IR 05000387/1995001
| ML17164A649 | |
| Person / Time | |
|---|---|
| Site: | Susquehanna  |
| Issue date: | 03/12/1995 |
| From: | Eugene Kelly, Brian Mcdermott NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML17164A648 | List: |
| References | |
| 50-387-95-01, 50-387-95-1, 50-388-95-01, 50-388-95-1, NUDOCS 9503210371 | |
| Download: ML17164A649 (16) | |
Text
U. S.
NUCLEAR REGULATORY COMMISSION
REGION I
DOCKET/REPORT NOS.
LICENSEE:
FACILITY:
DATES:
INSPECTORS:
50-387/95-01 50-388/95-01 Pennsylvania Power and Light Company (PPSL)
Susquehanna Steam Electric Station (SSES)
Berwick, Pennsylvania 18101 January 9-13, 1995 Douglas Dempsey, Reactor Engineer, DRS Stephen Shuman, NRC Consultant INSPECTORS:
Bria J.
cDer o
, Reactor Engineer System section Division of Reactor Safety Dat APPROVED BY:
Eugene N.
lly, Chief Systems tion Division of Reactor Safety D te SUMMARY:
The modification process provides engineers good guidance on the preparation and classification for the various types of design changes at SSES.
All design changes reviewed were found to be technically sound and reflected good engineering practices.
System engineering efforts associated with safety-related direct current (DC) electrical systems were effective in identifying and resolving design deficiencies and technical issues.
The licensee-identified engineering deficiencies reviewed by the inspector illustrated that subtle issues having a high 1'evel of complexity are being pursued by the nuclear engineering organization.
Four unresolved items were closed:
URI 50-387/94-11-01, RHR Pump Discharge Check Valve Modification Problem; URI 50-387/91-02-01, Design Control And Testing Of SGTS; URI 50-387/92-29-01, Failed AC Relay in DC Application; and URI 50-387/92-29-02, Feed Pump Failure To Trip On High Level.
Three unresolved items were opened:
URI 50-387,388/95-01-01, Control Of guality Drawings; URI 50-387,388/95-01-02, HPCI Suction Transfer Logic; and URI 50-387,388/95-01-03, Post-Scram Uncontrolled Rod Mithdrawal.
9503210371 950312 PDR ADQCK 05000387
DETAILS 1.0 INSPECTION SCOPE The objective of this inspection was to assess the technical adequacy of planned design changes and to review the engineering organization's resolution of several plant deficiencies.
The effectiveness of nuclear systems engineering (NSE)
was evaluated in an assessment of engineering activities associated with safety-related direct current (DC) electrical systems.
The issues and 'systems selected for review during this inspection were chosen based on their importance to safety, similarity to previous problems, and relative risk ranking.
NRC Inspection Procedure 37550 was used for guidance during this inspection.
2.0 INSPECTION FINDINGS 2.1 Design Change Processes The design change review assessed the adequacy of permanent plant modification packages and the processes used to generate these modifications.
The evaluation sample consisted of two major modification design change packages
{DCPs), four engineering change orders (ECOs), selected engineering documents relating to these changes, and four of the procedures utilized to generate the modifications.
Nodification Procedures Several of the procedures utilized in the preparation of DCPs and ECOs were reviewed in detail and utilized in a subsequent review of plant modifications.
MFP-(A-2309, Rev.
2,
"Design Change Package/Engineering Change Order Preparation,"
controls the detailed process for the preparation of major and minor DCPs and ECOs.
The process begins after a Modification Scoping Report (MSR) has been completed and work has been authorized to begin on an a DCP.
The procedure governs the major parts of the preparation process, including the assemoly and responsibilities of the Modification Team, the preparation of the DCP plan, DCP inputs, and drawing changes, and the review process.
The procedure is well thought out and provides clear direction and responsibilities for all parties, including supervision and management.
Examples and clarifications are provided.
Recently, additional direction has been added for specifying post-modification testing requirements (discussed further in Section 2.2).
"Design Inputs and Considerations,"
MFP-gA-2308, Rev.
2, provides procedural requirements for identifying the inputs and interfaces that could potentially affect a modification.
It emphasizes the need to identify all inputs and summarizes the inputs to be considered and the manner in which they should be established, in conjunction with Design Guide GDG-05, "Applicability Criteria for Design Considerations."
GDG-5 discusses 51 major design issues in detail, ranging from fire protection, a variety of electrical and controls issues, and radiological and risk assessment and management, for use in specifying the inputs for a modification.
In each case, the basis of the requirement, applicability criteria, and the actions required by the user are provide NDAP-gA-0726, "Safety Evaluations," provides a clearly written discussion on the preparation of safety evaluations.
Taken together these four procedures form a well written basis for the technical and procedural control of the preparation of design changes.
Design Change Packages The inspector reviewed two design change packages in detail.
Both of the modifications were prepared by the design modification group (DHG) at the Allentown corporate office.
The inspector found the modification packages to be generally well prepared and had the following comments:
DCP 94-3023C RHR Pum Motor Lube Oil Cooler Re lacement Modifications This design change package is one of eight identical DCP's to replace the safety-related, RHR pump motor lube oil coolers of the four RHR pumps in both of the SSES Units.
Each cooler is comprised of approximately 186 ft. of 3/4 inch tubing.
A portion of the emergency service water (ESW) piping that supplies the coolers is also being replaced as part of this modification.
The new ESW piping configuration that will allow nondestructive examination of the coils that had not previously been possible.
The licensee found that the original copper tubing coolers experienced
"underdeposit corrosion/pitting" as a result of microbiologically induced corrosion.
This condition has allowed pressurized ESW to leak into the lubricating oil for the pump motor bearings.
The new cooler coils are constructed of AL-6XN, a more corrosion resistant alloy of stainless steel, and the replacement ESW supply piping (ASNE Class III) is also made of stainless steel.
The original coolers were supplied with the RHR pump motors as part of a 1968 General Electric NSSS purchase order.
The inspector noted that the DCP and the procurement package for the new coolers did not include a design and fabrication code for the cooler, although they did speciFy ASHE III Class
for the ESW supply piping.
The inspector questioned how the licensee maintained design and fabrication control for the coolers without specifying code requirements in their procurement document.
The licensee's position was that the coils were being supplied by the manufacturer as replacement parts and are expected to meet the original design requirements.
The inspector noted that the procurement document did include many important design requirements that are typically included in a design and fabrication code.
These included material controls, welding requirements, and relevant testing requirements, such as eddy current testing.
Since many of the requirements that would have been included in a design code were included in the specification provided in the DCP, and since the AL-6XN material to be used in the replacement is superior to the original copper coils, the inspector concluded the new coils are an improvement over the equipment being replaced.
The inspector found other portions of the DCP to be thoroughly prepared and technically sound.
The design inputs and safety evaluation were both complete and well written.
Outstanding items identified during initial preparation of the DCP were appropriately identified and tracked by an engineering hold order
{EHO 94-036).
These items, related to the heat transfer and seismic capability of the new coils, were subsequently resolved and the EHO was properly closed out.
DCP 94-3053 Su lemental Deca Heat Removal SDHR The two existing systems for removing decay heat from the spent fuel pool are the fuel pool cooling and cleanup
{FPCC) system and residual heat removal
{RHR) systems.
As a result of fuel changes for 24 month fuel cycles and power uprate, the FPCC system alone cannot support the decay heat load of a full core off-load.
In addition, to shorten outages the licensee would like to remove the FPCC and RHR systems earlier than in previous outages for planned maintenance.
The SDHR modification provides permanent nonsafety-related
'iping to connect portable cooling equipment, located outside the reactor building, to the existing service water supply and return piping of the spent fuel pool heat exchangers..
The SDHR system is parallel to the service water system and would be used in place of it to cool the spent fuel pool.
The SDHR piping connects with the existing service water lines between the SW isolation valves and the heat exchangers.
The SDHR lines from both Units combine to form a single set of 12 inch supply and return lines that penetrate the reactor building terminate as a blind flange in the yard.
The temporary SDHR coolers and chillers will be connected at the blind flange and are to be added by a separate DCP.
The DCP for these temporary coolers and chillers was not complete or available for review at the time of the inspection.
Although no problems were found with the SDHR DCP reviewed, several important issues remain to be resolved before the design of the new system is complete.
The temporary chiller the licensee intends to use must maintain the heat exchangers tube side pressure at least 5 psi greater than the shell side in order to minimize the possibility of radioactive cortamination of the service water system in the event of a tube leak.
A system has not yet been purchased and tested to meet this requirement.
A second item relates to the isolation capability for the new coolers.
A method or quickly isolating flow in the event of a tube leak or pipe break had yet to be established.
Finally, although the approved DCP and existing safety evaluation is based on having a
radiation monitor in the new system, similar to the technical specification required radiation monitor for the service water system, this aspect of the design had not yet been finalized.
The inspector concluded that further discussion between PP8L and the NRC would be necessary if the licensee decided to use radiation monitoring other than the existing service water radiation monitor.
Engineering Change Orders (ECOs)
The inspector screened four ECOs to assess the safety significance of changes being made under the ECO process as opposed to the DCP process.
The licensee's DCP/ECO procedure, HFP-gA-2309, discussed above, provides for the use of ECO's for relatively simple configuration changes.
These generally do not effect safety-related or technical specification equipment, do not require a
CFR 50.59 evaluation (confirmed by a
CFR 50.59 screening),
do not
alter the manner in which a system operates, and do not require significant engineering or installation resources.
The total engineering effort is normally less than 300 man-hours.
When the ECO process is used for a safety-related change, it must be minor, and approved by either the supervisor of design/drafting, or the supervisor of site modification, in accordance with NDAP gA-1202, "Nuclear Department Hodification Program."
The approval is documented on an Engineering Change Order Evaluation Form, HFP-(A-2309-7, which also includes the
CFR 50.59 screening.
A complete evaluation of design inputs and considerations, similar to that made for DCP's, is made for all ECO's.
The inspector reviewed the following safety-related ECO's:
ECO 94-6022, Repair Crack in Zone III Duct ECO 94-6004, Unit 2 Seal Plate Grating and "Cattle Chute" Legs Both modifications involved work on some safety-related components, but the changes were relatively minor, simple in design, and met the criteria for the use of the ECO process.
The necessary
CFR 50.59 determinations were properly prepared and acceptable.
The following nonsafety-related ECO's were reviewed:
ECO 94-6034, Lighting Conduit Interference with HV-251F050A ECO 94-6011, Recirc Pump Hoist Honorail Bus Bar Guard Both were relatively minor nonsafety-related modifications to remove interferences, to correct personnel safety concerns, or to lower the potential for man-rem exposure of personnel during maintenance operations.
ECO 94-6034 included appropriate seismic and
CFR 50, Appendix R considerations.
Both were properly completed and thorough, the
CFR 50.59 screenings were appropriate, and no problems were found.
Controlled Drawing Updates
'lant modification packages must identify, via drawing change mechanisms, changes that are required for all affected plant drawings.
As-build drawings determined to be "critical in meeting daily plant operator needs" are designated as Class 1 Drawings in accordance with HFP-(A-4002,
"Drawings and Drawing Control."
Typically, Class 1 drawings are the piping and instrumentation drawings (P8 IDs), electrical single lines, and electrical schematic diagrams used by the plant control room operators and kept in the control room stick files.
Following the installation of a modification NDAP-gA-1211,
"SSES DCP Installation Process,"
requires the completion of an Operational Readiness Form (ORF).
The operations department ORF sign-off, confirms that any procedure changes required for operability are delivered to the control room.
However, the inspector noted that the ORF does not require any update or annotation of control room Class 1 drawings before the system can be made operable.
Nuclear Records procedure RI-002,
"Drawing Stick File Establishment
and Maintenance,"
requires the update of controlled stick files within three working days of notification.
The inspector concluded that the delays resulting from the licensee's processing could result in up to a five day lag (Friday through Wednesday)
in the correct configuration drawings being available for operators.
The inspector considered this a potential problem because, during that delay, operators could be mislead by the obsolete drawings when responding to an unexpected operational occurrence.
At the exit meeting, the licensee indicated that an October 1993 "near miss" incident related to this issue was being evaluated under the Human Performance Enhancement System (HPES).
Although not yet formally approved, the inspector reviewed the HPES's root causes for the incident that involved the preparation of equipment release forms (ERF)
and blocking permits.
The HPES addressed programmatic shortfalls that allowed a recent modification to be missed on the ERF and permits.
Although the delay time for update of controlled stick files was discussed as a contributor, the potential for obsolete drawings to misleading operators was not specifically addressed.
The inspectot concluded that the licensee's identification of the "near miss" and subsequent review of the incident was a strength.
This process led to the identification of programmatic concerns having direct impact on personnel safety, however, the HPES activity was not completed and corrective actions had not been taken.
The inspector also concluded that the licensee'.s requirements for the update of Class I drawings in the control room were not consistent with requirements for other modification-related document changes (e.g.,
operating procedures)
directly impacting an operator's ability to respond to plant problems.
The inspector considered this issue unresolved, pending the licensee's review of the inconsistency in timeliness requirements for updates of quality procedures and drawings, and the impact of this inconsistency on configuration control (VRI 50-387,388/95-01-01).
2.2 Engineering Evaluation Of Deficiencies The inspector selected two safety-significant issues for review based on a
screening of recent nonconformance reports (NCRs), significant operating occurrence reports (SOORs)
and engineering deficiency reports (EDRs).
In order to assess the involvement of the engineering organization and the technical adequacy of the dispositions for the selected issues, background information and closeout documentation were reviewed, and interviews were conducted with cognizant site and corporate engineers.
The licensee's actions regarding four unresolved items from previous NRC inspections also were reviewed.
Current Engineering Issues EDR 94-046 HPCI Suction Transfer The licensee's identification of a potential conflict between the HPCI design basis and the BWR Owner's Group Emergency Procedure Guidelines was initially discussed in the combined NRC Inspection Report (IR) 50-387/94-17, 50-388/94-18 issued on September 23, 1994.
After the inspection ended, the licensee concluded that HPCI was operable based on a suppression pool letdown
flow path through the RHR system to the radioactive waste system.
Although this alignment was referenced in the EOPs and provided for in existing procedures, the licensee recognized that calculations would be necessary to support their initial judgement regarding the acceptability the solution...
During this inspection, the inspector reviewed the licensee's initial operability determination made in August 1994 and questioned the capacity of the suppression pool letdown f'low path (through RHR shutdown cooling to the Rad Waste System) relied upon in that determination.
The licensee stated that the flow path was initially considered adequate since it existed in EOPs;
, however, no preliminary engineering estimates had been made.
In discussions with licensee personnel, the inspector learned that the detailed calculations had just been completed over four months after the initial operability determination.
These calculations showed that the letdown flow rate was significantly less than that necessary to mitigate the high suppression pool level concerns raised by the EDR.
Subsequently, PP&L had to reevaluate the operability of HPCI.
The licensee's evaluation and conclusions are discussed in NRC Inspection Report 95-02 for SSES.
The inspector considered the licensee's efforts to resolve the immediate operability issue appropriate, once the original (August 1994) determination was questioned in January 1995.
The inspector observed that there is no clear guidance on what technical basis is required for an interim operability determination or what immediate actions are required when information invalidating that determination is identified.
PP&L had recognized a need for improved guidance in this area and was planning to implement additional guidance in the near future.
The licensee's justification for HPCI operability is discussed in IR 95-02, and the inspector concluded that the licensees approach to resolving this engineering issue was appropriate.
However, the inspector considered the issue unresolved pending the licensee's resolution of EDR 94-046 and NRC review of certain aspects of this issue such as the suppression pool temperature response and ultimately the implementation of the keylock switch modification (URI 50-387, 388/95-01-02).
EDR 94-001 Post-Scram Uncontrolled Rod Withdrawa On January 6,
1994, the licensee issued EDR 94-001 questioning the potential for a post-scram, uncontrolled rod withdrawal due to leakage past a
nonsafety-related check valve.
The EDR postulates that following a loss of coolant accident (LOCA), multiple control rods in the full-in (overshoot)
position could withdraw due to leakage past the check valves that isolate each control rod drive (CRD) mechanism from the scram discharge volume (SDV).
The subject check valves are not subject to any periodic testing or maintenance and, due to their location in the system, a failure would not be detected under normal circumstances.
Following a postulated LOCA the reactor is expected to scram the reactor vessel will depressurize.
Once the scram is complete, the CRD mechanism seal leakage from the CRD pump and the reactor vessel continues to flow into the SDV until the SDV pressure has equalized with the reactor vessel pressur s The EDR postulates that as the reactor pressure falls below the SDV pressure, backleakage through the scram discharge line check valves could build up pressure sufficient to actuate the collet piston of any CRD that was not already latched.'he.EDR further postulates that the unlatched CROs, with their collet fingers now retracted, would be pressurized causing an unanticipated control rod withdrawal.
PPKL's operability evaluation discussed several variables associated with the hydraulic analysis of the postulated event.
Specifically, the event would be dependent on the leakage rates through all SDV check valves, the leakage rates of the CRO over-piston and under-piston seals, and the depressurization rate of the reactor vessel.
The licensee expected that the results of a more detailed analysis would conclude that withdrawal of one (or more)
CRO due to SDV check valve leakage is not credible.
PPLL commissioned a detailed hydraulic analysis of the CRD system in the post-LOCA condition for final resolution of the EDR.
The postulated scenario was evaluated for Susquehanna by General Electric Company (GE) in a proprietary report dated July 1994.
The report concludes that it is highly unlikely that a
CRD would be inadvertently withdrawn during post-LOCA conditions.
The inspector reviewed the GE report and concluded that the assumptions that bound the analysis were reasonable and that there appeared to be sufficient basis for the conclusions reached.
Also, the inspector concluded that PP8L was taking appropriate actions, although not yet complete, to thoroughly address the complex technical issue identified by EDR 94-001.
However, the licensee had not yet addressed maintenance recommendations in the GE report, testing issues raised by the EDR, or the acceptability of the generic BWR assumptions relative to Susquehanna's CRD experience.
Pending a more detailed NRC review of the licensee's final engineering evaluation, the inspector considered the issue unresolved (URI 50-387,388/95-01-03).
Closed Engineering Issues
~UR 94-11-0 Closed RHR Pum 0'schar e
C eck Valve Hod'fleet'o P oble On Hay 29, 1994, with Unit 2 in cold shutdown, the "B" and "D" residual heat removal (RHR)
pump discharge check valves failed to close when their respective pumps were secured.
Failure of the two vertically-mounted check valves was identified after air was detected at the system high point vent and operators were unable to establish keep-fill pressure.
The incident was documented in Significant Operating Occurrence Report, SOOR 94-356.
On Nay 31, the SOOR was amended to included the subsequent failure of the "C" RHR pump discharge check valve.
Ultimately PP&L determined that the all four RHR pump discharge check valves had been incorrectly modified during refueling outage.
A design change intended to increase the length of each check valve's backstop (reducing its swing arc)
was implemented to correct previous problems were these valve's had failed open.
However due to a vendor design error, the backstop length was decreased rather than increased, causing the valves to more readily fail open, This design error was missed by all of the barriers in the licensee's modification program and was not detected until the check valves failed after return to servic The NRC's review of this event in Inspection Report 94-11 evaluated the licensee's initial Event Review Team (ERT) findings and safety assessment presented to the Plant Operations Review Committee (PORC)
on June 3, 1994.
The PORC found the immediate corrective iactions acceptable, however, they directed the ERT to revise and strengthen the actions to prevent recurrence.
The inspector's assessment in IR.94-11 concluded that although the impact on plant safety was low, the modification process deficiencies that allowed this fundamental design error to go undetected were safety significant.
The issue was identified as unresolved (URI 50-387/94-11-01)
pending the licensee's final evaluation and corrective actions.
During this inspection, the inspector reviewed the licensee's corrective actions for modification process deficiencies identified during the outage and the licensee's self-assessment efforts upon which the corrective actions were based.
Two other modification design and installation related events occurred during the Unit 2 outage.
On Nay 20, 1994, Nonconformance Report 94-182 was issued when instrument technicians recognized Condensing Chamber XY-821-2D004A had not been installed in accordance with the requirements of DCP 93-3060A.
On June 2,
1994, Engineering Deficiency Report 94-032 was generated and a root cause team formed when the licensee determined that inadequate clearances existed for piping installed under DCP 93-3060C.
In both cases, the modifications had essentially progressed to the point of completion before the problems were recognized.
The inspector reviewed and evaluated the licensees followup of all three events, including the root cause investigations and corrective action implementation.
The-licensee had improved the modification procedures, conducted an audit of the check valve vendor 's quality assurance program, and conducted training for engineers and installation personnel.
The specific procedures revised during this effort are discussed in the following section of this report.
The inspector also reviewed the Nuclear Safety Assessment Group's independent review of the RHR check valve event (NSAG 8-94)
and the results of a separate management investigation into the human
,".erformance and personal accountability aspects of the event.
The licensee had made several reviews of the RHR check valve incident against the other two modification related events for commonalities, trends, or opportunities for improvement.
The inspector concluded that PP8L's actions in response to the RHR check valve design error, resulted in thorough corrective actions and demonstrated the organizations ability to perform a critical self-assessment of its performance.
The inspector considered this unresolved item closed (URI 50-387/94-11-01)
.
URI 91-02-01 Closed Desi n Control And Testin Of SGTS This item is concerns an instrumentation installation error that was not identified during either the design review or the post-modification testing of a
DCP for the standby gas treatment system (SGTS).
The modification had improperly established the setpoints for two different automatically initiated cooling modes.
The licensee's testing program did not detect the error since the testing did not verify the design function as related to the corresponding temperature setpoints.
The design error remained undetected until an
investigation into a spurious initiation of the system (resulting from the error) in 1991.
The unresolved item also noted a similar incident that had occurred a few years earlier related to the miswiring of the MSIV differential temperature detectors, which was also not;found during the post-modification testing process (Inspection Report No. 50-387/88-15).
As a result of these events, the licensee took several actions to lessen the possibility of this type of problem recurring.
These included the addition of an installation kickoff meeting prior to the release of a modification for installation to communicate the installation and testing strategy.
In addition, in the Fall of 1994, substantial changes were made to several plant procedures in response to the RHR/CS check valve event (URI 94-11-01)
discussed above.
These included a major addition to the direction given for establishing post-modification testing requirements in MFP-(A-2309, and expanding the requirements and direction to the MIG for the installation kickoff meetings.
MFI-3203, Rev. 0, "Modification Installation Group," issued on Nov. 30, 1994, gives additional responsibilities to the MIG and system engineers to ensure that sufficient post-modification testing is performed for each modification.
On the basis of the licensees actions described above, the inspector considered this unresolved item closed (URI 50-387/91-02-01).
Closed URI 92-29-01 nd URI 92-29-02 Failed C
e I
DC cto On November ll, 1992, a main turbine trip and reactor scram occurred during performance of a monthly functional test of the feedwater control system.
The
"A" reactor feed pump turbine also failed to trip as designed.
The event was caused by failure of a nonsafety-related Agastat
"GP" series relay in the main turbine and reactor feed pump turbine high water level trip logic.
The licensee subsequently found that the relay failed due to overheating attributed to misapplication of an alternating current relay in a direct current circuit.
These items were opened to track the licensees's assessment of why the misapplication originally took place, and the generic implications of the relay failure.
Because the relay was installed in 1982, the licensee was unable to determine the precise cause of the misapplication.
However, following the event, the licensee reviewed other Agastat
"GP" series relays at both units and found no further incorrect installations.
Several drawing errors involving Agastat relay designations were found and corrected.
The inspector noted that the architect-engineer drawing for the relay, which failed erroneously, specified an alternating current relay.
Thus it is possible that the misapplication originally was caused by an incorrect drawing.
The inspector concluded that the licensee's corrective actions were prompt and comprehensive.
In a related matter, the potential for accelerated thermal aging and premature failure of continuously energized Agastat
"GP" series relays was evaluated by the licensee in Engineering Discrepancy Report (EDR) G10070.
The EDR was initiated when degraded relays were found in a ventilation control panel, and came to fruition just prior to the November 1992 event.
As a result, the licensee developed a preventive maintenance program to replace Agastat
"GP" series relays on a 4.5 year cycle.
The inspector verified that the program was in place, and concluded that the specified relay replacement schedules
adequately address the generic concern regarding relay failures due to thermal aging.
Based on the licensee's actions discussed above, the inspector considered. the two unresolv'ed items closed (URI 50-387/92-29-01 and URI 50-387/92-29-02).
2.3 Nuclear System Engineering Engineering activities associated with safety-related direct current electrical systems. were reviewed to assess the effectiveness of the engineering organization in identifying and resolving technical issues and problems.
The inspection included a review of engineering deficiency reports, significant operating occurrence reports, and design change packages; system walkdowns; and interviews with plant personnel.
Items identified both by the licensee and the NRC were reviewed.
The inspector concluded that the licensee's mechanisms for identifying, evaluating, prioritizing,'nd resolving design deficiencies and technical issues effectively contributed to maintaining operability of the systems.
Appropriate corrective actions were implemented within a time frame commensurate with safety significance, and modifications adequately reflected design basis requirements.
Fuse Re lacement In Safet -Related 250 Ydc S stems In 1990, an NRC electrical distribution system functional inspection (EOSFI)
identified that control fuses installed in 250 Vdc systems were rated only for 250 volts, while normal system operating voltage was 264 to 285 Volts DC.
Higher voltages produce a longer arc and require greater length between terminal points within the fuse to quench the arc.
The licensee was unable to demonstrate that the existing fuses had the required capability, and implemented design changes to replace the existing fuses with others rated at 300 Volts DC. Design Change Packages 90-3084 and 90-3085 were discussed in the combined NRC Inspection Report 50-387/91-17, 388/91-17.
The modifications were implemented by the licensee in 1992.
The inspector verified completion of the administrative aspects, such as parts list changes and drawing revisions, by postulating fuse failure in a load center and requesting the electrical maintenance department to find a replacement fuse.
The maintenance electrician was unable to locate the fuse type in department files and properly consulted his supervisor and the system engineer.
Subsequently, the appropriate drawing was located and the inspector confirmed that the 300 Volt fuse was identified in the updated drawing.
The inspector concluded that the drawings affected by the design change had been updated properly, and that the electrician took the appropriate actions to locate a
proper replacement fuse.
I 5 Vdc S stem Si le F 'lure C neer In 1990 the licensee identified a condition in which postulated failure of 125 Vdc station battery 'A'or 'B') before or coincident with a loss of coolant accident and loss of offsite power would cause a loss of two 4. 16 KV safety busses, resulting in less than the required complement of emergency core
cooling system equipment to mitigate the accident.
The condition was discussed in the combined NRC Inspection Report 50-387/90-12, 50-388/90-12 and reported by the licensee in Licensee Event Report 90-013.
The problem was inherent in the original design of the plant in that the 125 Ydc breaker control power for certain 4.16 KY loads on the channel 'C'nd
'D'usses is provided by battery channels 'A'nd 'B'.
Loss of the 'A'r
'B'attery would result in failure to shed these loads, which could lead to an overload condition and loss of the associated emergency diesel generator.
The licensee performed failure modes and -affects analyses (FHEA) for the
'A'nd
'B'attery systems.
The analyses identified that 37 electrical Class 1E devices were cross-tied between the 125 Vdc channels and determined which of the devices required modification to correct the design deficiency.
The inspector reviewed portions of Design Change Package Series 93-3002, 3003, 3004, and 3005, which were developed to correct the condition.
The modifications added an automatic transfer logic to the breaker trip circuitry of each affected load on 4.16 KV busses 'C'nd 'D'uch that upon loss of the normal control power supply, power is provided by the associated channel
'C'r
'D'tation battery.
This was done through installation of a relay across the normal control power supply; when de-energized, the trip function will be isolated from the remaining control circuits and reconnected to the alternate supply.
An indica.ing light also was added to monitor the status of the transfer scheme.
The inspector noted that the licensee properly chose
"make before break" relays to assure that the normal and alternate battery supplies are never placed in parallel.
The inspector also verified that the relays and indicating lamps were evaluated against the battery load profiles.
The inspector concluded that the performance of a FHEA of the 125 Vdc systems was an appropriate response to the original concern, and that the design changes brought the plant back into conformance with the single failure criterion.
Re lacement of Alarm Rela s 'in 250 Vdc S stems The 1990 EDSFI identified that there was no design basis for the existing overvoltage (OV) and undervoltage (UV) alarm setpoints in the safety-related 250 Vdc system.
The alarms warn operators of abnormal system conditions caused by malfunction of the battery chargers.
The licensee calculated new setpoints based on normal system float and equalizing charge voltages.
However, the existing alarm relays could not be adjusted to alarm and reset properly using the new setpoints.
Design Change Package (DCP) 91-9072 replaced the relays with CSD alarm relays and Potter-Brumfield HDR-5151 isolation relays.
The HDR relays are used to isolate the 250 Volt Class IE system from the nonsafety-related alarm annuciator system.
The inspector noted that the DCP contained electrical isolation (safety tagging)
requirements and specified the technical specification safety equipment that would be rendered inoperable while implementing the modification.
Retest requirements and methods were explained in detail and adequately demonstrated
successful installation of the modification.
Performance of the retests was documented by annotating the retest work orders, which established traceability.
In addition, the actual lengths of associated electrical cables were fed back into design documents via raceway data input forms.
Engineering Deficiency Report G30010 documented a subtle problem with the modification.
The C8D alarm relays utilize a Potter-Brumfield model R10 auxiliary relay with output contacts in series with the MDR-5151 isolation relay.
Since the R10 relay contacts are rated only for 115 Volts OC, the potential existed to weld the contacts together when trying to interrupt current in a 250 Volt system.
This condition could fail the UV alarm or prevent an OV alarm from resetting.
DCP 93-9073 installed a zener diode circuit that clamps the voltage across the voltage sensing relay contacts and the MDR isolation relays, thus maintaining the proper conditions across the R10 auxiliary relays.
This solution also was incorporated into related DCPs that had not yet been installed in the plant.
The inspector found that the design documents were thorough and technically sound.
The associated safety evaluations adequately established that no unreviewed safety question existed.
Feedback of field cable lengths into raceway design documents indicated a good program for maintaining plant design configuration information.
The EDR demonstrated strength in the licensee's ongoing technical review process.
3.0 MANAGEMENT OVERSIGHT Direct management involvement in safety-significant engineering issues observed during this inspection was a strength.
With regard to the high pressure coolant injection (HPCI) suction transfer issue (Section 2.2, pages 5-6), the inspector considered the licensee's approach to the operability determination to be balanced, recognizing the necessity for a timely operability determination and the need to "validate" the issue as a potential problem.
Significant management involvement was noted in several aspects of the residual heat removal (RHR) check valve design error assessment.
The inspector considered the additional reviews directed by PP8L management (NSAG investigation and the "special management review") as indicative of a genuine concern for ensuring that the assessment of the incident was comprehensive.
4.0 MEETINGS The scope and purpose of the inspection were discussed at an entrance meeting conducted on January 9,
1995.
During the course of the inspection, the findings were discussed periodically with the licensee representatives.
An exit was conducted on January 13, 1995, at which time the preliminary findings were summarized and conclusions were presented.
The licensee acknowledged the findings and conclusions, with no exceptions taken.
Some proprietary information was reviewed as part of this inspection (relative to EDR 94-001),
however, the details of this information were not included as part of the written inspection repor The persons listed below were the principle participants in the exit meeting:
Penns lvania Power 5 Li ht Co.
G. Jones, Vice President Nuclear Engineering G. Miller, Manager Nuclear Technology H. Palmer, Manager Nuclear Systems Engineering M. Simpson, Manager Nuclear Modifications G. Stanley, Vice President Operations Nuclear Re ulator Commission M. Banerjee, Senior Resident Inspector