L-85-439, Responds to NRC Re Violations Noted in Insp Repts 50-250/85-32 & 50-251/85-32.Corrective Actions:Maint Procedures,Controls Over Plant Work Orders Training & Experience of Maint Personnel Will Be Augmented

Responds to NRC Re Violations Noted in Insp Repts 50-250/85-32 & 50-251/85-32.Corrective Actions:Maint Procedures,Controls Over Plant Work Orders Training & Experience of Maint Personnel Will Be Augmented

ML20137W983
Person / Time
Site:	Turkey Point
Issue date:	12/06/1985
From:	Williams J FLORIDA POWER & LIGHT CO.
To:	Taylor J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE)
References
L-85-439, NUDOCS 8512100389
Download: ML20137W983 (57)

Text

r--

i P.O. box 029100 MI AMI, F L 33102 FLORIDA POWER & LIGHT COMF ANY December 6,1985 L-85-439 Of fice of Inspection and Enforcement Attention: Mr. James M. Taylor, Director U.S. Nuclear Regulatory Commission Washington, D.C. 20555

Dear Mr. Taylor:

Re: Turkey Point Units 3 and 4 Docket Nos. 50-250 and 50-251 Safety System FunctionalInspection Report 250-85-32 and 251-85-32

. Your letter dated October 7,1985 transmitted the subject Safety System Functional Inspection Report, which documented the results of a new inspection process conducted by a team comprised of Resident, Region II, NRC Headquarters Inspection and Enforcement (I & E) and contractor personnel, and addressed the details of modifications and design control, maintenance, surveillance, and testing on the Turkey Point Auxiliary Feedwater (AFW)

system.

Your October 7 letter acknowledged that Florida Power & Light Company (FP&L) had taken prompt action to update procedures and training to address the team's safety concerns, but also requested that'FP&L respond with further actions resulting from the subject inspection within 60 days. In particular, your letter requested that FP&L: 1) review and evaluate weaknesses identified in the Report and take appropriate actions to improve management controls over licensed ~ activities; and 2) consider whether similar weaknesses apply to the operations and functions of other Turkey Point safety systems. The attachment to this letter provides FP&L's detailed response to each significant finding contained in the subject inspection report.

FP&L's review and evaluation of the subject inspection report has resulted in the following major observations and actions to improve management controls over licensed activities covered by the report:

1. Maintenance and Design Control - FP&L has determined that its existing Performance Enhancement Program (PEP), which was designed to manage change in priorities over the long term, should now be augmented, with particular emphasis on the Maintenance and Design Control areas. Your letter stressed the need for licensee self-identification of inspection

. issues. In this regard,it should be noted that many of the elements of the augmented PEP program had been identified by FP&L prior to the subject inspection, and were planned for later implementation at Turkey Point and/or on a company-wide basis. The principal program elements

, identified for augmentation in the maintenance area concern maintenance

. procedures, including post maintenance testing and independent verification; controls over Plant Work Orders; training and experience of maintenance personnel; _ and ' updating of preventive maintenance to f f i

8512100389 851206

{DR ADOCK 05000250 i I

PDR PEOPLE. . SERVING PEOPLE

_ . J

> e Re: Turkey Point Units 3 and 4 Docket Nos. 50-250 and 50-251 Safety System FunctionalInspection Report 250-85-32 and 251-85-32 Page 2 incorporate state of the art predictive maintenance techniques. The program elements identified in the design control area concern enhanced vendor surveillance; reconstitution of safety system design bases; standard engineering package implementation, including selected r

independent review of design documents; Design Integrated Review Team formulation and operation; and the System Operability Review Program (SORP). We believe that the inspection team was not aware of the latter

, program, which serves to establish the minimum requirements necessary

, to deem certain safety-related systems, including needed support systems,

" operable". We therefore believe that the inspection team did not take account of this program in evaluating the ultimate significance of its findings in the design control area. The SORP has been a part of the PEP since September of 1984.

4 2. AFW System Reliabilit/ - FP&L has committed (letter L-85-372, dated 4

September 30, 1985) to apply and implement appropriate technical

! specification requirements to address the availability and surveillance

{ testing of the two non-safety grade motor-driven standby feedwater pumps at Turkey Point. The Technical Specification amendment request will be submitted to the NRC by December 31, 1985. Since the inspection team concluded that there were no administrative controls or Technical ~

Specification requirements in place to assure the availability of this

, system on demand, they found it inappropriate to give credit for this system during analysis of the inspection findings. As stated in FP&Ls letter L-85-372, however, these standby " pumps have been routinely run in accordance with plant procedures". In addition, backup power supply is

- obtainable from five (5) non-safety grade diesel generators rated at e

nominal 2500 kw each. These diesels can supply power directly to nuclear side loads via internal (site) cable runs independent of the switchyard. Based upon the foregoing factors, FP&L submits that it would be appropriate for the capabilities of the standby feedwater system to be taken into consideration in the NRC's final analysis of its inspection .

findings. In addition, in order that the overall performance of the Turkey l Point AFW System can be better quantified and clarified, FP&L is l committing to, and by January 31, 1986, will commence performance of, j an AFW Availability / Reliability Study that willinclude:

, . l 0 Reliability modeling O Component failure contribution to reliability 4 3. Safety-Related Nitrogen System - Your October 7 letter discussed the

!- safety related nitrogen (N 2) system used as a backup to the instrument air system, which provides the motive force to operate the AFW flow control valves (FCV's). FP&L has revised its guidelines to require the operators to check the backup nitrogen bottle pressure and AFW System status each shift.' Further, Emergency Operating Procedures (EOP's) have been revised to require operators to shif t the FCV's to manual from automatic

, -r-, . - ---1 -- - , - - - . -

.. .m.,, ., , , , .. .-,--~.,.,w - . . . . . - , ~r - . _ , , ,..-..------..-o---.. .

i .

Re: . Turkey Point Units 3 and 4 Docket Nos. 50-250 and 50-251 Safety System FunctionalInspection Report 250-85-32 and 251-85-32 Page 3 control within 3 minutes of AFW actuation, in order to decrease the N2 bleeddown or consumption rate. Additionally, procedure revisions to require additional bottles to be valved into service on AFW actuation are being !nvestigated. On an interim basis, because of FCV oscillation, the N2 backup supply low pressure alarm setpoint has been raised to 1350 psig.

This alarm setpoint will allow at least 10 minutes for an operator to reach the N2 station and valve-in additional N2 bottles. Operators have been trained on the time requirements of 3 minutes for shif t of the FCV's to manual and the 10 minutes available af ter receipt of the low pressure alarm to valve-in additional N2 bottles; Although the manual evolutions discussed above have been routinely performed by operators at Turkey Point in the past, the emergency procedures have now been revised to explicitly require the action. _ On this basis, FP&L submits that the capability of this backup system should be favorably credited in NRC's final analysis of its inspection findings. In the long term, new FCV trim will be installed to decrease FCV oscillation and maintain overall system capability.

FP&L is undertaking a two-phase Safety System review to assure that the concerns expressed in the inspection report do not apply to the operations and functions of other important safety systems,'or that any appropriate corrective actions are promptly taken. Phase I (Initial Assessment) consists of a Safety Engineering Group review to identify any system problems that might impede the functional performance of the systems selected for review. The systems initially selected for review include:

Safety Injection Component Cooling Intake Cooling Containment Spray Emergency Power Emergency Coolers Emergency Filters Containment Isolation l Vital D.C.

Main Steam Isolation This review, which has already begun and will be comple'ed by January 31,1986,

! will include input and assistance from all relevent disciplines, including Plant Operations, Maintenance, Design Engineering, QA and QC. With the Phase I results as input for prioritization, the same groups will then undertake the more formal and detailed, in-depth Phase II (Comprehensive Assessment) review of the selected systems. This review will encompass and ensure pertinent design bases are clearly specified, providing additional assurance that the systems will function as designed. Any necessary corrective actions will be tracked to implementation. It is anticipated that Phase 11 will be scoped and scheduled by early 1986, and completed within two years af ter initiation of work activities.

An ongoing effort may be formulated based on Phase II results.

3- - _ . . . . , . , ~ _ _--m-- . . . . , _ - - . . . .~ , ,..-._...~ _,- ,- ,,.%.- -

-,,--._..m,.. - . . . . - ,

Re: Turkey Point Units 3 and 4 Docket Nos. 50-250 and 50-251

Safety System FunctionalInspection Report 250-85-32 and 251-85-32 Page 4 All of the actions under the PEP, those described above, and those described in the attachment have been incorporated into an integrated management plan that will provide the necessary objectives, description and sequence of actions,

, schedules and controls to assure timely and effective implementation, and accomplishment of any necessary corrective actions. Individual task elements within . the management plan will be placed under dedicated project management and engineering responsibility. The results will be documented and subjected to performance measurements and periodic assessment.

]

As indicated at our October 30 meeting with NRC Senior Management, FP&L's management is strongly committed to support the improvements set forth in the PEP, described above and in the attachment. FP&L has dedicated the financial resources and management attention to effectuate long-term improvements in management control of licensed activities and we believe that improved results have begun to be seen. We also believe that, although the subject inspection identified areas where augmentation is necessary, the basic structure and direction of the PEP remain sound. Further, all actions necessary to assure continued safe operation have been and will be taken. We recognize that the responsibility for improvement is ours, and pledge our best effort to that end.

There is no proprietary information in this report response.

Very truly yours, L L&1

3. W. Williams, Jr.

Group Vice President

• Nuclear Energy.

JWW/DAC: mis 4

Attachment i

i cc: W. 3. Dircks, NRC Executive Director for Operations i H. R. Denton, Director NRR

Dr. 3. Nelson Grace, Regional Administrator, Region II

.S. E. Elrod, Section Chief, Region II

, H. L. Thompson, Jr. Division Director, NRR S. A. Varga, Branch Chief ORB No.1, NRR L. S. Rubenstein, Director, Project Directorate No. 2, PWR Licensing -

Division A, NRR j D. G. Mcdonald, Senior Project Manager, NRR H. F. Reis, Esquire i

i

.. _ -, _, - . - - - _ .=. ,--,- - - -- --

ATTACHMENT I. . Inspection Objective

f 4

II. Summary of Significant Inspection Findings i

Item II A.: (Safety Effects on AFW System):

The NRC inspection team identified safety concerns regarding the ability of the AFW system to perform its safety function in the event of a loss of non-safety grade instrument air. Loss of the instrument air supply to the air-operated AFW flow control valves is an assumption in the AFW system design basis for most analyzed accidents involving AFW. To ensure that the flow control valves, and thereby the entire AFW system, continue to operate in such events, i a safety-grade nitrogen backup cystem is provided. The team determined that this . backup nitrogen system had never been functionally tested, even though this system had been substantially modified as recently as early 1984. The i licensee had based its procedures and operator training on the assumption that 15-20 minutes was available for operators to take necessary action to establish

, additional nitrogen capacity upon depletion of the first nitrogen bottle. This s

would be accomplished by valving in additional nitrogen bottles in the event of a loss of instrument air to the flow control valves (FCV's). Control room operators would be alerted to take action by annunciator alarms in the control room that indicate that the on-line nitrogen bottles for each of four trains (two

, trains per unit) had reached a low pressure condition of 500 psig. As a result of NRC concern during this inspection, the licensee tested all four trains of the nitrogen backup supply to the AFW FCV's. This test demonstrated that from the time the low nitrogen pressure annunciator alarmed, only 6 to 7 minutes

^

(instead of the expected 15-20 minutes) would be available in the most limiting case (FCV's remaining in automatic mode). The team further determined that correct operator response to a low nitrogen pressure annunciator for train I would have been hampered by the incorrect information in the annunciator response procedure, Procedure 0208.11, which directed the operator to ignore the alarm if all three train 1 nitrogen bottles were in service. Additionally, a review of recent design changes to the AFW system indicated that the low nitrogen pressure annunciator alarm setpoint had been reduced in March 1984 from its original setpoint of 1000 psig to the current 500 psig. This resulted in a significant reduction in the available time for operator response. The design change was also performed without an adequate safety evaluation.

The team concluded that the weaknesses identified above in operator training,

inadequate procedures, the failure to functionally test the nitrogen backup system, and the apparent non-conservative setpoint. for the low nitrogen pressure alarm could have all contributed to a significant risk of a loss of AFW

- - - * - > + -

flow. Specifically, the team concluded that there was inadequate assurance that the control room operators would take the required actions to maintain AFW flow within the 6 o- 7 minutes that would potentially be available once the nitrogen low pressure annunciator alarm was received. The team noted that the operators' training and procedural guidance could have provided a false assurance that at least 15-20 minutes were available. The team was also concerned that, even if operators had been correctly trained and had adequate procedures, the existing low nitrogen pressure setpoint of 500 psig might be too low to allow for a reasonable response time for operators to valve in standby nitrogen bottles. Several operators expressed the consensus that at least 10-15 minutes should be available to ensure necessary actions could be taken.

Response II A.: (Safety Effects on AFT System):

Functional (Dynamic)/ Static N3 ackup B System Testing Although dynamic (auto FCV mode) testing of the N2 backup ystem had not been performed prior to the Safety System Functional Inspection, static testing had been conducted. A more comprehensive N2 backup system testing program is being formulated, to be complete by April 30,1986, to include:

0 Quarterly FCV dynamic testing, verifying automatic operation of the N2backup system.

O Comprehensive FCV dynamic testing each refueling outage, f '

validate the continued adequacy of the low pressure alarm setpoint in allowing sufficient time for operators to valve in additional N2 bottles after an alarm.

O Quarterly static testing to verify the accuracy of the low pressure alarm.

Our response to III C.2.b details the conservative testing which resulted in the selection of the 500 psig low pressure alarm setpoint for the N2 backup system in March,1984. This testing is considered a satisfactory methoc' of determining the low pressure alarm setpoint in lieu of a design analysis. However, modifications performed on the AFW system introduced FCV oscillations which,

~

though not a design feature of the system, increased instrument air /N2 FCV usage. FP&L has been addressing these problems through initiation of an engineering evaluation in early 1985. Installation of new FCV trim during the units' next refueling outages should correct this problem in the long-term. In the interim, raising the low pressure alarm setpoint to 1350 psig gives increased operator response time to valve-in additional N2 bottles. Operator training has been conducted to assure operators will respond correctly and in sufficient time.

Additionally, a Standard Engineering Design Package Program has been developed and issued within FP&L for trial use. It is scheduled to be released for incorporation by the Architect Engineers prior to the end of December 1985.

Subsequent implementation of these packages should provide additional

! assurance that post-modification testing criteria is identified for adherence to 2

applicable design bases. Currently anticipated to be included in Standard Engineering Design Packages are: applicable design bases, post-modification testing, recommended procedure chan s, setpoint changes, etc.

i

Finally, ONOP 0208.11 was changed, clarifying immediate operator actions in the event of an alarm, on September 25,1985 (PNSC approved).

Item 11 B.:(Safety Effects on AFW System):

The team identified a safety concern regarding the ability of the AFW system to perform its safety function in the event of certain two-unit trip scenarios.

The AFW system design description and design basis required that 286 gpm be supplied to each unit within 3 minutes in the event of a two-unit trip and stated that operator action would likely be required to assure correct flow distribution to each unit if only one AFW pump were available. Specifically, the AFW system 15 arranged into two trains, and any one train is required by the design criteria to wpply both units. Train 2 contains only one of the three AFW pumps. Consequently, on the loss of train 1, the single pump in train 2 is required to supply both units. The team determined that the control room operators had not been trained for this eventuality. In addition, the applicable emergency operating procedures, such as EOP 20004, " Loss of Offsite Power",

and EOP 20007," Total Loss of AC", made no mention of the need to provide a j minimum of 286 gpm to each unit within three minutes. Without the requisite training and procedural support, the team lacked confidence that correct operator action would be taken to ensure adequate AFW flow to each unit in the event of a two-unit trip with only train 2 of AFW available. This becomes particularly important if one of the units provided less flow resistance to AFW, such as would be the case if steam generator pressures of one unit were lower than the other unit.

Re=aanse 11 B.: (Safety Effects on AFT System):

The NRC expressed concern that the single AFW pump in train 2, upon loss of train I, would be required to supply 286 gpm to each unit within 3 minutes in the event of a' two-unit trip, and that control room operators had not been so trained. Although training cannot be for performed for every eventuality, training for this scenario is ongoing for operators and operator trainees, and will be completed by February 28, 1986. Although a need for evaluation of procedural streamlining (ONOP-103 and OP-7308.1) was indicated, operator performance was judged satisfactory during a Region 11 evaluated drill conducted on November 21,1985.

Additionally, EOP's 20004 and 20007 have been changed to specify the need to provide a minimum of 286 gpm to each unit within 3 minutes, in the event of a two-unit trip.

Item 11 C.: (Safety Ef fects on AFW System):

The inspection team identified a safety concern regarding the ability of the on-shif t operators to isolate steam flow paths to the environment from the affected steam generator in the event of a steam generator tube rupture.

l Emergency Operating Procedure 20003, " Steam Generator Tube Rupture,"

i directed the control room operators to isolate the steam supply from the affected steam generator to the AFW turbines by shutting the associated l

motor-operated isolation valves using the hand switches in the control room.

The inspection team determined that the AFW turbine steam supply isolation valves could not be remotely shut from the control room if there was an AFW actuation signal present. The team identified that the steam supply isolation

valves were designed to cycle open if an AFW actuation signal were present, even if the control room handswitches were held in the "close" position. The licensee had not recognized this design feature. Therefore, the licensee had not provided operator training or adequate procedures to ensure that alternate means were taken to isolate the AFW steam supply from the affected steam generator. The team concluded that the lack of operator awareness that the steam flowpaths in question could not be isolated remotely from the control room could have resulted in an unnecessary and potentially significant radioactive release to the environment following a steam generator tube rupture. A significant amount of time could have been required for the control room operators to first identify that the steam supply isolation valve would not remain shut and then take appropriate compensatory actions.

Response II C.: (Safety Effects on AFT System):

It is correct that EOP 20003 directed the control room operators to isolate the steam supply from the affected steam generator to the AFW turbines, by shutting the associated motor-operated isolation valves from the control room.

As long as the Auxiliary Feedwater System signal is present, the motor-operated valves will stay open. One solution to overcome this is to rack out the power to the motor-operated valve and manually close the valve. In addition, there are manual isolation valves on each line which could also be closed. It is reasonable to expect that the operators would have noticed the valve position through direct position indicators in the control room and would have taken the necessary action to isolate the steam supply in an expedient manner even though the operating procedures did not provide specific guidance. The FSAR analysis for the steam generator tube rupture accident in Section 14.2.4, assumed 30 minutes to isolate the steam generator. The radiation release during this period would be well within the design basis for the plant. Based on this and the various options available to the operator as described above, we believe that this condition presented no undue risk to the public health and safety. Nevertheless, Operating Procedure 20003 has been revised to alert the operator to close the manual steam isolation valve to the affected steam generator. Operator training has also been conducted in this area.

Item 11 A.:(Effects on Other Safety Systems)

Problems were noted in the Turkey Point maintenance program. Programmatic weaknesses affecting quality of corrective and preventive maintenance performed on Turkey Paint safety systems included:

0 The maintenance department had experienced a high turnover rate among maintenance technicians which resulted in a shortage of experienced personnel. The Instrumentation and Controls (I&C) section was the hardest hit: at the time of the inspection over half (15 of 27) of the I&C technicians performing surveillance testing had an average of less than 6% months experience at Turkey Point.

.o .

4 O Maintenance technician training had not been conducted since August 1984.

O Management controls did act exist to ensure that safety-related maintenance activities were performed by qualified personnel. On-the-job training (03T) records or other forms of qualification documentation were not used by maintenance supervisors as a basis for work assignments.

O Maintenance procedures generally lacked detail. Complex safety-related maintenance activities were of ten considered to be within the scope of the " skill of the trade", and therefore not requiring procedures. The shortage of experienced technicians and lack of training referred to above, do not appear to justily the widespread use of " skill of the trade" as a substitute for detailed procedures.

O Post-maintenance testing requirements were typically not included as part of electrical and I&C Plant Work Orders. Further, documentation of completed post-maintenance tests for electrical and I&C maintenance were typically not part of the retained maintenance records. ,

Interviews with maintenance department supervisory personnel indicated that the above maintenance problems could have contributed to the large backlog of safety-related Plant Work Orders (PWOs) throughout both units. This backlog was of particular concern to the team as it applied to degraded and malfunctioning control room instrumentation. For example:

0 The ability of the control room operators to diagnose a steam generator tube leak was degraded.by the fact that the steam jet air ejector process radiation monitors had been out of service for about six months.

O The Unit 4 containment sump high level annunciator had been out of service since December 1984 due to a failed level switch.

O Two of the four post-accident monitors for containment sump level i

' for Unit 4 had been out of service since February 1935, 1 0 A Unit 3 safety injection accumulator Hi/Lo pressure 'and Hi/Lo level annunciators were in an alarmed condition although the associated pressure and level instruments read within their normal bands. l 0 Several area radiation monitors on both units were out of service.

Some of the monitors had been out of service for greater than six i months. -

0 AFW system nitrogen backup supply low pressure annunciators for nitrogen station No. 2 were alarmed on both units. Nitrogen station No. 2 had been removed from service since January 1985 as a result of a design change. The team considers this a concern because the I

~'

s alarmed nitrogen low pressure annunciators were located adjacent to the low nitrogen pressure annunciators for stations I and 4 and thereby could degrade the operator's reaction time to a valid low nitrogen pressure alarm. Since very little reaction time may be available (as little as 6 to 7 minutes) to take action to maintain AFW flow once the low nitrogen pressure alarm is received, the potential for confusion caused by the spurious alarms is considered  ;

significant. 1 0 Both units had leaking power operated relief valves (PORVs). In addition, the isolation valves (block valves) for the Unit 4 PORVs leaked and this resulted in elevated temperatures downstream of the Unit 4 pressurizer safety relief valves (which share common  ;

discharge piping with the PORVs). As a result, control room i annunciators were alarmed for all three Unit 4 pressurizer safety

, relief valves downstream temperature elements. This condition is

~

J significant because it could degrade the control room operator's '

ability to identify a lifted safety relief valve or the failure of a 1 PORV to reseat.

Response II A.: (Effects on Other Safety Systems) ,

Comment was made in your October 7 letter regarding the Turkey Point maintenance program, in the area of corrective and preventive maintenance on l safety systems. The following is provided te address perceived programmatic )

weaknesses:

0 Maintenare U rpartment turnover has been recognized to be high in the I 4 0 e tion in particular, since there is an industry-wide shoria , o Oi.i area, and it generally attracts individuals who are promGed w. of the sectiom rapidly due to high skill levels.

However, additional positions and training are budgeted and being )

conducted, respectively, to elevate manpower and system / vendor- r specific knowledge levels. The majority of low seniority I&C l personnel are Navy Nuclear Trained Electronic Technicians (ET's),

i whose training and experience in safety-related areas is generally

.very extensive. Additionally, FP&L maintains very rigid entrance l (qualification for all I & . C jouruymen, requiring one of the l following:

l a) Journeyman qualifications from another plant with the same Apprentice program.

i b) Completion of FP&L Apprentice program.

l 1 c) Two year technical degree, plus N-3 years instrument field '

experience. ,

d) Navy ET (second class or above), or equivalent.

=,3 s 3 0 Maintenance System Training commenced October 14, 1985 and will f continue until INPO accreditation courses commence in January / February,1986. Vendor training has been conducted on Inverters, and is scheduled for Nuclear Instrumentation. Additional

\ M

(

J being developed in specific vendor training courses are MOV/Limitorque and Selected Primary / Secondary Valves areas.

Also, Generating Equipment Maintenance System (GEMS) and Nuclear Job Planning System (NJPS) plant training is being i

scheduled and will be tracked by the PEP.

O Individuals are assigned work based on their qualifications as identified by the Supervisor. Additionally, plant training will be conducted on maintenance work controls, and tracked by the PEP.

O The initial PEP included only some 38 maintenance procedures for upgrade. Approximately 150 maintenance procedures are being developed / upgraded and will be tracked by the PEP. Specific Preventive Maintenance detailed procedures are being prioritized by system and incorporated into the PEP as well. Requirements for i

independent verification are being incorporated directly into new procedures.

• The Procedure Upgrade Project (PUP) has been writing post-maintenance testing requirements into all PEP maintenance procedures. Administrative Procedure coverage and guidance on documentation of post-maintenance testing now includes electrical Additionally, a Post and I&C Plant Work Orders (PWO's).

Maintenance Guidance Document (Rev. A) was issued in September, 1985, under the SORP PEP Project. Following review and approval, e

' it shall be incorporated into appropriate portions of the Turkey Point Maintenance Program.

3 3

0 PWO backlog reduction efforts underway since September,1985, have decreased I&C safety-relcted ready-to-work PWO's to This has been approximately 157 as of December 2, 1985.

accomplished through:

September - November 1985

s a) Extended selective overtime b) Contracting out specific work.

(approx. 8 contractors) November '85 - November '87 c) Staff increase. December 1985 (approx. 8 positions)

Approximately 6 engineers are being assigned to the Maintenance Department to l address corrective maintenance issues.

It should be noted that safety-related, ready-to-work PWO's account for less than

-25% of the current list of outstanding I&C PWO's.

O With respect to the listed control room instrumentation, the following applies:

l a) Steam 3et Air Ejector Process Radiation Monitors - under technical evaluation to improve reliability, or to replace with a different system. Backup monitoring is in place.

b) Unit 4 containment sump high level annunciator (level switch) -

x

i alarm has been cleared through repair / corrective measures. j c) Two of the four Unit 4 post-accident monitors for containment sump level - 1 of 2 qualified control board dual indicators is on order (SIGMA) with long procurement lead time. The circuit has parallel operable indication in the control room.

d) Unit 3 safety injection accumulator hi/lo pressure and level annunciators - these annunciators were not in a false alarm condition. However, a PWO is outstanding to investigate repairs associated with Unit 3 Safety Injection Accumulator status.

e) Area Radiation Monitors (ARMS) - Aging concerns effect the ARMS. A full-time journeyman is assigned to ARMS. A replacement system is in the budgeting process.

f) N2 low Pressure annunciators for N2 , station No. 2 - this station's annunciator card has been reconfigured to remove the alarm target. Permanent engineering fixes are in process to remove the unused station alarm.

g) The block valves for the Unit 4 Power Operated Relief Valves (PORV's) are currently shut due to PORV leakage. The PORV's are scheduled to be be repaired during the upcoming refueling outage scheduled for January,1986. However, acoustic flow monitors provide positive indication of any significant flow through safety valves.

Item 11 B.: (Effects on Other Safety Systems):

Problems were noted in the Turkey Point design change process. Programmatic weaknesses identified by the team that affects the adequacy of the design changes and modifications to safety-related systems include:

o The engineering group of ten did not provide post-modification testing requirements to confirm the adequacy of the installation to the design basis.

O The team identified instances where modifications were installed without a detailed design analysis. The licensee was found to frequently base design changes on engineering judgement that the new design was bounded by the original design analysis.

Documentation justifying the engineering judgement typically did not exist.

0 Design bases for safety-related systems were difficult to retrieve.

l In the absence of readily available design bases for many safety-l related systems, the team is concerned that excessive reliance could be place on engineering judgement for implementing design changes and for performing safety evaluations required by 10 CFR 50.59.

The team concluded that the above programmatic weaknesses in the design change process potentially contributed to the following examples of inadequate j

design analysis and design change implementation:

o Four of six AFW system steam supply isolation valve motor

-8

operators were changed from AC to DC motors without adequate design analysis. Motor overload protection for the new DC motors was not properly sized. Further, the new power cables were not properly sized to ensure adequate operating voltage for the motor operators in the event of a loss of offaite power. The licensee had '

not performed any cable sizing calculations to support this design change.

1 0 The design change to the AFW system to provide redundant Train A and Train B flow control introduce:I the potential for common mode failure due to control circuits from both trains coming to common limit switches and common relays.

O The design change to provide redundant nitrogen backup systems to supply Train A and Train B AFW system flow control valves introduced a potential for common mode failure in the redundant 4

control room annunciator circuits. As discussed later in this report,

^

the loss of these redundant annunciators could lead to a loss of AFW.

O Several problems were identified with the modification involving the replacement of the Unit 3 and Unit 4 safety-related station batteries: no calculation was available to substantiate the one hour battery discharge profile contained in the design specification; the factory acceptance test failed to adequately demonstrate the batteries could meet the design basis profile; and plant procedures i

and Technical Specifications surveillance requirements failed to recognize the existence of the new battery requirements required by the substitution of GNB lead-calcium batteries for the old C&D lead-acid batteries.

O The AFW system was modified to install a redundant solenoid operated steam vent valve. Design analysis does not exist to document the selection of 150 psig setpoint selection for 'the pressure switches that are used to control operation of the valves.

The team is concerned that the 150 psig setpoint would permit the valve to open automatically before plant cooldown could be transferred to the residual heat removal system.

4 j

0 The design change to install a redundant safety-related condensate storage tank low level alarm introduced a potential for an undetected common mode failure. This failure would have been caused by closing a normally open manual isolation valve. In addition, this valve was not administratively controlled. The design calculation to establish the setpoint for the low level alarm did not identify all the assumptic.ns and design inputs used to perform the calculation. In particular, there was no evidence that the calculation considered the net positive suction head (NPSH) required to maintain AFW pump operation.

4 0 A design analysis did not exist to document the setpoint selection (500 psig) for the AFW system nitrogen backup supply pressure e

.~w. -----c - _ . - - - - - _ _ _ _ _ _ _ . _ _

switches. Engineering did not provide post-modification testing requirements, and, as a result, the nitrogen backup system was never adequately tested. The electrical and I&C equipment associated with the nitrogen system were not identified as safety-related in the Turkey Point Q-List, and as a consequence were not being treated as safety-related by the electrical and I&C maintenance technicians.

R==aanse II B.: (Effects on Other Safety Systems):

Comment was made in your October 7 letter regarding the Turkey Point design change process, relating to design changes and modifications to safety-related systems. The following is provided to address perceived programmatic weaknesses:

O Post-modification testing criteria identification for enhanced adherence to design bases is being pursued through implementation of the Standard Engineering Package Program.

O As stated in Response 111 C.4., quality programs relating to the ,

preparation and control of design documentation are under review.

L 0 FP&L's two phase safety system review discussed in the cover to this report response, will encompass and assist in ensuring that pertinent design bases are clearly specified, providing additional .

assurances that these systems will function as designed..

' O With regard to the NRC report's cited examples of alleged inadequate design analysis and design change implementation, the following applies:

a) AFT system steam supply isolation valve DC motor overload protection and new power cables were properly sized. See Responses 111 C.5.a. and III C.5.b. As stated in Response 111 C.4., quality programs relating to the preparation and control of design documentation are under review.

b and c) Common mode failure issues are addressed in Responses 111 C.2.c. and 111 C.6; none of these areas appear to be i

significant safety issues in themselves, since original plant design bases were not altered regarding the pressure switches and annunciation system.

d) The modification involving the replacement of the Unit 3 and 4 safety-related station batteries is discussed in Responses 111 C.7.a,111 C.7.b., and ill C.7.c. Again no significant safety issues were evident, however, as stated in response III C.4., a review of existing quality programs relative to preparation and control of design documents is being performed.

e) The modification to install a redundant solenoid ope ated steam vent valve is discussed in Response !!! .2.4 Analyses demonstrate adequate steam supply to the AFW r

pump turbines in the event of a complete failure of the steam vent line.

f) The design change installing a redundant safety-related condensate storage tank low level alarm is discussed in Response III CJ. Utilization of Standard Engineering Packages should greatly aid this area, as discussed in Response C A (Safety Effects on AFW System).

g) The N2 backup low pressure alarm setpoint selection testing is a satisfactory method of determining the low pressure alarm setpoint in lieu of a design analysis. This area is addressed in Response til C.2.b. The classification of N2 backup system components has been evaluated by FP&L and is reflected in the updated Q-list, as discussed in Response III C.2.c.

Item 111. Detailed Inspection Findings:

Item til A. MAINTENANCE s item 111 A.1:

j A significant weakness noted in the Turkey Point maintenance program was the consistent failure to evaluate the root cause of equipment malfunctions and to -

trend these failures to provide input to the preventive maintenance program.

The Plant Work Order (PWO) form was used to document the performance of maintenance. A section of this form was provided to describe the cause or reason for the trouble found. A review of several hundred completed PWO forms revealed that the cause of the associated equipment failure was not Interviews with maintenance supervisory personnel described in most cases.

revealed that the cause of equipment failures and the consideration of the recurrent nature of failures are tracked informally by relying upon the memory of maintenance supervisors. The equipment history records were not being kept current in the electrical and mechanical areas. Specific examples of failures to evaluate root causes of equipment failures are discussed below:

0 A review of the maintenance history records, including PWOs and Licensee Event Reports (LERs) for the Auxiliary Feedwater (AFW)

System, revealed several component failures of a recurrent nature.

These included seven separate examples, since January 1984, of failure of an air-operated AFW flow control valve to properly function due to water or foreign material in the instrument air system.

O in 1983, on two separate occasions, two of the six AFW steam supply motor operated valves (MOVs) failed to open because of carbon build-up on the motor operator limit switches. A review of the maintenance records for the remaining four AFW steam supply MOVs revealed that, despite the recent failures described above, ,

1 one MOV (MOV 3-1404) had not been electrica!!y cleaned and inspected since 1979. Additional weaknesses associated with maintenance on MOVs are discussed in Maintenance Observations 2 and 3.

Response III AJ :

Existing PWO work instructions are being expanded to provide general guidelines to assure root cause identification is documented on PWO's.

Journeymen, Supervisors and GEMS personnel have been directed to ensure that the " Analysis of the Cause or Reason" section of PWO's is completed.

Additionally, Nuclear Job Planning System (N3PS), in trial implementation, requires an identical section to be completed on CRT screen. These actions will enhance root cause identification and appropriate corrective action implementation. N3PS, when fully automated, will automatically datalog system equipment history. Finally, the PEP is being enhanced to incorporate a formal centralized preventive maintenance program, emphasizing INPO Good Practices, and more centralized scheduling and prioritization.

Item III A.2:

A review of the maintenance activities performed on MOVs indicated weaknesses in training for repair of these valves. Interviews with supervisory maintenance personnel revealed that no training had been conducted in either the mechanical or electrical areas covering repair of MOVs with the exception of undocumented, on-the-job training and pre-maintenance briefings. A mock-up of a Limitorque valve operator was available in the training department but apparently had not been used to train maintenance personnel.

Response III A.2:

As stated in response 11 A. (Effects on Other Safety Systems), specific vendor training courses are being developed in MOV/Limitorque and selected Primary / Secondary Valves areas. The Limitorque valve operator mock-up was utilized in MOVATS (Motor Operated Valve Analytical Testing System) demonstrations this year, and will be used in future training.

Item III A.3:

Mechanical maintenance personnel were uncertain regarding the type of grease that was in MOV gearboxes. This was considered a problem for two reasons.

First, the mixing of different types of grease in the gearbox could cause hardening or separation of the lubricant. The potential for this exists at Turkey Point because its preventive maintenance instructions for Limitorque gearboxes specify the use of Texaco Marfac, while these same Limitorques have been supplied with either Exxon Nebula EPO or EPl or Sun 50 EP lubricants.

Secondly, the only Limitorque lubricant that meets the environmental qualification requirements of 10 CFR 50.49 at Turkey Point is Exxon Nebula EPO or EPI. A program to address these concerns was in progress and scheduled for completion by December 1986. The progress of this effort will remain an inspector followup item (50-250/8532-1; 50-251/8532-1).

Response III A.3:

Exxon Nebula is, for MOV's inside containment, the only Limitorque (MOV gearbox) lubricant that currently meets the environmental qualification

requirements of 10 CFR 50.49. Preventive Maintenance instructions for Limitorque gearboxes, which specified the use of Texaco Marfac, have been pulled and are no longer in use at Turkey Point. The Lubrication Manual's current revision specifies usage of only environmentally qualified grease. MOV gearbox grease has been sampled and changed as appropriate. Additionally, an Engineering Evaluation has been performed and forwarded to the Region II Administrator on November 27,1985 (L-S$-448) documenting the justification for prior limited operation with various greases in Limitorque Valve Actuators.

Item III A.42 The licensee has recently taken steps to improve MOV reliability. Temporary Operating Procedure 166 was issued in May 1985 and provided detailed instructions for troubleshooting and repair of MOVs, including limit switches, torque switches, and post-maintenance testing. This procedure provides specific torque switch settings for safety-related motor-operated valves and required that, during maintenance, proper torque switch settings be verified by an electrical quality control inspector. Discussions with management representatives revealed that the licensee was in the process of purchasing new MOV test equipment to use in improving the reliability of the MOVs.

Response III A.42 MOVATS testing and purchase of MOVATS test equipment, as necessary, is budgeted for 1986.

Item III A.5:

A review of calibration records revealed that the low pressure alarms for the AFW nitrogen system were not routinely calibrated (see Design Changes and Modifications Observation 5.c for further discussion). A search of calibration records with the assistance of an I&C supervisor revealed that the most recent calibration records for two of the nitrogen supply low pressure alarm pressure switches (PS 2322 and PS 2323) were dated June 14, 1978. In addition, no procedure was available for the calibration of these alarms. The apparent failure to establish and implement procedures for the calibration of the AFW nitrogen system low pressure alarms was discussed with the licensee and will remain unresolved pending followup by the NRC Region II Of fice (50-250/8532-2; 50-251/8532-2).

Due to this identified concern, the licensee issued PWOs 8349 and 8350 to i

calibrate all four nitrogen system pressure switches. These calibrations were performed on September 9,1985.

Response III A.5:

In addition to dynamic testing of the N2 backup system, quarterTy and during each refueling outage, quarterly static testing to verify the accuracy of the low pressure alarm will be performed. A maintenance instruction now covers switch calibration and has been inserted into the GEMS program. See Response 11 A (Safety Effects on AFW System).

l l

item til A.6:

The control and documentation of sampled post-maintenance testing was found to be weak. In many cases, neither the post-maintenance testing instructions nor the results of the testing were documented on the PWO. This was particularly evident for I&C and electrical maintenance activities. However, for mechanical maintenance activities, Administrative Procedure (AP) 0190.28,

" Post Maintenance Test Control," was specified on the PWO in most cases. This procedure described most of the testing considered adequate by the licensee to return mechanical systems to an operable status and also provided a form to document the test results as an attachment to the PWO.

The apparent failure to provided adequate instructions for post-maintenance testing on some PWOs appears to be contrary to AP 0190.19, " Conduct of Maintenance on Nuclear Safety Related and Fire Protection Systems," was discussed with the licensee, and will remain unresolved pending followup by the NRC Region !! Of fice (50-250/8532-3; 50-251/8532-3).

Response 10 A.6:

l As discussed in Response II A (Effects on Other Safety Systems), PUP has been writing post-maintenance testing requirements inte all PEP maintenance procedures. AP 0190.28, " Post Maintenance Test Control" guidance, now covers I&C and electrical maintenance activities, as well as mechanical maintenance.

PEP is being enhanced to incorporate aormal post-maintenance testing criteria into the PWO and Maintenance Procedures. The SORP Post Maintenance Guidance Document (Rev. A), issued in September 1985, will be evaluated for incorporation and consolidation of formal post-maintenance testing criteria.

Item til A.7:

A weakness was noted in the program to return instruments properly to service following maintenance or calibration while the plant was operating. The licensee had a program for providing general assurance that instruments inside and outside the containment were properly aligned when the plant was returned to operation from an outage condition. The procedures describing tiie instruments to be checked, 0-SMI-059.1 and 0-SMI-059.2, were considered adequate, providing a place for first and second check verification for each applicable instrument. However, interviews with l&C supervisory personnel revealed that these procedures would normally be used only to verify instrument alignment at the end of an outage condition. Instrument line-ups were not required by the licensee to be independently verified following maintenance or calibration while the plant is in an operating status.

Response Ill A.7:

Requirements for independent verification are being incorporated into the body of new procedures by the Procedure Update Project (PUP). Existing PWO work instructions have been expanded in the short term, to require independent verification of instrumentation isolation valves. Response II A (Effects on Other Safety Systems) discusses enhanced maintenance procedure efforts under PEP..

Item,111 A.3:

A sample of maintenance procedures indicated that many complex maintenance activities were accomplished without detailed, step-by-step procedures.

Instead, these complex activities were considered to be " skill of the trade".

The team considers the licensee's frequent reliance on individual skills of maintenance technicians as a substitute for detailed procedures to be unjustified in view of the limited training provided to maintenance technicians and the 'Tigh turnover rate among maintenance personnel. (See Maintenance Observations 10 and 11).

Response IH A.3 Response II A (Effects on Other Safety Systems) discusses the PEP enhancements to upgrade corrective and preventive maintenance procedures to Training and personnel a greater level of detail and comprehensiveness.

qualification are also dLeiau d in the aforementioned response.

Item III A.9:

A backig of approximately 900 PWOs existed in the I&C section. Included in this backlog of PWOs were a number affecting control room instruments. The team considers that any degraded condition of these instruments could hamper the operators' ability to diagnose and respond to abnormal plant conditions.

Examples of instruments that fit into this category were:

0 Unit 3 Steam 3et Air Ejector (SJAE) Process Monitor had been out-of-service (OOS) since February 13, 1985, and the Unit 4 SJAE Process Monitor Cabinet had been pulled from the control room for The SJAE Process maintenance for approximately 6 months.

Monitors are used to monitor radioactivity in the steam exhausted to the main condenser and are important diagnostic tool for identifying a primary-to-secondary leak. At the time of the inspection, the 53AE exhaust gas radioactivity was being recorded by a backup (SPING) system that had no control room indications or alarms. The readout of the SPING system was checked by the chemistry department every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

O The Unit 4 Containment Sump High Level Annunciator had been OOS since December 6,1984. The cause was determined to be an inoperable level switch, LS-1538.

O \The containment sump pump handswitches (labelled "Of f-Auto-Run")

kere in the "Off" position for both units. This was don down if the switches were lef t in " Auto" as designed.

O Two of the four accident monitors for Unit 4 containment sump level indication, which are used to determine the level during a Loss-of-Coolant Accident (LOCA), had been 005 since February 7, 1985.

O The Hi/ Low Pressure Annunicator and Hi/ Low Level Annunciator for one of three Unit 3 Safety Injection Accumulators were in an alarmed condition.

O Area Radiation Monitors on both units had many PWO tags which had been in place for extended periods. Some of these monitors

i

• e were in degraded conditions for greater than 6 months. This reduced the operators' ability to diagnose abnormal plant conditions and also increased the possibility of personnel exposure.

O The AFW nitrogen supply station number 2 low pressure annunciators were alarmed on both units. These annunciators were used to indicate low nitrogen supply to the AFW differential pressure transmitters, which had been disconnected since January 1985. Further, these annunciators were located beside the AFW nitrogen system station 1 and station 4 low pressure annunciators, and therefore could potentially degrade the control room operators' ability to distinguish a valid low nitrogen supply pressure condition (see Operations and Surveillance Observation 1.a and 1.b for further discussion).

Response III A.9:

PEP is currently being enhanced to expedite the reduction of existing I&C PWO backlog. This includes extended hours, contracting of certain areas, and staffing increases as discussed in Response II A (Effects on Other Safety Systems). Additionally, the status of control room instrumentation examples is also listed in the aforementioned response.

Item III A.102 Interviews with maintenance supervisors and training personnel indicated that formal classroom training sessions for maintenance technicians had been discontinued in August 1984. Licensee management stated that maintenance training had been discontinued to dedicate training resources to developing training materials required to support Institute of Nuclear Power Operations (INPO) accreditation of the maintenance training program. The licensee stated that this decision was necessary in order to meet the INPO accreditation Self Evaluation Report submittal date of February 1986.

Additionally, a review of maintenance training records indicated that a very limited amount of on-the-job (03T) training and vendor supplied training had been conducted since the decision to discontinue classroom training.

The team concluded that maintenance training being conducted did not appear adequate to maintain staff proficiency and to train new personnel, particularly in view of the high turnover rates experienced by the maintenance staff (see Maintenance Observation 11 of this section).

Response 111 A.10:

PEP is currently being enhanced to further develop and implement maintenance training requirements. Included is plant training on GEMS, NJPS, maintenance work controls, and Post Maintenance Testing. Systems and vendor training being conducted are discussed in Response II A (Effects on Other Safety Systems).

Item 111 A.ll:

Review of training records and interview with training and maintenance

I supervisors raised the following concerns:

o Over half of the I&C technicians that conduct surveillance tests (15 of 27 at the time of the inspection) had an average of less than 6.5 months of experience at Turkey Point. The electrical and mechanical maintenance groups had also recently experienced high turnover rates among their technicians, but not to the degree of the I&C group.

O The licensee's management controls for safety-related maintenance work assignments were considered weak. Maintenance supervisors relied on their knowledge of each technician's abilities and experience for work assignments. 03T recoros or other forms of qualification documentation were not used to assure that only properly qualified personnel were assigned safety-related maintenance activities.

Response III AJ1:

IAC experience levels and turnover issues are discussed in Response II A (Effects on Other Safety Systems), as is the area of management controls for safety-related maintenance work assignments. PEP enhancements are occurring in both areas, item 111. B. OPERATIONS AND SURVEILLANCE:

Item til B.1:

The procedures for normal and emergency operation of the auxiliary feedwater system were evaluated as weak, with numerous instances of incorrect information that could result in degraded AFW system operation. For example: ,

a. Procedure 0208.11, "Off-Normal Operating Procedure," stated that in the event of a low nitrogen pressure annunciator alarm, the standby nitrogen bottle should be valved in. However, in the case of the train 1 nitregen system, the procedure states that if all three available nitrogen bottles are valved in, the operators were to ignore the alarm. To ignore the annunciator alarm in that instance could quickly lead to a loss of sufficient nitrogen pressure to operate the train ! AFW flow. The licensee informed the team that this procedural inadequacy would be corrected on a priority basis. This item will remain an inspector followup item pending confirmation of the licensee's corrective actions (50-250/8532-4; 50-251/-

9532-4). Additionally, this procedure did not alert the operator to the fact that very limited time might be available to take corrective action, nor did the procedure advise the operators to conserve nitrogen pressure by shif ting AFW flow control valve operation from automatic to manual,

b. The team determined that confusing and incorrect information was available to control room operators regarding the capacity of the AFW nitrogen backup system. Procedure 7300.2, "AFW System Flow Control Valves Instrument Air / Nitrogen Backup System Operation," states the operators have 15 minutes to valve in standby nitrogen bottles af ter the low nitrogen pressure annunciator alarms. However, licensed operators were trained in their ongoing re ualification training program that they 1-

have 20 minutes to take action (reference: Training Brief #9, dated March 1,1984). The AFW system description and design basis states that only 10 minutes are available for the operator to take action. At the request of the NRC, the licensee performed a functional test of the nitrogen backup system during this inspection period. The test results indicated that, in fact, operators had as little as six minutes (with the flow control valves in auto) to take action to avoid the loss of AFW due to a loss of nitrogen pressure.

Because of the inadequate operator training and incorrect procedural e

information available, the team lacked assurance that appropriate 3

operator action would be taken in the event of a low nitrogen pressure annunciator alarm following a loss of instrument air, i

c. Emergency operating procedures did not provide adequate guidance to control room operators to assure that adequate AFW flow (286 gpm) would be provided to each unit within 3 minutes, as required by the AFW design basis,in the event of a two-unit trip with only one AFW pump available.

EOP 20004, " Loss of Offsite Power," and EOP 20007," Total Loss of AC,"

made no mention of the need for timely operator action to balance flow

! between the units in this instance.

4

d. EOP 20003 (E-3), " Steam Generator Tube Rupture," dated December 20, 1984, provided incorrect information to the control room operators regarding how to isolate the steam supply to the AFW turbines from the af fected steam generator. Specifically, EOP 20003 directed the control

' room operators to isolate the steam supply from the affected steam generator by shutting the associated motor-operated isolation valve using the handswitch in the control room. However, the inspection team determined that these AFW isolation valves could not be remotely shut from the control room if there was an AFW actuation signal present (see Design Changes and Modifications Observation 5.c for further details).

The licensee had not recognized this design feature and therefore had not provided operator training or procedures to ensure that alternate methods were available to isolate the AFW steam supply from the affected steam t

generator in the event of a tube rupture.

The licensee stated that the affected EOPs would be corrected on a priority basis. Further, the licensee provided training to all on-coming control room operators regarding this matter. This item will remain an inspector followup item (50-250/8532-5; 50-251/8532-5).

4 Response IU B.1:

Procedural enhancements have been accomplished in the following areas:

a. Procedure (ONOP) 0208J1 was changed to clarify immediate operator actions in the event of an alarm. It was approved by the Plant Nuclear Safety Committee (PNSC) on 9/25/85. Further, EOP's have been revised to require operators to shift FCY's to manual from automatic control within 3 minutes of AFW actuation.

b. Procedure (OP) 7300.2 has been superceded by OP's - 065.2, 075, J1. Procedures and training are 003J, 013, and ONOP , ,

I consistent in instructing operators that 10 minutes is available to valve-in additional N2 bottles af ter a low pressure alarm. The cover letter to this response contains additional details in this area.

EOP's 20004 and 20007 have been changed to provide instruction for )

c. I operating the AFW system in the event of a dual unit trip. Response H B (Safety Effects on AFT System) contains additional details.

d. EOP 20003 has been changed to alert the operator to close the manual steam isolation valve to the affected steam generator, as discussed in Response II C. (Safety Effects on AFW System).

l Item 111 B.2:

During a system walkdown of the Auxiliary Feedwater Supply and the Auxiliary Feedwater Steam Systems, as described in piping and instrument drawings 5610- ,

T-E-4062, Rev. 33, and 5610-T-E-4061, Rev. 6, the following observations were noted:

0 turbine casing exhaust silencer drain valves 328, 329, 331 and 332 were missing their associated handwheels; O local pressure instruments (PI) 1416,1417, and 1418 had an additional isolation valve not shown on the drawing; o feed flow transmitter 3-1401B was marked 4-1401B and one isolation valve,3-002, was not tagged; feed flow transmitter 3-1457B had an isolation valve,3-003, not tagged; O the following valves had no identification tags: 3-012, RV-6401A, AFWU-010,70-102, AFWU-0!!,70-103, AFWU-012,70-104, and isolation valves on PI-1430, PI-1431; O a flexible hose was supplied from the backup service water system through Aeroquip quick disconnect fittings to supply backup AFW pump cooling water. Debris was noted in the hose for the "A" pump.

There was no control for either the male or female fittings; o all the valves for nitrogen station No. 4 were mislabelled as station i No. I yalves; O three nitrogen bottles in each nitrogen station (No. I and No. 4) had

" empty" tags on them. When questioned by the inspector, the licensee determined that the bottles were,in fact, full; O the licensee had not estabMshed contingency measures to ensure that replacement nitrogen bottles could be made available on backshif ts. This issue was significant because only about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> of nitrogen is available at the nitrogen stations, so several replacement nitrogen bottles would be required to operate the AFW system long enough to cool down the units to allow for residual heat removal operation. The AFW system walkdown revealed that replacement nitrogen bottles were not readily available.

Response III B.2:

The observations noted during the AFW system walkdown have been corrected, however it should be noted that the locr! instrument isolation valves are not normally numbered or shown on drawings. The supply of replacement nitrogen bottles are currently being evaluated for enhancement.

Item til B.3:

A review of " Auxiliary Feedwater Train 1 Operability Verification," Procedure 3-OSP-075.1, dated August 7,1985, identified that it did not adequately verify the operability of AFW steam supply MOVs 3-1404 and 3-1405. Limit switches located in these valves are used to control associated flow control valves in the feedwater lines. When either of the MOVs opens, all flow control valves in trains ! and 2 open to assure a feedwater flow path. However, procedure 3OSP-075.1 required opening both of these steam supply valves together. Therefore, each of the MOVs was not independently verified capable of opening all the

. flow control valves as designed.

Response 111 B.3:

Procedure 3/4 - OSP-075.1 now requires that each MOV is independently verified capable of opening all FCV's.

Item III B.4:

The team considers local control of train 2 AFW valves to be virtually impossible. Off-Normal Operating Procedure 0208.17, " Control Room inaccessibility," dated May 24, 1985, would be used to take local feedwater control in the event of a control room evacuation. This procedure has no guidance for local control of train 2 AFW valves. Additionally,it appeared that operation of this train would be difficult because the valves are located under the feedwater platforms and all indications for train 2 are located on the platform area.

The team's concern regarding the ability of the licensee to safely shut down the plant in the event of control room inacessibility was reinforced by the observation that the licensed operator requalification program did not include drills or plant walkthroughs to simulate local control of essential safety systems. This is considered a weakness at Turkey Point for two reasons. First, Turkey Point does not have a safe shutdown panel outside the control room that would provide a central location for essential instrumentation and control.

Second, less than a quarter of the licensed control room operators had previously been a .watchstander outside the control room; therefore, the majority were not as familiar with local equipment operation.

Response III B.4: l 0-ONOP-103, approved on November 19, 1985, replaced Procedure (ONOP)  !

0208.17, " Control Room Inaccessibility". These procedures were recently I simulated and evaluated by Region il personnel on November 21,1985, regarding AFW Train 2 operation with the control room evacuated and both Turkey Point l Units tripped. Operator performance was judged satisfactory, however, as stated in Response 11 B (Safety Effects on AFW System), procedural streamlining is being evaluated. Extensive training for operators and operator trainees is currently underway and will be completed by February 28,1986.

A l

Item III B.5:

The team noted the following concerns with the condition of the auxiliary feed pump turbines and their associated steam supply system.

I a.

During a system walkdown, the drain lines on the turbine casings and the I exhaust silencers were noted to be hot. Water was flowing from the drains on the A and C turbines. The steam supply isolation valves for the A and C turbines were leaking and allowing steam to reach the turbines even though the valves were closed (MOV-3-1404, MOV-3-1405). A review of the valves' maintenance history revealed that these valves had been reworked several times. However, it did not appear that the problem had been resolved. The associated steam supply valves on Unit 4 also i

appeared to be leaking. It should be noted that the B turbine did not appear to have any leakage from its steam supply valves (MOV-3-1403 and MOV-4-1403). During this inspection period, no current PWOs were noted on the leaking steam supply valves.

b.

The steam supply vent system did not appear to be functioning properly in J that the vent valves were open but only a small amount of steam was being vented. Further, a substantial amount of steam appeared to be reaching the AFW turbines based on the condensate flow from the casing and silencer drains and the elevated temperature of the exhaust stack.

The team identified that one of the vent valves on Unit 3 was failed shut on September 11,1985. The licensee promptly corrected this problem.

Response III B.5:

Regarding the AFW pump turbines and steam supply system, the following applies:

a. The Unit 3 steam supply isolation valves for the AFW pump turbines were reworked during the October,1985 outage. The Unit 4 steam supply isolation valves will be worked during the January,1986

' outage. The Maintenance and Technical Departments are further pursuing root cause correction in this area.

b. As stated in Respo;ue III C.2.d,, analysis has demonstrated and 1

! confirmed adequate steam supply to the AFW pump turbines in the event of a complete failure of the steam vent line. The system is currently being evaluated by Engineering for potential removal.

Item til B.6:

It was noted during walkdowns of the Auxiliary Feedwater System that the seismic qualification of portions of the system was not being properly maintained. The following observations were noted: control air lines going to CV-3-2816 were attached to their tubing tray but the tray was not attached to the floor for several feet; nitrogen instrument lines were noted to go underground to transit from one location to another; and nitrogen bottles stored at nitrogen station No. I were not adequately restrained.

It was noted also that temporary scaffolding was in place above all four instrument racks for Unit 3 and 4 auxiliary feedwater flow transmitters. in

-2i-

l addition, a leg of one of these scaffolds was installed adjacent to the Unit 3 train 2 auxiliary feedwater instrument rack right between two of the flow transmitters. The failure of non-seismic components (scaffolding) could cause the failure of safety-related AFW components with the resultant common mode failure of all auxiliary feedwater flow to both units.

This item will remain unresolved pending followup by the Region II Office (50-250/8532-6; 50-251/8532-6).

Response III B.6s Non-Conformance Reports (NCR's) have been written and dispositioned for i

air /N 2 nstrument lines and N2 bottles have been properly restrained. The Phase H Safety System review will include walkdowns of selected safety systems to enhance p oper seismic maintenance. Additionally, seismic condition evaluation for appropriate small bore piping is being investigated by Site Erfrsing.

Regarding scaffolding controls, site Quality Assurance (QA) has a-W the need for enhanced controls under the Administrative Procedures. Operations input and procedural support is being pursued.

Item 111 B.71 Procedure 4-OSP-075.3, "AFW Nitrogen Backup System operability Verification," was reviewed by the team. This procedure did not appear adequate to functionally test the nitrogen backup system as it only tested the operability of the system during static conditions. The test did not demonstrate I

that the nitrogen backup system would function properly in its design basis mode of supplying the AFW flow control valves with the valves in automatic.

Response III B.7:

l Dynamic (functional) testing is being performed, as discussed in Response II A.

1 (Safety Effects on AFW System).

Item Ill B.8:

The differential pressure transmitters on the discharge of each AFW pump were disconnected in January 1985 in accordance with Procedure 0103.3, " Control and Use of Temporary System Alterations." This procedure required that a 10 CFR 50.59 safety evaluation be written and the alteration be reviewed and approved by the Plant Nuclear Safety Committee (PNSC). The Temporary System Alteration for disconnecting these differential pressure transmitters included neither a 10 CFR 50.59 safety evaluation nor PNSC approval. This item will remain unresolved pending followup by the Region 11 Of fice (50-250/8532-7; 50-251/8532-7).

, Response III B.8:

The differential pressure controllers / transmitters on the AFW pump discharge were disconnected due to maintenance problems with these components and

difficulties in obtaining spare parts. Removal of the pressure controllers was justified by analysis on the basis that cacessive differential pressure across the FCV would not exist during a loss of feedwater event, since the steam generator pressure would rapidly rise to the safety valve setpoint. Under this condition, the pressure drop across the FCV would be essentially the same regardless of whether the differential pressure controller was installed.

Response m C.2.a. contains additional details in this area.

However, in light of NRC concerns in the area, enhanced Temporary System Alteration (TSA) controls are being evaluated, and should be reviewed by the Plant Nuclear Safety Committee (PNSC) by January 31,1986.

Item 111 C. Design Changes and Modifications Item Ill.C.1:

Plant Change / Modification (PC/M) 80-77 was reviewed by the team. This modification package installed redundant instrument strings to provide safety related condensate storage tank level indication and an alarm 20 minutes prior to needing another source of water for the auxiliary feedwater pumps. The team determined that the implementation of this design change failed to ensure that it met the single failure criteria.

Specifically, an operator error to close one manual isolation valve (isolation valve 428) could have caused an undetected common mode failure of safety-related condensate storage tank level indication and alarm functions. The level transmitters for redundant level indication are connected to a common instrument tap from the condensate storage tank. The common instrument tap has a normally open isolation valve which could be mistakenly closed by an operator causing common mode failure of the level instruments. No valve position indication was provided to alert the operator of incorrect valve position and no administrative controls (such as locking the valve open) were applied to ensure that the valve remained open.

As a result of the inspection concern, the licensee checked open isolation Valve 428 and installed a locking device. Revision of appropriate valve lineup sheets and plant drawings will also be required. This item will remain an inspector followup item (50-250/8532-8; 50-251/8532-8).

Response M C.1:

The design bases for the addition of the redundant condensate storage tank level indication system, installed under PCM 80-77, was based on the connection to the tank being a passive portion of the system which allowed the redundant monitors to be on a common tap. This approach is considered j acceptable since a single passive failure of this line or the isolation valve is not a desip basis for Turkey Point. Prior to the implementation of PCM 80-77, the condensate storage tank was provided with a single level transmitter 4 downstream of Isolation Valve 428. When the redundant levelindication system was added downstream of Valve 428, it was assumed that the operation of the ,

valve was adequately controlled by administrative procedure since PCM 80-77 l did not modify either the tap off the tank or the valve. The need to control the isolation valvs was not addressed in PCM 80-77 since the valve was existing I and perforwing the same faction, and Operating Procedure 700lJ l

administratively controls Valve 428 in the open position. j i

Inadvertent closure of Valve 428 would create the potential for the operator to have mislerding information concerning the condensate storage tank level.

However, this is not considered to be a sipificant safety concern since there are other independent methods of determining tank level which would have alerted the operator to recopize that the level indication system was not functionirg properly. I.evel Switch LS-3/4-1503, which is safety related, alerts i the oper:ator that the minimum Technical Selfication volume of 185,000 gallons is remaining in the tank, would be available since it is not associated with this level tap. Should the condensate storage tank reach this level, the operatre would have noted a discrepancy in the level readings and taken curreedve action. Also, control room alarms are available to alert operators with respect to tank level.

The condensate storage tank Technical Specification also requires, by l def'/nition, a minimum volume of water for nineteen hours of Auxiliary l Feedwater System operation. With the Auxiliary Feedwater System in operation and drawing on the inventory of the condensate storage tank, the cperator would have noticed that the condensate storage tank level (as indicated by the redundant transmitters and checked by log readings) was not decreasing during this time period and questioned the validity of the level indication; appropriate corrective action could have been taken.

In addition, both condensate storage tanks are normally aligned to the Auxiliary

Feedwater pump suction. Assuming Valve 428 was inadvertently closed on one tank, the level on the opposite tank would be operable. Since the levels in the two tanks will decrease at approximately the same rate, a disparity between

! the levels in the two tanks would have been recognized by the operators and appropriate corsective action could have been taken.

It should also be noted that the design modification process has been substantially improved since the time this modification was implemented in

recopition of the need to coordinate changes in the plant with operations and maintenance perrannel. A program for the review of proposed plant modifications har, recently been established to ensure that the effects on operating documents, procedures and administrative controls are accommodated W the design prior to approval of the PCM by the Plant Nuclear Safety Committee (PNSC). Engineering personnel are also currently on controlled distribution for the plant operating procedures, which provides the design engineer with a better insight into the actual operation of the system and the potential impact of modifications of the system. Also, utilization of Standard Engineering Packages should greatly aid this area, as discussed in Response 11 A (Safety Effects on AFT System).

As noted in the NRC report Valve 428 has been locked open. In addition the associated drawings have been revised to show this valve locked opeh by

administrative control and the valve has been added to the locked valve list.

Item Ill.C.2.

PC/M 80-117 was reviewed. This modification added redundant steam supplies to the auxiliary feedwater turbines. The modification also replaced the l auxiliary feedwater flow control valves. Upon auxiliary feedwater initiation, l six pneumatic flow control valves per unit are automatically opened and i

controlled to supply 125 gpm through each valve. The three auxiliary feedwater pumps are aligned in a two train arrangement with turbine pumps A and C l assigned to train 1 and turbine pump B to train 2. Three flow control valves are assigned to each train to provide auxiliary feedwater flow to each of three steam generators. Flow transmitters immediately downstream of the flow control valves monitor feedwater flow and provide feedback to 1/P converters I to alter control air pressure to flow control valve positioners. Upon loss of instrument air, these valves are designed to fail shut. To prevent this from occurring, the flow control valves are provided with a safety-related source of bottled nitrogen to restore the sources of motive and control power for the flow control valves.

PC/M 80-117 also added six new flow control valves (three valves per unit) and replaced the actuators on the six installed valves (three actuators per unit). To accommodate redundancy in the nitrogen system, the existing nitrogen cylinders (five cylinders per unit) were divided into two trains per unit. This division resulted in assigning three nitrogen cylinders to train 1 and two cylinders to train 2. In each train, only one cylinder was valved on-line. During the team's review of PC/M 80-117, the design of the nitrogen system was examined. The following observations were made during the review of the modification package.

Item til C.2.a.:

The implementation of the design control process for this modification did not produce a documented analysis substantiating the design adequacy of the nitrogen system. The team found that a design analysis was not performed by i Bechtel to confirm that the design change was acceptable. The team was informed that Bechtel reviewed the original design analysis and confirmed that the new design was bounded by that calculation in lieu of a new design analysis.

No evidence existed documenting this engineering judgement. The team was informed that the existing calculation was considered bounding because the new components had a lower nitrogen consumption rate. The original design analysis was performed in 1972 and had consumption rates for components which existed in the original control scheme and which were subsequently replaced with new components by PCM 80-117. The calculation had no indication of a check or verification. Likewise, the sources and nature of the consumption rates were not identified. During the inspection, Bechtel could not determine if the values in the 1972 calculation represented steady-state conditions or consumption rates reflecting some assumption for valve modulation and component leakages.

4 Bechtel cited information from a vendor technical manual which indicated that i

the new valve actuators have a lower steady-state air usage value of 0.26 scfm per valve, rather than the 1.0 scfm per valve used in the existing calculation.

The valve actuators are diaphragm actuators with a balance positioner constantly exhausting air through a detecting nozzle. Bechtel pointed out that

only three actuators are being supplied by the one nitrogen cylinder on line instead of six Per the original design. Thus, Bechtel concluded that the original design analysis bounded the new design. By inspection, the team could not arrive at the same conclusion for the following reasons:

0 The team determined that the steady-state air usage value of 0.26 scfm was based upon a vendor test of a similar, but not identical valve positioner. The vendor test was conducted with an air supply pressure of 60 psi instead of the minimum nitrogen supply pressure of 80 psi furnished by the installed nitrogen system regulators at Turkey Point. As a consequence, the steady-state air usage value can be expected to increase. During the inspection, Bechtel indicated that a linear extrapolation was a reasonable assumption.

Therefore, the steady-state consumption rate approaches 0.36 scfm (i.e., increased by a factor of 80 psi /60 psi).

O The assumption of instantaneous steady-state operations does not appear to be consistent with the as-designed valve response (i.e.,

upon actuation the valve cycles full open and then closes towards the 125 gpm flow setpoint). The vendor's technical literature indicates that high operating speed is achieved with virtually no overshoot when approaching the final plug position. Although a designer might choose to assume a leak tight system with periodic testing to confirm this assumption, it appears unreasonable to conclude that no valve modulation is required and that a steady-state condition is reached immediately. The team was informed that the operators typically take the flow control valves out of automatic control and place them in remote manual control immediately af ter an auxiliary feedwater flow to maintain steam generator level. The team was informed that this operator action results in elimination of control valve modulation except for the initial valve cycle. However, the team determined that the operators were not required by procedure to take remote manual control nor were the operators directed to do so by existing management guidelines or training. Consequently, the team concluded that the licensee's assumption that operators would immediately take remote manual control of the flow control valves (and thereby reduce the valves' air usage rate) was unjustified. In addition, the team found no periodic testing performed on the nitrogen system to confirm its leak tightness and instead observed a system with significant leakage rates.

O The minimum available volume of nitrogen is higher in the original design analysis than prescribed in the system design description.

Specifically, the original design calculation uses a minimum volume based upon 1005 psig in the cylinder, and the system description indicated a minimum volume based upon 500 psig. This reduction can, in part, be explained by the reds.ction in the assumed time the operator has available to valve in a new nitrogen cylinder. The original analysis was performed with a design basis of operator action within 15 minutes of receiving a low nitrogen pressure alarm, whereas, the current system description specifies 10 minutes. This time reduction does not appear to be based on a documented analysis of the actions required of the operator to recognize the

I alarm, analyze the appropriate response, send another plant operator to the nitrogen cylinder and valve in a second nitrogen cylinder. (See Operations and Surveillance Observation I for further discussion.) <

0 The original nitrogen system design bases included a requirement that the stored volume of nitrogen be able to permit system i operation for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> assuming that all five nitrogen cylinders were

full. A similar requirement for the current system does not appear to be addressed. This does not appear to be consistent with the licensee's commitment to have at least one AFW system pump and its associated flow path and essential instrumentation capable of

- being operated independent of any AC power source for at least two hours (SER related to Amendment No. 75 to operating license No.

DPR-31 and Amendment No. 69 to facility operating license No.

t DPR-41).

Resnonse ill C.2.a The modification to split the nitrogen backup system into two headers was issued for implementation under the original scope of PCM 30-117 as shown on Drawing 5610-M-339/80-55, Revision 2, dated January 15, 1982. This design was established by engmeering judgement (although not fully documented) based on a technical evaluation of the original design basis for the nitrogen backup system in consideration of the following factors:

O The total number of flow control valves supplied by the on-line bottles in the split system was half of that in the original design.

. The original design had one bottle on line serving six flow control valves. The modified system resulted in one bottle on line serving three flow control valves.

O The total nitrogen consumption for the modified system was significantly less than the original system. The air consumption rate of original flow control valves was 1.0 scfm per valve, as compared to the air consumption rate for the replacement valves of 0.26 scfm, based on the original regulator setpoint of 55 psig.

o The pump differential pressure controllers were installed and operable, and maintaining the design pressure drop across the flow control valves. On this basis, valve oscillations were not an 4 operational problem.

o The design flow rate through each flow control valve was 200 gpm.

\

l 0 The low pressure alarm setpoint for the nitrogen bottle system at the time the PCM was issued was 1005 psig, which allowed 15 minutes for the operator to take the necessary action to valve-in a j

new bottle.

! O Air cperated hand controllers for the flow control valves supplied by the backup nitrogen were removed from the system as defined in the 4

scope of work under PCM 80-55.

) - - , - - - . - - - - . - _ _ .

The split of the nitrogen system into separate trains under the original scope of PCM 30-117 was considered acceptable within the parameters of the original design basis for this system. However, in response to NRC concerns with the engineering judgement used as a basis for this modification, a detailed analysis of the nitrogen h@c system was performed, based on the original design parameters described above and worst case results of previous tests performed on the system. The results of this analysis are documented in Calculation MOS-462-05, Revision O, dated November 1,1985. This analysis demonstrates that sufficient nitrogen should have been available from the valved-in bottles in the split system to permit the system to operate for more than 20 minutes without operator action following receipt of a low level alarm at 1005 psi. Based on these results, the split of the nitrogen system was confirmed to be consistent with the original design basis and operating procedures for the system. .

Responses to the specific NRC review team concerns identified in Findmg ID.C.2.a are discussed below:

0 The NRC review team indicated that a steady-state consumption rate of 0.26 scfm was utillzed in evaluating the nitrogen consurnption rate for the new flow control valves,instead of a rate l

of 0.36 scfm. The 0.26 scfm consumption rate was based on the original regulator setpoint of 55 psig. As h = mf above, Calculation MOS-462-05 was prepared to analyze the available nitrogen from the split system. This analysis included a steady-state consumption rate greater than 0.36 scfm to account for system leakage and the change in the regulator setpoint to 80 psig, and confirmed the acceptability of the split system.

O The NRC review team concluded that the assumption of instantaneous steady-state operations was not consistent with the as-designed valve response. As discussed above, the analysis supporting the split nitrogen system was based on the original plant design features which limited flow control valve oscillations. This is consistent with the vendor's technical literature which indicates that the valves quickly reach their setpoint with virtually no overshoot.

However, several changes were made to this system after PCM 80-

!!7 was released for implementation, which induced oscillations in the flow control valves and resulted in a subsequent increase in the nitrogen demand for the system. These changes were unrelated to the original scope of PCM 80-117 and included the following:

1. The differential pressure controllers on the Auxiliary Feedwater System were disconnected due to maintenance i

problems with these components and difficulties in obtaining spare parts, which resulted in an increased pressure differential across the flow control valves. This increased pressure differential resulted in oscillation in the flow control valves, and an increase in the nitrogen consumption rate under test conditions witnessed by the NRC review team.

Removal of the pressure controllers was justified by analysis on the basis that the excessive differential pressure across

the valve would not exist during a loss of feedwater event since the steam generator pressure would rapidly rise to the safety valve setpoint. Under this condition, the pressure drop across the flow control valve would be essentially the same re.g 4 ;. of whether the differential pressure controller was Installed.

i

2. Another change which induced oscillations in the flow control valves was the reduction in the amillary feedwater flow rate i

from 600 gpm to 373 spm. This reduced flow rate residted from a Westinghouse reanalysis of the feedwater flow requirements as documented in Westinghocse letter W-PTP-62, dated June 3,1932. As a result of this change, the setpoint for the flow control valves were revised to 125 spm.

Reduction in the setpoint compoemded the cecillation problems in the flow control valves since the design basis for the system was established at 200 gym. Subsequent to this change, a review of the valve oscillation problem was made during field testing of this system. These tests confirmed that the control valves performed satisfactorily teder the original design condition of 200 gym flow at 25 psi differential. However, oscillating control valve action was experienced when the system was tested at the reduced flow rate of 125 gpm and the auxiliary feedwater pumps rimning at maximum speed. As a result of these tests, modifications were recommended to eliminate the valve oscillation problems. It is anticipated that new valve trim will be installed by the upcoming refueling outages for each unit.

i The NRC's concerns with the volume of available nitrogen to l the flow control valves are directly related to the valve oscillation probleras witnessed during the inspection.

However, as discussed previously, valve oscillations are not considered a safety concern since the high differential pressure across the flow control valves are not expected to exist when the system responds to a design basis accident.

FP&L has pursued resolution of this problem in a systematic manner through coordination with its architect-engineer.

NRC's final evaluation of its inspection findings should give due recognition to the fact that this problem was identified

l by FPL prior to the inspection and that design modifications  ;

were in progress. l 0 The NRC review team noted that the reduction in the low pressure l alarm setpoint from 1005 psi to 500 psi did not appear to be based on a documented analysis. This change was made based on a field )

i The criteria i performance test conducted on March I,1934.

developed for the test was based on steady state operation of the valves on the understanding that valve oscillations were not a design basis for the system and would be eliminated by subsequent

, The amomt of time required ist modifications to the valves.

valving in the next bottle upon actuation of the low level alarm was

established at 10 minutes based on discussions with plant operations  ;

personnel. A total of six valves were included in the test to add  :

conservatism to the setpoint since only three valves are aligned to j

Also the valves  ;

one open bottle in the new system arrangement. operated forl i

• s setpoint which was considered another safety factor margin for the setpoint. On this basis, the test is considered to t,e a satisfactory method of establishing the low pressure alarm setpoint, in lieu of a i documented analysis.

• The original nitrogen backup system for the auxiliary feedwater flow control valves consisted of five nitrogen bottles to supply t motive power for six flow control valves. Original calculations concluded that the five bottle station would provide sufficient capacity for two hours of valve operation, however this was not a '

design basis requirement for the system. The nitrogen station is, desigped to allow sufficient time for bottle change out while maintaining system operation.

Operation of the system (both the original and the existing split system) is consistent with this design, as it requires manual operator action at the bottle station to valve-in bottles to access the full capacity of the station. Only one bottle is normally aligned to the valves it operates during standby conditions. The nitrogen backup system does not require AC power for operation. The system consists of pressurized nitrogen bottnes isolated from the normal lastrument air tubing to the flow control valves by check valves which open when instrument air pressure drops below the nitrogen pressure regulator setpoint of 80 psig. The solenoid valves which isolate air to each flow control valve are D.C. powered.

In addition, the flow control valves are capable of being operated manually via handwheels without either instrument air or nitrogen.

l Instruction for this operation is provided in Off-Normal Operating Procedure 7308.1" Malfunction of The Auxiliary Feedwater System".

Item lli.C.2.b:

The team found that a design analysis did not exist to document the setpoint selection for pressure switches used to alert the operator via control room i annunciation that ten minutes of nitrogen remained before loss of motive and control power to the AFW flow control valves. Instead the team was informed that the setpoint reduction from 1005 psig to 500 psig for the pressure switches was established by testing performed under Temporary Procedure 085 on March 1, 1984. This test appeared to have been performed prior to the spiltting of nitrogen system into two redundant trains but af ter addition of the new flow control valves and actuators. The test was performed with one nitrogen control cylinder supplying all six flow control valves with the valves in a full open position. Placing the valves in a full open position causes the air usage to be in a steady-state condition. Because the citrogen pressure decayed the last 500 psig in 15 minutes, the low pressure alarm was set at 500 psig. This setpoint was selected based upon a steady-state test without consideration of instrument error and without compensation for that pressure at which the flow contro!

valve can no longer modulate (approximately M psig per manufacturer information). The issue is safety significant because incorrect setpoint selection could ree. ult in the premature loss of nitrogen pressure and closure of all auxiliary flow control valves.

Response III.C.2.b.:

i As noted previously in rernonse to Finding !!!.C.2.a, the reduction in the low pressure setpoint was baseo on field tests performed in March,1984. The test

- - - - - -__ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _--___-,____--_,-,,._y___. - - , . , . , _ _ , , _ , . , _ . _ , .,__ .-_-. - - . _ _ . . _ .

?

performed for resetting the low pressure setpoint included a determination of the minimum operating pressure for the valves (22 psig) which corresponds to information provided by the manufacturer at that time (21-26 psig). The test data for bleeddown rates was provided to a final pressure of 24 psig.

e The selection of the 300 psig setpoint was based on a conservative test which l provided nitrogen to operate six flow control valves (during normal operation one nitrogen bottle only operates three valves). The testing indicates that the 500 peig setpoint was sufficient to operate the six valves in their desiped steady state condition for approximately 15 minutes. Therefore based on this testing, the 500 pelg,10 minute alarm to allow an operator to valve in another nitrogen bottle is considered acceptable for the system as designed. The test is mnsidered a satisfactory method of determining the low pressure alarm i setpoint in lieu of a design analysis.

However, modifications have been performed to the AFT system (temporary system alteration to remove the differeatial pressure speed controller from the pumps due to component failure and unavailability of spare parts) which have introduced oscillations into the automatic flow control system which were identified during system testing. These control oscillations, though not a design feature of the system, increase the instrument alr/N2 usage for valve operation. FP&L initiated an engineering evaluation to eliminate this oscillation prior to the NRC inspection.

In order to resolve the NRC concerns of increased N2 consumption until the oscillations can be eliminated, a reanalysis of the nitrogen backup system has been performed, based on conservative assumptions, regarding existing valve o:cillations. Based on this analysis, FP&L has temporarily revised the low pressure setpoint to 1350 psig in order to allow a minimum of ten minutesThe for

' the operator to valve in another bottle under worst case conditions.

adequacy of this revised setpoint was confirmed by a review of recent N 2 consumption testing. The low pressure alarm has been reset in the field based on the revised analysis and the appropriate design documents are being revised.

Item III.C.2.c:

The design verification process failed to ensure that appropriate quality assurance requirements were specified for nitrogen system components.

Electrical and !&C equipment associated with the nitrogen system were not identified as safety-related in FPL's Q-List. As a consequence, the pressure l

switches used to alert the control room operator of low nitrogen pressure and the need for immediate operator action were not being treated as safety- '

related by the site I&C group.

i The AFW system design description identifies the AFW system as an emergency safeguards system to prevent core damage in the event of transients such as a j

loss of normal feedwater or a main steam line break. The nitrogen system is essential to operation of the auxiliary feedwater flow control valves FPL and, Qualityas l

such, the nitrogen system serves a safety-related function. Systems and Structures, Instruction J PE-Ql-2.3A, " Classification of l'

i Components", indicated that the mechanical equipment but not the electrical and instrumentation and control equipment associated with the nitrogen system were safety-related. The team was informed that a more detailed component level Q-List was being developed and that this list indicated the pressure l switches were safety-related; however, this list had not been issued from

engineering at the time of the inspection, and the I&C group was unaware that

' the safety classification for the pressure switches had changed.

j

It appears that, contrary to the requirements of ANSI N45.2.ll Section 6.3, the design verification process for the Q-List and the design modification did not ensure that equipment performing a safety-related function were designed, specified, and maintained commensurate with that function.

This item will remain unresolved pending followup by the Region II Office (50-250/8532-9; 50-251/8532-9).

R===a ue IILC.2.c.:

The nitrogen system as originally designed and installed at Turkey Point utilized the existing pressure switches, wiring and annunciation system. Subsequent to its original installation, and consistent with NRC recommendations for improved Auxiliary Feedwater System re!! ability (refer to NRC letters Eisenhut to Uhrig, dated October 15, 1979, and Varga to Uhrig, dated May 30,1980), the nitrogen system was modified as part of the overall effort to upgrade the

reliability of the Auxiliary needwater System.

The modifications associated with this upgrade as defined in PCM 80-117 included splitting the existing five bottle nitrogen system for cach unit into two systems with a resulting two bottle system for one train and a three bottle system for the other train. The original five bottle system contained the subject pressure switches which had two different setpoints (Iow and low-low) and, therefore, were non-redundant. Use of these non-safety grade, non-redundant components in the modified backup nitrogen system was consistent with the original design of the system and considered acceptable. Although NRC guidance for the Auxiliary Feedwater System upgrade, as provided in the above referenced letters, included requirements for the upgrade of a number of Auxiliary Feedwater System signals and associated circuits, including flow indication and automatic initiation, no specific requirements for upgrade of the nitrogen system signals were identified or considered necessary. In addition, use of non-safety grade nitroCen system components was subsequently identified to the NRC in FPL letter L-81-405, dated September 18,1981, and considered acceptable with respect to the seismic qualification requirements as i defined in Generic Letter 81-14.

In regard to the design verification process for the Q-List, FPL has recognized that the current Q-List is a basic systems level document and is not intended to

! address individual system components. FPL has previously discussed this issue with the NRC (refer to Inspection Report Nos. 50-250/84-33 and 50-250/84-34),

and has committed to the development of an updated and more component specific Q-List. This new Q-List is data base etfective as of November 15, 1985, and has been identified for NRC review as Inspection Followup Items 250/84-33-03 and 251/84-34-03. The classification of the nitrogen system components has been evaluated by FPL and is reflected in the updated Q-List. A Q-list Task Team has been formed and has issued a preliminary implementation schedule for the new Turkey Point component level Q-list.

l l Item III.C.2.d:

Implementation of the design change process for this modification did not c

produce a design analyses to confirm that non-safety componentsAlthough of a system not do not adversely affect the safety function of the system.

l identified in the system design description and design bases document for the j

auxiliary system, steam vent valves were provided to vent steam when the system is not operating. The valves are signaled to close on increasing steam pressure (increasing steam pressure indicates thrt auxiliary feedwater sy E

l between the steam admission valves and the auxiliary feedwater pump turbines.

The steam vent valves are outside of the seismic boundary and are treated as non-safety related. In reviewing PCM 80-117, this design feature was examined and the following observations were made.

l 0 Design analysis does not exist to document the consequence of a  ;

failure of the vent valves to shut and the ability of the auxiliary l feedwater pump to supply sufficient feedwater flow at reduced l steam generator pressures to reach the point of Residual Heat Removal System operation.

o Design analysis does not exist to document the setpoint selection for

, pressure switches and the error band used to control the operation of solenold-operated steam vent valves. The setpoint was verified to be at 150 psig which would permit the valve to open automatically before the cooldown has been transferred to the Residual !!. eat Removal System. ,

The lack of a design analysis in the cases cited above in subparagraphs a, b, and

c appears to be contrary to the requirements of ANSI 45.2.11 Sections 4.1 and 4.2 which requires that design analyses be performed in a planned, controlled and correct manner and that there exist traceability from design input through to i design output. This item will remain unresolved pending followup by the Region II Of fice (50-250/8532-10; 50-251/8532-10).

Response ID C.2.d.:

The classification of steam vent valves as non-safety related components is consistent with the original design basis for the plant and was not changed by PCM 80-117. Therefore, ANSI N45.2.11 was not applicable to either the original design of the vent valve or the subsequent modifications. A design analysis was performed, as documented in Calculation MOS-162-02, dated November 20,1981, for the failure of the valves during the initial operating conditions of the Auxiliary Feedwater System with mandmum steam pressure in the system.

In response to NRC concerns, a confirmatory analysis has been performed at

! the lowest steam operating conditions (at the time the RHR System is put into operation) which has confirmed previous engineering judgement. This analysis is documented in Calculation MOS462-02, dated October 11, 1985. The ar.alysis demonstrated and confirmed adequate steam supply to the Auxiliary Feedwater pump turbines in the event of a complete failure of the steam vent line.

The selection of the setpoint for the steam vent valve on the new steam supply header was based on the setpoint established under the original plant design for the vent valve in the existing header. At the time the new header was added, as an exact duplicate of the existing header, the setpoint of the original steam valve was specified for the new valve. There was no reason to question the validity of the original valve setpoint since the new valve was functionally identical. As stated previously, a design analysis has been performed which confirms the system's operability with the vent open at low steam pressure.

Item Ill.C.3:

During the review of PCM 80-117, the team observed nitrogen system tubing i

which did not appear to be seismically supported and instances of broken 5 supports. This tubing was routed from the nitrogen cylinder racks to the flow 3

control valves and included original tubing as well as new tubing. The team was informed that this lack of adequate seismic supports was known by the licensee as documented in REA TPN 85-30. In a March 7,1985 letter, the licensee directed Bechtel to walk down the system in the field and determine if the tubing was actually supported in accordance with Bechtel's design specification for seismic Class 1 tubing supports or in accordance with the original seismic y

design specification. On July 19, 1985, in response to this request, Bechtel reported that most of the 3/8-inch tubing was installed in accordance with Bechtel specifications, but with two tube spans greater than that allowed.

These deviations were evaluated and found to be acceptable as installed. With i respect to the old tubing in the rest of the system, Bechtet identified that the configuration was different than originally accepted by Project Engineering.

Bechtel evaluated the configuration using the functionality criteria developed to justify continued operation in response to IE Bulletin 79-014. The Bechtel analysis determined that the tubing must be supported at 27 inch maximum intervals to meet final design requirements for long terrn operation. The licensee informed the team that correction of this nonconforming condition will be performed during the next refueling outage. This item will remain an inspector followup item (50-250/8532-11; 50-251/8532-11).

Response 111 C.3.2 The tubing support concerns identified during the NRC inspection had prev.ausly been identified by FPL during routine surveillance of this system and corrective actions were in progress to address these concerns. This tubing was inspected by Bechtel on April 4,1985 in response to an FPL request documented in letter JPES-PTP-85-262. The majority of this tubing wes found to be 3/8-

' inch stainless steel, with the remainder being Parker Multitube 8CTAT4 or 2CTAT4, consisting of 1/4-inch copper tubing in a flexible condult.

~

The 3/8-inch tubing was evaluated and accepted based on the final design criteria provided in Precedure 5177-102-P-003, Revision 6, Procedure for Piping Stress Reanalysis.

.. L Inspection of the rest of the system indicated that the Multitube was not supported in accordance with the original seismic design requirements. The as-found configuration of the Multitube was evaluated using the functionality criteria provided in Procedure 5177-102-P-003 and was found to meet functionality requirements. However, the Multitube must be supported at 27 inch maximum intervals to meet final design requirements for long term operation. Therefore, NCR 341-85 was generated and dispositioned by Bechtel to provide the required supports during the next scheduled refueling outage for each unit. A summary of the conclusions from this inspection efiort is provided E

in Bechtel letter SFB-1895, dated July 19,1985.

Sir :e Finding 111.C.3 did not identify which particular supports were considered broken by the NRC, reinspections were performed by Bechtel on October 17, 1985 and Octobec 22, 1985 to address the NRC's concerns. These reinspections found all tubing and support conditions to be the same as previously analyzed with the exception of two loose tubing support clips on the Unit 3 bottle rack at Nitrogen Bottle Station No. I and a missing tube tray mounting bolt at the end

=

of the tray near Vaive CV-3-2816. As noted in Finding IIf.B.6, the missing tube

-- tray mounting bolt results in the tray not being attached to the floor for several feet. It was also observed that the loose bolts on t% isottle restraining angle at the Station No. I bottle rack had been tightened in response to Finding Ill.B.6.

r i

l No evidence of broken supports was found. Rather, the evidence indicates that i possibly the supports considered broken by the NRC were actually supports I which were unbolted or removed, for installation of other items, and not Cg Jay reinstalled. Phase II Safety System review, which will include walkdown of selected safety systems, should enhance proper seismic maintenance.

As noted in Finding III.B.6, portions of the nitrogen instrument lines on Unit 4 go underground to transit from one location to another. Due to the low seismic l

{

ground response at the Turkey Point Site, relative displacements would be i negligible on the tubing and the acceptability of this condition is documented in 1 calculation 5177-462-C-46201 and Sl77-462-C-46202.

l All of the above support conditions have been evaluated and the system has been determined operable based upon hmetionality criteria. NCR 341-85 was l dispositioned to identify the necessary repairs for Unit 3 which were completed during an unscheduled outage in the last week of October 1985, and for Unit 4 to be completed during the next scheduled Unit 4 refueling outage in January 1986. l Item III.C.4:

1 The team found that design calculations were not being updated by FPL to I reflect current modifications. The team was informed that design inputs were i maintained so that, if required, the calculations could be recreated. The team r found that design criteria documents did not exist and that design bases were, in many instances, difficult to retrieve. This condition was further complicated by the controls Bechtel maintains over calculations performed by Bechtet. The team found that Bechtel had a set of original project design calculations which were used for reference purposes but not updated. For current design activities, Bechtel maintained design calculations and updated those  !

calculations as plant modifications were assigned to their design responsiblity  !

by FPL. As a consequence, it was difficult for a Bechtel or FPL engineer to i know where applicable design analyses were to be found. Further, the team observed a lack of attention to documenting assumptions, justification for their

, use, and confirmation that the assumptions were accurate af ter the design had proceeded. Likewise, the team found that the source of input data was not consistently design documents but the FSAR or uncontrolled Plant Data Books.

• Response III C.4 Although the need to maintain control of design calculations for reference in  !

support of system analyses or design modifications performed is not required by '

ANSI 45.2.11 or any other applicable standard, in recognition of the NRC's concerns, as raised specifically to Turkey Point, FPL and Bechtel have initiated an in-depth review of the existing quality programs relating to the preparation and control of design documentation. Revisions to these programs will be implemented to ensure that the bases supporting design are contro!!ed and available to both organizations. Any program revisions are anticipated to be initially scoped by January 31, 1986. In addition, the

' reconstitution / consolidation effort for enhancing the availability of safety system design bases should greatly aid this area.

Item til.C.4.a:

' During the inspection, the team observed errors in design documents (e.g.,

I calculations, drawing and specifications) which do not represent, in themselves,

d for more attention to design trace ability.

inadequate designs but reflect a nee j For examples Bechtel Calculation M-08-093-02, Auxiliary Feedwater System Control Valve Sizing, Rev.1, July 31,1981 did not identify ihe source of '

assumptions and input data such as main steam safety valve setpoints, relief valve accumulation, auxiliary feedwater pump flow, and pump discharge pressure.

The calculation made a general reference to FPL's Although this Turkey Point Unit 3 and 4 Plant Data Book, Volume 1.

document is not a design document,it appears that it was used as a source document for design input.

Response IE C.4.a.:

Bechtel Calculation M08 093-02, Revision 1, referenced Volume 1 of the Plant Data Book as a source of design input. The purpose of this calculation was to determine the required differential pressure to be maintained by the flow control valves under various postulated flow conditions. Although it is l

recognized that the Plant Data Book is not a controlled document,it was used as a general reference in the calculation and no other applicable design document was referenced. During preparation of the c=IM= tion, the validity of the input data was independently verified by review of controlled design information. However, this validation process was not documented in the calculation.

In response to the NRC concern, the input data used in the calculation has been traced to established source documents to document the validation process.

The input data used in the calculation was confirmed to be correct and the Calculation M08-093-02 has calculation results and conclusions remain valid.

been updated in Revision 2 to indicate references to appropriate source documents. Use of independent verification for controlled design information will be documented in future calculations, and audited by QA as appropriate.

Item til C.4.b.:

Bechtel Drawing 5610-P-151, Piping Isometric Auxiliary Feedwater System Pump Discharge, Rev. O, November 1,1931, had incorrect valve weights shown for AFW valves CV-3-2318, CV-3-2316, and CV-2-2317. The team confirmed that the valve weights identified on the vendor valve drawing were on Bechtel Drawing 5177-162-P-325, Rev.1, dated May 16,1983, and that these weights were used in the piping stress analysis. During the inspection, FPL initiated an External Request for As-Built Verification and Document Review to correc' the identified discrepancies in the Bechtelisometric drawings.

Response ID C.4.b.:

Drawing 5610-P-151 contains a table which listed the valve and operator weights for all the valves shown on the isometric. In the case of the flow control valves (CV-3-2816, CV-3-2817, CV-3-2818), the valves had been 5177-162-P-325.

removed from the drawing (shown in phantom only) ard were shown on DrawingHo Thus, of the old valves and operators were not removed from the drawing.

there was conflicting information for the valve and operator weights. A review of the stress analysis confirmed that the correct valve weight had been used.

The oversight occurred when the drawing was prepared.

4

Thl2 error did not have a safety impact on the plant since the correct valve weights were used in the strew analysis. Drawing 5610-P-151 will be revised by the FPL Drawing Update Group to remove the incorrect valve weights. l Program changes are currently being proposed by the Drawing Update Group to l improve drawing accuracy. These changes are scheduled to be implemented by the and of 1986.

i Item til.C.4.c  ;

Bechtel Calculation M-08-093-03, Auxiliary Feedwater Flow at Minimum Steam Conditions, Rev. O, May 4,1982, references FPL Plant Data Book, Sections 5.6 and 5.7, for pump performance ratings. As stated above (subparagraph a), the Plant Data Book is an uncontrolled document and is not considered a suitable source for design input.

Response III .C.4.c.:

Bechtel Calculation M08-093-03, Revision 0, referenced Sections 5.6 and 5.7 of the Plant Data Book. The purpose of this calculation was to determine the performance requirements and capabilities of the Auxiliary Feedwater Pump and Turbine at the point that the RHR System is actuated. It is recognized that the Plant Data Book is not a controlled document and, as a matter of course, any data obtained from the Plant Data Book is independently verified to be correct. However, this verification process was not documented in the calculation.

In response to the NRC concerns, the input data used in the calculation has been traced to established source documents to document the validation process. The input data used in the calculation was confirmed to be correct and the calculation results and conclusions remain valid. Calculation M08-093-03 has been updated in Revision 1 to include references to appropriate source documents. As stated in Response 111. C.4.a., use of controlled design information will be documented in future calculations, and audited by QA as appropriate.

Item III.C.4.d FPL calculation, Low Level Alarm on Condensate Storage Tank, dated November 15, 1979, does not identify all of the assumptions and design inputs used to perform the calculation. The calculation was performed to establish the alarm setpoint alerting the operator in the control room of the need to provide makeup water or transfer to an alternate water supply in order to

prevent a low pump suction pressure condition from occurring. The team found no evidence in the calculation that the preparer considered the NPSH required to maintain AFW pump operation. Instead, the preparer appeared to have assumed that the minimum NPSH would be below the instrument tap, because the analysis calculated the height above the instrument tap which corresponds to 20 minutes of water at a usage rate of 600 gpm with a 10% factor for conservatism. The team independently confirmed that the NPSH is well below the instrument tap and the design is not deficient. However, the calculation did not document assumptions nor identified those assumptions that required verification as the design proceeded. The calculation did not define the design bases and their sources. FPL procedures in place at the time this calculation was performed required a design analysis to contain this information (Quality Instruction EPP-Ql-3.1, Control of EPP Design, Rev. 2, October 9,1979).

.- --- = _ _ - .

Response III C.4.d.:

Engineering has found evidence on the microfilm records which indicates that NPSH was considered in the original calculation. However, this consideration for NPSH was not documented in the FPL calculation dated November 15,1979.

Calculatlun M08-462-01, dated October 1,1985, was recently performed to confirm that the required NPSH water level for flows anticipated at the end of the cooldown transient is beloaw the instrument tap level as assumed in the original calculation. The new calculation confirmed the results of the original calculation, and therefore the equipment and maarlated condensate tar & level setpoints are acceptable. Enhanced documentation of calculation assumptions will be pursued as stated in Response 111 C.4.

Item III.C.4.e:

Bechtel Drawing 5610-M-339 Sheet 1 of 1, Rev.15, incorrectly shows that the  ;

nitrogen system pressure Control Valves PC-3-1706, PC-3-1708, PC-4-1705, and i PC-4-1709 were set to provide 55 psig. These pressure control valves were set l for 80 psig.

Response 111 C.4.e.:

The pressure control valves were originally set at 35 psig based on the original l design of the plant which was not changed by the modifications made under PCM-80-l!7. Drawing 5610-M-339, Sheet 1 of I reflected this setpoint. Although this setpoint was acceptable based on vendor confirmation, the setpoint was adjusted to 30 psig by FPL after PCM 80-117 was implemented, to coincide with the normal air pressure operating range specified on the flow control valve data sheet. Due to an administrative oversight, this change was not incorporated on the referenced drawing. ,

The pressure setpoint shown on Drawing 5610-M-339 Sheet 1 of 1, Revision 15,is not a safety concern since the valve can operate at pressures significantly less than 55 psig based on previous discussions with the vendor and actual tests in the field. Therefore, the oversight did not affect the operability of the Auxiliary Feedwater System. As was stated in Response IH C.4.b., changes are currently being proposed by the Drawing Update Group to improve drawing accuracy. These changes are scheduled to be implemented by the end of 1986.

Drawing 5610-M-339 and the associated instrument index sheets will be revised to reflect the current valve setpoint of 80 psig.

l l Item Ill.C.4.f The Auxiliary Feedwater System Description and Design Bases document dated i January 31,1985 had the following errors.

O The system description stated that an air signal is supplied by a i differential pressure controller which is set to maintain a minimum pump discharge pressure approximately 120 psi higher than the steam supply pressure. As observed during the inspection, this design feature had been disconnected (see Operations and Surveillance Observation 8).

l O The systr n description incorrectly stated that when instrument air pressure drops below 55 psig (nitrogen regulator valve outlet l l

)

pressure), check valves open to automatically supply backup nitrogen. As stated previously, the pressure control valves were set at 80 psig.

O The system description incorrectly stated that the low pressure nitrogen alarm will allow about 10 minutes for the operator to get to the station, close off the first bottle and cut in Bottles 2,3, and 4, which will each provide about a 30 minute supply to the flow control valves. This description appeared to refer to the intended operation of the nitrogen station before the station was divided into two trains

, with three bottles in Train I and two bottles in Train 2. The described action would vloirte the single failure criterion.

Response III C.4.f.:

The Auvillary Feedwater System Description and Desip Bases document discusses the differential pressure controller used to maintain a pump discharge pressure approximately 125 psi higher than the steam supply pressure. However, the document also states on Page 4 that " specific differential pressure controuers have been remcied ". The system description is correct in this regard and does not require revision.

As discussed in Response IU.C.4.e, the 55 psig nitrogen pressure regulator setpoint was not revised on Drawing 3610-M-339 due to an adminstrative oversight. Consequently, this pressure setpoint was also referenced in tie design bases document. This discrepancy has been corrected in Revision I of the document.

The NRCS conclusion that the system description incorrectly described the required operator action upon receipt of a low pressure alarm does not reflect the actual system configuration. The described operator action to close off the first bottle and cut in Bottles 2, 3 and 4 was written with full cognizance of split nitrogen system. Bottles I and 5 are the normally valved open bottles in the split system. The operator action described in the document is correct and does not violate the single failure criterion. There are five bottles in the nitrogen station for each unit. Three bottles are aligned to one train and two bottles to the opposite train. A manual isolation valve provides separation

! between the bottles in the two trains. The design documents and the system l

description are correct in this regard and do not require revision.

Item III.C.5.2 PCM's 80-78 and 80-79 were reviewed. These PCM's addressed the diversity of the power supplies to the steam admission valves of the Auxiliary Feedwater system. The steam supply for the auxiliary feedwater pump turbines is developed in the steam generators and fed to the station common auxiliary feedwater turbine pumps through six steam lines associated with the six steam generators (three steam generators per unit). Each steam generator is isolated from the steam header with a normally closed motor-operated gate valve.

These valves are powered from a safety-related power supply (two motor-t operators per unit are DC powered and one is AC powered) and will Downstream automatically open upon an auxiliary feedwater initiation signal.

t of these steam admission valves, steam vents are provided to vent off steam that may leak past the isolation valves. The following observations were made during the review of the modification package:

l -. - -- .__, _

. . - ~ .- - - - _ - - - - . _ . -. _ _ _ _ _ .-

k f

item Ill.C.5.a.:

The modification of the motor-operators on the steam supply valves involved These motor starters were specified q the purchase of new DC motor starters.

4 and purchased by Material Requisition 5177-86-E-818-4. These starters were to be supplied complete with motor overload heaters compatible with Limitorque operators. The team reviewed the motor starter vendor's drawings to

{

determine the overload heater size supplied and to verify that the type of overload heater installed agreed with the drawing.

In response to a team request for criteria and the calculation used to determine the size of the motor overload heater needed to protect the steam supply valve motors, the licensee produced a preliminary Calculation 5177-462-E-02, prepared on September 6,1985 (i.e., prepared during the inspection), to demonstrate that the as-installed motor overload protection would not trip the valve motor for continuous currents below 9.19 amperes. From inspection of the motor nameplate data, the team determined that these DC motors are 5 minute duty rated motors and the fullload current is 6.5 amperes. This results The team independently in a trip point 140 percent of full load current. inadequate determined that the setting of the overload devices provided overload or stall protection for the motor-operators. The team also confirmed this conclusion with the motor-operator vendor's engineering department.

The team's concern was that the motor insulation could be damaged during normal plant operations or periodic testing because of inadequate overload protection. This could result in the inability of the DC motor-operated valves t erform their safety function during a design basis event.

In an attempt to determine the generic implications of this issue, the team requested the Bechtel criteria used to determine the overload protection for No basis the existing AC motor-operated valve on the third steam supply line.

for selection of the overload protection of these motor-operated valves at Turkey Point was provided during the inspection.

l The failure of the design organization to verify the adequacy of the overload protection specified for the DC motor operated valves is contrary to ANSI N45.2.ll-1974 Section 6.3 which requires that specifieu parts and equipment be suitable for the required application. This item will remain unresolved pending followup by the Region 11 Of fice (50-250/8532-12; 50-251/8532-12).

I Response III C.5.a.:

' The concern's identified by the NRC regarding overload heater sizing are not consistent with Turkey Point origmal design criteria nor Regulatory Guide 1.106.

l The motor-operator vends (Limitorque Corporation) published IEEE Paper F79669-3 in 1979 providing recommendations for sizing overload heaters to provide maximum protection for the operator motor. These recommendations i are not applicable to Turkey Point for several reasons:

1 0 Turkey Point Units 3 and 4 were in commercial operation for several years prior to the issuance of the Limitorque overload heater sizing recommendations. Overload heaters installed during original plant construction were sized by the motor starter manufacturer using his standard sizing criteria and the applicable plant motor data. This practice is still in use at Turkey Pomt and was the method used for sizing overload heaters for the subject motor operated valves.

Turkey Point has made no commitment to utilize the Limitorque sizing recommendations for reasons detailed below.

o Operating experience with thermal overload heaters for motor operated valves resulted in the issuance of NRC Regulatory Guide IJ06. The Regulatory Guide discusses the problems inherent in applying overload heaters for motor operated valves and provides guidance directed at ensuring the thermal overload devices will not needlessly prevent the motor from performing its safety faction.

In brief, the Regulatory Guide recommends the criteria for establishing the overload trip setpoint should be to complete the safety faction rather than protect the motor from overheating effects. While Turkey Point has not committed to compliance with Regulatory Guide IJ06, the overload heaters for the subject AC and DC motor operators are in general compliance since the overload heaters have a higher trip point than would be selected by following the Limitorque recommendations.

• An evaluation was performed utilizing the Limitorque sizing recommendations and various battery voltages to determine the overload heater trip settings. This evaluation determined that no single overload heater size could provide assurance that some degree of motor overheating or damage would not occur whileGiven also ensuring that the motor will perform its safety function.

these conditions, Regulatory Guide 1.106 recommends the trip setpoint of the overload heaters should be established with all uncertainties resolved in favor of completing the safety function.

Overload heaters are typically sized and supplied by the starter manufacturer on the Turkey Point Project, and calculations are not performed to size overload heaters when the responsibility for providing the overload heaters is For this assigned to the manufacturer through the procurement specification.

reason, a ca!culation was not immediately available for the NRC's review during the inspection. Calculation 5177-462-E02 was prepared during the inspection to demonstrate the acceptability of the installed overload heaters.

This calculation has been revised to include the above items and will be retained in the project calculation books. As stated in Response III C.4., quality programs relating to the preparation and control of design documentation are under review.

Item lil.C.5.b.:

Implementation of the design change process failed to verify that the design change did not violate the original design function.

i

' The proposed cable routing for Motor Cable 4DO12BQ from Motor Starter  !

3N1403 to Steam Valve MOV-3-1403, as shown in the cable and racewayThe team requ 12 wire.

1 schedule, was 73 feet of 5 conductor AWG No. j the sizing criteria and supporting calculations that would indicate that the i During the second week of the inspection, the conductor size was sufficient. i licensee produced a calculation, dated The September calculation 10, 1935,during was prepared with nothecalculation  :

number or file identification.

1 inspection and appears to have been performed in response to the team's

concerns about the adequacy of the wire size. No earlier calculation could be located at Bechtel's offices either on-site or in Gaithersburg, Maryland. The calculation used as installed cable lengths obtained from Bechtei's $177-E-45C Electrical Circuit Schedule and motor data from the Limitorque data sheet.

Although this motor data did not agree with the motor nameplate full load current, its application in this calculation was judged to be conservative by the team. The calculation demonstrated that the cable's ampacity and short circuit withstand capability were adequate. However, the calculation stated that the cable resistance was sufficiently low so that the voltage drop was not a concern because voltage at the worst case valve (MOV-4-1403) would remain above 96 volts DC. The team questioned this conclusion because Bechtel had failed to consloer starting current.

The team contacted the actuator manufacturer directly and confirmed that starting current and the resulting voltage drop to the motor must be considered because the valve was tested with only 90 volts DC as the minimum starting voltage. To assess the effect of starting current, the team substituted the

published 53 amperes locked rotor current obtained from the Limitorque data sheet for the 8 amperes full load current used in the Bechtel calculation. The team determined that the voltage would be less than the required minimum 3

starting voltage of 90 volts for MOV-4-1403.

i The team is concerned that during a loss of offsite power and the resulting DC system voltage drop, inadequate voltage would be available at the motor terminals resulting in a stall condition and a failure of the DC motor-operated valves to perform their safety function.

The failure to adequately understand the requirements of the original design and to confirm that those requirements were met with the new design is contrary to ANSI N45.2.ll Section 6.3 and 8.2. This item will remain unresolved pending followup by the Region 11 Of fice (50-250/8532-13: 50-251/8532-13).

Response IR C.5.b.:

Research of available records during the inspection could not locate a formal project calculation demonstrating the adequacy of the installed cable size.

However, one sheet of a multi-page preliminary calculation to determine the cable size was subsequently located in the project files. This calculation sheet, in addition to the proven suitability of the 'mstalled cables, provides evidence that the conductor slae was previously evaluated. Calculation 5177-462-E01 was prepared during the inspection to addeess the NRC's concerns with the cable sizing. This calculation was revised, independently checked and reviewed by the Electrical Effi.;;.ing Staff, subsequent to the inspection, to demonstrate that the motor will start under all required conditions, including consideration of a very conservative starting current of 53 amps. The actual starting current at a reduced voltage would be less than 53 amps.

As stated in Response IH C.4., quality programs relating to the preparation and control of design documentation are under review.

Item III.C.5.c:

i

The control circuit schematic for the DC and AC motor-operated steam isolation valves shows that the control switch used in the circuit is a

momentary open/ closed return to normal control switch. As a consequence, this switch will not stop the valve from automatically reopening following an operator's attempt to shut the valve as long as an auxiliary feedwater initiation signal is present. The licensee had not recognized this design feature (see Operations and Surveillance Observation 1.d for further discussion).

Response !!! C.5.c.:

l The control logic for the motor-operated steam isolation valves was an original plant design feature and was not modified by the PCWs for the Auvillary l Feedwater System. Isolation of the steam supply is only a concern in the event l of a tube rupture in a steam generator. Operator guidance to close the steam isolation valve from the affected steam generator was not included in the

, original operating procedure due to a misinterpretation of the control switch design features by the procedure writer. A procedural discrepancy of this l nature would not typically be identified in the design process since the l modifications made to the system did not affect the original control logic for l the valves, and there was no identified need to review the adequacy of the l original operating procedures.

As long as the Auxiliary Feedwater System initiation signal is present, the motor-operated valves will stay open. One solution to overcome this is to rack out the power to the motor-operated valve and manually close the valve. In addition, there are manual isolatior, valves on each line which could also be closed. It is reasonable to assume that the operators would have noticed the valve position through direct position indicators in the control room and would have taken the necessary action to isolate the steam supply in an expedient manner even though the operating procedures did not provide specific guidance.

The FSAR analysis for the steam generator tube rupture accident in Section 14.2.4, assumed 30 minutes to isolate the steam generator. The radiation release during this period would be well within the design basis for the plant.

Based on this and the various options available to the operator as described above, we do not feel this error involved an undue risk to the public health and i

safety. Nevertheless, Operating Procedure 20003 has been revised to alert the operator to close the manual steam isolation valve to the affected steam i

generator.

Item Ill.C.5.d:

PC/M 80-117 added a second steam vent valve between sne steam admission valves and the auxiliary feedwater pump turbines. The original header design contained an air-operated, DC solenoid controlled steam vent valve whose purpose was to vent steam that may leak by the normally closed steam admission valves. The vent is normally open and closes when the DC solenoid is energized through a pressure interlock. When the steam supply header was separated into two headers, an additional vent valve was added. The solenoid for this new valve must be energized to close the valve; however, the valve was powered from an AC source. The team is concerned that on a loss of AC power the open vent on the Train 2 steam header will result in a path for steam loss.

i

Response 111 C.5.d.:

The non-safety related claulfication for the steam vent valve added under PCM 80-117 is consistent with the original design basis for the plant. As such, there was no reason to power the steam vent from a DC power source. As discussed previously in response to Item IILC.2.d, a detailed analysis has been performed which confirms the capability of the Amtliary Feedwater System to operate at all steam pressure conditions when the vent valve failed open. On this basis, powering the valve from an AC cource is considered acceptable.

Item lli.C.6:

The design of the nitrogen system failed to provide the required separation in the low nitrogen pressure alarm circuit. Alarms are provided on the redundant nitrogen system to warn the operator that he must take action to maintain the nitrogen system's ability to position the auxiliary feedwater flow control valves.

The team determined that the low pressure signals from Pressure Switches PS-3-2322 (Nitrogen Train 1) and PS-3-2323 (Nitrogen Train 2) feed adjacent control room annunciator windows. Associated pressure switch contacts must close to alarm. The team determined that the two signals share a common field wire (Cable 3R38/3C05-TB3414/1 is a 3 conductor cable with wire AN38 common to both alarm circuits).

The team is concerned that a single failure, such as a loose or disconnected wire could result in the common mode failure of all low pressure alarms for the redundant nitrogen system. Further, this design appears to be contrary to the redundancy and separation requirements of ANSI N45.2J1, Section 3.2. This item will remain unresolved pending followup by the Region 11 Office (50-250/8532-14; 50-251/8532-14).

Response III C.6:

As noted in the response to Item III.C.2.c, the design modifications for the Auvillary Feedwater System utilized the pressure switches and annunication system installed under the original plant construction, which were neither designed nor maintained as nuclear safety-related. As a result, the separation criteria for these components was not changed from the original design basis of the plant, and ANSI N45.2J1 does not apply.

Item 111 C.7.:

i The team reviewed PC/M 83-05 concerning replacement of the safety-related station batteries. The auxiliary feedwater system uses direct current motor-operated valves and control systems whose power is derived from the station batteries. Turkey Point Units 3 and 4 share safety-related batteries such that the DC power for some of the Unit 3 auxiliary feedwater components is derived from the Unit 4 batteries. The converse is true for Unit 4 auxiliary feedwater components. The following observations were made during the review of this modification package.

Item III.C.7.a:

The safety-related battery system which existed before PCM 85-05 consisted of four batteries, two per unit. Unit 3 had one C&D battery rated at 1885 ampere-hours and an EX1DE battery rated at 648 ampere-hours. Unit 4 had one C&D b7ttery rated at 2175 ampere-hours and an EXIDE battery rated at 648 ampere

-4b

hours. With PCM 83-05, the 1885 ampere-hour and 2175 ampere-hour C&D batteries were replaced with smaller Gould-GNB 1800 ampere-hour cells. The 648 ampere-hour EXIDE batteries were replaced with larger Gould-GNB 1200 ampere-hour ce!!s. These new batteries were purchased using Bechtel Specification 5177-272-E-850.1, Rev. O, dated January 18,1983. This document contained a one-hour battery load profile and required corrections for a minimum electrolyte temperature of 550F and an 80 percent end-of-life compensation in accordance with IEEE Standard 485. This specified load profile did not agree with that given in FSAR Table 8.2.4. The team noted that the DC loads listed in this table did not include the au91ary feedwater DC motor-operated valves. In an attempt to determine if all DC loads were accounted for in the sizing of the new replacement batteries, the team requested the battery sizing calculations.

The licensee was unable to produce an analysis or calculation which was used to develop the load profile used in the procurement specification. However, the licensee did exhibit a DC system capability study, Calculation 5177-399-E-01, which was performed by Bechtel during the first half of 1985. The purpose of this study was to determine the capability of the DC system to respond to the unavailability of selected batteries under different operating conditions. In Case 1 of this study, each battery was checked with its own emergency loads.

This calculation did include loads for the auxiliary feedwater DC motor-operated valves; however, it assumed data based upon a preliminary 1980 calculation and not on manuf acturer's data or the equipment nameplate data.

This calculation included inappropriate assumptions for the steady-state load by basing this load on battery charger readings under normal operating plant-conditions. The calculation did not identify these as assumptions requiring verification. This calculation also did not include design margin correction factors for temperature or inadequate maintenance as required by IEEE

. Standard 485.

Response III C.7.a.:

We have reviewed the NRC concerns identified above, and agree that an analysis or calculation used to develop the battery load profile could not be located for the reviewer's inspection. When the replacement batteries were procured, existing Calculation 5177-099-E-01 for the loading on the DC System was used as the basis for determining battery requirements. An informal calculation was prepared at the time the batteries were specified, which modified the existing calculation in three main respects, as follows:

• Continuous loads were revised to include the full inverter capacity rather than actual measured value, due to anticipated TMI additions.

O Turbine emergency bearing oil pump and seal oil pump loads were deleted due to their planned transfer to the new non-vital batteries. ,

0 4KV switchgear tripping and closing currents were doubled to l

account for alternate feeds to the opposite unit.

I l

Although this calculation was never formalized, we can accosmt for the existence of the informal c=Ica'= tion by references made to it in both l l

Electrical Engineering Staff's review comments on Specification 5177-272-E- l 850.1 for the replacement batteries, and in Project Engineering's response to '

those comments.

-4 5-

In order to verify that this approach was used, we have recreated the modified load profile and compared the results with the load profiles included in the hattery specification. It should be noted that the specificationsince included only these are two profiles, one for 3D24 (4D24) and another for 3D03 (4003) the most heavily loaded batteries. The profiles represent the worst case of the two batteries. The results of this review are provided below:

Interval I-59m 59-60m 0-Imf Battery 3D24 545^ 248A 534^

Spec Values 530^

536A 244A Recreated Values l

Battery 3003 881^ 434^ 803^

Spec Values 792^ I 857^ 423^ i Recreated Values 1 As seen from this comparison, the results are very close w?*h the differences attributed to minor differences in assumed loads at the time of the batt,ery sizing and the actual loads used to recreate these values. )

Based on the technical evidence presented during the inspection, the NRC l review team did not question the capability of the batteries to perform their l design function. However, as noted in the finding, the review team was unable  ;

to determine the degree of margin existing in the new batteries. In recognition 1 of this, the following steps were taken to demonstrate and confirm the available margin in the new batteries.

o Calculation 5177-399-E-01 performed as part of a DC System Ca bility Study demonstrated a n.inimum margm of 87 percent for the most loaded battery (3003). This calculation based steady-state loads on field measurements rather than review of design drawings, so the calculation is not considered conservative.

i O A study was performed by Electrical Staff based on Calculation I 5177-399-E-01 and review of design drawings. This study considered aging and worst case (550F) temperature effects in addition to provision for future loading of the vital AC inverters to their rated )

output. (The inverters are presently operating at approximately 1/2 )

of rated output.) This study indica,tes an extreme worst case margin of approximately 20 percent for the most loaded battery (3D03). l O A new project calculation is being developed for the station batteries. The battery loading tables are being developed from design drawings and will be checked on project and independently verified by an Electrical Engmeering Staff review. This calculation will be prepared by February 14, 1986 and utilized to update the FSAR tables af ter completion.

This finding is not considered to be safety significant since the batteries have been demonstrated to have considerable margin under worst case conditions.

However, as stated in Response III C.4., a review of existing quality programs relative to preparation and control of design documents, is being performed.

-4 6-

Item til.C.7.b:

The design modification process failed to include adequate acceptance criteria and verification testing for the new batteries. The purchasing documents specified required testing by the battery manufacturer. Gould-GNB performed a standard eight hour capacity test which inowed that the batteries would deliver at least their eight hour rated capacity. This test stopped short of determining any margin above rating (Inspection Report 83779 dated May 5, 1983). The manufacturer also performed a load duty cycle test on selected &lls in accordance with the specified load profile, but failed to correct Ae discharge rates for the specified minimum temperature condition. The pm t-modification testing performed on the Unit 3 B Battery (Plant Work Oet.r 358353) tested the new battery using the FSAR half hour profile, not the one hour duty cycle of the specification. Again, no temperature correction us made to the discharge rate as indicated on the July 12,1985 data sheets.

Because of the lack of an acceptable load analysis combined with inadequate

' testing, the team was unable to determine the degree of margin existing in the new batteries.

Response ID C.7.b FP&L believes that acceptance criteria and verification testing for the new batteries were adequate. Although the capacity tests were not continued past the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> required time, they did demonstrate the ability to sustain the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> discharge rate for a full 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. In other words, the battery has a minimum of 100 percent of its rated capacity. Extending the test until the minimum allowable volt / cell is reached may be of interest to determine how much "over-built" a particular cell is, but is not in itself a necessary requirement to establish a battery's capability to meet its design conditions.

The capacity test discharge current was not corrected for ambient temperature as suggested by IEEE 450. The test results do, however, show that in all cases, the test ambients were below the 770F rated capacity temperature. As a result, the correction for temperature would have been in a direction to reduce the test current and thus be a less rigorous test. Due to the battery's

demonstrated ability to pass the capacity test with this higher discharge current, the lack of specific temperature correction is conservative.

As with the capacity test, all of the load profile tests were conducted at .

j ambients below 770F. This negates the need for adjusting the test currents to account for temperature effects. Conservative results were achieved.

Item til.C.7.c:

The plant operating procedures for the DC System failed to reference the specific periodic testing requirements for the new Gould-GNB batteries. Plant Operating Procedure 96041.1, dated June 19,1985, specified the requirements for the monthly equalizing charge. However, the new Gould-GNB batteries are 4

composed of lead calcium cells, and this type of battery cell should not be given monthly equalizing charges. Instead, they should only be given an equalizing j charge when required in accordance with the manufacturer's recommendation.

Further, this operating procedure references the instruction manuals for the old batteries and dces not reference the new Gould-GNB instruction manuals. Also,

this procedure calls for different float and equalizing voltages for the two new ,

Unit 3 batteries. These batteries are both made up of Gould-GNB NCX type cells and should have the same charging voltages.

Plant Operating Procedures 9654.1 and 9654.2, dated November 8,1984, describe the load test procedures for all four safety-related batteries. Again, these procedures only refer to the C&D Batteries Instruction Manual (even through batteries 3B and 4A were originally EXIDE batteries) and do not reference the new Gould-GNB instructions. Additionally, the description of the battery load test profile used in these procedures uses the 30 minute FSAR profile also without compensation for minimum electrolyte temperature requirements.

, The team could not find plant operating procedures describing a battery performance test to determine actual battery capacity compared to rated capacity (as recommended by IEEE Standard 450).

The apparent failure to establish and implement technically adequate procedures for the new station batteries will remain unresolved pending followup by the Region 11 Of fice (50-250/8532-15; 50-251/8532-15).

Response IH C.7.c.:

The plant Electrical Maintenance Department had previously determined that Plant Operating Procedure 96041.1 was inadequate and a request for a procedure change was submitted to the Procedure Update Project (PUP) on May 13, 1985.

The updating of this procedure and Operating Procedures 9654.1 and 9654.2 has been expedited and is expected to be completed by January 15,1986. These procedure changes will correct the concerns associated with references to incorrect instruction manuals, different charging voltages and lack of compensation for electrolyte temperature and level. However, these procedure changes will not address the concern on the monthly equalizing charge smce existing Technical Specification 4.8.2b requires that a monthly eg=llring charge be performed. A Technical Specification change will be prepared and submitted by February 1,1986.

Regarding the issue of a battery capacity test procedure, as recommended by IEEE Standard 450, we have determined the following: IEEE standard 450 states that a battery capacity test "should be made within the first two years of service" and therefore would not have to be performed prior to installation of new batteries. Since Turkey Point has a shared DC system, the current Technical Spelfication only allows one battery to be out of service for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for operation of either Unit 3 or 4. Additionally, however, as part of our efforts to incorporate the Standard Technical Specifications, we are evaluating the performance of a battery capacity test not currently required by the present Technical Specifications.

Item til.C.8:

4 The team had a significant concern that excessive reliance was placed on operator action instead of design features to ensure the proper functioning of l

. ,e the auxiliary feedwater system. Specifically, the team was concerned that immediate operator action may be required upon initiation of the auxiliary feedwater system following a loss of main feedwater and reactor trip with a concomitant loss of the non-safety related instrument air supply. Although the auxiliary feedwater system is designed to automatically initiate, design calculations do not exist which demonstrate tht; the system will continue to run for a period of time without iramediate operator action. This concern is,in part, based upon the lack of design analyses to support nitrogen system design details and the need for immediate operator action inherent in the design of the nitrogen system. This concern is based upon the following observations:

O Lack of design analysis based upon the as-installed system to

< document the setpoint selection for pressure switches used to alert the operator that ten minutes of nitrogen remain before loss of motive air control pressure (i.e., closure of flow control valves and loss of all feedwater).

O Lack of design criterion to define how long the Auxiliary Feedwater System has to operate without operator action. Consequently, no guidance was provided to establish operating limits on available n"rogen supply before reaching the low level setpoint.

O Lack of engineering direction with respect to post-modification testing requirements to confirm the adequacy of the installation to design bases.

Response 111 C.S.:

The required operator actions related to the split nitrogen backup system were consistent with the original design basis and procedures for Turkey Point, as originally defined 5 PCM 80-117. Oscillations in the flow control valves, due to the removal of the differential pressure controllers and reduction in the design flow rate resulted in an increase in the nitrogen demand for the valves. FP&L has pursued resolution of this problem in a systematic manner through coordination with its architect-engineer. The NRC concerns related to operator actions are based on an evaluation of the system assuming worst case oscillation of the valves. This problem was identified by FPL prior to the inspection and design modifications were in progress. Howeve , to specifically address the above three observations, the following is provided:

Pending modificatiove to eliminate the valve oscillation problems, a reanalysis of the nitrogen system, based m a revised setpoint of 1350 psig, has confirmed that a minimum of ten minutes is avallahle for the operator to valve-in bottles upon rM'; the low pressure setpoint based on a conservative assumption valve oscillation and with no credit ,taken for placing the valves in the manual ,

mode. The low pressure alarm has teen temporarily reset in the field to this revised setpoint, and the appropriate design documents are being revised.

In response to the NRC concerns related to engmeering direction for post-modification testing, it should be ngW lhat the need to confirm the adequacy of new installations to the establisw.J design bases by testing has been more clearly understood since the Auxiliary Fee (water System modifications were designed in 1983. Engineering instructions governing the preparation of design

~ . o modification packages were revised to require the identification of post-modification testing. Prior to this change, the necessary post-modification testing was defined by plant operations and startup personnel during their review of the PCM, consistent with procedures in place at that time. In addition, Bechtei and FPL are currently reviewing existing procedure, as well as operations and 'startup needs, to identify additional improvements in the interface between these departments.

O As stated in Response III C.2.b., the test conducted in March,1984, for the N 2iow Pressure setpoint setting, is considered a satisfactory method of determining setpoints, in lieu of a design analysis.

However, post-modification testing, including reevaluation of setpoint settings, will be enhanced through implementation of the Standard Engineering Package Program, scheduled to he released and implemented as stated in Response II A (Safety Effects on AFT System).

O Issuance of the AFT System Description and Design Bases, Revision 1, document addresses the design criterion issue for the AFW system. In addition, FP&L is performing a reconstitution effort for safety system design bases, to be done in conjunction with the two-phase Safety System review discussed in the cover letter to this report response.

O Post-modification testing adherence to design bases will be enhanced through implementation of the Standard Engineering Package Program.

Item III. D. QUALITY ASSURANCE Item III D:

A review of the corporate and site quality assurance auditing activities revealed tht these audits, as implemented, neither had identified nor were capable of identifying quality concerns of a technical and operational nature similar to those concerns identified during this NRC inspection. Both the corporate vendor audit and the plant audit programs were designed to assure that QA programs met NRC requirements and licensee commitments from a programmatic basis only. The following are examples of audits conducted by 1

corporate and site QA staffs that failed to identify any of the significant weaknesses identified during this inspection.

1 Audit Numbers Activity Audited OS.01.DTLMD.34.1 QA program including design control (BPCO)

QAS-EPP-33-1 Power Plant Engineering Q AS-3 PE-34-1 QAO-PTP-84-549 Training QAO-PTN-35-657 QAO-PTP-32-10-421 Plant Change-Modification QAO-PTP-34-534

< , e The lack of an implemented corporate and site audit program providing for technical and operational reviews of vendor and plant activities meant that FP&L management was not receiving important feedback on the quality of activities affecting the safe operation of the plant. The team noted that recent Performance Enhancement Program initiatives were being implemented and Quality Improvement Program efforts were underway to address some aspects of these QA weaknesses. The progress of this effort will be tracked by the NRC Region II Office as part of their routine followup to the licensee's Performance Enhancement Program.

Response III 0_:

In order to acure a more comprehensive method of auditing the Architect Engineering (A/E) firms who perform engineering services for FPL's Nuclear Power Plants, the QA Department has initiated a new program for planning and conducting these audits.

This program calls for all A/E audits to be coordinated by the QA Procurement

& Reliability Group (QAP&R). In addition, each site QA Group, along with Power Plant Engineering will assign at least one person to work with QAP&R.

These people will work as a team, who will plan, schedule and conduct all A/E audits. During the course of preparing for these audits, it is expected that this team will solicit assistance from other FFL Departments or Groups as they deem necessary. These other groups could irclude the QA Systems and Audits Group, specialized people within Engineering, or any other group that could be of assistance in a specialized area.

In utilizing this team concept, each group will have the opportunity to assure their concerns are addressed. It will also enable the team to assure that all aspects of any concerns are addressed during the audit, which will assure a more comprehensive resolution to problems and more meaningful corrective action for the prevention of recurrence. This program was initiated on October 17,1983.

We concur with the NRC in that Quality Assurance audits of our engineering department have been focused primarily on programmatic matters. Audits i

referenced in the inspection report (QAS-EPP-83-1 and QAS-3PE-84-1) did, however, evaluate design activities such as a basis for applicability of analysis and the performance of design verification for several plant modifications that are identified in the checklist for the audit reports.

We do not normally issue the detailed checklist with our audit reports, the NRC team therefore, did not have the opportunity to review the checklist maintained as a QA record in our Juno Beach files.

The QA Department has been actively involved in developing the Turkey Point site QA Group (and overall Quality Program) into one which implements significantly more "real time" surveillances and monitoring of plant activities (as well as maintaining required programmatic audits), following the PEP commitments in mid-1984. The requirements for implementing these programs 1

j  ;

< .,e are such that the actual enhancements would not appear immediately, attributable primarily to required logistics associated with personnel acquisition and program implementation. The site QA group added four individuals during the latter half of 19g4. The individuals were selectively recruited to provide necessary expertise to perform surveillances, system walkdown, etc., and in general, be much more "in tune" with plant operations and related activities.

These individuals possess a combination of Navy operating experience, design engmeeting experience, college degrees, and previously held operating licenses.

These time requirements resulted in programs which did not begin to show effectiveness until early 1985. Currently we have programs underway which provide for significant attention to providing real time surveillance and assessments for performing safety system walkdowns/ assessments, for performing increased activity audits, and in general, keeping QA management much more involved with the day to day operating issues.

Our training program for 1985 focused on nuclear plant operations, including formal operator licensing training, reactor theory, system operation, design considerations, and simulator time for QA engineers.

Consistent with the training programs, our Quality program will continue to give greater emphasis to technically oriented reviews.

)