ML16342C277

loads listed in the

FSAR and

EDG loads established

in licensee calculations.

UNRESOLVED ITEM 91-07-04 - 2.6.3 - The methodology

and inconsistencies

contained

in calculations

126-DC, 7/25/83,

and

1956-DC, 5/17/91, for MOVs

require further-review during future

MOV inspections.

UNRESOLVED ITEM 91-07-05 - 3. 1.3 - The licensee

needed

to perform or obtain

calculations

to establish

maximum

EDG jacket water and lube oi 1 temperatures

under

maximum design

ambient temperatures

to ensure that vendor established

limits would be met.

In addition,

an evaluation of adequacy of the high

jacket water

and lube oil temperature

annunciator

response

procedures

was

needed.

Further inspection

was also required,

to determine

the adequacy

of licensee

nonconforming condition identification, evaluation

and

performance of any analysis,

and performance of any resultant corrective

action, for high EDG,jacket water

and lube oil temperature

alarms that were

experienced

during

EDG 1-1

STPM-96 surveillance testing performed in

November,

1989.

NON-CITED VIOLATION 91-07-06 - 4.1 -

EDG 1-3 radiator

door was required to be

shut

and locked but was found open.

The licensee

took prompt corrective

action

and the safety significance

appeared

to be minimal.

VIOLATION 91-07-07 - 4. 1 - Acceptance criteria contained

in one

surveillance test procedure

did not fully implement Technical

Specifications

surveillance

test reouirements.

Two other surveillance

procedures

contained

poorly written data

sheets

with unclear acceptance

criteria and were

considered

by the

team

as

a

WEAKNESS.

-3-

VIOLATION 91-07-'07 - 4.1;1 - Additional example - Procedure

STP-V302,

Revision 1, allowed

EDG air start system

check valves to leak 30 psig

in'0

seconds.

No documented

technical

basis existed for the acceptance

criteria.

The licensee

needed

to establish

an appropriate

leak rate

and

a documented

technical

basis for the leak rate.

NON-CITED VIOLATION 91-07-08 - 4.6 - Battery Charger

11 had

a ripple voltage

slightly above

the acceptance

criteria during performance of preventative

maintenance

on April 18,

1991

and

was not identified in an appropriate

non-conforming condition report.

However, the acceptance

criteria was

conservative,

the item had minimal safety significance,

the licensee

took

prompt corrective action,

and it appeared

to be

an isolated case.

VIOLATION 91-07-9 - 5.2 -

EDG l-l did not start,

get to rated

speed

and

voltage

and load within the

10 second

Technical Specification

time limit

during the March 7,

1991 Unit

1 loss of offsite power event.

The failure was

considered

an invalid failure, although the cause

had not been definitely

determined,

contrary to Technical Specification 4.8. 1. 1.1.2.a

and Regulatory

Guide 1.108.

EXECUTIVE SUMMARY

DETAILS

TABLE OF

CONTENTS

PAGE

1.0

2.0

3.0

4.0

5.0

6.0

7.0

8.0

BACKGROUND, OBJECTIVES

AND METHODOLOGY

ELECTRICAL SYSTEMS

2. 1

Offsite Grid and

12

kVac Systems

2.2

4160

V ac Class

lE System

2.3

Emergency

Diesel

Generators

2.4

480

V ac Class

1E System

2.5

120 V=ac Class

1E System

2.6

125

V dc Class

1E System

2.7

Protection

and Coordination

2.8

Containment Penetrations

2.9

AFW Electrical

Syste~

MECHANICAL SYSTEMS

3.1

Diesel

Generators

and Auxiliary Systems

3.2

Heating, Ventilation and Air Conditioning System

3.3

Power

Demand for Major Loads

3.4

Auxiliary Feedwater

System

EQUIPMENT TESTING,

SURVEILLANCE AND MAINTENANCE

4.1

Diesel

Generator Testing

4.2

Relay Calibration Program

4.3

Setpoint Control

Program

4.4- Circuit Breaker Testing

4.5

Fuse Control

4.6

Charger

and Inverter Testing

4.7

Battery Testing

4.8

Equipment

Walkdown Inspection

4.9

Equipment Modification Review

ENGINEERING AND TECHNICAL SUPPORT

5.1

Identification of Nonconforming Conditions

5.2

Review of NCRs and Root Cause Analysis

5.3

~ Control of Vendor and Industry Information

GENERAL CONCLUSIONS

UNRESOLVED ITEMS

EXIT MEETING

4

~

7

11

14

16

17

19

20

21

24

25

29

30

31

33

34

35

36

Attachment

1, Persons

Contacted

Attachment 2, Inspection

Findings

37

38

0

EXECUTIVE SUMMARY

A, Nuclear Regulatory

Commission

(NRC) team conducted

an electrical

distribution system functional inspection

(EDSFI) at the Diablo Canyon Nuclear

Plant.

The inspection

was conducted

by personnel

from Region

V, Region IV,

the Office of Nuclear. Reactor Regulation

(NRR), and contractor

persohnel

from,

Atomic'Energy of Canada,

Ltd (AECL) from April 22 through June

10,

1991.

The

NRC team evaluated

adequacy of the design

and implementation of the

electrical distribution system

(EDS),

and the adequacy of associated

engineering

and technical

support.

The specific methodology is discussed

in

the next section of this report.

STRENGTHS:

There were

a number of strengths

noted

by the

team during the inspection.

For

example:

Engineering organizations

had reviewed findings of EDSFI inspections

at

other plants,

and

had aggressively

evaluated

the applicability of these

issues,

and initiated .corrective actions,

where necessary.

In general,

Engineering

appeared

to be technically competent

as

demonstrated

by the many calculations

generated

in'esponse

to team

questions.

An aggressive

vendor interface

program

had

been

implemented

to maintain

up-to-date

information on equipment installed in the plant.

E~n ineering Meaknesses

The following items were

some of the weaknesses

identified by the

team that

were considered

to demonstrate

poor or incomplete. technical

work and also

indicated

a weak

sense

of ownership of problems.

The 4160

V ac second

level undervoltage

setpoint

was set

such that 480

V ac

motor operated

valves

(MOV) and

120

V ac contactors

could not be

shown

to be operable at voltages just above the undervoltage trip setpoint.

The l.icensee's

engineering

organization

had not provided technical

direction or issued instructions

to the operations

organization

to ensure

continued operability during degraded

grid conditions.

In response

to

the

teams

concern

regarding

the continued operability of the

MOVs and

motors,

procedural

requirements,

to manually transfer to the

EDGs when the

trip setpoint

was approached,

were issued

by the licensee

during the

inspection.

Engineering

review, in response

to an

NCR, did not result in a

documented

technical

basis for the increased

4

KV IE breakers

short

circuit current ratings.

This occurred despite

the problem being caused

by

a previously supplied incorrect increased

rating for the

same breakers.

weakness

in the licensee's

calculation performance,

review and approval

process

was noted.

Many inaccuracies

in the load flow, voltage drop,

short circuit, etc., calculations

were noted that required reanalysis.

Similarly, non-conservative

assumptions

were noted in the

EDG fuel oil

consumption analysis.

The

EDG system design

basis

review was completed without identifying the

lack of a technical

basis for, nor confirmation of the adequacy of, the

air start

system

leakage criteria.

Three

EDG surveillance

procedures

contained

acceptance

criteria which

only partially implemented

the Technical Specification requirements.

Review of data did not identify EDG performance

outside of these

Technical Specification requirements.

Therefore,

EDG operability was not

considered

a concern.

The licensee

is implementing

changes

to the

procedures.

PROBLEM IDENTIFICATION AND TIMELY RESOLUTION

The following are

some of the weaknesses

identified by the

team in the

licensee's

problem identification and resolution

process

and implementation.

Evaluation of the validity of two fai lures of the emergency

diesel

generator

(EDG) were not performed appropriately,

contributed to by

the misquoting of Regulatory

Guide 1. 108.

During surveillance tests

on November

16,

1989, high temoerature

alarms

were received for jacket water temperature

and lube oil temperature.

However, the problem conditions

were not formally documented

and evaluated

by Engineering,

A fai lure of the inverter ripple voltage to meet acceptance

criteria was

not formally documented.

A failure to follow the procedure

to lock the

EDG radiator door was not

'formally documented within a week of the identification of the problem.

Since

an

NRC team inspection in 1988,

the minimum required

amount of EDG

fuel oil stored

on site

has not been

documented

in Technical

Specifications,

but in

a Justification for Continued Operation

(JCO)

supported

by calculations.

Although the licensee

agreed

in 1988 that

the appropriate

fuel oil volume required for operability should

be

included in Technical Specifications,

the issue

has

not been resolved in

a timely manner.

The licensee

stated

that the issue

would receive

increased

management

attention

as

a result of the concerns

identified in

this inspection.

CONCLUSIONS

In general,

the design of the

EDS and associated

systems

at Diablo Canyon

appeared

acceptable.

The team did not find any immediate safety/operability

concerns.

The team did not find any broad

scope

programmatic

breakdowns.

1.0

Background,

Objectives,

and Methodolo

at other utilities have observed that the functionality

of safety-related

systems

were compromised

as

a result of design deficiencies

introduced during initial design

and subsequent

design modifications of the

electrical distribution system

(EDS).

Consequently,

the

NRC initiated

EDS

functional inspections

to assess

the, capability of the

EDS to perform their

intended functions during all plant operating

and accident conditions.

The two main objectives of the Diablo Canyon

EDS team inspection

were (1) to

assess

the capability of the

EDS to perform its intended functions during all

plant operating

and accident conditions,

and (2), to assess

the capability

and

performance of the licensee's

engineerina

and technical

support organizations

in providing engineering

and technical

support.

In preparation for the inspection,

the team reviewed Diablo Canyon

FSAR and

Technical Specification requirements

and available probabilistic risk

assessment

information.

The team also reviewed both plant specific

and

industry historical information such

as

NRC Information Notices 91-06

(EDG

Lock-out), 91-29

(EDS Deficiencies),

NRC inspection reports,

Licensee

Event

Reports,

and

so forth.

The team selected

Bus

"G" as the inspection

sample

load path.

However,

because

of the

EDS system interaction

and the generic

nature of design,

installation, modification, testing,

and.other

processes,

the team also

inspected

many activities associated

with the other

two safety related

buses.

The team reviewed calc'ulations

and associated

documents

to ensure that

electrical

power of acceptable

voltage, current,

and frequency would be

available to safety-related

equipment

powered

from the station

EDS.

The

review included portions of the onsite

and offsite

EDS including the station

startup

and auxiliary transformers,

the

12

kV system,

the 4160

V ac Class

1E

system,

the emergency

diesel

generators

(EDG), the 480

V ac Class

lE system,

the

120

Y ac Class

1E system,

the station batteries,

and the

125

V dc Class

1E

systems.

The team also reviewed

the mechanical

systems

which interface with

the

EDS.

The

team conducted

walkdowns,

and inspected

maintenance,

calibration,

and surveillance

activities

and records for the above mentioned

systems.

In addition,

the

team reviewed selected

modifications,

nonconformance

reports,

and

LERs to assess

the capability and performance of

the licensee's

engineering

and technical

support organizations.

The

team verified conformance with General

Design Criteria

(GDC)

17 and 18,

specifically,

and

10 CFR Part 50 Appendices

"A" and "B", as appropriate.

The

team reviewed plant Technical Specifications,

the Final Safety Analysis Report,

and appropriate

Safety Evaluation Reports

to verify that technical

requirements

and licensee

commitments

were being met.

2.0

El ectrica~lS

stem

2.1

Offsite Powe~rSn

lg

Two separate

and independent offsite transmission

systems

(500

kV and

230 kV) provide power to the Diablo Canyon Nuclear

Power Plant

(DCPP).

The

main generator

output, operating at 25

kV during normal operations,

provides

power to the 500

kV switchyard via

a generator

disconnect

switch and main-

generator

transformer.

The normal operating

power for both the safety

and

. the non-safety unit auxiliaries

is provided by the main generator.

The 230

kV system provides

power =to the unit auxiliaries during unit startup

and unit

shutdown

modes.

On

a- loss of the

230

kV system,

coincident with a

LOCA, offsite power could

also

be provided

by the

500

kV power supply.

A review of the system design

indicated that restoration of the

500

kV connection for back feeding to the

safety .related unit auxiliary loads

could take

30 minutes or longer due to

the time required for generator

voltage decay during coastdown

and the time

required for the switching process.

However, licensee

procedures,

training

and past operational

experience

indicated that the

500

kV power supply could

be. restored

in approximately

30 minutes.

2.1.1

Brid Stabil i~tand History

The licensee's

Power Control Department

operated

the transmission

system with

an on-line, real time, energy

management

system

(EMS).

Power load flow

analysis

was performed.

Daily operations

were maintained within stability

limits.

The licensee's

Transmission

Planning

Department

performed

power

system transient stability analyses

for existing and'uture

configurations of

the system.,

A summary of the 1'icensee's

system stability studies

and several

sample

cases

presented

by the licensee

were reviewed

by the

team.

The stability studies

demonstrated

that tripping of both

DCPP uni ts did not appear

to significantly

affect grid stability nor degrade

the availability of the

230

kV power supply-

to the station.

System frequency

was normally maintained well above

58 Hz.

System voltage

was maintained

between

520

kV and

546

kV at the

500

kV system.

The 230

kV system voltage

was maintained

between

227.5

kV and

232 kV.

The

DCPP offsite power supplies. appeared

to be reliable

and stable.

2.1.2

Sur~e Protection

The 500

kV and

230

kV systems

were designed with provisions for lightning

impulse voltage

and switching surge protection.

The transmission

lines were

protected

from direct lightning strikes using overhead

ground wires.

Lightning arrestors

were installed

near

each

high 'voltage bushing

on the'500

kV - 25

kV main transformers

and

on the

230

kV -

12

kV standby startup

transformers.

,Lightning rods were installed

on the turbine, auxiliary and

fuel handling buildings,

as well

as

on containment structures.

Motors on the

12

kV system

were designed

with

a surge protector

on each

phase.

The

25

kV - 4

kV and the

12

kV - 4kV transformers

had totally 'enclosed

terminals.

Connections

were

made with. non-segregated

phase

bus duct.

The

transformer terminals

and connections

were not exposed

to direct lightning

strikes.

Any voltage

surges

on the

500

kV and

230

kV systems

would be

absorbed

by the lightning arrestors.

Any remaining propagating

voltage surge

wo'uld'e dampened

by two intervening transformers.

The design

and implementation of the offsite power supply voltage protection

schemes

and the overcurrent

schemes

appeared

to be acceptable.

2.!.3

M

g

A lii yT

f

2. 1.3. 1

Transformer Capacity

had two unit auxiliary and two standby star t-up transformers

per reactor

unit.

The maximum ratings of the unit auxiliary transformers

were

56

NVA and

40 NVA, respectively;

the maximum ratings of the standby start-up transformers

were

75

NVA and

40 MVA, respectively.

The team reviewed the loading

on each of

the transformers

with respect

to various reactor operating conditions,

including normal start-up,

shutdown, full load operation,

and

LOCA conditions.

The maximum transformer

loads

appeared

to be within the nameplate

rating of-

the transformers.

The licensee's

load flow and voltage drop calculation

96-DC, Revision 2, dated

4/29/91, including Volume 3, Revision 1, dated 8/25/89,

was reviewed

by the

team to evaluate

transformer. and,bus

loadings.

The calculation

used

a Sargent

II Lundy (SILL) Engineers

computer

based

program, Electrical

Load Monitoring

System - AC (ELMS-AC).

The

ELMS-AC program

was verified and validated

(V&V)

by

SILL and the

VSV documented

in

a letter from SILL to the licensee

dated

7/14/86.

A number of discrepancies

in the loading

used

by the licensee for

various safety

and non-safety

buses

were noted during the team's

review of the

calculation.

For example,

the loadings for the

same

bus

on different pages of

the report were different.

Loading

on one safety load train included

some of

the loads

from another safety load train.

The total loading

on

a bus did not

equal

the

sum .of all the feeder

loads

on the

same

bus.

The discrepancies

appeared

to have

been

caused

by the modeling of the station

EDS that was

used

as input to the

ELMS-AC computer

program.

The noted discrepancies

had the

potential for affecting the results of the shor t circuit calculations

(calculations

96A-DC and 968-DC),

and the voltage drop and load flow

calculations

(calculation

96-DC volumes

1 and 2).

As

a result of the discrepancies

identified by the team,

the licensee

reviewed

the input model of the

EDS connections

used in the

ELMS-AC load flow and

voltage drop program

and re-performed

th'e calculations.

Revision

3 of the

subject calculation

was provided to the

team at the

end of the inspection

period.

The

team did not have sufficient time to review the results

in

detail.

The licensee

stated

that the re-analysis

did not significantly change

the results.

A brief review of the results

by the teaoi appeared 'to confirm

the licensee's

conclusion.

Although the licensee

concluded that the modeling discrepancies

for the load

flow and voltage drop analysis

did not significantly change

the results,

this

could not be confirmed without the licensee

performing the re-analysis,.

This

was considered

to be

an example of poor design

performance

and review, in

,that the analysis

should not have

been

performed with the modeling

inaccuracies

and could not have

been readily reviewed with the modeling

~ inaccuracies

identified by the team.

2. 1.3.2

Transformer Protection

The unit auxiliary

and standby startup transformers

were protected

by

instantaneous

and time overcurrent relays,

sudden

pressure

relays,

and

differential current relays.

The team selectively reviewed the overcurrent

protection curves of the transformers

(incoming and load center feeders),

4160

Y large motor protection curves,

and the overcurrent protection curves of

the emergency

diesel generator.'he

protection

appeared

to have

been properly

selected.

Protection

and coordination of the offsite power supply incoming breakers,

the

unit auxi 1.iary and standby start-up transformers,

and the 4160

Y buses

appeared

to have

been acceptably

designed

and implemented.

2. 1.4

Transfer of the Loads

From the Unit Auxil~iar

2. 1'.4. 1

12

kV Automatic Transfer

The Diablo Canyon

EDS design

included

a provision for automatic transfer of

each

12

kV non-safety

bus

(D or E) from the unit auxiliary transformer

supply

to the standby start-up transformer

supply upon

a unit trip, auxiliary

transformer protective relaying trip, or 500 kV-generator breaker trip.

A

fast

bus transfer would occur first, if both normal

and alternate

supplies

were in synchronism.

Otherwise,

a slow bus transfer would occur.

2.1.4.2

4160

V Automatic Transfer

On

a unit trip or

a 4160

V bus undervoltage condition, without a

LOCA, any

4160

V bus fed from the auxiliary transformer

would be automatically slow

transferred

to the standby start-up transformer,

provided the start-.up

source

was energized.

The 4160

V loads

remained

connected

and would not trip.

On

a

4160

V bus undervoltage condition,

a slow bus transfer would occur when the

bus

voltage dropped

to

25% of rated voltage or 4 seconds

following a transfer

.

initiation signal, whichever

came first.

The team's

review of DCPP's transfer

schemes

generated

questions

that

necessitated

licensee

performance of further analysis.

In response

to team

questions,

the licensee

performed

an analysis

to verify that the load center

transformer feeder

breaker would not trip on transformer magnetizing current

inrush following transfer.

The licensee

also performed

an analysis

to verify

that the start-up transformer

incoming feeder breaker to the 4160

V safety

buses

would not trip on slow transfer.

Based

on the team's

review and licensee

analysis

and response

to the team's

questions,

the design of the slow transfer

scheme of the 4160

Y safety

buses

appeared

to be acceptable.

Class

IE 4160

V AC System

2.2

The 4160

V Class

1E system of each of the two units included three separate

and

independent

buses.

Each-bus

consisted

of an assembly of 250

MVA class

metal-clad switchgear.

The s'stem

served various safety-related

motors larger

than

350

HP and 480

V load center

transformers.

Safety'related

loads

were

assigned

to the buses

such that

a minimum. of two buses

could provide

power to

the minimum required safety related

loads in order to mitigate the

consequences

of a design

basis

accident.

s

The 4160

V system

was high resistance

grounded at the neutral

connections 'of

the unit auxiliary and startup transformers.

Ground fault detection

was

provided

on every feeder.

However,

the

EDGs were ungrounded

and thus the

4160

V safety system would be ungrounded

when powered solely by the

EOGs.

The

licensee's

ground detection

system

and the effects

on the ungrounded

EDG's are

further discussed

in Section 2.3.2.of this report.

2.2.1

4160

V SEstem

Short Circuit Level

The previously identified

ELMS-AC computer

program

was also

used in the

OCPP

short circuit calculation,

96A-DC, Revision 0, dated 4/19/91,, and voltage drop

calculation,

968-DC, Revision 0, dated 4/19/91.

The team reviewed the

calculations

and

had the following observations:

(a)

When all the station auxiliaries are

powered

by either the unit auxiliary

transformer or by the start-up

standby transformer,

and with the system

pre-fault voltage at the high range

(1.054

pu or 4385 V), the system three

phase

short circuit fault current at the 4160

Y safety

buses

would be

higher than the

250

MYA circuit breaker interrupting rating of 32.9

kA at

4385

Y.

(b)

During routine

EDG testing, while running in parallel with the unit

auxiliary transformer supply,

and with the generator

output pre-fault

voltage at its maximum voltage of 1.05 pu, the system short circuit fault

current could

be

as high as

37 kA.

However, Surveillance Test Procedure

(STP) N-9A, Revision 20, dated 4/10/91,

"Diesel

Engine Generator

Routine

Surveillance Test," limited the generator

output voltage to 1.0

pu during

the

EOG testing to avoid excessive

short circuit fault current

on the

4160

V buses

and to maintain minimum allowable operating voltage

on the

4160

V and 480

V bqses.

(c)

Calculation

96A-DC analyzed

system fault current duties

and voltage

conditions.

The

1990 system short circuit fault levels of both offsite

power supplies

were

used in the calculation.

The calculation did not

provide any allowance for future system expansion.

In addition,

the

calculation

used cable resistance

at 90 C.

While the latter provided

conservative

results

in the voltage drop calc'ulation,

non-conservative

results

were obtained

in the short circuit calculation.

To obtain

conservative

results for both calculations,

the short circuit fault

current calculation

and voltage drop calculations

should

have

been

performed separately

with their corresponding

conservative

input data.

The licensee

acknowledged

the team's

concerns

regarding

the calculations

but, pointed out that the calculations

showed that sufficient margin was

available to compensate

for the effects of the inaccuracies

that may be

4

caused. by the relatively non-conservative

input.

The team agreed with

the licensee's

evaluation

but noted that the margin could be affected

by

the licensee's ability to upgrade

the rating for the 4 kV breakers

(see

discussion

regarding

4

kV rating upgrade

in the next section of'this

report).

(d)

The

ELMS program did not evaluate

the 4160

V and 480

Y transient

bus

voltages

and motor terminal voltage during motor star ting.

The licensee

informed the

team that the transient voltage profile analysis

would be

included in calculation

96C-DC, which would be completed

by the

end of

this year.

The team

saw

no immediate safety concerns

in this regar d and

considered

the licensee's

schedule for the mentioned analysis

to be

reasonable.

.I.I

I 44~i

During the first week of this

team inspection,

the licensee

was in the process

of resolving

a nonconforming condition identified by

NCR DCO-90-EN-032

regarding

the

4

kV breakers.

The

NCR stated,

"During the procurement of

replacement

4

kV circuit breakers,

General Electric discovered

that

a previous

rating for short circuit (provided by General Electric)

may have

been

incorrect.

The actual

worse case fault current

may be closer to the equipment

rating then previously analyzed."

The licensee's

evaluations

and corrective

'ction for the

NCR were reviewed.

The licensee's

evaluation of the

NCR

indicated that during the Independent

Design Verification Program for DCPP,

.

verification of the adequacy of the

4

kV switchgear identified an interrupting.

requirement of 42,600

amperes for buses

F,

G, and

H, which was significantly

higher than the published interrupting rating of 33,100

amperes.

GE was

contacted

by the licensee

at that time and

GE provided

a letter, dated

February 25,

1983, to the licensee

to certify the breakers

to

a higher rating

of 45 kA.

In 1990,

the licensee

attempted

to procure similar replacement

circuit breakers

from GE.

GE subsequently

notified the licensee

that the

1983

"letter was

based

upon the interpretation of test results

on the originally

supplied breakers,

and'hat this interpretation

may represent

best

case

scenario

and

may not be representative

of all cases."

The breakers

were then

rerated

to an interrupting rating of 35

kA by GE.

Neither

GE letter included

test results,

nor did they include

a report- on the results of testing

sufficient to demonstrate

the acceptability of the reratings.

The licensee,

at that time, met with the vendor

and visited its facilities, and accepted

the

rerating to 35 kA.

The

team questioned

the acceptance

of the rerating

due to the lack of

documentation

of the technical

basis for the rerating.

Both the vendor

and

the licensee

attempted

to provide the

team with reports to show the basis for

the rerating.

Neither report provided adequate

technical

basis for the

rerating.

The team concluded

that the licensee

needed

to obtain

a documented

technical

basis for the increased

4

kY circuit breaker interrupting current

rating for the following reasons:

a)

The system short circuit fault level at the 4160

V safety

buses

was

higher than the

ANSI C37.06 interrupting rating for the

250

NVA breaker,

and under certain operating conditions,

the fault level

was also higher

than the

35

kA increased

rating.

b)

The manufacturer

had previously, in 1983, certified the

same breaker for

45

kA interrupting rating,

and subsequently

in 1990 admitted that -it was

an error and reduced

the interrupting rating to 35 kA.

Both

certifications were:provided in letters that contained

no technical

basis

for the upgrade rating.

The licensee

agreed, to further attempt to obtain the technical

basis for the

increased

4160

V safety

bus circuit breaker rating and provide'he technical

basis

to the

NRC for further review.

Pending licensee

action

and

NRC review

of that action,

the issue was'*identified as Unresolved

Item 50-275/91-07-01.

2.2.3

Protective

Re~la in

The

team reviewed

a sample of 4

kV motor overcurrent relay settings,

and the

protection coordination of the safety buses.

The settings

were based

on

normal running, short time overload,

and motor acceleration.

Motor

overcurrent relays

were coordinated with the upstream protective devices

and

the thermal

damage characteristic

of the motor.

The team also reviewed the

incoming feeder overcurrent protection trip setpoints

to verify that the

incoming feeder breaker

would not trip during slow transfer.

The protection

and coordination of the 4160

V motor fe'eders

and the- incoming

supply feeders

appeared

to be acceptable.

2'.4

Cable Sizina

All the safety related

4160

V loads

were located outside containment.

Standard

5

kV class,

133% insulation level cables,

per

ICEA S-68-516 or ICEA S-66-524,

were used.

The licensee

stated that the cables

were sized in accordance

with

ICEA P46-426/IEEE

S-135 standard

and the thermal electrical

design

standards

of PGIEE.

However,

no specific design

procedure

or calculations

to ensure that

the cables

had

been properly selected for their design functions were used.

Utilization of ICEA and the

PGImE standards

for cable sizing appeared

to be

acceptable if properly performed.

The licensee

agreed to perform an analysis

on selected

samples

to verify that the cables

had

been properly selected

and

sized with respect

to thei r voltage drop, short circui t current temperature

rise,

induced voltage along the cable shield,

and

so forth.

2.2.5

Degraded

Voltage

and Loss of Voltage

R~ela

s

The team reviewed settings

and the basis for settings

associated

with first

level undervol tage

pr otection relays,

second

level undervol tage protection

relays, startup

bus permissive relays,

and associated

timers.

First level

protection consisted

of two relays,

one

an instantaneous

relay,

and

one

an inverse

time relay.

The inverse

time relay provided

a delay of

approximately

25 seconds

at 2583 volts and

4 seconds

at 0 volts.

Both relays

were required to be activated

to avoid spurious actuation.

No adverse

findings were identified by the

team in relation to first level relays.

The startup

bus permissive relay was

used to detect

the availability of

voltage

on the startup

bus, during

a slow bus transfer of vital loads

from the

station auxiliary bus,

which was the

normal

supply for the Class

1E loads.

10

This relay was set

between

3342

and

3412 volts and

had

no associated

technical

specification.

The team noted that the startup permissive relays

were set

approximately

300 volts lower than the second'evel

protection.

With such

an arrangement;

loads could

be successfully

transferred

from .the

unit auxiliary bus to the startup

bus

and then disconnected

by actuation of

the second

level undervoltage.

The licensee

explained that this condition was

not credible

due to the fact that the degraded

grid condition would have 'to

occur within the

20 second

period after the transfer occurred,

and before the

actuation of the second

level undervoltage protection.

If the degraded

grid

condition was preexisting,

the second level undervoltage

would have already

actuated

and transferred

the vital loads to the, diesel

generators.

The

licensee

assessment

appeared

to be adequate.

At DCPP,

degraded

grid protection

was provided

by the second

level

relays,

which have

a minimum technical specification setpoint of

3600 volts.

Associated with these relays

were two timers;

a

10 second timer

for starting the diesel,

and

a

20 second

timer for. load shed.

The

10 second

diesel start timer allows for short v'oltage transients

and is in effect

for both

LOCA and

non-LOCA situations.

The adequacy of the second

level

(degraded grid) relay technical

specifications

and calibration setpoints

was reviewed to ensure that adequate

voltage would be available to all Class

1E loads at

a bus voltage just above

the point of relay actuation.

The second

level undervoltage

relays

were set

to activate

between

3682

and

3710

V ac.

The licensee

stated that the

adequacy

of this setpoint

was

under

review and

had

been

documented

in guality

Problem Report

dg0008201

dated January

22,

1991.

This document stated that,

if 4160

Y ac

bus voltage degraded just above

the relay setpoints,

480

V ac

motors required for accident mitigation could trip on thermal

overloads.

The

licensee

analysis

also stated that the degraded

grid condition would have to

be sustained for over 30 minutes before the motor tripping could occur.

Consequently,

the licensee

had re-sized

the thermal

overloads

to prevent

tripping on thermal overload.

However,

the licensee

had not performed

a

formal calculation to verify the operability of the

120 volt control circuits,

nor for evaluating

the effects of a postulated

degraded

voltage

on 480 volt

motor operated

valves.

Although the licensee

was planning to ra'ise

the

setpoints

to

a level that would ensure

operation of all Class

1E equipment,

no

interim actions

had

been

taken to ensure

equipment=operability.

As

a result

of this concern,

the licensee

issued

a change to Emergency

Procedure

EP-E-O,

to manually start the diesel

generators

and separate

from the grid should the

voltage fall below

a newly determined

minimum value.

Pending further licensee

evaluation

and performance of any necessary

setpoint

changes,

this was

identified as Unresolved

Item 50-275/91-07-02.

The

team also reviewed the calibration procedure

and calibration data for the

second

level undervoltage

relays.

Acceptance criteria for these

relays

were

contained

in Table

1 of MP E-50.33.

The table contained

a minimum acceptable

dropout,

a desired

drop out range,

and

a maximum acceptable

pickup.

The

actual calibration data

reviewed for these

relays

showed minimal .drift, and

documented

the accuracy of the test equipment

used to calibrate

these relays.

2.3

Emer enc

Diesel

Generators

EDG)

~EM

L

di

2.3.1

(a)

the total load

on bus

F was

2780

kW, which was higher than

the 2000 ho~rs rating of 2750

kW for the

EDG; and

(b)

the total load on bus

H was

2689

kW, which was higher

than the continuous rating of 2600

kW for the

DCPP.

was licensed with two

EDGs per'nit with a swing

EDG shared

between

the

units.

Each of the three

EDGs operating per units

was designed

to provide

emergency

power to each of the vital 4160

Vac class

1E buses of each unit.

DCPP, at the time of the inspection,

was initiating a design

change to add

a

sixth

The design criteria, operation,

and

bus loading for the

EDGs were

described

in

FSAR, Section 8.3.

The team reviewed the load sequencing

timers, starting time of the safety motors

under

various

bus voltage

conditions,

and the starting capability of the

EDGs.

The load sequencing

of

the

EDGs appeared

to meet applicable

licensee

commitments.

Table 8.3-5 of the

FSAR, Revision 5, dated 9/89, provided

a listing of the

maximum steady state

EDG load

demand following a

LOCA.

The team noted that

several

motor loads listed in the table were not representative

of the maximum

demand

by the motors listed in the table.

The team questioned

the licensee

regarding

the worst case

loading versus

the

EDG ratings.

The licensee

confirmed the maximum steady state

load

demand

on each safety

bus following a

LOCA, and identified the two hour rating of the

EDGs

as

3000

kW, the 2000 hour0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months

rating

as

2750

kW, and the continuous rating of 2600

kW.

The revised

loading

data indicated

the following:

In response

to team .questions

regarding

the above

noted condition, the

licensee

stated that the

EDG bus loading included

147

kW for the fire pumps.

DCPP design basis

does

not require analysis for a

LOCA and loss of offsite

power coincident with a fire.

The only condition that could cause

the running

of the fire pumps coincident with

a

LOCA and loss of offsite power would be if

an earthquake

caused fire protection

pi pi ng fai lure, consequent

low fire

'rotection

piping pressure

and resultant initiation of the fire pumps.

The

licensee's

emergency

response

procedure for an earthquake,

EP M-4, Revision

11

dated ll/5/90, required

an inspection of fire protection piping within two

hours following an earthouake

and the isolation of any damaged fire protection

piping.

This in turn would result in securing

the fire pumps if they

were not needed.

This would reduce

the

EDG bus

(F and

H) loads approximately

147

kW each.

The licensee

stated that corrected

EDG bus

loads would be

reflected in the next normal

FSAR update.

Pending submittal of an

FSAR change

to more accurately reflect

EDG bus loadings

and subsequent

NRR review and

acceptance,

this

was identified as Unresolved

Item 50-275/91-07-03.

2.3.2

Protective

Re~la in

EDG trips were provided for overspeed,

engine

low lube oil pressure,

and

generator current differential; in addition,

the

EDG was protected

from

reverse

power, loss of field, and overcurrent during routine testing.

A

review of the settings

and the control logic indicated that they were

generally designed

in accordance

with IEEE 387 standard.

a

12

Under

normal

system operating conditions

and during

EDG monthly testing,

a

ground fault inside the

EDG or along the

EDG cable

up to the 4160

V

breaker would not be detected.

However, during the

18 month

EDG surveillan'ce

testing,

performance of high voltage insulation resistance

testing

(meggering)

would reveal

the ground fault.

The 4160

V system cable were identified as

5 kV, 133$ insulating level 'cable

that met the requirements

of ICEA-S-66-516

and

ICEA S-68-524.

The team noted

that Table 3-1 of those

standards

required

a ground fault clearing

time of not

more than

one hour.

Because

of the apparent limitations of the ground fault

detection

scheme for the ungrounded

EDGs,

and the cable insulation

requirements,

the

team was concerned

with the adequacy of the

DCPP ground

fault detection

scheme.

In response

to team concerns,

the licensee

agreed

to

review the design

and consider modifying the

scheme

as appropriate.

2.3.3

EDB L

d~5

The

EDG load sequencer

was designed with two sets of individual timing relays

instead of a single multiple function timer.

One set of relays

was

used for

plant shutdown

on unit trip, or on loss of offsite power, or on degraded

grid

voltage.

The other set

was

used

when

a safety injection signal

occurs..

These

timers were

powered

by the secondary

winding of

a potential

transformer which

was connected

to the 4160

V safety

bus.

The voltage operating

range of these

timers

was within the operating

range of the 4160

V safety bus.

The load

sequencer

timer relay scheme

appeared

to be capable of performing its intended

function.

The, licensee

uses

a high resistance

ground system for the 4160

V system.

'he

EDGs are not grounded.

Mhen the

EDGs provide power to the 4160

V safety

~buses,

'the entire

4160

V safety

system

becomes

an ungrounded

system.

The

existing ground fault detection

system

measures

the residual

ground fault

current

and would not detect

ground fault in an ungrounded

system.

Should

a

ground fault exist in an .ungrounded

system,

the licensee

would not be

'mmediately

aware of the fault until the fault developed into a phase

to phase

fault that could then result in a trip of the. faulted circuit.

2.3.4

Voltage

and

F~ne

uenc~ Re~elation

t

A 1972 manufacturer's

shop test report

and

a sample of recent routine test

results of the

EDG were reviewed.

The data indicated that the

EDG could start

a 800

hp motor while maintaining the voltage dip and frequency drop within the

recommended

limits of Regulatory

Guide 1.9 and

IEEE 387.

The voltage

and

frequency recovery

time was within 2 seconds,'hich

was less

than

60K of the

sequencing

time interval

between

two load groups

as required

by Regulatory

Guide 1.9.

The shop test result also indicated

the voltage regulation

and

frequency were within the limits of the Regulatory Guide.

The steady state

and transient voltage regulation

and frequen'cy regulation of

the

EDG appeared

to be acceptable.

13

,2.3.5

Re~souse

to

NRC Information Notice 91-06 "Lock-Uo of

s~o

ns

douse

Circuit Preven~tin

Restart of Tr~sed

NRC Information Notice (IN) 91-06, dated 1/31/91,

informed all operating

reactor plant licensees

of potential

problems involving the restart of a

tripped emergency

diesel

generator

(EDG) because

of "lockup of EDG or load

sequencer

control circuits.

The incidents at Vogtle-1 and. Kewaunee raised

concerns

regarding

the understanding

of EDG and load sequencer

control

'circuits and their interfaces,

and the adequacy of procedures

for EDG restart

following expected trips.

The licensee

evaluated this

IN on 4/16/91

and documented

the result in a

memorandum

from Nuclear Engineering

and Construction

Services

to Nuclear

Operations

Support..

The

highlights of this evaluation

are

as follow:

Instead of a master

se'quencer,

the licensee

used separate

timing relays

for response

'to an accident signal

and to

a loss of offsite power

signal.

Each time delay relay controls

a safeguard

load.

These

120 Vac

relays

are

powered

by

a potential

transformer

on the

EDG 4160

V bus.

Thus, if the

EDG is tripped

and the timing sequence

is interrupted,

these

relays

are de-energized

and

become self-resetting.

Mhen the bus

is re-energized,

the sequence

is automatically reini tiated.

A Safety Injection or loss of offsite power condition automatically

, sta'rts

each

EDG-.

The

EDG is automatically loaded, if offsite power is

not.available. 'fter starting, if the

EDG is tripped,

a shutdown relay

.

(SDR) is activated

by the following four protective features:

a)

Generator differential overcurrent (short circuit).

b)

Low-lube oil pressure

( lack of lubricant).

c)

Overspeed.

d)

Emergency

manual

stop.

The

SDR locks out

EDG restart

and trips the

EDG output breaker.

These

protective features

include the minimum protection to prevent catastrophic

damage

to the

EDG while ensuring

maximum availability.

They do include

jacket water temperature

which caused

the spurious trip at Vogtle.

Operating

Procedure

OP J 6-8: I, "Diesel Generator

1-1 t1ake Available,"

provides specific instruction

on resetting

a locked out

The inspectors

assessed

the licensee's

evaluation

by review of drawings

and

operating

procedures,

walkdown of the control boar'd,

and interviews with the

operators.

The inspectors

found that the

EDG protective trips included only

re-energizing

the

EDG bus,

and the operators

are provided adequate

instructions

to restart

a locked out

by molded case circuit breakers

The licensee

concluded that the

concern,

outlined in IN 91-06 was not an issue for DCPP.

Based

on the team's

review, this appeared

to be

a valid conclusion.

,14

III

2.4

480 Volt AC Class

1E~Sstem

N

The inspection

team reviewed the design of the 480 Vac Class

1E System.

For each of the

two units of the power plant, three separate

and independent

load centers

and associated

distribution equipment'ere

provided.

Each load

center consisted

of a 4. 16 kV-480

V transformer,

close coupled to

a motor

control center,

served

from a separate

4.16

kV Class

lE bus.

The motor control

center construction generally consisted of combination circuit breaker,

contactor

and control transformer

units for motor loads,

and circuit

breaker-only units for non-motor loads.

Safety related

loads

were assigned

to

the load centers

such that

a minimum of two load centers

could provide power,

'o the minimum required safety related'oads.

in order to mitigate the impact

of a design basis

accident.

The largest .loads

connected

to the 480 Volt Class

IE system

were the two-speed

300/100

hp containment -fan cooler motors.

Features

and characteristics

of the design

reviewed

by the

team included

equipment ratings, short circuit duty, voltage regulation

and equipment

protection.

These attributes

appeared

to the team to be adequate.

However,

voltage regulation,

under degraded

230

kV system conditions,

posed

a concern

as discussed

in Section 2.2.5 of this report.

2.4. 1

480 Volt Load Center

P

Loadings

on the 480 volt Class

lE load centers

under all postulated

plant

conditions,

including startup,

normal

power operation,

shutdown,

and emergency

operation

under design

basis

accident conditions,

were demonstrated

by the

licensee's

calculations

15-DC, Revision 5, dated 4/25/91

and 96-DC, Revision

2, dated 4/22/91.

The latter calculation

was performed using

a certified

computer

program identified as

ELIvIS-AC.

The

team reviewed both calculations

and

noted that'here

was approximately

a

20K margin between

the transformer

and motor control center

bus ratings

and the worst case

loading "requirements

of each

load center.

Spare circuit provisions

were noted

on the motor control

centers

which would allow future load additions.

The team also observed that

the feeder circuit breakers

and contactors

used in the motor control centers

had continuous

ampere ratings compatible with their loads.

The team noted

two minor error s in calculation

15-DC, Revision 5.

The first

related to the

kVA load imposed

by the containment

fan cooler motors during

a

LOCA.

The total loadings

on 'the buses for the

LOCA, as calculated,

considered

a motor power factor of 0.9.

However, the documented

power factor value for

slow speed,

loss-of-coolant

accident operation

was 0.497.

This resulted

in an

error of approximately

74

kVA per containment

fan cooler.

The second error

involves the load

imposed

by the backup battery charger

ED121..

The

calculation

assumed

that the backup charger

would not be in operation.

However, it could have

been in use if either battery charger

ED11 or ED12 were

out of service.

In the latter case,

approximately

79

kVA (64

KW) would have

been

on 480 volt bus

1H.

The safety significance of these

two errors

on the

480 volt load center

equipment

was considered

by the team to be minor because

of the

20% margin in equipment ratings

and should

be corrected

in the next

revision of the calculations.

2.4.!

8~0V 1<<Sh

Ci

.

C

9

The

team reviewed the licensee's

calculation

96A-DC, Revision

0 dated 4/19/91

15

which was intended to determine

the short circuit current duty to which the

'.16

kV and 480 volt buses

could have

been

exposed.

The calculations

'considered

the maximum anticipated

480 volt bus voltage in determining the

fault level.

This calculation determined that the short circuit current duty

on the three

480 volt Class

1E load center

buses

was approximately

20 kA,

which appeared

to be

well within the capability of the specified short

circuit current interrupting rating of 25

kA for this equipment.

R.'l.3

480 ~15 ~iR g

1

Calculation 96-0C, Revision 2, determined

steady state

480 volt,bus voltages

under various supply voltage conditions

and plant operating

modes.

The

team

review of the calculation identified that the running and starting voltages

at

the terminals of the -480 volt safety related

motors

had not been determined.

The licensee

responded

by stating that their design practice

was

based

on

a

2X

steady state voltage"drop in load feeder cables.

A'conservative starting

current of 6 times running current would result in

a

12 percent voltage drop

during motor starting.

The licensee

provided the

team with copies of their

drawings

053994,

Change

2, dated 5/12/78,

and 053995,

Change

2, dated 4/19/78,

both titled "Thermal Electric Design Standard,

Power Circuits for Induction

Motors."

The drawings

showed conductor size

and length limitations for

various motor loads, for a steady state voltage drop of 2 percent of

460 volts in a 40'C ambient.

At the request of the team,

the licensee

performed

an informal bounding calculation for the longest

480

V ac power

cable.

This calculation analyzed

the 2472 ft. long,

k2AWG cable for the

auxiliary salt water cross-tie

motor operated

valve FCV-601.

Steady state

voltage drop was

shown to be 1.45

and starting voltage drop was

shown to be

6.3X.

The methodology

used

and the results of the calculation

appeared

to be

acceptable.

The team reviewed the licensee's

calculation

192-DC, Revision 0, dated 5/8/91,

which was intended to determine

the maximum allowable length of the

120

Vac

control wires associated

with the 480 volt motor control centers.

Individual

480-120 volt control transformers,

for each motor-starter control circuit,

were provided in the motor control centers.

Since the licensee

evaluated

these control circuits with the 480 volt system,

the team included this

calculation in the 480 volt system design review.

The licensee

appeared

to

have

used acceptable

methodology in determining

maximum control circuit

lengths for both

810

AWG and

812

AWG conductors

used in the plant design.

~

Further,

the calculation

addressed

the bounding case

which was the control

circuit for the previously mentioned auxiliary salt water

pump discharge

cross-tie valve,

FCV-601.

The methodology

used

by the licensee

to demonstrate

voltage conditions in the

480 volt system

appeared

to be acceptable.

However,

a concern

regarding

the

satisfactory

performance of 480 volt safety related motors

and motor operated

valves

u'nder degraded

230

kV grid conditions is di'scussed

in Section 2.2.5 of

this report.

2.4.4

480 Volt System

and E~uipment Protection

The

team reviewed

the overcurrent protection applied. to the 480 volt Class

1E

system

and its loads.

Short circuit protection

was provided

by molded case

breakers

using magnetic trips.

Overload protection

was provided for motor

loads

by thermal

overload devices

in conjunction with contactors.

The protection

16

for non-motor loads

was provided

using thermal

and magnetic trips.

The 'team reviewed the licensee's

calculations

195A-DC;

Revision 0, dated 9/ll/90; 1958-DC, Revision 1, dated 10/ll/90; 195C-DC,

Revision 0, dated

11/2/90;

1950'-DC, Revision 1, dated 4/4/91;

and

195E-DC,

Revision 0, dated 2/5/91 that evaluated

the various breaker magnetic

and thermal

trip settings

and thermal overload device trip setting or selection.

The trip

settings

appeared

to .be established

with all uncer'tainties

resolved

such that

the protected

devices

completed their safety related functions, including worst

case

voltage conditions for motor starting

and running and for trip setting

tolerances.

The team also noted that fuses

were used in the circuits for

480-120 volt control transformers

and potential

transformers.

The application

of protective devices

and their trip settings

appeared

to be acceptable.

l.l" lll1

ACC1

~AEE<<

The team reviewed

the design of the

120 Vac Class

1E system.

Each of the

, two

DCPP units

had four 120 'volt vital instrument

buses

and two supplemental

120 volt vital instrument

buses.

Each

bus

was served

by a separate

and

independent

7.5

kVA, Class

1E inverter.

A backup supply which consisted

of a

7.5

kVA, 480-120 volt transformer

and voltage regulator

was also provided.

The

backup supply was provided to facilitate maintenance

of any one of the

units'ix

Class

lE inverters.

Each inverter 's

normal or preferred

power supply was

from the

125 volt DC Class

lE system with an alternate

supply,

upon loss of

its

DC input from the 480 Vac Class

1E system.

The four vital instrument

buses of each unit served

the four redundant

channels

of the nuclear

steam

supply system's

instrument,

control

and protection

systems.

The supplemental

vital instrument

buses

served

loads

not specifically related to safety

systems

actuation

and safe shut

down.

Features

and characteristics

of the design

reviewed included equipment sizing versus

loading, voltage regulation,

and

inverter input requi rements

.

These attributes

appeared

to the

team to be

adequate.

/

2.5.1

E~ui ment

S~izin

The team reviewed the licensee's

calculation

93-DC, Revision 3, dated 12/1/89,

which was intended

to demons'trate

the loading'n the four vital instrument

bus

inverters

and

two supplemental

vital instrument

bus inverters.

The

'alculation

was

based

on detailed individual circuit load tables.

Individual

device

loads

had

been obtained

from vendor documentation

including bills of

materials,

elementary or schematic

diagrams,

and instruction manuals.

The

calculation demonstrated

that the individual inverter loadin'gs

ranged

from

approximately

78% to 97K of the nameplate

ratings.

The inverters

and .backup

voltage regulator

appeared

to have

been adequately

sized for the loads.

2.5.2

Voltage Regulation

The

team noted in the licensee's

design basis

document

DCN No. S-65, Revision

0, dated 9/30/90,

"120

VAC Systems,"

that voltage requirements

for the system

were listed

as

118 volts +,5W.

However,

the nuclear

steam

supply system

vendor information (E-Spec

677138

and

E-Spec

677414 for Nuclear

and Process

.

Instrumentation)

referenced

in the design

basis

document indicated

a-

requirement for 118 volts

+ 2X.

The

team noted that Section 7.6.2. 1 of

17

the plant's

updated

FSAR, Revision 6, dated 9/90, stated that the inverters

were designed. for an output of 118 volts

+ 2X, which agreed with the voltage

regulation informatio'n noted in the inverter. manufacturer's

published data.

In response

to the team's

concern for this anomaly the licensee

provided

a

copy of a telex from the nuclear

steam

supply system vendor,

dated 7/29/75, in

which the voltage regulation'f

+ 5X was indicated

as acceptable.

The

licensee's

response

to- this voltage regulation concern

appeared

to be

.

acceptable.

Based

on information contained

in

DCN No. S-65

and the manufacturer's

published data,

the inver ters will provide

+ 2X regulation with an input of

105 to 140 Vdc or 414 to 506 Vac.

In response

to the team's

request,

the

licensee

performed

an informal calculation to demonstrate

acceptable,

worst

case

input voltage from the preferred or normal supply at the end the battery

duty cycle, at which time the battery terminal .voltage would be

114 volts (see

Section 2.6.1).

This calculation indicated that inver ter terminal voltage

would be approximately

113 Vdc, which would be within the inverters

required

input range.

Based

on the design

and documents

inspected,

the

120 Vac Class

1E system

voltage regulation

appeared

to be acceptable.

2.6

125 Volt DC Class

1E System

The team reviewed the design of the

125 Vdc Class

lE system which, for

each of the

two units of the power plant, included three

independent

and

separate

buses.

Each

bus

was served

by its

own 125 volt, 60 cell, lead-acid

type battery

and battery charger.

A spare

charger

was provided to serve-

either

one of two buses,

while a second

spare

charger

was provided for the

third bus.

Each

normal battery charger for each of the three battery

buses

was supplied from a separate

480 Volt=Class

IE bus.

Loads were assigned

to

each battery

bus to support

and complement

the safety related

loads

served

by

-its associated

480 Volt Class

1E bus

and 4. 16

kV Class

1E bus.

Each of the

three battery

buses

served

two 120

VAC Class

1E instrument

bus inverters.

The

team reviewed the features

and characteristics

of the design,

including

battery

and battery charger sizi ng, short circuit duty and voltage conditions

for 125

Vdc motor operated

valve functions.

The team gave particular

attention to calculations relating to the portions of the system associated

with battery

12, since it was

on the team's

selected

load path for the

inspection.

These features

and characteristics

appeared

to be adequate.

2.6.1

Batter~and

Hattery Cha~rer

Sizing

The design

basis

document

DCN No. S-67, Revision 0, dated 9/30/90,

"125/250

Volt Direct Current System," stated

that the design criteria for battery

sizing was that the

end of duty cycle or minimum allowable voltage

was 1.9

volts per cell

(114 volts total).

Further,

the duty cycle for the design

basis

accident

was

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

and the duty cycle for station blackout was

4

hours.

The

team reviewed

the licensee's

calculation

2328-DC, Revision 2,

dated 2/15/91, for Class

1E battery

12, which was intended to verify that the

battery

was sized for the

2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months duty cycle.

The

methodology

used

employed

the computer

program

ELMS-DC, which was

based

on

IEEE Standard

485-1978,

"Recommended

Practice for Sizing Large

Lead Stora'ge Batteries for Generating

Stations

and Substations."

The results

indicated

an existing battery capacity

18

margin of 3.8/ for battery

12, with a 2-hour duty cycle and

a minimum voltage

to be not less

than

114 V.

Acceptable

margins

were also noted in calculations

232A, Revision

2 and

232C, Revision 1, both dated 6/1/90, for the other two

Class

1E batteries.

The team noted that the licensee's

calculation

144-DC, Revision 1, dated

3/19/90,

performed to verify that the batteries

were adequate

for the 4-hour

blackout duty cycle,

had used

data

from calculations

superseded

by calculations

232A,

B and

C-OC discussed

above.

In response

to the team's

concern for the

impact, the. licensee

provided the results of preliminary calculations

235A,

B

and

C - OC, which were intended to supersede

calculation

144-OC,

and used

data

from calculations

232A,

B and

C-DC.

These preliminary results

appeared

to

indicate acceptable

margins for the 4-hour duty cycles.

The licensee

had

no formal calculation for verification of battery charger

sizing.

However, the

team agreed that the 400 amperes

nominal rating (440

amperes

maximum) for the chargers

appeared

to be acceptable

based

on

a

continuous

charger

load (i.e., without battery charging) of approximately

210

amps,

as implied by calculation

232B-DC.

2.6.2

i 5~V l

0

S <<

Sh

Ci

i

C

The team reviewed the licensee's

calculation

233B-DC, Revision 1, dated

9/5/90,

which was intended to determine

the short circuit current duty on the portion

of the system

served

by battery

12.

The calculation, considering fault

current contribution from both the battery

and charger,

determined

that the

fault curi ent at the battery terminals

was approximately

14.4

kA and

approximately

14. 1

k

kA at the main bus.

These

values

were well below the main

bus breaker interrupting ratings of 25

kA and the distribution panel

breaker

ratings of 20 kA.

The battery fuses

were reported to have

a 200

kA

interrupting rating.

The team found the methodology

and results of the

calculations

to be acceptable.

Similar results for the portions of the system

associated

with the other

two batteries

were. demonstrated

by calculations

233A, Revision

1 and

233C, Revision 2, both dated 9/5/90.

The methodology

and

results of these calculations

appeared

to be acceptable.

2.6.3

Voltage to 125 Vdc Motor 0~crated

Valves

(MOVs)

The

OC motor operators

at

DCPP were purchased

and sized to develop

rated torque at 70K of motor terminal voltage.

The inspection

team reviewed

calculations

126-DC dated 7/25/83,

and

1956-DC, dated 5/17/91, which were

performed to determine

the worst case

expected

motor terminal voltage at motor

operated

valve FCV-95.

The calculations

assumed

an ambient temperature

of

163'

and the minimum expected

end of life battery voltage of 114 volts.

The calculation also

assumed

a maximum motor unseating

current of 19.31

amps,

which was taken

from test data

performed using the Westinghouse

Vital System

for a test performed

on 5/17/91, at

a pressure

of 775 psi,

and with an unknown

differential pressure

and flow.

Review of this test data indicated

inrush

currents of approximately .32 amps,

running current of 7.35

amps,

and

an

end

current of 19.31

amps.

It was unclear to the inspection

team as to whether

these

tests

were performed at design basis conditions

or whether currents

in

excess

of 19.31

amps

would be required for unseating

the valve in the open

direction.

Using the

19.31

amps,

the licensee

then developed

an equivalent

-19

circuit for this motor operated

valve using cable resistances

at 20'

and

a

motor resistance

at 163'.

Correcting for the motor resistance

but

'not for the feeder cable resistance

for high 'temperatures

was

non-conservative,

because

the resultant voltage available

to the motor under

these conditions

appeared

to be greater.

In addition, this methodology

assumed

that the motor torque

was

a pure function of terminal voltage.

This

is not true if motor resistance

increases

due to elevated

temperatures.

The

resultant calculation

showed that 82.25 voltage would be available across

the

motor shunt windings

and 78.34% voltage would be available

across

the motor

series windings, which is greater

than the stated

70K voltage requirement.,

The methodology

and inconsistencies

in this calculation brought into question

the validity of the results.

Due to the existing margin, there did not appear

to be

an operability concern with this valve.

However, the team was concerned

that similar errors might have

been

made for other valves

where adequate

margin was not available.

'In addition, true thrust requirements

for these

'valves

based

on design. basis testing,

o'r its equivalent,

need to be

established

in accordance

with the licensee's

Generic Letter 89-10 program.

This issue will be reviewed during

a future, Generic Letter 89-10 inspection.

P'ending further review, this was identified as Unresolved

Item 50-275/91-07-04.

2.7

Protection

and Protection Coordination

The

team reviewed the licensee's

various calculations

and coordination curves

that established

protective relay and tripping device settings,

and

demonstrated

coordination of circuit protection devices .applied in the power

plant's

Class

1E

EDS.

Particular attention

was given to relay

and tripping

device settings

associated

with the team's

selected

load path,

and included

the 4. 16

kV system,

from the startup

and auxiliary transformers,

through the

4.16

kV switchgear

and the 480 volt load center outgoing feeders.

The team

also reviewed protection

and coordination

as applied to the

125 volt DC 'Class

lE system,

starting at the battery

and battery charger terminals

through the

DC system main buses.

The relay and device settings that were'reviewed,

demonstrated

protection coordination of tripping devices for bus main

supplies,

bus ties, motor feeders,

load center transformer feeders,

diesel

generator

protection

and for battery

and for battery charger protection.

Protection and,protection

coordination

appeared

ac'ceptable.

2.8

Containment Electrical Penetrations

The team reviewed the licensee's

calculations

which were intended to

demonstrate

the application of penetration

assemblies

with regard to

current capability and overcurrent protection provided in'ompliance

with Regulatory

Guide 1.63,

Rev.ision

1, dated 5/77.

Primary and backup

overcurrent protection

were provided

by the licensee

in cases

where the

maximum anticipated fault currents

could exceed

the" capabilities

of the

penetration

assemblies.

Circuit breakers

were usually provided

as -primary and

backup protection devices.

Fuses

were used in som'e

low voltage circuits.

Primary and backup overcurrent protection devices

reviewed were physically

separated

from each other.

However,

team walkdowns

and subsequent

design

review identified

a containment penetration for a non-Class

1E emergency

lighting

DC circuit that appeared

to be

r outed in

a manner that jeopardized

20

its protection.

The loadside

leads for the circuit from the backup breaker

were routed

back through the panel

containing

the primary breaker

and then to

the penetration.

A catastrophic failure of, or within, this non-class

1E

panel

could have resulted

in shorting of conductors

which would bypass

both

primary and backup protection.

In the event of a design

basis

accident,=an

emergency lighting circuit fault within the containment, without circuit

overcurrent protection,

could have r'esulted

in a fai lure of the associated

electrical penetration

and

a challenge to the containment integrity.

The team

discussed

this condition with the licensee.

The licensee

did not consider

the

noted condition to be

a problem.

They considered that

a type of failure that

could bypass all the overcurrent protection for the penetration

was highly

improbable.

The conductor insulation

and the spacing

between

conductors

tended

to preclude

a short circuit that would bypass

the protection.

The team

concurred with the licensee's

position

and agreed that

a safety concern did

not exist.

However,

the

team felt that routing the load side conductors

from

the backup protection

back through the panel

contain'ing the primary protection

was not in keeping with prudent design practices for redundant

protection

schemes.

(N

The team noted that penetration

assemblies,

including their conductors,

and

the protective devices,

appeared

to be adequately

sized.

Coordination of 2

protective device trip characteristics

with the thermal characteristics

( I t)

of the penetration

assemblies

appeared

acceptable.

2.9

Auxiliar~Feedwater

(AFW) Electrica~lS

stem

The power supplies

to the

AFW pumps

and their associated

instruments

and

valves,

and the automatic initiating signals

to start the

AFW pumps

under

various

normal

and

abnormal

operating conditions

were reviewed.

Each of the

instruments

in

a given

AFW train was

powered

from the battery backed

inverters.

No inverters

supplied

power to instruments

and control valves in

more than one

AFW train.

The sequencer

timer relay used in the

AFW system logic circuit was the

same

type used in the

EDG sequencing

logic circuit.

The minimum voltage allowed by

the Agastat timers, cat.

no.

2412AO,

was

120

V - 132 V, which corresponded

to

3570

V - 4620

V at the 4160

V bus.

3570

V was higher than the second

level

relay

(SLUR) set point and the 4620

V was higher than the

10'X

allowance for the 4160

V system.

The application of this timer appeared

to be

acceptable.

The initiation of a safety injection actuation

signal

(SIAS)

appeared

to inhibit all other

AFW automatic actuation signals.

AFW pumps

would not start simultaneously with other

pumps during the

EDG load

sequencing.

The design of the electrical portion of the

AFW system

appeared

to be

acceptable.

3.0

Mechanical

Systems

The

team reviewed calculations

and documentation

and conducted

walkdowns of

EDG fuel oil storage

and transfer,

lubricating oil, starting air,

and diesel

heating

and cooling equipment,

on

a sampling basis,

to determine

the ability

of mechanical

systems

supporting

the

EOGs to perform their design

basis

~functions during postulated

accident conditions.

The team reviewed equipment

associated

with the heating, ventilating,

and air conditioning

(HVAC) of the

'diesel

generator

room, battery

rooms, essential

switchgear

rooms,

and selected

EDG and

HVAC design modifications.

The team reviewed the translation of

various mechanical

loads of selected

pumps to,electrical

loads for input into

design basis calculations.'

3.1

E ~Di

i

G

ill~E~

3. 1.1

Fuel Oil Storage

Capacity

FSAR Section 9.5.4.1,

Revision

6 dated 9/90, required availability of

sufficient

EDG fuel oil storage

capacity for 7 days of EDG operation while

providing power for minimum LOCA loads in one unit and

power for operation of

equipment in a second unit that was in hot or cold shutdown conditions.

Technical Specification (TS) 3.8. 1. 1 required that

a minimum of 52,046

gallons-of

EDG fuel

be available for both units in Modes 1-4.'CPP

had

two 40,000 gallon

EDG fuel oil storage

tanks.

The

team reviewed

EDG fuel oil requirements

and licensee calculations

to

verify compliance with those requirements.

Calculation M-786, Revision

1

dated 4/22/91,

determined

the amount of fuel oil required for 7 days

operation at

FSAR minimum ESF loads.

The calculation determined

that the

amount of fuel oil for two unit operation

(one unit experiencing

a

LOCA and

the second unit shutdown)

was 51,963 gallons.

The calculation also

determined that the

two

EDG fuel oil tanks

had

an unusable

volume of

972.4 gallon each for a total

two tank usable capacity of 78055 gallons.

The tanks were usually allowed to be depleted

by 7500 gallons before

additional fuel oil is ordered.

The team noted that calculation

M-786 used

a fuel oil average

specific gravity-

of 0.88.

TS surveillance

requi rement 4.8. 1. 1.3.c( l)(a) allowed

a minimum

specific gravity of 0.83.

Use of the minimum TS allowed specific gravity would

have

been

more appropriate

and would have resulted

in

a

EDG fuel oil storage

requirement of 54,975 gallons.

The noted non-conservative

calculation

was

discussed

wit% the licensee.

In response

to the

teams

concern,

the licensee

.

performed additional calculations

and demonstrated

that conservatisms

in the

assumed

fuel consumption for various

ESF loads could be revised

and

approximately

4000 gallons of fuel oil consumption

could be removed

from the

calculation.

'The licensee

agreed

to review and establish

a documented

basis

for the

TS fuel oil capacity requirements,

and submit any necessary

TS change.

The team acknowledged

the licensee's

response

but still considered

the lack of

conservatism

in the calculation to be

a. weakness.

The

team felt that the

calculation

lacked sufficient consideration for the

TS

EDG fuel oil specific

gravity requirements.

Furthermore,

the team noted that the

verification/checking

process

had not caught the non-conservative

assumption.

Supervision

had inappropriately

approved

the non-conservative

calculation.

During the review of the

EDG fuel oil capacity calculations,'he

team

was

informed of a licensee

prepared Justification

For Continued Operations

(JCO)

relevant to DCPP's

EDG fuel oil storage

capacity.

JCO 89-01 for Units

1 and

2

had

been

in effect since 2/89.

The

JCO was

implemented

to provide increased

fuel oil storage

requirements

to meet minimum loads for seven

days,

per the

22

FSAR,

due to increased electrical

load

and

added surveillance

requirements

of

Regulatory

Guide

(RG) 1. 137,

"Fuel Oil System for Standby Diesel'enerators,"

Revision 1, 10/79.

The

JCO was,still in effect and the fuel oil storage

capacity requirements

needed

to close out the

JCO were still unresolved at the

time of this

EDSFI inspection (4/91), the team 'felt that there did not appear

to be proper

and timely resolution of the still open (2/89)

JCO fuel oil inventory

issue with respect

to determination of the technical

basis

and resolution of

potential

TS licensing issues.

As noted above,

the licensee

agreed

to more

expeditiously pursue

the resolution of the

JCO issue

and potential

EDG fuel

oil TS change

requirements.

The team considered

the lack of prompt

resolution of this issue to an additional

example of the licensee's

weakness

in achieving timely corrective actions.

3.1.2

EDG Air Start

System

FSAR Section 8.3. 1. 1. 13.2 described

the

EDG air start system.

The

FSAR

section stated,

"Both of the two air-start

systems

operating together

are

capable of starting

and accelerating

the engine generator

set to rated

speed

and voltage in less

than

10 second's.

In the event that one of the air-start

systems fails or is unavailable,

the redundant air -start system is capable of

starting

and accelerating

the engine generator

set to rated

speed

and voltage

in less

than

12 seconds."

The section continued to describe

the

"turbocharger

boost system."

Although the

FSAR section discussed

the

need

for the turbocharger

boost system, it did not clearly state that it was

necessary,

in addition to the start air system, for the capability to start

and load the

EDGs to rated

speed

and voltage within ten seconds.

Preoperational

test records

reviewed

by the

team confirmed that need.

The

licensee

confirmed the team's

observation

and stated

that the

FSAR would be

clarified in the next normal

FSAR update submittal.

3. 1.3

Jacket

Water/Lube Oil Temperature

The team reviewed licensee calculations that evaluated

the

EDG cooling

capabilities.

DCPP Calculation 82-13 determined that at the maximum design

ambient temperature

of 91'F, the

EDG room temperature

would be 123'F.

The

design

temperature

of the diesel

generator

room was 120'F in accordance

with

FSAR Section 9.4.

The team questioned

the licensee

regarding

the long term

and short term effects of the higher temperature

on mechanical, electrical,

and electronic

components

located in the room.

The licensee

performed

an

evaluation

in response

to the team's

questions

and concluded that the 123'F

room temperature

would still be acceptable

(AR A0229031).

Acceleration of

aging

on

some

components

would occur;

however,

no short term failures were

expected.

The

team noted that the

EDGs

had upper limits on jacket water

and lube oil

temperature,

above which premature

wearing of components

and deterioration of

performance

could occur.

The

EDG vendor provided the licensee with a 205'F

upper limit for EDG water jacket temperature

and

a 185'F upper limit for lube

oil temperature.

The

team noted that at diesel

room temperatures

of 123'F,

which corresponded

to the maximum

FSAR stated

design

ambient temperature

of

91'F,

no design calculation

had

been

performed to determine

the jacket water

and lube oil temperatures.

The licensee

agreed

to obtain jacket water

and

lube oil temperature

calculations

from the

EDG vendor at 123'F diesel

room

23

,temperature

to ensure that the jacket water

and lube oil upper temperature

limits would not be exceeded.

In addition to the above:commitment,

the licensee

stated that alarms

were

provided to warn the operator

of, the high temperature

condition before the

upper limits were reached.

.The li.censee

provided the annunciator

response

procedure

(AR PK16-08), that ensured'hat

the

EDG room temperature

would not

increase

appreciably

beyond 120'F.

The

EDG room west doors were normally

open for EDG room cooling and the east

doors were normally closed for fire

protection.

The annunciator

response

procedure

checked that the west doors

had not inadvertently shut

and were still open.

The procedure

did not

require the opening of the east

doors to increase

EDG room ventilation flow.

The licensee

committed to review and change

the annunciator

response

procedure

as necessary'o

ensure sufficient diesel

room cooling on high room

temperature

annunciation.

Pending further licensee

evaluation

and

performance of any annunciator

response

procedure

change,

this was identified

as Unresolved

Item 50-275/91-07-05.

The day before the

team exit meeting,

the

team was

made

aware of, and

reviewed test records for performance of STPN-96. for EDG 1-1 performed

on

November

16,

1989.

The test records

showed that both high lube oil and high

jacket water temperatures

of 195'F (upper limit of 185'F

as described

in

Section

3. 1.3 (b) and 183'F, respectively,

were observed

before the licensee

was able to open the east roll-up door to cool

the room.

The

room

temperature,

at the time of high temperature

alarms,

was only at 92'F.

This

was well below the 123'F

room temperature" expected at maximum

FSAR stated

design

ambient temperature

of 91'F.

Test records

showed that lube oil, jacket

water

and

room temperature

went down, but drifted u'p again to higher values

after

a period of about six hours

and reached

values

higher than previously

recorded.

Since the

team obtained

these test records

near the end of the

inspection,

the

team

had insufficient time to appropriately

review the

information.

However,

on the basis of the information reviewed,

the team

had

the following concerns:

The cause of high lube oil and high jack water temperature

at only 92'F

diesel

room temperature

should

be determined.

The team noted that

maximum diesel

room temperature

could

be 123'F, which would result in

higher lube oil and jacket water temperatures.

An evaluation

should

have

been

performed to determine

the consequences

of the observed

condition should it occur during operation of the

EDGs under accident

conditions.

b.

Lube oil temperature

during this test

exceeded

the upper limit of 185'F

set

by ALCO.

An evaluation

should

have

been

performed to determine if

possible, deterioration of the

EDG occurred.

Pending further

NRC inspection

to review the licensee's

evaluation or

analysis,

determination of cause,

and performance of any necessary

corrective

actions for the

November

16,

1989, high temperature

alarms during performance

of

EDG testing, this was identified as

an additional

item for Unresolved

Item 50-275/91-07-05..

24

314

3

~it

E

EDGs could derate

due to high ambient temperature

and insufficient engine

warming.

The team noted:that

the diesel

engines

were rated at an ambient

temperature

of approximately 90'F.

The team noted that the maximum recor'ded

OCPP

ambient temperature

was 96'F.

The

team questioned

the licensee

regarding

the

possible derating of the

EOGs

due to ambient

temperatures

that were higher than

its rated ambient temperature

and possible insufficient engine warm-up during

its initial operating period.

The licensee

responded

that the diesel

package

was designed

by ALCO to compensate

for warm-up of engine 'inclusive of

support

systems

to operating

temperature

and for ambient temperature

above

rated temperature.

The input of fuel oil to the engine is varied to

compensate

for increasing

and decreasing

loads

and other variable conditions

which govern the output of the engine (load, ambient temperature,

air manifold

.pressure,

exhaust

pressure,

etc.).

The amount of derating

due to the

increase

in ambient temperature

to 96'F or insufficient warming of the engine

would be compensated

by increasing

fuel supply to the engine.

The team

had

no

further concerns

in this area.

3.1.5

1

4

1fff

1

f

1

133

The

EDG room west roll-up doors

were normally left open to provide for EDG

room cooling.

These

doors

were designed

to be closed

by means of fusible

links that sensed

high temperatures if a fire occurred in the room.

The team

reviewed the seismic qualifications of the doors

and the fusible links.

Calculation

E(jP 304. 1,

OCP N-34398 Rl showed that both the mechanical

and

electrical

components

of the fusible link and other mechanical

parts of the

doors

had

been seismically qualified.

The team concluded that seismic

qualification of the west roll-up doors were acceptable.

3.1.6

Pin~in

Stre~ss

Anal sis - Air Starting System

Q

The

EDG air start system

was

a seismically analyzed

system.

The team reviewed

selected

models of piping stress

analysis for the Air Starting

System.

The

analysis

was performed utilizing Bechtel

stress

analysis

program NE101.

The

analysis

assumptions

and methodology

seemed

to be acceptable

and the allowable

stresses

were well within code limit.

3.1.7

Fuel Oil and Jacket

Water Chemistry

The

team reviewed selected

samples

of fuel oil and jacket water chemistry

sample reports

to ascertain

that appropriate

chemistry controls were being

implemented

by the licensee.

The team noted that the licensee

had established

acceptance

criteria that were within TS allowable limits.

The team review of

the chemistry sampling records

indicated that results of the sampling

reviewed

were acceptable.

3.2

3.2,1

Heat~in

and Ventilation

Battery

Room Ventilation

The team reviewed

the ventilation design of the battery

room to ascertain

that

sufficient ventilation existed to preclude

a hydrogen explosion hazard

under

various postulated

design conditions.

Calculation 83-46 determined

the

25

.adequacy of natural ventilation to the battery

room on loss of fans

and the

hydrogen concentration

in the

room was calculated.

Based

on an ambient

'temperature

of 78'F and

room temperature

of 104;F, the natural ventilation

flow was calculated

to be

68

CFN and air flow required to maintain

2X

H

by

volume in accordance

with Regulatory

Guide 1. 128 was

1 CFN.

Although t(e

calculations

raised

several

questions

from the team,

licensee

response

to the

questions

and conservatisms

in the calculations

confirmed that the battery

room ventilation met licensee

commitments

and requirements.

3.3

Power

Demand for Major Loads

The

team checked selective

samples of vital 4.16

kV mechanical

loads to

ascertain

that the loads

were being appropriately

accounted for in the

EDS

design.

Review of the mechanical

loads indicated that actual

pump

characteristics

were

used

and were conservative.

The team noted however,

that loads listed in

FSAR Table 8.3-5,.Revision

5 were outdated

and not

conservative

as discussed

in Section 2.3. 1 of this report.

As previously

noted,

an

FSAR change will be accomplished

and the loads listed in Table 8.3-5

of calculation

150C, Revision

5 would be followed, except for the component

cooling water

pumps load which required further change

to 342

kW(e) instead of

318 kM(e).

3.4

Auxi'liar~Feedwater

System

3.4. 1

.

AFW Pump Runout Protection

Runout protection

was provided to the motors of the Auxiliary Feedwater

(AFW)

pumps to prevent motor overloading.

The team reviewed runout protection

design calculations

to 'verify that appropriate

design considerations

were

utilized.

Calculation

ISP-1-03 determined

low, AFM discharge

pressure

setpoints

and

AFW level control valves position to limit runout of AFW pumps.

For

a feedwater line break scenario,

low pump discharge

pressure

would

position the

AFM level control valves

to

a predetermined

position

and limit

the

AFW flow.

The

AFW motor power was limited to 600 hp by controlling the

AFW flow.

The team reviewed selected

calculation assumptions

and methodology

and concluded that the calculation assumptions

and methodology

appeared

to be

acceptable.

3.4.2

(uglification and Separation

of AFW Level Control Valves

~LCVs)

The team reviewed the

AFM system to determine

the effects of a feedwater line

break

and possible effects of steam

on the

AFM LCVs. The team reviewed

the

qualifications

and separation

of the

AFW LCVs in relation to their ability to

cope with a feedwater line break

and to ascertain

that

AFW would still be

available to the steam generators.

The team review indicated that the system

design

met licensee

commitments

and applicable

requirements.

4.0

Eq~ui ment Testing, Surveillance,

and Maintenance

4.1

EDG Testi~n

The

team observed

the performance of the monthly

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months surveillance

on

1-3,

as required

by TS and

implemented

by Procedure

N9H.

The operators

appeared

to follow the procedure appropriately.

An additional

EDG start

was

26

immediately performed after completing the surveillance

procedure

because

one

of the times recorded for the

EDG appeared

to be inappropriately short in in

comparison to previous experience for starting

and loading the

EDGs.

Shortly after

EDG 1-3 was shut down, the inspector discovered

the radiator

door of EDG 1-2 open about 80 degrees.

The inspector

informed an operator,

who promptly obtained

keys,

locked the door,

and checked that the other

radiator doors were locked.

The door was required

by Revision

10 Procedure

OP

J-6B: II, "Diesel Generator

1-2, Nake Available" to be locked shut.

This is to

prevent personnel

entry and to prevent

bypass

flow around the

EOG water jacket

radiator coils, which could result in inadequate

cooling of the water jacket.

The licensee

stated

that the configuration of the door is such that

an open

door would have blocked the walkWay past the radiator, resulting in quick

discovery

by an operator during operator

rounds.

Also, unless

the door was

fully open,

the airflow into the radiator would have

caused significant

differential pressure

across

the door, causing

the door to slam shut.

In

either case,

the licensee

stated that the safety significance of the open door

was minimal.

As corrective action;

the licensee

planned to review applicable

work instruction references

to include

a precaution

to close

and lock the door

after the activity, and to install warning signs

on the door that it must be

locked while the

EDG is operable.

The team considered

this assessment

to be

appropriate.

Therefore, this apparent violation of TS 6.8. l.a, which requires

that plant procedures

be implemented,

was identified as

a non-cited violation,

50-275/91-07-06,

in accordance

with 10 CFR 2, Appendix C, V.A., -since the

safety s.ignificance

appeared

minimal, and the licensee corrective action

appeared

to be prompt and appropriate.

The

team noted that the

EDG 1-3 room temperature

gage TI-99 appeared

to be

reading

about

10 to 15'F high.

The licensee

observed

the gage

and initiated an

Action Request

(AR) to have the calibration checked.

The gage is scheduled

for 18 month calibrations,

and

had

been calibrated

about nine months prior to

the inspection.

The licensee

stated

that this was not an immediate

operability concern,

because

the instrument bias

was in a conservative

direction.

The

team reviewed the records of the last two calibrations of the

gage.

The gage calibration records

reviewed did not indicate excessive drift

or bias

and that the calibration frequency

appeared

to be appropriate.

The team compared

the

TS surveillance

requirements

with the surveillance

testing

implemented

by plant procedures.

Three

EDG surveillance

procedures

contained

acceptance

criteria which only partially implemented

the

TS

requirements.

1.

TS 4.8. 1. 1.2.b(7)(b) required that, for

a simulated

loss of offsite

power, in conjunction with a Safety Injection test signal,

the

EDG must

energize

accident

loads

and operate for

greater

than or equal

to five minutes

while loaded.

After energization of these

loads,

the

EDG must maintain steady

state voltage

and frequency of the emergency

buses

at 4160

+ 420V and

60 +

1.2

Hz during this test.

However, Revision

14 of Procedure

N-15,

" Integrated

Test of Engineered

Safeguards

and Diesel Generators,"

Step

15. 1.7, referred to

Attachment 8.6 of the procedure.

Attachment 8.6 required information on

voltage,

frequency values and-stability

to be recorded at one minute, although

the body of the procedure

required this to be at five minutes.

This was

considered

a weakness.

'I

~ It

27

2.

TS 4.8.1.1.2.b(8)

required that, within five minutes after completing

a 24

hour

EDG operating test,

the requirements

of TS 4.8.1. 1.2b(5)(b)

be performed.

~ This required simulating

a loss of offsite power,

EOG auto start,

and

energization of emergency

loads.

After energization,

the steady state voltage

and frequency of the emergency

buses

shall

be maintained at 4160

+ 420

V and

60 + 1.2

Hz during this test.

- Revision

12 of Procedure

N-9G, "Diesel Generator

24 Hour

Load Test," Steps

12.3.2.m

and n, referenced

by Step.15.

1 as the acceptance criteria, required

that the voltage

and frequency

be verified to be steady.

However, the length

of time for this stability was not specified in the data sheets.

Although

the body of the procedure i'ndicated'hat

the scope of the procedure

was to

demonstrate

the stated condition, the

team considered

this to be

a second

example of poorly written surveillance test procedures

and identified this as

another licensee

weakness.

3.

TS 4.8. 1.'1.2,

and Table 4.8-1 requirements

concerning

EOG testing,

require, in part, that the criteria of Regulatory

Guide 1. 108 be used to

determine validity of

EDG failures'.

The

Reg Guide required,

in part, that

an

EOG start

be considered

successful if it met the design accident requirements.

This included design

basis

times to start

and load to the bus.

Con'sequently,

a failure to meet design basis

times would be considered

an unsuccessful

start.

Revision

3 of Procedure

N-9I stated that it implemented

the above requirement

to determine

the validity of the start

as defined

by Reg Guide 1. 108.

Steps

8.4 and 8.5 of the procedure

only require the diesel start

and load

1300

kW.

No specific time limits for starting

and loading are contained

in the,

procedure,

even

though the diesel

is required

to start

and load within 10

seconds

in order to be considered

a valid start.

There did not appear

to be

acceptance

criteria documented

in the procedure

which addressed

the time in

which the

EDG was required to start

and load to the bus.

For the three procedures

discussed

above,

the licensee

plans revisions to

specifically address

the

TS requirements.

For the first two instances,

the

licensee

stated that Procedures

N-15 and

N-9G wi'll be revised to contain

a

step which explicitly addresses

the five minute stabilization requirement

as

implemented in procedure

N-16Al, in order

to make the surveillance tests

consistent.

For the third procedure,

N-9I, the licensee

planned to review the

procedure"and clarify the acceptance

criteria.

The above

examples of inadequate

procedural

implementation of surveillance

requirements

appeared

to be

a violation of TS 6.8. l.a, referencing

Regulatory

Guide 1.33, regarding

adequate

implementation of Technical Specification

surveillance

requirements.

This was identified as Violation 50-275/91-07-07.

4. 1. 1

EDG Air Start

System Testing

The Emergency

Diesel

Generator

(EDG) air start

system provided the means for

starting the

EOG's.

The system consisted

of 'two separate

trains of starting

air and

an additional train of turbo air start for each

Each train

consisted

of a compressor,

after cooler, filter/dryer components,

an air

receiver,

pressure

reducer, air start solenoid valves

and air start motors.

Each train included

a check valve which served

as

a means for passively

isolating the

non safety-related,

non seismically analyzed

compressor,

after

28

cooler, filter/dryer piping from the safety-related,

seismically analyzed

piping system

up to the

EDG air start motors.

The 'licensee

tests

the

EOG air start system

check valves,

OEG-214,

225, 236,

247,'58

and

269 using Procedure

STP V-302 Revision

1.

The most recent

testing of those valves at the time of the inspection

was performed in April

of 1'989 for Unit

1 and in Yiarch of 1990 for-Unit 2.

STP V-302 and the results

of recent tests

were reviewed.

The inspector

had the following observations:

(1)

The tests

measured

receiver pressure

drop while piping upstream of the

check valve was vented.

The mechanism

used for venting the upstream

piping was

by manual lifting of a relief valve.

Filter drains

and

a

drain valve were available for performing this function but were not

required to be used

by the procedure.

(2)

The tests

were 'required to be conducted for only 10 seconds.

The

relatively short duration of the tests

appeared

to be susceptible

to

error.

(3)

The acceptance

criteria for the test

was that

no more than

a 30 psig drop

in receiver pressure

be observed

during the

10 second test.

Recent tests

indicated that

a maximum actual

leak rate of 2 psig in 10 seconds

was

observed

during testing of all the check valves.

However,

the acceptance

criteria would allow a check valve to pass this test with a leak rate

that would, within one minute, preclude

the air receive

s from having

sufficient air to start

an

EOG.

(4)

The licensee

had

no documented

basis for the check valve leakage

acceptance

criteria.

(5)

The check valves were not included in the licensee's

ASNE Section

XI

Inservice Test

( IST) Program.

NUREG 0675 Supplement

31, Safety

Evaluation Report, related

to the operation of DCPP,

dated August 1985,

Section 5.2.8. 1,

Item

12 required that valves in the diesel air start

system that perform

a safety function be full-stroke exercised quarterly

in accordance

with the requirements

of subsection

IMV of Section

XI of

the

ASYiE code.

The licensee

response

to the

SSER

31

NRC question

indicated that the

IST program

had

been revised to include testing

of EDG air start valves.

Subsequent

discussions

with the licensee

regarding

the above observations

resulted in the initiation of Action Request

A0231186 to establish

the

acceptance

criteria

and bases for EDG air start check valve leakage.

The

licensee

also stated

that

STP

V302 would be revised to utilize a more

appropriate

vent path other than the relief valve.

10 CFR 50 Appendix B,

Criterion

V requires,

in part, that instructions,

procedures,

or drawings

include appropriate

quanti tative or qualitative acceptance

cri teria for

determining that important activi ties

have

been satisfactorily accomplished.

OCPP

FSAR, Revision 2, Section 8.3. 1.1. 13.2 states,

in part, that each air

start

system provide

45 seconds

of continuous

engine cranking.

The acceptance

criteria of 30 psig/10

second

would not ensure

45 seconds

of continuous

cranking

with the system

leakage

and still be able to start the

EOG to rated

speed

and

voltage

and load within 10 seconds.

This appeared

to be

a violation of 10 CFR 50, Appendix B, Criterion V, and

was identified as another

example for

Violation 91-07-07.

29

4.2

~Rela

Calibratio~nPro

ram

'The team reviewed relay calibration records

to verify that setpoints

conformed

to those specified in the setpoint calculations.

The team inspected

the relay

settings of devices within the selected

load path

on

a sampling basis.

The

calibration of the protective relays

appeared

to be completed during .each

refueling cycle by the electrical

maintenance

department.

Work activiti'es

were usually monitored

by system engineers

and controlled by administrative

calibration procedures.

The team noted that

a top tier administrative

procedure

describing

the relay calibration program did not exist.

However, it

was noted that controlled procedures

for each

type of relay describing

guidance for calibration

and maintenance

were available.

The .team noted that

the licensee

appeared

to have

a good centralized electrical setpoint

document

.

which identified the setpo'ints

and the design'basis.

4.3

Setpoint Control

Program

The licensee's

program for establishing

and controlling safety-related

instrument setpoints

was described

in Administrative Procedure

AP-C-lS6,'

"Electrical

and Mechanical

Device Setting

and Instrument Setpoint

Change

Control Program,"

Revision 0.

The procedure

described

the requirements

and

methods for initiating, analyzing, controlling and documenting

changes

.,to

electrical

device setpoints.

Requests

for setpoint 'or device setting

changes

were documented

and tracked

by

action requests

(ARs).

The request

forms were routed to the engineering

manager

or his designee

(usually the system engineers)

for review and

. concurrence.

This initial review was intended to ensure

that the proposed

setpoint

change

was reasonable

and would not adversely effect system operation

or compromise

TS operability requirements.

4.4

llolded Case Circuit Breaker~Testin

The

team reviewed maintenance

procedure

MPE-64. 1A, "Electrical Maintenance

Procedure

AC and

DC Molded Case Circuit Breaker Test Procedure,"

which was

used

for verifying the operability of molded. case circuit breakers.

Acceptance

criteria .for the testing were contained

on the licensee "List of Electri'cal

Devices for Protection

and Control Circuits" drawing b'050024-15

and were

transcribed

by the craftsmen

on to the data

sheets

of MPE-64. 1A.

The

maintenance

procedure

contained specific sections for testing ma'gnetic only

breakers,

thermal

magnetic

breakers

with adjustable

magnetic trips,

and

thermal

magnetic

breakers

with fixed magnetic trips.

The team reviewed the specified

acceptance

criteria and results of testing for

circuit breaker

52-1H-60,

a thermal

magnetic

breaker with a fixed magnetic

trip, which was

used to supply the

ED121 battery charger.

The allowable trip

time for the breaker

was required to be 20-132

seconds

at 450 amps,

which was

+ or - 20K of the times specified

on the manufacturers trip curve for the

thermal

element of this breaker.

For the fixed magnetic

element,

the testing

verified that the breaker

would not trip at

a value lower than the lowest

value of the minimum trip range

(750 amps),

and that the breaker

would trip

instantaneously

within the upper

bounds of trip range for the magnetic

element

(2700 amps}.

No adverse

findinas were noted

by the team with regard. to this

procedure.

30

4.5

Fuse Control

The licensee's

fuse control

program

was governed

by a policy letter dated

April 5,

1991 from the Electrical

Maintenance

and Instrument Control Managers,

titled "DCPP

Fuse

Replacement

Policy."

This policy letter replaced

ISC and Operations policy memoranda

issued in 1987..

This policy letter required that:

an Action Request

(AR) be initiated for all

blown fuses,

affected

equipment

be inspected

before replacement,

appropriate

documents

be reviewed

to determine correct replacement

fuses,

proper selection

for containment penetration circuits

be verified, all fuses that may have

been

subject 'to

a fault be replaced

even if they did not blow, and replacement

fuses

be obtained for safety related

equipment

from approved locations.

The team verified that fuse replacement

was controlled by plant approved

work

orders.

The inspector walked

down

some of the accessible

fuses

on

some of the

safety related battery chargers.

The installed fuses

appear ed to be correct.

Based

on review of the above policy letter

, control of fuse replacement

by

approved

work orders,

and sample

walkdown, the

team concluded that the

licensee's

fuse control

p'rogram

was adequate.

4.6

Char er and Inverter Testin

, Surveillance

and Maintenance

The inspecto~

reviewed

sample

surveillance

and maintenance

procedures

and

records for Class

1E battery chargers

and inverters.

.These

procedures

and

records

appeared

to contain

key attributes,

parameters

and acceptance

criteria

to assure

the functionality of the

EDS.

One of the completed

maintenance

procedures

reviewed

was flaintenance

Procedure

(YiP) E-67.3A, Revision ll

"Routine Preventive

Maintenance of Station Battery.Chargers,"

performed

on

Charger ll under

Work Order Number

R72236

on April 8, 1991.

The inspector

found that in Section 7.30, "Voltage Ripple," the acceptance

criteria

specified

was less

than or equal

to

100

mVAC.

The actual ripple voltage

measured

was

108,

650

mVAC.

The Maintenance

Engineer identified that he was

verbally notified about this, per Step 7.30. 1 of the procedure.

However,

there

was

no documented

evidence *that this out of specification condition was

formally dispositioned.

Upon further revigw, the'nspector

learned that two other charger s were tested

previously using the

same

procedure.

Charger

231

was tested

on September

7,

1990,

and Charger

12 was tested

on February 9,

1991.

Ripple voltages

higher

than

100

mVAC were observed

on these

two chargers.

These

nonconforming

conditions

were documented

in the test reports,

and the Maintenance

Engineer

was notified.

In addition,

AR4 A0202659

and A0217639 were initiated for these

discrepancies.

The System Engineer considered

that the chargers

were

operable'lso,

the Maintenance

Engineer

noted that

a third AR was not

generated

because. of the two pending

ARs for the other

two chargers.

In response

to inspectors

question,

the System Engineer

generated

another

AR8

A0217639 to expedite

the resolution of the two pending

ARs.

On Nay 17,

1991,

the licensee

completed

the evaluation

and concluded that the

100

mVAC

criterion was in fact, overly conservative.

The

new acceptance

criteria was

revised

to

1% of the output voltage (i.e.,

1200

mVAC) per

EPRI guidelines.

The team reviewed this evaluation

and 'concurred with the licensee that the "as

found" ripple voltage

appeared

to have

been acceptable

"as is" and the

, I

31

identified condition

appeared

to have minor safety consequences..However,

~

failure to generate

an

AR for the third case of out of specification ripple

~voltage

was not in accordance

with Procedure

C-3, "Conduct of Plant

and

'quipment

Tests",

step 4;5.2.a.2.

The inspector considered this to be an

exampl,e of the following weaknesses:

( 1)

The

AR program procedure

NPAC C-12,

"NonConformances,"

did not clearly

require workers to formally document

nonconforming conditions

found

during testing (i.e. quanti tative acceptance

criteria not met) in an

AR.

(2)

The procedure

NPAC C-3, "Performance of Tests

and Surveillances," clearly

required

an

AR to be initiated upon failure to meet

an acceptance

criteria during

a test.

However,

NPAC C-12 and C-3 were not consistent

in this requirement.

(3)

The original

100

mVAC acceptance

criteria was unrealistically

conservative.

The industry standard

was

1% of line voltage

(1200

mV ac

for Diablo Canyon).

The basis

did not appear

to have

been

documented.

(4)

Similar discrepancies

had

been

found

on three chargers

since

September

1990.

The licensee

resolved it after the inspector questioned

the test

report.

The resolution did not appear to have

been timely.

The failure to document

the above

noted nonconforming condition was'identified

as non-cited violation 50-275/91-07-09.

The licensee

took prompt corrective

action

and the safety significance of the nonconforming condition was minimal.

The violation was considered

non-cited in accordance

with 10 CFR 2, Appendix

C, Section

V.A.

4.7

Batt~er

Testing, Surveillance,

and Maintenance

The inspector

reviewed the battery test procedures.

This included the

performance test conducted

every

60 months to assure

the battery capacity is

greater

than or equal

to 80% of the manufacture's

rating,

and the service

tests

conducted

every

18 months

to assure

the batteries

are capable of meeting

the load profile.

These

procedures

appeared

to include the necessary

acceptance

criteria and the.

proper testing steps.

The inspector also

sampled

a report for a recently

completed service test for Station Battery

12.

The service profile defined in

the

DCN appeared

to have

been appropriately

used for the test.

The licensee's

battery testing

program appeared

to be adequate.

4.8

Equipment

Malkdown Inspection

The team inspected

plant equipment within the

EDS 'and

compared

the installed

configurations of the components

with the requirements

of design

documents.

The team verified such attributes

as location, rating, size,

and type.

Additionally, the

team reviewed maintenance

and calibration activities

associated

with the selected

equipment.

32

4.8.1

Transformers

.The team inspected

the unit auxiliary transformer,

standby startup transformer

and load center transformer

on

Bus

1G.

The loading, rating, 'capacity,

and tap

settings

appeared

to be in accordance

with plant drawings

and design

do'cumentation.

However, the

team noted a'ifference

between

Drawing SK

437518,

Revision

12A and the

1G load center transformer.

This drawing

indicated the load center transformer

(1G) impedance

to be 6.75%.

The

nameplate

data indicated this value to be 6.8X.

The licensee

stated that the

6.75%

impedance

was rounded off on the

name plate to 6.8% and the 6.75K

impedance

on the drawing agrees

with the transformer test report data

(Document 663336-8).

4.8.2

Switchgear

and Motor Control Centers

Switchgear

and motor control centers

appeared

to be labeled correctly, easily

identifiable,

and well maintained.

For cabinets

which could be opened

by the

licensee without degrading

seismic qualifications during operation,

compartment

internals

inspected

were free of dust

and debris,

and internal wiring

harnesses

were secured

and not apparently

in the way of moving parts.

4.8.3

Circuit Breakers

'

A comparison of nameplate

data with the design

drawings for General Electric 4

kV and

12

kV magna-Blast circuit breakers

showed that the installed circuit

breakers

appeared

to conform to the documented

requirements

for loads,

voltage,

and interrupting capaci ties.

Visual inspection of accessible

circuits

showed

the breakers

to be clean

and well maintained.

Test procedures

appeared

to be'ell

developed

and contained pertinent vendor test

and

maintenance

requirements.

The data record

package of the procedures

appeared

to provide comprehensive

documentation

of as-found

and as-left conditions.

4.8.4

Cable

and

Race~wa

The team examined

the installation of Class

1E cable to verify that the

installation complied with the requirements

of Section 8.3 of the

FSAR.

The

cable train separation

in trays

and conduit in the cable spreading

room and

switchgear

rooms

appeared

to be maintained in accordance

with the

FSAR.

During this inspection

the

team noted that the licensee

had issued Quality

Evaluation

(QE) Q0008100 identifying circuit and raceway schedule

inconsistencies.

These inconsistencies

included:

raceway routing errors,

missing cable

codes,

duplication of sequence

numbers,

lack of circuit routing

to locations,

locations

not in file, and raceway overfills.

The licensee

stated that the root. causes

for"this quality problem included:

( 1) defects

in

the existing program (wire route), which allowed blank data fields (missing

data)

to be input into the system;

and (2) the responsibilities for design

and

data entry were previously in one area of responsibility.

This concept did

not allow for checks

and balances

to assure all data

had

been

entered

correctly.

To correct these deficiencies,

the licensee

was implementing

a

new program

entitled

"SET Route."

Data is presently

being converted

and transferred

from

the old wire route program to the

new

SET route program.

The licensee

plans

to complete

the conversion

and

have all deficiencies

resolved within 24

~

't

~

Ss

33

months.

The team inspected

portions of the

SET route program

and noted that

corrective actions

were being completed

and the concerns

noted

above

appeared

to be'encompassed

by this corrective action.

4.8.5

Low VoltaSeeS

stems

.

The team inspected

the

1E and,non-lE

120

V ac and

125

V dc systems,

including

chargers,

inverters,

and batteries.

Equipment condition and configuration

appeared

to be adequate,

and plant condition and cleanliness

appeared

good.

4.8.6 ~8~i

The team inspected

several

of the safety related

pump areas,

including the

auxiliary sa)t'ater

pump, auxiliary feed water

pump,

component cooling water

pump',

and safety injection

pump

rooms.

In addition, it appeared

that plant

cleanliness

was generally

good.

Seismic tie downs, were observed

to be. in

place for temporary

equipment

and tools.

4..7

~6 ~i1

6

The team inspected

the five EDGs.

Except for specific concerns

documented

earlier in this report,

the material condition of the

EDGs appeared

to be

good.

4.9

E ui ment Hodification Review

4.9.1

DCP-41644-Install

Cable~Sread~in

Room Air Condi tion~in

System

DCP-41644 involved installation of an air conditioning unit for the cable

spreading

room to provide

a relatively constant

temperature

for electronic

devices,

in order to promote service life.

The team reviewed the

DCP and

concluded that the changes

appeared

to be acceptable.

4.9.2

Transformer

V~olta e-Chandte

The team reviewed the unit auxiliary and startup transformers'ap

change

modification package,

DCP E-44355,

Revision

1, dated 2/22/90.

The subsequent

effect of the. change

had

been factored into the load flow and voltage drop

calculations,

96 A-DC and

96 8-DC.

The modification appeared

to be

acceptable.

4

.8 ~Eil

I

ET "I

I de

5. 1

Identi fi ca tion of Noncon formi no Condi tions

The team reviewed the procedures

which identify an'd evaluate

nonconforming

conditions,

and require documentation

of the identification of a problem.

As noted earlier in the report,

Procedure

C-3, "Conduct of Plant

and Equipment

Tests" stated

that observations

found outside of acceptance

require that

an

Action Request

(AR) be written to document

the nonconformance.

However,

a

higher tier procedure,

C-12,

"Nonconformances,"

which listed several

examples

of instances

requiring initiation of an

AR, did not note the specific

situation where procedural

acceptance

criteria were not met.

This is an

.example of a lack of consistency

in the requirements

to document

a

nonconforming condition or to initiate a problem identification document.

As noted earlier in this:report,

the team identified two occurrences

where

problems

were identified without prompt formal documentation.

Specifically,

these

included

the- open

EDG radiator door and the inverter ripple voltage that

did not meet its acceptance

cri teria.

Each of these

instances

appear

to be

violations of 10 CFR 50, Appendix B, Criterion XVI , which requires,

in part,

that conditions adverse

to quality be promptly identified. In each of these

cases,

the licensee

appeared

to have taken prompt, appropriate corrective

action,

and the safety significance

was minimal.

These violations were

identified as non-cited in accordance

with 10 CFR 2, Appendix C, Section

V.A.

5.2

Review of Selected

NCRs

and Root Cause Analysis

The team reviewed several

Nonconformance

Reports

(NCRs) written

on the

EOS.

lJith the exception of instances

documented

elsewhere

in this report,

the

NCRs

appear

to have

been dispositioned appropriately,

and the associated

safety

evaluations

appeared

to be adequate.

During the

teams

review of electrical related

NCRs,

two NCRs that concerned

failures of an

EDG to start

and load within TS requirements

were identified.

In the first case,

documented

in

NCR DCI-91-TN-N032,

EDG 1-1 took

approximately

19.8 seconds

to start

and load after offsite power was lost on

March 7,

1991.

In this instance diesels

1-2 and 1-3 started

and were loaded

to the vital buses within the ten second

requirements.

In the second

case,

documented

in

NCR DCI-91-TN-N035,

EDG 1-2 took 19.6

seconds

to start

and load

during the performance of Surveillance

Test Procedure

M-15, "Integrated Test

of Engineered

Safeguards

and Diesel

Generators".

on March 18,

1991.

TS 4.8. 1. 1.2.a requires,

in part, that

EDG starts

be verified by the

EOG

accelerating

to at least

900

RPM in less

than or equal

to 10 seconds

and

voltage

and frequency

be 4160

+ or - 420 volts and

60 + or - 1.2

Hz within 13

seconds

after

the start signal.

TS 4.8.1. 1.2.a also requires,

in part, that

EDG testing frequency

be in accordance

with TS Table 4.8-1.

TS Table 4.8-1 requires

EDG testing frequency that is dependent

on the number

of valid tests

and test fai lures.

TS Table 4.8-1 requires that the criteria

for determining

the

number of valid tests

and failures

be in accordance

with

Position c.2.e of Regulatory

Guide

(RG) l. 108, Revision

1.

RG 1. 108, Revision

1, defines "Failure" as the failure to start, accelerate,

and

assume

the

design rated

load within the 'time prescribed

during an emergency

or valid

test.

Position C.2.e of

RG 1. 108, Revision 1, requires,

in part, that all

start attempts

that result in failure to start,

be considered

valid tests

and

failures except if the fai lure can

be definitely attributed to

a malfunction

of equipment that is not

a part of the defined

EOG unit design.

Although the licensee

performed extensive testing relative to these failures,

the exact cause of the first fai lure has yet to be determined'.

The second

failure has

been attributed to the first level instantaneous