IR 05000313/1989004
| ML20247Q886 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 03/31/1989 |
| From: | Ray Azua, Stetka T, Wagner P NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20247Q877 | List: |
| References | |
| 50-313-89-04, 50-313-89-4, 50-368-89-04, 50-368-89-4, IEB-85-003, IEB-85-3, NUDOCS 8904070216 | |
| Download: ML20247Q886 (19) | |
Text
-,.
- - - _.
'
.-
,
,
'
..
,,
,
APPENDIX U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
NRC Inspection Report: 50-313/89-04 Operating Licenses: DPR-51 50-368/89-04 NPF-6 Dockets: 50-313 50-368 Licensee: Arkansas Power & Light Company P.O. Box 551 l
'
Little Rock, Arkansas 72203 Facility Name: Arkansas Nuclear One (ANO), Units 1 and 2 Inspection At: Russellville, Arkansas (onsite), and Arlington, Texas (NRC Region IV)
Inspection Conducted:
February 6-17,1989(onsite)
February 20-24, 1989 (In NRC Region IV)
Inspectors:
4% h 3/3//69
_
P. C. Wagner, Reactor Inspector, Plant Systems Date Section, Division of Reactor Safety J
L L
2Wer
-
R. Azua, Reactot }hs'pector, Test Progray6s Date
Section, Divisi6n of Reactor Safety h~ A
~
Approved:
A l l l.l$b 3!8/!,Q9 T. F O tetKa, Chief, Plant Systems Section Dafte '
Division of Reactor Safety Inspection Summary Inspection Conducted February 6-24, 1989 (Report 50-313/89-04; 50-368/89-04)
Areas Inspected:
Reactive, announced inspection of licensee's long-term followup actions related to equipment malfunctions which occurred following a turbine / reactor trip on January 20, 1989.
The equipment malfunctions included the failure of the main turbine generator exciter, the failure-of 6900 volt kifa40$$ckbbOO
.
--
)
i
\\
.-
.
.
'
'
-
..
.
-2-
Bus 1H1 to fast transfer, the failure of main feedwater (MFW) pumps and valves to properly respond to conditions, and the failure of a HPI check valve to reseat.
The NRC inspectors also gathered information on diesel fuel oil storage and handling to resolve additional, but unrelated, NRC concerns.
Results: Within the areas inspected, onS potential enforcement issue was identified (failure to maintain design controls, paragraph 2(f)). The NRC inspectors found the licensee's actions in response to the multiple equipment malfunctions which occurred following the January 20, 1989, reactor trip to be acce) table. The NRC inspectors noted that the licensee's earlier evaluation of tie MFW block valve actuator torque switch setting had not considered the worst-case differential pressure; this resulted in a too low of torque switch setting being recommended. The NRC inspectors also noted that the controls for installation, maintenance, and testing of the Integrated Control System (ICS)
were based on the existence of only schematic diagrams (wiring diagrams do not exist). The lack of detailed drawings probably caused the wiring problem and the erroneous postmodification test results.
Finally, the NRC inspectors l
determined that AP&L fulfilled the NRC request for quality assurance of the l
emergency diesel generator (EDG) fuel oil, based on the licensee's commitments and answers to survey questions.
l
!
!
)
i I
l
_ - -
,
- _ _ -
_
l l
..
.
,
-
'
.
,,
-3-DETAILS i
1.
Persons Contacted j
AP&L I
A. Cox, Operations Superintendent l
+*L. Humphrey, General Manager, Nuclear Quality
J. McWilliams, Manager Maintenance
+*P. Michalk, Licensing Engineer
- R. Lane, Manager Engineering, ANO
+*D. Lomax, Plant Licensing Supervisor
+*S. Quennoz, Plant General Manager J. Taylor-Brown, Quality Control Superintendent
,
- R. Tucke, Electrical Maintenance Engineer
{
- J. Vandergriff, Manager Operations j
- R. Wewers, Manager, Work Control Center l
4 C. N. Shireley, Plant Engineering Support
+ M. Durst, Project Engineering Support S. McGregor, Superintendent, Engineering Services M. Goodson, Supervisor, Project Engineering D. Crabtree, Supervisor, Engineering Services D. Williams, Supervisor, Nuclear Engineering W. Eaton, Manager, Mechanical, Civil and Structural Design D. Peschong, Supervisor, Structural Analysis W. Garrison, Operations Technical Support C. Turk, Superintendent, Nuclear Engineering NRC Personnel 4*R. Haag, Fesident Inspector l
+ W. D. Johnson, Senior Resident Inspector
- Denotes persons who attended the exit interview on February 10, 1989.
,
+ Denotes persons who attended the exit interview on February 16, 1989.
l The NRC inspectors also contacted and interviewed other AP&L operations, maintenance, and engineering personnel during the course of the inspection.
2.
Followup on Equipment Malfunctions - Unit 1 (93702)
i An automatic reactor trip of ANO-1 from 100 percent power occurred on l
January 20, 1989, as the result of a main turbine generator (1G) trip.
The TG tripped because of a fault in the generator exciter.
In the time immediately following the trip, several equipment malfunctions occurred.
The malfunctions, in addition to the exciter, included failure of a 6.9KV nonvital bus to rapid transfer to an alternate power supply; failure of main feedwater (MFW) block valves to close; failure of MFW control valves to close; failure of the MFW pumps to return to their minimum speed setpoint; and failure of a HPI check valve to reseat. An NRC augmented inspection team (AIT) was dispatched to the site to review
v
_ --
-
..
.
,
-
-
.
,,
-4-the initial actions taken by ANO. The results of that
!
inspection were documented in NRC Inspection Report 50-313/89-03; 50-368/89-03. This inspection evaluated the licensee's long-term corrective actions.
a.
Exciter Failure
<
The main generator exciter provides the electrical power for the magnetic field of the main generator. Approximately 1 1/2 hours before the January 20, 1989, turbine / reactor trip, the reactor
,
operators observed sporadic spiking of the exciter voltage. These voltage spikes began to occur more frequently and became larger in magnitude until a generator lockout occurred which resulted in a plant shutdown.
i
l Following the plant shutdown, an inspection of the exciter revealed a broken electrical connection on one of the stator pole pieces. The appearance of the connection indicated that arcing across the broken connection had caused the voltage spikes and had further deteriorated I
the connecting points. When the deterioration became significant, I
contact could no longer be reestablished and the field for the main
'
generator was lost. Th4 3 caused the generator lockout relay to actuate and resulted in the generator / turbine / reactor trip.
The licensee replaced the damaged pole piece, replaced one additional pole piece, and added a brace to an additional unsupported pole piece i
connector. The pole piece which failed was the only other pole piece j
which did not have a brace for the electrical connections.
The
)
licensee was unable to determine why the two coils' braces were l
missing and assumed the missing brace was instrumental in the
l
'
connector failure.
The NRC inspectors found the licensee's actions related to this
/
!
l malfunction to be acceptable.
No violations or deviations were identified.
!
!
b.
Bus Transfer Failure During normal plant operations, electrical power is provided to the l
equipment by the main TG through the Unit Auxiliary Transformer. The i
reactor coolant pumps (RCPs) are powered from 6.9KV Buses I
,
1H1 (RCPs P32A and P32C) and 1H2 (RCPs P32B and P32D). An automatic i
fast transfer of the 6.9KV Buses to either Startup Transformer 1 l
l (SVT1) or Startup Transformer 2 (SUT2) (both powered from the I
switchyard) is designed to be initiated by a main generator lockout l
relay. When the main generator lockout relay operated on January 20 j
'
1989, the IH1 Bus did not fast transfer to an SUT. This failure I
resulted in an undervoltage trip causing the loss of RCPs P32A and P32C. The IH2 Bus properly fast transferred to SVT1.
,
I t
i I
l
l
,
. _ _.
_
-
..
.
,
.
.
.
,,
-5-The licensee investigated the failure of fast transfer for Bus IH1 and determined that a protective interlock had probably blocked the circuit breaker closure. This protective interlock ensures that the voltage sources are in synchronism as a condition for circuit breaker closure.
In the period immediately following the main TG trip, large voltage swings occurred which could have created the appearance of an nonsynchronous condition.
In addition, the licensee determined that the time delay setting of the relays utilized to verify synchronism, had a longer than necessary dead band. The licensee reset the time delay from a setting of 10 to a setting of 2, where 10 is the longest delay setting and 1 is the shortest.
The NRC inspectors found the licensee's actions related to the fast transfer malfunction to be acceptable.
No violations or deviations were identified.
c.
MFW Block Valve Failure During plant operation above 50 percent of full power, the MFW block and control valves are positioned full open and the MFW flow rate is controlled by varying the MFW pump speed. The two 60 percent capacity MFW pumps are steam turbine driven and controlled by the Integrated Control System (ICS).
In order to preclude an overcooling of the RCS following a reactor trip, the ICS sends an automatic closure signal to the MFW block valves, the MFW control valves and a runback signal to the MFW pump turbines.
Following the reactor trip on January 20, 1989, the B train's MFW block valve (CV-2675) failed to close. The reactor operators recognized the malfunction and manually closed the safety related B train's MFW containment isolation valve to prevent overcooling the RCS.
The licensee evaluated the failure of the B train's MFW block valve to close, and determined that the actuator's torque switches had operated because of the unique conditions which existed. The B MFW pump did not return to a minimum speed setting as designed (see subparagraph 2.e below), thereby maintaining full MFW pump pressure.
The high discharge pressure resulted in a higher than anticipated differential pressure (DP) across the block valve, which in turn, required a greater than anticipated closing thrust on the valve's stem. The thrust provided by the motor actuator increased to the setpoint of the closing torque switch, which opened to deenergize (thereby protecting) the actuator motor.
The NRC had directed all licensees to evaluate the torque switch settings of certain emergency cooling system motor operated valve actuators in IE Bulletin 85-03. The Bulletin required the licensees to (1) ovaluate system parameters to develop the worst-case DP across the vake, (2) obtain valve and actuator manufacturers' data on valve requireinents and actuator capabilities to ensure that the actuator was ad@uate for the valve in the worst-case DP condition, and (3)
.i l
-
-
..
.
\\
,;.
..
-6-
~
determine and adjust the torque switch settings to ensure ~ correct
~
L actuator operation. APAL completed the required actions-for the
'
emergency cooling system valves and then expanded the ANO valve actuator evaluation program to other plant valves. The AP&L plan was to include all valves determined to have a potential effect on safe plant operations. The licensee assigned a priority to the selected valves and implemented the program on the valves of higher priority and those requiring maintenance. Approximately 100 valves had been completed by February 1989.
The B train's MFW block valve was originally assigned a lower priority but had been evaluated during the Fall 1988 refueling outage. The worst-case DP was calculated to be approximated 70 psid assuming the B train's MFW isolation valve was closed and'the_B MFW i
pump was runback to minimum speed. 'The closing torque switch was-
!
subsequently set for a DP of approximately 300 psid. This value, I
which the licensee originally considered to be conservative, did not I
account for the upset case DP and was less than-the DP which was calculated to be 340 psid during the February 20, 1989, event.
Following the failure to close, the licensee reevaluated the actuator and valve, and reset the closing torque switch for a DP of approximately 800 psid.. To preclude similar failures, the licensee also reset the torque switches for the A train's MFW block valve (CV-2625) and the A and B trains MFW low load block valves (CV-2624-andCV-2674)to800psid. The licensee also initiated a review to ensure that the worst-case DP calculated for all other previously evaluated valves included consideration of any possible upset conditions.
The NRC inspectors found the licensee's actions in response to this malfunction to be acceptable.
No violations or deviations were identified.
d.
MFW Control Valve Failures In addition to the 18-inch block valves, MFW is provided to the steam generators through a 10-inch low load control valve and its associated motor actuated block valve and through a 6-inch startup control valve. These control valves-are piped in parallel with the main block valves and are pneumatically positioned. The-low load control valves (CV-2622 and CV-2672) are in series with'their respective block valves. The startup control valves (CV-2623 and CV-2673) are not provided with block valves. The ICS provides the electrical. signals to the control ' valves for throttling MFW flow up to 50 percent power. The ICS also provides a closure signal to the control valves as part of the rapid feedwater reduction-(RFR)
circuitry to preclude overcooling events. However, none of the MFW control valves closed following the Jannary 20, 1989, event.
_
--.
..
..
...
-....
.
..
..
_.
- --
'
l
.
,.
,,
.,
.
-7-
In order to implement an Owner's Group Safety and Performance Improvement Program, the licensee had initiated a Design Change Package (DCP 87-1070) to add an ICS monitoring' system, make some'
minor control enhancements, and remove several modules which were no longer necessary. One improvement involved a small modification to the RFR circuitry. The modifications proposed by DCP 87-1070 were implemented by Job Order 764991'during the Fall 1980 refueling
,
outage. The Job Order, which referenced the DCP as the. controlling document, was not intended to provide step-by-step instructions and detailed wiring diagrams'did not exist. The work was to be completed in three parts:
first, the removal-of unnecessary components, second, the addition of new components and rewiring, and third, testing in accordance with Special Work Plan (SWP) 1409.130, "ICS l
Simplification Testing."
The NRC inspectors reviewed the following ICS drawings to gain an understanding of the. number and complexity of the changes which were implemented:
'
,
i Feedwater Flow Control MIR-277-6-1 MIR-278-8-1 MIR-279-7-1 MIR-280-7-1 MIR-281-7-1 MIR-282-9-1 MIR-283-6-1 MIR-284-9-1 MIR-284-2-0-1 Reactor Control MIR-163-7-1 MIR-162-7-1
- Unit Load Demand MIR-170-8-1 MIR-169-6-1 MIR-168-8-1 MIR-167-6-1
Integrated Master Control MIR-164-9-1
'
MIR-165-7-1 MIR-166-6-1 The NRC inspectors observed that the drawings were all schematic l
drawings with block type representation of the various control modules. The DCP was implemented utilizing these drawings because
'
interconnection wiring drawings for internal ICS connections were not I
available.
l The NRC inspectors also checked the ICS cabinets (C46 cabinets 1 through 5), the Non Nuclear Instrumentation (NNI) cabinets (C-47 cabinets 1 through 4 and C-48 cabinets 5 through 7) and the
,
l l
.
- - - -, - - - - - -. - _. - - _ - _ _ -
v.
-. -
...
....
...
.......
.....
..
.
.
'
.
,
,
,
L-8-cabinet (C585) for the new Plant Performance Analysis System (PPAS)
to see the wiring conditions which existed.
The major amount of work associated with DCP 87-1070 involved the installation of the PPAS. A considerable number of unnecessary modules were-also disconnected and removed. The enhancements and other modifications were only a small portion of the overall DCP 87-1070 effort.
As a result of these reviews, the NRC inspectors determined that a wiring error prevented the MFW control valves from closing. This error occurred as a result of the small change to the RFR circuitry.
The change involved incorporating a normally closed contact from the RFR initiation relay (86/RVRA for MFW Loop A and 86/RVRB for Loop B)
into the common memory module output for the startup and low load control valves. The change to the RFR logic was made to enhance the circuit by ensuring that the control valves would properly receive a signal to close during an RFR initiation, regardless of the position of the main block valves. The error resulted when only one of the two leads connected to a tie point was moved to the upstream side of the RFR contact. Due to the actual interconnecting arrangement of the circuitry, this wiring error caused the loss of the control signal when an RFR initiation occurred on January 20, 1989. The wiring error could have been identified if detailed wiring diagrams existed. Since only schematics were available, the error was not detected.
In order to evaluate why this error was not detected during the testing phase of implementation, the NRC inspectors reviewed SWP 1409.130. This SWP contained 120 pages of configuration and functional tests. The NRC inspectors observed that the test for proper RFR circuit operation involved ensuring continuity when the RFR relay was deenergized and no continuity when the relay was energized. The continuity readings, however, were taken between the output of the conrnon memory module and the signal input to the low load summer module input. The readings obtained were correct and as expected, however, the lead which had not been moved was actually providing a source signal which was, essentially, bypassing the RFR contact. Under normal operations this condition was acceptable, but when an RFR signal opened the contact, the control signal was lost to the remainder of the control circuitry.
The NRC inspectors determined that the lack of detailed wiring diagrams had also-contributed to the testing inadequacy.
The NRC inspectors concluded that the engineering effort in producing DCP 87-1070 was reasonable and that the implementation, including postinstallation testing, had been hampered by the lack of well defined and detailed drawings. The NRC inspectors noted that approximately 1000 man-hours of engineering effort and 1500 man-hours of implementation were expended on this complex task. The NRC inspectors also noted that during the implementation and testing i
l I
P
'
i
!
.
.
..
.
l
.
'
-9-i activities,14 problems with ICS drawings were identified and subsequently corrected (documented on Condition Report CR-1-89-058).
After the failure of the control valves to close on January 20, 1989, the licensee developed SWP 1409.163, "ICS Simplification Testing (Supplemental)." This SWP included 19 pages of instructions for
,
retesting various portions of the DCP 87-1070 modifications. The
'
error in the RFR circuitry was identified and corrected and no additional problems were discovered. The licensee planned to perform additional functional testing of the ICS and PPAS when thr.: plant was returned to service.
The NPC inspectors concluded that additional management oversight should have been provided because the lack of detailed wiring diagrams was recognized by the licensee as a weakness. Since the ICS has significant effects on safe plant operations, the NRC inspectors l
discussed his concerns over the lack of wiring diagrams and the quality of the schematic diagrams at the exit meeting held on February 10, 1989.
,
l Since the ICS is not a safety-related system, no violations or deviations were identified; however the licensee has been requested to respond to this deficiency.
e.
MFW Pump Speed Control Failure As mentioned above, the ICS controls MFW flow above 50 percent power by controlling MFW pump turbine speed. The ICS also provides a signal to return the MFW pump turbine to a preset minimum speed setting following a reactor trip. On January 20, 1989, however, the MFW pump turbines did not return to that minimum speed setting.
(1) A MFW Pump The MFW pump turbines receive motive steam from the main steam line (high pressure) and the outlet of the moisture separator reheater (low pressure). Thetwosetsofvalves(HPstopand governor valves and LP stop and governor valves) work in conjunction to control the steam inlet to the turbine. The MFW pump turbines' operating mechanisms were modified approximately 2 years ago by the replacement of the original control oil operating mechanism with a new mechanism t
manufactured by Lovejoy Controls Corporation. The naw operating mechanism receives an electrical signal from the ICS and converts it to a pneumatic signal which modulates the control oil pressure supplied to the stop and governor valves. The high pressure oil is used to position the governor valves and hold the stop valves full open. The turbines are tripped by dumping l
the oil back to the lube oil sump allowing spring pressure to l
shut the steam valves.
l l
c _ _ _ _ _ _ _ _ _ _ - _ - _ -
_
_
__
-.
-
-
.
,
.
,
,
<.
-10-Following the reactre trip on January 20, 1989, the operators observed a delay of approximately 4 minutes for the A MFW pump to return to minimum speed. The licensee determined that this delay was caused by the availability of low pressure steam from the MSR which was trapped between the HP turbine stop valves and the LP turbine intercept valves.
The minimum speed had been set during startup utilizing only main steam through the HP valves.
Even though the LP valves received the same control oil signal, no LP steam source was available during minimum speed setting and the contribution from an LP steam source was not considered.
Since the A MFW pump speed did decrease from its full-load speed after to the reactor trip, and since the delay in reaching the preset minimum speed was short, the NRC inspectors agreed with the licensee's determination that this malfunction was not significant in terms of plant safety.
The licensee subsequently implemented a study to determine a better way to set the MFW pump minimum speed which will account for LP steam availability. The NRC inspectors found the licensee's actions to be acceptable.
No violations or deviations were identified.
(2) B MFW Pump The B MFW pump turbine and controls are identical to the A unit discussed above. The B MFW turbine, however, never did decrease to the minimum speed setting.
Followup licensee evaluations determined that the B MFW turbine received a trip signal on high pump discharge pressure which allowed both the HP and LP stop valves to close. The LP valve, however, leaked sufficiently to maintain pump speed at approximately 3100 rpm.
(This was later verified by tests utilizing LP steam from the plant startup boiler.) The LP stop valve was repaired.
The licensee performed additional functional tests on the electrical, pneumatic and hydraulic portions of the B MFW pump turbine controls but was unable to recreate the problem which prevented the initial runback to minimum speed on January 20, 1989. The licensee planned to perform additional testing during the next startup. The NRC inspectors found the licensee's actions to be acceptable.
No violations or deviations were identified, f.
High Pressure Injection System l
As discussed earlier in this report, on January 20, 1989, ANO-1 experienced a transient with multiple failures. One of these failures concerned a check valve (MU-348) in the HPI system, which
_
m
.
.
..
,
.
.
.
..
-11-failed to close after the HPI flow to the RCS was terminated. This, coupled with a concurrent loss of two reactor coolant pumps, allowed for a backflow condition to exist. An AIT was dispatched to the site to review the initial actions taken by ANO.
During this followup inspection, the NRC inspectors reviewed the modifications proposed by ANO to preclude reoccurrence of the event described above.
In addition, the NRC inspectors monitored the progress of the modification program. A detailed description of the licensee's actions was transmitted to the NRC in a letter from Mr. Den R. Howard, ANO l.icensing Manager, to Mr. Jose A. Calvo, Directorate IV - Director, Division of Reactor Projects, NRR/NRC
" Engineering Evaluation to Address HPI Backflow Event," dated i
February 14, 1989.
-
The modifications proposed by the licensee were as follows:
(1) The MU-34 check valves, located in the HPI line inside the reactor building, were modified as suggested by the valve manufacturer (Velan). These modifications were made to preclude the valves from sticking open in the future.
The licensee stated that the reason the MU-34B check valve failed to close was due to wear on the hanger bracket, which allowed for the stellite bushing to ride up on the bracket, thus jamming the hanger and disc assembly in the open position (this
{
condition would only occur when lateral stresses were applied to
the hanger and disc assembly, while in the open position).
In i
addition, the licensee explained that during their inspection of the check valves, it was determined that the loose disc assembly I
in the MU-34C chect valve could allow the antirotation pin, located on the back of the disc, to jam between the disc assembly and the hanger, causing that valve to seat improperly
'
and thus possibly creating another leak path.
The modifications were made to all the valves and were specifically designed to prevent the conditions described above.
l The hanger bracket was modified by increasing the size of the bushings and increasing the she of the lip on the bracket that is in contact with the bushing. To correct the other condition j
described, a pin was driven through the hanger into the disc thus limiting the rotation of the disc to the clearance between the pin and the diameter of the hole ir the hanger.
t i
(2) A second set of check valves (MU-66 (A-D)) were added to the HPI l
i trains inside the reactor building, upstream from the j
MU-34(A-D)checkvalves.
This was done in an effort to provide l
redundant safeguards to prevent reactor coolant back'10w through l
'
the HPI system following the failure of a single check valve.
!
l The new c. beck velves are 2 1/2 inch, 2500 psi, Cla w I forged i
stop-check valves. They were manufactured by Anchy-Darling to
,
i
_. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_
b
--
-
'
~
e
,
..
,
l
..
.
.
-12-i
i the requirements of ASME Section III, 1974 edition with addenda through Winter 1975, and are made of ASTM A-351 CF8M stainless steel. The licensee, in an effort to prevent inadvertent manipulation of the new valves, removed the valve handwheels and anchored the valve stem into place with the use of an L shaped bracket. This bracket was welded on one end to the valve yoke.
The other end is bent over the top of the valve, with the valve stem protruding through the bracket. A rectangular hole in the bracket mates with the threaded stem, which is machined down on-two sides, this is then held into place by a nut threaded onto the top of the stem.
This modification to the HPI system is described in DCP No. 89-1005, Revisior 1, dated February 3, 1989.
As described in the DCP in addition to the new check valves, additional vent and drain lines were added to allow for. testing of the valves.
l (3) The licensee replaced the following fittings in the HPI system:
DP34 - Elbow Fitting:
C Train
,
DP19 - Elbow Fitting:
B Train
DP22 - Elbow Fitting:
B Train
DP50 - Elbow Fitting: B Train DP200 - Elbow Fitting:
B Train DP170 - Tee Fitting: B-C Cross Connect Pipeline DP170 - Elbow Fitting: B-C Cross Connect Pipeline DP203 - Nozzle Fitting:
B-C Cross Connect Pipeline These fittings were replaced based on a worst-case analysis of the B and C trains, and their associated cross connect pipeline.
This analysis assumed that the worst temperature these two trains could have been subjected to during this transient was 545*F; the temperature of t o RCS cold leg at the beginning of the postulated event. Based on this analysis, the stress loads on the original fittings were found to exceed the ASME Code allowables.
l This analysis was not repeated for the A and D trains and their associated cross connect pipeline, due to the-licensee's
]
determination that these trains did not experience the same
event. This determination is based upon the results of a review J
that the licensee performed to determine how often the condition i
existed in which a back flow between the A'to D loop and the D to A loop was possible, assuming the failure of either the i
MU-34A or MU-34D check valves. The first conclusion reached was
)
that due to the presence of a second check valve in the J
D HPI line, backflow is considered to be credible only via failure of MU-34A, thus only conditions which could lend to
,
backflow through the A to D loop were considered. The results
)
of the review showed that only four pump operating conditions
!
existed which could have allowed such backflow in the AD loop.
'
l
,
\\
._
- _ _ _ _ _
v
...
...
..
..
...
..
._
.
_...
..
..
.
.
.
..
.
- *
('
.
.
,
-13-l l
l Secondly,aninspectionofthevalveinternals'forMU-34(A-D)
)
was performed with the aid of the valve vendor, with a specific concern for the MU-34A check valve..It was established that no loose parts or serious degradation of MU-34A was found, and that ~
l the degree of wear found in the failed valve (MU-34B) was not I
present. Finally, a visual inspection of the A-D loop piping and supports, was.. conducted and no signs of defonnation in the piping or pipe supports was noted.'
In addition, pipe welds that were inspected via the liquid penetrant test (PT) method showed no signs of degradation.
(4) The HPI system upstream from the MU-34(A-D) check valves was reanalyzed at a higher temperature to cover all possible operating conditions. The previous system design temperature of 145*Fdidnottake.intoaccountthelowpressureinjection(LPI)
system /HPI system piggyback mode. As a result of this analysis, several pipe supports will either be reshimmed or modified to allow for higher load stresses. ' The work on the' pipe supports will be covered by DCP No. 89-1005A.
(5) Part of the modification program included development of postmodification testing procedures for both the MU-34 and
MU-66 check valves, and the HPI system as a whole. Also,
!
procedures are to be developed for subsequent' periodic tests
!
(once every outage etc.). The postmodification tests include j
the following.
HPI Hydro Test
]
i Back Leakage Test for MU-34 and MU-66 check valves i
PT and radiographic testing (RT) of new pipe fittings and
'
The HPI Hydro test is described in Procedure 1409.167, dated February 13, 1989. This procedure will hydrostatically test the repair / rework that was performed on the Unit'1 HPI headers. The system will be pressurized to 110 percent of operating pressure, i
or 2371' psi. After a 10 minute hold, the welds will be inspected for leaks.
l The back leakage test that will-be perfonned on MU-34 and i
MU-66 check valves is described in Procedure OP 1305.019, dated l
February 21, 1989. Th.e test will be performed locally at an.
'
approximate pressure of 21 psi. This test is designed to demonstrate that the check valves can seat.and prevent leakage with small' pressure differentials the valve.
Following the installation of all the pipe fittings, the welds
'i were inspected using the PT and RT methods to ensure the integrity of the welds.
_ _ _ _ _ _ _ _ _ _ _ _ _. _ _. _ _ _ _ _ _ _ _ _. _. _. -
,
_.
_
l
'
'
,
,,
.
l
.
.
-14-In addition to the postmodification tests, the check valves and the HPI system will be tested periodically. Two such tests are the low pressure differential leak rate test (described above),
which will be performed each refueling (outage, and the type A containment integrated leak rate test CILRT),whichis performed three times every 10 years. The new and existing check valves will also be full-flow tested during cold shutdown.
Upon conclusion of the modification program review, the NRC inspectors
'
found that the licensee had addressed the HPI system quite thoroughly with respect to detennining and correcting the.cause of the failures
!
that resulted following the TG trip on February 20, 1989. The NRC l
inspectors observed that the licensee addressed several of the l
.
corrective actions in a conservative manner. One such action by the j
l
'
licensee was to assume 545 F and rigid supports for the analysis of the B-C loop of the HPI system.
This was done even though it was believed by the licensee that the temperature of the B-C loop piping, during this event, did not exceed 300 F.
In another instance, the NRC inspectors noted that the licensee, based on the 545 F analysis, i
replaced several fittings even though they had not displayed any l
signs of degradation. The initiative taken by the licensee in this j
specific area was found to be noteworthy. The statement provided by
.j i
the licensee to explain why the A-D loop of the HPI system was not
'
analyzed for 545 F, was found to be satisfactory by the NRC inspectors.
The NRC inspectors performed a physical walkdown of the HPI system piping to observe the modifications that had been performed.
In addition, the NRC inspectors reviewed the qualifications of the welders involved in welding the valves, and the valve fittings, to i
the HPI system. No problems were noted in this area.
In the previous paragraphs, one of the modifications performed by the licensee, was to reanalyze the HPI piping system upstream from the j
MU-34(A-D)checkvalves. The basis, as explained by the licensee, was to include the operating condition known as the LPI/HPI system piggyback mode which was considered the most limiting condition that the HPI system could be subject to, with regard to system temperature. The NRC inspectors found that the LPI/HPI piggyback mode had been considered during the original-plant design, and had been included in the Unit 1 Emergency Operating Procedure (1202.06, Revision 0). The failure of the licensee to adequately consider the LPI/HPI system piggyback mode, when performing the HPI system piping analysis, created the condition where the HPI system design could not address all'possible operating conditions. This led to the present condition where the HPI system design temperature of 145'F was
'
l exceeded. This appears to be a violation of 10 CFR 50 Appendix B, Criterion III.
!
E ____
v
"
",.
,
,,
"
.,
-15-Another example of the apparent violation was discovered by the licensee, while reviewing the LPI system analysis.
It was discovered that some portions of the LPI system piping were erroneously analyzed using a temperature of 208'F, which is lower than the actual temperature (280 F) required for the analysis.
During this inspection, the NRC inspectors also reviewed some of the questions that were raised by the AIT. One of the questions that was being reviewed concerned the veracity of the ANO Unit 1 FSAR.
Table 6.3 in Section 6.7 of the Unit 1 FSAR lists the system design temperatures for the core dump system, the LPI system and the HPI system. The table lists the design temperature for the HPI system piping, upstream from the MU-34(A-D) check valves, and downstream from the isolation valve outside containment as 300 F.
The licensee, following review of the plant design documents, has determined that this 300 F value is incorrect and that the section of piping described above, was only analyzed for a design temperature of 145*F. This finding is directly related_ to the apparent violation described above.
1 3.
Diesel Fuel Oil - Units 1 and 2 (255100 and 25593)
Because consumable items, which are necessary for the proper functioning i
of safety-related components may not have been included in some facilities' Quality Assurance Plans (QAPs), the NRC requested all reactor facilities to either include EDG fuel oil in their QAP or to provide justification for not doing so.
In order to verify that the fuel oil had been included in the QAP, lemporary Instruction (TI) 2515/93 was issued to the NRC Inspection Manual.
The NRC inspectors questioned how AP&L controlled the EDG fuel oil and was i
provided a copy of the AP&L April 3,1980, response to the NRC request i
dated January 7, 1980. The AP&L response stated that "Section 2.6.3 of Revision 5 of (the AP&L) Quality Assurance Manual includes diesel fuel in (the AP&L) program." The NRC inspectors reviewed the current revision of the Quality Assurance Manual, Revision 10 dated August 31, 1988, and found Section 2.2.2 to contain the following:
i
!
" Expendable and/or consumable items where quality is necessary for l
the performance of Q-listed structures, systems and components are identified and controlled in accordance with Technical Specifications and/or procedures.
"The following expendable and/or consumable items are to be controlled in the following manner to assure service quality:
"(1) Diesel Fuel - Service quality is ensured by applicable provisions / tests required by the Technical Specification for each operating nuclear unit...."
l l
_ _ _ _ _ _ _
.
_ - _ _ _ _ _ _ _ -.
.
.
.,
,
,
e a
,
.
-16-Since the above commitment did not provide the conclusive criteria the NRC inspectors needed to determine adequate control of the EDG fuel oil, additional information was requested. The additional information to
resolve the inspector's concern had also been requested in TI 2500/100,
)
" Proper Receipt, Storage, and Handling of Emergency Diesel Generator (EDG)
Fuel 011." The information was requested in the form of answers to 15 questions.
The NRC inspectors reviewed the Technical Specifications and germane procedures for both units and obtained additional information from licensee personnel.
The NRC inspectors noted that AP&L had expanded the program to include all diesel fuel oil tanks..
The completed survey of 15 questions is included with this report as Attachment.
l Based on the licensee's commitments and the answers to the survey
,
l questions, the NRC inspectors determined that AP&L fulfilled the NRC
'
request for quality assurance of the EDG fuel oil.
No violations or deviations were identified.
l 4.
Exit Meeting (30703)
l Exit meetings were conducted February 10, and February 16, 1989, with the
. licensee representatives identified in paragraph 1 of this report.
No written material was provided to the licensee by the NRC inspectors during this reporting period. The licensee did not identify as proprietary any of the materials provided to or reviewed by the NRC inspectors during this inspection.
During these meetings, the NRC inspectors summarized the i
scope and findings of the inspection.
,
1 i
l
._ -_____ _ _-___ -
-
'
~
' ', - '
.,..
.
..
.
ATTACHMENT SURVEY OF LICENSEE'S RESULTS TO SELECTED EDG F0 ISSUES
,
,
PLANT NAME AND UNIT Arkansas Nuclear One l
INSPECTOR (S)
P. C. Wagner
'
l 1.
Has the licensee adequately reviewed and evaluated IE Information Notice 87-04 issued on January 16, 1987, as a result of the ANO Unit 2 EDG fuel oil (F0) starvation event which occurred on June 27, 1986?
.
Yes.
Since the event occurred at this facility, considerable review and evaluation was conducted.
(Reference 1)
2.
Does the licensee have a permanent F0 storage tank recirculation system I
which allows for complete F0 inventory cleaning by filtering each refueling outage to remove accumulated particulate?
No. However, a temporary micron filtration system is utilized during refueling outages and a permanent system has been proposed.
3.
Are all F0 storage tanks being cleaned and inspected at a minimum of i
10-year intervals in accordance with Regulatory Guide 1.137?
The EDG FO tanks are cleaned every 18 months in accordance with plant procedures.
(References 2 and 3)
I 4.
Does the licensee's F0 program include a regular analysis of F0 samples
,
and bottom testing for accumulated water, at the lowest point in the F0 day tanks and F0 storage tanks?
I Yes. The licensee's procedures require sampling and analysis including
'
checking and draining any water from the day tanks every 31 days or after each start of the EDG.
(Reference 4 and 5) The AND Technical
Specifications (TS) include testing requirements.
(Reference 6 and 7)
5.
Is a fuel additive being used as a fuel stabilizer which will function to
.
l prevent oxidation and bacterial growth?
Yes. A fuel additive has been added since June 1986.
A recent evaluation by Southwest Research resulted in recommendations for new, more effective additives which will begin to be added in the near future.
(Reference 1)
6.
Does the licensee effectively ensure that periodic F0 bottom san:pling and analysis are being performed to detect high particulate concentrations in the F0 supply which occurs over long-term storage due to the. effects of
-
-
.
-
..
,
'
.
,
-2-oxidation, and biological contamination in accordance with ASTM D270-1975?
l The requirements discussed in 4 above, ensure proper sampling and analysis.
7.
Are day tanks and integral tanks being checked for water monthly, as a minimum, and after each operation of the diesel where the period of operation was I hour or longer?
l J
Yes. The day tanks are checked for the existence of water each time the EDG is run; any observed water is drained.
8.
Is accumulated water removed immediately if it is determined that water is i
I present in the storage, integral or day tanks?
Yes. However, to date, no water has been detected in the day tanks.
9.
Is the licensee replacing F0 in a short period of time (about a week) if it is determined that the F0 does not meet the applicable specifications?
l Yes. However, to date, the applicable specification for the F0 have not been exceeded.
10. Are F0 components which may be prone to fouling being routinely monitored i
for indications of fouling?
l Yes. The 10 month surveillance requirements for the EDGs and the F0 tanks require these inspections.
(Reference 2, 3, and 8)
11. Are F0 filters and strainers being cleaned and inspected on a periodic basis per the vendor recommendations?
Yes. The F0 filters and strainers are cleaned and inspected at 18 month intervals in accordance with procedures.
(References 2, 3, and 8)
12. Does the F0 system utilire dual element filters and strainers which permit on line cleaning of the elements, in the event of fouling, to allow continuous operation of the EDG?
No. Unit I does not have duplex filters or strainers.
Unit 2 has duplex filters and one strainer which can be cleaned on line.
(Reference 9 and 10)
13.
Is there a differential pressure indicator for each duplex filter / strainer i
for indication of fouling in accordance with ANSI N195-19767 Yes. Differential pressure indicators are installed for the duplex filters / strainers.
(References 9 and 10)
- _ - _ _ _ _ _ _ _ _ _ _.
-
.
.
.,
,
<
.a
-
-3-l l
!
14. Are F0 alarms annunciated in the main control room or incorporated into a general control room trouble alarm with local individual alarms, in accordance with of ANSI N195-1976?
EDG trouble alarms are annunciated in the control room and local individual alarms are provided.
(Reference 9 and 10)
15. Are any of the instruments that perform a control function and provide an alarm seismically qualified in accordance with the IEEE Recommended Practices for Seismic Qualifications of Class 1E Equipment for Nuclear Power Generating Stations, IEE-344-1975?
The portions of the systems which are Class IE are qualified to IEEE 344-1971 (not 1975), the other instrumentation systems are not seismically qualified.
l i
l References:
,
1.
ANO - Unit 2 LER 86-014 2.
ANO - Unit 1 Procedure 1402.066 j
3.
ANO - Unit 2 Procedure 2402.028 4.
ANO - Unit 1 Procedure 1618.010 5.
ANO - Unit 2 Procedure 2618.005 6.
ANO - Unit 1 TS 4.6.1.4 7.
ANO - Unit 2 TS 4.8.1.1.2b i
8.
ANO - Unit 2 Procedure 2306.005 9.
ANO - Unit 1 FSAR Figure 8-3, Sheets 1, 2, and 3 10. ANO - Unit 2 FSAR Figures 8.3-58 and 9.5-8 i
.__
.___---__---________n