ML17328A388

S. V. Athavale, Discipline Lead,

Melanic A. Miller, Operations

Engineer,

Gregory

M. Nejfelt, Reactor Engineer,

Region III

Hershell A. Walker, Reactor Engineer,

Region III

John

D. Wilcox, Senior Operations

Engineer,

Harban Singh,

AECL (Atomic Energy of Canada,

Ltd.)

Mahesh Singla,

AECL

Donald A. Beckman,

AECL

David B. Waters,

AECL

Lo

. nley

AECL

4( / l1o

eter

.

o tay,

earn

ead

Team Inspection Section

A

Special

Inspection

Branch

Division of Reactor Inspection

and Safeguards

Office of Nuclear Reactor Regulation

at

Approved by:

arne

.

on

n,

se

Team

nspection

Section

A

Special

Inspection

Branch

Division of Reactor Inspection

and Safeguards

Office of Nuclear Reactor Regulation

(

ayn

.

anni ng,

ve

Speci

1 Inspection

Branch

Division of Reactor Inspection

and Safeguards

Office of Nuclear Reactor Regulation

9008270005

900822

PDR

ADOCK 050003l5

9

PDC

at

g/'zz

Po

a e

TABLE OF

CONTENTS

PAGE

EXECUTIVE SUMMARY..~ ~ ~ ~ ~ ~ ~ ~ . ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ . ~ ~ . ~ ~ . ~ ~ ~ ~ ~ ~ ~ ....

~ ~ ~ ~ ~ ~ ~ . ~ ~ ~

1.0

INSPECTION OBJECTIVE AND SCOPE.

~.... ~..... ~...... ~ . ~...

~ ~ .. ~.....

2.0

INSPECTION DETAIL ... ~ . ~ . ~ . ~ . ~ ~ . ~ ..

~ . ~". ~ ~.;"~ . ~"'. ~ ~ ~ ~ ~ ~

2.1

Design Review...............................................

2.1.1

Design Control and Independent

Design Verification...

2.1.2

Electrical Systems...................................

2.1.3

Mechanical

Systems

and Components....................

2.1.4

Instrumentation

and Control..........................

2

3

5

7

2.2 Operations............"..""..'-.".""".-""- -"

~ ~ ~

2.2.1

Procedures.........................

2.2.2

Control

Room Drawings..............

2.2.3

Material Condition of Equipment....

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ 1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

9

10

11

2.3 Haintenance.................-"""-"-"-.-"".-"- "."

2.3.1

Procedures

and Vendor Manuals......

2.3.2

System/Component History...........

2.3.3

Spare Parts

and Material Control...

2.3.4

Engineer ing Support................

2.3.5

Drawing Updates....................

2.3.6

Root-Cause Analysis................

~ ~ ~ 1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

12

13,

14

15

16

2.4

guality Assurance..........................................

2.4.1

Onsite

Review Committee.............................

2.5

Surveillance

and Inservice Testing.........................

16

17

2.5.1

Surveillance

Test Procedures.......

2.5.2

Station Battery Testing............

2.5.3

Inservice Testing (IST)............

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

17

19

20

3'

CONCLUSIONS ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

20

4 0

UNRESOLVED

ITEHS ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

21

5.0

EXIT MEETING..... ~ . ~~...~.....................

~ .~...

~ ~ ~ .

~ .

21

APPENDIX A - Summary of Inspection Findings.........

APPENDIX

B - Personnel

in Attendance at Exit Meeting

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

A-1

B-1

EXECUTIVE SUMMARY

A Nuclear Regulatory

Commission

(NRC) inspection

team conducted this safety

system functional inspection

(SSFI) from June ll through June

22 and July

9

through July 13, 1990, to assess

the operational

readiness

of the essential

(ESW) system.

The SSFI

team focused

on the licensee's ability to

integrate

systems

and components within the functional areas of design,

design

control, operations,

maintenance,

and surveillance

and testing into cohesive

programs that support operational

readiness

of safety systems.

The SSFI team determined that the

ESW system

had an adequate

design capacity to

perform its required safety functions.

Nevertheless,

problems requiring

management

attention were identified in the areas of design control, surveil-

lance

and testing,

procedural

adherence,

and corrective actions.

The team was particularly concerned with the licensee's

failure to implement an

effective independent

design verification program.

The absence

of a design

verification program was recognized

by the licensee

in 1987

and was again

identified in a 1989

NRC inspection report.

The team identified several

examples of design deficiencies that were the result of an ineffective inde-

pendent

design verification program.

These

included under sized electrical

cables

and circuit breaker current interrupting capacity for the 4-kV buses,

improper inverter voltage qualification, and wrong relief valve settings for

the service water system.

Although the individual findings did not affect safe plant operations,

the team

was concerned that not all existing designs

were supported

by acceptable

calculations

because

of the significant number of deficiencies it had

identified in the calculations

reviewed.

The team identified numerous

minor deficiencies

which could be attributed to a

general

lack of attention to procedural

requirements.

Examples

included the

improper use of limitorque motor mounting bolts by the maintenance

personnel

and the improper use of locked valve procedures

by the operations staff.

The

team also identified procedural

inadequacies

in the areas

of surveillance

and

testing.

Other weaknesses

identified by the team included the lack of a

comprehensive

root-cause

analysis

program,

inadequate

control over the list of

safety class

equipment,

and inadequate

coordination

between engineering

design

groups'he

team determined that, although

concerns

in the areas of independent

design

verifications, station battery testing,

drawing controls,

emergency

diesel

generator

loading calculations,

and setpoint calculations

had been identified

to the cognizant engineers

through previous

NRC and licensee audits,

both engi-

neering

and operations

personnel

had failed, in some cases,

to recognize the

safety significance of the concerns,

and that consequently,

licensee

manage-

ment had failed to take prompt corrective actions.

ln

I

1.0

INSPECTION OBJECTIYE AND SCOPE

The Nuclear Regulatory

Commission

(NRC) staff performed

an announced

safety

system functional inspection

(SSFI) to verify the functionality of the

emergency

(ESW) system at the D. C. Cook Nuclear Power Plant,

Units I and 2.

The primary objective of the SSFI

was to assess

the operational

readiness

of

the

ESW system

and other interacting

systems

by determining whether:

The systems

were capable of performing the safety functions required

by

their design bases.

Surveillance testing

was adequate

to demonstrate

that the systems

would

perform their required safety functions.

System maintenance

(with emphasis

on pumps

and valves)

was adequate

to

ensure

system operability under accident conditions.

Training was adequate

to ensure that technicians

could proper ly operate

and maintain the systems.

Management controls were adequate

to ensure that the safety

systems

would

fulfillthe safety functions required

by their design bases.

Procedures

provided adequate

guidance to ensure

proper system operation

under normal

and accident conditions.

The SSFI team reviewed system descriptions;

the Updatea

Final Safety Analysis

Report; equipment sizing calculations;

documentatior, pertaining to system

protection, controls,

and interlocks; equipment specifications;

modification

packages;

related test

and operating

procedures;

and one-line

and elementary

diagrams

and equipment layout drawings.

In addition, the team reviewed operating

and administrative control procedures,

selected

operator

status

logs,

and control room system files; performed

walkdowns of systems

and plant areas;

and interviewed licensed

and non-licensed

operators,

and instrumentation

and control personnel

arid system engineers

with

regard to the

ESW system.

2.0

INSPECTION DETAIL

The

ESW system

was

common to Units I and

2 and provided cooling water to compo-

nent cooling heat exchangers,

containment

spray heat exchangers,

emergency

diesel generators,

and control room air conditioners.

In addition

the

system

served

as

a backup water source to the auxiliary feedwater

tAFW) pumps

when the condensate

storage tank, which was the normal supply for the

AFW

system, is either empty or otherwise lost.

The system consisted of four

pumps, fuur duplex strainers,

and associated

piping and valves.

System piping

was arranged

in two independent

headers,

each serving certain

components of

each unit.

2.1

Design Review

The design portion of the inspection

was conducted at the corporate

headquar-

ters of American Electr ic Power Service Corporation

(AEPSC) in Columbus,

Ohio.

The team evaluated

the technical

adequacy

of the design,

compliance with

regulations

and licensing

commitments,

and the effectiveness

of the design

controls.

The evaluation

was accomplished

by review of drawings, specifica-

tions, calculations,

engineering

and design control procedures,

modification

packages,

and interviews with the licensee

engineering staff and all levels of

licensee

management.

The team reviewed in detail approximately

5 engineering

calculations

in the electrical discipline,

20 in the mechanical discipline,

and

10 in the instrumentation

and control (I&C) discipline.

In addition to reviewing various diagrams,

calculations,

engineering

proce--

dures,

and design modification packages,

the team evaluated

the engineering

organization

and experience,

interdiscipline coordination,

and engineering

--.

support for operation-related activities.

The engineering

and technical

support to the operating staff was adequate.

2.1.1

Design Control and Independent

Design Verification

The team found that independent

design verifications were either not performed

or were performed inadequately

for original plant design calculations, test

reports

and drawings,

and design

documents resulting from design

changes

and

design activities subsequent

to plant licensing.

The

NRC staff had identified the absence

of independent

design verification

during

a 1989 inspection.

A licensee-sponsored

SSFI inspection of the Unit 1

auxiliary feedwater

(AFW) system in 1987

had resulted in the

same finding.

In

response

to the finding, the licensee instituted

a program for independent

design verification in 1989.

The team found that the program -properly incorpo-

rated the requirements

of 10 CFR Part 50, Appendix B, and the American National

Standards

Institute (ANSI) Standard

N45.2.11-1974

but that the licensee

had not

effectively implemented the program.

Calculations

performed after the

new program was implemented in both electrical

and mechanical

designs either did not receive

an independent

design verifica-

tion or received

an improperly performed verification.

In addition, verifica-

tion of many post-1988 calculations

were accomplished

by the verifier stating

not applicable

(N/A) for each of the verification items

on the independent

verification forms.

Some of the verification questions

noted

as

N/A related to

the correctness

of the calculation inputs, application of proper codes to the

calculations,

and the validity of information relating to design

and environ-

mental conditions.

Hany of the calculations

the team reviewed

had been

based

on unverified assumptions,

and the licensee

did not have

a program to track

these

assumptions

to ensure verification before declaring the affected safety

system(s)

operational.

Although previous inspections

had indicated that the independent

design verifi-

cation program was deficient, the licensee failed to correct this problem and

to implement an effective verification program.

Title 10 CFR 50, Appendix B,

Criterion XVI, required that measures

be established

to ensure that conditions

adverse to quality are promptly identified and corrected in a manner to

preclude repetition

(see Appendix A, Unresolved Item 90-201-01).

Several

examples

where inadequate

design verification contributed to design

deficiencies

are listed below with reference to subsequent

report sections

in

which each is discussed

in more detail:

Undersized

4-kV electrical cables

(Section 2.1.2);

Undersized

4-kV circuit breaker current interrupting capacity

(Section 2.1.2);

Improper inverter voltage qualification (Section 2.1.2);

Incorrect service water system relief valve settings

(Section 2.1.3);

and

Inadequate

setpoint

program (Section 2.1.4).

The following examples of original calculations that did not receive

indepen-

aent design verification but were subsequently

verified by the liceiisee during

the inspection period are discussed

in Section 2.1.3:

Essential

service water flow requirements

during a fire scenario,

calcula-

tion No. HXP890720AF;

.

Essential

pump potential runout, calculation

No. HXP900613;

and

Essential

pump room temperature

calculation

No.

DCCHV12ES.

The lack of traceability and validation of design input, the lack of design

document control, and lack of independent

design verification indicated weak-

nesses

in the licensee's

capability to maintain design control for the plant.

The team concluded that the quality assurance

requirements for the design of

nuclear

power plant structures,

systems,

arid components

as delineated

in 10 CFR Part 50, Appendix B, and ANSI N45.2.11-1974

were not properly implemented in

the plant design

and design

change activities in accordance

with licensee

commitrrents.

Title 10 CFR 50, Appendix B, Criterion III, requires that the

adequacy of designs

be verified by the performance of design reviews,

by use of

alternate or simplified calculations,

or by testing

(see Appendix A, Unresolved

Item 90-201-02).

2.1.2

Electr i ca 1 Systems

The team reviewed the

power

source

and distribution system for the

ESW system

as well as design documentation for motors,

loads,.and circuit breakers

needed

for the operation of the

ESW system equipment.

The team identified deficien-

cies in the design basis calculations.

The subject calculations

were indica-

tive of inadequate

design verification as described

in Section 2.1.1 of this

report.

However, these deficiencies

did not affect the operability of the

system.

Specific concerns with the electrical

system design are described

below.

The neutral

ground for the emergency

diesel

generator

(EDG) was grounded

through

a 6-ohm resistor

equipped with a ground detector relay.

This relay

I

~ I

would trip the

EDG output breaker if a ground fault occurred;

however, the trip

function is required to be bypassed

following initiation signals for either

a

loss-of-coolant accident

(LOCA) or a loss-of-offsite-power

(LOOP) cond)tion.

A

ground fault under either of these conditions could result in a fault current

of 400 amps or about

960

kW (about

27 percent of the nominal

EDG rating), with

no protective action until the resistor failed, interrupting the current.

Under the most conservative

condition this would result in an additional

load

of 48

kW.

The initial 1CD

EDG sizing calculation

was unconservative

because

low service

factors were assigned

to cyclic loads such

as the boric acid tank heaters

and

the boric acid heat trace

and load center transformer efficiencies were

omitted.

The licensee

performed another calculation for EDG sizing during

this inspection which accounted for transformer losses,

cyclic loads

and

increased

loading of approximately

48

kW as

a result of an undetected

ground

fault.

The result of this calculation indicated that the load for the

1CD

EDG

was approximately

3590

kW, thus exceeding

the continuous rating of 3500

kW, but

below its 2,000 hour0 days <br />0 hours <br />0 weeks <br />0 months <br /> rating of 3650

kM during

LOCA and

LOOP conaitions.

8ecause

the latest calculation

was conservative

in its use of assumptions,

the

team a9reed that the

EDG would meet its maximum load demands.

However, the

team noted that the licensee

had not performed

dynamic analysis to determine

actual fluctuations of EDG loads.

The licensee

stated that

EDG dynamic

analysis

would be performed.

The specifications for Class

1E vital instrument

power inverters stated that

the inverters were qualified to operate at a minimum of 210 Vdc at the input

terminals.

The team found that the end-of-life voltage at the battery termi-

nals would be about 210 Y; therefore,

a lower voltage would exist at the

inverter input terminals

due to the line loss between the battery

and the

inverter.

The licensee

performed calculations

during the inspection,

but the

new calculations

used

an incorrect battery charger output voltage

(250 V) as

an

initial battery condition, even though the battery

charger

would be unavailable

during

LOCA and

LOOP conditions.

The licensee

was reevaluating

the analysis at

the close of the inspection

and expected to obtain confirmation from the

inverter vendor that the units were qualified to operate at the lower,

end-of-life voltage of approximately

200 V.

The licensee

stated that

a

calculation will be performed to show inverter qualification to 200 Vdc (see

Appendix A, Urresolved Item 90-201-03).

As a result of voltage drop considerations for the inverters,

the team reviewed

a voltage drop calculation for the'cable that feeds

dc power to the steam-

driven

AFW pump feedwater inlet valve motor to assess

the adequacy of the motor

terminal voltage.

The worst-case

terminal voltage at the motor was

178 Vdc.

Valve vendor technical information only provided

a single nominal value of

250

V for the terminal voltage.

The licensee

could not substantiate

the

adequacy

of the lower voltages to the valve motor.

The team was concerned with

the operability of the

AFW pump inlet valve during the battery end-of-life

period.

Since the batteries

were installed in 1986,

no immediate safety

concern existed.

However, Technical Specification Section 3.7.12 required that

the turbine-driven

AFW pump be operable while the plant was in modes 1, 2,

and 3.

The team considered this to be an unresolved

item (see Appendix A,

Unresolved

Item 90-201-04).

Cable sizing calculations did not verify the capability of the

ESW pump feeder

cable to withstand effects of short circuit currents until these currents

were

interrupted

by the upstream breaker.

The licensee's

short circuit calculation

indicated that, if a short circuit occurred at the motor terminals,

the value

of the fault current could be 20,940

Amps.

Using an alternate

method

(ICEA

Publication

page 32-382, "Short Circuit Characteristics

of Insulated

Cables" ),

the team estimated that, for a fault at the motor terminals,

cable conductor

temperature

could rise to damaging

levels before the upstream

breaker

opened

the circuit.

This appeared

to be

a generic design

problem for all of the

safety-related

cables.

However, the team verified that

a single failure due to

a short circuit would result in the loss of a single piece of equipment,

and that redundant

equipment would not be damaged.

Therefore,

no immediate

safety concern existed.

However, the licensee

agreed to review this issue.

Short circuit calculations

had not been performed for the 4160-Y Class lE

buses.

As a result of this inspection,

the licensee

per formed the calcu-

lations.

The calculations indicated that the breakers for the safety-related

and nonsafety-related

4-kV buses

were undersized.

For the 4160-V safety-

related buses,

the maximum calculated short circuit duty was found to be about

69,000

Amps, but the installed breakers

were rated for a maximum of 60,000

Amps.

The calculation did not consider the short circuit contribution from the

EDG or higher

(5 percent)

operating voltages,

which could result in short

circuit currents of almost 75,000

Amps, and possible breaker destruction or the

melting and fusing of contacts.

Although the licensee

was aware of the

undersized

breakers, it had not analyzed the effects of such breaker failures.

The team verified that the loss of a breaker would not affect redundant

equipment.

Therefore,

no immediate safety

concern existed.

However, the

licensee

agreed to review this issue.

2.1.3

Mechanical

Systems

and Components

The team evaluated

calculations

and design documentation

associated

with the

ESW system.

The calculations

indicated

inadequate

design verification as

described

in Section 2.1.1 of this report.

Specific concerns with the mechani-

cal engineering

and design

documents

are described

below.

The design documentation

indicated that the thermal relief valves

on the

component

cooling water heat exchangers,

diesel

generator

heat exchangers,

and

containment

spray heat exchangers

had been set at 150 psig while the piping

system design pressure

was

105 psig.

This was inconsistent with the American

Society of Hechanical

Engineers,

Boiler and Pressure

Vessel

Code

(ASNE Code),

Section III, Article ND7000, which required that the set pressure

of the relief

valves

be at, or lower than, the design pressure.

The licensee

stated that the

relief valve setpoints

would be lowered to 105 psig.

No documented

basis

was available to substantiate

the, values for ESW system

design pressure.

The

ESW system description

(SD-DCC-HP102, Revision 9)

provided the design pressure for the duplex strainers

as

125 psig.

The vendor

specification sheets for the heat exchangers

provided the design pressures

for

the heat exchangers

as

150 psig,

and the piping material specification

(DDC PV112 gCN, Revision 0) specified the piping design pressure

as

105 psig.

The

ESW pump performance

curve calculation

(TC-1774 dated September

23,

1971)

showed the

pump shutoff head

as

245 feet (approximately

106 psig).

On the

~I

~

basis of the measured

pump shutoff head of 245 feet,

and considering

the

allowances for the instrument calibration errors in the

pump head measurements,

the piping'design

had little or no calculated

margin.

However, the

ESW system

piping wall thickness

was based

on the standard

weight pipe wall thickness,

which can withstand

much higher pressures

than the

ESW pump shutoff head and,

as noted above,

the system

components

other

than piping were designed for

higher pressures,

so the team considered that no significant safety

concern

existed.

Two inconsistencies

were found between the piping material specification

DCC PY112 gCN, Revision 0, and the system flow diagram 1-5113-30,

Revision 30.

First, the system flow diagram

showed that all the safety-related

piping for

the

ESW system

was piping Class A-12.

However, the piping material specifica-

tion iaentified only the containment

spray heat exchanger

piping, the

AFW

cross-connecting

piping, and component cooling water heat exchanger

piping as

Class A-12.

Second,

the system flow diagram

showed that the maximum discharge

pressure

of the

pump was

120 psig.

However, the piping material specifica-

tion showed the maximum design pressure

of the piping as

105 psig.

The

licensee

agreed to resolve the inconsistencies.

Three different seismic analysis reports were found to be applicable for the

same

ESW pump.

Two of these reports

were apparently

prepared

by the

pump

vendor at the time of procurement,

and the third report was prepared

in 1976 by

a licensee contractor.

None of the analyses

had been annotated

to indicate

which was effective.

The licensee

committed to resolve this discrepancy

by

maintaining the

1976 seismic analysis report as the design-controlled

document.

The design calculation for ESW flow under normal operating conditions (dated

September

11, 1972)

showed that the flow through the system using

one

ESW pump

per unit was less

than the required flow.

The licensee

had taken

no action to

resolve this concern before plant licensing.

During this inspection,

the

licensee

performed

a new design calculation

(HXP900627), using the system

resistances

as calculated

in 1984 for calculation

HXP841106,

and demonstrated

that the

pump could supply adequate

system flow.

The team identified a number of additional calculational

weaknesses

attributed

to an inadequate

design verification program.

In each

case,

the licensee

was

able to perform a supplemental

calculation during the inspection to show design

adequacy.

Calculation

HXP890720AF was performed to determine whether

one

pump could

supply the

ESW flow requirements

during a scenario with a fire in one unit

and with the opposite unit maintaining the capability to shut

down

(10 CFR 50, Appendix R).

The calculation did not consider the effect of

full ESW pump lift, the effect of pressure

drop across

the strainer,

and

the full component cooling water

design flow to the residual

heat

exchangers.

The licensee

performed supplementary

calculation

HXP900628

to consider these

issues

and concluded that one

pump could supply

ESW flow requirements.

Because of questions

about the boundaries

of different piping classes,

the

team questioned

whether

ESW pump runout could occur if a nonsafety-related

Class

A-31 pipe broke at the point where it interfaces with safety-related

Class A-12 piping.

The licensee

performed

a

new calculation

(HXP900613AF)

assuming

a break

on the return piping at the exit to the turbine building

and concluded that the

pump would not run out.

~I

~ r

o

To determine the

ESW pump room temperature,

calculation

DCCHV12ES02N

assumed

the screen

house

maximum temperature

tu be 104'F based

on

operational

experience.

However, the licensee

could not provide documen-

tation of the operational

experience

and subsequently

performed

a supple-

mentary calculation to justify the assumption.

Calculation

HXP841106 demonstrated

the capability of the

ESW system to

meet flow requirements for one unit at full power while a

LOCA was occur-

ring in the other unit.

However, the calculation did not consider

the

effect of full ESW

pump lift and pressure

drop across

the strainer.

The

licensee

performed supplementary

calculation

HXP900626AF during the

inspection

and the results,

although not verified or approved,

were found

to be acceptable.

2.1.4

Instrumentation

and Control

The SSFI

team reviewed the

ESW system electrical

schematic

diagrams,

instrument

calibration and setpoint records,

automatic controls, indication, alarms,

protective relaying and interlocks,

and power supplies for motors

and control

circuits.

The team identified weaknesses

in setpoint calculation methodology

and in the control of installation and maintenance

of safety-related

com-

ponents.

However, these

weaknesses

did not affect the operabi lity of the

system.

The team's

review of instrument setpoint calculations

involving the

ESW system,

reactor

protection system,

and component cooling water system indicated that

existing setpoint values

were within acceptable

values.

However, the estimated

accuracy

was not provided or

was incompletely modeled in most instances.

Procedures

employed since

1973 for the format, content,

and control of the

calculations

appeared

to be inadequate

to produce

a technically complete

and

comprehensive

instrument setpuint calculation for safety-related

instrument

application because

they contained insufficient guidance for the instrumenta-

tion and control (IhC) engineer.

Consequently,

the team found the following

inadequacies

in the setpoint calculations:

Setpoint accuracy

tolerances

either did not exist or had

no basis stated.

None of the calculations

accounted for the effect of a seismic event

on

the setpoint

and its tolerance.

None of the calculations

considered

the effect of radiation

on setpoint

tolerances,

where appropriate.

Over half of the calculations aid.not contain

a value for anticipated

instrument drift.

Approximately one-half the calculations did not address

the amount of

hysteresis

between

a trip setpoint

and the subsequent

reset value.

None of the calculations

contained stated

assumptions

that would normally

be subject to confirmation from operating plant tests or vendor tests.

Most of the calculations

were deficient in identifying the method used for

verification and on the actual

implementation of the independent

design

verification process.

Approximately half of the calculations did not use the Westinghouse

methodology

and the alternative

method for the calculation

was not ident)-

fied or justified.

No specific setpoint errors in plant systems

were identified'y the team.

The

licensee

stated that the setpoint calculation procedure will-be improved using

the guidance of Regulatory

Guide 1.105, "Instrument Setpoints for, Safety-

Related Systems,"

Revision 2, February

1986.

During the review of applicable drawings

and specifications

the team identified

instances

where nonsafety-related

components

were installed in safety.-related

applications of the

ESW system.

In order to assess

the extent to which

nonsafety-related

components

were installed in safety-related

systems

other

than the

ESW system,

the team expanded its review to the instrumentation

and

control components

of the safety injection system accumulator tanks. =-Subse=

quently, the team identified solenoid valves installed in the air-operated

control valves associated

with the fill, vent,

and drain line of the=accumu-

lators which may not have met the environmental qualification requirements for

their specific application.

The team also noted

one example where the equip-

ment, in this case thermostats,

was purchased

and installed

as safety-related

equipment,

however,

no maintenance

and surveillance testing

had been performed

on the equipment for approximately

15 years.

The team verified that the misuse

of components

in the subject

examples

did not impact the safe operation of the

affected equipment.

However, the team was concerned with the licensee's

ability to control the purchase,

installation,

ana maintenance of components in

safety-related

applications.

The following specific examples of improper

designation of components

were identified by the team.

Pressure

indicators

(1-WPI-707, 1-WPI-705, 2-WPI-708, 2-WPI-706) were replaced

on each of the

ESW pump discharge

headers

in the

ESW pump tunnel during late

1989.

The replacements

were classified

as nonsafety-related

instruments.

The

instrument root valves

between the instruments

and the safety-related

piping were maintained in an open position.

An internal

AEPSC letter dated

August 21, 1989, stated that these

pressure

indicators

had no safety function.

AEPSC subsequently

developed

a calculation

(HXP900613PDC)

showing that follow-

ing a pipe failure at the interface

between the instruments

and the

ESW header,

the leakage into the pipe tunnel would be 120 gpm.

The team determined that

the

120

gpm leakage

would not degrade

the safety function of the

ESW system.

The elementary

diagram for the

10 CFR 50, Appendix B, Criterion V.

pump and discharge strainer controls

and

interlocks indicated that electrically operated

solenoid valves that control

instrument air for control valves in the strainer

backwash circuit were not

identified as safety related.

These solenoid valves were connected directly to

a Class lE safety-related circuit.

Failure of these

solenoid valves as

a

result of shorted windings would cause

a series of 8 Amp fuses to open, dis-

abling both manual

and automatic

backwash of the strainers.

The team verified

that the failure of the fuses would not affect the operability of the

100 percent capacity,

redundant,

standby

ESW pumps.

Accumulator tank solenoid valves associated

with tank fill, drain,

and ventila-

tion valves

IRV-100, IRV-ill, IRV-112, and GRV-341 were designated

as not

safety related in the facility data

base

(FDB) and were assumed

to reposition

to their normally closed, fail-safe state

on loss of air or electric power.

However,

such solenoid valves located within the containment are subject to a

postulated

cordon-mode failure from either

a seismic event or a small-break or

large-break

LOCA.

Unqualified solenoid valves under these

environmental

conditions could be postulated to fail open,

causing the concurrent

loss of all

safety injection accumulator

tanks for both units.

Although the team consid-

ered this nonmechanistic multiple failure to be of low probability, the

requirements

of 10 CFR 50.49 regarding the qualification of nonsafety-grade

electrical

components

need to be evaluated

by the licensee.

Two thermostatically controlled venti lation fans were provided in each

ESW pump

room to provide cooling of the

pump motors.

The design basis

maximum ambient

temperature for the

pump motor was determined to be 125'F per calculation

DCCHY12ES02N, the normal fans at 90'F rising temperature

and the backup fans

at 95'F.

Each

ESW pump room also

had

a high temperature

alarm set at 105'F

for temperature

switches

VTA-701, VTA-703, VTA-705, and VTA-707, respectively.

Licensee

Problem Report 90-621

(Hay 22, 1990), identified that fan temperature

switches,

which had been

purchased

as safety related,

had not had preventive

maintenance

or periodic calibration performed since they were installed.

The

eight temperature

switches

were calibrated

on June 4, 1990:

one was in a

failed state

and six others

were outside the acceptable

calibration band.

During the inspection,

the licensee

prepared

documentation to establish

a

24-M nth calibration interval for the fan temperature

switches.

During the inspection,

the team noted that a significant number of components

in the

ESW system

(such

as pressure

indicators

and electrical solenoid valves)

were incorrectly designated

as not safety related in the

FDB (9-List).

The

licensee

had earlier identified the incorrect classification of the

ESW venti-

lation temperature

switches

and subsequently

provided several

other examples

where they had detected

and corrected similar FDB errors over the past several

years.

2.2 Operations

The team assessed

the

ESW system operations

to evaluate

the adequacy of proce-

dures,

equipment,

and training available to plant operations

personnel

to

ensure

the operability and reliability of the

ESW system.

2.2.1

Procedures

During its review cf the operating,

abnormal,

emergency

operating

and

annunciator

response

procedures

that pertained to the

ESW system,

the team

conducted control

room ana field walkdowns of procedure activities.

The team

identified minor procedural

weaknesses,

and the licensee,

in all instances,

a9reed to initiate corrective actions.

Several

procedural

discrepancies

were

corrected before the close of the inspection.

The weaknesses

described

below were found as

a result of the review:

The

ESW system description

and Section 9.8.3.2 of the

FSAR referenced

the

capability to open motor-operated

sluice gates

and provide additional

capability to access

Lake Michigan and to ensure

continued operation of

the

ESW system should the screen

house forebay, which is supplied

by three

intake pipes,

be isolated from the lake.

However, this mode of operation

was not incorporated into existing plant procedures.

Procedure

10HP4024.104,

"Annunciator ¹104 Response:

Essential

Service

and

Component Cooling, Drops

55 and 65," Revision 7, did not identify partial

misalignment of the strainer inlet and outlet gates

as

a cause of the high

differential pressure

alarm.

The following weaknesses

were identified in procedures

associated

with the

plant alternate

shutdown capability.

These

procedures

responded

to the require-

ments of 10 CFR Part 50, Appendix R, Fire protection,

and will be evaluated

as

part of an upcoming regionally based

inspection effort.

Procedure

120HP4023.001.001,

"Emergency

Remote Shutdown," Revision 8,

contained instructions

and responses

for an alternate

method of achieving

safe

shutdown in the event that equipment

could not be controlled from

the control room or hot shutdown

panel

because

of fire or other event.

However, there

was

a discrepancy

between Attachment R-4 (Section R-4-1

and R-4-2, restore

ESW pumps) of this procedure

and Procedure

120HP4021.019.001,

"Operation of the Essential

Service Water System,"

Revision 8, with regard to the discharge

valve position before

pump start.

In addition, the availability of tools and equipment to conduct modifica-

tions to restore

the

ESW pump room exhaust

fans to service

and perform

modifications to enable local control of individual

EDGs were not speci-

fied in the procedure.

The licensee

agreed to review the procedure

and

make the necessary

corrections.

Procedures

120HP4023.032.002

and .003,

"AB Diesel Generator

Local Control," and

"CD Diesel Generator

Local Control," Revision 0, Sheet

2 contained

instructions to establish

local control of individual

EDGs in the event of

a fire in the cable spreading

room.

However, the procedure did not

adequately

relate the procedure entry conditions to the emergency

remote

shutdown procedure.

The licensee

indicated that the emergency

remote

shutdown procedure

should take precedence

in the event of a cable spreaa-

ing room fire and stated that the entry conditions would be corrected.

2.2.2

Control

Room Drawings

Operations

personnel

used the drawing records maintained in the Unit 1 and

Unit 2 control rooms.

The drawing files were maintained

as microfiche cards

rather than hardcopy prints and reader/printers

were available for the opera-

tors'se.

The Shift Supervisor's office contained

the

same type of drawing

files outside th~ control room complex.

Full-size, hardcopy prints were

available only from the document control area.

10

The team noted that the microfiche cards

and the copies obtained from the cards

were difficult to read in some instances.

Improved reader/printers

were

installed in the control rooms for both units during the inspection period.

The inspectors verified that the

new equipment

enhanced

the quality of the

prints.

2.2.3

Haterial Condition of Equipment

The

ESW pump rooms and areas

containing equipment cooled by

ESW were found to

have

good housekeeping,

except for a few isolated instances.

Equipment

material conditions, for the

ESW and adjacent safety-related

systems

were found

to be adequately

maintained.

Equipment labeling was especially

good and the

team considered this a licensee

strength.

Although several

instances

of

packing leaks,

missing or inadequate

bolts or screws,

clogged floor drains,

and

loose sensing

line supports

were observed,

the licensee

promptly initiated

corrective action in the form of maintenance

job orders for these

items.

During the tour of the motor-driven and turbine-driven

AFW pump rooms, the team

noted that six

ESW system Cell-tale valves

(ESM-110,

ESW-116,

ESW-140,

ESW-146,

1-ESM-244 and 2-ESW-244)

had locks and metal chains

as opposed to seals

and

plastic chains or cables

as specified

by procedure

120HP4030.STP.035,

"Cori-

trolled Valve Position Logging,."

The licensee

replaced

the metal chains

although its evaluation of the safety significance of using the metal chains

and locks was not adverse to safety.

Valves 2-ESW-140

and 2-ESW-146 in the

AFW

pump rooms

and valve 2-ESW-171S,

associated

with the control room air con-

ditioning system were improperly chained

and locked such that the intent of the

locking device could have been defeated

by removing the chain.

The licensee

took prompt corrective action by properly locking the valve operators.

During the tour of the component cooling water

(CCM) heat exchanger

areas for

both units, the team noted several

instances

where bolts used to attach

the

Limitorque valve operators to the butterfly valve yokes for

ESM inlet and

outlet valves to the

CCW heat exchangers

(valves

WMO-731 through -738),

appeared

tu have inadequate

thread

engagement.

In addition, the bolts used for

valves

1 Mtt0-731, 1-MN0-733, and 2-MYi0-734 had

an incorrect head configuration

for use with the valve yoke flange.

The licensee initiated job orders to

correct the deficient conditions.

On the basis of this finding, the licensee

performed

a review of other motor-operated butterfly valves in the

ESW and the

CCW systems

and found additional instances

of inadequate

thread

engagement for

operator-mounting bolts.

Engineering evaluations of the as-found conditions

concluded that safety functions of the valves would not be compromised.

A

definition of adequate

thread

engagement for threaded

fasteners

was not con-

tained in maintenance

procedures

or other plant documentation.

The licensee

stated that

a procedure detailing bolting practices will be prepared

and

provided to maintenance

personnel.

2.3

Haintenance

The team assessed

the adequacy of ESM system maintenance

to ensure

system

operability under accident conditions

by system walkdowns and observations

of

maintenance

in progress.

The team also reviewed maintenance

procedures,

vendor

manuals,

and the preventive maintenance

program and activities as they applied

to the system parts,

and material control, post-maintenance

testing, engi-

neering

and technical

support,

personnel training,

and maintenance

program

documentation.

~ ~

I

2.3.1

Procedures

and Vendor Manuals

The programs for administrative

and technical

procedures

in the maintenance

area

were described

in Plant Manager Instruction (PNI)-2010, "Plant Manager

and

Department

Head Instructions,

Procedures,

and Associated

Indexes,"

Revision 16,

and in various maintenance

department

procedures

and instructions.

The

licensee

had established

both equipment-specific

and generic maintenance

and

repair instructions for the major

ESW system

components.

However, the

NRC

and licensee

reviews of maintenance

had found that these

procedures

required

significant improvement in technical

content

and ergonomics to meet current

inaustry standards.

In 1989, the licensee initiated a major procedure

upgrade

program to rewrite existing maintenance

procedures

to address

human factors,

vendor requirements

and recommendations,

quality attributes,

and deficiency

identification.

The program was recently initiated and the writer's guide,

policy instructions,

and administrative procedures

were still in unapproved

form.

The licensee

had

a 1992 completion target date for the program.

Maintenance

Head Instruction (NHI)-5030, "Preventive Maintenance

Program

and

Environmental gualification Program," Revision 12, was being replaced

by a

long-term reliability-centered maintenance

(RCM) program scheduled for comple-

tion in the next

2 to 5 years.

The team reviewed the maintenance

head procedures

(NHPs) and instrument

head

procedures

(IHPs) which provided both administrative

and work instructions for

the

kSW pumps,

power-operated

valves,

check valves,

ESW. system instrumentation

and controls, motor control centers,

4-kV circuit breakers,

EDGs, station

~

batteries,

and completed job orders

and tests.

While major programmatic

improvements

were being

implemented in all areas of maintenance,

the team found

that the following procedural

weaknesses

existed:

Procedure

12NHP5021.032.026,

"Emer gency Diesel

Engine Inlet and Exhaust

Hydraulic Valve Lifters Inspection

and Testing," Revision 1, provided

instructions for a "leakdown" test of the hydraulic lifters'nternal

check valves with an acceptance

criterion of 12 to 120 seconds.

This

criterion deviated from the requirement of a maximum 35-second

leakdown

time stated in the Worthington Company's Instruction Manual for Type

SWB-VEE Diesel Engine, Hydraulic Valve Lifters section

(page 28).

When advised of this technical

manual discrepancy,

the licensee

produced

a vendor letter dated

March 19,

1984, which authorized the

120-second criterion.

This letter was not included in the controlled

vendor information/manual file, which was contrary to Procedure

12PNP2030

VICS.001, "Control of Vendor Documents,"

Revision 2.

This

procedure established

a vendor information control system

(VICS), and

Section 5.0 of that procedure required that all vendor information,

including bulletins, letters,

vendor manuals or revisions,

be processed

and controlled to ensure their proper availability and use under the

licensee's

document control system.

Procedure

12NHP5021.032.025,

"Emergency Diesel

Engine Timing and Balanc-

ing," Revision 1, provided instructions for adjusting exhaust

temperatures

and for obtaining measurements

and adjustments

in compression

and

combus-

tion pressures.

During testing

on June

13,

1990 of the lAB EDG following

replacement of cylinder 3R valve lifters, the procedure

was not available

12

at the job location and was not used to connect or use the drum-type

cylinder pressure

indicator.

PMI-2010, "Plant Manager

and Department

Head

Instructions,

Procedures,

and Associated

Indexes,"

Revfsion 16, Section

3.1.1, required that procedures

having

a double-asterisk

designation

such

as procedure

12HHP5021.032.025

be present

and used at the job site.

The licensee's failure to follow procedures

did not meet the requirements

of

Criterion

V required that activities

affecting quality be accomplished

fn accordance

with appropriate

proceaures

(see Appendix A, Unresolved

Item 90-201-05).

2.3.2

System/Component

History

The team noted several

adverse

trends involving repetitive maintenance

on

spring-loaded

check valve maintenance,

butterfly valve maintenance,

and

pump.

In each

case the licensee

was responsive

and demonstrated

that remedial

action was either complete or in progress.

The licensee

had not fully imple-

mented

a root-cause

analysis

program;

as

a result, the licensee's

actions

were

largely responsive

to equipment

symptoms rather than cause.

Maintenance history for the

ESW inlet and outlet valves to the

CCW heat

exchangers

for Units

1 and

2 showed that six out of the eight valves

(1/2-WMO-

731 through 738) were 16-inch butterfly valves manufactured

by Henry Pratt

Company.

These

were replacement

valves for the six valves originally installed

and manufactured

by Center line.

The other two valves were Centerline valves,

one of which had been replacea with a new Centerline valve in 1982.

Job Order (JO) 728163

was performed fn June

1989 to replace the Centerline

valve in position 1-WHO-735 with a Pratt valve.

The

JO documentation

showed

that one and possibly all of the pipe flange bolt holes were enlarged

from

1 1/8 to

1 3/16 inches to achieve alignment with the valve bolt holes.

No

indication of engineering

review or evaluation of this modification was evi-

denced in the

JO documentation,

and the licensee

could not find arly documented

follow-up of this change.

The team was concerned that changes

in plant config-

uration of safety-related

equipment could be performed

by maintenance

personnel

without evaluation of the safety significance of the change

by supervision or

engineering.

The team observed that the replacement

of a Centerline

Company butterfly valve

with a valve manufactured

by the Henry Pratt

Company

on the

ESW inlet to the

Unit 1 west

CCW heat exchanger

had been performed

as

a maintenance

JO rather

than

a design

change

JO.

The licensee

had received

a Notice of Violation fn

1988 for replacing parts

and components

with those from another manufacturer

without designating

the work as

a minor modification and performing

a safety

evaluation in accordance

with PMP5040MOD.002,

"Minor Modifications," Revision 2.

JO 728163

was initiated in August 1987 but the physical valve replacement

was

not performed until June

1989.

Thus, the valve replacement

under

a maintenance

JO constituted

an apparent

repeat violation.

The licensee's

continued failure

to properly designate

and evaluate

minor modif'ications in accordance

with the

requirements

of the subject procedure is another

example of lack of prompt cor-

rective action of a deficiency adverse to quality (see Appendix A, Unresolved

Item 90-201-01).

13

IKC calibrations of

ESW instruments

had repeatedly

found instruments

out of

calibration with as-found errors of 4.5 to 11 times the allowable tolerances.

No evaluation of as-found instrument drift conditions

and no adjustment to

calibration frequencies

were made

by the licensee.

Specific examples

included:

The

ESW header

pressure

switch,

1-WPS-701,

had an as-found error of

4.5 percent (high) versus

1 percent allowable during

a February

1989

calibration.

The pressure

switch was used for starting-of the standby

pump on low header

pressure

and

had

a nominal 48-month calibration fre-

quency.

The instrument

was recalibrated without further evaluation.

Similarly, the setpoint for the

ESW strainer differential pressure

alarm,

1-WDA-701, had

an as-found setpoint

10 percent over the required

maximum

allowable setpofnt.

The calibration tolerance

was

1 percent.

Thl's

instrument provided

an alarm when the strainer

had fouled and backwash--had

failed.

Similar out-of-tolerance

data were found for instruments

1-WPA=701,

2-WPI-708, 2-WFI-712, 2-WFA-706, and 1-WFA-703.

Data for ESW-safety-

indicated that a significant fraction (20 to 25 percent)

had been fourid out of tolerance for two or more of their most- recent

calibrations.

The licensee's

current calibration program as described

by procedure

12IHP6030IMP.044,

"Instrument Data System Preventive

Maintenance

Program,"

Revision 15,

became effective in early 1989.

The procedure

provided for

tracking the acceptability of as-found instrument data

and for adjusting the

frequency of testing if those instruments

had been found unacceptable for

three consecutive calibrations.

8ecause

the program did not incorporate the

pre-1989 calibration data,

no adjustments will be made until at least three

calibration intervals of 4 years

each

(a total of 12 years from 1989-90)

have

elapsed.

Although the licensee

indicated that these considerations

were

included in the planned reliabi lity-centered maintenance

program, there were

no

immediate plans to evaluate

the instrument performance

tracked

by this proce-

dure, which was considered

a weakness

in the licensee's

control of

safety-related

instr'uments.

2.3.3

Spare Parts

and Mater ial Control

The team reviewed the licensee's

methods of controlling material

used in

safety-related

applications,

focusing on the control

and replacement of fuses

in safety-related

circuits, use of all-thread stock as threaded fasteners,

and

storage of weld rod.

The licensee

maintained

segregated

areas for certified

and open stock stores

items within the plant area.

Storage of larger items fn

remote warehouses

was well-controlled with clear designation of safety-related

versus nonsafety-related

items.

However, the supply of fuses maintained

by

operations

were riot traceable

to certification documentation.

The team

revfewea several circuits that use fuses,

including 4-kV and smaller circuit

breakers

and circuits for containment isolation valves.

The diesel generator

test

bank breakers

contained

a mixture of controlled and open stock fuse types

in the control circuitry, while the containment isolation valve circuitry

contained

a large

number of certified fuses,

but of a type that could be replaced

with open stock fuses.

During the inspection,

the licensee

established tighter

controls

on fuse replacements

by operators

to ensure that only certified fuses

would be placed in safety-related circuits.

14

2.3.4

Engineering Support

Plant engineering

support

was centered

in two groups within the plant organiza-

tion within the past year.

The plant engineering

group, under the Technical

Support Manager,

was responsible for all plant engineering activities,

such

as

system engineering,

predictive maintenance/performance

testing, reactor engi-

neering,

and engineering

support functions.

The project engineering

group,

under the Projects

Manager,

was responsible for coordinating all outage activi-

ties

and design

change activities,

such

as requests for change,

minor modifica-

tions,

and plant modifications.

The system engineering

positions were about

50 percent staffed at the time of the inspection

by existing plant personnel

that had been assigned

to specific systems

in early 1990.

The goals

and res-

ponsibilities set forth for the system engineers

were oriented to safe, effic-

ient,

and reliable functionality of the assigned

systems

as opposed to design-

related functions.

As such, the system engineering

program appeared

to be

consistent with programs established

by other utilities.

In practice,

the

system engineers

appeared

to rely heavily on the input of the corporate engi-

neering organization for design-related

questions.

The team also noted that

the system engineering

group was not yet functioning at the desired maturity

level and was not performing all the intended functions efficiently.

The

AEPSC Nuclear Design Group had

a representative

organization

on site, the

site design organization.

This organization

served

as liaison between the

plant site and the corporate

design

group with regard to design questions

and

concerns

and design

change activities involving the

AEPSC organizations.

The

site design organization also coordinated the updating

and revision of opera-

tions series

drawings to ensure that these

drawings were properly revised

before design

changes

were turned over to operations

personnel.

This organiza-

tion has

been available

on site for several years

and appeared

to be function-

ing well.

2.3.5

Drawing Updates

The team noted that while the control room drawings were maintained

up to

date,

the engineering

organization

had

a backlog of approximately

2000 drawings

that required updating to incorporate

design

changes that had been

implemented

in the field.

Most of these

drawings were associated

with balance-of-plant

systems rather than safety-related

systems

and equipment.

The licensee

stated

that the backlog of pre-1990 drawing changes

(some extending

as far back as

1984) would be eliminated

by January

1991

and

a 60-day turnaround

on all

drawing revisions would be achieved

by January

1992.

Priority will be given to

safety-related

drawings affected by design

changes

to ensure

updated

design

information was employed

by design engineers.

Maintenance craft and other plant personnel

assumed

that the latest controlled

drawing revision reflected as-built plant conditions when, in fact, the drawing

could be affected

by one or more implemented

design

changes

that had not yet

been incorporated into the arawing.

Out of the

36 drawings reviewed in the

satellite maintenance

library, 6 were not the latest revisions.

The licensee's failure to maintain the latest revision of drawings in the

maintenance

drawing library was contrary to the requirements

of procedure

PMI-2030, "Document Control," Revision

11 and to 10 CFR Part 50, Appendix B,

15

~I

e

0

Criterion VI, which requires

measures

to be established

to control changes

to drawings that prescribe activities affecting quality.

(see Appendix A,

Unresc 1ved Item 90-201-06).

2.3.6

Root-Cause

Analysis

AEPSC general

procedure

(GP) 15.1, "Corrective Action," Revision 5, and

PHI-7030, "Condition Reports

and Plant Reporting," Revision 14, provided the

vehicles for identifying deficiencies

and processing

them with or without

root-cause

investigation.

Both procedures

required

the. use of investigations

but neither procedure

provided root-cause

investigation methodologies.

Little

evidence of formal application of disciplined root-cause

investigations

was

observed in the problem reports

and other deficiency documentation (e.g.,

JOs,

audits,

and surveillances)

reviewed

by the team.

The procedures

required that a

condition report be prepared

when

a potential

problem or condition adverse to

quality.

Several

cases

were identified in which apparent

problems meeting the

criteria of the procedures

did riot result in the preparation

of a condition

report or performance of a root-cause

investigation.

Procedure

20HP4030.STP.038,

"Leak Rate Test of Liquid Systems,"

Revision 4,

identified unacceptable

leakage in the containment

spray

system during

performance of the test in April 1988.

Job orders were apparently

com-

pleted for the repairs but the post-repair testing

was not documented

on

the sheets

as required,

and the testing for valve 2-IHO-212 (JO 37595)

was

not completed correctly.

The procedure

was repeated

in February

1989 as

a

result of the extended

Unit 2 outage

and coincidentally retested

the

subject areas

although specific inspections of repairs

were not separately

documented.

The procedure

was signed off as acceptable

by the plant staff

without recognition of the omissions.

Following the team's review,

a

condition report was issued

on June 20, 1990.

Job Orders

B020648 and

B013903 involved check valve removal from the

20-inch, Schedule

40,

ESM pump discharge

piping for the Unit 2 west

pump.

Both JOs were annotated

by the mechanics

indicating that abnormal

"pipe

strain" (piping deformation)

caused

substantial difficulty in valve

reinstallation.

Although the JOs were signed off as complete in

December

1987 and April 1990, the pipe strain condition apparently

had not

been identified for engineer ing evaluation.

Six cf the butterfly-type Pratt valves

had been replaced

since

1982 with

new or reworked valves

as

a result of rubber seal or other undocumented

failures.

The licensee

had not conducted

a root-cause

analysis to deter-

mine the cause of the failures, nor had it evaluated

the potential for

affecting the safety function of the valves during accident conditions.

Further examples of lack of initiation of condition reports are discussed

in

Section 2.5.1 of this report.

The team verified that site staff training in

root-cause

analysis

techniques

had been initiated by the licensee.

2.4

Quality Assurance

The team reviewed the licensee's

Quality Assurance

(QA) audits

arid surveillances

of plant activities for identifying problems

and problem areas.

Audits by

design were broad in scope

and addressed

overall control and methods of per-

forming activities rather that addressing

specific systems.

Surveillances,

16

however,

were narrow in scope

and covered specific activities.

In all cases,

application of the activities and controls to the

ESW system

was evident.

gA

surveillances

were conducted to supplement audits

and were limited to specific

activities such as repair of specific components

or systems.

2.4.1

Onsite Review Committee

The Plant Nuclear

Safety

Revie~ Committee

(PNSRC)

performed the onsite review

function.

The technical specification requirements

were appro~riately

addressed

in procedure

PMI-1040, "Plant Nuclear Safety

Review Committee, 'evision 9.

The

procedure

appeared

to be adequate.

PNSRC meetings

were required to be held

monthly but were usually held weekly with special

meetings

held as needed.

During the review,

nc issues

were discussea

involving the

ESW system.

2.5

Surveillance

and Inservice Testing

The team reviewed the surveillance

and inservice test program for the

system io verify that the surveillance

procedures

would confirm the required

ESW system function.

The team conducted

a technical

review of the survei llance

procedures

for the

ESW system

and electrical support

systems

and observed

the

performance of three

ESW surveillance

procedures

as well as two surveillances

associated

with the reactor protection system

and steam generator

instrumenta-

tion.

In addition, the team reviewed the results of surveillance tests per-

formed recently

on the

ESW system

and assessed

the implementation of inservice

testing

program requirements.

The team concluded that surveillance test procedures,

with the exception of the

18-month surveillance test procedure for battery

emergency

load arid the

inservice testing

program requirements for the diesel generator

of 10 CFR Part 50, Appendix B, Criterion XI.

and the

ESW pump discharge

check valves,

were adequate

to ver ify that

safety-related

equipment

and systems

could accomplish their intended functions.

2.5.1

Surveillance Test Procedures

The team evaluated

the licensee's

biennial procedure

review program as it

applied to the

ESW surveillance

procedures.

The team had concerns

regarding

the timeliness

and effectiveness

of the licensee's

biennial reviews.

The

review of procedure

1THP4030.STP.068,

"Essential

Service Water Liquid Process

Monitor (R-20) Surveillance Test," was overdue

because it should

have been

performed in January

1990.

The latest biennial review for procedure

2THP4030.STP.175,

"Essential

Service Water Liquid Process

Monitor (R-28) Test,"

was late when performed in July 1989.

The failure to perform timely biennial

reviews was inconsistent with PMI-2010, "Plant Manager

and Department

Head

Instructions,

Procedures

and Associated

Indexes."

Further,

paragraph

3.14.1.A

of this procedure required that those

procedures

whose biennial review cycle was

exceeded

should be marked to ensure

they were not used before

an appropriate

review was accomplished.

Procedure

1THP4030.STP.068,

performed June 21, 1990,

was not so marked.

Additionally, some of the biennial reviews conducted

had been ineffective.

For

example,

the last biennial review of procedure

1THP6030.IMP.012,

"Radiation

Monitoring System Calibration:

Air/Liquid/Gas," was performed in January

1990.

On June 21, 1990, the team observed that four change notices

were required

to be issued in order to accomplish the tasks detailed in procedure

ll'HP6030.IMP.012.

None of the problems that required

change

sheets

during its

17

I 4 ~

I J

P

implementation were identified during the biennial review of the procedure.

The form used to document the reviews was found to be ambiguous

and unclear in

its questions

and required responses,

contributing further to the ineffective-

ness

of the biennial review.

The team identified the following additional

examples

where licensee

personnel

failed to adhere to procedural

requirements.

During completion of procedure

1THP6030. IMP.012, the technicians

did not perform independent verification as

required.

The technicians'ailure

to observe

independent verification

requirements

and the need for generating

change

sheets

to accomplish

a sur-

veillance required the issuance of condition reports in accordance

with

PM1-7030, "Condition Reports

and Plant Reporting."

In both instances,

condi-

tion reports were not initiated by the staff until the team identified the

deficiency.

The lack of condition reports prohibited management

from being

informed of problems

and prevented effective and timely assessment.

The team noted through direct observation

and review of completed procedures,

that the technicians

did not utilize the tolerance

allowed by procedure

1THP4030.STP.068.

This procedure

required setting

and reading the meter for

the liquid process

monitot

between

a target value and -.25 decade

less than

this target value.

However, the technicians routinely attempted to set the

meter at the target value.

The team observed that this was not always possible

and that the meter

may actually be set at more than the target value.

The review of completed surveillances identified numerous

instances

where

recorded

data fell outside the acceptable

range identified in the procedure.

For example, for the four liquid process radiation monitor surveillance

proce-

dures

(27 completed surveillances

reviewed), the counts-per-minute

range

was

exceeded five times,

and counts-per-minute

values

were not recorded for an

additional four times.

In addition, Step 7.10 (the calibration of the low

level alarm) of procedure

1THP4030.STP.068

was exceeded

by a full decade

on

March 30, 1990.

Procedure

10HP4030.STP.022E,

"East Essential

Service Mater

System Test," conducted

on December

18, 1989, did not show an acceptable

flow

through valve 1-ESW-113.

In each of the instances

noted above, neither the personnel

conducting the

surveillance

nor the supervisor reviewing the results

noted the procedural

deviations.

The large number of instances

associated

with the radiation

monitor surveil'lances

indicated

a lack of understanding

of procedural require-

ments

and an inability of IEC technicians to properly implement these

procedures.

In addition, the lack of acceptance

criteria in the

IKC surveillance

procedures

for the liquid process

radiation monitors contributed to uncertainty

as to when

the surveillance test failed.

Numerous other discrepancies

in completed surveillances

were identified by the

team including missing dates

and serial

numbers,

incomplete review sheets,

and

sloppy data taking.

In total, these

inadequacies

with the data of completed

surveillance

procedures

inaicates

a lack of attention to detail

and

a recurrent

lack of adherence

to procedures.

The examples of lack of procedural

adherence

discussed

above did not meet the

requirements

of 10 CFR Part 50, Appendix B, Criter ion V, which requires that activi-

ties affecting quality be accomplished

according to procedures

(see Appendix A,

Unresolved

Item 90-201-07).

18

2.5.2

Station Battery Testing

Battery sizing documents

prepared

by the utility engineers

during 1984

and

1985, in preparation for the purchase of replacement batteries,

showed that the

battery

load profile developed

by the engineers

exceeded

the identified load

profile of the technical specification

by 35 to 65 percent.

Following the

installation of the

new batteries

in 1986, the licensee failed to incorporate

the new battery capacity

and test profile into existing test procedures

(2NHP4030.STP.034,

2MHP4030.STP.022,

and IHHP4030.STP.044),

and the 18-month

surveillance

procedures for 2AB, 2CD, and IAB battery

emergency

load discharge

and battery charger tests.

Therefore,

the technicians

continued to test the

new station batteries to a load profile that was

up to 65 percent

below the

calculated

emergency

loads.

The licensee,

by not incorporating the 1984

battery

load profile into the applicable battery capacity test, did not meet

the requirements

This criterion

required

a test program to demonstrate

that components will perform satisfacto-

rily in service in accordance

with written test procedures

that incorporate the

requirements

and acceptance

limits contained in applicable design

documents

(see Appendix A, Unresolved

Item 90-201-08).

To date only one out of the four station batteries

(LCD) had been tested against

the

new battery load profile.

That test

was successfully

completed in Hay 1989.

The team questioned

the operability of the remaining three station batteries.

The licensee

provided the team with a justification for continued operation for

the improperly tested batteries.

It considered

the aging, testing history,

and

overall capacity of the batteries.

Further, the licensee

expected to test both

Unit 2 batteries

during

a refueling outage that began during the inspection.

The Unit 1 batteries

were to be tested

during the planned October

1990 outage.

The team reviewed additional calculations of the battery duty cycle preparea

for the 1990 station blackout

(SBO) engineering

studies.

These calculations of

a 4-hour

SBO duty cycle were not intended to replace the 1984-85 8-hour duty

cycles for technical specification surveillance

purposes,

but the newer calcu-

lations appeared

to identify battery

loads previously not considered.

These

loads could increase initial battery discharge

rates (e.g.,

EDG field flash

current, initial switchgear

control power demand during engineered

safeguards

sequencing,

and related loads).

The team considered

the newly identified loads

to be potentially significant with regard to near end-of-life battery

conditions.

The licensee

stated that such

loads will be considered for

inclusion into the battery capacity test procedures.

The team evaluated

the effects of battery end-of-life operating

temperatures

on

the battery sizing calculations for the station batteries installed in 1986.

Review of battery

room temperature

monitoring data indicated that the battery

'oom

temperatures

were monitored weekly by an informal program established

by

the system engineer.

The

1AB and

2AB battery

rooms

had intermittently been

below the end-of-life design limits by as

much as

12 to 15 degrees

Fahrenheit.

On the basis of information contained in the battery vendor

manuals,

the

battery capacity degradation

as

a result of temperature

variations

appeared

minor except for end-of-life conditions.

The licensee

stated that

a program to

monitor and control battery

room temperatures

within acceptable

ranges

would

be established.

19

2.5.3

Inservice Testing (IST)

The appropriate

ESW valves were included in the

IST program,

and program

requirements

were properly reflected in procedures

with the exception of diesel

generator

ESM-111 to -114 (Unit 1) and

ESW-141 to -144 (Unit 2)

and

ESM pump discharge

ESW-101E

and -101M (Unit 1) and

ESM-102E

and

-102W (Unit 2).

The licensee

planed to test the forward-flow capability of

each valve but not the checking capability.

These valves perform a safety function in the checked position for certain

scenarios.

The four check valves

on each aiesel

generator

cooling supply are

each in series with a motor-operated

valve.

The four motor-operated

valves

open simultaneously

on a diesel generator start signal

and, in so -doi~n

,

interconnect

the two

ESW headers of a single unit.

Therefore,-should

an-ESW

pump fail or a line break occur upstream of the diesel generator

branch stop

valves,

ESM-111 to -114 and

ESW-141 to -144 would be called. upon.

to perform a checking function.

Likewise, check valves

ESM-101E,

-101W, -102E,

and

-102W would perform a

checking function should

an