IR 05000333/1989080
| ML20246F760 | |
| Person / Time | |
|---|---|
| Site: | FitzPatrick  |
| Issue date: | 08/17/1989 |
| From: | Durr J, Thomas Koshy NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20246F734 | List: |
| References | |
| 50-333-89-80, NUDOCS 8908310128 | |
| Download: ML20246F760 (72) | |
Text
-
--
.
H
..
.~
!
I'
O. S. NUCLEAR REGULATORY COMMISSION
REGION I
Report No.
50-333/89-80 Docket No.
50-333-License No.
_
Licensee:
New York Power Authority P. O. Box 41 Lycoming, New York 13093 Facility Name: James A. FitzPatrick Nuclear Power Plant Inspection At:
Scriba, New York Inspection Conducted: May 1-26, 1989 Team Members:
H. Gray, Senior Reactor Engineer, DRS, Region I J. Lara, Reactor Engineer, DRS, Region I l
C. Woodard, Reactor Engineer, DRS, Region I l
'
R. Barkley, Reactor Engineer, DRP,- Region I C. E. Morris, Electrical Engineer, NRR A. Perez, Nuclear Regulatory Body of Spain (observer)
G. Toman, NRC Consultant, ERC International G. Morris, NRC Consultant, ERC International D. Prevatte, NRC' Consultant, ERC International A. Goyal NRC Consultant, ERC International M70F Team Leader:
-
-
,,,
. Koshy, Senior Reactor Engineer, DRS, date F
R gio I Approved by-8/'7/8f -
_,,, _.
Durr, Chief, Engineering Branch, DRS date Inspection Summary:
See Executive Summary in Section 1.0.
8908310128 890822 PDR ADOCK 05000333 G
PNU
_ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ - _ _ _ -
.
_ _ - _ -
_.
-
o
_
Y
" -.: g.+-
4 e-
'n
.
.i E
TABLE OF CONTENTS
'
.Page
- 1. 0 : Ex e c uti ve S umma ry.................................................
1:
2.0 Introduction and Background.........................................
3.0 Inspection Objective and Methodology.............................
- 5
-
4.0 Detail s of Inspection of Electric Power Systems..................
'7~
-4.1 General Revi ew of Desi gn Feature s...........................
7-4.2 Veri ficati on of As ' Buil t Drawi ng s............................
4.2.1 4kV Switchgear.....................................
4.2.2 600V AC Load Centers...............................
4.2.3 600V Motor Control Centers and
.
Distribution Panels...............................
'10 4.2.4
'419/125V DC System................................
-
4. 2. 5 '
Di e s e l Aux i l i a ry Sy s tem s..........................
4.3' Electrical System Operation..................................
4.3.1 Procedures........................................
4.3.2'
- Testing...........................................
4. 3. 3 -
Administrative Controls............................
-4.3.4 EDG Support' Systems..............................
4.3.5-HVAC for Electrical Switchgear Area...............
4.3.6 Electrical Systems Training........................
4.4 Electrical Configuration Control and Plant Modifications....
4.4.1 Administrative Controls on Electrical Load. Growth.......................................
4.4.2 Review of Modification Packages....................
4.5 Review of Protection and Coordination.......................
4.5.1 Offsite Power System and 4.16kV i
Electrical System.................................
L 4.5.2 600V AC Electrical System.........................
4.5.3 125V DC System.....................................
4.6 Electrical System Stability.................................
L 4.6.1 Undervoltage Study.................................
1:
4.6.2 Offsite Power System.......................
.....
4.6.3 600V Design Calculations..........................
l L
- - - -
- - - - -
_
.-
--
_ - -
._
_
..
..
4.
,L tut
..
,
,
""
LTable of Contents
3
'4.'71 Maintenance..................................................
- 41
'4.7.1 Offsite Power System and 4.16kV.AC.
><
El e c t r i c a l - Sy s t em '...................................
4.7.2 600V AC El ectri cal. System '......................... -
41'
4.7.3-419/125V DC System......-..........................
-
'4.7.4 Diese1' Generator Maintenance Program..............-
'4.7.5
. Air. System........................................
._ 4.:
L4.8 Emergency Diesel Generator..................................
4.8.1 Cooling System......................................
4.8.2 Fuel System.......................................
4.8.3-
- Air System......................................'...'
55-4.8.4 -
Electrical Controls...............................
4.8.5-Long Term Operation...............................
_57.
.
2-
.
.,
4.9 Reactor Building Closed Loop Cooling Water System...........
58-
-
5.0 Unresolved' Items.................................................
61-
6.0 Exit....................<.........................................
~61 Attachment:1.- AC One Line Drawing
'
Attachment 2 - 419V DC One Line. Drawing Attachment 3
.125V DC One Line Drawing Attachment 4 -' Calculation. Reviewed Attachment5:. Persons Contacted
.
_ - _ - _ _ _ - _ _ _ _ - _ _ -
_. _ _ _ - _ _ -
,
.'
V a
1.0 EXECUTIVE SUMMARY A team of NRC inspectors and contractor personnel conducted a Safety System Functional Inspection (SSFI) at the James A. Fitzpatrick Nuclear Power Plant, Scriba, New York, _to assess the electrical power. system including the Emergency Diesel Generators and their support systems. During this inspection, the SSFI team reviewed design bases, surveillance and calibra-tion, maintenance, system operations, and associated procedures.
The team determined that the site engineering' staff was very knowledgeable in the maintenance and operation of the plant. However, certain weaknesses.
were noted in design-bases evaluations and in the lack of attention to details in drawing control, surveillance testing, and maintenance activities.
Significant deficiencies ' identified during the inspection include those listed below.
The design bases for the plant assumes that the Reactor Building Closed-
Loop Cooling Water (RBCLCW) system is a closed loop system inside the containmen_t.
However,-under certain emergency conditions (e.g., loss of power to the RBCLCW pumps), an automatic action connects the emergency service water system to the RBCLCW systems thereby opening the RBCLCW system to the outside environment.
Furthermore, the RBCLCW system is not protected against a high energy'line break and is not equipped with containment isolation valves.
A programmatic deficiency was formed in the electrical area regarding
the updating of electrical one line drawings to reflect the as-built equipment ratings and sizes.
The level gauges for the-fuel in the Diesel Generator fuel day tank
were not calibrated to a standard. Also, numerous concerns were identified with regard to the emergency diesel generator fuel supply, air, and de electrical control systems.
Although the emergency diesel generator maintenance had been signifi-
cantly improved, a documented formal maintenance program and procedures had not'been developed.
The checklist used during operator rounds showed an unacceptably low
acceptance value for de battery voltage.
The dc breakers, the undervoltage relay for the de bus and the check
valve in the control air for the reactor building closed cooling water system isolation valves were never tested to demonstrate the capability of performing their specific safety functions.
The original HVAC design calculations for the switchgear enclosure
did not adequately consider function during a high energy line break in the reactor building.
There was not an integrated up to date calculation to support the
protection and coordination of the electrical system.
I
y_
_
.
-
.
.
!
There was not a thorough evaluation to support a modification performed
in 1981, which resulted in the diesel generator room drains being plugged and the potential for spreading an oil fire into adjacent diesel generator rooms if the sprinkler system was actuated.
Significant strengths identified during the inspection include these listed below:
The team found that the program of developing cognizant engineers is
an effective program to provide more attention to design details and operational requirements.
The team concluded that surveillance and calibration testino "or
electrical equipment was generally acceptable except for ti its-crepancies addressed in Section 4.7.
Based on the concerns raised in this inspection the licensee committed to take the following corrective actions.
Action Scheduled Completion Field Survey of AC and DC loads November 1, 1986
(4.2.4 and 4.2.3)
On line program to update electrical End of 1990
load configuration and design bases (4.4.1)
Maintenance program for emergency Prior to refueling outage
diesel generator (4.7.4)
in 1990
'
Fuel day tank level switch changes (4.8.2.1)
End of 1989
DC breaker testing (4.7.3)
Mini outage of 1989
Summary of Inspection Findings Area Section Number 50-333/
A.
Violations 1.
Reactor Building Closed Loop Cooling System 4.9 89-80-01 2.
Inadequate Procedure:
89-80-02 2.1 Day Tank level switch calibration 4.8.2.7 2.2 Backup air supply to EDG 4.8.3.2 2.3 Minimum acceptable voltage for 125V DC 4.3.4 2.4 EDG annunciator response 4.3.1.2 3.
Inadequate Drawing Control 89-80-03 3.1 AC Discrepancies 4.2.3 3.2 DC Discrepancies 4.2.4
- ___ _ _ _ _
_
___ _______ __u
F ' '
.5
-
n c
'
1..
L Y
3-
,
p 4.
Inadequate' Testing-89-80-04 L.
4.1 125V DC circuit breakers 4.7.3
,
4.2~.125V DC undervoltage alarm.
4.7.3 4.3i Check valve--in the air system for RBCCW system isolation.
4.7.5-5.
Inadequate Design ~ Control 89-80-05
- 5.1 Plugging 'of floor drains in DG room 4.4.2.3 5.2 Reactor building MCC Environmental Enclosures 4.4.2.2 6.
Inadequate Control of Diesel Oil Procurement (Non Cited)-
4.8.2.8 89-80-06 B.
Unresolved Items
.1.
RBCLCW Isolation Valve Air Supply Design-4.7.5-89-80-16
'
-2.
Electrical Load Growth Control'and-4.4.1 89-80-l'2 Updating of Electrical Design Calculations 3.
Reactor Building MCC Enclosure Cooling 4.4.2.2 89-80-08 Unit Testing 4.
Adequacy of EDG room drains-4.4.2.3 89-80-09
'
5.
Residual Voltage Transfer 4.5.2 89-80-13 6.
4160 Volt Breaker Control Circuit 4.5.1.5 89-80-10 Coordination 7.
600 Volt System Voltage 4.6.3.e 89-80-11 Operating Range 4.6.3.f 8.
Annunciator Response Procedure not at 4.3.1.3 89-80-07 EDG Panels
'
9. 'DG Load Testing 4.3.2 89-80-14 10.
a. Fuel Oil Day Tank Level Switch Logic 4.8.2.1 89-80-18 b. Fuel Oil Day Tank Level Switch Positions 4.8.2.2 89-80-18 c. Fuel Filter Design /G;,eration 4.8.2.4 89-80-18 d. Diesel Fuel Technical Specifications 4.8.2.5 89-80-18 e. Diesel Fuel Consumption Test 4.8.2.6 89-80-18 11.
Lube Oil Sampling 4.7.4 89-80-15
_ - _-__- -
.. -.
-_
_
.
.
.
.
..
...
i.
-
-
.
.4.
I 12. Unrestrained Equipment-4.2.4
'89-80-17.
C.
^$servations-
.
1.. Fuse Control-4.2.2'& 4.2.3 2.
Wire Bend Radius 4.2.2 3. ' Control of Void (Superceded).. Documents
. 4.2.3 & 4.2.2 4.. RBCLCW Isolation-Valve Air Supply Testing 4.7.5
.5.
Diesel Starting Air.
4.8.3.2 6.
Transfer of Offsite Power Sources 4.3.3.1-7.
Coordination:of CRD Pump Breaker 4.5.2.2'&-
and Transformer Feeder Breaker 4.5.2.3 8.
Preventive Maintenance for 600V MCCs 4.7.2 9.
Breaker Reclosing 4.7.2.2 10. 4160 Volt Switchgear Interrupting 4.5.1.3 Capability l
'
11. DG Room Ventilation Procedure 4.8.3.3 12. Emergency Fuel Shutoff
. 4.8.2.3
,
13. EDG Governor Modification for Self 4.8.4 l
Sustaining Operation 14.
Long Term Operational Procedure for EDG 4.8.5
)
i l
__.___._______.____m_____
_ _ _ _. _ _ _ _ _ _ _ _ _. _. _ _ _
- ----,--
_
-
.
S'
2.0 INTRODUCTION AND BACKGROUND The electric power systems (onsite, offsite and emergency diesel generators)
are important to.the safety of a nuclear power plant and must be designed and maintained accordingly. The safety function of each electrical system is to provide adequate electrical power when called upon for the safe operation of the plant under all operating modes including anticipated operational occurrences and postulated accidents. To achieve this safety function,10CFR 50, Appendix A, General Design Criteria 17 and 18 for electric power systems specify design requirements and the required pro-visions for the periodic inspection and testing of electric power systems.
The Final Safety Analysis Report (FSAR), Chapter 8, Electric Power Systems, describes how these design requirements are met.
It also specifies the licensee's commitments with respect to the applicable Regulatory Guides (RGs) and industry standards such as the Institute of Electrical and Electronics Engineers (IEEE) Standards.
Following the issuance of the Operating License, plant modifications can be made which involve significant changes in the configuration of the electric power systems.
These modifications may involve substantial load growth of the electric power systems, and adequate controls must be exercised to assure the electrical power systems stay within their rated load capacity.
Overloading the electrical systems could adversely affect the functioning of the protective relays and coordination of the interrupting devices.
Uncontrolled load growth also could create bus undervoltage conditions that may trip out or damage motors and result in unnecessary bus transfers thct may cause other operational transients. Therefore, plant modifications should be evaluated to ensure that their effect on the electrical >ystems is in accordance with General Design Criteria 17 and 18 and FSAR commitments.
Types of significant changes in the configuration of electric power systems that might adversely affect the performance of these systems are: a transfer of a large load from one bus to another; replacement of system components such as breakers and fuses with a component having different functional characteristics; and changes in the set point of protective relays or breakers. All such changes should be reviewed to ensure the integrity of the electrical system.
3.0 INSPECTION OBJECTIVE AND METHODOLOGY The objective of the Safety System Functional Inspection (SSFI) et Fitzpatrick was to assess the operational readiness of the electric '.
system, including the emergency diesel generators and their support systems, and to evaluate the following The adequacy of the electrical system to perform the safety functions
required by its design bases.
Effectiveness of testing and calibration to assure the electrical
system will perform the required safety functions.
- _ _ _ - _ _ _ - _ _ _. -_.__ _ -
- - _ _ _ _ _ _ -__
_
_-____
... a y
e
..
Effectiveness of maintenance of' components to ensure system reliability.
,
l-under postulated accident conditions.
>
Adequacy of human factor considerations related to electrical system and emergency diesel generator procedures to ensure proper operation
'
.
under: normal and accident conditions.
l l
- To accomplish this objective, the SSFI team verified that.the physical configuration,~ including modifications, conforms to the current electrical drawings ~and that the evaluations of the configuration are correct and that they support the required ~ functioning of the electric power system. The-team reviewed the adequacy of the safety related electrical distribution system with respect to the following factors affecting system availability:
(1) selectivity among the various protective devices that respond to over-load; (2) sensitivity and speed of response of the protective devices considering the characteristics and criticality of the protected equipment; (3) accuracy of the coordination curves in representing the types, ratings,-
and. settings of the devices actually present in the plant; (4) adherence-to the principal that no single failure (including a failure of a circuit breaker,. fuse, protective relay, or instrument transformer) can disable more than one redundant safe-shutdown train; and (5) absence of apparent credible common cause multi-train failure modes in tf}ose cases where complete selective coordination cannot practically be. achieved.
Primary emphasis was placed on the safety buses and connected loads, including 4160V ac, 600V ac, 125V de and 419V de systems. A selected sample of Class IE and Non IE buses as indicated in Attachments 1, 2 and 3, were physically' inspected to collect as-built data on relay set points, load configurations and equipment ratings. These data were compared to electrical one line drawings, protective device setpoint calculations and load studies.
The licensee's analyses on. selected protective relaying and breaker coordina-tion were reviewed and field verified to determine the electrical system capability to limit the effects of electrical faults.
The diesel generator support systems, air start, cooling, and fuel systems were reviewed to determine if the current configuration supports the design bases and if these systems are maintained to support the emergency operation of the diesel generators.
Selected electrical modifications were reviewed in detail to verify that appropriate controls for the assurance of quality were in effect and that adequate safety evaluations were performed by the licensee to ensure that no unreviewed safety questions exist, as defined in 10 CFR 50.59.
The onsite electrical power systems, eeergency diesel generators and the 125V battery load calculations were reviewed to verify the systems'
capability to respond to design basis events.
The team witnessed the technical specification surveillance on diesel generator loading and evaluated nonlicensed operator skills and training.
__ _ ___-___- _ _ _ _.
_ __. _ - _ _
p t
.
w
.
..
?
1 V
l
' 4. 0 DETAILS OF INSPECTION
. 4.1 General Review Of Design Features 4.1.1 Offsite Power Systems and 4160-Volt System -
.The J. A. FitzPatrick Nuclear Power Plant is connected to four trans-mission lines: two 345-kV lines and two 115-kV lines. - At the JAFNPP
transmission substation, the 345-kV lines connect to a common bus via airblast circuit breakers. The main transformer for the generator, actually two transformers in parallel (TIA and T1B), connect directly to the 345-kV bus. 'The generator.and the normal service transformer (T4) connect to the 22.8-kV side of the main transformer. The two 115-kV lines are connected to a common bus via oil circuit breakers.
Two reserve station service transformers are connected to the 115-kV bus. A disconnect switch is located in the bus between the two.trans-mission line connections so that each reserve transformer could be connected independently to a 115-kV transmission line.
(See oneline diagram in-Attachment 1). However, under normal conditions, the discennect switch is normally closed so that if either transmission line trips (i..e., the circuit breaker at each end of the line opens-automatically), the two reserve transformers will be fed from the-remaining line. All of the 345-kV and 115-kV lines are connected to the Niagara Mohawk transmission system.
.The 4160V' system is normally fed from the 345-kV system from the two
secondary windings of T4. This transformer is provided with a 19-step
'
load tap changer to maintain the secondary 4160 volt within 1 1/2%.
The "X" winding feeds the two 4-kV buses associated with the recircu-lation pump motor generator sets. The "Y" winding feeds the two normal 4-kV buses through a bus tap.
Each of the normal 4-kV buses subfeeds to its respective safety-related bus through two 250-MVA circuit breakers in series. 'Under' abnormal operating conditions or from shutdown through
.startup, c th normal 4-kV bus also can be fed separately from the 115-kV system from the reserve power transformers associated with that division (either T2 or T3). The voltage on this transformer is controlled by the Niagara Mohawk Power load dispatcher.
.
<
The onsite emergency supply for each safety-related bus consists of two 3250 kVA diesel driven generators per bus with a unique forced paralleling circuit design.
No deficiencies were observed in this area.
4.2 Verification Of As-Built Drawings 4.2.1 Offsite Power Systems and 4-kV Switchgear The team reviewed selected portions of the offsite switchyards, main and reserve power transformers, and the 4160V switchgear. The as-built single line drawings and the equipment were compared and no deficiencies were noted, except for the concerns on the offsite power system addressed in Sections 4.3.1.1 and 4.3.3.1.
,
_ _. _. - _ _ _ _ _ _ _. _ _. _ _ _ _ _ _ _ _ _ - _ _ _ _. _ _ _ _ _ _ - - - _
., -
.=..
--
-
-
- -
--
-
-
-
- -
-
- -.
,
m, u
- .:.
~ 4.
(
,
L
.4.2.2 -
'600-Volt AC-Load Centers
~
The team physically inspected UnitL substation L-16 and verified.the.
, equipment ratings by observing the nameplate data. All the incoming
'
feeders and load circuit. breakers were checked for equipment data and-cleanliness. The team's specific findings'are~ discussed below.-
Lack of a Fuse Control Program-The team reviewed all the control fuses associated with load center <
L-16 to' verify their rating and type.
In a number _of cases,
,,
information could not be. collected because the fuse label was'not
~
visible. The. team found that the ampere rating-of the fuses agreed.
'with that'specified.on the design documents, but the type was not always. consistent (see Section 4.2.3 for'similar. finding). The
'inspectio'n team determined that the licensee does not have a fuse Lcontrol program in place.
Without a fuseicontrol program to ensure that the proper ampere rating and type of fuse.is used, a loss of-coordination could cccur. The license 9 responded by issuing a standing order on this subject and is implementing a fuse replacement program'to ensure the correct rating and type of fuse.
Discrepancies Between Nameplate Data and Design Documents
The inspection team identified the'following discrep'ancies'between the circuit breaker nameplate data and the iniv. ration on the design documents.
Unit compartment 703C (feeder for MCC 116100) breaker trip devices
-
had-settings of 80 A, 85 A, and 90 A, whereas the single line'
drawings and manufacturers' drawings showed these settings to be 40 A.
The licensee confirmed this as an error in documenta-tion'and has rectified the situation.
Unit compartment 704C (feeder for Bus 116300) breaker nameplate
-
identified the breaker to be rated for 225 V, whereas the required nominal rating should have been 600 V.
The licensee discussed the matter with the manufacturer, GE, who confirmed that the subject breaker was actually a 600-volt circuit breaker. GE will provide a new nameplate stating the correct rating.
Load Center Spare Breakers
The team.found that spare breakers were left in the drawn-out position E
as a permanent arrangement. The team was concerned that this could compromise the integrity of the substation with respect to ingress of dust and vermin: dust could cause long-term contamination of the unit i
substation, whereas the latter could result in insulation deterioration l-and possibly short circuits.
In addition, the partially drawn-out I
_. _ _ _ _ _. _. _ _. _ _.. _ _ _ _ _. _. _ _ _ _ _ _ _ _ _
_
..
+
...
.
position of the breakers, especially those at a higher level, is a configuration that was not analyzed for seismic forces.
In response to this finding, the licensee initiated prompt action to ensure that the the practice of keeping the spare breaker pulled out is no longer followed.
Update of Manufacturer's Drawings
The manufacturers' drawings have not been updated since 1971 and did not reflect the present plant configuration. This resulted in a number of discrepancies between these drawings and the as-built load center.
The team noted that the Design Document Control Program did not require that out-of-date drawings be identified as. void or superseded. The licensee should evaluate tnis situation and establish the necessary controls.
Circuit Breaker Overcurrent Settings
The team found that series overcurrent settings on two breakers varied considerably between the phases of each breaker as shown below:
a.
Unit 7028 - Incoming Feeder Overcurrent Release 2A Phase A:
1280 A Phase B:
1280 A Phase C:
1600 A b.
Unit 704A - Feeder for Bus 116200 Overcurrent Release IB Phase A: 560 A Phase B:
320 A Phase C: 600 A The variance was the result of recalibration during preventive mainte-nance.
However, when substantial drift between phases occurs over time and is not attended to, it can possibly result in maloperation as this drift is indicative of a change in performance of that particular overcurrent trip mechanism.
Present preventive maintenance proce-dures only require that the breaker operate within a particular-time frame for a specified current value.
In the event the test shows that it operates outside this time range, an adjustment is made without noting the new setting of the graduated scale on the overcurrent
,
release.
Therefore, the device would be allowed to drift over time without any acknowledgment nf this change in setting.
The drifting of the overcurrent releases made visual inspection of the settings unreliable. Since no record was kept or displayed of the last setting, the equipment was susceptible to unauthorized adjustments l
that could affect the safety of the plant. The licensee stated that this information would be recorded in the future and these data reviewed by the maintenance engineer.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ - _ _ -
_
-- _-
.
- - _ _ _ _ _ _
-
. _ _
-
_ _
.--
"
[
,
\\
s Cable Bend Radius
,
' Durin'g a random inspection of unit substation L-14, the team noted
~
.that'the power cable for the reactor building cooling water pump 15P-2B had a -180" bend with a bending' radius off about 3 inches. The licensee agreed that.this was less thanithe minimum bend radius recommended by the manufacturer, Okonite. Although this switchgear serves'only
-
non safetyrelated loads, the licensee committed to rectify the situation'and to look at other potential areas for this problem.
'
' 4.2.3
- 600V Motor Control Centers and Distribution Panels The team inspected. Motor Control Center MCC C161 and verified the equipment ratings by opening the starter. compartment doors and noting the' data on'the various nameplates. All but two of_the compartments were checked for. equipment data and cleanliness. The teams findings are discussed below.
" Lack of a Fuse Control Program
A number of the' compartments had been modified with an additional control fuse installed for remote shutdown requirements. Although the control fuses were'of the same rating, the type of added fuse was different in each circuit.
From discussions with various personnel,
.it was clear that there was no fuse replacement program in place that
.would ensure that a fuse of the proper rating and. type was installed.
This finding applies to the following MCC C161 compartments:
OA2, OA3, 0B1, OB2, 0B3, 0C1, OC2, OC3, 002, OEl, and OE3.
- Control schematic drawings typically specified only the current.. rating and not-the type of fuse.
The licensee acknowledged the absence of a fuse control program to ensure-that the proper ampere rating and type of fuse is utilized (see Section 4.2.2 for licensee corrective action).
Update of Manufacturer's Drawings
l There were a number of discrepancies in the nameplates on the compart-i ment doors, single lines, and manufacturers' drawings as follows:
l-l The manufacturer's outline drawing indicated that compartment
-
. '
.004 should be SPARE; the actual nameplate indicated that the compartment fed a lighting panel.
t The manufacturer's drawing indicated " BLANK" for one compartment;
-
the team found instead two nameplates, one indicating " SPARE" and the other " REACTOR BUILDING DISTRIBUTION PANEL RB-AC-6".
j The licensee considers the manufacturers' drawings as information
'
drawings and are not subjected to the normal update process.
i.
i
-
_.
~m
__
.__________m_-_______________________.________mm
-
-_. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ -
M
~~
..
..
,,
.This approach can. lead to problems when significant modifications are made to the MCCs. The licensee should evaluate this situation to determine if modifications to their drawing control system are appropriate.
Inadequate Drawing Control
A. number of MCC compartments had discrepancies between the actual motor rating and that given on the one line diagram 11825FD-15, Rev. 15.
Compartment One Line Equipment Actual 081 1.3 hp 10-MOV-012B'
1.6 hp OB2 4.0 hp 10-MOV-089 1.0 hp OC3 3.9 hp.
10-MOV-926B 2.0 hp The above discrepancies-constitute a violation of 10 CFR 50 Appendix B Criterion V which requires that activities affecting quality be prescribed by controlled drawings (50-333/89-80-03.3).
Other examples of the same violation are addressed in Section 4.2.4.
'The licensee committed to perform a walkdown of the AC. loads prior to the end of 1990. The updating of the calculation and respective drawings.are addressed in Section 4.4.1.
The team noted that in the case of the MCC drawings,.the manufacturer's drawings have been updated since 1971 to reflect the present plant configuration. However, the team found that load / relay. data such as full load current, short circuit rating and CR123 heater had not been incorporated in the updated drawings.
- ~
Overload Relays The team verified all the overload relay and heater element size data.
Per JAF Preventive Maintenance Procedure MP-56.1, the heaters were to be selected at 300% of rated motor current for Class IE motor operated valves (MOVs).
For other loads, such as fans and pumps, the normal industry practice of approximately 100% full load current times the motor service factor is followed.
The use of 300% setting for heater elements is inadequate as it generally fails to provide adequate protection. This is especially true-for stall (locked rotor current) protection. As MOV motors are most likely to require locked rotor protection, the present practice of using 300% heaters is technically unsound. A sustained locked rotor current can cause permanent damage to the motor. The following inconsistencies were found for MOVs:
l l
___-_________________-___-___-_____-_______-__-__-_-__--_a
_ _ _ _ _ _ _ _ _
.
+-
.
,
MOV Rating OL Relay Heater Heater / Rating Unit (hp/FLA)(A)
Type Heater Rating (A)
Ratio (%)
OA2 2.6/4.7 CR124K028 3 X K16.3B 14.1 306'
OA3 2.6/4.7 CR124K028 3 X K13.6B 11.7 250 081 1.63/3.2 CR124K028 3 X K9.63A 8.37 262 OB2 1.0/2.2 CR124K028 3 X K6.42A 5.69 259 OB3 2.6/4.6 CR124K028 3 X K16.3B 14.1 306 0B4 0.66/0.73 3 X C2.20A 2.1 300 OC)
0.13/0.76 CR124C024 3 X C2.20A 2.1 276 OC2 0.13/0.76 CR124C024 3 X C2.20A 2.1 276 0C3 2.0/2.8 CR124K028 3 X K9.63A 8.37 299 002 4.0/6 CR124K028 3 X K19.4B 16.9 282 OEI 0.133/0.43 CR124C024 3 X C0.43A 0.41 95*
OE3 CR124K028 3 X K9.63A 8.37 SPARE
- Non-1E valve On presenting the above heater / rating ratios to the licensee, the team was informed that those sections of PM-56.1 that provided the criteria for sizing the heaters were being revised and the proposed procedure was described to the team..The proposed changes if implemented will satisfy the team's concerns.
Some of the above motor data was taken from the motor nameplates that were accessible; whereas the licensee personnel provided balance from MOVATS Data Sheets and the Master Equipment List (MEL).
The licensee informed the team that the MEL was a controlled document and should reflect the existing plant configuration.
However, the following differences were noted:
l
'
Valve Actual MEL 10MOV-268 3.9 hp 2 hp 4.9 A 2.8 A 10MOV-31B 3.2 hp 4 hp l
4.2 A 6A L
Apparently some MOVs had been changed in the field, but the MEL was
!
not updated. The licensee indicated that this may have been due to
work in progress.
The team considered this is an example of a break-down in the plant program for updating the Master Equipment List.
This does not pose a significant concern, as the design changes and operations are done according to the electr' cal one line drawings.
l Cable Installation
lhe cables in the vertical wiring compartment of the MCC were found bundled together but not supported to the sides of the MCC compartment.
All the wiring inside the MCC had been bundled and supported; no sharp corners or edges were found and the cables are tagged in the wireway
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _
...
, - _ -
__
.
"'
a u.:
y
)
-c a-
$'.
ifor identification.
In a number of. cases, spare cables were bent with;very sma11 ' radii and were not attached to the side.of the wiring compartment. Although the cables are-still susceptible to movement,.
the use' of strong terminal' strips provided the necessary support to the cable termination.-
' '
-
{s ;
The. cables as they are installed and used do not compromise safety; J"l'
however, clamping of the cables to theisides of the MCC cable compart-g ment.would protect the cables from movement.
The use of spare. cables which have been bent with a very small radii should be reviewed before their.use in the future. These are some good: industry practices worthy of attention.
xb
.MCC Verification-
=
The~ team physically in,pected Distribution Panel 71ACB3 and verified-equipment ratings by opening the panel door and noting the rating of the breakers. The team also visually checked the panel for missing cover plates,. cleanliness, and general upkeep. The breaker data-agreed with the single line diagram, Dwg. No.11825-FE-1AD. 'The. team checked the circuit list on the inside of the panel door and noted a few discrepancies between this list and the controlled single line diagram.
The maintenance department stated that this list was not a controlled document.
Void or Superseded Drawings
The licensee provided Schematic drawings to the team to review the controls related to equipment covered by this inspection. The team found that the vendor's schematic drawings had not been kept up to date. 'There.was no notification of.this on the subject drawings.
The. team was. subsequently informed that only the'"ESK" series drawings
~
were valid. -The. team considered.the fact that the drawings that are
.not~ updated.are not identified as void or superseded 1s a deficiency in the Document Control Program. -The licensee utilizes their drawings only for reference. The engineers that the team interacted with were knowledgeable about this fact. However, this can be a problem in the future if the drawings are not identified to be obsolete.
4.2.4 419/125 Vdc System The team selected the 'B' 125 Vdc and 419 Vdc systems to assess the licensee's de system configuration contrels. The team performed a walkdown of selected Battery Control Boards (BCB), Battery Motor Control Centers (BMCC) and distribution panels to collect as-built data to verify engineering calculations and fuse, cable and battery sizing. The team used this information to review the overall protec-tion and coordination of the de system. The findings are described below.
i
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _. - - - - - - -
w
,
-
_,y
Review of as-built drawings resulted in identified discrepancies between the 125 Vdc one lire diagrams and actual field installation of circuit breakers and motor nameplate data. The discrepancies identified are listed below (Section 4.2.3 addresses other discrepancies in the er: area):
One Line Actual Bus Load Drawing Installation Circuit Breaker Ratings:
BMCC-2 23P-141 20 A 15 A BMCC-4 23MOV-25 30 A 40 A BMCC-4 23MOV-222 20 A 30 A Motor Horsepower:
BMCC-2 23P-141 1.0 hp 1.3 hp BMCC-4 23M0V-122
.66 hp 2.89 bp These discrepancies were presented to the licensce for evaluation during the inspection period. The licensee's initial evaluation indicated that some of these discrepancies dated back to initial installation and one line drawings had never been revised for the as-built configuration. The licensee issued Work Requests and Drawing Change Requests to accurately document the field installations with the one iine drawings. The team agreed with the licensee determination:;
that the discrepancies did not present a current safety concern in terms of equipment operability. The above discrepancies constitute a violation of 10CFR 50 Appendix B Criterion V which requires that activities affecting quality be accomplished in accordance with controlled drawings.
(50-333/89-80-03.2).
The licensee committed to perform a complete walkdown of the DC loads prior to the end of 1990. The updating of the calculations and respective drawings are addressed in Section 4.4.1.
l During the walkdown the team observed that MCC-'165 cubicle OA1, load 02MOV 53B (13.3 hp motor) had a i.. I starter installed, as specified in plant drawings. The team que;,t:oned the licensee as to whether the installed starter was undersized since National Electrical Manu-facturers Association (NEMA) standards recommend a size 2 starter for motors rated higher than 10 hp.
This 13.3 hp motor has a service period of less than 1 minute and draws approximately 15 full load amps.
To avoid overheating of the contactor the motor full load current should not exceed the cor,tinuous ampere rating of the starter.
The continuous ampere rating for a size 1 starter is 27A. Therefore, the licensee concluded that the starter size was adequate for the
'
motor size and its service.
The team reviewed the sizing of the motor overload heaters to determine if they were sized to protect the motor in an overload condition. The team determined that the overloads
.
_-
-
.
,-
were sized at approximately 300%.
Even though this approach does not pose any immediate safety concerns, a sustained locked rotor current would cause permanent undetected damage to the motor.
(See Section 4.2.3, overload relays, for a related finding).
The team observed unrestrained equipment on wheels in the 'B' battery charger room within close proximity to safety-related equipment without their wheels choked. This equipment included a battery load bank, transformer and tool cart. The team questioned the storage of this equipment on wheels in *
area where it could have an impact on safety-related equipment during a seismic event. The licensee stated that Fitzpatrick internal memorandum JSOP 88-037 adequately addressed the storage requirements for such equipment and that the observed equipment was stored in accordance with the stated requirements.
The team reviewed the memorandum which indicated that such equipment was only required to be stored a distance of 4 feet from safety-related equipment and their wheels were not required to be choked. The team questioned the technical basis for such guidelines since it is possible for medium weight equipment to move a distance of greater than 4 feet during a design basis seismic event.
The licensee stated that it would review its policy on the storage of equipment near safety-related equipment.
This is an Unresolved item (50-333/89-80-17).
4.2.5 Diesel Auxiliary Systems The following discrepancies were discovered between plant drawings documents and the actual hardware in the field:
1.
Drawing OP 22-2, Rev. 4, Flow Path For Air Start Lines For The Emergency Diesel Generators, System 93:
a.
Flexible hoses were shown between the air bank piping and the diesel skid piping.
These hoses did not exist.
b.
Solenoid valves S0V IB and 2B were shown as two-way valves whereas three-way valves were installed.
c.
The tagging of the following items is reversed from one side of the engine to the other:
Pressure switches PS-11B and PS-12B
Pressure switches PS-13B and PS-148.
+
d.
The following items a-a not tagged:
Solenoid valves SOV IB and 2B
Manual valve 518.
- l l
_ _ _ -
-_ _ _ - _ _
.-
- -
-
- _.
_...
.
- _ _
.
_-_ -__
w y.
.; g :
,
- 6
-
2.-
Drawing OP 22-1, Rev. 7, Flow Path Fuel Oil Lines Emergency Diese'l
-
Generators System 93 - The tagging of level indwators LI-101BL-and LI-101BR for the fuel oil storage tank is reversed.
3.
Drawings 11825-7,65-350, 351, and 352, all'Rev. 1 - The instal-'
lation of the backup air supplies for_ the RBCLCW s.' stem contain-ment isolation valves incorporates vent valves bet',~een the sole.
noids and the actuators. The drawings do.not show these valves.
Some.ofgthese discrepa'ncies.had already.been. identified by the
. licensee at the' time of the inspection and drawing corrections had-been initiated. The above discrepancies should not cause any
.significant concerns. The licensee agreed to correct all the deficiencies addressed above.
4;3: Electrical System Operation 4.3.1.
Procedures 4.3.1.1 Offsite' Power System and 4.16-kV Electrical System During a manual transfer between the two alternate sources of offsite power.at JAFNpP, two separate sections of the local transmission system are effectively paralleled through a 4-kV bus. When a voltage difference or phase angle difference exists on these sources at the 4 kV bus just before paralleling, large currents will flow through the 4-kV-e bus when both offsite supply breakers are closed.
The paralleling is of short duration (i.e., long enough for the operator to be sure that paralleling has occurred, after which the original source breaker
- is opened). The manual transfer is a make-before-break operation that is used to p; event a momentary power interruption to the loads during the transfer. The automatic fast transfer that occurs at the time of a station trip, is a break-before-make operation and is.less~.
desirable than a make-before-break operation because it can cause surges and has the potential for' needless trippings of plant equipment, including the main. unit.
In previous correspondence with the NRC [New York Power Authority
'(NYPA) letter JPN-89021, April 27,1989], the licensee stated that caring a slow manual transfer, Bus 10300 can experience circulating currents of 3587A and Bus 10400 can experience 3116A. The team's review of ths relay settings for the inverse time overcurrent relays for the 10300 h s indicated that this relay could operate in as few as 3.7 seconds.
When the 10300 bus is fed from both sources 'during a transfer, the operator may unknowingly be in a race with the overcurrent (IAC) relay for the 10302 bus tap.
Similarly, the IAC for the 10402 breaker is starting to operate during a manual transfer but at a much slower pace.
(The exact time is not given in the relay technical manual.)
The team was not able to find an example where this time race condition I
l
-
.--
- - _ _ - - - _ _ - _ _ _ _ - _ - _ _ _ _ _ _ _
-
v
_
_
. - - - _ _
.
!
had caused a tripping to date; however, the potential exists for the 10302 breaker to trip by overcurrent relay during a manual transfer.
The 10302 breaker connects the bus to the normal station service transformer.
Tripping of this breaker by IAC during a transfer would
not upset the station if the reserve feed breaker (103.12) remained
!
closed..However, during a manual transfer at unit startup, a possi-bility exists that the operator will trip the reserve feed (breaker 10312) just when the IAC trips the 10302 breaker. Such a tripping will cause the loss of one train of safety-related power and could lead to a plant trip if the condensate pump and other important plant loads were lost.
The 4160-volt operating procedure, F-0P-46A, discusses the steps that are required by the control room operators to transfer the station auxiliaries between the two offsite-power sources. Both Sections E and F of that procedure contain explicit cautions that the transfer
should be made quickly since the undervoltage relays may time out in 9 or 45 seconds, depending upon whether or not a LOCA occurs. An explicit note is contained in these sections that the transfer should be made without hesitation to reduce the probability of the breaker tripping on high current. This note should have a more explicit caution because the overcurrent relays may trip in as few as 3.7 seconds.
The team further believed that (1) operators should be made aware of the potential for unwanted IAC relay operation when the 4-kV source phase angles or voltages are significantly different; (2) guidance should be provided to show when the margin for error between a success-ful transfer and a station trip (i.e.,1 or 2 seconds) is too small, and (3) action should be taken either to alleviate the potential for 150% of pickup current being experienced during transfers or to set the IAC relays such that they are not in a race with the operator.
These actions would improve the reliability of the power source transfer to the buses.
4.3.1.2 Annunciator Response Procedures
.
The control room annunciator response procedures for the diesel generators do not provide sufficient information to the operator to i
be of any significant value in responding to the alarms.
Specifically, I
they do not enumerate the most probable causes for each individual alarm nor specify operator actions to identify the causes and corrective actions for the alarm conditions.
The following are examples:
1.
Annunciator Response Procedure ARP 09-8-4-4, EDG B Fuel Tank Level or Transfer Pump Switch Off Normal l
The procedure states the probable cause of the "EDG B fuel tank level or transfer pump switch off normal" is " Improper fuel oil tank level..."
This is not a cause but rather a reiteration of the alarm description itself. The team considered this description to be of no use.
____ _ __ _ _
D
_
.
-
___._
__ -___
___
.
-
'l If the-alarm is for low level, probable causes could be failure.
I of the. transfer pumps, clogging of:the transfer pump strainers, improper valve lineup, emptying of the main fuel oil tank from l"
which the pumps draw, or failure of the level switch providing the alarm.
If the alarm is for high level, probable causes could.
be. failure of a pump shutoff level. switch'or failure of.the alarm level switch.
Operator action statements such as:
"If necessary, restore fuel oil tank level to normal." and " Initiate a work request for any necessary corrective maintenance" are vague.
Instead, for the low level condition,. the operator actions could' be, to' determine the actual level 'in the. tank and, if the immediate operation of -
the' diesel is threatened, to take the'necessary steps to. provide fuel to the tank.from'another source, such as cross connecting from the other diesel. The procedure also should include actions such~as checking to see if'the pumps are operatins, if their breakers are tripped, if the fuel oil supply valves are properly aligned, if the strainers are plugged, or if there is fuel in the main storage tank, etc.
2.
Annunciator Response Procedure ARP 09-8-4-11, EDG B Engine Trouble or Sautdown This alarm is actuated in the control room when any one of.12 alarms for various engine parameters is actuated at the local diesei generator annunciator panel.
One of these alarms, the engine automatic shutdown, is actuated by seven different engine / generator conditions.
Each of the parameters or conditions represented by these alarms.can have a myriad of causes.
Yet, the procedure lists only two very general conditions as probable causes:
"1.
Abnormal system condition which inhibits operability of EDG." and "2.
Engine or generator fault which results in engine shutdown." As in the first example, these are restatements of the basic alarm description, not causes.
The " Operator Action" section of this procedure tells the operator, in effect, to identify and correct the cause of the alarm. Such direction is. superfluous and is of no value to the operator.
The purpose of annunciator procedures is to provide pre-thought-out operator guidance based on the most probable alarm scenarios.
If the procedures are not sufficiently detailed, they result in unnecessary delays while the operator searches for direction that is not there and then ultimately takes action based solely on his own initiative. This is the mode of operation the annunciator procedures are specifically intended to preclude.
The above 2 discrepancies constitute a violation of 10CFR 50 Appendix B Criterion V which requires procedures appropriate to the circumstance.
See futher examples of this violation in Section 4.3.4, 4.8.3.2 and 4.8.3.7 of this report.
(50-333/89-80-02.4).
e
<
- - - _
_ - - - - - - - - _ - - _
- - -
. -__
.
__
T:.
%.:
.
..
..o
- 4.3.1.3 Annunciator Procedures Not at EDG Panel Locations H
The annunciator panels for the diesel generators are located at the engine skids. They contain the individual atarms that actuate an.
" Engine Trouble or Shutdown" alarm in the control room. To determine the specific-alarm, the operator must go.to the local panel and read the individual annunciator. The team observed that response procedures for these-annunciators were not provided at these local panels where they are intended to be used.
At the conclusion of the inspection, the licensee agreed to place the procedures at the local panels. This is an unresolved item pending NRC verification of the licensee action to locate the annunciator response procedure.
(50-333/89-80-07).
4.3.2 4160 Volt Emergency Power Supply System The team physically inspected the licensee's 4160 Volt emergency power supply system which consists of four diesel generators powering two emergency buses. The team inspected-the condition of the diesel generator support systems (i.e., fuel, starting air and ventilation)
and reviewed the daily inspection of the diesel generators and support systems by the Operations Department.
It was noted that Operations
~
personnel verified the fuel oil storage tank levels and ensured that the-air receivers for the diesel generhtor air starting system were pressurized and free of moisture.
The team reviewed Surveillance Test Procedure ST-9C, " Emergency AC Power Load Sequencing Test and 4 KV Emergency Power System Voltage Relays Instrument Functional Test", Revision 8 which tests the load sequencers for the Emergency Diesel Generators,. The' procedure verifies that all the loads described in the Final Safety Analysis Report (FSAR) are properly sequenced within the required time constraints.
The team also reviewed the Abnormal Operating Procedures regarding the loss of 4160V buses 10500 and 10600.
The team reviewed the normal monthly surveillance test on the diesel generators, ST-98, "EDG Full Load Test and ESW Pump Operability Test".
.The teaa noted that the procedure meets all applicable test requirements and that the engine is loaded on a continuous basis to a load that would be experienced in the worst case event of a Loss of Coolant Accident coincident with a Loss of Offsite Power. The procedure contains a caution stating that operation of any diesel generator at a load of 2000 kW should be avoided since excessive wear of the turbo-charger clutch mechanism occurs at this point.
Furthermore, to ensure that the operators are well aware of this warning, a caution statement is clearly labeled on the main control board next to the diesel generator controls. The team noted that in the event of a Loss of Coolant Accident
<
(LOCA) coincident with a Loss of Offsite Power, the peak load on each I
diesel generator pair is estimated to be approximately 4000 KW (2000 KW per Generator).
The team discussed this finding with the licensee i
l
'
_. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
.
_ _ _ _ _ _ _ -
. _ - _ - _ _ - -
-. _ _
_-
_ - - _ _
-
__
- _ -
__ -
_ _ _ _ - _ _.
l$;
v
who stated that the precaution statement.was meant to avoid normal operation at this load level to avoid excessive wear to the turbo-charger. clutch assembly; however, the manufacturer does certify the
. engine for operation in this range for a minimum of 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />. Because
<
the load demrnd of the 4160 Volt emergency. buses following ~a LOCA drops off rapidly, operation of the diesel generators in the 2000 kW range will be'very limited; therefore, no safety concern exists with the operation of the EDGs at this load for'short time intervals.
On May 23, 1989, the team observed performance of a surveillance test in accordance with procedure ST-9B, Rev. 26, "EDG Full Load Test and-ESW Pump Operability Test". The team observed the preoperational
. checks of the diesel generators and their support systems. The team noted that the day tank level indicating gauges 93-LI-102A, B, C and
,
D were out of calibration. When the fuel transfer pumps shutoff set-point of 95% was reached (terminating-pump operation),.the indicators read between the 100 and 105 percent level.
It was determined at a later time that the level indicators are calibrated on a 2 year interval and that the drift in the calibration of the gauge would not affect EDG operability.
,
The team witnessed, from the control room'and at the EDG panel, the starting and' paralleling of each of the diesel generators. An anomaly was noted during the operation of the engines; the low fuel oil pressure sensor of EDG D was malfunctioning and annunciated an alarm.in the control room. The inspectors.noted that the alarm had been previously tagged as deficient, an outstanding work request had been initiated (WRED 93/64016) and it is scheduled to be repaired during the next plant outage.
Personnel associated with the test were knowledgeable of the procedure and performed 11 tasks required in an orderly and professional manner.
The team reviewed surveillance test ST-9F which is performed during refueling outages and consists of automatically starting and loading the EDGs. The team reviewed the latest completed test results to evaluate the response of the units to an automatic st - si g nal..
Review indicated that the procedure data sheets record i. sly the time that the loads receive their automatic start signal. The test does not require that the 4-kV bus voltage be monitored nor does it require that an oscillograph be used to verify that the voltage transient remains within specification and that the motors come up to speed within their required accelerating time. This is an unresolved item.
(0 pen Item 50-333/89-80-14).
4.3.3 Administrative Controls 4.3.3.1 Transfer of Offsite Power Sources On May 2 and May 11, 1989, the team members met with licensee station and engineering personnel to discuss the history of manual 115-kV power supply transfer problems and the remedies being pursued. The
_______ _
_ ______--___
_ -
.-
-
_
_
_ _ _ _
_ - _. _
_ _ - _ _
- _ _ _ - - _ _ _
_ _ _ _
.
o-
SSFI team asked if the station operator requested the system operator to raise the 115-kV voltage at the time of manual transfers. The licensee responded that the 115-kV system is_ operated by Niagara Mohawk; however, JAFNPP operations is governed by the licensee's power system operator.
Requests for transmission line voltage changes must be-passed though the licensee's system operator to the Niagara Mohawk system operator. Therefore, the changes to the 115-kV system voltage, if they are possible under the cont:litions existing at the time of the request, are difficult to implement. During the meeting, the licensee stated that "iagara Mohawk had tempo arily installed a 345-kV to 115-kV transmission t ansformer at the Oswego 5 Dstation that had improved the phase angle difference between 115-iV and 345-kV sources at the site from to 25 tegrees to 2.5 degrees.
This transformer was installed for transmission system purposes and not to cause a specific effect at Fitzpatrick.
The temporary installation of a transmission transformer at Niagara Mohawk's Oswego transmission substation provided relief from the relatively large phase angle difference between Fitzpatrick's 115-kV and 345-kV feeds. This transformer was later removed to substitute for a transformer failure.at another location on the Niagara Mohawk system.
If switching is required at Fitzpatrick when the Oswego transformer is out of service (as it was at the time of inspection)
the phase angle will return to 17 to 25 and high currents will again flow through the transfer buses.
The unique nature of the Fitzpatrick technical specification for the 115-kV system, which requires transferring the emergency bus loads to the reserve station source transformers upon declaring a diesel generator inoperable, causes unnecessary possibilities for switching errors and problems that could result'in reactor upset conditions.
The team agreed with the licensee that, based on the power reliability of the Fitzpatrick's EDGs, this requirement to transfer power sources under these conditions is neither wise nor desirable.
The NRC office of Nuclear Reactor Regulations (NRR) has indicated that relief will be granted from this technical specification requirement. After this requirement is removed, the only times that transfer of sources will be required is at plant startup and shutdown.
With regard to the difficulties that occur when attempting to match a low 4-kV voltage on the reserve station service transformer with the normal station service transformer, the Oswego transformer also may provide relief. The team suggested that the licensee investigate the ability of Niagara Mohawk to increase the 115-kV system voltage upon request.
The Niagara Mohawk system operator may have sufficient control of the transmission system to be able to improve the 115-kV system voltage.
In addition, the licensee should complete the current l
effort on the evaluation of changing the 90% undervoltage setpoint, l
the evaluation of changing the taps on the reserve station service transformers, and evaluate the effects of paralleling with up to a 5%
_ - _ _ _ _ _ - _ - _ _ _ _ _ _ _ -
__
_ _ _ - _
_
- _.,
_ _ _.
_
'
.
,;4;
--
difference in 4-kV source voltages. During this inspection, representa-tives of the licensee and Niagara Mohawk met to discuss-improving coordination and communications between the.two systems' supporting JAFNPP..
,
4.3.3.2 Operator Control of 600-Volt Circuits The licensee provided Schematic drawings to the team to review the controls.related to equipment covered by this inspection. The team-found that the. vendor schematic drawings had not been kept up to date.
There were no stamps on these drawings to indicate that they were outdated and therefore obsolete. The team was subsequently informed that only the "ESK" series of drawings were current and controlled.
The team noted that the control schemes reviewed enabled the automatic logic (where provided) to bypass the operator control switch. There was no "AUT0" logic position evident on:the drawings; therefore, the operator actions can easily be overridden hy the automatic logic.
'The ability to control a device from two or more remote locations simultaneously is not considered by the team to be a safe practice.
It appeared that there was no predefined protocol built into the. plant controls. This design logic provides a potential for confusion in case of maloperations and/or abnormal. c'erating conditions because control'1ocation is not controlled.
On the-600V switchgear feeder for the Conttv1 Rod Drive (CRD) drive water pumps, the remote automatic logic and the main control panel handswitch can operate the breaker in both the plugged-in and test position.
In the test position, maintenance may be working on the circuit breaker and therefore a remote signal could be a hazard. The team was informed that there were sufficient administrative controls.
in J' ace to prevent this from happening.
This control philosophy
,
als. provides the potential for leaving a circuit breaker in the test position. The operator may not be aware of this as the remote controls would operate as required. This problem may go unnoticed and affect systems with a number of pumps, fans, heaters, etc., in parallel that are connected to a common header, duct, vessel, etc. This configuration requires strict compliance to the procedures.
4.3.4 Diesel Generator Support Systems The team reviewed the design of the ventilation system for the Diesel Generator room, as well as the relevant operating procedure. No deficiencies were noted with the system design, operation, or main-tenance status. However, the team did note that two work requests, WRED 76/56068 & 56059 had been outstanding for almost 2 years with regard to the inoperability of two dampers that isolate the ventilation
-
. _ -.
_ _.. - _ _ _ _ _ _ _ _
_
_
_
>
.
l -
j L
j i
system supply to the EDG switchgear rooms in the event of an actuation of the carbon dioxide system in the room. Discussions with the licensee indicated that the work requests cannot be resolved and closed out until a modification, scheduled for completion at the next available plant outage (scheduled for September 1989), is completed. This condition does not pose a significant concern at the present time.
Resolution of these work requests is being tracked by the licensee's j
i l
normal work tracking process.
"
The team also reviewed the arrangement of the controllers for the diesel generator ventilation system and the preventive maintenance conducted on the controllers. The controllers are checked on an annual besis using prnentive Maintenance Procedure MP 56.1.
The team questioned th licensee concerning the sizing of the CO2 fire extinguishing system for the emergency diesel generator switchgear rooms. The licensee supplied an internal memorandum, TS-79-392, as well as Preoperational Test Procedure 76-B, "C02 System", dated May 15, 1974, concerning the testing of the CO2 fire suppression system for the EDG switchgear rooms and other areas in the plant equipped with.CO2 systems. The memorandum indicated that the CO2 system for these rooms was preoperationally te:ted and that the system provided a CO2 concentration greater than Su% during its initial pressurization of the room and a 30% concentration 20 minutes after discharge. These concentrations agreed with the design requirements of the system. No deficiencies were identified.
The team reviewed the sizing of the ventilation system for the diesel generator rooms to determine its adequacy. Discussions with the 1;censee revealed that a special test of the diesel generator ventila-tion system was conducted in August 1988 in response to a recommenda-tion made by the manufacturer, Morrison-Knudsen Corporation. The test was recommended because the vendor's original estimate of the radiant heat losses from the EDGs was in error in the nonconservative direction.
As a result, the licensee performed Preoperational Test (POT) Procedure 92A, "EDG Room Ventilation Capacity Test," on August 23, 1988, for the B & D diesel generator rooms.
Results of the test indicated that the ventilation system was adequate to remove sufficient heat from the diesel generator rooms to maintain the room temperature below 122 F,
as recommended by the tranufacturer, assuming the worst case outside air temperature of 93 F.
The inspector reviewed the procedure and the Nuclear Safety Evaluation for the test.
No deficiencies were noted.
To ensure that Operations personnel ha,a xcess to vital equipment in the Diesel Generator building, the inspector confirmed that the operators are provided security keys to the entrances to the building.
In addition, the team observed that the licensee performs an audit of those keys annually.
-_
-.-_
._
.-
-
'
...
l
Station Battery /LPCI Batteries The team reviewed the design of the ventilation system for the battery rooms for the 125V station batteries as well as the LPCI 419V batteries.
The team also reviewed the Abnormal Operating Procedures regarding the loss of the DC and uninterruptable power source system and surveillance test procedure F-ST-19, Rev. 4, " Battery Room Ventilation Equipment Operability Test," which was conducted on May 4, 1989. All essential components of the system were signed off and the system was returned to its normal lineup upon completion of the test.
In addition, the team reviewed ISP-87, Rev. 5, " Battery Room Ventilation Temperature and Differential Pressure Instrument Calibration".
The procedure was implemented to verify the operability of the battery room ventilation and differential pressure instruments. The team confirmed that the temperature indicating instruments were properly adjusted to ensure that the battery room was not subjected to excessively high or low temperatures and that in the event of a ventilation or heating system failure, an annunciator in the controi room would actuate. To confirm that proper preventive maintenance of the equipment was conducted, the team verified that the battery room fans (as well as the fans for the EDG rooms) were included in the licensee's preventive maintenance program and that the equipment had been serviced at the prescribed interval. No deficiencies were noted.
The team examined the condition of all of the batteries during their tours of the battery rooms, and also examined the condition of the connecting cables on the batteries.
The team noted that the Operations daily round sheets contained provisions for monitoring key parameters of the 125V system; however, the licensae does not record 419 Volt battery system parameters during the operators daily rounds. This concern was raised to licensee management and they agreed to incorporate a check of the system voltage during the daily operator rounds.
The team did note that the auxiliary operator's daily rounds sheet, 0050-17, " Auxiliary Operator Plant Tour and Operator Logs", Revision 6 stated that the minimum acceptable value for the 125V de system was 90 Volts.
The Fitzpatrick design basis for minimum battery voltage at discharge is 105 Volts.
(calculation F1-85-038). This was not an acceptable voltage level for the system. This finding constitutes a violation of 10 CFR 50 Append 1x B Criterion V which requires procedures appropriate to the circumstance.
(50-333/89-80-02.3).
4.3.5 HVAC for Electrical Switchgear Area The team toured the east and west electric bays of the Turbine Building which house the essential 600V load centers, various vital motor control centers, and the Reactor Protection Sys19m motor generator sets. The team reviewed the ventilation system design for the rooms as well as the position of the exhaust dampers for the room. The team noted that the filters for the fan units are inspected on a monthly basis
. _ _ _
_ _ _ - _ _ _ _ _ _ - _ _ -
_--
_
_ - _ - _ _ - - _ _ - _
- - _
-
._
_
____ _ _ __ _
_ _ _ _ - _. _ _ _ _ _ _ - _ _
_
_ _ _ -
.
.-
.
and the fan motors and controllers are surveilled annually under Preventative Maintenance Procedures MP 101.04 and MP 56.1, respectively.
The team noted that these units are not routinely monitored by the 11cansee but, unlike the battery room ventilation system components, are normally in an operating versus a standby mode.
The tegn reviewcd the calculations regarding the heat load in the electric bay areas and noted that the cooling units for these areas were of adequate size for the rooms.
It was noted that the units are in the licensee's preventive maintenance program and periodically are lubricated and have their filters checked.
The team questioned the licensee regarding their use of space heaters in their motor control centers and vital switchgear.
The licensee stated that enclosure space heaters have never been installed in the facility because of mild humidity environment that is present year round.
4.3.6 Electrical Systems Training The team reviewed and discussed the licensee's training program with regard to the station electrical system with several members of the licensee's training organization. The team reviewed the licensee's replacement operator qualification cards with respect to training in the Electrical area. The operator qualification cards on the Emergency Service Water System, AC Electrical Distribution, DC Electrical Distribution, Administration Building and Battery Room Ventilation and Emergency AC Power were reviewed.
These qualification cards were comprehensive and sufficiently tested the operator of his knowledge in the electrical area.
The team also reviewed replacement operator examinations 5 and 8 which contained questions regarding the operation of the various portions of the electrical system as well as the Emergency Service Water System.
The questions were comprehensive and addressed important areas of the electrical system.
The team also spoke with a licensee training representative about the event scenarios affecting the plant electrical system which are run on the licensee's new plant simulator.
It was noted that the licensee recently had placed considerable emphasis on these scenarios due to previously identified deficiencies in the operator's training in the
,
electrical area.
Up until late last year, the licensee performed simulator training on another plant simulator whose electrical system was completely different from the design at FitzPatrick). The scenarios
-
were well documented and contained a feedback mechanism to ensure that deficiencies with tha simulator were communicated to the simulator support staff for their correction.
In response to previously defined deficiencies in operator knowledge of the electrical system as well as specific training requests from the Operations Department, the Training Department upgraded their training program in the areas of electrical circuit breaker operation, l
_ _ _ _ _ _ _ _
.
.
.
t
4160 Volt automatic bus transfers and the 345 kV and 115 kV tone and carrier systems.
The team reviewed these training materials for these areas and found them to be well formulated and challenging in content.
No deficiencies were noted.
In summary, training in the electrical area for the licensed operators appeared to be comprehensive and is improving significantly at the station.
4.4 Electrical-Configuration Control And Plant Modifications 4.4.1 Administrative Controls on Electrical Load Growth
'
The team reviewed the licensee program for engineering designs and modifications.
The plant and Engineering and Design Procedures (EDP)
listed below were reviewed:
EDP-1, " Procedure for Design / Engineering Activities" EDP-3, " Design Verification Procedure" WACP 10.1.6, " Control of Modifications and Component Changes" WACP 10.1.18, " Control of the Plant Mastcr Equipment List (MEL)"
These procedures define the responsibilities of engineers and other personnel performing design activities and plant modifications. These prucedures apply to design activities 'in all disciplines.
Enclosure 6.1 of EDP-1 lists the minimum design inputs required to be considered.
This design input checklist specifies 45 items to be considered includ-ing equipment qualification requirements per 10CFR 50.49, electrical separation requirements and impact on installed equipment.
Upon completion of modifications the responsible engineers are required to ensure that as-built drawings are revised accordingly and changes to the Master Equipment List (MEL) are completed for all installed, retired, or removed components. Although the current design process requires that various design inputs be reviewed, it does not hava a mechanism to ensure that plant calculations affected by modifications are updated to ensure that they are maintained up-to-date and accurate.
This leaves the potential for existing calculations to become arolete after such equipment as circuit breakers, transformers, motors, and other electrical equipment is replaced. This condition was noted during this inspection with regard to the calculations which were reviewed.
Calculations dating from the early 1970's were no longer accurate as a result of plant modifications.
The licensee committed to provide an on-line program by the end of 1989 to capture electrical load growth. An overall program to update electrical design bases on short-circuit calculations, voltage drop calculations, etc. will be in place by the end of 1990. This is an unresolved item (50-333/89-80-12)
-___________m
--_ - _.
__. -__
_ - _ _
--
"'
r
.-
j'l
- '
?
..-
'
.4.4.1.1.
4160-Volt System
,
'
The load on the diesel generators.was reviewed in 1987.in a calculation prepared by Stone & Webster, AE for'the project. The calculation assumed the horsepower on the motor nameplates and also included losses associated with the unit substation transformers. A review by the SSFI team of the' pump curves associated with the safety-related pumps driven by 4-kV motors indicated.that it might be possible to draw higher'than-nameplate horsepower with the RHR and core spray: pump-W motors, depending upon possible flow conditions. However, this over-sight in the calculational assumptions does' not appear to be. significant
,
since the total load on the diesel generator pairs was'approximately:
80% cf the total continuous rating of the generators; allowing sufficient margin to more than offset this potential increase in load.
4.4.1.2 Battery Capacity y
Station batteries A and B provide control power to the Emergency D esel Generators (EDGs), Class IE 4160V and 600V switchgear, 125V de'BCBs, BMCCs, and distribution panels.
The original station batteries, Gould Type NCX-2250 AH, were replaced with batteries of a larger capacity (NCX-2400 AH)'in 1983.
In 1985 plant modification F1-85-038 reduced the number of cells in the batteries from 60 to 58 cells. This modification was implemented to reduce the dc bus voltage during a battery equalizing charge while increasing the individual cell voltages to achieve better cell performance characteristics.
In April 1989 the licensee completed an additional battery capacity study'taking into account the full effects of battery temperature as recommended by IEEE 485-1983. Results of this study indicated that there was less excess capacity than expected according to the calculation for
'the above modification. To address this finding the licensee proposed several actions which are briefly summarized below:
Implement a modification to increase battery room minimum
.
temperature to 70 F.
Reinstall the two cells that were removed as part of modification
=-
F1-85-038 when battery capacity tests indicate that the battery capacity can be expected to decrease below 90% of rated capacity.
Initiate plans for replacing of the present battery when the
capacity decreased below 85% of rated capacity.
The licensee is also evaluating the possibility of performing a battery
. capacity test during the 1989 mini-outage instead of during the 1990 refueling outage. The licensee is tracking this activity for completion.
_ _ _ _ _ _ _ _ _
,
7_-
--
-
-.
- 7 p
,
m
<
.
.
s
!
!
4.4.2
. Review'of Modification Packaoes 4. 4. 2. I'
Modification F1-84-041, Second Level Undervoltage Protection
s
!?
Plant modification F1-84-041 was implemented during the last refuel-ing outage; though it was.not closed pending verification of documenta-E tion..The team reviewed the installation, wiring and elementary
. diagrams, technical manuals, safety evaluation, system description, and calibration. records for selected devices, j
The team had the following minor comments:
a.
The team found an elementary diagram that incorrectly identified the normal contact position of;the undervoltage relay. The correct' contact position was indicated on the installation wiring diagram.
b.
The technical manual contained two different manufacturers'
instruction bulletins for the 27 device undervoltage relay.
One bulletin did not apply to the actual 27N relay installed during this modification. The licensee stated this discrepancy will be corrected.
4.4.2.2 Inadequate Design of Reactor Building Environmental Enclosures Plant Modification F1-84-005 was implemented to provide environmental enclosures to protect the two LPCI uninterruptable power supply charger / inverter systems and the two 600-Vac emergency power switchgear substations in the reactor building from the effects of high-energy line breaks (HELB). The licensee did not exercise adequate control in the design and implementation of this modification.
In' designing the cooling system for the environmental enclosures, the ability of the cooling units to function in the HELB environment (approximately 170 F peak temperature) was not properly considered.
In response to team inquiries, it was determined that the units would trip at 145'F and that they would not automatically reset as the temperature decreased. This had the putential of causing failure of power supplies to several safety-related components common to both trains of ECCS (common mode failure). As a result of this discovery, the licensee made a report to the NRC in accordance with the require-ments of 10CFR50.72.
Immediate modifications were made to the design of the control logic of the cooling unit compressors to provide auto-
matic reset when the temperature dropped below approximately 140*F, and the' licensee performed an analysis which they stated shows this would not produce unacceptable temperatures inside the enclosures.
This is a violation of-10CFR 50 Appendix B Criterion III which states that requirements and design bases be translated into instructions.
Another example of this violation is addressed in Section 4.4.2.3.
(50-333/89-80-05.2).
_ _ _ _ _ _ _ _ _ - _ -
- _ _ _ _ _ _ - _ - _ _ _ - _ _ _ _ - _ _ - _ _ -
- _ - _ _ _ _ _ _ _ _ _ _ _ -
.
_ _ _..
_ _ _ _ _ _ _ - _ -
.;
o
.
-l b -'
L
4
,
.]
Although this concern produced an immediate response, other problems and potential problems-also were identified as'follows:
1.
In determining the accident heat load on the enclosures, no
'
consideration.was made of the heat: load from the external source of-the HELB environment itself.
2.
The heat load from the cooling equipment was not correctly considered.
3..
The units were tested at ambient. conditions and no. extrapolations.
~
were made to accident conditions...Therefore, the test results did not confirm the capability of the, design.
Extrapolations made during the inspection purported to confirm the capacity of.
the' unit.
However, the licensee.could not confirm various
. questionable assumptions and methods used.
,
'
This is an unresolved. item (50-333/89-80-08).
l4.4.2.3'
Plugging of Floor Drains in Both Diesel Generator Divisions-
.
In or about 1981,' floor drains were plugged in the diesel generator
'
rooms. The licensee stated that this modification was made to preclude accidental release of chromated EDG jacket water into the environment.
~No modification package or 10CFR50.59 Safety Evaluation was produced for.this modification. As a result, the safe shutdown capability for the plant in case of fire required by 10CFR 50, Appendix R was-potentially compromised as described below.
.
With an oil fire in either the
"B" or "C" diesel. generator rooms, there is the potential. for failure of both divisions of onsite emergency AC power should the combustible material spread to the adjacent room.
10CFR 50, Appendix. R requires that one train of. equipment necessary to achieve hot shutdown must be maintained free of fire damage by a single fire, and NFPA Codes require that sufficient drainage be provided to remove all liquids from a fire area for the maximum flow conditions.
The uncontrolled modification to plug the floor drains in the diesel generator room, resulted in an as-found configuration that could spread the fire.
If an oil fire occurred in either the "B" or "C" rooms it had the potential to spread into the opposite division as the result of the room flooding. This potentially could cause loss of both trains of onsite emergency power.
The actuation of the sprinklers, would provide the mechanism to spread flood the room up to the tops of the curbs. At this point, the water and oil could spillover into the adjacent room.
Since oil floats on water, the first liquid to spill over would likely be oil, thereby creating a flammable liquid fire hazard in that room.
Per the licensee's calculation, even with the equipment drains that were open in the rooms, if half the sprinklers were assumed actuated, sp111over
- _
_____-
. _ - _ _ _ _ _ _ - _ _______ _
.
n
+
l 3J
- would occur. in approximately 20 minutes.. At the conclusion of the inspection, the drain plugs were.being removed. The failure to factor in the design bases is a violation of 10CFR 50 Appendix B Criterion III which states that-requirements' and design bases.be' translated into instructions.
(50-333/89-80-05.1).
The team questioned whether there was. sufficient drainage even with-the plugs removed to prevent spillover with the maximum design sprinkler flowrate'as required by NFPA codes..No' evidence could be produced that'this was ever considered as a part of the original design. A new calculation was performed during.the' inspection, but it was inconclusive since it did not address the issue in question, spillover into the adjacent diesel generator room, and it failed to' consider the common drain lines from the floor drains as possible restriction points. This is an: Unresolved Item (50-333/89-80-09).
Subsequent to the inspection the licensee indicated that when all but 2' drains were p aged, the spray from the fire protection system can spill over to the adjacent room.
The licensee believes' that the fire will be extinguished-by the. spray before it can spread to the adjacent room due to the high ignition point of diesel oil. The licensee did not support this conclusion.
4.5 REVIEW OF PROTECTION AND COORDINATION 4.5.1 4160-Volt System
~4.5.1.1 Diesel Generator Electrical Protection Each diesel generator is provided with multiple sets of diverse elec-trical protection, including differential protection, overcurrent protection with voltage restraint, reverse power protection, and loss of field protection. The overcurrent protection setpoints were selected to permit-the diesel generator to supply over 200% of rated load if the bus voltage remains at-100%. However, for a bus fault with the bus voltage dropping to 0 volts, the diesel generator breaker will trip in less than 2 seconds when the diesel generator tries to provide a fault current of 3200 A The reverse power protection is provided to trip the generator and circuit breaker when the diesel driving power is lost and the generator tries to function as a motor.
This is especially important for this plant because of the unique forced parallel arrangement of the two diesel generators.
If one unit of the two unit combination, is driven to 200 rpm by its air system without starting, the tie breaker between units will ;till close. The team noted that the contacts from these relays go to the diesel control circuit before being relayed back to the generator output breaker control circuit. This additional relay path slightly decreases the reliability of the circuit, but during
this relaying time, however short it may be, the diesel will continue to be motored by the' generator until it is tripped off by the work power protection.
. _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ - _ _ _ _ _ _ - _ - -
.
'
.'
s i
4.5.1.2 4160-Volt Motor Protection
)
The team reviewed the selection of the setpoints on the 4000V safety-related motor overcurrent relays.
The selection process was docu-mented in formal calculations consisting of superimposed motor and relay time-current characteristic curves. The original designer had obtained thermal characteristics from the motor manufacturer for each of the safety-related 4000V motors as well as estimates for the acceleration times for the two motors which are automatically loaded onto the diesel generators following an accident signal.
This accelera-tion calculation assumed a starting voltage drop to 70% of motor rating and recovery to 90% of rated voltage within 1 second.
The relay circuits were designed to alarm on small overloads and trip on overloads of approximately 175% of rated load. Although the alarm setpoint for the Residual Heat Removal (RHR) service water pump motors appeared to be set low (109% of rating) compared to its service factor of 1.15, a closer review of the pump brake horsepower curve by the team indicated that this setpoint was adequate because the maximum normal load on the motor wculd only be approximately 93% of motor rating.
4.5.1.3 4160-Volt Switchgear Interrupting Capability The 4160-volt switchgear consists of metal clad gear with circuit l
breakers rated for 4760 volts maximum and 250 MVA interrupting
capability.
There are four sources of short circuit current that can feed the safety-related gear. The main power supply consists of a double source of the 345-kV system and the main plant genierator. The reserve source comes from the 115-kV system which normally feeds the plant only during shutdown. The large motors could also contribute to a fault.
Each month during diesel surveillance two EDG units are paralleled with the offsite supply for at least one hour per pair.
The team reviewed the short circuit calculation that had been prepared to justify the short circuit interrupting capability of the 4160-volt switchgear while the diesel generators are connected to the system.
The team found that the licensee had assumed incorrect system contribu-tion, incorrect transformer impedance, and incorrect motor contribution.
The team independently estimated the contribution from all sources and estimated that the switchgear would nct have sufficient interrupting capability for this application. Neither the licensee nor its con-sultant was able to produce an analysis that could confirm the adequacy of the 4160-volt switchgear interrupting capability by the close of this inspection.
Subsequent to the inspection the licensee informed the team that
'
interrupting capability is a concern only when EDGs are connected to the system for monthly surveillance testing. However, no action is planned to be taken as such a fault during testing is a low probability.
The team was not concerned with the two offsite sources paralleled at the same time, since it was a transient condition.
_ __ -___-_-_
- _ _ - - _ - _ _ _ _ _ _ _ ____
i
'
'
!
l
j.
>
4.5.1.4 Undervoltage/0vercurrent Relay Coordination
.I The 4.16-kV switchgear-is provided with an undervoltage relay that I
will operate when the voltage at the 4.16-kV bus drops below 75% for more than 2.5 seconds. Once this relay operates, the'4.16-kV incoming
feeder breaker is tripped and the diesel generators are started and connected to the 4.16-kV bus to pick up the necessary loads.
This delay is to ensure that in case of a fault on the 4.16-kV system, the fault.is cleared by overcurrent relays and the inadvertent connecting of the diesel generators onto a faulted system is avoided.
The licensee provided calculations based on minimum system impedance (maximum short circuit level) and confirmed that proper coordination exists between the overcur ent and undervoltage relays.
The licensee had not reviewed the case of maximum system impedance (minimum short circuitlevel). The team considers the settings to be adequate, however an evaluation woulo ensure that there is no possibility of-maloperation of these two types of devices.
4.5.1.5 4160-Vcit Switchgear Control Circuit Power The safety-related 4160V switchgear is controlled with circuits powered from the 125-Vdc system. The main dc distribution panel subfeeds a remote distribution panel in the diesel generator relay room through a 225A circuit breaker. The branch circuit breaker feeding the safety-related switchgear de control power bus is a 40-A thermal magnetic molded-case circuit breaker.
Each individual 4160-volt circuit breaker control circuit consists of two subcircuits for the close and trip circuits which are fed from the control circuit power bus through 15-ampere and 35-ampere fuses, respectively. Those circuits associated with the remote shutdown circuits are fed from two sets of fuses for each subcircuit.
Prior to this inspection, the licensee had not considered coordination between the 35-ampere fuse and the 40-ampere circuit breaker.
Upon plotting the time-current characteristics of both devices, it was clear that inadequate coordination exists between these devices.
Exacerbating this situation, is the fact that some of the remote shut down circuits may contain a slow-blow fuse type, making it conceivable that a fault on a trip circuit could result in loss of automatic control for the entire switchgear. This is an Unresolved Item.
Additional coordination problems with 125 Vdc systems discussed in Section 4.5.3 are related to this issue.
(50-333/89-80-10).
4.5.2 600-Vac Electrical System The licensee provided the team with protective relay coordination curves for the 4.It'-kV feeder breaker 20660 for 600V transformers T14 and T16 feeding 600 volt unit substa u cas L-16 and L-26, respectively.
In addition, protective relay curves for the 600-volt feeders to the MCCs and motors on L-16 also were reviewed.
_ _-_-__ __________ - _
__ _ _
_
,
-
- .
L 1.
The setting of the overcurrent relays for the incoming feeder of L-16 was shown differently on Calculations E5-2 and E-130 (Curve No. 12966-60-E-103084-2) for the same devices.
It was confirmed i
that the curves on Calculation E-130 for 600-volt unit substation L-16 were correct.
The margin between the relays on the incoming feeder breaker (11602) and the 400-A feeder (11612) is minimal for the short time elements and should be increased for reliable, coordinated operation. The licensee has recognized this and has committed to prepare new coordination curves. This is an improve-ment of the existing coordination.
2.
The relay curve on Calculation E-120 for CRD pump feeder breaker (11616) was based U1 a GE Type IB-3 overcurrent device, whereas the actual device is a GE MicroVersaTrip. Therefore, the presented trip curve was invalid. This discrepancy occurred due to a site modification in which the old GE overcurrent devices were being replaced by the new MicroVersaTrip devices. The licensee is now preparing new coordination curves. The cursory review of the present setting did not reveal any significant concerns.
3.
The setting of the overcurrent relays on the 4.16-kV transformer feeder breaker (10660) and the incoming feeders of 600-volt unit substations L26 and L16 were checked for proper setting / operation as follows:
a.
Overcurrent Check The team found that the relay settings did not sufficiently take into account the cumulative effect of the load current of the second 600-volt transformer, the additional margin required for Star / Delta conversion, and the IAC51 relay resetting margin required during clearing of a fault by downstream breakers. The licensee committed to review the curves and modify settings as necessary.
This would improve the coordination.
b.
Residual Voltage Transfer Check During a residual voltage (RV) transfer, the 600V loads are dis-connected from one source of power, and after the residual voltage has decayed to 25%, the alternate source is connected. This transfer time results in the motors slowing down (motors that are controlled by contactors would be completely disconnected),
and the subsequent, simultaneous reacceleration of all the 600V motors would result in currents of 4.5 times full load current (as estimated by the licensee in Calculation E-69) until the motors have reaccelerated (the licensee is unable to provide any calculation establishing this time period).
In addition, the voltage on the 600-volt buses would be much less than 90% rated voltage, the normal minimum design point.
_ - _ - _ _ _ _ _ _ - - - _ _ _ _ _ _ _ -
p
..
.
.;
b The t'eam estimated that there 's a possibility that,_during a i
residual voltage transfer, the overcurrent relays on the 4.16-kV feeder (10660) and the unit substations L-16 and L-26Lcould -
.
'
- operate and lock out-the corresponding buses. This would. defeat,
,
the purpose of the RV transfer.
<
The ability of the 4.16-kV bus undervoltage relay to override-the undervoltage effects during a RV transfer had not been verified by the licensee and the licensee was unable to provide-the magnitude and duration of the undervoltage condition during
'the RV transfer.
The licensee is'now considering performing a transient stability study'that will provide the necessary data.for proper setting-of the above relays.
This is an Unresolved Item (50-333/89-80-13).
,
c.
Motor Starting Check The team: reviewed the overcurrent device setting on 600V incoming:
feeder 11602 to verify-if sufficient margin existed for starting-the largest load on a fully loaded bus. The team confirmed that
,
.the settings are adequate and sufficient margin exists for proper coordination.
4.
Feeder to MCC C161
' Calculation E-124 shows coordination curves between the 600V switchgear breaker 11606 and 40 Amp feeder breaker to distribu-tion panel 71ACB3, the largest feeder in use on this MCC. The
,
'
curves are coordinated, but the. margins are minimal'when resetting requirements of the 600V switchgear breaker 11606 are taken into account.
In addition, the MCC contains a 70 Amp breaker which is not being used at present.
If it is used, the setting of the overcurrent elements on the 600 volt switchgear breaker 11606 should be reviewed.
4.5.3 125 Vdc System Stone and Webster Engineering Corporation studies dated 1971 calculated the battery cable feeder size required to limit the available battery short circuit fault current at the Battery Control Boards (BCBs) to less than 20,000 A.
The team requested for review an updated de system short circuit study to verify that the available fault current would be below the de bus molded case circuit breaker short circuit inter-rupting ratings. The licensee provided calculations that documented the available fault currents throughout the de system as well as circuit breaker coordinatio _ - _
.
.
.
s.
35
i
,
!
i The' team noted that the Class.IE batteries lacked protective devices-d such as. fuses or circuit breakers to provide a disconnecting means l
from the de bus during maintenance and potential pole-to pole short circuit faults.
The licensee design philosophy was that such faults were highly unlikely due.to physical separation of. the battery terminals..The de system is ungrounded and detected ground. faults are alarmed in the control room.
Review indicated that the calculated.
short circuit faults at the B BCBs, 8 MCCs,. and distribution panels do not exceed the corresponding circuit breaker interrupting ratings.
The licensee's. position is that even in the.unlikely event of a pole-to pole fault downstream of the batteries, these circuit breakers would be able.to cl. ear.the fault.
This design nhilosophy places additional importance on having a well coordinated r ' system to systematically isolate any faulted circuit.
The team reviewed the licensee's dc. coordination study'to ascertain whether the system was designed such that any circuit fault could be cleared with minimum interruption to the system.
Review of the. study indicated that circuit breaker coordination could only be established between the. BCBs a nd distribution panels 71DC-A4 and B4.
Coordination could not be established for bolted bus faults for other BMCCs and distribution pene13 since most of these breakers are of the thermal magnetic type that has fixed instantaneous, nonadjustable settings.
In the two cases in which coordination was established, upstream circuit breakers have adjustable-instantaneous settings and are set at the-highest setting. The licensee concluded that for the more likely type of fault, such as a high impedance fault for which the short circuit current would be less than for a bolted phase to phase fault, circuit breaker coordination is achieved.
However, further review by the team indicated that coordination could still not be established between de circuit breakers feeding protective fuse circuits in 600 and 4160 V switchgear.
See Section a.5.1.5 for further details.
The team requested for review ti.2 licensee's calculations documenting the available voltages at load terminals during starting of essential loads to verify that they had adequate voltage to perform their intended function. The following observations were noted in the review of the calculations:
a.
Circuit breaker control voltages for the 4.16 kV switchgear were calculated to be at 93.2 volts minimum during the 2 hr. battery duty cycle.
These values are within the operating voltage range of the 4.16 kV breakers with 70 to 140V de for trip coils and 90 to 130V dc for closing coils.
b.
Based on the required MOV starting torques and the results of voltage studies for essential loads, there is sufficient voltage to develop the required torque to allow the MOV to perform its operating function.
No deficiencies were identified.
---
-
_- -
_ _ - _ -
_ _ _ = _
____ --_ -__-_--__- _ -_ _ - _
__
o
)
'
'
,
,
-
_ ;.
36s 4.6 Electrical System Stability
,
4.6.1-Undervoltage Studies The original' voltage study for the JAFNPP was performed in 1969 using
.the 115-kV ; system from the; Lighthouse Hill. substation. -In this study, the-licensee concluded that the.4-kV emergency core cooling loads,.
.
would have to be sequenced on the bus to limit the voltage drop at the 600V bus to 90%. This study was updated in 1976 in response to the industry experience on degraded grid voltage studies. T_his study also was limited to the voltage seen at the safety-related buses and not at the equipment terminals.
In 1980, In response to an NRC: inquiry, the terminal voltage at select (worst case)~ safety-related equipment-was calculated.
In 1982, additional ~ calculations were performed for motor terminal voltages during starting conditions.
l The results of the voltage calculations were used to select the transformer tap settings.and the degraded voltage relay settings.
The team also reviewed the 90% undervoltage relay and timer scheme. Two time-delay circuits are usedi a 9-second delay under accident conditions and a 45-second delay for nonaccident, manual transfer.
The 9-and 45-second timers for this system are Agastat time delay relays. _ The undervoltage relays that initiate the time delay relays are ITE Brown Boveri Circuit Shield under voltage relays. Their settings were marked as 110% pickup and 99% dropout.
No discrepancies were observed.
4.6.2 Offsite Power System Under most system connections,.a long electrical distance exists between the 345-kV and 115-kV terminals when viewed from the JAFNPP substation. There are no transformers between the 115-kV and 345-kV systems that are electrically close to JAFNPP. Therefore, phase angle differences of 17 to 25 degrees have occurred between the 115-kV and 345-kV systems.
In addition, the 115-kV system could experience relatively low voltage while the 345-kV system is experiencing relatively high voltage.
The transmission system conditions have presented no significant problem during normal operation. However, when it has been necessary to manually switch station auxiliary load (both safety and non-safety loads) from the reserve transformers to the normal. service transformer and back again, operational difficulties have occurred. During the transfers, the 115-kV and 345-kV sources are paralleled through the 4-kV distribution buses for the plant. When the sources are paralleled, the 4-kV buses experience significant overloads for short periods because of the phase angle difference between the 115-kV and 345-kV l
sources. A low voltage condition on the 115-kV system presents another switching problem when attempting to connect the auxiliary load to
- ___--_-__ _ -__-__-- _ _
-
_ _ -
_ _ _.
_
_
..
-
, ;..
.
l
the normal station service transformer, T4. The 4-kV voltage on transformer T4 must be adjusted downward by way of a load tap changer (the station reserve transformers, T2 and T3, have no load tap changers)
to nearly match the 4-kV voltage on the buses resulting from the 115-kV voltage condition. Although the voltage on the 115-kV system is stable and will not change appreciably %, variations in 4-kV loads, the voltage on the 4-kV side of the normal station service transformer, T4, decreases as the auxiliary load is transferred to it.
This con-dition can cause the 4-kV voltage to drop below the setting of the 90's undervoltage relays for 9 seconds, which initiates an automatic start of the emergency diesel generators. Although the station operator can adjust the voltage on the 4-kV side of the T4 transformer by the load tap changer, the taps do not move rapidly enough to prevent the voltage from momentarily dropping below the undervoltage relay settings.
If the voltage returns to normal before the diesel generator voltage is up to 75%, the load will remain on the T4 source and will not automatically transfer to the generator.
In the two automatic diesel starting events that occurred on June 11, 1987 and September 12, 1987, the 4-kV voltage returned to normal before the diesel generator attained the 75% voltage level.
The JAFNPP Technical Specifications require the 4-kV safety loads to be transferred from the normal station service transformer source to the reserve station service transformer whenever the associated emergency diesel generator is declared inoperable. Because of the requirement, needless transfers of emergency loads occur, causing additional opportunities for switching problems to occur. This require-ment is unique to JAFNPP and is not required of any other nuclear power plant in the United States. The requirement appears to have originated from concern about the reliability of the unique emergency diesel generator system at JAFNPP.
In this system, there are two sets of two emergency generators. During the startup of each generator set, the leads of the two generators are paralleled to force synchron-ization of the machines. Thereafter, the bus breakers for the generators are closed and the paralleling breaker is opened. The parallel generator system is used to provide sufficient power for the total emergency loads.
-
In response to the two events in 1987 when automatic actuations of the emergency generators occurred, the licensee requested two changes to the Technical Specifications:
1.
Relief from the requirement to transfer the emergency buses to the reserve sources upon an emergency generator becoming inoper-abla, and 2.
Permission to install a 45-second delay timer on the 90% under-voltage actuation system for the emergency diesel generator for use during manual transfer of the emergency buses.
The 45-second delay would be in service only during manual transfers (without an accident signal present) and would allow sufficient time for the load tap changer on the normal station feed to restore the 4-kV voltage to acceptable levels.
= _ _ _ -
_ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ - _
_ ________ _ ____ - __ _ _
_
__
_
_
.
.
,
i In addition to the above, the licensee is in the process of evaluating three other techniques for eliminating manual transfer problems:
Changing the no load taps on the station reserve transformers to
cause an improved 4-kV voltage, Reducing the 90% undervoltage relay setting such that a larger
margin exists between the operating voltage and the trip point at the time of manual transfer (this requires increasing the conductor size of some feeder circuits so that the voltage at the equipment is not unacceptably low), and Evaluating if manual transfers an be made with up to a 5%
difference in the 4-kV voltages of the normal service source and the reserve service source.
Any of the above solutions can resolve the manual transfer problems.
The NRC office of NRR nas been looking into this matter.
4.6.3 600-Volt Design Calculations The licensee provided the electrical calculations for the 600-volt electrical system. These calculations date back over the last 15 years.
Some of these calculations reflect the state of the olant during construction stage, whereas otliers are based on actual as-built data.
Because these calculations cover a long period of time, they use inputs from one another and are not adequately referenced for traceability.
In some cases, obsolete data was utilized in newer calculations.
Therefore, even though a calculation may be relatively new, use of old data compromises its validity.
In addition, obsolete calculations were not identified as void and superseded and are an indication of deficiencies in the electrical design basis documents.
A few examples follow:
a.
Calculation E-67, Load Flow Study (Coordination) was reviewed for Bus L-16.
This calculation was performed in November 1971 and it has not been updated.
MCC C166 has not been included in this study. MCC C161 load data does not reflect the actual plant loads. Similar discrepancies were noted on other MCCs. Although the differences in load data were not substantial, they could affect other calculations if the information is later used else-where. The team was subsequently informed that the calculation was obsolete and that new studies were available.
The new study, E77-01, Emergency Diesel Generator Load Review, was also found to contain erroes for MCC C161. The licensee committed to update this calculatict.
Based on the current loading of the diesel generator, these errors do not raise any significant concerns.
L
-
- - _ _ _ _ _. - -
-
- - - - _ _ _
-_
_ _ _ _
._.
_.
. _ _.
-
.
i
'
'
b.
Calculation E-69, Voltage Profile Study, documents the full load l
for Load Centers L25/26 as 46.9 A each and for L15/L16 as 72 A I
each.
There is no reference as to the source of these calculations that were performed in 1973.
This study does not address.the effects of transient currents and torques during the fast open transfers but rather only addresses steady state conditions. As i
the major risks in such transfers are the transient effects, l'
this-study cannot be considered adequate.
In the case of the
.l residual voltage transfer, the scheme adopted is-to shed and sequence all the 4.16-kV loads and reaccelerate only the 600-volt loads.
However, there are no calculations for establishing the voltages, currents, and reacceleration times for these 600-volt motors.
Other problem areas such as contactor dropout and over-current relay operation have also not been addressed. As a result of the team's concerns, the licensee is'now considering performing computer-based transient stability studies that will address these above issues. This will be a supplemental analysis to the computerized electrical data analysis that had been already planned by the licensee for 1990.
c.
Calculation E-77, Voltage Profile - Emergency Buses, was performed in Sept mber 1976. There are no references for the equipment and loao data shown on page 2 of this calculation.
In addition, there is no source reference for the variation in the grid voltage between 115 kV and 122 kV.
There was no evidence provided to verify that the computer program used for this calculation has been validated. The licensee has stated that its contractor, Stone & Webster, can verify the accuracy of the program used.
A documented verification can better support the conclusion.
d.
Calculation E-81, Undervoltage Study of Class IE MCC Control Circuits, addresses only the undervoltage operation of the MCC control circuits and does not address the effect of capacitive currents to prevent dropout of the contactors. The licensee provided a calculation indicating a maximum cable length of about 2878 feet. According to E-81, the longest cable length is only 1650 feet and therefore there should not be a problem with regard to capacitive currents on control of 120-volt control circuits.
e.
The licensee was requested to provide the short circuit calcula-tions for 600-volt unit substation L-16 and MCC C161.
The licensee could not locate these calculations at the start of this inspec-tion. During the last days of the inspection, the calculations i
were finally located. The calculations do not take into account that the voltage on the 600V system can go as high as 635 volts and therefore would result in higher short circuit currents. The team estimated that at 635V the rating of the switchgear on L-16 would be adequate. However, as the margins are minimal, the
]
licensee has committed to verify this for all the 600-volt buses.
!
This is an unresolved item (50-333/89-80-
).
___ _ -_-
, _. - - _ - - - _
-_
_
--
- _ -.
-
.
__
._
.
,
..
i1
,
j The. calculations suggest that the short circuit' rating of the equipment on the MCCs is 22,000 A.
In view of the fact that there are. feeders with only molded case circuit breakers-(no starters), the maximum interrupting rating for these feeders is-only 18,000 A and not 22,000 A.
The equipment rating on.MCC C161;is adequate, taking all the' above factors into account.
Here again,' the short circuit level could be higher on other MCCs as the MCC analyzed has a long feeder cable of 379. feet which helps reduce the~ fault current.
f.
While carrying out the above analyses, the licensee assumed that the grid voltages will be within the valu~es specified'in. thel FSAR. These values are 345 kV'to'370 kV and 115 kV to 122 kV.
-Plant records (BOP. log) and direct readings ~of the meters.in the
. control. room by the team and the licensee have shown the plant
~to be operating at values higher than those' stated in the FSAR.
This higher value affects the short circuit levels on all the.
buses and could result in an unacceptableTshort circuit level situation. At present, there are no alarms or. instructions'in the main control' room for operating the plant-with grid voltages above the~ maximum values in.the FSAR. The grid voltages are-under the control of the Load Dispatch Center. 0perators should be made aware that high voltages.can compromise the safe. operation-of electrical equipment and request necessary: corrections be l
made by the Load Dispatch Center.if an overvoltage conditon persists.
The licensee was requested to confirm that the 600V equipment
,
I is capable of operating satisfactorily at the maximum voltage of-L 635V. -The licensee confirmed that the 600V unit substation L
switchgear is rated for 22,000 A at 635V and no derating is necessary. The licensee is investigating the continuous and
'
interrupting capability of the switchgear and control gear above 600V. This is an Unresolved Item (50-333/89-80-11).
Electrical system analyses are carried out to ensure that the equip-ment and systems are capable of performing their design function.
These analyses, coupled with the' capabilities verified and warranted by manufacturers, provide the necessary framework within which the system, components and structures will operate satisfactorily.
Inaccurate, obsolete, missing, or invalid calculations may expose equipment to conditions it was not designed to operate under and could possibly jeopardize the safety of the piant.
Subsequent to the inspections, the licensee informed that interim controls will be placed to reduce the voltage at 600V MCCs.
This is achieved through reduced voltages at the 4-kV level. The following long term corrective actions are also considere m
,
._
y.;
-
41'
n.
1.
Analyze air circuit breaker and MCC breakers' interrupting ratings at greater than nominal. voltage (600'VAC).
2.
-Evaluate changing' transformer. taps at the.600V level via the modification process.to maintain 600V buses at approximately 600 VAC with acceptable 4-kV voltages being maintained.
4.7' Maintenance 4.7.1 Offsite power System and-4160-Volt System The licensee has recently formalized the preventative and predictive maintenance it performs on the reserve power transformers T2 and T3.
This. maintenance has been in practice at Fitzpatrick since the.early 1970s. Analyses of oil and gas samples have been trended since that time.. Since 1988, the licensee has analyzed these samples on a system-wide basis instead:of sending the sample to an outside laboratory.
Minor procedural inconsistencies noted by the team, such as the delivery locations for the oil and gas samples, had not interfered with the
'
correct' processing of the samples.
Although no formal procedures were in place for the main and normal service. transformers TIA, TIB, and T4, these transformers also'were being subjected to'the oil and gas analyses.
Formal preventive maintenance (PM) procedures exist for the safety-related 4160V switchgear and incorporate the recommendations published by the-manufacturer of the switchgear and the circuit breakers.
Formal surveillance procedures have been implemented at Fitzpatrick to verify the setpoint and calibration of the undervoltage, overcurrent, and timing relays used on the 4160-volt system.
No discrepancies L
were found by the team in this area and the recorded data was within ecceptable. limits.
'4.7.2 600-Volt ac Electrical System Discussions with licensee personnel indicated that a formal preventive maintenance program is not in place for the 600V Class IE systems, components, and. structures.
Such a program is required to ensure that maintenance is carried out in a pre planned, organized manner so that all the systems, components, and structures are suitably attended to in order to ensure proper operation.
Such a program would track, record, verify, and clearly define the time duration between maintenance and the applicable sections of the relevant PM procedure for such maintenance.
Currently, the maintenance strategy and rationale behind maintenance work are not clear. Work Request instructions are given under "Special Instructions" by quoting only the relevant sections of applicable PM procedures.
l lw
_
_
_ _ _ _
___._ _ _ _.
_____________
__ _ _ _
_ _ _
-
.
.,
i The absence of a formal program can eventually result in degraded performance of equipment not subjected to scheduled preventive maintenance. Furthermore, the misapplication or omission of relevant
PM activities increase in the absence of a formalized PM program.
i Although no hardware deficiencies were identified as a result of the lack of a formalized maintenance program for 600-volt ac systems, the licensee should strongly consider development and implementation of such a program in order to ensure that effective maintenance will continue to be performed in the future.
4.7.2.1 Maintenance Procedures The team reviewed the following preventive maintenance procedures:
MP-55.2 "600-volt Load Center Maintenance"
MP-55.1 "600-volt Air Circuit Breakers"
MP-56.1 "600-volt Motor Control Centers"
-
MP-101.09 "600-volt Motors"
MP-59.3 "600-volt Limitorque Motor Operators"
=
The team fcund that the procedures are comprehensive and that adequate provisions had been made for taking corrective action if equipment degradation is detected. However, the following shortcomings were noted:
a.
MP-55.1, "600-volt Air Circuit Breakers", does not require main-tenance personnel to note the existing and/or the new setting of the overcurrent devices on the breakers. This shortcoming has enabled the setting of the overcurrent devices to drift between different phases of the same breaker.
In one case (non-safety-related breaker), the setting was outside the range of the trip device and it could affect reliable operation of the breaker.
In a number of cases, it was found that the setting, as per the calibration on the trip device, was quite different from the desired setting.
Repeated calibration over the years had allowed the device to drift without attracting any attention to a potential future problem.
In response to the team's concern, the licensee immediately initiated a modification to the procedure to note the old and new settings when calibrating the trip device.
Current test records indicate an acceptable trip characteristic.
b.
MP-56.1, "600-volt Motor Control Centers", has instructions for sizing the overcurrent heater elements fcr MOVs. This procedure was reviewed with licensee personnel and it was determined that it did not reflect the true requirements; it will be revised to more clearly explain the sizing methed.
Sizing of the overcurrent heater elements for MOVs was under review by the licensee prior to the start of this inspection. The licensee has stated that a revised procedure will be issued when that review has been completed. (See Section 4.2.3 for a related finding)
..
- - - -.
'
.
.
.
,
l L
c.
MP-59.3, " Motor Operated Valves," Section 8.8.2, has a provision for entering the required stroke time. However, in the two cases reviewed, 10MOV-148B and 10MOV-149B, this was not provided in the Preventive Maintenance Work Request. Monitoring the stroke time in the preventive maintenance would enable early detection of incipient failures.
4.7.2.2 Centrol of Replacement Parts The heater elements for overcurrent relays are commercially available items and whose lack of performance can compromise the function of safety systems. These items do not have any manufacturer's identific-
'
ation mark when purchased. The only mark is a rubber-stamped serial number on the heaters and the box in which they are supplied. The team reviewed NYPA's procurement practices for ttese heaters.
It was determined that the licensee is procuring heaters 1irectly from the manufacturer, General Electric, with appropriate procurement controls.
In addition, the heaters undergo a calibration test prior to use in the starter.
From this sample, it appears that adequate care has been taken in using commercial grade elements in safety-related systems.
In view of the fact that molded case breakers are not designed to interrupt more than one severe fault, licensee personnel were asked what action would be taken in response to a fault on an MCC feeder.
At present, the Operations group first determines the nature of the fault by looking for damage, smoke, etc.
If the operators believe that the fault may have been a transient or minor trouble, they may bse the breaker again depending on the plant conditions or require-ments.
If operating flexibility is adequate, the operations will generally ask the Maintenance to investigate the fault / problem first.
Once Maintenance is involved, it appears they will always check out the circuit and equipment thoroughly before closing the breaker.
In any case, a Work Authorization will be prepared and the activity will be controlled accorcling to plant procedures.
However, there is no specific instruction available to the operators or maintenance staff with respect to necessary action on an MCC feeder after it trips on a fault. All personnel are cautious about not closing the breaker without checking. However, it was not clear if operating and maintenance personnel were aware of the single operation limitation of the molded-case breakers in clearing heavy fault currents.
The consequences of closing the molded-case breskers onto a heavy fault, after having just cleared one, can be catastrophic. Therefore, utmost caution should be exercised and personnel should be made aware of the limitations and risks associated with operation of molded-case breakers after clearing heavy short-circuit currents.
___-_ - ____-
=-
--
y
.?,
,
y,-
E 44'
aD i
'
4~.7 3!
419/125 Vdc System The Fitzpatrick design which_ relies on the de bus molded case' circuit
~ breakers to isolate the battery from the system upon a fault places additional emphasis on the reliability of these devices.
It is there-
. fore essential that these protective devices be well maintained with
,'
a preventive maintenance, program to provide reasonable assurance that
they will~' operate when required within: stated operating times for.
circuit protection. During the' team's review of-maintenance: activities within the de system, the licensee was unable to provide any. evidence =
.of calibration ~or testi'ng of these brea'kert to demonstrate the required trip characteristics.
The consequences of circuit-breakers not operating within their required operating bands coeld result in;the
. loss of,a de bus. upstream of the breaker. A properly coordinated electrical 1 system along with.well. maintained circuit breakers sub-stantially iroproves the system reliability.
In response to the~ team's-findings the licensee has~1nitiated plans to' test the circuit breakers in BMCC-6 during the 1989 mini-outage. The licenso also plans to initiate a full testing program and schedule to vet ify.that the breakers.-
are capable of performing as d signed. Nevertheless, the present.
lack of de circuit' breaker' testing on'a periodic basis does not meet the testing requirements addressed in the technical specifications, Failure to perform periodic' testing of the dc molded case circuit
.
-
breakers cons.itutes a violation of FitzPatrick Technical Specification o
Requirement 6.8A which requires that written procedures be established and implemented for safety related ~ protectiva circuits.
(50-333/89-80-04~.1). Two other examples of indadequate testing are addressed in this section and 4.7.5.
The current dc system design does-not provide any'underdtage relay f alarm to alert the operators that the 125 Vdc battery is reaching an unacceptably low voltage level. Local and remote indication of the system voltage is provided. However, t'ae only alarm provided to
' indicate a low system voltage is from.an internal battery charger. low output voltage sensing relay. The sensing relay is designed to dropout when the charger output voltage drops below the factory installed setting of 120 Vdc. The-team requested for review the calibration records to determine that the device is maintained such that it would be able to perform its alarm function.
The licensee was unable to provide any records to indicate that the sensing relay had ever been calibrated at any time since its installation.
Presently the charger testing procedures require opening the charger output breaker to verify that the relay alarms in the control room. This testing method, however, does not verify that the relay will drop out at 120-Vdc but rather only verifies that it will dropout on a total loss of output voltage.
Failure to calibrate the charger low output voltage sensing relay to verify its ability to perform its alarm function does not meet the calibration requirements referenced in the technical specifications.
.--:--.-a_-m...__._.____
,
.
.
N?.
jy
,
45-t q-Failure to perform periodic calibration of the charger voltage sensing -
relays constitutes a violation of FitzPatrick Technical Specification
Requirement 6.8A which requires that written procedures be established and implemented for safety related protective circuits.
(50-333/89-80-04.2).
.
b During a walkdown of the 125 Vdc batteries the team observed signs of; corrosion'on cell 32 of battery 715B-2. The. licensee took as-found resistance measurements for connections between' cells 31.to 36 prior to cleaning this connection. These readings were found to be within the acceptance criteria of less than 60 micro ohms. The team reviewed the licensee's battery maintenance procedures to determine the level-
~
of scheduled preventive maintenance performed for both'the 125 and 419 Vdc batterier.. -Review indicated that t % licensee was not recording resistance measurements between battery bus connections and the verification of tcrque values for cell connections on a scheduled periodic interval. These attributes are included in current mainten-ance procedures anj were performed subsequent to initial installation of the battery. Hovever, they are not performed within a preventive maintenance program but only as corrective actions when the need arises.
'This battery maintenance practice does not follow the manufacturer's recommendations or the current industry praci. ice of performing these activities on an annual basis.
The licensee conducts performance discharge tests on both the 125 and 419 Vdc batteries every five years to detect changes in the battery capacities.
In addition, a service test is performed every
- 18 months.to verify the battery's ability to satisfy the design require its of the battery duty cycle. These tests are performed to conwy with technical specification requirements. The team reviewed the following battery test procedures:
MST-71.21, "125 VDC Station Battery Performance and Charger
-
Surveillance Test"
'
MST-71.22, "LPCI Independent Power Supply Performance Discharge
-
Test"
,
MP-71.20, "125 VDC Station Battery Service Test and Charger E
-
Performance Test"
'
--
Review of these procedures revealed inconsistencies in the required
'
initial conditions before the conducting of these tests. The technical specifications require that performance and service tests be performed in accordance with RG 1.129 which endorses IEEE 450-1975. This standard requires that no equalizing charge be given to the batteries before
,
conducting the performance discharge test.
Review of procedure l
MST-71.21 revealed that the licensee currently equalizes the 125V battery before conducting the test in contradiction of the IEEE 450 initial condition requirements. The team questioned the licensee as to the validity of the test results since the battery is charged to its optimum condition before te:;ted therefore biasing the results.
L The licensee stated that the ability of the battery to carry its
)
l
. _ _
_ _ _ - _ _ _
__
_
.
-
._._
. _ _ -
.
.
.
,
,
jy
46-
~
design leid is tested,-in an as-found. condition, without an equalizing charge every 18 months via the. service test and that' this test is in -
accordance with technical' specification requirements.. Furthermore, the licensee contended that the IEEE 450-1987 version allows an equalizing charge prior to the performance discharge test;tf a service
' test also is' performed on a periodic interval.. Therefore,_ licensee stated that it was in conformance with the technical specification.
testing. requirements.
Following discussions with NRR the team' concluded that even though the licensee's testing methodology differed'from that specified in the IEEE'450-1975 standard, testing.via the 1987 version was acceptable and met the intent of the' technical specification requirements. However, the team pointed out to~.the licensee-thatn this performance discharge testing method was not consistent.between the 125 and 419 Vdc batteries. The 419 Vdc battery is not. subjected to an equalizing charge as is the 125 V battery prior to testing.
-The licensee stated that procedures would be revised-to achieve con-
- _
sistency between the battery test methods. A technical specification change will also be proposed to clarify the testing standard that will,be utilized.-
' 4.7.4 -
EDG Maintenance Program The-vendor instructions and-manuals applicable to the diesel engine and generator were complete and available for reference by maintenance planners and others involved in EDG maintenance. The mair ;enancez procedures series MP-52 covers maintenance work on engine and generator-
. components including fuel oil transfer pumps, turbocharger, lube oil:
cooler, and other mechanical and electrical preventive maintenance.
'The' diesels have performed with a high degree of reliabil_ity and.
availability which are indicators of effective maintenance. During the past 5 years, the licensee has been systematically analyzing and replacing subcomponents on the EDGs. These actions, coupled with testing and controls on engine fuel oil and engine lube oil, have further improved EDG reliability.
The licensee does not have an overall procedure or program outlining the essential attributes of the EDG maintenance program but relies on the initiative of involved individuals for defining the task and scheduling it. There are two problems with the lack-of an EDG main-tenance program.
First, if individuals presently contributing to
<
favorable results move to other positions, work continuity could be L
interrupted.
Second, quality assurance and management have no written L
program for use in auditing or controlling EDG maintenance activities l'
to ensure that required tasks continue to be performed. The licensee l.,
committed to preparing an EDG maintenance program before the 1990 L
refuel outage.
/:
<
________m.____
______m_m.____m__u
m
-
- g y
g
%-
,
One specific' discrepancy was noted Lin the area of Diesel Generator lube oil sampling. The condition' of the diese1 ~ ge'nerator. lubricating
,
oil profoundly affects the wear and,' hence, the performance of L the engine..It also provides a mechanism for detecting excessive wear or impending failure. Currently, the 'obe' oil is being sampled and analyzed' quarterly, but the sampling is not'being done in accordance with.a formal, written procedure. Since this_is-a safety-significant
- activity that provides information on diesel. engine. reliability, it should.be prescribed by a documented procedure.
Such a procedure should prescribe the frequency and method of perform-
- ance, and the acceptance. criteria, among other things. This procedure should. prescribe such details as sample locations, sample sizes, engine condition (operating or idle), and oil condition (hot or engine standby temperature),etc. At the conclusion of the inspection, the licensee had prepared a draft procedure addressing most of these considerations.
~
This is an Unresolved Item (50-333/89-30-15).
EDG and ESW Monthly Test The plant technical specification requires monthly surveillance testing of' the Emergency Piesel Generators (EDG) and Emergency. Service Water (ESW) pumps. The inspectors also observed the EDG testing on May.23l.1989 noted that the test was conducted.in accordance with procedwe ST-98. With the exception of minor instrument problems,..
. the' diesels started and performed'as expected by review of the plant technical specification and diesel generator technical manuals. Work requests were generated to correct the instrument or indicator problems.
4.7.5 Testing and Design of Reactor Building Closed Loop Cooling Water Systte.
'
Containment Isolation Valve's Safety-Related Air Supply The surveillance testing of the backup air supplies for containment
- isolation valves in the reactor building closed loop cooling water system (RBCLCW) was inadequate to demonstrate operability of the valves.
The drywell supply and return lines for the RBCLCW system are equipped with air-operated containment isolation valves. Since these valves fail open on loss of their non-safety-related air supply, they are
-
provided with safety-related backup air supplies.
..
The licensee has recognized the need to perform surveillance testing of the backup air supplies, and testing was being performed that did verify the ability of the backup supply to cycle the valves closed two times.
However, this testing did not address the other aspect of the backup air supply's fundamental function, holding the valves shut for the duration of the accident.
p
l r
.
_a t----
- - -
_----_----.-----_---~--__---.-.---_____a-
- - _ - -
-
- - - - - - - _ _ _
,
,17
>
.
y j
.r
,
- To ~ fulf1111the hold shut' function, three. basic parameters must be considered:~
(1) the minimum pres:ure required to hold the valves shut.
(2) :the pressure loss due..to leakage out of_the system. The test
'
' incorporates no provisions for maintaining' the backup air supply:
L isolated from the nain air supply for a period of time while
~
monitoring the pressurt. drop to determine the actual leakage
,-rate, and
,
(3) the pressure loss due to the worst-case post-accident temperature
. drop in the. reactor building.
,
. It appears that the last two of these parame'ters were not considered
-
in the design, and hence tne pressure margin they would require was not. incorporated into the acceptance criteria of. the test. This design deficiency is an Unresolved Item (50-333/89-80-16)-
The safety-related to non-safety-related boundary in tne system, the inlet check valve, was not periodically tested to demonstrate its-capability to function.
Instead, the system was. isolated at the manual
.
valve upstream of the check valve. This is a violation 6.8A which requires that written procedures be established and implemented for testing the safety-related protective circuits. (50-333/89-80-04.3).
- 4.8-Emergency Diesel Generator 4.8.1 Cooling System The Emergency Service Water (ESW) system provides the cooling for the emergency diesel generators.
The EDG design data indicate the diesel engine releases heat to the ESW cooling water at the rate of 8.2 x
10 BTU per hour. The inspector examined the ESW system and ESW heat exchanger to establish how heat removal capability had been verified by previous system testing and by the EDG monthly tests. During monthly diesel engine test runs, the ESW system pumps supply water to the ESW heat exchanger for each diesel engine. During a plant emergency, the ESW pumps also can supply the Reactor Building Closed Loop Cooring Water System (RBCLCW) as shown on drawing 11825-FM-46A.
Flow to each diesel engine ESW heat exchanger is limited to approximately 700 gallons per minute through a 2.04 inch diameter flow orifice with excess pump capacity being diverted back to the pump suction bay. The preoperational tests performed in June 1974 demonstrated adequate ESW system flow and pressure capability with various system lineups. The testing verified that the ESW pumps and piping had the required capacity to deliver water to the diesel engines above the minimum flow and pressure requirements. During diesel operation, ESW flow is indicated at the engine by flow meters 46FIS-102(A-D). During the May 1989 diesel test, the ESW temperature increase of 18 F through the heat exchanger indicated at least 50% more heat removal capacity than that required to remove heat rejected by the diesel water cooling system. The team concluded that the ESW system has been verified to have the capacity to remove EDG generated heat.
--_-_ ___ _ _ _ _ __ _ _ - _ _ _ ___ -
p y
pg,
-
-
p; f [l V:
,
49-
,
4.8.2 Fuel Systems
'
~
, 4 '.8. 2. I :
Fuel Oil Day Tank Level Switch Logic
,
The.setpoints 'for the fuel oil day. tank. low-level alarms are below
c the. start setpoints'for both the lead and the backup fuel' oil transfer-pumps. _ With this design, if the lead pump fails-to n:aintain the tank.
level, the backup pump will start and the alarm will not be actuated.
,
!The second pump must also fail to maintain the level before the alarm
<will be actuated._ The alarmLsetpoint should actually be set.between:
-thefstarting setpoints.for the pumps such that both the alarm and the-
,
backup pump willlbe actuated when the lead pump fails to maintain-the
,
L level. This arrangement is' logical and consistent with other redundant design' features in the plant.
p-At the close of the inspection, the licensee initiated a design change
>
package to provide an alarm when the first pump was out of service.
This is an Unresolved Item (50-333/89-80-18).
- 4.8.2.2 Fuel Oil Day Tank Level Switch Positions-The level switches.on'the fuel oil day tank, which control the fuel oil transfer pumps, and the low-level alarm are located in such positions'that there is not sufficient fuel for diesel generator
'
operation at full load for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> as specified in'the Bases Section of the Technical. Specification.
In addition, they. provide an alarm only minutes before all the fuel will be exhausted.
'At the nominal full load fuel consumption rate of 180 gallons per hour, 540 gallons of fuel are required to operate for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. The level-switch locations are such that, under the worst of normal conditions, u
when the level is at the starting point for the back up transfer pump,-
there would be sufficient fuel in the tanks for only a few minutes of oper,
"on.
The icw level alarm setpoint, which should be keyed to the Technical Specification Bases, is even lower, providing an alarm only as the tank is completely drained.
To resolve this problem the licensee should provide a low-level alarm setpoint above the Technical Specification Bases value while, at the same time, tho licensee should coordinate this solution with the resolution of the logic problem described in Section 4.8.2.1.
Since, given the limitations of the tank size and the level. switch design, the tank cannot reasonably be maintained above 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> worth of fuel, a downward revision of the Technical Qualification Bases value will i
also be required. However, it still should be maintained as high as practicable to provide sufficient time-for the operator to respond to a low-level alarm in the midst of an accident situation befcre the tank runs out. The licensee agreed to request a change to the Technical Specifications Bases by September 1, 1989.
This is an Unresolved Item (50-333/89-80-18).
I i
_ - ___ _ _
_-_- - a
- _ _
_
-
ff sy
>
js n.-
Ir
'50 l
'4.8!2.3 Emergency' Fuel Shutoff
.
It is common' practice in diesel engine design to provide'an emergency
.
fuel-shutoff knob to'stop the engine if normal. controls fail.- This
.is provided because' diesel engines have a history of running out of control and: causing' fires associated with fuel line. ruptures. 'In the nuclear industry, both types _of r.ccidents have occured.
The licensee's engines are equipped with a red pull knob on the engine skid labeled " Fuel Cutoff-Pull'." ' However,' the knob will shut off fuel only from the motor-driven pump. The engine-driven pump will'
continue to supply more.than adequate' fuel to operate at full load.
'The licensee had previously recognized this problem and, at the time of the inspection, had begun the modification process to-resolve it.
However, the modification being considered was not adequate.. It would change the' cutoff valve from the motor-driven pump line-to the engine-driven pump line. With this design,.a second action of turning off-the motor-driven pump would be required to completelyishut off the fuel. This'is contrary to standard industry practice and would create
~
unnecessary risk to an operator not specifically oriented with the peculiarities of this machine.
Even if the operator was aware, it would require additional time to achieve fuel shutoff, and it may even'be impossible if the second control were rendered inaccessible by the condition that prompted the emergency shutdown.
At the close of the inspection, the. licensee committed to evaluate
> this item along with the other diesel generator fuel system items,.to take appropriate corrective action, and as an interim measure, place a'. warning sign at the knob explaining its limitations.
4.8.2.4'
Fuel Filter Design / Operation The team noted that there are no differential pressure instruments provided to indicate plugging of the fuel supply duplex filters.
In an accident situation, there would be no iMication of plugging until engine performance had begun to deteriorate.
In addition, even if plugging were suspected as the cause of the deterioration and there are many other possible causes -- the operator could not shift from one filter to the other for diagnosis or for filter changeout because the lineup currently being used is with the filter unit in the "both" position.
In this lineup, both filters wooid be loaded and a shif t would cause further deterioration of EDG performance.
The standard operating mode of duplex filters is with one filter on-line and the other in standby, The design intent is that when the on-line filter becomes plugged, the lineup can be switched to the clean filter to allow continued operation while the plugged filter is
,
changed. The current lineup of these filters in the "both" position i
defeatr, this capability.
_ _ _ -
.--_
_-
-
- -
.-
E v
ll I.
L Plugging of fuel. filters / strainers e a high probability threat to
,.
k emergency diesel generator:, during r e s ccident when they may be operated for long periods, drawing the fuel :.ar.s down to. low levels which require refilling.
This creates the potential-to' introduce ~new contaminates into the tanks and to stir up the existing sediment,.
>
.thus increasing the loading rate of the filters / strainers..Since all
+
.of-the tanks may be refilled at about the same time, there is the potential'for simultaneous plugging in all of the units, thus producing a poter.tial common mode failure.
During: review of this concern, the. team found conflicting information P
concerning the installed filters. One excerpt from the vendor manual described them as " designed to filter 100 gallons per hour when filter-
.
ing to capacity using clean oil through both clean elements." Since the engine uses approximately 180 gallons per hour at full load, this would imply that both.the engine-driven and motor-driven fuel. supply-systems operating through both filter units in the "both"' position would be required to supply the engine.
Even then, there would be very little margin for anticipated loading. The team raised this concern for prompt' action.
A drawing of the filter unit' from the same manual has a note, " Pres-sure drop across complete filter will not exceed 5.0 psi when operating to capacity of 5 gpm of clean fuel oil at 68 degrees F thru clean o
element." It is not clear if.this rattrig is with the unit in the
" single" or the "both" position, but the drawing shows the unit in the." single" position.
-At the end of'the inspection,.there was still uncertainty about the filter capacity. However, if the motor-driven and engine-driven fuel systems are redundant as described in various plant documents, and if the filter units are properly designed such that they can be operated in the." single" position, then each filter element must have the capacity to pass full flow at engine overload conditions, with sufficient margin to allow a reasonable degree of loading before becoming overloaded. The licensee agreed to rectify fuel problems by the 1991 refueling outage.
Prompt resolution of the filter capacity is needed. This is an Unresolved Item (50-333/89-80-18).
4.8.2.5 Technical Specification on Diesel Generator Fuel Technical Specification 3.9.C., Diesel Fuel, requires a minimum of 64,000 gallons of diesel fuel be on site for each operable pair of diesel generators at any time the reactor is critical. The quantity is verified monthly using procedure F-ST<9A and also af ter each
,
operation of the diesel using procedure F-0P-22. These procedures require that the levels in the tanks be determined by dipstick and that the local and remote level instruments indicate less than 7 inches differential from the dipstick indication. This translates to a nominal error in these instruments of as much as plus or minus 1500 gallons per tank (8.33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br /> operating time at full load).
__-__-_________ _ _ _ _ -
,
_ - _ _ _
-
--
-_ _ -_- _ - --
_. -
_-
. -
- -.
_.
_ - _ - --
-
o
.r
,
..
a i
52.
The same insti nts are used for making routine checks: every shift of the undergrwAd storage tank levels, with the results recorded in the. Operations Log No. 2 rounds sheets (procedure.0DS No.;17).. However, unlike other critical parameters recorded on these sheets, there is no stated minimum cllowable level'and..'therafore, no accounting for-the.possible instrument error. The only standard'available'for comparison _is the tank graph in procedure F-ST-9A, " Diesel Fuel Oil
- Quantity Check", which also does not reflect instrument error.. The team was concerned that each tank could be as much as 1500 gallons o
below the Technict.1 Specification minimum, whereas the shift round sheets would still indicate acceptable levels when compared with the tank graph.
The licensee maintains that the purpose of the shiftly rounds is not to determine if the level drops below the Technical Specification minimum, but.rather to detect trends in the levels. The licensee stated that only the monthly test is intended.to verify being above this minimum.
The shift.round sheets should include acceptance criteria, and the ecceptance criteria should incorporate sufficient margin to include instrument error. :This is an Unresolved Item (50-333/89-80-XX).
4.8.2.6 Inadequate Diesel Generator Fuel Consumption Test The fuel consumption rates of the diesel generators t',e never been-
-
properly verified by testing. Although the licensee ptrformed tests during plant startup, they were not pe, formed properly and therefore, the data provides unreliable indicatirn and in one case indicates an unacceptable consumption rate.
The licensee has previously estimated tre rate of fuel consumption by measuring the drop in level in the main fuel oil storage tanks during timed runs of the diesels. The testing wa; iin error for the following reasons:
1.
The tests were performed only at an overload condition, thereby precluding comparison of the data with the full load consumption rate upon which the Technical Specifications were based. The resultant test data were not evaluated against valid acceptance criteria. The test results were accepted althougn one engine had a consumption rate more than twice the rate to satisfy the Technical Specification Bases of 7 days full load operation with the required quantity of fuel on site.
2.
The fuel consumed was determined by measuring the level change in the main storage tanks. Given the relatively short duration of the. tests, this method is not sufficiently precise. Since the tanks are large (36,000 gallons) horizontal cylinders, a very small error in level measurement wou?d produce a large error in volume.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ -
.
y i
j
>
g 1,
R.**
l', -
_
.
!
l L
j 3.
The design of the fuel oil day tank level control instrumentation I
(described in Sections 4.8.5.2 and 4.8.2.2 of this report) may
.have. induced errors of as much'as 500 gallons.
The licensee.has.taken the position that such testing is not required.
However,~the licensee's performance of the test during the plant startup i
indicates its original recognition of this requirement.
~
The importance of this test can best be appreciated in view of the very small available design margin.
If the actual fuel consumption exceeds the advertised rate by less than.1%, the minimum required
~ fuel on site is insufficient to satisfy the. Technical Specification
Bases.
For at least one of the engines, the only available data l
indicate it is exceeding this rate by more than 100%. At the con-clusion of the inspection, the licensee agreed to perform these tests before the end of 1989. This is an Unresolved Item (50-333/89-80-18)).
4.8.2.7 Improper Calibration of Fuel Oil Day Tank Level Instruments The procedure for calibration of the level instrumentation and controls.
for the diesel generator fue' oil day tanks is incorrect.
This creates the potential for.not meeting the Technical Specification 8 ares requirement of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> rated Icad capability from the day tank.
The tanks are each equipped with six level switches for control of the fuel oil transfer pumps and.the tank level alarms, and one level instrument providing indication at the engine control panel. These instruments are calibrated using Procedure No. F-IMP-93.6, Emergency Diesel Generator Fuel Oil Day Tank Level Functional Test, Revision 2,
dated 10/2/85.
There are four basic inadequacies in the procedure.
First, it does l
not use a legitimate standard for calibration of the installed level instrument. At the beginning of the procedure, the tank is filled to
"approximately 100% full." The procedure does not specify how to determine " full." The licensee stated that 100% full is determined by filling until the transfer pump cutout level switch stops the pump.
This is taken as the 100% level, and the installed level instrument (93-LI-102) fs adjusted to indicate 100% full. Since the accuracy of the level switches is not known, and indeed is what is being calibrated in this procedure, it is not legitimate to use them as the standard for producing a calibration point. Typical standards which could be used to calibrate such instruments include differential pressure puge, a temporary sight glass, a dipstick, or a tape.
Second, the one calibration point for the installed level instrument as described above is the only calibration point taken. Therefore, the error rate of the level instrument cannot be detected. The instruments usually have at least a two point calibration. The industry norm for such an instrument is five points.
l
- _ - - _ _ _ _ _ - _ _ _.
____ _ -
- _ _ _
- _ _ _ _
-
a
-
,
,
The. third inadequacy noted is that the procedure does not provide any requirement or space on the documental. ion form for noting the "as left" indication of the level switches.
The fourth inadequacy is that the procedure uses the incorrectly calibrated installed level instrument as the standard for the subsequent calibration of the level switches that control of the transfer pumps
-;
and the alarms.
This is done by lowering and raising the level in the tank and noting, per the installed instrument, the actuation levels of the switches. This creates the potential for calibrating the instrument to a device that is not in calibration. This finding constitutes a violation of 10 CFR 50 Appendix B Criterion V v;hich requires procedures appropriate to the circumstance (50-333/89-80-02.1).
This is another example of inadequate procedures.
Further examples are addressed in Sections 4.3.1.2, 4.8.3.2 and 4.3.4.
4.8.2.3 Quality Control of Emergency Diesel Generator Fuel Oil In evaluating the licensee's means for ensuring the proper fuel oil for the EDG units the team reviewed the EDG manufacturer's fuel oil recommendations, the licensee's EDG technical specification fuel oil requirements, and fuel oil purchase order specifications. The team also verified the quality of fuel oil purchased and fuel oil stored in the EDG tanks.
Following are the-findings:
The EDG manufacturer's recommendations for the fuel specifications
are essentially the same as those cited in America Society for Testing and Materials (ASTM) Standard D1975 for No. 2 diesel fuel.
The licensee's. technical specification requirements for diesel
fuel are in agreement with ASTM D 975 except for two parameters.
The ASTM specification limit for water and sediment is 0.05% and for ash is 0.01% whereas the licensee's technical specification limit is 0.5% for water and sediment and 0.1% for ash.
This appears to be an error. The licensee has agreed to request for a technical specification change.
The licensee's fuel oil purchase orders requ'.re EDG fuel in
accordance with specification ASTM D 1975.
The vendor is required to provide a certificate of compliance.
Fuel analysis supplied by the vendor and those made by the
licensee on a routine periodic basis provide evidence of fuel which meets the ASTM Standard D1975 requirements. However, the team observed that the licensee's program provides no means for the verification of new fuel before adding it to the storage tanks.
_ - _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ -
,_-
..
sg i
-
r NRC Regulatory Guide 1.137 Part C.2.b suggests that prior to adding new fuel to the supply tanks that onsite samples of the fuel be.taken for testing of the specific or API-gravity, water and sediment, and viscosity.
Fuel oil is added to.the storage tanks on a quarterly basis. The current practice is to accept fuel on the basis of a fuel ticket certification that the fuel delivered is in conformance with l
the ASTM Standard D975.
No onsite samples of the new fuel are taken.
!
Quality control has not been involved in fuel receipt and quality
'
assurance has not audited the fuel supplier.
During this inspection, the licensee prepared a Receipt Inspection Procedure (QAI.7.0, Appendix 7.9) for #2 diesel fuel oil c.onsistent with RG 1.137 and trained selected individuals in application of the procedure.
The diesel fuel in each storage tank is sampled munthly by the Chemistry Department in accordance with the technical specification 4.9.C.1 requirement.
Results of the analysis i.re received approximately three weeks after the sample is taken. Therefore, if an improper fuel had been supplied, a period of seven weeks could pass prior to identifica-tion of the problem. The lack of testing new fuel for quality is a violation of 10CFR 50, Appendix Criterion VII, " Control of Purchased Material, Equipment and Services" in that measures were not established
,
to assure that purchased material (diesel fuel) conformed to the procurement documents. This violation is not cited in Appendix A to this report on the basis that the licensee took prompt corrective action, chemistry samples tcien monthly ucording to the technical specification indicated that high quality fuel had been supplied to I
the plant on a regular basis, and the violation, if cited, would be a Severity Level IV or V.
4.8.3 Air Systems 4.8.3.1 Emergency Diesel Generator Air Starting Reservoir Capacity Test The FSAR in part 8.6.3 states that each EDG engine has the capability for 10 engine starts from the air start system without the air com-pressors recharging the air system.
The air start system includes 2 redundant sets of 5 air tanks and en tir compressor to provide 200 psi maximum pressure to four air start motors that initiate diesel engine rotation.
In September 1988, the starting capacity of I set of 5 tanks on EDG "C" was tested yielding seven successful engine starts where the initial tank pressure was 184 psi.
The engine did not start with an initial tank pressure of 56 psi. The initial air start from'184 psi caused a 28 psi drop of tank pressure to 156 psi.
Successive pressure drops on starting were less than 28 psi; the last
,!
!
start requiring a tank pressure drop of 15 psi. During this inspection, the pressure drop on starting the "D" diesel was approximately 50 psi from the initial level of 200 psi.
The team asked if this observation invalidated the applicability of the "C" diesel tests to engines A, B and D.
The licensee agreed to evaluate this situation by starting each diesel with approximately 180 psi air pressure and measuring the pressure drop to start during the next monthly diesel test.
- _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - - _ _ _ _
-
_-
- - _
_._
-
-
_-
._-.-
- _ -
'
.. ;
,,
..
,
y-c.
v
.
4.8.~3.2'
Inadequate Procedure for Switching Diesel Generator Starting Air Banks:
The normal lineup of the diesel generator. starting air banks is with half of the reservoir (five ' accumulators; on-line. to start the unit and the.other half-isolated in the staraby mode. The procedure for
- switching ' air banks-(procedure number F-0P-22,. Diesel Generator Emergency Power) does not recognize the operating scenario.in which
-the on-line bank has been depleted.
It recognizes only.the scenario in which tt.e on-line bank is not-depleted, such as normal shifting to
achieve even-wear on the. compressors.
The proper sequencing of the air bank isolation valves for each of.
these. scenarios 'is' the opposite of the other.
In the first scenario, when the on-line b'ank has been depleted, such as for unsuccessful start attempts, the on-line air bank isolation valve a ould be closed before the standby air bank isolation valve is opened, to prevent.
. losing the. air from the' standby air bank to the depleted on-line air bank. ~In the second scenario in which the unit is in normal standby, the. isolation valve for the. standby. air bank should be opened before the on-line' air bank isolation valve is closed, to prevent momentarily rendering the unit i mperabl9. The operating procedure addresses only the latter case. There are no instructions in this or other-procedures for the unsuccessful start attempt case. Since this case is the~ reason for'having the backup reservoir in the first place, the-procedure is incomplete.
'The procedure contains a built-in dilemma for an operator. This was demonstrated during several conversations with the licensee. When
. asked what ~ valve sequence would be used to line up the standby bank if the on-line bank'had been depleted, an operator responded with the correct seqeence, but it was contrary to the directions given in the operating procedure. When the same situation was posed to operations management, they also indicated that the operator should proceed with what he believes is the correct sequence. This is in direct conflict with the principle of " verbatim compliance".
The operating procedure should be revised to differentiate between the two operating modes for the system and should provide clear operating instructions for each. This finding constitutes a violation of 10 CFR 50 Appendix B Criterion V which requires that activities affecting quality shall be prescribed by procedures appropriate to the circumstance.
(50-333/89-80-02.2).
4.8.3.3 Diesel Generator HVAC Design Requirements / Operating Procedure Conflict Operating Procedure Number E0P-60, " Diesel Generator Room Ventilation,"
contains a statement that the HVAC is not required for the operation of the diesel generators. The licensee was asked to provide an analysis which demonstrated this capability. At the conclusion of the inspection, this analysis had not been provided.
- - - _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ -
_,
'
.
.
57 L
l Subsequent to the inspection, the licensee determined that the state-
& nt about the HVAC conclusion cannot be supported; the licensee will remove _the statement from the procedure.
4.8.4 Emergency Diesel Generator Electrical Control The team reviewed the EDG electrical starting, running, and shutdown control circuits in order to assess their functions in providing for the reliable operation of the EDG units during their normal LOOP /LOCA accident scenario.
The electrical control circuits for each pair of EDG units is from a separate division 125V dc battery circuit through two circuit bretkers, a knife switch, fuses, cable and wiring. Starting of the EDG is initiated by either the LOOP or LOCA redundant relay contact signal inputs into the 125V de control circuit. The starting signal actuates switching devices to provide 125V dc to the air start solenoid, governor booster pump, governor shutdown solenoid, fuel prime pump, generator field flash, and the circuit breaker ciosing coil. When the EDG is started and is providing power to the LOOP /LOCA loads, it is no longer dependent "pon the 125V de power (self-sustaining) except for the automatic r.nutdown circuit.
Loss of voltage in this circuit either as a consequence of protective relay function or circuit failure (such as fuse, circuit breaker, etc.) will de-energize the governor shutdown solenoid which causes the governor hydraulics to drive the governor to the engine fuel shutoff position thereby causing the EDG to shutdown.
According to the Woodward Governor Technical Manual, the shutdown solenoid could provide shutdown function either by being energized or de-energized.
The licensee identified this potential problem in October 1987. However, no specific action had been taken to evaluate /
resolve this potential problem before this inspection. The licensee currently plans to conduct a design review and evaluation in this area'to find changes that could improve EDG reliability.
4.8.5 EDG Long Tern Operation Since the function of the EDG units is to provide emergency power for safe shutdown of the plant in the event that normal or reserve station power is unavailable, the team assessed the procedures provided to operators to enhance LOOP /LOCA long-term operation.
Licensee procedure F-0P-22, " Diesel Generator Emergency power" gives the operator with detailed procedures for the pre-operational. alignment, startup, normal monthly testing, and shutdown of the EDG units. These procedures appear to be zdequate in most areas, including the normal short-run operational testing of the machines, but they appear to be deficient in providing the operators instructions for the potential long-term operation of the units. These procedures only provide for the routine monitoring of EDG parameters such as engine temperatures and oil pressure, and for adding oil and switching fuel transfer pumps. Some of the areas of procedural deficiencies noted during this brief review are the following:
____ _ _ - _ _ _ -
_
l4
-
.,
l
r,o instructions on how to bring the second EDG on line and load
it if it initially fails to start and can subsequently be started no instructions on how to transfer loads and shutdown an EDG a
no instructions for the emergency starting and operation of an
EDG if 125V de control power is lost or a circuit failure occurs no instructions on how to change fuel oil filters with the engine
running no instructions on how to operate without the DC motor driven
fuel pump no instrucitons when to order replacement diesel fuel
The licensee committed to address the above deficiencies by the end of 1989.
4.9 Reactor Building Closed Loop Cooling Water System In reviewing the adequacy of the emergency service water (ESW) system for cooling the diesel generators, the team discovered that the system is connected with the reactor building closed loop cooling water (RBCLCW)
system. The ESW systems feed into the RBCLCW systems whenever the pressure in the RBCLCW falls to 40 psi. A loss of offsite power can also prompt this automatic actuation.
The designs of these two systems are such that, in a LOCA, lcrge direct leakage paths may be opened from the containment to the reactor building and to Lake Ontario if the RBCLCW system is faulted.
During normal operation, the RBCLCW system provides cooling water to two heat loads inside the reactor containment:
the drywell coolers and the recirculation pump and motor coolers.
Both of these loads are non-safety-related and the RBCLCW piping to these loads is non-safety-related and not protected against the effects of high energy line break.
Each of the containment penetrations for the RBCLCW lines is provided with I
one air-operated isolation valve outside containment that was added in response to NUREG-0737. 1he supply lines are each equipped with one check valve. The air-operated valves are actuated only by operator action.
There is no automatic actuation.
The ESW to RBCLCW system crosstie is through two normally closed motor operated valves in the return side of the system. These open automatically upon sensing a low pressure (less than 40 psi) in RBCLCW, allowing the ESW system to supply the RBCLCW loads on loss of power to the non-1E powered RBCLCW pumps.
- - _ _ - _ - _ - _ _.
_
__
_ _ _ _.
-
.
.
,
}
'
<
,
A
'
gy K
'i
'
';
.
-
,
.The~ concern'with this design is as fol_ lows: During a LOCA,J the RBCLCW l
'
D piping'inside the drywell.may be ruptured due to the HELB effects. As a
'
~ result, the water'in-the system may drain out, and the~ pressure-in the system will drop below the ESW system' crosstie actuation point. ~When these.
i
'
-valves open, a large direct leakage path:will exist from the containment:
-
vessel to Lake Ontario.
- A second less-direct leakage path would-also exist through the open vent on the RBCLCW head tank._ Although leakage from this path would be processed by the standby gas treatment system, this system is designed to process only the design-basis leak, which is much less tnan the leakage which could" potentially occur through the 1-inch diameter head tank vent. Therefore,
- the 10 CFR 100 limits could potentially be exceeded.
'
The licensee contended that in such a case the operator'would detect radiat'on in the ESW effluent and would close. the containment isolation.
valves. However, since this is not the only potential ' source of radiation
.in the ESW system, the operator could not necessarily ideatify this as the source.
In addition, since the other instruments on the RBCLCW system which might give further evidence of system rupture are not pcwered from Class'3E power sources, they would not necessarily be'available.
The licensee ~also contended that leakage through the head tank vent would be detected by tne reactor building. area radiation monitors. However, in
.
a LOCA, these monitors could all be overranged even with normal leakage.
Therefore, their ability to detect this leakage is questioned.
I The licontee has also contended that since the RBCLCW s.ystem is closed inside containment, this problem does not exist. The system is indeed closed during normal operation. -However, since this system's piping is not protected from HELB and is-in close proximity to primary system piping at-several' locations,'without an analysis that shows otherwise, it must be assumed'to be ruptured by the LOCA effects and not to remain closed.
~
The following requirements were in the public record at the time of the original plant license, and (b) and (c) were specifically designated as requirements for this plant by a letter from the Atomic Energy Commission to the licensee dated Decembe-18, 1972.
l a.
10CFR 50, Appendix A, Criterion 10 (1967 version), Containment, requires that "The containment structure shall be designed to sustain the e
initial effects of gross equipment failures, such as a loss of coolant boundary break, without loss of required integrity and, together with l
the other engineered safety features as may be necessary, to retain for as long as the situation requires the functional capability to protect the public."
l
-. -.
. _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _
_ _ _ _ -
-
_ - _ -
. _ - -
i ppy
..,
60'
~
b.
10CFR 50, Appendix A,- Criterion 40.(1967 version), Missile Protection, requires.that " Protection.for' engineered safety features [such as the
_ containment and-its appurtenances] shall be provided against dynamic-effects and missiles that might result from plant equipment failures."
c.
10CFR.50, Appendix A, Criterion 42 (1967. version),' Engineered Safety Features Performance Capability, requires that " Engineered safety features shall.be designed so that.the capability of each component-and_ system-to perform its required function is not impaired by the effects of a-loss-of-coolant-accident."
In addition to the basic. oversights in. the original. design,. there are several other related. shortcomings in the design of the NUREG-0737 modifications
- that were performed as follows:
(1) GDC-56 requires that automatic isolation valves shall be designed to take the_ position upon power l failure that provides greater safety; in the case of'these valves, that position would be closed.
These valves fail-open on loss of air.
The licensee takes the position that " fail open" was used to comply with the NUREG-0737 requirement that non-safety-related systems which could-be used'for accident mitigation (the drywell-coolers) be made available to the maximum extent practicable. This argument assumes that this criterion and-the containment' isolation criterion are mutually exclusive.
However, they are not and both can be satisfied. Even if they could not, the criterion related to the basic safety requirement would take precedence.
Additionally, the drywell coolers would be effective for mitigation only for the case of.a small-break LOCA, which is of no threat to the integrity of the RBCLCW system piping and therefore of no concern in this situation.
For the large-break LOCA, which is the accident of concern, the drywell coolers-would be ineffective for three reasons:
(i) their capacity is insignificant compared to the heat' load of this LOCA; (ii) their fans are not designed ~to operate in a DBA LOCA environment; and (iii) they may be incapacitated by the loss of-the RBCLCW system, which is the focus of this finding.
2.
The design criteria for the safety-related backup air supplies for the containment isolation valves did not include consideration of the-air leakage from the system for the duration of the accident and the loss in. pressure due to worst-case reactor building cooling post-accident.(according to the licensee's analysis the temperature may drop.to 32 F) as described in Section 5.3.2.2.
Therefore, they could be undersized.
.3.
GDC 56 requires that isolation valves outside the containment be located as close to the containment as practical. These are not so located.
t
-
-
_
- - - _ _ _ - - - - _ - _ _ _ _ _ _
__ - -_ - _
.
- ..
.
10CFR 50, Appendix A,-Criterion 56 (version as amended October 27,1978),
Primary-Containment Isolation, requires that '9 solation valves outside containment shall be located as close to the contatament as practical and upon loss of actuating power, automatic isolation valves shall be designed to take the position that provides greater safety." These requirements were applicable at the time these modifications.were made.
Therefore, this is a Violation (50-333/89-80-01).
i In response to this observation, at the close of the inspection, the licensee agreed to the following short-term actions: The emergency opera-ting procedures would be immediately changed to instruct the operator to close all of the RBCLCW containment isolation valves upon coincident indi-cation of a LOCA and the actuation of the RBCLCW/ESW cross-tie valves.
Although this is acceptable for the short term, it may not be an acceptable long-term solution since it depends on operator action during
'the initial stages of the accident, and because it only addresses the automatic isolation shortcoming of the design and not the others.
In a subsequent correspondence, the licensee committed to leak test the check valve in the air system for the RBCLCW valve and establish the adequacy of the back up air cylinders for the valve.
5.0 UNRESOLVED ITEMS Unresolved items are matters for which more information is required in order to ascertain whether they are acceptable, violations, or deviations.
Unresolved items are discussed in Section 4, 6.0 EXIT INTERVIEW At the conclusion of the inspection on May 26, 1989, the inspection team met with the licensee representatives, denoted in Attachment 5.
The team leader summarized the scope and findings of the inspection at the time.
The team gave no written material to the licensee.
>
_ - _ _ _ _ - _ _ - - _ _ _ _ _ - - _ _ - _ _ _ _
_ _. -.
1 l:
- ".
,
.,
-
l.-
- -
ATTACHMENT 1
]
1 AC ONE LINE DRAWING l
!
TO 115H0 SWD 5"
g
- T4 U..v TO 115 W SkuD r
TO
- T2 UAv tY % Nw T3 g
/
.
-
"
,(
(Y Yn (Y %
.
345 W
N% (Y Tg W-
-
SWD -- *
- [
,,,
-
1160 V
'
g.*
.
g
- 1 Ele * 10110
)g 10703 HB D
A C
@@
@@
A A
'
I l
)
)
)
) 4160 V
)
)4160 V )
)
)4160U l
F10cm i i*,)4160U)
, 18300.)
I I
I i 18580 im00 i
- .e. --. _,
,
i
.
/
/
v1v v1v T14 T6
)
)
- 11600 l 603 U
" 11 " I 600 U
-
,
i
- DOCTT.S EUS/EQPT/ LOADS AS-EUILT UERIFIED
.
.
_ _ _ _ _. _ _. _ _ _ _ _. _ _ _ _ _ _ _ _. _ _ _ _ _. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
- _ _ _ _ _ _ _ _ _ - _ _
..
ATTACHt1ENT P.
- 419 V DC ONE LINE DRAWING MCC-155/*165 MOC-153/163-l l III 1.
))) )
)-
)Lo.
IIIl l
MCC-152/162
)
)
) 480 V
)
_i 71-INV a
3*A/'B v." T14 nm I
a+-
<ee-
)
)
l 419 Vdc
-
)
)
_
Ol O
1.
lA Di
'
V V
- m ons msmnetons 93-EDG AS-MILT UDII'ID l
_ _ - _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ - - _ - _ _ - - - _ _ - - _ _ -
_-_-.
. _ - - _ _. _ _ _ _ _ _
_ _ _
_ _ _ _ _ -
-.
.
.
.,
-e
. ATTACHfiENT. 3 125 Vdc SYSTEM
-
$0!E A
- SB-ia
- 71Bc-ia F
BCB-24
)
y
)
~)
)'
)
)
)
- - -
- -
- -
EmC.1 Esc.,
d N
O
C e
e a
I l
t l
0
0 Q
Q Q
Q
.
d a
a a
F F
F F
e 7.A..
_..eg.,
.
.
@
- SB-1B
[""" f"[p]
}
f
- BCB-2B
,
} }
}
}
}
}
}
)
" " " " "
" "
"
"" BMCC-2
- BTC-4
- N n t
n aa a m
a i e i
i
- BMCC-6 0 0 0
0 Q)
Q Q
Q Q
-
-
-
- -
!
F F F F
F
!
- IMOD 4160 U SLCR BUS
- Busiqpt/ Loads which
were As-built verified
-
_ - _ _ _ _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _
w
-
-
- - -
---
.
i.;
r
ATTACHMENT 4 CALCULATIONS-REVIEWED-Calc. No.
Date-
. Title / Subject.
,
.11825-E-19 4/8/69
' Heat Release -'4-kV Emergency Switchgear
-
11825-E-24.
7/8/69 HVAC Loads on Eme'rgency Bus.- Estimate
,
11825-38'
4/22/70 Heat Release During Emergency - 600-V, Unit Substation 12966-PE(N)-
4/13/82 Effect of Equipment Heat Load on the Reactor-026 Building for the First-24 Hours Post LOCA and
. Post HELBE 12966-PE(N) -
4/13/82 Reactor Building.Long Term' Temperature,
- 024
' Post LOCA & Post HELB-001 5/18/89, Determination of Post HELB Transient Heat Flux.
Into the Load Center Enclosure, L-15 and L-16 Inside the Reactor Building None 5/1S/89.
Extrapolation of' Environmental' Enclosure Performance to HELB Conditions [[::JAF-89-019|JAF-89-019]].
5/19/89 Environmental Enclosures Heat Load and o
Capacity Evaluation 9017-1 5/11/89 Potential Flooding. Impact for EDG Room Sprinkler Actuation with Floor Drains Plugged
4/18/89 Evaluation of Impact of Flooding Inside Emergency Diesel Generator Rooms on Safety-Related Equipment
'
E-120 4/7/72 Buses 11500 (L15) & 11600 (L16), FDRS 11516 &
11616 to Control Rod Drive Water PP E-124 5/11/72 Bus 11600 (L16), Feeder 11606 to MCC C161
'
E-125 4/6/72 Bus 11600 (L16), Feeder 11608 to MCC C161 j
E-126 4/6/72 Bus'11600 (L16), Feeder 11610 to MCC C161 i
I I
E-130 4/6/72 Bus 11600 (L16), Bus Coordination
'
E-241 8/10/72 Bus 10500 SWGR H05 & Bus 10600 SWGR H06, Bus Coordination
i J
.
l
'
.,
-
-
___ __ _9
_
_
-
_ _ - _ _ _
Li
'
'
,,gs
- g-a-l ? Attachment 4L
~
- y
, , r m iL '. v: 6,s Calc. No.
Date ' Title / Subject , q ?E-242- .4/10/72' 350 Hp. Service Water Pump,' Feeders 10510,. , 10520, 10610 & 10620 < ' - E-243 4/10/72 1250 Hp= Core' Spray Pump,' Feeders'10530 &'10630 E-244-4/10/72l 1000 Hp RHR Pump, FDRS 10640, 10650, 10540 & j
'10550 < E-252 2/16/73 BUS 10500 SWGR~H05 & Bus 10600 SWGR H06, ,
- Engine / Gen.
-11825-E-4 ~10/3/88 4KV Motor List
11825-E-14 2/20/69 Short; Circuit Calculation - Isolated Phase Bus 11825-E-16 4/4/69 Automatic Start & Seq. Loading of'Emerg. Gen.
System - Study . 11825-E-17 4/4/69 Estimated Diesel Gen. Loads for Post' Accident Conditions-11825-E-19 4/8/69-Heat Release - 4KV Emergency Switchgear- '11825-E-20 4/8/69 4KV Bus Sizes & Total Load 11825-E-33.
11/29/68 Aux. Pwr.-Transformer Fault Duttes S'.S. 4160V-Switchgear 11825-E-34-1/29/69' 4160V Switchgear. Fault Duties 11825-E-43 11/25/70 '5KV Motor Leads 11825-E-44 11/25/70 Diesel Generator Leads Cable Size Calculation 11825-E-45 11/25/70 Bus' Tie Cable Size Calculation 11825-E-46 11/25/70 4KV Transformer Cable Size Calculation 11825-E-63 8/10/72 Load on Bus 10300 11825-E-66 1/23/73 Fault Calculations on 4KV Bkrs with Diesels i ' 11825-E-67 11/16/71 600V System - 600V Loads 11825-E-69 3/20/73 Voltage Profile Study 11825.10-E-77 3/25/87 Voltage Profile - Emergency Buses Fed from Reserve Station Service Transformer 11'825.10-E-81 6/25/77 tladervoltage Study of Class IE Equipments MCC Control Ckts ' , _ ___E______________________-_-__--_-_________ AgSig; ;.9 " ~ 9;[hjTh%ym- -
G s-j-l '
, {(.;; 'id ' , , ( f g- @ Attachment'4.-
~ ln , ' ~
r j ,. - ' l ' i '
- Calc. No.
- Date Title / Subject-
' > L' 14620-E-77-01'- . 3/25/87..- Emergency Diesel Generator Load Review , ,
$' u ' , , . 832955-E5-8/14/861 Protective Device. Settings 600V ~ L25 &L26 . ' Feeders to 71TS-7,. Feeders 12502 & 12602, . '4.16KV. Feeders 10560'& 10600 g _ o:
' ' 9, . . .
e. 3.. : . .3/7/72 Shor Circuit Rating of BMCC 1&'2.
, - E-48: JAF-89-022 5/24/89 DC Voltages at Critical Loads - ' , O, [JAF-89-024 5/24/89 DC. System Coordination and Short Circuit
Calculations
- -'
\\, , L \\ .I < W-ik'. i t \\
I s
~ 'o s ' ,',i.. r _'_a_ m_ _.__ _._ _ _
... _ _ _.
t ,c ' ' ... ATTACHMENT S 1.0 PERSONS CONTACTED 1.1 NEW YORK POWER AUTHORITY (NYPA) J. A. FITZPATRICK NUCLEAR POWER PLANT (JAFNPP) T. Anderson, Electrical Engineer (WPO)
- R. Baker, Maintenance Superintendent
- R. Beedle, Vice President, Nuclear Support F. Bloise, Electrical Engineer P. Brozenich, Operations Shift Supervisor W. Childs, Senior Licensing Engineer
- A. Ettlinger, Director, Design
- W. Fernandez, Resident Manager
- J. Gray, Licensing Manager L. Guaquil, Director, Project Engineering (WPO)
- M. Hansen, Plant Engineer A. Heath, Fire Protection Engineer T. Herrmann, Plant Engineering Supervisor, Mechanical
- R. Hladik, Plant' Engineer D. Holliday, Plant QA
- R. Houston, Electrical Engineer N. Hoy, Plant Engineering Supervisor T. Hunt, I&C Chief Technician N. Johnson, Maintenance Planner D. Keeper, I&C General Supervisor
- H. Keith, I&C Superintendent W. Kenner, Senior Nuclear Operator K. K11 pack, Construction. Supervisor
- R. Lasino, Superintendent of Power J. Lazarus, Plant Engineer
- R. Locy, Operations Superintendent R. Lowe, I&C Superintendent B. Marks, Maintenance Engineer K. Moody, Plant Engineer
. , '
- S. Mukerjee, Electrical Engineer (WPO)
D. Nacamuli, I&C Supervisor , R. Patch, QA Superintendent l S. Rokerya, Licensing Engineer
- D. Reddy, Plant Engineering Supervisor, Electrical /I&C S. Scott, I&C Supervisor
- D. Simpson, Training Superintendent D. Squires, Operations Shift Supervisor G. Tasick, QA Supervisor K. Vehstedt, MOV Engineer (WPD)
- V. Walz, Technical Services Superintendent J. Wieroski, Technical Training Supervisor
- Present at exit meeting on May 26, 1989.
. _ _.....
_.--__- o' ~ q.> d i I f Attachment 5
" 1.2 STONE AND WEBSTER (SWEC) D. Patel, Senior Electrical Engineer 1.3 U.S. NUCLEAR REGULATORY COMMISSION R. Plasse, Resident Inspector
- W. Schmidt, Senior Resident Inspector
- J. Strosnider, Chief, Engineering Branch
- H. Wang, Project Engineer, NRR 1.4 REGULATORY CODY OF SPAIN A. Perez
- Present at exit meeting on May 26, 1989.
, - - -. - - - - - - -. - - -, -- -- - -- - -, - -. - _ - - - - - - - - - _ _ - - - ---_-.--------_------x--------- - - - - -_--__--- _ - - - _. - - - - _ - -. _ - - - - _ - -- - }}