IR 05000344/1986023
| ML20214D657 | |
| Person / Time | |
|---|---|
| Site: | Trojan File:Portland General Electric icon.png |
| Issue date: | 11/07/1986 |
| From: | Ang W, Callan L, Huey F, Jim Melfi, Richards S, Royack M, Sorensen C, Toth A, Wagner W, Zwetzig G NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| To: | |
| Shared Package | |
| ML20214D602 | List: |
| References | |
| 50-344-86-23, TAC-65350, NUDOCS 8611240191 | |
| Download: ML20214D657 (30) | |
Text
{{#Wiki_filter:> + U. S. NUCLEAR REGULATORY COMMISSION
REGION V
Report No. 50-344/86-23 Docket No. 50-344 License No. NPF-1 Licensee: Portland General Electric Company 121 S. W. Salmon Street Portland, Oregon 97204 Facility Name: Troj an Inspection at: Trojan Site, Rainier, Oregon and PGE Engineering Office, Portland, Oregon Inspection conducted: August 11, 1986 through August 22, 1986 Inspectors: bd b roc.
s o -1 -% F. R. Huey, Team Leader Date $G r art-u l-96 L. J. Callan (IE-ORPB), Assistant Team Leader Date b
// - 7-g4 W. Ang, Reactor Inspector Date - NA Fo n.
n-7-sb G. Zwetzig, Reactor Inspector Date Y // '7/A G ' g. "i fi, eact6r Inspector Da'te ' fMwa n Mu.
Datel ~ / C. 'SoMdn, ) Reactor Inspector ). b. 7 un-n A. Toth, Reactor Inspector Date & r on-nl7 /L W. Wagner Pea or Inspector Date // Y$ yo eactor Inspector Date / Consultants: G. Overbeck, Westec G. Morris, Westec M. Eli, Lawrence Livermore National Laboratory R. White, Lawrence Livermore National Laborate ry C. Kimura, Lawrence Livermore National Laboratory S. Bruske, EG&G 8611240191 861107 PDR ADOCK 05000344 G PDR , - . _ _ . - -
>
s Approved By: nlil% S. Richards, Chief, Engineering Section Date Summary: ' Inspection on August'11-22, 1986 (Report No. 50-344/86-23) ~ Areas' Inspected: This announced team inspection of the Trojan Nuclear Plant focused on the operational readiness of the 125 VDC ESF batteries, the service water system and the component cooling water system. The systems and components within the systems were selected on the basia of probabilistic risk assessment data. The systems selected are critical safety systems in that they are required to function for normal safe shutdown of the plant and for mitigation of the consequences of many of the analyzed accidents described in the Final Safety Analysis Report. The inspection specifically emphasized an evaluation of the impact on operational readiness of engineering and maintenance activities conducted since initial plant criticality in December, 1975.
Review of licensee activities covered the following four functional areas: 1.
Plant Engineering and Design Modification 2.
Maintenance and Surveillance 3.
Operations and Training 4.
Quality Assurance The inspection was conducted by eight Region V inspectors, one inspector from the NRC Office of Inspection and Enforcement, and six NRC consultants.
Inspection procedures 30702, 30703, 37700, 37702, 38701, 41701, 42700, 61700, 61701, 61725, 61726, 62700, 62702, 62705, 71707, and 71710 were applicable to this effort.
Inspection Objective: The objective of the team inspection of the Trojan Nuclear Plant was to assess the operational readiness of the above identified systems. To accomplish this objective, the team specifically addressed the following questions: 1.
Is the system capable of performing the safety functions required by its design basis? 2.
Is testing adequate to demonstrate that the system would perform all of the safety functions required? 3.
Is system naintenance adequate to ensure system operability under postulated accident conditions? 4.
Is operater and maintenance technician training adequate to ensure proper opetation and maintenance of the system? 5.
Are human factors considerations relating to the system (e.g., accessibility and labelling of components) and system procedures adequate to ensure proper system operation under normal and accident conditions? i
Dr
v Summary of Significant Inspection Findings: This section summarizes the safety implications of the more significant inspection findings. Detailed inspection findings, pertaining to each of the functional areas evaluated, are included in the detail section of the report.
Engineering Related Findings 1.
The team noted several instances of plant system performance testing which did not adequately confirm the ability of systems to meet design requirements.
a.
Routine battery surveillance testing did not appear to meet the requirements of the plant technical specifications. This is an apparent violation.
Specifically: 1.
The 18 month service test did not load the battery using the ESF equipment load profile, as defined in the safety analysis report.
In particular, the licensee surveillance test loaded the battery for 30 minutes at a constant discharge current of 300 amps, whereas, the discharge current profile is 534 amps for 1 minute, followed by 306 amps for 28 minutes and 321 amps for the final minute.
2.
The 18 month battery service test and the 60 month caoacity test, which were performed at a battery temperature of approximately 90 F, were not properly compensated for temperature. The service test data were not compensated to account for the 50 F minimum battery design temperature specified in the safety analysis report nor was the capacity test compensated to account for the 77 F battery manufacturer's rated temperature.
b.
Several safety related check valves were not included in the licensee implemented inservice test (IST) program as required by technical specifications. This is an apparent violation.
Specifically: 1.
Several safety related check valves associated with the backup nitrogen system to the CCW surge tanks, which are normally out of their required safety position, were not periodically tested to confirm operability.
2.
Several safety related check valves associated with CCW to the cantainment air coolers were not periodically tested to confirm operability.
c.
The licensee had not implemented periodic surveillance testing of pressure regulators associated with the CCW surge tank emergency nitrogen system. These regulators have no instrumentation to allow periodic monitoring of proper pressure setting and discussion with-plant operators indicated that regulator drift problems had been experienced.
If the pressure settings of these regulators are allowed to drift low, adequate CCW system subcooling margins might
I
a not be maintained under postulated accident conditions. This item remains unresolved pending additional licensee action.
2.
The team identified several potentially major safety issues which apparently resulted from poor conduct and control of engineering work.
a.
The licensee used the Updated Safety Analysis Report (USAR) as a source of design input for safety related calculations.
In some instances, the information in the USAR appeared to be in error or it was not being used in the proper context. For example, the USAR included four different values for CCW heat exchanger outlet temperature under postulated accident conditions (ranging from 120 F to 140 F).
Licensee engineers were not able to determine the bases for these numbers and could not confirm that the proper numbers had been used. Two specific areas of concern, identified during the team review, remain unresolved: (1) The containment pressure analysis does not appear to use the most limiting CCW system tempernure in calculating peak containment pressure; and (2) Available design calculations do not appear to confirm the adequacy of pressure and capacity requirements for the CCW surge tank emergency nitrogen system. Although the team's judgement was that the inconsistency in CCW heat exchanger outlet temperature would not have a significant effect on containment pressure, the team felt these issues should be addressed promptly by the licensee. At the team exit interview, the licensee stated that these concerns would be addressed on a priority basis.
b.
Licensee engineering files include a January 1981 calculation which concluded that the design closing time of CCW system interface valves (CV-3287 and CV-3288) is too slow to prevent loss of the CCW system in the instance of a seismic event. No plant modification was initiated to correct this deficiency and no documented resolution of the concern was available. The licensee maintains that assumptions made in the calculation are inappropriately , conservative.
Nonetheless, licensee management failure to ensure a . documented resolution to a significant safety concern is unacceptable performance. The CCW system is required for safe plant shutdown and the adequacy of the system to perform its required function remains unresolved pending additional review of system performance requirements.
c.
The station battery load profile, as defined in the USAR, is based on battery sizing calculations which were performed by Bechtel in 1975. The licensee has not revised these calculations or updated the battery load profile since that date, although several modifications involving the 125 VDC system have been performed.
Although the licensee maintained that the total battery load still remained within the load profile, the licensee did not have any ' corroborating documentation available. The licensee stated that the ability of the batteries to supply their actual loads would be reviewed and reverified on a priority basis.
This item remains unresolved pending additional revie _ _.
. . _ _ - _ _ _ - ___
c.
,- d.
One of.two CCW surge tank relief valves was recently gagged to correct a nitrogen leakage problem..Although the temporary modification was made in accordance with the licensee's administrative procedures, the licensee had not performed.
., calculations to show proper surge tank function with a relief valve gagged, relying instead on engineering judgement. The licensee. _ , committed to document the engineering adequacy of the as modified system.
, e.
Other deficiencies and errors were noted in engineering calculations performed by the licensee in support of design modification activities. The types of deficiencies included math errors, reliance on undocumented engineering judgements', use of incorrect' relationships and lack of justification of simplifying assumption. 3.
The team noted several engineering related problems involving an apparent lack of adequate coordination between the corporate engineering ~ organization and the site. The most significant examples of this problem involved site operating, training and maintenance procedures that did not reflect current design requirements. Specifically: a.
Site surveillance procedures did not reflect the correct battery voltage acceptance criteria following a 1982 battery modification to remove two cells. The specified criteria of 1.75 volts / cell could result in an overall battery voltage of approximately 102 volts, which is less the minimum specified 105 volts required for battery inverter operability. Failure ~of the inverters could result in loss of power to vital 120 VAC busses.
b.
Site operating procedures and training documents identify an incorrect temperature limit-for CCW heat exchanger outlet temperature during post accident conditions. The specified maximum allowable temperature of 140* F is considerably above the maximum design temperatu: e of 120* F to 125* F and could result in CCW . flashing and loss of function of the containment air coolers. The containment air coolers remove heat from containment during design bases accident conditions and thereby limit containment pressure to an allowable value. Furthermore, the specified 140* F is greater than the 120* F maximum temperature assumed for the containment pressure analysis.
c.
Site operating procedures provide for an incorrect setting of the CCW surge tank backup nitrogen system pressure regulators. The procedure specifies a setting of 90 psig for one of the two regulator valves in each train. The system design is based on a minimum setting of 95 psig for both pressure regulators.
Site Operations Related Findings 1.
During a May 1985 service test of battery D-11, the licensee failed to , completely document the results of surveillance testing of the battery as required by technical specifications.
In particular, the licensee failed to record the final 30 minute battery voltage reading following a discharge test of the batter ) . 6' . e 2.
Leakage was noted from several of the SWS booster pump bearing oil sumps.
The team observed that several of the sump oil level indicators were painted over and that the licensee.had not implemented a pump bearing oil monitoring program which adequately trends oil leakage and additions.
-Quality Assurance Related Findings 1.
The QA organization has recently initiated independent review of some design engineering functions. These QA evaluations involved different areas from those considered by the team, however,'the types of findings are similar to those noted by the team. This additional confirmation of.
the team findings emphasizes the need for aggressive licensee action to follow through with implementation of the programs which have been ' identified by the licensee to correct the noted weaknesses.
Results:
Of the areas inspected, four apparent violations of NRC requirements were identified: 1.
Failure to comply with technical specification requirements for
surveillance testing of safety related station batteries.
2.
Failure to comply with station. procedure requirements for . performance of battery surveillance testing.
, 3.
Failure to comply with technical specification requirements for inservice testing of safety related check valves.
4.
Failure-to maintain station operating procedures consistent with plant _ design requirements.
- e $ $
, w - ~ - > - - w-- - -,- - ---- ., - - ~-e s -- ,, e -
" -- - . - - Ar . , DETAILS , 1.
Persons Contacted PGE personnel attending the exit meeting on August 22, 1986 included: W. J. Lindbla', President d B. D. Withers, Vice President, Nuclear W. S. Orser, General Manager, Trojan C. P. Yundt, General Manager, Technical Functions C. A. Olmstead, Manager, Nuclear Quality Assurance P. A. Morton, Engineering Supervisor R. L. Steele, Manager, Nuclear Plant Engineering J. W. Lentsch, Manager, Nuclear Safety and Regulation S. E. Hoag, Manager, Trojan Programs R. E. Fowler, Manager, Mechanical Engineering Branch A. N. Roller, Manager 3 Electrical Engineering Branch M. R. Gandert, Supervising Engineer,. Civil Engineering Branch E. L. Davis, Supervising Engineer, Electrical Engineering Branch G. A. Zimmerman, Manager, Nuclear Regulation Branch C. H. Brown, Manager, QA Operations Branch J. L. Dunlop, Manager, QA Engineering and Support Branch In addition to the individuals identified above. various other engineering, quality assurance, maintenance, and operations personnel and other members of the licensee's staff attended the meeting.
For the NRC, J. M. Taylor of IE-Headquarters, J. B. Martin and J. Crews of Region V, S. A. Varga of NRR, the licensing project manager and the , resident inspectors. attended the exit meeting, in addition to the
- ,
inspection team members.
During the inspection, the inspectors interviewed numerous licensee employees including some of the above individuals at both the Trojan plant site and Portland engineering offices.
2.
Plant Engineering and Design Modification The team reviewed design changes and modifications in the disciplines of mechanical, electrical, and instrumentation and control. This review concentrated on those design changes and modifications that affected: the capability of the component cooling water system to deliver required flow and remove heat, the design adequacy of the emergency nitrogen supply to the CCW surge tanks, the adequacy of instrumentation and control equipment associated with CCW system equipment, and the design adequacy of supporting systems such as the electrical power distribution system.
a.
Design Adequacy of Seismic I/II Interface The CCW system consists of two independent seismic category I flow paths, each of.which serves a single train of identical engineered safety features (ESF) equipment and a single seismic category II . _ _
$P O
(non-safety-related) flow path connected between the two seismic category I paths.
The USAR states that the seismic category II flow path is automatically isolated from the seismic category I portions of the system by a safety injection signal or by a low level in the CCW surge tanks. The intent of this automatic isolation is to ensure that the failure of seismic category II equipment and components does not adversely affect the operation of ESF equipment essential to safe shutdown of the plant. However, the team found design analysis (Calculation No. TM-051, "CCW System Loss of Inventory Following A Seismic Event," Rev. O, 1/26/81) in the licensee's calculation file which concludes that the design of the CCW system is inadequate to protect the system from a seismic event, because the seismic category I/II interface cannot be closed quickly enough to prevent loss of significant CCW system water inventory.
The design analysis concludes that (1) calculation of the total inventory loss is unnecessary, as system failure can be shown to occur from loss of inventory through only one valve prior to valve closure and (2) corrective action has been initiated under a request for design change. However, the team found no design change implemented or initiated, and no documentation in the engineering files as to how this safety concern was resolved. The team noted that the calculation was independently verified and approved by supervisory personnel in accordance with the licensee's procedures.
L;ss of the CCW system following a seismic event could inhibit the ability of the plant to reach a cold shutdown condition.
The licensee indicated that the calculation is too conservative for a number of reasons with varying degrees of significance. The most significant conservatism is the calculation's assumption that the seismic event initiates a complete double ended guillotine rupture of the seismic category II pipe.
Instead, the licensee has indicated that only a moderate energy crack needs to be postulated; therefore, by observation one can conclude that the isolation valves have sufficient time to close to prevent loss of the CCW system. The reasonableness of assuming a moderate energy crack in lieu of a complete loss of non-seismic piping in the absence of additional analyses or documentation demonstrating integrity of the piping and support system requires clarification of the seismic requirements for Trojan. The NRC Office of Nuclear Reactor Regulation has been requested to review the licensing seismic basis for the Trojan plant with regard to the failure mode of moderate energy systems. The inspectors observed that should the plant lose both trains of CCW during a seismic event, the plant would still retain the capability to remove decay heat in the natural circulation mode. The plant would also apparently retain the capability to refill the CCW system, and proceed to cold shutdown conditions using the " swing" CCW pump.
The licensee's failure to satisfactorily resolve in a documented manner an identified, potential safety concern and the apparent use of undocumented engineering judgement in lieu of design analysis is contrary to normally accepted engineering practice. This failure is indicative of a lack of adequate management control of engineering L_
.o'
a , ,
, ..v , ' < , work. This-item remains unresolved pending clarification of the . seismic design requirements for Trojan (86-23-01).
'b. : Design' Analyses or Calcul'ations Not Performed' , ^ The team noted taat several design cont'rol activities did not ensure that design analyses'were performed or existing analyses were revised during the preparation and closcout of modifications.
In some cases, the team noted that the licensee did not refer to the , original or modified. design bases'when preparing and approving a design change and, instead, relied upon undocumented. engineering judgement. The following examples were noted: ,(1) For modification RDC 84-058, no review of.overcurrent . protection.was' performed even though the motor on the valve operator to CCW valve.M0 3294 was changed. The adequacy of the motor overcurrent protection could not be confirmed during the inspection because of~ inconsistent documentation of motor data for this valve. LAu overload relay study performed in 1976 used a value of 1.3 horsepower for'the motor. The latest-motor-operated valve inspection and maintenance data sheet (dated 6/17/85) does indicate that this valve has a 1.3 horsepower motor; however, the routine test data received with the new replacement motor indicates that this motor is only ~ 0.70 horsepower. Because MO 3294 (CCW supply isolation valve to train A reactor coolant pump heat loads) is located inside
Containment, nameplate data could not-be obtained during the inspection to confirm the actual horsepower. This is-an open item (86-23-02).
(2) The-team noted that one of two CCW surge. tank' reserve relief valves had been gagged to correct a' nitrogen leakage problem.
Although this temporary modification was made in accordance-with the licensee's administrative procedures, no design analysis was performed to document the adequacy of continued plant operation with one of two CCW surge tank pressure relief
' valves gagged shut. Interviews with plant personnel indicate that engineering judgement was used in lieu of design analysis-and that this judgement was not documented. Subsequent to the [ inspection, the licensee has indicated that analysis has been ~ performed to document the adequacy of one relief valve to . protect the CCW surge tank from overpressure transients. This
analysis was not reviewed by the team and will remain an open j item (86-23-03).
c.
Errors In Design Analyses Or Calculations t' Weaknesses were identified in the manner in which design analyses were performed. Although only a limited number of calculations were reviewed, the types of deficiencies noted indicates a need for additional management attention to calculations. The types of deficiencies noted included use of an inappropriate source of design input, reliance on undocumented engineering judgements, use of incorrect relationships, lack of. justification for simplifying
. l
- ,,,,. -.,, - - - - _, -,, -, ., - - -. - , -. ...,,.. . _,.. - - - -. - - - - - - -, - - - - - -. - - -., - - - .
- - _ -
' ... , e.
+ .. ,.c .- asskamp'tionsand'mathematicalerrors.Thefollowingexampleswere p , .noted: v j i - !- ~ (1) The safety analysis report was used as a source of design input for required battery load in calculation TE-009. A l ' justification-for using the one minute profile from the USAR was'provided in the calculation instead of referring to the original design calculation. However, the justification only addressed the 'switchgear breaker transient loads in the first ' i minute and assumed the remaining load to be relays and emergency lighting. The justification failed to identify the inverters as the largest steady state load on the batteries and also the most sensitive load to low voltage anticipated during the.first minute inrush. Even though the calculation did not use a conservative load profile, it recommended that the capacity test procedures should be revised to re-define end of life for the station batteries as 1.81. volts / cell and 84 percent' capacity. The basis for tnis conclusion was to limit minimum battery voltage to 105 volts so that circuitry beyond the battery would not have to be examined because the design voltage criteria was not altered. However, these , recommendations were not implemented. During the inspection the licensee committed to revise maintenance procedure MP-1-14 following an analysis of the de system, to address these concerns. This item is discussed further in paragraph 2.d.
(2) The battery sizing calculation uses an FSAR Profile as a design , input. The team traced this profile to a Bechtel Calculation which has not been revised since 1975. The load profile has , not been updated in spite of changes to the de system which could affect the capability of the battery to supply its safety related loads. The licensee maintained that the emergency loads remained within the profile. Although the actual loads may well be within the battery profile, the licensee had no documentation that this had been reviewed by Engineering.
The 125 volt de safety related battery must be able to supply the de system loads. The team reviewed a number of modifications to the de system (including RDC 81-104 and 84-104) and determined that the original load study had not been updated since 1975. This load profile was used as the input for calculation TE-009 to support modification RDC 81-104. The team also questioned the accuracy of some of the - inputs assumed in the 1975 calculation.
Independent calculations performed by the team indicate that the present size battery would be too small to deliver the required load at the 50 degree F design temperature at the defined end of life (i.e. 80% capacity) without the battery voltage dropping below 105 volts. This conclusion was confirmed by the post modification test to the original profile performed following , the RDC 81-104 modification.
Between the time the Trojan batteries were purchased and the time of the 1981 calculations, the battery manufacturer raised . g--- - ~ m- , - -, y c
n - - + - - - -
,.
.. E
p.: the published ratings on his KCU cells (catalog section 12-203) based upon actual-test performance. The cells with these new
ratings were renamed KC cells and given a new catalog number section number (12-315). There were no physical changes to the cells. These new ratings effectively showed that cells that previously, by calculation, would have discharged to 1.75 Volts would actually only discharge to 1.80 Volts. However, even using these new higher manufacturer's ratings, an independent - calculation by the team indicated that, with a revised load.
profile and maintaining the battery above 70% F, less than 5% margin for age degradation would remain to limit.the discharge - voltage to 1.81 volts per cell (105 volts on a 58 cell battery). As discussed in paragraph 2.d, the batteries are still at almost.100% capacity. Additionally, the team did observe that the battery rooms are automatically maintained > 'above a minimum temperature of 65*F and have a control room alarm for low temperature, thereby providing assurance that the batteries were capable of supplying their accident loads. Thia item' remains unresolved pending additional review of the effect of plant modifications on battery sizing calculations (86-23-04).
(3) Modification package RDC 84-104 contained a calculation to establish the terminal voltage at new dc motor-operated valves.
. The calculation concluded that the terminal voltage would be less than the motor-operator guaranteed minimum voltage. The results of the voltage drop calculation was used as the basis for the exchange of design interface information between the licensee and manufacturer to confirm the acceptability of the low starting voltage. This calculation did not include the , series windings of the de reversible motor. This error adds - 340 feet to the length of the cable run and results in a voltage drop approximately 40 percent higher than that calculated. LAs a consequence,'the actual starting voltage could drop to a value almost 14 percent lower than that identified to the manufacturer and 28 percent lower than the guaranteed starting voltage. Although the actual starting voltage is lower than that guaranteed, this does not appear to be a hardware problem because the manufacturer provided an operator rated at a significantly higher capacity than that required (i.e., required torque is 0.58 ft-lbs while the operator is rated.at 2 ft-lbs at nominal voltage). While the ' identified error may not require the modification of hardware, it demonstrates inadequate design verification and contributed to the team's concern with respect to the implementation of the design verification process.
(4) Analysis by the licensee in calculation TE-009 identified i " non-conservative values in the technical specification requirements, which do not reflect current industry practice
' but recommendations to revise the technical specification were not incorporated.
Specifically:
y
s t y 4 + -es~ ,,,,,,w-1-y.,,-,-
- ,c---
p ,4-- cew,-w-..: , -,-n.
- ,,w nr- - - -, - - + ,w.,, , -. _ -,,, - -, -, -,-,,,.-,m,~ - _, - - - - - - - - - - ,-
, - ~ . n. . - _ .. - . - _ " n .. .6 .,: , , - , - (a) The average specific gravity of a battery cell'should be
between.1.200 and-1.220. Specific gravity, under' normal . float conditions, corrected for temperature and level, , . that is.less than that value recorded at the acceptance test,~ -indicates. loss of capacity..The capacity of a-battery falls off at the approximate rate of.2 to-3% for each 10 points (0.010) of specific gravity. The Trojan - batteries should have a nominal specific gravity'of 1.210 atl100% capacity..The. Trojan technical specifications on the weekly pilot cell surveillance and the individual cell quarterly.urveillance accept a specific gravity reading of 1.190 for all~the cells equivalent to a loss of capacity of approximately 5%. While industry standards that are in use today (IEEE-450) accept specific gravity-variations, it is. common to require an equalize charge when average specific gravity has dropped by:10 points.
Today's industry standards for sizing batteries (IEEE-485)' ' account for capacity. loss because of maintenance by including a design margin factor in the calculation.
. ' i . (b) The battery float voltage for a lead calcium cell should be maintained between 2.20 to 2.25 Volts per. cell. The minimum float voltage given in the manufacturer's operation manual is 2.17 Volts per cell. This equates to 125.8 Volts for a 58 cell battery. _ An individual cell float voltage of less than 2.07 volts indicates a cell problem which requires immediate attention. The Trojan technical specifications on the weekly pilot cell . surveillance and the individual cell quarterly j surveillance accept a cell voltage' of 2.00 and an overall battery. voltage of 113 volts. _The manufacturer's operation instructions state that'an equalize charge should be given if any cell falls below 2.13 Volts..This equates to 123.5 Volts on a 58 cell battery, only 2.3 , Volts below the' manufacturer's minimum float' voltage.
(c) The technical specification states'that specific gravity readings should be. corrected to a standard temperature of~
77 degrees F.
No limit is placed on minimum or maximum electrolyte temperature. The specification also requires , l' that the electrolyte level be between the minimum and l maximum level indication marks. The battery maintenance.
procedure MP-1-14, section II.a.10, notes that specific l gravity hydrometer readings.are uncorrected for l temperature or level.
Instructions are included for l temperature correction but no instructions are included for level correction. The level indication marks.are one ' inch apart. This equates to approximately 30 points , (.030) potential error in-uncorrected sp=cific gravity readings, because specific gravity reads higher with decreasing level. This is a significant difference compared to a correction of only 1 point (.001) for each 3
degrees F.
The technical specification and the .
% l
_ ____,_ . . ?-. . . . - . . _., _, _. _ - - - -. _ _,, _ _ _ _.. -, -, -.. _. _ _ _. _ _ _ _,
,_ r.- ,
, . * - , maintenance procedure should be corrected to include a - level compensation for specific gravity.
The licensee stated that they would review this area for adequacy.
,This~ item remains unresolved pending completion of licensee review and determination of needed changes (86-23-05).
(5) Design change RDC 83-019 modified the CCW isolation valve control circuits to actuate upon receipt of Phase B containment , isolation signal (CIS) or Phase A CIS coincident with a low CCW surge tank level. The modification package concluded that the cooling capabilities of the CACS (Containment Air Cooling System) under DBA conditions would not be affected based upon the results of calculations TNP-83-62.and TNP-83-78. These analyses contained numerous errors which should have been detected during implementation of the design checking and verification process. The following are examples of these errors, by calculation: Calculation TNP-83-62 (a) Assumes that CCW flow can be partitioned to heat loads based upon the flow rates stated in the USAR.
Justification for this simplifying assumption was not provided.
(b) In assessing the effect on air cooler pressure drop, the calculation did not consider the pressure drop through the CCW supply header piping and elbows inside containment to the CACS coolers. This omission results in a non-conservative value for the pressure at the discharge of the CACS coolers.
If the pressure drop had been included the pressure at the discharge of the CACS coolers would not have met the stated objective of the calculation.
Calculation TNP-83-78 , (a) The pressure at the discharge of the CACS coolers depends, in part, upon the amount of nitrogen overpressure maintained at the CCW surge tank. The calculation does not address this system characteristic.
Instead, the calculation implicitly assumes that the nitrogen overpressure at the time the test data was collected is equal to the overpressure expected following a DBA.
Nitrogen overpressure during normal operation can vary between 105 psig (setpoint of nitrogen supply a self-regulating pressure control valve) and 125 psig , (setpoint of nitrogen relief self-regulating pressure control valve). During DBA conditions, the normal source of nitrogen may be lost and an emergency supply of nitrogen is supplied at 95 psig. Therefore, the nitrogen
_ .. . _ _ _ _ . , m r, -8 +- . ' overpressure during a plant temporary test may be 'quite different from that experienced during a DBA. The failure to record the overpressure condition at the time of the test (see Observation 3.1.4) and to compensate the calculation's conclusion based upon worst expected overpressure, appears to invalidate the calculation's conclusions.
. Test data recorded indicates that pressures as low as 12 . psig were measured at the outlet of the CACS cooler.
If the nitrogen overpressure at the time of the test was greater than 108.7 psig, then one could conclude that the test would predict flashing at the discharge of the cooler.
(b) The friction factors at various flow rates are incorrectly determined from the Moody curves for friction factors for pipe flow. The incorrect friction factor underestimates the pressure drop by approximately 20 percent.
(c) In calculating the Reynold's-number, the fluid velocity in the pipe in ft/sec was calculated incorrectly.
(d) Although plant test data was used to extrapolate conclusions concerning DBA conditions, the calculation ' inconsistently handles the effects of temperature on viscosity and density correction.
(e) 'In calculating the pressure drop through the CACS coolers, an incorrect effective cross-sectional area of the coolers was used to determine fluid velocity and Reynold's number.
Temporary plant testing was performed to demonstrate that the CCW system will remain within design limits stated in the safety analysis report following completion of modification RDC-83-019. This testing was determined to be weak-in that the design intent was not verified. This modification altered the control logic of CCW isolation valves associated with the reactor coolant pumps to permit continued operation of these pumps under certain accident conditions. As a result of this , modification, isolation of these valves will now occur as a result of a Hi-Hi Containment pressure or any safety injection , signal coincident with a low CCW surge tank level. Test TPT-20 was performed to confirm that the addition of the non-safety-related reactor coolant pump heat loads did not adversely affect the safety-related function of the system for accident conditions. The test acceptance criteria was based upon quantitative values against which the success or failure of test activity could not be judged. The quantitative values selected were based upon conditions which could only exist ' following a design basis event with multiple component failures, and the acceptance criteria was not correlated to the test condition. For example, the acceptance criteria specified that containment air cooling system (CACS) cooler outlet I
t --. --. - -,. - - , - _. -. -. + , - - - -. - - - - - --,~ .--. -- , , .
c; - , ,, _ , '
-
" ,
.l
, pressure be greater than or equal to 27 psig and that cooler outlet temperature not exceed saturation temperature for that pressure; This pressure does not reflect the pressure expected i to be" experienced following a design basis event (i.e., single train' operation, CCW heat exchanger outlet temperature of 123 degrees F, surge tank overpressure at 90 psig).
In addition, the test procedure did not require that the.value ' of CCW surge tank nitrogen overpressure be recorded,-even though the pressure at the discharge of the CACS coolers depends, in part, upon the amount of nitrogen overpressure in - the CCW surge tanks. Per the test procedure, the nitrogen overpressure was supplied by the normal. nitrogen supply instead of the safety-related emergency supply. The pressure.
acceptance criterion was not correlated to reflect that. nitrogen overpressure during normal operation can vary between . 105 psig and 125 psig, while the. emergency supply of nitrogen is supplied at 95 psig.plus or minus 5 psig. Other weakness were also noted including (1) failure to confirm that the worst system configuration was usedsto arrive at the lowest pressure at the most distant CACS cooler, (2) 'se of flow instruments u without sufficient range, and (3) incorrect guidance for balancing CCW system flow.
This item remains unresolved pending completion of licensee review of the adequacy of the CCW surge tank backup nitrogen system to perform its intended function-(86-23-06).
With the possible exception of the calculation performed for modification RDC 83-019, it appeared that the errors identified above did not adversely affect the design of installed hardware but could have affected the assumed design margin. The team's judgement was that sufficient design margin exists, such that appropriately performed calculations would confirm the' adequacy of the design. The licensee agreed to promptly. address the team's concerns. ANSI N45.2.11 requires that design analyses be performed in a controlled and correct manner. This requires that analyses ontain sufficient detail as to purpose,- method, assumptions, oesign input, references and units so that a person technically qualified in the subject can review and understand the analyses and verify the adequacy of the results without recourse to the originator.
ANSI N45.2.11 also requires that design analyses be verified to confirm or substantiate adequacy.
The above discussed findings indicate a significant weakness 2r the licensee's performance of design activities.
d.
DC Fastem Minimum Voltage The safety related inverters are provided with two sources of power.
The 480 volt ac system supplies the rectifier input while the de system provides the backup cource. The original plant design consisted ~of two 60 cell safety-related batteries. The operation of the batteries with 60 cells required that the equalize charge be
r ..
- -
- s given at a voltage approaching 140 volts dc.
This, in turn, required.thattherectifie;dacsupplyforthesafety-related inverters be, maintained above that,value, so that.the inverter would not become.a~ load on the de system during periods of the equalizing . charge.< This normally.high rectified voltage resulted in burnout . problems with the inverter components. The licensee modified the batteries-(RDC 81-104) by removing 2 cells from the 60 cell batteriesiin order to reduce the required maximum equalizing voltage land:~thus penmit reduction of the rectified ac. input to the inverter.
The licensee did-not recognize the effect a lower system minimum ^ voltagetwould have on all~ connected de equipment and failed to adjust the permissible cell discharge voltage from 1.75 volts per cell (equivalentLto 105 volts on.a 60 cell battery) to 1.81 volts per cell in~ order to maintain a' minimum 105 volts with the 58 cell batteries. Instead the battery is presently permitted to discharge to 101.5 volts-(1.75 volts per cell as stated in the safety analysis report, on a 58 cell battery). Operation of the de system below 105 volts may result in degraded operation or loss of some safety-related de loads.
As the input voltage to an inverter drops, it will draw more current in an attempt to maintain the output voltage. The instruction and operating manual for the safety related NSSS instrument inverters specifies an operating range of 105 to 140 volts dc.
This same document states that operation outside this range will result in the t clearing of the semicenductor fuses.
. - Calculation TE-009 was performed to support the battery modification.
In response to the calculation checker's comments, the preparer acknowledged that 105 volts is the system minimum design voltage. The calculation recommendations also states that the battery end of life should be redefined to maintain this as the minimum voltage. However, this recommendation was never implemented leaving the permissible minimum cell voltage at 1.75 volts (i.e., 101.5 volts across the battery).
The licensee's 60 month performance tests run in 1985, show that the batteries have almost 100% capacity and their operating history to date has shown that the battery temperature has not-dropped 'oelow 60 degrees F and is normally above 70 degrees F.
A battery discharge under these conditions should not result in the battery volta e dropping below 105 volts. This instead, appears to be more of an example of inadequate communication between engineering and operations.
The team noted that 1985 performance test on the 13 year old batteries still showed a capacity greater than=the 1970 manufacturer's published data contained in the battery technical manual. The team pursued this with the manufacturer who stated that the KCU cell, similar to those at Trojan, were very conservatively , rated at the time of shipment. By 1980 those cells were more accurately rated and renamed KC without any physical changes to the.
. cell. Based upon the latest manufacturer's test data for the size
. - _. .. . ..- _ -. . . _. ,.
, , ' i,. " '
,, ; ~ - . " ., .
.
, and type cells installed at Trojan, the 8 hour performance test at 90 Amperes should result in in individual cell voltage of 1.80 volts (not the 1.75 volts used as the Trojan acceptance' criteria) to ' equate to 100% capacity.
.- Failure to revise battery surveillance procedures to account for reduced voltage following modification RDC-81-104 is an ap' parent violation (86-23-07).
e.
Improper Use of Plant Configuration Change The inspectors reviewed a sample of design change evaluations in the licensee's engineering office in Portland, Oregon. The engineering department utilizes a Plant Configuration Change (PCC) to make minor changes to the plant configuration provided the change does not - affect the. performance or function of a component, and is not ' safety-related. The team reviewed the PCC Index to assure that . changes did not involve safety-related work which must be performed under Request ~for Design Change.(RDC) procedures.
PCC No. E 85-511 was questioned because it allowed two nonsafety-related fans to be installed on safety-related Post Accident Monitoring Instrumentation (PAMI) panels. These panels contain the reactor vessel level indicator and the subcooling margin monitor. Since.the operation of these instruments depends upon the cooling effect supplied by the fans, the concern is that the fans were not classified as safety-related thereby receiving the proper engineering review and evaluation under RDC procedures.
A. review of the performance records for these instruments revealed a higher failure rate after the fans were installed; which indicates that the corrective actions taken to prevent the instruments from overheating was inadequate.
The modification of the safety-related PAMI panels to correct the overheating problem remains open pending additional follow-up (86-23-08).
3.
Maintenance and Surveillance ! l.
The team reviewed the testing associated with assuring functional ! performance of.the service water system, the component cooling water (CCW) system and the 125 volt DC system.
In particular, the team sought l to determine that system components had been adequately tested to L demonstrate that they could perform their safety functions under all . conditions.
. l l a.
Battery Discharge Testing Battery service tests are performed to demonstrate that the existing battery has sufficient capacity remaining to provide the emergency loads for the committed time-duration at the minimum design-temperature. The Trojan battery service test, as detailed in plant battery maintenance procedure, MP-1-14, fails to provide this assurance because: the test does not use a discharge profile to
include the critical transient loads; the test procedure fails to compensate'the test current value to account for the extra capacity required to power the loads at the minimum design temperature; and ^ , <A
-
r ,, ,
,
- e t
, the test procedure does not credit the battery for any additional l capacity it may exhibit because of test temperatures above the
- manufacturer's rating at 77 degrees F.
Also no pass / fail acceptance criteria is presented for the critical part of the test which attempts to demonstrate sufficient. capacity. Failure to adequately perform'the battery. surveillance as required by plant technical specifications is an apparent violation (86-23-09).
. The USAR profile consists of a 28 minute constant current 306 amps ' discharge preceded and followed by one minute peaks of 554 and 321 ,. amps, respectively. Temperature compensation would increase this profile by 19% giving-a first minute peak of 659 amps if the battery was tested at its rated temperature.
If the temperature of the battery is 90 degrees F, as it has been for some surveillance tests, then the test profile should also be increased by another 6% to compensate for the a'dditional capacity the cells will exhibit at ' temperatures above 77 degrees F.
This compensation to the required USAR profile was included in Temporary Test Procedure TPT-55 following the installation of modification RDC 81-104.
A similar problem exists with the 60 month performance test MP-1-14, in that the constant curre'at 8 hour discharge test is not compensated.for electrolyte temperatures above 77 degrees F.
Cell temperature above the manufacturers rating effectively' adds capacity to the battery. The purpose of the performance test is to verify that the battery can still deliver 80% of the manufacturer's rating.
before any cell ~ drops below the cell voltage corresponding to the - discharge rate and time: The team noted that the licensee's procedure stops.the test at the end-of 8 hours even if no cell has reached its rated minimum. voltage. While this may be sufficient to determine that the battery has at least the minimum capacity, and ' meets the technical specification requirements, it is not sufficient to accurately trend the loss of capacity.from one test to the next test 5 years later.
Licensee' procedure MP-1-14 describes the requirements for ' j.
performance of periodic battery service testing.
In section !. III.c.3, step j, the procedure requires that the battery voltage at [ the end of the 30 minute discharge be recorded. This is the most j-significant data recorded by the procedure, since this value- - ! represents the acceptance criteria on which battery operability is-l based. When this test was performed in May 1985, the final-30 minute voltage reading was not recorded for battery D-11.
While ' there is no indication that the battery failed the test, the i licensee's failure to document the test results as required by
procedure is an apparent violation (86-23-10).
! f b.
Periodic Testing for Emergency Nitrogen Supply System Weaknesses-were noted with the licensee's periodic testing for the nitrogen bottle backup system associated with the CCW surge tanks.
Nitrogen is supplied during normal and accident conditions to maintain system pressures above saturation conditions at the outlet of the containment air coolers. The nitrogen overpressure is l ! ? l ,. - -, -,. ,. - - -. - - - -. --. ..---,--. - - - - -- -. - - - - - - -. - - - - - -,. -. - - - - -
a,-
.- .A -. ' applied-to the CCW' surge tanks through self-regulating pressure , control valves. Because the normal nitrogen supply is not-safety-related and is not designed to withstand seismic loadings, an ' emergency supply of' bottled nitrogen is provided.
Pressure regulation by the emergency nitrogen system during simulated accident conditions was not demonstrated. Calculations were not available to demonstrate that the emergency nitrogen system had sufficient' capacity at, reduced bottle pressure to maintain CCW system overpressure.durir.g! accident conditions. -Additionally, the licensee had not implemented a periodic surveillance test program . for: the self-regulating pressure control _ valves associated.with the '< emergency nitrogen system -and was conducting no periodic testing of '- their performance. These regulators have no instrumentation to allow periodic monitoring of proper pressure setting. Discussions /with plant' operators indicate that regulator drift problems have - been experienced. The periodic testing of these backup nitrogen systems and the adequacy of the system capacity remains unresolved pending completion of the licensee's review of the CCW surge tank backup nitrogen system (86-23-11).
Mot'or-O'perated Valves (MOV) c.
Four Limitorque MOV Actuators were inspected, all of which were exempt from equipment qualification (EQ) 10 CFR 50.49 requirements.
The following observations were made: 1) M0 FCV 610 (West RHR Puinp A, Mini-flow, Recirc) had a= wire-splice covered by electrical. tape. One of the wires was.from bundle #AB 2509D and had white insulation with a black stripe.
The other wire in the splice was smaller diameter -heater wire with blue insulation.
2) MO 8700A (West RHR Pump A, Suction Isolation) had two field-run wires clipped off, with no heat shrink tubing on the ends. The wires were from bundle #AB2112J; one wire with red insulation and one with green.
3) M0 2052A -("A" Train Containment Spray Recirculation Sump suction valve) had one wire with damaged insulation that was covered with electrical tape. Trojan Event Report #86-098 was written on 8/18/86 as a result of the NRC inspection of this.- valve actuator. The Event Report recommended permanent corrective action to " add instructions to the MP (Maintenance Procedure) for MOV inspections to specifically inspect for electrical tape."
While the'above observations did not appear to adversely effect the operability of these valves, the licensee would be prudent to prescribe repairs in a proceduralized manner. Trojan Maintenance Procedure MP-12-5 " Valve Motor Operators" did not have any instructions for specifically looking for and repairing occurrences of improper splices and terminations or presence of electrical tape at those locations. This is an open item (86-23-12).
- < ,, f
6 . r The licensee's maintenance program for MOVs was reviewed.
Maintenance Procedure (MP) 12-5, " Valve Motor Operator," Revision 17, was used by electrical maintenance technicians to inspect and adjust limit and torque switches. This procedure appeared to provide an adequate level of detailed guidance for limit switch adj ustments. The licensee's program for upgrading the current practices regarding establishing, testing, and maintaining MOV torque switch setpoints was reviewed. This program was established as required by IE Bulletin 85-03. Although the documents reviewed were general in nature and lacked specific details regarding actual implementation, the overall scope of intent appeared to be adequate to remedy the weaknesses identified by the team. The team noted that the projected schedule for completing corrective actions extended to the end of 1987. Licensee management representatives.were urged during the exit meeting to consider prioritizing their approach so that the MOVs that would experience the highest operating torques during-sn accident would have their torque switch setpoints verified as soon as possible.
d.
Safety-grade Classification of Instrumentation The team reviewed safety-related classification of equipment and the methods for determining proper classifications of equipment. The Q-List was the principle document used for determining safety-related classifications. However, the Q-List was very general and did not always provide sufficient detail to permit classification of equipment.
For example, instrumentation such as transmitters and switches were not included on the Q-List except under the general category of instrumentation. As a consequence, other documents such as the Technical Specification Equipment List, the Inst rument Index, and the Piping and Instrumentation Diagrams (P& ids) contained indications of safety classification. For example, the P& ids used a hexagon symbol to indicate a Q-instrument which must function following a safe shutdown earthquake. A double circle is used to indicate Q-instruments which must retain its pressure boundary integrity following a safe shutdown earthquake, while a single circle to indicate non Q-instruments. The team found errors on the CCW system P&ID. The following examples illustrate some of those errors.
(1) Pressure control valves PCV 3388, PCV 3389, PCV 3395 and PCV 3396 are identified as Q-instruments which must retain their pressure boundary integrity following a safe shutdown earthquake. However, these valves are the self-regulating pressure control valves between the seismically qualified emergency nitrogen supply and the seismically qualified CCW surge tanks.
If the non seismic, normal nitrogen supply is lost following an earthquake, these pressure control valves must remain functional.
(2) Motor-operated valves MO 3210A and MO 3210B are identified as Q-instrument which must retain their pressure boundary
. . -, -. -.. '. ~ '15 ,. . . . ' integrity following a' safe shutdown earthquake. The ' handswitches for these valves are indicated as non ~ Q-instruments.,However, these valves are the CCW supply isolat. ion valves for the residual heat removal heat exchangers, ' and the operator must open these valves to provide a decay heat.
removal path for cooldown.
(3) Solenoid valves SV 3715A and SV 3715B are identified as Q-instrument:which must retain their pressure boundary integrity following a safe shutdown earthquake. However, these valves.are solenoids which operate normally open tell tale drain isolation valves downstream of the safety-related CCW makeup pumps. The solenoids must operate to shut the drain isolation valve or CCW makeup flow will be diverted.
The team considers.the methods for determining the safety classification to be a weakness. ' Contributing to this concern was , the various documents containing safety classification information without procedures or instructions on how and by whom these-determinations are to be made if a safety classification is unclear.
. ~ l _ Interviews at the plant suggest that safety classifications are based on an individual's knowledge of the system function and ! engineering judgement.
There does not appear to be a program to. track the safety classification of the various instruments at Trojan. This has resulted in some instruments being tested as nonsafety-grade instruments when they should be tested as safety grade instruments (Level sensors LS 3211, LS 3212, LS 3376, LS 3377, LS 3387, and LS 3394 and pressure differential sensors PDIS 3704A and PDIS 3704B).
This does not appear to be a serious problem because even the non-safety grade instruments are treated as quality components in so far as maintenance and procurement are concerned. The only difference in so far as safety-grade versus nonsafety-grade , instruments are treated appears to be in the area of surveillance frequency.
Safety grade instruments are checked every two years as compared to three years for nonsafety grade instruments. A program to track the safety classification of the various instruments at Trojan would be useful. This item remains open pending licensee action to correct the identified deficiencies (86-23-13).
e.
Inservice Testing Program The inspectors examined the licensee's implementation of NRC surveillance requirements applicable to safety-related pumps and valves included in the Service Water and Component Cooling Water Systems..These basic requirements are set forth in 10 CFR-50.55a(g)(4)(i), and are specifically applied to the facility in Technical Specification 4.0.5. The substance of the requirement is that inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with Section XI of the ASME Boiler and Pressure Vessel Code.
, , n + -
m - f; 4.
'
i Based on discussions with licensee representatives, and review of the facility Updated Final Safety Analysis Report and Inservice Testing (IST) Program for Pumps and Valves, the inspectors determined that the ASME Code Classes 1, 2 and 3, correspond to the licensee's Quality Groups 1, 2 and 3.
The inspectors reviewed
selected portions of the~ Service Water (SW) and Component Cooling ' Water'(CCW) Systems falling within the Quality Group 1, 2 and 3 , classification, as shown in facility drawings, to verify the required valves were included in the licensee's IST Program ~ '(Inservice Testing Program for Pumps and Valves, PGE-1022, Amendment ~ This limited review identified several valves 3, November, 1985).
~ that were not included in the licensee's Program. The review also indicated the valves were not exempt from the Program (pursuant to ' .the provisions of paragraph IWV-1200 of Section XI), nor was there evidence the NRC granted < relief from the testing requirements for , these valves (pursuant'to 10 CFR 50.55a(g)(6)(i)). The valves identified by this review are listed below.
' 1"-GBD-26 CK (2) N supply to CCW Surge Tank Class I/II '
interface valves 1/2"-CBD-5 CK (2) N Bottle Supply to CCW Surge Tank
check valves (numbers'not known) Containment Air Cooler Vent / Check Valves Based on the licensee's failure to include the above-listed valves in the facility IST Program, it appears these valves have not been tested in accordance with the requirements of ASME Section XI.
Failure to test these valves in accordance with Code requirements is an apparent violation of regulatory requirements.
(86-23-14) The inspectors reviewed recent Inservice Testing results for Service Water Pumps P-108A, B and C, and Service Water Booster Pumps, P-148A, B, C & D.
These reviews indicated the pump test procedures satisfactorily conformed to Code requirements (and relief granted by the NRC for pumps P-108A, B & C) and the testing had been conducted in accordance with these procedures.
Review of the results generated by the above tests revealed some instances where the measured pump performance was less than that specified in the FSAR, however, still within the IST requirements. This occurred in the case of SW Pumps P-108A&B and all of the SW Booster Pumps.
l Regarding the SW Pumps, the data suggest the reduced performance is } due to wear.
It also appears that, faced with similar observations, the licensee (in August 1985) adopted more restrictive acceptance criteria for the " Alert" and " Required Action Ranges" applied to IST results and initiated actions to replace the impellers on all of the SW Pumps. At the time of the inspection, a new impeller had already been installed on Pump P-108C (March 1986). The new impeller is believed to be the reason the performance of Pump P-108C showed good agreement with the manufacturer's pump curve and the FSAR. The ' licensee plans to replace the impellers on the A&B pumps by the end of 1986.
I
ff[[ - s ' . - y ~ ,_ ~ , g
' r; ,- , ,t
, N c, - , . ,,;. ~ ~ , , O As for the interim performance of SW Pumps P 108A&B, the inspectors - * " reviewed a licensee analysis which was used to establish the more x . restrictive acceptance criteria for these pumps, reviewed the: cooling loads required to be. served in the event of an accident, and 4 discussed.with licensee representatives' operating experience with - - the SW System under normal and abnormal operating conditions.
Based
on.these reviews ~and discussions,.the inspectors concluded that the .' present pump performa'nce is ' acceptable and that the licensee is - ' taking action to ensure long term performance remains acceptable.
Regarding the SW Booster Pumps, the inspectors determined these pumps generally perform within the acceptance limits established for
the IST Program. The inspectors also determined,' however, the acceptance liraits for the pumps are based on the manufacturer's measured pump characteristics curve, not the curves shown in the current version of the Updated FSAR.' In addition, the manufacturer's curves show a lower pump capability than' that shown in the FSAR, e.g. a shutoff head of about 165 feet of water versus an FSAR value of 180 feet. At maximum flow (2800 gpm at 106 feet of water - FSAR Table 9.2-3), however, it, appears the measured data would be reasonably close to the FSAR values.
In addition, this is close to the maximum flow required from the SW Booster pumps in the event'of ESF actuation or Loading of the Emergency Diesel Generators (2699 gpm - FSAR Table 9.2-1).
The inspectors also discussed this matter.with a licensee representative. This individual stated the licensee uses a computer program that conservatively models the SW system and is based on the pump manufacturer's curves. The individual added this program also predicts adequate performance of the SW. System under accident conditions. Based on the foregoing, the inspectors concluded the SW booster pumps are demonstrating adequate. performance.
The inspectors noted that the CCW makeup pumps do not appear to be included in the licensee IST. program. These Seismic Category I pumps are provided with a Seismic Category I makeup water supply so that water levels can.be maintained in the CCW system as necessary to, provide the design basis cooling capability. The need for such makeup may arise from existing system leakage or from leakage across isolation valves installed between Class I and Class II systems..It is noted the acceptable leakage rate across such isolation valves in the CCW System is directly related to the capacity of the CCW Makeup Pumps. This item was discussed with a licensee representative, however, he stated that these pumps are not required to shut the-reactor down to the cold shutdown condition or to mitigate the consequences of an accident, and thus were not subject to Section X1 (Section IWP-1100 and IWV-1100).
This item remains unresolved pending additional review (86-23-15).
f.
Chemistry Control of Component Coo' ling System The licensee found high chloride content (1.0 - 1.5 ppm) in the component cooling water system, as a result of using improved analysis methods for coolant chemistry. The licensee determined
b ' ... ' , , -
& . . . , jhattheCCWsys'temwas'likelyoperatedbetween1975and1986'with ~ unknown: chloride +1evels under the belief that analytical test results of 0.15 ppe. chlorides'were accurate..As of July 31, 1986 i the licensee has not been able to assess the potential stress .
corrosion' damage to stainless steel. safety-related portions of the ' ~CCW system,.e;g..RHR heat: exchanger, letdown heat exchanger, reactor coolant pump thermal barriers.
, The origin of the chlorides appeared to be the corrosion inhibitor used in Trojan's CCW system. The fact that this material was high in chloride content.was-apparently known by the licensee technical staff as earlylas 1976, when a decision was made to use this nitrite-sillicate based material in lieu of the Westinghouse recommended chromate based inhibitor.
(The licensee had agreed on May 2,1972 to not use chromates at the ~ Trojan plant, in view of potential unacceptable discharges to-the environment)..The high . chloride content was apparently not quantified and evaluated due to the belief that analytical techniques were sufficient to measure concentrations of chlorides diluted in the CCW system after additions of the material.
Purchase orders assigned a non-quality class to procurements of the material (e.'g; P.O. N-32359 dated 5/15/86) and did not specify maximum chloride content nor requirements for material certifications. 'In'Mid-1986 the licensee-replaced the inhibitor with a new material believed to be free of-chlorides. This was done via CCW feed and bleed over a two month period.
The licensee prepared an internal event report (86-067) which defines the problem and its history, and includes an evaluation for reportability to NRC, concluding that the event is not reportable on the basis that it is a'"non-technical specification item".
This item remains open pending further' review (86-23-16).
4.
Operations and Training In the area of operations, the inspection team evaluated the adequacy of - shift manning; control of work and operations; operating, emergency operating, and off-normal operating procedures;' operator familiarity with ! the physical location of various electrical and mechanical components; equipment operation in abnormal situations; routine system status.
. ! verification; and operator training.- This evaluation focused on'how each of these elements interfaced with operation of the CCW and service water.
' systems under various normal and abnormal conditions.
a.
Operations Weaknesses ! A review and walkthrough was conducted of the normal operating and j emergency procedures for the CCW system..The following significant weaknesses were identified: '
(1) Operating Instruction OI-4-2, " Component Cooling Water," ' Revision 10, dated 6/29/86, page 9, step 8.0 cautioned the operator to not allow the CCW heat exchanger outlet temperature
on the CCW side to exceed 140 degrees F.
Since the Containment f l s . _ - ~ - -. ..,.., _. +. _.
. .,,,... .,v - - - .. .
.. .~ e.
'
./' pressure analysis was based upon 120 degrees F and flashing at.
the outlet of the CACS coolers may occur if the CCW outlet ~ temperature approaches 140 degrees F.under DBA conditions, the caution misleads the. operator. A similar concern ~was ' identified with Off-Normal Instruction ONI-14, " Loss Of Component Cooling Water," Revision 0,. step II.E.3.
Upon loss of'one CCW pump with both trains in service, the operator is ' directed to monitor CCW heat exchanger inlet temperatures and valve out any,non-essential loads as; required to maintain CCW -, less than 140 degrees F.
This subsequent action appears to be incorrect and.is misleading. The temperature of interest is the_CCW outlet. temperature not the inlet temperature.
- ttaintaining 140 degrees F inlet temperature does not guarantee that CCW heat exchanger outlet temperature will be maintained
,below that'value used as a design basis.
' These errors could have an adverse affect on the operator's
' i o.- ability to h'andle accident conditions. Specifically, his , training and procedures would lead him to believe that CCW heat exchanger outlet temperatures of up to 140 degrees F are ' acceptable. This. incorrect information may prevent the- . operator from~taking timely corrective action or from ' recognizing the potential consequence of_too high a CCW temperature at the outlet of the CACS air coolers.
(2) Operating Instruction 0I-4-2, " Component Cooling Water," Revision 10, dated 6/29/86, page 4 through 6, steps I.C.27.0, I.C.28.0, I.C.33.0 and I.C.34.0 require the adjustment of the emergency nitrogen regulators at 90 psig and 100 psig. These values are contrary to the setpoints per the instrument index.
It appears that when the regulator setpoints were revised to 95 psig by modification RDC 76-068(M)-the operating instruction was not' revised.
The above items are an apparent violation (86-23-17).
'Several other weaknesses were noted: (1) -Administrative Order A0-3-13, " Control of Locked Valves and ESF Equipment," Rev. 33, page 8 identifies the normal position for . . residual heat removal heat exchanger A and B CCW outlet valves, CC-213 and CC-214, as locked " throttled for approximately 5,000 gpm flow (see Table 9.2-9 of FSAR)." Discussion with plant operators indicate flow indication is used to establish the , throttle position, as suggested by the locked valve list, instead of actual throttle settings established by Preoperation Test Procedure PTP 16, " Component Cooling Water System," dated 11/18/75. The failure to use actual throttle settings (i.e., turns open) could result in an incorrect throttle position.
Good practice suggest that the throttle position be set in accordance with preoperational test results and then confirmed by available flow indicatio N ~ Y y -
,. ,- p % . b
'~ (2) LA walkthrough of' the operating procedure for switchover of ~the ". ,. low pressure -injection systen (injection to recirculation) was performed with a licensed operator, , , ' u , ' Valves which were required to be operated if a service water ' > " pump failed were not readily accessible.
In order to operate.
. , the lube water supply valves for the' service water pumps,.the - . ' operator climbed up the support structure for the "C" service . water pump.
' The operations manager stated that this and other-similar - problems had been recognized and request for permanent ladders 'and/or operating platforms had been submitted. (3) Interviews with operations personnel and reviews of operating procedures.and administrative guidelines and maintenance , procedures revealed that guidance and instructions were provided to monitor pump oil supplies and to periodically fill' pump oil reservoirs. However, no guidance or instructions were provided which. required documentation of observed leakage or-oil additions. Experience at other operating plants has indicated that a program to provide trend analysis on oil leakage and oil additions is useful to prevent pump failure.
The inspectors also noted that several of the bearing oil sight glasses on the' service water booster pumps had been inadvertently painted over, making oil monitoring difficult or impossible.
(4) Interviews with operations personnel, including the operations supervisor indicated that the capability to provide a backup supply of service water by. way of portable pumps, hoses and/or fire trucks has never actually been demonstrated. This backup supply is addressed in the FSAR as a backup supply of service water utilized in the unlikely event of a failure of the intake structure. This capability is also assumed functional to provide makeup water to the system when cross connected with the circulating water system.
> (5) A review of applicable operating procedures, maintenance ' procedures and surveillance procedures indicated that there are
no requirements for routine or periodic monitoring of the set pressure on the backup (seismic I) nitrogen pressure regulators i for the component cooling water surge tanks. Failure or improper settings (in the low pressure direction) of these regulators could result in decreased system pressure and loss of system function if the non-seismic normal-nitrogen pressure supply should fail. This item is discussed further in paragraph 3.b.
, (6). A review of emergency procedures indicated that the procedure related to operation of the residual heat removal pumps during , ' accident conditions did not include specific instructions to monitor or verify operation of the pump recirculation flow path. Failure of recirculation flow under certain conditions
L _ _
l# ' .
- t . ,. .s , , % ~ (relatively high RCS pressure) could result in pump overheating - an'd possible loss of the pump.
, b.
Training Weaknesses.
^ ^ Several errors were oted in licensee training documents as follows: ' (1) Licensee training document.02-A-11-SD,-Component Cooling Water System , (a) On page 4,'the design basis of the CCW system are ~ incorrectly stated. The document incorrectly states CCW system limits on temperature. The temperature limit at the outlet of the CCW heat exchanger is identified as 140 F, even though the containment pressure analysis was based upon.120 F snd flashing at the outlet of the containment '
- air, coolers may occur if the CCW outlet temperature
' approaches 140 F under accident conditions.
(b) On page 7, the automatic stop of the CCW makeup pumps are incorrectly described. The document indicates that when the CCW surge tank reaches 66% full t. hat a level switch actuates to stop the pump. The setting diagram for level switches associated with the CCW surge tank indicates'that the makeup pump stops when the level reaches 55" or 57.3% l of tank level. The value of 66% full corresponds to 60" level which was revised down to 55" during the ' implementation of modification RDC-76-068(M).
(c) On page 7, the overpressure protection for the CCW surge tank is incorrectly described as lifting at 135 psig and ~ 150 psig. The instrument index indicates that one relief valve is set at 130 psig and the other at 135 psig. These latter settings were confirmed by the licensee.
(d) On page 23 and 25, the tables, identifying: heat loads and flow requirements for various operating and abnormal conditions, were not revised to reflect the addition of the reactor coolant pumps as a design basis accident heat load following installation of modification RDC-83-019.
r (2) Licensee training document 02-A-11-HO, Component Cooling Water ! (a) Tables 1 and 2 were not revised to reflect the addition of-the reactor coolant pumps as a design basis accident heat load following installation of modification RDC-83-019.
t (b) Figure 6, incorrectly indicates that the two safety valves . connected to the CCW surge tanks have setpoints of 135 , psig and 150 psig.
I ! The incorrect training of operators with respect to the maximum ' allowable CCW outlet temperature could adversely affect the , operator's ability to properly handle accident conditions.
In i ~ . . ,_ . . . _ _ . -
,,
/ addition, these errors demonstrate the need for clearly establishing the design base:s of systems to facilitate validation of training material. However, in accordance with the NRC enforcement policy relating to findings in the area of training, a violation will not be issued if the-licensee promptly corrects the identified deficiencies. This is an open item (86-23-18).
c.
System Walkdowns A walk-down was conducted on several systems in the plant. This included the diesel generators, service water booster puaips and area coolers, cocponent cooling water pumps and ventilation, SW and CCW systems, control room,' 480 volt room, and the battery room. The purpose of'the walk-down was to look for and identify any potential problem areas, to observe material ~ condition, controls, and housekeeping. : During the walkdown inspections, the following items were noted, the licensee informed, and followup action initiated.
1) The three safety-related nitrogen bottles that supply the safety-grade back-up for the CCW surge tanks appeared to be loosely mounted. The N distribution bottle rack is shown on
Wright-Schuchart-Harbor drawing WSH-FS-111 Rev. 6.
The drawing specifies that the straps for securing the N bottles are to be , ,
" field provided". The licensee was unable to find a drawing detailing the mounting of the N bottles to the rack. The
licensee had calculations for tne design of the rack. However, ' the calculations did not include the N bottle strap attachment
to the rack. During the inspection, tne licensee was unable to obtain design calculations for the N bottle strap attachment
to the rack. Pending further licensee review and determination of availability of design calculations, this was identified as an unresolved item (86-23-19).
2) During the system walkdown, the inspector noted approximately six cracked areas in the masonry block walls surrounding station ESF battery rooms 39 and 40 in the control building.
The most severe cracking was observed around HVAC ductwork on the common wall between the two battery rooms. The licensee informed the inspector that periodic engineering test - PET - 9-1 requires inspection of all structures once every three years. The licensee further informed the inspector that the control building was inspected in April of 1984 and was to be inspected again before the end of April 1987. At the time of the NRC inspection, the cracks observed had not been evaluated by the licensee, Upon notification, the licensee promptly doc'.mented the condition and initiated a review and evaluation.
Pending completion of the licensee's evaluation, this was identified as an open item (36-23-20).
3) Housekeeping in areas inspected appeared to be good. No accumulation of trash or excess material was observed and most areas appeared to be routinely cleaned.
I 5.
Quality Assurance l i
<
U r ,' . , ' ' - The Trojan. quality assurance (QA) program was assessed to ' determine if-the' program, as implemented, was effective in identifying and correcting _, significant technical and operational deficiencies. This assessment was -
' based on interviews with QA and supervisory personnel and on a review of.
the' documentation from selected audits performed during the past two " , . years. Emphasis was placed.on audits conducted in the areas of site
engineering, corporate engineering, corrective actions, and, main.tenance.
' , ./ .The' licensee had recently (July 1986) initiated an in-depth' technical- ' audit of the residual heat removal (RHR) systen to supplement the routine
, . programmatic audits. A review of the preliminary findings from this i - . technical nudit revealed that many of the concerns identified were . similar-to'the concerns raised by the NRC inspection team regarding the '. - 1
- CCW system. Licensee management appeared to be responsive to the various
. audit' findings and recommendations reviewed. However, the team was
- '
unable to assess the effectiveness of the resultant corrective actions because the majority of the actions either have been only recently implemented or have not yet been fully implemented.
Plant' procedures governing design change control and implementation were examined to compare current controls with controls existing in the 1982 to 1984 period. Two design changes examined in detail by the team (RDC-M83-019 and E81-104) had been processed by the licensee engineering and plant staff during this period. The procedures in effect at that time were examined to identify potential weaknesses which may have increased the possibility of hardware inadequacies. Some weaknesses were identified which appeared relevant to tardware related findings described-elsewhere in this report: a.
-Design control procedures did not instruct engineers to obtain and' refer to original design calculations.during their preparation of system / equipment design changes. This appeared to contribute to'the finding that engineering clerical personnd could not recall any engineer request for such calculations nor an index of such calculations, and the unavailability at the licensee engineering offices of an index of Bechtel originated calculations. The referral to such design basis information has not been corrected in.
current revisions ~to the procedures.
-b.
Design control procedures did not include instructione to engineers or plant staff to identify and revise applicable operating procedures, maintenance procedures, surveillance procedures, vendor technical manual files, training program materials, as related to the design change. This was corrected in late 1983 with revisions to procedures and introduction of system design change description practices. At this time, the licensee implemented utilization of a . plant procedure revision form as part of each design change package.
A special effort to update the vendor technical manual files has also-been implemented.
The team found that the requirements of ANSI N45.2.11 had not been adequately implemented. A significant weakness was noted in the apparent lack of traceability from design input through to design output. For example, neither the licensee nor his original design agent had calculations supporting the bottle size and low nitrogen pressure
'
p setpcint of the emergency nitrogen system to the CCW surge tanks.
Likewise a calculation did not exist to confirm that 90 psig (minimum nitrogen pressure from emergency nitrogen supply) was sufficient to provide for subcooled conditions at the outlet of the Containment air coolers during the injection phase. The lack of traceability from design input through to design output was judged as the principal reason the frequent use of the USAR as a source of design input for calculations and modifications. The team found the Nuclear Safety and Regulation (an organization responsible for the USAR) using the USAR as a source of design input. The team found that mechanical engineering does not have original design analyses and did not have an index of those calculations.
Therefore, the Nuclear Safety and Regulation Department did not use or review original design information when confirming the mechanical aspects of a design modification. The implication is that internal PGE design organizations performing mechanical design analyses do not refer to the original (or most current) design analyses when performing design modifications or to the design organizations that have access to original design information. This design traceability weakness was discussed with the licensee. The team was informed that this weakness will be corrected upon completion of the newly initiated program to establish the design bases of plant systems.
6.
Licensee Corrective Actig In response to previously identified deficiencies in the engineering area, the licensee has initiated a program to upgrade their performance.
This program was described to the team and includes: (1) Reviewing and updating the design basis information and calculations for plant safety systems. This information will be collected into one accessible, controlled format for use by licensee engineers.
(2) Review of the operation, maintenance, testing, and training associated with plant safety systems. This review will ensure these activities reflett design basis requirements.
(3) Performance of an independent review of engineering activities by an outside consultant.
This action appears to be a significant step towards addressing the team's basic findings. The team encouraged the licensee to aggressively pursue this action.
7.
Exit Interview On August 22, 1986, an exit interview was conducted with the licensee representatives identified in paragraph 1.
The inspectors reviewed the scope of the inspection and findings as described in the Summary of Significant Inspection Findings section of this report. }}