ML20034B147
| ML20034B147 | |
| Person / Time | |
|---|---|
| Site: | Peach Bottom  |
| Issue date: | 04/20/1990 |
| From: | Koltay P, Konklin J, Lanning W Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20034B085 | List: |
| References | |
| 50-277-90-200, 50-278-90-200, NUDOCS 9004260082 | |
| Download: ML20034B147 (34) | |
See also: IR 05000277/1990200
Text
. -_
. .
.
-
.__ _
- . -.
_
.
.-
.
-.
'
.
.
,
,
.
,
'
U.S. NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR REACTOR REGULATION
!
NRC Inspection Report:
50-277/90-200
License Nos: DPR-44
50-278/90-200
Dockets: 50-277
50-278
l
Licensee: Philadelphia Electric Company
Peach Bottom Atomic Power Station
Route 1. Box 208
Delta, Pennsylvania 17314
1
facility Name:
Peach Bottom Atomic Power Station, Units 2 and 3
,
,
Inspection Conducted:
February 5 through 16, and
February 26 through March 2,1990
Inspection Team:
Peter S. Koltay Team Leader, NRR
'
John D. Wilcox, Assistant Team Leader
Janes A. Isom. Discipline Lead
,
Peter D. Drysdale, Senior Reactor Engineer, Region I
NRC Consultants: Robert E. Grazio. NEAC
Jack Klein, EBASCO
Herbert Stramberg, EBASCO
David S. Waters, EBASCO
Approved by,
dl%
//Jo/90
/
Peter 5. Koltay, Teant Leader
Date /
Team Inspection Section A
Special Inspection B:'anch
Division of Reactor Inspection and Safeguards
l
Office of Nuclear Reactor Regulation
Approved by:
mes I d
N'//7/96
s E. Konklin, Chief
Date '
'
eam Inspection Section A
i
Special Inspection Branch
Division of Reactor Inspection and Safeguards
Office of Nuclear Reactor Regulation
Q
Approved by: _
dUlu
M/
0
, e ., , ,
kdfne D. La nflin7, Chief
Dat'e
'
Specia'l Inspection Branch
Division of Reactor Inspection and Safeguards
Office of Nuclear Reactor Regulation
T
9004260082 900420
DR
ADOCK 0500
7
,
_
. .
-. - _ .
- -. .
_
_
_ . - -
-_
-.
2
r
.
,
,
'
!
.
.
EXECUTIVE SUMMARY
!
.
A Nuclear Regulatory Commission (NRC) inspection team conducted this safety
'
system functional inspection (SSFI) f rom February 5 through February 16 and
2
.
February 26 through March 2,1990, to assess the operational readiness of the
energency service water (ESW) and high-pressure coolant injection (HPCI)
,
systems. The $$FI team focused on the utility's ability to integrate system
i
,
and component design, design control, operations, surveillance and testing, and
maintenance into cohesive programs that support system operational readiness.
1
ESW SYSTEM
The team identified a concern regarding the operability of the ESW system based
on significant weaknesses in design, design control, system operations, and
surveillance testing.
As a result of this review, the SSFI team concluded that the licensee had not
perforned adequate analysis or testing to demonstrate operability of two of the
three ESW modes (closed cooling modes). The team was particularly concerned
that the ESW system lacked actual field test information to validate the design
!
basis flow calculations in its normal mode (open loop). A complete network
analysis performed by Bechtel in 1984 had indicated that the ESW system could
not meet original design flows to the pump room coolers for the emergency core
cooling system (ECCS). The licensee's engineering reevaluation of temperature
limitations in the ECCS pump rooms, however, resulted in lower than the origi-
nal system demands, indicating that the maximum cooling loads could be met.
The reevaluation did not allow any temperature margin in several of the ECCS
i
pump rooms. Documentation reviewed by the team indicated that licensee engi-
!
neers were concerned about the lack of field verification of the calculated
flow values. Although the engineers were aware of the weaknesses of the ESW
i
system, both operations and engineering personnel failed to recognize the
'
safety significance of the concern, and the licensee failed to take prompt and
appropriate corrective action.
In addition, some modifications to the system
were not supported by adequate engineering and safety evaluations. Certain
,
modifications actually reduced the flow capacity of the ESW system in the
'
closed cooling mode.
I
The SSF1 team determined that the ESW system, in its existing configuration,
had not been shown capable of performing its required safety functions for the
following reasons:
.
Appropriate testing had not been performed to demonstrate that the ESW
,
system could meet its design performance requirements with two units in
l
operation.
"
Although surveillance tests were capable of demonstrating that designated
parameters were satisfied, the par 6 meters chosen were not capable of
verifying ESW system performance.
Calculations had not been performed to determine acceptable net positive
suction head for the ESW booster pumps and to correlate the controlled
throttling of the pump discharge valve with system flow requirements and
pump suction pressure.
1
-
.
- - .
.-.
-
..
-
.. ..
..
_
,
. _.
--
--
-
,
i
.
-
,
'
'
.
.
Safety evaluations were not performed to determine the impact of two
modifications to ESW system operation:
the isolation of the reactor
building closed cooling water (RBCCW) system and throttling the booster
pump discharge valves.
The operating procedure for closed loop operations did not include ade-
.
quate instructions concerning positioning of the ESW booster pump dis-
!
charge valves and the emergency cooling tower (ECT) inlet valve.
j
The ECT fans and associated controls and equipment were not verified to
-
meet requirements for performing safety-related functions.
Technical staff performing surveillance tests observed by team members
failed to adhere to procedural requirements and exhibited a lack of
understanding concerning the use of surveillance procedures covering the
installation and use of appropriate instrumentation.
<
HPCI SYSTEM
The SSFI team determined that the HPCI system is capable of performing its
required safety functions.
However, the team identified problems with mainte-
nance, modification, and design controls which indicated the need for increased
management attention to ensure continued reliable operation of the HPCI system.
The team's conclusions were based on the following observations:
,
Threaded fasteners on the hydraulic oil flanges and the steam chest cover
,
of the HPCI pumps were of improper size and lacked noterial designations.
.
Existing fusing practices on the auxiliary oil pump, condensate pump, and
vacuum pump did not meet original design configuration.
The fusing
arrangement was not analyzed to determine the impact of a 10 CFR Part 50,
Appendix R plant shutdown following a fire, on the operability of the
auxiliary pumps.
i
l
.
I
l
!
l
'
i
ii
!
--
.-.-
.
_
.
.
..
-.
-
.
-
.
_
_
.
-
. _ _ _
- -
- - - _
_ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _
.
,
,
'
.
.
TABLE OF CONTENTS
PAGE
EXECUTIVE SUMMARY..........................................................
i
1.0 INSPECTION OBJECTIVE AND SC0FE........................................
1
2.0 DETAILED INSPECTION...................................................
1
2.1 Eme rgen cy Serv i ce Wa ter Sy s tem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
I
2.1.1 ESW Mechanical Des 1gn.....................................
2
2.1.2 ESW Electrical Des1gn.....................................
5
2.1.3 ESW I nstrumenta tion and Control Desi gn. . . . . . . . . . . . . . . . . . . . 6
2.2 High-Pre s sure Coola nt Inje ction Sy stem. . . . . . . . . . . . . . . . . . . . . . . . . . .
8
2.2.1
HPCI Mechanical Des 1gn....................................
8
2.2.2 HPCI Electrical Des 1gn....................................
9
2.2.3 HPCI Instrumentation and Control Design..... . . . .. .. . .... .
10
!
2.3 Other Related E lectri cal Sy stems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
11
2.3.1 E me r g e n cy D i e s e 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
12
2.3.2 E lectri ca l Protection Sy stems. . . . . . . . . . . . . . . . . . . . . . . . . . . .
12
2.3.3 Voltage Regulation for Control Circuits..................
13
2.3.4
Improper Documentation of Design Basis Calculations......
13
2.4
0perations......................................................
14
2.4.1 Operational
Programs.....................................
14
,
2.4.2 Operations Procedures....................................
14
'
2.4.3 Ope ra to r T ra i n i ng . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
18
2.5 Surveillance and Inservice Testing..............................
18
2.5.1
Surveillance Test Procedures.............................
18
2.5.2 Surveillan ce Test Rev1ew. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
19
2.6
Maintenance.....................................................
21
2.6.1
Fastener Control, Replacement Material, and
Mhintenance Practices....................................
21
2.6.2 Root-Cau se Ana ly se s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
22
2.6.3 Control of Equipment Trouble Tags........................
23
2.6.4 Motor-Operated Va1ves....................................
23
2.6.5 Spare Parts..............................................
24
2.6.6 Pl a nt Ma teria l Condi tion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.7 Design Ba seline Reconstitution Program. . . . . . . . . . . . . . . . . . . . . . . . . .
24
3.0 CONCLUS10N...........................................................
25
-
.
.
.
-
.
I
.
TABLE OF CONTENTS
<
PAGE
4.0 UNRESOLVED ITEMS.....................................................
25
,
i
5.0 EXIT MEETING.........................................................
25
APPENDI X A - Category of Finding s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1
APPENDIX B - Personnel Contacted...........................................
B-1
.
i
e
e
P
b
I
i
.
.
I
i
4
,-
~
. . _
_
._
__
__
_ _ _.
.
.
._
_
._
,
.
'
,
'
.
,
i
.
1.0 INSPECTION OBJECT!YE AND SCOPE
'
Nuclear Regulatory Commission (NRC) staff performed an announced safety system
I
,
functional inspection (SSFI) to verify the functionality of the emergency
)
l
service water (ESW) and the high-pressure coolant injection (HPCI) systems at
i
l
the Peach Bottom Atomic Power Station, Units E and 3.
i
!
)
The primary _ objective of the SSFI was to assess the operational readiness of
j
the HPCI and ESW systems by determining whether
1
The systems are capable of performing the safety functions required by
j
their design basis.
'
Testing is adequate to demonstrate that the systems could perform all of
the safety functions required.
System maintenance (with emphasis on pumps and valves) is adequate to
'
ensure system operability under postulated accident conditions.
Operator and maintenance technician training is adequate to ensure proper
operations and maintenance of the system.
Procedural adequacy (e.g., accessibility and labelling of valves) relating
to the selected systems to ensure proper system operation under norrel and
accident conditions.
Management controls including procedures are adequate to ensure that the
'
safety systems will fulfill the safety. functions required by their design
bases.
The SSfl team reviewed system descriptions; the Updated final Safety Analysis
Report (UFSAR); equipment sizing calculations; docunentation pertaining to
.
system protection, controls, and interlocks; equipment specifications; modifi-
cation packages (MPs); licensee event reports (LERs); related test and operat-
,
ing procedures; and one-line diagrams, elenentary diagrams, and equipment
layout drawings.
In addition, the team reviewed operating and administrative control procedures,
reviewed selected operator status logs and control room system files, performed
walldowns of systems and plant areas, and conducted interviews with licensed
and non-licensed operations personnel and system engineers regarding the HPCI
and ESW systems.
2.0 DETAILED INSPECTION
2.1 Emergency Service Water System
The ESW system and its associated emergency cooling tower (ECT) are common to
Units 2 and 3 and provide cooling water to diesel generator heat exchangers,
,
emergency core cooling system coolers, and reactor building closed cooling
water heat exchangers during loss of offsite power. The main system components
that are supplied with ac power are two ESW pumps, two ESW booster pumps, one
emergency cooling tower (ECT) pump, and three emergency cooling tower f ans.
>
>
i
1
.
-.
..
.-
- ---
.
.
.
_
___ _ _ _ .
_
_
__
_
.
_ _ - . _ . . . _ _
_
_
.
.
,
'
.
.
2.1.1
ESW Mechanical Design
The SSFI team reviewed the available design information for the three modes of
>
ESW system operation to determine whether ESW. system design parameters used in
the various safety analyses and referenced in the Final Safety Analysis Report
(FSAR) and Technical Specifications were adequately supported by analyses. The
team 1ound that the licensee did not have adequate analyses to demonstrate
oper6bility of the two alternate ESW modes.
The team also was concerned that
the licenses had not demonstrated operability of the normal ESW cooling mode
i
because of little or no design margin calculated for the ESW system in this
mode and insufficient field test information to validate the design input
assumptions.
'
Although the licensee did not have a design basis document for the ESW system,
the team was able to reconstruct the design requirements for the ESW system
J
through interviews with the licensee's engineering staff and through review of
several licensee documents, such as Bechtel calculation " Emergency Service
Water Pump Head Requirement," dated December 4, 1968; "Bechtel Calculation to
Determine ESW System Pressure Loss," dated May 12, 1971; and "The ESW System
,
'
Network Analysis," dated May 1984
The ESW system at Peach Bottom serves both Units 2 and 3, and is designed,
.
under a loss-of-offsite power condition, to provide cooling water to the heat
.
i
exchangers for the unit with a loss-of-coolant (LOCA) accident, as well as to
provide cooling water to the heat exchangers of the other unit that needs to be
!
shut down. To reliably accomplish this function, the following three modes of
ESW operation have to be considered:
(1) the normal ESW system operation -
utilizing the ESW pumps, (2) the ESW cooling tower mode - utilizing the ESW
'
pumps, booster pumps, and fans, and (3) the ECW cooling tower mode - utilizing
the cooling tower pump, booster pumps, and fans.
During normal ESW system operation, each of the two ESW pumps was designed to
provide all of the required cooling water to the emergency core cooling system
(ECCS)heatexchangers. The source of water is the Conowingo pond, with ESW
discharge back to the Conowingo pond.
In the event the pond is lost as a
source of cooling water, the ESW system can be reconfigured into its closed
loop modes of operation by closing its intake gates (one gate for each of the
two ESW pumps) to isolate the system from the Conowingo pond.
In the
closed-loop configuration, the ESW system can be operated in either the ESW or
the ECW cooling tower modes of operation.
In the ESW cooling tower mode, the
cooling water path is from the ESW pump to the heat exchangers through the ESW
booster pump to the emergency cooling tower and back to the ESW pump suction.
In the ECW cooling tower mode, the ECW pump takes suction on the cooling tower
basin and sends water through the ECCS heat exchangers.
The water is then
returned to the cooling tower by the ESW booster pump.
The SSF1 team reviewed the Bechtel calculation for emergency service water pump
head requirements (dated December 4, 1968) and found that:
"
The ESW pumps were purchased with no margin for pump head. The calcula-
tion recommended that the pumps be purchased for a capacity of 8,750 gpm
at a head of 96 feet.
Instead, the pumps were purchased for a capacity of
8000 gpm at a head of 96 feet.
,
2
.
.
.-
.
.~
_
_
.
y
..___ _
- _ _ _ _
____
__
_ __
~ _ _ _ _
._
i
j
.
..
.
1
The calculation used the friction loss factor for new pipe although the
i
instructions to the calculation stressed the need to be conservative by
using the system friction loss based on aged pipe.
!
The calculation did not consider the elevation of the discharge spillover,
I
which would have added approximately 24 feet of static head to the
l
required total head of the pump.
The calculations did not address the emergency cooling tower mode of
operation in which an ESW pump operates in series with the ESW booster
pump. There was no provision in the calculation for booster pump suction
-
requirements.
l
The team also reviewed the " Emergency Cooling Water System No. 48" final
calculation (datedDecember 22,1971), which was performed to obtain the ESW
system flow requirements after construction of the ESW system was completed.
l w team found that this calculation assumed that the ESW pump can provide 44
,
feet of head to the suction of the ESW booster pump. The licensee was not able
,
to determine the justification for this assumption.
?
'
The SSFI team reviewed the Bechtel " Emergency Service Water System" calculation
(dated May 25,1971), which was performed to prove that the installed pumps
could provide the required system flow. The required system flow was derived
through sumation of various required flows to the individual heat exchangers
and was found to be 6376 gpm, which was lower than the pump design flow of 8000
,
gpm. The calculations indicated that, at a flow rate of 6376 gpm, the
emer0ency service water pump could produce a head of 104 feet, which is suffi-
cient for both static and dynamic resistances of the system. The calculation
assumed balanced flows. However, 1or the system as configured in the plant,
the flow is not balanced.
The team also reviewed the Bechtel " Emergency Service Water System Network
Analysis" dated July 1984. This was the most recent analysis performed by
Bechtel to determine the effect on flow to the individual ECCS room coolers due
to a loss of control air to the safeguard coolers isolation valves. The
licensee had considered the effect of a loss-of-air event on the ESW system
performance because the air system at Peach Bottom was not safety-related. The
analysis indicated that loss of air would cause both ECCS room coolers to be
placed in service, although.ely one of the two room coolers would be effective
in reducing the room temperature because only one of the two ECCS room cooler
fans would receive an initiating signal during a design basis accident. The
team was concerned because this analysis indicated that the ESW pumps could not
deliver the design flow to most of-the components in the normal cooling mode
and that, under certain conditions, there could be reduced net positive suction
4
head 1or the ESW booster pump when the ESW system was operated in either of the
,
cooling tower modes. The team further found that:
A
'
The new ECCS room temperatures had little or no design margin for HPCI,
core spray, and the residual heat removal rooms.
The Bechtel analysis did not fully account for the effect of corrosion and
erosion of the ESW piping on the system flow.
3
.
.
-
.
~.
_
_
_.
_
.
.
i
.
,
'
.
The analysis did not take into account the fouling of heat exchangers and
I
'
piping and its effect on both ESW flow and heat exchanger performance.
The analysis made reference to qualification temperatures based on prelim-
l
inary calculations.
'
Bechtel's analysis showed that, in the worst case, the flow to several unit
,
coolers was 37 percent of the design flow.
Bechtel concluded that, with a loss
of air and unbalanced system flow, the ESW pump was capable of delivering
approximately 6440 gpm to the system.
The analysis compared the increased room
'
temperatures with the preliminary equipnent qualification temperatures and
concluded that the ESW system was still functional because all room tempera-
!
tures would satisfy equipment qualification temperatures.
.
However, the S$F1 team was unable to determine from the Bechtel analysis
whether Bechtel had assumed that the reactor building closed cooling water
(RBCCW) heat exchangers (HXs) were in service for the purpose of calculating
ECCS room temperatures. The team was informed by the licensee that the ECCS
,
room temperatures were calculated with RBCCW HXs in service. However, since
'
RBCCW HX can receive a significant portion of the ESW flow when in service
1
(approximately 40 percent of total ESW flow), the team determined that it was
important that this factor be clearly identified in the report. Additionally,
.
the team could not understand why the RBCCW HX would be considered for the ESW
system performance analysis in 1984
The RBCCW system was required to be
'.
isolated based on a 1979 safety evaluation that found the system not to be
seismically qualified.
The team considered that inadequate design control and the lack of a suitable
testing program by the licensee had allowed a potentially significant design
'
deficiency in the ESW system to go unrecognized by engineering and operations
personnel. While system analyses performed in 1984 had shown that calculated
flow values could minimally meet calculated load demands, and field tests to
,
verify the analytical results were recommended by Bechtel in 1984 and by pECO
engineers in 1989, no such integrated ESW system field test had been performed
prior to this inspection.
In addition, the licensee modified the system in
l
1988 by replacing two-inch piping on Unit 2, and in 1989, by increasing the
size of the Unit 3 ring header. The licensee's failure to identify ESW system
flow deficiencies from initial plant startup to 1983, and the failure to
initiate corrective action once the ESW system flow deficiency was assessed in
1983 is a potential violation of the requirements of 10 CFR Part 50, Appendix B
Criterion XVI (50-277/90-200-01; 50-278/90-200-01).
Based on the team's
findings, the licensee initiated imediate corrective actions to assess the
capability of the ESW system.
Preliminary p16ns to this effect were presented
to the team at the conclusion of the inspection,
j
The team was unable to review calculations for the two ECW cooling tower modes
of operation because the licensee had not yet performed calculations to deter-
i
j
mine the design requirements for the ESW system in those two modes. However,
l
af ter review of available design information associated with the system in
these two modes, the team noted that the licensee had completed modifications
'
to the ESW system operations without adequately evaluating the effect of such
modifications on the operability of the ESW system.
4
g
l
l
y-
.
+y--w+w..-
-
,-
-
,.
. . .
,-.
pr
g
gr
--
'*.e
-
-
i
.
,
.
.
The licensee had not calculated the effect of throttling the ESW booster
pump discharge valve on the system flow. Operators were directed to
throttle the discharge valve to prevent tripping the ESW booster pumps
during low suction pressure. The team was concerned that throttling close
the discharge valve to 75 percent could reduce ESW flow to the point that
the ECCS coolers would receive less than the design flow.
The ESW system design had been changed in 1979 by isolating the reactor
building closed cooling water (RBCCW) system from the ESW system. This
change in the plant configuration was necessary to isolate the seismically
designed ESW system from the nonseismically designed RBCCW system. This
change resulted in the reduction of ESW flow to the suction side of the
ESW system booster pumps.
The licensee may make changes to the facility as described in the FSAR pursuant
to 10 CFR 50.59. The licensee must maintain records that include a written
safety evaluation to determine whether an unreviewed safety question was
introduced by the change. The licensee completed the above modifications,
which changed the ESW and RBCCW systems from those described in the FSAR
1
without performing. appropriate safety evaluations.
This is a potential
violation of the requirements of 10 CFR 50.59 (50-277/90-200-02; 50-278/
90-200-02).
2.1.2 ESW Electrical Design
i
The team reviewed the power source and distribution system for the ESW system
.
as well as the design documentation for the motors and loads needed for the ESW
'
system equipment. The team found minor discrepancies between the design basis
calculations and the regulatory requirements. However, these discrepancies did
not affect the operability of the ESW system.
i
<
l
Design basis documents, such as essential calculations, should be controlled in
l
accordance with Section III, " Design Control " and Section V, " Instructions,
i
l
Procedures, and Drawings," of 10 CFR Part 50, Appendix B, and ANSI Standard
N45.2.11-1974, " Quality Assurance Requirements for the Design of Nuclear Power
Plants."
The following discrepancies were identified:
I
The coordination diagram, Figure 1 of sheet 16 of the coordination study,
calculation E-4, did not show that the load center transformer was
'
properly protected for a ground fault of 1002 amperes for 2 seconds in
accordance with the ANSI standard.
Further investigation showed that this
protection was adequately provided by relay 151 N, which was not shown in
j
the coordination diagram. The licensee stated that the graphs of calcula-
tion E-4 will be revised to indicate that adequate transformer protection
is provided.
The SSF1 team reviewed the protection documentation for the ESW pump, ESW
booster pump, and ECW pump and found that documentation of motor protec-
tion against current overloads and short circuits, and coordination of
protective relay settings versus motor starting inrush current were not
-
!
l
5
.
.
a
4
properly shown in the calculations or were entirely misting.
Important
parameters, such as the motor accelerating time and the motor stall time
(which relates to the period of time that the motor is able to withstand
the high level of starting current) were not included in the original
coordination graphs. This information is important to ensure that the
motor will trip during the starting and running periods before exceeding
the limits to prevent damage to the motor.
It also is important to ensure
that spurious tripping will not occur during motor acceleration. The team
also found instances where that the calculations were unchecked, refer-
entes were not provided, and some assumptions were not stated or validated.
The preliminary rough calculation performed by the licensee to answer the
team's concerns indicated that adequate relaying protection was being
provided, and that no spurious trips could be present during the motor
accelerating period. The licensee committed to formalizing the revisions
to the calculations performed during the inspection.
The team could not determine from the control diagram for the ECT fan
motors, drawing E-347, whether proper undervoltage protection for the ECT
fans was provided. The licensee initiated a search and was abic to find
switchgear vendor information which demonstrated that this protection was
provided by devices internal to the breaker.
The team examined the control circuit for the sluice gate valves and found
that a potential existed for the overload protection to be spuriously
i
,
bypassed by an accidental ground fault. While this constituted a design
I
shortcoming, it was eventually determined that there was no safety impact
because sufficient time would be available for operation of the valves by
hand if the motor operators became inoperative. Therefore, the opera-
tional capability of the ESW system would not be affected.
,
2.1.3 ESW Instrumentation and Control Design
'
The SSFI team reviewed the ESW system electrical schematic diagrams and instru-
ment calibration records, the valve and pump manual, and automatic controls,
indication, alarms, protective relaying and interlocks, and the power supplies
for motors and control circuits.
The inspection team reviewed the control logic of the redundant ESW pumps,
Trains A and B, and noted the following:
,
4
The logic circuitry design would initiate and maintain an automatic start
signal to the standby pump upon loss of the operating ESW pump.
If the
standby pump were tripped manually or automatically after it was initially
started, it would be difficult to restart. The 4.16kV brehkers for the
ESW pumps are provided with antipump logic circuitry designed to prevent
cycling of the circuit breaker between the closed and tripped position
when closing and trip signals exist concurrently. The details of this
design problem were issued as part of Information Notice Number 75, 1988.
Because the automatic start signal is continually maintained and this
feature seals in the antipump circuit, attempts to close the breaker for
the standby pump would be prevented without altering the control logic.
The team was concerned that this unique design feature associated with the
ESW pumps would unnecessarily confuse the operators if the second ESW pump
6
,
.
. . _ _
_
._
. __
_
_.
_ _ _ _ _
_
.
__
.
i
'
'
,
was needed. The inspectors verified that control room operators were
unaware of this design feature. The licensee agreed that applicable alarm
response cards and off-normal operating procedures will be revised to
,
include information for operators on how to reset and restart the pumps.
1
The power circuitry for the ESW pumps logic was common to both trains A
.
and B, resulting in the degradation of independence between trains.
.
'
Furthermore, cross wiring between the logic circuitry networks of trains A
and B created a condition in which wiring of the logic circuitry for both
trains was terminated on adjacent control switch terminals, violating the
intent of the separation criteria of docunent 22A1421. " Electrical Equip-
t
nent Separation for Safeguards Systems." Although the licensee had
performed an analysis to demonstrate that a single failure of comon
devices that would disable both trains is not likely, this analysis did
not account for gross failure of the switch, which could be caused by a
-
fire or other external event. This item remains unresolved pending an NRC
,
review of the licensee's evaluation to determine the impact of cata-
strophic switch failure on system operability (50-277/90-200-03;
50-278/90-200-03).
'
,
The SSFI team reviewed the electrical circuits for the ECW tower system and
.
found that controls and associated cables for the ECW tower fans were not
'
seismically qualified. Some equipment was classified as safety related and
other equipment was classified as not safety related. The team's review of
.
drawings 6280-E-347, " Electrical Schematic Diagram Emergency Cooling System
Cooling Tower Fans," Revision 7, and 6280-E-346, " Electrical Schematic Diagram
Energency Cooling System Cooling Tower Fan inlet Valves," Revision 7, indicated
that the controls and associated cables to the ECW cooling tower fans were not
seismically qualified. Section 10.24.2.4 of the peach Bottom FSAR requires the
ECW system to be operable during a loss of offsite power and after a seismic
>
event. Although the team determined that, based on the design documents, all
emergency cooling tower equipment appeared to be operable after a loss of
offsite power, the team concluded that adequate documentation did not exist
to show that the ECW cooling tower fan controllers could withstand a seismic
event.
The failure of ECW fans following a seismic event would result in loss of both
modes of the closed cooling operation of the ESW system, which constitutes the
plant heat sink when the normal heat sink, Conwingo pond, is unavailable. The
licensee stated that documentation verifying the seismic qualification of the
subject equipment will be developed. This item remains unresolved pending NRC
,
reviewofsuchdocuments(50-277/90-200-04;50-278/90-200-04).
.
The team also reviewed the records and procedures used to routinely conduct
instrument calibrations to determine whether the setpoints were set correctly
and whether instrument accuracy w adequate for the use of the instrumenta-
tion. The team found that the calibrations were conducted according to proce-
dures without discrepancies, and that the procedures were acequate for the
calibrations performed.
,
7
___
_
_
. _ . _ _
.
- -
-
_
_
__
-
_.
_
. _
._. _ _ _ . ._
___ _ __
_
1
.
.
,
-
,
i
-
2.2 High-Pressure Coolant Injection System
I
I
l
2.2.1 HPCI Mechanical Design
'
The SSF1 team reviewed the available design documents to determine whether HPCI
system design parameters used in the various safety analyses and referentec in
the FSAR and Technical Specifications were adequately supported by calculations
or analyses. Although the team determined that the HPCI systen was adequately
a
'
designed, the team found that the HPCI gland seal condenser is a nonsafety-
!
related component. As a result, the team was concerned that failure of the
4
condenser could affect the HPCI system capability to meet its functional
t
requirements. The gland seal condenser associated with the HPCI pump condenses
!
the gland sealing steam, to prevent the steam from entering the room. Since
'
the gland seal condenser is not environmentally qualified on the shell side
j
where it is connected to the turbine seal leak-off connections, the team was
concerned that, during a design basis accident, the integrity of the shell
,
could be lost and the steam from the turbine shafts could leak into the HPCI
room and raise the room temperature. Although FSAR Section 6.4.1 indicates
j
that failure of the gland seal condenser does not prevent the HPCI system from
fulfilling its core cooling objective, consideration was apparently not given
to the increase in room temperature that would result from the gross failure of
the gland steam condenser.
Based on the team's concerns, the licensee
calculated the maximum room temperature following a condenser failure, and
determined that the room temperature would be maintained at less than 150'F,
which would assure continued system operation.
The team reviewed calculations to ensure that vortexing would not be caused by
'
the HPCI pump at either the suppression pool or the condensate storage tank.
-
Calculation ME-378, " Determination of Vortex Limit for ECCS Pumps Taking
Suction on Suppression Pool," dated March 14, 1989, showed that the level at
which vortexing would occur is well below the low water level alarm of the
suppression pool. The team considered this to be acceptable protection against
vortexing when taking suction from the suppression pool.
l
However, calculation 18247-M-035, " Condensate Storage Tank - Minimum Water
l
Level to Prevent Yortex Formation," dated February 20,.1990, showed that the
'
present low suction setpoint associated with the condensate storage tank was
below the level at which vortexing would occur. The calculation showed that a
water level of 6 feet 9 inches from the botton of the condensate storage tank
iP required to prevent vortex formation and that the present low suction
transfer set)oint f rom the condensate storage tank to the suppression pool is
5 feet 3 incies, per Technical Specification Table 3.2.B.
The 6-foot 9-inch
"
value includes an allowance for a 35-second transfer of the pump suction from
the condensate storage tank to the suppression pool.
,
The licensee stated that, even though the HPCI pump would be vortexing for
approximately 2 minutes until the suction transfer to the suppression pool is
complete, there would be no damage expected to the pump from this short dura-
!
tion of vortexing.
The team agreed with the licensee's assessment.
l
The team reviewed the licensee's station blackout procedure and found that the
l
temperature requirement to shift suction from the suppression pool to the
condensate storage tank could subject the HPCI pump to cavitation. Procedure
SE-11, Revision 2 " Station Blackout," Paragraph 16.b, directs the operator to
,
,
!
transfer the HPCI pump suction to the condensate storage tank when the torus
,
i
8
-
--
-
.
.
-
-
-
- - - - -
.
.
..-
-
..
..
,
t
.
temperature reaches 200'F.
Bechtel calculation MO-1, Revision 4. dated
November 2 1989, " Maximum Torus Temperature Allowed (Assuming no Torus Back
Pressure) for the ECCS Systems," determined that cavitation of the HPCI pump
would begin at a torus temperature of 196'F. Therefore, the team was concerned
that the 200*F value in procedure SE-11 was above the maximum temperature for
adequate net positive suction head for the HPCI pump. The licensee agreed that
the 200*F transfer point for the HPCI pump was unsatisfactory and said it would
revise procedure SE-11 to indicate 190*F in lieu of 200'F. This consnitment is
considered to be an open item (50-277/90-200-05; 50-278/90-200-05).
The team also found a discrepancy in calculation 18247-M-034, which was per-
formed to support a General Electric (GE) specification 22A1330AB requirement
that the total condensate reserve storage capacity for both HPCI and reactor
core isolation cooling systems, be 135,000 gallons per unit.
However, the
condensate storage tank had only 99,137 gallons available. The licensee said
4
that the original specification of 135,000 gallons dedicated reserve for the
HPCI and reactor core isolation cooling systems corresponded to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of
system operation, making up decay heat boil off and inventory shrink. The
135,000 gallons was based on the reactor and core models of the late 1960's.
However, the team found that a recent analysis performed by GE using present
day GE models indicated that a capacity of 140,694 gallons is needed to ensure
B hours of satisfactory system operation.
The licensee did not consider the condensate storage tank inventory discrepancy
to be a safety concern. The condensate storage tank is not required to be
seismically qualified and the torus is available as a safeguard source of water
for the HPCI system accident response. However, the available water volume in
the condensate storage tank for safe shutdown may impact other Analyses (e.g.,
safe shutdown for Appendix R). The licensee and GE reviewed the Peach Bottom
Fire Protection Plan and the Station Blackout Analyses, and concluded that the
ability to safely shut down the reactor is not af facted by this volume discrep-
ancy. Although there now appears to be no significant safety concern in this
area, the team considered that the licensee failed to recognize a long-standing
design deficiency.
2.2.2 HPCI Electrical Design
lhe team reviewed the power source and distribution system for the ESW system
as well as the design documentation for the motors and loads for the equipment
that is needed for the HPCI system. This was a limited review because of the
relatively small number of components that are required to function in order to
render the HPCI system operable. With the exception of the steam supply
inboard containment isolation valve MO-15, the HPCI system does not depend on
ac power. This isolation valve is normally in the open position, therefore, it
does not need to operate to allow the HPCI function. All other valves and
auxiliary systems, including controls and instrumentation and power, are from
the oc onsite power system.
During its review of drawing E26, Revision 42, the team noted that, because a
1
portion of feeder to panci 2PPC connecting fuse box 2AD17 to fuse box 20D19,
did not have a dedicated fuse protection, it appeared to be unprotected against
overloads. The licensee responded that the likelihood of short circuit between
'
the positive and negative wires was precluded because the cable conductors are
run in separate conduits and are very short in length. The team considered
this explanation to be adequate.
9
--
-
--
- -
- -
- - - -
-_.
.. -
_ _ _ _ _
- _ _ _
_
n
>
.
i
i
-
The team reviewed the one-line diagram, drawing E-26, Sheet 1, for plant de
'
power and 1ound that 35-ampere fuses were being used to protect the #10 AWG
cable feeder. This fuse size appeared to be too large for proper branch
circuit protection. The licensee indicated that presently available fuses for
i
250V de were 35 ampere rating and larger and that no fuses rated below
35 ampere were consnercially available for operation at 250 volts. The lack of
concercially available fuses in the lower level amperage and 250 volt rating
motivated the use of a larger fuse than would normally have been provided. The
team agreed that voltage rating was more important than ampere rating, and that
the overload protection in the starter should afford adequate protection for
the cable.
-
2.2.3 HPCI Instrumentation and Control Design
The team reviewed the electrical schematic diagrams, instrument calibration and
functional test records to determine whether the automatic and manual controls,
indications, alarms, and interlocks were adequate to reet the requirements of
the FSAR and Technical Specifications. The review included an evaluation of
the control circuit fuse coordination, motor-operated valve limit switch and
torque switch application, and instrunent setpoint accuracies. The instrumen-
tation and control for the HPCI system appeared to be inadequate for concerns
,
regarding fuse selection and sizing.
l
The team also reviewed the motive and control power fuse protection for the
HPCI de pump motors in the 125V and 250V de circuits. Three auxiliary pumps
.
are associated with each of the two HPCI pumps. Two of these pumps, the gland
-
seal condenser condensate and vacuum pumps, are not safety related. The third
pump, the auxiliary oil pump, is safety-related and is used during initial HPCI
.
pump startup for supplying control oil to the HPCI turbine control unit and for
1
supplying bearing oil to the HPCI bearings. The team found that the fuse
.
sizing coordination for short circuit protection of the gland seal condenser
condensate and vacuum pumps was modified in response to 10 CFR 50 Appendix R
l
requirements to accommodate alternate shutdewn capability following a fire.
l
The new design did not provide selectivity to ensure that a short circuit
i
induced fault would only blow the fuse close to the f ault without blowing the
!
fuse upstream.
For example, the 125V de control power supply positive phase
for the gland seal condensate pump motor had a 12A fuse in series with a 15A
fuse. This configuration did not provide selectivity to ensure that only one
of the fuses would blow on short circuit fault current in the control circuit.
The fuse manufacturer's guidelines for fuse coordination indicated that a two
'
to one ratio between fuses in series is needed, thus both the 15A and 12A fuses
were likely to fail.
l
l
Although the operators would be able to regain control power to these pumps
l
even if both the ISA and 12A fuses had blown, the optrators would not be able
I
to maintain operability of the pumps because the power to the motors themselves
could not be regained.
In addition, the team was concerned that at the time
i
the auxiliary oil pump controls are transferred to the alternate 125V de power
!
control circuit, two 15A fuses on the feeders would then be in parallel,
capable of supplying 30 amperes of current.
However, 30 amperes appeared to
exceed the ampacity of the control circuit conductor size of No. 14 AWG or less
,
l
resulting in the loss of the auxiliary oil pump. On the basis of the team's
finding the licensee prepared nonconformance reports to initiate corrective
actions. This item remains unresolved pending NRC review of the completed
correctiveactions(50-277/90-200-06;50-278/90-200-06).
,
10
l
-.
-_ - -
-
. - - -
-_
-.
.
_
.
--.
. .
. - -
.
.
-
.
.
The team reviewed the HPCI system alarms on drawing 6280-M-$-36, sheets 19 and
26, Revision 62, and found that the licensee did not have bypassed or
loss-of-status indication for the motor power to HPCI valves 23 17, 19, 21
14,
16, 24, 25, 57, and 58. The team was particularly concerned that a loss of
motor power to HPCI valves M0-14 and 19 would not be annunciated in the control
room. These valves are required to open in order for the HPCI system to
function. M0-14 is the steam inlet valve to the HPCI turbine and MO-19 is the
HPCI discharge valve.
Additionally, the team's review of design input document M-20593, Revision 1,
dated April 3,1985,)for the alternate control station modification, referenced
Regulatory Guide (RG 1.47, " Bypassed and Inoperable Status Incication."
RG 1.47 requires that bypassed or inoperable status of equipnent be indicated
in the control room. However the licensee had not followed RG 1,47 because
inoperable status alarms were, lacking for loss of 250V de power to valves
2317,19, 21,14,16, 24, 25, 57, and 58 and control switches $23A-S17, $19,
and $72 in the " locked-out-in-stop" position.
Also, the team was concerned that the annunciator for the loss of motor power
to the auxiliary oil pump might not invoke a timely response from the operators
because it is the common alarm to detect loss of motor power to the gland seal
condenser condensate pump and the gland seal condenser blower. Prompt atten-
tion is required for loss of motor power to the auxiliary oil pump because it
provides lubrication initially for the HPCI turbines and also provides control
oil to the HPCI stop and control valves. These valves control the startup time
of the HPCI turbine, which must neet a 25 second criterion.
The licensee st6ted that PECO was not comitted to implement the requirements
of RG 1.47 at the Peach Bottom power station. The implementation of the
RG 1.47 requirement for modification M-20593 was an engineering initiative not
supported by departmental procedures. The licensee stated,-however, that a
consistent policy will be developed and incorporated into engineering
procedures.
The team also reviewed a sample of the records of the routinely conducted
instrument setpoint calibrations for instrumentation associated with the HPCI
system to determine whether the records adequately demonstrated setpoint
accuracy. The team found that calibrations had been as required by procedures,
that the procedures were adequate, and that no significant discrepancies
existed.
The team also reviewed a sample of surveillance test records to determine
whether the tests checked the logic functions from the initiating source to the
actuation device.
For the cases in which the initiation was from a coincidence
logic, the team reviewed only one channel. The team determined that the tests
reviewed were adequate and met the surveillance requirements.
2.3 Other Related Electrical Systems
The team also reviewed other electrical systems which provide ac or de power to
.
either the ESW or the HPCI or that could affect the reliability of ac or dc
'
power to these systems.
11
___
.
.
.
-
,
.
2.3.1 Emergency Diesel Generators (EDGs) Loading
The team reviewed modification package 2123A, dated February 2,1990, and found
that a recalculation of the loading conditions- for the EDGs showed a substan-
tial increase in previously estimated loads that were the basis for the values
given in FSAR Tables 5.5.2.
Newly calculated loading conditions resulted in
considerable reduction of the previously established design margins for the
EDGs.
The team also noted that, in the event the operators had to restart the RHR
pumps on a loaded diesel generator, they would have to reduce the bus loads to
1400 kW because of the existing diesel design margin. The licensee is now in
the process of revising the operating procedures and associated training for
this event.
2.3.2 Electrical Protection Systems
The team reviewed various electrical protection devices for the ac and dc
systems to determine their ability to protect the ac and de power sources.
Although the team concluded that the existing protection systems could ade-
quately provide the required protection, the team had the following concerns:
The ability of the de ground fault detection system to detect grounds was
questionable because the supporting calculations could not be found. The
licensee performed calculations to demonstrate that the system would
operate successfully.
The ground fault detection scheme consists of a relay and indicating
lights.
If a ground fault occurred, the relay would be energized and
cause the alarm indicating lights in the control room to identify the
location of the fault, and which system is affected, i.e., either the
positive, negative, or neutral bus system. The calculations performed by
the licensee during the inspection show that the system operates success-
,
fully even with high resistance faults up to about 10
which complies with industry-accepted practice (e.g.,,000 ohm in value,
EPRI power Plant
Electrical Reference Series, DC Distribution System Manual, page 9-19).
The licensee committed to formalizing the calculations performed during
the inspection.
The team's review indicated that the EDG ground fault protection would not
be bypassed during accident conditions, as expected by current industry
practice. The team was initially concerned that this condition might
subject the EDG to increased spurious trips.
However, the licensee's
calculation performed during the inspection indicated that there should be
no concerns with undue spurious trips.
The EDG grounding system was a high-impedance type system, consisting of a
grouncing resistor connected between the stator, or neutral point, and
ground. The grounding resistor was rated for 30 amperes for 10 seconds.
If a fault occurred, the potential of the generator neutral would become
elevated relative to ground. When the fault was at the generator termi-
nals or outside the generator winding, the fault value was 30 amperes.
!
When the relay was energized, it tripped the generator circuit breaker and
1
the associated diesel engine. Contrary to current practice in nuclear
generating stations, the tripping function of the relay would not be
l
J
12
. _ _ _ _ - - _ - - -
.. . . _ . . . _ _ - . . - - . .
.
.
'
i
bypassed during accident conditions. The licensee's calculation showed
that the combination current transformer and tine delay overcurrent relay
would provide for fault detection and would operate down to 6 amperes of
fault current; thus providing protection for 80 percent of the generator
winding. The 6-ampere level was considered sufficiently high to prevent
undue tripping under conditions of third harmonic current flow. The team
requested that the rating of the grounding resistor be verified for its
ability to continuously withstand a current of 6 amperes, which was the
threshold level of detection. The licensee contacted the resistor manu-
facturer and confirmed that the resistor was able to carry 6 amperes
indefinitely.
Concerns regarding the adequacy of protection coordination in case of a ground
fault in the diesel generator winding for the case of low-level faults were
alleviated by the licensee's calculation.
However, the following observations
were made by the team:
Small magnitude ground fault currents (less than 6 amperes) would be
undetected by the EDG protective relay; the resulting voltage unbalance
could be harmful to the motors or activate the zero sequence protection
provided by the engineered safety feature (ESF) breaker. Also, for fault
currents below 6 amperes, the feeder ground fault protection could be
activated if faults occurreo inside the generator winding. The ground
fault protection could be activated if the voltage unbalance was of
sufficient magnitude to provide for a large enough capacitive charging
current flow to trip the zero sequence relay.
No calculation or analysis existed for the case of unbalanced voltage.
However, the licensee's preliminary rough calculation indicated that the
voltage unbalance would be about 14.25 percent, which was low enough to
preclude any concerns regarding the feeder ground f ault protection.
2.3.3
Voltage Regulation for Control Circuits
The team reviewed calculation E-13, Revision 2, performed to demonstrate that
the motor control center (MCC) contactor coil would receive sufficient voltage
to operate when coils for the control circuits fed from control transformers at
the MCC were energized (picked up). The minimum pick-up soltage was established
by the manufacturer as 85 percent of nominal voltage. Although some of the
calculation methodology was not correct and some of the assumptions were not
properly supported, the team concluded that the discrepancies were not suffi-
cient to disable any control circuits for the ESW and HPCI systems because the
design margin for the control circuits was adequate.
2.3.4
Improper Documentation of Design Basis Calculations
The team found discrepancies between the design basis calculations and the
regulatory requirements, such as Sections 111 and V of Appendix B to 10 CFR Part 50 and ANSI N45.2.11-1974
Many of the calculations were found to be
deficient in terms of proper referencing, substantiation of assumptions,
methodology, proper checking / verification, and control.
For example, calcula-
tions E-3 and E-4 were not properly controlled, as evidenced by the originals
being used for everyday consultation and by revisions being indicated with red
pen, and without proper checking or traceability.
In addition, references to
the relay ch6racteristic curves were missing, the relay device numbers were not
13
_ _ _ _ . _
. . . - .
- .
._
.
._
.
.
.
.
..
.
.
..
..
.
.
.
.
4
,
shown, and the main coordination graphs did not have a checked signature. The
licensee committed to review and revise calculations E-3 and E-4 to address the
team's comments.
2.4 Operations
Deficiencies and weaknesses were found in the general areas of system configu-
ration and system operation versus design requirements and conformance of plant
operating documents and design drawings to actual plant configuration.
- 2.4.1 Operational Programs
The SSFI team reviewed operational programs for night orders control of
temporary plant alterations and operator aids, as well as selected plant status
alas such as the equipment status list, the control room information book, and
the system status file.
No deficiencies or weaknesses were noted in these
programs.
The licensee employed an Operations Manual which delineated the coeduct of
operations in administrative and technical areas, and appeared to be adequate
for guidance in correct operational practices.
The operator aids program, administered under Section OH-9 of the Operations
Manual, appeared to be an area of strength. Operator aids were in widespread
use, were generally well controlled with regard to the scope of information
provided and needed for posting, and were periodically verified to be in place
as required. The use of operator aids for control room panels was coordinated
with the plant simulator to that inconsistencies would not develop.
If unau-
thorized operator aids overe found, personnel were directed to remove them and
to inform the Shift Tet.hnical Advisor (STA).
The team observed uncontrolled copies of electrical drawings placed at one
breaker cubicle to facilitate maintenance and testing activities. As a correc-
tive measure, the licensee inspected all HPCI-associated MCCs and removed the
uncontrolled drawings from these cubicles.- The licensee also stated that
additional corrective actions will be taken by issuing a memorandum to all
supervisors prohibiting the use of uncontrolled documents in the field, and
that the proper use of procedures and drawings would be included in the techni-
cal staff's training program. This commitment is considered to be an open item
.
(50-277/90-200-07;50-278/90-200-07).
'
2.4.2 Operations Procedures
The team reviewed the licensee's trip response procedures applicable to the
HPCI and ESW systems and noted no deficiencies. The team also reviewed appli-
cablealarmresponseprocedures(ARPs), check-offlists(COL), drawings,and
station blackout procedure SE-11 and conducted system walkdowns using drawings
and COLs.
The licensee previously used alarm response cards (ARCS) to govern alarm
response in the control room and at selected local panels, and was in the
process of revising and upgrading these to ARPs. The team found several
deficiencies regarding the licensee's use of these procedures:
14
-
_
-
____j
.
.
-,
,
%
Discrepancies were identified between the setpoint values engraved on the
control room annunciator windows and the values of the setpoints used in
the ARCS /ARPs for windows 20C204B(B-3, C-3, and A-4) and 20C226(A-4).
In
addition, similar discrepancies were noted for the alarms on the alterna-
tive shutdown panel. The licen ne stated that setpoint information that
was not related to technical specification limits will be removed from all
control room annunciator windows and the alternative shutdown panel.
During walkdown of the Unit 2 alternative shutdown panel, outdated ARCS
were observed in a holder located on the face of the panel next to the
HPCI controls. Current ARPs were located in a procedure notebook in the
panel area. The team reviewed the actions required by the superseded ARCS
and determined that no degradation of. safety would have occurred if an
operator had erroneously used the superseded cards. The licensee
corrected this deficiency by removing the holders from the panels of both
Units 2 and 3.
The team also found discrepancies between the drawings and check-off lists
(COLs) for HPCI and ESW systems as well as between the documentation and the
actual field installation for system vent and drain valves on Units 2 and 3.
For example, valves were shown on the COL as being closed when they should have
been shown as closed and capped, valves shown on the COL should have been shown
on the drawings, and valves shown on the drawings did not exist in the field.
The licensee initiated corrective actions to correct the documents. Most of
the discrepancies were noted on Unit 2, which was in the process of a drawing
4
walkdown and update program. No unsafe conditions were noted in the plant as a
result of the documentation discrepancies.
During a walkdown of the ESW system in the emergency cooling tower (ECT) area,
the inspection team observed that valve HV 0-48-11211A, ESW to ECT vent valve,
was in the open position when it was required to be closed by the system COL
and the system drawing. The open valve would have diverted a small portion of
the flow from the ECT riser to the sump area during operation of the ECT, but
the sump pumps would have returned the water to the ECT basin. A review of the
currently applicable COL for the system, which was conducted in April 1989,
verified the valve to be in the closed position. The licensee immediately
placed the valve in the correct position and initiated an operations incident
report to determine the cause and duration of the condition. The licensee's
report was not completed at the close of the inspection. This item remains
unresolved pending NRC review of the licensee's incident report and subsequent
i
,
correctiveactions(50-277/90-200-08;50-278/90-200-08),
j
The inspection team conducted a walkdown of Appendix 4 to Station Blackout
Procedure SE-11, which directed activities outside the control room for taking
manual control of HPC1 and reactor core isolation cooling. These activities
included lif ting leads in the cable spreading room, blocking doors to provide a
ventilation pathway,-and adjusting the control system for the HPCI turbine.
The licensee selected an employee to accompany the team and simulate the
activities directed by the procedure. The following deficiencies were observed
by the team:
The licensee had not prestaged tools, meters, door blocks, and other
materials to expedite conouct of the required activities. Some delay was
experienced initially in retrieving the appropriate tools, and suitable
door blocks in sufficient qu6ntity were not available,
i
15
l
,
,
.
,
~
.
4
The eyloyee simulating the performance of the procedure was unfamiliar
with the specified actions required to adjust the control system for the
HPCl turbine. The actions involved adjusting a null-voltage potentiometer
in close proximity to an operating turbine while observing a portable
voltage meter attached to a panel some distance away. The team observed
that two individuals may be more appropriate for this action. Addition-
ally, no cautions were present in the procedure concerning the potential
for excessive radiation exposure.
The licensee stated that a human factors review of the station blackout proce-
dure will be performed. The necessary tools and equipment for performance of
_
the actions outside the control room will be prestaged. The appropriate
individuals to perform the actions will be designated and training will be
provided.
This comitment is considered to be an open item (50-277/90-200-09;
50-278/90-200-09).
Procedure 50 48.1.B. " Emergency Cooling Water System Startup," provided
instructions to start up the ECW system and provide an alternate heat sink in
,
the event that the normal heat sink became unavailable.
The procedure contained notes and precautions advising the operator that
sufficient suction pressure to the ESW booster pumps may not be available if
less than the design flow path was in service for ESW.
If a booster pump trip
occurred because of low suction pressure, the procedure provided steps to
restore the ESW booster pumps to operation by throttling the manual pump
discharge gate valves or by throttling the ESW inlet valve and then restarting
a booster pump. The team found the following deficiencies in the procedural
guidance which could adversely af f act :;ystem heat removal capability and
prevent it from being able to meet its function during accident conditions:
1.
In step 3.2 and note No. 2 the procedure erroneously identified the
reactor building closed cooling water (RBCCW) system as being part of the
design ESW flow path,
i
2.
Step 4.2 of the procedure directed the operators to line up the ESW to the
RBCCW heat exchangers. A 1979 safety evaluation determined that the RBCCW
i
is not seismically qualified. Therefore, the isolation of this system
'
from the ESW flow path is essential to the continued operability of the
<
seismically qualified ESW system.
3.
The procedure allowed the automatic starting booster pumps to trip prior
to throttling discharge valves to a position that would assure continued
booster pump operations.
'
4
Step 4.8.4 did not instruct operators how to recognize that the booster
pump discharge valve in the throttled position is 25 percent open.
The team considered that the procedure was contrary. to the previous licensee
design to maintain the RBCCW system isolated from the ESW, and that the proce-
dure did not assure continued operation of the emergency cooling water system
because it allowed the automatic starting booster pumps to trip prior to
adjusting to flow conditions necessary to maintain the system operable. This
item remains unresolved pending NRC review of the licensee's corrective action
(50-277/90-200-10;50-278/90-200-10).
16
_
____-
.
..
..
.
.
..
.
.
.
\\
'
.
.
Operations Procedure A0 33.2, "ESW Manual Startup and Operations," noted that a
flow path should be proviced for the ESW pumps since minimum flow recirculation
paths were not provided in the system design. The team reviewed surveillance
test (ST) 6.3, "ESW Pump, Valve, Flow, Cooler," and found that Steps 18 and 21
contained requirements for starting and stopping ESW pumps A and B at shutoff
head conditions in order to record pump discharge pressure, pump amps and
vibration. The team was concerned that no caution to avoid pump damage was
provided in ST 6.3 to indicate maximum running time under these conditions.
The licensee stated that the procedure would be revised to incorporate the
appropriate precautions, and agreed to review test procedures ST 13.21 and ST
13.El.1, "ECW Booster Pump and Emergency Cooling Tower Fan Operability," to
determine whether similar revisions were necessary. This commitment is consid-
ered to be an open item (50-277/90-200-11; 50-278/90-200-11).
TheteamreviewedthetestresultsofSpecialprocedure(SP)630-2," Integrated
Test of the Unit 2 Emergency Cooling Water System," which was performed on
April 8, 1989, and SP 630-3, " Integrated Test of the Unit 3 Emergency cooling
Water System," which was performed on September 24, 1989. The purpose of the
tests was to determine the cap 6bility of the system to deliver adequate flow to
system components and to deliver adequate flow by gravity drain from the ECTs
to the ESW/HPSW pump bays under closed-loop operation with the pump bays
isolated from the conowingo pond. The team identified the following
deficiencies:
Steps 47-50 of SP 630-2 and Steps 7.48-7.51 of SP 630-3 calculated the ESW
pump flow and the ESW booster pump flow based on measuring pump differen-
tial pressures and determining flow rates from the pum) head curves. The
system was in a closed-loop node of operation during t11s portion of the
test and the ESW pump and ESW booster pump flows should have matched. The
team found that the Unit 2 pump flows differed by 3800 gpm and the Unit 3
pump flows differed by 2000 gpm. This discrepancy was not noted in the
test procedure as being questionable.
The licensee concluded that the
differences in flow rates resulted from several factors including instru-
ment tolerances for pressure gauges, use of pump curves,to determine flow
rates, instrument tolerances for bay level, and an inability to read small
level changes with the indicators. The team concluded that the test was
unsatisfactory to conclude that design flow requirements were maintained.
The instrumentation which was used did not allow an accurate determination
of system flow.
"
One portion of the test for Unit 3 specified an acceptance criterion of
i
17000 gpm f or roturn flow from the ECT to the pump bay. The team found
that a portion of the flow calculation used too high a flow rate for the
ESW pump under the tested condition, since the emergency diesel generator
coolers were valved out for this portion of the test. The acceptance
criterion was not met. The licensee reviewed the test results and con-
cluded that adequate flow was returned from the ECT to the pump bay to
maintain level in the bay and that the acceptance criteria in the test was
poorly stated.
"
A portion of the tests determined the capability of the ESW booster pumps
to remain in operation by throttling the pump discharge valves to prevent
low suction pressure trip under system flow conditions less than design
maximum.
The test successively closed diesel generator cooler paths and
adjusted discharge valve positions to maintain suction pressure in the
17
i
.I
.
. _ _ _ _ _ _
._ .__
.
. _ . _ _ _ _ _ _ _ . . _ . . _ _ _ _
'
1
<
.
.
.
'
.
.
,
desired range. The test did not establish flow conditions and discharge
valve positions for the case in which RBCCW would be isolated and the
diesel generator and ECCS cooler paths would be open, which would be the
i
expected plant condition.
j
l
2.4.3 Operator Training
The team found lesson plans and simulator scenarios to be generally adequate in
'
'
the depth of information presented and the correctness of the information as
related to approved plant procedures. Several deficiencies in the training
.
material regarding alarm setpoints for HPCI system components were noted by the
l
team and were identified to the licensee for corrective action. The deficien-
cies were related to the deficiencies noted between the annunciator window
>
l
labels and the alarm response procedures as discussed in Section 3.4.2.
The
i
simulator capabilities appeared to be adequate to provide operator training on
the control room aspects of system operation and malfunction although the team
noted that the ESW booster pumps low suction pressure trip conditions were not
modeled on the simulator.
As part of the plant restart' program, the licensee developed Operations Section
Performance Standards as a means to define how certain operational activities
'
are to be conducted or controlled. The performance standards were used by the
simulator instructors to evaluate trainees. The performance criteria ranged
from excellent to unsatisf actory and allowed an objective means of evaluating
candidates for reactor operator as well as candidates for the senior reactor
operator position. The team considered the use of these standards to be a
,
'
strength.
2.6 Surveillance and inservice Testing
The SSF1 team reviewed the surveillance and inservice test program as imple-
mented for the HPCI and ESW systems to ensure that the surveillance procedures
used to verify system function were adequate.
2.5.1 Surveillance Test procedures
The team found that surveillance test procedures reviewed lacked the necessary
detail in some cases to verify that safety-related equipment and systems could
accomplish their intended functions. For example, test procedure ST 13.21,
acceptance criteria for pump running current, shutoff discharge pressure and
suction pressure. The procedure also called for an improper flow alignment by
including the reactor building closed cooling water system in the path. The
RBCCW is required to remain valved out because of its lack of seismic capabil-
'
ity. Additional examples of procedural inadequacies included the requirement
for use of an electrical jumper, although the type and size of the jumper was
not specified, and specifying a flow test to be performed at a nominal 150 psig
reactor pressure, although Unit 2 Technical Specification 4.5.c.1.e required
the test to be conducted at 150 psig steam pressure with no allowance for the
use of nominal readings.
The licensee stated that a program with a scheduled completion date was now in
'
place to evaluate and rewrite surveillance procedures. This item remains
unresolved pending NRC review of the secpe and the schedule of the licensee's
program (50-277/90-200-12; 50-278/90-200-12).
.
18
-
.
. .
- .
-
..
.
- . . - --
- - -
-
-
-
.-
.
..
- _ - .
.
. _ .
.,
.
.
O
.
L
2.5.2 Surveillance Test Review
i
The team reviewed the results of surveillance tests performed recently on the
!
HPCI and the ESW systems and observed the performance of testing activities.
The paragraphs below address deficiencies and concerns identified by the
inspectors.
The licensee performed ST 10.1-3, " Unit 3 HPCI Flow Rate at 150 psig Steam
Pressure " to satisfy the requirements of Technical Specification (TS).
'
4.5.C.1(3). The requirement called for the testing of the HPCI system flow
,
l
rate at 150 psig steam pressure once per operating cycle. The HPCI pump was-
.
required to deliver at least 5000 gpm over a range of reactor pressure from
1000 psig to 150 psig to be considered operable. The surveillance test was
4
last performed on November 26, 1989, at a reactor pressure of'160 psig in lieu
l
of the requirtu value of 150 psig. Thus, the test did not demonstrate the
l
system to be operable at a 150 psig system pressure as required by the Techni-
cal Specifications.
r
The licensee stated that the change in the HPCI pump test parameters was
allowed by the Plant Operations Review Committee (PORC), as discussed in PORC
Position 24, dated April 15, 1989. The PORC position made the TS 4.5.C.1(3)
requirement less limiting by changing the test parameter from 150 psig to a
range of 150 psig to 170 psig system pressure. The change in the technical
specification requirement was not supported by a documented safety evaluation.
l
as required by 10 CFR 50.59, to determine whether an unreviewed safety question
existed. Additionally, controlled copies of the technical specification did
not reflect the subject change. Procedure ST 10.1-3 did not reference the PORC
position. This matter was discussed with site operations and licensing manag-
ers. Subseountly, an engineering evaluation dated February 26, 1990 verified
thst performing the test at a system pressure up to 170 psig did not constitute
an unreviewed safety question. This is considered to be another example in
i
whic.n the licensee failed to perform and document a safety evaluation as
!
required by 10 CFR Part 50.59. A potential violation for the failure to
L
perform such reviews is discussed in Section 2.1.1 of this report.
The team observed licensee activities during a portion of the performance of
ST 21.5-2, "ESW Flow Test Through Room Cooler and RHR Pump Seal Cooler," on
February 14, 1990. The following weaknesses, deficiencies and concerns wera
identified:
The surveillance test crew performed steps out of sequence within the
procedure, for example, step 4.d was performed before steps'4.a. b, and c.
Administrative Procedure A-47, " Surveillance Test Procedures," requires-
.
that procedural steps shall be followed in sequence.
Changes to and
"
deviations f rom the procedural steps required a temporary procedure change
to be performed in accordance with administrative procedure A-3.
The surveillance test work copy was not completed as the test was per-
formed. - Additionally, core spray room coolers A, B, C, and D and residual
,
heat removal room coolers had been previously tested without the working
copy of the surveillan::e test procedure being signed off.
The test crew used uncontrolled instructions that were not specified or
referenced in the test procedure to set up their ultrasonic test (UT)
instruments. The instructions contained average values for the piping
19
.
.
-
_
.~ . .
.
'
.
,
outside diameter and wall thickness in the-general area where the test
crew had to attach the UT probes.
However, the UT probes could be posi-
tioned anywhere around the pipe circumference or along the piping run-
where the insulation had been removed. This variable positioning coupled
with everage measurements- for diameter and wall thickness could affect the
measured flow anc reduce the reliability of the test measurements.
q
Administrative Procedure A-8, " Control of Locked Valves," and Administra-
tive Procedure A-47, " Surveillance Test Procecures," identified the
requirements for independent verification and specified that the individu-
als performing the independent verification should operate independently
and should Iot be directly involved with the specific task to be verified.
The inspection team observed that these requirements were not adhered to
by the test crew and that. independence was not achieved during the verifi-
cation activities specified-in the test procedure.
The performance of ST 6.7.4.2, " Core Spray Motor 011 Cooler Heat Transfer
Capability," on February 16, 1990, appeared to be adequate, but a review of the
completed test document revealed the following deficiencies:
I
On Page 34, " Motor 011 and ESW Temperature Data
'C' Core Spray Pump,"
!
the thrust bearing temperature at starting time was not recorded.
l
'
On Page 35, " Motor Oil a u ESW Temperature Data
'D' Core' Spray Pump,"
l
the thrust bearing temperatures at 0, 70, 80 minutes were not recorded.
On Page 34, " Motor Oil and ESW Temperature Data
'C' Core Spray Pump,"
4
the motor oil temperature at 60 minutes was missing and the data recorder
!
initials were missing from starting time to the time of 120 minutes.
.
The team reviewed the documentation associated with ST 6.6F-2, " Core Spray A
Loop Pump, Valve, Flow and Cooler Test - Unit 2," performed on February 16,
1990. The following deficiencies were found:
1
The recorder's initials block in paragraph 78A, Step 77, was not filled
a
in.
Paragraph 79 requires the removal of a fluke meter from SORT-H 83A with
and independent verification of the removal. There were no independent
j
verification signoffs made.
~
In sumary, during the observed performan~ce of ST 21.5-2 the test crew disre-
garded the requirements.of Administrative Procedure AP-47 by-performing sur-
ve111ance test steps out of sequence, by not initia111ng completed steps and by
not adhering to independent verification requirements;, Temporary procedure
changes were.not requested by the crew as required by administrative procedure
AP-3 when the test cannot be accomplished in the sequence it is written. The
test crew utilized uncontrolled instructions to install temporary flow instru-
mentation. A review of documentation of completed surveillance procedures for
.
ST 6.7.4.2 and ST 6.6F-2, also indicated a lack attention to detail and a
!
failure to conduct adequate reviews of test'results. The general lack of
adherence to procedural requirements was brought to the attention of plant
management by the team. Criterion V of 10 CFR Part 50 Appendix B, requires
that activities affecting quality be performed in accordance with appropriate
procedures. The licensee's failure to adhere to procedural requirements was
,i
20
--
.
- -
-.
-
-
-
--
.
-
-
1
. '
.
.
.
-)
.
,
,
considered by the team to be a potential violation of 10 CFR Part 50
Appendix B, Criterion V (50-277/90-200-13; 50-278/90-200-13).
The licensee stated that corrective actions,.in the form of training that
emphasizes the importance of procedural adherence, and procedural improvements
'
as needed, had been initiated prior to the end of the inspection.
2.6 Maintenance
The SSFI team reviewed activities in the general areas of fastener control,
!
replacement materials, maintenance practices, and spare parts.
2.6.1
,
Fastener Control, Replacement Material, and Maintenance Practices
,
The SSFI team reviewed the area of licensee control of original and replacement
threaded fasteners (studs, nuts, bolts) during maintenance and modification
activities, control of materials used for replacement fasteners and piping,'and
,
maintenance practices governing the removal and reinstallation of fasteners.
Replacement fasteners were installed in plant system components, especially in
the HPCI system, over several years as a result of maintenance or modifica-
tions, but in a number of cases the material used could not be identified.. The
team found that the origin of. some quality related piping and fasteners
installed in the HPCI system could not be traced through maintenance request
form (MRF) package records. The level of documentation contained in the MRFs
was inconsistent. Some MRF packages contained copies of documents that traced
the materials used, the signed off copies of procedures that were used, and the
documentation of the closecut review, while other packages did not contain.some
or any of this documentation.
Procedure A-26, " Corrective and Preventive Maintenance, Revision 27," Step
7.6.2.4, required that copies of quality conformance data tags be included in -
completed MRF packages for all safety-related materials used. However, some of
the MRF packages that were reviewed contained direct delivery system documen-
tation instead of the required data tags. Although this documentation was
considered by the team to be adequate to specify the quality requirements of
the material used, fewer than half of the packages reviewed that required
safety-related materials contained this form of documentation or the required
,
data tags.
The team found that numerous studs had been fabricated from threaded rod at the
plant site and installed in safety-related components without maintaining the
original fastener size or type. Markings indicating fastener specification and
grade were not transferred to fabricated studs when appropriate. The team also
found cases in which installed fasteners could not be referenced to any known
<
work package, and some pipe sections recently installed in the Unit 2 HPCI lube
011 system via a MRF which did not have an associated material record.
.
The team also identified improperly sized (length and diameter) studs, nuts,
and bolts in the HPCI system. On the basis of the team's findings, the system
+
engineer initiated nonconformance reports (NCRs) for several of the instances
4
that required an engineering evaluation to determine acceptability for contin-
ued operation of the HPCI turbines on Units 2 and 3.
The team found the
evaluation for overtorqued studs in the 100 psig oil line of the steam stop
actuator relay valve to be marginally adequate. Based on the team's concern
8
21
_
_
_ _ _
.
.
. . .
___
-
'I
, < < .
.
.
l
regarding apparent undersized and overtorqued studs installed in the HPCI steam
chest cover flanges, the licensee undertook an evaluation to determine the
effect on HPCI turbine operability, since the studs form part of the high-
pressure steam boundary. This review was not completed at the close of the
SSFl.
The team also found that inadequate maintenance practices or use of improper
replacement fasteners led to numerous instances where studs, bolts, and nuts
installed in plant piping systems and components did not have adequate thread
engagement. The licensee investigated and determined that these conditions
were not in accordance with manufacturer's standards.
,
The licensee did not have a general maintenance instruction or plant equipment
I
specification that defined acceptable bolting practices and standards.
Various
!
requirements were contained in several site documents, such as the site piping
specification (M-300) that identifies the correct fastener size and type for
the various classes of ASME Code piping installed in the plant and formal
maintenance procedures that identify bolt size, torque, and thread engagement.
However, MRF packages that did not reference formal approved procedures for
work did not provide specific guidance or reference to acceptable standards for
size and thread engagement of studs, bolts, and nuts.
The licensee provided a draft version of Specification M-301 for torquing of
flange bolts, and the team observe 6 that the scope of the specification did not
cover acceptable standards for fastener type, size, torque, and thread engage-
ment for all plant piping and component configurations existing at the plant.
Site craft training did not currently provide formal instruction regarding the
subject practices; however, training material existed in draft form that will
eventually be used to address that area.
Because of the deficiencies in documentation of maintenance activities assoc 1-
ated with the HPCI system, the SSFI team could not precisely determine when the
i
wrong size fasteners were installed.
Interviews with maintenance personnel and
'
responsible engineers indicated that this condition has been in existence for
several years before the team brought it to the licensee's attention. Addi-
tionally, there was no assurance that the bolting problem is limited to the
',
HPCI system. The 10 CFR Part 50, Appendix B, Criterion VIII, requires
licensees to establish measures for the identification and control of materi-
als and parts in order to prevent the use of incorrect or defective materials
in the field. The licensee's apparent failure to implement an adequate progran
to identify and control the installation of fasteners in the field is contrary
to the requirements of 10 CFR 50, Appendix B, Criterion Vlli (50-277/90-200-14;
50-278/90-200-14).
,
2.6.2 Root Cause Analyses
The team reviewed the methodology used by Maintenance for root cause analyses.
Root cause analyses by Maintenance were governed by MG-16.2-1, " Guideline for
Equipment Failure Report."
(
The team found that no equipment failure reports (EFRs) had been generated for
the ESW system, although several MRFs or groups of MRFs appeared to meet the
criteria of Section 7.1 of MG-16.2-1 for initiation of EFRs. For example,
there were 143 MRFs issued for work on the ESW system air-operated valves and
their associated solenoid valves between the beginning of December 1987 and the
end of 1989,
i
22
._
__
'
<
,
.
.
.,
s
One root cause analysis had been initiated on the solenoid valves because of
sticking, but it was initiated outside of the EFR program. Two reports were
generated, one by a metallurgical laboratory and one by the manufacturer.
The
two reports were consistent in their determinations, and the one from the
solenoid manufacturer contained reconnendations. The reports addressed sole-
noid valve orientation and air quality as potential causal factors that could
be common to several solenoid valves.- The inspection team was unable to
determine the natcre and extent of any planned actions to address the manufac-
turer's recommendations, nor were~ follow-up actions specified by the licensee
to resolve the concern for this potential connon-mode failure that could block.
cooling to the EDGs and the ECCS room coolers. The team noted that the
licensee's root cause analysis program may be inconsistent with existing-
procedure requirement, however, no items of safety significances were identi-
fied by the team.
.
Other MRFs that appeared to meet the criteria in MG-16.2-1 for en EFR where
such reports were not initiated included out-of-specification ESW system valve
stroke times, cooler plug leaks, and several check valve problems.
2.6.3 Control of Equipment Trouble Tags
Equipment trouble tags (ETTs) were used by the licensee to indicate deficien-
cies in plant equi) ment and to initiate corrective action based on the issuance
of an.MRF or an NCl. The team identified instances where ETTs were not removed-
after completion of an MRF to correct the deficiency.
In addition, the team
found some ETTs which had been installed for a year or longer without initia-
tion of a corresponding follow-up NCR or MRF.
Controlling procedures for MRFs
required that ETTs be removed when the MRF was closed out; however, there was
no mechanism available to' track ETT numbers before an NCR or MRT was written to
ensure that the condition was formally addressed. Personnel error allowed
deficient conditions to be identified on a component but not translated or
communicated to various site organizations for evaluation and disposition.
The
team was concerned that tags that were hung but which lacked follow-up could
mislead plant personnel to believe that a deficient condition was properly
addressed. The licensee stated that this condition will be evaluated for
corrective actions as necessary.
2.6.4 Motor-0perated Valves
The SSF1 team reviewed the licensee's practices for the contr91 of torque
switch settings on mctor-operated valves (MOVs). The licensee had recently
finished an extensive inspection, preventive maintenance, and testing program.
The program involved a tear-down inspection of the-motor operators; inspection
of motor-operator components such as spring packs and gears; cleaning and
renewing of lubricants; replacement of worn, improper and consumable parts;
reassenibly and testing. Torque switch setpoints were based on target, maximum
and minimum thrust values. The minimum thrust values were based on assuring
the valve will close against a design flow condition. The maximum thrust
values considered the strength of the valve as well as the stall torque of the
motor. Personnel-were trained and experienced in use of the motor-operated
valve analysis and test system (M0 VATS) and they were knowledgeable of the
Limitorque design and fabrication practices. All of the safety-related valves
had been through this program before the start of the inspection. This program
was considered by the inspection team to be a strength.
23
. .
- -
-
.
.
.
-
.
-
-
-
'
.
2.6.5 Spare Parts
The team assessed the method and documentation used to specify, obtain, and
install parts used to perform safety-related maintenance, as well as the
process of dedicating comercial-grade parts for safety-related applications,
!
substitution evaluations. upgrades to the automatic reorder process for the
warehouse, and training for the procurement engineers. The licensee's Procure-
ment Engineering Group had made significant progress in the specification of.
spare parts used in maintenance during the past year.
During the past several months the licensee had required that all outside
!
procurement items for maintenance go through the Procurement Engineering Group.
Reorder of items stocked in the warehouse was included in the process.
Items
of this type were reviewed by the Procurement Engineering Group for accuracy of
description, stock number, vendor, quality classification, and special require-
ments such as environmental qualification. .The licensee characterized this
review as being approximately 50 percent complete. The schedule was based on
'
,
the need to reorder items to replace expended stock. Completion of this review
of warehouse stock would strengthen the control.of commodity items such as
'
fasteners.
The inspection team reviewed dedication and substitution packages that were
developed by the Procurement Engineering Group for spare parts used in the HPCI
and ESW systems. The packages to dedicate commercial-grade parts for
safety-related applications were based on the EPRI guidelines. The evaluations
focused on identification of the key attributes of a part by assessing the
'
function of the host component and how the part was related to that function.
This was then used to establish technical code and standard requirements,
receipt inspection requirements, and, in a few cases, post-work test require-
ments. The substitution packages were used to evaluate superseded parts and
replacements for parts that were no longer available from the original manufac-
turer of the host component. .The evaluations were based on the function of the
i
host component and the design features of both the replacement and substitute
parts related to that function. The dedication and substitution packages
appeared to be complete and technically adequate. Almost all of the personnel
performing evaluations to dedicate commercial-grade parts for safety-related
application had recently attended an EPRI workshop on the dedication process.
The broad availability of this training opportunity was considered to be a
i
strength by the inspection team.
2.6.6 Plant Material Condition
The team observed that the HPCI and ESW hardware conditions were adequate and
that the general area housekeeping was good.
The team found, however, that
some difficult access areas underneath the HPCI turbines and pumps and in the
i
area of the ESW pumps contained an excess accumulation of lube oil and debris.
Additionally, several unrestrained f reewheeling trolleys used in maintenance
activities were stored directly over safety-related equipment, such as the HPCI
pumps and piping and the CRD pumps and piping. These items were brought to the
licensee's attention, and appropriate actions were initiated by the licensee.
2.7 Design Baseline Reconstitution Program
The licensee was in the process of initiating a design baseline reconstitution
program for the Peach Bottom and the Limerick f acilities at the time of the
1
24
.
.
.
.
..
..
. . . _ . . . . . . . . .
. . . .
..
_--
- -
-
. _ _-_
. _- _ _ _ _ _
_ -__ _ _ _ _ - _ _ _
- - - -
<< .
..
-
.
2
t
inspection. The licensee planned to use the design baseline documents (DBDs)
developed from the program to make operability determinations and to perform
licensing evaluations, training, and other support functions with the intent of
conducting all nuclear group activities within a known, approved, and currently
l
licensed design baseline.
The licensee identified 55 system documents and 20
topical documents to be developed by the program. The systems included all
safety-related systems, systems important to safety,'and systems important to
i
ef ficient plant operation (e.g., condensate, main generator, traveling water
screens, substation and transmission). The topical documents were divided into
^
topical-physical (e.g., structural, containment - piping / supports / snubbers),
<
topical-hazard / accident (e.g., external hazards. , station blackout, design basis
accidents), and topical-special component (e.g., sampling, annunciators,
i
simulator).
The pilot phase of the )rogram, which was begun in January 1990, included
i
development of DBDs at )each Bottom and Limerick for the HPCI system and the
ESW system by June 1990, along with DBDs for four other safety-related systems. .
!
The DBD for the ECW system and ECT at. Peach Bottom, which constitutes a third
mode of operation under which emergency components are cooled upon loss of
E
normal service water, was not scheduled until late 1992.
The licensee planned.
to complete the last DBD of the overall program in late 1994, resulting in a
total of 75 documents at each f acility.
!
The inspection team observed that the ECW/ECT system DBD was-not being devel-
oped in the same time frame as the ESW system document, which is not consistent
4
with the importance of the system as identified by the SSFI inspection.--
3.0 CONCLUSION
The inspection team identified significant concerns regarding the ability of
the ESW system to perform its required safety functions.
The concerns included
deficiencies in system design and design control, safety analyses and documen-
tation, applicable operating procedures, the performance of surveillance tests,
and the evaluation of surveillance test results. The inspection team deter-
mined that the HPCI system met its design requirements.
However, the team
identified concerns regarding the HPCI system design change and modification
controls and maintenance. The SSFI team also identified problems with the
licensee's-programs to recognize safety significant-issues and to initiate
prompt corrective actions.
In response to the team findings, the licensee
immediately initiated a safety evaluation to assess the operability of the ESW
system at Unit 3.
'
4.0 UNRESOLVED ITEMS
Unresolved items are matters about which more information is required in order
to determine whether they are acceptable, deviations or violations. Unresolved
items identified are listed in Appendix A to this report.
5.0 EXIT MEETING
On March 8, 1990, an exit meeting was conducted at the site.
Both PEC0 and NRC
representatives at this meeting are indicated in Attachment B.
During the exit
meeting, the NRC inspectors sununarized the scope and findings of the
. inspection.
1
25
,
-a
w
e
,
,
a.
- - -
-
-
- - - - - - - - - -
_ . _ .
-
-
-
.,
1
,
,,
,
.
,.
..
APPENDIX A
'
Category of Findings
<
item Nunber
Description
Section
Potential Violation
Licensee failed to initiate prompt
3.1.1
90-200-01
and comprehensive actions to correct
ESW system deficiencies.
Potential. Violation
Licensee failed to perform, document
3.1.1
,
90-200-02
and maintain records of written safety
evaluations as required by
Unresolved item
Licensee will demonstrate that ESW
3.1.3-
90-200-03
pumps A and B manual start switches-
meet single failure criteria following
,
catastrophic failure of either switch.
Unresolved item
Licensee will demonstrate through
3.1.3
90-200-04
acceptable documentation that the ECT
fans are seismically qualified.
Follow-up Item
Licensee to revise station blackout
3.2.1
j
90-200-05
procedure SE-11.
!
Unresolved item
Licensee will provide documentation
-3.2.2
90-200-06
that the fusing of the HPCI support
~
pump is of acceptable design.
'
Open Item
Licensee will implement. training in
3. 4.1 ~
90-200-07
the personnel use of procedures and
training in the field in order to
preclude the use of uncontrolled
documents.
Unresolved item
Licensee to establish root cause
3.4.2
90-200-08
for leaving a normally closed vent
valve in'the open position.
Open Item
Licensee to make improvements to
3.4.2
90-200-09
the station blackout procedure.
Unresolved item
Licensee to develop a procedure
3.4.2
90-200-10
that assures the startup and opera-
tion of the emergency cooling water
<
system.
Open Item
Licensee to revise ESW pump test
3.4.2
90-200-11
procedures to include appropriate
.
cautions against overheating during
-'
,
operation against closed discharge
valve.
A-1
,-
. - . . _ . _
__
_
-
-_-____ - __ __.--_ -__-____-_-,
o
ro. .
,.
.
x
,,
6
<
Category of findings (Cont.)
.
_
ltem Number
Description
Section
,
'
Unresolved. Item
Licensee will provide documentation
3.5.1
1-
90-200-12
. showing the scope and schedule of the
surveillance procedure rewrite
program.
.
Potential Violation
Licensee failed to follow pro-
3.5.3
'
90-200-13
cedural requirements.
Potential Violation
Fasteners of the wrong sizes, types,.
3.6.1
90-200-14
torques and thread engagements, and-
of indeterminate neterial, were
installed in safety-related
applications.
,
l
l
l
is
A-2
--
.. .
.
-
,
-
.-
. _ .
_ - - _ - - _ _ _ - _ _ _ _ _ _ _ _ _ - _ _ _ _ - - _ _ _ _ .
!
'
,;<s..
,
..
,
1
%
APPENDIX B'
,
Personnel Contacted
Organization
!
- Harry R. Abendroth
Atlantic Electric
M. Aldefer
R. Andrews
PECO Operations Supervisor
R. /sbary-
PECO Electrical Engineering
.I
R. Artus
PECO Simulator Training
l
- James A. Basilio Sr.
PECO Branch Head PBAPS Licensing Branch
1
..
- Paul Blackeston
PECO Engineer Licensing
'
vW. L. Bloomfield
PECO ISEG Engineer
- W. J. Boyer
PECO Electrical Plant Section Manager-Engineer
- Kennard M. Buddenbohn
Delmarva Power
- Walter R.' Butler
NRC Project Director, PD 1-2, NRR
- J. M. Cockroft
- Frank Cook
PECO Engineering Support NED
- John B. Cotton
- T. E. Cribbe
PEC0 Regulatory Engineer
- George Daebeler
PECO Technical Supervisor PBAPS
- G._F. Daereleu
PECO Support - Manager
,
- L. T. Doerflein
NRC Projects Section Chief
- Joan Dolezal
PEC0 NED, ESW System Engineer
- Don Falcone
C. Fletcher
PECO Electrical Engineering
..
- David J. Foss
PECO Licensing Engineer
- Al fulvio
PECO Senior Systems Engineer
- Brian Grimes
NRC Director, DRIS, NRR
J. Hill
PECO Instrumentation, HPCI System Engineer
- H. D. Honan
PECO Project Management
- John G. Hufnagel
PEC0 NED Branch Head BOP
M. Hyslop
PECO Hechanical Engineer
- James A. Isom
NRC Operations Engineer, NRC
l
G. John
PEC0tHPCI System Engineer
- W. V. Johnston
NRC Deputy Director,- DRS, Region I
L
A. Jones
PECO Electrical Engineer
L
- J. A. Jordan
PECO Supervising Engineer, Reactor Systems-
+
D. Keene
PECO Drawing Update Program
- Jerry A. Kernaghan
PECO Maintenance Engineer, Rotating Equipment
S. Kiesewetter
PECO Electrical Engineer
- Peter Koltay
NRC Team Leader
- J. E. Konklin
NRC Section Chief, RSIB, DRIS, NRR
'
J. Kovalchick
-
P. Kuhn
Bechtel, San Francisco
C. Kuo
Bechtel,-San Francisco
- Wayne Lanning
NRC Branch Chief, RSIB, DRIS, NRR
- J. J. Lyash
NRC' Senior Resident Inspector
J. W. Lyter
PECO Training
G. Maisel
PECO Training-
- Eric Marcantoni
PECO ESW System Engineer, PBAPS
D. McClelland
PECO Training
- C. A. McNeill
PECO Executive Vice President
- D. R. Meyers
PECO Support - Technical PBAPS
B-1
.
.
.
-
--
_ _ _
- ___.
--
_ _ _ _ - _ - _ _ _
,4
,.
t'
.
Monnel Contacted
Organization
- F. J. Michaels
W. Mindick
PECO Electrical Engineer
- James E. Mitonan
PECO Maintenance I&C Engineer Supervisor
K. Patel
- J. Michael Pratt-
- Gary J. Reid
PECO Engineering Division
D. Robi
Becthel, San Francisco
J. Starosta
PECO Operations Support
E. Sawchuk
- Chris Schwarz
PECO Shift Manager
- Dennis R. Shaulis
PECO Performance and Surveillance Supervisor
D. Spanner.
- R. C. Stott
PECO B.0.P. Reactor Engineer
- Gene Y. Suh
NRC NRR Project Manager
- Dennis Tauber
Public Service Electric & Gas
S. Thomas-
PECO Civil Engineer
- D. J. Thompson, Jr.
- Tyrone S. Tonkinson
PECO NED, HPCI System Engineer
- David Torone
PECO Senior Engineer, NED
- Joe Tulskie
R. Walker
PEC0 Electrical Engineer
- J. D. Wilcox
NRC Operations Engineer
'
J. Wilkes
PECO Electrical Apparatus Expert
- J. P. Wilson
PECO Outage Support
-l
- Attended exit meeting on March 8, 1990,
]
.;
.
i
B-2
i
-