IR 05000423/1989023
| ML20011F552 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 02/24/1990 |
| From: | Haverkamp D NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20011F548 | List: |
| References | |
| 50-423-89-23, NUDOCS 9003060248 | |
| Download: ML20011F552 (30) | |
Text
'
'
'
'
_,,-
og
.
h..
J.
-
,
s.'
.
-
g.',
.
l
)(
U.S. NUCLEAR REGULATORY COMMISSION
-
REGION I
p Report No.:'
'50-423/89-23
' Docket No.:.
50-4g
'
{
License No.:
NPF-d9
,
- Licensee
Northeast Nuclear Energy Company P.O. box 270 Hartf'rd, Connecticut 06141 0270 e
Facility Name: M111 stone' Nuclear Power Station, Unit 3 Inspection.at: Waterilord, Connecticut Inspection Conducted:
November 28, 1989 - January.4, 1990
. Reporting Inspector:
Kenneth.S. Kolaczyk, Resident Inspector, Millstone 3 Inspectors:
William J. Raymond, Millstone Senior Resident Inspector
-
Kenneth S. Kolaczyk, Resident Inspector, Millstone 3 Approved by:
Mk w
/
2/21/f6 Donald R. Haverkamp, Chie#~
Date Reactor Projects Section 4A
-
Division of Reactor Projects Inspection Summary:
Inspection on November 28,- 1989 - January 4, 1990 (Inspection Report No. 50-423/89-23)
Areas Inspected:
Routine safety inspection by resident inspectors of plant operations; radiological controls; maintenance and surveillance; engineering and technical support; and safety assessment and quality verification.
Results:
1.
General Conclusions on Adequacy,-Strength on Weaknesses in Licensee Programs
$1 During this inspection period, the inspectors noted several instances of appropriate -in-depth engineering assessment by the licensee's engineering and operations organization.
During the cold shutdown outage, the condi-tion of components in containment was thoroughly assessed by operations and engineering staffs (section 3.2.1).
Also, corporate engineers discovered a potential weakness in tne fast bus transfer scheme and conducted a comprehensive analysis and assessment of the problem (section 6.1).
i 90030gh,h
FDR O
,
...
.
-
.
.
.-
p,
,.
.
"'?i; f
.,
..
Additionally, the inspector noted timely and appropriate action was taken by the licensee when the operability of a safety valve was in question (section 3.1.1).
Weaknesses were noted in the removal of safety-related equipment from
operation (section 3.4); and, in procedural preparation (section 3.6),
and procedural adherence (section 5.2.1).
'
'2.
Violations-
'Within the' scope of the inspection, two apparent violations were identified. One concerned the removal of the automatic start feature of the service water booster pumps from operation (section 3.4).
The second apparent violation concerned the improper shipment of radioactive materials (section 4.3).
'
3.
linresolved Items Two open items were closed. One item concerned repairs performed on the power operated relief valves (Section 5.1.2).
The other item concerned a licensee-identified weakness in the fast bus transfer scheme. (Section 6.1).
One item was opened; it concerned the timeliness of reporting to the NRC the licensee-identified weakness in the fast-bus transfer system (section 6.2).
l h
. -
r.
s
. e
..
W
..-
,
,
4;
I TABLE OF CONTENTS Page
'
1.0 Persons Contacted.........................
2.0 S umma ry o f ~ Fa c i l i ty Ac t i v i t i e s..................
.
3.0 Plant Operations (IP 71707/71710/93702)*.............
3.1 Control' Room Observations..................
+
3.1.1 Plant Shutdown Because of Faulty Pressurizer Safety
,
Valve.........................
3.2 Plant Tours........... _.............
3.2.1 Tours of Containment Structure............
3.2.2 Steam Generator Snubber Leakage
...........
3.3 Stand-by Readiness of Engineered Safety Features Systems and System Walkdown..............
...
3.4 Service Water Booster Pump Automatic-Start Function
' Defeated...........................
.
3.5 Review of Plant Incident Reports...............
'
3.6 Engineered Safety Feature Actuation....
.........
3.7 Auxiliary Feed Water Check Valves Examined.
,
.........
t 4.0' Radiological Controls (IP 71707/93702)..............
12-4.1 Posting and Controls of Radiological Areas.......
...
4.2 Minor Spill of Contaminated Fluids,.............
4.3 Radwaste Transportation - Millstone Station.........
5.0 Maintenance / Surveillance (IP 62703/61726/92701)..........
s 5.1 Observation of. Maintenance Activities............
5.1.1 Steam Generator Leakage Repairs............
5.1.2 (Closed) Unresolved Item 86-29-02, Power Operated Relief Valves............. ~14 5.2 Observation of Surveillance Activities............
5.2.1 Inadvertent Containment Discharge Actuation......
'
6.0 Engineering / Technical Support (IP 37701/93702/92701).......
6.' 1 (Closed) UNR 89-21-06 4160 Volt Bus Fast Transfer Scheme...
6.2 Reportability Evaluation - Reporting Timeliness.......
,
7.3
-
Safety Assessment / Quality Verification (IP 90712/92700).....
7.1 Review of Licensee Event Reports (LERs)...........
- 8.0 Management Meetings (IP 30703).
.................
The NRC. inspection manual inspection procedure (IP) or temporary
instruction (TI) that was used as inspection guidance is listed for L:
each applicable report section.
T-1
.
.
'
L
.:
.
!
,
,,
_,
,.
P DETAILS 1.0 Persons Contacted Interviews and discussions were conducted with licensee staff and management during the report period to obtain information pertinent to the areas inspected.
Inspection findings were discussed periodically with the supervisory and management personnel identified below.
,
- S._Scace, Station. Superintendent
- C. Clement, Unit 3 Superintendent
- M. Gentry, Operations Supervisor
- R. Rothgeb, Maintenance Supervisor S. Jonasch, Maintenance Engineer
- J. Harris, Engineering Supervisor D. McDaniel, Reactor Engineer M. Pearson, Assistant Operations Supervisor
- B. Enoch, Supervisor, Instrument and Controls K. Covin, Assistant Operations Supervisor
- Attendee at post-inspection exit meeting on January 12, 1990.
2.0 Summary of Facility Activities On November 28, a containment entry during Millstone Nuclear Power-Station Unit 3 (Millstone 3 or the plant) operation at full power revealed that the operability of the "C" pressurizer safety valve was questionable as a result of a discovery that an adjustment screw-had been dislodged from the valve. Accordingly, the licensee (Northeast Nuclear Energy Company) shut down the plant in accordance with plant technical specifications and placed the plant in mode 5 cold shutdown to replace the defective valve.
During the outage, additional work was performed including reworking the "C" and "D" steam generator secondary inspection plates and inspection of the "D" auxiliary feedwater check valves. Outage activities appeared to be well planned and sequenced which could be' attributed to the maintenance of active hot / cold shutdown work lists. On December 5, while opening the main steam isolation valves in preparation for testing and the final phase of steam plant heatup, a safety injection occurred when a main steam isolation valve was opened.
The plant responded as expected and upon completing a review of the event, b-plant startup recommenced. The turbine was synchronized to the grid on December 7 and full power was obtained on December _9.
While performing slave relay testing on December 11, operator error caused a partial containment discharge actuation (CDA). The event was quickly recognized and terminated by the operators and the plant restored to a normal configuration. During the remainder of the report period, Millstone 3 operated essentially at 100% of rated thermal power. One minor power reduction was conducted on December 20 to allow backwashing of the condenser.
.
,n 4,
i
,,.
.-
.
.
,
.
l The inspection activities durin'g this report period included 110 hours0.00127 days <br />0.0306 hours <br />1.818783e-4 weeks <br />4.1855e-5 months <br /> of inspection during normal utility working hours.
In addition, the review of plant operations was routinely conducted during portions of backshifts (evening shifts) and deep backshift (weekends and midnight
!
shifts).
Inspection coverage was provided for 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> during backshifts and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> during deep backshifts.
3~.0 -Plant Operations 3.1 Control Room Observations The inspector reviewed plant operations from the control room and reviewed the operational status of plant safety systems to verify
!
'
safe operation of the plant in accordance with the requirements j
of technical specifications and plant operation procedures.
[
Actions taken to meet technical specification requirements when I
equipment was inoperable were reviewed to verify the limiting i
conditions for operations were met.
Plant logs and control room indicators were reviewed to identify changes in plant operational l
status since the -last review and to verify the changes in the j
status of plant equipment was properly communicated in the logs i
~
and records.
Control room instruments were observed for correlation
{
between channels, proper functioning and conformance with technical j
specifications. Alarm conditions in effect were reviewed with control room operators to verify proper response to off-normal j
conditions and to verify operators were knowledgeable of plant
status. Operators were found to be~ cognizant of control room indications and plant status during normal working hours and
,
backshift observations.
Control room manning and shift staffing
were reviewed and compared to technical specification requirements.
'
No inadequacies were identified.
i 3.1.1 Plant Shutdown Because of Faulty Pressurizer Safety Valve
~
Inspection Report 89-11 documented safety valve seat leakage that was identified at the commencement of Cycle 3 operation.
The
safety valve leakage was noted by a 200 degrees F safety valve i
discharge tailpipe temperature which is 140 degrees F higher than normal and by the need to frequently pump down the pressurizer
,
relief tank (PRT). The safety valve seat leakage into the PRT i
remained essentially constant until November 24 when safety valve
.
tailpipe temperature had decreased to 100 degrees F.
Additionally, containment-radiation levels had increased slightly, as read on l
containment radiation monitor CMS-22 and unidentified leakage had
!
increased.
The inspector was informed that the suspected cause of
'
the decrease in safety valve tailpipe temperature was a failed l
bellows joint.
A failed bellows would allow safety valve seat
"
leakage to discharge into the containment. This would cause tailpipe temperature to decrease, radiation levels to increase, i
and unidentified leak rate to increase since the safety valve
!
.
.
- - - - - - - - - - -
.
_
m
.
'
.
.
'
w
leakage is no longer being collected in the PRT.
The bellows are used as a cleanliness seal and, according to licensee engineers, have a-history of failure in other plant applications, j
l On November 28, with the plant operating at 100% of rated thermal power, the licensee made a containment entry to examine the bellows
'
on the safety valves. Additionally, the containment entry was made to check the status of known leakage from the manhole cover on the
"C" steam generator.
The secondary steam leakage was measured as a function of containment sump pump rate which had remained steady at 5.1 gallons per minute.
The maintenance crew exited the containment at 1:46 p.m. after confirming the safety valve bellows was intact.
However, the licensee identified extensive boric acid crystal buildup and leakage frot the valve setpoint adjustment screw access port on the "C" pressurizer code safety valve 3RCS*SV8010C.
The lower (blowdown) locking pin (used to set a clean lift at the lift setpoint) was found still correctly attached by lock wire to the upper locking point (used to set the valve reset setpoint),
but the lower locking pin plug assembly was found backed out of the access port. The findings were reviewed with. plant supervisory.and management personnel and the "C" safety valve was declared inoperable at 2:56 p.m,-since there was no assurance the.
valve would lift at the required setpoint. A controlled shutdown was begun at 3:04 p.m. in accordance with Technical Specification l
3.4.2.2, which requires the plant to be in hot standby within six l
hours, and in hot shutdown within an additional six hours with any of the three valves inoperable.
,
,
The licensee notified the NRC headquarters operations officer (H00)
at 3:47 p.m. per 10CFR 50.72(b)(1)(1)(A). The plant entered hot l
standby at 8:50 p.m. on November 28, and the reactor was in hot l_
shutdown at 1:48 a.m. on November'29. The plant entered cold l
shutdown at 2:50 p.m. on November 29. The cold overpressure i
protection system was activated at 12:24 a.m. on November 29 using the pressurizer power operated relief valves.
The resident inspector reviewed shutdown and maintenance activities and licensee corrective actions on November 28-29 and determined actions were performed in accordance with procedures OP 32-6, 3204, i
3208, and 3207.
The plant remained shutdown for about ten days while actions were
-
completed to replace the "C" safety valve and to complete detailed inspections on the other two code safeties.
No problems were noted with the "A" and "B" safety valves and the set screws on the two remaining safety valves were verified to be locked in place.
Examination of the defective valve's set screw revealed that the threads appear to have been worn away through erosion while the threads on the valve body appeared to be in good conditio y
-
.
,
,,:
w
'-
+
o
,
y.
Therefore, an incorrect setscrew material was. suspected.
The set screw was examined by the metalurgical' laboratory at the licensee's corporate office which determined that the material appears to be carbon steel instead of the required stainless steel.
Final determination of the set screw material will be made by an
-
independent laboratory. Additionally, the licensee plans to. test the safety valve at Wyle Laboratories to determine if the missing set screw affected the valve setpoint.
~
The inspector considers that the licensee took the appropriate actions once the safety valve was found in its degraded condition.
However, the inspector noted that on November 24, the licensee had indications that something had changed in the safety valve since valve tailpipe temperature had decreased from its elevated tempera-ture of 200 degrees F to 100 degrees F, yet a containment entry was not performed until November 28 to investigate the cause.
' Consequently, the safety valve could have been in a degraded condition for approximately 4 days. The inspector asked the superintendent why he delayed his investigation.
The superintendent stated that he delayed the containment entry until November 28 because he felt that a rapid response to a suspected bellows failure was not justified, since a failed bellows joint would not affect valve operability.
He also stated that calling personnel into the plant during a holiday period for what was a perceived non problem would be counterproductive to
unit morale. He acknowledged the fact that in retrospect his L
decision not to examine the safety valve earlier was in error.
The inspector acknowledged the superintendent's comments, and determined that the superintendent's decision was reasonable given the history of previous bellows failures and he has no further questions on the issue.
3.2 Plant Tours The inspector observed plant operations during regu'lar and backshift tours of the following areas:
Control Room Containment l
Vital Switchgear Room Diesel Generator Room
!
Turbine Building Intake Structure ESF Building Auxiliary Building During plant tours, logs and records were reviewed to ensure
'~
compliance with station procedures, to determine if entries were correctly made, and to verify correct communication and equipment status.
No inadequacies were noted, i
l l
.
..
,
..,
y
,
t
,
.
+
3.2.1 Tours of Containment Structure During the outage period, the inspector conducted periodic tours of the containment structure. The containment areas appeared to be clean with the exception of the C and D loop areas where exposed metal was disco red due to steam generator inspection cover leakage.
The insp'e'
iso noted that identified discrepancies such as valves with packing leakage or defective pipe joints that the inspector located had already been examined and evaluated by the plant staff. The inspector determined that thorough licensee walkdowns of the containment structure had taken place during the outage.
'
3.2.2 Steam Generator Snubber Leakage Noted During a tour, the inspector identified slight leakage from one of.four hydraulic snubbers on the
'A' steam generator.
The leakage was found after a few drops of oil had collected on the horizontally
located. snubber.
The inspector discussed this finding with a maintenance foreman who stated that the licensee was aware of the slight leakage and had intended to repair the snubber during the second' refueling outage; however, due to higher priority work, the snubber repairs were rescheduled for the third refueling outage.
The foreman stated that the observed leakage was not indicative of failed interior seals which control the snubber shock resisting action but leakage'from seals which collect any oil that leaks past the interior i
seals.and returns the oil to the hydraulic collection reservoir.
According to the snubber technical manual, the snubbers are designed for-zero leakage.
However, 2% of the snubber volume is. allowed to
!
leak out over a two year time period.
Examination of the snubber reservoir which supplies hydraulic oil to three other snubbers indicated that although the level was low, it was still-within the required range.
Through conversations with the cognizant system engineer, the inspector was informed that no oil has been added to the tank since the first refueling outage. Therefore, the decrease
,
in tank level is = indicative of snubber leakage over twenty months l
of plant operation. The engineer" stated that he would inspect the snubbers if another cold shutdown outage occurs. The inspector determined that.the increased monitoring of the snubber was satisfactorily based on the limited leakage observed.
The inspector was informed later that prior to startup the tank was refilled to high in the indicating range.
Based upon review of the snubber technical manual and the limited leakage that was observed by the inspector, the licensee's decision to defer snubber repairs until the next refueling outage and increased monitoring of the devices appeared to be adequate and the inspector had no further questions.
- - -
-
-
-
- -
-
- -
.
7-
[. %
..
,,,
.
r (
.,
.
1 3.3 Stand-by Readiness of Engineered Safety Features (ESF) Systems and System Walkdown
,
The inspector performed walkdowns of the charging pump cooling system and vital station batteries. While performing a walkdown of the charging pump cooling system, the inspector verified that the system was lined up per the station's system drawings, and.
!
the as-built configuration was compared to the system drawing.
No inadequacies were noted.
The vital battery system walkdown included verifying battery electrolyte level was in specification and clear of any visible contaminants, flame arrestors were in good condition, hydrogen monitors for the applicable rooms were in operation and rooms were clear of debris. Additionally, seismic mountings were examined for adequacy and battery room temperatures were verified to be,within specifications.
No inadequacies were identified.
3.4 Service Water Booster Pumps Automatic Start Function Defeated Located in the 24-foot and 44-foot levels of the auxiliary building
are several vital motor control center (MCC) and rod control (RC)
components, such as the volume control tank isolation valve LCV-1120, spent fuel building exhaust fan, residual heat removal inlet isola-tion valves 3RHS-MV8702B, 3RHS-MV8702C and pressurizer relief isolation valve 3RCS-MV8000B.
These components should be operable during a loss.of offsite power to ensure the plant can be placed in a safe shutdown condition and to prevent the escape of activity to the environment.
Cooling air is normally supplied to the rooms that contain these components by two redundant air conditioning units whose air is cooled through a chilled water system.
In the event that a loss of offsite power (LOP) occurs, the chilled water system which supplies cooling water to the' air conditioning units shuts down.
Cooling water.to the room air conditioning units is then supplied by service water whose flow is augmented by two redundant booster pumps which start automatically. If cooling water is not supplied to the units, they are designed to automatically shut down when inlet air temperature to the units reaches 115 degrees Fahrenheit.
While conducting routine resident tours of the uxiliary building on January 2, 1990, the inspector noted that the electrical breakers
):
for both the "A" and "B" train service water booster pumps were caution tagged in the open/off position.
Both tags indicated that the breakers were opened to prevent excessive running of the pumps.
Therefore, the pumps would not start automatically in response to a LOP, as required by the plant design.
Through. conversations with a shift supervisor, the inspector was informed that both pump breakers were opened during February 1989 to prevent excessive pump operation. The pump operation was caused F
a
.
e'
U s;
<
,
,
.
by the necessity to have the discharge isolation valves MOV-130A and B in the open position due to the wiring sequence which supplies a start signal to the booster pumps. The shift supervisor explained that there are two reasons for leaving the MOV-130A/B isolation valves in the open position, First, during construction of the facility, licensee review of the MOV 130A/B piping and wiring diagram revealed that due to their location, which is about two feet apart, Appendix R separation criteria could not be met.
Specifically, it had been postulated that if a fire occurred in the 66-foot level of the auxiliary building where the MOV 130 A/B valves are located, both could be rendered inoperable and would not open if required.
Therefore, a decision was made to open the i
B train isolation valve and run the respective pump. This lineup
!
existed until the licensee was informed through a 10 CFR Part 21
!
notification that the MOV-130A/B isolation valve stem and disk I
assembly were susceptible to a disk / stem separation failure.
Prior
'!
to completing a permanent fix to the valves, as an interim measure, j
the licensee decided to open both isolation valves which started
-
both booster pumps.
Tte licensee continued to operate both booster pumps continuously until excessive wearing ring and impeller loss developed. Accordingly, to minimize impeller and wearing ring
,
(
replacement, the licensee decided to reduce pump run-time by i
opening and tagging their breakers with caution tags at the pump l
breaker.and main control board.
l The inspector reviewed service water operating procedure 3326A and determined that it did not contain provisions regarding the fact that both service water booster pumps were out of' service. The i
procedure only stipulated that MOV 130B was to be left in the open i
position with the B service water booster pump running. Review of the
!
main control board revealed that althougn the service water booster i
pump switches were cautioned tagged off, the service water emergency q
safety features (ESF) bypass annunciators for service water were not
illuminated on the main control board.
Therefore, the operators may
!
not have been fully aware of how removal of the service water booster l
pumps from automatic startup would affect other plant components.
Technical Specification 3.7.14 requires the temperature of the MCC/RC area at elevation 24'6" level to be maintained at less I
'
than-or equal to 120 degrees F.
If the temperature exceeds-this setpoint different actions must be taken depending on the temperature of the room and length of time above the 120 degree F
setpoint. These actions range from recording the cumulative time that the components exceed the setpoint or declaring the components l
inoperable if the temperature stays 20 degrees F above the setpoint j
for greater than four hours.
T,he temperatures of this room and other components is measured by a data recorder that is located on the 44'
level of the auxiliary building.
The temperatures can be read directly at the data recorder or in the control room on a computer
m
.,
- -
'..
- '4,
,
'
,
c screen. The data logger is powered off a non-class IE 120/208V power supply; therefore, if offsite power is lost, temperatures of the rooms cannot be monitored.
The inspector determined that, if a loss of offsite power occurred, and the service water booster pumps were not-started, both air conditioning units would automatically shutdown when inlet temperature reached 115 degrees F.
The air temperature in the affected areas would then begin to increase; operators would have no way of knowing how warm the room would get since the temperature monitors are powered off a non safety-related power supply. To restore cooling, the operators would first have to jumper out the high temperature automatic cutout in order to restart the units. The inspector noted-that the alarm response procedure for a loss of air flow to the affected area did not contain any instructions on how to jumper out the cutout. The procedure also did not recognize the fact that the booster pumps have to be started manually. Therefore, this alarm response procedure was deficient.
Through conversations with the cognizant licensee system engineer, the inspector was informed that the licensee did determine what temperatures would be reached in the auxiliary building if all cooling was lost in the area. This evaluation was documented in a memorandum' dated August 29, 1988 which stated that when cooling was_ lost to the air conditioning units in the auxiliary building room, air temperatures would be expected to reach 162 degrees F in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or 144 degrees F in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> if the doors to the affected rooms were opened within 30 minutes of the loss of cooling.
The inspector determined that the analysis was incomplete in that it failed to address whether the equipment in the room would be rendered inoperable under these conditions.
Additionally, it failed to determine how fast the air temperature would increase in the building, which alarms would alert the operator to the condition, whether an operator could restore service water to the coolers rapidly enough to avoid equipment damage and how the flow through the open discharge valves could affect other components
.
cooled by the service water system.
The inspector discussed his concern with the unit superintendent that the inoperable automatic start feature of the service water booster pump may not have been fully evaluated.
The superintendent acknowledged the inspector's concern and stated that he would run I'
the booster pumps to supply water to the coolers until either an
'
engineering analysis was located to support the pumps temporary condition or a permanent modification to the system was performed.
At the exit meeting, the unit superintendent stated that the service water booster pumps would continue to be operated until a modification that was already under progress is completed. The modification would remove the automatic start signal that the booster pumps receive when MOV 130 A/B are opened.
The pump I
. -- ----- -
-
.
a
.'4.
.
start system would then be modified to receive the signal directly on a high temperature or LOP condition. According to the licensee
-
engineering supervisor, the remaining work that needs to be accomplished prior to the implementation of the modification consists of engineering calculations that would support the design change, among which would evaluate the effect of the reduced service water flow through the' discharge valves on the other components. Additionally, the engineering supervisor stated that the inoperable condition of the automatic start feature of the booster pumps had been evaluated, and the licensee concluded that the operators would be able to take action in sufficient time in the event that cooling was lost to the air conditioning units prior to exceeding the technical specification temperature limit.
The inspector reviewed the analyses and had no questions.
However, the inspector stated that the analyses should have been performed prior to, not after, disabling the automatic start feature of the pumps.
The inspector also asked the unit superintendent why-the FSAR was not updated to reflect the decision that was made during construction of the unit to keep the B train booster pump cooling system in operation continuously. The superintendent stated that this modification was missed during the update process for unknown reasons, however, he stated that the FSAR would be updated to reflect current system conditions.
Through review of this issue, the inspector has determined that when the facility, as described in-the licensing basis, was changed, the licensee did not determine whether the change involved a change in the Technical Specifications or an unreviewed safety question, as required by 10 CFR 50.59(a)(1).
Additionally, the service water operating instruction OP3326A was not modified to reflect the changed plant configuration, as required by Technical Specification 6.8.1.
The inappropriate actions, that were associated with removal of the automatic start capability of the service water booster pumps, collectively constitute a violation of regulatory requirements.
(423/89-23-01)
The inspector questioned whether, if an operator was not able to restore coo 11ng to the affected areas ~, several motor control centers which contain vital equipment would have been damaged due to excessive heat generation.
The licensee had not determined how g
long the equipment could operate at the elevated temperature and how long an operator would have before cooling should be restored to prevent excessive temperatures from developing in the rooms.
However, from review of partial evaluations of a loss of cooling, excessive temperatures in the motor control centers would not be generated immediately. Additionally, the licensee evaluations did not take into account that even with the booster pumps secured, a slight amount of service water will flow through the heat exchangers. The inspector determined that the minimal service
rp..
.
'
,'
..
p
water cooling would provide operators a longer time to respond to a loss of cooling event.
Therefore, operation with the automatic start feature of the pumps inoperable had minimal safety significance.
3.5 Review of Plant Incident Reports
'
The plant incident reports (PIRs) listed below were reviewed during the inspection period to (1) determine the significance of the events; (ii) review the licensee's evaluation of the events; (iii)
verify the licensee's response and corrective actions were proper; and, (iv) verify that the licensee reported the events in accordance
>
with applicable requirements, if required. The PIRs reviewed were:
number's 3-89-201 through 3-89-216, 3-89-218, and 3-89-219. The following PIRs were selected for inspector followup:
3-89-208, 3-89-209, 3-89-212, and 3-89-215.
The technical issues and licensee actions associated with these PIRs are discussed in further detail in 1, 3.1.1, 3.6, and 5.2.1 of this report, respectively.
sections r 3.6 Engineered h fety Feature Actuation On December 5, 1989, while opening the 'A' main steam isolation valve (MSIV) in preparation for full stroke MSIV testing and to complete steam plant heatup, an engineered safety feature (ESF)
actuation occurred.
The actuation signal was generated when the opening of the MSIV caused a pressure drop in the steam generator.
The plant responded as designed and operators reset the ESF signal af ter verifying that a safety injection was not required.
A safety injection signal is generated when steam line pressure decreases to 658 psi and the plant is above the P-11 setpoint of 2000 psi or when steam pressure decreases at a rate of 100 psi / min.
-in one generator when plant pressure is below the 2000 psi P-11 setpoint. When the
'A' MSIV was opened, steam generator pressure did not decrease below 658 psi; however, the circuitry contains a lead / lag card which senses an abrupt change in steam generator pressure and raises the setpoint in anticipation of exceeding the 658 psi limit.
The " acceleration" affect of the setpoint caused the actuation.
(
Through conversations with operators, the inspector was informed
'
that during previous plant startups, two MSIVs are opened simultaneously. Opening two MSIVs decreases the magnitude of the pressure drop that-a steam generator undergoes; therefore, an ESF actuation on low steam generator pressure is avoided.
The opening of two MSIV's simultaneously to avoid a safety injection during startup was a well known fact to the majority of shift crews since ESF actuations had occurred previously during hot functional testing when one MSIV was opened.
However, this was the first time that this evolution was performed by the onshift crew and they were unaware of previous problems with the
t
,
,-
x
p#
. *
,
.
.
'
e b
'MSIVs.
Review of procedure 3316A." Main Steam" revealed that there was no requirement to open two MSIVs simultaneously.
.The specific step which operated the valves contained only a requirement that MSIV differential pressure (dp) be below 100 psi prior to opening an MSIV.
Operators stated'that, in response to
.the safety injections during hot functional testing, there was at one time a requirement to open both MSIVs simultaneously, but this requirement was deleted for unknown reasons.
'
To prevent recurrence of the event, the operating procedure 3316A was revised to require two MSIV's to be opened simultaneously.
Additionally, the maximum dp across an MSIV prior to opening was limited to 25 psi.
When the inspector asked an assistant operations superintendent what the technical bases were for allowing a 25 psi dp, he was informed that experience has shown the 25 psi dp to be acceptable since no safety injections had occurred when two MSIV's were opened simultaneously. The inspector was concerned that if the 25 psi number was chosen arbitrarily and not determined by engineering analyses, an ESF actuation may recur if the 25 psi number would cause a pressure decrease that is close to the lead / lag setpoint.
The inspector expressed this concern to a licensee reactor engineer who had begun already to determine the lead lag circuit response based upon the time constants stated in technical specifications.
The reactor engineer determined that the maximum pressure drop that can occur in a steam generator without receiving a safety injection signal is 44 psi. This was based upon calculation methologies contained in the Westinghouse
" scale manual".
The inspector reviewed the engineer's methodology and determined that an ESF actuation should not occur.
The licensee actions to prevent recurrence of the event were proper.
3.7 Auxiliary Feed Water Check Valves Examined
,
Inspection Report 50-423/89-14 documented licensee-identified check-valve backleakage on the 'D' steam generator auxiliary feedwater system. To reduce feedwater line temperature, operators would periodically inject water into the steam generator.
Upon shutdown of the unit on November 28, auxiliary feedwater check valves V885
.
and V14 were checked to examine the condition of their seating surfaces.
Inspection revealed that both check valve discs were not seating properly. The upstream valve V14 required only minor l
adjustment to enable a good seating contact, however, the downstream l
valve V885 would have required extensive grinding and seat repair l
to enable a tight fit and was not repaired because of the impact on i
the outage schedule.
Since the completion of the valve adjustments, injections of j
feedwater into the "D" steam generator have continued at the same i
l frequency that existed prior to valve repair. Therefore, the valve
'
(
.%
'
..
12
,
i adjustments performed did not correct the backleakage condition.
Through conversations with a licensee system engineer, the inspector was informed that _the licensee will reexamine the check valves during the next refueling. outage. The licensee actions to address the check valve back leakage will continue to be reviewed in future NRC inspections.
t 4.0 Radiological Controls
,.1 Posting and Controls of Radiological Areas During plant tours, posting of contaminated and high radiation areas were reviewed with respect to boundary identification, locking requirements -and appropriate control points. No inadequacies were identified.
4.2 Minor Spill of Contaminated Fluids While conducting tours of the protected area, the inspector observed a worker installing yellow polyethylene bags over drain lines on the two waste test tanks which are located outside the waste building at Millstone 3.
The waste test tanks are used as an interim storage area for contaminated fluid that is processed from the waste evaporator or radioactive waste demineralizer.
Depending on sample results, the water is either reused in the primary plant or it is discharged through the circulating water tunnel. When questioned as to the reason for the bag installation, the worker informed the inspector that a drain plug downstream of valve 3LWS-V954 had become dislodged when the line froze.
Apparently, sample valve 3LWS-V954 leaked by which caused water to collect in an 18 inch section of pipe that was not heat traced, the water then froze and expanded which caused the plastic pipe plug located downstream of the valve to be dislodged. The worker stated that the bags were installed as a precaution to collect any leakage that may occur if the event was to recur.
The licensee conservatively estimated that one gallon of water spilled from the tank onto the ground and was recovered since the water froze on the ground and on the valve. The activity of the water when-surveyed was approximately 3-4000 disintegrations per minute above background.
Soil directly beneath the valve was collected and surveyed.
Readings indicated that activity was low
- approximately 60 dpm above background.
It is unlikely that any water was able to permeate extensively throughout the ground since the soil was frozen. The inspector considers the licensee cleanup of this minor spill to be acceptable. However, there is no apparent reason why plastic pipe plugs were used downstream of l
the sample lines.
The inspector discussed tM s issue with the operations supervisor who indicated that this issue will be l
reviewed in the plant incident report (PIR) which was written l.
to document the event.
The inspector will review the PIR and
'
licensee actions in future resident inspections.
l
"
9: os
+-.
!
'
-
-
. _ -
-
..
.
4.3 Radwastq Transoortation - Millstone Station On September 14, 1989, the licensee shipped to the Haddam Neck Plant a package containing contaminatec ladders and a fiberscope as a Limited Quantity-package.
The fiberscope, which had a maximum dose ratn on contact of 1.1 millirem per hour, was placed
-
in the middle of the shipping container, wedged between several-ladders. A survey conducted by the licensee at the time of the shipment indicated the maximum dose rate on the external surface of the package to be 0.3 millirem per hour.
10 CFR 71.5 requires that NRC licensees comply with the regulations
set forth in 49 CFR Parts 100-179, for the transportation of radio-active materials.
49 CFR 173.421 requires that in order for a package of radioactive materials to be shipped as Limited: Quantity, the maximum external dos 4 rate on the surface of the package must
.
not exceed 0.5 millirem Der hour.
!
,
Upon receipt at the Haddam Neck Plant cn September 14, 1989, the package was surveyed by Haddhm Neck health physics personnel and determined to have a maximum dose rate of 0.7 to 0.8 millirem per hour on the bottom. A representative of the licensee's shipping staff was notified telephonically on September 14, 1989 by the-Haddam Neck staff. Millstone plant staff traveled to Haddam Neck to survey the package.
That survey, conducted with the same survey instrument utilized for the shipping survey at Millstone, revealed a maximum surface dose rate of 0.6 millirem per hour on-the bottom of the package.
Upon opening the package, it was discovered that the fiberscope had shifted in transit and now rested on the bottom of the package at the location of the maximum survey reading.
This is an apparent violation of 10 CFR 71.5 (50-423/89-23-02).
5.0 Maintenance / Surveillance 5,1 Observation of Maintenance Activities The inspector observed and reviewed selected portions of preventive and corrective maintenance to verify compliance with regulations, use of administrative and maintenance. procedures, compliance with codes and standards, proper QA/QC involvement, use of bypass jumpers and safety tags, personnel protection, and
)
equipment alignment and retest.
The following activities were included:
a service water lube oil strainer repair
--
CMS-22 radiation monitor troubleshooting activities.
--
No inadequacies were identified.
-
.
.-
--- - -
-
-
O 4 -
%
.
.
,,.
.
U-5.1.1 Steam Generator Leakage Repairs l
During the month of October, containment sump pumping rate increased from 1.1 gpm to 5.1 gpm. The increased pumping rate was attributed to a leaking handhole on the
'C' steam generator
.which was verified by taking samples of the containment sump water and by direct observation of the leak through containment entries.
On November 28, while performing a containment entry to investigate the cause of the change in safety valve tailpipe temperature, another leak was identified on the 'D' steam generator manway cover. During the cold-shutdown period, both generators were drained and the hand hole and manway cover seating surfaces were examined.
Both exhibited
'
signs of degradation due to steam cutting and required minor weld buildup. Through discussions with a licensee maintenance engineer,
.
the inspector was informed that the cause of the leak on the 'C'
steam generator hand hole may be attributed to-a less than optimum crush depth on the Flextallic gasket seal.
The recommended depth is 0.125" +/- 0.005", however, this Flexitallic crush was at 0.120".
Before the handhole was reassembled, the licensee remachined the seating surface to the optimum 0.125" crush depth.
The leak on the
'D' steam generator manway may have been attributed to use of a
.
seating surface and Flexitallic crush depth that is recommended by Westinghouse, the nuclear steam tystem supply vendor, but not Flexi-tallic, the gasket manufacturer.
Currently the licensee employs a Westinghouse recommended seating surface that is smooth with a crush
.
depth of 0.110" vice the Flexitallic recommended serrated surface and a
crush depth of 0.125".
In the future, when the manway covers are removed, the licensee intends to forego use of the Westinghouse required specifications and use the Flexitallic seating surfaces and depths. However, before the new specifications can be used, a machine must be purchased that can produce the serrations on the generator seating surface. Consequently when the manway was repaired, only serrations on the cover were machined. In addition to following the Flexitallic recommended specifications, a new torque sequence is also being evaluated for use on the manway cover.
The inspector l
reviewed the licensee actions and.found the licensee's actions to be appropriate and had no further questions.
5.1.2 (Closed) Unresolved Item 86-29-02, Power Operated Relief Valves Inspection Report 86-29 documented licensee repairs performed x
on power operated relief valves (PORVs) 455A and 456 during a July-August 1986 outage to correct excessive seat leakage.
Remaining modifications that were to be accomplished on the PORVs following reactor startup in August of 1986 involved installation of new solenoid valves and redesign of the underseat gasket assembly. Additionally, the reporting inspector expressed a concern that other plants that utilize PORVs of this vintage should be notified of the modifications accomplished to dat.:
!
e
,..
15
,
Through conversations with a licensee maintenance engineer, the inspector was informed that new solenoid valves that contained improved pilot valve seating surfaces were installed during the May-August 1987 refueling outage.
Through observation of PORV performance, this modification appears to have eliminated a-significant leak path since excessive PORV leakage has not been observed.
However, a final modification to the underseat gasket has yet to be developed.
A proposed solution includes machining a groove in the valve body and installation of_flexitallic gasket in lieu of the grafoil design now used. Testing of the proposed modification by the vendor is expected to be completed before the commencement of the third refueling outage in November 1990 therefore it may be utilized at that time.
The inspector was informed by the licensee that if PORV performance does not deteriorate over the remaining fuel cycle, the improved seating surface may not be utilized.
Through conversations with the engineer, the inspector was informed that the modifications that the licensee has performed to date on the PORVs have been accomplished per a generic Westinghouse Field Change Notice. Accordingly, there is adequate assurance that other facilities which contain these PORVs have been notified of the required changes and valve improvements, k-The inspector agrees that PORV seat leakage has decreased noticeably since the installation of new solenoid valves in August of 1987. Accordingly, the licensee decision to forego replacement of the PORV gasket with an improved design may be warranted. Additionally, the inspector believes that notification of other facilities through a' field change notice is adequate to inform them of the PORV modifications. Based on the acceptable PORV performance since the completion of the modifications, and the assurance that other facilities are informed of the modification, this item is closed.
5.2 Observation of Surveillance Activities The inspector observed and reviewed portions of completed surveil-lance tests to assess performance in accordance with approved pro-cedures and Limiting Conditions of Operation, removal and restoration of equipment, and deficiency review and resolution. The following tests were reviewed:
I Protection set rack III testing
--
MCC/RC area booster pump testing
--
No inadequacies were noted.
..-.
- -
- - - -
.
m-
-
- - n. +
.
.. <
,,-
,4 a
'
16-5.2.1 Inadvertent Containment Discharge Actuation On December 11, 1989_while conducting slave relay testing per surveillance procedure SP 3646A.9, an inadvertent partial containment discharge actuation (CDA) signal was generated. The
.
signal was initiated for approximately 20 seconds until it was j
reset and the affected components secured._ The event was caused
'
by operator error.
Specifically, the individual who performed the surveillance failed to take the automatic sequencer logic tester out of. service as required by procedure.. Consequently when the operator energized master relay K645 by going to the
" test" position, an actual CDA signal that is generated by the
'
sequence tester was sent to the appropriate slave relays. This.
caused equipment that is operated by the slave relays such as the
'B' auxiliary feedwater pump and 'B' quench spray pump to start.
An actual spray down of the containment structure did not occur since operators reset the CDA signal in 20 seconds, which is
!
before the 60-second time required from initiation of a signal to actual spray flow from the discharge rings in the containment.
i Additionally, the quench spray header discharge valve QSS M0V34B
!
did not open since it is operated by a different_ slave relay.
The inspector verified that the plant responded as designed to the CDA signal through review of schematics and system drawings.
'
Through conversations with the operations superintendent, the inspector was informed that the operator who performed the surveillance thought that he blocked the automatic test signal, therefore, a defective block switch was initially assumed.-
However, repeated testing of the toggle switch which has a spring return to the mid position could not identify a failure. Through review of the procedure, the inspector noted, when the automatic sequencer is blocked, the procedure does not require the operator to verify that the sequencer trouble and Engineered Safety Features Group 2 Off Normal annunciators are illuminated on the main control board. This is different from I&C procedures which require control board verification when switches are positioned which change system status.
The inspector discussed this observation with the operations superintendent who stated that surveillances performed by the operations department did not routinely require the control board to be examined to verify
<
proper switch manipulation or actuation.
However, the h
possibility of requiring the control board check would be examined as a corrective action.
The inspector informed the operations superintendent that personnel errors continue to detract from good overall operation department performance. This observation was also made in Systematic Assessment of Licensee Performance (SALP) Report 88-99 for the period June 1 - October 15, 1989.
The inspector encouraged the operations superintendent to examine the root
y
--
q 3e*
,o,
..-
.
,
.
causes of these errors in greater detail as a means of improving performance.
The operations superintendent noted the inspectors Comments.
6.0 Engineering / Technical Support 6.1 (Closed) Unresolved Item 50-423/89-21-06 4160 Volt Bus Fast Transfer Scheme Problem Summary
.i The licensee notified the inspector of a potential problem with the 4160 volt fast bus transfer scheme that was determined on November 27, 1989 to be reportable per 10 CFR 50.72(b)(2)(iii)
The problem was identified as a result-of reportability evaluation form (REF) 89-50 initiated on October 20, 1989 by the licensee's engineering organization in Northeast Utilities Service Company (NUSCO),
NUSCO determined that the 4160 V bus fast transfer scheme could, if performed repeatedly, damage redundant safety-related motors.
The fast transfer can result in service voltage transients across motor terminals, potentially causing shaft and/or winding damage after repeated occurrences. Based on the testing and analysis, Generation Electrical Engineering (GEE) concluded that 4.16 KV auxiliary buses may be exposed to an unacceptable level of resultant volts per hertz of greater than 1.33 per unit (p.u.)
at the time of a fast transfer.
Repeated fast transfers at resultant volts per hertz greater than 1.33 per unit could potentially damage redundant safety related motors for systems such that the ability to shutdown or mitigate accidents could be adversely affected. The safety implication is that a potential
common mode failure of safety-related equipment on redundant Class IE busses 3 ENS *SWG-A(34C) and B(34D) could occur if fast transfer testing were to continue on a once per-refuel basis.
.The inspector interviewed licensee engineering personnel and reviewed the issue as described in plant information report-(PIR)
3-89-208 and attacied references.
The review also included a review of the results of engineering analyses and testing during the 1989 refueling outage.
The inspector attended a meeting of the plant operations review committee at 3:40 p.m. on November 27 to observe the licensee's evaluation of the issue and the technical justification for leaving the high speed transfer l
circuit in effect.
The licensee made an ENS notification to the NRC:H00 at 2:00 p.m.
on November 27.
The item was reported as LER 89-30 on December 26, 1989.
Since the Millstone 3 fast transfer scheme is typical of the generic design used at other nuclear power plants, the
l
,1 o
<. -
+
,
.
,
1 licensee concluded the issue should also be reported to the NRC
]
under 10 CFR Part 21.
The reporting requirements of 10 CFR 21 were satisfied with the issuance of the LER.
Design Description of Millstone 3 Fast Transfer Scheme
,
The tast transfer scheme at Millstone 3 was designed to effect a high speed transfer of station service power from normal to
reserve supply after occurrence of: the simultaneous opening of both 345 KV circuit breakers 15G-13T-2 and 15G-14T-2, for any reason; and/or, an electrical fault in the main generator, main transformer, main generator 345 KV circuit breakers, normal station service transformer, and all intercunnecting conductors, including isolated phase bus duct, overhead 345 KV conductors, and normal station service transformer secondary cables.
Unlike most plant designs, due to the use of a main generator output breaker at Millstone 3, the fast transfer will not normally occur following a reactor trip or turbine trip.
Instead, plant loads will remain powered from the 345 KV switchyped automatically by back feeding t5 rough the main transformer e.;.u normal station service transformer as the turbine generator coasts down.
The fast transfer from normal to reserve station service was designed to perform with a maximum of six cycles of " dead time"
,
on the 4.16 KV and 6.9 KV buses.
Bus dead time is defined as the time when the bus voltage and the source voltage begin to depart until the time the transferred source is connected.
The six-cycle dead time was developed because it was a time restriction the switchgear equipment could meet and it was generally considered that a transfer within six cycles would produce a resultant motor voltage of less than 1.33 V/Hz p.u.
The design studies showed that the bus residual voltage and phase ange would have been such that when the reserve voltage is reapplied, the resultant voltage would not be greater than 1.33 V/Hz p.u.
NEMA MG-1-20 (motor industry standard) specifies that motors be able to operate under a transfer that produced a resultant motor voltage of less than 1.33 V/Hz.
The Millstone 3 4 KV and 6,6 KV motors were designed with the capability of operating with a transfer from one power source to another as long as the resultant voltage when the new power source is applied is less than 1.33 V/Hz p.u. at the motor terminals.
)
A study performed for Millstone 2 that showed a time greater than six cycles is required to produce a resultant motor voltage greater than 1.33 V/Hz.
The results of this study were used to provide the basis for the fast transfer design for Millstone 3.
Tests were performed with the buses unloaded during the Millstone 3 initial startup program to ensure that the transfer time was within the six cycles.
No specific studies were performed to
F'
5 O
,
'
a
verify the bus motor resultant voltage being within 1.33 V/Hz
,
for a six-cycle transfer. Millstone 3 does not use synchronizing
<
check relays to assure 1.33 V/Hz will not be exceeded.
Problem Identification - Desion Study While reviewing the Millstone 3 electrical protective system for a previous issue (reference LER 88-26), the licensee's System Planning group performed a study that showed that under normal operating conditions, the maximum dead bus time that could occur before the resultant motor voltage exceeds 1.33 V/Hz is 4.05 cycles.
The computer simulation showed a momentary peak voltage of approximately 1.85 V/Hz at times beyond 4.05 cycles.
Closing an incoming breaker beyond this time has the potential to result in motor V/Hz above the design capability.
The study was completed in April 1989 and the results were reported to GEE in an memorandum dated April 26, 1989.
During the 1989 refueling outage, PDCR MP3-89-010 implemented design changes to the fast transfer scheme such that whenever both switchyard breakers 15G-13T-2 and 15G-14T-2 were open, a fast transfer to the RSST would occur thereby not exposing plant motors to a main generator coastdown. As part of the PDCR test plan, tests were done during the 1989 outage to evaluate: (1) the adequacy of the model used by System Planning to predict motor residual voltage; and, (2) whether the high speed transfer to the
'
reserve supply occurred within the acceptable time window as determined by the model.
The test results are described below, along with the impact on the high speed transfers at Millstone 3.
Summar, of IST 3-89-009 and Previous Test Results For the tests performed under IST 3-89-009 during the 1989 refueling outage, the fast transfer was initiated by opening the switchyard breakers.
These tests showed a 4.16 KV "A" bus dead time of 10.5 cycles and a "B" bus dead time of 9.08 cycles. When initiated by opening the switchyard breakers, the fast transfer time exceeded the iraximum design time of 6 cycles as well as the maximum time of 4.05 cycles for safe transfer of power sources for Millstone 3 motors.
I For Train A (Bus 34C), the possibility of exceeding the 1.33 V/Hz
.
limit was reached after 4.2 cycles of dead bus time. The
!
resultant voltage reached its peak of 1,68 p.u. after 6.8 cycles
'
of dead bus time and then decreased below the limit after 8.5 l
cycles of dead bus time.
The time from 4.2 to 8.5 cycles is a window of vulnerability where if the RSST breaker had closed, it would be possible for the resultant voltage to exceed the motor I
l
-
>
)
<,
a
o o,
.
.. -
limit of 1.33 V/Hz. After 8.5 cycles of dead bus time, the bus residual voltage decays such that the resultant voltage never exceeds the 1.33 V/Hz limit again for the test case.
For Train B (Bus 34D), the window of vulnerability was from 4.1 cycles to 7.8 cycles.
The maximum resultant voltage was 1.68 V/Hz and occurred at 6.25 cycles of dead bus time. The B test only showed one window-of vulnerability.
An additional test was performed which initiated a fast transfer by operating the switchyard breakers trip emergency pushbuttons located on Main Board 7.
The pushbuttons simulate a fault on the main transformer by operating the main transformer primary and backup lockout relays.
These relays not only open the switchyard breakers but also open the NSST supply breakers. The test results showed a total dead bus time of 4.8 cycles which is within the original design of the fast transfer scheme.
However, the results also show the window of vulnerability starting to occur after 4.1 cycles of dead bus time and indicate that the transfer occurred within the window of vulnerability.
It is important to note that recorded data showed the actual motor terminal voltages were less than 1.33 V/Hz p.u. when the RSST breakers closed for all three tests conducted during the 1989 outage.
Thus, for the initial startup and the 1989 tests, the motors were not exposed to excessive voltages. The only other tests conducted of the fast transfer scheme were during the first (1987) refueling outage.
However, the tests only verified the bus transfers occurred in less than six cycles and no voltages were recorded. Unless the transfers happen to have occurred within the window of vulnerability during the 1987 tests, it is possible that the Millstone 3 motors never experienced voltages in excess of 1.33 V/Hz p.u.
Conversely, the motors have experienced at most one cycle in excess of the limits.
Comparison of Test Results with System Planning Model The licensee compared the test data resultant voltages with those predicted by the computer simulation.
The computer and test results were similar with respect to both magnitude and time.
Therefore, the model was used to analyze the effects of the fast g
transfer scheme.
Case 1. - Fast transfers initiated by switchyard actions without depressed bus voltages.
l l
t o
.
,
.
,
A fast transfer resulting from actions opening the switchyard breakers result in the type of transfer performed in IST 3-89-009. The two tests performed show that the transfer time is completed after the first window of vulnerability. The computer simulations show the transfer would have to occur approximately 1.4 cycles sooner on the B train and +/- 1.9 cycles on the A train to be in the window of vulnerability.
There is a margin of over 10% of the entire transfer cycle for different transfer times and if a transfer initiated in the switchyard was to occur, the licensee concluded there is good confidence that the resultant voltage would be less than the 1.33 V/Hz limit.
Additionally, it is not expected that the transfer times will drift over the next operating cycle due to aging because of the short time period involved.
A licensee probabilistic risk assessment (PRA) determined that the probability of a fast transfer occurring as a result of switchyard action is.03 per year (a once in 40 year event).
This low probability of occurrence combined with the high probability that the transfer time falls within the acceptable windows of vulnerability supports the continued operation of the plant under the design scheme.
Case 2. - Fast transfers initiated by plant equipment actions.
For faults on the main generator, main transforms, NSST or station connections, the computer model shows that a three phase fault causes the motor residual voltage to collapse very quickly such that when the RSST source is connected, the resultant voltage is less than 1.33 V/Hz.
The predicted maximum resultant voltage with a dead bus time up to 6 cycles is 1.75 V/Hz.
Licensee evaluation of this event concluded that the plant motors could perform their safety function as long as the motors were not repeatedly exposed to this type of event. Therefore, having one additional fast transfer in the next operating cycle is acceptable.
For the spurious protective relay operation event, a PRA calculation showed a probability of.043/yr (a once in 20 year event) to result in a fast transfer of both trains.
The relatively low probability combined with the confidence in the b
motors capability to operate successfully, supports continued operation of the plant for one more operating cycle with the present high speed transfer system.
Fast Bus Transfer Effect on 4KV and 480V Motors As a result of the analysis and testing described above, the licensee evaluated the consequences of subjecting a motor to torques in excess of rated motor torque.
The evaluation,
(
o.'
o
.
o
,
,
.
described in an engineering memo dated July 6, 1989, eddressed the possible effect to the motors should the fast bus transfer occur with the resultant voltage at 1.75 V/Hz p.u.
A fast bus transfer under the above conditions would cause the motor torque to increase above the motor rated torque. However, this is the air gap torque which is the electromagnetic torque between the stator and the rotor. Considering the elasticity of the rotor shaft structure which absorbs some of this torque, not all of the torque is transmitted to load.
Some torque is also absorbed as the motor changes speed.
The torque increase may result with some aging of the motors.
The concern occurs with the effect of repeated fast bus transfers with a resultant voltage at the motor terminals of 1.75 V/Hz p.u.
r A single bus transfer with 1.75 V/Hz p.u. will stress the motors
-
both mechanically and electrically.
However, the concern is the cumulative effect of many fu t bus transfers with a resultant voltage of 1.75 V/Hz p.u.
A single bus transfer during the operating cycle would not substantially reduce the life of the motors.
Licensee discussions with motor vendors concluded that motor life is shortened during a fast bus transfer with a resultant voltage greater than 1.33 V/Hz p.u.
However, the amount of life reduction could not be quantified.
The licensee concluded that the Millstone 3 motors can safely function for one additional fast bus transfer. The situation that could result with a fast bus transfer and a 1.75 V/Hz p.u. resultant voltage is a low probability event which would only take some life from the motor
,
provided that only ore fast bus occurs during the next operating
'
cycle.
Subsequent licensee evaluation on November 29 addressed whether the motor torque and current transients anticipated from a fast transfer would be more severe than those from a typical motor start.
Fast transfer transients can result in air gap torques 10 to 20 times greater than motor full load torques.
Starting torques are approximately six times full load torque. This is due in part from a symmetrical component of motor current which can be attributed to the out-of phase transfer voltage transient I
(as great as two times motor rated voltage), yielding up to twice
.
the starting current.
In addition, there is an exponentially l
decaying asymmetrical DC component of motor current that is not present at motor start.
This asymmetrical component is attributable to flux linkages in the motor that cannot change instantaneously, which in effect is what the out-of phase transfer is trying to do.
!
!
l
.
a c.
o
'
,.
y
The licensee's evaluation addressed the type of degradation that might be expected from frequent and repeated fast transfers, and whether the degradation can be detected through vibration analysis. The possible degradation includes:
loosening of winding bracing due to large magnetic forces within and between windings, which can lead to winding movement and ultimately insulation failure due to abrasion (not voltage over-stressing);
loosening of rotor bars (or damper windings in the case of synchronous motors) possibly leading to vibration and fatigue failure; fatigue failure of the shaft, coupling, or driven mechanical equipment due to repeated torque transients. The licensee concluded the last two mechanism would most likely be detected under the ISI vibration monitoring program.
The stator degradation would not be detected.
Justification for Continued Use of the High Speed Transfer The licensee concluded the plant can continue to operate with the high speed transfer as-is without danger to redundant ssfety equipment for a minimum of one high speed transfer occurring.
This conclusion was based on an engineering review of the electrical system transients caused by a fast transfer.
The evaluation was summarized above and were described in a memorandum dated July 6,1989 (GEE-89-255).
Field tests show that a high speed transfer can take place within a window of vulnerability.
However, the computer study showed that for most types of faults, the motor residual voltage collapses so quickly such that when the RSST source is connected, the resultant voltage is less than 1.33 V/Hz.
The other type of fault conditions are bounded (V/Hz limit) by a high speed transfer under ncrmal operating conditions.
A PRA determined the probability of a high speed transfer to be a low frequency event In addition, GEE evaluated the bounding event and concluded that the motors could trform their safety function as long as t0e motors were not ex esed to the transfer on a repeated basis. This conclusion was t,ased on the momentary torque produced by this * vent not being sufficient enough to cause motor damage as an isolated event.
However, motor damage could occur if exposed to this type of transient on a repeated basis.
I GEE evaluated these results and concluded that in the short term, the plant motors could perform their safety function as long as the motors were not repeatedly exposed to this type of event.
Therefore, GEE recommended to the plant that the fast transfer scheme remain in effe:t until the next refueling outage.
.
o o o
?. *
,
Followup Actions and Plans Based on the above, the licensee concluded continued operation of the plant under the current design for one more operating cycle was acceptable.. This was based on the following summary of the above bases:
1.
Low probability of event occurring in the next operating cycle.
2.
Transfers initiated out in the switchyard result in a transfer time outside the window of vulnerability.
3.
Capability of the motors when exposed to the worst case V/Hz predicted for a transfer initiated within the plant.
Licensee engineering recommended that the plant no longer test the fast transfer, but to test the slow transfer instead to show compliance to Technical Specification paragraph 4.8.1.1.1.
These recommendations were based on the fast transfer being a low probability event as determined by PRA and that the safety related motors will perform their safety function when only exposed to the fast transfer on an isolated basis.
During the present operating cycle, licensee engineering is investigating whether a design change could be implemented to eliminate safety concerns involving the fast transfer scheme.
The design changes under consideration include the addition of sync-check relays and elimination of the fast transfer scheme.
Engineering recommended that the fast transfer scheme be disabled, should a fast transfer occur prior to the end of the present cycle. The licensee was considering a bypass / jumper, along with the necessary safety evaluation, that could be initiated to eliminate the transfer prior to the next outage, if necessary.
NRC Findings and Assessments NRC review of the technical issue included a review by the NRC Region I Division Reactor Safety and identified no inadequacies.
The matter is reportable per 10 CFR 50.72(b)(2)(iii) and 10 CFR 50.73(a)(2)(v). The inspector concluded the safety significance i
of the matter is minimal due to actual fast transfer experience at Millstone 3, the low probability of the fast transfer event and the lower probability of motor damage from such an event, and the adequacy of the licensee's engineering assessmen.
. o o
'
- ....
i i
The inspector noted the licensee has concluded the issue is not applicable to Millstone 2.
Preliminary analysis results indicate the problem is also not applicable to Millstone 1.
However, the Millstone 1 results require verification by field test. The
licensee's corrective actions and plans are appropriate to further address and resolve the issue.
There was good cooperation between the site and corporate engineering to resolve the technical issue.
Engineering followup
of the previous problems identified with the fast transfer scheme were thorough and timely. There was good support from corporate engineering and licensing to evaluate the technical problem once identified and to address reportability criteria. The engineering analyses and assessments were thorough and technically sound.
Corporate engineering initiatives to study a standard transfer scheme widely accepted in the industry are noteworthy, as are the actions to address the problem and report the potentially generic issue to the industry. NRC followup of this item from a regional perspective is complete; therefore, the item opened in inspection report 50-423/89-21 is closed.
6.2 Reportability Evaluation - Reporting Timeliness Notwithstanding the generally good performance noted above in the study identification, assessment and correction of a potentially generic problem with the fast bus transfer scheme, the inspector noted that the timeliness of the reporting of the problem could be improved.
As noted in Section 6.1, the deficiency in the high speed transfer design was reportable per 10 CFR 50.72 and 10 CFR 50.73 as a " condition" that alone could have prevented the fulfillment of the safety function of systems that are needed to shutdown the reactor and mitigate the consequences of an accident. CFR 50.72 and 50.73 require the NRC to be notified within specified time periods af ter the " occurrence of" or af ter " discovery of" the event or condition specified in the reporting criteria.
In the case of the fast transfer deficiency, since there was no " event",
the matter is reportable af ter " discovery" that a reportable condition occurred. NRC guidance in NUREG 1022. " Licensee Event Report System" recognizes the role of engineering judgement and analysis in evaluating conditions for determining reportability.
b In this example, the event wauld become reportable upon
" discovery" that a condition existed where the safety function could have been compromised.
Inspector review of the sequence of actions, evaluations and reviews relative to this item noted the following:
F-
. * * O I
(
Ea *
'
G
,
(1) An engineering study was completed in April 1989 that concluded a vulnerability existed for fast transfers completed
,
'
within the design time of six cycles, with a potential adverse impact on plant safety related utors.
These preliminary i
,
conclusions were based on computer simulations that required
verification by field testing.
(ii) Testing completed during the 1989 refueling outage verified I
the computer simulations.
(iii) Engineering reviews were completed on July 6,1989 with the results of the comparison of the predicted and test cases, and conclusions that there was a real but low probability of an event.
Also on July 6, engineering had a " justification" prepared for leaving the high speed transfer in place, and recommendations for plant actions and the scope of an action plan for the study of
potential long-term fixes.
In response to inspector inquiries, licensee engineering representatives stated the additional analyses completed after July 1989 include sensitivity studies to verify the accuracy of computer models to simulate fast transfer events for certain fault conditions.
(iv) A reportability evaluation was initiated on October 20, 1989 per NU procedure NE0 2.25 identifying 10 CFR 50.73(a)(2)(v)
as the applicable reporting criteria.
The reportability evaluation.was completed on November 27, 1989 with the conclusion
'
that the event was reportable. The plant superintendent was notified that same date and a plant information report (389-208)
was initiated that resulted in the NRC:H00 notification on that same date.
(v) A formal evaluation entitled " Justification for Leaving the High Speed Transfer Operational" was completed on November 27, 1989. This evaluation contained essentially the same analysis results and engineering evaluations available on July 6,1989, and contained no new information.
Based on the above, the inspector could identify no basis for deferring initiation of the PIR and REF evaluations beyond July 1989, or why a reportability determination per 10 CFR 50.72(b)(2 (iii) should not have been made by the licensee on July 6, 1989.
The inspector noted by review of NEO 2.25, Identification and Implementation of NRC Reporting Criteria, Revision 1, dated l
October 24, 1989, Section 6.3, addresses completing reportability evaluations and justifications for continued operations concurrently, and further, that responsibility for completing both can be assigned to the same technical supervisor / manager.
-
This appears to have occurred for the fast transfer issue. The procedure appears to create a potential conflict between the l
l
-
- O yd*
h
.m
h~
timely completion of reportability evaluations and the completion
.
of engineering evaluations to assure solutions to problems that may impact plant operation.
Inspector concerns were discussed with the licensee station management. The licensee stated a similar issue was noted by the NU management and was being addressed.
Documentation of the issue would be provided for NRC review.
This matter requires
!
further NRC review and is unresolved pending further evaluation
!
(UNR50-423/89-23-03).
7.0 Safety Assessment / Quality Verification o
7.1 Review of Licensee Event Reports l
Licensee event reports (LERs) submitted during the report period were reviewed to assess LER accuracy, the adequacy of corrective actions, compliance with 10 CFR 50.73 reporting requirements and to determine if there were generic implications or if further information was required.
Selected corrective actions were reviewed for implementation and thoroughness.
The LERs reviewed were:
89-09-01, 89-21-00, 89-26-00, 89-28-00, 89-30-00, 89-31-00 and 89-32-00. The following LERs were selected for additional inspector followup:
89-30-00 and 89-31-00, discussed in sections 6.1 and 3.1.1 of this report, respectively.
8.0 Management Meetings Periodic meetings were held with station management to discuss inspection findings during the inspection period. A summary of findings was also discussed at the conclusion of the inspection.
The apparent violation regarding the removal of the automatic start
-
capability of the service water booster pumps was discussed and acknowledged by the licensee.
No proprietary inf ormation was covered within the scope of the inspection.
No written material was given to the licensee during the inspection period.
I