ML17279A735
| ML17279A735 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 12/04/1987 |
| From: | Huey F, Johnston K, Pereira D, Ramsey C, Richards S, Rod K, Wagner W, Joel Wiebe NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| To: | |
| Shared Package | |
| ML17279A733 | List: |
| References | |
| 50-397-87-19, NUDOCS 8712230145 | |
| Download: ML17279A735 (42) | |
See also: IR 05000397/1987019
Text
U.
S.
NUCLEAR REGULATORY COMMISSION
REGION V
Report
No. 50-397/87-19
Docket No. 50-397
License
No.
Licensee:
Washington Public Power Supply System
P.
0.
Box 968
Richland,
99352
Facility Name:
Washington Nuclear Project
No.
2 (WNP-2)
Inspection at:
MNP-2 Site,
Benton County, Washington
and
MPPSS Engineering
Offices, Richland,
Mashington
Inspection
conducted:
August 3,
1987 through August 28,
1987
Inspectors:
F.
R.
Huey,
Team Leader
W.
ner,
Re
tor Inspector
'PÃl
. ~Ramsey;,
Re qtor Inspector
i )
8&.'~
Pereir a,
Reactor Inspector
i2- /-8 >
Date Signed
~/-
z7
Date Signed
2- I -81
Date Signed
i~A/~z
Date Signed
K. Johnston,
Resident
Inspector
J.
Miebe, Resident
Inspector, RIII
K.
Rod, Inspector Trainee
Consultants:
G. Morris, Westec Services,
Inc.
D. Prevatte,
Westec Services,
Inc.
L. Stanley, Zytor, Inc.
Approved By:
S.
Richards,
Chief,
ngineering Section
Date Signed
>2.-H -8 l
Date Signed
s2 -"I-87
Date Signed
z,-9 -87
Date Signed
8712230145
871208
ADOCK 05000397
G
~Summar:
Ins ection
on Au ust
3 throu
h 28
1987
Re ort No. 50-397/87-19)
Ins ection
Ob 'ective
The objective of this inspection
was to assess
the operational
readiness
of
selected
safety
systems
at WNP-2.
Ins ection Method:
A Safety System Functional
Inspection
(SSFI)
was performed
on selected
safety systems.
An SSFI type inspection is
a design
based
inspection process.
One of the chief advantages
of this type of inspection is
that it concentrates
a comprehensive,
multi-discipline review into a
relatively narrowly defined area.
The intent of the inspection is to define
an inspection
area that is not only important to plant safety
or accident
mitigation, but to select
an area involving a broad cross-section
of
activities by the various disciplines in the licensee
organization.
This type
of approach
allows the inspectors
to develop
a fairly accurate
perspective
of
how well the licensee organization integrates
the various aspects
of plant
design,
engineering,
operation,
maintenance,
etc.
Recent experience with this
type of inspection
has
shown it to be effective at pointing out deficiencies
both in the area of adequate
licensee
understanding
of the design basis for
the plant and in the area of control of the design process.
Basis
and
Sco
e of Ins ection:
In defining the scope of this inspection,
the
NRC adapted
generic
PRA data to
the specific
WNP-2 plant design in order to determine significant plant
failure modes.
Recent
NRC findings relating to engineering
and quality
assurance
problems (e.g.
root cause
assessment)
were also considered.
This
review process
resulted in the selection of the
AC and
DC electric power
distribution systems
as the primary areas
of emphasis for the inspection.
The
inspection
scope also included the Standby Service Water System
(a significant
emergency
power support system)
and the Automatic Depressurization
System
(a
significant accident mitigating system in the event of a loss of power event).
Results of the Ins ection:
Ma or Concerns Identified
1.
Inade uate Control of Plant Desi
n
Re uirements
The team noted several
examples of problems in which the licensee
appeared
to have lost control of the plant design process.
Specific
concerns
in this regard involve both
a lack of licensee
understanding
of
the plant design basis
and
a loss of control of implementation of design
requirements
into plant modifications
and procedures.
In addition, the
types of problems
noted raises
a concern
as to the adequacy of quality
assurance
controls in the deficient areas.
-3-
2.
Plant Material Condition and Housekee
in
Deficiencies
The team observed
several
examples of plant material condition and plant
housekeeping
deficiencies.
3.
Inade uate
Root Cause
Assessment
and Corrective Action
The team identified some instances
in which it did not appear that the
licensee
had implemented aggressive
root cause
assessment
or timely
corrective action following specific plant malfunctions.
A more detailed
summary of the team findings is provided
as Appendix
B to the
transmittal letter accompanying this inspection report.
Summar
of Violations Identified
Of the areas
inspected,
ten apparent violations of NRC requirements
were
identified,
as
summarized
below:
A.
Failure to comply with requirements
for establishing,
implementing
and maintaining procedures
for the surveillance
and testing of
safety related
equipment.'.
Failure to comply with Technical Specification requirements
for
minimum fuel oil supply for emergency
diesel
generators.
C.
Failure to properly implement quality assurance
program requirements
for compliance with station procedures.
0.
Failure to comply with Technical Specification requirements
for
obtaining review and approval of station procedure
changes.
E.
Failure to comply with requirements for periodic testing of safety
related time delay relays.
It should
be noted that several
areas of potential violation of NRC
requirements
remain unresolved,
pending completion of additional
licensee
review of the specific problems involved.
Further actions in this regard will
be the subject of future correspondence,
following review of additional
licensee
information on these
items.
DETAILS
Persons
Contacted
Licensee
personnel
attending the exit meeting
on August 28,
1987
included:
S.
S. Allen, Engineer I, Fire Protection
J.
W. Baker, Assistant Plant Manager
G. Brastad,
Technical Specialist (Electrical/I&C)
J.
P.
Burn, Director of Engineering
S.
Chaudhuri,
Principal Electrical Engineer
J. Civay, Principal Electrical Engineer
J.
D. Cooper,
Principal
Engineer,
Maintenance
C.
D.
Eggen,
Principal Engineer,
Fire Protection
C. J.
Foley, Technical Specialist
G.
Freeman,
Principal Test Engineer
F.
D. Frisch, Principal Engineer,
Operations
P.
W. Harness,
Technical Specialist
L. T. Harrold, Manager,
Generation
Engineering
D.
A. Injerd, Engineer I, Mechanical
Systems
W.
M. Kelso, Principal
Engineer
R. Koenigs,
Supervisor Plant Engineering
G.
Lawrence,
Principal Electrical
Engineer
J.
Massey,
Supervisor Electrical Maintenance
R. Matthews,
Principal Electrical
Engineer
G. Moore, Senior Electrical
Engineer
J.
C.
Mowery, Principal
Engineer
D.
M. Myers, Principal
Engineer
B.
D.
Ngo, Engineer I, Mechanical
Systems
C.
R.
Noyes,
Manager,
Mechanical
Systems
N. Porter,
Manager, Electrical/I
8
C Systems
C.
M. Powers,
Plant Manager
M. Rice, I 8
C Engineer
(Diesel Generator)
D. Thorn, Principal Electrical Engineer
S.
N. True, Clerk, Records
Management
A. Warren,
Nuclear Plant Engineer
(DC Systems)
C.
M. Whitcomb,
Leader,
Technical
Program
D.
L. Whitcomb, Technical Specialist
S.
G. Willman, Engineer I
In addition to the individuals identified above,
various other
engineering,
quality assurance,
maintenance,
and operations
personnel
and
other members of the licensee's
staff were interviewed during the
inspection.
For the
NRC, J.
B. Martin and
R.
P.
Zimmerman of Region V, the,NRC
licensing project manager,
and the resident inspector,
attended
the exit
meeting,
in addition to the inspection
team members.
2.
Plant
En ineerin
and Desi
n Modification
Plant-engineering
and design modifications were reviewed in the
mechanical, electrical,
instrumentation
and controls,
HVAC, and fire
protection disciplines.
The review focused
on the
Emergency Electrical
Systems
(both ac and dc) and their support
systems.
These
included the
emergency
Diesel Generators
and their auxiliaries,
the
AC and
Electrical Distribution Systems,
the Standby Service Mater System,
the
125
VDC and
250
VDC Batteries
and their associated
hardware,
the
essential
HVAC for these
systems,
and the fire protection for these
systems.
In addition,
the Automatic Depressurization
System
and its
support
systems
were reviewed.
The team findings in this area are
summarized
in the following sub-paragraphs:
Class
lE Batter
Sizin
The Division 1 and Division 2 125 volt batteries
and the Division 2
250 volt battery were replaced in 1983 with. different type Exide
cells than
used in the original batteries.
The
common battery
sizing calculation (Calculation
No. 2.05.01,
Revision 6, 3/5/84)
was
revised to address
the
new 125 volt cells only.
The team reviewed
the battery sizing calculation
and
had the following concerns.
The data documentation
used to develop the load profile was
deficient in that many of the inputs,
such
as
dc motor loads,
switchgear control,
and
demand
and diversity factors,
were not
sufficiently referenced
to permit verification.
The team attempted
to duplicate the loads
on the Class lE battery profiles and found
problems in both the
125 volt and 250 volt profiles reviewed.
The
250 volt Division 1 battery motor loads
used in the calculation did
not agree with the dc single line drawing (Drawing No.
E505,
Revision 41, 7/21/86).
Additionally, the motor starting currents
were
assumed
in the calculation to be limited to 200K full load
current,
however,
the team found that the calculation (Calculation
No. 2.05.08,
Revision 1, 7/21/83) which sized the starting
resistors,
permitted
a motor starting current of 300K.
This
inconsistency
alone could account for an additional profile load of
over 300 amperes
in the first minute
on the 250 volt battery.
Additional errors
noted by the team were associated
with both the
250 volt and the 125 volt safety-related
inverter loads,
including
corrections to battery loading for inverter dc input voltages at
less than nominal voltage
and decreased
inverter efficiency at less
than rated load.
The team also identified problems with the methodology
used in the
calculation.
The calculation
was performed looking only at the
total length of battery discharge
and failed to consider the
incremental effect of each step in the load profile.
This was most
significant in the 125 volt Division 1 battery in which the
licensee's
calculation concluded that
a cell with only 2 positive
plates
would provide adequate
margin.
In fact, based solely on the
original profile, the team calculated that
a cell with 6 positive
plates
would be required to maintain the battery voltage
above
105
volts during this initial transient.
The methodology for this type
calculation
was published
by EXIDE as early as
1954 with HOXIE'S
AIEE paper,
"Some Discharge Characteristics
of Lead Acid Batteries".
This paper
formed the basis for IEEE-485,
Recommended
Practice for
Sizing Large
Lead Acid Storage Batteries.
In addition, the
calculation failed to account for the degraded
battery conditions
permitted
by the plant technical specifications
(Technical Specification 4.8.2. 1) and should
have included correction factors
for the minimum permitted operating temperature
of 60 degrees
F,
aging,
and maintenance
margins.
If all these
margins
were included
in the original load profile, as
recommended
by current industry
,
standards
and 1983),
both the existing 125 volt and
250 volt Division 1 batteries
would appear to be undersized.
Only
because
these batteries
are relatively new and tested capacity
shows
these batteries
have greater
than rated capacity,
does the team
believe that this is not an immediate safety concern.
The Division 3 battery
was modified to a 58 cell battery by design
change
PMR-2-85-0181-0.
The sizing for this battery is documented
by Supply System calculation
no. E/I 02-85-02,
Revision 0, 5/3/85.
The load profile for this calculation is based
upon the Final Safety
Analysis Report
(FSAR) load Table 8, 3-6.
The calculation did not
attempt to confirm these
FSAR loads.
Similar to Division 1, the
team found
a problem with the motor starting current
assumed
for the
diesel
standby fuel
pump.
The
FSAR table
assumed
the starting
current
was limited to 10 amperes
(200K of full load current).
However, the motor test record indicated the starting current could
exceed
20 amperes.
In addition, while the calculation included margins for minimum
temperature,
aging,
and design margin, the team found that the
correction factor for minimum temperature
was based
upon
65 degrees
F, not the allowable
60 degrees
F minimum temperature.
Corrections
for these errors would require
a battery cell with 5 positive plates
to permit battery replacement
at 80K rated capacity.
The present
Division 3 cells contain only 4 positive plates
and the latest
battery performance test dated 4/18/87 revealed that the battery
has
already
degraded
to 88.35K capacity.
The team is concerned that
little margin remains in this battery.
Failure to assure that the design basis for the safety-related
batteries
was correctly translated
into station
documents
appears
to
be
a violation of 10 CFR 50 Appendix B, Criterion III.
This item
remains
unresolved,
pending additional
licensee
evaluation
(50-397/87-19-01).
S stem
Minimum Volta e
The team reviewed voltage drop calculations
(Calculation Series
2.06.xx) for voltage drops
from motor control centers to their
associated
loads.
(1)
The team selected
Calculation
No. 2.06.04,
Revision 13, dated
3/11/87, to review the Division 1,
125 volt dc motor operated
valve
(MOV) supply cable voltage drop determination.
The team
4
observed that the calculation correctly stated
the requirement
that the voltage drop calculations for dc motor operated
valves
must consider four (4) times the one-way distance to the valve
in order to account for the reversal
of the current through the
armature windings required to change
valve direction.
The team
noted,
however, that the voltage drop calculation for many of
the valves did not consider this assumption.
The team
was
informed by- the. licensee that instead of including four times
the length of cable run in the calculation,
the conductors
were
paralleled to reduce
the conductor resistance
in half.
During
this review, the team learned that the parallel conductors,
which were in fact identified in the calculation
by noting
a
cable construction
o'f 9 conductors
versus
the original
5
conductors,
were never installed.
The team was informed that
the reason
the additional conductors
had not been installed in
the
DC'MOV circuits was that the Startup organization
had
performed
a test which was intended to demonstrate
that
sufficient voltage would exist at the valves without the
parallel conductors.
As a result of this test,
the design
modification was voided.
The team found the test results
recorded in PED-S218-E-C640 deficient for the following
reasons:
(a)
Bus voltage
was measured
to be varying between
125 and
135
volts during the test, indicating that other factors were
affecting the recorded voltage measurements.
(b)
The valves did not appear to be under design
load
conditions
when tested.
(c)
Starting currents
were not considered
in a majority of the
valves tested.
The combined starting currents of the
valves could significantly reduce the terminal voltage
available at the valves.
(d)
Test results
recorded
for the valves in question did not
include valve CAC-V-8..
The team observed that the calculation
assumed
a total
allowable drop from battery to load of only 4X (125V x .04 = 5
volts).
This criteria was contained in the calculation
apparently to account for the worst case
voltage degradation
during battery discharge
(105 volts - 5 volts drop = 100 volts
at the loads).
However, neither this calculation,
nor
Calculation
No. 2.07.04,
Revision 3, 7/6/83,
which was to
account for the
1X drop between the battery
and the
MCC,
considered
the voltage drop in the cabling during transient
conditions including motor starting.
This initial total
voltage drop should
be considered
to confirm the adequacy of
the voltage at the valves at the time the valves first start to
stroke.
Based
upon the WNP-2 original battery load profile,
the team estimated
the battery voltage at degraded
conditions
during
a battery discharge
and concluded that the starting
voltage at five of the
125 volt dc motor operated
valves in
Division 1 would drop below the specified
minimum starting
voltage of 100 volts.
The voltage drop from the battery to the
MCC could account for an additional
8X voltage drop under worst
case conditions.
This is an apparent violation of 10 CFR 50,
Appendix B, Criterion
V (50-397/87-19-02).
(2)
The team also noted that
no voltage drop calculations
had been
performed for the safety-related
inverter
dc supply or for the
125 volt switchgear control circuits.
The team estimated,
based
on the original load profile, that the voltage at the
inverters
and certain safety-related
4kV switchgear control
circuits could fall below the manufacturer's
rated
minimum
voltage of 105 volts.
While the team believes that margin
exists
below the published Westinghouse
rated
minimum voltage
of 105 volts (Application Data 32-262,
Type DH-P air circuit
breakers)
for the close coils, the safety-related
inverter
manufacturer's
(Elgar) instruction manual
(Inv 203-101) states
that the inverter will automatically shutdown
when the battery
is discharged
to 105 volts.
It is the teams
understanding
that, in response
to this inspection,
the licensee
has performed preliminary voltage calculations,
based
upon
a new load profile, which will demonstrate
adequate
voltage at
these
components.
This is an open item (50-397/87-19-03).
Motor 0 crated Valve Overload Selection
The team reviewed the overload protection provided for a number of
the service water valves required to support the diesel
generator.
The majority of the associated
motor control centers
were
manufactured
by ITE and
use
3 single phase
protect their motor loads.
The team found that overload heaters
were selected
to trip the valve motors
based
upon Burns
and
Roe
technical
memorandum
T.M.
No.
1129,
dated 8/11/78.
This document
implied that if the overload heaters
were selected
at 140K of motor
full load current, sufficient locked rotor current protection would
result.
No supporting documentation
could be found by the licensee
at the time of the inspection to support this conclusion.
The failure to confirm the assumption that thermal
overload, relays
selected
at 140X of motor full load current would provide adequate
protection for short time duty motor operated
valves
appears
to be
a
violation of 10 CFR 50 Appendix B, Criterion III.
This item remains
unresolved,
pending additional
licensee
evaluation.
(50-397/87-19-04).
The team independently
sized overload protection for these valves
based
upon the valve actuator manufacturer's
recommendation,
obtained
from the licensee,
as presented
in IEEE technical paper
F79669-3,
dated 5/1/79.
This document
recommended that for short
time duty motors
used
on motor operators,
the locked rotor current
time should
be limited to 10 to 15 seconds
in order to protect the
motor windings from thermal
damage.
With the over load heaters
selected
by the licensee at 140K of" full load current,
no running
protection
and insufficient locked rotor protection would result.
The team determined that at locked rotor current,
the heaters
would
require approximately
one minute to actuate.
The team estimated,
based
upon
a review of valves
SW-V-2A, 2B,
4A
and 4B, that overload heaters
six sizes
smaller than presently
installed would provide both running and locked rotor protection
and
still provide at least
700K margin on valve stroke time at motor
full load current.
An overload heater size smaller would still
.
provide 200K margin
on full load current at rated valve stroke time.
Other valves
checked
by the team produced similar results.
In addition to the above,
the team found that most of the valves in
the
RHR system
and
some valves in other systems
appeared
to have the
B phase
overload
heatet
wired for alarm only and not to trip the
breaker.
However, these
heaters,
used for alarm purposes
only, were
also found to be selected
by the
same original
TM 1129 criteria so
that the alarm would not be received prior to motor damage.
In contrast,
the team found that the overloads
provided
on
a
motor control center
(MC4A) included
a three
phase
trip on motor overload
and
a single phase
overload relay with a
smaller heater to alarm on a smaller overload.
However, the
licensee
had elected
not to wire these
alarm relays to take
advantage
of the early alarm feature.
The team
was not able to
confirm the adequacy of these
GE overload relays during the
inspection
because
of time constraints.
En ineerin
and Desi
n Modification
The methods
and instructions for the identification, control,
implementation,
documentation
and closeout of plant modifications is
addressed
in Administrative Procedure
No. 1.4. 1, "Plant
Modifications," Revision 6, of April 17,
1987.
This procedure
describes activities to ensure that plant modifications properly
implement plant design
changes.
The program, in part, requires
the
proposed plant modification to be described
in a Design
Change
Package
(DCP) which, when approved,
is implemented
by a Material
Work Request resulting from initiation of a Plant Modification
Record
(PMR).
The
PMR, therefore,
is the controlling document
because it identifies the plant modification to be performed,
including the
MWRs; it provides authorization for implementation;
and requires verification that the installation is complete
and the
system operable.
Review of the plant modification procedure
by the
team indicated that the program does not contain provisions
addressing partial implementation of design modifications.
The
concern
expressed
by the team was that if, due to unforeseen
circumstances,
a modification is partially implemented,
there are
no
procedures
to describe
what actions to take to ensure that the
partial implementation is acceptable.
Discussions with licensee
management
personnel
involved with outage
scheduling
and
imp 1 ementati on of wor k authori zed by PMRs concurred
with thi s
observation.
Their position was essentially that their procedures
do not allow partial implementation of design
changes.
The team reviewed the records of DCPs processed
over the past
several
years looking for design modifications involving more than
one
DCP or multi-disciplined groups.
The team also interviewed
licensee
engineering
personnel
regarding implementation of design
changes.
This effort revealed
a discrepancy
regarding
a plant
design modification covered
by
DCP 84-1096-OA and
OB and approved
for implementation in September
1984.
This modification installed
two new safety-related
auxiliary steam isolation valves
(OA) and
missile shielding for these
valves
(OB).
Each of the design
packages
(OA and
OB) required that both
be completed in order
to consider either
DCP to be complete.
Both
PMRs written to
implement the
DCPs were signed off as complete
and design drawings
were revised in July 1985 to show the additional valves
and
shielding.
However,
when the team reviewed the completed
installations, it was observed that the shielding
was not installed.
Subsequent
review of the modification package
revealed that the
field work was never specified
on a
MMR and therefore
not
implemented.
The licensee initiated
NCR No. 287-297 to document
this problem.
The team reviewed the modification program and
concluded that had the responsible
Technical
Engineers
followed
their procedure,
this problem would not have occurred.
Specifically,
the procedure
in effect in June
1985 was Revision
2 of Procedure
No.
1. 4. 1.
Section
1. 4. 1. 6 required
the Plant System Engineer to
initiate the
HWRs to implement the change.
The
MMRs for the missile
shielding were not prepared.
Attachment 1, the
PMR form, Block 18
required the signature
and date of the Plant System
Engineer
indicating that the installation of the modification was complete.
Although Block 18 was signed off as complete,
the work was
never'nitiated.
These
events
led
up to the Shift Manager reviewing
a
supposedly
complete
PMR package
and signing off that the system is
considered
thus returning the system to service.
Failure to install the missile shield
as required
by the Plant
Modifications procedure is an apparent violation of 10 CFR 50
Appendix 8, Criterion V (50-397/87-19-05).
The inspectors'valuation
into the probable root cause of this
problem identified two weaknesses
in the current modification
program
as addressed
in Procedure
1.4. 1.
First, there
are
no
provisions to assure
the
MMRs are initiated covering the entire
scope of a modification.
Second,
there are
no specific requirements
assuring that the entire
scope of a modification was actually
implemented.
The inspector discussed this with the Plant Technical
staff which resulted in the licensee initiating a Procedure
-Deviation to revise
Procedure
1.4. 1- to include these provisions.
The
inspector
reviewed the proposed revision and
recommended
that the
licensee
consider including a joint verification as-built walkdown
of completed
DCPs by the Plant Technical
and Design Engineering
groups.
Although no commitment was
made
on this matter,
during the
exit meeting,
the licensee
did respond favorably to the idea.
Other examples of
PMR signoffs indicating completion of a
modification when, in fact, the entire work was not completed are:
(a)
NCR No.
287-294 written on August 14, 1987, identifying that two
pipe supports,
DSA-4275-12
and 13, to be installed during the April
1986 outage,
were not installed.
As a result, this system
was
declared
operable without justification that failure would not
occur.
However, justification was obtained
from the design
engineering
group on August 14,
1987, stating that no actual fai lure
of the line would occur
had
a seismic event occurred;
(b) standby
service water valves
SWS-PCV-38A and
38B were modified to eliminate
automatic pressure
control
and valve position indication (VPI) in
the control
room,
and (c) condensate
valves
COND-V-9A and
9B were
also modified to eliminate VPI in the control
room.
In examples
(b)
and (c), instrumentation
and controls in the control
room did not
provide indication,
as required
on the
MWRs, that their related
systems
have
been retired.
How the licensee
plans
on addressing
the
issue of partial implementation
and partial justification for
declaring
an effective system operable is an open item.
(50-397/87-19-06).
Fire Protection
S stems for Diesel Generators
WNP-2 is equipped with three diesel
generators,
Division 1 and
Division 2 units which supply onsite
emergency
AC power for the two
basic trains of ECCS equipment,
and the Division 3 unit which
supplies onsite
emergency
AC power for the
pump only.
They are
located in separate
rooms of one building, these
rooms having 3-hour
fire rated walls and doors.
Each
room has
two access
points,
one to
the south opening to the outside
and another to the north opening
into a
common hallway.
The doors
open outward away from the room.
The north doors are equipped with a curb approximately
3 1/4 inches
high; the south doors
have
no curb.
Fire protection is provided in the
rooms by a pre-action sprinkler
system with fusible sprinkler heads.
Drainage for the
rooms is
through several floor drains in each
room connecting to a
common six
inch line in the Division 1 and
2 rooms
and
a
common four inch line
in the Division 3 room.
These drains are capable of carrying only a
limited flow from the sprinklers.
The fuel oil transfer
pumps for all three divisions are located in
three separate
rooms adjacent to the Division 3,
HPCS diesel
generator
room.
The only entrances
to these
rooms are from the
diesel
generator
room.
They are also protected
by pre-action
sprinklers.
No drains are provided for these
rooms.
The design of the diesel
generators
and the associated
systems
and
components
is governed
by several
codes,
standards,
and regulatory
documents,
which specifically address
the fire protection
requirements
and the separation
and redundancy
requirements.
These
include 10 CFR 50, Appendix A; and
NRC Branch Technical
Position
APCSB 9.5-1.
In response
to these
requirements,
the licensee
made the following
commitments in the
FSAR:
FSAR; Appendix F, Fire Protection Evaluation,
Amendment
No.
37
dated August 1986,
response
to Branch Technical Position
APCSB
9.5-1,
NRC Position Dl(a), states
"All Appendix
R
safety-related
systems
have
been separated
from unacceptable
fire hazards
through remote separation
or fire barriers to the
extent that is possible."
FSAR response
to Po'sition Dl(i) states
"Actuation of the fixed
fire protection
system would not adversely affect any
safety-related
equipment
by flooding.
FSAR response
to Position D2(a) states
"Safety-related
systems
have
been isolated or separated
from combustible materials to
the extent possible."
FSAR, Section 8.3. 1. 1.8 - Standby
AC Power System,
Amendment
No.
34 dated January
1984, states
"Design provisions ensure
that flooding in one diesel
generator
room does not jeopardize
the operation of the other diesel
generators."
FSAR, Section 9.5.4.2,
Amendment
No.
36 dated
December
1985,
states
"Although a single failure may result in loss of fuel to
one diesel
generator,
the other diesel
generator
can provide
sufficient capacity for emergency conditions,
including safe
shutdown of the reactor,
coincident with loss of offsite
power."
Several
inadequacies
were observed
by the team in the coordination
of the design of the fire protection
systems
and the floor drainage
systems
of the diesel
generator
rooms.
These
problems
are discussed
in more detail
as follows:
Failure of the Fuel Transfer
Pum
s
As discussed
above,
the fuel oil transfer
pump rooms for all
three
emergency diesel
generator
units are located adjacent to
the Division 3 diesel
generator
room with their only entrances
being from this room.
The fuel oil transfer
pumps are
electrically driven and are located in pits in the
rooms just
above the ends of the main fuel storage
tanks.
These pits have
no curbs
around their upper edges
and
no drains.
The rooms
have
no floor drains.
Therefore,
any fluid entering the
rooms
will fill the pits and potentially drown out the
pump motors.
At the door to each
room is
a curb approximately
7 5/8" high
separating it from the Division 3 diesel
generator
room.
The primary accident
scenario of concern is the single failure
of a pump seal or a flexible fuel line on the discharge
side of
the fuel oil pump on the Division 3 diesel
generator
followed
by a fire in the room.
The worst case of this scenario
would
be when
a large
amount of oil would be leaked onto the floor
10
and would spread
over a large area before being ignited by some
heat source
on the engine.
In this case
the initial fire could
be quite large,
and
many of the sprinkler heads
in the
room
could be fused,
causing
a high flow rate of water into the
room.
If the rate of flow into the
room exceeded
the drainage
rate,
the level would eventually rise to the point where it
would spill over the curbs of the Division 1 and Division 2
transfer
pump rooms, at which time both pumps could be
incapacitated.
Within as little as
5 1/2 hours after this,
both Division 1 and Division 2 diesel generators'ay
tanks
would be empty, their engines
would stop,
and all onsite
power could potentially be lost.
This would be particularly
significant if it occurred during a loss of offsite power
(loop).
For less
severe fires, the number of sprinkler heads
fused
would be less; therefore,
the time until spillover would occur
would be longer.
An exacerbating
condition is the licensee's
use of absorbant
pads
around the diesel
generator
units to absorb oil drips.
These
pads
are not secured,
and additional
pads,
wiping rags,
and other extraneous
material
are loosely stored in the rooms.
These would tend to be washed to the drains
and under the south
door early in the event, potentially blocking all drainage.
The licensee
was asked if there
was any analysis
which showed
that actuation of the fire protection would not flood the
room.
None was produced,
although
a quick, on-the-spot,
unverified
calculation
done by the licensee
showed that spillover into the
fuel oil transfer
pump rooms would occur at about
17 minutes
after fire initiation assuming
no drainage
from the room.
The licensee
also could produce
no evidence that the drains
had
ever been verified open.
This together with the potential for
plugging provided by the loose material
observed
in the
rooms
strengthens
the assumption
used in the calculation that
no
drainage
would occur.
The licensee
presented
a position that the flooding would not
likely occur because
the site fire brigade would arrive at the
scene
minutes after the fire started
and they would shut off
the sprinklers and/or
open
one or both of the doors to the
Division 3 diesel
generator
room, releasing
the water.
The
team did not consider this to necessarily
be
a valid response
for several
reasons:
(1)
The licensee
was apparently
not
aware of this threat prior to this inspection,
and there is no
plant procedure
which gives any special
instructions
on how to
deal with water in this room.
.There is therefore,
no reason to
expect that the fire brigade would take any deliberate action
in time to prevent flooding to the critical stage.
(2)
An
argument
can
be made that, without specific direction to the
contrary,
a reasonable
response
of the fire brigade might be to
leave the doors shut and allow the sprinklers to perform their
function.
This would be particularly true if it were suspected
that flooding did exist in the room, since opening of the doors
might risk allowing burning oil to move to other areas
not
previously threatened.
And finally (3), even if the fire
brigade desires
to open the doors, there is no reason to expect
that they necessarily
could in a timely manner.
Flooding
pressure
against
the latches
may prevent their being opened
normally. Additionally, oil spreading
under the doors could
also
be burning,
impeding timely access.
With the scenario
described
above,
as
a result of a single
credible failure, all three
sources
of onsite
AC electrical
power could potentially be lost.
This item remains
unresolved,
pending additional evaluation
by the licensee
and
NRR.
(50-397/87-19-07).
Fire Threat to Both Safe
Shutdown Divisions
In the
common hallway outside the diesel
generator
rooms are
raceways for all three divisions of emergency
power with only
Division 2 Safe
Shutdown cables
being fire protected
by
sprinklers
and by being wrapped with a one-hour fire barrier
material.
Division 2 is the designated
Safe
Shutdown Division
for the plant.
In all three
rooms the fire accident scenario
described
in (1)
above also
has the potential to spread
the hazard outside the
3-hour barrier of the
room where the fire has occurred
and
threaten
the other
two unprotected
divisions of LOCA required
cables
in the
common hallway.
The mechanism for this threat
is,
as described
above,
flooding of the
rooms
due to actuation
of the sprinkler system.
This flooding would cause spillover
at the curbs at the north doors,
and the liquid would flow
under the doors
and into the
common hallway.
Since the oil
would tend to float on top of the water, it would be the first
liquid to spill over,
and therefore, this transient combustible
would be in the hallway where it would be
a threat to all three
divisions of cables.
If the fire scenario
were to occur in the
Division 2 diesel
generator
room at any time including normal
operation,
the ability of the plant to achieve
safe
shutdown
could be compromised.
Fire in Division 1 or Division 2 Fuel Oil Transfer
Pum
Rooms
The diysel fuel transfer
pump
rooms for the Division 1,
Division 2,
and Division 3 emergency
diesel
generators
are
located adjacent to the Division 3 diesel
generator
room with
their only doors opening
from this room.
The fuel transfer
pumps are located in pits in the rooms,
and fire protection is
provided by sprinklers.
There are
no floor drains or other
drains in the rooms.
At the entrance
to each
room is a sill
approximately eight inches high.
12
The event of concern
here is
a fuel oil leak in either the
Division 1 or Division 2 fuel transfer pit area
being ignited
by an electrical
spark.
In this case,
the sprinklers in the
room would be activated.
Such
a fire could occur at any time a
transfer
pump is running,
such
as during an, engine test,
when
an operator is topping off an engine
day tank in preparation
for filling the main storage tank, or during engine
response
to
an event.
With activation of the sprinkler system,
the pit
will fill with water,
and after
some finite time, if the
sprinklers
are not secured
by the fire brigade,
the
room will
fill to the point that the liquid will spill over the door sill
and into the Division 3 diesel
generator
room.
Since oil would
be part of the fluid spilling over, the Division 3 equipment
could
now be threatened
by the uncontrolled flammable liquid on
the floor.
In this fire scenario,
one division of emergency
power would be
disabled
by the initial fire, and
a second division, Division 3
could be threatened
as
a result of this single failure.
Although this particular scenario
does
not prevent achieving
safe
shutdown
from normal plant operations
since either
Division 1 or Division 2 will not be affected, it does
degrade
the condition of the plant.
Items (2) and (3) above
remain
unresolved,
pending additional
review by the licensee
and
(50-397/87-19-08).
The licensee
has
agreed to take several
corrective actions to
alleviate the problems
caused
by fires in the diesel
generator
rooms.
These include:
Installation of automatic acting scupper flappers
on the south
doors of the
rooms to allow drainage to the outside.
Securing or removing all oil soak
up pads
and other articles
capable of plugging the drains in the rooms.
Verifying the drains to be open
and clearing those not found
open.
Training of the fire brigades
on the special
hazards
to plant
safety associated
with fires in these
r corns.
No remedial action
has
been
suggested
by the licensee with regard to
the hazards
associated
with fire in the fuel transfer
pump rooms.
f.
Air Filtration for Emer enc
Diesel Generator
Units
10 CFR 50, Appendix A, Criterion 2, Design Basis for Protection
Against Natural
Phenomenon
requires. that systems
important to safety
shall
be designed
to withstand the effects of natural
phenomenon.
One natural
phenomenon for which the diesel
generator
and their
support
systems
as well as other systems
in the plant must be
designed
is particulate matter in the air.
Air in large volumes is
required for operation of the diesels for both combustion
and
13
ventilation of the spaces,
and the particulate matter must be
removed to assure reliable operation of the systems.
The
concentration of matter which must be dealt with ranges
from
relatively minute during normal conditions, to dust storms which are
common in the area,
to volcanic ash fallout which is rare but
credible in view of the Mt. St.
Helens eruption which generated
heavy ash fall in close proximity to the plant.
The designs
to deal with these conditions consist of oil bath
filters for the combustion air for each diesel
generator unit for
normal operation
and design basis
dust storms;
dry disposable
paper
filters for the ventilation systems for normal operation
and design
basis
dust storms;
and dry disposable
paper filters for the design
.
basis
ash fall event,
which are temporarily installed
upstream of
and provide
common prefilter banks for both the combustion air
and
ventilation filters for the Division 1 and Division 2 diesel
generators.
Abnormal Conditions Procedure
4. 12.4.5,
Design Basis
Ash Fallout,
requires that these
temporary filters be installed
and the plant
shut
down upon being notified of an eminent
ash fall event.
No
prefi lter banks are required to be installed for the
HPCS diesel
generator.
The team found numerous
discrepancies
and inadequacies
with the
design,
and examples of non-integration of the operational
or
maintenance
requirements
for the diesel
generator
systems with the
design requirements.
The following paragraphs
describe
the
conditions
found and the remedial
actions
taken or planned by the
licensee:
(1)
No Anal sis of Oil Bath Combustion Air Filters for Dust Storm
The licensee
had
no analysis
which documented
the capability of
the Division 1 and Division 2 oil bath combustion air filters
to function for the design basis
dust storm.
An analysis
was
performed during the inspection which did show their
capability, but it had not been verified or approved at the
close of the inspection.
(2)
No Anal sis of Tem orar
Filters for Ash Fall
The licensee
had
no analysis
which documented
the adequacy of
the temporary filters for the design basis
ash fall event.
An
analysis
was performed during the inspection which indicated
the filters could be fully loaded at 19 minutes into the event
if the systems
were operated
per the existing abnormal
conditions procedure.
For this event, with the plant shutdown,
at least
one diesel
generator
must be operational
per the
Technical Specifications.
Since,'er
the licensee,
the
changeout
time for the filters would be three hours,
the
Technical Specifications
requirement
cannot
be met and the
design and/or procedure is inadequate.
Additional analysis
was performed which showed that if the
abnormal
conditions procedure
were changed to require shut off
of the ventilation air drawn through these filters, the time
until changeout
was required would be increased
to
approximately 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
However, the potential
adverse
effects of this mode of operation,
such
as infiltration of ash
into the rooms,
had not been fully analyzed.
No Anal sis of Oil Bath Combustion Air Filters for Ash Fall
The licensee
had
no analysis
which documented
the ability of
the Division 1 and Division.2 oil bath combustion air filters
to function for the design basis
ash fall event with the
temporary prefi lters in place.
This analysis
was performed
during the inspection
showing their adequacy,
but it .was not
verified or approved at the close of the inspection.
Inade uate
Abnormal
0 eratin
Procedure
The Design Basis
Ash Fallout Procedure,
4. 12.4.5,
requires that
if the diesel
generators
are not required for operations (it is
not clear what plant condition this refers to), the operator
is'o
manually adjust
two ventilation
in each diesel
generator
room "so that approximately
2000
CFM of outside air
is drawn through the filter bank to insure pressurization
of
the room."
However,
no provisions are
made for the operator to
accomplish this task;
the damper positions
are not pre-marked
and there is
no instrumentation
which would facilitate this
action.
As written, the filters will load
up faster than they
can
be changed
and ventilation air flow cannot
be adjusted
as
required
by procedure.
No Documentation of Filter Structural
Ade uac
The mountings for the temporary filters are permanently
installed grid type frameworks.
They are installed in the
reverse direction from the normal position
recommended
by the
manufacturer.
That is, the flow induced
dp tends to unseat
rather than seat the filters, potentially allowing some blowby
of the ash,
and the 24 inch by 24 inch cardboard filter frames
are supported at four points
by the attachment clips rather
than uniformly around the filter periphery.
The licensee
had
no documentation that the filters are structurally adequate
with this configuration to sustain
the differential pressure
they would experience
at loaded conditions.
The licensee
contacted
the vendor
and received verbal
assurance
that the
filters were structurally adequate
and
a commitment by the
vendor to provide written documentation to that effect.
No Testin
of Tem orar
Filter Arran ement
The licensee
had performed
no testing of the diesel
generator
systems with the ash fall temporary filters installed or trial
fittings of the filters.
Such testing would have the potential
15
to reveal difficulties with installation,
time required to
perform installation,
engine performance
problems associated
with higher inlet differential pressure,
HVAC adjustments
required for higher inlet differential pressure,
etc.
Other Ash Fal 1 Filters
Abnormal Conditions Procedure
4.12.4.5,
Design Basis
Ash
Fallout requires that temporary filters such
as at the diesel
generator air intakes
be installed at 19 other locations in the
plant.
In further discussion with the licensee, it was learned
that,
as with the diesel
generator filters, no analyses
have
been performed for the design basis
ash fall event or the
design basis
dust storm for these other locations.
(either
have there
been
any preoperational
tests
performed with the
filters in place or any trial fitups.
Considering that at
these other locations,
the filters serve purely ventilation
functions,
which at the diesel
generator
location produced
unacceptable filter changeout
times, it is expected that the
same results
may be found at these
other locations.
The licensee
was asked
how many of the temporary filters of the
size required
by the diesel
generator
were maintained onsite.
The reply was
666.
Per the procedure,
404 are required for the
initial loading of diesel
generator
locations plus all the
other locations which, require this size filter.
Considering
the time to changeout that was calculated for the diesel
generator
location and the 20-hour duration of the event, it is
highly unlikely that when the changeouts
required for the other
locations
are finally calculated,
there are
enough filters to
last the duration of the event.
Another consideration
which may require the licensee's
attention is the manpower to effect the required.changeouts.
Considering what the probable
changout rate will be for all of
the filters and the time required to effect a changeout of any
one of them, it would appear to be unreasonable
to expect that
they all could be changed
out as fast as they would load
up
with the manpower resources
that would likely be available.
Additionally, with a design basis
ash fallout event occurring,
these
resources
could not be augmented
by outside resources.
Overall, the licensee's
entire program for handling the design
basis
ash fall event
was found to be poor.
The design
does not
appear
to be well thought out.
The operating procedure is
unrealistic,
untested
by walkthroughs,
and apparently
unable to
be performed in certain areas.
No preoperational
testing
was
performed
on the system,
and insufficient resources
appears
to
be available onsite to carry out the design intent of the
system.
This is considered
by the team to be
a major
example
of lack of coordination
between
the various facets of the
licensee
s organization-Engineering,
Operations,
Maintenance,
and guality Assurance.
Items (1) through (7) above
remain
16
unresolved
pending additional evaluation
by the licensee
and
NRR (50-397/87-19-09).
Overdue Maintenance
on Permanent Filters
Cleaning of the permanently installed oil bath combustion air
filters is currently controlled by the plant's
Scheduled
Maintenance
System
(SMS),
a computerized
scheduling
and
tracking system.
The filters are currently on
a 52-week
cleaning cycle.
At the time of the inspection,
the filter for
the Division 3 engines
was past
due for its required cleaning.
When asked
why the maintenance
had been deferred,
the licensee
responded
that
a plant outage
was required to perform this
work.
The team considers this to be questionable
for two
reasons:
(1) the filters can apparently
be cleaned
when the
plant is in operation
by taking one diesel at
a time out of
service while the plant is in an
LCO action statement,
and (2)
an outage
has occurred since the maintenance
was due.
In further investigation of this situation,
the licensee
was
asked
how it is determined, i.e.,
by what criteria, that
scheduled
maintenance
on safety-related
equipment is acceptable
to, be defer red.
The licensee
replied that the decision is made
at the discretion of the maintenance
supervisor.
The licensee
was asked
how such deferred
maintenance
is tracked.
The reply
was,
through the
SMS system.
The licensee
was then asked,
what
ensures
that maintenance. is not deferred for an inordinate
period of time.
The reply was that it is deferred at the
judgment of the maintenance
planner/supervisor.
It was
acknowledged that there are
no proceduralized
safeguards
to
ensure that deferred
maintenance
on safety-related
equipment
receives
adequate
formal evaluation
and control of
rescheduling.
The team feels that this is
a weakness
in the
plant's
maintenance
program which has the potential to
negatively affect plant safety.
This is an open item
(50-397/87-19-10).
Nitro en Tank Threat
To Diesel Generators
During normal operation of the plant, the primary containment
is inerted with gaseous
nitrogen to prevent
an explosion of
hydrogen which may result from an
LOCA.
This nitrogen is
supplied
from an approximately 11,000 gallon liquid nitrogen
storage
tank located at the southeast
corner of the diesel
generator building.
This is a nonsafety-related
system
and was
not originally designed to withstand the effects of natural
phenomenal
such
as earthquake
or tornado.
Were the tank to be
ruptured
due to being toppled over by an earthquake
or tornado
or due to being struck by a tornado
gener ated missile, its
contents
could be spilled
on the ground in close proximity to
the diesel
generator air intakes.
Since liquid nitrogen must
be kept at cryogenic temperatures
to remain liquid, it would
very quickly vaporize, potentially starving the diesel
generator
intakes of oxygen.
It is also of some concern what
17
negative effects the sudden dramatic
change in environmental
temperature
might have
on the engines.
(10)
This event scenario
could occur coincident with an
LOCA or
during normal operation
when the diesel
generators
may
automatically start in response
which would also
be likely to occur as
a result of an
or tornado.
Although the licensee
could produce
no analyses
to refute this
accident scenario,
analyses
were initiated during the
inspection.
This is an open item (50-397/87-19-11).
Diesel Generator
Fuel
Su
1
Technical Specification 3.8. 1. 1.6.2 requires that the Division
1 and Division 2 diesel
generators
have
minimum of 53,000
gallons of fuel in their respective
main fuel oil storage
tanks
at all times the plant is in mode 1,
2 or 3.
Per
FSAR Section
9.5.4.3,
the minimum storage
capacity is sufficient for 7 days.
This is consistent with the requirements
of Regulatory
Guide
1. 137, which requires that fuel oil storage
capacity
be
calculated
based
on assuming
the diesel
generator
operates
continuously for 7 days at its rated capacity or based
on the
time-dependent
post
LOCA load.
The capacity at WNP-2 was apparently
based
on
7 days operation
at rated capability as per Burns
and
Roe calculation
number
5.43.02.
This calculation is based
on the actual
fuel
consumption rates at rated
load that were observed
during the
engines'uel
consumption tests.
The number
one engine rate
was
5. 10 gallons/minute,
or 51,408 gallons for 7 days.
The
number two engine rate
was 5.4039 gallons/minute
or 54,437
gallons for 7 days.
Therefore,
the Technical Specification
minimum storage
requirement for the number
2 engine is not
consistent with the regulatory guide or the
FSAR statement.
This inconsistency
is not a violation of requirements,
per se,
since (1) the licensee is not committed to Regulatory
Guide
1. 137 and (2) if the licensee
were to calculate
the fuel
requirement
based
on time-dependent
load profile, it would
almost certainly be less than 53,000 gallons.
However, it is
an inconsistency
which has the potential to confuse the
operator or engineer
using this information.
An additional factor which may generate
operator confusion is
the inconsistency
in units of measure
used in determining the
actual
amounts of fuel in the main storage
tanks.
The
Technical Specifications
require 53,000 gallons.
procedures
4.800.C1-9. 1 and 4.800.C5-9. 1 for the tank low level
alarms indicate the set points at 81K (this is consistent with
the local gage)
~
The sounding devices at the tanks
(a steel
tape
and
a rod) are graduated
in feet and inches.
There are
no
correlations
in the Technical Specifications
or the annunciator
18
procedures
between
any of these.
Additionally, the 81K value
in the annunciator
procedure
is subject to misinterpretation,
to wit, 81K of tank volume,
81K of tank level, or 83% of the
instrument
range.
This observation
would call into question
the consistency
of values with which the operator
must deal
which are contained in other operating procedures.
Subsequent
to completion of the inspection,
the licensee
determined that misinterpretation of tank measurement
parameters
had resulted in errors in the licensee
procedures
for determining diesel
generator
tank fuel oil capacities.
As
a result,
the licensee
determined that the minimum fuel oil
limits specified in plant Technical Specifications
had not been
maintained
on several
instances.
The specific discrepancies
are described
in licensee
LER 87-026.
This is an apparent
violation of Technical Specification
requirements
(50-397/87-19-12).
(11) Diesel
Fuel Oil Loadin
The inspector walked through the method
used to fill the diesel
fuel oil storage
tanks with emphasis
on methods of preventing
inadvertent contamination (introduction of foreign material).
The review included procedures
PPM 7.4.8. 1. 1.2.3,
"Diesel
Generator
Fuel Test,"
and
PPM 12.5.21,
"Diesel Fuel."
These
procedures
specified requirements
for sampling the
storage
tank periodically and fuel shipments prior to
transferring the contents to the storage
tanks.
The parameters
to be analyzed
and their specifications
are listed in the
procedure.
The method of sampling is not specified in the
procedure
but standard practice is to use
a sampling
bomb which
opens at the bottom of the tank.
There is no procedure
which
specifies
the method of connecting
and transferring the diesel
fuel shipment to the storage
tanks
and there is
no guality
Assurance
involvement.
The inspector also noted that the locks
on the fuel oil fill
connections
are ineffective because
the screwed fitting just
below the lock can
be disconnected
with the pipe wrench stored
at the station.
This fitting is, according to the operators
present,
the connection
used to connect the shipment to the
fill line.
This is an open item (50-397/87-19-13).
Instrument Set oint Calculations'nd
Methodolo
The team reviewed the setpoint calculation methodology
used at WNP-2
for safety-related
instruments.
The methodology
used to determine
instrument
loop inaccuracy is required by NRC Regulatory Guides
1. 105 and 1.89, to take into account
any inaccuracies
resulting from
normal plant operation
as well as those inaccuracies
resulting
from
and radiation exposure effects.
The General
19
Electric
BWR setpoint methodology,
as
shown in specification
22A5261
and licensing topical report NEDC-31336, considered
only normal
plant conditions
and did not take into account the effect of harsh
environment conditions.
Burns
and
Roe setpoint calculations
also
did not take into account
harsh
environment
or seismic effects
on
instrument accuracy.
WNP-2 environmental qualification evaluations
did not apparently
combine
normal operation
and accident environment
effects.
Pressure
switches
LPCS-PS-1
and -9, used for the automatic
depr essurization
system
AC inter lock permissive,
were selected for
detailed
review.
These
switches
have
a Technical Specification
inaccuracy limit of 8 percent of full scale.
The normal operation
inaccuracy calculated
by General Electric was 4 percent of full
scale,
and the environmental effect inaccuracy calculated
by WPPSS
was estimated to be 3.44 percent of full scale.
These results
had
not been
combined,
nor had seismic effects
been evaluated.
Algebraic
summing of these results for these particular
instruments
appears
to
leave very little margin with respect to Technical Specification
limits.
This item remains
unresolved,
pending additional evaluation
by the
licensee
of the combined effects of normal operation with
environmental
and seismic considerations
on setpoint methodology
(50-397/87-19-14).
h
Desi
n Verification Criteria in Procedure
EI 2.15 Revision 4
ANSI N45.2.11 requires that safety-related
calculations
be design
verified to assure
design
adequacy.
In Revision
4 of WNP-2
procedure
EI 2. 15, the criteria used the phrase "significant affect"
to determine
whether
design verification was required or not;
however,
no definition was provided for "significant" to provide
guidance for implementation
by the engineer.
The team reviewed
a
number of WNP-2 safety-related
and nonsafety-related
calculations
and found that each
had
been verified.
During the inspection,
issued
Revision
5 of this procedure
which eliminated the phrase
"significant affect" from the design verification criteria.
This
action was satisfactory to resolve this concern.
Incor rect Desi
n Documents
Several
examples
were discovered
where the actual physical
configuration of plant structures,
systems,
or components
were not
in accordance
with the most current design
documents.
Examples:
(1)
Drawings M852, Revision 12,
shows
a floor drain located in the
HPCS Diesel
Fuel Oil Day Tank
Room.
This drain does not exist
in the plant.
(2)
Drawing M512, Sheet
1, Revision 3,
shows the piping inboard of
the Fill Isolation Valve on Diesel Oil Storage
Tank ¹2 as
20
Seismic Category II and the piping outboard
as Seismic Category
I.
The reverse is actually the case.
(3)
Drawing M512, Sheets
2 and 3, Revision 1,
shows valves
DO-RV-4A1 and DO-RV-4Bl respectively
as relief, valves.
In
fact, they are spring loaded check valves.
(4)
Pressure
switches
DLO-PS-4A1, 4A2, 4B1 and 4B2 shown
on
drawings
M512, Sheet
2, Revision 1,
and M512, Sheet
3, Revision
1, respectively,
are labeled
as
L.O. circulating pump low
pressure
alarms.
They cannot perform this function since they
are isolated
from the circulating pump discharge
by a check
valve.
Therefore,
the labeling is incorrect.
Additionally,
these
pressure
switches
have
been deactivated,
and this is not
noted
on the drawings.
(5)
DSA-V-37A1 and 37A2,
shown
on drawing N512,
Sheet
2, Revision 1;
and DSA-V-37B1 and
37B2 shown
on drawing N512,
Sheet
3, Revision 1, are
shown backwards
from the required
direction of flow.
The actual installations of the valves
appear
correct.
(6)
DO-V-53Al and DO-V-53A2 and associated
lines,
indicated
on drawing M512, Sheet
2, Revision 2, are not
installed.
(7)
Several
Restricting Orifices R0-3A-l, R0-4A-l, R0-3A-2,
and
RO-4A-2 and associated
lines, indicated
on drawing N512,
Sheet
2, Revision 2, are not installed.
Restricting Orifices R0-3B1,
R0-4B-1,
R0-3B-2,
and
RO-4B-2 and associated
lines, indicated
on drawing M512, Sheet
3, Revision 2, are not installed.
The above
examples
note
a lack of design control
and attention to
detail in that the licensee
has failed to correct or keep current
diesel
generator
flow diagram
M512. If the basic design
documents
for the plant do not accurately reflect the actual plant
configuration,
then they cannot
be relied upon by operations
and
engineering
personnel
in the performance of their respective
functions, or if they are relied upon,
can foster errors in plant
operations
or subsequent
engineering.
This item remains
unresolved,
pending additional
licensee
evaluation of the failure of design
documents
to accurately reflect actual plant configuration.
(50-397/87-19-15).
j.
Procedural
Control Over Use of ADS Inhibit Switch
For
FSAR Chapter
15 design basis
events,
the operator
has the
capability to prevent the opening of the
ADS valves
by pressing
a
timer reset pushbutton
in the control
room at 90 to 105 second
intervals.
A two position inhibit switch was
added to the control
room panel
by DCP-85-0073-OA for the purpose of preventing
operation for the anticipated transient without scram
(ATWS) event.
For this unlikely event where failure of the control
rods to insert
into the reactor core is postulated,
the operator is required to
21
inhibit ADS actuation in order to prevent dilution of the sodium
pentaborate
solution injected into the reactor core by the standby
liquid control system.
WNP-2 procedure
5. 1. 1,
"RPV Level Control," was modified in
mid-1985, but placed
no constraints
on the
use of the two position
ADS inhibit switch.
The
ADS inhibit switch,
when activated,
prevents
ADS operation which may be required for small break
events,
and reduces
the availability and reliability of the
safety function.
The WNP-2 procedure
should
have designated
use of
the timer reset pushbutton for design basis
events
and constrained
any use of the
ADS inhibit switch to only the
ATWS event.
Potential
use of the
ADS inhibit switch, in lieu of the timer
pushbutton
switch, is safety significant in that it reduces
the
availability and reliability of the
ADS toward performing its
safety function.
This item remains
unresolved,
pending additional
licensee
evaluation of requirements
for constraints
on use of the
ADS inhibit switch (50-397/87-19-16).
k.
ADS Backu
Nitro en
Su
1
Discre ancies
Several
discrepancies
were noted by the team with the safety-related
backup nitrogen supply system for the automatic depressurization
valves.
This system is required to provide
a 30-day supply of
nitrogen to operate
the
ADS valves in the event of failure of the
nonsafety-related
normal nitrogen supply.
It is also designed
to
provide the ability to replenish the backup supply from a remote
location that is accessible
post-LOCA.
(1)
Bottle
Ca acit
Not Per
FSAR, Section 9.3. 1.2.2, states that the
bottles
have sufficient capacity to provide
a 30-day supply
using conservative
leakage
estimates
and considering
48 cycles
of the
ADS valves.
WPPSS calculation 5.46.05; Revision 1, dated August 28, 1984,
shows that with a 30-day supply in the bottles,
only 18
valve cycles
can
be performed.
The source of this error was determined to be
a Technical
Specification
change that was
made early in the plant life to
reduce the minimum required
backup bottle pressure
from 2490
psig to 2200 psig.
No attendant
change
was
made in the
FSAR.
The design basis for the original 48 cycle. requirement
could
not be produced
by the licensee.
However,
an argument
was
made
that considering the worst case
long-term function the
valves
must perform, i.e., provide an alternate
shutdown
cooling section of flowpath, the 18 cycles would be adequate.
This argument will be presented
in support of the
FSAR change
the licensee
intends to make.
22
It should also
be noted that the
number
of cycles addressed
in
the
FSAR is the number of individual
ADS valve openings
rather
the number of times all of the valves
can
be cycled.
The
current
FSAR wording is not clear
on this point and can easily
be misinterpreted.
This item remains
unresolved,
pending
additional licensee
evaluation (50-397/87-19-17).
Time Avai 1 abl e for Bottle Chan cput
The backup nitrogen system for the
ADS valves
has
two divisions
with each division having two sources
of nitrogen.
The primary
.
source is
a bank of bottles containing the 30-day supply and
located in the reactor building.
The secondary
source is a
station located in the diesel
generator building hallway where
one bottle for each division is located
and other bottles
can
be connected.
This station
can
be manually placed into service
whenever the primary source is exhausted.
Its location allows
operation
when the reactor building may be inaccessible
post-LOCA.
Warning that the primary source pressure
is approaching
the
critically low stage is provided by a low header
pressure
alarm.
Burns and
Roe calculation
number 5.46.05,
Revision 1,
dated
September
3, 1982,
was generated
to determine
the time
available
from receipt of the alarm until the
ADS valves would
begin to close
and therefore the time available to valve in the
secondary bottles.
It addressed
the situations
where the
valves would require
one cycle open for each valve after the
alarm and where the valves would only require being held open.
The results
were
54 and
57 minutes for the
A and
B divisions
respectively for the
one cycle scenario
and 3.72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />
and 3.97
hours for,the held open scenario.
In generating this calculation,
Burns
and
Roe
used
two
apparently incorrect non-conservative
design inputs.
A Drywell
temperature
of 200
F was
used whereas for the small break
for which this system is required,
the temperature
given by
FSAR is 340
F.
The second error was the
use of 75 psid as the
minimum differential pressure
required to operate
the
ADS valve
operation piston.
The vendor manual for the valves
(Crosby
manual
VPF6115-18 (1) states
the minimum required differential
pressure
as
88 psig.
The effect of these errors would be to
lower the actual
response
time available.
The current annunicator
response
procedure for the low pressure
alarm have
no indication to the operator
of the time available
to put the secondary
supply in service after the alarm is
received.
Since this time may be very short, the team
considers this to be
a significant weakness
in the procedures.
This item remains
unresolved,
pending additional evaluation
by
the licensee
(50-397/87-19-18).
Bottle Installation Not Per Desi
n Drawin
23
The design of the racks to seismically restrain the backup
nitrogen bottles for the
ADS valves is shown
on MNP-2 drawing
FSK-346, Revision 3, dated
June
18,
1983.
Note
6 on this
drawing requires that shims
be placed
under the bottles
as
required depending
on the individual bottle height to achieve
a
snug fit between
the top of the bottle and the collar of the
rack.
These
had not been installed for any of the
bottles for either the primary or secondary
stations in both
divisions.
As a result, all of the bottles were free to move
around in the collars during a seismic event, potentially
causing failure of the bottles and/or the rack.
At the conclusion of the inspection,
the licensee
had initiated
a design
change to the restraining
system for the bottles
because
the licensee felt that the existing design
was not
"user friendly" for maintenance
personnel
who perform the
bottle replacements.
In addition to their not being installed in accordance
with the
design drawing, the racks were also assembled
in a very
careless
manner.
Bottles were missing,
nuts were missing,
and
when they were present,
they were not even
assembled
hand tight
in most cases.
-The fai lure to install the backup nitrogen bottles in
accordance
with the design
drawings is an apparent violation of
10 CFR 50 Appendix B, Criterion V (50-397/87-19-19).
3.
Maintenance
and Surveillance
The team reviewed maintenance
and surveillance activities associated
with
the systems
under review by the team.
The results of this review are
summarized
below:
a e
Batter
Surveillance
Testin
The licensee
uses
24 VDC, 125
VDC and 250
VDC batteries
to supply
Division 1 and
2 vital D.C. electrical
power.
In addition the
licensee
uses
a 125
VDC battery to supply division three vital D.C.
electrical
power.
Technical Specification 4.8.2. 1 lists weekly,
quarterly,
once per 18 months,
and once per 60 months surveillance
requirements.
The weekly and quarterly surveillances
require
battery inspections.
The
18 month test requires
the verification
that the battery capacity is adequate
to supply
a
dummy load,
based
on the battery design criteria, while maintaining the battery
terminal voltage greater
than or equal to a specified
minimum
voltage.
The 60 month test requires
the verification that the
battery capacity is at least
80K of the manufacturer's
rating by
subjecting the battery to a performance
discharge test.
The team reviewed the licensee's
surveillance
procedures
against the
Technical Specification
requirements
and
had the following findings:
The team observed that the battery load profiles contained in
the Division 1 and
2 125 Volt 18 month battery surveillance
tests did not agree with the latest calculations
(2.05.01)
or
the
FSAR Load Tables.
This discrepancy
had already
been
identified by the licensee prior to this inspection
and
had
been
documented
in Nonconformance
Report
(NCR-237-013 (1/7/87),
however this discrepancy
was not resolved prior to the latest
outage battery testing,
prompting the
60 month performance test
to be substituted
for the 18 month service. test.
The battery capacity is affected
by electrolyte temperature.
Capacity decreases
with decreasing
temperature
and increases
with increased
temperature.
Batteries
are rated
by the
manufacturer at 77'F and will lose approximately
llew capacity
at 60 F; the minimum temperature
permitted for the
WNP-2
batteries
by the technical specifications.
Likewise a battery
would gain approximately
9X capacity. at the WNP-2 maximum
permitted temperature
of 100
F.
The team observed that the 18
month service test disregards
any effect that electrolyte
temperature
during the test would have
on the apparent
capability of the battery to meet the technical specification
requirement to demonstrate
the battery's ability to maintain
the emergency
loads operable.
With no regard to the
electrolyte temperature
existing at the start of the test,
no
judgement
can
be
made from the results of the service test to
state whether or not the battery is satisfactory for its design
requirements
which includes operating the emergency
loads at
the minimum permissible cell temperature.
The chart recorder
used in the test device for the
18 and
60
month survei llances
was scaled
such that voltage
changes
could
not be accurately
determined.
As a result of the battery surveillance test deficiencies listed
above,
the
18 month service tests
performed in 1986 failed to
demonstrate
the capability of the batteries
to meet design
requirements.
This item remains
unresolved,
pending additional
licensee
evaluation
(50-397/87-19-20).
The team observed that
a temperature
monitor exists for the safety
related battery rooms.
The team determined that the operating
temperature
range for the Class lE battery
rooms
was
65 to 100
degrees
F.
Burns and
Roe calculation 5.52.084
sheet
58 calculated
only a high temperature
alarm setpoint at 100 degrees
F.
No low
temperature limit was established
even though the batteries
may
begin to lose
a significant portion of its capacity at approximately
60 degrees
F.
WPPSS subsequently
revised procedure
PPM 7:0.0 on
September
2nd to add local temperature criteria of greater
than
65
and less
than 104 degrees
F for shift monitoring of each of the
three battery
rooms,
and provided
an action statement
to restore
the
room temperature within these limits by immediate corrective action.
These
added procedural
controls satisfy this concern.
b.
Thermal Overload Testin
25
Technical Specification 4.8.4.3 requires that thermal
overload
protection devices for valves listed in Table 3.8.4.3-1
be
demonstrated
operable at least
once per 18 months
by the performance
of a channel calibration of at least
25K of all thermal
over loads
for the required valves.
The licensee
has
used oversized
thermal
overloads
so that during accident conditions the thermal
overload
protection will not prevent safety-related
valves
from performing
their function.
This is consistent with Regulatory Guide 1. 106;
"Thermal Overload Protection for Electric Motors on Motor Operated
Valves," Revision 1, March 1977.
Procedures
7.4.8.4.3. 1 through .4
establish testing for the four groups of valves.
The team reviewed these, procedures
and test results
from three
groups of valves
and
made the following findings:
For
Group Four thermal overloads,
tested
in 1985, the test
current prescribed
by the procedure
did not match the time to
trip criteria specified
by the manufacturer.
For
Group Four thermal overloads,
maintenance
personnel
recognized that five thermal
overloads installed did not match
the size listed'n the procedure.
In all cases,
maintenance
adjusted
the test current without appropriate
review.
In two
cases
the test current did not match the time to trip criteria.
For Group
Two thermal overloads,
tested
in May, 1987, revisions
made to the procedure
in accordance
with the deviation
procedure,
1.2.3,
changed five thermal
over load heater sizes,
but did not change
corresponding test currents
used in the
surveillance
procedure.
For Group
Two and Three thermal overloads,
in four cases
the
test currents
prescribed
by the procedure
did not match the
time to trip criteria specified
by the manufacturer.
Thermal overload relay trip time is current dependent.
To test
thermal
overloads
the procedure
should establish
a current
and
a
corresponding
minimum time to trip criteria.
Group 4 thermal
overloads,
tested
in 1985,
were the first overloads tested
by the
licensee.
Due to calculational errors,
most group 4 valves were
tested at approximately
275K of the full-load motor current
specified
by the vendor.
This corresponds
to a time to minimum trip
of approximately
50 seconds.
The licensee's
procedures
specify 40
seconds
which corresponds
to 300K of full-load motor current.
A
review of the data taken during the 1985 testing
shows that none of
the overloads tested at 275K tripped quicker than
50 seconds,
indicating they performed
as designed,
however this is an example of
an inadequate
procedure.
A review of the group four test results
shows that in five cases
maintenance
personnel
identified heaters
of sizes different from
that specified in the procedure.
In all five cases
the maintenance
personnel
tested
the overloads at a current other than that
specified in the procedure.
The test current
used
and the as
found
26
heater
sizes
were noted by those performing the test in the comments
section of the procedure.
In two cases,
for valves
RCC-V-6 and
RHR-V-3A, the cur rent used did not correspond
to the minimum trip
time criteria specified in the procedure.
In these
two cases,
test
data
shows that the thermal
overloads
performed
as designed.
However,
changing thermal
overload test currents is an example of
maintenance
personnel
making
a procedure
revision without the
appropriate
review.
In March 1986, revision
1 to the thermal overload procedures
for all
groups
was issued.
The team reviewed the group four procedure
revision and noted that the five overloads
mentioned in the previous
paragraph
were not revised to reflect the hardware installed.
In
addition, the testing current was changed
from 275K of full load
motor current to 375K of the nominal trip current.
However, the
time to trip criteria remained at 40 seconds.
The appropriate
minimum time to trip for the revised test current was
22 seconds.
This revised procedure
was never
used.
Prior to the testing of group two and three thermal overloads,
the
minimum time to trip criteria was recognized to be in error and
revised to 22 seconds.
In addition, for both groups,
thermal
overload sizes in the procedures
were compared to the sizes in
licensee
drawings
and revised accordingly.
For five group two
thermal
overloads
the corresponding test currents
were not revised.
Of the five thermal overloads,
there are two outlying examples.
In
the first, valve RRC-V-16A was originally listed in procedure
7.4.8.4.3.2
as having G30T45 thermal overloads,
requiring a test
cur rent of 60 amps.
The revision to the procedure
changed
the
thermal
overloads to size G30Tll.
Although the test current
was not
changed,
the correct current for G30Tll overloads
corresponding
to a
minimum time to trip of 22 seconds
is 1.9 amps.
Test results
indicate that the three thermal
overloads tripped between
35.3 and
42.4 seconds.
Had 60 amps
been applied across
a G30Tll heater for
35.3
seconds it would have burned out.
The inspector
observed that
G30Tll heaters
were installed for valve RRC-V-16A and that there
was
no evidence that the heaters
had burned out.
In the second
example,
valve SW-V-24 was originally listed as having
G30T21 heaters,
requiring
a test current of 5.4 amps.
The procedure
revision changed the heaters
to size
G30T26 which require 8.7
amps
to have
a minimum trip time of 22 seconds.
Again, the trip current
was not changed.
According to the vendor drawings, at 5 '
amps
one
would expect
a minimum time to trip of approximately
80 seconds.
. Test results indicate that the three thermal
overloads tripped
between
40.6 and 50.0 seconds.
The inspector observed that G30T26
heaters
were installed for valve SW-V-24A.
This indicates that if
the three overloads
had been tested, in accordance
with the
procedure, all three tripped faster
than design.
On August 28,
1987,
the licensee
tested
the thermal
overloads for SW-V-24A and
found them to operate appropriately.
27
In addition to the previously mentioned procedural
inaccuracies,
the
inspector
found four examples of group two and three overloads test
currents
inappropriate for the heater size were specified
by the
procedure.
All four examples
were in the conservative direction so
there
was
no question of thermal overload operability.
Finally, although deviations existed for group two and three
testing,
at the time of the inspection
no deviations
had been issued
for group
one
and group four.
In addition
no document
was presented
tracking the future revision to group
one
and four based
on the
errors
found in group two and three procedures.
Had changes
been
made in accordance
with the methods
used to revise the group three
procedure,
the errors in the testing of group two overloads wouldn'
have
happened.
The inadequacy of procedures
7.4.8.4.3.2,
3,
and 4 is an apparent
violation of Technical Specification 6.8. 1 (50-397/87-19-21).
Failure to properly implement changes
to procedures
7. 4.8.4. 3. 2 and
. 4 is an apparent violation of Technical Specification
6. 8. 3
(50-397/87-19-22).
The inspector
reviewed the licensee's
surveillance
procedures
corresponding
to the Technical Specification requirements
to verify
the transfer
between
the offsite transmission
network and the onsite
Class
lE distribution system.
Specifically, the inspector reviewed
procedure 7.4.8. 1. 1, "18 month manual
and auto transfer test,
startup to backup station power," corresponding
to Technical Specification 4.8. 1. l.l.b, procedure 7.4.8. 1. 1.2.5,
"Standby Diesel
Generator
Loss of Power Test (Divisions 1 and 2)," corresponding
to
portions of Technical Specification 4.8. l. 1.2.e,
and procedure
7.4.8. 1. 1.2.7,
"Standby Diesel Generator
LOCA Test (Divisions 1 and
2)" corresponding
to portions of Technical Specification 4.8. 1. 1.2.e.
The following findings were
made:
Procedure
7.4.8. 1. 1.2.5 did not specify which breakers
open
on
vital bus undervoltage.
Procedure
7.4.8. 1. l. 1.2 did not require the functional testing
of the backup transformer.
Division One and
Two bus primary undervoltages initiate a two second
time delay relay.
The time delay relay initiates,
among other
things,
load shedding.
Seven breakers
on three separate
buses
are
opened
on load shedding.
Procedure
7.4.8. 1. 1.2.5 states,
"verify
that... loads are
shed
from the bus."
Technical Specification 4.8. 1. 1.2.e.4.a)l)
requires that verification be
made of load
shedding
from the buses.
Although the procedure
quotes
the
technical specification,
the lack of a verification of specific
breakers
opening is a weakness
since
upon load shedding
not all
breakers off the main 4
KV vital buses
open nor are all breakers
that open off the main 4
KV buses
(SM-7 and SM-8).
The
28
inspector discussed
this weakness
with the engineer
responsible for
the procedure
who committed to address it prior to performing the
test during the next outage.
The second
weakness
identified was the lack of a full functional
test of the backup offsite power source for the 4
KV vital buses.
At
the time of inspection it was apparent that the backup offsite power
source,
and specifically the backup power transformer
TR-B, was only
being functionally tested
to a fraction of its design
load
requirements.
TR-B supplies
both main 4KV vital buses
SM-7 and.
SN-8.
Procedure
7.4.8. 1. 1. 1.2 Revision 3, tests
the transfer from
startup
power to TR-B.
Prior to the test, all rotating equipment
with redundant
equipment available
on the bus not tested
are shut
down and the redundant
equipment started.
During the test,
TR-B is
only loaded with the non-shed
loads of one bus excluding those
mentioned
above.
The licensee
should evaluate
the
need for
increased
functional testing of TR-B.
This is an .open item (50-397/87-19-23).
Functional
Test and Calibration of Time Dela
Rela
s
Time delay relays
are
used in a number of safety-related
control
circuits.
These safety-related
Class lE components
are not usually
explicitly identified in Technical Specifications;
nevertheless,
they are required to have design basis setpoint calculation values
and to be periodically tested
and calibrated in accordance
with the
WNP-2 Chapter
7
FSAR commitments to IEEE Std. 279-1971
and
The team requested
both setpoint calculations
and
periodic test surveillance instructions for various time delay
relays in safety-related
systems,.but
was informed that
no such
documentation
existed.
For the majority of such time delay relays,
there
was
no indication that any periodic surveillance testing
had
been performed since the initial plant preoperational
tests
had been
completed.
During the inspection,
the licensee
provided
an April 19,
1985,
inter-office memorandum that identified 22 time delay relays in the
4KV switchgear requiring calibration.
There
was
no indication that
any other safety-related
time delay relays were subsequently
identified as being subject to periodic test
and calibration.
Seven
specific time delay relays
were selected
by the team to illustrate
this concern.
In each instance,
the
WNP-2 master
equipment list
correctly designated
these particular time delay relays
as Class
1E
devices,
but this information did not lead to the development of
appropriate
documentation.
These
examples
are:
(a)
SE-RLY-V/2A3 and 2A4, that provide
12 second
and 62 second
time
delay values to control the slow opening of the service water
pump discharge
valve to minimize water
hammer effects.
(b)
SGT-RLY-TK/2Al and 2A2, that provide
a 30 second
time delay for
automatic start of the redundant
standby
gas treatment
system.
29
(c)
RHR-RLY-K54A, that provides
a 10 second
time delay for minimum
flow bypass for the
RHR pump.
(d)
RHR-RLY-K70A, that provides
a 5 second
time delay for starting
of the
RHR pump.
(e)
RHR-RLY-K93A, that provides
a 10 minute time delay before the
operator
can manipulate
RHR heat exchanger
valves after the
start of an accident.
Failure to provide instructions for the periodic calibration
and
testing of time delay relays is considered
an apparent violation
(50-397/87-19-24).
S stem
The Service Water System
(SWS) provides cooling water to several
safety-grade
components
such
as the
HPCS Diesel
Engine,
1A Diesel
Engine,
and
RHR heat exchanger.
The team reviewed maintenance activities
on the
SMS.
During the
team inspection
walkdown of the
SWS,
an overhead
crane in service
water
pumphouse
1A was observed to have its block extended
such that
it could impact safety-related
conduit during
a seismic event.
The
license
has
no procedure
covering seismic control of lifting
equipment installed in safety-related
areas.
This is
a repeat
example of a similar concern raised in a previous inspection report
(86-33-01),
and remains
an open item (50-397/87-19-25).
Emer enc
Diesel Generators
EDG)
The emergency
diesel
generators
(EDGs) provide emergency
AC power in
case of loss of offsite AC power.
The team reviewed the maintenance
activities associated
with the
EDGs and the High Pressure
(HPCS) diesel
generator.
No deficiencies
were noted.
Missin
Hardware
on Safet
Related Valve
During a walkdown inspection of the Service Water System,
the
hardware for butterfly valve SW-V-165B was found to be broken off.
This valve is required to be operated to the open position to bypass
the spray ring and send the service water directly to the spray pond
whenever
pond temperature
is less
than
60OF or before outside
ambient temperature
can fall below 32 F.
Mithout the hardware in
place,
the operator
cannot operate
the valve without using
a wrench
or other improper tool.
Furthermore,
the operability of the valve
is questionable
considering
the possible
cause of the failure of the
handwheel.
The licensee
has initiated action to repair the valve.
Standb
S stem Pool
Tem erature
Elements
The team reviewed the Standby Service
Water
System pool
temperature
elements installation to determine
the adequacy of
monitoring the Technical Specification Limits on pool temperature.
30
The review showed that the pool is generally about 14.5 feet deep
(overflow point to pool bottom), the bottom end of the two foot long
temperature
probe is one foot above the general
pool bottom and is
located
under the Standby Service Water building where the pool
depth is 26.5 feet.
Since the temperature
probe is located in the
service water flow path to the pump, the temperature
of the water
being supplied to the plant (system in service) is monitored
accurately.
The WNP-2 Technical Specifications
require the water
temperature
to be less
than 77~F.
Since the system is normally
secured,
the pool water is stagnant
and there will be
a temperature
gradient with the warmest water at the top of the water in the
general
pool area
and the coolest water under the Service Mater
building in the deepest part.
Since the Surveillance
Procedure
verifies that the temperature
at the temperature
probe is less
than
77 F,
and this temperature
may not be representative
of the overall
pond temperature,
this is an apparent violation of WNP-2 Technical
Specification Surveillance
Requirement
4. 7. l. 3 which requires
verification every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that the ultimate heat sink water
temperature
is within its limit.
This item remains
unresolved,
pending additional
licensee
evaluation
(50-397/87-19-26).
During the above review,
the inspector
reviewed Design
Change
Package
(DCP) 86-0155-OA dated April 23,
1986.
The
DCP modified the
support for the temperature
element to facilitate maintenance.
On
page
4 of the
DCP,
Note 1 of the "Notes
on Installation" indicates
that the original design
showed perforations
in the pipe containing
the temperature
element,
but because
of the slow temperature
response
of the pool, these perforations
are
no longer needed.
There are no.calculations
or analysis
concerning time response
which
support
the determination that the perforations
are not necessary.
Further review of the
DCP drawings
shows that the perforations
were
not changed
and the licensee
does
not believe that the pipe
containing the perforations
was
removed.
This item remains
open
pending additional
licensee
action to provide
a basis for the note
(50-397/87-19-27).
Automatic
De ressurization
S stem
During the
ADS system walkdown, the inspection
team noted that
seismic restraints
were improperly restored
on the backup nitrogen
cylinders for ADS following nitrogen cylinder replacement.
The
licensee
has
no procedure
addressing
the requirements
for proper
cylinder replacement.
The nitrogen cylinders mounting brackets
were
not tight around the collars of the nitrogen cylinders,
nor were the
bolts
and nuts secured properly. It was determined
from the licensee
that they use training as the method for teaching their operators
the proper replacement
of the nitrogen cylinders.
The team
considered
that
a procedure
should
have
been
issued for nitrogen
cylinder replacement
to ensure
proper collar engagement
around the
nitrogen cylinders.
In addition, the team noted that temporary
scaffolding was noted
as being installed in the vicinity of the
backup nitrogen supply for ADS since
June
1987.
This scaffolding
was constructed
in accordance
with maintenance
procedure
10.2.53
which provides guidelines
and seismic requirements
for scaffolding
31
ladders,
tool gauge
boxes
and metal storage
cabinets.
The team
felt that the scaffolding was constructed correctly and was tagged
in accordance
with procedure
10.2.53
as required.
Thus, scaffolding
should
have
been
removed
upon completion of its intended function.
Multi le Features
of CIA Valves
Containment
Instrument Air (CIA) solenoid valves
CIA-V-39A and
39B
serve
as the safety-related
isolation valves
between
the
safety-related
and nonsafety-related
portions of the system.
Their
function is to close
upon loss of the nonsafety-related
N
bottles.
In July 1986,
CIA-V-39A was found to be inoperable during the
performance of surveillance
procedure T.S.S.7.4.5. 1.21.
286-0333
was generated
as
a result.
It was dispositioned
"use-as-is" with the reason
being given that check valve CIA-V-41A,
which is in series with CIA-V-39A, serves
as
an isolation valve and
provides sufficient isolation for the system.
This
NCR also took
credit for the normal
N2 inerting supply and the CIA compressors.
The team did not concur with this disposition for the following
reasons:
(1)
Per
values
given in the
FSAR (Section 9.3. 1.2.2), the maximum
allowable leakage rate for all components
of one branch of the
backup
N
supply is approximately
4 SCFH.
Therefore,
the
maximum allowable leakage
rate of the check value CIA-V-41A
must be less
than or equal to 4 SCFH.
Existing plant IST
procedures
do not verify the ability of these
valves to meet
this requirement.
Therefore,
a nondetectable
failure can
exist.
IEEE Standard
379-1977
on single failure states
"...identified nondetectable
failures shall
be assumed
to have
occurred."
(2)
Since the normal
N
supply and the CIA compressors
are
associated
with th3 nonsafety-related
portion of the system,
credit should not be taken for these.
Subsequent
to the immediate disposition,
the valve was cycled
manually until it would operate electrically.
However, after
sitting idle for several
minutes, it was again
found to be
inoperable electrically.
The valve was then disassembled
and
internal contamination
was found. It was then cleaned
and
reassembled.
The source of the internal contamination
was not
addressed
and
no action was taken to preclude repetition.
In June
1987, while performing the
same surveillance test,
both
valve CIA-V-39A and the
same valve in the opposite division,
CIA-V-39B, were found inoperable.
NCR 287-219
was written.
In
violation of Plant Problems
Procedure
1.3. 12, Section 1.2. 12.5, the
originator did not indicate that the
NCR was safety-related.
32
Section l. 3. 12. 5. E. 3 of the
same procedure
requires
the Plant
Technical
manager to check "yes" or "no" in the safety Significant
Block.
This block was incorrectly checked
"no" in violation of the
definition in Section 1.3. 12.2.C.
In spite of at least
one similar earlier fai lure of one of these
valves
and the simultaneous failure of both valves
(one in each
division) in an apparent
common
mode at this time, the licensee
performed
an inadequate
root cause
analysis
and
no appropriate
corrective action
as required
by the licensee's
procedure,
Section
1.3. 12.5.0.4
C and
D.
The valves were dissembled,
cleaned,
reassembled
and tested.
One of the immediate disposition actions called 'out on the June
1987
NCR was to "exercise the valve manually (through bottom hole vent)
until valve operates electrically."
This is an improper disposition
since it had been proven ineffective in the earlier
NCR,
and it
involved no action which could have defined the cause of the problem
or correct it. It could, at best,
only mask the problem.
Had the
valve been operated
successfully with manual
assistance,
there is
every reason to believe it would have
been put back into service
with no form of corrective action having been taken.
In July 1987, during
a plant shutdown,
the valves were tested
again,
and again they both failed.
At this point, the corrective action
was determined to be adding
a washer
under the valve operating
spring to increase
the closing force on the valve.
No
NCR was
written.
This is
a violation of the licensee's
procedure,
Section
1.3. 12.5.A. l.
Also, there is
no evidence that root cause analysis
was performed
on this event
as
r equired or had ever subsequently
been performed.
The above described
incidents
have significance
with respect to plant safety in that the operational
and leak tight
integrity of the solenoid valves in question
and their backup check
valves is vital to ensuring that the design basis
30-day
N2 supply
to the
ADS valves is indeed sufficient for 30 days.
The maximum
allowable leakage
rate to maintain
30 day's
supply is extremely low,
on the
same order
as containment isolation valves.
By the
licensee's
failure to define the root cause of the recurring
fai lures
and then the taking of appropriate corrective action to
preclude recurrence, it is reasonable
to expect that failure could
occur again.
Since the leakage rate of the check valves
has
never
been quantified, they can
be assumed
to leak more than the
allowable.
Therefore, it is reasonable
to conclude that with
failure of one of the solenoid valves in an
LOCA situation with loss
of the nonsafety-related
containment
instrument air supply, the
backup air supply would not be sufficient for 30 days.
Considering this, the
common
mode failures that occurred
on both
divisions
on two separate
occasions, constituted
the plant being "on
a condition that was outside the design basis of the plant..."
as
described
in 10 CFR 50.73.
The failure to identify, on multiple occasions,
nonconforming
conditions or,
when they were identified, the failure to evaluate,
33
analyze or disposition these conditions in accordance
with the
procedure
is considered
an apparent violation of 10 CFR 50 Appendix
B, Criterion V (50-397/87-19-28).
Instrument
Rack Terminations
Paragraph
8.3.1.3. 1, Class
IE Raceways,
Cables,
Equipment (Panels
and Racks), of the
FSAR identifies Instrument
Racks (IR) 67, 68,
and
69 as Class
IE.
DWG E538 W.O. 2808,
Sheets
20 and 21, note 2,
identifies IR-67, IR-68, and IR-69 as work being of equality Class
1.
Paragraph
3.2.4 (a), equality Assurance Classification, of the
reads "...All equality Class
1 items meet the applicable provisions
of 10 CFR 50 Appendix B."
Paragraph
17. 1. 1.2 (c), Design Control
JAR-3, of the
FSAR establishes
a system of independent
reviews to
assure
applicable quality, regulatory code,
and design basis
requirements
are properly translated
into design
and procurement
documents for each structure,
system
and component.
The documented
review provides
a check for design
adequacy,
inspectability,
and
compatibility with intended
usage.
WNP-2 termination
and splicing
Instruction
No. 10.25.46 provides the direction and installation
details
required for all permanent electrical terminations.
During the inspection,
the team conducted
an evaluation of the
installation and design requirements
for low voltage
(600 or below)
terminations
and heat shrinking specifications
of plant
instrumentation wiring.
The results of the team's
evaluation is as
follows:
During plant tours,
an inspector walked
down portions of the
ADS Nitrogen Supply System where IR-67, IR-68, and IR-69 were
opened for observation of wiring installation.
The inspector
noted the following deficiencies:
~Crim in
IR-68 wire terminal
87 insulation was excessively
stripped
and subsequently
inserted
and crimped to the terminal lug
exposing its conductor at the end of the connector barrel
insulator.
Two wires were additionally found in IR-67 and
another wire in IR-69 was found revealing the
same
conditions
as stated
above.
Terminal
Lu s
Terminal wires 6,7 and 36,37 were spliced from terminal
wires
5 and 35, respectively.
Terminal wires
5 and 35 are
size
16 with a larger insulator covering whereas
terminal
wires 6,7 and 36,37 are size
16 with a much smaller
insulator.
The inspector. noted that the wire insulation
is not commensurable
with the size of the terminal
connectors
jacket.
Therefore,
terminal wires 6,7 and
36,37 connector
appear to be unacceptably
modified in
IR-69.
34
Cabinet H-13,
P631,
ADS Division 2 in the control
room was
also inspected for terminations.
Terminal wires B22-FBB,
10B, 14B,
16B,
25B, 29B,
33B, 35B,
and
37B each
had
an
additional wire whose
lugs were terminated
under
one
terminal
screw which were not installed back to back.
Terminal wires 36 and
37 were spliced to terminal wire 35
in IR-69., The heat shrinking tubing was improperly
installed over the splice
and subsequently
exposing
terminal wire 37 conductor
from the splice connection.
Failure to comply with station procedure
requirements
for proper
installation of electrical terminations is an apparent violation of
10 CFR 50, Appendix B, Criterion
V (50-397/87-19-29).
1.
Seismic Considerations
and Housekee
in
During the first week of onsite inspection,
an unsecured
tool box
and breaker truck were observed
in the safety related
SM7 switchgear
room.
These
are
heavy
and relatively easily moved items which could
damage
important safety equipment during a seismic event.
It
appeared
to the
team that these
items should
be stored elsewhere
or
properly secured.
During the second
week of onsite inspection,
the
team noted that the breaker truck and tool box had been
removed;
however,
the team again noted that ladders
were left stored in both
the
SM7 and
SM8 switchgear
rooms
and several
sets of disassembled
metal brackets
and mounting hardware
were piled in the corner of the
SM7 switchgear
room.
Licensee
procedure
10.2.53,
"Seismic Control
for Scaffolding,
Ladders,
Tool Gang
Boxes
and Metal Storage
Cabinets,"
provides specific requirements
for ensuring proper
seismic restraint of equipment in safety related areas.
The team noted that the licensee
was not providing adequate
attention to plant housekeeping.
The following deficiencies
were
observed:
(1)
Piles of disposable
absorbant
towels
and several
cardboard
boxes
were observed
in the
DG rooms.
This debris would
contribute to drain plugging in the event of fire system
actuation.
(2)
A pile of drawings
and papers,
a discarded
candy wrapper
and
several
pieces of loose wire were observed
on top of breaker
cubicles in the
SM8 switchgear
room.
(3)
Numerous cigarette butts
and
a cigarette
wrapper
were observed
within the
no smoking area adjacent to the diesel
generator
fuel oil tank fill manifold.
Licensee
procedure
1.3. 19, "Housekeeping",
provides specific
requirements
for proper cleanup of work areas
following maintenance
activities.
35
The above is considered
a violation of 10 CFR 50, Appendix 8,
Criterion
V (50-397/87-19-30).
m.
Im ro erl
Controlled Plant Modification
The team noted that the licensee
had installed temporary
foam
insulation filters on the ventilation louvers for the
4KV breakers
on safety related
SM7 switchgear.
These filters were not installed
using
a maintenance
order,
as required
by station procedures,
nor
was the modification properly reviewed
as required
by 10 CFR 50.59.
This is considered
a violation (50-397/87-19-31).
4.
Control
Room Observations
The team observed
operator activities in the control
room.
The operators
appeared
to
b'e knowledgeable
concerning their duties
and
responsibilities.
The control
room was free from unnecessary
distracting
activities.
The background
noise from the control
room ventilation
system is fairly high, but did not appear to interfere. with operator
response
to audible alarms
or communications.
The operators
were alert
to unusual
noise patterns
such
as
a malfunctioning chiller and
expeditiously corrected
the problem.
The Main Control
Panel
appear ed to be well marked with little impromptu
marking to clarify labels.
Equipment controllers provide clear feedback
to the operators
as to valve or controller position.
~ADS
S stem
The team walked
down the control
room indications for the Automatic
Depressurization
System
(ADS).
The operators
were familiar with the
indications,
the indications were adequately
marked,
and all
indications
showed proper equipment lineup and operation.
The team
discussed
the operation of the
ADS inhibit switch with an operator.
The operator
was familiar with the switch and indicated
he
had
received training on the operation of the switch as
a result of the
modification which installed the switch and also
as
a result of
requalification training.
The operator
was able to describe
how the
switch was
used
and what indications occur when the switch is in the
inhibit position.
Verification of these indications is performed
by
the "Minimum Startup Checklist" which is performed prior to every
startup.
The operation of the switch is prescribed
by the
licensee's
Emergency Operating
Procedures
which are symptomatic.
These
procedures
include the
symptoms for an
ATMS. The team walked
down the control
room indications for the Electrical
Power
Distribution System including offsite power sources,
the vital 4
KV
busses,
the vital 480
V busses,
the 125
V and 250
V batteries,
and
the Emergency
Diesel Generators.
The operators
were familiar with
the indications,
the indications were adequately
marked,
and all
indications except
a ground alarm
showed proper equipment lineup and
operation.
The ground alarm was the result of a problem with the
alarm circuit and not an actual
ground. Alternate indication of the
ground status
on the affected
buss
was available,
however, there is
36
no requirement or directive in place to monitor the alternate
indication in the absence
of the alarm function.
Further review
showed that there is no system in place to provide compensatory
actions for an inoperable
or alarm function.
This is an
open item (50-397/87-19-32).
b.
S stem
The position indicator lights for SW-PCV-38A and
38B were not
working.
These valves are pressure
control valves for the Standby
Service Water System.
Further review showed that
a recent
modification (DCP-86-0324) deactivated
these
valves
and therefore
deenergized
the valve position indication.
A field change
(FCR-08)
to this
DCP modified the labels to the valves to identify them as
having been deactivated.
A Maintenance
Work Request
(MWR-AT-0444)
to change
the labels
was initiated but not yet completed.
The
installation completed section of the Plant Modification Record
was
signed off on May 28,
1987, without MWR-AT-0444 being completed.
This is another
example, identified by the team, of the type of
violation described
in section 2.d of this report.
The Reactor
Feed
Pump Turbine vibration recorders
have handwritten notes
dated
December'985
indicating that their labels
are incorrect.
This
appears
to be an excessive
period of time to correct his deficiency.
This is an open item (50-397/87-19-33).
The
CRT displays for the Safety Parameter
Display System
(SPDS) are
impossible to read from the Reactor Operator's
desk
and are
difficult to read
when standing at the Main Control
Panel itself.
This situation
does
not appear to be consistent with the
description which says in Section 7.5. 1.23 the
CRT supplies
additional information via high performance
human factored displays
useful for emergency
response.
This item is unresolved
pending
NRC
review to determine if the
meets licensee's
commitments
(50-397/87-19-34).
ualit
Assurance/Trainin
The gA/gC activity have identified similar design control deficiencies to
those
found by the inspection
team in some areas.
This is evidenced
by
the inspector's
review of gA/gC audit, surveillance,
observation
and
inspection reports.
In other areas of concern to the inspection
team,
the gA/gC activity has
been limited or nonexistent.
In response
to Region
V inspection report
No. 86-11 findings regarding
the adequacy of gA/gC involvement,
the licensee
has strengthened
the
overall site quality verification organization
and programmatic
approach
to assuring quality of facility operations.
This revised
approach is
still in the implementation process.
According to the licensee,
details
of this approach
as discussed
in the recent
Region
V SALP report are
described
accurately.
Elements of the program,
such
as onsite gA/gC,
Nuclear Safety Assurance
Group and Corporate
gA functions are expected
to
be fully implemented during
FY 1988.
During the implementation process,
the licensee
indicated that further adjustment
and fine tuning of the
approach will occur.
Therefore, it may be premature to attempt
an
37
assessment
of the effectiveness
of the licensee
revised quality
verification program at this time.
However, to the extent that the
licensee's
quality verification program should
have
impacted the
inspection team's findings, the following is evident:
a.
No evidence of quality verification activity was produced
by the
licensee for the following inspection
team findings.
(1)
Battery design calculation for DC motor in-rush current.
(2)
125
VDC and
250
VDC design calculation correction factors for
aging,
temperature
and specific gravity.
(3)
Instrument tolerance
consideration for harsh environments.
(4)
ADS instrument rack electrical terminations.
(5)
Reactor
shutdown margin response
time.
Limited evidence of quality verification activity was produced
by
the licensee
for the following inspection
team findings:
(1)
Materials (scaffolding,
loose parts,
crane
hook, etc.) stored
in the vicinity of safety-related
equipment creating
a
potential
SSE concern.
(2)
Inadequate
surveillance
procedure for MOV electrical
overload.
(3)
Inadequate
surveillance
procedure for periodic testing of
safety-related
batteries.
(4)
Monitoring of safety-related
battery
room temperature
design
limitations.
(5)
Improper closure of completed
and
NCRs (i.e., proper
design not implemented
and failure to provide root cause
evaluations for repeated
NCRs).
(6)
Inadequate
drainage capability for D.G.
Rooms.
Licensee quality verification activities
have identified in several
surveillance,
audit and observation
reports
design control problems
associated
with and similar to repeated failures of D.
G.
day tank
valves
and repeated fai lure of automatic valves for isolation of
nonsafety-related
air to ADS control
system.
In these
cases, it
appears
that the plant staff did not perform root cause
evaluations
and did not take timely corrective action to the identified
deficiencies.
At present,
site
gA reports that there are
16
outstanding that are over
6 months old.
While some of this work may
be done,
the documentation
is not complete.
C.
Evidence of quality verification activity was produced
by the
licensee for the following inspection
team findings:
38
Design calcs (Instrument setpoints).
(2)
Weekly and 60-month battery surveillance testing.
(3)
Automatic sprinkler system installation
and diesel
generator
room flooding
removal of oil spills.
(4)
Seismic restraints.
(5)
Time Delay Relay
(TDR) Setting (not specific to IEEE
requirements).
(6)
Thermal overload of MOV (Torque and limit switch settings).
d.
Continuing weaknesses
in the licensee's
quality verification program
appear to exist as follows:
The focus of'udits, surveillances,
inspections
and
observations
should
be increased
in the area of physical plant
conditions
and work performance.
(2)
(3)
NCR,
DCP, tQR,
PHR or
PDR completed
reviews should include
physical verification of design
implementation
by plant QA/QC.
No
NCR was issued for the nonconforming safety-related
hand
wheel for manual
valve
No.
S.W.
V-165B because
licensee policy
appears
to allow individual interpretation/discretion
in such
cases.
Furthermore,
root cause
evaluations
may not be required
unless
a 50.59 review is required.
50.59 reviews are only
required
on
NCRs if it is determined
equipment is to be used
"as is or repaired."
(4)
(5)
(6)
Proper coordination of resources
and personnel
expertise (i.e.,
onsite
QA/QC, corporate
P.A. outside consultants,
engineering,
operations,
NSAG, etc.) to further enhance
program
implementation
appears
to be in the developmental
stage.
t
Plant,
corporate/QA interface
appear to have
improved to the
extent that
a working relationship exist that produces
an
environment for effective quality verification program
implementation.
However, this environment is in its infancy
and
may not have
been disseminated
down through the ranks of
plant and corporate
personnel.
The training groups did not appear to be incorporating quality
verification results into plant training programs (i.e.,
instructions to operations
and test staff regarding reported
seismic
concerns
and operations
response
to
QASR 86-202
regarding operator requalification training).
Unresolved
Items
Unresolved
items are matters
about which more information is required to
determine whether they are acceptable
or may involve violations or
39
deviations.
The licensee is requested
to provide additional information
on these
items,
as noted in the forwarding letter to this report.
7.
Exit Interview
On August 28, 1987,
an exit interview was conducted with the licensee
representatives
identified in paragraph
1.
The inspectors
reviewed the
scope of the inspection
and findings as described
in the
Summary of
Significant Inspection Findings section of this report.