IR 05000373/1988016
| ML20154C578 | |
| Person / Time | |
|---|---|
| Site: | LaSalle  |
| Issue date: | 09/07/1988 |
| From: | Bjorgen J, Bongiovanni A, Hasse R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20154C561 | List: |
| References | |
| 50-373-88-16, 50-374-88-16, NUDOCS 8809140417 | |
| Download: ML20154C578 (23) | |
Text
,
.
'
'
.
,
U.S. NUCLEAR REGULATORY COMISSION
REGION III
Reports No. 50-373/88016(DRS); 50-374/88015(DRS)
Docket Nos. 50-373; 50-374 Licenses No. NPF-11; NPF-18 Licensee:
Comonwealth Edison Company P. O. Box 767 Chicago, IL 60690 Facility Name:
LaSalle County Station, Units 1 and 2 Inspection At:
LaSalle Site, Marseilles, Illinois Inpsection Conducted:
June 27 through July 22, 1988 9fbf7.1 Inspectors:
R s
d Date (
/
/o J. C. B or en 7/ 7/ 80
/
/
Date GM Resqwa_n$u A. M. Bongiovanni 9fb f N f
Date
[h 6 /&
/
9 2l00
/ (,,0.Y. H s
Dat6 /
<
$1f,4w L F. A. Maura 9 7"ff i
OY P.
escheske
.
Date
~
l Va el
!
Date l
Accompanying Personnel:
'
i 8009140417 880909
!
PDR ADOCK 05000373 o
PDC i,
i
!
--
___
_
.
_ _ _. _ _ _.. _. _ _ _ _ _. _ _. _ _ _. _, _. _ _ - _, _ _ _ _. _ _ _ _ _ _ _... _ _ _.. _, _ _ _ _ _ _ _ '
-
.
Q LOP ct -
Approved By( M. P. Phillips, Chief 7h/[
Operational Program Section Date Inspection Suninary Inspection on June 27 through July 22,1988 (Reports No. 50-373/88016(DRS);
No. 50-374/88015(DRS))
Areas Inspected _:
Special announced inspection of risk significant aspects of plant operation as identified in the LaSalle Probabilistic Risk Assessment (PRA) currently being performed.
This inspection utilized portions of inspection modules 41701, 71707, 42700, 61700, 61726, 62705, 62702, 62703, 62704, and 71710.
Results: Two violations were identified during this inspection:
The LaSalle Station was notified in 1984 by both the Station Nuclear Engineering Department of industry problems with Potter-Brumfield relays used in the closing circuits of the output breakers for Diese's Generators
"O," "1A" and."2A."
The station failed to take corrective action until three failures of these relays occurred at LaSalle in 1987.
This failure to take prompt corrective action was particularl because of the c mmon mode failure implication (y safety significant Paragraph 3.d.(3)).
Due to an inadequate procedure for tracking the number of failures of the Unit 1 diesel generators to start during surveillance tests, the Technical Specification testing frequency was not maintained (Paragraph 3.f.(4)).
The inspectors also identified other concerns during the inspection:
The corrective maintenance level appeared-to be high for the instrument air and drywell pneumatic systems, indicating poor reliability.
Further, the gas streams produced by these systems were not being monitored for particulate or oil content (Paragraph 3.a.(2)(b)).
'
Other concerns with the diesel generators included the poor reliability of the air start systems and the potential lack of insulation of the diesel from the generator (Paragraph 3.f.1)).
The failure to perform a root cause analysis of the failure of an under-voltage relay in the 242Y bus system, precluding the determination of implications for other similar relays in the plant (Paragraph 3.d.(2)).
Although overall training and qualifications of the staff appeared to be good, several specific concerns were identified:
(1) The operating crew did not follow the emergency operating procedure exactly during the simulation of a severe accident sequence; (2) not all licensed operators interv ewed were aware of ths need to reset the RCIC inboard steam supply valve upon recovery of AC power 'ol kwing the loss of offsite power; (3) the station staff may need training in identifying significant safety issues as evidenced by the first violation noted above (Paragraph 4).
- The effectiveness of the o.uality oversight groups could be improved.
Only one of the concerns identified by the inspectors had been addressed by one of the oversight groups (Paragraph 5).
- ~
.-
_. _ _ _ _ _ _ _ _ _ _
_ _ - _
_ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
. - _ _ _ _
,
- .
<
.
.
.
,
-
.
l The inspectors also identified several strengths during the inspection:
Plant cleanliness was impressive.
- Plant equipment was well labelled and easily identifiable.
- t l
Equipment outage times for maintenance and surveillance activities i
were minimized.
,
Vendor recommendations were generally incorporated into the PM program.
l
l
,
t t
i t
I
,
l
'
!
t
,
I k
i
!
L
!
i
[
a
,
L
!
i
,
l
'
>
I
I t
r
.
.
...
-
.
'
'
.
DETAILS 1.
Persons Contacted Commonwealth Edison (CECO)
G. Diederich, LaSalle Station Manager
- W. Huntington, Services Superintendent
- J. Renwick, Production Superintendent
+*J. Ahlman, Technical Staff Engineer
- J. Gieseker, Technical Staff Supervisor
- J. Peters, Technical Staff Engineer
- J. Klika, Technical Staff Engineer
- D. Ulrich, QA Engineer T. Hammerick, Regulatory Assurance S. Dileto, BWR Engineering J. Kolonowski, BWR Engineering R. Raguse, LaSalle Simulator Supervisor Sergeant and Lundy (S&L)
H. Bar, Senior Electrical Project Engineer J. Pabich, Senior Electrical Engineering Analyst C. Furlow, Senior Electrical Project Engineer United States Nuclear Regulatory Commission (USNRC)
- H. Phillips, Chief, Operations Section, Region III
- S. Dupont, SRI, Dresden
- M.
Ring, Chief, Projects Section, Reg'on III
- D. Jones, Project Inspector, Region III Other personnel were contacted as a matter of routine during the inspection.
- Designates those personnel attending the exit interview held on July 22, 1988.
+Partic',7ated in telephone call on September 8, 1988 (See Paragraph 7).
2.
Introduction This inspection was based on the results as of June 1, 1988, of the LaSalle, Unit 2 Probabilistic Risk Assessment (PRA).
This PRA is being performed under the Risk Methods Integration and Evaluation program (RMIEP).
The objectives of RMIEP are to:
Integrate internal, external, and common cause methods to achieve
greater efficiency, consistency, and completeness in PRAs.
(valuate PRA technology developments and lay the basis for improved
PRA procedures.
- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
'
.
,
Identify, evaluate, and effectively display the modeling and data
uncertainties in PRA results.
Conduct a PRA on a BWR 5, Mark II nuclear power plant including
offsite consequences.
LaSalle was selected for this study because it met the requirements of the fourth objective and its simulator provided a good engineering model of the plant.
The importance of this last point is highlighted in the discussion in Paragraph 3.c.(2) of this report.
In this case, a design weakness in the plant was identified during an evaluation of the plant's response to accident sequences conducted as part of the PRA development.
,
Fundamentally, a PRA identifies sequences of events (event trees) leading to core damage (Level 1), containment failure or bypass (Level 2), and offsite consequences (Level 3),
This inspection focused on the Level 1 sequences (with one exception discussed in Paragraph 3.k).
The Level 1 sequences consist of an initiator (plant transient or event leading to a plant transient), followed by a series of failure of systems (sequence events) to perform their design function in returning the plant to a stable and safe condition.
The causes of sequence events are identified by fault trees constructed under each sequence event.
These faults or failures may be system unavailability due to a maintenance outage, specific (identified) component faults, operator error, or an unspecified i
local fault of a system component.
Probabilistic data (from a variety of i
sources) is then assigned to these faults and propagated through the fault and event trees.
Finally, this data must be modified to reflect the probability that the plant would recover from a fault or system
failure (interrupt the event sequence).
This could be as simple as
!
manual operation of a motor operated valve whose operator was assumed to have failed.
While the absolute probabilities of the occurrence of given faults (and hence, event sequences) have relatively high uncertainties, the relative probabilities are considered to be less uncertain.
Thus, the PRA identifies those faults that contribute most to plant risk.
This inspection focused on initiators and faults identified by the PRA as encompassing s98% of the total plant risk, although only a sample of
.
this population could be examined. While the PRA is not yet complete.
l little change in the primary contributors to plant risk is anticipated.
!
Although the PRA was specific to LaSalle Unit 2, Unit 1 was included
'
j in the inspection. This was done because of plant similarities and the
increased data base.
,
l 3.
Inspection Results
.
a.
,
Initiating events are plant transients or events which lead to
!
plant transients which challenge the ability of plant systems and the operating crew to return the plant to a stable and safe l
condi t.i on.
'
s i
'
.
l
'
.
(1) Operator Response The inspectors reviewed normal operating, annunciator, and emergency procedures with respect to operator response to initiating events.
Control room walkdowns were conducted and operator response to the events were discussed with the licensee.
The following initiating events were evaluated from this operations perspective:
Turbine trip with or without bypass
Loss of condenser vacuum and feedwater Relief valve opening (fails or leaks)
e
Loss of 125 VOC
Loss of instrument air Loss of drywell pneumatic
Loss of reactor level instrumentation
Loss of 4160 VAC The inspectors determined that operator knowledge and procedures were adequate.
(2) System Reliability The corrective maintenance and surveillance histories since 1985 and the preventive maintenance programs for three of the systems involved in initiating events were reviewed to assess system availability and reliability.
The results of these reviews are discussed in the following paragraphs.
(a) 125 VDC System The review of the corrective maintenance history for the 125 VDC batteries indicated no recurrent maintenance or availability problems.
The PM and surveillance programs were reviewed against the Technical Specification requirements, and IEEE-450 (1980) and vendor manual recommendations.
One concern was identified in this area.
Prior to June 1988, LaSalle station procedures (e.g.,
LOS-DC-07, "Battery Equalizing Charges"), required an equalizing charge be put on the Division III batteries on a quarterly basis.
These batteries are C and D Type 0 (lead-calcium).
The vendor's manual recommended that the batteries not be placed on an equalizing charge
s
?
'.
.'
when floated between 2.20 and 2.25 volts as was the case at LaSalle.
Placing these batteries on an equalizing charge can cause electrolyte stratification.
The Technical Specification operability requirements are based, in part, on the specific gravity readings.
Thus, a Technical Specification operability determination can be impacted by the equalizing change.
The discrepancy between the vendor manual recommendations and station procedures was identified by the station technical staff in May 1987 and brought to the attention of the corporate DC Task Force.
The discrepancy was also highlighted as a concern is the result of the QA Safety System Functional Inspection conducted by the licensee QA organization in September 1987.
Final corrective action (revision of station procedures) was completed in June 1988.
The impact of this discrepancy on battery operability or reliability was minor.
However, the inspectors were concerned that the vendor recommendations were not incorporated into the original station procedures and that it took over 12 months to correct the discrepancy af ter it had been identified.
'
(b) Instrument Air and Drywell Pneumatic Systems The instrument air system provides air to operate instruments and air operated valves outside the drywell.
The drywell pneumatic system provides nitrogen to perform the same functions inside the drywell.
The review of the corrective maintenance history for the compressors in these systems indicated relatively poor reliability.
The station air compressors had bearings replaced twice in 1985 and once in 1986.
Motor bearings were replaced twice in 1987 and once in 1988.
The nitrogen "A" compressor was rebuilt in 1986, 1987, and 1988.
The "B" compressor was rebuilt in 1985, 1986, and 1987.
The licensee shared the inspectors concern and indicated during the exit interview that actions were being planned to correct the problem.
In the interim backup systems had been installed to preclude loss of instrument air or nitrogen in the event of system failure.
A concern was also identified during the review of surveillances for these systems. Neither the air nor nitrogen provided by these systems were monitored for particulate content. Also, the station did not monitor the gas streams for oil content; however, the corporate technical cent?- did monitor the instrument air system for condensable hydrocarbons on a semiannual basis for
I
.
!
o'
'
.
breathing air purposes.
The consequences of particulate and oil contamination in instrument air systems are documented in NUREG-1275, Volume 2.
The licensee took immediate action to address this concern.
Completion of corrective action will be tracked as an open item (373/88016-01; 374/88015-01).
(3) Core Instability
,
On March 9, 1988, LaSalle Unit 2 underwent a dual recirculation pump trip event.
After the pump trip, the unit experienced a large diverging neutron flux oscillation while it was on natural circulation.
The event is described in NRC Information Notice No. 88-39,
"LaSalle Unit 2 Loss of Recirculation Pumps With Power Oscillation Event," dated June 15, 1988. Additional details of the event have been documented by the NRC augmented inspection team (AIT) in Inspection Reports No. 50-373/88008 and No. 50-374/88008.
Since this event was not considered in the LaSalle PRA, the NRR consultant to the inspection team evaluated the event to determined if it had significant impact on plant
-
risk as an initiator of a severe accident semence.
The conclusion was that this event, while not unimportant, did not represent a substantial increase in overall plant risk.
This conclusion was contingent on completion of actions to be taken by the licensee described in the Confirmatory Action Letter (CAL-RIII-88-03) issued as a result of the event and NRC Bulletin No. 88-07,
"Power Oscillations in Boiling Water Reactors," issued on June 15, 1988.
b.
Recovery Actions The ability of the plant to recover from an initiating event is an important factor in determining the overall plant risk.
The ability of the plant to recover from oi? of the dominant initiating events, loss of offsite power, was assessed by the inspection team.
Licensee procedures, activities and site involvement in reestablishing power were reviewed by the inspectors through discussions with licensee personnel and a review of station procedures.
The following LaSalle administrative procedures were reviewed:
LOP-AP-01, Revision 4, June 1, 1985, "Restoring the System
Auxiliary 'iransformer SAT 142(242) to Service with Unit 1(2)
Shutdown"
, _ _ _ _ _ _ _ - _ _
.
!
,
a'
,
LOP-AP-02, Revision 3, May 29, 1987, "Restoring System
Auxiliary Transformer to Service During Unit Operation" LOP-AP-07, Revision 7, June 10, 1987, "Loss of Auxiliary
Electrical Power" LOP-AP-08, Sevision 7, July 31, 1987, "Total Loss of AC Power"
LOP-AP-16, Revision 2, August 6, 1985, "Returning 4160 Volt Bus 141Y(241Y) from Diesel Generator 0 Power to its Normal Source of Power" During discussions with licensee personnel, the inspectors were provided the following information:
Commonwealth Edison Company controls power generation and
'
load handling for their entire system by the Load Dispatcher l'cated at the Glenbard Dispatch Center and, in conjunction with the Mid-American Interpool network (made up of regional utilities), the midwest grid distribution system.
LaSalle personnel maintain contact with the Load Dispatcher at
the Glenbard Dispatch Center through a dedicated phone line located on the "center desk" of the control room.
This assures prompt access for cooperative effort in restoration of offsite power when required.
The LaSalle 345kV substation has two independent 345kV loops
and four outgoing transmission lines that normally carry the power being generated to the grid.
These four transmission lines, two to the Plano substation and two to the Braidwood substation, are carried by two lines per set of transmission poles to each substation.
The LaSalle station would be dependent on this same system to provide its offsite power if a site blackout condition would occur.
Offsite power is considered available when any one of the four feeders is functioning.
Therefore, total loss of off site power would only happen when all four lines are down.
The most likely event to cause all transmission lines to come
down and be out of service would be a tornado.
In northern Illinois, the path of a tornado occurs in a southwest to northeast path.
Since the two transmission lines go in different directions, the probability of affecting both lines would seem minimal.
The substation itself and the two independent loops would also seem to have minimal susceptibility; however, given the loss of offsite power, its restoration is not controlled by station personnel.
The administrative procedures reviewed were designed to aid plant operations in the event of loss of power, to adjust to essential loads only, or in the event of restored power, to return to normal power operations.
No procedures existed dealing with those action
/
i
.
,
'.
,'
and activities required to restore offsite power.
Ttese activities are directed by the load dispatcher via the dedicated telephone line.
Further, damage to the 345kV substation and/or the transmission lines would be responded to by personnel not located at the site who would also be under the direction of the Load Dispatcher.
Thus, the inspectors could not fully assess the adequacy of plans to restore offsite power; however, the procedures for adjusting to the loss of offsite power and its restoration were determined to be adequate.
c.
Operator Errors or Failures Because of their high consequence level, certain operator errors can contribute significantly to plant risk even if the probability of occurrence is low.
Two risk dominant operator errors / failures were evaluated during this inspection.
(1) Failure to control condensate system.
Caution statements existed in the appropriate station procedures alerting the operator to the actions to be taken when reactor pressure is Miow the condensate booster pump discharge pressure.
The required valve lineup and method for level control was stated.
In addition, the operators were routinely trained on this function.
The inspectors concluded that the procedures and training were adequate to minimize the probability of occurrence of this event.
(2) Failure to reset RCIC Valve F063.
During a station blackout, RCIC is isolated.
When the diesel generators auto start, it is necessary to reset the isolation in the event that the diesel generators are lost.
If the isolation is not reset, the RCIC isolation would be non-reversible (locked-out) because the inboard steam supp'
isolation valve (F063) is closed and not accessible.
This event sequence was identified in the LaSalle simulator in 1985.
It was determined that the "timer window" of the time delay relay, which would prevent this event sequernce, may not be adequate.
The licensee stated that a modification to the relay was under consideration.
In the all of 1985, this scenario was included in the licensed operator requalification training.
Discussions with the licensee indicated that no caution statements in station procedures regarding the RCIC isolation valve existed.
No formal training on this scenario has been given to licensed operators since the Fall of 1985; however, the licensee stated that this event sequence was routinely discussed during station blackout scenarios.
The inspectors determined through interviews, that not all control room operators were familiar with this event sequence.
The licensee committed to include information regarding this scenario in the required reading package for all licensed personnel, to be completed in September 1988.
__
_ _ _ _ _ _. _
-
.
-
!
.
,
o o
,
l
!
d.
Electrical System Faults l
Many dominant faults contributing to event sequences identified I
in the PRA are related to electrical systems.
Faults or failures
!
of the station auxiliary power Divisions 1, 2, and 3 system's 4.16kV switchgear and bus system were selected for review.
'
The faults reviewed are summarized below.
(1) local Fault of Circuit Breaker The 4.16kV ITE metalclad switchgear utilized for the f
Divisions 1 and 2 systems was selected for review.
-
The documentation review included the following:
{
The ITE (Brown-Bavari) type IB-8.2 SkV medium voltage
,
switchgear manufacturers manual was reviewed.
-
Recommendations for maintenance and testing were
identified and compared to the requirements and acceptance
'
criteria included in the relevant station surveillance test procedures.
i Five separate Station Surveillance Procedures for I
circuit breaker testing were reviewed including Procedure i
No. LES-GM 103, Revision 6, March 21, 1988, used for the
[
testing of the ITE Medium Voltage circuit breakers.
A maintenance history computer printout of completed
electrical breaker work requests was reviewed.
An additional computer printout of plant reliability data for three separate ITE 4.16kV circuit breakers was also reviewed.
I An overcurrent relay coordination study, obtained during l
a visit to the Sargent and Lundy corporate offices, was
reviewed.
This review included comparison of the settings
!
identified in the study to actual relay settings of selected Divisions 1 and 2 circuit breakt: relays.
l l
A walk-down of the switchgear rooms for both units was conducted
!
arJ the following was observed:
Both switchgear rooms were clean, orderly, and free of
debris.
.
!
The ITE switchgear appeared very well cared for and in i
good condition.
One breaker, rolled out of its cubicle
[
of the 141X gear, was observed to be clean and in good
}
condition.
!
i I
l
?
i I
- _-_ _._
-
-- :
. - _ -
l
-
.
,
'.
A breaker test panel, used for the surveillance testing
of breakers, was available in each switchgear room.
Both appeared to be adequate to successfully perform the required testing.
Breakers of Unit 2, Division 1 and 2 busses, in Cubicles 1,
4, 12 and 2, 5, 13 were inspected to confirm that the
.,
l overcurrent relay settings correspond with the Sargent
-
and Lundy relay coordination study.
Based on this inspection, the inspectors determined that:
Breaker surveillance testing was in compliance with
Technical Specification Section 4.8.3.2.b regarding
,
frequency of testing.
Overcurrent relay tap and time dial settings were as
prescribed by Sargent and Lundy relay coordination study, i
The review of Deviation Reports, maintenance histories,
i and plant reliability data established that the switchgear
'
was free of frequent or recurrent problems.
The frequent preventive maintenance (wipe down cleaning of
.
breakers) minimized any potential ground faults.
No concerns regarding availability or reliability of equipment were identified in this area.
(2) local Fault in Under Voltaae Circuit Relay i
The documentation reviewed included the following:
)
,
Unit 2 Technical Specifications Table 3.3.3-2, "Emergency l
l
l Core Cooling System Actuation Instrumentation Set Points,"
'
j was consulted for the required trip set point and
i allowable values for the under voltage (loss of voltage)
'
control on busses 241Y, 242Y, and 243.
!
A surveillance test procedure (No. LES-GM-219. Revision 0, l
'
June 7, 1988) and a completed surveillance test performed
'
on January 22, 1987, were reviewed.
During this test, of bus 242Y, undervoltage relay No. 2427-APO40A was found to be out of technical specification values for trip set point
!
and delay time and exceeding the LCO limit.
Additionally,
[
j the relay 'ould not be re-calibrated.
The licensee replaced l
this relay under work request L64539 and issued a Deviation
Investigation Report (DVR) tio. 01-02-87-004 evaluating the
!
operational consequences of the failure.
However, neither
>
root cause nor prevention of recurrence were addressed.
l l
t l
'
l l
l
_ _ _ _ _ _
.
'
'
-
.
Computer print outs of the calibration history and plant
reliability data for under voltage relays were reviewed with no additional problems being identified.
While only one instance of a failed u/v relay was identified, the inspectors were concerned that the licensee had not determined the root cause of the failure.
In the absence of a root cause determination, the implication for other similar relays in the plant could not be determined.
(3) Fault of Relays in the 0/G Closina Circuit A major concern was identified in this area.
NRC Inspection R* ports No. 50-373/88006(DRS); 50-374/88006(ORS) outlined, it. Daragraph 3.3.3, the failure of Potter and Brumfield (P&B)
MOR relays used in the closing circuit of the Diesel Generator (0/G) output breakers.
The inspectors reviewed two Commonwealth Edison Co. internal letters concerning these relays, one issued by Station Nuclear Engineering Department (SNED) dated June 1, 1984, and the other issued by Station Electrical Engineering (SEED) dated August 1, 1984.
Both provided information regarding their evaluation of an INPO notice No. OPEX83-29 (normally energized P&B type HOR 137-8 relay failures) noting that these failures could occur at LaSalle.
However no action was taken by the statioa at that time.
Subsequently, three failures attributed to P&B relays (LERs87-002, 87-033 and 87-040)
occurred at LaSalle in 1987 during surveillance testing of 0/G Units "0" (one failure) and "1A" (two failures).
An Engineering Change Notice (ECN) package was prepared for replacing both Unit 1 0/Gs, "0" and "1A," P&B relays during the Unit I refueling outage.
This was completed for "1A" on April 17, 1988, and for "0" on May 16, 1988.
Similarly, an ECN package has been prepared for the Unit 2, D/G "2A" and it is planned to be implemented during the Unit 2 refueling outage scheduled for October 1988.
.
In response to questions, relating to the failure to take action based on the SNED and SEED letters, the inspector was informed that the station had not recognized the P&B relay failures to be a common mode failure.
They did agreo that 0/G "O," "1A" and
"2A" could fail commonly and fail to close onto the eastgency busses at the same time.
This would prevent emergency power from reaching Divisions 1 and 2 of both units.
In such an event, only 0/Gs "1B" and "2B" supplying power to Division 3 HPCS loads for both units would be operable.
The licensee had been aware of industry problems with these relays since 1984.
However: no corrective action was taken until the three separate failures in 1987 emphasized the serious-ness of the problem.
This is considered to be a violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action,"
(373/88016-02; 374/88015-02).
The need for the licensee to identify and promptly correct common mode fait *t problems
.
.
,
e c'
,
i i
cannot be overemphasized, t
I e.
Core Standby Coolina System (CSCS)
The inspectors reviewed the operating, maintenance, and surveillance I
history of the RHR train A and B strainers, the HPCS cooling water pump and strainer, and the "0" diesel generator cooling water
!
strainer for the period of January 1,1987 to June 1,1988.
The review included Work Requests, a comparison of the lubrication history against vendor recommendation, and a visual inspection of the equipment.
No Licensee Event Report covering the above
,
i equipment was found.
No recurring problems, significant trends, nor excessive time out of service were noted.
The lubrication program followed vendor's recommendations.
f.
Emeroency Diesel Generators The inspectors reviewed the operating, maintenance, and surveillance history of the five emergency diesel generators (Unit 1:
1A and 18, Unit 2:
2A and 28, and "0" swing diesel) and supporting subsystems such as starting air and service cooling water.
The review covered the period from January 1, 1987 to June 1, 1988 and included the following records:
Work Requests
LERs and DVRs Lubrication History
Surveillance History
In addition the inspectors witnessed the uperability surveillance test on the "0" diesel generator, and interviewed members of the maintenance (mechanical ard electrical), operations, technical, and Operational Analysis Department (OAD) staff.
The result of the inspection are as follows:
(1) Work Requests Of the 79 work request summaries (January 1, 1987 to June 1, 1988) approximately 45% involved corrective maintenance.
With the exception of the air start system air compressors, no recurrence of a specific equipment failure were noted.
In the case of the air start system, at least 15 Work Requests for corrective maintenance had been written, ten of which involved work on tt.e motor driven air compressors.
The licensee is presently preparing a modification to replace the diesel driven air compressors with electric driven units because of the difft:ulty experienced in repairing tne Potter d(esel which drives the compressors.
Since the record seems to indicate that most of the problems have occurred with the existing motor driven units, the inspectors recommended that the licensee review the records to determine what additional
- - _ _, - _ _.
__
-
,
'
- -
,
,
e'
,
steps should be taken to reduce the problems experienced with
these critical units.
The licensee's action will be tracked as an open item (373/88016-03; 374/88015-03).
blork Requests covering emergency diesel generators were reviewed for timeliness of work completion and equipment
!
returned to iArvice.
Except for cases when the nuclear unit
-
was shutdow.'. for refueling, all work was completed within two
!
days after the component was taken out of servi:e.
The i
'
equipment was returned to service within two days af ter (in several instances the same day) the work was completed.
No problems with equipment availability were found as a result of this review.
l The inspectors reviewed the post-maintenance test performed l
on the diesel generators following replacement of air start motors. The test is performed in accordance with LOS-DG-M1, 2, or 3 "Diesel Generator Operability Test." The inspectors
' determined that the testing guarentees the capability of each
!
redundant pair of eir start motors.
'
,
With regards to preventive maintenance, the inspectors inquirea wh6tter the diesel is insulated from the generator, and if not, whether generator resistance to ground ineasurements are takan to ensure that a breakdown of the insulating capabilitics of the generator bearings has not occurred.
Such a breakdown
,
would permit stray current to travel through the shaft and the
diesel main bearing, damaging the latter.
The licensee does not take generator to ground measurements, but stated they would
,
i review the problem.
Considering the problems experlenced by
!
anoi.her Region III facility in this area (Prairie Island Unit 1
,
LER 87-011) this will bw tracked as an open item (373/88016-04;
,
374/88015-04).
.
I (2) LERs and DVRs
,
!
A total of sixteen Deviation Reports, nine of which were also
LERs, covering the period from January 1,1987 to June 6,1988 l
were reviewed.
Three appeared to have been caused by human error with the remaining being the result of either mechanical
>
or electrical failures.
Only the failure of the diesel output
'
'
breakers to close due to the failure of a Potter and Brumfield auxiliary relay was repetitive in nature (3 occurrences) and
,
common to three of the diesel generators (0, 1A, and 2A),
t
'This item is discussed in Paragraph 3.d.(3).
l I
'
On August 16, 1986, the license 6 experienced a HPCS diesel generator start failure due to the failure of an Agastat time
[
delay relay in the start circuit.
The relay failure was caused
,
by one of the three screws keeping a diaphrage from dislodging.
t
The licensea 13 working on a modification to the start circuitry of the five diesel generators which when implemented will
!
F
,~
-..
, _-- - - - - - - - - -., _ -
- - - - --. --- -.,.. - -
. - -. -
--_
_ _ _ _ _ _ _ _
.
+
s
.
o eliminate two of the time dalay relays in the present circuitry and upgrade the relays to a new model which has six screws holding the diaphragm.
This modification will also prevent the failure to start event described in LER 374/87-001 by allowing the diesel to start once the lobe oil pressure switch resets indicating the diesel has stopped rotating.
(3) Lubrication The inspectors reviewed the lubrication history of the emergency diesel generators (EDGs) and auxiliary equipment, and the lube oil sample results of the EDGs.
The lubrication program meets the recommendations of the specific equipment vendor.
For the diesels the program follows the recommendations found in Electro-Motive Division maintenance instruction M.I. 1742 Revision E.
The lube oil sample results were compared against M.I.1760. Revidon G, and the oil vendor specifications for Mobilgard 446 anu 450.
No problems were identified.
The last revision of M.I. 1760 added a lube oil analysis for tin with a corrective action to be taken if higher than 40 ppm.
Presently, the licensee is not testing for tin, however, CECO is testing for tin at some of its fossil stations to develop a data base from which to determine if analyzing for tin as a precursor of equipment failure is worthwhile.
According to the licensee, lube oil samples are taken from the diesel sump after the diesel had been shutdown for days.
The inspector recommended that the licensee consider taking the sample shortly after the diesel operational monthly surveillance test to ensure good mixing of the oil in the sump ensuring a representative sample of the lubricant.
(4) Surveillances The inspectors reviewed the General Surveillance System History File being maintained by the technical staff.
The file is used to maintain a record of the dates when a specific test was perfor9ed satisfactorily and to schedule future tests based on the Technical Specification requirements, regulatory commitments, or station policy.
During the review, it was noted that the frequency of Unit 1 diesel generators operability testi had been increased to weekly due to recently experienced valid start failures.
A review of diesel generator logs maintained in the control room, and interviews with station personnel, showed that no accurate system existed to track the number of diesel generator failures in the last 100 valid tests as defined in Regulatory Guide 1.108.
The licensee's program depended to a large extent on the staff's memory of when failures had occurred and tha log's function was to keep track of how many successful valid starts were needed to return to the normal testing frequency.
-
.
\\
,
o.
Using the LERs submitted since January 1,1986, the inspectors determined the dates and number of failures for each unit.
For Unit 1 four valid failures had occurred as follows:
August 10, 1986, September 17, 1987 December 18, 1987, and June 8, 1988.
The present testing frequency of once per 7 days was based on the last three failures.
At the time of the September 17, 1987, failure the licensee established that it was the first failure in the last 100 valid starts.
A record review showed that only 74 valid tests for the Unit 1 diesel generators had occurred between the August 10, 1986 and September 17, 1987.
As a result, what the licensee had considered to be the first valid failure in the last 100 valid tests was actually the second failure.
The review also showed that from August 10, 1986 to December 18, 1987 only 85 valid tests had occurred.
Therefore, the December 18, 1987 event was the third valid failure instead of the second in the last 100 valid tests.
Technical Specification 4.8.1.1.2 requires that the diesel generators be demonstrated operable in accordance with the frequency specified in Table 4.8.1.1.2-1.
The table specifies that the test frequency after 2 failures in the last 100 valid tests be at least once per 14 days, and after 3 failures it be at least once per 7 days.
Because of the licensee's failure to include the diesel generator 1A failure experienced on August 30, 1986 its testing frequency between September 17, 1987, and December 18, 1987, was once per 31 days (normal frequency) and after the December 18, 1987, failure on diesel generator 1A the test frequency was only increased to once per 14 days.
Failure to adequately track the number of Unit diesel generator failures resulted in a violation of Technical Specification 4.8.1.1.2 (373/88016-05).
The inspectors reviewed three QA Audit and tw-QA Surve111ances conducted during 1987 to determine if the licensee had identified a problem with the method being used to comply with TS Table 4.8.1.1.2.1.
Based on the review and interviews of QA personnel the inspectors determined that no audits in this area had been performed.
During the inspection, the licensee developed a method of tracking, on a per Unit bases, the number of valid tests and failures per the last 100 valid tests which should prevent the violation from recurring; however, the licensee has decided not to incorporate this new method into the station procedures because it plans to submit a Technica' Specification change to determine the testing frequency based on an individual diesel generator's history instead of a per Unit basis.
On July 13, 1988, the inspectors witnessed the startup, loading, and operation at 2600 kw of diesel generator "0" during the performance of surveillance procedure LOS-DG-Hl.
No problems were identified.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _.
<
.
.
l
- .
.
i f
j g.
Hiah Pressure Core Spray (HPCS)
The ins,,ectors reviewed the operating, maintenance and surveillance history of the motor driven HPCS pump and the southwest ECCS room
'
(HPCS room) heat removal equipment for the period of January 1987 to June 1988.
The review included nine Work Requests, two Licensee i
Event Reports, three surveillance procedures (LOS-HP-M1, LOS-HP-R1,
'
i and LTS-500-10), a comparison of the lubrication history against the i
vendor recommendations, a visual inspection of the equipment in the i
HPCS pump room, and a review of the licensee's trending program.
No recurring problems or significant trends were identified.
Work requests were completed and the equipment returned to operable status within a few days.
The lubrication program agreed with the
vendor recommendations.
j h.
Reactor Core Isolation Cooling System I
i
!
l The inspectors made the following observations:
l'
i Approximately twenty LERs were issued between January 1986 and
,
{
July 1988 pertaining to the RCIC system.
No recurring problem
'
or significant trend was identified except for a water leg pump t
l bearing problem (see Inspection Reports No. 373/88006; j
347/88006(DRS)) which had been corrected.
Nine work requests were initiated between January 1988 and l
June 1988.
The work included preventative maintenance, lubrication, and corrective maintenance.
Except during outages i
the work was completed and the system was declared operable i
within a few days.
.
I
While reviewing LOP-RI.01M, "Filling, Venting and Draining i
the RCIC System," the inspectors noted an error in P&ID M.101,
{
Sheet I regarding the standby position of the IE51-F004 and
1E51-F005 valves.
The procedure correctly positioned these l
valves as opened and closed, respectively.
The inspectors
[
'
'
notified the licensee of this discrepancy, i
!
!
Based on this review, the inspectors concluded that the reliability f
I and availability of the RCIC system was adequate.
!
L
)
No problems or concerns were identified.
l
!
i 1.
Residual Heat Removal System (LPCI Mode)
The PRA identified local faults of the motor driven pumps and the
heat exchangers and unscheduled maintenance as dominant failure i
!
modes of this system.
The inspectors reviewed the histories to i
j assess the availability of the equipment.
The inspectors made the f
following observations:
l l
l
'
!
l l
b
?
'
1
'
-
--- -- ----
_
- _ _
-- - -.___ _-
-
o
.
,-
d.
- The licensee was following the vendor recommendations regarding lubrication of the speed reducer and the bearing guides on the three RHR pumps.
No significant trends or recurring problems were identified
during the review of LERs and DVRs.
A majority of the maintenance work performed on the RHR
pumps and heat exchangers was completed during outage conditions.
Other work performed included lubrication and preventive maintenance.
The inspectors observed the completion of LIS-RH-301, "RHR
(LPC1 Mode) Pump Discharge Pressure Permissive Functional Test" and verified that the testing was performed in accordance with procedures.
No deficiencies were identified during the testing.
Based on this review, the inspectors concluded that the licensee had adequate controls to ensure the reliability of the LPCI pumps and heat exchangers.
No problems or concerns were identified.
j.
Event Simulation The team reviewed the ten most dominant sequences in the LaSalle PRA study, and f om these, two severe accident sequences were selected for simulation on the LaSalle Simulator:
loss of all injection capability and a MSIV isolation followed by a failure cf the containment and primary system heat removal systems.
The ability of the plant operational staff was observed in responding to and i
l recovering from the selected accident sequences on the simulator.
l Two accident sequences were simulated and the following activities were considered:
Demonstration of equipment and system operations
Utilization of station normal, abnormal, alarm, and emergency operating procedures.
Ability of the plant specific simulator to duplicate these
events.
(1) Preparation Simulator scenarios were developed based on the PRA study.
The sequences were reviewed for specific component / system failures and these were collated into scenario events.
Plant conditions assumed in the sequences were duplicated to the extent feasible on the simulator.
The simulator malfunction document was used to develop the component overrides and determine the plant response to events.
-
- - - - - - - - - - - _ _ - - - - _. _,
O
.
\\.
-
,
The Emergency Operating Procedures and the Abnormal Procedures were used to predict operator response to the scenarios and the expected responses were documented for use by the inspectors.
The crew consisted of one Shift Engineer, one Shift Control Room Engineer, and two Nuclear Shift Operators.
The crew was briefed on their tasks and was then asked to respond to the simulations.
The simulator exercise lasted about four hours.
Confidential discussions and trial simulations of portions of the selected sequences were conducted with training department personnel prior to the exercise.
These discussions were conducted to allow the facility staff to review and comment on the predicted plant / operator response to events.
Modifications suggested by the training department personnel were incorporated into the scenarios in order to accelerate plant response such that '.he exercise could be completed within a reasonable time frame.
Collectively, the inspectors reviewed the expected responses of the plant / operators on the simulator, familiarizing themselves with the control board layout and the roles of the various operators involved.
(2)
Loss of All Injection Sequence The loss of all injection sequence was initiated by a loss of condenser vacuum followed by successful reactor scram and SRV operation.
All injection systems failed except the RCIC system.
AC power was available initially but both AC power and RCIC subsequently failed.
Observations from the loss of all injection simulation scenario were as follows:
Upon the failure of AC power (and thus loss of the remaining available injection systems), there was no useable indication of reactor water level in the control room.
(Harrow range indication was the only reactor water level indication still receiving power in the control room and actual reactor water level was already below this range.) Useable reactor water level indication was available elsewhere (shutdown panel) in the plant but there was no attempt by the crew to obtain this information for approximately ten minutes.
During this time interval, the crew instead assumed what they considered to be worse case conditions (that reactor water level had dropped below -275 inches) and initiated steam cooling with one open SRV.
(The crew had already been depressurizing with multiple SRVs prior to the loss of AC power in anticipation of the use of the condensate system for injection.
Thus, upon the loss of AC power and the realization that no injection systems were available the crew just closed all but one of the SRVs.) The Emergency Operating Procedures (EOP) do not require steam cooling with one open SRV until -275 inches reactor water level (Minimum
_ _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _
%.
o
.
, -.
,
Zero - Injection RPV water level) is reached.
During the sequence, reactor water level dropped to only -192 inches.
'
Opening a SRV before RPV water level decreases to the Minimum Zero - Injection RPV water level results in less effective steam
,
cooling due to lower fuel temperatures and reduces the time over which the core remains adequately cooled with no injection.
In actuality, when the crew attempted to initiate steam cooling with one open SRV the reactor pressure was at 460 psig due to the previous depressurization.
The Emergency Operating Procedures require all ADS valves to be opened when RPV pressure is below 700 psig with no injection systems.
(Below 700 psig RPV pressure, steam cooling with one open SRV is no longer effective.) The crew had failed to check available RPV pressure indication (RCIC Turbine Steam Pressure av,ailable in the control room) prior to taking this action.
Approximately one minute later the crew checked RPV pressure, realized their error, and opened all ADS valves in accordance with the E0Ps.
'
The het effect of these errors in this particular case was just a slight delay in opening all ADS valves.
These errors do however indicate that operator training needs to better emphasize the use of alternate indications of plant parameters upon the loss of power.
(3) MSIV Isolation Followed by a Failure of Containment and Primary System Heat Removal Systems
!
This transient was initiated by an inadvertent closure of all
'
MSIVs with successful scram of the reactor and SRV operation.
Only RCIC worked for the higi pressure injection.
A loss of all AC power except Emergency Diesel Generator (EDG) 1A followed.
Those containment and primary system heat removal systems powered from EDG 1A also failed.
"
Observations from this simulation scenario were as follows:
i The crew properly entered and executed the E0Ps during this
!
scenario.
Actions taken by the crew were determined to be adequate.
(4) Other Findings The ability of the plant specific simulator to duplicate
'
these events was determined to be adequate.
'
D ei,tg the second scenario, the output breaker to the
operr, ting Diesel Generator did not automatically close.
,
'
This was due to another breaker supplying the bus for some unknown reason failing to open upon the loss of AC power.
This necessitated the operator to manually line up AC power to the bus.
l
j
7_ _ - - - - _ _.. _ _
'
.
N
, c.
,
The simulator capability for overrides is very extensive.
- All desired overrides were accomplished without difficulty.
Recognizing that the simulator was not designed to model
core melt sequences, the sequences selected were beyond that expected for the simulator capability.
The longer term decay heat removal operations and core-melt conditions were not incorporated due to this limitation.
The operators involved in the simulation appeared to be
familiar with PRA scenarios and thus seemed to expect these types of events (which may have led to the worst case assumptions made in the first scenario).
The second scenario on the simulator had to be stopped and
later restarted due to a failure of the "Executive." This was described by the simulator personnel as a recurrent problem with the simulator.
k.
Containment Leakage Rate While this inspection focused on Level 1 events (events leading to core damage), one Level 2 event (containment response) identified in the PRA as risk significant was reviewed.
This event was containment leakage.
While no additional inspection effort was expended in this area, the results of the initial containment leak tests are discussed below for perspective.
The first periodic Type A test (CILRT) on the Unit 1 primary containment us performed on June 1986 (See Inspection Report No. 50-373/86004).
The as-found leakage rate was 0.538 wt %/ day which exceeded the maximum allowable (.75 la) of 0.476 wt %/ day.
The as-left leakage rate was 0.269 wt %/ day.
The first periodic Type A tes' on the Unit 2 primary containment was performed in Mr/ 1987 (See Inspection Report No. 50-374/87033).
The as-found le W ge rate was 1.247 wt %/ day exceeding the maximum allowable of (,.4.'d wt %/ day.
The as-left leakage rate was 0.399 wt
%/ day.
In summary, bocn units have failed their first periodic test as-found condition.
The main contributors to the failures were the feedwater and RCIC steam exhaust isolation valves (check valves) for Unit 1, and the feedwster check valves and TIP purge supply stop valve for Unit 2.
Thus, the identification of containment leakage as a dominant release mechanism is not unfounded.
Both units remain on the normal test frequency of 3 CILRT's in ten years.
[
_ _ _ - - _ _ _ _ _ _ _ _ _.
,
,
ok
,
1.
PRA Flood Scenarios During the inspet. tion, the consultant from the Office of Research evaluated the incomplete flood scenarios for the PRA.
The two flood scenarios occur on separate floors in the reactor building, but initiate from rupture of low pressure service water piping.
The flood propagation was reviewed and the affected equipment was rechecked to make sure of the assumptions used in the analysis.
It was found that some additional analysis will be needed before the final flood sequences are quantified.
In addition, venting flow paths from ihe steam tunnel into the turbine building were reviewed and verified.
4.
Trainin; and Qualification Effectiveness With the exceptions noted in Paragraphs 3.c.(2) and 3.j.(2), the licensed operating staff and meintenance staff appeared well trained and qualified.
While the technical staff also appeared to be generally well qualified, the violation discussed in Paragraph 3.d.(3) (Potter-Brumfield relays)
indicates the staff needs to be better trained in recognizing safety issues.
5.
Quality Verification Effectiveness Only one of the various concerns identified by the inspection team had been previously identified by an oversight group (Paragraph 3.a.(2).(a)).
Of particular concern is the failure of any oversight group to identify those concerns resulting in the violations described in Paragraphs 3.d.(3)
and 3.f.(4).
The licensee should exert more effort in this area.
6.
Open Items Open items are matters that have been discussed with the licensee, which will be reviewed further, and involve some action on the part of the NRC or licensee or both.
Open items identified during the inspection are discussed in Paragraphc 3.a.(2).(b), and 3.f (1).
7.
Exit Interview The inspectors met with licensee representatives (denoted in Paragraph 1)
on July 22, 1988, and summarized the purpose and findings of the inspection.
The inspectors discussed the likely content of the inspection report with regard to documents or processes reviewed by inspectors during the inspection.
The licensee did not identify any such documents or processes as proprietary.
Additional communication with the licensee was conducted by telephone on September 7, 1988 informing them that the Patter-Brumfield relay problem (Paragraph 3.d.(3)) was considered a violation, l
l 23