ML18096A077
| ML18096A077 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 05/28/1991 |
| From: | Chaudhary S, Eapen P NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML18096A075 | List: |
| References | |
| 50-272-91-80, 50-311-91-80, NUDOCS 9106250107 | |
| Download: ML18096A077 (35) | |
See also: IR 05000272/1991080
Text
U. S. NUCLEAR REGULATORY COMMISSION
REGION I
Report Nos.
50-272/91-80
50-311/91-80
Docket Nos. 50-272
50-311
License Nos. DPR-70
Licensee:.
Public Service Electric and Gas Company
P.O. Box 236
.
Hancocks Bridge .. New Jersey 08038
Facility Name:
Salem Units 1&2
Inspection At:
Hancocks Bridge. NJ
Inspection Conducted:
April 15-26. 1991
Inspectors:
fJ!ti,.,a;;;ii !?t!!!t
S. K. Chaudhary ~
eactor Engineer,
Systems Section, EB, DRS, Team Leader
J. Trapp, Sr. Reactor Engineer, SS, EB, DRS
R. Mathew, Reactor Engineer, ES, EB, DRS
J. Lara, Reactor Engineer, ES, EB, DRS. *
P. Kaufman, Project Engineer, PB2, DRP
L. Kay, Reactor Engineer, ES, EB, DRS
F. LeGuen, NRC Consultant
. H. Wang, Sr. Reactor Engineer, NRR
Approved by:
Q. \\L.. * ~ 8
/Jv--
Dr. ~K. Eal>en;fhif,S)Titems Section,
Engineering Branch, DRS
Inspection Summary: See Executive Summary
, ..
9106250107 91061~
fDR
ADOCK D~ono~*7?
i I
............. .,._
"'**-
~
date
date.
EXECUTIVE SUMMARY
A special Safety System Functional Team Inspection (SSFI) was conducted at Salem Nuclear
Generating Station, Units 1 and 2, on April 15 to 26, 1991. The inspection team was
composed of a team leader, NRC personnel and a contractor. -
The objective of this SSFI was to assess the design basis and the operational readiness of the
Residual Heat Removal (RHR) system. This system was selected because of its relatively
high ranking in the PRA accident sequence hierarchy, and the recent system operating events *
as rep0rted to the NRC, that put the plant operations in unanalyzed conditions.
As *detailed in the report, the inspection focused on: mechanical (Section 2.1); electrical
(Section 2.2); instrumentation and control (Section 2.3); operations (Section 2.4); and
structural/piping (Section 2.5) aspects of the RHR system. The major findings in each area
are summarized below.
In the mechanical area, the team concluded that the system is designed and maintained
adequately with acceptable programs in inservice testing and modification controls.
However, the team observed-that the component cooling outlet valve (11CC15) to the RHR
heat exchanger was not locked open as required by the applicable procedure. This has been
- identified as a non cited violation, as the team considered this as an isolated incident and it
_met the criteria specified in the regulations for non cited violations .
In the electrical area, the team concluded that the emergency and the normal power supply to*
the RHR equipment is adequate. However, the Unit 1 emergency diesel generators have not
been verified to be capable of carrying the maximum emergency loads documented in a
recent study; and an undersized current interrupting device (fuse) has been installed in the de
power system, although this misapplication was known to engineering for a considerable
period of time. The team has categorized the above deficiencies as violations.
With* the exception of a few minor discrepancies in drawings and configuration control
documents, the team concluded that the I&C components of the RiIR system are capable of
performing the design functions.-
The operational and surveillance testing, normal and emergency operating procedures, and
operator training program were observed by the team to be adequate to assure safe plant
operations.
The structural and piping design, material condition, and modifications to original design
were adequate to assure intended functional safety and operability of the plant.
3
Overall, with the exception of the violation, unresolved item and weakness, the team
concluded that the RHR system is functionally capable of fulfilling its intended safety
function.
The violations identified during the inspection are summarized in Table 1, and the observed
weakness is listed in Attachment I to this report.
4
TABLE 1
Summary of violations:
Violations
1.
Valve No. 11CC15 unlocked. (50-272/91-80-01) non-cited per lOCFR 2,
Appendix C.
2.
Failure to implement adequate design control measures for EDG load calculations
(50-272/91-80-02). .
.
3.
Failure to implement prompt corrective action regarding under-rated fuse
(50-272/91-80-03; 50-311/91-80-01) .
5
1.0
INTRODUCTION
The Qbjective of this Safety System Functional Inspection (SSF:I) at the Salem Nuclear Station
Units 1&2 was to assess the design basis and the operationai readiness of the Residual Heat
Removal (RHR) system. This system was selected for inspection because of its relative high
ranking in the PRA accident sequence hierarchy, and the system operating history as reported
to the NRC; specifically, the events that put the plant in an unanalyzed condition.
The objective of the* inspection was aecomplished by determining whether:
a.
The RHR system is capable of performing its various safety functions required by the
design.
b.
Testing and surveillance are adequate to demonstrate that the system will perform all
required safety functions.
c.
Maintenance is adequate to ensure system availability and reliability.
d.
e.
Human factors considerations related to the system, its supporting systems,
procedures, and operator training are adequate to assure proper system operations .
Engineering support and quality programs provide assurances-that the system, as
maintained and operated, meets the design basis.
The team reviewed the FSAR, Plant Technical Specifications, modification packages and
reference documentation and examined the available calculations which support design and
operation of the systems. System operating procedures were evaluated to assess the detail,
accuracy and adequacy of direction provided to operators. The team observed control room
activities during the course of the inspection, and reviewed maintenance procedures and
programs related to the RHR system. Additionally, the team performed system walkdowns to
verify that the system configuration is in accordance with design documents. Finally, the
team assessed the overall design control program as applied to the RHR system. The
principal findings pertain to the operational readiness of the system and auxiliary support
systems, the effectiveness of programs to ensure continued safe operation and the adequacy of
engineering calculations. The following sections provide detailed findings, including both
strengths and weaknesses, in each of the functional areas inspected.*
6
1.1
Residual Heat Removal (RHRl System
The RHR System is designed to remove core decay heat during normal plant cooldown. In
addition, the RHR system is part of the emergency core eooling system which removes decay
heat from the core during the injection and recirculation phases of safety injection. During
the injection. phase of safety injeetion, the system transfers borated water from the refuelfug
water storage tank to the reactor coolant system cold legs. During the recirculation phase of
safety injection, the RHR system provides long term cooling following *a loss of coolant
accident (LOCA) by transferring water from the containment sump to the core.
The RHR system consists of two independent trains. Either train is capable of meeting the
safety design basis capacity. Each train consists of one RHR pump, RHR heat exchanger,
and the associated piping, valves, and instrumentation required for operation and control.
Components shared by both trains are a Common suction *line from the refueling water storage
tank (RWST) and reactor coolant system (RCS) loop 1 hot leg, a heat exchanger bypass, and
a RHR discharge line to the RCS loops 3 and 4 hot legs. The two parallel flow paths are
cross tied so !hat eitlier RHR pump may supply flow to all four cold legs.
During normal system operation, reactor coolant flows from the reactor coolant loop 1 hot
leg to a residual heat removal pump through the tube side of a RHR heat exchanger, and
back to the RCS through the safety injection system cold leg injection headers. The heat load
is transferred from the RHR heat exchangers to the comj>onent cooling water system (CCW),
which is circulated on the shell-side of the RHR heat exchangers. The heat is transferred
from the CCW system to the ultimate heat sink via the service water system .
. The two RHR pumps are aligned to autoinaticcilly start on a safety injection signal.
Following a LOCA, the pumps take water from the RWST and inject it into the RCS via the
accumulator cold leg injection lines when RCS pressure drops below the RHR pump shutoff
head of 170 psig. When the :RWST low level is reached, the RHR pump suctions are
switched to the containment sump (recirculation phase). The RHR heat exchangers then cool
the fluid which is delivered back to the RCS.
During the recirculation phase, the RHR system provides flow to the suction of the
centrifugal charging pumps and the safety injection pumps. This assures adequate injection to
the core if RCS pressure remains above the RHR pump discharge pressure. The RHR system
can also provide containment spray during the cold leg recirculation phase after the *RWST is
empty.
-
--*~- --* -- ...... .:. ----
7
2.0
DETAILS OF INSPECTION
2.1
Mechanical
2.1.1 RHR System Walkdown
A detailed system walkdown of the RHR system was conducted by the inspectors. The
walkdown included selected sections of the RHR systems in containment and the auxiliary -
building for both units 1 & 2. The puq)ose of the system walkdown was to determine the
material condition of the RHR system components, and to assure that the system
- configuration .was consistent with design documents.
The RHR system material condition was generally good. RHR system Piping and
.Instrumentation Diagrams (P&IDs) were compared with the actual system configuration. The
as-fastailed system was consistent with the design drawings. No discrepancies were identified
regarding material condition, or with the drawings.
However, one discrepancy was identified with regard to the component cooling outlet valve
(11CC15) to the RHR heat exchanger. Operations procedure II 7.3.2, "ComPonent Cooling.
System," required that the component cooling system valves be aligned in accordance with
Tagging Request Inquiry System (TRIS) CC MECH OCH. TRIS CC MECH 001, required
valve 11CC15 to be locked in a throttled position. On April 22, 1991, this valve was
observed to be unlocked. The licensee reviewed this concern to determine the cause. The
. test results indicated that the valve was properly throttled. The licensee found that the valve
had been left unlocked following the inservice pump test for the component cooling pumps
conducted on April 5, 1991. The inservice test procedure SP (0) 4.0.5-P-CC(ll), "Inservice
Testing-Component Cooling,
11 step 5.2.2, was the applicable procedure for throttling valve
11CC15. However, the procedure did not require the operator to lock the valve upon
completion of the test, and did not include this valve as part of the final valve position
- verification at the conclusion of the test.
The licensee took extensive corrective action to address this issue prior to the conclusion of
this inspection. A special test was conducted to assure that this valve was throttled correctly.
Procedure revision requests were initiated by the operations staff to correct the deficiency in
procedure SP(O) 4.0.5-P-CC-11, Rev. 11, "Inservice Testing"'Component Cooling.
11 The
licensee also performed checks of all locked valves in the Auxiliary Feed water, Safety
Injection, Component Cooling, Residual Heat Removal, and Chemical and Volume Control
systems. The results of this surveillance .did not disclose any other unlocked or mispositioned
valve. Therefore, it was concluded that this was an isolated incident .
'---------
8
This finding would normally be classified as a Severity Level V violation. However, the
violation is not cited because the criteria specified in lOCFR 2, Appendix C,Section V.A. of
the Enforcement Policy was satisfied. Speeifically, this violatipn is a Severity Level V, and
the licensee initiated prompt corrective actions prior to the end of ihe insi)ection. This
violation, therefore, constitutes a non-cited violation (Violation 50-272/90-83-01).
2.1.2 Inservice Test i>roi:ram
The Inservice Test Program was reviewed to determine if the RHR system pumps and valves
were tested in accordance with ASME B&PV Code,Section XI .. The licensee's response to
Generic Letter No. 89-04, "Guidance on Developing Acceptable Inservice Testing
Programs," was also reviewed to establish their IST commitments~ The IST review was
performed:
To verify that all applicable RHR system pumps and valves were included in the IST *
program.
To ascertain that the pumps and valves in the program were properly tested. *
To verify that test result acceptance criteria were met.
The team determined that all applicable RHR system valves and pumps were included as part
of the IST program. The licensee's IST program was found to be detailed, and provided
ready access to relief requests, and to information regarding the tests performed on individual
components.
P~ocedures used for IST were found to be acceptable .
. One discrepancy was noted during this review of the RHR pump test baseline data. The test
acceptance criteria was found to be different than that provided in Technical Specification 4.5.2 f. Technical Specifications required the RHR pump discharge pressure to be greater
.than 195 psig. The limit provided in the IST baseline was 165 psid. The more conservative
IST value was based on a Westinghouse study (PSE-90-700) which determined required
ECCS flow rates. The licensee stated that a technical specifications change request had been
prepared for submittal to the NRC to resolve this* issue.
The RCS hot leg suction valves to the RHR pumps (RHl & RH2) are not required to be leak
tested in accordance with 10 CFR Part 50 Appendix J. These valves are notType "C" tested
by the licensee. However, these valves are not included in the FSAR table 6.2-13,
"Containment Isolation Valves not Subject to Type "C" Leak Rate Testing." The licensee
stated that this omission would be corrected during the next FSAR update .
9
One discrepancy was noted during a review of surveillance procedure SP(O) 4.4.6.3,
"Emergency Core Cooling System - ECCS Subsystems." This procedure in part is used to
establish the leak rate of the RHR pump suction hot leg isolatiQn valves lRHl and 1RH2.
These. pressure isolation valves isolate the RCS from the lower design pressure RHR system.
The lRHl valve test requires pressumation to 300 psig between the two isolation valves
using a hydraulic pump. The pump is then isolated, and the pressure is momtored for an
increase. The test is considered successful provided the pressure does not increase above 400
psig. However, the minimum time required to wait for monitoring any pressure increase is
not established in the procedure. Therefore, depending on the amount of air in the system,
the results of this test could vary. The licensee agreed and added a five minute test duration
to the procedure. This procedure change was found acceptable.
Three valves were selected for a review of the stroke time test results. The IST was
performed only during refueling- outages; hence, only the last two tests were reviewed. Of
the three sets of data reviewed, one had an error in "the previous test stroke time" transcribed
on the valve test data sheet. The previous valve stroke time was used to establish the
acceptable stroke time and it was therefore important to record the correct value of previous
stroke times. The sample was expanded to three additional valves and a second error was
identified. Both errors were minor, and when the correct previous valve stroke times were
used the results were found to be acceptable. Therefore, the safety significance of this
finding is low; However, the errors appeared to occur when maintenance was performed in *
between surveillance tests and the valves were stroked as post maintenance tests. The
apparent lack of control of stroke time data following valve maintenance was determined to
be a weakness.
With regard to the RHR system, the IST program was found to be thorough in identifying the
program scope. Overall, testing procedures were adequately developed. The RHR check
valve inspection by the licensee complied with guidance in GL 89-04. Trending of test
results data is presently weak; however, the licensee was in the process of implementing an
. improved trending program for pump vibration and valve stroke time data. The licensee also
was supplementing current records of inservice tests (Article IWP-6000) in the areas of pump
records, inservice test plans, and records of tests.
2.1.3 RHR Heat Exchanger Performance
The team reviewed the maintenance history and surVeillance testing of the RHR heat
exchangers. This review was performed to verify the integrity, and the long term heat
transfer capability of the RHR heat exch~gers.
The RHR heat exchangers are part of original plant equipment.* Component cooling water
cools the RHR heat exchanger on the shell side. Component cooling is a closed system with
service water providing the cooling medium .
.. * *
10
Three of the four component cooling water heat exchangers were re-tubed with titanium
tubes. The fourth CCW heat exchanger, in Unit' 1, was replaced with a plate type heat
exchanger. The replacement of the CCW heat exchangers was. completed in the mid-nineteen
eighties. The CCW heat exchangers are monitored in accordance _with the guidance provided
in NRC Generic Letter 89-13, "Service Water System Problems Affecting Safety-Related
Equipment." CCW chemistry samples are taken and measured for chlorides and sodium
twice per week. The data reviewed showed extremely low chloride concentration in the
CCW. The CCW heat exchangers are also eddy current tested to provide data on tube wall
thicknesses. The eddy current data reviewed did not indicate any significant wall thinning of .
the CCW heat exchanger tubes.
The RHR heat exchanger maintenance history from 1983 was reviewed. The data indicated
only one corrective maintenance activity where the heat exchanger gasket was replaced due to
leakage. The RHR system pressure is higher than component cooling and therefore leakage
from RHR heat exchanger tubes would be into the CCW system. RHR system leakage has
not been experienced. The RHR heat exchangers are not included in the Generic Letter 89-
13 program and, therefore, eddy current tests have not been performed.
2.1.4 RHR Parallel Pump Interaction
This inspection was performed to ascertain that the licensee had taken adequate measures to
address the concerns discussed in NRC Bulletin No. 88-04, Potential Safety - Related Pump
Loss. As stated in the bulletin, all licensees were expected to investigate and correct, if*
necessary, the following two minimum flow design concerns: (1) the potential for the
deadheading of one or more pumps in Safety-Related Systems that have minimum flow lines
or other piping configurations that do not preclude pump-to-pump interaction during
minimum flow operation; and (2) the adequacy of the installed minimum flow capacity for
single pump operation. This review by the team was conducted only for the RHR system.
The NRC has identified the potential for pump-to-pump interaction in the RHR system at
Salem Unit 1 in NRC inspection report (50-272/90-81). Salem unit No. 2 has two check
valves located upstream of the pump suction lines which prevents pump-to-pump interactions.
The licensee has addressed the pump-to-pump interaction at Unit No 1 through changes made
to IST surveillance procedures and proposed changes to the emergency operating procedures,
if required.
The quarterly RHR pump surveillance procedure first runs each RHR pump independently
and records pump discharge pressure. The differential pump discharge pressure is then
calculated to assure that the differential is less than 6 psid. The licensee has calculated
(Calculation #S-1-RHR-MDC-0537) that an 8 psid pump discharge pressure differential will
potentially cause dead heading of the weaker pump. If the differential is calculated to be
greater than 6 psid, one pump is declared inoperable and the system engineer is contacted to
provide proyedure changes to the emergency operating procedures (BOP) as described below.
If the differential discharge pressure is less than 6 psid, then both RHR pumps are run
11
together in parallel and the pump flow is monitored for each RHR pump. If the weak pump-
strong pump interaction were to occur the flow on the weak pump will decrease. The
surveillance procedure monitors the pump flow and assures that the flows remain acceptable.
This test method provides a positive indication on a quarterly basis that the pump-to-pump
interactions are not present. Since the pumps would not normally be operated between tests
there is no likely mechanism for pump degradation.between tests.
The licensee plans to make emergency operating procedure changes if pump-to-pump
interactions are identified during a quarterly pump test. A lOCFR 50.59 safety evaluation
has been approved which changes. procedure EOP-TRIP-1 in the event that pump-to-pump
interactions are identified .. The change incorporates an additional step which will be
performed after the completion of the immediate action steps. The licensee* states in the
. safety evaluation that this step will be completed in less than 7-8 minutes. The licensee has
calculated (Calculation S-1-RHR-MDC-0544) that the weak pump may operate dead headed
for eight minutes without damage. This calculation has also been concurred with by the
pump vendor. The EOP step first checks if both pumps are running, and if only one RHR
pump is running the procedure directs the operator to the next step,* since pump-to-pump
interaction cap.not occur with only one pump operating. If both pumps are running, then
RHR system flow is monitored. If RHR flow is greater than 3000 GPM, the operator is
directed to proceed to the next step, since pump-to-pump interactions will not occur at this
flow rate. If RHR flow is less than 3000 GPM, the RHR discharge cross-tie valve is closed.
Closing the cross tie_ valve makes the RHR system into two independent subsystems and
eliminates the pump-to-pump interaction concern.
The BOP safety evaluation, supporting calculations by :Westinghouse, Ingersoll Rand, and the
licensee were reviewed by the team. The safety evaluation and supporting analysis were
thorough and technically sound. The surveillance testing of both RHR pumps in parallel on a
quarterly basis was found to be a particularly positive approach to this concern. The
methodology used by the licensee to address the parallel pump issue, was found to be
acceptable.
The second concern presented in NRC Bulletin 88-04 is that the recirculation flow rate may
be inadequate to prevent pump degradation.Bulletin 88-04 requests the licensee to provide
documentation that the minimum flow rate is adequate to prevent pump damage. The design.
minimum flow rate for the RHR pumps is 500 GPM. The licensee has a letter from the
pump vendor, Ingersoll Rand, stating that at 500 GPM the pump may operate for a* short
duration of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> or less. The licensee has calculated (Calculation S-C-RHR-MDC-0486)
that the RHR pumps can run at 500 GPM flow for 2-2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. This calculation was
performed by the system engineering group and verified by a calculation by Ingersoll Rand.
The licensee has made changes to the operating procedures to assure that the RHR system is
Iiot operated in the minimum recirculation flow condition f~r greater than 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The
calculations and changes made by the licensee to address this concern are. extensive and
technically sound. The quality of documentation reviewed is strong. The licensee's approach
to operating the RHR pumps at minimum flow is found to be acceptable.
12
2.1.5 RHR Seal Heat Exchanger
The Salem RHR configuration was reviewed to determine if a ~ingle failure could occur
which would divert seal cooler flow from both RHR pumps. The loss of RHR pump seal
, water flow was described in NRC Information Notice 89-71, "Diversion of Residual Heat
Removal Pump Seal Cooling Water Flow During Recirculation Operation Following a
LOCA."
A single failure which could disable RHR seal cooler flow to both RHR pumps was
determined not to exist. However a concern existed that a design change DCR-2EC-2149 had
increased CCW flow to the RHR heat exchangers from 2000 gpm to 4000 gpm. Since the
RHR heat exchangers and the RHR pump seal cooler heat exchangers are in a parallel flow *
circuit, the licensee was requested to evaluate the effect of the increased RHR heat exchanger
flow on the RHR seal cooler heat exchangers.* The licenSee performed a test in which flow
was varied to the RHR Heat Exchangers. The increase in flow to the RHR heat exchangers
to 4000 gpm resulted in approximately a 1.5 gpm decrease in RHR seal cooler heat
exchanger flow. The RHR seal cooler heat exchanger flow was nominally set for 9.5 to 10.5
gpm. Therefore, the accident flow rate to the seal cooler heat exchanger would be
approximately 8-9 gpm. The required seal cooler heat exchanger flow is 4-5 gpm. Based on
this test the inspector concluded that the CCW flow to the RHR seal cooler heat exchanger
was adequate.
Conclusions
Based on the above findings, the team concluded that the design, operation and maintenance
of the mechanicaI portions of the RHR system, within the limits examined, are satisfactory to
assure its safety functions. Although some minor deficiencies were identified in the areas of
RHR pump discharge pressure, e.g., type C leak rate listing of valves RHl and RH2, and
errors in transcribing test data; the deficiencies were minor, and did not affect the overall
functional safety of the system. The team, however, identified that a valve (l 1CC15), which
was required to be locked in a throttled position, was unlocked. But the licensee's extensive
research, special test, and proposed procedure revision assured that there was rio threat to
operational safety. The team considered this an isolated incident, and categorized it as a non-
cited violation because it satisfied the specified criteria in lOCFR 2, Appendix C.
2.2
Electrical
In the electrical portion of the inspection, the team's objective was to assess the design
capability and operational readiness of the Class lE electrical system to support the functions
of the RHR system. This review included evaluation of the effectiveness of testing and
calibration of selected equipment to ensure system reliability.
13
Documentation reviewed by the team included Salem 1&2 Technical Specifications, UFSAR
Chapter 8, electrical one-line diagrams, electrical calculations, and procedures and design
studies. The team performed a walkdown of selected portions _of the Class IE electrical
system that serves the RHR system to verify configuration control.
Findings
2.2.1 Emergency Diesel Generators ffiDG)
The team reviewed the loads on the EDG to determine the design adequacy and operational
readiness of the EDG units to power the emergency loads during the worst case accident.
Each Salem Unit has three emergency diesel generators that are designed to perform their
Safety function when any 2 of the 3 diesels are operating during an accident. The EDGs are
manufactured by Alco Engines Division, and are each rated as follows: ~
- Continuous - 2600 kW
2000 Hours - 2750 kW
2 Hour -
2860 kW
30 Minute -
3100 kW
The team reviewed Salem Units 1 and 2, EDG load calculations S-C-4KV-EDC-0652,
Revision 0, performed by ASTA Engineering, Inc. The calculation showed auto sequence
loads and manual loads connected to the EDG for several postulated design basis accident
scenarios (Cases A thru E). The analysis showed that all diesel loads were within the EDG
rating for all scenarios. The team reviewed the worst case loading (Case D) for EDG 2A,
which was for a loss of offsite power plus a LOCA with diesel generator 2B failed.
The loading analyses indicated that the peak load was 2872 kW for 16 minutes which was
above the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating (2860 kW), but within the 30 minute rating (3100 kW). The team
noted that the licensee had not performed any design verification or technical evaluation to
determine the adequacy of the EDG loading calculation as required by the licensee's design
verification procedure DE-AP.ZZ-0010(Q). The analysis contained significant discrepancies,
specifically, cable losses for all loads connected to EDGs were not considered; battery
charger limiting conditions were not accounted for; hydrogen recombiner full load kW
loading was not considered; pump runout conditions did not account for calculating* maximum
BHP; and a load factor of 0.8 was assumed without justification. Moreover, the existing
peak load of 2872 kW for 16 minutes wa.s found to be non-conservative. The peak load time
is based cm containment spray pump off times. The licensee assumed the off times based on
the capacity of the RWST to supply 2 pumps for approximately 30 minutes instead of worst
case of 1 pump for 60 minutes to reach the RWST Lo-Lo level alarm condition for transfer to
14
the cold leg recirculation phase. This resulted in increasing the peak load te> another 14
additional minutes. Furthermore, the team determined that the present peak EOG loading
would be between 3000 kW and 3100 kW based on runout co~ditions of ECCS pumps and
must include other discrepancies identified, above.
During the review, the licensee stated that their onsite review committee (OSRC) had
identified several discrepancies among various documents (FSAR, Loading Calculations SC-
4 KV-EDC-0650 and EDM-66) concerning the brake horsepower values of the pump. The
team reviewed the OSRC findings addressing the issue and noted that a discrepancy
evaluation form, DEF #DES-90-01489 was written by the licensee to address the specific
issues. No final action had been taken to resolve this issue except a preliminary review
which was performed to determine whether there were any safety or operability concerns.
The review indicated no safety or operability concerns, and concluded that the issue should be
handled as a part of the deficiency reporting program.
The team concluded that these discrepancies were caused by the inadequacies in the licensee's
design control process in that a detailed design verification was not conducted to identify and
correct these discrepancies before the loading calculation was issued for use. Failure to
perform a detailed design review and to 'implement adequate design control measures for the
EOG loading calculation is a violation of lOCFR 50, Appendix B, Criterion III (50-272/91-
80-02 and 50-311/91-80-02).
The team reviewed test results for the lB and lC safeguard emergency cabinet 18 month
relay response and sequence test dated March, 1991 to determine the accuracy and response
of auto sequenc~ timers. The team noted that the test data indicated several readings outside
the acceptance criteria mentioned in procedure SI-MD-ST.SEC-002(Q). A deficiency report,
DR# SMD-91-287 was written by the licensee to address this issue and an appropriate
lOCFR 50.59 review and a safety evaluation were performed to justify the acceptance of this
test. The test results were found'to be acceptable "as is" and it met the manufacturer's
detailed specification (72-8058), and the cabinet test specification (PSBP-145773).
The team noted that the acceptance criteria in the procedure were recently added by the
licensee as part of the.-procedure enhancement program, and the revised acceptance criteria
had a tighter band than the manufacturer's recommended values. The team had no further
questions regarding this issue.
The team also reviewed monthly and 18 month technical specification surveillance tests for
the lA and 2A EDGs. The team noted that the Unit 1 surveillance tests and TS requirements
were less conservative for Unit 1. Unit 1 and Unit 2 TS surveillance requirements and actual
test values are as shown below .
Unit 1 TS
18 month~ 2665@ 1 hr
31 day ~ 1400@ 1 hr
Unit 2 TS
18 month~ 2860@ 2 hr
~ 2600@ 22 hr
31 day ~ 2600 @ 1 hr .
15
Actual Test
2700 kW @. 1 hr
. 1500 kW @ 1 hr*
Actual Test
2900 kW
2650 kW
2700 kW
Although the existing surveillance tests individually meet the minimum TS test requirements
for each unit, the test did not envelope the PSE&G computed worst case load value of
2804 kW for Unit 1. Unit 2 TS surveillance tests did envelope the PSE&G computed worst
case load of 2872 kW. However, neither TS tests envelope the NRC estimated worst ~e
loading of approximately 3000 kW.
The team was concerned that the Unit 1 EDGs were not adequately tested to demonstrate
their* capability to envelop the peak load accident load. The team also noted that there. were
no regulatory or technical impediments to prevent the licensee from testing the EDGs at their
peak accident load. The Unit 1 TS surveillance requirement indicated that the EDGs be
tested at greater than or equal to 2665 kW. The licensee's recognition of the surveillance test
inadequacy was evident by the submittal o_f the TS amendment request (NLR-N90068). The
proposed TS amendment will not only demonstrate the Unit 1 EDGs peak load carrying
capability, but also will make it consistent with Unit 2 requirements, which will also require
testing to the computed peak accident loading for Unit 2.
In response to the teams concern regarding inadequate surveillance testing of Unit 1 EDGs,
the licensee provided the team with the manufacturer's original qualification test
specifications showing continuous to half-hour (2600 kW - 3100 kW) load rating for the*
EDGs in question. However, no subsequent tests were performed by PSE&G to verify the
half-hour rating of the EDGs.
Subsequent to the above onsite inspection, the team leader had telephone conversations with
the licensee's staff on May 3, 6, and 10, 1991, in which the NRC was informed that the
licensee would perform surveillance tests on Unit 1 EDG before July 3, 1991, with. a load at
least equal to or greater than the loads documented in the licensee study.
The* team concluded that there was no immediate safety concern regarding the operational *
readiness of the EDGs, because all EDGs were identical units from the same manufacturer,
and the Unit 2 EDGs were tested for peak accident load, providing some assurance that
Unit 1 EDGs were also likely to meet the peak demands for worst case accident conditions .
16
2.2.2 Cable Ampacities and Equipment Maintenance
The team reviewed the cable ampacities for the RHR pump mo.tor, diesel generator service
water pump motor' and selected motor operated valves in the :QHR system to determine
whether the cables were sized correctly to handle the maximum design basis loading
requirements. The review indicated that the cables were adequately sized and appropriate.
derating factors were used for additional safety margin. The criteria used to determine cable
ratings met the IPCEA Publication Standards No: P-426. The team had no further questions
regarding this issue.
The team also reviewed 4160 V, 460 V, and 230 V circuit breaker maintenance procedures to
assess the extent of maintenance activities for selected RHR equipment, such as the RHR
pumps and motor-operated valves. The RHR motor overcurrent relay calibration results were
also reviewed for completeness and accuracy. .
Several walk-through inspections were performed to verify the system configuration control.
Equipment inspected included EDGs, 125 Vdc batteries, AC and DC circuit breakers, and
relays. Equipment installation in accordance with system drawings also was verified .. No
unacceptable conditions were identified.
2.2.3 230 Volt Motor Control Center (MCC) Loading
The team performed a review to determine the adequacy of safety-related MCC units to
power their loads during a worst case accident condition. 2A east and west valve MCC
loadings were r~viewed. The main feeder breaker for these MCCs were adequately sized and
the maximum connected loadings were within the rating of the MCCs. No unacceptable
conditions were noted during this review.
2.2.4 125 Vdc System
The team reviewed DC System Study S-C-EOOO-EDC-0129, Rev. 0, which was approved on
217 /89. The study contained three calculations addressing battery sizing, de short circuit fault
current, and voltage profile. The study identified individual loads for each de bus to properly
model the de system. It also identified individual feeder cable sizes and lengths. The data
were used throughout the study to establish the acceptability of the present system
configuration.
The team found the studies to be complete in addressing de system loads at each de bus. The
battery sizing calculation was adequate in establishing that the battery had sufficient capacity
to power required loads. Similarly, the voltage profile calculation established the adequacy
of the available voltage at individual .end loads.
17
Review of the de short circuit calculation indicated several deficiencies. Specifically, it did
not address the most limiting system conditions for the purpose of calculating the worst case
fault .current available at the main de buses. The identified deficiencies are as follows:
1)
The calculation used 120 Vat the battery terminals even though the assumptions stated
that the battery was considered to be in,a fully charged state. The correct terminal
voltage should have been the system float voltage of 132-135 Vdc. The higher
voltage results in a higher fault contribution from the battery.
2)
The effects of higher than nominal individual cell temperatures were not considered.
Higher than normal temperatures increase the available fault contribution from the
battery.
3)
The calculation assumed an incorrect battery charger contribution during a fault
condition. It assumed 220 A as the rated output current contrary to the actual rated
output of 250 A as stated on the charger nameplate. However, the calculation did
conservatively assume that two chargers are connected to the system at any one time
even though only one is connected at anytime .
. The team estimated that due to the above deficiencies, the available fault current at any of the
main de buses would be approximately 10 % higher than the calculated value of 20,408 A.
The 125 Vdc batteries (3/Unit) supply the main de buses through 1200 A fuses (1/pole)
which have an interrupting rating of 10,000 A. Since the available fault current exceeds the
interrupting rating, the fuses will not be able to safely interrupt the fault current. This,
therefore, can result in the complete loss of the main de buses due to high thermal stresses.
The licensee's short circuit calculation acknowledged the deficiency of the available fault
current exceeding the fuse interrupting rating.
The licensee's Configuration Baseline Documentation (CBD) for the 125 Vdc electrical power
system DE-CB.125-0018 (Q) Rev. 0 identifies the design requirements for the de system
short circuit protection. It specifically states in part that "None of the components in the 125
Vdc system shall be subject to short current which exceed its design rating". It further
incorrectly states that the above de system study (DC System Study S-C-EOOO-EDC-0129)
indicates that, " ... the maximum short circuit currents are lower than the interrupting capacity
of the intefr!-Ipting devices."
The licensee has been aware of the fuse misapplications since at least 1987 as documented in
an NRC inspection report.
~he licensee indicated that this condition was known and the
fuses were being tracked for replacement (6/Unit) in 1992. However, this deficiency was
not documented as a non-conforming condition. Procedure DE-AP.ZZ-0018 (Q),
"Engineering Discrepancy Control", Rev. 2 describes the procedure for implementing an
engineering discrepancy program for the identification and resolution of potential engineering
discrepancies. The procedure requires that once a potential engineering discrepancy is
18
identified, a Discrepancy Evaluation Form (DEF) is required to be initiated to ensure an
- assessment of the potential safety ooncem. An Engineering Discrepancy is further defined as
an inadequacy including installations which do not conform to .required design criteria.
Contrary to the above procedural requirements, no DEF was initiated to formally document,
track and resolve the engineering discrepancy. Failure to assure that conditions adverse to
quality are promptly and properly identified and corrected is a violation of lOCFR 50,
Appendix B, Criterion XVI (50-272/91-80-03 and 50-311/91-80-01).
2.2.5 Environmental Qualification
The team reviewed the environmental qualification of electrical equipment associated with the
Residual Heat Removal (RHR) and support systems to verify that RHR equipment and
components were included in the Envrronmental Qualification Master List (EQML), and that
the proper documents were available to support such qualification.
Findings
Qualification reports, analyses, calculations, and safety evaluations of environmentally
qualified equipment and components are included fu controlled record binders. These binders
are established, maintained, and coordinated by an EQ Sponsor Engineer, and reviewed by
the Program Analysis Group supervisor.
To determine the status of EQ equipment, the team reviewed the EQML and several EQ
binders for RHR components. The EQML lists all safety related electrical equipment located
in harsh environments that is designed to remain functional during a design basis event. No
discrepancies were identified.
Selected maintenance procedures, denoted as field directives by the licensee, were reviewed.
The inspector verified that they incorporated adequate requirements to maintain qualification
of EQ components. Completed preventive maintenance procedures and EQ program reviews
were examined by the team to assure that qualification requirements were met. Additionally,
selected work orders and Licensee Event Reports (LERs) were reviewed to determine their
adequacy in addressing discrepancies pertaining* to EQ issues. LER corrective actions were
found to be acceptable.
During the inspection, the team questioned the control of information provided in binder EQ-
29, "Magnetrol Level Switch".
These level transmitters monitor the RHR pump room* sump
level to detect a RHR pump leak. The team noted that the binder was not complete, because *
the "EQ Audit Bind.er Control Sheet" had not been signed indicating approval for
completeness and finalization of review. The licensee stated that this. binder was under
review, and only the component qualification analysis within the binder was approved.
Subsequently, the licensee approved the information contained in EQ-29 binder, and
19
completed the EQ program upgrade project initiated on August 3, 1988. The licensee
indicated their intent to declassify the level transmitters for the RHR pump room sump,
thereby excluding them from the EQ program.
The licensee's.justification for this
declassification is based on the rationale *that failure of.the level transmitters due to a harsh
environment in one RHR pump room will affect only one RHR pump since the other RHR
pump is located in a separate room. The team found this declassification of transmitters
acceptable and concluded that the above documents were complete and controlled. Also,
support documentation was established and maintained for EQ of electrical equipment in
compliance with the requirements of lOCFR 50.49.
Conclusions
Based on above findings, the team concluded that the electrical emergency and normal power
. systems were designed adequately to support the RHR system function. However, the
engineering support provided to assure and maintain the functional capability of emergency
diesel generators, and a proper sizing of de system fuse was not adequate. The Unit 1 EDGs
were surveillance tested at a smaller load than the maximum* expected load after a design
basis accident. Similarly, underrated fuses are used in de systems despite a study showing a
larger fault current, which they intended to interrupt. The above deficiencies have been
categorized as violations;
2.3
Instrumentation and Control a&C)
The objective of this portion of the inspection was to assess the adequacy of instrumentation
and control (I&C) design and engineering, and to determine the functional capability of the
I&C associated with the Residual Heat Removal (RHR) system.
The team examined the RHR Configuration Baseline Document (CBD) DE-CB.RHR~
0030(Q), Revision 0, to verify that all the I&C loops and components of the RHR system
were adequately documented and referenced. The team reviewed logic diagrams of the RHR
system to verify that they conform to design specifications. In addition, control schematics
were reviewed to determine whether they conformed to design specifications .and loop
diagrams; Instrument and Control components of the RHR system were examined to verify
that they meet the design separation criteria; and instrument calibration procedures were
reviewed to ascertain that instruments were properly calibrated ..
2.3.1 Findings
The logic diagrams, control schematics and wiring diagrams pertaining to the RHR system
were reviewed. The following valves which have interlocking features that must operate
during a design basis accident were reviewed:
..
20
. 11 RH4 and 21 RH4 - RHR Pump No. 1 Suction Valves
12 RH4 and 22 RH4 - RHR Pump No. 2 Suction Valves
11 SJ 44 and 21 SJ 44 - RHR Pump No. 1 Containme~t Sump Isolation Valves
12 SJ 44 and 22 SJ 44 - RHR Pump No. 2 Containment Sump Isolation Valves
1 RHl and 2 RHl - RCS Hot Leg Suction Valves.
1 RH2 and 2 RH2 - RCS Hot Leg Suction Valves
On Unit 1, the RHR valves 11 RH4 and 12 RH4 are interlocked with the containment sump
valves 11 SJ 44 and 12 SJ 44, respectively, so that the pump suction valves cannot be opened
unless the associated containment sump isolation valve is fully closed. This interlock
prevents inadvertent draining of the refueling water storage tank (RWST) to the containment
sump.
On Unit 1, provision for valves 11 SJ 44 and 12 SJ 44 to be manually locked out is also
provided. On Unit 2, there.is no provision for manual lockout of valves 21 SJ 44 and
22 SJ 44. Instead,' a semi-automatic switchover was provided so that, when it was armed~ *ii * *
would open valves 21 SJ 44 and 22 SJ 44 upon receipt of a switchover signal from a
switchover sequen~r. As soon as valves 21 SJ 44 and 22 SJ 44 become fully open, the
- associated valves 21 RH4 and 22 RH4 close to prevent the pump suction valves from being
opened manually unless the containment sump isolation valves were fully closed and vice
versa.
On each of the units, valves RHl and RH2 were interlocked with pressure transmitters.
PT 403 and PT 405 respectively, to prevent those valves from being opened by the operator
if the reactor ~lant system (RCS) pressure is above 37~ psig.
Valves 1 RHl and 1 RH2 on Unit 1, and valves 2 RHl and 2 RH2 on Unit 2 also provide
permissive signals that allowed opening of the following valves only if valves RHl and RH2
were closed: 11 SJ 45, 12 SJ 45, 11 CS 36 and 12 CS 36 on Unit 1 and 21 SJ 45, 22 SJ 45,
21 CS 36 and 22 CS 36 on Unit 2, respectively. These valves are primarily containment
spray and safety injection valves.
-
The team verified that, on both units, the interlocks were correctly designed and that
separation requirements had been met. The team also reviewed the manual switchover
operating procedure for switching the RHR pump suction from RWST to containment sump.
The team verified that during any manual switchover from RH4 to SJ 44 or vice versa, no
RHR pump would be operatin_g when the corresponding valves RH4 and SJ 44 were closed.
The team reviewed the logic diagrams and electrical *schematics for the Residual Heat
Removal pump Nos. 11, 21, 12 and 22. The team found that the controls for the pumps
were adequately designed and that separation requirements had been met.
21
The instrument_schematic for the RHR system and selected_ flow transmitter 1Fr641A which
measures RHR pump 11 discharge flow, and the associated flow signal comparator 1FC64l
were reviewed for the flow alarm setpoint calculations and as~iated loop calibration
procedures. The team found that the range of the flow transmitter was 0-71" H20 in,stead of
0-83" H20 as stated on page Tl-4 of the Configuration Baseline Document DE-CB.RHR-
0020(d), Revision 0. This was due to a change carried out under DCR lE0-1002, titled,
"Orifice Plate.Replacement" after the.December 1989 cut off date for the Configuration
Baseline Document. However, the team found that DCR lE0-1002 was not listed in the.
DCCMS *data base used by the licensee to keep track of configuration baseline changes; this
is reported as a concern further in this report. DCR lE0-1002 had been issued to replace
existing orifices in the ECcs* systems with calibrated orifice plates. The calibrated orifice
plates provide more accurate flow-coefficients than those obtained by calculation. The
calibration of the new orifice plates is documented in report S-C-SJ-MEE-0434, Revision 0,
titled "Applieation of Fluid Metering Orifices for the Emergency Core Cooling (ECCS)
Salem Generating Station Unit #1 and Unit #2." The team found that the loop flow and
alarm setpoint calculations were correct and that the calibration procedures 2IC-2.9.214 and
2IC-2.10.214 for calibration of the flow transmitter and bistable comparator were adequate. _
A spot check was carried out to ascertain that the station had a testing procedure for
calibrating limitorque limit switches on motor operated valves RH4, SJ 49, SJ 69, SJ 45 and
- CS 36. The team found that the station had procedure M31-1 titled, "Limitorque
Maintenance Surveillance and Movats Testing." This procedure is used for setting the torque
required to operate limitorque switches in accordance with the calculated values of the thrust
required to cycle the valve as described in document S-C-XllO-MFD-0365, Revision 1,
titled, "Motor Operated Valve ThrusfRequirement."
Calibration procedures lIC-2.5.070 and lIC-2.5.071 were reviewed for transmitters lPT-403
and lPT-405 which provide RCS hot leg pressure indication and alarm. The calibration
procedures for those pressure transmitters were found to be adequate.
Table T...;1 of the Configuration Baseline document lists the Instrumentation and Control
devices of the Residual Heat Removal System. The team found that the following devices
were missing from Table T-1: FT-946, FT-947, FT-956, and FT-957. The team also found
that the drawings corresponding to the above devices had not been referenced. The licensee
agreed to add the missing devices to Table T-1 and the missing references to Section 9.0 of
the Configuration Baseline document at the next revision.
DCR-lE0-1002 had been initiated for the purpose of changing flow coefficients associated
with a number of orifices in the Chemical and Volume Control System (CVCS) and the
Residual Heat Removal System. The team found that in the MMIS data base used by
PSE&G for keeping track of design base configuration changes, the DCR lE0-1002 had not
been identified as affecting the RHR system. This was traced to the fact that the DCR
originator had listed DCR lE0-1002 as affecting the CVCS system and the ECCS system,
with no specific reference to the RHR system. A similar omission had occurred in the
22
preparation of DCR packages 34 to 37 of DCR lE0-1002, which were the packages affecting
the RHR system. However, ECCS is not a system, but a group of systems which includes
RHR. The consequence of that omission was that the ECCS entry was ignored by the
computer and therefore DCR-lE0-1002 was not listed by MMIS*under the RHR system.
The licensee has agreed to ensure that PSE&G staff is made aware of the *need to identify
specifically and accurately all the systems affected by any DCR or DCP or associated
package.
The team examined the loop diagrams for loops 12SJ44, 22SJ44, 12RH4, 22RH4, lRHl and
2RH1 (PSE&G d~wing 224390) and the corresponding schematic (PSE&G drawing 211507)
and carried out a thorough verification of those drawings. The team found that some of the
drawings contained errors that made the drawings unclear and incorrect. For those loops,
there are significant differences between Unit 1 and Unit 2. On Unit 1, a lock-out feature for
valve SJ44 is provided, but this feature is not provided on Unit 2. On Unit 2, there is a
semi-automatic switchover between valve SJ44 and valve RH4 which is not available on
Unit 1. The use of labels and boxes labelled "Unit 1 only" or "Unit 2 only" was not done
accurately and consistently so that the drawing was often incorrect and confusing in that
respect. Several push button references and relay identifications were incorrect and a cross-
reference for a relay was also missing. However, those errors in the loop diagram and
schematic were not reflected in the wiring diagram. Nevertheless, such errors are a concern
because the loop diagrams and schematics are likely to be used for training and
troubleshooting purposes. The licensee has agreed to inspect the drawings for errors of a
similar nature and to correct those errors. In the case of the drawings for loops 12SJ44,
22SJ44, 12RH4, 22RH4, lRHl and 2RH1, the licensee has agreed that separate drawings for
Units 1 and 2 will be prepared and issued.
Conclusions
With the exception of the minor concerns discussed above, the team determined that the
instrumentation and control components of the Residual Heat Removal system were capable
of performing their design function.
2.4
Operations
During this inspection, the 9th refueling*outage had just been completed on Unit 1 and the*
licensee was preparing for startup and power operations. Unit 2 was operating at full power
throughout the inspection.
The team conducted evaluations of the RHR .system operability status for the various plant
conditions to verify conformance with Technical Specification and licenSe requirements.
System interfaces between the RHR system, the Service Water (SW) system, and the
Component Cooling Water (CCW) system were also evaluated in lesser detail.
23
To verify the opera,bility of the RHR system under normal and accident conditions, the team
assessed operations of the RHR system by evaluating the adequacy of operating and
surv~illance procedures, surveillance reSults, system drawings,. training of licensed operations
personnel, and the unavailability rate of the RHR system.
2.4.1 Surveillance and Qperations Procedures
The majority of the teams review was concentrated on RHR normal operating and
surveillance procedures, because the NRC had recently completed an emergency operating
procedll;re (BOP) inspection in 1990, and a follow-up BOP inspection was also completed in .
January 1991 (NRC IRs 90-80 and 91-02; respectively, for both units 50-272 and 50-311).
The team evaluated Salem's RHR system operational event history to verify that corrective
actions, inCluding procedural changes, were implemented for events that affected the plants
RHR systems design bases.
The team reviewed the following three events which placed the RHR system outside of
Salem's design bases to verify that operating and surveillance procedures were revised to
prevent recurrence.*
1)
2)
An RHR system flow path configuration was found to be outside the emergency core
cooling systems (ECCS) design bases requirements. The loss of coolant accident
(LOCA) design basis assumes that RHR pumps are capable of providing injection flow
to all four cold legs of the reactor coolant system (RCS). On January 13, 1987 while
Unit 2 was operating in Mode 1, the RHR cross tie valve 22RH19, connecting both
RHR *subsystems, was closed for maintenance activities and one of the RHR
subsystems was placed out-of-service. With the cross tie valve closed, the RHR flow
path was only capable of injecting water to two RCS cold legs which put the facility
in an unanalyzed condition. The team reviewed surveillance procedure SP (0) 4.5.3.1
to verify that changes had been incorporated to reflect that both RH 19 cross tie valves
and the cold leg injection valves SJ 49 were opened prior to changing Modes from
cold shutdown to hot shutdown. The licensee has also revised the UFSAR and TS to
clearly reflect. the ECCS design bases requirements for injection capability into all four
RCS cold legs.
Installation of a design modification to both units RHR cold leg injection valves (SJ
49) control circuitry in 1987 introduced a potential single failure vulnerability in the
ECCS. This postulated single failure ~uld have terminated ECCS injection flow to
two RCS cold legs. This condition placed both units outside the ECCS design bases
which requires a minimum of three cold leg injection flow paths from the RHR
system. The licensee's immediate corrective actions to resolve the ECCS single
failure concern consisted of changes to emergency operating procedures (BOP).
However, the changes made to the BOP contained an unreviewed safety question, in
that, the changes reestablished a single failure vulnerability in the ECCS by early
restoration of breaker power to the SJ 49 valves. The team reviewed the licensee's
.
3)
24
BOP change to ensure that the introduced single failure was eliminated in the revised
BOP. The revised procedure BOP-LOCA-3, "Transfer to Cold Leg Recirculation",
now has a nuclear equipment operator (NEO) dispatch~ to the SJ 49 motor breakers
- to close the breakers when instructed to do so from the control room for the RHR
recirculation switchover phase. The team concluded that the BOP revision
satisfactorily resolved the BCCS s4tgle failure vulnerability.
A Unit 2 RHR system over-pressurization event occurred on October 27, 1989 when
the unit was in Mode 4 and the RHR system was out-of-service. The 21 RHR loop
suction piping was pressurized to 600 psig, 150 psig above the stated UFSAR design
pressure, resulting in the unit being outside the design basis. Integrated operating
procedure IOP-2, "Cold Shutdown to Hot Standby" was changed to require the
operators to monitor RHR pressure while RCS pressure is being raised and terminate
the*RCS pressure increase if the RHR pressure is increasing. Also, operating
procedure Il-6.3.3; "Terminating RHR," was revised to eliminate terminating RHR
when the pressurizer is solid so the RHR cold leg injection check valves will seat
properly. The team determined that tli-e changes are adequate to prevent accidental .
over-pressurization of the RHR suction piping.
The team discussed *various RHR operating and surveillance procedures with operations
personnel to verify their knowledge of the RHR system operations and Technical
_ Specifications requirements. The operators were knowledgeable about the RHR systems
various modes of operation and the applicable Technical* Specification Limiting Condition for
Operation (LCO) action requirements 3.4.1.3, 3.4.1.4, 3.5.2, 3.5.3, 3.9.8.1, and 3.9.8.2.
Valve lineups were also evaluated and discussed with operations personnel to verify that the
flow configuration matched the plants operating condition. The configuration of valves is
controlled and tracked by the computerized system Tagging Request Inquiry System (TRIS).
Valve position abbreviations used in the TRIS computerized database are derived from
procedure OD-64, "TRIS Users Guide."
The procedure was determined to be inadequate, in
that, it did not identify several valve position abbreviations (i.e. ,RO and RX) which are
utilized in the TRIS database. Some operations personnel were not able to readily identify .
what the abbreviation RO meant. However, the TRIS valve lineups which contained the RO
abbreviations were being verified and signed-off by these individuals. This is a weakness in
the licensee's valve lineup procedure. The team, however, did not identify any other
operating procedural problems.
The team verified that adequate actions have been implemented to resolve previous cases
were the facility operated outside of its design bases. The team concluded that the procedures
provide adequate guidance to ensure proper RHR system operation under both normal and
accident conditions .
~
- ----
25
2.4.2 Surveillance Testing
The team reviewed the surveillance testing program for the ~
system and .*its* supporting
systems to verify that the surveillance procedures and results assure the RHR systems safety
functions.
The team conducted a review of the surveillance requirements and results to verify
conformance with the acceptance criteria in the Technical Specifications (TS) and Updated
Final Safety Analysis Report (UFSAR). The normal and accident flow paths of the RHR
system were also compared to the UFSAR. The recently completed flow path valve lineups
for Mode 1 operations were reviewed for the RHR and supporting systems to verify
component status control and demonstrate that the systems could perform their required safety
function. Unit 1 was selected for review since it had just completed a refueling outage. The
surveillance procedures valve lineup ch~k-off lists were assessed against the P&ID prints and
the computerized TRIS valve lineups to verify that the RHR system was operable and able to
perform its intended safety function. TRIS valve lineups were utilized for tagging and status
. control of a oomponent's position depending on the plants Mode of operation. To further
verify component/configuration control, the signed-off valve lineup check-off lists were
. compared to control room panel indications. The valve positions on the panels were in
conformance with the signed-off valve position check-off lists .
The following ~urveillances we.r;e verified to assure operability of the RHR system:
SP(O) 4.5.3.1, "Emergency Core Cooling - ECCS-Subsystems"
SP(O) 4.7.3.1,"Plant Systems - Component Cooling"
SP(O) 4~7.4. la, "Plant Systems- Service Water"
SP(O) 4.5.2c, "Emergency Core Cooling - ECCS-Subsystems"
SP(O) 4.5.2d, "Emergency Core Cooling - ECCS-Subsystems-Containment Sump"
SP(O) 4.5.2b, "Emergency Core Cooling - ECCS-Subsystems"
The following discrepancy was identified by the team:
The component position of RHR heat exchanger outlet valve 11RH18 is shown as
open (0) in the TRIS computer alignment printout. The component position for
this valve in the TRI.S printout should have been the same as the position
indication assigned to RHR heat exchanger outlet valve 12RH18, which is remotely
open (RO). The Nuclear Shift Supervisor initiated a TRIS database revision form
OD-16-A-1 to change valve positipn to RO for 11RH18.
Even though a minor discrepancy was identified, the team determined that the RHR and
supporting systems are adequately aligned and surveillance test results confirm that the RHR
system. meets the TS and UFSAR requirements. The team concluded that the RHR and
supporting systems are capable of performing their required design and safety functions.
26
2.4.3 Control Room Drawings *
During control room observations the team verified that operations personnel had ready
access to reference a controlled, u~to-date~ and accurate copy of drawings for the RHR and
supporting systems; e.g., Component Cooling Water (CCW), and Service Water (SW)
systems.
Controlled Piping and Instrumentation Diagrams (P&ID) system drawing files for each Salem
unit are maintained in full-size, hardcopy prints in the Nuclear Shift Supervisors' office.
Design Change Requests (DCR's) affecting a system that have not been incorporated into the
P&ID are noted *On the drawings that a DCR is outstanding against that particular drawing.
A review of the Nuclear Shift Supervisor's (NSS) DCR notebooks indicated that there were
no outstanding DCRs existing against the RHR, CCW, or SW systems. The operators were
able to retrieve all of the required controlled P&IDs for these systems from the NSS's files.
except the Unit 1 CCW drawing, P&ID 205231, sheet 2. *The operator stated that it was
probably just misfiled. However, the operator was able to readily access a controlled copy of
this print from the Work Control Center which is located just outside the main control room.
A discrepancy was found with four P&IDs (205232, sheets 1&2 and 205332, sheets 1&2).
These drawings indicated the valve position for the RHR heat exchanger bypass isolation
valves 11RH12, 12RH12, 21RH12 and 22RH12 to be normally closed (NC). The Mode 1
TRIS valve lineup for the RHR system and the valve check-off list in procedure OP-II.6.3.3,
"Terminating RHR", indicated these valves to be locked closed (LC). The licensee stated
that the P&IDs were incorrect, and initiated corrective actions to revise the P&IDs.
The team concluded that the P&IDs and system drawings adequately reflect the status of the
above systems current configurations. Minor discrepancies, however, were found between
the RHR valve position abbreviations on the P&ID drawings and procedure check-off
lists/computerized TRIS valve lineup sheets. The positions of these valves were actually in
their correct position for the systems to perform their intended safety functi~n.
2.4.4 Operator Training .
The training provided by PSE&G to licensed and nonlicensed operators for the RHR system
was reviewed by the team to verify that the training satisfactorily encompassed the UFSAR,
TS requirements, design changes to the system, event feedback, and evaluations of industry
experience.
The attendance records of several operators were reviewed for the RHR, *SW, and CCW
training. Results of the review indicate that the operators received RHR training on
September 5, 1989, SW training on January 14, 1991, and CCW training on January 18,
1991. By review of the licensee's training matrix, the team was able to verify that these
system training sessions were conducted within the required two year requalification cycle,
and were in accordance with the training program guidelines.
27
The system descriptions and lesson plans associated with the RHR system, which describe the
various system functions and operating characteristics of the RHR and interacting systems,
were reviewed in detail. The system descriptions were determi,ned to be adequate. However,
the RHR system (Chapter 8) and ECCS (Chapter 10) descriptions did not match the RHR
pump runout flow of 4500 gpm documented.in the FSAR and operating procedures. The
flow listed in two system descriptions indicated the flow to be 4800 gpm.
Through discussions with the operators, the team verified that the operators were able to
correctly identify the required 4500 gpm runout flow of the RHR pumps. It appears to be an
error on the part of the training staff to correctly identify the proper runout flow rates in the
system description material.
. The team observed an operating crew on the Salem simulator perform a generator hydrogen
leak scenario followed by an explosion and generator trip resulting in the isophase bus duct *
being blown apart. The team found that the crew performed the various steps of the EOPs
proficiently. The Nuclear Shift Supervisor displayed good command and control functions
throughout the entire event.
The team also observed a licensed operator classroom training session on control air systems.
There were only three operators that attended the session which was presented by a
contractor. Based on the information presented it appeared to be an in depth lecture on the
- system.
The team concluded that the RHR system training contained industry experiences and events,
design changes, -µFSAR, and ECCS design bases requirements. The operator training
program, relative to the RHR system, is adequate to ensure that operators can properly
operate and maintain the system within its design basis.
2.4.5 Tracking and Trending of RHR System Unavailability
The unit availability/reliability of the RHR system is tracked by the Performance Monitoring
group within . the licensee's Technical Organization. This information is tracked by *the
licensee as a safety system performance indicator under Safety Injection and is compared to
the industry unavailability average. The percentage rate that a safety system is unavailable is
determined by the number of hours the units were in Mode 1 divided by the hours the safety
system was unavailable (tagged out-of-service). The unit unavailability rate for each units
RHR system in 1989/1990 was as follows:
Unit 1
Unit 2
2.98% RHR system unavailability
1. 64 % RHR system unavailability
28
The industry average for RHR system unavailability is 2 % . The industry average is based on
a three year period of operational data. Based on the two year trended data at Salem it
appears that Salem Unit 2 RHR system unavailability rate will _be better than the industry
average and that Salem Unit 1 unavailability rate will be higher than the industry average.
The licensee's established goal for the Salem RHR system unavfillability rate is 1.5 % *
The licensee CQmpiles a monthly Safety System Unavailability Report for Salem Units 1 & 2.
A copy of the report is sent to the General Manager at Salem and copies get distributed to all
Salem department managers. The actual information- is evaluated and discussed at the
licensee's staff meetings each month. This information is being utilized to enhance the
licensee's planning and scheduling activities.
Conclusions
Operation and surveillance testing of the RHR system indicate that the system will fulfill its
intended design function. Operating procedures, surveillance procedures, and training
material adequately reflect the UFSAR, TS, and design basis of the RHR system.
Surveillance results indicate that the RHR system is operable and capable of performing its
safety function. Operations personnel exhibited 'technical and operational competence with *
respect to RHR system operation. However, based on the identified deficiencies in the P&ID
drawings, TRIS users procedure, and TRIS valve lineups the team concluded that due to
inattention to detail a weakness exists in quality oversight.
2.5
Structural/Piping
2.5.1 Scope
_ The objectives of this portion of the inspection were to evaluate the as-built design and
installation of the struCtural/piping items of the Residual Heat Removal (RHR) system and its
subsystems to fulfill their intended designed functions, to assure that system modifications
implemented since initial licensing had not introduced any unreviewed safety questions, and
any design basis changes had not degraded the system functional capability.
The SSFI team performed a system walkdown and reviewed the following documents to
assess the adequacy of the design of the RHR system:
Updated Final Safety Analysis Report (FSAR)
Selected Design Change Requests (DCRs) and Design Change Packages (DCPs)
Calculations, includirig pipe stress packages, pipe supports, equipment supports,
equipment seismic qualifications, and Tray Supports.
RHR and Safety Injection (SJ) flow diagrams, P&IDs.
RHR System descriptions
Seismic interaction analysis
29
2.5.1.1
Equipment and Equipment Smworts
The ~
reviewed different equipment and equipment support_s to determine that they were
adeqtiately designed to withstand a design basis seismic event. The following items were
reviewed by the team during the inspection.
2.5.1.2
_Rosemont Transmitter SupP<>rts
The licensee grouped 95 various transmitter supports into 16 categories and evaluated each
category for seismic adequacy. The result of this evaluation indicated that 13 of the 16
categories had a fundamental frequency less than 33 HZ, indicating that these supports should
not have been designed as rigid supports. The original design had assumed that these
supports were rigid, and zero period accelerations were used to account for the seismic load.
The licensee informed the team that outside consultants had been engaged to evaluate these
transmitter supports for their acceptability.
The team's review of the calculations indicated that, except in one case, the seismic niodel
reflected the as-built condition. The support that was the exception and as analyzed in
calculation s:..c-ZZXX-SDC-0248, "Salem Locally Mounted Transmitter Support-TSG No.
3," Revision 0, March 28, 1989 showed that the transmitter was mounted 5'-0" from the base
plate, but the as-built drawing depicted a distance of only 3'-8". The team visually examined
the support and verified that the as-built drawing was correct; however, the team found that
the licenSee's approach was conservative. The longer distance between the mass and the
support resulted in a lower fundamental frequency which would yield a higher seismic load.
The team found that the supports were adequately qualified.
'
.
2.5.1.3
Cable Tray Supports and Control Tray Hanger Seismic Qualifications
The team reviewed calculation S-C-ABV-EDC-0495, "Review of Control Tray Hangers
Seismic Restraints," Revision 0, October 10, 1989 which seismically qualified the tray
restraints for the control system conduits and found that the model reflected the as-built
condition, and the analysis used the appropriate damping values. The team also reviewed
calculations that seismically qualified the cable tray supports. Those calculations were S-C-
ABV-EDC-0494, "Cable Tray Hanger Support for Seismic Loads," Revision 0,
January 15, 1990, and S-C-ABV-EDC-0497, "Control Area Cable Support Seismic
. Analysis," Revision 0, January 15, 1990. The results of the calculations indicated that the
supports were designed to sustain the design basis seismic load. The team found that the
calculations utilized the appropriate input values to have the cable tray supports adequately
qualified .
30
2.5.1.4
The RHR and the service water intake structure (SWIS) sump pumps of the Salem station
were replaced in 1985 with Flygt pumps to facilitate maintenance. The pumps were moilnted
such that the connection to the discharge piping was held by a wedge clamp and the weight of
the pump instead of bolting rigidly to the piping. Due to the operational vibration of the
pump, this kind of connection has a potential for excessive leakage or separation if excess
movements were induced. Safety Evaluation S-C-M700-0367, "Seismic Qualification of
Mounting Method of Residual Heat Removal and Service Water Intake Structure Sump
Pumps," Revision 0, August 30, 1985 indicated that the Flygt mounting method was
dynamically qualified to loads that enveloped all seismic Class I design criteria.
The moun-
ting method was tested through a simulated horizontal acceleration from 0.2g to 0.6g and
vertical acceleration from 0.13g to 0.4g. During the test, a slight separation of the pump
discharge connection was observed which would allow a portion of the pumped liquid to be
discharged back into the sump through leakage. The separation disappeared after the
completion of the test and the pump remained fully operational during the entire test.
Since the RHR sumps were located in highly contaminated areas and the sump covers were
bolted down securely, the team decided to examine the SWIG sump to actually observe the
Flygt method of mounting. The team found that the pump mounting and the discharge pipe
connection were as described and the discharge connection was leaking. The licensee
indicated to the team that the sizing of the pump had already considered the factor of leaking.
The pump was sized twice the size necessary, in that the RHR sump pump could remove 100
gallons per minute for the estimated in-leakage of 50 gpm.
2.5.2 Pipe Stresses and Pipe Supports *
RHR piping was not categorized as high energy line, therefore, the team did not review the
pipe rupture analysis. The stress packages and the associated supports reviewed were
267204J for the RHR sump line and 567550 and 267244A for the RHR pump discharge line.
2.5.2.1
Stress Package 567550 for the RHR and SJ System
Piping described in this package was located in the Auxiliary Building. The model, with all
the branch lines, was derived from the as-built configuration. The team performed a spot
check of the computer input to ensure that the right information of the model was correctly
recorded as input to the computer. The team also spot checked the interface to ensure that
the appropriate computer output was properly used in the stress check and support design.
Pipe Hanger 2A-HRHG-21-10 was a horizontal guide located between valve 21RH8 and
21HR10 on the RHR pipe discharge line as described in stress package 567550. It was
evaluated in March, 1980 by a licensee contractor (UE&C) due to NRC IE bulletin 79-14,
. and was determined to be inadequate due to excess shear and bending stresses in the steel
members of the support. Design Change Request DCR-2EC-1151 together with modification
~
- I
31
package M39/2 adequately resolved this problem by adding a diagonal member to alleviate
the overstress condition. The team reviewed the original evaluation and the corrective action,
and found that they were.technically adequate. A separate w~down verified the as-built
configuration.
Pipe support 2-RHRA-21-9 was an anchor next to RHR pump 21 on the suction side. The
original design was determined to be inadequate due to the overstressing of the baseplate and
concrete anchor bolts. DCR-2EC-1151 and M39/2 redesigned the baseplate, and
satisfactorily qualified the support.
2.5.2.2
Pipe Suru><>rts Associated with Stress Package 267244A.
Pipe stress package 267244A was for the Unit 1 RHR piping on the suction side of the RHR
pump 12. Pipe supports reviewed were IP-RHRA-PS16 and IP-RHRG-S16. Both were
located at the containment penetration sleeve No. 16. The original design was prepared in
November, 1979 in response to NRC IE-Bulletins 79-02 and 79-07. These supports were
reevaluated in 1987 using the load comparison approach. The comparison showed that the
newly generated loads were either less than or no more than 10% greater th~ the loads used
to design the supports. The calculation concluded that, even though the new loads were
higher than the old loads, the stresses were still within the allowables for the support. The
team reviewed the evaluations and considered the conclusion acceptable. However, the team
did not review the original support design.
2.5.2.3
Pipe stress package 267204J assessed the stress in the 3/4 RHR sump line from RHR pump
No. 12 to anchors WDGA-225 and RHRA-20. The team reviewed stress package 267204J
and found that this package described a very short pipe run, and the higher stresses were near
the anchors but still within ANSI B31.1 allowables.
2.5 .3 Seismic Interaction
The team had planned to review the licensees seismic interaction program as part of the SSFI.
The licensee indicated to the team that Salem was constructed prior to the seismic interaction
requirements and this problem was presented to NRC as part of the resolution to unresolved
safety issue USI-A-46. Public Service Electric and Gas Company (PSE&G), the licensee, is
a member of the Seismic Qualification Utility Group which together with the Electric Power
Research Institute had prepared resolutions to USI-A-46. Revision 2 of the Generic
Implementation Procedure (GIP) had been submitted to NRC for review and approval in
February, 1991. After consulting with NRR, the team learned that NRR planned to issue a *
i
I
32
Safety Evaluation Report (SER) on this matter later this year. After the issuanee of the SER,
the utilities have to implement the GIP on a timely manlier. The licensee also informed the.
team that, on their own initiative, they were implementing the _seismic interaction issue
(commonly called the seismic 2 over 1 issue) through out the plant. During the walkdown,
the team did not observe any unacceptable conditions.
2.5.4 Design Change Control
The team received materials from the licensee during the preparational period of the *
inspection. There were 16 design change requests (DCRs) listed in the Configuration.
Baseline Document (CBD) .. The team requested that all DCRs should be available for the
team to review and the licensee replied that all DCRs *were contained in the CBD package.
During the team's two week site inspection, the team requested the licensee to provide a
DCRs list from time of the issuance of the operation license. The list contained many more
DCRs than those contained in the CBD package. The licensee's explanation indicated that *
Westinghouse was contracted to prepare the CBD package, and only DCRs affecting the
design basis were included in the CBD package.
During the review of the DCR list, the team found that DCR 2EC-l 158, replacing an existing
mechanical snubber with a rigid strut in the RHR and steam generator blowdown area, should
have been included in the CBD package. The rigid strut definitely changed design basis
because it behaved differently than a snubber. After certain amount of research, the licens~
responded that the snubber was replaced with a different size snubber by the same
manufacturer and PSE&G routinely modeled snubbers as rigid support in pipe stress analysis,
therefore, the change of snubber size did not impact the results of the pipe stress analyses
and, therefore, did not change the design basis. As-built drawing and a recent surveillance
record confirmed that a snubber was indeed installed.
3.0
Exit Interview
At the conclusion of the onsite inspection, on April 26, 1991, the inspection team met with
the licensee representatives, listed in Attachment II of this report. The team leader
summarized the scope and the findings of the inspection at this time .
ATTACHMENT I
- Summary of Weakness
A weakness is a condition or potential problem that is presented for licensee review to
establish what, if any, corrective actions are required. The following is a summary of
weakness as noted by the inspection team.
1.
Lack of control over stroke-time data after valve maintenance. (Reference Page 9)
2.
Identified deficiencies in P&ID drawings, TRIS users procedure, and TRIS valve
lineup (Reference page 28) (TRIS) .
'
J'
~.
ATTACHMENT Il
Persons Contacted
PERSONS CONTACTED
Public Service Electric and Gas Company
J. Bailey, Acting Manager, Nuclear Engineering Services
D. Bhavnani, Senior Staff Engineer
B. Binz, Supervisor, Specialist Group
A. Blum, PrinCipal Engineer
R. Brown, Principal Licensing Engineer
M. Bursztein, Manager, Nuclear Engineering
T. Cellmer, Manager, Rad. Prot./Chemistry - Salem
P. Craig, Onsite Safety Review - Salem
R. Donges, Licensing Engineer
G. Englert, Manager, Nuclear Engineering Standards
. J. Fest, Onsite Safety Review* Engineer - Salem
S. Fogelson, Offsite Safety Review
W. Grau, Senior Licensing Engineer
A. Kao, Principal Engineer
E. Krufka, Salem Onsite Representative
- S. La.Bruna, Vice President, Nuclear Operations
G. Luh, Principal Staff Engineer
W. Meyer, PTS, Mechanical Maintenance, Salem
. K. Moore, Safety Review Engineer
M. Morroni, Manager, Tech. Department - Salem
M; Mortarulo, Nuclear Electrical Supervisor
A. Orticelle, Maintenance Manager - Salem
I. Owens, Principal Engineer
P. Pla, Lead Electrical Design Engineer
J. Polizzi, Operations Manager - Salem
J. Ronafalvy, Manager, Nuclear Engineering Design
. M. Sessok, Atlantic Electric Site Representative
W. Shultz, Manager, Station QA - Salem
Y. Shyu, Senior Staff Engineer
R. Smith, EQ Engineer - Salem
A. Stone, Lead Engineer - CBD
B. Thomas, Licensing Engineer
F. Thomson, Assistant to Plant Manager
R. Vadhar, Engineer - Falcon
C. Vondra, General Manager
J. Wang, Safety Review Engineer - Salem
J. Weideman, ECCS..: System Engineer - Salem
D. Wilson, Nuclear Training
,*
A 'ITACHMENT III
Salem Station Equipment Qualification Master List (EQML), Rev. 5
Environmental Qualification Review Report (EQRR-0001), Rev. 6
Nuclear Department Programmatic Standards Equipment Qualification DE-PS.ZZ-0002 (Q)),
Appendix 8: 'Instruction_s for the preparation, review, and update of equipment
qualification binders for Salem Generating Station Units 1 and 2'
Work Control Process (Salem Maintenance Department) NC.NA-AP.ZZ-0009 (Q), Rev. 2
EQ Program Upgrade, 8/3/88 (SCI-88-0182)
LERs: 88-0182, 86-007-00, 87-015-00, 89-019-00
Work Order Package 911126007 for FT946-11, RHR HX Out, SI Flow Sensor Calibration
Work Order 901230010 for 1FT946, 1 lRHR Pump SI Flow DP Xmtr
Work Order 871019013 for 12RH19-MTRY, 12RH19 Limitorque Motor
EQ Binders:
16:
Westinghouse IE Motor Out-Of-Containment
28:
29:
Magnetrol Level Switch
49:
Rosemont 1153 Series D Transmitters
51:
SMB Limitorque Valve Actuators