ML17250B242
| ML17250B242 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 08/21/1991 |
| From: | Anderson C, Cheung L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML17250B239 | List: |
| References | |
| 50-244-91-80, NUDOCS 9109060005 | |
| Download: ML17250B242 (66) | |
See also: IR 05000244/1991080
Text
U.
S.
NUCLEAR REGULATORY COMMISSION
REGION I
Report
No.
Docket No.
License
No.
Licensee:
50-244/91-80
50-244
Rochester
Gas
and Electric Corporation
89 East Avenue
Rochester,
14649
Facility Name
Ginna Nuclear
Power Station
Inspection
Conducted:
May 6 through June
7,
1991
Inspection
Team
L. Cheung,
Team Leader,
'RI
J.
Lara,
Reactor
Engineer,
RI
R. Mathew, Assistant
Team Leader,
RI
NRC Consultants:
M. Goel,
Mechanical
Engi'neering,
AECL
S. 'Inamdar, Electrical Engineer,
AECL
J.
Leivo, Leivo Associates
P repared
By:
Le nard Cheung,
Team Leader,
El
Engineering
Branch
Section,
ate
Approved By:
CD J.
An
rson,
hief, Electrical Section,
date
Engineering
Branch,
Inspection
Summary:
Ins ection
on
Ma
6 throu
h June
7
1991
Re ort No. 50-244/91-80
Areas
Ins ected:
Announced
team inspection
by regional
and contract personnel
to review the functionality of the electrical distribution system.
Results:
As described
in the Executive
Summary.
9.'i QPQ/>QQQR
P i Q~~ ~ g
AGCICK QHQQ<):3+4
F riF
0
4
Table of Contents
EXECUTIVE SUMMARY .
1. 0
INTRODUCTION
2.0
ELECTRICAL SYSTEMS
2. 1
Offsite Power and Grid Stability
2.2
Bus Alignment During Start-Up,
Normal
and
Shutdown Operation
2.3
Bus Transfer
Schemes
2.4
Emergency
Diesel
Generators
.
2.5
Degraded
Voltages
on Class
1E Buses
.
2.6
Over-Voltage
on Class
1E Motors
.
2.7
AC Systems
Short Circuit Review
.
2.8
Protection of Class
1E Motors
2.9
Selection
and Sizing of Power Cables
2.10 Electrical Penetration
Sizing and Protection
2.11
120
Vac Class
1E System
2.12
125 Vdc Class
1E System
2.13 Conclusion
3.0
MECHANICAL SYSTEM
3. 1
Power
Demands for Major Loads
.
3.2
Diesel
Generators
and Auxiliary Systems
.
3.3
Heating, Ventilating and Air Conditioning System
3.4
Service Water System
3.5
Conclusion
PAGE
8
12
13
14
15
15
16
17
18
19
19
19
22
24
25
0
Table of Contents
4. 0
.
ELECTRICAL DISTRIBUTION SYSTEM
E UIPMENT........
~ ..
25
4. 1
Equipment Walkdowns
.
4.2
Equipment Maintenance
and Testing
.
4.3
Protective
Device Setpoint Control
and Calibration
4.4
Conclusion
5.0
ENGINEERING AND TECHNICAL SUPPORT
5. 1
Organization
and
Key Staff
5.2
Root Cause Analysis
and Corrective Action Programs
5.3
Self Assessment
Programs
5.4
Equipment Modifications
5.5
Temporary Modification Program
5.6
Engineering Support/Interface
.
5.7
Technical Staff Training
5.8
Conclusions
6.0
UNRESOLVED ITEMS
7. 0
EXIT MEETING
ATTACHMENT 1
Persons
Contacted
ATTACHMENT 2
Electrical Distribution System One-Line Drawing
25
26
28
31
32
32
32
33
34
36
36
37
37
38
38
EXECUTIVE SUMMARY
During the period between
May 6 and June 7,
1991,
a Nuclear Regulatory
Commission
(NRC) inspection
team conducted
an Electrical Distribution System
Functional
Inspection
(EDSFI) at Ginna Nuclear
Power Station.
The inspection
was performed to determine if the. Electrical Distribution System
(EDS) was
capable of performing its intended
safety functions
as designed,
installed,
and
configured.
The team also assessed
the licensee's
engineering
and technical
support of EDS activities.
For these
purposes,
the team performed plant
walkdowns
and technical
reviews of studies,
calculations
and design drawings
pertaining to the
EDS,
and interviewed corporate
and plant personnel.
Based
upon the
sample of design drawings,
studies
and calculations
reviewed
and
equipment
inspected,
the
team determined that the electrical distribution
system at Ginna Station is capable
of performing its intended functions.
In
addition,
the
team concluded that the engineering
and technical
support staff,
both at the Ginna Station
and at the corporate offices in Rochester,
provide adequate
support for the safe operation of the plant.
The inspection
also identified one violation, two deviations,
and three
unresolved
i'tems,
as discussed
in the paragraphs
below.
In addition,
one previously identified
item (Violation 50-244/89-81-06)
was closed,
as discussed
in pa'ragraph
4.2.2.
i
The licensee
has
implemented controls to maintain the electrical
system
configuration.
Equipment inspected
was observed to be well-maintained
and
an
effective fuse control
program
was evident.
The development of a molded
case circuit breaker test
program is ongoing.
The testing attributes
being
addressed
are comprehensive
and thorough.
A deficiency
was identified in
handling the as-found data of the protective relay testing.
The dropout
voltage settings of three protective relays drifted below the Technical
Specification limits during the
1991 refueling outage yet
no evaluation
was
performed
as required
by station
procedures.
The corporate
and site technical
engineering
and modification support personnel
are adequately
staffed with competent
personnel
and are very familiar with the
EDS and its support
systems.
Effective interfaces
exists
between
station
and
engineering
personnel.
Communications
between
the various engineering
and
technical
support organizations
were
found to be good.
Engineering
support to
operating
and maintenance
activities was determined to be good.
The team
determined that the licensee
has
an aggressive
self assessment
program
and
considered this to be
a strength.
The licensee
has
a good program to investigate deficiencies,
identify root
causes
and to complete appropriate
corrective actions
in
a timely manner.
Technical training and guality Assurance
Programs
were
found to be adequate.
The team observed
several
examples
of a lack of attention to detail in the
design calculation process.
The examples
included power demand calculations for
the diesel
generators,
circuit breaker coordination calculations,
battery
room ventilation and hydrogen concentration
calculations
and
use of incorrect
fuel oil storage
requirements.
Corrections of these calculations
were
completed during the inspection
except for circuit breaker coordination which
is an unresolved
item.
Part of this weakness
was due to the fact that the
licensee's
engineering
personnel
had generated
a large
volume of design
calculations within a,short
time before this inspection.
Increased
management
involvement to improve the existing design control process
and quality of engineering
work was demonstrated
by the completion of P&ID
Update
Program, Electrical Configuration Controlled Drawing Program,
Engineering
Work Request
(EWR) Procedure
upgrades,
ongoing Design Basis
Reconstitution
Program and.Configuration
Management
Control
Program.
Improvement in the licensee's
design control
and modification process
was noted
during this inspection.
The inspection
findin'gs are
summarized
as follows:
One Violation
Discussed
in
Para
ra
h
Item Number
Protective relay settings
.
drifted below Technical
Specification limits
and were not evaluated
Two Deviations
1. Onsite
power supply not
meeting the single
failure criterion
4.3.3
2.2
50-244/91"80-04
50-244/91-80-01
2.
Redundant control cables
of component cooling
water
pump control
circuits were not
adequately
separated
Three Unresolved
Items
2.2
50-244/91-80-02
1. Completion of a
comprehensive
coordination analysis
for all circuit breakers
2.8
50-244/91-80-06
2.
Degraded
voltage effects
on Class
lE Motors
3. Completion of dynamic
response
analysis of
emergency diesel
generator, loading
2.5
2.4.2
50-244/91-80-05
50-244/91-80-03
Three Observations
1. Unprotected diesel
generator
output cables
2.4.6
2. Undersizing of
certain circuit
breakers
2.7
3.
Lack of loss of
field protection
for emergency
diesel
generators
2.4.5
One Meakness
lack of attention to detail in the desi
n calculation
rocess
examples:
1.
Power demand calculation
for the diesel
generator
2. Circuit breaker
coordination
calculations
3. Battery
room
ventilation
and
hydrogen concentration
calculations
3.1
2.8
3.3.5
4.
Use of incorrect fuel
oil specific gravity in
calculating the fuel oil
storage
requirements
3.2.1
1. 0
INTRODUCTION
During inspections
in the past years,
the Nuclear Regulatory
Commission
(NRC)
staff observed that, at several
operating plants in the county, the
.
functionality of related
systems
had
been
compromised
by design modifications
affecting the. electrical distribution system
(EDS).
The observed
design
deficiencies
were attributed,
in part, to improper engineering
and technical
support.
Examples of these deficiencies
included:
Unmonitored
and
uncontrolled
load growth on safety related
buses;
inadequate
review of design
modifications;
inadequate
design calculations;
improper testing of electrical
equipment;
and
use of unqualified commercial
grade
equipment
in safety related
applications.
In view of the above,
the
NRC developed
an Electrical Distribution System
Functional
Inspection
(EDSFI) program for operating plants.
There are
two
objectives for the
EDSFI.
The first objective is to assess
the capability of
the electrical distribution system's
power sources
and equipment to adequately
support 'the operation of safety related
components.
The second objective is to
assess
th'e performance
of the licensee's
engineering
and technical
support in
this area.
To achieve
the first objective,
the inspection
team reviewed calculations
and
design
documents.
Particular attention
was paid to those attributes
which
ensure that quality power is, delivered to those
systems
and
components
which
are relied upon to remain functional during and following a design basis
event.
The review covered portions of onsite
and offsite power sources
and included
the 34.5
kV offsite power grid, station auxiliary transformers,
4. 16
kV power
system,. emergency-diesel
generators,
480
V Class
1E buses
and motor control
centers,
station batteries,
battery chargers,
inverters,
125
Vdc Class
lE
buses,
and the
120
Vac Class
1E vital distribution system.
The team verified the adequacy
of the emergency
onsite
and offsite power
sources for the
EDS equipment 'by reviewing regulation of power to essential
loads, protection for calculated fault currents, circuit independence,
and
coordination of protective devices.
The team also assessed
the adequacy
of
those
mechanical
systems
which interface with and support the
EDS.
These
included the air start,
lube oil,. and cooling systems for the emergency
diesel
generator
and the cooling and heating
systems
for the electrical distribution
equipment.
A physical
examination of the
EDS equipment verified its configuration
and
ratings
and included original installations
as well as equipment installed
through modifications.
In addition,
the team reviewed maintenance,
calibration
and surveillance activities for selected
EDS components.
The team's
assessment
of capabilities
and performance of the licensee's
engineering
and technical
support covered organization
and
key staff, self
assessment
program
and technical training, temporary
a'nd permanent
plant
modifications, operating
procedures
for EDS, root cause
analysis
and corrective
action programs
and engineering
support in design
and operations
and their
interface.
In addition to the above,
the team verified general
conformance with General
Design Criteria
(GDC)
17 and
18, Systematic
Evaluation
Program
and
Supplement
1),
and appropriate criteria of Appendix
B to 10 CFR Part 50.
The
team also reviewed the plant's Technical Specifications,
the Updated Final
Safety Analysis Report
and appropriate
safety evaluation reports to ensure that
technical
requirement's
and licensee's
commitments
were being met.
The details of specific areas
reviewed,
the team's
findings and the applicable
conclusions
are described
in Sections
2 through
5 of this report.
2.0
ELECTRICAL SYSTEMS
The characteristics
of the power system electrical grid to which the Ginna
plant is connected
were reviewed to assess
the adequacy
of important
parameters
such
as voltage regulation,
short circuit contribution, protective
relaying,
surge protection, control circuits, stability, and reliability.
The
station auxiliary (startup)
transformers
were reviewed in terms of their
kilo-volt-amperes
(kVA) capability, their connections
to the safety buses,
protection,
and voltage regulation.
The emergency
diesel
generators
(EDGs)
were reviewed to assess
the adequacy of the kilo-watt (kW) rating,
the ability
to start
and accelerate
under assigned
safety
loads in the required time
sequence,
the voltage
and frequency regulation, under transient
and steady
state
conditions,
compliance with single failure criteria,
and the applicable
separation. requi.rements.
The
480
V safety buses
and their connected
loads were
reviewed to assess
load current
and short circuit current capabilities,
voltage
regulation, protection,
adequa'cy
of cable connections
between
loads
and buses,
compliance with single failure criteria,
and applicable
separation
requirements.
The team reviewed the regulation of the
EDS loads,
the overcurrent protection,
and coordination of protective devices for compliance with regulation,
design
engineering
standards,
and accepted
engineering
practices.
The review included
system descriptions,
station
Updated Final Safety Analysis Report
(UFSAR),
equipment specifications,
licensee
event reports
(LERs), operating
procedures,
one line diagrams,
and equipment
layout drawings.
The team also reviewed procedures
and guidelines
governing the
EDS design
calculations,
design control
and plant modifications,
and
EDS single line
diagrams
and wiring schematics.
A simplified single line diagram of the Ginna
EDS is
shown
on Attachment 2.
, 2. 1
Offsite Power
and Grid Stabi lit
The Ginna Station receives its power from two independent
34.5
kV circuits
(circuit 751
and circuit 767).
Circuit 751- receives
34.5
kV direct from the
RG&E station
204 and circuit 767 receives
34.5
kV from the Ginna switchyard
station
13A via the
115
kV to 34.5
kV stepdown transformer
No. 6.
Four
115
kV lines (908,
911,
912,
and 913) connect to substation
13A through
the breaker-and-a-half
technique of switching.
This arrangement
provides the
versatility of dual
feed for each line and the ability to remove
any breaker or
transmission
line without deenergizing
any other part of the substation.
The Ginna electrical
power system
was initially designed with a single
auxiliary ( startup)
transformer
12A but
a spare
transformer
'12B was
added after
the beginning of commercial
operation.
However,
the station continued to
operate with only one auxiliary transformer
feeding all safety related
loads.
To increase
the availability margin in the event of a single
system failure,
the 34.5
kV bus
was split and the
system
was re-configured in 1989 to its
present
state.
Each of the auxiliary transformers
is rated
34500-4160-4160
V, 28-41.8
MVA.
These
two transformers
have
two load ratings associated
with them,
the
OA
(oil-air) and the
FA (forced-air) rating .
All safety
loads are supplied
by 'the
these transformers,
however,
according, to 'Load flow and voltage profile
analysis'ocument
No.
EEA-03001,
Revision 0,
each of these
feeders
is capable
of supplying the entire load.
The worst case
loading for the
12A and
12B
transformers
occur when the main generator trips and when all auxiliary loads
are connected
to the offsite grid.
Maximum system loading is 29.6
MVA, split
evenly between
the two secondaries.
The safety related
buses
do no't have
access
to either the main generator
output system or the
115
kV network.
The safeguards
or
1E distribution is divided into two redundant
and completely
independent trains,
A and
B.
'Train A and
B are
each
made
up of two safeguards
480
V buses.
Train A consists
of buses
14 and
18 while train
B consists
of
buses
16 and
17.
2.2
Bus Ali nment Durin
Startu
Normal
and
Shutdown
0 eration
During normal operation,
the main generator
feeds electrical
power at
19
kV
through
an isolated
bus to
a 19-120
kY stepup transformer.
The bulk of the power
required for auxiliaries is supplied
by unit auxiliary transformer
11,
connected
to
a
19
kY isolated
phase
bus
~
During normal
shutdown all auxiliary loads
are transferred
to the station
auxiliary transformers
12A and
12B.
During startup operation all station
loads are energized
from auxiliary
transformers
12A and
12B.
Bus
11B is connected
to bus
12B and bus
11A is
connected
to bus
12A.
After successful
startup
the operator manually transfers
buses
11A and
11B to the main generator.
When the main generator trips, the plant auxiliary loads
from the transformer
are automatically transferred to buses
12A and
12B by closing tie breakers
BTB-B
and BTA-A.
Upon loss of offsite power the loss of voltage relay
on 480
V
emergency
buses
14,
16,
17 and
18 will start the emergency
diesel
generators
DG A and
B and connect
them to their respective
buses.
While reviewing the emergency
bus'es configuration,
the team identified
a design
deficiency in the 'emergency tie breaker
arrangement
between
buses
17 and
18 in
the screenhouse.
Bus
17 (train B) and
bus
18 (train A) are tied with a single
breaker (BT17-18).
Interlocks are provided to prevent closure of the
tie breaker if more than
one
AC power source
were serving the Class
1E buses.
To close the tie breaker,
either (a) both diesel
breakers
must be tripped .and
one offsite breaker tripped,
or (b) both offsite source
breakers
must
be
tripped and one diesel
breaker
must be tripped.
While the interlocks preventing closure of the tie breaker
were redundant,
only
one control circuit for the breaker
was provided within the switchgear;
therefore,
spurious closure of the breaker
due to
a fault in the control
circuit could be postulated
during an event requiring onsite
power sources.
If this occurs
when both EDG's are running out of phase,
buses
17 and
18 plus
one of buses
14 and
16 could be lost (assuming
one of the
EDG breakers trips
before tiebreaker
BT17-18,
because
of a lack nf a comprehensive
breaker
coordination
program).
The team concluded that this design deficiency
constitutes
a deviation
from paragraph
3. 1.2.2.8 of Ginna Updated Final Safety
Analysis Report
(UFSAR), General
Design Criterion 17, which states,
in part,
"the onsite electric
power supplies,
including the batteries,
and the onsite
electric distribution system,
shall
have sufficient independence,
redundancy,
and testabi lity to perform their safety functions assuming
a single failure"
(50-244/91-80-01).
In response
to the team's
concern,
the licensee
withdrew the tiebreaker to the
test position,
so that the tiebreaker
cannot
be closed inadvertently during
plant operation.
The licensee
also revised
the affected
procedures
to accom-
modate this new'onfiguration.
While reviewing the control logic for the component cooling water
(CCW)
pump
operation,
the team identified that
125 Vdc control circuit conductors
from
Train A and Train
B Component Cooling Water
Pumps
shared 'the
same four-
conductor cable.
The cable
was routed within a relay cabinet,
through
a
conduit,
and into a cable tray.
This deviates
from UFSAR Paragraph
8.3. 1.4.2,
Separation
of Redundant Circuits, which states,
in part, "All components
requiring redundant
cabling,
as well as the cabling for redundant
components,
have
been identified and the redundant
power, instrumentation,
and control
cables
are run separately."
This constitutes
a deviation (50-244/91-80-02).
The licensee
stated that this deficiency will be corrected
during the next
refueling outage.
~
~
I
The above
separation
deficiency combined with the ground detection
procedure
(Procedure. M-38.23) could cause
operational
problem of the
CCW system.
According to Procedure
M-38.23,
removal of grounds in the
DC system is not
mandatory-,
and could permit
a ground to persist for a long time.
Suppose
two
conductors of the unseparated
cable are shorted to the conduit (this may be due
to cable insulation deterioration).
If this condition is not isolated
and
corrected
and
a second
ground develops
somewhere
in the
DC system negative
side
(either in Train A or Train B),
a hidden potential
problem will be created.
The
CCW system would appear to function normally until
a postulated
accident
occured.
When this happened,
assuming
the
EDG's started, all
CCW pumps would
be de-energized initially (per load sequencing
requirements).
When restart of
the
CCW pumps is later required,
the short-to-ground
would blow (and continue
to blow) the fuses of the control circuits, causing'oth
CCW pumps to be
According to the licensee,
the plant had about
12 to
18 grounds
per year in the
DC system.
In response
to the team'
concern,
the licensee
checked with the plant to
confirm that
no ground currently existed in the
DC system.
The licensee
also
initiated
a revision of Procedure
M-38.23 to strengthen
isolation
and correc-
tion of detected
grounds
in the
OC system.
The licensee
also conducted
a
comprehensive
analysis
to determine if other similar situations exist in the
design.
The team
had
no further questions.
2.3
Bus Transfer
Schemes
The team reviewed the transfer
schemes
to ensure that transfer occurs without
any inrush in the
system 'and without adversely affecting any class
1E
equipment.
The team noted that during any maintenance
work on transformer
12A or 12B, the
loads
are normally transferred
to the unaffected
side
by closing ei .her breaker
12AX or 12BY as required.
The operator follows procedure
0-6.9.2
"Establishing and/or transferring offsite power to bus
12A/bus 12B."
The team
was
concerned that the procedure
did not address
the
maximum permitted
phase
angle shift between
the
two sources.
Since the transfer is
'make before
break'he
out of phase transfer could cause
high inrush currents
and high transient
torques at the motor shaft.
The licensee
stated that its preliminary analysis
indicated that the
maximum
phase shift between
buses llA and
11B,
12A and
12B,
and
PPSX
and
PPSY will not
exceed
15 degrees,
based
on simulations that considered
reasonable
contingency
conditions.
The team determined that this response
is acceptable
based
on the
fact that 1) During normal operation
the Class
1E buses
are lightly loaded
and
hence
the voltage drop
on these
buses will not be very significant; 2) A 15
degrees
phase difference will not cause
an appreciable
inrush current.
2.4
Emer enc
Diesel Generators
The
EOGs consist of two Alco 16 cylinder Model
251F engines
coupled to
a
1950
kW (continuous rating), 0.8 power factor,
900 rpm,
480 Vac
generator.
The team reviewed the licensee's
steady-state
and dynamic loading
analyses
for
EDG 1A, since
these
analyses
indicated that
EDG 1A had lower
loading margins
than
EDG 1B.
The acceptance
criteria for these
analyses
were
that the short-time ratings would not be exceeded
and the minimum voltage
and
frequency recovery requirements
of Regulatory
Guide 1.9 would be met.
The team
reviewed the licensee's
assumptions,
analytical
procedures,
and results with
respect
to those criteria.
Protection of the
EDGs was also reviewed.
This is discussed
as follows.
2.4. 1
Stead
State
Loadin
Anal sis
The team reviewed the Licensee's
Design Analysis
EEA-01002,
"Diesel Generator
1A Steady State
Loading Analysis", Revision 0, dated
May 6,
1991 to ensure that
the loading was within the capability of the
EDG rating.
The team identified two discrepancies.
The first involved an incorrect deter-
mination of brake
horsepower for the residual
heat
removal
pumps
and the safety
injection pumps.
The effect of this error
was to add 20.6
kM to the load
on
each
EDG.
The Licensee
updated
the data
base accordingly during the inspec-
tion,
and demonstrated
that there
was
no substantial
effect
on the existing
load margin.
This issue is also discussed
in Paragraph
3. 1.
The second discrepancy
in the steady-state
calculation
involved the licensee's
incorrect
and nonconservative
assumption
that "The
EDG can
be loaded to its
two-hour rating immediately after it has
been
loaded to its 30 minute rating".
This assumption
for short-time rating is not permissible
by Regulatory
Guide
1.9 and
IEEE Standard
387-1984,
which defines the short time rating as:
"The
electrical
power output capability that the diesel
generator unit can maintain
in the service
ehvironment for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, without
exceeding
the manufacturer's
design limits and without reducing the maintenance
interval established
for the continuous rating." Based
on the above,
the team
concluded that the
2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating could not be applied again for at least
22
hours.
During the inspection,
the licensee
re-evaluated
some of its conservative
assumptions,
and re-adjusted
the operating
time of the safety injection
pump to
58 minutes instead of 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
They demonstrated
that the short-term
and
continuous
loading of the
EDG does not exceed
the
EDG rating at any time.
The
team did not have
any further questions.
2.4.2
D namic Loadin
Anal sis
The team reviewed the licensee's
Design Analysis
EEA-01001,
"Diesel Generator
Dynamic Loading Analysis," Revision 0, dated
May 6,
1991.
The licensee
had
identified this analysis
as
an interim use
document for providing reasonable
assurance
that the
EDGs were properly sized to meet their loading requirements.
The licensee
stated that they intended to revise
and refine the analysis
as
more data
became
available
from field testing.
t
10
On the forgoing basis,
the team concluded that the licensee's
general
approach
to the analysis
was acceptable.
However,
the licensee
had identified several
unverified assumptions
in the analysis.
These
included unvalidated
model
software,
unknown constants
for the exciter
and the governor,
and unretrievable
v'alues for speed-torque
curves
and motor inertia.
The licensee
committed to
complete the final dynamic loading analysis,
including justification of the
unverified assumptions,
by May 1992.
This is an unresolved
item pending
NRC
review of the final analysis
(50-244/91-80-03)
~
2.4.3
Emer enc
Diesel Generator
Protection
The team reviewed the co-ordination
curves for breakers
EG1A1,
EG1A2,
EG1B1,
1B3,
and
EG1B2 which provide the protection for the
EDG.
The team observed that the co-ordination
study did not contain sufficient
information to evaluate
the adequacy
of the protective devices.
The curves
lacked the following information:
1) The maximum and minimum loads
on the
generator
breakers;
2) The maximum and minimum fault currents;
3) The cable I>t
curves;
4) The generator
damage
curve;
5) The decremental
characteristic
of the
EDG and the time/current charasteristic
of voltage control overcurrent relay
(51V) .
During the inspection
the licensee
provided additional
information to support
the coordination of the
EDG breakers.
They demonstrated
that the
EDGs were
adequately
protected.
The licensee
agreed to include this information into the
coordination analysis
program discussed
in Section 2.8.
The team concluded
that the
EDGs were adequately
protected
against
overloads
and did not have
any
further questions.
2.4.4
Emer enc
Diesel Generator
Field Ground Fault Protection
The team reviewed the
EDG wiring diagram
and was concerned
that the field was
not protected
against
ground faults nor was there
any alarm to warn the
operator of
a fault situation.
The generator field circuit is ungrounded.
Thus
a single ground fault will not
result in equipment, damage,
or affect the operation of the generator.
If,
however,
a
second
ground fault should occur,
there will be
an unbalance
in the
rotor magnetic field.
This unbalance
may be enough to develop destructive
vibrations within the generator.
The licensee
acknowledged this concern
and stated
t,hat the probability for the
field circuit to have
a second
ground was very low and that this was not
a
safety issue
since in the case of the loss of one
EDG, there
was still
another
EDG available.
The team
had
no further questions.
0
1'I
11
2.4.5
Emer enc
Diesel Generator
Loss of Field Protection
The team observed that the
EDG did not have loss of field protection for the
EDG nor was there
an alarm to warn the operator of this condition.
This
protection is of value
when the
EOG is being tested
and connected
in parallel
with the grid.
Should
a generator
lose its field excitation during testing, it
will continue to operate
as
an induction generator
obtaining its excitation
from the grid.
This causes
the generator rotor to quickly overheat
due to
induced slip frequency currents.
The licensee
stated that this type of
protection is not generally provided
on 480
V generators.
However,
in nuclear
power plants,
where the availability of safety support
system is of importance,
this feature
would minimize failures during testing.
This is not considered
a safety issue
because
only one
EDG would be affected. at
a time.
2.4.6
Un rotected
Cables
Connected
to the
Emer enc
Diesel Generators
The team reviewed the
AC Electrical
System
One Line Diagram,
Drawing Number-
33013-2409
and found that the two cables
feeding
480
V buses
14 and
18 were
directly connected
to the
EOG without any protection.
The team
was concerned
with the potential for a fault at the
end of the unprotected
long screenhouse
feeder cables
since the cables
are buried underground
and are susceptible
to
water exposure.
Normally such cables
are prone to faults and
a fault could
remain undetected
for a long period of time.
If a ground fault develops, it
can
cause
the loss of two emergency
buses.
The licensee
stated that these
cables
have not been
a problem.
Furthermore
these
cables
are meggered
annually
per procedure
M15. 1.
The team observed
that
a fault could occur between
the
testing periods.
2.4.7
Emer
enc
Diesel
Generator
Drop
Mode Alarm
During periodic testing of the
EDGs, the
EDG has to be switched in the "Droop"
(parallel)
mode
so as to enable it to be paralleled to the grid.
The team
noted that the switch position in Parallel
mode is not alarmed in the control
room.
The team
was concerned
that after the test is over,
the operator
may
inadvertently
leave the switch in the droop mode, affecting the availability of
the
EDG during
a loss of offsite power event.,
The licensee
responded
by stating that the monthly test procedures
PT 12. 1 and
PT 12.2 require the Unit/Parallel
switch be placed in the ".Unit" mode prior to
procedure
completion.
The team
had
no further questions.
12
2.4.8
Safet
Injection Si nal While Testin
Emer enc
Diesel Generator
The team noted that when the
EDGs are tested
every month, they are operated
in
the .parallel
mode (parallel with the grid). If a safety injection (SI) signal
occurs at this stage,
the following takes
place:
The two Class
1E buses
associated
with the
EDG under test are isolated
from the offsite power;
- The SI signal
does
not bypass
the 'Test'ode;
- All non-class
1E loads are tripped;
- All non-sequenced
Class
lE loads are tripped;
-, The sequencer
is initiated and loads
are connected
to the
EDG in a
predetermined
sequence;
Since the
EDG is in the parallel
mode,
the generator
terminal voltage is
not automatically regulated.
As the load increases,
the frequency
and voltage
drops,
causing
the generator
to trip on overloads
In response
to the team's
concern,
the licensee
stated that this deficiency was
known to them and
had existed
since the plant was built.
They had
raised
a
PCAQ (Potential
Condition Adverse to Quality) to correct this
deficiency
(PCAQ 8 91-029
was subsequently
issued
on June
3;
1991 for this
problem).
The team concluded that this is not
a safety
issue
since only one
EDG is
tested at
a time.
The other
EDG is available
to carry the
sequenced
load.
2.5
De raded Volta e
on Class
lE Buses
The'team
reviewed
Document
No.
EEA-03001,
Rev.
0, dated April 27,
1991,
"Loadflow and Voltage Profile Analysis" and
Document
No.
EWR 4525-2,
Rev.
1,
dated July 24,
1990,
"Adequacy of Electric System Voltages".
The team noted
that each
safeguards
bus (14,16,17
and
18)
had four undervol tage relays to
sense
both
a complete
loss of voltage
and also
a degraded offsite source.
The
four relays
were divided between
type 27D, which was
used to detect
a complete
loss of voltage,
and type 27, which detected
abnormally
low voltage.
Any one
of the four undervoltage
relays could start the
EDG associated
with its train.
However,
two relays were required to cause tripping of the bus breaker.
The
degraded
voltage relays
on Class
1E buses
14,16,17
and
18 were set to trip at
418 V, and loss of voltage relays
were set to trip at 372 in 0.5 seconds
~
The team noted that the analysis
did not include the effect of degraded
voltage
on
some of the Class
1E motors.
The licensee
provided preliminary computer
results indicating expected
voltages
on
some of the Class
1E motors'uring
worst case conditions with LOCA loads
on the system, if the grid voltage dips
to 116.47
kV, the Class
lE bus
14 could be at 418 V.
This may not cause
tripping of the degraded
voltage relay.
This condition
may result in motors
13
'perating
at
a degraded
voltage at the motor terminal.
In response
to the
NRC
concern,
the licensee
carried out
a preliminary study for large motors
and
found that there
was
no concern
except for the
RHR pum'p motor.
The study
revealed that the voltage at the terminal of
RHR pump
1A could be as
low as
413
V. 'The threshold operating voltage limit for this motor is 414
V.
Below this
voltage the motor could get overheated
causing
degradation
of the motor winding
insulation.
However,
the team concluded that 413
V is close to the threshold
voltage of, 414
V and this degraded
voltage condition will not last long enough
to cause
damage
to the motor winding.
However, the team
was concerned
about degraded
voltages at
some of the Class
1E
MCCs.
For example
1C could have
a degraded
voltage of 411
VS
The study
did not analyze
the voltage levels at the terminals of all vital loads supplied
from Class
1E
MCCs that are required to operate
during accident conditions.
Therefore,
the
team could not determine if such motors could operate
safely
under the degraded
voltage condition.
The licensee
committed to complete the
analysis of the degraded
voltage situation,
on
a motor by motor basis,
by- June
1992.
This is an unresolved
item pending
an
NRC review of the analysis
(50-244/
91-80-05).
2.6
Over-Volta es
on Class
lE Motors
The team reviewed
Document
No.
EEA-03001,
Rev.
0,
"Load Flow and Voltage
Profile Analysis ", to determine if any of the Class
1E loads could be
subjected
to
a high voltage during lightly loaded conditions or grid voltage
fluctuations.
The team noted that there were
no restrictions
on overvoltage
operation
in the Ginna Station Technical Specification or UFSAR.
The team
observed that the
maximum voltage
seen at bus 17'could
be as high as
496
V.
The team was specially concerned
about the
300
Pump which
would'be subjected
to voltages
beyond its rating (440
V +10
% = 484 V) while
operating
in the 1. 15 service factor (SF) range
(EWR 4232,
Revision 0, dated
May 9,
1980
" Insitu Motor Load Determination
" indicated that the above motor
could operate
in the
1. 15
SF range during
a design basis accident).
The licensee
presented
a letter dated January
21,
1980,
from Westinghouse
Electric Corporation
(WEC) stating that the average
temperature
rise of the
above motor was 68'C at 500
V and 72'C at 515 V, which is below the
90
C
temperature
rise (above
40'C ambient) allowed for a Class
B insulation
system.
The team however noted that the letter did not specify if the temperature
rise
calculations
were done for a service factor of
1 or 1. 15.
The licensee
gave further clarification of the
WEC letter stating that the
temperature
calculations
were based
on the
maximum winding resistance
temperature
immediately after starting the motor and not the steady
state
winding resistance.
With continuous
operation this temperature will decrease.
The team did not have
any further concern with this issue.
14
2.7
S stem Short Circuit Review
The team reviewed
EWR 4525-1, "Fault Current Analysis of Power Distribution
System",
Revision
1, dated July 27,
1990, to determine if the Class
lE
equipment
was properly sized to withstand the available short circuit current.
The team noted the interrupting current ratings of the Class
1E 480
V circuit
breakers
are
as follows:
Bus
Ratin
Am
s
s
m.
14
8( 16
17
8( 18
DB-50
DB-25
50,000
30,000
The team observed
that the fault currents
were significantly above the breaker
ratings
when either
EDG was running in the test
mode.
The test
mode configur-
ation required
1A to be paralleled with both its
1E buses
(14
8 18).
Similarly, the test
mode configuration for
EOG
1B required it to be
paralleled with both of its Class
1E buses
(16
& 17).
The calculated fault
currents
were
as follows:
Bus
Without
With EDG
14
16
17
18
39,099
39,463
24,336
22,260
55,337
56,418
51,148
48,879
The licensee
stated that they had evaluated
the probability of such
an fault
current occurring
and found it to be very low (3xl0-'er year).
2.8
Protection of Class
lE Motor s
The team reviewed Amptector Response
Characteristics
for several
large Class
1E
motors
and was concerned
that the curves did not include the motor character-
istic for degraded
voltage situations.
In some
cases
the margin between
the
motor full load current
and the lower band of the pickup current
was very
narrow.
This could cause tripping of a motor at degraded
voltage conditions
while attempting to start or while operating
in the service factor zone during
an accident condition.
The industrial practice is to set the pickup at
115-125% for motors with a 1.00 service factor and
125-140% for motors with a
1. 15 service factor.
The team
was specially concerned
about the Containment
Recirculation
Fans
and the Service
Water
Pumps where the margin between
the
full load current of the motor and the lower band of the relay pickup set point
was very small.
The licensee
provided preliminary calculations
which indicated
that there
was
no cause for concern.
However,
the acceleration
time was based
on
an Electrical Transient Analyzer Program
( ETAP) that modeled
these
two
motors,
since the acceleration
time characteristics
at various voltages
were
not available
from the manufacturer.
1
15
The licensee
stated that
a comprehensive
coordination analysis is being prepared
to document
the basis for all Amptector setpoints.
Since this document is not
yet complete all factors for setpoint
changes
have not been
evaluated.
The
licensee
committed to complete
the coordination analysis of the 480
V and 4160
V
breakers
by November
1992.
This is an unresolved
item pending
NRC review of
the coordination analysis
and the evaluation of the factors for setpoint
changes
(50-244/91-80-06).
2.9
Selection
and Sizin
of Power
Cables
The team reviewed document
EDG-4A, Revision 0, dated April 9,
1991,
"Cable
sizing analysis for cables installed in conduit and cable trays".
The team
noted that the document
was very recent
and was intended for new. installations'
similar document did not exist in the past.
The team found that the analysis
was adequate
and considered
the effect of short circuit current that could
damage
the cable,
cable routing requirements,
cable construction
requirements,
cable capacity
and the necessary
derating factors.
However,
the analysis did
not address
the
maximum allowable voltage drop in the feeder .or the review of
the cables for voltage drop during starting of motors.
The team conducted
a spot check of recent modifications
and did not identify
any improperly sized cables.
2. 10 Electrical Penetration
Sizin
and Protection
UFSAR 8.3. 1.3 stipulates
and Regulatory
Guide 1.63
as the
design
bases.
In addition,
the
UFSAR cites manufacturer's
fault tests
and
studies
conducted
in support of SEP Topic VIII-4, "Electrical Penetrations".
The team selected
analysis
package for review.
This analysis
was
documented
in the licence's
SEP Technical
Evaluation Topic VIII-4 Report,
"Evaluation of Selected
to Mithstand
Low Magnitude Faults", dated
June
3,
1981.
The Izt values for the silver brazed
and soft solder penetrations
were
calculated
based
on the equivalent of I.
M. Onderdon'
fusing current-time
equation for copper conductors
and connections.
An adiabatic
thermal
process
was
assumed.
The initial temperature
of the penetrations
was
assumed
to be the
LOCA temperature.
A review of the protection analysis
using short circuit
values
from more recent calculations
did not identify any protection
concerns
for the
sample
reviewed.
The team identified that several
of the original Standard
Evaluation
Pl'ant
(SEP)
commitments for backup protection
had not been implemented'he
licensee
explained that, subsequent
NRC staff guidance
allowing exceptions for backup
protection,
where the circuit is Class
1E qualified or where the circuit is
isolated,
resulted
in eliminating the
need for backup protection in some cases.
On that basis,
this was acceptable
to the team for the penetrations
reviewed
during the inspection
(480 Vac penetration
CE-21 serving containment recircu-
lation fan A motor).
0
16
No anomalies
were found for the review of the 4160
Vac penetration
CE-25
Pump
1 A), and
a field check of a
sample of protective relay
settings did not identify any deficiencies.
2. 11
120 Vac Instrument
Bus
S stem
Section 8.3. 1. 1.S of the
UFSAR and the licensee's
drawing 03201-0102,
120 Vac
Instrument
Bus One-Line Diagram",
Rev.
0 dated April 20,
1991 describes
the
design basis
and configuration of the
120 Vac Class
1E system.
Only three= of
the buses
supporting
the four channel
protection
system instrumentation
are
Class lE, and only two of the Class
1E buses
are battery-backed.
In addition
to the four instrument
buses,
one channel
each of certain engineered
safety
features actuation
system
(ESFAS) instrumentation
is served
from a separate
inverter.
The licensee's
one-line diagram indicated that this additional
inverter was served
by battery
A (which is also the source for instrument
bus
1A), but the loads were identified as Instrument
Channel
D.
2.11.1
S stem Confi uration
The team asked
the licensee
to demonstrate
that the
use of a non-lE power
source for one channel
did not compromise
the
independence
of the four
instrument buses.
The licensee'nalysis
indicated that the power feeder for
instrument
bus
1D shared
the
same conduit as the power feeder for instrument
bus
1C.
The licensee
stated this was acceptable
under the. original design
basis
and
was
supported
by the failure analysis
provided during the inspection.
The team identified to the licensee
that the
UFSAR provided
a commitment that
the instrument
buses
meet separation criteria of IEEE Std 384-1974.
Based
on
the foregoing description of the configuration of the buses,
the design
does
not conform to
The licensee
agreed,
and stated that this was
an error in the
UFSAR that occurred during the
FSAR update,
and that
a
correction to the
UFSAR had been identified to delete this commitment.
The team concluded
on the foregoing basis that the
system configuration
appeared
to conform to the original design basis
as reviewed
by the
NRC staff,
although the design did not conform to more recent
st'andards
and practices with
regard to qualification,
independence
and separation.
2. 11.2
Loadin
and Continuous
Ratin
s
The licensee
monitored the loading of the instrument
buses for normal operating
conditions;
the values for known additional
loads of instrumentation
being
retrofit and the margins for normally de-energized
loads were determined.
The
values
were totalled to determine
the
system loading.
The licensee
determined
that the existing loading
on buses
1A and
1C was acceptable,
but that future
additions of loads
should
be restricted until
a load monitoring program is
established.
2. 11.3
Fault Protection
and Coordination
The licensee's
analysis
indicated that the existing breakers
used in the
120
Vac distribution system
(Buses
1A and
1C) have
adequate
interrupting ratings for
g
I
0
17
the maximum available short circuit currents.
The analysis
evaluated
coordi-
nation of all breakers
in the
Bus
1A and
Bus
1C panels,
and determined it was
adequate.
In the instances
where coordination could n'ot be demonstrated,
the,
analysis
showed that the lack of coordination
was
bounded
by the system failure
analysis.
Based
on
a review of the foregoing analyses,
the team concluded that
fault protection
and coordination
was adequate
on buses
1A and
1C.
2. 12
125 Vdc Class
1E
S stem
The
125
Vdc Class
1E system is divided into two buses.
Each
bus contains
two
battery chargers
(200'mp
and
150 amp).
Each of the
200
amp chargers,
was sized
to recharge its battery within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> while carrying its load..
Two 60-cell,
lead-acid,
batteries
are provided for supporting control power,
emergency
lighting, and the instrument
bus inverters.
The team reviewed the battery
capacity,
load profile, fault protection
and coordination,
and voltage drop
analyses
to determine
the design
adequacy.
The results
are discussed
as follows.
2. 12. 1
Batter
Ca acit
and
Load Profile
The batteries
were replaced
approximately five years
ago.
The team reviewed
the licensee's
confirmatory Design Analysis
EEA 09004,
Rev.
0, dated
May 4,
1991,
and
EWR 3341 Design Analysis
No. 5,
"DC System
Load Survey",
Rev.
1,
dated
February
3,
1988.
The analysis
confirmed adequate
battery capacity in
accordance
with IEEE Std 485-1983.
The analysis
established
the basis for
battery sizing for a four hour station blackout
(SBO) event pursuant
to
The licensee
was aware that the
UFSAR describes
an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> duty cycle
as
the basis for sizing.
The licensee
indicated that the
UFSAR would be revised
to reflect the
SBO four hour duty cycle
as the limiting condition.
The team reviewed the analysis
assumptions,
the basis for individual load
contributions to the profile, and performed
an independent
check of cell sizing.
The team noted that each battery
load profile depended
on automatic
shedding at
twelve minutes of a significant load (for non-safety related
of the main feedwater
pump)
by
a timer that was not in the surveillance
program.
The timer was replaced
during the last outage with a qualified timer
in order to provide
a reliable load setting.
The setting of the timer had been
verified to be less
than twelve minutes
as part of the post maintenance
test.
The team
was concerned
about the possibility that the load would not be
shed
within twelve minutes,
thus affecting the reserve
capacity of the battery.
In
response,
the licensee
agreed
to include the timer setting in their surveillance
program.
2. 12.2
Fault Protection
and Coordination
The team reviewed the licensee's.
Design Analysis
EEA-09005,
Rev. 0, dated
April 29,
1991,
supplemental
data
on panel ratings,
and
EWR 3341 Design
Analysis
No.
10,
"Fuse Isolation
and Coordination",
Rev.
1 dated
February
12,
1988.
The
125
Vdc system
uses
fuses
as protective devices
except for a small
t
0
18
number of load side breakers.
The team also reviewed the
DC one-line diagram
33013-1036
Sh.
2-,
Rev.
5 dated
March 1,
1990.
The team concluded that avai 1-
able short circuit currents
were acceptable
for the fuses
and panels installed
and that
a fault on any Class
1E or non-class
1E branch circuit would not
result in
a main fuse degradation.
2. 13 Conclusion
Based
on the team's
review of the
EDS design,
the
team concluded that the Ginna
electrical distribution system is capable of performing its intended function.
The team also noted that the licensee
had carried out major modifications to
the
34 '
kV bus to increase'he
availability margin in the event of a single,
off-site power system failure.
However, the team identified two deficiencies
in the
EDS:
1)
A single short in the control logic or
a single mechanical
malfunction (although unlikely) could cause
the
EDS to lose three
emergency
buses;
and
2)
The redundant
control cables for'the two Component Cooling Water
(CCW)
pumps
have
no separation.
This deficiency,
combined with the
existing ground detection
procedure,
could cause
both
pumps to be
The team also identified three
unresolved
items which require further correc-
tive actions
by the licensee:
1)
A comprehensive
coordination analysis for all safety related circuit
breakers;
2)
Analyses of degraded
voltage effects
on the
480
V MCC motors;
3)
Completion of the dynamic loading analyses
of the
EDG did consider
the scenario
where the
pump
and the third SI
pump could occur as
random load on'he
EOG.
In addition, the
team
made three observations:
1)
Unprotected
output cables
from emergency diesel
generators.
2)
Undersizing of circuit breakers
of buses
14,
16,
17,
and
18.
3)
Lack of loss of field protection for the emergency diesel
generators.
With the exception of specific findings, observations
and unresolved
issues
identified in the report,
the
EOS components
were adequately
sized
and
configured.,
19
3.0
'ECHANICAL SYSTEMS
To determine
the functional ability of mechanical
systems
to support the
during postulated
design basis accidents,
the
team reviewed
sample
documenta-
tion and conducted
a walkdown of the fuel oil storage
and transfer,
lubricating
oil, starting air,
and diesel
heating
and cooling equipment.
The team also
reviewed equipment associated
with the heating, ventilation and air condition-
ing (HVAC) of the diesel
generator buildings,
service water screenhouse,
relay
room, battery
rooms, control
room,
and selected
EDG and
HVAC design modifica-
tions.
The team also reviewed the power demand for major loads (selected
'pumps) for input into design basis calculations.
3.1
Power
Demands for Major Loads
The team reviewed the power demands
for the major
pump motors
powered
by the
EDGs following a loss of offsite power during
LOCA conditions.
The team noted that the peak Residual
Heat
Removal
(RHR)
pump loading occurs at
runout condition and peak Safety Injection (SI)
pump loading occurs prior to
.
runout.
The
RHR pump brake
horsepower
(bhp) based
on the manufacture's
pump
curve for the flow of 2500
gpm near runout condition
was
173 and the motor
power
demand
was
139.2
kW.
The
EDG loading calculation
EEA-01002,
Revision 0,
May 6,
1991
assumed
the
RHR pump bhp as
165 and the motor power demand
132.8
kW.
For the SI pumps,
the
maximum bhp based
on the manufacturer's
pump curve
corresponding
to
a flow of approximately
400
gpm was
367
and the motor power
demand
was 289.7
kW.
-The
EDG loading calculation
assumed
358 bhp for the SI
pump and 282.6
kW for the motor power demand.
Based
on the team's findings,
the licensee
agreed
to revise the
EDG loading calculations to correct these
loads.
In summary,
as
a result of the team's finding, the automatic
and steady
state
loads will be increased
by 20.6
kW (6.4
kW for the
RHR pump,
7. 1
kW for the SI
pump and 7. 1
kW for the
SI swing
pump)
from the existing loading calculations.
The licensee
incorporated this
new power demand into the
EDG loading calculations,
resulting in
a load increase
of about
one percent.
This issue
was also
discussed
in Paragraph
2.4. 1.
3.2
Diesel
Generator
and Auxiliar
S stems
The team reviewed the licensee's
calculations,
procedures,
and other
documentations
to determine. the design
adequacy
of diesel
generator
cooling,
air start
system,
fuel oil storage
and transfer
system.
These
are discussed
as
follows.
3.2. 1
Diesel
Generators
Coolin
Two Alco 16 cylinder
model
251F turbocharged
and aftercooled diesel
engine
generator
sets
are provided to generate
the required
emergency
power for all
the engineered
safeguards
equipment.
Each diesel
generator-has
a continuous
rating of 1950
kW,
a two hour rating of 2250
kW and
a 30 minute rating of 2300
kW.
20
The team reviewed performance
trending data
from May 15,
1990 to April 21,
1991 for both
EDGs.
The trending
program was utilized to measure
jacket water
and lube oil outlet temperatures
to verify the
EDG cooling function.
The team
noted that these
temperatures
must
be maintained within a normal range's
defined in plant procedures
PT-12. 1 and PT-12.2.
However, if a measurement
was
obtained which was outside the specified
range,
remedial
action would be taken.
Within the
scope of this review,
no unacceptable
conditions were identified.
According to the
UFSAR, Section 8.3. 1. 1.6.4,
and technical specification, Section 3.7;2,
an onsite diesel
fuel oil inventory at all times
was maintained
to assure
the operation of both
EDGs carrying design
load of all the engineered
safeguards
equipment for at least
40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />.
Technical specification, Section 3.7. 1, stated that the reactor would not be maintained critical without two
EOGs operable with an onsite
supply of 10,000 gallons of fuel oil available.
The team noted that calculation
ME-91-0011,
Revision 0, dated
May 2,
1991,
"Diesel fuel oil minimum onsite
storage
requirements,
PECAQ 91-0010",
used
a
fuel oil specific gravity of 0.89 which was not conservative
for evaluating
the technical
specific onsite fuel oil storage
requirements
since the fuel
consumption
was converted
from lb/hr to gallons/hr.
The licensee
agreed that
fuel oil could be at
a specific gravity as
low as 0.82
and still satisfy all
other fuel oil specification
requirements.
The licensee
determined that the
specific gravity of the fuel oil used in the fuel consumption test
was 0.865
and after applying correction factor for the higher heating
value for the lower
specific gravity fuel oil, the net effect of minimum fuel oil specific gravity
would be
an increase
of 3.5% in the onsite fuel oil storage
requirement.
In
addition,
the increase
in
EDG loads mentioned
in Section
3. 1 would have
an
effect of further increasing
the onsite fuel oil storage
requirement
by about
1%.
The licensee
provided preliminary calculations to include the effect of minimum
fuel oil specific gravity and the increased
EOG loads
on onsite
storage
requirement which indicated that to assure
the operation of both
EDGs at design
load of all the engineered
safeguards
equipment for 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />,
an onsite fuel
oil storage
capacity of about
10,600 gallons would, be required.
The team reviewed calculation
EWR 4526 ME-23, Revision 0, dated April 30,
1991,
"Diesel Generator
Fuel Oil Storage
Tank Usable
Volume" and noted that the
usable capacity of the two fuel oil storage
tanks
was
5827 gallons
each,
giving
a total capacity of 11,654 gallons.
The team also reviewed procedure
0-6. 13, "Daily Surveillance
Log," Revision
65,
and noted that by following the procedure,
the volume of onsite diesel
fuel oil
in each tank was maintained at the required
value of 5,300 gallons.
The
licensee
agreed
to correct value of 10,000 gallons stated
in the technical
specification.
This is one
example of a weakness
in engineering calculations.
21
3.2.3
Fuel Oil Transfer
S stem
The team noted that there
was
no fuel oil transfer
pump trip on low storage
tank level.
The licensee's
response
was that the Technical
Support Center
was
mandated to be fully actuated within one hour of an accident.
It would be the
duties of the recovery staff to assure that enough diesel
fuel was available or
could be ordered
and delivered in sufficient time to assure
that
a low level in
the storage
tank did not occur.
In addition, operations
personnel
would be
monitoring the diesels if they were running during
an accident.
The team
had
no further questions.
3.2.4
Fuel Oil Stora
e and
Da
Tank Vents
The team determined that the exposed
fuel oil storage
and day tank vents were
not qualified to withstand tornado generated
missiles.
The licensee
stated'hat
in addition to having
an inconsequential
probability of a missile stri ke
to the fuel oil tank vents, diversity was available in venting.
As shown
on
P8
ID's 33013-1239,
sheets
1 and 2,
each
storage
and day tank has
independent
venting as well as
a
common vent
on each of the recirculation/overfill lines.
Therefore, if a missile strike were to occur on any of the vents,
venting
capability would not be lost.
The
team
had
no further questions.
3.2.5
Air Start
S stem
The team reviewed instrument calibration data
sheet
CP-I-DG-INSTR-64A, Revision
01
Page
236 of the data
sheets
indicated that the setpoint for the
EDG low
starting air pressure
alarm was
90 psig.
However, after the air boosters
were
installed in 1975,
there
was
no test data to demonstrate
that the
EDG would be
capable of starting
and
be ready to receive
the load within 10 seconds
with 90
psig starting air.
The team reviewed
CYGNA Energy Services calculation
92528-001,'evision
1, dated
May 9,
1991, "Evaluation of the capacity of the
Diesel Air Start
System"
and noted that after four starts,
the air pressure
in
the receivers
would be about
1'l7 psig.
The licensee
provided
a copy of the Auxiliary Operator's
Log sheet
to the
team
and stated that the, starting air receiver pressure
log was performed twice per
shift to ensure that the receiver pressure
remained within the
normal
range of
225-260 psig.
'he
licensee
also stated that the Alarm Response
Procedure
directed the
Auxiliary Operator to verify that the air compressor
was running and the
correct valve aligned.
The alarm response
directed the Auxiliary Operator
to notify the control
room of the alarm
and cause of the alarm.
If the low air
pressure
condition could not be corrected
immediately,
the
EDG would be
declared
and the other
EDG would be started
in accordance
with
Technical Specification, Section 3.7.
The team
had
no further questions.
I
~
~
1
3.3
22
Heatin
Ventilation and Air Conditionin
HVAC S stems
The team reviewed the licensee'rawings,
calculations
and other documentations
to determine
the design
adequacy of the
EOG room
HVAC system,
Screenhouse
Ventilation System
and Battery
Room ventilation.
These
are discussed
as
follows:
3.3. 1
Emer enc
Diesel Generator
Rooms
Tem erature
In response
to the team's
concern,
the licensee initiated
a procedure
change
notice
(PCN 91-3283) to revise
procedure
0-6: 16 to monitor the
room
temperature
and manually start the ventilation,fans
when the temperature
reached
90
F..
The team
had
no further questions.
EDG Rooms Ventilation
S stem
3.3.2
According to the
UFSAR, Table 3. 11-1, all equipment
in the
EDG rooms was
designed for operation at
104
F when the diesels
were not in operation.
However, the ventilation system for the
EOG rooms
was designed
to maintain the
room temperature
below 104'F, with the
EOGs running, during
summer with an
outside air design temperature
of 91~F.
The team noted that the ventilation
system for the
EDG rooms would not start unless
the
EDGs were running and,
therefore,
the heat
loads
in the rooms could raise
the temperature
above, 104'F.
The
team noted that the calculation
assumed
an
ALCO provided heat loss of 4
Btu/Bhp per minute from all the
ALCO EOG and auxiliaries
and electrical
components
excluding the heat
load from the exhaust
stack.
However, the
licensee
could not provide the contributions
from various heat
sources
to
arrive at this value.
Therefore,
the
team
was unable to verify that all the
EOG heat
sources
were included in the
HVAC calculation.
In response
to the
team's
concern,
the licensee
contacted
the
EDG manufacturer,
Canad',an
General
Electric, to verify that all 'the
EDG heat
sources
including the electric
components
but excluding the exhaust
stack were in fact included to arrive at
the
4 Btu/Bhp per minute heat rejection to the
EDG room air.
Calculation
ME-91-0010 indicated that the
maximum predicted
temperature
in the
EDG room would be 104.3
F.
The
team noted that the calculation
had
assumed
an
air density
based
on
a temperature
of 70~F,
whereas
the outside air design
temperature,was
91~F.
Correcting for the air density,
the
maximum predicted
EDG room temperature
would be 104.8'F which was above the design
temperature
of
104~F.
The licensee
stated that
Appendix
F established
a
continuous
temperature
of 140'F for the
EDG electronic governor which was the
limiting piece of equipment.
This provided reasonable
assurance
of continued
functionality of the
EDGs at the maximum room exhaust
temperature
of about
105~F for the
GINNA EDG rooms.=
23
3.3
~ 3
Seismic
uglification of Steam Heaters
and Associated
Pi in
in the
EDG Rooms
In response
to the team's
question
regarding
the seismic qualification of- the
steam heaters
and the associated
piping in the
EDG rooms,
the licensee
stated
that the heaters
and the associated
steam piping were evaluated
using
methodology during
an interaction
review of the
EDG air start
system.
According to Section 4.5 of EQE report 42031-R-001,
Revision 0, dated January
18,
1991,
"Seismic Verification of the Diesel Air Start
System at the Ginna
Nuclear Power Station," the
space
heaters
and piping were 'judged'o
be
adequate
to maintain position
and structural integrity during and after
an
SSE.
The licensee further stated that they would conduct
a seismic analysis of the
steam line inside the
EDG room to evaluate
and confirm the
SQUG finding. The
analysis
would be completed
by July 31,
1991.
3.3.4
Screenhouse
Ventilation
S stem
The team reviewed the screenhouse
HVAC calculation
ME-91-0009,
Revision
1,
dated
May 15,
1991.
The team identified the following discrepancies:
(i) Air infiltration was
assumed
to be 1.25
room air change
per hour whereas
based
on the
ASHRAE recommended
value of 0.6 cfm per
sq. ft, the air
infiltration would be
1. 1 room air change
per hour.
(ii) The calculation did not address
the effect of the loss of non-1E powered
ventilation fans
on the
screenhouse
temperature
during
summer with the
outside air temperature
of 91~F.
In response
to the team's
concerns,
the licensee
revised calculation
ME-91-0009,
Revision 2,
May 24,
1991.
The revised calculation demonstrated
that the screenhouse
temperature
could
be maintained
below the design
value of
104
F by natural ventilation alone.
3.3.5
Batter
Room Ventilation
There
was
no calculation to demonstrate
that
on loss of non-1E powered
ventilation fans
and air conditioning unit, the
DC powered
backup ventilation
fan could maintain the hydrogen concentration
in the battery
rooms below the
required limit of 2% and room's temperature
below the
summer design
temperature
of 104
F with the outside air at 91'F.
In response
to the team's
concerns
the licensee
evaluated
the flow split to the 'A'nd 'B'attery
rooms
to demonstrate
that the hydrogen concentration
in the 'B'attery
room (lower
ventilation flow) would remain below the
2% limit.
The licensee
evaluated
the
battery
room temperature
to demonstrate
that the
maximum temperature
would be
within the design limit of 104OF.
The fact that there
were
no calculations
for
the battery
room temperature
and hydrogen concentration
before the team's
arrival is
an example of a weakness
in engineering calculations.
3.4
Service Mater
S stem
The service water
(SW) system takes
suction
from Lake Ontario
and supplies
cooling water to the
EDG h'eat exchangers
and other plant loads.
The system
discharges
back into Lake Ontario.via the discharge
canal
or via Deer Creek.
The system consists
of four vertical,
two stage,
centrifugal
pumps rated at
5300
gpm each.
The normal flow requirement is provided by two or three
pumps,
with the remaining
pump(s)
on standby.
Materhammering
can
cause
severe
damage
to the piping and other mechanical
equipment
in the
SW system.
There are
two cases
where waterhammering
can
occur:
1)
SW pumps switching operation,
and 2) loss of power to
a
SW pump,
The licensee
stated that both cases
have occurred at Ginna Station.
Service
water
Pump switching was
a planned operation that occur red frequently; whereas,
loss of
SM pump power was
an unplanned transient condition that had occurred
a
couple of times.
During any planned starting or stopping of the
SW pumps,
an operator is
stationed
in the Screen
House Building to observe
the operation.
The operator
was able to hear the check valve close
a'nd did observe
minor pipe movement
during the operation;
however,
no loud banging occurred
and
no major movement
of the
SW piping was noticed.
At 1'east
two occurrences
of loss of power to
SW pumps
had occurred at Ginna
since
1980 based
upon
a review of LERs.
Based
upon the
20 years of operations
experience
accumulated
to date in
combination with the valve and support inspections
routinely performed at the
Ginna Station
as part -of the Inservice Testing
( IST) and Inservice Inspection
( ISI) programs,
the flow-induced thermal hydraulic transients
associated
with
SW pump discharge
check valve slamming
had
no
caused
any observable
damage to
date to the check valves
themselves
or to the
SM piping and its supports.
The licensee
provided
a
summary of the waterhammer
problems
experienced
in the
SW piping to the Standby Auxiliary Feedwater
(SDAFW)
Pump
Room Cooler,
and
included the status
of activities performed to date to address
the issue.
The
licensee
stated that during the mid 1980's
the plant experienced
waterhammer
in
the 4"
SW piping to the
SDAFW Pump
Room Coolers during performance
of Plant
Procedure
PT-2.7.
Observations
and test data
gathered
during the performance
of PT-2.7 indicated that pressure
spikes
were occurring in the 4"
SW piping
during the opening of
SW valves
4616,
4735,
4615,
4734 after these
valves
had
been closed for a period of time in excess
of a couple of minutes.
PT-2.7
required that these
valves
be closed prior to the performance of periodic
testing of portions of the
SW System,
After completion of
SW testing,
the
valves were stroked
open
from the control
room.
It was only during the opening
of the valves after they had been closed for a long period of time that
pressure
spikes of a couple
hundred
psi were measured
by temporary pressure
transmitters
connected
to the vent valves
on the 4"
SM piping to the
SDAFM Pump
Room Coolers.
Testing of stroking the valves closed followed immediately by
stroking the valve open demonstrated
that
no severe
pressure
spikes
were
experienced.
(
25
As an immediate
response,
Plant Procedure
PT-2.7
was revised to require that
the four
SW valves
be manually opened to approximately the
50% position;
and
then stroked with the motor operator the remainder of the travel.
This was to
be done after the valves
had
been
closed
as part of the SW'ystem alignment for
performance of PT-2.7.
Due to the longer time required to manually stroke
these valves,
the plant reports that the pressure
spike previously experienced
during the automatic valve openings
had
been eliminated.
On a long term basis,
EWR-4612 was initiated on December
17;
1976 to evaluate
changes
to the
SW System to alleviate the potential for water
hammer
due to
the opening of the above service water valves.
The team
had
no further concerns
in this area.
3.5
Conclusions
The team concluded that the appropriate
technical staff was knowledgeable
of
the mechanical
systems affecting the
EDG.
Sufficient information was available
to review and assess
the operability of these
mechanical
systems.
i
A number of issues
were identified in the mechanical
area with regard to the
design
and calculations.
These
issues
indicated the
need for establishing
a
thorough design
review of the
and associated
equipment.
These
issues
are
'onsidered
by the
team
as examples
of a lack of attention to detail in the
original design calculations.
The identified issues
were fully addressed
and
resolved during the inspection.
However,
the
team
had
no concerns
regarding
the operability of this equipment.
Il
The
scope of this inspection
element
was to assess
the effectiveness
of the
controls established
to ensure that the design
bases
for the electrical
system
is maintained.
This effort was accomplished
through the verification of the
as-built configuration of electrical
equipment
as specified in electrical
single-line diagrams,
modifications packages,
and site procedures.
In
addition, the maintenance
and test
programs
developed for electrical
system
components
were also reviewed to determine
the technical
adequacy.
4. 1
E ui ment Walkdowns
The team inspected
various areas of the plant to verify the as-built
configuration of the installed equipment.
Areas inspected
included the diesel
generator,
switchgear,
battery,
and electrical
panel
rooms.
Transformer,
protective relay and
pump motor nameplate
data
were also examined.
This
information was collected to verify the completeness
and accuracy of system
calculations.
) ~
In summary,
walkdown inspectio'ns
indicated that adequate
measures
are in place
to effectively control
system configuration.
The inspected
equipment
was
found to be installed in accordance
with design drawings.
Equipment inspected
was
found to be well kept with surrounding
areas
clear of safety hazards.
26
4.2
E ui ment Maintenance
and Testin
The team reviewed various operations,
maintenance
and.testing
procedures
for
equipment
such -as diesel
generator,
switchgear, circuit breakers,
batteries
and battery chargers,
inverters
and protective relays.'
Licensee
personnel
were
interviewed to ascertain their understanding
of the testing
programs.
The
team also reviewed the program established
to control instrument setpoints
during the calibration
and testing process.
The team's observations
are
described
below.
4.F 1
Diesel Generator Testin
The
team reviewed licensee
periodic surveillance tests for the
EOG units.
The
tests
are performed in accordance
with approved
procedures
which demonstrate
the
1950 to 2250
Kw capability required
by the technical
specifications.
The
team reviewed test procedure
PT-12. 1,
1A" which
provides instructions for performing surveillance testing of
EOG
1A as required
by the Technical Specifications.
The
team witnessed
a surveillance test performed
on
May 24,
1991.
The team
observed that the test procedure
does
not require the recording of the as-found
no-load
EDG voltage
and frequency.
This data is valuable
since
any abnormal
readings
could indicate that either the as-left settings
were left incorrectly
or the control
knobs
were adjusted
subsequent
to the previous test.
The effect
of such abnormal
readings
would be that the
EDG may not be able to carry the
design
loads during required operation
since the unit voltage
and frequency
are critical parameters
for proper operation.
In response
to the team's
concern,
the licensee
stated that verification and documentation
of the as-found no-load
voltage
and frequency at the startup of the 'units would be evaluated for
incorporation into station procedures.
The team observed that procedure
step
6. 12 requires that the
EDG voltage
be
raised to approximately
5 volts higher than the running bus voltage prior to
synchronizing with the offsite system.
During the surveillance test,
the
no-load voltage
was observed
to be approximately
10-15 volts higher than the
bus voltage.
The control
room operator,
nevertheless,
closed the
EDG output
breaker onto the bus.
In response
to the team's
question
as to the acceptability
of the operator's
action,
the licensee
evaluated
the voltage difference
and
concluded that
a voltage difference of 0 to 25 volts would not exceed
the
generator
or breaker capabilities.
Nevertheless,
the licensee
stated that
further operator
guidance
would be provided as to an acceptable
voltage
range
prior to closing the output breaker.
The team
had
no further questions.
4.2.2
Molded Case Circuit Breaker Testin
A deficiency (Violation 50-244/89-81-06)
pertaining to
a lack of scheduled
periodic testi'ng of Class
lE 480
V molded case circuit breakers
(MCCB) and the
lack of established
acceptance
criteria for testing
the
125
Vdc system
relay alarms
was previously identified during
a
1989 Safety
System
Functional
Inspection
(SSFI)
~
27
In response
to the
NOV, the licensee
stated that it was developing appropriate
test methods for MCCBs as part of the Reliability Centered
Maintenance
(RCM)
program.
Corrective Action Report
1985 was initiated to formally track and
address
the lack of MCCB testing.
A corrective action plan was developed to
systematically
evaluate
the identified violation.
This consisted of:
Evaluation of 10 CFR 21 notifications pertaining to MCCBs;
Review of data of installed
MCCBs to ensure
proper setpoints
and
conditions;
Investigation of industry methods for periodic testing of MCCBs;
Development of a program for such testing;
and
Initiation of a program for periodic
MCCB testing
by the next refueling
outage.
The licensee
performed
a failure mode analysis
to determine attributes for the
MCCB testing
program.
Maintenance
Work Requests,
industry experience
and
practices,
vendor manuals
and Ginna station
procedures
were reviewed in this
effort.
This resulted
in recommended
items to address
the considered
fai lure
modes.
These
recommendations
included performing periodic electrical
exercising of over load devices
and instantaneous
tripping units of the circuit
breakers.
In addition, it included performing periodic inverse-time
characteristic
tests.
Presently,
program development is ongoing with completion expected
by the
end
of 1991
and implementation
expected
by 1992.
Through discussions
with the
licensee staff, the team concluded that although the program is still being
developed,
the expected
program attributes
address
the requirements
of periodic
testing of MCCBs.
With respect to the lack of established
acceptance
criteria for the dc
relay alarms,
the licensee
has revised test procedure
PT-11,
"60-Cell Battery Banks 'A'
'B'" to explicitly define the acceptance
criteria
for the undervoltage
relay alarms.
As part of the corrective actions,
the
licensee
revised
PT-9. 1, "Undervoltage Protection - 480 Volt Safeguard
Busses"
to incorporate explicit acceptance
criteria.
The team concluded that the corrective action plan initiated to address
the
lack of MCCB testing
was comprehensive
and addressed
the essential
elements
to
develop
an effective testing
program.
Based
on the licensee's
continuing
test
program development
and the revision of appropriate test procedures,
this
violation is closed.
4.2.3
Inverter Testin
The
120
V instrument
buses
lA and
1C are provided with uninterruptible
power
supplies
from a separate
inverter, regulating transformer
(Constant
Voltage
Transformer
CVT), and static switch combination.
These
combination units
ensure reliable
power to Class
1E instruments.
Normal
power to these units is
from Class
1E battery
systems.
A static switch is provided to transfer to the
alternate
AC power supply from respective
on
a loss of inverter output.
. 1
C
28
As stated
in the
UFSAR, the
maximum transfer time, including sensing
time, is
1/4 cycle.
The automatic static-switch transfer is initiated by one of the
following conditions:
Inve'rter failure
beyond the static switch
Inverter output undervoltage
Manual
The team reviewed maintenance
procedure
M-38.2, "1-A Inverter/CVT Maintenance
or Repair",
Revision
14 which
provides instructions for preventive
and
corrective maintenance
for the
1A inverter/CVT.
Through review of the
procedure
and discussions
with licensee
personnel
the team concluded that there
had
been
no initial or subsequent. testing to verify that in fact the static
switch would be able to transfer
from the normal to the alternate
power source
within 1/4 cycle.
The licensee
stated that the static transfer switch capability was not
a safety
function since the fai lure of the auto transfer would result in de-energizing
an instrument
bus
and therefore protective devices
would fail to the safe
mode.
The licensee
stated that the manufacturer's
operating
manual
lacks sufficient
instructions for testing the transfer capabilities.
An additional
manual w'ill
be procured
and existing procedures will be revised to demonstrate
the transfer
switch capabilities.
4.2.4
Class
lE Batter
Testin
The Ginna Technical Specification
(TS) Surveillance
Requirement
4.6.2 requires
that each
125
Vdc battery
be subjected
to load (service)
and discharge
(performance)
tests.
Additional maintenance
requirements
are also specified in
the TS.
The team revie'wed surveillance
test procedures
PT-11 "60 Cell Battery
Banks
'A'
'B'" and PT-10.2 "Station Battery
1B Service Test."
Within the
scope of this review no discrepancies
were identified.
4.2.5
Other Electrical
E ui ment
The team reviewed test procedures
for other Class
1E electrical
equipment.
This review included battery chargers,
circuit breakers
and relays.
The
procedures
reviewed were determined
to be technically adequate
with applicable
acceptance
criteria.
4.3
Protective
Device Set oint Control
and Calibration
4
The team reviewed the licensee's
program for controlling protective device
setpoints
to assure
that equipment will operate
at predetermined
levels.
In
addition,
instrument calibration procedures
and records were'lso
reviewed to
determine
whether the contents
of procedures
and test results
were acceptable.
These
are discussed
as follows.
P
~
I
C
29
4.3.1
Protective
Rela
Set oint Control
The licensee
provides control of protective device setpoints
through the
Engineering
Work Request
(EWR) process
and applicable
design output documents.
Once
a design
change
to protective device setpoints
has been'determined
to be
required,
an
EWR is initiated to assure
adequate
review and control.
Documents
generated
during the review and approval
process
include:
Design Criteria,
Safety Analysis,
Design Analysis,
and Design Verification.
The team examined
the installed equipment to assess
the control of protective
device setpoints
and
system configuration.
As-found settings for overcurrent
relays, circuit breakers
and undervoltage
relays were
compared against controlled
documents.
The team also verified the installed fuse sizes
and types in several
control circuits'he installed fuses
were the
same
as that specified in wiring
diagrams.
.No discrepancies
were identified.
4.3.2
En ineered
Safet
Feature
Load
Se uencin
Timers
The team reviewed procedure
RSSP-2.7
"Safety Injection Sequence
Timers Train
A
and B".
This procedure
is used to set the individual
ESF load sequencing
timer.
The procedure
describes
the initial conditions,
precautions,
and instructions
for, the performance of the test.
The t'est results
provide verification that
the timers
have not drifted significantly from the previous as-left values.
This assures
that the
ESF loads will load onto the respective
480
V buses
at
appropriate
time intervals to preclude
the
EDGs from being overloaded.
The
as-found times for each individual timer is recorded
and evaluated
against
specified values.
These
values
are derived
from Engineering
Work Request
(EWR)
4960-1
"Time Delay Relay Setpoints
ESFAS System",
Revision
4.
The
EWR analyzed
the individual timers considering
instrument drift and
ESF motor acceleration
times.
Although the times are derived
from the
EWR, the as-found values
are
compared against
the
The procedure
requires that any timer which does
not fall within the specified required time band
be evaluated
to ensure full
compliance with the values specified in UFSAR Table 8.3-2.
The
UFSAR table
lists the individual
ESF load running times,
which are the times by which each
individual motor is required to have
reached full speed.
The team noted that
MOVs 871-A/B have individual timers to ensure
proper
closing
upon receipt of
a safety injection (SI) signal
and are included in
procedure
RSSP-2.7.
However,
the
MOVs are not listed in the
UFSAR Table 8.3-2
and therefore
cannot
be evaluated
against
the
This was evident
from the
review of records for a test performed in April 1990.
In this instance,
-the
procedure
specified time band for the timers were exceeded.
However,
these
values
were not evaluated
since
they are not specifically listed in the
table.
The
MOV required times are
based
on the capability of the swing SI
pump
1C to operate.
These times,
as well as those for other timers listed in the
UFSAR table,
have
been
analyzed with the required times
summarized
in
4960-1.
The team
asked
why the procedure
required evaluation of the
30
as-found timer values against
the
UFSAR load running times instead of the
established
timer setpoints
in
EWR 4960-1 'since the
EWR already
has considered
the
UFSAR values
in the analysis.
Use of the setpoints
from the
EWR would
ensure that all loads,
including the subject
MOVs, are properly evaluated.
The
licensee
agreed that the
EWR criteria will be incorporated into the RSSP-2.7
procedure.
The out-of-band
MOV timer values
were subsequently
evaluated
and
were determined to be adequat'e
such that the
swing SI
pump
1C would still have
been able to operate
during
an accident
since there
was sufficient margin in
the setpoint value.
The team
had
no further
questions.'.3.3
Under volta
e and
De r aded Volta
e Rela
s
Ginna Station Technical Specifications
(TS) Section
2.3 specifies
the Limiting
Safety
System Settings for Protective
Instrumentation.
Section
2.3'. 1
specifies that
480
relays will be tested to ensure that they
operate
in accordance
with their design characteristics.
Figure 2.3-1
identifies the .loss of voltage
and undervoltage
relay operating
ranges.
In
accordance
with TS Table 4. 1-1,
each
channel
is required to be tested
on
a
monthly basis
and calibrated
every refueling outage.
Ginna Station procedure
PT-9. 1 "Undervoltage Protection - 480 Volt Safeguard
Busses"
provides instructions for testing the operability of the loss of
voltage
and degraded
voltage relays associated
with 480
V Safeguard
buses
14,
16,
17,
and
18 .
This procedure
implements
the
TS monthly, survei
1 lance test
requirements.
Procedure
PR-1. 1 "Protective Relay Calibration
480
V
and Ground Alarm Scheme
For Buses
14,
16,
17 and
18" provides
instructions for the calibration of protective relays.
It implements
the
refueling outage
TS Surveillance
requirement.
Review of procedure
PR-1.1 calibration results
performed during the
1991
refueling outage
(March 1991)'indicated
that three (3) as-found relay values
we'e below the
TS limits specified
in TS Figure 2.3-1.
Specifically, the
as-found relay dropout voltage settings
were less
than the
TS limit of 103.5
V
(equivalent to 414
V at the
480
V buses).
These
are denoted
below.
~Rela
As-Found
Dro out
V
Volta e at 480
V Bus
27B/14
27/16
27B/18
103.39
103.07
103.38
413.6
412.3
413.5
Although the above as-found values
were below the
TS limits, the results
review
performed
by the
1'icensee
did not identify this condition.
Therefore,
no
evaluation
was performed to determine
whether safety-related
motors would still
have
been
able to operate
at reduced
voltages prior to the relays dropping out.
In response
to the team's
concern,
the licensee
performed
an evaluation
and
determined that
no adverse effect
on the safety related motors would
result'ue
to the small voltage deviation.
In addition, the licensee initiated
a
31.
Ginna Station
Event Report to document
and evaluate
the above condition for
reportabi
1 ity.
Procedure
PR-1.1 "Protective
Relay Calibration
480
and Ground
Alarm Scheme for Buses
14,
16,
17 and 18", section
5.3 requires
an I&C/Electrical
Equipment Failure Safety Related
Report
be prepared
to evaluate
those relays
that exceed
the calibrated tolerance.
Failure to prepare
the I&C/Electrical Equipment Failure Safety Related
Report
for the protective relays described
above constitutes
a violation of Ginna
Technical Specifications, Section 6.8. 1, which requires that written procedures
be established
and implemented for surveillance
and test activities of safety
related
equipment (50-244/91-80-04).
4.4
Conclusion
The licensee
has
implemented controls to maintain electrical
system
configuration.
Equipment
inspected
was observed to be well-maintained
and
an
effective fuse control program was evident.
The development of the molded case
circuit breaker test
program is ongoing.
The testing attributes
being
addressed
are comprehensive
and thorough.'
deficiency was identified in
handling the as-found data of the protective relay testing.
The droupout
voltage settings
of three protective relays drifted below the Technical
Specification limits during the
1991 refueling outage yet no evaluation
was
performed
as required
by station
procedures.
5.0
En ineerin
and Technical
Su
ort
The team assessed
the capability and performance
of the licensee's
organization
to provide engineering
and technical
support
by examining the interfaces
between
the technical disciplines internal to the engineering
organization
and
the interfaces
between
the engineering
organization
and the technical
support
groups responsible
for plant operations.
The
team also reviewed
a sampling of the licensee's
Potential
Conditions
Adverse to Quality (PCAQ) reports,
Nonconformance
Reports
(NCRs),
Licensee
Event Reports
(LERs), major,
minor
and temporary modification programs,
training, quality assurance
(QA) audits,
root-cause
investigation
and
corrective action programs,
and self assessment
programs.
5. 1
Or anization
and
Ke
Staff
The Engineering
and Technical
support for the Ginna Station is provided by the
Corporate
Nuclear
Engineering
Services staff at Rochester,
New York, the Site
Technical
Engineering
group
and Site Modification Support group.
The Corporate
Nuclear Engineering
Services
group is headed
by the Manager,
Nuclear Engineering
Services.
The Corporate
Engineering
support for the
electrical distribution system is provided by the Electrical
Engineering
group
within Nuclear Engineering
Services Division.
The Site Technical
Engineering
32
group
and Modification Support group are responsible
for providing site
engineering
support to plant operations,
maintenance
and design
support.
The corporate
engineering staff performs all major engineering design,'nd
the
Ginna Station performs all minor modifications.
Engineering consultants
are
used only to supplement
the in-house capabilities,
on
an
as
needed
basis.
The
team noted that the Nuclear Engineering
Services
Department Staff has
been
increased
from 68 to
104 from 1989 to'present
to improve the engineering
support for the station.
Throughout the inspection,
the corporate
and site
engineering staff provided timely and thorough
responses
to the team members.
The team concluded that the engineering
positions
are adequately
staffed with
knowledgeable -personnel.
5.2
Root Cause
Anal sis
and Corrective Action Pro
rams
The team reviewed several
Licensee
Event Reports,
Potential
Conditions Adverse
to Quality (PCAQ) documents,
Non-Conformance
Reports
(NCRs), Corrective Action
Reports
(CAR) and
QA Audits to assess
the effectiveness
of the licensee's
root
cause
analysis
and corrective action
programs
The
NCRs reviewed
by the
team indicated that corrective actions
were
appropriate
to address
the problems identified in the
NCRs and in accordance
with procedure
QE-1501.
Engineering dispositions
and applicable
and Part
21 reviews were found -to be thorough.
Several
PCAQ reports
in accordance
with Procedure
QE-1603 were reviewed to
determine
whether safety concerns
were properly identified, reported
and
corrected.
The team noted that in all cases,
the licensee
promptly identified
potential, safety concerns,
made accurate operability and preliminary safety
assessments,
reportability evaluations,
and necessary
corrective actions
were
initiated.
Quality Assurance
audits
reviewed were found to be adequate
and
addressed
various elements
of engineering
organization
design control
and
surveillance
programs.
Corrective actions
and response
to the audit findings
were prompt and proper engineering
management
attention
was noted
as evidenced
by the minimal outstanding
open audit findings.
The team also reviewed selected
LERs to assess
the adequacy of engineering
organization
involvement in
NRC reporting requirements
(in accordance
with 10
CFR, Parts
20, 21, 50.72,
50.73
and 50.36)
and to determine
the adequacy
of
root cause
analysis
and corrective actions.
Corrective actions
were generally
broad in scope to address
the root and contributing causes.
The root cause
investigation
process
was thorough
and self critical to identify weaknesses.
This was evidenced
during the review of LER 87-008,
inoperable circuit breakers
for "1B" RHR and "1B" safety injection
pump and
LER 90-005,
low safeguards
bus
voltage during start of "A" RCP.
The team noted that
a corrective action group
working for the manager
tracks
and initiates corrective action reports for LERs
and any potential
safety concerns
identified by the station.
The
sample
review
of open
CARs indicated that
CARs were closed out in
a timely manner.
33
The team determined that the licensee
has
a good program to identify and
investigate discrepancies
and root causes
and to complete corrective actions
in
a timely manner.
5.3
Self Assessment
Pro
rams
The team reviewed the licensee's
self assessment
programs to assure
that safety
issues
are properly identified and corrected.
The team noted that the licensee
had performed
an electrical distribution system functional inspection to make
an independent
assessment
of the
EDS.
The independent
assessment
covered
electrical
and mechanical
design
review, operations,
testing
and modifications.
The assessment
was comprehensive
and several
technical
issues
were identified
in the report.
The corrective actions to resolve
these
issues
were being
pursued at the time of inspection.
Another self assessment
program reviewed
was the licensee's
Potential
Conditions Adverse to Quality (PCAQ) Program which identifies and resolves
safety significant issues with appropriate
engineering
and station personnel
review.
Several
potential
safety concerns
were identified by the licensee
during this year.
The review of sample
PCAQ indicated that potential
safety
concerns
were reviewed in
a timely manner to determine operability and safety
concerns
and were found to be thorough.
The quality assurance
area
was also
reviewed
by the
team to evaluate
the
involvement of QA personnel
in assessing
the quality of engineering
services'he
team concluded that
QA audits
and
QA involvement in monitoring engineering
effectiveness
were adequate.
The team noted that the licensee
had performed internal
and independent
assessments
to assess
the capability and quality of output generated
by their
Nuclear Engineering
Services Division.
These
comprehensive
self assessments
were performed to address
design control
and engineering
assurance
weaknesses
identified during previous
NRC SSFI Inspection
(No. 89-81).
The team noted
that in order to improve the Ginna Station's
performance,
'licensee
management
has committed to implement configuration
management
engineering
projects
such
as
P&ID Upgrade,
Electrical Controlled Configuration Drawing (ECCD) upgrade,
Q
list, Design Basis
Documents,
Programs
and Commitment Tracking Systems.
Some
of the projects
such
as
P&ID upgrade,
Q list document
and
ECCD upgrade
were
completed
and the remaining configuration
management
projects
are scheduled
to
be completed
by 1994.
The team concluded that the licensee's
self assessment
program efforts were
thorough
and aggressive
and considered
to be
a strength
for achieving the
licensee's
nuclear mission goals for attaining outstanding
performance
in all
aspects
of operation
and safety of the Ginna Station.
l
5.4
E ui ment Modifications
The team reviewed the program for plant design
changes
and modifications to
ascertain
that they were performed
in conformance with the requirements
of the
Technical Specifications,
l0 CFR,
FSAR,
and applicable
procedures.
n
The
RGEE modification process
is categorized
into major-mods
and minor-mods..
Major modifications are performed through the licensee's
Engineering
Work
Request
(EWR) process
and are performed
by the Corporate
Engineering group.
The major modifications are either mostly safety related
changes
or non-safety
related plant changes
that are
complex in nature.
Minor modifications are
performed
by Ginna Station Technical
Engineering
group
and are either generally
non-safety related
changes
to the plant or safety related
changes
which are
minor in nature.
All minor modification requests
(TSR process)
are reviewed
by
the
RG&E corporate office to determine
whether modifications are classified
approproately
in accordance
with procedures
gE 322 and
A 301. 1 and also to
provide corporate
engineering
oversight
in the Modification Process.
The major and minor mods reviewed are identified in Attachment
2 and include
a
variety of permanent
plant changes
to the electrical distribution and support
systems.
The team noted that engineering
procedures
for modification process
were
prescribed
in several
individual, "gE" procedures.
No single procedure
exists describing
the whole modification process.
The modification packages
reviewed (1984-1990)
indicated that design criteria, design verification,
design input and safety evaluation
thoroughness
and technical
review could be
improved.
For example,
(1)
EWR 3891-Design criteria for DC battery replacement
did not consider
guidance
for cell sizing, design margin, charger capacity;
the
safety analysis did not consider
hydrogen evolution; the increase
in short
circuit current contribution did not coordinate
and design
a verification
appeared
to be more administrative in nature rather
than
a technical verif-
ication.
(2)
EWR 2929-Safety analysis
and design verification did not appear
to identify the potential for degrading
the coordination of system protection
when back
up protection is applied to electrical penetrations.
I
However, recent
analyses
reviewed
by the
team indicated that these
aspects
have
since
been identified and addressed.
The team observed that the documentation
of completed modification packages
were not kept in one specific location
and
were difficult to retrieve.
Numerous
weaknesses
were identified with respect
to design documentation
and calculations during the previous
NRC SSFI
(inspection
Report
No. 89-81).
The
team noted that in order to address all the
design control plant modifications process deficiencies,
the licensee
had
performed
a comprehensive
internal
and independent
assessment
of the above
area.
Increased
management
involvement to improve the existing design control process
and quality of engineering
work was observed
by the the team during this
inspection.
As
a result,
Nuclear Engineering
Services modification design
process
standard
and flow chart describing
the integrated
design modification
process
were developed
and in the final stages
of approval.
Several
"gE"
procedures
were revised to provide
a better understanding
of the existing
design
process
and appropriate
procedure training were completed.
A sampling
of work orders for the
EDS completed
in 1990-1991
was reviewed to assure
that
maintenance activities did not result in design
changes.
No unintended
design
changes
were identified.
35
During this inspection,
the team observed that several
calculations
were
developed
by the licensee
in
a very short time duration.
The
team deter-
mined that technical
review and thoroughness
of some of the calculations
could
have
been
improved.
The team interviewed several
members of the engineering staff (both corporate
and site) to determine their understanding
of the design control
and modif-
ication process.
The engineering staff were found to be knowledgeable
and
have
a good understanding
of the modification process.
The team noted, that
a design
basis reconstitution
program
and configuration
management
controls are being
implemented to enhance
the documentation
so that it more accurately reflects
as-built conditions
and to better
assure
that the Ginna plant is operated
and
modified within its design basis.
The team observed
a positive improvement in the design modification process,
engineering
procedures
and
EDS calculations.
However,
the team concluded that
,the effectiveness
of licensee's
design control
and modification process
cannot
be determined at the present
time since most of the proposed corrective actions
for the identified weaknesses
are yet to be completed.
5.5
Tem orar
Modification Pro
ram
Temporary modifications for electrical
systems
(Bypass of Safety Function
and
Jumper Control) are administered
and controlled by procedures
A-1402,
1405
and
1406.
These
procedures
identify the controls for use of bypass
features
on
safety related
and non-safety related
equipment.
The team's
evaluation of
selected
temporary modifications revealed that they contained
appropriate
review and approval
by the Technical
manager
and the Shift Supervisor
and
appropriate
safety evaluations/reviews
'were performed to meet the intent of the
10 CFR 50.59 requirements.
However,
the
team noted that the procedures
do not
require
a detailed
formal 50.59 review or safety evaluations.
The licensee
state that temporary modification procedures
are being updated
to address all
program weaknesses
'as part of 'the procedure
update
program.
'The team noticed
that four of the non-safety related modifications were found to be approx-
imately six years old.
The licensee
stated that these
are being replaced
by permanent
plant modifications through their
EWR/TSR
modification process
and are
scheduled
to be wor'ked in accordance
with the
priority assigned
to the modifications.
The licensee
also stated that the
Ginna Station's
goal is to closeout
the temporary modifications before the end
of one year.
The team reviewed the log kept in the control
room for tracking temporary
mods
and interviewed control
room supervisors.
The review indicated that
open'emporary
mods are reviewed periodically and tracked.
The team determined that
the licensee
has
an adequate
program for controlling temporary modifications
and bypasses
in the plant.
I
r
'
'
5.6
En ineerin
Su
ort/Interface
36
The team reviewed the involvement
and effectiveness
of the engineering staff to
support design functions, operations,
maintenance
and other organizations
at
.
the site.
The team noted that the licensee
has
an integrated prioritization
system for controlling and assessing
engineering
work activities.
The inter-
face between station and.engineering
personnel
at Ginna was found to be
effective as evidenced
by the presence
of technical
engineering,
modification
support staff .and corporate staff, at the site, to support the engineering/
technical
needs of the plant.
A close working relationship
between
the
engineering
and operations
personnel
was noted during this inspection.
Several
corporate,
plant engineering,
maintenance
and operations staff were interviewed
during the course of the inspection to understand
the communication channel/
interface established
for Ginna Station.
The licensee
has established
morning
and, afternoon meetings to discuss
plant activities pertaining to design,
operation
and maintenance
action items.
The active participation of management
representatives
from different organizations
for these
meetings exhibits the
effective interface
between
engineering
and plant organizations.
Furthermore,
the team observed that the licensee
was able to provide required
design
documents
and calculations within a short time indicating
a good coor-
dination between different organizations
and the Ginna Station.
The team found
the engineering staff to be very knowledgeable
of the
EOS.
The team that
interacted with the
NRC inspection
team indicated
a good familiarity with their
area of responsibility.
A good -interface
between
support organizations
was
noted during this inspection.
5.7
Technical Staff Trainin
The team reviewed the licensee's
technical training program to evaluate
the
adequacy
of training given to the corporate
and site engineering staff.
The training program is conducted
in accordance
with licensee's
procedure
No.
gE 102, "Indoctrination and Training."
This procedure
provides instructions
for'he control
and documentation
of indoctrination
and training for Nuclear
Engineering
personnel
for their specifically assigned
functions.
The training
program consists
of initial and continuing training.
The initial training
program depends
on the qualification and experience
of the individual. The
initial training program extends
up to
2 years.
The continuing training
program is an ongoing program
and it covers at least
4 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of classroom
training.per quarter.
The Ginna training center provides
adequate
training in
several
courses
such
as
System Engineering,
50.59/safety
evaluations,
LER
process,
modifications process,
industry events
and simulator training.
Furthermore,
the technical staff is required to attend administrative
and
engineering
procedures
training in addition to the normal required
reading
assignments.
The
team noticed that training d'ocuments
are pro'perly maintained
and tracked in the computer data
base
and updated periodically to maintain
an
effective training program.
The team also
noted that the licensee
engineers
.4
0
37
actively participate
in industry groups
and programs,
and are
aware of
technical issues'he
team concluded that the licensee
has
an adequate
training program for the technical staff for performing engineering
and design
functions
and for providing adequate
technical
support for the plant's
operational activities.
5.8
Conclusion
The corporate
and site technical
engineering
and modification support personnel
are adequately
staffed with competent
personnel
and are very familiar with the
EDS and its support
systems.
Effective interfaces exist between station
and
engineering
personnel.
Communications
between
the various engineering
and
technical
support organizations
were found to be generally good.
Engineering
support to operating
and maintenance
activities are generally
good with an
effective interface
evidence
in many areas of projects.
The team determined
that the licensee
has
an aggressive
self assessment
program.
This program is
considered
to be
a strength.
The licensee
has
a good program to investigate deficiencies,
identify root
causes
and to complete appropriate corrective actions
in a timely manner.
Technical training and guality Assurance
Programs
were found to be adequate.
The team observed
several
isolated
examples
which indicate that the thorough-
ness of technical
reviews
and attention to detail
could be improved in the
design calculation/modification
process.
Increased
management
involvement to
improve the existing design control process
and the quality of engineering
work
was evidenced
by the completion of P8 ID update
program, Electrical Configur-
ation Controlled Drawing Program,
EWR Procedure
upgrades,
ongoing Design Basis
Reconstitution
Program
and Configuration Management
Control
Program.
Improvement in the licensee's
design control
and modification process
was noted
during this inspection.
6.0
Unresolved
Items,
Weaknesses
and Observations
Unresolved
items are matters
about which more information is required in order
to ascertain
whether they are acceptable
items or violations.
Unresolved
items
identified during this inspection
are discussed
in detail,
Paragraphs
2.42,
2.5
and 2.8
~
Weaknesses
and observations
are conditions that do not constitute
regulatory requirements
and are presented
to the licensee for their
evaluations.
7.
The inspector
met with licensee
corporate
personnel
and licensee
represent-
atives (denoted
in Attachment I) at the conclusion of the inspection
on June
7,
1991.
The inspector
summarized
the
scope of the inspection
and the inspection
findings at that time.
1'
Attachment
1
Persons
Contacted
1.0
Rochester
Gas
and Electric Cor oration
RG5E)
S.
Adams, Technical
Manager
C. Anderson,
Manager, Quality Assurance
B. Carrick, Mechanical
Engineer
R. Carter,
Mechanical
Engineer
G. Daniels, Electrical
Engineer
B. Flynn, Engineer,
Nuclear Safety
and Licensing
C.
For kell, Manager, Electrical Engineering
B. Hunn, Electrical
Engineer
M. Kennedy,
CM Program Directory
M. Lilley, Manager,
Nuclear Assurance
D. Markowski, Mechanical
Engineer
R. Mecredy,
Vice President,
(Ginna) Nuclear Production
J. Metzger,
Senior
Mechanical
Engineer
T. Miller, Electrical
Engineer
- R. Morrill, Operation
Experience
Coordinator
T. Newberry, Mechanical
Engineer
J.
Pacher,
Electrical
Engineer
L. Rochino,
Lead Mechanical
Engineer
W. Roeltger, Electrical
Engineer
J. Sargent,
Electrical
Engineer
E. Smith, Mechanical
Engineer
L. Sucheski,
Supervisor,
Structural
Engineering
P. Swift, Electrical Engineer
C. Vitali, Mechanical
Engineer
- G. Voci, Manager,
Mechanical
Engineer
- T. Weigner,
Technical Assistant to Dept.
Manager
P. Wilkens, Dept.
Manager,
NES
J. Widay, Superintendent,
Ginna Production
G. Wrobel, Manager,
Nuclear Safety Licensing
2.0
Nia ara
Mohawk Power Cor oration
F. Constance,
Electrical
Engineer
D. Goodney,
Lead Electrical
Engineer
- A. Julka,
Supervisor,
Nine Mile 2 Electrical
A. Pinter,
Licensing Engineer
"T. McMahon, Supervisor,
Nine Mile
1 Electrical
3.0
United States
Nuclear
Re ulator
Commission
C. Anderson,
Chief, Electrical Section,
M. Hodges, Director, Division of Reactor Safety
A. Johnson,
Project Manager
R.
Wessman,
Project Director PDI-3,
N. Perry Ginna Resident
Inspector
- denotes
those
not present at the exit meeting
on June
7,
1991.
'
ATTACHMENT 2 - GINNA ELECTRICAL DISTRIBUTION SYSTEM
STA 204
STA 42
STA 122
STA 204
STA 42
I
CKT 913
CKT 912
CKT 9'I1
STA 121
52
91302
91202
52
1GISA72
52
7XISA72
52
8X13A72
52
9X13A72
CKT 908
52
90812
52
91102
STA 204
I
I
I
I
I
I
I
I
NO. 6 TRANS F.
30/40/50
MVA
I
CKT751
CKT 909
52 90912
SWITCHYAAO115KV
STATION 13A
CKT 767
STA AUX.
TRANSF. 12A
52
52
12AX
12AY
NO
Nc
STA AUX.
TRANSF. 12B
52
52
12BY
NO
19KV/4160V
UNIT
AUX.TRANS F. NO. 11
REMOVABLE
LINK
RFMOVABLE
LINK
REMOVABLE
LINK
MAINTAANSF.
19KV/115KV
ONSITE
SPARE M/UN
TRAN5F.
DUMMY
BREAKER
52
52
DUMMY
BREAKER
4160V BUS 12 B
4160V BUS 11 8
4160V BUS 11 A
4160V BUS 12 A
52
52
52
52
52
52
52
52
STA SERV
TRANS F. NO. 16
STA SERV
TRANSF. NO. 15
STA SERV
TAANSF. NO. 13
SERV
TRANS
NO. 14
GEN
EXC
PMQ
480V BUS 15
480V BUS 16
480V BUS 14
480V BUS 13 )
)
)
)
)
)
)
NEUTRAL
TAANSF.
STA 5ERV
~ TAANSF. NO. 17
EMER. GEN.
)
NO. IB
480V BUS 17
EMER. QEN,
NO. 1A
STA SERV
TRANSF, NO. 18~
480V BUS 18
,J'
~
(
0