IR 05000285/1998011
| ML20236M758 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 07/08/1998 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20236M748 | List: |
| References | |
| 50-285-98-11, NUDOCS 9807140246 | |
| Download: ML20236M758 (18) | |
Text
L.
.
ENCLOSURE 2 U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
~ Docket No.:
50-285 License No.:
DPR-40 Report No.:
50-285/98-11 Licensee:
Omaha Public Power District Facility:
Fort Calhoun Station Location:
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 399, Hwy. 75 - North of Fort Calhoun Fort Calhoun, Nebraska Dates:
May 21-June 5 Inspectors:
V. Gaddy, Resident inspector C. Skinner, Resident inspector Approved By:
W. D. Johnson, Chief, Project Branch 8 ATTACHMENT:
Supplemental Information l
l 9907140246 990708
~
PDR ADOCK 05000285 Y
G PDR L
'
)
- _ _ _ _ _ _ _ _ _ _ _
_-_
t.
EXECUTIVE SUMMARY Fort Calhoun Station NRC Inspection Report 50-285/98-11 Operations The inspectors identified several examples of inconsistent wording between several plant
.
,
procedures, the procedure basis documents, and associated references. None of the inconsistencies affected the licensee's abilities to perform the procedures in a satisfactory manner (Section O3.1).
Operators responded to the fault on House Service Transformer T1 A-3 in a expeditious
.
manner and properly characterized the event (Section O3.3).
The inspectors concluded that management expectations and the training provided to
.
the operators were inconsistent with the procedural guidance. Proceoural guidance required operators to implement abnormal operating procedures whenever entry conditions were met. Operators were trained to, and management expected them to, implement the highest-order abnormal operating procedure first. Also, operators performed a step out of sequence and did not provide justification in the control room logs. While licensee management stated that this met their expectation because all steps in the abnormal operating procedure were performed, it was inconsistent with the guidance provided in Standing Order SO-O-1 (Section O3.3).
Two examples were identified where the Updated Safety Analysis Report was not
.
accurate in the description of plant systems. The first example was that the Updated Safety Analysis Report did not clearly state that the automatic bus transfer will not occur when the main generator is not in service. The second example was that the fire protection system was modified and in service for approximately 10 months, and the description in the Updated Safety Analysis Report had not been revised to reflect the new configuration (Section 08.1).
Maintenance The root cause of the inadvertent deluge of House Service Transformer T1 A-3 was
.
determined to be the failure to perform preventive maintenance on the entire deluge system. This was considered a weakness in the preventive maintenance program (Section M8.1).
Operations personnel did not initiate a maintenance work document to document a
.
,
deficiency with Alarm Test Valve FP-230 in accordance with Standing Order SO-O-1.
j l
This was a violation of 10 CFR Part 50, Appendix B, Criterion V (Section M8.1).
l
\\
!
U-___-______________
_ _
_
_ _ _ _
_.
_ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
-2-Enaineerino
..
The electrical distribution system was designed such that a single fault could cause the loss of both vital buses. This design protects the electrical distribution system by clearing faults as quickly as possible. The design met General Design Criteria 17
- requirements (Section M8.2).
t
The inspectors concluded that the root cause analysis performed by the licensee
.
properly identified the cause of the loss of power to the vital buses. The corrective actions taken and proposed were appropriate (Section E7.4).
<
{
l i
!
L J_-
- ___ __-__-_ :_- _
J
___:--_-___
__
__
-
l
.
Reoort Details Backaround On May 20,1998, at approximately 2:11 p.m., an electrical fault occurred on 161kV/4160V House Service Transforrner T1 A-3. This transformer provided the normal source of power to Vital Bus 1 A3. House Service Transformer T1 A-4, similar to T1 A-3, provided the normal source of power to Vital Bus 1 A4. Two feeder breakers, Breakers 110 and 111, normally provide parallel paths for 161kV power to Transformers T1 A-3 and T1 A-4. Breaker 110 was out of service for maintenance and both transformers and vital buses were being supplied by 161kV via Feeder Breaker 111 through their respective house service transformers. Both house service transformers are located on pads inside the protected area outside the turbine building.
l When the fault occurred, the plant was in the 50th day of a refueling outage with a new core loaded, the reactor vessel head in place but not tensioned, and the reactor coolant system filled.
Shutdown cooling was in service, and reactor coolant system temperature was approximately 105 F. Unit Auxiliary Buses 1 A1 and 1 A2 were energized and providing power to nonvital plant loads from the 345kV offsite power supply through the main Transformer T1.
When the transformer fault occurred, Feeder Breaker 111 opened, and 161kV power was lost to l
both vital buses. Both emergency diesel generators started and connected to their respective vital buses. The shutdown cooling pumps, which are supplied by vital power, were deenergized
{
for approximately 10 seconds while the emergency diesel generators started and connected to l
the vital buses. All plant equipment operated as designed.
l The plant declared a Notification of Unusual Event based on Emergency Action Level 6.1, " Fire or Explosion inside the Protected Area."
!
At 3:33 p.m. the licensee completed the process of backfeeding Vital Buses 1 A3 and 1 A4 from the 345 kV offsite power supply through the main trailtormer and the Notification of Unusual Event was terminated at 3:57 p.m.
This inspection examined the circumstances surrounding the electrical fault on House Service Transformer T1 A-3. Specifically, the inspectors evaluated the response of plant equipment and operators during the event,
,
l
Operations Procedures and Documentation
03.1 Adequacy of Procedures
'
a.
Insoection Scooe (93702)
The inspectors reviewed Abnormal Operating Procedure AOP-32, " Loss of 4160 Volt or 480 Volt Bus Power," Revision 3.2, and Emergency Plan Implementing i
Procedure EPIP-OSC-1, " Emergency Classification," Revision 28, which operators l
entered as a result of the electrical fault on Transformer T1 A-3.
l
._
_ _ _ ____ A
_ _ - _ _ _ - _ _ _ _
_ _
_ _ _
'
- '
l-2-l
.
b.
Observations and Findinas
!
Technical Basis Document for Abnormal Ooeratina Procedure AOP-32 The inspectors reviewed the Abnormal Operating Procedure Technical Basis Document
]
TBD-AOP-32, " Loss of 4160 Volt or 480 Volt Bus Power," Revision 3.2. The purpose of this document was to provide reference information for the procedures, an overview of the procedural strategy, and the intent of the individual steps. Operators performed the abnormal operating procedure steps as written with regard to exiting the procedure.
However, there appeared to be inconsistent information between the technical basis j
document and the procedural steps of the abnormal operating procedure.
'
The purpose section of the technical basis document contained a sentence which stated that the procedure should not be exited until all power supplies were returned to their normal lineup. The Updated Safety Analysis Report stated that the normal source of power for Vital Buses 1 A3 and 1 A4 was from Transformers T1 A-3 and T1 A-4, respectively. Operators exited Abnormal Operating Procedure AOP-32 when power was restored to Vital Buses 1 A3 and 1 A4 from the 345 kV offsite power source, which is the alternate power source. The procedure indicates that it is complete when offsite power is restored to the affected buses.
Based on the Technical Basis Document, the abnormal operating procedure should not be completed until the vital buses are realigned to Transformers T1A-3 and T1 A-4.
Basis Document for Emeraency Action Levels 4.1 and 4.3 The verification criteria for Emergency Action Level 4.1, " Loss of Offsite Power for >
15 Minutes," was that offsite power (345 KV and 161 KV) is not available to energize Buses 1 A3 and 1 A4 for greater than 15 minutes. The licensee's basis document for the emergency action level stated, in part, that 15 minutes was allowed to exclude transient or momentary power losses and to allow automatic or manual recovery actions.
The basis document referenced NUREG-0654, " Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Nuclear Power Plants," Appendix 1, Notification of Unusual Event initiating Condition #7, " Loss of Offsite Power or Loss of Onsite AC Power Capability." NUREG-0654 did not specify a duration for the loss of offsite power, only that offsite power was lost.
NUMARC/NESP-0007,"NUMARC Methodology for Development of Emergency Action Levels," Revision 2, Initiating Condition SU1, discusses a loss of all offsite power to essential buses for greater than 15 minutes. The basis provided by NUMARC stated
!
that a prolonged loss of AC power reduces required redundancy and potentially degrades the level of safety of the plant by rendering the plant more vulnerable to a complete loss of AC power, and 15 minutes was selected as a threshold to exclude l
k transient or momentary power losses.
-
_.
. _ _ _ _ _ - _ _ _ _ -
l l
.
l l-3-Therefore, the licensee's Emergency Action Level 4.1 appeared to be more consistent with the NUMARC guidance rather than the NUREG-0654 guidance which was listed as the reference for the emergency action level.
The verification criteria for Emergency Action Level 4.3, " Buses 1 A3 and 1 A4 are deenergized (<= 15 minutes)," was that Busses 1 A3 and 1 A4 are deenergized for 15 minutes or less. The basis document for the emergency action level stated, in part, that 15 minutes was allowed to exclude transient or momentary power losses and to allow automatic or manual recovery actions. Emergency Action Level 4.3 does not allow 15 minutes to elapse prior to declaration of the action level.
The wording in the basis document was not consistent with the direction provided by Emergency Action Level 4.3.
The basis document referenced NUREG-0654, Appendix 1, Alert initiating Condition 7,
" Loss of offsite power and all onsite AC power." NUREG-0654 did not specify a time duration for this alert initiating condition, but the associated initiating condition for a site area emergency indicated a duration of greater than 15 minutes. Therefore, the licensee's Emergency Action Level 4.3 was consistent with NUREG-0654; however, the wording in the licensee's basis document appears to be inconsistent.
The licensee stated that these documents would be reviewed to determine if either should be changed. The licensee also stated that they would consider reviewing other basis documents to ensure that no other potential conflicts exist.
c.
Conclusion The inspectors identified several examples of inconsistent wording between several plant procedures, the procedure basis documents, and associated references. None of the inconsistencies affected the licensee's abilities to perform the procedures in a satisfactory manner.
O3.2 ControBoom Loa Error a.
Insoection Scoce (93702)
The inspectors reviewed the control room logs to assess the operator actions taken following the electrical fault on Transformer T1 A-3.
b.
Observations and Findinas l
The inspectors identified that operators incorrectly logged that Emergency Diesel Generators DG-1and DG 2 were shut down per Emergency Operating l
Procedure / Abnormal Operating Procedure Attachment 17 " Restoring Off-Site Power to Bus 1 A3," Revision 3.3, and Attachment 18, " Restoring Off-Site Power to Buses 1 A4,"
j
_ _ __ -_ - -
_ _ _ - _ -..
_ -_
_
_
_
?
.
I L.
-4-
- Revision 3.3, respectively. During discussions with the inspectors, the licensee stated that Emergency Operating Procedure / Abnormal Operating Procedure Attachments 19,
" Shutdown of Diesel Generator D1," and 20, " Shutdown of Diesel Generator D2," were used to shut down the diesel generators.
l i
c.
Conclusion
!
The inspectors identified a minor logging error in the control room log, where the operators logged the incorrect attachments used to shutdown the diesel generators.
03.3 Instructions to Ooerators Different frorn Manaoement's Expectations
)
a.
Insoection Scoce (93102)
]
The inspectors reviewed operator response and procedural guidance to verify all actions were completed as required following the electrical fault on Transformer T1 A-3 which occurred on May 20,1998.
b.
Observations and Findinos
)
,
i The response of operations personnel during the transformer fault was good. Operators
{
properly characterized the fault and responded in a professional, expeditious manner.
j i
Operations personnel were originally informed that Transformer T1 A-3 had exploded.
This misinformation did not appear to impact the ability of operations personnel to mitigate the event. Once the event was properly diagnosed, the plant was stabilized and operations personnel quickly established backfeed from the 345 kV offsite power source through the main transformer to supply the vital buses.
The inspectors verified that appropriate notifications to governmental agencies were made.
~
However, the inspectors did note a few discrepancies. The inspectors reviewed the control room log and identified that Spent Fuel Pool Cooling Pump AC-SA was started
"
prior to energizing station lighting. Specifically, at 2:15 p.m. operators started the spent fuel pool cooling pump and at 2:38 p.m. station lighting was restored. Abnormal Operating Procedure AOP-32, " Loss of 4160 Volt or 480 Volt Bus Power," listed the
restoration of station lighting prior to starting the spent fuel pool cooling pump. No l
justification was provided in the control room log as to why the spent fuel pool cooling
'
pump was started prior to returning station lighting to service.
Standing Order SO-O-1, " Conduct of Operations," Step 12.1.2.A(1), stated that emergency and abnormal operating procedures are offered as guidance to mitigate the consequences of an accident or an unanticipated occurrence, During these occasions, l
verbatim compliance is recognized as potentially impractical, depending upon the event
,
_ _ _ _ _ _ _ - _ _ _ _.
. _ - _.
circumstances. However, when at all possible, the guidelines offered should be followed as written. Deviation from these procedures requires shift supervisor or licensed senior operator judgement, approval, and justification in the cont,al room log. Technical Basis Document TBD-AOP-32 stated in the purpose section that steps are placed in order of importance to plant safety and availability.
Discussions were held with the licensee on what was expected from the operators with regard to the order of performance of steps in the abnormal operating procedure. The licensee stated that it was operation management's expectation that the appropriate abnormal operating procedure be entered and that the operators were allowed to perform steps in any order as long as all of the steps were performed. The licensee also indicated operator training was consistent with management's expectations. In this particular case, control room operators' performance of the steps out of sequence met management's expectation. No justification was provided in the control room log because this was not viewed as a deviation by the operators.
The inspectors noted that the entry conditions for Abnormal Operating Procedures AOP-17, " Loss of Instrument Air," Revision 4, AOP-18, " Loss of Raw Water,"
Revision 4, AOP-19, " Loss of Shutdown Cooling," Revision 3, and AOP-36, " Loss of Spent Fuel Pool Cooling," Revision 1, were met following the loss of power to the vital buses, but operators did not enter these abnormal operating procedures or log why it was unnecessary to enter them. Since the entry conditions had been met, the inspectors asked if operators had referenced the abnormal operating procedures to determine if they provided guidance in addition to that provided in Abnormal Operating Procedure AOP-32. Operators did not reference the additional procedures. Step 12.4.3
!
of Standing Order SO-O-1 stateo that abnormal operating procedures shall be implemented whenever the entry conditions are met.
Discussions were held with licensee management regarding this apparent difference between Standing Order S0-0-1 guidance and observed operator actions. Licensee managemcnt stated that they expected operators to enter the appropriate, and highest-order, abnormal operating procedure, and in this instance Abnormal Operating Procedure AOP-32 was the appropriate procedure. The licensee also stated that operators had been trained to enter the highest order abnormal operating procedure and,
.
at the completion of that procedure, if additional abnormal conditions warranted entry into l
other procedures, they would be entered at that time.
i The inspectors concluded that management expectations and operator training did not agree with the wording in Standing Order SO-O-1.
c.
Conclusion j
Operators responded to the fault on House Service Transformer T1 A-3 in a professional manner and properly characterized the event. The inspectors concluded that management expectations and the training provided to the operators were inconsistent
!
i l -
l
I
!
I
-______
_ - - _ _ _ _ _ _ _. -
.
-6-with the procedural guidance. Procedural guidance required operators to implement abnormal operating procedures whenever entry conditions were met. Operators were trained to, and management expected them to, implement the highest-order abnormal operating procedure first. Also, operators performed a step out of sequence and did not provide justification in the control room logs. While licensee management stated that this met their expectation because all steps in the abnormal operating procedure were performed, it appeared inconsistent with the guidance provided in Standing Order SO-O-1.
i
Miscellaneous Operations issue 08.1 Uodated Safety Analysis Report Weaknesses
,
a.
Insoection Scooe (93702)
l
!
The inspectors reviewed the Updated Safety Analysis Report regarding plant electrical
)
systems and fire protection systems.
b.
Observations and Findinas
)
i Section 8 of the Updated Safety Analysis Report described the electrical systems.
l Power for the 4.16 kV station auxiliary system is available from two separate systems, the main generator 22 kV bus and the 161 kV offsite power source. The 22 kV power
'
source is the preferred power source for Nonvital Buses 1 A1 and 1 A2 and the 161 kV offsite power source is the preferred source for Vital Buses 1 A3 and 1 A4. Section 8.4 of the Updated Safety Analysis Report described two modes of automatic transfer, fast and slow, from the preferred to the alternate sources. It stated that the automatic transfers are inhibited when there is a source under-frequency or excessive voltage angle difference, no alternate source voltage available, uncleared faults on the transferred bus, or failure of the preferred source circuit breaker to open. The automatic transfer can also be manually inhibited. The Updated Safety Analysis Report text does not clearly state that the automatic transfer will not occur when the main generator is not producing electrical power.
Section 9.11 of the Updated Safety Analysis Report contained a paragraph which stated that the fire protection system was flushed and filled from the clarifier surge tank by utilizing one or both of the demineralized water system clarifier booster pumps after any system actuation and prior to the system Deing returned to operation. The inspectors questioned if this paragraph was still valid. The licensee stated that Design Modification MR-FC-94-023 changed the system such that Blair Municipal Water was the source for flushing and filling the system. The modification was open with all work completed, except a section to increase the capacity of the storage tanks. Operations personnel had been using Blair Municipal Water for flushing and filling the system since July 1997 when that section of the modification was completed and appropriate procedures were revised.
The inspectors verified that the modification package contained a markup page of the j
- _ - _ _ _ - _ _ - _ _ _ _ _ _ _ _
.
.
-7-Updated Safety Analysis Report. The licensee had an internal administrative limit of 12 weeks from the final closecut of a modification to revise the Updated Safety Analysis Report. The inspectors questioned if it was appropriate to wait until final close out to update the Updated Safety Analysis Report, especially since operations personnel had been using Blair Municipal Water since July 1997. The licensee indicated that the modification to increase the storage capacity of the tanks was on hold and that the modification package would be closed soon. During the 10 month interval that the modification package was open, the Updated Safety Analysis Report had been revised on January 30,1998, but the revision did not include information pertaining to the fire protection system modification.
c.
Conclusion Two examples were identified where the Updated Safety Analysis Report was not accurate in the description of plant systems. The first example was that the Updated Safety Analysis Report did not clearly state that the automatic bus transfer will not occur when the main generator is not in service. The second example was that the fire protection system was modified and in service for approximately 10 months, and the description in the Updated Safety Analysis Report had not been revised to reflect the
,
new configuration.
II. Maintenance M8 Miscellaneous Maintenance issues M8.1 Cause of Electrical Fault on House Service Transformer T1 A-3 a.
In.soection Scoce (93702)
The inspectors reviewed the licensee's evaluation to determine the cause of the electrical fault on Transformer T1 A-3.
b.
Observations and Findinas At or near the time of the fault, several witnesses stated that they saw a flash from Transformer T1 A-3 and the deluge system operating. However, witnesses could not conclusively state which occurred first.
During the evaluation to determine the cause of the fault on House Service Transformer T1 A-3, the licensee used data from the plant computer and determined that, approximately 12 seconds before power was lost to the vital buses, Bus 1 A1, which supplied power to nonvital loads, voltage decreased from 4146 volts to 4142 volts.
I
_
_
_ _ _ _ _ _
_ _ _ _ _ - - - _ _ - - - - - - - - - - - - - -
.
e-8-Concurrent with the 4 volt decrease, Bus 1 A1 picked up approximately 180 kW of load.
The licensee concluded that the voltage decrease and load increase was due to the i
starting of the electric fire pump. The electric fire pump was powered from Bus 1A1.
Since the plant computer indicated that the fire protection system was operating before voltage was lost to the vital buses, the licensee focused their evaluation on determining if the electrical fault could have been caused by the actuation of the deluge system.
To confirm this hypothesis, the licensee conducted a test on May 21,1998, to determine whether the fault was an electrical or mechanical malfunction of the fire protection system. Specifically, the tests were designed to detect any failures in the deluge system for House Service Transformer T1 A-3.
Data gathered indicated that there was no valid signal for the deluge system to have automatically actuated. The licensee stated that there were only three ways to electrically initiate the deluge system. These were:
Operation of the fire suppression manual pull station. This did not occur because
.
the pull station was inspected and observed to be intact.
Local temperature indication. Temperature indicators were located in a ring
.
around the transformer. A temperature increase to approximately 165 F would cause an electrical circuit to be completed and actuate the system. Inspection of the local temperature indicators determined that none had been actuated.
Operation of the manual actuation pull valve. This valve was inspected and
.
verified to be intact.
The inspectors noted that there was no electricalinterlock to prevent a deluge actuation when the transformers were energized.
The transformer deluge system was controlled by Deluge Valve FP-754. The valve was kept closed by maintaining priming pressure on the valve's top chamber. When the top chamber of the deluge valve is vented, flow is actuated, and greater than 6 psig is sensed in the piping downstream of the deluge valve by a reset prevent valve, pressure is continua!!y vented off the top chamber of the deluge valve and the valve would remain open. If the deluge valve were closed, and the reset prevent valve sensed 6 psig in the deluge valve discharge header, it would open, vent the deluge valve upper chamber, and allow the deluge valve to open.
The testing was intended to prove that a valid electrical actuation signal did not cause the deluge valve to operate and spray down House Service Transformer T1 A-3. The licensee shorted the manual pull station leads together to simulate its operation. The deluge valve opened, system pressure decreased, and both fire pumps started on low system pressure. The deluge system sprayed down Transformer T1A-3 as designed.
- _ _ _ _ _
- _ - _ _ _ - - - ___- _ ______.
.
.
-9-Since the electrical portion of the circuitry operated as designed, the licensee concluded that the actuation was not due to an electrical malfunction. The licensee then suspected the deluge valve may have suffered a mechanical failure.
The licensee determined that several hours before the electrical fault on the transformer, operations personnel had performed a system flush of the deluge system. The test was conducted in accordance with Preventive Maintenance Procedure OP-PM-FP-1000,
" Quarterly Fire Protection Drain Valve Flush and Alarm Test." To verify the operability of Transformer T1 A-3 Deluge Valve FP-754, the procedure directed operators to open Alarm Test Valve FP-230, verify its associated control room alarm actuated, close Alarm Test Valve FP-230, and verify the alarm clears. Alarm Test Valve FP-230 was a manually-operated ball valve. Following the alarm check, that portion of piping was drained.
The licensee removed and inspected Valve FP-230 on May 23,1998. The licensee determined that the external mechanical stop of the valve had been bent, which allowed the valve to travel past its fully closed position. This resulted in leakage past the valve seat. The licensee verified this leakage by hydrostatically testing the valve. Directly upstream of Alarm Test Valve FP-230, Check Valve FP-342, which separates the deluge valve discharge piping from the Alarm Test Valve piping, was also found to leak. With both of these valves leaking, the water column to the sprinklers and to the reset prevent I
valve was allowed to slowly fill. With the water columns being filled, the pressure sensed by the reset prevent valve increased until, at 6 psig, the reset prevent vane opened, vented the upper chamber of the deluge valve, and allowed the deluge valve to open.
When the deluge valve opened, fire main pressure dropped, both fire pumps started on low system pressure, and Transformer T1 A-3 was sprayed. The deluge system sprayed the energized transformer with river water, causing Phase B to ground and Phase B to Phase C faults on the primary side of the transformer. The conductivity of the river water was subsequently measured to be approximately 550 micrombos/cm.
In following up on the alarm test, the inspectors noted that the input into the annunciator was a pressure switch. With Alarm Test Valve FP-230 open, fire system pressure was detected and an alarm in the control room was received. When pressure decreased, the alarm cleared. The inspectors reviewed the annunciator response procedure to verify the alarm setpoint. No setpoint was listed for the alarm nor did the licensee know exactly what the setpoint was for the pressure switch. The inspectors then reviewed the vendor data for the pressure switch and determined that the pressure switch setpoint was set by
' the vendor and could vary from 2 psig to 20 psig and was adjustable. Based on the testing and findings by the licensee, the setpoint of the pressure switch was most likely greater than 6 psig, or a control room annunciator would have been received prior to the l
reset prevent valve opening.
L
_J
_ _ _ _ _ _ _ _ - _ - - _ _ _ _ - -
>
.
l
'
i
-10-The inspectors reviewed the training that operations personnel had received regarding ball valve operation. The training covered how ball valves operated and provided adequate information to alert operators that a valve was not functioning properly if it was -
allowed to travel past its 90 degree stop position.
The inspector reviewed Standing Order S0-0-1, " Conduct of Operation." Step 5.5.3.B stated that in many cases the failure of a valve to operate in either direction may result in serious consequences; therefore, every deficiency must have a maintenance work documerit written. No work document or deficiency document was initiated addressing the bent stop on Alarm Test Valve FP-230. Failure to follow this procedure and document the deficient ball valve is a violation (50-285/9811-01).
The inspectors asked about the maintenance history on Check Valve FP-342. The licensee stated that the check valve was vendor supplied and was not in the preventive maintenance program. No maintenance had ever been performed on the valve. The valve had been in service since plant startup. The check valves in the other four transformer deluge systems, as well as other components in each of the transformer deluge systems, were not in the preventive maintenance program and no preventive maintenance had been performed on these components. Failing to perform any preventive maintenance on the components in the deluge system is a weakness in the preventive maintenance program.
!
As interim corrective action, on May 23,1998, the operations department issued Memorandum FC-OPS-130-98. This memorandum directed turbine building operators, during their rounds, to open drain valves on each of the five deluge valves twice per shift and to monitor the leakage from the drain line. During the first evolution, approximately 1-2 cups of water was drained from the deluge piping for Transformer T1 A-1. No water was drained from the other deluge piping. No additional leakage was noted during subsequent draining operations.
c.
Conclusions The root cause of the inadvertent deluge of House Service Transformer T1 A-3 was determined to be the failure to perform preventive maintenance on the deluge system.
This was considered a weakness in the preventive maintenance program. Operations l
personnel did not initiate a maintenance work document to document a deficiency with
'
Alarm Test Valve FP-230.. This was a violation of Standing Order SO-O-1 and 10 CFR Part 50, Appendix B, Criterion V.
M8.2 Switchvard Resoonse Durino Transformer Fault a.
Insoection Scoce (93702)
The inspectors evaluated the response of switchyard equipment during the transformer
- fault.
__
_ _ _ _
_J
_
___ __
_ _ _ _ _ - - - - -
.
.
-11-b.
Observations and Findinos When the fault on House Service Transformer T1 A-3 occurred, Feeder Breaker 110, one of two parallel breakers which can supply 161 kV to the vital buses, was out of service for maintenance. As a result. 4160 volt power was being supplied to Vital Buses 1 A3 and 1 A4 via Breaker 111 through Transformers T1 A-3 and T1A-4. Unit Auxiliary Nonvital Buses 1 A1 and 1 A2 were being backfed from the 345kV system via the Main Transformer (T1) and Transformers T1A-1 and T1A-2.
At the time of the electrical fault, the substation fault recorder detected a bushing fault on Transformer T1 A-3. The fault lasted for approximately 11.5 cycles. A Phase B to ground fault occurred during the first 5.25 cycles. A Phase B to Phase C fault occurred during the last 6.25 cycles. When the fault occurred, Differential Relay 87/161-2, i
external to Transformer T1A-3, sensed an approximately 7550 amp current differential l
during the first 5.25 cycles. During the final 6.25 cycles, Differential Relay 87/161-2 l
sensed an approximately 9000 amp current differential. This relay monitored Phase B of j
Circuit 1587. Circuit 1587 was the 161 kV line connecting Feeder Breakers 110 and 111 i
to Transformer T1 A-3 and T1 A-4. Due to the magnitude of the differential current, the J
differential relay tripped Feeder Breaker 111 which isolated 161kV power from
Transformers T1 A-3 and T1 A-4.
l The differential relay also sent open signals to Breakers 1 A31,1 A33,1 A42, and 1 A44.
These breakers separate Nonvital Buses 1 A1 and 1 A2 and Vital Buses 1 A3 and 1 A4 l
from Transformers T1 A-3 and T1 A-4. On the loss of power to the vital buses, both I
emergency diesel generators started and restored power to Vital Buses 1A3 and 1A4.
Nonvitalloads continued to be supplied by Unit Auxiliary Buses 1 A1 and 1 A2 via the main transformer.
l The inspectors asked if the Fort Calhoun breaker scheme was designed such that a single fault could cause a loss of both vital buses. The licensee responded that the breaker scheme operated as designed because the 161 kV supply is subject to common mode failure (one fault can cause the loss of the 161 kV supply to Buses 1A3 and 1 A4).
The licensee stated that the system was designed in this manner to protect the electrical
,
distribution system from any real fault and to clear a fault as quickly as possible. If high
'
amperage faults were not cleared quickly, damage to the 161kV/4160V distribution system could occur.
Had the fault occurred with the main generator in service, a fast transfer of vital bus power from the 161 kV supply to the 345 kV electrical supply would have occurred.
This fast transfer would have prevented the vital buses from losing power and the emergency diesel generators would not have started.
Following the fault, engineering personnel performed an evaluation to determine if the inadvertent deluge, and resulting power loss, placed the plant outside its design basis.
The plant was designed to meet General Design Criteria 17, which required the
., _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _
_
-_
-
,
.
..
-12-
!
The plant was designed to meet General Design Criteria 17, which required the following:
An onsite and offsite electrical system, each of which was capable of safely
.
shutting down the reactor.
The onsite electrical system was to have sufficient independence, redundancy,
.
and testability to accomplish safe shutdown assuming a single failure.
Th'e transmission system was to be supplied by two physically independent
.
circuits.
Each offsite power supply was to be available in sufficient time to assure safe
..
reactor shutdown, assuming the loss of both onsite supplies and the other offsite supply.
!
One offsite supply was to be available within a few seconds to mitigate the
.
consequences of a loss of coolant accident.
The design will minimize the probability of the loss of any of the remaining
.
sources as a result of or in coincident with the loss of power generated by the nuclear unit, the loss of power from the transmission network, or the loss of power from the onsite electrical supplies.
The inspectors reviewed the licensee's response to each of the design requirements and verified that General Design Criteria 17 requirements were met and that the plant met its design basis even though the 161 kV and 345 kV offsite power supplies are not single
' failure proof.
c.
Conclusions The electrical distribution system was designed such that a single fault could cause the loss of both vital buses. This design protects the electrical distribution system by
. clearing faults as quickly as possible. The design met General Design Criteria 17
,,.
requirements.
M8.3 Transformer Damaae Assessment a..
Insoection Scoce (93702)
The inspectors evaluated the damage assessment the licensee performed on the faulted
)
l transformer.
,
,
__.____._.__.__________.____..__-_.___.._._____________w
_.. _ _
_ _ - _ _ _ _ _ _ _ _ _ - _ _ - _ _ - _ _ _ _ _ - _ _ - _ _ _ _ _ - _
.
.
-13-b.
Observations and Findinos On May 20,1998, the licensee performed their initial damage assessment of Transformer T1 A 3. During the external damage assessment, the licensee noted burn marks on the Phase B and Phase C bushings. On Phase B, one burn mark was located on top of the bushing and two burn marks were located at the base of the bushing. The Phase C bushing had one burn mark on top of the bushing. No other external damage was noted.
The licensee performed Doble transformer power facts testing to identify any internal damage to the transformer. The test results were satisfactory. Additionally, the licensee performed oil analysis for dielectric, checked transformer oil level, performed transformer turns ratio tests, and checked lightning arrestecs. All test results were satisfactory, Excitation current was also measured and compared with testing conducted earlier during the outage. The readings were equivalent.
The license filed rough surfaces on the bushings to reduce corona potential and cleaned the glazing damage that had occurred on the bushings.
Since testing and external damage assessments did not identify any internal problems with the faulted transformer, the licensee did not perform any testing on Transformer T1 A-4. Visualinspections were performed and no damage was noted.
c.
Conclusions The testing performed by the licensee was adequate to detect any internal problem with the transformer.
M8.4 Other Onooino Switchyard Activities i
(
a.
Insoection Scone (93702)
l The inspectors reviewed the other work being performed in the switchyard when the
'
electrical fault occurred to determine if it could have caused the transformer fault.
b, Observations and Findinos
)
When the fault of Transformer T1 A-3 occurred, maintenance was being performed in the I
switchyard. Specifically, licensee personnel were performing maintenance on Feeder j
Breaker 110. Breaker 110 is one of two breakers that supply 161 kV to i
I Transformers T1 A-3 and T1 A-4. The breaker was isolated and out of service to perform l
timing testing and breaker adjustments. This was the only work authorized in the l.
switchyard at the time of the event.
l l
!
w
_-
-
i
_ _ _ _ _ _ _ _ - _ -
I
.
-14-The inspectors verified that the work being performed in the switchyard did not contribute to the electrical fault on Transformer T1 A-3.
c.
Conclusions None of the work in progress in the switchyard prior to the electrical fault on Transformer
T1A-3 contributed to the event.
M8.5 Maintenance Rule implications a.
Inspection Scoce (62707)
,
The inspectors followed up on potential implications of the deluge system failure with regard to 10 CFR 50.65, " Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants."
b.
Observations and Findinas
The 10 CFR 50.65 implications of the transformer fault were addressed in Condition Report 199801214. Prior to the fault, the DELUGE functional group of the fire protection system was monitored under Category (a)(2) of 10 CFR 50.65. The performance criteria for this functional group was no functional failure. A functional failure was defined as the spurious actuation of any suppression system, structure, or components, which causes the unavailability of any component reportable under 10 CFR 50.65. The inadvertent actuation of the deluge system was considered a functional failure and caused the performance criteria to be exceeded. As such, on June 11,1998, the DELUGE functional group of the fire protection system was placed into Category (a)(1) of 10 CFR 50.65. As a result of being placed in Category (a)(1), corrective actions and monitoring goals were established.
c.
Conclusions The inadvertent actuation of the deluge system caused 10 CFR 50.65 performance criteria to be exceeded. This resulted in the DELUGE functional group of the fire protection system being placed in Category (a)(1) of 10 CFR 50.65.
E7 Quality Assurance in Engineering Activities E7.1 Insoection Scops The inspectors reviewed the licensee's root cause analysis and corrective actions l_
implemented and proposed.
!
- _ _ - _ _ _ _ - _ _ _ _ _
_ _ - _ _ _ _ _ _ _ _ _
.
.
!
-15-l l
E7.2 Adeouacy of Root Cause Analysis On June 4,1998, the licensee completed their root cause analysis of the inadvertent actuation of the deluge system and resulting transformer fault. The root cause was determined to be a lack of a preventive maintenance program on the deluge system.
Several contributing causes were identified. These included:
Lack of initiation of a maintenance work document for manual ball Valve FP-230
.
which had a bent mechanical stop; Mishandling Valve FP-230 in such a manner which allowed travel beyond its
.
90 degree fully closed position resulting in valve leakage; Lack of identification of the damaged ball valve during flushing / alarm testing of
.
the system and shutting the valve past the fully closed position and allowing it to leak; Crowded and poorly lit area around the transformer deluge valve; and l
.
i Conductivity of the river water.
.
The inspectors concluded that the root cause performed by the licensee properly identified the cause of this event.
E7.3 Corrective Actions to Prevent Recurrence To prevent recurrence, several corrective actions were recommended. The first, which was a short-term corrective action, required operators to check and drain as necessary the appropriate portion of the deluge piping during normal rounds. This action will continue until evaluation indicates it is no longer necessary. The second, which was a long-term corrective action, involved a review of preventive maintenance activities for the fire protection system to assure the system will operate without inadvertent actuations.
This review was scheduled to be completed by November 20,1998.
E7.4 Conclusions The inspectors concluded that the root cause analysis performed by the licensee properly identified the cause of the loss of power to the vital buses. The corrective actions taken and proposed were appropriate.
J
. _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _, - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ ___._-___ -..,
(.
-.
l..
-16-V. Manaaement Meetings l
l V1 Exit Meeting Summary
!
The inspectors presented the inspection results to members of licensee management at an exit meeting on June 18,1998.
- .
'
i.
No propriety information was identified.
l L-
,
. I l
L l-
-
l l'
!
H P
l-
- f..,
'
_
-
p.
-
_ _ _ _ -.
_o_____
_ _. ___ _ _ ___ _ _ _ ____ ___ _____ _ _ _ _ _ _ _ ___
_ _ - - _ _ _ _ _
- _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ ___________________-_____________ _ __- _ __ _ _ - _ - _ - _ _
a
.
ATTACHMENT i
i SUPPLEMENTAL INFORMATION
'
PARTIAL LIST OF PERSONS CONTACTED Licensee R. Clemens, Manager, Maintenance J. Chase, Plant Manager S. Chomos, System Engineering A. Christensen, Operations Engineer
'
O. Clayton, Manger, Emergency Planning M. Core, Manager, System Engineering B. Hansher, Supervisor, Station Licensing R. Ridenoure, Operations Supervisor R. Short, Assistant Plant Manager LEC W. Walker, Senior Resident inspector INSPECTION PROCEDURES USED IP93702:
Prompt Onsite Event Response ITEMS OPENED. CLOSED. AND DISCUSSED Ooened 50-285/9811-01 VIO Failure to initiate a maintenance work document i
<
I-
!.
p w
_ ---- --- --- ----