IR 05000285/1989040

Insp Rept 50-285/89-40 on 891023-27 & 1106-09.Violation & Deviation Noted.Followup Item Identified.Major Areas Inspected:Critical Components of Plant & Operational Activities Re Dominant Accident Sequences

ML20006C245
Person / Time
Site:	Fort Calhoun
Issue date:	01/23/1990
From:	Singh A, Stetka T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML20006C238	List: IR 05000285/1989040 ML20006C237 ML20006C240 ML20006C241
References
50-285-89-40, NUDOCS 9002070178
Download: ML20006C245 (32)

Text

~.

• ,

-]

~"'

.

C

@W;.

'

e,

.

,

.

p.;

k n-yM.:

..

h j. %

"

.

h

. APPENDIX C U.S. NUCLEAR REGULATORY COMMISSION

'

.,

REGION IV-f

'

'M

.NRC' Inspection Report:n 50-285/89-40

. Operating ~ License: -DPR-40'

,

, y

' Docket:: 50-285;

Licensee: Omaha Public Power District iOPPD)

,

444 South 16th Street Hall f

Omaha, Nebraska 68102-2246 p--

,

e

- Facility:Name:

Fort Calhoun Station L

a d

Inspection At:. Blair, Nebraska

- r y

'

' Inspection Conducted:.0ctober 23 through 27, and November 6 through 9, 19891 s

,

Inspector:

I

/!#390 e

A. Sin ~gh, Reactor Inspectafr Plant Systems Date

</

-:!

.Section,1 Division of Reactor Safety (Team Leader)

,

,.

Team Members:

J. E. Whittemore, Reactor Engineer (License.

.

Examiner).s0peratorLicensingSection, Division

,

'

of Reactor Safety l

'

!

u _

P. H. Harrell, Senior Resident: Inspector, Fort Calhoun Station j

R. E. Farrc11, Senior Resident Inspector Fort-St.'Vrain-

,

R. J. Travis Probabilistic Risk Assessment (PRA)

Specialist, Brookhaven National Laboratory (BNL)

'

E. A. MacDougall, Electricel Specialist, BNL j

i J. W. Chung, Senior PRA Inspection Coordinator,

,

OfficeofNuclearReactorRegulation(NRR)

j r

<,

J. Wing, Risk Analyst, NRR

,

.

A d

/ 23 90

- Approved:

,

Date

~

T. F. Stetka, Chief, Plant Systems Section

'

Division of Reactor Safety 9002070178 900130 PDR ADOCK 05000283 Q

PDC

,

}f'

f

-

..

j

.

,

1. 4

,

.

f...

,

inspection Summary A special, announced _ team inspection of critica11 components of the plant and

,

the operational activities relating to dominant accident sequences-developed by a generic-based risk assessment. The generic probabilistic risk assessment study identified the important systems, components, and activities that could contribute significantly to core melt accident sequences or mitigate the consequences of such events.

'

The inspection team concluded that Fort Calhoun Station emergency operating

'

-

procedures (EOPs), when used by experienced end trained operators, provided

adequate direction to mitigate the consequences of an accident. The risk-important systems and components are generally tested and maintained commensurate with their importance to risk. This provides reasonable assurance of syster/ component availability for accident mitigation.

Twoviolations(one'ofwhichwasnotcited),onedeviation,_andthreeinspector-followup-_ items were identified during this inspection. The violations involved:

(1) inadequate emergency operating procedures and abnormal operating

,

procedures; and (2) a licensee identified failure to have an adequate design

'

control program for electrical circuit fuses. The deviation involved a failure to conduct an E0P validation as committed to in the submittal to the NRC dated March 1, 1985. The three inspector followup items concerned:

(1) the lack of a fuse / breaker coordination study; (2) the lack of a fuse control program; and, (3) the lack of performance of a stroke test for.the power-operated relief valves (PORVs).

>

-2-

___

'

Y

~

<lW'a L ' %

y#

'

<

,

g..

1. .1p #

.

s u

e,a,

o y

.-

,p p p;g:'j P Fil ;- 4:

4rf1

.

-i a

" ~ '

>

,

Q-s-

i

.f-

,

,

s

,-

,

s m,.

y

,

.

,

.

1y

>.

- - * -'

.,.

<

,,,

~

'

1 SUMMARY

.

During the period October 23 through November 9, 1989, a team inspection was

conducted to evaluate the risk-based operational safety and performance assessmentattheFortCalhounStation(FCS). Since the FCS does not have a site-specific probabilistic risk assessment (PRA) study, a generic PRA-based

methodology was developed. This inspection was conducted to apply the generic-methodology at FCS in order to evaluate the availability of important systems -

and components and the success of operator actions to prevent reactor core

,

damage. The inspection was conducted _in accordance with the guidelines of

!

Inspection Procedure 93804, Risk-Based Operational Safety and Performance Assessment."

The inspection team concluded that the activities, systems, and components important to mitigate the consequence of a core melt accident were satisfactory _

at FCS; however, the following weaknesses were identified:

>

1.

Multiple examples of inadequacies were identified in abnormal and emergency operating procedures.

2.

The validation of emergency operating procedures was not completed in i

accordance with the licensee's commitment to the NRC in a letter dated March 1, 1985.

3.

There was no fuse / breaker coordination study for the -480 volt AC, 120 volt AC, and 125 volt DC buses.

4.

The lack of a fuse control program was noted. The FCS does not have a fuse control program to ensure that the correct fuses are installed. The design documents do not provide sufficient information to determine the proper type of fuse to be installed, and the program for procurement of

'

fuses does not assure correct fuses will be procured.

,

5.

The FCS power-operated relief valves were not being stroke-tested as part

-

of the inservice testing program (IST). The licensee made a commitment in Revision 3 of IST program to stroke-test these valves. However, this program revision will not be fully implemented until the end of the 1990

,

refueling outage.

The inspection team also identified the following strengths of the licensee's program:

-

1.

Discussions with the licensee's PRA staff revealed that OPPD will have a L

comprehensive PRA program when completed.

l l

2. -

The licensee's monitoring system to detect the intersystem LOCA was l

considered effective.

3.

General housekeeping was considered to be excellent.

i

!

,-

.

-

.

- - -

- - -

-

-

.. _ _.. _.

_ _ _ _ _ _ _ _ _ _. _.... _. _.. _ _......

_.

.. _

-

-

-

t c

<

....

'..

,

INSPECTION DETAILS

.

1.-

SCOPE OF INSPECTION A probabilistic team inspection was conducted to apply. the generic inspection methodology that is based on probabilistic risk assessment (PRA) insights at EtheFortCalhounStation(FCS). The objectives of the inspection were to

evaluate the availability of the systems and components important to mitigate i

!

an. accident, and to evaluate the ability of operator actions to prevent reactor core damage. The generic methodology used focused on core damage with one exception. The interfacing system loss-of-coolant accident (LOCA) sequence was-

also included due to the poten_tial offsite consequences of-such an event.

Eleven representative pressurized-water reactor (PWR) accident sequences have been developed. Each representative accident sequence and the associated PRA-based events were reviewed to determine relevance te FCS. The result was a

list of 11 dominant accident sequences and multiple combinations of component failures and human actions that can lead to core damage at FCS.

.'

.

.The 11 generic accident sequences were ranked on the basis of relative risk in accordance with Fort Calhoun's design. The 7 sequences of major concern are listed below:

i

Small or medium LOCAs with failure of high-pressure injection or

!

-recirculation; Interfacing systems LOCA;

Loss of 125 volt DC bus with failure of the auxiliary feedwater system i-

(AFW);

Loss of offsite power with failure of AFW and feed and bleed;

. Station blackout with loss of the ARI system;

• -

Loss of power conversion system (PCS) (or a general transient with loss of

,

PCS) followed by loss of AFW; and

'

A transient with failure to automatically and manually scram the reactor

• ~

with failure of timely emergency boration.

'

Each accident sequence is composed of an initiator with subsequent system failures that ultimately lead to core damage. Similarly, each critical system

'hasmultiplecombinationsofcomponentfailuresandhumanerrors(orbasic events) that can disable it. Each of these basic events can be ranked using an importance calculation, which is a relative measure in terms of prevention, mitigation, or recovery fron core damage sequences.

,

,

,

.

,

E 's

,

,

([v d-i

.

,

.,.

"

r iThe estimated. system importance ranking at Fort Calhoun is given below:

-System-Importance

,

Estimate g

"

' Auxiliary feedwater

.very high c

Emergency' power, AC and DC, including vital buses / inverters very high High-pressure safety injection (including recirculation mode)

high

'

10nce-through_ cooling (PORVs,blockvalves)

high

,

w Low-pressure injection medium H

e

. Room cooling medium l

Safety injection' and refueling water tank medium

,

Safeguards actuation logic medium.

Closed cooling water:

medium

l Raw water.

medium

.The inspection = scope was modified to account for recent station. experience.

.,

For_ example..the review of maintenance activities was de-emphasized because of.

the recent NRC maintenance team inspection. Since the emergency diesel generators-(EDGs) have been the subject of much scrutiny, they were given a lower inspection priority, with the exception of potential common-cause failures.

Although the; instrument air system is generally not addressed in-plant PRAs, it

- i

- can impact safety-related components. Because Fort Calhoun has a large number f

of safety-related air-operated equipment-(1200 components), the system was

'

examined during this inspection.

The' Fort Calhoun water chemistry program, which is also normally outside the scope of the PRA, was reviewed.

,

Four of the activities that ensure system and component availability were

,

examined. These are briefly described below:

x Accurate surveillances - to ensure the system or component is tested in a

manner that approaches an actual system demand; Timely surveillances - to ensure prompt detection of f ailures;

Prompt maintenance activities - to minimize component unavailability; and,

i-2-

yx w

-

,

~-

-

q

[j!;;,k,,y [

~

j

,.

-.

.

.

~

.

s r

<

.,

g

,

(

. g'[

'

"

,

,

,

,

q

'

.

i PreventionLof failures,' including trendingiprograms and root-cause d

'

.-

analysis,- to maintain availability of systems and components.

'

,

,

.

{M Human actions were addressed in'the specific areas described below:

,j

~

g

,

Training' to confirm the operator has received adequate training to

l

• -

>

y address high-risk sequences;

• -

Human factors - to minimize the potential for human error;

,,

' Procedure adequacy

.to confirm that the operator has clear guidance; and,-

'

'E Control room' simulations - to review operator response to selected risk

!

significant accident se_quences.

>

>

,

J2.

ASSESSMENT OF EMERGENCY OPERATING AND ABHORMAL OPERATING PROCED'URES

'

-.

The inspectors. interviewed licensed operatorst n the control room to. assess the-

.

i

'

'

effectiveness of the emergency operating procedures (EOPs) and an abnormal =

"

operatingprocedure(A0P). The inspectors also1 evaluated the knowledge of the

-

- operators to detect and mitigate _ a LOCA in aisystem located outside the

~

,

containment that? interfaces with the reactor coolant system (RCS). During

,

these_ interviews, procedures were walked down, Technical ~~ Specifications-(TS);

'

f

. interpreted,- and specific equipment operability determined.

,

2.11 Operator Performance With AOP Usage l

-

T'

'The inspectors walked down AOP-17, " Loss of Instrument Air,"; Revision 13, for

!

all portions performed in the control roomthe walkdown, decreasing: instrument _ air-(

During

'.

yi other event or transient in progress. The operator,was provided cues to

-

represent' changing plant conditions and was asked to interpret various steps, notes, and cautions. -The following procedural inadequacies were observed-during this effort:-

x

'A0P-17 instructs the operations staff to control feedwater flow using the-

feedwater regulating bypass valves through the alternate auxiliary ifeedwater injection path. However, the auxiliary feedwater injection

'

valves (normal flow path) fail open on a loss of IA system pressure,

-

e

Therefore, while the operator is establishing flow 4 control with the main

'

-feedwaterregulatingbypassvalves,thesteamgenerators(SGs)continueto be filled through the normal flow path. This procedural inconsistency

,

represents n' potential for initiation of an overcooling event.

"

>

o

-

If_IA system pressure is lost, the pressurizer spray valves fail closed.

,

A0P-17 notes that RCS pressure control may be difficult, but the procedure does not provide information about the alternate method available for pressurizer pressure control (i.e., use of a charging pump through

-

y solenoid-operatedValveHCV-249). This lack of procedural information

~,

could lead to a potential overpressurization event and unnecessary challenges to the pressurizer relief and safety valves.

l

,

-3-r i

.

l

'

'

__

.

y-.

,

,

J,..'

TS 5.8.1 requires the-licensee to have adequate A0Ps. The procedural problems-discussed above represent inadequacies with Procedure AOP-17 and are considered to be an apparent violation of TS 5.8.1.

Violation (285/8940-01):

Failure to have adequate procedures to mitigate transient plant conditions.

In response to the procedural problem with regard to initiation of an.

overcooling event,-the licensee revised Procedure AOP-17 to specify the correct method for feeding the SGs if IA system pressure is lost. The licensee had not addressed the problem of providing information in Procedure A0P-17 regarding

.the method for pressurizer pressure control on loss of IA system pressure by the conclusion of the inspection.

-These inadequacies only represented a portion of the observations made during

!

the execution of the walkdown of A0P-17. The following additional problems

were identified:

j i

No sumary sheet was provided for what happens to the valves in containment when IA system pressure is lost. Sumary sheets were provided for valves in other plant areas. Containment summary sheets would provide a good reference for operations personnel.

• Step 3.1.7 states that if air pressure returns to normal, refer to

Attachments 1 and 4 for the failure mode of valves located in containment.

This step.does not provide operators with specific actions to take. Some valves in Attachment I do not have position indication in the control i

room; therefore, it is not apparent how the operator can verify the

failure mode position.

• A note:in Procedure A0P-17 states that raw water / component cooling water (RW/CCW) interface valves to and from the shutdown cooling heat exchangers, safety-injection and containment spray pumps, and containment and control room air handling units, are equipped with accumulators designed to hold valves closed for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. As a precaution, these valves

'

should be hand-jacked closed. A list-of the appropriate valves was not provided in the procedure.

Inaddition,ValveHCV-2812C(aRW/CCWinterfacevalve)couldnotbeshut I

because of interference between a pipe and the handwheel. When the

'

inspectors notified the licensee of this observation, the licensee removed

the handwheel on Valve HCV-2812C and replaced it with a ratchet wrench, which allowed the valve to be hand-jacked closed as directed by the procedure.

Attachment 4, " Air-0perated Yalves with Accumulators," provides the expected length of time a valve will be operable after a loss of IA pressure. For 16 RW/CCW interface valves listed in the attachment, the procedure states that the valves will remain operable for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The accunolator assemblies for the valves were tested after the initial installation in approximately 1972 and have not been tested since; therefore, it is not apparent how the 2-hour time was established.

-4-

'

-

1.

p%pc'

y-

,

,

,

g

.,

.

'

n

- '

'

'

i

'

,

y w

f

'!

~'

v

'

r Step 3.2'10 irnplies that any containment-isolation valve not in its fail i

'

';

-

.

i

safe' position shall'be manually operated to establish containment ~

~

i integrity. This may require a containment" entry when ~ undesirable. - The

, ;

licensee should review this step to determine =the actions that operations:

,

personnel should be performing.

"

":

Although the procedute states that the operator may manually block

-

" air-operated valves:1_n a' position other than their fail safe position, the

'

inspectors could not' determine-how valves that failed shut, could be

-

. manually blocked ^in the open position.

,,

,

,

.

iThe licensee has performed a review of the concerns listed above.-_A change to

<

n'

Procedure A0P-17 was made to address;the concerns. =-

>

'

g

-

v-

'2.2 Operator Performance With E0P Usage

<

,

,

,

1, The inspectors developed two scenarios to:be used to evaluate:

(1) the ability'

.

p of. control room operators to exercise the E0Ps, and (2) the effectiveness of-

,

the EOPs. The specific accident sequences were selected on.the basis of their i

e applicabilityt to FCS and generic PRA int,ights for PWR plants. The first 1 scenario used a station blackout as the initiator with failure of:the AFWS

"

'

system., The second scenario used a loss of offsite power as therinitiator with

-

a subsequent loss of all fee'dwater. Both of these sequences have an enhanced

'

applicability, to FCS because of the high estimates for failures ofzvarious

, safety-related equipment and systems. The scenarios were walked down 1n the

'

~

g control room with.an off-duty operations crew. These walkdowns encompassed the

'

, following E0Ps:

'

Eme

. -

Operating Procedure (EOP)-00,:" Standard Post Trip Actions,"-

'

-

Rei

.c

.1; ~

,

N E0PA,' Loss of Offsite PoweF/ Loss of Forced Circulation,"

n Revision 6; c

p

,

.

E0P-06, " Loss of All' Febdwater," Revision 4;

'

'

-

-

E0P-07, " Station Blackout," Revision 0; and

-

'

i E0P-20, " Functional Pecovery Procedure," Revision 6.

-

The' inspectors initiated the problems by providing the operators with initiating.

q cues to depict plant conditions. Subsequent cues..were provided to the operators depending on their individual and collective actions. With this methodology, it L

i was not possible to assess operator perforraance or effectiveness in taking actions required within critical time restraints. :The inspector observed these scenarios and'was able to provide insight as to how operator performance and procedures affected risk.

,

L l

As the result of the execution of these scenarios, the following procedure

'

inadequacies were' identified:

-5-

'

.

.

a

.

'

. o

.O I

Step 3.6.d of E0P-C2, " Loss of Offsite Power / Loss of Forced Circulation,"

does not address the need to augment the cooling water for the air compressors if turbine plant cooling water is not available.

(Insufficient cooling water could result in overheating and subsequent-loss of the air compressors.)

Steps 3.8 and 3.9 of E0P-02 do not provide instructions for the control

'

room operator to ensure that the radiator exhaust dampers open for emergency diesel generators 1 and 2.

(Failure of the dampers to open wouldresultinoverheatingandsubsequentinssofthedieselgenerators.)

E0P-06, Step 3.11, Contingency Action states:

"1 mediately Initiate Once

Through Cooling if both steam generators (SGs) ar~el ess than 201 (wide range) and RCS temperature it, increasing." This step was inserted into the procedure as a result of the safety evaluation report for Generic Issue 124, " Resolution of Generic Issue 124 Auxiliary Feedwater Syttem Reliability, for Fort Calhoun," dated May 9,1988. As previously pointed out, there is an urgency to initiate ence-through cooling early in a transient to ensure it will be successful. The only place in the procedure that this urgency is communicated to the operator is in Step 3.11 of E0P-06. There are numerous situations that could occur in which the operator would exit the procedure before reaching this step.

For example, E0P-06, Step 3.2.c. directs the operator to E0P-20. The licensee needs to review the E0Ps to ensure that this urgency is repeated throughout the E0Ps so that it can be comunicated to the operator when necessary.

E0P-20, Resource Tree E, page 30, indicates that once-through cooling will

be successful if there is one operating high-pressure safety injection (HPSI) pump and RCS pressure is less that 1350 psia. Step 6.8 of the safety function status check for core and RCS heat removal does not designate the number of HPSI pumps needed to meet the success criteria. A caution on the first page of HR-4, the procedure for once-through cooling, states that successful heat. removal using once-through cooling requires both power-operated relief valves (PORVs) and at least two HPSI pumps.

The caution statement directly conflicts with the requirements found in the resource tree and the cafety function status check.

Further, if this caution statement is accurate, it may not be seen by the operator for several minutes while he is performing instructions for all safety function success pathL in use.

The procedural problems discussed above represent inadequacies with the E0Ps and are considered to be part of the apparent violation of TS 5.8.1 identified in paragraph 2.1 of this report.

These inadequacies only represented a portion of the observations made during the preparation and execution of these scenarios. The following additional problems were identified:

E0P-00, Step 3.7, did not explain how to verify that the numbers 1 and 2

DC buses were energized. The crew pointed out two different methods to-6-p

_ - - - _ - -

--

-

-- - - - - - - -

__.

.

.

.

,

t

.. '.

l e

.

-

,

determine that the bus s were energized but did not know what constituted i

a satisfactory verifit.6(ion.

r

E0P-00, Step 3.13, directed the operator to verify conditions associated with the SGst Substeps c and d required the operator to take specific

,

actions. Action steps should not be hidden.

.l

E0P-00 reovired the operator to verify that one of the component cooling i

water (CCW)pumpswasoperatingatgreaterthan60psigdischarge

gressure. However, the safety function status check (SFSC) for E0P-02

-

Maintenance of Vital Auxiliaries (MVA)," required that two CCW pumps be i

in operation. The purpose of E0P-00 is to ensure that all SFSCs are satisfied. Therefore, the requirements of steps in E0P-00 and an SFSC

should be identical.

!

Licensee personnel informed the inspectors that the use of E0P resource i

trees and flow chart diagnosis was not a requirement. Step 3.16 of E0P-00 instructs the operator to enter E0P-01 for a normal reactor trip recovery l

or provides contingency action directing the operator to the diagnostic

'

action flow chart. There are no procedure steps that allow the operator

,

Recovery) y access one of the event-specific E0Ps or E0P-20 (Functional to directl i

without transition through the diagnostic action flow chart.

!

t The format of the E0Ps requires E0P-00 to be completed prior to entering

.

subsequent E0Ps.

In the event of a loss of feedwater, the operator is not

'

instructed to isolate SG blowdown until Step 3.10 of E0P-06. Since E0P-06 is not performed until after E0P-00 is completed, this results in an extended inventory blowdown of the SGs.

In addition, E0P-00 and E0P-06 have a number of w it" points prior to the operator reading Step 3.10.

Therefore the pompility exists that the operator may not isolate the SG

blowdown resulting in a considerably reduced heat removal capacity of the SGs.

The operators demonstrated a decided unfamiliarity with the heat removal

capability of the steam generator (SG) inventory after the occurrence of a

loss of all feedwater. When asked about their estimate of elapsed time before SG inventory would be exhausted after a reactor trip with no i

feedwater available, answers ranged between 1 and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. A lack of oserator knowledge about SG inventory--hence, loss of heat removal ability

,

wiich may be exhausted within 20 minutes after reactor trip--could be a i

.

major contributing factor to core damage. Once-through cooling should be l

initiated before SG inventory is exhausted if it is to be effective. The validity of the need for timely initiation of once-through cooling is supported by the CE Report * Engineering Evaluation of Feed and Bleed for Total Loss of Feedwater Events at Fort Calhoun Station," dated December 1988.

l

The entire three-member operating crew demonstrated a strong reluctance to enter E0P-20, the functional recovery procedure. Entry into this procedure is required when there is not apparent event diagnosis, the correct guidance cannot be identified, actions are not satisfying the acceptance criteria for the optimal safety function status check, or plant-7-

>

- -, -

~. +,

-

.,

,

.

. -.

-.

.

...

.-

l conditions indicate that two or more events are occurring simultaneously, i

During the initial scenario, the operators collectively exhausted every

path before they would consider entry into E0P-20. During the second

,

scenario with only one essential bus being energized by a diesel simultaneous with a loss of all feedwater, one operator rationa1Ized that

,

!

it was not necessary to enter E0P-20 because, if the loss of power could f

be solved, the loss of feedwater would be solved and would no longer be a

!

concern. When the inspectors asked the operators about their reluctance

[

to enter E0P-20, one operator alluded to the sheer volume or size of the e

procedure.

!

,

The step (15.97 - 15.105 and 15.107 - 15.114)s to restore full once through coolinf

E0P-20 should be expedited because

'

partial once-through cooling does not meet the heat removal success criteria.

It is necessary to complete these steps quickly to preclude

-

greater risks of core damage.

!

E0P-20, Steps 15.99 and 15.108, provide breaker identification numbers for

!

components that should be identified as buses.

At the time of the inspection, formal training of licensed operators had

!

been completed on only E0Ps -06, -07, and -20.

F hal review of all training lesson plans used to familiarize the operators with the revised i

E0Ps was not complete. More training was needed to address the operators'

!

lack of knowledge on the execution of E0P-20.

2.3 General Performance Observations In addition to the A0P and E0P performance problems discussed in paragraphs 2.1

'

and 2.2 of this report, the following general observations were made by the inspectors during procedure walkdowns and scenario executions:

l The operators are not provided clear instructions to assess the emergency I

core cooling system (ECCS) check valve leakage. Assessing total valvs leakage from all four loop injection >oints is a simple process of reading

.

a flowmeter. However, Table 2-9 in tie Technical Specifications provides limits for individual valves and does not address total valve leakage.

!

The operator stated that he knew of no method to quantify individual valve

-

leakage if it was suspected that leakage was occurring through more than one check valve. He also stated that he was not sure when the limiting i

conditionofoperation(LCO)onECCSduetoinoperablepipingandvalves t

,

should be entered. Subsequent to this interview the inspectors determined that the LCO would be entered before any one valve had significant leakage

'

and.that individual valve leakages are verified during outage period testing.

At the time of the insaection, there was no documentation located in the

control room from whic1 to determine plant relief valve set points. The

,

operator being interviewed and the on-shift operators could not determine I

the set points for two relief valves (SI-187 and SI-222).

-8-L

.

_

_.

.

.

. -

_

_

_

~

+

,

,'

c-,,

,

,

+

' Step 3;14 of E0P-03, " Loss of Coolant Accident," provided instructions to

determine if.a LOCA had occurred inside containment. Contingency action

L then required the operator to determine if the leak was in the P.CS's

'

samplesystem,thechemicalandvolumecontrolsystem(CYCS)letdownline, or the shutdown cooling system. The low. pressure safety injection system (LPSI) was not eddressed because this system is normally isolated

,

!

from the RCS by two check valves and a closed anotor-operated isolation valve to minimize any chance of this low-pressure piping being exposed to

,

,

RCS pressure. Risk of a LOCA occurring outside the containment via the LPSI system is further reduced by a relief valve (SI-187) located inside the containment and discharging to the pressurizer quench tank. The operator

.

being-interviewed was readily able to determine LPSI header pressure and

!

pointed out.how the header relief valve would limit header pressure c

T increase from leakage within the system. The inspectors concluded that a LOCA that would effectively bypass the containnent barrier was not a

,

.

significent risk at FCS.

c

'2.4 'EOP Validation

<The NRC informed the licensee by letter dated October 5,1989, that the licensee's

~

proposed, validation plan for revised E0Pc needed to be strengthened. However, 4,

because of the' date of the HRC response, the more stringent requirenents for the validetion program were not assessed during this inspection. This insaection

. assessed conformance with the validetion program orig)inally submitted in tie licensee's proposed procedure generation package (PCP by letter dated liarch 1, 1985.

,

Part 5, paragraph 5.0, of this PGP states that "the initial E0P/AOP validation process shall consist of Control Room walk.throughs utilizing the fort Calhoun.,

Control Room Mock-lfp." However, the licensee could not provide documentation to show that this effort was undertaken and completed. Licensee personnel stated that they believed this requirement only epplied to the two new E0Ps (07.and 20) because they are the only E0Ps that are " technically different"

'

from the E0Ps in effect before the revision of July 31, 1989. The inspectors

'

informed the licensee that all E0Ps currently in effect are required to be validated in accordance with the licensee's connitment specified in the PGP.

<

submittel letter and that documentation is required to support this validatien.

This discrepancy in the licensee's E0P validation process is an apparent deviation from the licensee's connitment to validate the E0Ps in accordance with the PGP submitted to the NRC for review.

Deviation (285/8940-02): Failure to perform E0P validations in accordance with the PGP as cormitted to the NRC.

h In addition to this deviation from a connitment, the inspectors made the following observations with respect to the procedure validation process:

The E0P validation documentation consisted of scenarios designed to

exercise the E0Ps with verious attachments from Part 5 (Validation 9 m i~

_,

'

'

,;.

3,

.

<

.

-,.

-

.

'

.

-

a f'

'

<

L Program) of the PGP. However, there was nothing to indicate if the F

validation hed been 3erformed using:the simulator, walkdown tabletop, or-

'

reference method. T1elicenseestatedthatallvalidationforcontrol

'

'

roomstepshadbeenperformedontheCombustionEngineering(CE)

simulator located in Windsor, Connecticut, and that all local action

,

steps had been validated by slant walkdown.

In this case, the i

documentation did not descriae how the simulator process provided

,

adequate validation considering the significant differences between the

FCS control room and the CE simulator. Further, since there was no

documentation to support validation of local action steps by wall:down in

.

_Y

'

the plant, the inspector concluded that this validation had not been i

accomplished, p

p Attachment 4 to the PGP, Part 5, is a~ form used to resolve discrepancies

discovered during the validation process. The licensee stated that a

procedure discrepancies were discovered by several individuals during-the validation process. A review of approximately 50 of these discrepancies indicates that only two contractor personnel-reported discrepancies.

'

Further review confirms that in every case where a discrepancy was reported, the resolution was approved by the seme individual finding the

discrepancy. There is no documentation to indicate an independent review of approved resolutions.

2.5 Conclusions l

"

From a PRA perspective, the above examples of procedural inadequacies and operator training deficiencies are cause for concern. Because of this concern, the inspectors questioned the ability of an inexperienced operator to

'

mitigate a serious plant challenge. Since the present f acility staff consists

-

of experienced operators, the inspectors considered the present procedures to

,

be adequate for present operations.

Improvement to the procedures will be

monitored as part of the NRC followup to the apparent violation discussed

'

above.

'

The procedural inadequacies can impact both frequency of occurrence and. system availability. For example, the *1ack.of guidance in A0P-17 for RCS pressure control after a loss of instrument air could result in an overpressuriration i

'

event. The increased challenges to the pressurizer relief and safety valves probabilistically increase the' chances of a. stuck open valve, which is a contributor to the~small LOCA.

The inspection revealed strengths and weaknesses associated with the human

,

!.

factors aspects of A0ps and E0Ps at the FCS. The two-column format was

-

&

considered a strength because of the direction that:was provided to complete

,'

the step. Another strength was noted in the draft lesson plans ~being developed to teach the operators and operator license candidates how to use the procedures.

-

These lesson plans should provide the student with a flow chart to illustrate

'

individual steps within'the procedure. The training departnent is enthusiastic i

,

_

about developing effective training naterial to improve the operator's knowledge L ^

,

- and enhance procedure usage. The individual E0Ps are kept in separate identifiable

'

p binders in the control room, readily available to the operators. The licensee L

l.

-10-

.

~

p

-.

.

,'

-

ut

.-

<:.

.

-

..

L Of,

'

. <,

.

,

i

'

,

,

,,

plans to convert A0Ps into the'same two-column format, which should improve

n

'

'

~these documents.

lhaddition to the weaknesses presented earlier in this report, another weakness i

c was-that there is no consistency for use of the procedural requirement to monitor

.

J

the floating steps." This phrase appears at the beginning of each E0P and is

- !

'

randomly inserted throughout the E0Ps. The licensee could not explain the criteria used to place this step within a procedure.

Further, it appeared to the'

inspectors that at any given point during the exercise of the E0Ps, several i

" floating Steps" should not be monitored, but ignored.

3.

AUXILIARY FEEDWATER SYSTEM j

3.1 Components of the Auxiliary Feedwater System (AFWS) and_ Their' Availebility

)

The inspectors reviewed f actors, such as inservice testinklity of key (IST), mainten history, and surveillance testing, that affect the reliab components i

of the'AFWS. They also reviewed:

(1) the adequacy of test proceduresto ensure

that testing provided meaningful results, (2) test history to verify that tests

]

were conducted regularly to maintain confidence in equipment operability and to

'

neetrequirementsoftheTechnicalSpecifications(TS),and(3) equipment

,

maintenance history to identify continuing problems.

Finally, the NRC evaluations j

of the AFWS were reviewed. The results of the reviews are discussed below:

The review of the maintenance records for motor-driven AFWS Pump FW-6 did not

reveal any new problems. The inservice testing / surveillance testing problems

'

identified in NRC Inspection Report 50-285/89-27 were the subject of pending escalated enforcement actions. The licensee had committed to adding a third

.

AFWS pump during the 1990 refueling outage, as a result of the NRC AFWS

!

reliability study. The licensee also plans to install a new header which

'

will allow full-flow testing of AFWS pumps while the plant is on-line.

The inspectors reviewed the system operating procedures and walked down the

AFWS to verify correct system alignment for current plant conditions (100 percent power).

In the procedure review, the inspectors noted one format problem. The system alignment checklist, FH-4-CL-A, in Procedure 01-FW-4, Revision 42, dated July 27, 1989, was numbered as "pege of eight."

Actually, the checklist was 11 pages long. When the licensee was informed

,

of this' discrepancy, the checklist was corrected so that the correct number of pages were listed. Altnough this was not a significant safety issue, it did indicate poor administrative control of procedures.

'

System alignment was correct for plant conditions and the auxiliary feedwater

spaces looked very good from a housekeeping perspective. However, the inspectors noted deficiency tags on the AFUS turbine steam inlet

-

valve (YCV-1045)andontheturbinethrottlevalvebecauseofexcessive

+

leakage. The leaking valves allow steam to migrate into the turbine casing

-

s where steam trap (ST)-16 is the only component available to ensure that the e

condensate is drained out of the turbine. Condensate accumulation in the turbine has been shown to be a contributor to AFWS pump turbine failures to-11-

.

s

,

-

,

.

-.

~-

.. -

,< -

,

,

-.

,

t..

L

.

+-[

..

..

-

.

L start (NRC Information Notice 88-09)..The licensee was asked if compensating

"

measures had been implemented to ensure that the turbine would operate on demand. The licensee subsequently revised the turbine building log-(Form FC-78, Revision 31) to check the proper operation of the steam trap.

During a review of the AFUS documentation, a discrepancy was noted in the

normal position of the turbine steam inlet Yalves YCV-1045, -1045A, and-1045B and AFWS containment isolation Yalves FCV-1107A, -11078 -1108A, and-1108B. The applicable flow diagrams (11405-405-M252, Revision 55, and L

11405-405-11253, Revision 67) show all valves normally closed. However, the licensed operator training program materials for the AFU system (Lesson Plan 7-11-1, Revision 2, dated September 11,1989, transparency index and student handbook) show these valves normally open. The licensee L.

has corrected the licensed operator training lesson;.the corrective action

[

taken by'the licensee is acceptable.

3.? Conclusions As previously discussed in Section 1, the FCS AFWS is an especially important

system from a core damage perspective. The failure of AFWS is a contributor to four of the seven accident sequences that are considered risk irnortant for i

FCS.. The inspection effort was commensurate with the system ris s importance.

i

=

The AFWS pumps (FW-6 and -10) are key system components and were examined

!

in-depth, including surveillance, inservice testing, and maintenance practices.

i

. The availability of each pump was calculated and noted to be approximately the On the basis of these observations, the inspectors determined that the licensee

.

industry norm. Selected system valves were also examined in a similar manner.

-

i is treating the AFWS commensurate with its risk importance to FCS. The team

'

did not note any outstanding concerns that could significantly change the estimated AFWS availability identified in the generic methodology, 4.

ELECTR_ICAL SYSTEM

4.1 Availability of Electrical Components The inspectors reviewed the availebility of the PRA driven electrical systems and components'

A common-mode concern for all components associated with the i

.

PRA is the lack of coordination between the electrical fuses, circuit breakers,

. and relays. This was expressed as a " common bus" concern in the fire protection reviews; conducted to ensure compliance with 10 CFR Part 50, Appendix R.

The

"

-

l basic concern is,that an electrical fault will cause an upstream breaker, fuse, L

or relay to trip or open before the protection unit serving the faulted component actuates or trips. This could result in a power loss to redundant components.

l i

The ~ inspectors requested a coordination study for the components associated

with the PRA, but.the. complete information was not provided by the time of the

,

exit interview. A review of the provided coordination curves disclosed the

.following shortcomings, which should be addressed as a part of the fuse coordination corrective. action progran:

i

-12-

.

.

[ [>

,

.

.

.

>

..

, e r

)

F Coordination information should be developed for the control fuses for

~

Yalves YCV-1045A/B, HCV-1107A/B, HCV-1108A/B, HCV-383-3, and HCV-383-4; s

.

. Block Valves HCV-150 and FCV-151; PORVs PCV-102-1 and -102-2; and controls

!

.

for ATW automatic initiation.-

,

Writtin conformation should b'e provided which verifies that the short

circuit current for Circuit Breaker ITE.J12-T400 (feed for 125 volt DC bus No.2)islimitedto450 amps. This will satisfy the coordination overlap

.

'

of Curves 2 and 3 on the coordination sheet dated October 30, 1989.

'

An explanation of the apparent lack of coordination between the input and

out?ut circuit breakers on Battery Charger 2 should be developed. The

,

y lack of coordination is shown on coordination Curves 4 'and 5.

Discussions with licensee personnel indicated that the fuse / breaker coordination

'

problem is already a part of the FCS safety enhancement program (SEP). Licensee progress in this area will be reviewed during future inspections and is considered i

_

'

to be an Inspector followup Item.

i

'

InspectorFollowupItem(285/8940-03):

Review resolution of the electrical breaker / fuse coordination problem.

Another common-caus' concern that could affect almost all of the PRA driven

'

e electrical com)onents is the lack of a comprehensive fusing program, which interfaces wit 1 the coordination concern on circuit breakers, relays, and fuses discussed above. A comprehensive fusing program should include:

• -

A master fuse list for. safety-related systems that would state the size

-

and type of fuses and that reflects the correct engineering design of all the safety-related circuits; f

A means of labeling the fuses in the field so that the craftsmen replacing

,

the fuses would have clear labels to follow;

'

Documentation of the proper fuse and relay / circuit breaker coordination;

and

A means of updating and correcting installation and maintenance work

orders that bring about changes in fuse sires and types.

The need for'such a program was determined when auxiliary feed control Panel Al-179 was examined and compared with OPPD Print 161F593, Revision 12.

The inspectors noted that:. (1)manyfusesizescouldnotbedetermined;.and (2) 5-amp fuses.were installed at fuse blocks F-21 and -22 in place of 1-amp fuses as required by the print. These fuses are for a preamplifier used in the reactor protection system. The inspectors verified that several other' PRA driven component fuses were the correct size, but were unable to verify the.

. correct design type because of the lack of a comprehensive fuse program. This item had previously been identified by the licensee and therefore has been determined to be a licensee-identified violation. The licensee comitted to

,

develop an, interim (short term) fuse control program within 5 days of the end

>

-13-

.

._m._._

..

s

.

-

...

,

L

!

of this inspcction and to develop a cor:prehensiu fuse control program by the end of the spring 1990 refueling outage. The interim program provides that r

electrical / craft persort,el will be notified by a memorandum to replace any defective fuse with the sane type of fuse. Also procedures will be issued

'

that will require an engineering evaluation whenever fuse replacement is required. 'This interim corrective action was found to be acceptable by the inspectors. Based upon these corrective actions taken by the licensee and in accordance with the revised enforcement policy, a Notice of Violation is not being issued.

The NRC will review impleinentation of this program during future inspections.

"

InspectorFollewupItem(285/8940-05):

Review implementation of the electrical fuse control program,

,

c The inspectors considered the electrical common-cause failure of the two diesel

generators. The inspectors reviewed the Fire Hazard Analysis, Revision 3, dated September 1988, for Fire Area 35 A/B, and discussed the availability of the emergency AC power system with the plant fire protection engineer. When offsite power is lost and the control room evacuated, the diesel generators can be controlled locally at their local control cabinets.

Each of these cabinets has a normal and an emergoncy feed. Although the inspectors were not concerned about an electrical common-mode failure, the general concerns discussed above apply to the fusing and circuit breakers of the diesel generator control circuits.

The reliability of the vital buses and their associated power inverters encompasses almost the entire electrical system. The inspectors were therefore, concerned over the lack of an overall preventive maintenance program or comprehensive surveillance test procedure for.the Class IE inverters. New inverters and battery chargers were installed in 1985,-and certain limited maintenance procedures were written, e.g., HP-EE-16A-R1, dated May 26, 1987, provides for the replacement of capacitors every 9 years. The inspectors reviewed a draft f

copy of a preventive maintenance procedure for the Class IE inverters, EM-PM-EA-0800, and found it to be acceptable.

Implementation of this FM is an InspectorFollowItem(285/8940-04).

The inspectors reviewed failure information for the 120 volt AC inverter, in 6 of the 11 failures described, a fuse had blewn. A September 2, 1988, memorandum (PED-FC-88-510), established that in the case V $ failures of Class 1E inverters, 7 failures involved a blown fuse. The licensee was unable to verify to the inspectors if the correct size of fuse has been replaced.

These examples emphasize the importance of the protection provided

>y the correct size and type of fuse.

4.2 Conclusions The lack of a fuse control program and a comprehensive breaker / fuse / relay coordination study and the inverter concerns previously cited are considered to

!

be important sources of common-mode failures. These concerns could affect all of the accident sequences used for this inspection. The lack of a fuse control program or an incomplete breaker / fuse / relay coordination study can have severe consequences.

For example, a critical component could fail randomly on demand

)

-14-

-

h

.. - -

g a

!

.

.

O

.

,

(e.g., a locked pump rotor), and instead of actuating the local i

device, an uncoordinated electrical system (or an improper fuse) protective could result in the actuation of an upstream protective device. This could disable additional critical components.

Similarly, several important FCS accident sequences postulate losses of electrical power. The concerns expressed above could potentially increase the probability of a loss of a DC bus as well as a station blackout resulting from

!

the loss of an AC bus.

5.

INSTRUMENT AIR (IA) SYSTEM The failure of the IA system was identified as a major contributing factor to the potential for a significant accident because of the large number of valves and components installed in the safety-related systems that use the IA system.

Operation of the valves and components during accident conditions is mandatory for ths mitigation of accidents and for preventing alant perturbations from

,

resulting in more severe accident scenarios.

For t11s reason, maintaining the

.

stability of the IA system represents a high concern with respect to safe plant

operation.

In evaluating the operation of the IA system, two major vulnerabilities were considered:

the loss of IA system pressure and the inadvertent introduction of water into the system. The occurrence of either problem has the potential of

'

significantly affecting the operation of the valves and components supplied by the system, 5.1 Loss of IA System Pressure

,

The loss of IA system pressure was considered on the basis of all potential initiating events such as loss of power to the air compressors or a major line break in the system.

It was assumed that the IA pressure was lost as the

'

motive force to air-operated valves or as the operational source for components such as level indicators and controllers.

The inspectors reviewed the licensee's documentation of specific valves that

-

are designed to fail in the safe position should air pressure be lost. This

,

review included the licensee's Operations Support Analysis Report (0SAR) 87-10 and Preventive Maintenance Procedure PM-REG-1. On the basis of the reviews, it appeared that the licensee had taken the appropriate actions to address the availability of the IA system to mitigate the consequences of an accident.

5.2 Water Intrusion into the IA System In addition to the loss of IA system pressure, the intrusion of water into the system could adversely affect the operability of valves and components because they are designed to operate using dry, clean air. The inspectors reviewed the l

actions taken by the licensee to prevent entry of water, and to detect the presence of water in the IA system, and found them acceptable.

-15-

K

]

,

.

..

'

.,.

In July 1987 the licensee experienced an event where water entered the 1A system causing the status of the system to be indeterminate. As the result of this event,_one of the licensee's corrective actions was to blowdown the

.

'

accumulators for the emergency diesel generator exhaust dampers (YCY-871E and YCV-871F) quarterly to verify that no water was in the accumulator. The blowdowns were accomplished in accordance with Preventive Maintenance Procedures PM-DAMP-1 and PM-DAMP-2. This corrective action was a commitment i

made in' response to a Notice of Violation and Proposed Irnposition of Civil Penalty documented in NRC Inspection Report 50-285/87-27.

i I

'During the 1988 outage, the licensee replaced the air-operated actuators for l

YCV-871E and YCV-871F with actuators that did not have accumulators._ in an

'

!

internal memorandum dated January 8,_1989, the licensee cancelled Procedures PM-DAMP-1 and PM-DAMP-2 as they were no_ longer required since the newly installed actuators did not have accumulators.

It appears that the licensee's replacement of the actuators did not introduce edditional vulnerabilities into the IA system.

t 5.3 Con _clusions

,

Overall, the IA system appeared to be well m.aintained and an appropriate leyc1 of testing was being conducted for early identif n.ation of adverse system trends.

If the licensee continues its current program designed specifically to

,

, address the availability of the IA system, it is anticipated that the system will perform reliably.

6.

SAFETY INJECTION SYSTEM 6.1 Availability of the Safety Injection System (SIS) Pumps The failure of the miniflow system to provide sufficient recirculation flow to

'

prevent safety injection pump damage was considered a contributor to a failure

_of high-pressure injection during a small or medium LOCA. The PRA concern is the potential conmion-cause failure of all operating pumps.

In e draft response i

to NRC Bulletin 88-04 (PED-FC-88-1355, dated December 27,1988), the licensee committed to change the containment spray (CS) pump actuation logic to alleviate the concern that the miniflow configuration was not sized to allow sufficient recirculation flow with all pumps running (Combustion Engineering letter,OPPD-88-170datedDecemberP2,1988). This change rodified the CS pump

,

actuation logic such that these pumps would not start until a high containment pressure signal was available. If this condition occurred and the CS punps start, they will not operate in the recirculation mode because containment spray will be in full operation.

Following implementation of this modification to the CS pump actuation logic, a

'

test involving the simultaneous startup of high pressure safety injection / low pressure safety injection (HPSI/LPSI) upon receipt of a safety injection actuation signal was conducted. This test was run for 45 minutes. Since the CS pumps did not start during this test (due to the lack of a high containment pressure signal) the miniflow system provided adequate recirculation flow.

In addition, the existing plant accident analyses and the emergency and abnormal

, -

-16 -

,

,

'

.

-

.

-

.

.

.

..

.

O O

..

operating procedures provide assurance that the HPSI and LPSI pum)s will not operate in the sinultaneous minimum recirculation mode for more tian 30 minutes.

Based upon the test results and the administrative control of these pumps, the inspectors found SIS pump availability to be acceptable.

The containment sump recirculation Yalves HCV-383-3 and HCV-383-4, were not accessible for direct observation with the plant on-line. These valves are located inside an extension of containment that protrudes into the auxiliary building. However, the inspectors reviewed the maintenance and testing records of these valves and did not identify any concerns. With regard to the availability of the containment sump recirculation system, the inspectors

'

reviewed the postulated failure mode which could cause the valves to fail to open. These recirculation valves are motor-operated valves with open and close limit switches for remote indication. The inspectors reviewed eight Maintenance Orders (M0s) relating to these valves, surveillance test ST-SI/CS-1 performed in Pay 1987, and the equipment qualification documentation forms.

Revision 4, dated October 5,1987, for quality-related problems. The inspectors did not identify concerns during these reviews.

The inspectors examined LPSI pumps, SI-1A and SI-1B, and the general area of the sump rooms. The pumps appeared cican-and well maintained, and housekeeping in t1e pump rooms was excellent. A review of maintenance records produced no inspector concerns. A review of testing records, however, revealed that these pumps are tested with the same procedure and same technique as the HPSI pumps.

This is a minimum recirculation flow test. The testing of the high-pressure

, pumps is the subject of Unresolved Item 285/8901-01 identified during the maintenance team inspection (NRC Inspection Report 50-285/89-01). This concern is also applicable to the LPS! pumps. This item will be evaluated further during the inspection followup for NRC Inspection Report 50-285/89-01.

The inspector examined the component cooling water Pumps AC-3A, B, and C and found housekeeping in C - general areas satisfactory. A review of maintenance and testing records p%3d no inspector concerns. The test procedure satisfactorily testeo w pumps and measured appropriate parametas, including discharge pressure, flow rate, and bearing vibration. Records of completed

'

tests indicated satisfactory pump performance.

With regard to pump room cooling, the inspectors also reviewed the postulated

_'

failure of the electrical supply feed and circuit breaker to the safety injection (SI) system that ventilates the SI pump room. Drawing 11405-M-2 Sheets 2 and 3, show that fans VA-40A, B, and C cool the SI pump rooms and other large sections of the auxiliary building. The licensee stated that this ventilation system could be completely lost without any loss of safe shutdown ability. This position was supported by a Combustion Engineering Company study, dated July 19, 1979, that showed that pump room temperature without the fans is 117'F, which is 5'r below the upper temperature limit for pump room operation. This study was found to be acceptable.

-17-

-

_

T

.

-,

• e l

j

'

6.2 Conclusions The SIS consists of the HPSI and LPSI subsystems. The HPSI provides emergency

!

coolant injection and decay heat removal following a small LOCA, and the LPSI performs a similar function in the event of a large LOCA.

In the FCS design, the recirculation mode of LPSI would be used for long-term cooling for all LOCA sizes.

In addition, HPSI is used for RCS injection in the once-through cooling mode. The HPSI system is a contributor to five of the seven important FCS

accident sequences, while the LPSI is somewhat less important.

Based on the above observations, the inspectors determined that the licensee's programs provide reasonable assurance that the SIS will be available for accident i

mitigation.

7.

ONCE-THROUGH COOLING l'

Once-through cooling (0TC) is the decay heat removal mode of last resort to

'

mitigate the consequences of a total and unrecoverable loss of all

.

feedwater(TLOFW) event. The primary objective of a OTC process is to remove decay heat in a manner sufficient to prevent core heatup and possible fuel damage. There are several important parameters to be satisfied if once-through cooling is to be successful. These include the time from the start of the event until OTC is initiated, the number and flow capacity of the HPSI and charging pumps, and the number and size of the power operated relief valves

-

(PORVs)used.

A plant-specific OTC analysis was performed by Combustion Engineering for the licensee (Combustion Engineering Report dated December 1988, " Engineering Evaluation of Feed and Bleed for TLOFW Events at the Fort Calhoun Station"),

j The study concluded that the use of two PORVs results in a lower RCS pressure than using only one PORY.

The use of one PORY may not be sufficient to keep

'

the RCS pressure below the pressurizer safety relief valve set yoint unless all three HPSI pumps are available.

Essentially, two PORVs limit t1e RCS repressuri::ation to a point where the HPSI pumps have an early impact on the OTC process. The use of three HPSI pumps provides adequate makeup water to prevent uncovering the core with either one or two PORVs availabic.

Another important result of the above study was that OTC should be initiated before steam generator (SG) dryout (approximately 20 minutes). The study demonstrates that starting at 10 percent level in the SGs is satisfactory, but waiting for the PORVs to open at the 2500 psia set point (at approximately 26 minutes)willresultinuncoveringthecore.

Lastly, operator training is a key factor in a successful OTC operation. The operators should be aware of the key factors which affect the process, namely, the number of PORVs open, when to initiate the process, and the number of HPSI pumps available.

Since assurance of successful OTC requires the availability of both PORVs, the

inspectors reviewed the licensee efforts to assure PORV operability.

PORVs PCV-102-1 and 102-2 are solenoid-operated relief valves on the pressurizer. These valves are used for the bleed portion of feed and bleed once through cooling. A review of maintenance records revealed that no

,

maintenance had been done to these valves since 1985. Additionally, the

)

-18-

.

-

.

.

-

-

-

-

y J

-

.

,.7

,

,.

e licensee produced no procedure indicating that these valves had been cycled

,

under, conditions approximating those under which the valves must operate, e.g;,

operating temperature and pressure. 'Although the NRC identified the need to test these valves as part of the inservice testing program and the licensee

?

,egreed in Revision 3 of the inservice testing program to test these valves, i

~

-this program revision will not be fully implemented until the end of 1990.

In f

addition, the licensee'apparently hed never stroked these valves under conditions approximating those under which these valves are required to j

operate. This condition reduces the confidence that these valves will perform

!

L if required to do so. The licensee has committed to perform the stroke test during the upcoming refueling outage in 1990.

t inspectorFollowupItem(285/8940-06): Review results of the PORV stroke test performed during the 1990 refueling outage.

7.1 Conclusions j

.

The generic FPA-based team inspection methodology focused on seven accident sequences that are considered risk importent for the FCS. The OTC process is an integral part of several sequences, and the human and hardware dependencies were extensively examined during this inspection.

,

Asdiscussedpreviously'inSection2,)theinspectorslookedatpotentialhuman errors-(i.e., training and procedural that might contribute to the failure of-OTC. Based on a review of the E0Ps, supporting documentation for OTC and as

,

confirmed during a control room simulation, the operators do not seem to have:

'

Consistent success criteria for OTC; and

,An appreciation of the short-time period that is available for the

successful implementation of OTC.

To further ccmpound the situation, the licensee has not implemented an

,

effective inservice test for the PORVs to provide reasonable assurance of valve

'

operabi11ty.

The generic probabilistic inspection methodology assigned a medium importance value to the OTC mode. This generic methodology was, however, based on a level of operator performance that made OTC human error a small contributor to core damage and included a periodic POR'. testing program that provided some assurance of valve operability. The potential failure to implement

'

successfully the OTC mode is higher than normal at FCS and can be attributed

!.

- both to procedural and training inadequacies and to the current lack of an adequate FORV inservice testing progrem.

8.

SECONDARY C00LAliT WATER CHElilSTRY CONTROL The inspectors reviewed the secondary coolant water chemistry program at FCS.

The licensee uses an all-volatile treatment for controlling the pH and chemical impurities in the secondary coolant water, using ammonia, hydrazine, and

. morpholine as the chemical additives.

In addition, the licensee uses a boric l

y-19-

l

,

E O

__l

_ -

t

.

.

..

l

,..

acid soak to minimize caustic attack and denting in the steam generators.

Since 1984, copper components in the secondary side have been replaced by stainless steel components.

8.1 Conclusions The licensee's secondary coolant water chemistry control and the boric acid soak appear to be effective in sninimizing erosion / corrosion and stress-induced cracking which could lead to tube rupture in the steam generators. The inspectors were informed by the licensee that, in the last in-service surveillance, no tubes in the steam generators needed to be plugged.

9.

EXIT MEETING An exit meeting was held on November 9, 1989, with the personnel indicated in Attachment I to this report. At this meeting, the scope of the inspection and the findings were summarized as detailed in this report. The licensee did rot identify as proprietary any of the information provided to or reviewed by the inspectors.

,

[

-20-

)

g,

...

,

,

.

i

,2

w%,

,

..

.

.

i

.+

!

ATTACHMENT 1

'

I PERSONS CONTACTED Omaha Public Power District

-

• C. B16yd, Special Services Engineering

.

,

D. Bonsal, Licensed Control Room Operator V.

• F. Buck, Raw Water Systems Engineer

'

i M. Bufford, Licensed Control Room Operator

• J. Chase Manager, Licensing

.

I

,

J. Connolley, Acting Lead System Engineer

• M. Core, Supervisor, Maintenance

'

J..Fluehr, Supervisor, Operations and Technical Wr_iting

'

..

• J.'Foley, System Engineer J. Friedrichsen, Licensed Control Room Operator I

• S. Gambhir, Division Manager, Production Engineering l

• J. Gasper, Manager, Training

'

• W. Gates, Executive Assistant to the President

,

G..Guliani, Supervisor, Operations Training A. Hackerott, PPA-Specialist K. Henry, Lead Systems Engineer J. Hermann, Supervisor, Initial License Training K. Holthaus, Manager, Nuclear Engineering

"'

• R. Jaworski, Station Engineering Manager J. Kelly, Supervisor, System Engineer

.

L. Kusek, Manager,' Nuclear Safety Review Group a

L. Labs, Shift Supervisor.

,

M. Lazar, Supervisor, Operations and Technical Training R. Lippy, Inservice Testing Coordinator T..Matthews, Station Licensing Engineer D. Matthews, Supervisor, Station Licensing T. McIvor, Manager, Nuclear Projects

• K. Morris, Division Manager Nuclear Operations R.Mueller, Supervisor,NuclearProjects

.

.

B. Odden. Acting Lead System Engineer, Secondary System

.

' *W. Orr, Menager, Quality Assurance and Quality Control

.

.

C. Ovici, PRA-Specialist

i

'.

• G.Peterson,-PlantManager,FortCalhounStation(FCS)

• R. Phelps, Manager, Design Engineer

• A.. Richard, Assistant Manager, FCS

,

M. Sandhoefner, Licensed Control Room Operator C. Schaffer, Systems Engineer, Safety Injection

• C. Simmons, Station Licensing Engineer

• F. Smith, Supervisor, Chemistry W. Stecker, Systems Engineer M. Stewart, Lead Nuclear PRA Specialist

• D. Stice, Nuclear Licensing Engineer J. Tesarek, Supervisor, Licensed Operator Training

• D.. Trausch Supervisor, Operations

'

.

• e

--

-

-

,

.

.

.

.

.

-

-

._.m

,

,

....

s.

? *'

'

. c

,

,

,,

H

• G. Wood, System Engineer -

L-C. Zaccone, Systems Engineer-Instrument Air

'

>

NRC

• R. Barrettl Chief, Risk Application's Branch, Division of

.

p Radiation Protection and Emergency Preparedness, Office of Nuclear i

.

ReactorRegulation(NRR)

• A. Bournia, Project Manager for fort Calhoun Station

'

• J. Jaudon, Deputy Director, Division of Reactor Safety

• T. Stetka, Chief, Plant Systems Section, Division of Reactor Safety-

• T. Westerman, Chief, Reactor Projects Section A, Division of

Reactor Projects

'

c~'

!

L iThe inspectors also contacted other members of the licensee's staff during i

the inspection period to discuss identified issues.

• Denotes those personnel.in attendance at the exit meeting held on

,

I

. November 9, 1989.

,

e

'

,

!

r

,

1,

-

i

. ~

,t

,

,

P J

.*

.g.

,

,

T

\\

t

.

pa y e

,

.4. O t

~

l W.

)

ATTACHMENT 2

'

,

t DOCUMENTS REVIEWED LETTERS I

NRC Letter dated May 9, 1988 Milano(NRC)toAndrews(OPPD): " Resolution of

.

Generic Issue No.124, Auxillary Feedwater System Reliability, for Fort

!

.

L Calhoun" C

CombustionEngineering(CE)LetterdatedDecembhr 22, 1988 Caruso(CE)to 4.

Peterson(OPPD): OPPD-88-170, " Safety injection and Containment Spray System -

' Recirculation Flows"

,

OPPD Letter dated December 27 1968,Gambhir(OPPD)toFisicaro(OPPD):

'

PED-FC-88-1355, "NSNRC IE Bulletin 88-04, Potential Loss of Safety Related

'

Pumps" OPPD Letter dated April 21,1989, Jones (0 PPD)toMartin(NRC): LIC-89-396,

"161kV Power Supply Reliability Review" OPPD Letter dated December 23, 1986: LIC-86-669, " Fort Calhoun Station Unit

No.1 Auxiliary Feedwater System Reliability Analysis"

,

'

OPPD Letter dated May 18, 1987: LIC-87-313 " Additional Information on Auxiliary Feedwater System Reliability Analysis (TAC No. 64236)"

L OPPD Letter dated June 8, 1987: LIC-87-390, "Information Provided to Support the Auxiliary Feedwater System Reliability Review"

OPPD Letter: LIC-88-524, that submitted Revision 4 of the Inservice Testing Program OPPD Letter: LIC-89-202, that submitted Revision 3 of the Inservice Testing

. Program

,

OPPD Letter dated September 6, 1979:

Requested Technical Specification Amendment-

'

l NRC REPORTS NRC Maintenance Team Inspection Report 50-285/89-01 L

HRC Inspection Report 50-285/87-25, Section 16, regarding Event V

'

'

confi urations

NRC Special Inspection Report 50-285/89-27

.

.

o l

..

...

-

,

&;

~~

.i

'

<

'

'

V., s _,

.

,

,

y

,

c

.

c

.

.

,

ff;!

^

'

'

-

.,

.

q,y :s.. :

.

,

cp pc 8 3

,

$ N.0PERATING INSTRUCTIONS (011

'

"

'

,'

,. t :

.u

.

.

,

,

.

,

"

/

ga.v Operation", Revision 42r

_

{

,*

01-FW-4, " Auxiliary Feedwater Pump Operation and Testing Auxiliary Feed

j j

OI-CA-1, " Compressed Air System-Normal Operation," Revision 30.

I l

'

-

,

,

.;

,

,

,

[

','SURVEILLANCETEST(ST) PROCEDURES'

'

{

'

~

,

.

,

.

q

.,

.

'

p ST-FW-l', Revision 47. " Auxiliary Feedwater" r

<

W

..

-

'

)

,

.

.,

'

^

T"'

ST' AFW-3003, 'Revisio'n 0, "AFW' Pump FW-10 Steam Supply Line Check"

-

a I

^,

.

.

.

' t ST-SI/CS-1, Revision 54, "SI/CS Pumps and Valves"-

-

• *y

.

..

.

.3-l

...

.ST.-ISI-CC-3,. Revision 29, " Component Cooling Water Pump-Inservice Testing"

.

.i

.

'

ST-PORV-1,' Revision 13,3" Low. Temperature - Low Pressure Power Operated Relief.

,

Valve System"

,

s

>

ST-ISI-SI-1,^ Revision 51,'" Safety Injection Valves In-Service Testing,"

.

-

,

ST-DC-3, ' Revision 14. "D.C. Transfer Switches"

'

. ST-DC-2, Revision 20,J " Battery Chargers"

!

ST-FW-1, Revision 46, " Auxiliary.Feedwater"

.

.

,

.

SPECIALPROCEDURES(SP)

SP-FW-11. " Auxiliary Feedwater Pump Operational Test" i

SP-SI/CS-3, "Special Procedure-Simultaneous Operation of LPCI/HPSI pumps in t

-

Min. Recir. Mode" t

.

.

,

R SP-MOV-1,."Limitorque Motor Operated Valve Inspection," Revision 4 l

,,"

. ANNUNCIATOR PROCEDURES A-21 for Window B-6L, " Instrument Air Pressure Low,":' Revision 18

-

A-21 for Window B-6V, " Plant Air Pressure Low," Revision IS

!

'

~Ph5VENTIVE MAINTENANCE (PM) PROCEDURES

'

!

.

,

PM-RLS-1, " Periodic Inspection and. Filter Replacement for Air Filter Regulators that buyply CQE Components," Revision 0

,-

t l

s I

!

]

/

)

.

>

<i

.

a-2-

]

,

w

.

f

';

i

~

y-<

,

,

u,-

.

b

- in A.

.

.

.

..

.

i

Q,fT Qp

-

,

'

1

}

,.

.

.

.

y,b j ;_o.

,,

$f'~

,l

'

.

,

(?.

,,

,

"

1.

PM-TXBD. " Replacement of Dessicent in Air Dryers"

-

,

.

_

,

PM.UXHV', " Air Diyer Inspection"

>

'I

. MODIFICATIONREQUESTS(MR)

'

.

MR-FC-88-035, " Hot Leg Injection During Long Term Cooling" l

,

,,

- MR-FC-87-021', " Pressurizer Spray Piping Fatigue"

'

MR-FC-88-120. Reglacement of Motor Operators for HCV-311, 312, 314 315, 317

,

.

,

318', 320, and 321 l

-

- MR-FC-88 110. "SI-3A/3B/3C Start Signal Logic Change"

'

'

'

TRAINING DOCUMENTS ~

'

Nuclear Operations Division Licensed Operator Training Program, Safety

,1 Injection and Containment Spray System, Lesson Plan 7-11-22. Revision 4, incl.:

'

Instructor Handbook, Transparency Index and Student Handbook OPPD Systems Training Manual for Auxiliary Feedwater, ATIAF689

'

OPPD Systens Training Manual for Emergency Core Cooling, ATIEC689 j

!

Nuclear. Operations Division Licensed 0 3erator Training Program, Auxiliary

)

'

Feedwater System, Lesson Plan 7-11-1, tevision 2, Incl. Instructor Handbook,

,

Transparency Index and Student Handbook

'

'

MISCELLANEOUS DOCUMENTS

.

> ^

General Engineering' Instruction GEI-27 Revision 0, "10 CFR 50.59 Safety =

Evaluation,m" issued November 1989

,

,

~. Inservice Testing Program for Pumps and Valves, Revision 3, dated December 22,

,

1988

.

!

'

Combustion Engineering Study CE-18074-611, datedduly 19, 1979, regarding

" Safety Injection Pump Roc,m Temperature. Evaluation"

- Amendment No. 52 to Facility Operating License DPR-40

Operations Support Analysis Report 87-10. " Determination of the Air-Operated

Valves _ Required for Safe Plant Shutdown," dated April 6, 1988 Combustion Engineering Report., " Engineering Evaluation of Feed and Biced for

'

TLOFW Events et Fort Calhoun Station," dated December 1988 l

Chemistry Procedure CMP-3.74, " Dew Point Sampling by A1nor Dewpointer,"

Revision 0:

-

,

l'

-3-

,

,

-

.

-

.,.. -., -

-

-

--

.-

- - -

--

+

,

j

'

.

1,.

...

~

f: ll;)f

'

• '

'

+

.

.o s

>

I^

Updated Safety Analysis Report (USAR) Sections 7, 8, and 9

.

"

. Design Basis Document SDBD-CA-1A-105, " Instrument Air," Revision 1,

[ F'ailbre Modes and Effects analysis - Static Inverters November 8,1989

,

,

,

e? i Failure Modes and Effects analysis - Inverters 1 and 2, November 8,1989

,

^

p4>

Failure Modes and Effects analysis - 125V Battery Chargers Nos 1, 2,. 3,

- y'

November _8,'1989

,

..

I_ l *

Failure Study of 120V ACLInverters, dated October 30, 1989

!

.

'

,

'

,

,

,

.

'

Maintenance.and Testing History for the following components:

'

,

a

,

,

.

,

,

Motor Driven Auxiliary feedwater (AFW)L Pump (FW-6)

,

e Turbine Driven AFW Pump (FW-10)

.

',

Y

'AFWPumpDischargeCheckValves(FW-173,1743

"

'

TurbineDrivenAFW.PumpSteamSupplyValves(YCV-1045,1045A-1045B)

AFW System Containment 1 solation Valves (HCV-1107A, -1107B, -1108A,

-1108B)

.

Conta_inmentSumpRecirculatinLineIsolationValves(HCV-383-3.383-4)

'

'

.'

s PowerOperatedReliefValves(PCV-102-1,-102-2)

Low Pressure Safety Injection Pumps (SI-1A, -1B)

,

Coraponent Cooling Water Putaps (AC-3A, -3B, -3C)

'

Safety Injection / Containment Spray Maintenance Orders (M0s) Reviewed:

s

,

'

'871216 863598 858038 858182

-

.852122 852123 863599 872415

,

Reactor Protection System MOs Reviewed:

843071

'842981 844117 850779 867004 851077-852525 857112 860638 867002

'

Auxiliary Feedwater MOs Rt. viewed:

.

.

852234 862369 873772 881904 843165 886860 843164 852164 845156 852174 892681 841339

'

Computerized History and Maintenance Data System (CHAMPS), Maintenance History Summaries for:

.ReactorProtectionSystem(RPS)pplyValve(YCV-1045)'

Turbine Driven AFW Pump Steam Su

,4 Containment Sump Recirculation Line Isolation Valves (HCV-383-3, -383-4)

CHAMPS Incident Report for 345kV ard 161kV Power Supply Lines

-4-

E6

.

.,

D

%.

~

-

t-Eo...

. -.

,

t

-

.

l

,,.] o

'

oo g

ATTACHMENT 3

'

-DRAWINGS REVIEWED h

OPPD 11405-M-97, Misc. HVAC Flow Diligram, Revision 41 OPPD 11405-N-252, Flow Diagram Steam, Revision 55 OPPD 11405-M-253, Flow Diagram Steam Generator Feedwater and Blewdown, l

Revision 67 OPPD 11405-M-263, Flow Diagram Compressed Air, Revision 38-OPPD 11405-M-13, Plant Air Flow Diagram, Revision 28 OPPD 11405-M-264, Sheet 1, Instrument Air Diepram, Auxiliary Building and-Containment, Revision 35

OPPD 1140541-264, Sheet 2, Instrument Air Diagram for Turbine Building and Intake Structure, Revision 17

'

OPPD 11405-M-264, Sheet 3 Instrument Air Diagram, Riser Details, Revision 24 OPPD 11405-M-264, Sheet 4 Instrument Air Diagram, Riser Details, Revision 27 OPPD 11405-M-264, Sheet 5, Instrument Air Diagram, Riser Details, Revision 27 OPPD 11405-E-28 SI System OPPDMCC3a(GE177B2371), Revision 3 OPPD 136B2492, Sheet 28, Controls YCV 1045, Revision 9 OPPD E-4043, Sheets 1 and 2, Auxiliary Feedwater,. Revision 1 OPPD 11405-E-3, 4.16 KV Auxiliary Power One Line Diagram OPPD 11405-E-6, 480 Volt Primary Plant Motor Control Center One Line Diagram OPPD 11405-E-8, 125 Volt D.C. Misc. Power Distribution Diagram e

OPPD 11405-E-9, 120 Volt Instrument Buses, Revision 29 OPPD 11405-E-10, Primary Plant Power Distribution, Revision 4 OPPD 11405-E-11, 4.16kV Switchgear Schematic, Revision 9 OPPD 11405-E-27, Schematic 4160V Diesci."01" Breaker'"1AD1" OPPD 11405-E-28, Feedwater and Main Steam System SC OPPD 11405-E-45, Misc. SC&I, Automatic Load Shedding, Revision 3 OPPD 11405-E-60. Reactor Building Troy and Conduit Layout, Revision 11

.

OPPD,11405-E-137, Controls YCV-1045 and FW/C l

OPPD 11405-E-138, Controls YCV-1107 A and B, Revision 6 OPPD 11405-E-139, Controls YCV-1108 A and B, Revision 6

'

OPPD 11405-E-405, Sheet 2, Wiring Diagram Al-66A, Revision 8

,

OPPD 11405-E-405, Sheet 2, Wiring Diagram Al-66B, Revision 8

!

GE Three Line Diagrams 161FS31, Sheets 1-10 GE Switches - AI-30A, Al-30B GE Wiring Diagrams 161F597, Sheets 6, 7, and 8 GE Wiring Diagram 161F598, Sheet 8

,

GE Wiring Diagran 161F532, Sheet 9 I'

GE Wiring Diagram 161F593, Sheet 1 i

,

.

l

.

-

---J

p?"

'

~

~

'

,,

,

..

p q

,.

.

.

!;.

aLi *i

.

'

i'o O '

t-

.

a '-

P&lD E-23866-210-130, SI/CS P&I Diagram, Revision 51

.

,

P

+

s

"

. Instrument & Control Equipment List,11405-EM-383, Revision 8'

Toxboro CD 1A, 2A, 3A, and 4A, Aux. Feedwater Auto Initietion-

'

.C Drawing C-4175, Sheet 1 " Typical Control Valve Air Source Valve Configurations, Revision 2 Coordination curves for'most of the PRA driven components - drawn October 30, j

,

1989 and November 1, 1989 by P. Vovk.

,

'

I fuse Curve - min-10 for YCV-1045, dated August 14. 1974

'

'

C 3-Page Coordination Circuit Analysis, dated October 25, 1989

'

i GE and ITE Catalog Type Curves for Molded Case Breakers i

'

.Gibbs and Hill Coordination Curves dated May 28. August 27, September 7 and Septewber 23, 1971

Stone 8 Webster ($&W) SDBD-EE-200,120 Volts AC Vital Distribution, Revision 0 S&W SDBD-EE-201, AC Electrical Distribution, Revision 0

S&W SDBD-EE-202, DC Electrical Distribution, Revision 0-

l

l i

,

t

,

!

,

.

'

,

W, J

'

r J

'

(-

'

-2 --

-

.

.

L

-

-

.-

...

-. -.

-