordination studies for
'
i portions of the EDS. However, a full EDS coordination program was scheduled for completion in 1991.
L l
3.2.1 4160-Vac System l
The team reviewed the motor protection scheme, protection criteria, and protec-i tive relay settings for the safety injection pump 1-P15A powered from Class 1E bus 1-A05. The review consisted of evaluating motor data and curves; relay, metering and one-line diagrams; and other data used to calculate and establish the protective relay setpoints. The relays included the instantaneous and long-time phase overcurrent relay (device 50/51), the percentage differential relay (device 87), and the zero sequence ground fault relay (device 50G).
Bus undervoltage and degraded grid relays were also reviewed. The team did not identify any deficiencies or concerns in this area other than the concern with overcurrent relays for the safety injection pumps, which is discussed in
,
Section 3.1.1.2.
3.2.2 480-Vac System The team reviewed several features of the 480-Vac system dealing with-switchgear,and motor control centers. The team selectively evaluated motor starter operation under reduced voltage and a selection of thermal overload relays and heaters for motor-operated valves. Although full circuit-breaker coordination studies were not available, the team reviewed several studies performed by contractors. The team did not identify any deficiencies or concerns in this area.
-
3.2.3 125-Vdc System Short-Circui't Current The team reviewed Calculation N-89-025, which was performed to determine the cell size and capacity for the new station battery (D-06) replaced in 1988 under Modification Request 88-074 The battery was sized on the basis of a conservative 63 'F temperature which represented the lowest recorded electrolyte temperature. However, the team found that WEPC0 had not performed
,
l an analysis-to determine the maximumivsilable short-circuit current from the -
new battery based on the highest possible electrolyte temperature. Based on
!
the team's review in this area, WEPC0 contacted the battery vendor and came to the preliminary conclusion that the maxi.<um available short-circuit current from the battery could be as high as 22,700 amperes. The original design basis was a maximum available current of 20,000 amperes. The team concluded that using the unverified design value and not establishing the maximum available current' constituted a weakness in WEPCO's engineering program.
Pending additional evaluations by WEPCO, this item is considered unresolved (see Appendix A, Deficiency 90-201-06).
Additional problems regarding the 125-Vdc system were previously identified and resulted in NRC Region 111 issuing enforcement action.
In a letter dated November 10, 1989, from C. W. Fay to the NRC on the subject " Request for Discretionary Enforcement Related to Technical Specification 15.3.0.A." WEPC0 reported that a single 125-Vdc train could be lost owing to a fault such as a
short circuit. This condition was caused by the original design's use of circuit-breakers which only had thermal trip devices and did not have magnetic
l
~
.
-- -
- - - _ _........
_,.
_
.
trip devices. These breakers were not capable of interrupting f ault current of the magnitude postulated to occur on the aus. WEPC0 replaced certain breakers feeding comon equipment (such as switchgear normal and alternate supply), thus eliminating the possibility of common-mode failure on both trains.
3.3 Electrical Distribution System Interlocks and Load Sequencing Logic The team reviewed the control logic, eleinentary wiring diagrams, schematics, and certain vendor drawings that described the PBNP design for detection, initiation, and execution of the automatic safeguards loading sequence for loss-of-offsite-power events, inclucing those scenarios involving design basis events. The design attributes of primary interest in the drawing review were (1) acequacy of the logic under design basis conditions. (2) vulnerability to single failure, (3) vulnerability to undetected failures, and (4) independence and separation. The team's findings are discussed in the sections that follow.
3.3.1 Potential Comon-Mode Failures The team identified four deficiencies related to potential comon mode failure of all onsite 4160-Vac and 480-Vac power when offsite power was unavailable, in one of those cases, described in Section 3.3.1.3 below, the common-mode failure could also prevent the supply of power to engineered safety features loacs even with offsite power available.
3.3.1.1 Bus Tie-Breakers for Safety-Related Busses
'
The team identified a deficiency involving inadequate seismic evaluation for a modification to the 4160-Vac safeguards bus tie-breakers. The team was con-cerned that because the breaker was.not seismically restrained in its new configuration, the breaker could disable critical relays and other devices j
mounted in the same compartment during a design basis earthquake. The
- nonseismic configuration was contrary to the requirement of 10 CFR Part 50, Appendix A, GDC 2, " Performance Standards" (see Appendix A, Deficiency 90-201-07).
In response to this finding, WEPC0 removed the tie-breakers from the switchgear compartments and secured them in a storage area. The team asked WEPC0 to confirm that this new configuration would not compromise any actions such as those required by their comibnents to 10 CFR Part 50, Appendix R, since WEPC0 indicated that it would b.e difficult to reinstall this breaker.
The team also identified a deficiency concerning the single failure of the safeguards 480-Vac bus tie-breaker. The team recognized that a spurious closure of the tie-breaker between the redundant safeguards busses could connect the redundant diesel generator outputs when the voltages are out of phase, resulting in a potential loss of all onsite power from a single event.
The team identified at least one such mechanism for this initiating event.
In response to the team's concern, WEPC0 performed both a 10 CFR 50.59 evaluation and a failure analysis. WEPC0 removed the control power fuses to disable the control circuit and preclude the effects of single electrical failures.
However, the team was then concerned that, with the breaker circuit in this new configuration, breaker position would no longer be remotely monitored since control power had been removed. Consequently, the breaker could be closed manually at the switchgear (tieing the busses together) and this condition could remain undetected. Should the plant lose offsite power, both onsite
-
. - - -.
.... - - - -- - -
.
-
-.
.
.
- -... - -
,
,
sources would be connected and all 4160-Vac and 480-Vac power could be lost.
The relevant requirement is found in GDC 39.
This item is considered unresolved (seeAppendixA. Deficiency 90-201-08).
l Another deficiency involved the 480-Vac safeguards bus tie-breaker.
The team i
determined that two of the redundant control cables were incorrectly classified i
as nonsafety-related and that they connected the train A and train B switchgear
by sharing comon raceways for the entire route. This was not in accordance j
with the FSAR criteria for cable separation.
Resolution of the tie-breaker single-failure deficiency previously describea may also resolve this item.
Pending additional actions by the licensee, this item is considered unresolved (see Appendix A, Deficiency 90-201-09). A more general deficiency regarding c6ble separation is discusseo in Section 5.1.1 of this report.
3.3.1.2 Component Cooling Water Pumps The team identified a deficiency that involved the component cooling water (CCW) pump motor circuit-breaker control circuit.
Portions of the 125-Vdc control wiring for train A and train B pumps shared the same raceway. Although the CCW system was not considered safety related in the original design of the plant, the system provided vital support to safety-related system components.
The plant was in the process of upgrading the system to safety-related status
-
and was treating the system eccordingly. The team identified that a single failure could disable the control circuits of both CCW pumps. The licensee had been unaware of this potential for failure.
This item is considered unresolved pending additional WEPC0 actions (see Appendix A, Deficiency 90-201-10).
The team identified a second deficiency regarding components in the control
'
circuits of the feeder breakers for the CCW pump motors. A common relay that distributed a start signal to both!CCW pumps was located in a nonsafety-related i
cabinet. Therefore, WEPC0 could not demonstrate the relay's seismic qualifi-cation. Since the relay and cabinet were similar in structure and config"ra-tion to the qualified safeguards relays and cabinets, the team expected that qualification can be demonstrated if supporting documentation is provided.
However, an ongoing industry study by the Seismic Qualification Utility Group (SQUG) may resolve this issue. This item remains open until the licensee demonstrates that the component and related circuits and structures are qualified for use in a safety-related circuit (see Appendix A, Deficiency 90-201-11).
3.3.1.3 DC Control Power Switches WEPC0 was unable to produce analyses demonstrating the seismic qualification of knife switches used to connect alternate de sources for switchgear control power. The knife switches were mounted on the vertical panels of the switchgear, were normally in the up position, and were only secured by the friction forces necessary to ensure sufficient electrical contact.
If the switches shook loose, all de control power would be lost to the switchgear busses, and all automatic and remote control would be disabled for engineered safeguards and safe-shutdown loads. This would render the automatic load sequencing and remote manual control inoperable, even though offsite and onsite ac power were available. The relevant requirement is found in GDC 2.
This item is conridered unresolved (see Appendix A. Deficiency 90-201-12). WEPC0 was in the process of qualifying this configuration, and comitted to take necessary corrective actions if the qualification proved unsuccessful.
-
.
i
.-
3.3.1.4 Diesel Generator Output Intericcks The team identified a deviation f rom the FSAR comitment to provide a voltage interlock on the diesel generator output breaker. WEPC0 committed in the FSAR that the EDG breaker would not close until the generator reached rated output voltage. This requirement was also reflected on WEPC0 logic diagrams reflecting a typical industry practice for generator output breaker closing logic. A speed interlock (also required by the FSAR) was provided, but no voltage interlock or sensing device existed.
In the absence of the voltage interlock and any supporting documents such as a transient load analysis and periodic testing, it was uncertain that the diesel generators would be at the proper voltage before breaker closure on an automatic start ano load sequence.
This was of particular concern to the team because significant loads were immediately connected to the diesel generator when the output creaker closed.
WEPC0 presented a test performed in 1974 to show the EDG output voltage when the breaker closed.
However, the test data was not completely auditable.
In response to this deficiency, WEPC0 comitted to perform a representat1Ye test the week of April 9,1990, and was also analyzing the adequacy of the current design with the consultation of the diesel generator vendor. Pending completion of these actions, this item is considered unresolved (see Appendix A, Deficiency 90-201-13).
3.3.2 Drawing Discrepancies During its review of a significant sample of drawings, the team identified two separate errors on a safeguards wiring diagram and on an elementary wiring diagram for the diesel generator. The first error was a discrepancy in terminal identification of external connections for an alarm circuit in a safeguards logic cabinet. The ala'rm circuit function was shown two different weys on two different sheets of the drawing, and the terminations were identified differently. The discrepancy was between Sheet 8 and Sheet 15 of Westinghouse Drewing 110E163, WEPC0 stated and the team agreed that Sheet 15 was functionally correct.
The team identified a second error on'the elementary wiring diagram for the emergency diesel. Terminals 6A3 and %A4 in a safeguards rack were incorrectly identified as terminals A3 and A4 on Sheet 1508 of Wiring Diagram 499B466. The cross-referenced safeguards drawings showed the terminals correctly, and the circuits would presumably not test successfully if wired incorrectly.
The team verified that the installed wiring was correct in both insmce.
During the inspection, WEPC0 initiated a nonconformance report (NCR) to correct the first error and the team understood that WEPC0 would also correct the second error.
3.4 Safety-Related 120-Vac Instrument Power System
- The 120-Vac instrument power system supporting both units consisted of 16 busses divided among 4 channels. Each of the 4 channels was allocated 4 busses which were subdivided further into 2 bus groups, one group serving Unit 1 and the other group serving Unit 2.
Each channel could obtain power from three inverters. One inverter was dedicated to the Unit 1 bus group and a second
_
__
_ _ _ _ _ _ _
_ _
__
_. _
__
_.
.
,
inverter was deoicated to the Unit 2 bus group. The third inverter was a backup which could swing between the Unit 1 and Unit ? busses of the same channel. WEPC0 used the third inverter to provide power to the bus while performing maintenance on the inverter that was normally connected to the bus.
The team performed a cursory review of the 120-Vac instrument power system.
This review included the major Modification E-206, " Upgrade of Power Supplies to Instrument Busses," installed in 1985. This modification added inverters, regulating transformers, distribution panels, and cabling for two instrument bus channels. The team also reviewed specifications and ratings for the new inverters as well as the maintenance history of the original and new inverters.
Althoughnolimitsforderipple(remainingaccomponentafterrectification)
were initially specified for the inverters (or for new battery chargers installed on a different modification), WEPC0 stated that the specifications were later evaluated and ripple limits were established.
WEPC0 reported that subsequent tests were conducted to confirm that actual ripple was well below the specified limits. WEPC0 also stated that it had not changed any channel assignments for safety-related instruments, except for a small number of indicating channels that were reassigned in response to NRC requirements.
The team concluded that the addition of the two batteries and two inverter groups resulted in a distribution configuration that should substantially improve instrument bus reliability and availability relative to the original design. However, the team identified a significant concern regarding control of the inverter dc input low-voltage shutdown setpoint. This concern is discussed in Section 5.2.3 and Appendix A, Deficiency 90-201-26, of this report. The team also identified several weaknesses in the 120-Vac system, some of which WEPC0 was apparently a'ddressing. These weaknesses are described in the four items that follow.
I
!
O The first weakness the team identified was the absence of requirements for (
surge withstand capability (SWC).in the specification for the new (Elgar Comp WEPC0 had not inverters. WEPC0 appar-
'
ently did not consider standards that were available at the time the
!
specification was developed, such as IEEE Standard 472-1974, " Guide for Surge Withstand Capability (SWC). Tests."
.
O The second weakness identified was a lack of surge protection for the inverters. Several critical components in the Elgar inverters, such as input capacitors, were rated at 500 Y or less, and the team's review of the vendor manual indicated that the inverter design did not include any comprehensive surge protection. Because of switching surges common in power plants, impulse voltages substantially higher than the 500-V ratings may be expected on the de and 120-Vac systems, and could be sufficient to break down dielectrics and semiconductors.
For example, the NRC Office for Analysis and Evaluation of Operational Data (AE0D) Case Study Report C605, " Operating Experience Involving Losses of Electrical Inverters,"
identified electrical disturbances as a dominant contributor to inverter failures. This lack of protection was of particular concern at Point Beach because the FSAR allows for 480-Vac,125-Vde, and 120-Vac control cables to be routed for long runs in the same raceways.
-
-.
---
- - - - - - -
- - - -
'
.
.i.'
The team performed a cursory review of a small sample of maintenance work requests (MWRs) and an MWR sumary list for both the original
,
(Westinghouse)andnew(Elgar) inverters. This review identified a significant number of capacitor and ciode failures (predominantly on the original Westinghouse inverters) as well as unexplained failures. These failures could be indicative of component failures due to voltage impulses.
The third weakness identified was the out-of-specification condition for total harmonic distortion (THD) on the 120-Vac system. An MWR reviewed by the team indicated that the THD that WEPC0 measured in February 1990 on one of the new instrument busses was about 12 percent. The specification
,
limits permitted only 5 percent THD. Although a noteworthy program f or measuring THD on the instrument busses was recently initiated by WEPCO in an attempt to restore the system to within-THD specifications, the team noted that no provisions had been made for monitoring impulse amplitudes.
<
However, the team understood that WEPC0 intended to use the services of
,
one of its groups from off site that was experienced in the monitoring and analysis of power line disturbances, and the team encouraged this effort L
as a supplement to the THD study already under way.
l l
The team noted that the plant computer systems, which were connected to instrument busses only through circuit breakers, might be contributing to the harmonic distortion on the vital instrument busses since the systems likely contained switching-mode power supplies. WEPC0 stated that if isolation was available, it was provided within the computar systems equipment; however, WEPCO had apparently not evaluated computer system
'
'
isolation. The team noted that the circuit breakers only provided fault isolation. The team also noted that other sources of harmonics external
!
to the instrument busses and their loads also could be coupled to the 120-Yac instrument power system.
l The team also found that " isolation transformers" procured for the instru-i ment bus distribution system would only be effective for low-frequency (60 Hz) isolation and would provide little isolation of impulses having fast rise times or higher-order harmonics. WEPC0 had provided regulating
,l'
transformers, without interwindihg shields, as isolation transformers and these transformers will not prov;1de a broad spectrum of isolation.
The team had some other concerns regarding the instrument bus THD being out of specifications:
(1) possible effects on the life and performance of instrument loop power supplies and other components that support the reactor protection and engineered safety features actuation systems instrumentation, (2) possible effects on protection system loop accuracy.
(3) the extent of the THD problem on other safety-related instrument busses, and (4) the potential for common-mode degradation of multiple protection channels. The team recommended that WEPC0 assess these effects in its current THD evaluation.
L
The team identified a fourth weakness with the sizing of cables for the L
120-Vac instrument bus upgrade. WEPC0 stated that cables were sizec to l
the National Electrical Code, but that no documentation was retrievable l
for voltage drop, short circuit, or ampacity calculations. The team
,
l
'
!
_. _ _ ~. _ _ _
. _.
_
_ _ _ _ _ _ _ _ _ _ _
_.. _ __ _
_
..
..
noted that the primary electrical supply cables f rom the inverters were routed from the primary auxiliary building to the cable spreading room cistribution panels; these panels in turn served distribution panels in the control room, computer room, and primary auxiliary building. These long runs of cable could experience greater voltage drops if the THD was too far out of specifications, since voltage drop calculations typically assume a 60-Hz sinusoidal wave with little distortion.
The team concludeo that these concerns represented weaknesses in WEPCO's engineering program.
3.5 Voltage Regulation The team determined, using the methodology presented in Section 6.1.1 of IEEE
!
Standard 485-1983 and the maximum cell float voltage (2.26 V) recommended by the battery manufactiner, that the aximum allowable battery voltage was 133.3 Vdc. The team found that the actual float voltage for battery DOS was l
135 V and station procedures allowed a float voltage higher than 135 V.
Battery float voltages exceeding 133.3 V were not consistent with the battery
'
manufacturer's recommendations or guidance provided by IEEE Standard 485.
NRC Information Notice 83-08 notified the industry that certain components subjected to voltagas above their rated voltage may degrade due to heating and embrittlement. WEPC0 previously had issued NCR N-88-069, which identified that the voltage rating for the close coil circuit in the Westinghouse 4-kV type-DHP-
,
switchgear was exceeded by the high battery float voltage. The team noted that although WEPC0 knew that the 125-Ydc system was on a high float voltage, and I
switchgear close coil ratings were exceeded, WEPC0 conoucted no further evalua-tions of this problem. The team concluded that WEPC0 failed to ensure that applicable design bases were corre,ctly translated into plant procedures and t
!
nonconforming conditions were promptly evaluated and corrected. The relevant l
requirements are found in 10 CFR Part 50, Appendix B, Criteria Ill and XVI.
This item reamins unresolved (see Appendix A, Deficiency 90-201-14).
3.6 Conclusion The team did not identify any areas 1[n which the electrical distribution system would clearly fail to perform its intended design function. However, because the team identified a number of significant design deficiencies, it could not i
determine that the system would function under all postulated design and accident Conditions. These deficiencies included a substantial number of conditions that were susceptible to comon-mode or single-failure vulnera-l bilities.
Many of the team's findings resulted from deficiencies in the original design that had previously been undetected. However, other findings related to plant modifications reflected an inadherence to the Point Beach cesign basis for the electrical systems and equipment. The team found that this condition was caused in part by inadequate design basis documentation and poor design controls for performing proper engineering evaluations and analyses to support
'
more recent modifications. The team found that the FSAR did not comit to any IEEE Standards, and that some modifications were performed without considering
.
- -
.
_
-.
-
__
_
__.
___
__. _ __ _
__
_.
_ _ _ _ _
_. _ _ _ _ _
'4
-
..
industry accepted standards. The team also believed that the small size of the engineering staff may also contribute to the incomplete engineering for modifit.ations.
With respect to design basis documentation, the team ncted that WEPC0 had only recently completed a steady-state loading shalysis of the emergency diesel generators, and a transient analysis did not exist. The team found that the l
EDGs would be operating with little or no margin with respect to steady-state i
loading, and that there were additional loads (some specified by the emergency operating procedures and some that were not) which were not included as EDG loads in the load calculation. The team found that this issue must be evaluated in detail to ensure that the diesel generators are capable of starting and carrying all required loads. Also, the team found that a transient analysis of diesel generator loading should be conducted.
L Regarding the unavailability of calculations, ANSI Standard N45.2.11-1974,
" Quality Assurance Requirements for the Design of Nuclear Power Plants,'
to which WEPC0 is committed, specifies that design analyses be sufficiently detailed so that the adequacy of their results can be determined without
,
!
recourse to the originator. The team recognized that several WEPC0 programs l
offered the potential to address the concern regarding a lack of design documents and information. However, these were new programs still in a
,
L preliminary stage.
l 4.0 MECHANICAL DESIGN REVIEW l
-
The team reviewed and evaluated the adequacy cf design for selected mechanical systems that supported the electrical distribution system. The team reviewed l
l in detail engineering, licensing, and other documents, and inspected systems i
and components. The types of documents reviewed included (1) the FSAR and Technical Specifications, (2) sele'cted modifications and safety evaluations associated with the emergency diesel generators (EDGs) and associated mechani-cal support systems, as well as heating, ventilating, and air conditioning tions, (ystems for electrical equipment rooms, (3) mechanical systems calcula-(HVAC)s4) drawings, (5) EDG manufacturer technical manuals, and (5) WEPC0 responses to NRC bulletins and information notices on EDGs and support systems.
4.1 Emergency Diesel Generator Fuel bil System The team identified several oeficiencies with the fuel oil and fuel oil trans-l l
port system for the emergency diesel generators at PBNP.
l l
4.1.1 Seismic Condition The PBNP Technical Specifications and basis for availability of the EDGs required that 11,000 gallons of fuel oil be available. WEPC0 commitment during original licensing was that this capacity would be available in a seismic Category I structure, the emergency storage tank.
However, the fuel oil transfer system that transports the fuel oil from the emergency storage tank to the EDGs was only partially qualified as Category 1.
WEPC0 was in the process of analyzing the piping located in the fuel oil pump house and preliminary results indicated that the piping stresses were above ASME Code allowable i
values. WEPC0 planned to modify system supports, but did not yet have any
,
.-
--
-
-
-
-
..
..
-
.-. --
--- _ - - - -
.
-.
-
.
.
detailed calculations that the team could review. WEPC0 indicated the piping in the EDG rooms was originally installed according to architect / engineer handbook methods for installing seismic small-bore piping, and was, therefore, qualified. However, again WEPC0 did not have any calculations that supported the seismic adequacy of this piping. The team was concerned that the nonseismic condition of the fuel oil system could interfere with the avail-ability of the fuel oil in the emergency storage tank under design basis conditions.
After considering both the team's concerns and additional information, WEPC0 performed a more detailed evaluation of the fuel oil system immediately after the inspection. WEPC0 determined that the system was inoperable and modifico the piping supports before declaring the system operable.
Pending review of WEPC0's corrective actions, the NRC considers this item unresolved (see Appendix A, Deficiency 90-201-15).
4.1.2 Quality of Fuel Oil The team reviewed records of test results of fuel oil purchased for the EDGs as well as for several items that were not classified as safety related. The
,
'
review revealed that the cloud point of the fuel oil had always exceeded (by 12 to 22 'F) the maximum recommended by the American Society for Testing and Materials (ASTM)StandardD975.
In 1980, WEPCO comitted to purchase oil to this standard. Records indicated that, although in some cases W2PC0 had noted the excessive cloud point, nothing was done to rectify the problem.
In extremely cold weather, a high cloud point could interf ere with the ability of the fuel oil (1) to drain down directly to the EDGs to meet an Appencix R scenario,-(2) to replenish the enwrgency storage tank, and (3) to flow to the gas turbine required to operate during a station blackout. The records also indicated that WEPC0 was aware of the discrepant condition with the fuel oil quality but had not taken correctiye actions. The team concluded that WEPC0 failed to take corrective actions. The relevant requirement is found in 10 CFR Part 50, Appendix B, Criterion XVI. Thisitemisunresolved(seeAppendixA, Deficiency 90-201-16). WEPC0 made an incorrect presentation as to the safety significance of the finding at the exit meeting, apparently due to a misreading of temperature units in the ASTM standard.
Upgrade to Safety-Related andhA Status 4.1.3 The team reviewed WEPC0's docunented evaluation of NRC Information Notice (IN) 89-50, " Inadequate Emergency Diesel Generator Fuel Supply." WEPC0 was unable to show that PBNP met the IN recommendation for a 7-day supply of fuel oil
,
'
because of inconsistencies in the FSAR and Technical Specifications and a lack of a cocumented design basis for fuel oil capacity. The team noted that WEPC0 proposed in the evaluation several action items regarding the adequacy of the fuel oil supply.
In its review of fuel oil capacity, the team was informed by
,
WEPC0 that the fuel oil system was not classified as safety related; however, WEPC0 indicated that it planned to upgrade the system to a safety-related status.
It was the team's position that because the system performed a safety l
function, it should have been classified as safety related. The team found
,
l that WEPC0 did not have a procedure to implement such an upgrade, but planned l
to use a process similar to one used in a previous upgrade of the spent fuel
!
pcol. The team concluded that WEPC0 failed to describe activities affecting i
l'
l
l
__.
.
. _ _ _ _ _ _ _ _ _ _
.
.
.
The team also reviewed several fuel oil system nodifications that WEPC0 per-forr.ed in the early 1980s. The modifications had not been classified as QA.
,
Although the fuel system between the emergency tank and the EDGs was not classified as QA at the tine of the modifications WEPC0 had subsequently upgraded the system to QA status. The team requested the documentation of the upgrade including the relevant procedure. The team was told that no procedure for implementing such an upgrace had been available during the period when the upgrade was performed. The team's review of the specific modifications revealed that WEPC0 could not produce QA-required records for material procure-ment and installation. The team concluded that WEPC0 failed to maintain suf ficient recoros to furnish evidence of activities affecting quality. The relevant requirenent is founo in 10 CFR Part 50, Appendix B, Criterion XVll.
This item is unresolved (see Appendix A Deficiency 90-201-18).
4.1.4 Fuel Oil Delivery Under Emergency Conditions The team reviewed Procedure PBNP 4.12.22, " Fuel Oil Ordering, Receipt & Sample Disposition Instruction " Revision 13, dated October 30, 1989. The procedure provided the method of Yuel delivery to one emergency diesel generator should the normal method for transferring fuel oil be unavailable. The team found several deficiencies with the procedure that related to fuel oil delivery under energency conditions:
A large number of staggered truck deliveries might be required with short intervals to accomplish the required operations. For example, one 7,000-gallon tank truck would be required overy 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> if the only user of the fuel oil were the one diesel generator.
O The current contractual agreement with the fuel supplier did not require a 7-day inventory at the supplief's premises, or delivery of No.1 Grade fuel oil during winter months as required by the procedure.
O A barreling nozzle and 150 feet of companion hose needed to supply the EDG day-tank, and required by the procedure, are not available on site and are not a requirement of the contractual agreement with the fuel supplier.
Until WEPC0 solves these problems, the staff considers this item unresolved (see Appendix A, Deficiency 90-201-19.).
.
l The original design of the fuel oil system could not deliver oil to the EDG day tanks in cases:of control room inaccessibility or fire in the fuel oil pumphouse. These emergencies could incapacitate both fuel oil transfer pumps.
WEPs,0 had nodified the system piping to bypass the fuel oil transfer pumps and I
to deliver fuel to the EDG day tanks by draining fuel down from the outside storage tanks to address these contingencies under the requirements of 10 CFR Part 50, Appendix R.
By performing a calculation and a test, WEPC0 had estab-11shed the feasibility of this approach. The team reviewed the feasibility of the Appendix R scenario and had concerns with WEPCO's calculation and test results of the approach.
O The calculation used a single fuel density and viscosity for the whole system. Parts of the system were above ground level and exposed to the elements, while part of the piping buried underground was above the frost line.
1
.
.
_-.
.
-.
.
.. -. _ _ _ _.-
-.
_- -
. -.
.
..'
O Very low temperatures will substantially impede and even stop the flow of the No. 2 Grade fuel oil currently used in the piping connecting the-outside storage tanks to the emergency tank. WEPC0 recently experienced difficulty starting its gas turbine in cold weather. The difficulty may have been caused by the quality of the fuel 011.
O WEPC0 made no provision for providing fuel oil to the plant's diesel fire pump day tank.
O Fuel system isometric drawings and calculations for normal flow did not exist.
O Draining will require appropriate valve lineup as well as establishing the siphon. Access to the valves following a fire in the fuel oil pump house would require retrievel and use of a portable pump stored at another location. WEPC0 could not demonstrate that these actions could be effectively implemented in a timely manner and did not include the location and use of the portable pump in the associated procedures.
Pending(additional review by WEPC0 and the NRC, this item is considtred unre-solved see Appendix A, Deficiency 90-201-20).
4.2 Heating, Ventilating, and Air Conditioning Systems 4.2.1 Battery Room Heating The amount of-heat required to keep the temperature in the battery room: within 5 degrees of 77 'F was computed in Calculation N-88-033. This calculation was performed as part of Modification Request 87-156. Local heaters were recently installed to implement this modifi. cation. Since the installation, WEPC0 had detected that the temperature in the battery rooms had not been uniform.
In a memorandum dated March 20, 1990, WEPC0 identified that the problem had been caused by the inappropriate location of the heaters and recommended removing the existing heaters and installing heaters in the cold air supply duct. The recommendation was made because the ventilation air was supplied at 45 'F, a temperature substantially lower than 4he desired temperature of 77 *F.
The
,
team concluded that the modification.was ineffective and represented a weakness in-the modification program.
- 4.2.2 EDG Room Heating, Ventilating, and Air Conditioning WEPC0 documented its evaluation of NRC Information Notice 87-09, * Emergency Diesel Generator Room Cooling Design Deficiency," dated February 5,1987, in NEPB-87-536, dated June 29, 1987, by identifying several deficiencies and recommending solutions to six items. WEPC0 indicated that the maximum tempera-ture permitted in the EDG room would be exceeded (by 6 'F) and considered this small deviation acceptable.
However, in an internal audit subsequently per-formed, WEPC0 found this higher temperature unacceptable since exceeding the maximum temperature rating could substantially degrade the performance of the diesel generators.
.
.
.
_
. _ _
_ _. _ _ _ _
_ __
_ _ _ _ _ _ _ _
_ _ _ _ _
.
'
Additional work established a more accurate maximum temperature for the EDG rooms. Work Maintenance Temporary Procedure (WMTP)-9.22 was used to more accurately define several parameters of the room temperature calculation under various conditions.
Using the results of WMPT-9.22, WEPC0 performed Calcula-tion N-88-034 to derive generator heat losses for the various conditions.
Finally, WEPC0 used the minimum diesel generator heat losses of Calculation N-85-034 in Calculation h-88-040, which established that tht, uax..w oom temperature would be 118 'F, only 4 'F below the maximum temper W N
,
recommended by the diesel manufacturer. However, the conoition tora fr i
operating) used in N-88-040 was not one of the conditions anema in
--034 The team also noted that the minimum heat losses used in N-88-040 m; y,>roxi-mately one-third of the losses recomended by the EDG manufacwrer. Eis nonconservative heat loss resulted in a lower maximum ambient t w Sr<ture.
,
The team did not have enough time to verify WEPCO's justification for its use of the nonconservative heat losses. But because the team found that the loading of the EDGs was marginal and that operating the diesels in an ambient temperature above the maximum recommended could reduce the EDG's capacity, this I
item remains unresolved pending further review by the NRC (see Appendix A, Deficiency 90-201-21).
'
4.3 Conclusion
l The team's review of mechanical systems design raised significant concerns regarding the ability of the emergency EDG fuel oil system to provide fuel to the EDGs unoer all design conditions. The team found that the complete system was not seismically designed and installed.
In addition, the fuel oil storage and supply system required by plant. Technical Specifications was not considered by original design to be a safety-related or QA system and the licensee's programs for upgrading the systems were not documented. The team also found that the fuel oil being purchased by the plant did not meet the appropriate requirements for quality and, under certain conditions, may not be able to reach the diesel generator day tanks.
WEPC0 was already aware of each of the team's major concerns. However, it had either not fully evaluated the issue t>r not fully understood the significance.
,
For example, WEPC0 had evaluated the seismic condition of the fuel oil system
.
and found that although modifications ~ were required there were no concerns with system operability. After a more detailed evaluation based on the team's i
concerns, WEPC0 found that the system was inoperable. WEPC0 was also aware of I
the high cloud point for the fuel oil but had not issued a nonconformance l
report nor fully evaluated the deficiency. Such an evaluation was particularly
'
important because, for certain plant conditions, WEPC0 was relying on a gravity drain supply and the feasibility of the gravity drain process under cold weather conditions was not well supported. These are further examples of weaknesses in WEPCO's engineering support.
'
5.0 SYSTEM CONFIGURATION AND TESTING REVIEWS The team reviewed installed portions of the EDS and associated subsystems. The review included walkdown inspections of various safety-related electrical components and an assessment of the associated procedures, maintenance orders, instructions, and drawings.
In general, the cleanliness and quality of plant
.
- -
- - -
-
-
.
.
-_
_ _
_ _ _
__
_
__
_ _ _ _ _
_
_.__ _ _ __ _ __ _
N
.
installations were acceptable. Electrical system components and associated hardware were in good condition and gave evidence of conscientious maintenance
.and housekeeping activities. The team, however, did identify severel specific design, testing, and installation deficiencies. These issues and pertinent responses from WEPC0 are discussed in the following sections.
5.1 Equipment Walkdown Inspections The physical welkoown of plant equipment consisted of an examination of selected components within the EDS. The team compared the installed configura-tion of these components with the requirements of design documents for such attributes as location, orientation, system interface, rating, type, and size.
Additionally, the team reviewed maintenance and calibration activities associated with the selectea equipment.
5.1.1 Separation of Redundant Division Cables The team examined the installation of Class 1E cables associated with portions of the EDS and identified a number of cable installations which did not comply with the requirements of Sections 7.2 and 8.2 of the FSAR. These two sections prohibited the routing of redundant Class 1E cables in the same raceway. The team noted that three Class 1E cables in conduit JJ-1 had been routed from l
division A cable tray JJ11 to division B cable tray JE02, thus resulting in division A circuits routed through both division A and B cable trays. WEPC0 indicated that, although this routing was not consistent with the FSAR commit-l ment, the subject circuits no longer perforned a safety-related function and l
that the condition appeared to be the result of a construction error. The team
,
then asked WEPC0 to search the PBNP computerized cable database in order to t
determine if additional deficiencies ~ existed with respect to cable separation.
The resultant computer report inoi,cated that 25 raceways contained cables of redundant safety divisions. The team concluded that these installations did
. not meet requirements for system redundancy and separation. The relevant requirements are found in GDCs 20 and 23. Thisitemremainsunresolved(see Appendix A, Deficiency 90-201-22).
The team also asked WEPC0 to perform a functional analysis of the affected l
Clast IE cables to determine if any potential conditions for comon-mode
,
failure existed. During the inspection, WEPC0 was able to complete a partial review of the 25 raceways and associated cables.
From this review, WEPC0 cetermined that cables ZC2NA0120 and 202NA0128, which were redundant division cables for the automatic start circuit for the Unit 2 turbine-driven auxiliary feedwater pump, had been r a ted in the same conduit. These circuits sense an undervoltage condition on the redundant 4160-Vac busses 2-A01 and 2-A02 to initiate an automatic start signal which opens steat supply valves 2-2019 and 2-2020 to the auxiliary feedwater pump turbine. Thus, a single failure of any
,
cable within the conduit could impact redundant control functions and defeat I
the undervoltage automatic start signal for the auxiliary feedwater pump.
After this concern was identified, WEPC0 issued NCR N-90-058 to document and correct this deficiency and placed Unit 2 in a Technical Specification limiting conditionforoperation(LCO). The team concluded that this installation violated the requirements for redundancy and separation. The relevant require-ments are found in GDCs 20 and 23 This item remains unresolved (see Appendix A. Deficiency 90-201-23).
.
,
-
. - -
_ _
-
- - - - -
-
- -
- - -
The team also identified several nonsafety-relatec cables which were routed i
through both divisions of engineered safety features raceway.
Exaniples of this deficiency included:
Nonsafety-related circuits in cable tray C009 were routed through division A cable tray CQ14 and division B cable tray CQ08.
)
Nonsafety-related cable 04102A was routed from division A cable tray JJ11 to division B cable tray JE02.
The team noted that the configurations observed were not directly prohibited by the FSAR, which permitted routing of non-Class IE and Class IE cables through the same raceway. However, the team found that the intent of 10 CFR Part 50, Appendix A, GDC 39 and prudent engineering practices would avoid bridging redundant Class IE raceways with non-Class 1E circuits.
The team also was concerned about the accuracy of the computerized raceway loading and cable routing program. WEPCO's response to cable routing deficien-cies inoicated that conduit JJ-1 contained only three cables.
However, on inspection of the conduit, the team found thct two additional cables were present which were not shown on the coniputer database. Several additional errors were noted during review of this database.
However, WEPC0 did not commit to evaluating the database for errors.
5.1.2 Cable Damage During a walkdown inspection, the team observed that a condensate receiver tank
'
'
vent was venting steam cn to safety-related cable trays JE06, JE07, FV12, and FV13, The team inspected the cables in the affected trays and noted that the jackets of a number of single conduc' tor cables showed signs of deterioration I
and, in one case, the jacket had ppeled back, exposing the inner insulation.
Other cables in the trays were di nolored. The team cuestioned WEPC0 and determined that the licensee was aware of the venting steam and that the l
condition had existed for many years. However, WEPC0 had not investigated the effect of the steam on the safety-related cables. A deterioration of
'
safety-related cables could result in cable faults and could prevent the end devices connected to the affected cables from performing their intended safety I
functions.
,
'
I l
As a result of this finding WEPCO inspected the cables and deterinined that the most reverely daninged cables were connet.ted to nonsafety-related loads. WEPCO also stated that the remaining cables were safety related,ly following the were within one trein and showed no obvious evidence of damage.
Innediate inspection, WEPCO issuea NCR 90-056 to evaluate the cables and determine what actions to be taken.
In the interim, WEPC0 stated that it intended to wrap the affected cables in an effort to com>ensate for insulation damage and to l
minimize any further effects from tie steam. The team concluded that WEPC0 failed to prceptly identify and correct a known nonconforming condition with a safety-related installation. The relevant requirement is found in 10 CFR Part 50, Appendix B, Criterton XVI. Thisitemremainsunresolved(see Appendix A Deficiency 90201-24).
l l
-_
- - - -
.. -
-
.
-
. _.. -
--
_ - -
- - -
- _-
. - _ _ -
.
_ _ - -
--
s
,
5.1.3 Switchgear The team performed a walkdown inspection of vital 480-Vac and 4160.Vac switchgear. The team also examined portions of the 125-Vdc system including station batteries, associated static inverters, and dc distribution cabinets.
On the basis of this examination, the team concluded that vital switchgear components have been installed in accordance with requirements. However, the ta&m identified a deficiency in the 125-Ydc system. Output breakers 72-104 and 72-204 for battery charger D-09 could be closed at the $4me time, thus
connecting redsndant vital batteries D-05 and 0-06 electrically. Although simultaneous c10hure was prohibited by Procedure 01-33 WEPCO, by letter, had committed to the NRC in 1980 to install a mechanical interlock between the circuit breakers.
The licensee planned a modification to install the interlock next year. The team concluded that WEPCO's untimeliness in implerenting the
'
commitment was another example of a weakness in WEPCO's engineering support program.
5.1.4 Transformers and Tap Settings
'
The team performed a walkdown of the main power transformers, station auxiliary transformers, the 460-Vac, and 4160-Vac transforners. The team reviewed transformer tap settings and physically verified tap configuration on the
,
460-Yac and 4160-Vac transformers. The team found no deficiencies or other concerns in this area.
5.1.5 Motor-Operated Valves
,
i The team examined three safety-related velves and associated wiring during the intpection. 1he examination compare.d installed configuration with the require-sents of applicable piping and instrunentation diagrams, schematics, and wiring l
Otagrams. The team noted that WEPCO's program for maintenar.ce and testing of I
motor-operated valves (MOVs) had greatly benefited from a knowledgeable and j
dedicated engineering staff.
Interviews with PBNP engineering personnel demonstrated a thorough understanding of MOV operation, r.omponent weaknesses, l
j and the actions requireo to ensure reliable component operation.
The examination of safety injection section blast valve 151-8260 disclosed a oeficiency in wiring of the actuator limit switch. Detail MM of Connection Diagram E-98, Sheet 10 Revision 12,16howed a jumper between limit switch rotor 1 (terminal point 1C) and rotor 3 (terminal point 110). The jumper in question provided valve position indication to the control room. The team observed that this jumper had not been installed.
in response to this observa-tion WEPC0 indicated that an NCR would be written to document the deficiency and install the missing limit switch jumper. WEPC0 also noteo that position for this valve was indicated through the open side of the actuator torque switch. This was confirmed by the team through examination of valve position indicator lights in the control room. The team concluded that the missing jumper, although an installation deficiency, was of minimal safety significance and WEPC0's commitment was sufficient to resolve the problem.
j residual heat removal system heat exchanger) and ISI-825A151-871B (containment The examination of valves refueling water storage tank to safety injection pump) disclosed no additional deficiencies.
--
._
- - -
--.
-
-
--
-
- - - -
. _
.
.._.- -. -...
.. -,
- - -
- - - - -
.
D 5.1.6 Pump Motors The team reviewed installation and maintenance of the motors for the component cooling water pump 1-P11A, safety injection pump 1-P15B, and charging pump
,
i 1-P2B. The team compared nemeplate data for modt) number, horsepower, service i
rating, insulation class, voltage, and current with the requirenents of 6ppli-cable design docunants. The team also reviewed pump and motor
>erformance curves supplied by the manufacturer. These reviews indicated tiet the subject pump motors were adequately sized f or system requirements and that routine maintenance activities had been consistently implemented.
The team did not identiQ any deficiencies or other concerns in this area.
5.1.7 Emergency Diesel Generators The team reviewed maintenance and test activities associated with EDGs G-01 and G 02. The review focused upon both historical and current work activities in
>
order to gain a thorough understanding of EDG performance and reliability. The team a ho examined WEPCO's evaluation of several NRC information notices relating to maintenance and operation of plant EDGs.
In general, the team considered these evaluations to be technically sound and confirmed that correc-tive actions, when required, had been properly implenented. After reviewing these activities, the team concluded t1at the EDGs had been installed ano maintained in accordance with maintenance requirenents.
The team also monitored WEPCO's performance of the EDG biweekly test, TS-2.
Specific observations relating to this test are found in Section 5.2.4 of this report.
5.2 Equipment Testing
-
'
5.2.1 Circuit-Breaker Testing
-
The tvam reviewed WEPC0 programs for >eriodic testing of circuit breakers. All 480-Vac Westinghouse DB-25, 50, und 75 safety-related ctuuit breakers and the 4160-Yac breakers were tested annually; however, molden caso circuit breakers were not tested periodically. The team reviewed the PM task sheets, which are part of WEPCO's Computerized History and Maintenance Planning 3ystem (CHAMPS),
l The PM task sheets contained the "Callup Instructions," which stated to
,
" inspect, maintain, and multi-amp [ current test) breakers, per Westinghouse Bulletin 1B33-850-3C." The team noted that the Westinghouse instruction did not include procedures for circuit breaker overcurrent testing. WEPC0 stated that overcurrent testing was performed in accorcance with procedures contained in the technical manual for the Multi-Amp current tester and acceptance crite-ria were contained on data sheets kept by the electrical foreman. Each specific breaker had a corresponding data sheet with test and acceptance criteria for trip currents and times that were provided by the engineering organization. Although the team reviewed several completed data sheets and found no specific deficiencies, it considered it prudent to develop a formal test procedure.
In aedition, it was unclear as to what future periodic testing would be performed after the modifications to install Amptector trip devices into all Westinghouse 0B-25, 50, and 75 circuit breakers are complete.
l
--
_ _ - _
__
_
_. _ _
_
. _ _
_. _.
_ _ _ _ _ _ _
_ _ _ _ _ _. _. _ _. -
.
.
As a result of these concerns, WEPC0 provided draft co)ies of procedures for performing overcurrent testing using the Multi-Amp mac11ne and for performing testing using the Amptector. These procedures were already under development at the start of the inspection and were not reviewed by the inspection team.
The team also expressed concern that no periodic testihD has being performed on
,
molded case circuit breakers. Trip times for these breakers can change as a result of changes in lubrication and spring constants.
An unidentified change in performance of these breakers could compromise the plant's protective
coordination scheme.
However, the team recognized that the NRC has no requirements for testing molded case circuit breakers although some licensees are identifying certain safety-related molded case breakers for periodic testing.
5.2.2 Relay Calibration The team reviewed the documents and procedures relative to the calibration of key safety-related protective rtleys at PBNP. These relays included the 4160-Yac undervoltage relays, the 4160-Vac degraded grid voltage relays, and the 4160-Vac overcurrent relays.
From this review, the team determined that although the relays were apparently being calibrated atriodically, these calibrations were being performed by a non-nuclear WE)C0 organization located in Appleton, Wisconsin. As a result, the calibrations were not being performed in accordance with a nuclear QA program. The team found deficiencies in the areas of procedures, calibration tolerances, calibration test equipnent, procurement, and trending. The tean: concluded that WEPCO f ailed to properly document and control activities affecting quality. The relevant requirements are found in 10 CFR Part 50, Appendix B, Criteria IV, V90-201-2$)andXI.
This item remains unresolved (see Appendix A, Deficieacy
.
$.2.3 120-Vac Inverter Surveillance The team performed a walkdown inspection ano reviewed associated surveillance l
procedures for the Westinghouse and Elgar inverters. The team found that Routine Maintenance Procedure (RMP) 36 for the Westinghouse inverters was
'
generally adequate, except for the fact that inverter output escilloscopic traces were being manually recorded on data sheets. The tear found that this method was inaccurate and did not lend itself to easy trend {t,g or evaluation of the output data, in addition, the team identifitd several deficiencies with
RMP-45 for the Elgar inverters. First, this procedure did not require that the oscilloscopic output traces be recorded. Second, the procedure did not include l
a check or a calibration of the inverters' low-voltage shutdown circuit. This I
circuit could prematurely shut down the inverters and should be checked at regular intervals. The team concluded that WEPC0 failed to translate all design information into site procedures. The relevant requirement is found in 10 C:R Part 50, Appendix B, Criterion 111. This item remains unresolved (see Appendix A, Deficiency 90-201-26).
5.2.4 Emergency Diesel Generator Testing The team monitored the performance of the biweekly EDG test TS-2. This test assessed the operational readiness of EDG G02 and fulfilled testing require-ments for diesel air valves CV-3050A and CV-3058B, as required by Section XI of the ASME Code. The test placed EDG G02 in an exercise mode and initiated a cold start and 1-hour run of the diesel engine. The team monitored test l
_, _ ____ _ _ _ _
_.
..
.
-
.
.
I
'
activities from the control room and at the EDG. The team noted that sta tion operators had properly reviewed and verified the test prerequisites descr bed in TS-2. Aoditionally, the team's review of in->rocess test activities itdi-cated that station operators were f amiliar with EDG test requirerents and thorvugh in their implenentation of those requirenents.
The team identified one concern regarding the verification and signoff of sequential test steps. Test Procedure TS-2 required the signature of only one party bef ore proceeding with additional test activities. This process did not reflect the usual industry practice of a two-party signoff and could lead to equipment damage or personnel injury if test steps were overlookeo or improperly perf orned out of sequence.
5.2.5 Battery Testing The team reviewed the performance and surveillance test activities for vital station betteries. The review included Test Procedure R-5 for service testing of battery D-05 and Maintenance Proceoure RMP-46 entitled " Station Battery."
Aeditionally, the team reviewed acceptance tests associated with the replace-ment of batteries D-05 and 0-06.
No deficiencies were identified with the acceptance tests; however, the team determined that yearly service tests were not currently glanned. Based on a previous Region 111 concern, the NRC staff is reviewing the issue of battery testing requirerents for PBNP.
In addition, the team noted a deficiency in RMP-46: the procedure lacked acceptance criteria for the ground resistence check. The team concluded that, although the procedure provided guidance for measuring and calculating grovna resistance, it did not provide acceptance criteria or limits for the calculated values. The relevant req'uirenant is found in 10 CFR Part 50, Appendix B, Criterien XI. This item remains unresolved (sot Appendix A, Deficiency 90,201-27).
5.3 Equipnent Modifications 5.3.1 Modification of Circuit breakers TheteamreviewedSpecialMaintenanceProcedure(SMP)975furtheupgradeand replacement of the overloads for Westinghouse DB-50 circuit breakers. The old overloads were operated by an air-type diaphragm and are not as reliable as the new electronic Amptector devices being installed. The proceoure contained no specific inst' actions for performing *.he modification but rather referenced Westinghouse lutruction Belletin 33-850-00. The team reviewed the Westinghouse bulletin and found the instructions adequate for completing the work. SMP-975 contained instructions for performing a full-current injection test using the Multi-Amp tester af ter completion of the modification but before the circuit breakert are reinstalled in their cabinets. The test was consid-ered adequate for postmodification testing.
In addition, the team reviewed Modification Request (MR)87-034, which con-tained the engineering proposals, comments, and supporting documents for performance of this nodification. The modification request was found to be thorough; all aspects of the modification were considered, including seismic qualification, coordination effects, and conenercial-grade versus safety-related procurement. The corresponding purchase order (P0 C45129) to Westinghouse for i
_
._ -
- - -. -. -
- -
..
-
.
.
.
i
.
the Amptector overlo6d devices was reviewed and found to contain all pertinent references to Appendix B to 10 CFR Part 50, IEEE 344, and 10 CFR Part 21.
.
Setpoints for t'ie new Amptector overload devices were cetermined by matching
'
'
the settings to those on the previous mechanical overloads.
In addition, sone additional review of coordination was done by the WEPC0 protection engineering division for telected ovvices.
5.3.2 Cable Modifications
'
The team reviewed activities associated with two plant modifications. Modifi-c6 tion Package E-250 provided details for the inst 6114 tion of 6%rical cables and associated racewys within the Unit I containnent building ano implemented the requirenents of several specific plant upgrades, including the containment air temperature upgrade and the core exit thermocouple upgrade. Modification Package E-252 provided similar details for installation o1 cable and raceways within the auxiliary building. A limited review of work activities associated with these modifications disclosed no design or installation deficiencies.
The team noted that the modification packages included design and installation requirements more stringent than those specified in the FSAR. Of particular interest were references to Standards IEEE 384-1974 and IEEE 383-1974 These nuclear industry standards provided guidance for the design and installation of i
systems which require physical independence and qualification of Class 1E equipment and materials. Comitment to these standards suggested that sone recent plant modifications included current industry practices.
,
l 5.4 Conclusion in general, the team found electrica*1 1r.stallations to be adequate. However, the team's examination of the installation and testing of electrical
,
'
distribution system components rev6aled $5veral significant deficiencies. Of particular concern were the deficiencies identified in the routing of Class IE l
l cables. These cable routing deficiencies were violations of the plant licensing requirenents and JSAR connitm6nts. The lack of a proper quality l
prograt for tuting of safety-related relays also was seen as a major l
programmatic weakness.
In addition, the lack of molded case circuit breaker testing could compromise the plant's; protective coordination scheme.
,
6.0 ENGINEERING AND TECHNICAL SUPPORT REVIEW i
6.1 Programs and Procedures 6.1.1 Engineering Interfaces The team reviewed and evaluated the acequacy of the procedures that govern the relationships between the various engineering organizations, both corporate and site.
The team's review included interviews with key personnel. The following major program areas were considered:
O procedure writing and input
procurement and spare parts O
surveillance
Technical Specifications O
maintenance
design
..
- -
-__.
.
.
- -
.-.
- -.
__
--
- -.
- - - -. -
_ - -
- - _. -. - - ~. -. - - -.
.
.
The team found no specific discrepancies in its review of the documented
-
prograr.6 for engineering relationships. However, the team noted a weakness in
,
the proctoure for temporary nodifications during the review of the engineering
!
involvement in design and the related review of the design procedures.
This wtakness is docunented in Section 6.1.2 which follows.
l 6.1.2 Design Procedures The team reviewed and evaluated the adequacy of the design control procedures includin 13, 1989; QP3-2,gQP3-1,"ModificationRequests," Revision 3,datedOctoberDesign Control," R
'
Preparation Review & Approval," Revision 2, dated October 13, 1989; and PBNP
'
4.17, " Temporary Modifications," Revision 12, dated March 23, 1990.
The team found procedure QP 3-1 for nodification requests was complete and that the corporate staff and the plant staff work to the same procedure. The process was considered a strength, since it simplified the often complex engineering relationships between the participating otsign organizations.
However, the team considered the plant's temporary accification procedure, PENP 4.17, to bc weak, since no design organization was responsible for the procedure and the procedure did not prescribe an adequate level of design control.
For example:
The procedure was not enveloped by QP 3-1, * Modification Requests."
l l
Responsibilities and relationships for the eff9cted individuals and l
organizations were not defined-.
l
The initiator of the temporary inodification determined if a 10 CFR 50.59 l
review was remind; QP 3-1 requires the moditication engineer to make that determination.
O The requirements for a technical reviewer were not the same as in QP 3-1; that is, possession of an appropriate engineering degree, appropriate training, and documented basis for personnel qutaification.
'
O The engineering organization may not be involved in specifying installa-l tion int.tructions and did not prtvide the testing requirements or accep-l tance criteria, which are design control items.
6.1.3 Procedures for Upgrading System Status in reviewing the QA status of the fuel oil transfer system, the team found that before November 12, 1987, there were no procedures for upgrading systems from non-QA to QA status. Revision 0 of procedure QP 2-1, " Upgrading of Non-QA Scope Systems or Components to QA-Scope Status," became etfactive on November 12, 1987. The team found this two-page procedure inadequate, providing essentially no guidance for such an u h rade. The team was then given the draft of Revision 1 of QP 2-1.
The team did not review this draft in detail, but noted that it appeared to be a marked improvement over Revision 0.
The team was also given the draft of Revision 0 of Procedure QP 4-2, ' Technical Evaluation of Replacement items." This procedure described requirements and responsibilities for performing part classification, equivalency evaluations, and commercial-grade procurement and dedication. This procedure was to be used in conjunction with QP 4-1, *Procurenent of QA Scope. Goods and Services."
.
.
.
- -.
- - -
,
-
._-
---
-
-
.
_
__ _ _ _. _.
_ _ _. _ _ _.
_ _ _ _. _ _
_ _ _ _ _
.
.
Again in reviewing the nonsafety-relateo status of the fuel oil system, the team Iound that there were no procedures for upgrading a system from nons&fety-related status to safety-relateo status. WEPCO indicated it did not plan to
!
write such a procedure.
6.1.4 Maintenance History The team reviewed and evaluated the adequacy of the estcblished system for the control of maintenance history including the use of the Corouterized History and Maintenance Planning System (CHAMPS) and interviews witi Ley personnel.
'
The team had no concerns in this inspection area.
-
6.1.5 Trending The team reviewed anc evaluated the adequacy of the trending program relative to electrical maintenance. This review included the use of CHAMPS, aoministra-tive control systems, selected completed work requests, and interviews with personnel. The team was satisfied with the trending program with one excep-tion: root causes were poorly documented and in sone cases the f ailure mecha-nism was erroneously docunented as the root cause of failure. The team considered this a weakness in the program.
6.2 WCPCO Action on Comitments and Concerns f.2.1 In-Service Testing Program for EDG Fuel Oil System A letter from C.W. Fay (WEPCO) to T.G. Colbourn (NRC), dated April 2, 1987, discussed the in-service testing (IST) program for pumps and valves at PBNP, Units 1 and 2.
Item 76 of the letter addressed exclusion of the " Emergency Diesel Generator Fowl Oil Transfer, Pumps and All Active Inline Valves to Supply i
the Day Tank," from PBNP's IST prograra.
In support of its effort to exclude the pumps arf valves between the bulk storage tanks and the day tanks from IST, WEPC0 2 tate) that: "The inventory of diesel fuel necessary to mitigate an
,
accide,it or to shut down a unit to a safe condition is contained within the day i
l tanks and base tanks for each engine." Each day and base tank had a capacity
'
of approximately 450 gallons. The staten=nt in the letter was not consistent I
with the plant's Technical Specifications, which required a fuel supply of l
11,000 gallons to be available. The 11,000 gallons essentially represented the capacity of the emergency fuel tank (12,000 gallons when completely full).
In the same section of the letter, WEPC0 stated that:
"The emergency diesel generator fuel oil transfer system pumps and valves located between the bulk storage tank and the day tanks are not safety related. Therefore, the emergency diesel generator fuel oil transfer pumps and ac'Jve inline valves to supply the day tanks should not be included in our IST pr gam." However, WEPC0 had since reconsidered the safety classification of.ne system and was in the process of establishing an IST program.
It was the te W s assessment that
as evidenced by the above letter, WEPC0 had misstated its comitments and engi-neering requirements.
'
.. - _ -
. -
-
-
-
-.
.
.
.
6.2.2 Responses to NRC Bulletins and Information Notices
,
Several of WEPC0's responses to NRC bulletins and information notices are covered in the appropriate sections of this report. Sone additional responses that the team reviewed are addressed in this section.
l IE Bulletin 63-03, dated March 10, 1503, addressed check valve failures in the raw water cooling systems of diesel generators. This bulletin was a followup to IN 82-08 on check valve failures in diesel generator engine cooling systems.
In response to this bulletin, the Executive Vice President of WEPC0 stateo in a letter to J.G. Keppler of NRC Region Ill, dated June 6,1983, that:
"We have verified that there are no check volves in the flow path of cooling water for the diesel generators." This response failed to consider the system's intake check valves, which were specifically listed as a concern in the bulletin.
However, the licensee has since established an in-service test for these valves.
Molded-CaseCircuitbreakers.gonsetoNRCBulletin88-10."honconforming The team reviewed WEPCO's res Originally, WEPC0 determined that 57 of 94 breakers being maintained as spares could not be traced to the original equip-ment u nufacturer. As a result, all breakers installed since 1983 were reviewed for traceability. From this review,116 additional breakers that could not be traced were identified. The majority of these 116 breakers were installed in two auxiliary system instrument panels, one in Unit I and one in Unit 2.
Justifications for continued operation (JCOs) were written for these 116 breakers. WEPC0 was replacing these breakers with traceable breakers procured as saf ety-related equipment from the original manuf acturer. The team reviewed Purchase Order (P0) 140378 to Square D Company for 189 replacement breakers and PO 157849 to Westinghouse for 6 replacement breakers. The pur-chase orcers properly included references to 10 CFR Part 50, A)pendix B.
In i
addition, the purchase orders required the vendors to supply tse applicable time-current curves which delineate the performence characteristics of the
'
circuit breakers.
The team reviewed WEPC0 evaluation of IN 89-21, " Changes in Performance Charac-l teristics of Molded Case Circuit Breakers."
The information notice concerned
changes made by vendors to the performance characteristics of molded case circuit breakers without notifying the customers of these changes and without i
changing the part numbers. The team noted that WEPC0 had taken appropriate
,
action by requesting new time-current curves for breakers during procurement.
{
6.2.3 Responses to Other Concerns i
i.
As e result of its inspection of the main fuel oil storage tanks on September 30, 1900, WEPC0 identified a potential problem described in PBM l
89-0125, dated February 1,1989. The drain line on the bottom of the tank was susceptible to rupture from freezing or other causes.
Such a rupture would 6mpty both storage tanks of fuel oil. An engineering analysis was recormended, in PBM 89-0222, dated February 23, 1989, several recomendations were made for alleviating this problem. However, none had yet been implemented.
The team found that the swing battery charger for bacteries DOS and 006 did not have an interlock for its output circuit breakers. WEPC0 had committed to the NRC, in 1980, to install the interlock. At the time of the inspection, WEPC0 t
was planning to install the interlock in 1991.
1 t
-
-
---
-
--
.
-.
_ -... _, _ _ _
--
..
-_ - - -
- --
- -._
- -. - -
-
..
.-
.
.
6.3 Conclusion Although the procedures controlling the engineering program were generally i
complete, the team identifiec several weaknesses. The team found that the temporary modification procedure did not incluce many of the requirements of similar or controlling procedures.
Procedures for upgrading the QA and safety status of systems were weak and some were absent.
There was no effective procedure for upgrading systems from non-QA to QA status, and no procedure existed for nonsafety-related systems to the safety-related category.
In addition, several letters to the NRC and responses to NRC bulletins were not completely adequate.
Several WEPC0 replies either misstated commitments or engineering basis, or missed key elements of the bulletin. The team also noted 10 years after WEPCO's comitment to the NRC to install circuit breaker inter-locks on a battery char 0er, the interlocks still were not in place.
7.0 OVERALL CONCLUSIONS The team identified a large number of significant problems from its review of a relatively sniall saple of the electri;61 distribution system and support systems. The nunber and significance of the findings prevented the team fron, initiclly determining that the system 1 were capable of performing their safety functions under all design basis conditions. The three major issues that raised the. must concern about operability were (1) emergency diesel generator i
loacing, (2) seismic capabilities of the emergency ciesel generator fuel oil system, and (3) redundant division cables routed in the same raceway. The actions taken by WEFC0 inmeciately folloviing the inspection and discussed 6t the exit nweting on April 17, 1990, alleviated the imediate operability j
concerns for these three issues.
.
licwever, the deficiencies identified by the team indicated general weaknesses in Everal areas:
(1) dnsign and modification deficiencies in the EDG and 127-Vdc systems, (2) lack of available design end engineering information, (3) design features where a single failure can disable redundant equipment, and (4) engineering support that did not fully evaluate design br changes to design. The first weaknesses noted were the deficiencies in the emergency diesel generators and fuel systems, ahd the batteries and 125-Yde system.
Because of PBNP's design (only two EDGs and two safety-related batteries shared by both units), these two systems haie utmost safety significance. Within the EDG system, the team found the steady-state loading of the diesels to be marginal with the potential to be exceeded.
In addition, no transient analysis existed for the dynamic EDG loading. The fuel oil transfer system between the l
seismic energency storage tank and the seismic day tanks was not seismically designed and installed, and the f uel oil quality did not swet the appropriate requirements. Finally, a voltage level interlock described in the FSAR and system logic diagrams was not part of the EDG installation.
The team's findings in the 125-Vdc system included a nonconservative calcula-tion for sizing replacement batteries. The float voltage for the batteries exceeded the manufacturer's recomendation and component ratings. The proce-dure for neasuring ground resistances on the system did not include acceptance criteria or limits, and the significance of such neasurements was not evaluated. The maximum available short-circuit current was not determined when
.
.
.-
.
-
.
. - - -
- -. - -. -
.
-.
-
-..
__
_ _ _ _~
__ _
. _ _ _ _ _ _. _ _ _ _ _.
O O
l circuit breakers were replaced on the system and the circuit breakers were replaced because of a recently cisclosed problem with the de breakers not having a siaximum fault-interrupting capability. The final resolution for the main de bus breakers was still being reviewed by the licensee.
The second area of weakness was the unavailability of design documents. The
'
tearn's review cf the adequacy of the electrical distribution system was corrpli-cated by the lack of adequate and complete calculations and analysis. The team
could not confirm ratings of certain equipment or determine fault currents to
'
equipment.
A steady-state load calculation for the EDGs did not exist until the inspection and a transient analysis had not been performed.
In addition,
>
calculations for many device setpoints did not exist. The team recognized that WEPC0 had several existing programs for addressing these concerns in the future. However, the programs represented recent and preliminary efforts and their effectiveness could not be evaluated.
The third weakness the team 16entifi6d was in the plant design itself. The l
team recognized that PBNP was designed and built in the late 1960s and early 1970s and would not meet current standards for design and construction.
However, the team did not expect to find such a large number of design defi-ciencies in its relatively small sample. Although the plant was designed to seet the requirements for withstanding the effects of a single failure, the team toentified a number of conditions that, given a single failure, could jeopardize redundant equipment required for safe operation of the plant. Three of these conditions were the result of original design and two conditions were i
the result of plant modification.
Ironically, two of the examples had been
'
reviewco and modified by WEPC0 to eliminate other single failure problems.
These conditions included (1) the routing of redundant safety-related cables in the same raceway. (2) single-failure of the tie breaker between the redund6nt safety-related 480-V busses, (3) potential seismic failure of the knife switches providing de control power to the safety-related 4160-V switchgear, and (4) potential f ailure of redundant 120-Vac channels f rom an automatic shutoff feature on new inverters.
The fourth area of weakness the team identified was the engineering support provided to PBNP. Several of the team's findings indicated that WEPC0 engi-neering groups did not evaluate design adequacy or establish adequate bases for certain changes or modifications to the plant. The findings also indicated that when WEPC0 identified a problem with original design, the full extent of
,
the problem or the possibility (of other similar problems was not always addressed.
Examples included 1) not developing a full load profile for sizing l
replacement batteries, (2) not determining the maximum available short-circuit current when replacing de system circuit breakers and batteries, (3) not fully evaluating the affects of excessively high battery float voltages, and (4) not evaluating the affects of fuel oil that did not meet quality requirements.
l Other examples of weaknesses in the engineering support program included (1) performing some modifications without considering industry-standard prac-tices, (2) adding incorrect information into emergency operating procedures, procedure, and (4) y-related status of systems without a controlling program (3) upgrading safet 10 years. The team concluded that a lack of design basis documents and design l
\\
l
.
_
.
-
.
__
.
.
information contributed to the weaknesses it found in the engineering program.
The team also believed that the limited size of the engineering staff contributed to the weaknesses with engineering support.
8.0 EXIT MEETING The NRC held an exit meeting with Wisconsin Electric Power Company management on April 17, 1990. The meeting was held at WEPCO's corporate offices in Milwaukee, Wisconsin. Appendix B to this report identifies the WEPC0 and NRC personnel who attended the neeting. The team's more significant fincings and the teaci's conclusions were discussed. WEPC0 described the actions it took immediately following the inspection and the status of reny of the team's findings and concerns. Of particular interest to the NRC were the operability determinations that WEPCO n.ade regarding diesel generator loading, seismic condition of the diesel fuel oil system, and cable separation deficiencies.
Licensee actions taken after the close of the inspection period were not evaluated by the team and are not addressed in this report.
e e
l l
l
'
.
l l
- -
.. -
..
..
. -
4
.
AFFENDIX A UNRESOLVED DEFICIENCIES The following deficiencies are those the team identified that require additional review or action by WEPC0 or NRC to fully resolve or to verify corrective action. The deficiencies have been individually numbered and are c16ssified as unresolved or open items. The section numbers identified in each deficiency title refer to the inspection report section in which the deficiency is ciscussed. The associated requirements f rom 10 CFR Part 50 and commitments from the Final Safety Analysis Report (FSAR) are identified for each deficiency. The references to the General Design Criteria are the requirements to which WEFC0 committed in its FSAR.
,
,
e e
i
'
-
.
L
l l
A-1
- -.
._
_.. -
.
.
-_
-
.
- _..
-.
.-
.
_
__
_
_
._
_ _ _ _ _ _ _
___
_ _ _ _ _ _ _ _ _ _
_
i
.
DEFICIENCY 90-201-01 l
Deficiency Title: Nonconservative Diesel Generator Steacy-State Loading Calculation (UnresolvedItem-Section3.1.1.1)
Description of Condition:
The safety-)related ac electrical loads applied to the energency diesel genera-tors (EDGs during the injection and recirculation phases of accident mitiga-tion are identified and tabulated in the Final Safety Analysis Report (FSAR)
Table 8.2-1, " Emergency Diesel Generator Loading following Loss 01 Coolant
-
Accident Injection Phase," and Table 8.2-2, " Emergency Diesel Gener6 tor Loading following Loss of Coolant Accident Recirculation Phase." The team reviewed state loading on each EDG Calculation 0870-103-011, which determined the steady-(LOCA) in one unit and a (G-01 and G-02) following a loss-of-coolant accident shutdown of the other unit concurrent with the loss of offsite power. Calcula-tion 0870-103-011, page 49A, showed that the worst-case steady-state loading
'
scenario was the loading on EDG G-02 following a LOCA in Unit 1 and the shut-oown of Unit 2.
For this case the loading on EDG G-02 was calculated to be
97.8 percent of 2000-hr/yr rating, injection phase
94.1 percent of 200-hr/yr rating, injection piase l
103.1 percent of 2000-hr/yr rating, recirculation phase
99.2 percent of 200-hr/yr rating, recirculation phase
!
The team noteo that the steady-state ciesel generator loading analysis per-formed in Calculttfon 0870-10'l-011 was based on the assumption (Assumption
'
No.13 g) that the containmant recirculation fana for the shutdown unit to be used during an accident were not automatically or manually r,terted and, there-
l fore, were not running during the hccident scenario. The load tabulation in the calculation indicated that the loading for containment fans 1W-00101 and IW-00101 (fed from 480-Vac bus 1B04) was 124.3 kW each for the faulted unit; l
the loading for containment f ans 2W-00101 and 2W-001D1 (fed from 480-Vac bus
2B04) was 0.0 kW for the non-faulted unit. However, the FSAR Tables 8.2-1 and 8.2-2 require that one containment fap in the non-faulted unit (identified as a t
l 25-kW load) be manually started in the injection phase and continue running in l
the recirculation phase.
'.
The team determined that Calculation 0870-103-011 was not conservative because it assumed that a containment fan for the non-faulted unit was not o)erating
!
ouring the injection anc recirculation phases of the accident and, titrefore, did not include the fan as a diesel generator load.
Plant personnel told the team that the plant emergency operating procedures for the non-faulted unit did not exclude starting a single containment fan. The team also was told that the actual current that a containment fan draws during normal continuous operation was 82 A.
This value represented a 61.3-kW load.
i The addition of this load onto diesel generator G-02 (as comitted to in the FSAR) during the recirculation phase would increase the loading from 99.2 percent to 101.27 percent based on the 200-hr/yr rating.
A-2
- -
_...
. - - _ _ - _. - - -
.
.--.. ~.
- - - - -
.
- -
-
v
6 Recuirenents ano Consattants:
TSARSection8.2.3(page8.2-13),"LoadEvaluation,DieselGenerators" states that "each diesel generator will be sizea to start and carry the engineered safety features required for an acceptable post-blowoown containment pressure transient in one reactor unit and provide sufficient power to allow the seconc reactor unit to be placed in a safe shutdown condition. These loads are tabulated in Table 8.2-1." Table 8.2-1 aodresses the injection phase. Loads for the recirculation phase are tabulated in Table 8.2-2.
rSAR Tables 8.2-1 and Tables B.2-2 state that one 150-hp containment f an (representing a 25-AW load) in the non-faulted unit will be operating during the injection nr.d recirculation phases of a postulated LOCA. This load was added to the other tabulated loads and was considered continuous with respect to energency generator loadire.
Docunents Reviewed
.
1.
FSAR Section 8.2.3 (page 8.2-13), " Load Evaluation, Diesel Generators."
2.
FSAR Table 8.2-1, " Emergency Diesel Generator Loading following Loss of Coolant Accident Injection Phase."
,
3.
FSAR Table 8.2-2, " Emergency Diesel Generator Loading Following Loss of Coolant Accident Recirculation Phase."
'
l l
4.
Impe11 Calculation 0870-103-011. " Diesel Generator Loading Analysis, WEPCO, P8NP," Revision 0, date,d March 31, 1990.
'
1
-
e A-3
--
-
...
v
.
o
l l
,
DEFICIENCY 90 201-02
'
I Deficiency Ti_t_le:
Lack of Transient Analysis of Diesel Generator Loading
(Unresolveditem-Section3.1.1.2)
'
Description of Condition:
The team reviewed Calculation 0870-103-011, which analyzed the steady-state loading on each diesel generator with the opposite train inoperable. The l
calculation did not include a dynamic analysis of the capacity of the diesel generator to handle starting loads and sequencing intervals. Therefore
'
in-rush currents, starting load (kW) under low-voltage conditions, acceleration time of large motors, loads resulting from the operation of motor-operated valves, and the allowable tolerance of load sequence timing relays were not analyzed. Since a small margin existec for the steady-state loading of the
,
ciesel generator in both the injection phase and the recirculation phase, the team considerec the lack of dynamic analysis of diesel generator loading to be l
a significant deficiency.
In response to the team's concern, WEPC0 pointed out that the Diesel Generator Instruction Manual (Section 1, page 3, figure enti-
>
,
tied "Model 999 System Dead Load Pickup Capability") indicated that the diesel
'
generator capacity could acconnodate the starting of a large load such as that of the safety injection pump motor. The team considered this response to be inadequate with respect to transient loading of the diesel generator throughout the injection and the recirculation phases.
.
The team also found two inconsistencies that related to the issue of transient loading of the diesel generators. The first inconsistency involved the protec-phaseovercurrent)oforthe50/51 device (instantaneousandlongtimecelay tive relay settin for 56fety injection pump motor IP15A (Drawing 499B466 Sheet 222). which was based on a time-current cnaracteristic curve prepared by WEFC0 in 1982. The time-current curve assumed that the motor acceleration time was less than 5 seconds. The team found that WEPC0 did not have a basis for this assumption nor were motor torque-current and torque-speed curves avail-able. Setting of protective relays without motor-starting curves was inconsis-tent with WEPC0 Reference Manual 14-493-1279. More importantly, motor acceleration time could affect diesel transient loading.
'
The second inconsistency involved diesel generator load sequencing.
FSAR Section 8.2.3, page 8.2 12. " Loading Description," provided the loading sequence. The FSAR description of elapsed time for start of loads was misleading because it was based on the assusiption that the diesel generator takes 10 seconds to come up to speod and load onto the bus.
In Nonconformance Report N-89-348, the licensee stated that Procedure OkT-3 used for the testing of diesel generators showed that the actual time was approximately 5 seconds; therefore. the sequence times in the FSAR were 5 seconds longer than the actual time. WEPC0 indicated it was planning to revise the FSAR accordin The diesel generator load sequence timing relays (Agastat Series 2400) gly.
I had repeat accuracies of plus or minus 5 percent (Agastat Catalog page 3). WEPC0 estab-lished an acceptance criterion (tolerance) for these load sequence timing relays (Procedure ORT-3, Appendix B).
However, WEPC0 did not have data on the tolerance and accuracy of these timing relays based on seismic testing.
Since a seismic event could potentially change the accuracy and tolerance of subsequent operation of the timing relays, WEPC0 had no basis for establishing A-4
_
--
.
.
-
.
v o
.
I the tolerance.
Possible shifts in the accuracy of the load sequence timing re16ys could adversely affect diesel generator transient loacing.
I In suninary, the team believed that the lack of a transient loading analysis for the diesel generators was a significant deficiency.
,
!
Requirenents and Comitments:
l l
FSARSectionS.2.3(page8.2-13),"LoadEvaluation,DieselGenerators," states that "each diesel generator will be sized to start and carry the engineered safety features required for an acceptable post-blowcown containment pressure transient in one reactor unit anc provide sufficient power to allow the second reactor unit to be placed in a safe shutdown condition."
10 CFR Part 50, Appendix 0, Criterion 111. " Design Control," requires, in part, that measures be established to ensure the design basis is correctly translated l
into specifications, drawings, procedures, and instructions.
Docunentf Reviewed:
1.
FSARSectionB.2.3(page8.2-13),*LoadEvaluation,DieselGenerators."
2.
FSARSection8.2.3(page8.212),"LoadingDescription."
J 3.
Im> ell Calculation 0870-103-011. " Diesel Generator Loading Analysis, WE)CO, PBNP," Revision 0, March 31, 1990.
l
Diesel Generator Instruction Manual, Section 1, " General Description."
!
5.
WEPCO Engineering and Construftion Department Reference Manual l
14-403-1279, " Protection of Power Plant Auxiliary Systems," December 1979.
l
.
l 6.
Westinghouse Dr6 wing 499B466, Sheet 222, "Elenentary Wiring Diagram Safety injection Pumps IP15A and 1P15B," Revision 11, July 6, 1987.
7.
WEPCO Tine-Current Characteristic Curve, " Safety injection Pumps, 4KV i
Motor Protection," June 21, 1982.
i l
.
.
I 8.
WEPC0 Nonconformance Report N-89-348, December 7, 1989.
9.
Agastat Catalog, *2400 Series Timing Relay," 1969.
10. WEPC0 Review of ORT-3 Test Results, " Appendix B Acceptance Criteria Suninary, Page 2," Revision 0, March 30,1989.
l l
t A-5
-
.
-
.
-
- _ _
-.
_ _ -.
_-
- _ _
-
--
.
,
,
-,
DEFICIENCY 90 201-03 Def Sciency Tit 1_e:
Incorrect Load Ratings Listed in the Energency Operating Procedures (Unresolveditem-Section3.1.1.3)
Description of Condition:
The team reviewed emergency operating procedures (EOPs) and emergency contin-gency actions (ECAs) related to electrical equipment and emergency diesel generator (EDG) loading to determine if the operational load requirements were consistent with EDG capacity. Reference notes in the E0Ps and ECAs that the te6m reviewed stated the EDG capacity ratings and referred the Operator to &n appencix table that listed the load ratings of critical equipment. The opera-tor was instructed to refer to these lists before loading the equipment onto the EDG.
In the two appendix tables reviewed by the team (Appendices to E0P-0 and ECA-0.0), the equipment load ratings were incorrect and nonconservative with respect to both the FSAR and a current EDG loading an61ysis performed for
the licensee (Calculation 0870-103-011). The list of incorrect load ratings could result in operator actions that would overload the EDGs. An overloaded EDG could result in its failure and the loss of its ability to perform its intended safety function.
The team reviewed the incorrect ratings with WEPCO. The licensee stated that it intendeo to review the ratings and correct them accordingly. However, the licensee did not issue a nonconiormance report during the inspection.
Requirements and Consnitments:
'
FSAR Section 8.2.3, " Emergency Power," states that loads to be carried by an EDG are given in Tables B.2-1 and 6.2-2.
These two tables list the kilowatt load ratings of most of the equipment listed in the affected E0P appendix tables.
l l
10 CFR Part 50, Appendix B, Criterion 111
" Design Control," requires that
'
l measuresbeestablishedtoensurethedesIgnbasisiscorrectlytranslatedinto specifications, drewings, procedures,{and instructions.
- Documents Reviewed:
1.
FSAR Section 8.2.3, " Emergency Power."
2.
PBNP Emergency Operating Procedure 0, " Reactor Trip or Safety injection,"
Revision 6. February 7,1990.
3.
PBNP Emergency Contingency Action 0.0, " Loss of All AC Power,"
February 7, 1990.
Impe11 Calculation 0870-103-011 " Diesel Generator Loading Analysis, WEPCO, PBNP." Revision 0, March 31, 1990.
. -
A-6
-
-
-
. - -.
.
-
-
. _ -
, _.
_ __-.. - -.
.
O DEFICIENCY 90-201 04 Deficienc.y Title:
Emergency Diesel Generator (EDG) Loading as Instructed by
-
Emergency Operating Procedures (EOPs) for a Design basis Accicent (Unrescheditem-Section3.1.1.3)
Description of Condition:
The team reviewed in detail E0P-0,1, and 1.3 and Emergency Contingency Action (ECA) 0.0 with WEPCO senior operations staff. During the review, the team determined the EDG loads that would be renuired by the E0Ps to safely mitigate the consequences of a design basis accident (OBA) concurrent with a single failure of one EDG. The team listed the loads the operator would add to the EDG in accordence with the E0Ps and the timing of these loads and determined whether or not these loads were necessary to safely mitigate the consequences of the DBA. After reviewing the required E0Ps, the team noted the following i
concerns:
The E0Ps did not coordinate the sequence of loading the EDG during an accident, and did not take into account additional loads that may be required by the nonaccident unit.
O The only instrur4ntation available to the operator for monitoring EDG loads was a single kilowatt meter (and related annunciator) that was
,
'
calibrated once every six years. The licensee provided no basis for the calibration cycle and did not include the meter tolerance in the EDG load profile.
.
l
The E0Ps called for specific equipment to mitigate the consequences of the
'
i DBA. The team tabulated the tilowatt ratings of that equipment, the FSAR-required loads, ano the loads that were not shed with a loss of i
offsite power and safety injection signal. 1he team found the EDG would exceed its 200-hour rating. The severity of this situation was further heightened since the EDG 4-hour rating was only 37 kW above the 200-hour rating.
In addition, the senior, operations staff felt that there were additional loads that were not considered in the FSAR EDG load profile and the E0Ps may be needed. For exam)1e, control room air conditioning may be t
required both to ensure the opera)ility of control instrumentation and to l
resolve control room habitability concerns. At the time of the team's i
revicw, control room air cor.ditioning was not considered part of the EDG j
load profile.
If the control room air conditioning were loaded onto the l
EDG with the E0P-designateo loads, the EDG would exceed its 4-hour rating during the DBA.
(In the case of diesel generator G-02, it would exceed
'
its half-hour rating.)
The team questioned what operator actions would be expected once the EDG loading capacities stated in the E0Ps had been exceeded. The team was told that the operator would probably remove certain loads to reduce the i
EDG load level. However, the E0Ps provided no guidance to the operator concerning the choice and timing of loads to be removed.
Furthermore, l
the team could not determine which of the loads can be terminated and still provide a reasonable assurance that the consequences of the DBA could be safely mitigateo.
A-7
__
_ _ _ _ _ _ _ _ _ _
_ _. _.
V
.
c
!
!
[
On the basis of these and other tean, findings, the team had serious concerns about the EDG loading and the ability of the EDG to perform its intended safety
!
function in a challenged, accident situation.
f Requirements and Comitments:
10 CFR Part 50, Appendix B, Criterion 111, " Design Control,* requires, in part, that measures be established to ensure the design basis is correctly translated into specificatior.s drawings, procedures, and instructions.
06 sign control measures shall pro)1de f0r verifying or checking the adequacy of otsign, such j
as by the performance of design reviews.
GDC 39, " Emergency Power for Engineered Safety features," requires, in part, that alternate power systenis be provided and designed with adequate l
independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, each onsite power system shall independently provide this capability assua. irs a failure of a single active component in each system. The load growth and present day plant needs as designated by E0Ps and plant docunents exceed the EDG capacity j
ratings.
!
Documents Reviewad:
l 1.
PBNP Emergency Operating Procedure (EOP) 0, "Re&ctor Trip or Safety j
Injection," Revision 6 February 7,1990.
l 2.
PEhP E0P-1, " Loss of Reactor or Secondary Coolant," Revision 6, February 7, 1990.
,
t
3.
PBNP E0P-1.3, * Transfer to Coctainment Sump Recirculation," Revision 6 j
February 7,1990.
-
PBNP E0P-1.4, " Transfer to Containnent Sump Recirculation, One Train Inoperable," Revision 1, February 7,1990.
5.
PBNP Emergency Contingency Action 0.0, " Loss of All AC Power," Revision 6,
,
february 7, 1990.
i
.
.
l i
l l
l
.
!
..
.
.
.
..
_
__
._
_.
.
.
d DErlCIENCY 90-20135
,
!
Deficiency Title:
Nonconformance to Design Basis Criteria for Electrical Cable Tray (Fill and Cable Ampacity Derating
UnresolvedItem-Section3.1.3)
Description of Condition:
'
The ampacity of an electrical cable is the maximum current a cable can carry in
,
a given ambient temperature without exceeding the insulation temperature rating of the cable. Ampacity derating is the method of reducing the maximum current
'
for a cable based on known physical conditions of the cable's environnent. The team reviewed the FSAR to determine the cable tray fill and ampacity derating criteria used in the plant's design. The team also randomly selected the power cable connected to safety-related motor-operated valve 151-0841A located inside the containnent to determine the cable type, empacity derating, routing, and associated tray fill.
Elenentary Wiring Diagram 499B466 (Sheet 723), and Connection Diagrams E-99 ($heet 1), and E-92 (Sheet S), indicated that the power cable connected to ISI-0841A was a train A cable, designated ZA1324FA (outside containment) and j
l ZA1324FT(insidecontainment). The power cable consisted of 3-1/C No.10
l American Wire Gauge conductors rated at 600 Yac. The team reviewed the l
computer-generated raceway report for the subject cable and found that cable
i tray section FK07 (which carried cable ZA1324FA) was 39.02 )ercent filled.
Cable tray section FK07 (power and control tray) violeted tie criteria of the
,
I FSAR, which stated that power and control cable trays are filled less than l
30 percent and instrument trays less, than 40 perant.
WEPCO indicated to the team that page 7.2-7 of the FSAR represented the correct design criteria; that is, power and control trays are filled less than
,
!
30 percent and instrument trays less than 40 percent. Derating factors used
)
l wereinaccordancewiththeNationalElectricalCode(NEC)orwiththemanufac.
l turer's reconmendation, whichever resulted in the lowest rating of cable.
WEPC0 also indicated that Section 8.2.2 (page 8.2-7) of the FSAR was incorrect
'
in stating that tray fill does not exceed approximately 40 percent and that Cable Engineers Association (y factors recomended by the Institute of PowerIn 1985 cables in trays are derated b IPCEA, nbw ICEA).
with a sumary of the original design criteria, including sizing of 4160-Y and 480-V cables. The basis for ampacity ratings in the Bechtel discussion was essentially the 1965 National Electrical Code. WEPCO's current practice was to use the most recent version of the National Electrical Code for ampacity determination. WEPC0 could not provide any formal guidance for sizing of cables.
For 480-V power cable applications, the team found that Bechtel's design criteria were consistent with the 1965 National Electrical Code. Bechtel used a 0.9 correction factor for cable located in a 40 'C ambient temperature and specified that cable ampacity be decreased further using a 0.7 derating factor for a maximum of 24 cables in a tray without maintained spacing. The team reviewed the computer-generated raceway report for the su) ject cable and found that cable tray section FK07 (which carries cable ZA1324FA) contained 55 cables. Loading a tray with 55 power and control cables did not conform to A-9
<
_ __
_
_
_
.
- - - - -
. -
.- -_ --
.- -.
.
C
.
Bachtel's original design basis, which limits the tray loading to no toure than 24 single conductor cables in order to obtain correct empacity derating in accorcance with the 1965 National Electrical Code.
In response to the team's concerns regarding nonconformances to criteria for tray fill and cable derating, WEPC0 evaluated the computerized standard report on raceway during the inspection. KEPC0 determined that 210 power and control cable tray sections and 15 instrunentation cable tray sections did not conform to FSAR ano Bechtel electrical design criteria regarding tray fill. WEPC0 then analyzed all cables contained in tray section FK07, ownonstrating th6t these cables had adequate current carrying capability and would not exceed their maximum operating conductor insulation temperature.
However, this determina-tion was made using ICEA Publication P-54-440 nethodology for ampacities in open top cable trays, and was not consistent with the FSAR comitment to use the NEC. WEPC0 stated that all remaining cable tray sections that did not conform to FSAR and Bec.htel design criteria regarding tray fill would be fully
,
analyzed.
Ruuirements and Consnitments:
FSAR Section 7.2 (page 7.2-7), "Pmtection Against Multiple Disability f or Protection Systems, stated in part that " power and control trays are filled less than 30 All cable is deratedfor(percentandinstrumenttrayslessthan40 percent.a) ambient temperature in e nunber of conductors in raceways. Derating factors are used in accordance with
the National Electrical Code or with manufacturer's recommendation, whichever resulted in the lowest rating of cable."
The Bechtel electrical design criter' ion, provided to WEPC0 in 1985, states in part "All cables of 250 MCN and less are sized for installation in conduits ano trays without maintained spacing. 'Not more than 24 single conductor cables may be installed in a tray or conduit." This criterion complies with Table 310 12 of the 1965 M6tional Electrical Code and Note 8 of Table 310-12.
Docunents Reviewto:
i
-
1.
FSAR Section 7.2 (page 7.2-7). "Pmtection Against Multiple Disability for
'
Protection Systems 2.
FSAR Section 8.2.2 (page 8.2-6), " Cable Trays."
3.
Westinghouse Elewentary Wiring Diagras 4998466, Sheet 723, " Motor Operated Valves," Revision 7. March 30, 1978.
Bechtel Connection Diagram E-99, Sheet 1, " Penetration IQ26 and 1057,"
Revision 15, December 16, 1989.
l 5.
Bechtel Connection Diagram E-92, Sheet 8, "480V Mutor Control Center 1832 " Revision 3, November 16, 1987.
6.
PBNPUnit1 Raceway (s)StandardReportGeneration 09:41:51," Cables ZA1324FA and ZA1324FT, Tray FK07," March 14, 19s3.
!
A-10
-,,..m-e-
-g
,_p--
,
.--,_,y
..-. _.,
.
__,,,_g
, _ _ _
w
, ___ __.
.__.
,
I
_
.
O 7.
NationalElectricalCode,hationalFireProtectionAsscciation(NFPA)70, 1965; Table 310 12
" Allowable Ampacities of Insulated Copper Conductors "
and Note B "Notas to Tables 310-12 Through 310-15."
8.
Sunmary of original Bechtel design criteria presented to WEPCO in 1985.
9.
ICEA Publication P-54-440, "lCEA-NEMA Standards Publication, Ampacities of Cables in Open-Top Cable Trays " Second Edition (NEMA Publication ho. WC
.'
51-1975).
.
$
e e
e
.
A-11
- -
.
..
..
--
.
..- --.
.-
.
-
-.
-
. _.
__._-
_ _ _ _ _ _ _ _ _ _ _ _ ___ _ _--__
.
DEFICIENCY 90-201-06 Deficiency Title:
Lack of Assessment of Available Short-Circuit Current Due i
'
to High Battery Temperature (UnresolvedItem-Section3.2.3)
D_escription of Concition:
The m6ximum short circuit current is the sum of the current delivered by the
,
battery, by tht battery charger, and by the contribution f rom large motors.
l The available capacity of a battery is affected by its optrating temperature.
Therefore, a calculation of the available short-circuit current from a station battery must include the consideration of an increase in short-circuit current
'
'
due to an increase in battery electrolyte temperature.
'
The team reviewed the safety-related 125-Ydc system, which was shown on single-line Diagram E-6.
The team also reviewed Calculation N-89-025, which was performed to determine the size of the new Exioe station battery (D-05)
that was recently replaced under Modification Request 88-074 Battery D-05 was sized on the basis of a conservative 63 'F temperature, which represented the lowest recorded electrolyte tesperature. However discussions with WEPC0 engineering personnel revealed that the battery electrolyte temperature had been recorded to be as high as 90 'F.
,
The team determined that the available short-circuit current from the battery, at 77 'F, would be approximately 20,000 am>eres. Since the battery electrolyte temperature could be much higher than 77 'r, the team asked WEPC0 whether the maximum available short-circuit current was evaluated on the basis of the worst-case electrolyte temperature. * WEPC0 was unable to demonstrate that an assessment of maximum available short-circuit current (from battery D-05) had been prepared as part of the battery replacement modification. WEPC0 also
l informed the team that its preliminary assessment (based on the team's ques-tions and WEPC0's discussions with Exide) indicated that the maximum available
'
short-circuit current from the battery could be as high as 22,700 amperes.
Theteamwasinformedofareport(WEPC0LetterVPHPD-89-583andInternal Memorandum NEM-90-15) that WEPC0 had. submitted to the NRC concerning an inade-quacy in the original design of the 125-Vdc system. The original design of
!
this system stipulated the use of circuit breakers in the distribution panels
.
!
that had thermel trip elements but do not have magnetic trip elements. This l
included the input breaker (Westinghouse type HMA 1200 A) from the station battery to the main distribution bus, supply breakers (Westinghouse types HLA 300 A and 400 A) to distribution panels, and panel breakers (Westinghouse type HFA 70 A). These breakers were not capable of interrupting fault currents that and fault currents of were in excess of approximately 10 times the trip ratingformed the team that de this magnitude were considered to be possible. WEPC0 in system circuit breakers feeding cosson equipment were replaced with breakers that have thermal and ugnetic trip elements, thus eliminating the potential for conston-mode failure.
l A-12
,-_-.---,,.,,.-.----,,,--,9 g-
,,e.-
.w
-
wi.w--_
- -.
-.w.-
-.
,_w-p
. + -
-
-..,,.
,
,
.,w
.-,-,w.,w.
-, - - -
--.%
--
-,
.
__
_
. _ _.
_ _ _ _
$
,
The team concluded that WEPC0 had not perforned an evaluation to determine the maximum available short-circuit current (from battery D 05) due to the worst l
case high electrolyte temperature. The team believes that this determinati0n
.'
should have been made as part of the battery replacement rodifica+, ion. The team also recognized that WEPC0 planned to take corrective actions to adoress the breaker interrupt capacity issue, which was part of a previous NRC Region 111 enforcement actiun.
Requirements anc Commitnents:
10 CFR Part 50, Appendix B, Criterion III, * Design Control " requires, in part, that measures be established to ensure the design basis is correctly translated into specifications, drawings, procedures, cnd Instructions.
Documents Reviewed:
)
1.
Bechtel Drawing E-6, Sheet 1. " Single Line Diagram 125Vdc System," Revi-sion 16, January 16, 1989.
2.
WEPCO Calculation N-89-025, * Battery 005 Sizing," Revision 1, March 23, 1990.
3.
WEPCO Modification Request 88-074
,
j
IEEE Standard 946, *Otsign of Safety Related DC Auxiliary Power Systems for Nuclear Power Generating Stations," 1985 5.
Exide Battery Instruction Manual Control No.1384, " Discharge Curve S-1027 for Type GN-17 to 23 Battery."
6.
WEPC0 Internal Menorandum NEM'-90-15, *NE Safety Review Committee Meeting
,
l 89-04, DC System Design Deficiency," Janetry 5,1990.
l 7.
WEPC0 Letter VPNPD-89-583, " Request for Discretionary Enforcerent Related
)
to Technical Specification 15.3.0.A, Point Beach Nuclear Power Plant l
Units 1 and 2, Docket Nos. 50-260 and 50-301 " November 10, 1989.
-
,
I
,
l A-13 l
- -
-
--
.--
-
..
..
I l
,
C DEFICIENCY 90-201-07 Deficiene.y Title:
Inadequate Seismic Evaluation for Modification to 4160-Vac Safeguards E,us Tie-Breaker (UnresolvecItem-Section3.3.1.1)
_ Description of Condition:
The original design provided, in each unit, a single circuit breaker that een tie the two redundant 4160-Vac safeguards bussts to In 1987 the nuclear steam supply system vendor reported uncer Ibother.
CFR Fart 21 a failure of the breater's auxiliary cell switch at another plant.
The report resulted in the issuance of NRC Information Notice (1N) 87-61. During its review of IN 87-61, WEPCO founc that this potential for single fatlure txisted with regard to the 4160-Yac tie-breakers et PBNP. To eliminate this potential failure mode,thelicenseeimplementeoModifications87-204anc07-205(Units 1and2, respectively),)whereby th tie-breakers were racked out (placed in the with-drawn position within the switchgear cubicle, and the cell switches were raravved from the diesel loading sequence logic, in developing and implementing these modifications, VEPC0 had not perforned any seismic evaluation and hhd indicated none was required, without providing justification. WEPC0 change control process included Form QP 3-2.1, * Design Verification Notice," which indicated that the chanie would not exceed the capabilities of the equipnent, and form QP 3-2.2, "!)nal Design Review Guide,"
which indicated in three alar.es that seismic qualification was not required.
QP 3-2.2 indicateo that tie test switches involved in the modification were seismically qualified, but did not identify any other potential seismic interactions.
-
These modifications changed the configuration of the tie-breakers connecting the two redundant 4160-Vac Jafeguards busses in both units so that the breakers were no longer in the " operate" (connected) position, which was the configura-tion on which scismic qualification was based. The modified configuration was in the racked or withdrawn position within the cubicle, thus permitting the breaker to move within the cubicle. The team was concerned that no evaluation had been made of the acceptability of'the new configuration with respect to seismic qualification, and that no special seismic constraints on the racked-out breaker had been considered. The team believed that the breaker could impact the switchgear structure and possibly disable safety-related components and circuits such as undervoltage relays and latching relays neces-sary to detect and initiate the safeguards loading sequence, as well as bus differential lockout relays. Also mounted on the hingec panel for each tie-breaker was a double-pole-double-throw (DPDT) knife switch that may be used for manual dead transter of oc control power from the preferred de bus to an j
alternats de bus of the opposite train.
Failure of the relays could disable the diesel load sequence. Failure of the knife switches could cause a loss of de control power to the switchgear if the switch opened between poles.
WEPCO agreed that seismic qualification had not been considered. WEPC0 was unable to qualify the present configuration during the inspection and, in response to the team's concern, completely removea the breakers frem the cubicles.
In addition WEPC0 will revise Operations Instruction 01-35 to A-14
-
-
-
.--
-
-
- - - -
..
-
.
--
---
-
_. --
-
_ _ _ _.
.. _. -_
- - _
- _ -. _
,
l reflect an 8-hour limit on the use of these breakers during maintenance.
The team also noted that FSAR Section 8.2.3, page 8.2-13, does t.ot reflect either the original modification or the modification made during the inspection, i
The team asked WEPC0 to confirm thbt this new configuration would not compro-mise any actions required by WEPCO's comitments to 10 CFR Part 50, Appendix R, since WEPC0 indicated that it would be very difficult to reinstall the breaker b6cause of an extrently tight fit requiring careful alignment.
Pending this assurance and a comitment to update the FSAR, this item remains open.
_ Requirer:ents anc Comitments:
GDC 2, "Perforrance Standards," requires, in part, that systems and components
)
essential to the prevention ci ecc1 dents be designea to withstand the effects of earthquakes.
.
FSAR Section 7.2.1 (page 7.211) states the basis for seismic qualification of type DH circuit breakers used in the 4100-Vac safeguards switchgear.
i WEPCO Quality Procedure QP 3-2.1,for their ef fect on analyzeo or specified' Design V cesign modifications be reviewed capabilities of any affected equipment.
Quality Procedure QP 3-2,2, " Final Design Review Guide," requires an assessnent of any need for seismic qualifi-cation, seismic Category 11 over 1 analysis, and failure modes and effects i
analysis. These procecures, as implenented for these modifications, cid not
,
jdentify or address these aspects of the modified breaker configuration.
I Documents Reviewed:
,
(
!
1.
' Failure of Westinghouse W2-Type Circuit Breaker Cell Switches," becember 7,1987 2.
FSAR Section 7.2.1 (page 7.2-11), Revision 1 March 1987.
l 3.
FSAR Section 8.2.3, p. 8.2-13, Revision 2 June 1986.
Modification MR-87-204 (Unit 1),'"A05/A06 Bus Tie Breaker Single Failure Correction", May 26, 1988.
-
5.
Modification MR-87-205 (Unit 2), *A0b/A06 Bus Tie Breaker Single failure Correction", October 13, 1988-6.
Quality Procedure (QP) 3-2.1, " Design Verification Notice", Revision 1.
7.
QP 3-2.2, " Final Design Review Guide", Revision 0, 8.
WE/ Westinghouse Drawing 594F907, *1A05 4160 Volt Switchgear Unit 61 Internal Wiring Diagram," Revision 13, 9.
WEPC0 Night Order Book form PBF-2015, notice that tie-breakers 1A52-61 and 2A52-72 had been removed from their cubicles, and revision of 01-35 to reflect an 8-hour limit on use of these breakers during maintenance, April 5, 1990.
10. OperationsInstruction(01)35,"ElectricalEquipmentOperation."
A-15
. -.
.
.
.
.
.
_ _ _ _
.
__ _ _ _
. _.
,
o
.
DEFICIENCY 90-201-08 Deficiency Title: Single Failure of Safegu6rds 480-Yac Bus Tie-Breaker
~
(Unresolveditem-Section3.3.1.1)
l Description of Concition:
The team identified a single failure, such as a short circuit between adjacent cables 4 a shared raceway, th6t could result in spurious closure of the
!
450-Vac safeguaros bus tie-breaker when both safeguards busses are served by their respective diesel generators.
This closure could then result in a loss of both safeguards power trains by connecting the diesel generator outputs when they are out of phase. Thus, a loss of all onsite ac power could result f rom a single event. The team identif tad at least one specific mechanism of this type by reviewing the cable routings for the circuits in question. Other problems with the cable routing that hne more generic implications are separately identified in Deficiency 90 201-09.
In response to the team's finding, WEPC0 evaluated two alternative corrective i
actions:
(1) withdrawing the tie-breakers (one per unit) from the ' operate"
l position and securing them within the compartment or (2) removing the control power fuses from the compartment control circuits. WEPC0 considered the impact on the design and performea a review pursuant to 10 CFR Part 50.59 before implenenting the corrective action. WEPCO's review of the second alternative (removing the control power fuses) incluoed a failure modes and effects analy-sis of the remaining control circuitry in the com)artment af ter the fuses had
-
been removed. This analysis included postulated 1ot shorts and undetected grouno faults of up to 500 ohms to ground (stated to be consistent with WEPCO's ground detection and management procedures). WEPC0 concluded that removal of the fuses would eliminate any unacceptable effects of all credible single failures that could be postulated.' It further concluded that removal of the fuses would be less disruptive of the current Appendix R scenario, which requires the manual local operation of this tie-breaker. According to WEPC0, since this scenario already assumed a loss of de control power, removal of the fuses would not appreciably affect operator action during recovery from Appen-dix R events. WEPC0 concludeo that the other alternative (racking the breaker)
would introduce an additional step for the Appendix R scenario, and would also require a seismic evaluation.
-
WEPC0 issued a nonconformance report to remove the fuses and perform a failure modes and affects analysis and notified the operations department of the new operating condition. However, in this new configuration, breaker position would no longer be remotely monitored since control power had been removed.
j Consequently, the breaker could be closed manually at the switchgear, tying the busses together. This condition could remain undetected until a loss-of-offsite-power event, at which time both orsite sources would be connected and all 4160-Yac and 480-Yac power could be lost. This item remains open until HEPC0 takes acceptable corrective action.
finally, the team also noted that Modification MR 85-053 to the tie-breaker trip circuit had effectively corrected other single-failure deficiencies in the original circuit, but had not correcten this one, in that modification, WEPC0 had added a redundant trip signal f rom the safeguards lockout relay.
A-16
. -.
-
-
.
..
--
-
-
.
--
.
.
.
.
.
.
.... -.
_.
-....
.
. ~. -
.e.
J
-.
!
Requirements and Commitments:
GDC 39, " Emergency Power for Engineered Safety Features," requires, in part, that each onsite and offsite power system shall independently provide adequate-redundancy to permit the engineered 56fety features to function, assuming a failure of a single active component in each power system.
Documents Reviewed:
1.
.WE Elementary Wiring Diagram 499B406, Sheet 354 Revision 9, August 20, 1986, 2.
WE Cable and Raceway Report for Elementary Wiring Diagram 4995466, i
Sheet 354, April 2, 1990.
.
i:
3.
WEPC0 Nonconformance Report (unnumbered), "B03-B04 Bus Tie Breakers L
(1852-16Cand2B52-400)," April 4,1990 j
'
WE Night Order Book Form PBF-2015, notice that Unit I and 2 B03-B04 bus I
tie-breaker had 125-Vdc control power removed, April 5,1990.
L 5.
WEPCO Modification MR 85-053 (Unit 1), "B03-804 Tie Breaker Trip Circuit,"
May Ib, 1986.
.
ll'
-
.
A-17
- -
-
.
_ _ _
___
.. - _. _ _ _
._
.
..
.-.. _ _ _
_
,
s;
,
DEFICIENCY 90-201-09 Deficiency Title:
Incorrect Safety Classification and Nonconformance With
Separation Criteria of Control C6bling for 400-Yac Bcs l
Tie-Breakers (UnresolvedItem-Section3.3.1.1)
,
Description of Condition:
In investigating the single-failure vulnerability icentified in Deficiency
.
90-201-08, the team deters.ined that two of the cables for the 4B0-Vac bus
'
L tie-breakers were incorrectly classifiec as not safety related and thet'the routing of.the cables did not conform to the FSAR separation criteria. The two functionally safety related but also con-misclassified cables were not only(B03) to train B 450-Vac switchgear (804).
nected train A 480-Vac switchgecr L
WEPCO's cable and receway report indicated that the cables share comon race-
'
ways for the entire route.
I Appropriate corrective action taken by WEPCO for the single-f ailure deficiency
identified in Deficiency 90-201-08 for this circuit would eliminate the j
1 mediate safety concern in regard to this finding. However, WEPC0 should evaluate the extent and significance of the misclassific6 tion of cable and nonconformance with the separation criteria, particularly in light of the numerous nonconformances identified by the installation team (see Section 5.1.1 of the main report). This item remains open until WEPC0 resolves this generic
,
!
concern regarding cable classification, circuit separation, single failure, and
'
l integrity of the data in its cable and raceway management database.
L
"
Requirements and Comitments:
GDC 1, " Quality Standards," requir'es, in part, that structures, systems, and i
I l
components important to safety be designeo and tested to quality standards commensurate with the importance of the safety function being performed, and that quality records be niaintained throughout the life of the unit.
GDC 39, " Emergency Power for Engineered Safety Features," requires, in part, i
that each onsite and offsite power system shall independently provide adequate redundancy to permit the functioning of the engineered safety features, assuming failure of a single active component in each power system.
FSAR Section 7.7 (page 7.7-14) states that all cables for mutually redundant safeguards systems en run in separate trays or conduits.
Documents Reviewed:
1.
WEPC0 Elementary Wiring Diagram 499B466, Sheet 354, Revision 9, August 20, 1986.
2.
WEPC0 Cable and Raceway Report for Elementary Wiring Diagram 499B466, Weet 354, April 2, 1990, i
A-18
,
q.
e
!
' 3, WLP'C0NonconformanceReport-(unnumbered),"B03-B04BusTieBreakers-
'
.
l (1E52-160and2B52-400),"Apr11'4,.1990.
>
l.
WEPCO Night Order Book form P;F-2015, April 5,1990, notice that Unit 1
.
and 2 B03-B04 bus tie-breakers had 125-Vdc control power removed.
,
5..
WEPCO Modification MR 85-053 (Unit 1), "B03-B04 Tie Breaker Trip Circuit."
y May 15, 1986.
.
,
'l l
'l l
p-i
.
1
l
,
.,
l l
!-
t A-19
- -, -.. -. -..., _ _
_
.
.
..
DEFICIENCY 90-201-10 Def_iciency Title:
Nonconformance with FSAR Separation Criteria, and Potential t
i for Consequential Common-Mode failure of Both Trains of the
!
Component Cooling Water Pumps IUnresolvec item - Section 3.3.1.2)
'
y Description of Condition:
'
The team 4 review of elementary wiring diagrams and eeble and raceway routing reports indicated that portions of 125-Vdc control wiring for train A snd train B component cooling n ter (CCW) pumps shared the same raceway-The
.
wiring sharto vertical riser RB2 connecting miscellaneous relay rack (MRR)
a:
1C158 to the raceway systems servin9 main control board panel 1C03 and other s
destinations. This was not in ctmformance with the FSAR requirements for train f
separation and also raised a safety concern relatin9 to conformence with General Design Criteria 39 and 41 of 10 CFR P6rt 50, Appendix A.
A comon line-to-line (+ to -) oc short may be postulated within R82 (from a fire, for example) that could simultaneously blow fuses in the control power for CCW pump breakers in both trains. Both trains would be effected because of
_
the presence of both polarities of de power from both battery trains, and the E
presence of both safety-related and (predominantly) nonsafety-related dc
-
control conductors within the shared vertical riser. This event would require-E
_
that operators recognize that the control circuits were disabled and that the
'
.
switchgear fuses were the cause; identify, locate, and isolate the fault; replace the fuses; and return the pumps to service.
Since the CCW pumps
provide cooling to emergency core cooling systen. pumps, their continued w
tion must be ensured.
,
-
r
This item is open until WEPC0 takes appropriate corrective action to resc k RE the FSAR nonconformance ano adequately resolves the concern of common mode CCW pump Mllure.
Acquirements and Conuitments:
r FSAR Section 7.7 (page 7.7-14) states that all cables for mutually redundant
"
t safeguards systems are run in separate trays or conduits.
3i GDC 39, " Emergency Power for Engineered Safety Features," requires, in part, i
that the onsite electrical power systems be capable of supporting the required
safety functions, assuming failure of a single active component.
i
p"'
GDC 41, " Engineered Safety Features Components Capability." requires, in part, that engineered safety feature systems provide their required safety functions, F
assuming failure of a single active component.
y M.
Documents Reviewed,:
.
1.
FSAR Section 7.7, (page 7.7-14), Revision 1, June 1986.
2.
WEPCO Elementary Wiring Diagram 499B466, Sheet 317. " Component Cooling Pumps 1-P11A and 1-P11B," Revision 7, December 19, 1980 A-20
!
- - _ _ _ _ _ _ _ _ _
_ _ _ _
Mt;[ 't '.
-
,).
'
,g
..~
i 3.
WEPC0 Elementary Wiring Diagram 195A778, Sheet 420, 'S/D Relay i
,
ds '
1.-PC-439-X, Revision' 5. July 24,1984
-WEPC0 Cable and Racew&y Report for Cables 1J312A, 1K3116A, D1609A,
,
-ZA1810ac, ZB1623BC, March 29, 1990.
l
.
.
I S
.-
e A-21
-
.. -
- - _. _ _.
.
DEFICIENCY 90-201-11 Deficiency Title: Use of Non-Qua11ited Components in Safeguards Bus Breaker
.
Control Circuits
'
(0penitem-Section3.3.1.2)
Description of Condition:
A coninon control relay in the miscellaneous relay rack (MRR) originally provided with the nuclear steam supply system was shared by both trains of component cooling water (CCW) pumps. The relay distributed a low CCW header pressure start signal to the CCW pump breaker close circuits in both CCW and safeguards bus trains. Postulated failure of this relay or its circuits as a result of a seismic event could impair the function of both CCW trains. The CCW pumps support operation of emergency core cooling systeni pumps.
A related finding regarding inaaequate cabis separation involving these circuits is presented in Deficiency 90-201-10.
WEPC0 was not able to retrieve docunentation establishing that the MRR circuits that support the CCW pump breaker controls are included on the 0-list or are classified as safety related, and that the rack assembly and relay circuit in question are seismically qualified. The team believed that the original design basis for the MRR did not incluoe seismic qualification. WEPC0 stated that the MRR was qualified because it was similar in structure and configuration to the adjacent safeguards relay racks (SRRs); the SRRs were qualified as a part of the original design. The team tends to agree, on the basis of experience at other older plants and familiarity with the design.
However, documentation must be available to certify this assumption, and the equipment in question must be classified ano maintained as safety related.
An ongoing industry study by the Seismic Qualification Utility Group also may resolve this issue.
Pending these actions by WEPCO, th'is item is open.
Requirenents and Commitments:
GDC 1, " Quality Standarcs," requires, in part, that structures, systems, and components important to safety be desjgned and tested to quality standards consnensurate with the importance of the safety function being performed.
~
GDC 2, " Performance Standards," requires, in part, that structures, systems, and components important to safety be designed to withstand the effects of earthquakes.
Documents Reviewed:
1.
WEPC0 Elementary Wiring Diagram 499B466, Sheet 317, " Component Cooling Pumps 1-P11A and 1-P11B," Revision 7, December 19, 1980.
2.
WEPC0 Elenentary Wiring Diagram 195A778, Sheet 420, "S/D Relay 1-PC-439-X," Revision 5, July 24, 1984 A-22
_
.
__
._ _
_
I
.
.,
ALLEGED DEFICIENCY 90-201-12 Deficiency Title:
Vulnerability of Switchgear Control Power to Seismic Event That Opens Manual Transfer Switches (UnresolvedItem-Section3.3.1.3)
'
Description of Condition:
WEPC0 was unable to produce analyses demonstrating the seismic qualification of knife switches used to connect alternate de sources for switchgear control power. The knife switches were mounted on the vertical panels of the switchgear, were normally in the up position, and were only secured by the friction forces necessary to ensure sufficient electrical contact.
If the switches shook loose, all de control power would be lost to the switchgear busses, and all automatic and remote control would be disabled for safeguards and safe-shutdown loads. This would render both automatic and remote manual load sequencing inoperable.
It appeared that this change to the design was made by the architect / engineer after the equipment was seismically qualified. WEPC0 was attempting to seismi-cally qualify the knife switches by test and analysis, and had committed to any necessary corrective action. Although successful qualification by thorough and
'
conclusive analysis and test with adequate margin is acceptable, it may be difficult to establish a repeatable and representative range of forces that would consistently disengage the various switches.
Requirement:
.
GDC 2, " Performance Standards," requires, in part, that structures, systems, and components important to safety be designed to withstand the effects of earthquakes.
Documents Reviewed:
WEPC0 Elementary Wiring Diagram 4998466, Sheet 219, Revision 6. July 2, 1970.
,
e l
l l
A-23
..- - -
-
...
.-
--.
--
. - _ _ _
_ - -
-
- -
.__-
p o
'
l DEFICIENCY 90-201-13 Deficiency Title: Nonconforming Diesel Generator Sequence Logic (Unresolved Item - Section 3.3.1.4)
Description of Condition:
FSAR Section 8.2.3 (page 8.2-11) requires that the emergency diesel generator (EDG) cutput breaker close automatically after the unit comes up to s)eed ano voltage. WEPC0 Emergency Generator Starting Logic Diagram 883D195, 51eet 6, also showed that the breaker is not to be closed until the alternator output voltage is up to an acceptable level. The team noted that this was typical practice for diesel generator breaker closing logic. The team reviewed Elemen-tary Wiring Diagrams 499B466, Sheets 1509, !J08, and 263, and EDG vendor (GeneralMotorsElectromotiveDivision) Drawing 8413730. The team identified a deviation from the FSAR comitment in that the alternator output voltage interlock had not been provided in the breaker close circuit, as required.
The FSAR takes credit for the breaker closing only when rated voltage is available, thereby providing the assumed initial conditions for voltage drop and dynamic analysis of the safeguards bus and distribution system during the automatic loading sequence. These conditions begin with the initially connected loads of the safety injection pump-(nominal 700 hp) and the station service transformer inrush and 480-Vac loads. A static analysis of the system was not available until late in the inspection, and it was the team's
,
I understanding that no dynamic analysis had been done.
Typicalpractice(andconsistentwiththeFSAR)istoensurethegeneratoris
!
ready for loading by providing an in~terlock with a voltage-sensing protective
,
relay connected to the generator s.ide of the breaker. 'No such device exists in L
the PBNP design. The PBNP design hssumed that the generator is read load when the engine saeed is 870 rpm (synchronous speed is 900 rpm)y to acc and there 1s no loss of= field, tie safeguards bus is isolated, and no overspeed trip or generator or bus lockouts exist. Whether the generator output is at rated voltage under these conditions will depend on several unknown factors including the dynamic response of the regulator, uncertainty in the speed measurement, and the dynamics of the machine. These factors may vary with time, so there is no assurance without conclusive analysis or testing that the diesel generators l
would be ready to automatically accept load under worst-case conditions follow-ing an accident.
If the limiting initial voltage conditions were shown to be inadequate, neither safeguards bus could automatically accept load without offsite power.
In the absence of conclusive documentation, WEPC0 comitted to perform a representative test during the week of April 9,1990, and to analyze the current design in consultation with the EDG vendor. Pending. successful resolu-tion by these means, and any necessary corrective action, this item is open.
Requirements and Comitments:
FSAR Section 8.2.3 (page 8.2-11) requires that the diesel generator output breaker close automatically after the unit comes up to speed and voltage.
A-24
-
-
. -
- - -
-.
..
-
-
-
~
.-
.
WEPC0 Emergency Generator Starting Logic Diagram 883D195, Sheet-6, Revision 7, showb that the breaker is not to be closed until the alternator output voltage is up to an acceptable level. The team noted that this was typical practice
~for diesel generator breaker closing logic, i
_ Documents Reviewed:
FSARSection8.2.3(page8.2-11), Revision 2, June 1986.
2.
WEPC0 Energency Generator Starting Logic Diagram 883D195, Sheet 6, Revision 7.
,
3.
WEPC0 Elementary Wiring Diagram 499B466, Sheet 1509 Revision 6.
WEPC0 Elementary Wiring Diagrani 499B466, Sheet 1508, Revision 7.
5.
WEPC0 Elementary Wiring Diagram 499B466, Sheet 263 Revision 14 6.
General Motors Electromotive Division Drawing 8413730, Revision 12, February 16, 1990.
7.
WEPC0 Procedure ORT-3, " Safety Injection Actuation With Loss of Engineered Safeguards AC, Unit 1," Revision 20, August 17, 1989.
8.-
WEPC0 Operations Refueling Test, Loss of Engineered Safeguards AC Simulta-neous With Safety injection (Unit 1), February 7,1974 9.
WEPC0 Memorandum from R. Hoyt to F. T. Rhodes, " Loss of AC Test With Safety injection Detailed Study," April 19, 1974
'
.
..
"
[
'
'-
.
l l
l
.A-25
.
-
-
- - -
.
.
-
-
- -.
._
_
__
_
_
. _ - - _.
__
_
___
_
. _ _
.
___
.
..
DEFICIENCY 90-201-14 Deficiency Title:
Excessive DC Voltage Applied to Equipment Terminals (Unresolved item - Section 3.5.1)
Description of Condition:
Saf ety-related equipment powered by de systems should have voltage ratings that correspond to the variations in httery terminal voltage and de system bus voltage.
In recognition of this general design requirement, Institute of Electrical and Electronics Engineers (IEEE) Standard 946-1985, Section 7.3, specifically addresses this issue and recommends that equipment maximum and minimum voltage ratings govern the allowable de system voltage. With respect
to excessive de voltage applied to equipment, NRC Information Notice 83-08 notified the industry that certain saf et,y-related components subjected to voltages above their rated design voltage may degrade as a result of such stress mechanisms as heating and embrittlement.
L The team reviewed Calculation N-89-025, which determined the size of the new l
station battery (0-05) that was recently replaced under Modification Request l
MR 88-074 Battery 0-05 consisted of 59 Exide type 2GN-23 cells. The Exide Battery Instruction Manual (Section 50, page 8 Figure 10) stated that the recomended float voltage per cell was 2.17 to 2.26 Vdc.
Using the methodology in Section 6.1.1 of IEEE Standard 485-1983 and the maximum cell float voltage recomended by Exide (2.26 Vdc), the team determined that the maximum allowable battery voltage shoulo be.133.3 Vdc. The team found that the actual float voltage (based on meter readings in the control room and at the battery charger) for battery D-05 was 135 Vdc. The team also found that Section 3.6.1 of Routine Haintenance Procedure RMP-46 allowed battery float voltages exceeding 135 Vdc based on a criterton of 2.38 Vdc per cell. Battery float voltages exceeding 133.3 Yde are npt consistent with the manufacturer's recommendations and the guidance provided by IEEE Standard 485-1983.
The team was concerned that high battery float voltages would exceed equipment I
design ratings. The team asked WEPC0 to demonstrate that de equipment ratings (for control components such as switchgear closing coils, trip coils, anti-pump relays, and Westinghouse type BFD and MG-6 relays) were within the maximum allowable battery voltage range.
In response to the team's request, WEPC0 provided product data sheets for some of the oc equipment. The data sheets showed that the device rating was 140 Vdc (4160-V switchgear trip coils, Agastat diesel generator load sequence timing relays, Westinghouse HFB-type circuit breakers, and Westinghouse inverters). WEPC0 stated that the technical information for the resiaining de equipment was not available. However, the team was informed that Nonconfonnance Report (NCR) N-88-069 had previously
shown that the voltage rating for the closing coil circuit in the Westinghouse 4-kV type DHP switchgear was only 90 to 130 Vdc. Since the batteries were floated at 133 Vdc and above, the switchgear closing circuit was supplied with control voltage above its specified rating.
l NCR N-88-069 recommended that the battery float voltage be reduced after addition of a swing battery. The team noted that Internal Non-Routine Request for Services NRR-139 identified this concern pertaining to high float voltage and requested an evaluation of de equipment ratings based on IE Information A-26
.
_ --
. _ _
_
_
_
__
. _.
_. _ _ _ _ _ _ _ _ _ _ __
__
'
.
S Notice 83-08.
However, the licensee did not perform a further engineering evaluation of other. de equipnent because a thira battery was purchased, and in Internal Correspondence PBM 89-0610 cancelled the evaluation.
Requirements and Consnitaents:
10 CFR Part 50, Appendix B, Criterion III, " Design Control," requires, in part, that seasures be established to ensure that applicable bases are correctly
!
!
translated into specifications, drawings, procedures, and instructions.
10 CFR Part 50, Apper. dix B Criterion XVI, " Corrective Action," requires, in part, that measures be est6blished to ensure that conditions adverse to qu611ty, such as nonconformances, are promptly identified and corrected.
Documents Reviewed:
1.
IEEE Standard 946, " Design of Safety Related DC Auxiliary Power Systems for Nuclear Power Generating Stations," 1985.
2.
NRC 'lE Information hotice 83-08, " Component Failures Caused by Elevated DC Control Voltage," March 9, 1983.
3.
Bechtel Drawing E-6, Sheet 1. " Single Line Diagram 125Vdc System," Revi-
.
sion 16,. January 16, 1989.
L
4.
WEPC0 Calculation N-89-025, " Battery 005 Sizing," Revision 1 March 23, 1990.
5.
IEEE Standard 485, " Sizing Large Lead Storage Batteries f or Generating Stations and Substations," 1983.
L 6.
Exide Battery Instruction Manual, Control No.1384, Section 50, page 8, Figure 10, " Float Voltage per Cell."
l 7.
IEEE Standard 450, " Maintenance, Testing, and Replacement of Large Leaa l
Storage Batteries for Generating, Stations and Substations," 1987.
8.
WEPC0 PBNP Routine Maintenance Procedure (RMP) 46, " Station Battery,"
Revisicn 5, October 25, 1989.
9.
WEPC0 Nonconformance Report N-88-069, "4160V Switchgear, 125Vdc Batter-ies," May 3, 1988.
i l
L 10. WEPC0 Internal Non-Routine Request for Services (NRR) 139, "Non-Routine Request for Services,125Vdc System," March 3,1989.
11. WEPC0 Internal Correspondence PBM 89-0810, "NRR-139 Cancellation,"
August 11, 1989.
<
A-27
--
...
.
--
.
. - - ---
-
. - -
.. _ -
-4-o L
DEFICIENCY 90-201-15 Deficiency Title:
Incomplete fuel Oil System Seismic Category 1 Classification (Unresolved item - Section 4.1.1)
_ Description of Concition:
The Technical Specifications and basis for av611 ability of the emergency diesel generators (EDGs) require thht 11,000 gt11ons of fuel oil be available. WEPC0 committed during licensing that this anount would be available in a seismic Category I structure, the emergency storage tank. However, the fuel oil.
transfer system that trdnsports the fuel oil from the emergency storage tank to the EDGs was only partially qualified as seismic Category 1.
WEPC0 was in the process of analyzing the pipins located in the fuel oil pumphouse.
The prelim-inary results indicated that the piping stresses were above the allowable values specified in the Anerican Society of Mechanical Engineers Boiler and PressureVesselCode(ASMECode). WEPC0 was planning to modify the system supports. No calculations were available for the team's review.
l According to WEPC0 the piping in the EDG rvoms was installed using the methods for installing seismic small-bore piping specified in the architect / engineer handbook. WEPC0 did not have any calculatioas to support the seismic adequacy
,
of this piping. Therefore, the team's preliminary concluston was that the l
functionality of the systerr could not be determined, immediately following the inspection, WEPC0 performed a detailed review of the seismic capabilities of the fuel oil system. As a result of that review, WEPC0 determined the system was inoperable and modified the system supports before declaring the system-operable.
-
Requirements and Commitments:
Point Beach Technical Specification 15.3.7 A.1.c requires that 11,000 gallons l
of fuel oil be available.
,
GDC 2, " Performance Standards," requires, in part, that systems and compor.ents essential to the prevention or mitigation of accidents be capable of with-standing the forces of earthquakes.,.
Documents Reviewed:
Preliminary facility Description and Safety Analysis Report, Docket No. 50-301, January 11, 1968.
A-28
e a
DEFICIENCY 90-201-16 Deficiency Title:
Fuel Oil Cloud Point Substantially Higher Than Required
'(Unresolved Item - Section 4.1.2)
Description of Concition:
In a letter to the NRC dated March 24, 1980, WEPC0 addressed the quality assurance requirements for the emergency diesel generator fuel oil system:
" Fuel oil is purchased under the agreement which includes specific requirements for the fuel oil properties. These requirements are generally consistent with those specified in ANSI / ASTM American National Standards Institute /American Society for Testing and Materiels Standard D975-78.
(Regulatory Guide 1.137 endorses this standard.)" According to Regulatory Guide 1.137, the cloud point shoulo be less than or equal to the minimum temperature at which the fuel oil will be maintained curing the time it will be stored.
For the winter months, this would be even more restrictive than the ANSI / ASTM 0975 requirement for cloud point, which is 6 'C above the specified tenth percentile minimum ambient temperature.
The team reviewed the laboratory reports of the fuel oil test samples for the last few yesrs and found that these reports did not always report the cloud to 22 'F than the maximum (-7 'F) point was reported, it was always higher by 12 point. Moreover, when the cloud recommended by ANSI / ASTM D975.
In some Instances, WEPCO had noted the high cloud point temperature in its files, but took no action. The high cloud point temperature was inconsistent with WEPC0's comitment as stated above. Nonconformance reports were not filed for these instances as required and safety evaluations were not performeo.
'
WEPC0hadaddressedNRCInformationNotice(IN)87-04,"DieselGeneratorFails Test Because of Degraded Fuel."
Iti a memorandum to files it stateo, "PBNP fuel oil samples generally neet this standard [ ANSI / ASTM D975-78] except for cloud point. This-is due to the specification for oil procured by the company and has no real effect on the quality of the fuel oil." The team did not agree with this assessment for the following reasons:
The fuel oil cloud point is sign 1ficant because it is the temperature at which the fuel becomes cloudy as,a result of the formation of wax crys-tals. This is accompanied by an increase in viscosity and, therefore, friction, as well as an increased likelihood that strainers, valves, and pipes would be clogged.
It was the team's assessment that under extreme cold weather conditions, such as -10 to -15 *F, the " pour" >oint (tempera-ture at which the fuel no longer flows) of the fuel oil mig 1t be reached, in this case, the flow would stop completely.
O Considering that both fuel oil storage tanks, and a good portion of the 4-inch piping attached to them, are above ground and exposed to the elements, the high cloud point could impair the following processes and scenarios:
A-29
. _ _ _ _ _
.
-
- - - -
- --
.
.
_.
-
-
.
.
.
i WEPCO's procedures pertaining to draining fuel oil by gravity to meet
-
the requirements of 10 CFR Part 50, Appendix R, nay not be satisfied because of the inability of an extremely viscous fuel oil to drain to the emergency diesel generator day tanks.
Replenishing of the fuel oil in the energency tank via gravity from
-
the storage tanks under normal circumstsnces may not be feasible.
The fuel oil transfer pumps of the gas turbine may not be abic to
-
pump the required flow to the gas turbine, or nay stop completely.
This turbine would be required to operate under station blackout conditions.
WEPCO stated that it had experienced some cold weather problems and that it was looking into ordering a fuel oil that would have a lower cloud point and would be compatible with all needs of the plant.
Finally, the team reviewed Instruction PBNP 4.12.22, " Fuel Oil Ordering, Receipt & Sample Disposition Instruction." By this instruction, WEPC0 required, for emergency situations only, delivery of No.1 grade fuel oil during the months of October through March. However, the existing agreement with the supplier was for No. 2 grade fuel oil only.
Requirements and Comitments:
10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action," requircs, in part, that measures be established to ensure conditions adverse to quality are promptly identified and corrected.
.
l ANSl/ ASTM D975-78, " Standard Specification for Diesel fuel Oils," which speci-fies fuel oil cloud points based on average ambient temperatures, l
Docunents Reviewed L
l.
1.
WEPC0 Letter from C. W. Fay to H. R. Denton, " Docket Nos. 50-266 and 50-301, QA Requirements for Diesel Generator Fuel Oil Point Beach Nuclear Plants Units 1 and 2," March 24 4 1980.
L 2.
NRC IE Infornation Notice 87-04, " Diesel Generator Falls Test Because of Degradea fuel," January 16,1957.
3.
WEPC0 Instruction PBNP 4.12.22, " Fuel Oil Ordering, Receipt & Sample Disposition Instruction," NNSR, Revision 13, October 30, 1989.
4.
NRC Regulatory Guide 1.137, " Fuel-011 Systems for Standby Diesel Genera-tors," Revision 1, October 1979.
5.
WEPC0 Fuel Oil Purchase Order C-46320.
6.
ANSI / ASTM D975-78, " Standard Specification for Diesel fuel Oils."
A-30
_
__
__
_
_ _ _ _.
_.
__. __ _._ _ _ _. _.
_ __ _ _
_
__
._
.
C DEFICIENCY 90-201-17 L
Deficiency Title:
No Procedure to Control Upgrade of Fuel Oil System to Safety-Related Status (Unresolved Iten - Section 4.1.3)
l Description of Condition:
WEPC0 addressed several issues in its response to NRC Information Notice 89-50,
" Inadequate Emergency Diesel Generator fuel Supply," dated May 30, 1989. Those issues included the lack of a design basis for the fuel oil storage capacity and inconsistencies between the Technical Specifications and the FSAR. WEPCO determined that the following three issues 1ad to be addressed:
determination of the design basis for fuel oil capacity
reconciliation against the available storage capacity
revision of Technical Specifications and FSAR, based on the above findings The Technical Specification basis indicated that the total onsite availability was a 10-day supply, but the FSAR indicated that it was only a 132-hour (5.5-day) supply. The team noted that the Atomic Energy Consnission's safety
'
evaluation report (SER) for the operating license of Point Beach Nuclear Plant states, "0nsite fuel storage capacity is sufficient for a minimum of seven
,
days' operation of the required safety feature loads which is acceptable." The only common denominator for the Technical Specification basis, the FSAR comit-L l
ments, and the SER acceptance was the availability of fuel in the non-seismically designed outdoor bulk fuel tanks.
The team determined that-the fuel otl transfer system was originally classified
as nonsafety-related. WEPC0 provi.ded the team with Point Beach Action Request (PBAR)89-013, dated August 24, 1989, which initiated an evaluation of the fuel oil system for upgrading it to safety-related status. This PBAR evaluation would address, among other things, the above three issues. The PBAR replaced a previous Non-Routine Request (NRR) for Services No. 137, dated June 30, 1988, on the same subject. NRR-137 was written to address a concern resulting from a previous internal audit. The team observed that the PBAR was written more than
a year after NRR-137 was issued.
,
WEPC0 did not have a procedure for upgrading a nonsafety-related system to a L
safety-related system. The team's discussions with WEPC0 indicated that the L
evaluation WN1d involve a review of the present system configuration against l
criteria established in NUREG-0800. Differences between the PBNP system and l
HUREG-0800 criteria woula be identified as a result of this review and recom-l mendations for upgrading the system would be presented to the managers' super-l visory staf f for discussion and concurrence. WEPC0's scheduled the evaluation and the presentation for July 31, 1990 WEPC0 planned to use an approach for upgrading the fuel oil transfer system to safety-related status that was similar to the one used to upgrade the spent fuel pool. The team did not review the approach used to upgrade the spent fuel
,
pool cooling system. However, as part of the future upgrading of the fuel oil
'
system, WEPC0 had formulated an inservice testing (IST) program. The first functional test of the fuel oil transfer system, WMTP 11.54, was performed in A-31
=
_
__
-...
...
-
..-
. - -. -
-
-
.. -. -..
-
.
.
February 1989 in response to Nonconformance Report (NCR) N-88-162. This NCR addressed deficiencies in the original functional test, K-11.0, performed more than 20 years ago in 1909. These deficiencies related to both the flow rate
,
through the system and the automatic control functions of level transmitter
~LT-3932.- The first quarterly test, IT-14, of the fuel oil transfer pumps and valves was conducted on March 27, 1990, during the team's inspection.
Inlet pressure and flow instrumentation had not been installed. As such, IT-14 did L
not meet ASME Code Section XI requirenents.
Finally, the team observed that since the fuel oil transfer system did not consist in its entirety of two inoependent redundant systems, WEPCO would have to address single-failure vulnerabilities during the upgra e.
Requirement:
10 CFR Part 50, Appendix C, Criterion V, " Instructions, Procedures, and Draw-ings," requires, in part, that activities affecting quality shall be prescribed by docunented instructions, procedures, or drawings of a type appropriate to the circumstances.
Docunents Reviewed:
t 1.
NRC Information Notice 89-50, " Inadequate Emergency Diesel Generator Fuel
'
L Supply," May 30, 1989.
l 2.
NRC, NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," Section 9.5.4 "Energency Diesel Engine
'
Fuel Oil Storage and Transfer System," Revision 2, July 1981.
t
3.
Safety Evaluation by the Division of Reaco r Licensing, U.S. Atomic Energy Consnission, in the Matter of Wisconsin Electric Power Company and
'
Wisconsin Mfchigan Power Company, Point Beach Nuclear Plant Unit Nos. I and 2, Docket Hos. 50-266 and 50-301, July 15, 1970.
4.
WEPC0 Internal Correspondence from J. Z. LaPlante to J. J. Zach,
,
l June 21, 1989.
-
5.
WEPC0 Internal Correspondence from J. J. Zach to E. J. Lipke, "Non-Routine Request for Services 137," June 30, 1968.
6.
WEPC0 Internal Correspondence from V. E. Treague to J. C. Reisenbuechler,
" Diesel fuel Oil System - IST Program Review," December 12, 1989.
7.
WEPC0 Point Beach Action Request PbAR 89-013. " Evaluate Fuel Oil System for Upgrade to Safety-Related Status. Present Evaluation Results to MSS,"
i August 24, 1989.
8.
WEPC0 Letter NEPB-87-29, from J. Z. LaPlante to J. J. Zach, " Evaluation of the Spent Fuel Pool Cooling System for Upgrading to Safety-Related Sta-tus," April 21, 1987.
A-32
.
--
_
. - -.
---
,
-.
.
9..
WEPC0 P8NP In-Service Test IT-14. "In-Service lest of Fuel Oil Pumps and Valves," Revisior. O, March 27, 1990.
10. WEPC0 Test Procedure K-11.0, "Futi 011 Transfer System Functional Test,"
1969.
l 11.- WEPCO Work liaintenance Temporary Procedure (WMTP) 11.54, " Functional Test
.
of fuel 011 Transfer System," February 1989.
12. ASME Coce Section XI,1977/Sunimer 1979 Edition.
13. WEPC0 Nonconformance Report N-88-162, " Fuel Oil Transfer System; P70A&B, L
MOV 3930."
l
!
PBNP Technical Specificatioes, Section 15.3.7 A1.C.
l'
{'
,
e
l l.
!
!
,
A-33
.
.
_ ____
_..
-. _ _
_
________7
..
.
DEFICIENCY 90-201-18
)
Assurance (QA)pgrade of Fuel Oil System to Quality Undocunented U Deficieney Title:
Status (Unresolveditem-Section4.1.3)
Description of _ Condition:
Several nodification packages for the fuel oil system had not been classified as QA. WEPC0 stated that before about 1985, the only part of the fuel oil system that was classified as QA was the emergency diesel generator (EDG) cay tanks ano the associated piping connected to the EDGs. The clessification of the modifications was consistent with the classification of this part of the fuel oil system.
WEPC0 told the team that since about 1985, Revision 0 of the QA Policy Manual, which contained the " green line" diagrams of QA systems, identified the fuel oil system all the way back to the emergency fuel oil tank as falling within the QA scope. The team requested the docunentation of the upgrade and was told that before QA Procedure QP 2-1, dated November 12, 1987, was promulgated no formal process existea for upgrading the QA status of a system.
As a means of checking the QA status of the fuel oil system, the team requested the documentation of the above modifications as well as WEPCO's assessnent of the QA status of these modifications. Modification 704 was implemented in 1980 and was classified as non-QA. This modification rerouted underground fuel oil
.
' i piping between the emergency storage tank and the day tanks. Bechtel, the plant s original architect / engineering company, evaluated the rerouting and found it acceptable. Bechtel's acceptance of the modification was documented in a July 28, 1980, memorandum.
(However, the criteria for acceptability were not defined in the memorandum.) The team did find some evidence that piping and fittings were procured as QA-scope material. The docunentation also referred to ANSI B31.1. Specification PB-98 was written for controlling the installation work. However, WEPC0 was unable to produce any other quality assurance records for the installation.
Modification 82-51 was initiated and classified as non-QA in 1982.
It again rerouted the underground piping that.had been changed by Modification 704 Reference was made to Specification PB-98. Materials used were those lett over
,
t from the previous modification as well as some supplied by the installatian
'
contractor. WEPC0 again was unable to produce installation documentation for the modification.
I
!
Modification 83-150 was initiated and classifieo as QA in 1983 and involved the l
bypassing of the fuel oil transfer pumps. The work was done to address control l
. room inaccessibility concerns as well as a fire in the fuel oil pumphouse, which could potentially incapacitate both pumps.
Installation was performed by the site maintenance organization. The modification file did not include any material or instbilation documentation.
I The team concluded that WEPC0 did not have the documentation to support the upgrade of the system to QA-status.
l A-34
.
-
-
-
.
.
. -.
.
.-
-.
-
.
.-
..
i f.
..
Requirement:
{
~10 CFR Part 50, Appendix B, Criterion V, " Instructions, Procedures, and Draw-ings," requires, in part, that activities affecting quality be prescribed by documented instructions or procedures.
Docunents Reviewed:
1.
WEPCO Procedure QP 2-1, " Upgrading of Non-0A Scope Systers or Components to QA-Scope Status," Revision 0, November 12, 1987.
2.
WEPC0 Letter from D. H. Clark to D. K. Porter, " Emergency Diesel Fuel Oil-Line," July 28, 1980.
3.
ANSI B31.1.0-1967, " USA Standard Code for Pressure Piping."
WEPC0 Modification 704, " Reroute Fuel 011 Underground Piping HB-22."
5.
WEPC0 Modification 82-51, " Reroute Fuel Oil Line for Gatehouse."
6.
WEPC0 Nocification 83-150, " Bypass Luergency Fuel Tank." (Note: The title was incorrect. The modification bypassed the fuel oil transfer pumps.)
.
.
I L
L
.
.
A-35
.
.
...
. _ -.
---
-
-
-
..
..
-- _ -. - -.
t
.
.-
!
l DEFICIENCY 90-201-19 Deficiency Title:
Procedure PBNP 4.12.22. Revision 13, Deficient for Delivaring fuel Oil Under Emergency Conditions (Unresolved Item - Section 4.1.4)
Description of Condition:
I The Technical Specifications req)uirement for fuel oil inventory beyond theday tanks an emergency diesel generator (EDG j
gallons. The Technical Specifications basis showed that this amount provides t
for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of operation for one EDG only. This amount would provide for
'
.
about 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> of operation for both EDGs and a supply of oil for the heating boilers.
Fuel oil celivery to the site under normal and emergency conditions was gov-erned t.y Procedure PBNP 4.12.22, " Fuel Oil Ordering, Receipt & Sample Disposi-tion Instruction," Revision 13, dated October 30, 1989. The team found several oeficiencies in the procecure with regard to the ordering and delivery of f uel oil under emergency conditions:
To supply the req)uired quantity of fuel oil (equivalent to a 7-day con-l
sumption by EDGs, approximately 10 trucks will be required during a 7-day j
I period with staggered delivery and operations to be accomplished within 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The latter is the time that it takes to empty the day tank and portion of the base tank, which may be at their half-full points.
,
t l
'
O The celivery contract was with only one supplier.
It obligated the supplier to provide 125,000 gallons of No. 2 grade fuel oil during a 1-year period.
It was not clear to the team whether the quantity required for a 7-day delivery was available at the supplier's premises at all i
times. Such dependence was very restrictive and raised the potential for i
inability to respond in an emergency.
The truck must be dis)atched with a barreling nozzle and 150 feet of
,
companion hose.
If t11s hose and nozzle were unavailable or damaged during manipulations, fuel delivery could not be completed.
O lt may not be possible to slip the barreling nozzle and companion hose through the bottom ventilation louver; this may create a fire hazard.
No provision existed in the contract with the supplier for delivering the procedure required ho. I grade fuel oil during the months of October through March.
Requirement:
PBNP Technical Specifications, Section 15.3.7, requires that a fuel supply of 11,000 gallons be available. The basis for Section 15.3.7 indicates that the source of these 11,000 gallons is the emergency fuel tank.
Document Reviewed:
l WEPC0 Procedure PBNP 4.12.22, " Fuel Oil Ordering, Receipt & Sample Disposition Instruction," Revision 13, October 30, 1989.
A-36
-
-
-
-
.
---
-
. -...,,
.,.,,
.
.
ALLEGED DEFICIENCY 90-201-20 Deficiency Title:
Feasibility of Appendix R Scenario inadequately Investigated by the Licensee (Unresolveditem-Section4.1.4)
Description of Cnuition:
WEPC0 performed Calculation N-88-036 to determine the ability to drain fuel oil from the outside storage tanks to the emergency diesel generator (EDG) day tanks. This calculation addressed a modified (Modification 83-150) piping configuration that bypassed the fuel oil transfer pumps. Modification 83-150 was implemented to compensate for the potential loss of the control room or loss of both fuel transfer pumps because of fire. The team concluded that this calculation did not adoress the most limiting conditions and may not be conser-vative. The team had the following concerns:
The calculation used a single density and viscosity for the whole system.
The viscosity and density of fuel would vary significantly in the piping because part of the system was exposed to atmospheric conditiuns, a substantial part was buried under grour,4, one section was located above the frost line, and a part was in the pumphouse.
O The calculation considered flow to only one EDG day tank and no flow to the other EDG day tank or diesel-driven fire pump day tank.
Under very low temperatures (-15 'F) the fuel would not drain because of the high cloud point of the fuel oil in the storage tanks and the above-ground piping. Moreover, the calculation showed that the minimum average temperature at whichtfuel could drain to one EDG day tank was only 0 'F.
O The team could not adequately revie.: the geometry of the system because isometric drawings for the fuel oil transfer system were not available.
In addition, a design calculation for the norm 1 flow of the system did not exist.
,
~
O The gravity drain process could not provide fuel oil to the heating boiler day tanks. Although WEPC0 indicated to the team that under certain conditions the heater boilers may be required, it had not evaluated the significance of the boilers being unavailable.
WEPC0 performed a test, Work Maintenance Temporary Procedure (WMTP) 9.23, to verify that the outside storage tanks could drain into the EDG day tanks. The test, which ran for about 15 minutes in warm weather, indicated that sufficient drainage by gravity could be established and could potentially provide adequate fuel oil to both EDGs. However, the test did not demonstrate flow under conditions of extremely cold weather. WEPCO then used the flows that were inferred from WMTP 9.23 in Calculation N-88-0k to adjust the pressure drop through the system so that the analysis matched the test results. The adjusted value of pressure drop through the fuel oil transfer system was one-fourth the originally calculated value. However, the team was unable to verify the calculation and basis for the pressure-crop adjustments. Considering the A-37
..
. - -. _. _.....
.
a.agnitude of the adjustment, the team recommendwo that the licensee review N-88-036 for accuracy.
Moreover, there were three calculations that addressed the same topic. These
!
calculations were 5.12.1 dated September 13, 1983,85-009 dateo July 18, 1985, and N-88-036 dated June 21, 1988. There was no indicaticr. that the first two had been superseded by the last.
The team had additional concerns about the gravity drain process regarding the feasibility of realigning the system for gravity drain within 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> before the EDGs are starved of fuel.
O System alignment required the manual opening of the emergency fuel oil tank fill valve CV-3923 and manual line up of the cross-ccnnect valves F074 F075, F076 and F077 in the fuel oil transfer pump room. Following a-fire in the fuel oil pumphouse, access to the valves would require use of a portable pump, which was stored at elevation 26 feet in the turbine building. The location and use of the pump were not documented in the associated procedures.
O The gravity drain process would require continuity of the fuel oil; that is a siphon effect needs to be established. Establishing the siphon would require, among other thins,s, that the emergency storage tank first be filled up completely. This in turn would require that the emergency storage tank be leak tight, a condition not normally required for the tank.
Requirement:
,
10 CFR Part 50, Appendix E, Critersion Ill, " Design Control " requires, in part, that measures be established'for the selection and review for suitability of processes that are essential to the safety-related functions of systems and components.
Documents Reviewed:
1.
WEPC0 Calculation N-88-036, " Diesel Generator Day Tank Gravity Fill,"
June 21, 1988.
-
2.
WEPC0 Calculation 85-009, " Gravity Flow and Seismic Support Fuel Oil Transfer Piping," Revision 0, July 18,1985.
3.
WEPC0 Calculation File No. 5.12.1, September 13, 1983.
4.
WEPC0 Procedure A0P-10A, " Control Room Inaccessibility," Revision 9, August 17, 1989.
5.
WEPC0 Work Maintenance Temporary Procedure 9.23, Diesel Generator Day Tank Fill by Gravity, Modification Request 83-150," August 17, 1989.
6.
WEPC0 Drawing Change Notice for M-219, March 28, 1990.
A-38
-
.
.
.
.
.
..
...
..
_..
.
.
l ALLEGED DEFICIENCY 90-201-21
'!
Def1_ciency Title: Nonconservative Calculation for Emergency Diesel Generator l
Room Temperature
-
(Unresolveditem-Section4.3.2)
Description of Condition:
l The team reviewed WEPCO's evaluation of NRC Information Notice 87-09,
,
" Emergency Diesel Generator (EDG) Room Cooling Design Deficiency."
In the evaluation, which was docunented in Letter NEPB-87-536, dated June 29, 1987, WEPC0 identified several deficiencies with the installation at Point Beach and made six recommendations. The evaluation showed that the maximum temperature of 122 'F perinitted in the EDG room would be exceeded by 6 degrees, but WEPC0 considered this deviation acceptable. However, a subsequent internal audit by WEPC0 showed that this higher temperature was unacceptable, since it could degrade the performance of the diesel generators.
WEPC0 performed Work Maintenance Temporary Procedure (WMTP) 9.22 on May 25, 1988, to more accurately define some parameters in the original room tempera-ture calculations:
EDG heat radiation rates and flow rates for air exhausted from the rooms under various conditions.
WEPC0 performed Calculation l
N-88-034, "EDG Room Ventilation Test Evaluation," and using the results of WMTP 9.22, derived heat losses for the diesel generators under various condi-i tions. WEPCO then used the minimum diesel generator heat losses determined by Calculation N-88-034 and calculated-the maximum room temperature in Calculation N-88-040. The maximum calculated temperature was 118 'F, which was only 4
'
degrees below the diesel manufacturer's recomended maximum temperature of (
122 'F.
-
The team noted that the room conditions - only one fan operating - assumed in Calculation N-88-040 was not a condition considered in Calculation N-88-034 The minimum diesel generator losses chosen by WEPC0 to reflect the low diesel generator (radiation) losses at high room temperatures, were approximately i
one-third the losses recomended by the diesel manufacturer. Because of lack of tine, the team was unable to verify the justification for WEPC0's choice of l
minimum diesel generator losses. However, the team noted that this choice was not conservative and resulted in a lower ambient temperature for the diesel generator room.
Because the loading of the diesel generators was marginal and because operating the diesel generators in an ambient temperature that was above the reconnenced maximum could reduce the diesel generators' capacity, this item remains open pending further review by the NRC.
Requirement:
10 CFR Part 50, Appendix B, Criterion III, " Design Control," requires, in part, that measures shall provide for verifying or checking the adequacy of design.
i Documents Reviewed:
l 1.
WEPC0 Letter NEPB-87-536, June 29, 1987.
2.
Work Maintenance Temporary Procedure 9.22. " Emergency Diesel Generator Room Ventilation Test," Revision 0, May 25, 1988.
A-39
.-
-
.
.
..
k
'.
. EPC0 Calculation N-88-034, "EDG Room Ventilation Test Evaluation,"
= 3.
W
. June-10, 1988.
-WEPC0 Calculation N-86-040, " Diesel Generator Room Ventilation,"
'
July 7, 1988.
,
,
y O
.
,
l a
e L'
l.
l A-40 I
-
-
.
.
.
.
.
.
m.
..
..
-
. - - - -
_. _. - -
_-. --.
-
..
-
.
d DEFICIENCY 90-201-22 Deficiency Title:
Inadequate Physical Independence of fledundant Class 1E Cables (Unresolveditem-Section5.1.1)
Description of Corediti_on:
During its review of electrical cistribution systeni cable installations, the team determined that numerous Class 1E cables had been routed in violation of PBNP licensing requirements. Sections 7.2 and 8.2 of the FSAR prohibit the routing of redundant Class 1E cable in a common raceway. The technical basis for this restriction is given in GDC 20 and 23 of 10 CFR Part 50, Appendix A.
These criteria limit the potential for a single failure to compromise reliable operation of both divisions of vital system cabling.
Contrary to this requirement, a physical ex6mination of cable installations and subsequent review of the PBNP cable database disclosed approximately 25 race-ways that contained Class 1E cables of redundant engineered safety features and reactor protection system divisions.
These deficiencies represed ed a direct violation of PBNP licensing requirements and may impair safe and W 1able operation of vital plant systems.
.
Requirements and Commitments:
GDC 20, " Protection Systems Redundancy and Independence," requires, in part, that redundancy anc independence designed into protection systems shall be sufficient to ensure that no single.f ailure or removal from service of any component or channel of a system will result in loss of the protective function.
i GDC 23, " Protection Against Multiple Disability for Protection Systems,"
~
requires, in part, that the effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protective function or shall be acceptable on some other basis.
l
.
Documents Reviewed:
1.
FSAR Section 7.2, " Protective Systems."
2.
FSAR Section 8.2.3, " Station Emergency Power."
A-41 l
-.-
- -
-
-
-
-
-
,
'
,.
.
DEFICIENCY 90-20_1-23 Deficiency Title:
Potential Common-Mode failure of Turbine-Driven Auxiliary Feedwater Punip Automatic Start Circuitry (Unresolveditem-Section5.1.1)
L Description _of Condition:
[
_
i The team's review of Elementary Diagram 499B466, Sheet 1532, inoicated that cables ZC2NA012D and ZD2NA0128 perform redundant functions associated with the automatic start circuit for the Unit 2 turbine-driven auxiliary feedwater pump.
This circuit senses an undervoltage condition on 4160-Vac busses 2-A01 and 2-A02 through relays 2-272X1 and 2-272X2, respectively. An Agastat time-delay relay then initiates an automatic start signal to steam supply valves 2-2019 dnd 2-2020. The cables in question were routed through a common conduit.
Thus, a single tailure of any cable within the conduit could affect redundant control f unctions and defeat the undervoltage automatic start signal for the auxiliary feedwater pump.
As a result of this finding, WEPC0 issued Nonconformance Report N-90-058 to document and correct the condition noted. Additionally, Unit 2 was placed in a Technical Specifications limiting condition for operation status pending resolution of this deficiency.
_ Requirements and Commitments:
GDC 20, " Protection Systems Redundancy and Independence," requires, in part, that redundancy and independence designed into protection systems shall be sufficient to ensure that no single f ailure or removal from service of any component or channel of a system will result in loss of the protective
,
function.
GDC 23, " Protection Against Multiple Disability for Protection Systems,"
requires, in part, that the effects of adverse conditions to which redundant (.
i channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protective l
f unction or shall be acceptable on some other basis.
Documents reviewed:
1.
FSAR Section 8.2.3, " Station Emergency Power."
2.
FSAR Section 7.2, " Protective Systems."
l l
A-42
.-_
-
_-
- -. - -.
. -
-.
-.
- _ - - - - - - -
..
e i
DEFICIENCY 90-201 24 Deficiency Title:
Venting Steam on Safety-Related Cables (UnresolvecItem-Section5.1.2)
De, script 1_on of Condition:
The team observed that a condensate receiver tank vent was venting steam onto safety-related cable trays JE06, JE07, FV12, and FV13. The team inspected the cables in the affected trays and noted that the jackets of a number of single conductor cables showed signs of ceterioration and, in one case, the jacket hao peeled back exposing the inner insulation. Other cables in the trays were discolored. lhe team questioned WEPC0 and found that WEPC0 was aware of the venting steam and that the condition had existed for many years. However, WEPC0 had not investigated the effect of the steam on the safety-related cables. Atter further investigation, the team determined that the venting steam was the result of an earlier modification. The nod 1fication had config-ured this section of the condensate system so that higher pressure condensate and steam were feeding into a low-pressure header. The configuration resulted in a higher than normal pressure in the receiver tank and an abnormal amount of steam venting below the safety-related cables.
A ceterioration of safety-related cables could resuit in cable faults and could prevent the end devices connected to the affected cables from performing their intended safety functions.
As a result of this finding, WEPCO inspected the cables and determined that the most severely damaged cables were connected to nonsafety-relateo loads. WEPC0 also stated that the remaining cables were safety related and were within one train. WEPC0 issued Nonconformance Report 90-056 to evaluate the cables and determine what action was necessary.
In the interim, WEPC0 intended to wrap I
the affected cables in an effort to compensate for insulation damage and to l
minimize any further effects from the steam. After further discussion with WEPCO, the team noted that a modification package was being developed to
'
!
correct an overpressurization problem of the same condensate system. The l
modification could correct the venting-steam condition.
Requirements and Commitments:
WEPC0 Quality Assurance Manual, Chapter 19-1, Revision 0, " Environmental Qualification of Electrical Equipment," requires that any modification request
,
l that involves the installation or relocation of equipment that could poten-tially change area temperature, pressure, or radiation exposure omst be evalu-l l
ated for the effect on the qualified status of existing environmentally qualified equipment, l
WEPC0 Quality Procedures Manual, Chapter 15.1.5, " Guidance for the Issuance of
'
Nonconformance Reports (NCRs)," requires that an NCR be written when a noncon-
.
forming condition is discovered during performance of work. Section 15.1.5 gives examples of some nonconforming conditions:
incorrect use of an item,
'
incorrect installation, inadequate design, and faulty maintenance. Further-more, Section 15.1.5 requires that an NCR be initiated when the assignment of A-43
..
.
-
,
.
_
._.
__.
_
_
_
_
_
_
_.. _.
._
_
.
,
q
,,
. quality assurance scope EQ applicability, safety-related status, or similar scoping is improper or in question.-
10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action, requires that measurcs be established to ensure that conditions adverse,to quality, such as
- failures, malfunctions, deficiencies, deviations, defective material and equipnent, and nonconformances, are promptly identified and corrected, i
Document Reviewed:
WEPC0 Nonconformance Report 90-056, March 30, 1990.
.
t i
r
>
'
'
r
,
!
-
'.
!'
l,8 A-44
.
.. -
. -
.
.
.
.
.
_ _ - - _
_
.
_
. _.. _ _
_
.__ _
__
__ _ _ _ _ _
_ _.. _ _. _
,
.
,
, DEFICIENCY 90-20_1-25 Deficiency litle:
Inacequate /rogram for Calibr6 tion of Protective Relays (Unresolvec Item - Section 5.2.2)
'
Description of Condition:
The team found that all protective (i.e., undervoltage, differential, and
,
overcurrent) relays at Point Beach were periodically calibrated by a WEPCO relay group from an office in Appleton, Wisconsin.
.
'
This group was not part of the huclear Engineering Department or of the site staff and, therefore, was not subject to typical nuclear quality assurance (QA)
j requirements. As a result, the team determined that PBNP's safety-related i
protective relays were being calibrated by a group that was not under WEPCO's approved QA program. The following specific deficiencies were identified with respect to the calibration work.
O No specific work procecures existed for performing the calibrations. The
'
relays were purportedly calibrated in accordance with instructions con-tained in the manufacturer's manuals or leaflets.
O The setpoint document that contains the settings for all protective relays did not include tolerance bancs. As a result, it was unclear how much
deviation from the setpoints is acceptable before recalibration is required. WEPC0 told the team that relays were reset if they were out of l
tolerance by more than 3 percent; however, this number was not documented i
in any procedure nor had an eva.luation been performed to ensure its j
accepta>ility.
No program or procedures existed for trending or evaluating settings that
,
l were found to be out of calibration. The establishment of proper calibra-l tion intervals requires the trending and evaluation of these data, i
No program existed for evalating previously calibrated relays when the test equipment used to perform the calibrations was found to be out of calibration.
.
.
O Relays apparently had been repaired with parts procured by the relay group in Appleton. This work was not performed in accorcance with work proce-dures that apply at the nuclear plant.
In addition, the parts were not purchased to nuclear requirements and were not subjected to a consnercial-grade dedication program.
Requirements anc Cessnitments:
10 CFR Part 50, Appendix B, Criterion IV, " Procurement Docunent Control,"
requires, in part, that measures be established for ensuring that appropriate i
desig : :nd regulatory requirements are included in procurement docunents.
10 C?P, Part 50, Appendix B, Criterion V, " Instructions Procedures, and Draw-ings," requires, in part, that activities affacting quality be prescribed by documented instructions and procedures.
A-45
-
.
__
.
.,.
_ __ __
.. _
-. _ -
. _ ~ _
<
.
10 CFR Part 50, Appendix C, Criterton XI. * Test Control " requires, in part, a
[
test program that includes written test procedures that include acceptance criteria.
Docusent Reviewed:
Wisconsin Electric Point Beach Setpoint Docunent, Section 21.0.
!
,
9
.
e
!
.
-
[
l
!
'
A-46
...
-
.
_.
.
_-
O i.
l D_EFICIENCY 90 201-26 Deficiency Title:
Inadequate Surveillance Procedure for Elgar Inverters (Unresulved item - Section 5.2.3)
Description of Condition:
DuringitsreviewofRoutineMaintenanceProcedure(RKP)45fortheElgar inverters, the te6m found the procedure cid not include a check of the setting of the inverter's low voltage shutdown circuit. This circuit shuts off the invertor when the de input falls to sone predetermined value. The circuit is adjustable and if taproperly set could disconnect essential safety-related loads before the tina.s assumed in the plant's design basis.
To function properly, the circuit must not actuate until the battery cutout voltage reaches the v61ue assumed in the battery design calculations. Additional voltage crops for cable losses and setting tolerances also need to be considered and factored into the setpoint.
WEPC0 was unabit to confirm the exact setting of this circuit or that it had been tested since it was originally installed.
Discrepancies in the setting of this circuit had been addressed by Southern California Edison in Licensee Event Report 88-027, which reported the premature shutdown of the inverters at an input of 115 Y instead of the required 105 V.
Requiren=nt:
10 CFR Part 50, Appendix B, Criterion l!!, " Design Control " requires, in part, that neasures be established to ensure that the design basis is correctly translated into specifications and procedures.
Document Revieweo:
WEPC0 Routine Maintenance Procedure 45, " Station Battery," Revision 5, October 25, 1989.
,
e
,
A-47
_ _ _ _ _ _ _ _ _ _ _ _ _
_ __
_
_.
.
. _ ____
__.
.
.
I DEFICIENCY 90-201-27
!
Deficiency Title:
No Acceptance Criteria in Routint Maintenance Procedure 46 i
for Locating Grounds (Unresolveditem-Section5.2.5)
j Description of Condition-Routine Maintenance Procedure (RMP) 46, " Station Battery," was performed monthly to verify that the station batteries were in accordance with Technic 61 Specification requirements. The t=am noted that Step 3.6.5 of the procedure required that ground resistance meawrements be taken on each battery bus.
Although the procedure gave guidance on how to measure and calculate this resistance, no specific acceptance criteria were given. Consequently, once the ground resistance was calculated, no further evaluation or trending was l
performed.
The bettery chargers have a ground oetection light as well as a relay that i
sends en annunciation signal to the control room. On battery chargers D-07, 0-08, and D-09, this indication and relay were set at 500 ohms, and on chargers D-107, D-108, and 0-109, they were set between 18,000 and 19.000 ohmt. WEPC0 provided no basis for the alarm setpoints.
Requirement:
10 CFR Part 50, Appendix B, Criterion XI, " Test Control," requires in part, thattestproceduresincorporatetherequirementsandacceptancellmitscon-tained in applicable design documents and that tests be evaluated to ensure that test requirements have been satisfied.
Documents Reviewe,d:
-
1.
NRC Information Notice 88-86, " Operating with Multiple Grounds in Direct Current Distribution Systems," October 21, 1988, and Supplement 1, l
March 31, 1989.
'
t 2.
WEPCO Routine Maintenance Procedure 46, " Station Battery," Revision 5, October 25, 1989.
- A-48
_ _.
-
_ _ - -
.-. -
_
-.
.
.
_ _ _ _
_
r
.
l APPENDIX B PERSONS CONTACTED Wisconsin Electric Power Concany Personnel J. Anthony, Quclity Assurance Section D. Bell, Nuclear Systems Engineering and Analysis
- S. Cartwright, Nuclear Systems Engineering and Analysis
- C. W. Fay, Vice President
- G. Frieling, Superintendent Systems Engineering W. From, PbNP
- R. Heiden, Superintendent Nuclur QA W. Hennig, PBNP W. Herrmen, PBKP
- D. Johnson, Superintendent Nuclear Regulation
- P. Katers, Nuclear System Engineering and Aralysis
- G. Krieser, General Superintendent, QAS
- E. L1)Le, General Superintendent, NPERS
'J. Mciamara, Nuclear Systems Engineering and Analysis
- S. Mayer, Nuclear Systems Engineering and Analysis J. Meyer, PBNP R. Mitchell, CHAMPS Coordinator E. Mours, PBNP
- R. Newton, General Superintendent NSEAS C. Olson, PBNP G. Poletto, Impe11 Corporation
- T. Pridgeon, Nuclear Engineering Pro'jects J. Roberts, PBNP s
'
- T. Rodgers, OSRC
- S. Schellin, Superintencent, NEPD
- R. Seizert, Regulatory Engineer
- B. Susman, NSE
- J. Zach, Plant Manager
- E. Ziller, PBNP
-
'
Nuclear Regulatory Commission
+0 Gadzala, Region 111
- R. Gardner, Region 111
- B. Grimes, NRR/DRIS
- S. Guthrie, NRR/DRIS
- N. Jackiw, Region 111
- T. Martin, Region 111
- S. Stein, NRR/DRIS
- W. Swenson, NRR/PD33
- R. Westberg, Region 111
' Attended the exit meeting on April 17, 1990.
B-1