IR 05000528/1991029
| ML17306A217 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 10/04/1991 |
| From: | Wong H NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| To: | |
| Shared Package | |
| ML17306A216 | List: |
| References | |
| 50-528-91-29, 50-529-91-29, 50-530-91-29, NUDOCS 9110220029 | |
| Download: ML17306A217 (39) | |
Text
U. S.
NUCLEAR REGULATORY COMMISSION REGION V
Re ort Nos.
Docket Nos.
License Nos.
Licensee Facilit Name 50-528/91-29, 50-529/91-29, and 50-530/91-29 50-528, 50-529, and 50-530 NPF-41, NPF-51, and NPF-74 Arizona Public Service Company P. 0.
Box 53999, Station 9012 Phoenix, AZ 85072-3999 Palo Verde Nuclear Generating Station Units 1, 2, and
Ins ection Conducted Ju'ly 28 through September 7,
1991 AJ~ JB'P Cb~c lo-g-2/
ong le g
Reactor ProjectsSection II Ins ectors D. Coe, F. Ringwald, J. Sloan, S. Friedenthal, Senior Resident Inspector Resident Inspector Resident Inspector Region V Inspector Intern Ins ection Summar Ins ection on Jul 28 throu h Se tember 7, 1991 Re ort Numbers 50-528/91-29 50-529/91-29, and 50-530/91-29 Areas Ins ected; Routine, onsite, regular and backshift inspection by t ree resident inspectors, and one inspector intern from the Region V staff.
Areas inspected included: previoysly identified items; review of plant activities; engineered safety feature system walkdowns - Unit 3; surveillance testing - Units 2 and 3; plant maintenance
- Units 1, 2, and 3; essential cooling water (EW) system feed and bleed - Unit 1; missed nuclear cooling water (NC) system activity samples - Unit 1; operator familiarity with annunciators
- Unit 2; spray pond system lineup - Unit 2; manual reactor trip following control element dr'ive mechanism (CEDN) fan failure - Unit 2; reactor trip following a generator excitation failure - Unit 2; containment personnel airlock door interlock failure - Unit 2; main feedwater pipe over-pressurization
- Unit 2; unmonitored release of activity due to nitrogen system contamination - Unit 2; main steam isolation valve (HSIV) inadvertent closure - Unit 2; reactor shutdown due to failed inverter - Unit 3; undervoltage condition on class 1E bus PBA-S03 - Unit 3; loss of safety bus PBB-S04 - Unit 3; essential chilled water (EC) system technical specification (TS) discrepancy - Units 1, 2, and 3; water reclamation facility (WRF)
recalcing furnace personnel safety - Units 1, 2, and 3; review of quality classification and compliance with UFSAR commitments for the safety equipment status system (SESS) - Units 1, 2, and 3;.and review of licensee event reports
- Units 1 and 3.
9110220029 911007 PDR ADOCK 05000528 G
t During this inspection the following Inspection Procedures were utilized:
30702, 35702, 51332, 60705, 61726, 62703, 71707, 71710, 92700, 92701, 92702, 93001, and 93702.
Results Of the 22 areas inspected, two non-cited violations were identified sn unsts 2 and 3.
The violations pertained to failure to follow procedures.
General Conclusions and S ecific Findi~cis Si nificant Safet Matters Summar of Violations Hone
Non-Cited Violation - Unit 2 and
Non-Cited Violation - Unit 3.
Summar of Deviations None 0 en Items Summar 7 items closed, 1 item left open, and 3 new items opened.
Stren ths Noted Engineering response to the main feedwater piping overpressure was appropriate and thorough.
Good work group coordination was noted during CEDM fan replacements in Unit 2.
A reactor trip and a forced reactor shutdown due to Technical Specification action requirements resulted in part from failing to follow procedures.
In addition, identification and resolution of an unplanned release potential and a containment airlock operability concern could have been more timely.
On two occasions, operator knowledge of annunciators was wea Persons Contacted DETAILS The below listed technical and supervisory personnel were among those contacted:
Arizona Public R. Adney, J.
N. Bailey, J.
A. Bailey, B. Ballard, D. Blackson,
- T. Bradish, P. Caudill, L. Clyde, W. Conway,
.
- E. Dotson, R. Flood,
- J. Fogarty,
- R. Fullmer,
- D. Gouge,
- W. Ide,
- S. Kanter,
- J. Levine,
- R. Logue,
- T. Matlock, D. Mauldin, P. Maynard, J. Minnicks, T. Murphy, G. Overbeck, T. Radtke, F. Riedel, R. Rogalski,
- R. Rouse, C. Russo, R. Schaller,
- T. Shriver, J. Scott, J. Scott,
- B. Simko, L. Spiers,
- P.
Wi 1 ey, Other Personnel or ova, J. Draper,
- K. Hall,
- R. Henry, Service (APS Plant Manager, Unit 3 Vice President, Nuclear Safety.5 Licensing Director, Nuclear Engineering Director, Quality Assurance Manager, Central Maintenance Yianager, Compliance Director, Site Services Operations Manager, Unit 3 Executive Vice President, Nuclear Site Director, Engineering 5 Construction Plant Manager, Unit 2 Manager, Work Control Unit 2 Yianager, Quality Audits and Monitoring Manager, Plant Support (Chairman Plant Revie Plant Manager, Unit I Representative, Owner Services Vice President, Nuclear Power Production Supervisor, Operations Computer Systems Manager, Nuclear Safety Group Manager, Site Maintenance Sr. Mechanical Engineer, Site Nuclear Engine Maintenance Manager, Unit 3 Supervisor, RMS Chemistry Site Director, Technical Support Operations Supervisor, Unit 3 Operations Manager, Unit I Supervisor, Audit (QASM)
Supervisor, Compliance Manager, Quality Control (QA/QC)
Assistant Plant Manager, Unit I Assistant Plant Manager, Unit 2 Assistant Plant Manager, Unit 3 General Manager, Chemistry Maintenance Manager, Unit 2 Manager, Central Maintenance Work Control Operations Manager, Unit 2 w Bd.)
ering Dept.
Site Representative, Public Service of New Mexico Site Representative, Southern California Edison Site Representative, El Paso Electric Site Representative, Salt River Project
- Personnel in attendance at the Exit meeting held with the NRC Resident Inspectors on September 9, 199 The inspectors also talked with other licensee and contractor personnel during the course of the inspection.
2.
Previousl Identified Items - Units 1, 2, and
92701 and 92702 Unit i (0 en Fol l owu I tern 528/90-03-03:
"Fuel Buildin Rol lu Door Dama e/Venti ation Dam er Jum er Installation
- Unit
92701 This item involved the installation of pneumatic jumpers, which shut the fuel building supply dampers long enough for the exhaust fan to damage the fuel building rollup door, thereby rendering the fuel building essential ventilation system inoperable.
The licensee is evaluating this under Engineering Evaluation Request (EER)
90-ZF-009, which is still open and is scheduled to be closed on November 16, 1991.
This item will remain open until EER 90-ZF-009 is closed.
b.
Unit 2 Cl osed Enforcement I tern 529/91-19-01 and 530/91-19-01:
'Maintenance Performed on the Mron Com onent
- Units 2 and
92702 This item involved three examples where plant workers performed maintenance on the wrong component resulting in various plant transients.
The licensee disciplined the workers.
The Vice President, Nuclear Production, issued a memorandum on July 23, 1991, to site management requiring communication of the importance of attention to detail and of the effects of complacency and poor work practices to all personnel.
The Unit 3 Plant Manager directed a work stand down on May 24, 1991, to address safe work practices, procedure use and worker feedback.
Shop briefings were held to stress the importance of self-verification and job/task performance.
The Unit 2 event has been included as a subject for third quarter industry events training for Chemistry Radiation Monitoring System Technicians.
The inspector concluded that these activities will increase individual worker awareness of the need for greater attention to detail when performing work.
The effectiveness of the.
licensee's measures will be evaluated on an ongoing basis.
This item is closed.
(2)
Closed Fol1owu Item 529/91-04-01:
"Procedure Chan e Not Ref ected In Affected Procedures'
Unit 2 92701 This item involved the inspector's identification of incorrectly positioned Control Room smoke dampers and the failure of the change to one procedure affecting these dampers not being reflected in
other affected plant procedures.
Inspection Report 91-04 verified that these specific conditions had been corrected.
The licensee reviewed the options and concluded that improving on the present system would require a computerized database.
The licensee also concluded that the problem does not justify the expenditure of resources required.
The licensee has discussed this event with procedure writers in the Operations Standards Department to heighten awareness of this concern.
The inspector concluded that the licensee is relying on the individual procedure writers to remember how a given procedure change impacts other procedures and woula review the effectiveness of this on an ongoing basis.
This item is closed.
c ~
Unit 3 (2)
(Closed Foll owu Item 530/90-45-02:
"Incident Investi ation e ort rac
>n e >c>encies
- n>ts,,
and
)
This item involved an IIR corrective action which did not get implemented as a result of tracking deficiencies in the IIR program.
The missed corrective action, to reinsert a missing page from procedure 43EP-3ZZ01, was completed and the inspector confirmed that the current controlled copies in the Unit 3 Control Room were complete.
In addition, the licensee evaluated their program and revised procedure 90DP-OIPOI, "Incident Investigation Report Preparation,"
to require IIR corrective actions be tracked using the procedure 01GB-OC(01,
"Commitment Action Tracking System - CATS."
The inspector concluded that this will improve IIR corrective action tracking.
This item is closed.
0 en Unresolved Item 530/91-26-02:
"NUE for Hi h
RCS Leak Rate"
- Unit 3 92702 This item resulted from an apprently late notification of an NUE by the licensee subsequent to an RCS leak rate in excess of Technical Specifications.
Further discussion between Region V inspectors and NRC Headquarters have'Indicated that an NUE was not required in this case.
As noted in Inspection Report 530/91-26, this item will be closed by Region V Emergency Preparedness inspectors (Inspection report 530/91-34).
3.
Review of Plant Activities 71707 and 93702 a
~
Unit
b.
Unit 1 operated at essentially 100% power for the duration of the reporting period.
Unit 2 Unit 2 entered this period operating at 100 percent power.
On August 9, 1991, at 6:48 AN (NST), the unit was downpowered and manually tripped from about 40 percent power due to the failure of all control element drive mechanism cooling fans (see Paragraph 11).
The unit was restarted on August 15.
Power was increased to 64
percent and held pending resolution of a feedwater system overpressurization event (see Paragraph 14).
A reactor trip occurred on August 16 following a turbine trip caused by a main
'generator control malfunction at 8:39 AM on August 16 (see Paragraph 12).
The reactor was restarted on August 19.
Power was increased to approximately 90 percent, where it was held due to a feedwater heater problem.
Power was increased to 100 percent on August 22, 1991, but at 5:52 PM on that date, main steam isolation valve, MSIV-1S1, inadvertently closed, and the plant was stabilized at 70 percent power (see Paragraph 16).
On August 23, 1991, the unit experienced a loss of the Core Operating Limits Supervisory System for about six hours and a downpower to 70 percent power resulted.
Following MSIV repairs, power was increased to 100 percent on August 24, 1991.
The unit operated at essentially 100 percent power for the remainder of the reporting period.
Unit 3 Unit 3 entered this period operating at 100 percent power.
On July 31, 1991, the unit experienced a Containment Purge Isolation and Control Room Essential Filtration Actuation due to the failure of the "A" Containment Power Access Purge radiation monitor RU-37.
On August 30, a Notification of Unusual Event (NUE) was declared due to a shutdown required by Technical Specifications due to the failure of a vital 120 VAC inverter PNC-N13 (see Paragraph 17).
The NUE was terminated after the unit entered Mode 3 at 1: 19 AM (MST) on August 31, 1991.
The reactor was restarted on September 2, 1991.
Power was held at 10 percent unitil September 4, 1991, due to emergent problems with main turbine controls.
The unit then increased power, achieving 100 percent power on September 5,
1991.
The "B" heater drain pump failed on September 7, 1991, resulting in a power decrease to approximately 90 percent.
The unit ended the reporting period at this power level.
Plant Tours The following plant areas at Units 1, 2, and 3 were toured by the inspector during the inspection:
Auxiliary Building Control Complex Building Diesel Genera'tor Building Fuel Building Radwaste Building Technical Support Center Turbine Building Yard Area and Perimeter The following areas were observed during the tours:
(1)
0 eratin Lo s and Records - Records were reviewed against Technical Specifications and administrative control procedure requirement During the Unit 2 reactor shutdown nn August 9, 1991, discussed in Paragraph 11, the Control Room Log entry regarding the reactor Axial Shape Index (ASI) at the time of the manual trip was incorrect in that it incorrectly specified a positive ASI instead of a negative ASI.
This resulted in an unnecessary initial NRC concern that a reactivity anomaly may have occurred.
During the inadvertent NSIV closure event at Unit 2 discussed in Paragraph 16 of this report, the inspector noted that the Shift Supervisor documented entry into Technical Specification (TS) Action Statement 3.2.6 due to cold leg temperature above 570 degrees Fahrenheit (F}.
The TS requi rement is for cold leg temperature to remain below 568 degrees F when power is above 30 percent.
The inspector concluded that this represents inattention to detail.
The inspector noted that the Unit 2 Control Room log did not document the loss of 2 reactor coolant pumps on August 8, due to the failure of fast bus transfer, and reopening of MSIV 181 on August 24, 1991.
Log entries were corrected in these cases and licensee management acknowledged the need to maintain accuracy in log keeping.
Nonitorin Instrumentation
- Process instruments were observed for correlation between channels and for conformance with Technical Specifications requirements.
~Shif S
fbi
-
C
d hi<<
fthm g
b d
for conformance with 10 CFR Part 50.54.(k), Technical-Specifications, and administrative procedures.
E ui ment Lineu s - Various valves and electrical breakers were verified to be in the position or condition required by Technical Specifications and administrative procedures for the applicable plant mode.
E ui ment Ta in
- Selected equipment, for which tagging requests a
een initiated, was observed to verify that tags were in place and the equipment was in the condition specified.
General Plant E ui ment Conditions - Plant equipment was observed for indications of system leakage, improper lubrication, or other conditions that could prevent the systems from fulfilling their functional requirements.
During a tour with a Unit 3, Area 1 Auxiliary Operator (AO},
the inspector pointed out to the AO that the oil level in the outboard turbine bearing for auxiliary feedwater pump AFAP01 was outside of its band, after he had marked it as satisfactory in his logs.
Upon discussion with the AO, it became apparent that the discrepancy was due to the level marks being extremely
(7)
(g)
difficult to read.
The licensee initiated a work order to make the sight glass level marks more readable.
The licensee had previously determined that high oil levels in this range do not impact operability.
Fire Protection - Fire fighting equipment and controls were observed for conformance with Technical Specifications and administrative procedures.
<<h i<<
-C conformance with Technical Specifications and administrative control procedures.
~gecurit
'
Activities observed for conformance with regulatory requirements, implementation of the site security plan, and administrative procedures included vehicle and personnel access, and protected and vital area integrity.
The inspector noted one occasion in which a security officer who was present at an inoperable card reader to the Unit
Control Room entrance allowed passage through the door to several individuals, including the inspector, without first checking to verify that access would have been granted by the card reader had it been functional.
The officer noted the numbers on the cards as the individuals passed through, wrote them down, and was apparently going to check them later.
However, allowing access to a vital area without first verifying authorization is not in accordance with licensee procedures.
The licensee determined this was a loggable event, which would be reported to the NRC in a routine submittal.
The inspector notified Region V security inspectors who will evaluate the need for further NRC action.
(10) Plant Housekee in
- Plant conditions and material/equipment storage were obse'rved to determine the general state of cleanliness and housekeeping.
Radiation Protection Controls - Areas observed included control point operation, records of licensee's surveys within the Radiological Controlled Areas (RCA), posting of radiation and high radiation areas, compliance with Radiation Exposure Permits (REP), personnel monitoring devices being properly worn, and personnel frisking practices.
No violations of NRC requirements or deviations were identified.
4.
En ineered Safet Feature ESF S stem Walkdowns - Unit 3 71710 Selected engineered safety feature systems (and systems important to safety)
were walked down by the inspector to confirm that the systems were aligned in accordance with plant procedure During this inspection period the inspectors walked down accessible portions of the following systems.
Unit 3:
"8" Auxiliary Feedwater System
"A" and "8" Essential Chi llers "A" and "8" Ho violations of NRC requirements or deviations were identified.
5.
Surveillance Testin
- Units 2 and
61726
'a
~
Selected surveillance tests required to be performed by the Technical Specifications (TS) were reviewed on a sampling basis to verify that:
1) the surveillance tests were correctly included on the facility schedule; 2)
a technically adequate procedure existed for performance of the surveillance tests; 3) the surveillance tests had been performed at the frequency specified in the TS; and 4) test results satisfied acceptance criteria or were properly dispositioned.
b.
Specifically, portions of the following surveillances were observed by the inspector during this inspection period:
Unit 2 Procedure Descri tion o 42ST-2NIOl Adjustable Power Signal Calibration Unit 3 Procedure Descri tion o 43ST-3ZZ23 CEA Position Data Log o 43ST-3'EM02 Essential Cooling Mater Pump Operability o 43ST-3EC02 Essential Chilled Mater Pump Operability o 72ST-9SB02 CPC/CEAC Auto Restart Check o 73ST-3XI16 FMIV Section XI Test No violations of NRC requirements or deviations were identified.
6.
Plant Naintenance
- Units
2, and 3 (62703 a
~
During the inspection period, the inspector observed and reviewed selected documentation associated with maintenance and problem investigation activities listed below to verify compliance with regulatory requirements, compliance with administrative and maintenance procedures, required guality Assurance/guality Control involvement, proper use of safety tags, proper equipment alignment and use of jumpers, personnel qualifications, and proper retestin The inspector verified that reportability for these activities was correct.
b.
'Specifically, the inspector witnessed portions of the following maintenance activities:
Unit 1 Descri tion o Spray Pond Pump "A" Oil Change o Cleaning and Inspection of Spray Pond Pump "A" Filter o Miscellaneous Preventive Maintenance on Diesel Generator
"A" Unit 2 Descri tion o Boric Acid Walkdown in Containment o Inspection of Feedwater Piping o Repair and MOVATS Test of valve SG-UV-134 (1)
The inspector observed Unit 2 electricians perform a routine Preventative Maintenance (PN) task on emergency light 2E-SAL-72A-04-051-10 under Work Order (WO) 502245.
The inspector noted that the WO required the electricians to document each cell's electrolyte level with a criterion of 1/8 inch below the top reference mark.
The inspector observed electricians measure this level "by eye" and questioned the electricians who said that this was common practice because of their experience.
Noting that the level appeared to be sloped and more than 1/8 inch below the top reference mark in cells
and 3, the inspector independently measured them to be 1/4 inch below the top reference mark.
The level sloped from this 1/4 inch point to the top mark, probably due to surface tension effects.
System Engineering evaluated this and concluded that the measurement should be taken from the lowest point of the observed electrolyte level and initiated Instruction Change Request 24990 to revise all applicable PM tasks to reflect this requirement.
As a result, cells 2 and 3 of 2E-SAL-72A-04-051-10 were below the minimum acceptable level yet were documented as satisfactory in Work Order 502245.
The licensee determined that the electrolyte level requirement was very conservative and stated that recommendations from an ongoing evaluation of this PM task were expected by October 31, 1991.
The inspector concluded that the failure of the electricians to note the unusual cell electrolyte level was due, in part, to imprecise work instructions, but that the observations were not significant from a safety perspective.
The inspector further noted that the restoration step of the WO was signed off as completed while the retaining clips were
still not fastened.
The licensee determined in Engineering Evaluation Request 90-gD-018 that retaining clips or screws are not required, and is considering removal of those fasteners still in place.
The inspector concluded that the licensee's evaluation and response to these observations were appropriate.
(2)
In a separate event, an Auxiliary Operator (AO) misjudged the rate at which the fuel transfer canal was being filled resulting in allowing the canal to be.overfi lied.
Approximately 100 gallons of water overflowed into the new fuel inspection pit before the AO terminated the filling evolution.
The water damaged the new fuel elevator.
The inspector concluded the AO had not adequately monitored the evolution.
The licensee disciplined the AO and initiated CDR 2-1-0077, which resulted in ICR 39973 to 420P-2PC06,
"Spent Fuel Pool Cleanup and Transfer", requiring the AO to continuously monitor this evolution.
(3)
The inspector noted one occasion where engineers in System Engineering were not notified of a planned Unit 2 RCP seal injection outage during the repair of two seal injection heat exchanger drain valves.
It was System Engineering's intention to closely monitor seal performance during such outages as a means of establishing a valid technical basis to support operating the seals for more than one fuel cycle.
The inspector noted that plant computer data on seal parameters remained available for engineering review, but encouraged the licensee to maintai n close coupling between maintenance activities and engineering where appropriate.
Licensee management acknowledged these comments.
Unit 3 Descri tion o
Inspect Control Room Main Control Board Section B02 for Electrical and Ma'terial Deficiencies o
Refurbish Multistud Tensioner (for Unit 2)
o
"B" Emergency Diesel Generator (EDG) Maintenance and...
Change Oil in "A" Spray Pond Pump Motor o
Inspect and Clean Spray Pond Screens o
Troubleshoot and Repair CEAC No.
o Repair Class IE 120 VAC Inverter PNC-N13 During a planned maintenance outage of the "A" Emergency Diesel Generator (EDG) and the "A" spray pond pump (SPA-P01) motor on July 30, l991, the inspector noted evidence of apparent inefficiency which contributed to the systems being out of service longer than necessar The inspector noted that apparently no activity was in progress for over an hour during the midst of scheau'led work on EGG "A."
Condition Report/Disposition Request (CRDR) 3-1-0065 was initiated to investigate the scheduled work activities.
The licensee determined that two of the four Work Orders (WOs)
had been completed by the time the inspector made the observation.
However, the other two WOs were unnecessarily delayed.
One WO was delayed because a part was not available, and the other WO delay was due to weak communications which resulted in workers deciding to start work about four hours after they could have because they didn't understand the priority, and EDG "A" was unnecessarily unavailable for an additional four hours.
The mechanics changing the SPA-P01 oil did not have sufficient containers into which to drain the old oil, necessitating a
delay while additional containers were obtained.
Additionally, the makeshift apparatus and method used to collect the used oil introduced risk of an oil spill, which fortunately did not occur.
Also, even though the mechanics knew that over 20 gallons of oil would be needed to replace the old oil, only 10 gallons were brought to the work location.
This necessitated an interruption in the work while more oil was obtained and introduced some risk that sufficient oil may not have been available to complete the oil change.
The licensee is evaluating these evolutions to determine how to improve their maintenance practices and to minimize safety system unavailability.
In an unrelated inquiry, the inspector reviewed WO 467805, involving a Unit 3 safety-related molded case circuit breaker, and the associated test equipment records to determine why the tests were repeated and if different test equipment was used to obtain acceptable results.
The records indicate that the same piece of test equipment, an NCB-400 (control number EN1610),
was used for all performances of the 300 percent over current long time trip test (Section 8.5).
The WO requires a minimum of two repetitions of the test before considering the breaker unacceptable, and requires a minimum cool down period before repeating the test.
The test was repeated several times, by two separate shifts of electricians, before acceptable results were obtained, for all three phases, with the same NCB-400.
The records indicate that a wider scale on the NCB-400 was selected on the day the test was passed than during the previous tests, though all of the ranges used appeared adequate.
The work continuation sheets indicate that cooling the breaker to ambient temperature appeared to be an important factor in the successful test performance.
The inspector concluded that the test had been performed in an adequate manner.
The inspector inquired if GE Nagnablast circuit breakers were excessively damaged by frequent operation.
The inspector determined through discussions with the licensee that the
vendor recommends breaker overhaul every 2000 cycles.
The licensee stated that their.'eakers are infrequently operated, and are not approaching this number.
The licensee estimated that the most often used breaker has less than 1000 cycles.
Additionally, the licensee stated that the breakers have exhibited very few failures, and. that no excessive damage due to frequent operation has been observed.
The inspector reviewed the licensee's equipment Failure Data Trending information for 4. 16 and 13.8KY breakers and confirmed the licensee's statement.
The inspector concluded that the licensee is cognizant of Magnablast breaker limitations and has not experienced excessive breaker damage due to frequent operation.
The risks of racking in Magnablast breakers with shorted outputs was also evaluated.
The licensee acknowledged that a
shorted output (or input) could result in the feeder breaker opening.
If foreign material caused the short, it could burn or melt before the breaker tripped open.
However, the licensee's system engineer stated that mechanical interlocks prevent the Magnablast breakers from being racked in when closed.
A shorted output would cause an 86 lockout which would cause the breaker to reopen on over current if closed after being racked in.
This type of breaker takes about 4 to
cycles to reopen on a dead short.
Based on discussions with licensee electricians fami liar with Magnablast breakers, the inspector determined that while the breakers should be able to sustain a dead short until the over current condition causes the breaker to open, a substantial personnel hazard would be present.
The electricians noted that the breaker would not automatically close after being racked in because the control power fuses are generally removed and not reinstalled until after the breaker is racked in.
However, if a close signal were present, the breaker would attempt to close as soon as the fuses were reinstalled.
r The Unit 3 electricians stated that to their knowledge, no Magnablast breakers with shorted outputs had ever been racked in at Palo Verde.
Both the electricians and their foremen appeared very conscious of the personnel safety risks associated with racking in breakers.
The inspector concluded that the licensee is aware of the potential risks associated with breaker faults, and that no Magnablast breakers with shorted outputs had been racked in at Palo Verde 3.
No violations of NRC requirements or deviations were identified.
7. Essential Coolin Water EW S stem Feed and Bleed - Unit
71707 On August 8, 1991, Unit 1 was performing a feed and bleed operation in the "A" EW system to replace one corrosion inhibitor with another.
The
Shift Supervisor halted the operation when he realized that the controls over the feed and bleed left the system in a potentially degraded condition.
A manual drain valve was opened at a low point, while the non-Class IF automatic expansion tank level control system was being relied upon to maintain system inventory.
The Shift Supervisor directed that an operator be assigned to monitor the expansion tank level and to close the drain valve should the tank level get too low.
The feed and bleed was then resumed.
8.
The inspector concluded that the Shift Supervisor had acted prudently in identifying and correcting the situation before.resuming the evolution, but that it would have been better to put compensatory measures into place prior to commencing the evolution.
Licensee management acknowledged these comments.
No violations of NRC requirements or deviations were identified.
Missed Nuclear Co'olin Water NC S stem Activit Sam les - Unit
92700 9.
On July 30, 1991, the licensee failed to obtain a backup activity sample of the NC system as required by Justification for Continued Operation (JCO)
161-03709,
"Potential for Small Break Loss of Coolant Accident Due to Pipe Rupture in the Reactor Coolant Pump Seal Cooler."
The sample was required to be obtained after the initial sample, taken at 8:00 AM (MST)
on July 30, 1991, indicated the presence of Iodine-131 activity, a
potential indication of Reactor Coolant System (RCS) leakage into the NC system through the reactor coolant pump seal cooler.
The samples are required every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
The next sample, obtained at 8:52 PM, showed no activity.
On August 12, 1991, the licensee failed to obtain the periodic activity sample of the NC system required by the JCO.
The next sample showed no activity present.
These events were referred to Region V Chemistry and Radiological protection inspectors for fbrther review and are being addressed in Inspection Report 528/91-33.
0 erator Fami liarit With Annunciators - Unit 2 71707 On two occasions the inspector selected an annunciator that could have impact on current plant operations and questioned the operators regarding the reason the annunciator was in alarm.
On August 20, 1991, the inspector questioned the PPS IN TEST annunciator when the reactor had just been taken above 20 percent power with Control Element Assemblies (CEAs) below the short term insertion limit of Technical Specification (TS) 3. 1.3.6.
Neither the control room operators nor the assistant shift supervisor knew why the annunciator was in alarm.
The assistant shift supervisor quickly ascertained and corrected the cause, a partially open door for a Plant Protection System (PPS) cabinet, clearing the annunciator.
According to the licensee, these PPS cabinet door limit switches are sensitive to the precise orientation of the
closed door, and this annunciator is lit frequently during door operations.
The licensee has concluded that door modifications are not warranted at this time, provided operators take action to determine the cause of an alarm and correct it.
The inspector concluded that the unknown alarm condition represented operator unfamiliarity with an existino alarm condition.
On August 22, 1991, the inspector questioned the CPC/CEAC TRBL annunciator when the reactor was about 90 percent power.
Neither control room operator was aware of why the annunciator was in alarm.
The responsible operator was able to determine that the annunciator was in alarm due to open cabinet doors on auxiliary protection cabinets.
The inspector concluded that this represents operator unfamiliarity with an existing alarm condition.
The inspector discussed this with responsible licensee management who stated that these examples did not meet licensee expectations and that these would be used during operator briefing to heighten operator awareness of alarm conditions.
Subsequently, these examples were included in a memorandum to all Unit 2 staff stressing the need for better attention to detail.
No violations of NRC requirements or deviations were identified.
S ra Pond S stem Lineu
- Unit 2 71707 On August 16, 1991, with the unit in Mode 3 following a reactor trip (see Paragraph 12), the inspector observed that both trains of the Spray Pond (SP)
system were operating in bypass mode, in which flow enters the pond directly beneath the water line instead of through the spray nozzles.
The accident condition status for the system is spray mode.
The system was being run in bypass mode for chemistry control purposes.
Licensee procedures allow operation of the SP system in bypass mode as long as the spray pond temperatures are maintained less than the Technical Specification limit.
The inspector verified temperatures were acceptable.
The inspector asked if the spray pond could operate under accident conditions for 30 minutes in bypass mode without impacting the safety analysis, which assumes no operator action for 30 minutes.
The licensee determined that spray pond temperature increase during the first 30 minutes of the design basis accident would be less than one degree, well within the safety analysis assumptions.
The inspector noted that the licensee could achieve its chemistry control purposes by operating the SP system either one train at a time in bypass mode, or by operating one or both trains in spray mode.
Although the licensee's actions were acceptable, the inspector found that emergency procedures assume the system is aligned to spray mode.
The licensee responded by initiating Condition Report/Disposition Request (CRDR) 9-1-0132 to evaluate if emergency procedures contained adequate direction regarding restoration to spray mod t No violations of NRC requirements or deviations were identified.
11.'anual Reactor Tri Followin Control Element Drive Mechanism CEDM Fan Fai ures - Unct
92700 and 93702 On August 9, 1991, with the unit operating at 100 percent power, failure of all available CEDM fans resulted in a forced downpower and a manual reactor trip from approximately 40 percent power at 6:48 AM (MST).
At the time of the event, only two of the four CEDM fans were available, due to failures of mounting bolts and bearings, noted in NRC Inspection Report 529/91-26 (Paragraph 11}.
At 5:10 AM, the running "D" CEDY. fan tripped due to a bearing failure and ground fault indication, at which time the
"C" fan was placed in service.
The "C" fan tripped at approximately 6: 10 AM, also with a ground fault indication, but without any control room annunciation, leaving no available fans.
Per licensee procedures, the operators commenced a reactor shutdown by boration only, and manually tripped the reactor at 6:48 AM due to being unable to maintain Axial Shape Index (ASI) and azimuthal tilt within Technical Specification (TS) Limiting Condition for Operation (LCO) limits without the use of the control element assemblies.
During the reactor trip transient, the fast bus transfer for 13.8 KY bus NAN-S01 failed, resulting in the loss of power to two of the four operating reactor coolant pumps and some other less significant equipment.
Power was restored to NAN-S01 within two minutes of the failure.
Otherwise, the plant equipment functioned as designed and the plant was stabi lized in Mode 3.
The licensee initiated Condition Report/Disposition Request (CRDR)
2-1-0055 to investigate the event.
During the investigation, the licensee identified a loose bracket and a loose contact on an auxiliary microswitch in the bus NAN-SOl supply breaker, which were determined to be the cause of the fast transfer failure.
The affected breaker had been refurbished by its manufacturer during the 1990 refueling outage, and the deficient relay connection was not included in the scope of the receipt inspection or other licensee preventive maintenance activities.
A fast transfer test had been successfully performed, though that test did not verify the functions oi this microswitch.
The licensee is reviewing its receipt inspection and Preventive Maintenance (PM) practices and alternatives related to this breaker and relay.
The licensee stated that the faulty components would be included in the revised PM test.
The licensee's safety assessment determined that the safety analyses assumptions concerning ASI and azimuthal tilt were maintained.
ASI reached-0,45, in excess of the TS LCO limit of -0.27.
The Core Protection Calculator (CPC) trip setpoint is -0.50.
The azimuthal tilt LCO limit was exceeded only in the sense that the CPC tilt allowance was exceeded, but this is normally corrected by the allowed adjustment of an addressable constant.
The licensee replaced three of the four CEDM fans with new fans and repaired the NAN-S01 supply breaker.
Following these activities, the unit was restarted, going critical at 12:03 AM on August 15, 1991, entering Mode 1 at noon, and synchronizing to the grid at 5:01 PH the same da.
The licensee had previously installed CEDN fan vibration monitoring equipment in Unit 1, but did not install similar equipment in Unit 2,
'ven though significant vibration was suspected as a principal cause of the boltino failures experienced on June 25, 1991.
Vibration monitoring equipment was subsequently installed in Unit 3.
The inspector concluded that licensee responses to the CEDN fan failures, the reactor trip transient, and the fast bus transfer failure were adequate and appropriate.
Good coordination between work groups was noted during the evaluation and repair of the failed components.
No violations of NRC requirements or deviations were identified.
Reactor Tri Followin a Generator Excitation Failure - Unit 2 92700 and 93702 At 8:39 AM (NST) on August 16, 1991, while the reactor was operating at 64 percent power pending resolution of a feedwater system problem, an automatic reactor trip occurred due to high pressurizer pressure following a main turbine trip at 8:39 AN caused by a generator trip at 8:38 AN.
All systems responded as designed and the plant was stabilized in Node 3.
The generator trip resulted from an excitation system malfunction which caused reactive load to increase from +20 HVAR to over +1200 NVAR and generator output voltage to exceed
KV.
While operators attempted to restore proper excitation, the Generator Exciter (Generex) shifted to fixed field momentarily and the generator tripped on high voltage to frequency ratio.
The turbine tripped automatically as a result of the generator trip.
The Steam Bypass Control System (SBCS)
responded by quick opening seven in-service Steam Bypass Control Valves (SBCVs).
As steam header pressure decreased, the SBCVs modulated closed, causing steam header pressure and pressurizer pressure to begin to increase again.
The SBCS did not cause the valves to modulate open fast enough to prevent pressurizer pressure from reaching the reactor trip setpoint.
Pressurizer pressure peaked at 2385 psia.
SBCV-1003 was in OFF at the time of the event, contrary to procedure 420P-2ZZ04,
"Plant Startup Mode 2 to Mode 1."
Operators intentionally left one valve off because when operating at greater than 75 percent power, one valve is required to be in OFF.
However, below 75 percent power, all available valves are supposed to be in service in order for the unit to sustain a loss of load without a reactor trip.
SBCV-1003 was selected to be in OFF because it demonstrated the least reliable performance during routine preventive maintenance observations, but it was available to be placed in service.
Procedure 40AC-90P02,
"Conduct of Shift Operations,"
requires operators to follow procedures as written, and notes that "procedures are generally written assuming the appropriate plant equipment was available for service."
This procedure further states that
"when plant conditions prevent performing a procedure as written," operators are to "resolve the problem in accordance with approved administrative control procedures
before continuing with the activity," and provides an internal reference to guidance for "Special Variances."
The Special Variance guidance in 40AC-90P02 'describes the Special Variance as
"a means to the on-shift operations personnel to document, review, approve, and use non-intent changes to existing procedures and alignments due to unique one-time plant conditions,"
and states that a Special Variance may be used to
"alter system/component alignments to accommodate existing plant conditions."
The licensee acknowledged that a Special Variance was required in this case.
The Shift Supervisor and Assistant Shift Supervisor were counseled regarding their performance and this performance expectation is being addressed in a.memo to Unit 2 operations personnel.
The failure to implement a Special Variance before deviating from the SBCS alignment required by 420P-2ZZ04 is an apparent violation of NRC requirements.
This licensee-identified violation is not being cited because the criteria specified in Section V.G. of the Enforcement Policy were satisfied (NCV 529/91-29-02).
The licensee initiated Condition Report/Disposition Request (CRDR)
2-1-0071 to investigate the reactor trip event.
The inspector concluded that the operators should have utilized the administrative controls for procedural variance prior to proceeding with the activity in progress.
Otherwise, the licensees actions and response to this event appeared appropriate and adequate.
One non-cited violation of NRC requirements was identified.
Containment Personnel Airlock Door Jnterlock Failure - Unit 2 92700 At about 10:30 PM (MST) on August 10, 1991, while the unit was in Mode 3, personnel exiting the Unit 2 containment through the 140 foot elevation personnel airlock noted that another group of people attempting-to enter the airlock were able to undog the outer door before those inside the airlock were able to completely shut the inner door.
The outer door was not opened until the inner door was shut and at least partially dogged.
The apparent failure of the door interlocks was reported to the lead Radiation Protection (RP) technician, who in turn reported it to the containment coordinator and to the Assistant Shift Supervisor.
Without coordination from the control room, the containment coordinator investigated the airlock and reported to the Assistant Shift Supervisor that the interlocks were functioning properly.
However, he only checked that the inner door would not open when the outer door was open.
The Shift Supervisor and the night shift Outage Manager were not made aware of the problem until shift turnover time at about 7:00 AM on August 11, 1991.
Day Shift management aggressively responded to this condition.
Condition Report/Disposition Request (CRDR) 2-1-0060 was initiated and a
person was assigned to operate the airlock, acting as a
human interlock, until the condition could be more fully assessed.
Following a discussion with the night shift RP technician who initially observed the problem, the inner door was locked at 11: 18 AM pursuant to the licensee's interpretation of Technical Specification Action Statement
.
(TSAS) 3.6. 1.3.b.
Surveillance Test 73ST-9CL05,
"Containment Ooor Interlock Test,"
was performed and failed at 1: 17 PM, confirming that the outer door interlock was inoperable.
The licensee inspected the interlock and found a sheared key and damage to the associated shaft.
These parts were replaced and the airlock was subsequently retested and declared operable ori August 12, 1991.
TSAS 3.0.3 was entered on August 11 at 1: 17 PM for five minutes, arid again at 2: 10 PY for less than one minute, after management review of the reports that both doors had been open for a few.seconds during the initial observation, during performance of the failed surveillance test, and during troubleshooting of the interlocks.
Further review indicated that during the troubleshooting and testing only one door at a time was open, with the other door being operated only far enough to verify the interlock function.
Both the troubleshooting Work Order (WO) No.
510007 and the surveillance test included precautions against opening both doors simultaneously.
The interlock function can be verified with the door seal remaining intact and the pressure equalizing valve remaining closed.
The extent to which the seal integrity was absent on both doors simultaneously when the deficiency was first noticed is unclear, but appears to have been minimal.
The licensee determined that containment integrity had not been breached and that the entry into TSAS 3.0.3 was not necessary and not reportable.
Work order 510007 did not contain specific precautions regarding how far the hand wheel of a closed door could be turned while the other door was open.
The WO restricted the worker from opening both doors simultaneously, but "open" was not defined.
The licensee acknowledged both of these weaknesses and agreed to review the WO for lessons to be learned.
The licensee has a Preventive Maintenance (PM) task, performed every refueling, to inspect the airlock doors and interlocks.
The inspector was informed that interlock failures are not uncommon.
The licensee agreed to review the maintenance history to determine if the PM frequency needs to be adjusted.
Maintaining containment integrity in Node 3 is required by Technical Specification Limiting Condition for Operation (LCO) 3.6. 1.1 and airlock operability is required by LCO 3.6. 1.3.
Prompt and rigorous attention is required when conditions indicate a potential lapse of integrity.
The inspector concluded that communications following the initial identification of the potential breech of containment integrity demonstrated a lack of sensitivity, by various personnel, to the importance of containment integrity.
The evaluation by the Containment Coordinator was performed without guidance or authorization and was not thorough in that the wrong interlock was checked and the wrong conclusion drawn.
Additionally incorrect information provided to the control room resulted in the Shift Supervisor's incorrect understanding that both doors had twice been
"opened" simultaneously and resulted in the subsequent unnecessary entries into TSAS 3.0.3.
The troubleshooting WO lacked specific criteria to ensure containment integrity was maintaine J
14.
However, it was noted that management exhibited appropriate sensitivity to this condition when notified on the morning of August 11, 1991.
The licensee initiated a
Human Performance Evaluation System (HPES)
evaluation to further assess the communication problems and need for corrective actions.
Licensee management acknowledged the need for operations, maintenance, RP, and others to increase the sensitivity toward potential containment integrity breeches.
Yo violations of NRC requirements or deviations were identified.
Main Feedwater Pi e Over ressurization
- Unit 2 '2700 On August 16, 1991, while the unit was in Mode 1 at approximately 60 percent power, the licensee determined that a portion of Main Feedwater Pump (MFP) "B" discharge piping had been pressurized to approximately 7500 psig.
An apparent hydraulic lock had developed between FMB-HV-32, the "B" MFP discharge isolation valve, and FWB-V-012, the discharge check valve, preventing the opening of FWB-HV-32 while attempting to place the "B" MFP in service.
The licensee performed both a physical and a magnetic particle inspection of the piping, which did not reveal any deficiencies.
Calculations showed the yield stress had been substantially exceeded.
FWB-V-012 failed a functional check and was subsequently disassembled and repaired.
FVB-HV-32 was successfully operationally checked after the packing was adjusted.
The licensee performed a
CFR 50.59 safety evaluation supporting plant operation with the existing valves and piping.
Procedures were revised to require the MFP discharge valves to be open during secondary plant heatup to prevent overpressurization.
Following a review of Material Nonconformance Report (MNCR) 91-FM-2001 and discussions with NRR personnel, the inspector concluded that the licensee's actions were thorough.
No violations of NRC requirements or deviations were identified.
15.
Unmonitored Release of Activit Due to Nitro en S stem Contamination
- Unit 2 92700 On August 11, 1991, an unplanned unmonitored radiological gaseous release occurred due to contamination of the low pressure nitrogen system.
The contamination occurred when the nitrogen header was de-pressurized to allow repair of a blown rupture disc, GAN-PV-0041.
The nitrogen header supplies several contaminated and non-contaminated system loads.
The nitrogen system contamination was identified while the licensee was investigating the source of contamination of the normally non-contaminated Nuclear Cooling Mater (NC) system, which had a confirmed positive activity sample obtained pursuant to the requirements of Justification for Continued Operation (JCO)
161-03873,
"Potential for Small Break Loss of Coolant Accident Due to Pipe Rupture in the Reactor
Coolant Pump Seal Cooler."
The licensee determined the contamination came from the Equipment Drain Tank (EDT), which is normally pressurized to about 3 psig, and does not have a check valve to prevent venting the EDT to the nitrogen header if the header becomes depressurized.
The day after the licensee repaired the nitrogen header rupture disc, the inspector identified the potential for an unmoni tored release through the rupture disc.
The licensee had not considered this potential up to that time.
The licensee determined that the rupture disk had failed 27 previous times in Unit 2 alone, plus 8 times in Unit 1 and 3 times in Unit 3.
A design change had been implemented in Unit 2 during the 1990 refueling outage which reduced the failure frequency.
The modification was also completed in Units 1 and 3.
This was the first failure in Unit 2 since the design change was implemented.
The licensee evaluated the potential unmoni tored releases from each of the failures, confirming that small releases had occurred.
The licensee determined that the worst case release was within Technical Specification limits.
Additionally, the nitrogen system contamination resulted in the contamination of several other interconnected normally clean systems.
A Region V Health Physics inspector evaluated the licensee's actions following discovery of Nitrogen contamination and the potential release path in a separate inspection (see NRC Inspection Report 528/91-33).
An Engineering Evaluation Request (EER) was initiated to evaluate potential design changes to install check valves in the nitrogen supply lines to those interconnected contaminated systems which do not have them, and to increase the capacity of the nitrogen header pressure safety valve to reduce the risk of rupturing the rupture disc.
A previous recent example of a slow response to a potential unmonitored release path is documented in Inspection Report 529/91-26, Paragraph 2.c.2.
This event involved unplugged Auxiliary Building floor drains.
The inspector concluded that the licensee's corrective actions for previous rupture disc failures did not prevent recurrence, but that proposed corrective actions appear adequate.
The inspector further concluded that the licensee was slow to recognize the unmonitored release path and take action after the nitrogen system was determined to be contaminated.
Licensee management acknowledged these comments at the exit meeting.
The need for further NRC action will be assessed in Inspection Report 928/91-33.
No violations of NRC requirements or deviations were identified.
Main Steam Isolation Valve NSIV Inadvertent Closure - Unit 2 93702 On August 22, 1991, while at 100 percent power Unit 2 experienced an inadvertent fast closure of MSIV 181.
Pre-trip annunciators were received for Variable Overpower, Steam Generator Level, and Departure from Nucleate Boiling Ratio.
The operators reduced plant power to 65
percent using control element assemblies and boration.
Operator response to this event appeared satisfactory even though no procedure existed for responding to this event.
This event also occurred on December 21, 1990, at Unit 2 as documented in Inspection Report 529/90-54, Paragraph 9.'he current schedule for developing an Abnormal Operating Procedure (AOP) for the inadvertent closure of an YiSIV is 1993.
The licensee was unable to determine a root cause of failure.
The licensee replaced the most likely suspect components and is conducting an investigation of these replaced components.
Following retest, the valve was returned to service with a recorder installed to monitor the valve controller circuitry.
The inspector reviewed the
CFR 50.59 safety evaluation of the recorder installation and had no questions.
The inspector concluded that the licensee responded appropriately to this event.
The inspector noted that the licensee re-evaluated the need for procedural guidance for this event and determined that an accelerated schedule for an AOP was warranted.
The licensee stated that an AOP for this event will be in place no later than Yarch 1992.
The inspector concluded that these actions appear appropriate.
The previous event occurred at Unit 2 on December 21, 1990, and was documented in Inspection Report 529/90-54, Paragraph 9.
The inspector reviewed the corrective action from the previous event and noted that root cause of failure EER 90-SG-221 recommended replacing the failed solenoid valve every other refueling outage to be more consistent with the vendor's qualified life recommendations.
A review of the SINS database for replacing these valves showed that this corrective action has yet to be implemented.
The replacement interval is still every
months, the interval in place prior to the 1990 event.
The inspector will review further the reasons why the closed EER did not result in the initiation of action to carry out the recommendations (Followup item 529/91-29-03).
No violations of NRC requirements or deviations were identified.
Reactor Shutdown Due to Failed Inverter - Unit 3 62703 and 93702 On Friday, August 30, 1991;Palo Verde Unit 3 commenced a normal shutdown from 100 percent power required by Technical Specifications due to the failure of the "C" Class lE Inverter which supplies 120 VAC vital instrumentation loads.
The shutdown was completed at 1: 19 AM (YEAST) on August 31, 1991, by manually tripping the reactor from 20 percent, as allowed by the reactor.shutdown procedure.
Repairs were completed to the inverter in time to preclude a cool down to Node 5 (Cold Shutdown).
The inverter failed as a result of load induced by a momentary direct ground in a Control Element Assembly Calculator (CEAC) and the static switch automatically transfer red the instrumentation loads to an alternate Class lE power source.
The CEAC ground was caused by an improperly paralleled power supply during calibration of a power supply per Surveillance Test (ST) 77ST-9SB06,
"CEAC No.
2 Calibration."
The technicians performing the calibration failed to remove fuse CFU3 for the normal power to the CEAC, as required by step 8.2.8 of the surveillance procedure.
The licensee initiated Condition Report/ Disposition Request (CRDR) 3-1-0082 to investigate the events leading up to the inverter
failure.
Immediate corrective action included testing the CEAC to ensure it was not damaged and re-performing the ST.
The licensee also counseled the work crew involved with the CEAC event regarding positive communications during surveillance testing.
The licensee-identified violation is not being cited because the criteria specified in Section Y.G. of the Enforcement Policy were satisfied (NCV 530/91-29-04).
During the shutdown, an 0-ring on a four-way hydraulic actuating valve for a feedwater isolation valve failed, and was subsequently repaired.
A CRDR was also initiated to evaluate the root cause of failure.
Additionally, the "A" log power channel indication was inconsistent with the other channels and was also repaired.
Mhile the unit was shutdown, the licensee replaced the
"D" Control Element Drive Mechanism (CEDM)
cooling fan, which had previously failed, and determined from vibration measurements that the "B" CEDM fan was seriously degraded.
The licensee restarted the reactor at 2:31 PM on September 2, 1991, entered Mode 1 at 5:33 PM, and returned to 100 percent power on September 4, 1991, after completing emergent repairs to the main turbine controls.
A Notification of Unusual Event (NUE) was declared at 8: 15 PM on August 30, 1991, as a result of the Technical Specification required shutdown.
The NUE was terminated at 1:32 AM on August 31, 1991, following completion of the shutdown.
The inspector concluded that the licensee's actions with respect to the equipment fai lures and plant operat'.ons were adequate and appropriate.
Additionally, good work group coordination was observed between the various organizations involved in this inverter repair.
One non-cited violation of NRC requirements was identified.
Undervolta e Condition on Class 1E Bus PBA-S03 - Unit 3 92700 On August 31, 1991, with the Unit in Mode 3, one of four undervoltage relays, UV-8, actuated on the 4. 16 KV Engineered Safety Features (ESF)
bus PBA-S03 when the non-Class 1E motor-driven auxiliary feedwater pump (APN-P01)
was started.
AFN-P01 is powered from PBA-S03.
Upon inspection, the licensee determined that the secondary voltage tap off of ESF Service Transformer NBN-X03 was in the incorrect position.
It was in position 1 while it should have been in posi tion 3.
The licensee checked the taps in all the ESF Service Transformers for all three units and determined that they were properly set in position 3.
The tap in NBN-F03 had been adjusted during the refueling outage completed in June 1991.
The licensee initiated Condition Report/Disposition Request (CRDR)
3-1-0086 to investigate the event, including the maintenance history, safety significance, and root cause of failure.
The licensee reset the tap in NBN-803 to position 3 and verified that the voltage on bus PBA-SG3 was prope The inspector will review CRDR 3-1-0086 upon completion to evaluate the root cause of failure and the safety significance (Followup 1tem 530/91-29-05).
No violations of NRC requirements or deviations were identified.
Loss of Safet Bus PBB-S04 - Unit 3 93702 On August 24, 1991, a ground occurred on DC control power bus NKN-M46 which supplies control power to breaker 3E-MAN-ROl which feeds bus 3E-NAN-S06 from startup transformer AE-NAN-X01.
This caused 3E-MAN-R01 to open deenergizing buses 3E-NAN-S06 and 3E-NAN-S04 which deenergized the Engineered Safety Features (ESF) transformer 3E-NBN-X04 deenergizing the 4160 volt Class lE Train "B" bus 3E-PBB-S04.
This triggered the Loss of Power (LOP) Balance of Plant Engineered Safety Features Actuation System (BOP-ESFAS) signal which started the "B" Emergency Diesel Generator (EDG).
The diesel started normally and loaded as expected.
The "B" train auxiliary feed pump and essential chiller also started as expected.
The ground and trip of breaker 3E-MAN-R01 occurred because water from a rainstorm was blown into a multiplexer cabinet adjacent to bus 3E-NAN-S06 shorting multiplexer contacts from breaker 3E-MAN-R01 which activated the breaker trip coil.
No breaker protective function actuated because the breaker opened due to the short in the trip coil control circuit.
The multiplexer is used to provide control room indications of breaker position and bus parameters.
The water in the multiplexer cabinet shorted these multiplexer contacts which provided enough current to actuate the trip coil.
The licensee corrected the short, isolated the multiplexer contacts from breaker 3E-MAN-R01, and tested the affected components.
Approximately one day after the buses were deenergized by the breaker trip the licensee restored breaker 3E-MAN-R01 to service and paralleled ESF transformer 3E-NBN-F04 with safety bus 3E-PBB-S04.
The EDG was then secured.
Water entered the multiplexer cabinet through loosely attached flashing tape around a window style air conditioner which cools the multiplexer cabinet.
The air flowpath from the air conditioner fan would blow any water leaking in directly onto the multiplexer contacts for breaker 3E-MAN-R01.
The inspector noted that this condition exists for both air conditioners on both multiplexer cabinets for redundant offsite power buses 3E-NAN-S05 and 3E-NAN-S06.
The similar multiplexer cabinets for Units
5 2 have more substantial flashing around the air conditioner air inlet.
The licensee identified evidence that water had been in the bottom of both Unit 3 multiplexer cabinets but not in the Units
E
cabinets.
The licensee immediately applied duct tape and sealant to prevent more water intrusion until permanent flashing could be constructed.
The licensee is also reviewing all other multiplexer connections to plant equipment to evaluate other possible unanticipated interactions.
The inspector concluded that the cubicle enclosure deficiencies in Unit 3 represented a lack of hardware consistency between the units and a
significant vulnerability to safety electrical bus reliability. However, the licensee's actions following this event appeared appropriat t No violations of NRC requirements or deviations were identified.
20.
Essential Chilled Water EC S stem Technical S ecification TS Discre anc
- Units 1, 2, and
92700 In August, 1991, while all units were operating at or near full power, the licensee determined that the basis for TS Action Statement (TSAS)
3.7.6.a contained false information regarding the capacity of the normal HVAC system with respect to its capacity as a backup system to the EC system.
Based on the assumption that the normal MVAC is capable of providing 100 percent cooling of the normal and design accident heat loads, the TSAS allows one train of EC to be inoperable for seven days.
However, the licensee determined that the normal HVAC system is only capable of removing about 5 percent of the required capacity in the pump rooms for both trains of the High Pressure Safety Injection system, the Low Pressure Safety Injection system, the Containment Spray system, the Auxiliary Feedwater system, and the Essential Chilled Water system.
The adequacy of cooling to the containment electrical penetration rooms was still being evaluated.
The licensee immediately issued a Night Order prohibiting routine outages of these systems.
The Plant Review Board met on August 23, 1991, and directed that the TSAS seven day action be replaced with a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action for those components.
This was based on TSASs for other systems for which a complete train is rendered inoperable.
A Night Order was issued in each unit to this effect.
The licensee is pursuing a
TS amendment to revise the TSAS and to correct the basis.
21.
The licensee conducted Probability Risk Assessment (PRA) analysis which concluded that with a site total of seven action statement entries which exceeded 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, since April 1989, that the increased probability for core damage from the four day extension to a standard 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action statement, was on the order of 1 to 2 percent.
The licensee determined that the original TS basis error occurred due to an oversight during initial review.
Even though the appropriate personnel reviewed the TS basis, which was copied from another utility's TS, the difference in capability was not recognized or corrected.
The licensee is preparing a Technical Specification amendment request to correct the basis and continued to require a maximum action statement allowance of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
The inspector concluded that licensee identification of and response to this error is appropriate and adequate.
No violations of NRC requirements or deviations were identified.
Water Reclamation Faci lit WRF Recalcin Furnace Personnel Safet
- Units
2, and
93001 The NRC referred a personnel safety issue to the licensee for evaluation.
The issue involved tagging practices associated with removing recalcined sludge plows from the recalcining furnace.
The licensee found its practices to be consistent with industry practices in terms of both
operations and tagging.
However, a procedure change was made to require the furnace rakes to be stopped prior to plow removal, an aspect which was inconsistent between shifts.
Another issue involved the possibility that Engineering Evaluation Requests (EERs)
were being used to bypass the tagging process.
The licensee found this to be unfounded, but acknowledged that an EER had been initiated to evaluate the use of a delay or bypass in the interlock feature which shuts off the furnace burners when the rakes are stopped.
A similar bypass is used elsewhere in the industry and does not constitute an avoidance of tagging requirements; The inspector concluded that the licensee's evaluation was thorough and that no undue personnel safety risk is created by the plow removal method.
No violations of NRC requirements or deviations were identified.
22.
Review of ualit Classification and Com liance With UFSAR Commitments For t e Safet us ment Status stem SESS
- Un>ts 1, an
35702 The inspector reviewed several licensee documents initiated to resolve questions over the proper quality classification and design requirements for the SESS.
The inspector concluded that the licensee analysis pursuant to down grading certain SESS components was deficient.
However, subsequent analysis showed this design to meet regulatory standards.
a
~
REGULATORY BASIS FOR SESS AND SYSTEM DESCRIPTION The inspector examined the requirements for isolation of Class lE from non-class lE circuits relative to the design of the SESS.
The SESS implements the licensee's UFSAR commitments (7.5. 1.1.6 and 7.5.2.6) to Regulatory Guide (RG) 1.47,
"Bypassed and Inoperable Status Indication For Nuclear Power Plant Safety Systems."
It monitors the status of safety related equipment, for example valve position, and alerts the operator if a condition exists, such as Safety Injection, with such a valve in other than its required SI position.
Also, operators can manually insert indications of system inoperability as status reminders.
The SESS uses status contacts on monitored equipment, such as limit switches driven by Class lE motor operated valves, to detect equipment status.
The SESS status contacts in such cases are interrogated by power supplied from SESS, thus no direct electrical connection exists between Class lE power within monitored components and SESS status contacts in the monitored components.
However, SESS status contacts may be in close physical proximity to the monitored component internals which use Class 1E power.
The SESS also receives signal inputs from Class 1E annunciators, but in these cases utilizes optical-isolator devices to maintain electrical separation from the SESS (reference SESS and Plant Annunciator course handout NIB33).
The SESS is non-safety related (per UFSAR 7.5.2.6.A) since its function is indication-only, and has no control functions.
However, since it monitors signal inputs from Class 1E components, it is powered from a Class lE 125
vdc power supply.
As an example, the SESS that monitors the "B" train safety system receives power from the "B" Class 1E 125 vdc bus via a
DC switch and 300 amp fuse to distribution panel PKB-D22, which provides Class lE power to numerous
"B" train safety-relatec loads, including the EDG.
A circuit breaker and fuse within this panel carry power directly to the "B" SESS cabinet in the control room, within which is a
amp circuit breaker.
After passing through this breaker, power is then distributed to four separately fused (10 amp) inverters which produce 120 vac.
Each inverter's output is then sent to one or more individually fused (3 amp or 0.5 amp) rectifiers which produce 12, 14, or 24 vdc which is then utilized as field contact interrogating power, and SESS logic and annunciation power.
Thus, the SESS has a direct electrical connection to the Class 1E power system, utilizing it for input power, and has status contacts in close proximity to Class 1E monitored component power, which are used as logic signal inputs.
b.
REGULATORY RE(UIREMENTS ASSOCIATED MITH CLASS 1E CIRCUITS The licensee is committed, per UFSAR, to Regulatory Guide (RG) 1.75,
"Physical Independence of Electric Systems,"
(Revision 1, 1975)
which endorses IEEE Standard 384-1974,
"Separation of Class lE Equipment and Circuits."
These documents provide that the SESS configuration described above is an example of an "associated circuit," meaning it "shares" (is directly connected to)
a Class 1E power supply and shares (is in close physical proximity) enclosures, such as in monitored components, within which exist Class lE power.
Furthermore, IEEE 384-1974 (Pa.agraph 4.5) requires such a circuit meet ALL requirements placed on Class 1E circuits OR:
"be analyzed or tested to demonstrate that Class 1E circuits are not degraded below an acceptable level."
RG 1.75 (1975) Paragraph.
C.4 further emphasizes this by requiring:
"associated circuits to be treated as Class 1E unless it can be demonstrated that the absence of such requirements could not significantly reduce the availability of the Class lE circuit."
Non-Class 1E circuits may be connected to either Class 1E or associated Class 1E circuits but MUST be separated by an "isolation device" which "prevents malfunction in one section of a circuit from causing unacceptable influences in... other circuits."
However, RG 1.75 (1975 and most currently 1978) states:
"Interrupting devices actuated only by fault current are not considered to be isolation devices within the context of this document."
But later states:
"It is recognized that proper breaker or fuse coordination would preclude [degradation of the Class 1E circuitJ.
However, because the main breakers are in series with the fault and
could experience momentary currents above their setpoints, it is PRUDENT to preclude the use of interrupting devices actuated only by fault current as acceptable devices for isolating non-Class 1E circuits from Class 1E or Associated circuits" (emphasis added).
Thus, RG 1.75 recognizes the use of breakers and fuses, with proper coordination, as isolation devices separating non-Class 1E circuits from Class 1E or Associated circuits.
under RG 1.75 exceptions, states:
"...
some associated circuits are provided with two (redundant)
isolation devices: i.e., fuses and/or circuit breakers."
LICENSEE INTERPRETATION OF REGULATORY RE(UIRENENTS The licensee's current interpretation is documented in Engineering Evaluation Request (EER) 88-ES-010 and states that the breakers and fuses in SESS are NOT considered
"isolation devices" in the IEEE 384 sense.
Pursuant to their commitment to IEEE 384-1974 the licensee maintains that SESS is a Class 1E Associated circuit and must either be treated as Class lE, or "be analyzed or tested to demonstrate that Class 1E circuits are not degraded below an acceptable level."
Since they have elected to install certain non-quality parts in the SESS, the licensee cannot fully demonstrate Class 1E treatment, and therefore recognize the need for an analysis.
The level of detail of this analysis is not specified in IEEE 384-1974.
However, in 1986 and again in 1989 a licensee document (Engineering Action Request (EAR) 89-0585)
acknowledged the need to conduct a
time-current characteristic study of a breaker/fuse used to protect the Class lE circuit if SESS components were downgraded to less than quality class "g."
This level of detail was recognized to'e required bv IEEE 384-1981 version.
In 1987 the licensee downgraded the quality class of certain SESS components, but the analysis method chosen was entirely qualitative (see Equipment Change Evaluation (ECE) ZZ-A102).
In 1989 this methodology was upheld by the licensee in spite of questions regarding the acceptability of the isolation scheme (see EER 89-ES-001).
The inspector noted that although the IEEE standard to which the licensee is committed is not specific with respect to the depth of analysis required; in view of the 1981 guidance a qualitative analysis such as offered by ECE ZZ-A102 (i.e., the Class lE circuit is protected because the fuse there) did not appear sufficient.
The inspector concluded that the analysis required by IEEE 384-1974, which provides the basis for protection of Class lE circuits from associated circuits, must necessarily include quantifiable results.
If this analysis assumes the acceptable performance of any current limiting device, an appropriate quality classification for the device must be assumed as well.
The licensee agreed that the analysis of ECE ZZ-A102 was deficient and performed a more thorough time-current characteristic study which demonstrated that maximum
fault currents would be cleared by the breaker/fuse prior to degtading Class 1E circuits.
This analysis was reviewed by NRC Region V and found to be acceptable from a current interruption perspective.
Currently the licensee maintains SESS quality class
"Q" with the exception of those subcomponents specifically authorized by ECE ZZ-A102 to be non-quality related (NQR).
This appears consistent with licensee documents requiring that key SESS components which prevent degrading Class 1E associated signal inputs or Class 1E 125 vdc power supplies be quality class
"Q" (Design Criteria Manual, Part III, Rev 5, 8/29/86).
LICENSEE HISTORICAL PERFORMANCE ON THE ISSUE OF SESS DESIGN In 1986 the licensee found that the SESS vendor's QA program was not in place since 1983 and issued a change to the SESS procurement specifications to upgrade them from "R9E" (important to plant reliability, seismic class 9) to "Q1E" to "keep intact the qualification reports done for SESS."
Since then licensee documents (EAR 89-0585)
suggest that SESS was treated as Class 1E by maintaining procurement specifications as quality class
"Q1E."
However, the licensee chose to downgrade the quality classification of certain replacement parts purchased from the vendor after 1983, including two AC to DC power supplies ( 14 VDC and
VDC output),
by performing an IEEE 384 analysis.
This analysis was entirely qualitative engineering judgement (ECE ZZ-A102, and later EER 89-ES-001)
which simply noted that the SESS
amp breaker and
amp fuses would protect the Class 1E power supply circuit from degradation.
The licensee position on the qualification and analysis required for the SESS is discussed in EER 88-ES-010, EER 89-ES-001 with attachment ECE ZZ-A102 included, EER 90-ES-003, and EAR 89-0585.
The inspector evaluated these documents as follows:
( 1)
In 1986 APS Engineering demonstrated awareness of the depth of fault study and breaker/fuse coordination detail per IEEE '384 (1981) appropriate for showing Class 1E Associated SESS circuits could not degrade Class 1E circuits (memo attachment to EAR 89-0585) if SESS components were less than quality Class
"QIE."
However, this detailed analysis was not performed in 1987 when two SESS internal power supplies were downgraded to QAG and subsequently to NQR (ECE ZZ-A102).
Nor was it performed:
1) in 1988 when EER 88-ES-010 was initiated specifically questioning the validity of ECE ZZ-A102 pursuant to quality requirements for SESS; 2} in 1989 when EAR 89-0585 was initiated questioning the adequacy of isolation between SESS and Class 1E ci rcuits; and 3) following initiation of EER 89-ES-001 which questioned the lack of consistency between ECE ZZ-A102 and the overall quality classification of SESS as "Q."
Thus the inspector noted that even though engineering was called upon several times over several years to justify determinations made regarding the acceptability of SESS quality
(2)
(3)
classification and means of isolation from Class 1E circuits, they failed to recognize the need for quantitative detail in their analysis intended to meet these requirements.
From ECE ZZ-A102 through subsequent analyses to the present, the licensee has shown that for.SESS circuits to NOT degrade Class 1E circuits requires the proper functioning of a
amp fuse and a
amp breaker.
The inspector noted that imprecise use of "isolation device/isolator" clouded the issue of.IEEE requirements for the breaker and fuses in the SESS, and that multiple licensee organizations, including Engineering and Licensing, repeatedly over a four year interval challenged with these specific questions, did not clarify the requirements.
Also, the licensee has no document, among those reviewed, which clearly characterizes the SESS pursuant to these requirements.
The term "safety-related" is used loos'ely throughout these documents, sometimes apparently meaning "quality-related."
In addition several documents conflict in that some claim SESS is not safety related (EERs 88-ES-010 and 89-ES-001) while another claims portions are safety related (EER 90-ES-003).
The licensee's position that the SESS breaker and 10 and
amp fuses are "safety-related" does not appear to be in complete conformance with the UFSAP, (Section 7.5.2.6.A).
Thus the inspector noted that the licensee needs to either change the UFSAR, or to revise existing Engineering documentation on this subject.
The licensee's position on the current quality classification of SESS is that it is "Q" unless authorized by an ECE (only ECE ZZ-A102 is valid at this time).
Discussions with a licensee procurement supervisor determined that the recently approved Item Procurement Specifications for SESS require quality class
"Q" with the exception of those items authorized as non-"Q" by ECE ZZ-A102.
SUYYARY AND CONCLUSIONS The inspector cor eluded that:
Based on a review of applicable regulatory documents:
if the licensee does not maintain Class 1E design and ouality controls over the entire SESS, they must demonstrate, quantitatively, that failures within non-"Q" SESS components will not adversely impact Class IF equipment, and that if such analysis requires the active performance of any individual device (i.e., breakers or fuses), it must have an appropriate quality classification.
(2)
The licensee's analysis to demonstrate SESS non-"Q" component failures will not adversely impact Class 1E circuits and components was apparently deficient in that no quantitative analysis existed.
The licensee's position that the SESS
n9 (3)
breaker and fuses are not IEEE 384 isolation devices is based on maintaining the SESS as an Associated Class 1E circuit by design control ( channel independence)
albeit not by quality control (some non-"g" components).
The lack of complete quality control invokes the need for an analysis.
However, if the licensee had acknowledged that the breaker and fuses were IEEE 384 isolation devices (as would be the case between Associated 1E and non-1E circuits),
a more complete analysis including transient voltages, and periodic testing would be required.
The merit of the licensee's position rests primarily on the maintenance of Class 1E design architecture (channel/train separation)
for SESS circuits, such that a fault or voltage disturbance generated from SESS could only potentially affect one out of four Class lE 125 vdc buses.
Thus the licensee's position that SESS is maintained as Associated 1E and their revised ECE ZZ-A102 analysis appears to meet regulatory requirements.
The licensee's repeated attempts to demonstrate their compliance with requirements placed on SESS design did not address quantitative analysis.
This appears to be due, in part, to use of inconsistent terminology (i.e., "safety-related" ), lack of clear definition of the term "isolation device," multiple organization involvement without strong coordination, and a lack of thoroughness of the documented review:.
f.
LICENSEE ACTIONS (2)
The licensee performed a quantitative analysis (EAR 91-1410 which became Revision 4 to ECE ZZ-A102) to demonstrate that SESS failures will not degrade Class 1E equipment.
Responsible licensee supervisors acknowledged that the only previous documented analysis was contained in ECE ZZ-A102.
The new analysis was reviewed by NRC Region V and was found to be satisfactory from. a current interruption perspective.
The licensee used it to revise the basis for allowing certain non-quality SESS components.
This action is complete.
The licensee committed to review SESS related engineering documentation and to ensure consistency of interpretation of regulatory requirements and internal APS recommendations, and consistency of terminology such as "safety related, quality related, and isolation device," including consistency with the UFSAR.
In addition, the licensee will evaluate the need to document their interpretation of these requirements and how they are being met such that all reviews and analyses which are performed on electrical systems are consistent.
They will also identify all other Class lE associated circuits in the plant and determine if they are acceptable from an IEEE 384 basis.
Finally, they will evaluate the need for training appropriate engineering personnel on the correct use of this terminology.
The licensee's compliance with the UFSAR commitments as well as the licensee's corrective action commitments will be reviewed during a later inspection (Unresolved Item 528/91-29-01).
No violations of NRC requirements or deviations were identified.
23.
Review of Licensee Event Re orts - Units
and
92700 The following LERs were reviewed by the Resident Inspectors.
Unit
Closed)
LER 528/91-01-LO:
"Postulated Reactor Coolant S stem Leak ot nc ude in esi n
asis
-
nits
,
,
an This report identified a potential Reactor Coolant System (RCS) leak path through the Reactor Coolant Pump (RCP) high pressure seal ccoler into the Nuclear Cooling Mater (NC) system, located outside of containment.
A double-ended guillotine break of a RCP seal cooler tube could result in overpressurization of the NC system,
'stablishing.
a leakage path outside of containment.
The licensee evaluated the risks due to this postulated event and developed a
Justification for Continued Operation (JCO) which was reviewed and approved with modifications by NRC/NRR.
This issue is further documented in Inspection Reports 528/91-01 (Paragraph 13)
and 528/91-19 (Paragraph 2.A.2).
This item is closed based on the previous reviews.
Unit 3 a
~
Closed LER 530/90-07-LO:
"Reactor Tri Due to Power Distribution Ytodule Fai ure Causin Al Steam B
ass Contro S stem SBCS Va ves to en 92700 This event was discussed in Inspection Report 530/90-45 in Paragraph 12.
The LER does not suggest any additional issues.
This item is closed.
b.
Closed LER 530/91-03=LO: "Inadvertent Containment S ra ctuation This June 19, 1991, event involved an inadvertent containment spray actuation followed by a manual reactor trip from 100 percent power and termination of forced reactor cooling system circulation.
The event is described in detail in NRC Inspection Report 530/91-26, Paragraph 15.
This LER is closed based on this previous event evaluation.
c ~
Closed)
LER 530/91-05-LO:
"Enoineered Safet Features ESF ctuation ue to Radiation onitor ai ure This report describes the July 31, 1991, actuation of the Containment Purge Isolation and Control Room Essential Filtration systems due to the failure of RU-37, the "A" Containment Power Access Purge radiation monitor.
All systems actuated as designed and licensee corrective actions appeared appropriate.
This LER is closed on the basis of this revie An exit meeting was held on September 9,
1991, with licensee management during which the observations and conclusions in this report were generally discussed.
The licensee did not identify as proprietary ary materials provided to or reviewed by the inspectors during the inspectio o!
I 1