Text

Insp Rept 50-245/85-15 on 850617-28.Violations Noted: Failure to Provide Adequate Written Procedures for Two Specific safety-related Activities & Failure to Follow Station Procedure
	ML20133G579
Person / Time
Site:	Millstone
Issue date:	09/03/1985
From:	Anderson C, Bissett P, Chung J, Murphy K, Petrone C, Pullani S; NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:	;
Shared Package
ML20133G523	List: ML20133G519; ML20133G549; ML20133G579;
References
	REF-GTECI-B-55, REF-GTECI-PV, RTR-NUREG-CR-3085, TASK-B-55, TASK-OR 50-245-85-15, IEB-80-25, IER-80-25, NUDOCS 8510160037
	Download: ML20133G579 (48)
	v • d • e

.. .. - - . - . - . . _.- - - . . .. . -._

.. ..

i

!

i

U.S. NUCLEAR REGULATORY COMMISSION

i

REGION I

) Report No. 50-245/85-15

Docket No. 50-245

License No. DPR-21 Priority --

Category C

} Licensee: Northeast Nuclear Energy Company

, P. O. Box 270

Hartford, Connecticut 06141-0270

]

~

i

Facility Name: Millstone Point Unit 1 Nuclear Power Plant

Inspection At: Waterford, Connecticut

Inspection Conducted: June 17-28, 1985

Inspectors:

/ in W.

40

u a

_

ctor Engineer, Team Leader

7-d2-[

date

'

-

w 8 P-scas

l K. G M ur/hy, echnf' cal Assistant, DRS date

,0 (D. 8 u_ S 2 *~

{ harles D. Petr g

, tead Reactor Engineer

~

date

-

'

. Y hM $~3LY

j -S

11&nt,LeadpaptorEngineer date

,

./ U [- 2 2 - W

P.H.pfsset~t,'ReactorEngineer

~

.

date

i

Approved by: - .

_

C. A serson, Chief, Plant Systems Section

f1 #

date

,

i Inspection Summary: Inspection on June 17-28, 1985 (Report No. 50-245/85-15)

l Areas Inspected: Special announced inspection of equipment and activities

identified in the Millstone Unit 1 Interim Reliability Evaluation Program

which are important to prevent or mitigate a core melt accident. Specifically,

equipment and activities related to recovery of offsite power; feedwater

i

i 851016003785g245

PDR ADOCK PDR-

G

__

L

.. ..

2

. . ,

coolant injection system; safety / relief valves and manual depressurization;

emergency AC power system; isolation condenser; and licensee administrative

controls were inspected. The inspection included 405 inspector-hours on-site,

15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months off-site and 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months at the NRC regional office by five region-based

,

inspectors.

Results: Two violations were identified: Failure to provide adequate written

procedures for two specific safety-related activities; failure to follow

station procedure.

l

t

.. ..

3

DETAILS

1.0 Persons Contacted

W. Adams, Plant Equipment Operator

R. J. Asafaylo, Quality Service Supervisor-NNECO

N. G. Bergh, Operations Assistant

E. Berry, Unit 1 Shif t Supervisor

M. Brennan, Unit 1 RPS Health Physicist

J. Burke, PMMS Technician

G. J. Closius, QA/QC Supervisor

K. Dickson, Production Test Supervisor

J. Flannigan, Station Technical Assistant

R. George, Product Test Engineer

, *L. Georgian, Unit 1 Plant Engineer

"

R. Grofeli, I&C Technician

E. Hernandez, Maintenance PMMS Planner

R. King, Assistant I&C Supervisor

E. Lindsay, Reactor Engineer

L. Loring, Plant Equipment Operator

D. McIntire, I&C Technician

C. Monk, Licensed Operator

J. Norwell, Unit 1 Shift Supervisor

E. Olszewski, I&C Engineer

T. Padberg, Maintenance Engineer

R. Palmieri, Unit 1 Operations Supervisor

E. Pelisit, Licensed Operator

R. L. Peterson, Unit 1 Assistant Maintenance Supervisor

P. J. Przekop, Unit 1 I&C Supervisor

H. M. Quin, Unit 1 Engineer

W. D. Romberg, Station Superintendent

C. J. Shine, Unit 1 Shift Supervisor

- J. Stetz, Unit 1 Superintendent

'

J. A. Summa, Jr. , Unit 1 Engineer

- W. Varney, Unit 1 Maintenance Supervisor

C. Wargo, Maintenance Engineer

G. Zitka, Shift Supervisor

USNRC

S. D. Ebneter, Director, Division of Reactor Safety, Region I

L. Whitney, I&E

- J. T. Shedlosky, Senior Resident Inspector

The inspector also held discussions with other licensee employees during

the inspection, including operations, technical support and administrative

l personnel.

Denotes those present at the exit meeting on June 28, 1985

Denotes those present at the preliminary exit meeting on June 21, 1985.

__ _

. . _ - _ . , . - _ -

.-. _. . .- . .- .- . - ~~ . .

.. ..

l 4

2.0 Scope of Inspection

l 2.1 Objective

!

] The inspection objectives were to apply the results of the site- -

1 specific PRA study (IREP) to the inspection program in order to

l evaluate the availability of important systems, components and

activities. Potential human or operational errors were also evalu-

, ated to assess the readiness and the effectiveness of the recovery

j actions to terminate or mitigate the accident.

2.2 Inspection Items

l

The Millstone Unit 1 IREP study (NUREG/CR-3085) was a probabilistic

,

assessment of the plant-specific risks and provided information on

!

potential accidents and sequences with core melt consequences. The

study identified the dominant accident sequences by their severity

1

and provided insights into the contributing or mitigating plant I

design and operating features. The most dominant accident sequence

! was selected, and the inspection plan was developed from the plant

specific items of highest importance (relative to accident initiator,

j preventive and success features, core melt contributors and recovery

actions).

2

The accident sequence selected was "A Loss of Normal AC Power", which

contributed 23% to the total core melt frequency. The initiating

event of the accident was a loss of normal AC power, followed by a

'

,

failure of a safety / relief valve to reseat after opening, resulting

in depletion of the core cooling water inventory. The contributing

'

l factors were the failures of the Feedwater Coolant Injection (FWCI)

System and of the operator to depressurize the reactor coolant system *

1

!

manually. The pressure reduction of the coolant system was a vital

recovery action in order to allow the low pressure coolant systems to

l operate. These failures of FWCI and to manually depressurize pre-

vents flooding and coolant coverage of the core, and eventually

results in core melt down in 30 minutes. Therefore, it is necessary,

1 in this sequence, to recover power within 30 minutes to mitigate the

l accident.

I

i The most important systems, plant features, operator actions and

related plant specifics were identified considering the event

sequence, equipment, operability, nature of the failures and suc-

i cesses, and potential weaknesses.

l The following important failures were identified from the IREP study:

i

'

1. Failure to recover offsite power within h hour;

2. Failure of a safety / relief valve to reseat after opening;

- - _ _ _ . _ _ _ _ . . _ , _ _ _ . . . _ _ . _ , _ , . . , _

.. ..

5

3. Operator failure to manually depressurize the reactor coolant

system;

4. Breaker failures to prevent the loading of emergency AC buses

onto the gas turbine;

5. Gas turbine generator failure;

6. Failure of condensate transfer system to provide makeup flow

to FWCI;

7. Relay failures to prevent FWCI initiation; and

8. Failure of FWCI pumps due to,

--

FWCI pump breaker failures

--

Mechanical failures of the service water system to provide

cooling to FWCI train pumps, and

--

Failures of the FhCI pump pressure permissive switches.

In the PRA analysis, no credit was taken for the isolation condenser

even though the isolation condenser could provide additional cooling

water during the loss of coolant accident. As a preventive measure,

the isolation condenser was added to the inspection items list.

From the above, a total of 52 plant specific features and activities

were identified as inspection items, which included the following:

1. Recovery actions and equipment associated with the offsite

power: 2 components

2. Manual depressurization: 3 components

3. Gas turbine: 5 components

4. Feedwater coolant injection system: 37 components

5. Isolation condenser: 4 components

(" Component" is the specific plant equipment or operational action

identified for inspection).

2.3 Conduct of Inspection

The inspection methodology was based on the results of IREP study

which identified plant features important to accident initiation.

It also identified as an accident contributor the unavailability

of important plant equipment, due to either its failure to function

or improper alignment, and inability and/or failure of operators to

respond and cope with the event in a timely manner.

. - . -

. . - . . _ _ _ ._ _ _ _ _.. _ . . _ . _ _ _ - _ _ _. . . _ . _ . .

>

.

j ..

.

..

1

l 6

!

l

4

! The logic used for developing the inspection plan is shown in Figure

1:

1). The licensee's programs must address the means to:

--

prevent equipment deficiencies or failures;

' --

detect deficiencies'or failures promptly;

1

--

correct.them effectively;

l

--

prevent recurrences; and

--

verify the equipment operability after maintenance, surveill-

ance, and testings.

[ The degree of equipment availability was evaluated based on these

criteria as supported by the records, programs, activities, initia-

tives, and "As Found" conditions.

l 2). Plant operators must be provided with sufficient training, be ;

j able to assess events rapidly and respond effectively under

l accident situations. The state of operational readiness was

'

evaluated based on the following:

i

,

--

Adequate plant procedures, equipment identification, and

posting;

}

--

Operator familiarity with plant equipment / system and their

< locations;

i

--

Operator knowledge.of normal, abnormal, and emergency ,

operations.

!

i 2.3.1 Equipment Availability

i

! The availability or operability of plant equipment was

l evaluated based on the effectiveness of the plant mainte-

nance and surveillance programs. The programmatic aspects i

,

were inspected to verify that the station programs

addressed administrative control mechanisms to prevent,

, detect, correct and recover from equipment failures,

! deficiencies and inoperable conditions effectively and

promptly. The supporting records were reviewed to assure

that the preventive measures, corrective maintenance and

1

periodic surveillance on the important plant equipment were

-performed effectively in accordance with the prescribed

i procedures. The inspection verified that generic problems o

and recurring equipment failures were resolved in a timely i

, manner. This included the trending of equipment repairs

i and engineering evaluations. -The following aspects

l . relating to equipment-availability were reviewed.

i

.

'

!

l

. . . . _ _ _ . _ _ _ . - ._. .._ _ _ __ _ . __ _ _ _ _ ._._

., _ . . _ . . . . _ . ._. - _ _

l ^

. . *

j ..

!

HIGH ASSURANCE

OF

MINIMUM RISK

PRA Driven PRA DRIVEN

l

'

Identify High-Risk Systeras O Identify Plant Staff

Recovery ctions

.

Assess Availability AsseksRecoverability

i

Can Plant Equipment Can Staff

Respond? Respond?

--

s

l I I I .

QA/QC Surveillance Maintenance Arabient Conditions Simuladion

1

Procedure of Activities

Adequacy Human Factors

Staff

! Qualification

i I

e chon HVAC Fire Abnormal

Ln s

i

T.S. Conditions

Requirements -Timeliness

,

! I

'-

Faflure Effective-Prompt

Prevention Correction

i

Recurrence Post-Maintenance

Trending Testing

i

/

I

l !

i

t

!

INSPECTION RATIONALE ---- FIGURE 1

l

.. . __,.._____.___.,___.-_._...._,..___._.._,___...,_._m

. -_.. _ _

._ .. h., _,__,,.-..........m,.... .~,,,

. . _. . . . _

j . . . .

1

7

!

--

Preventive and corrective maintenance programs,

t

applicable administrative procedures, vendor manuals

)

'

or specifications, maintenance records and trends,

post-maintenance testing, and simulation or witnessing

of the maintenance activities.

--

Surveillance program, procedures, records, test

witnessing and hand-on simulations. i

,

--

Accessibility of the equipment, alternate means of

j operations (auto, manual, remote and local), equipment

i status, indications, alarms and visual inspection.

,

--

Component cooling, electrical supports, ventilation,

.; and environmental qualifications.

--

Calibration of indicators, transmitters.

--

QA/QC.

--

Potential fire sources / prevention.

--

Equipment identification labels / posting.

,

2.3.2 Plant Operations and Recovery Actions

.

J

The operational readiness and the effectiveness of plant

operations were evaluated based on the ability of the plant

1

staff to respond to and recover from the accident. This

was evaluated from the the following plant activities:

1

--

Demonstration of equipment.and system operability:

remote, automatic, manual, and local operations.

! --

Station operations: operator ability to utilize the

,

'

control room and local panel indications and para-

meters, to determine the plant abnormal and emergency

conditions, and to respond to accident situations.

--

Station operating procedures: normal, abnormal, alarm

! and emergency (symptom oriented) procedures and their

utilization. Procedural reviews on technical con--

,

tents, identification of equipment and clear instruc- l

l tional steps. l

1

--

Operator knowledge and administrative procedures to

cope with emergency situations: operator interviews

and system walk-throughs, training and qualification.

.

A

!

4

f

z

- - . - , - , - - , - .,--.---w,- ,.cm.-,- ,. ,---,,--,,--.--,-.,._.+..,..-,,,-,y-,.y

-

- , ._, ,~--.~--.,..,r.,,.,,,.._, , . ~ ~ . , _ . . - , . - , - , y.- _

.. . . .

8

--

Simulation of normal, abnormal and emergency opera-

tions.

--

Operator understanding and hunan factors engineering:

equipment identification, detection of equipment /

system inoperability (alarms, indication, etc.) and

communications.

2.3.3 - Non-PRA Features and Station Records

To assess the integral aspects of the plant status and

operations in general, non-PRA features of the complimen-

tary station programs and document / records were evaluated,

which included:

--

Administrative controls of safety-related events and

off-normal conditions, ,

--

Implementation of training and QA/QC programs,

--

Station initiatives on safety measures,

1

--

Potential fire sources and preventive measures:

electric shorts, ground wires, circuit boards, open

circuits, temporary test jumpers and cables, improper

wiring, poor ventilation and mechanical overheating, '

and combustibles,

--

Documentation and document controls, tagging and

housekeeping,.

--

Pertinent station records and the automated computer l

system:

!

Surveillance maintenance, post-maintenance test

and functional test records.

Plant Piping and Instrument Drawings (P&ID)

QA/QC Manual and plant "Q" list manual

LERs, FSAR, System Descriptions, Environmental

Qualification Reports, Deficiency Reports,

Nonconformance Reports, and Plant Incident

Reports (PIR). l

l

1

!

l

r

_ . - _ ,r. , _,-- ._ - , , . , ,-._ --.,_ ---,,..--_ ,- .- , ,.-... -,,. - - - -

..,,- -,,,,,,,,, ,,- - w ,, ,,,,,...,,,,,,,,,,,,,,,,,,,,,,,,m.,.. , , , , - - - -

.. ..

9

Surveillance and maintenance schedules, the

Production Maintenance Management System (PMMS),

and Automated Work Order (AWO) computerized

system.

3.0 Recovery of Offsite Power

The IREP study identified that, based on the selected sequence, the

resulting core melt could be prevented from loss of normal AC power,

should offsite power be recovered within 30 minutes from the time of

initiation.

As a preventive measure, operator's understanding and responses to the

power loss were evaluated by a simulated recovery operation and procedural

review. However, availability of the offsite power source was not

included, particularly during the peak summer season loading.

The inspector reviewed the licensees procedures, ONP 503B, Loss of All

Station AC Power (LNP), and ONP 503C, Loss of Offsite and Onsite AC Power

(Station Blackout) and verified that they contained appropriate; imme-

diate, subsequent, and automatic actions, and checkoff lists for resetting

electrical breakers.

The inspector performed a walk-through of each procedure, first with an

SR0 with 15 years experience, then with an R0 with 1-1/2 years experience.

The operators were asked to simulate all the actions they would take in

response to a loss of offsite power, or a loss of all onsite and offsite

power. Without referring to the procedures, the operators were asked to:

describe how they would recognize each event; discuss the automatic

actions which occur; then walk through the immediate actions and subse-

quent actions required by the procedure. The SR0 knew the procedure

extremely well; his knowledge of the plant and the emergency procedures

was excellent. The RO was very knowledgeable; was able to describe the

symptoms of each event; knew all the required immediate actions, and most

of the subsequent actions. Both were well qualified to respond to this

type of emergency. Each walk through, which included simulated switch

actuation, as well as discussion with the inspector, took less than 20

minutes.

Upon loss of station normal AC power the control room operator may have to

call the CONVEX dispatcher to verify availability of of f>ite power. The

inspector noted that four independent communication lines were providad in

the control room to gain access to the offsite CONVEX dispatcher.

They were:

l

!

l

.

.. ..

10

Dedicated CONVEX hot line,

Commercial telephone system,

Station telephone line in the control room,

State wide radio system with an uninterruptable power source.

Based on hands-on simulation and discussion, the inspector observed that

CONVEX communications could be established within 10 minutes, provided

that offsite power was readily available even during the peak summer

season. However, the availability of the CONVEX dispatcher and the offsite

power line was not within the scope of this inspection.

4.0 Safety Relief Valves and Manual Depressurization

The accident sequence identified two major failures associated with the

pressure relief system that will result in a core melt accident sequence.

These were the failure of a safety / relief valve to reseat after opening

and an operator failure to depressurize the reactor coolant system man-

ually. The inspection efforts were, thus, directed toward the equipment

availability of safety / relief valves and the assessment of operations

which required manual depressurization.

4.1 System Description

There are six safety / relief valves (S/RVs) installed on the four

steam lines upstream of the main steam isolation valves (MSIVs).

These valves have three modes of operation:

Automatic Pressure Relief (APR)

Manual Depressurization Mode (MDP) of APR valve:,

Safety / Relief Mode

The APR system is designed to provide a backup method for reducing

reactor pressure in the event of the failure of high pressure cooling

systems following a LOCA. The APR system consists of four out of

the six S/RVs designed to prevent the reactor vessel pressure safety

limit from being exceeded. In addition to this self-actuating safety

valve function, the four special APR valves are capable of automatic

remote actuation on indication of a LOCA. All six valves are capable

of remote manual operation by the control room operators.

._- _ _ _ _ _ _ _ _ __- -

.. ..

11

Automatic remote actuation of the APR system following a LOCA

requires coincident indication of reactor low-low water level signal

for at least two minutes. This time delay allows the FWCI system

a full two minutes to achieve proper operation and maintain water

level in the reactor vessel. If vessel level has not been restored

after two minutes, APR system actuation will take place, causing a

reduction in vessel pressure which will allow the low pressure core

cooling systems to make up the lost reactor coolant,

i

When the system operates, the four APR valves will open via their air

operators. Steam passes through the valves into discharge lines that

lead into the torus, permitting the steam to condense as it blows

down into the torus water.

,

Control power to the air operator solenoids is supplied by redundant

125 volt DC power sources from separate batteries, and sufficient air

for several valve cycling operations is stored in emergency air accu-

-

mulators. Furthermore, all six S/RVs (including the four APR valves) !

may be operated manually from the control room to blowdown the

4

reactor in the event of automatic circuitry failure.

The APR system also has a manual depressurization mode (MOP). This

,

is required because, in the case of transients, high drywell pressure

will not occur since steam is blown directly into the torus. Thus,

if high pressure cooling fails following a transient, the only way

!

to lower the pressure so that the low pressure cooling systems can

operate is by th) operator action to manually open the APR valves.

He does this by actuating the valve open switch for each of the six

i S/RVs from the control room.

4

4.2 Manual Depressurization

The inspector reviewed the licensee's procedure OP 337, Auto Pressure

'

Relief System and verified that it contained an appropriate descrip-

l tion of the sequence of events and operator actions required to blow

!

down the reactor vessel and allow the ECCS to reach full discharge

capacity in an accident condition. The Inspector interviewed an

experienced SRO about the plant operating requirements, prerequi-

sites, precautions, and procedural steps contained in the procedure.

The operator had essentially the entire procedure memorized and

easily explained the reasons for the various precautions and proce-

dure steps to the inspector. The operator walked through the steps

required to place the system in standby readiness. He also explained >

the cause of the various possible alarms and malfunctions, and walked

through the required immediate and subsequent operator actions

!

specified in this procedure.

-- - -. _ _ _ , _ - _ _ - ._ . - ,_ _- . _ - _ . __

.. ..

12

The inspector concluded that the operations staff was knowledgeable

of the auto pressure relief system and could easily operate it

manually if required during an accident.

No violations were identified.

4.3 Availability of Safety / Relief Valves

As per the accident scenario, it is essential that the safety / relief

valves reseat after opening and that the valve availability and

readiness were important to mitigate the accident.

The three-stage Target Rock (TR) S/RVs installed in several boiling

water reactor (BWR) plants had experienced multiple operational

problems in the past. The main problem was the tendency of the valve

to leak at its pilot valve and thereby keep its main disk from re-

seating. The two-stage Target Rock S/RV was designed to overcome

this problem. The original three-stage valves at Millstone-1 were

replaced by two-stage valves during the 1979 Refueling outage.

However, even the two-stage valves had experienced certain generic

operational problems at several BWRs as documented in IE Bulletin

80-25 and IE Information Notices 82-41, 83-22, 83-39, and 83-82,

Further problems are discussed in General Electric Service Informa-

tion Letter (SIL) 196 and associated supplements. The main problem

with the two-stage valves is setpoint drif ting (Generic Issue B-56)

resulting from two unrelated causes:

1. Sticking of the pilot valve disc in its seat, a corrosion

induced mechanism,

2. Binding of the pilot valve stem if clearances between the stem

and its guide bushing are too small.

One event related to setpoint drifting was reported by the licensee

ir Licensee Event Report (LER)84-012, caused by the above item 2.

To ascertain the operational availability of the S/RVs at the plant,

the inspector reviewed the follo,ving documents, selected on a samp-

ling basts:

IE Bulletin 80-25 and the licensee response in their letter

dated March 16, 1981.

LER 84-012, dated July 13, 1984 and the corrective actions

documented therein.

Surveillance Procedure SP 626.3, Manual Operation of Relief

Valve When At Operating Pressure, Revision 5, August 25, 1983.

.. ..

13

Surveillance Procedure SP 778.1, Inspection of Safety / Relief

Valves, Revision 3, August 27, 1980 and results of this test

performed on February 25, 1983 and June 25, 1984.

Surveillance Procedure SP 778.2, Bench Check of Safety / Relief

Valves, Revision 5, June 30, 1983 and result of this test

performed on December 27, 1982 and June 25, 1984.

Maintenance Procedure MP 717.1, Maintenance of Target Rock

Relief Valves, Revision 6, December 25, 1983.

Maintenance Procedure MP 717.7, Target Rock Valve-Topworks

Changeout, Revision 2, December 2,1982.

Maintenance Procedure MP 717.8, Target Rock Valve Solenoid

Maintenance, Revision 3, August 25, 1983.

Preventive and corrective maintenance records of the S/RV

for the last two years.

In reviewing the above documents, particular attention was given to

the operational problems associated with two-stage Target Rock S/RVs

and the licensee actions and initiatives to resolve these problems.

The following licensee initiatives were observed to resolve the

generic operational problems of two-stage Target Rock S/RVs:

The licensee is a member of the BWR Owner's Group and is active-

ly pursuing resolution to these problems.

The licensee has a program to inspect and bench check the

setpoints of all six S/RVs, every refueling outage (This is

done offsite at Wyle Laboratories, Huntsville, Alabama).

The licensee's preventive and corrective maintenance program

appears to address the presently known problems of these types

of valves.

Based on the above observations and review of plant records, there is

a high degree of confidence that the S/RV's would be available and

function properly.

No violations, deviations, or other unacceptable conditions were

identified.

5.0 feedwater Coolant injec_ tion (FWCtBystem

The failure of the FWCI system was identified as a major contributing

factor to the core melt during the accident sequence of " loss of normal AC

power". The event analysis further provided detailed insights and iden-

tified three major root causes of the FWCI failure:

.. ..

14

1. Failure of FWCI initiation due to re'.ay failures.

2. FWCI pump failures due to,

Pump breaker failures,

Failures of pump pressure permissive switches, and

Mechanical failures of service water system (SWS) to provide

cooling to FWCI train pumps,

3. Failure of condensate transfer system to provide makeup water to

FWCI.

The inspection effort thus focused on the availability of the FWCI

initiation logic relays, FWCI pumps and associated pump breakers, instru-

ments and cooling water, and condensate transfer system. The FWCI system

was evaluated for normal and emergency operations.

5.1 System Description

The FWCI system is designed to maintain adequate primary coolant

inventory in the reactor vessel following a transient or a small

break loss of coolant accident (LOCA) which does not result in rapid

depressurization. After reactor pressure has decreased sufficiently,

the core spray and/or LPCI systems can then be placed into operation.

l The FVCI system is a part of the normal feedwater system and uses

normal plant operating equipment; it pumps water from the main

condenser hotwell into the reactor vessel. Additional water is

supplied to the hotwell from the condensate storage tank through the

condensate transfer pumps. The feedwater/FWCI system consists of

three condensate pumps, three condensate booster pumps, three reactor

feedwater pumps, two condensate transfer pumps, and an emergency

condensate transfer pump, along with the associated pipes, valves and

control circuits. However, only two trains, A and B, are assigned to

l the emergency FWCI system.

The FWCI systerr operation is subdivided into two modes:

Normal AC power available, and

Normal AC power not available.

In the event of a trip initiator with normal AC power available, the

FWCI System will continue to operate automatically maintaining proper

reactor vessel coolant level. As feedwater flow rate increases, the

feedwater/FWCI control logic will transfer to flow control providing

the feed pumps with protection against pump run-out.

.. ..

15

In the event of a loss of normal AC power, the loss of normal power

(LNP) circuitry will load shed all of the feedwater/FWCI system pumps

momentarily. This slight delay allows the emergency gas turbine

generator sufficient time to reach operating speed before applying

the pump motor loads (approximately 48 second:,). However, to prevent

excessive loading on the gas turbine generator, only one train of the

FWCI system is restarted. Makeup flow is provided from the conden-

sate storage tank through the emergency condensate transfer pump.

This train, previously determined by the operator selecting either

the A or B pump strin; through a switch on the 926 panel, consists of

the following: one retctor feed pump, one condensate booster pump,

and one condensate putp. However, if the A pump string has been

preselected and fails to start, the B pump string will not provide an

automatic backup. Th s can only be accomplished by manually starting

each of the three pumps in the string or changing the string selec-

tion switch position.

5.2 Assessment of FWCI Operation

The inspector reviewed the licensees procedure OP 334, "Feedwater

Coolant Injection System", for technical adequacy and verified

that it contained appropriate prerequisites and precautions as

well as instructions for placing the system in standby readi-

ness. In addition, automatic and manual actions following a

LOCA, with and without a loss of normal power, are described in

detail.

The inspector performed separate " walk throughs" on portions of this

procedure with an SR0 with approximately eight years experience and

an R0 with approximately 1h years experience. The inspector

questioned the operators about the information contained in the

procedure including: plant operating requirements; minimum conden-

sate storage tank level, system initiation signals, and valve lineup

requirements. The operators were then asked to describe an automatic

initiation during a LOCA, with and without normal power available,

then simulate manual FWCI initiation. They walked through the steps

necessary to return FWCI to standby readiness after Automatic

Initiation and described the actions they would take in response to a

"FWCI System IN0P" annunciator alarm, an emergency condensate trans-

fer pump overload or trip, and other malfunctions. The SR0 was

extremely knowledgeable of the procedure, and was prepared to explain

the basis for the procedure steps, including the possible causes of

malfunctions. The RO was also familiar with the procedure and equip-

ment and knew the required immediate and the subsequent operator

ac t. ion s.

Based on this sample review, the inspector concluded that.the

operators at Millstone Unit I would respond quickly and correctly to

a FWCI initiator and the proper manual actions if required.

- - - . - -- - . _ - - - . _ . . .- .. . . _ - . . .- .~ -

~

>

. . ,,

l 16

1

i

5.3 Assessment of FWCI Initiation and Availability of Relays and

Initiating Components

i

'

!

It is essential to assure that relays associated with the FWCI

initiation logic are highly reliable and would be available when

-

their services are demanded. Proper FWCI actuation and operation

could prevent propagation of the accident sequence. The availability

4

was thus assessed based on the evaluation of surveillance tests,

simulation, and appropriate maintenance activities,

j 5.3.1 Surveillance Simulation of FWCI Actuation

On June 20, 1985, portions of Surveillance Procedure SP 628.1,

i Integrated Simulated Automatic Actuation of FWCI, CS, LPCI, DG, and

GT, Revision 5, were simulated. The objective of the simulation was

i to verify that the procedure was clear and adequate, and to evaluate

the performance and knowledge of the operating (test) personnel.

. The inspector reviewed the test results of the Surveillance Procedure

i

SP 628.1, performed, on June 22,1984. The objective was to assure

that the periodic surveillance test verified the operability of the

FWCI initiation logic and associated relays.

i This surveillance test is performed every refueling outage in accor-

? dance with Technical Specifications 4.9 A.1.b and 4.9.A.2.b. The

!

inspector ascertained that the test was performed in accordance with

the procedure and the test results met the specified acceptance

criteria.

) 5.3.2 Availability of FWCI Initiation Relays and Components

i

! FWCI initiation on a loss of normal power is dependent upon the

l correct operation of the loss of normal power relays. Failure of any

i of the relays could result in the subsequent failure of FWCI initia-

j tion.

!

i

The inspector visually inspected the location of all the associated

relays (with the exception of V2-la, which was inaccessible) to i

, verify proper identification, tagging, and general conditions. No

j problems were identified.

! Calibration of the relays is performed only upon initial install-

i

ation. The inspector reviewed Product Test (PT) procedure 1403L

, " Relay Procedure Type HFA Auxiliary Relay" and PT 1402 " Timing Device

Calibration" and associated data sheets to verify that: 6

.

! --

calibrations were performed using up to date, approved

l procedures

i

--

test equipment used was calibrated and recorded

l

i

$

l

._ _ . _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . _ . _ .. _ _ _ _

.. o.

17

--

test data met applicable acceptance crite'ria

--

calibrations were performed by qualified personnel

--

second party verification was performed as required by

procedure

During each refueling outage, an operability check is performed

through the conduct of surveillance procedure (SP) 617.1 " Loss of

Normal Power Relays". Conduct of this test includes functional

testing of all relays, breakers and contacts required to operate

during a loss of normal power condition. The test itself is per-

formed in two parts, the first part being a functional test of

individual component logic relays and associated breakers and the

second part being an overall system integrated test. In conjunction

with the performance of this test, SP 628.1 " Integrated Simulated

Automatic Actuation of FWCI, Core Spray, LPCI, Diesel and Gas Turbine

Generator" is also accomplished.

The inspector reviewed SP 617.1 and SP628.1 and associated data

sheets for those tests perform during the last two refueling outages.

The integrated systems tests were performed on June 22, 1984 and

November 11, 1982 (individual component logic relay testing is

accomplished as availability permits throughout the duration of the

refueling outage).

A review of these tests verified that:

--

tests were performed using properly approved up-to-date proce-

dures

--

tests were performed within the required time frequencies

--

test data results met acceptance criteria

--

completed tests were reviewed by appropriate personnel

as required

In addition to the above review, the inspector had the licensee

demonstrate, through the use of Control Wire Diagrams (CWD), the

logic sequences involved during a loss of normal power. Particular

attention and discussion dealt with the failure of the relays and the

subsequent failure or failures of those components necessary for FWCI

initiation.

Following the review of " loss of normal power" logic diagrams, the

inspectors had the licensee simulate the performance of SP 617.1,

! " Loss of Normal Power Relays". This simulation included:

!

- . . _ _ .__ ._ . _ _ . , . _ _ _ _ --- . . _ - .

_ .. o.

'

18

1

--

Functional checking of individual component logic relays

! including:

l

visual location of breakers, relays, limit switches, pumps,

valves, etc. associated with the FWCI system

i

,

a racking out of breakers

1 *

installation of test couplers used during breaker trip

functioning tests

a tripping of individual relay contacts and the resultant

tripping of associated breakers

1

--

Overall integrated system test including:

transfer from normal station power to reserve station power

'

i

loss of normal power with the resultant startup of the

diesel and gas generators

i

! --

Restoration to normal station line-up.

j The inspectors found no problems associated with the performance

. of the test. The licensee representatives involved with the

! simulation were very knowledgeable in all aspects of the test

!

f

including component locations, test precautior.s and test

content.

1

l The licensee has nearly completed a total replacement of previ-

. ously used GE HFA51 type relays with GE HFA151 type relays.

A possible breakdown of the relay coil spool, if made of lexon

or nylon, resulting in a possible malfunction of the relay had

been identified to the licensee through several GE Service

Information Letters.

(

The licensee's response to this problem was more than adequate

i

in that:

--

the potential problem was thoroughly evnluated by engineer-

)

ing

l --

the decision to replace all HFA51 relays, e' ten if there was

l no indication of degradation, was very conservative

i

--

interim corrective action, prior to replacement of the ;

l relays, was instituted immediately after identification of

>

the problem

--

upper management was kept advised of the replacement status

_ . _ _ . . . . . _ . . __ _ _ . - . - _ . _ , ~ . _ . . . _ . _ _ _ . _ - . - . , _ , _ . . _ _ _ _ _ _

-

. . . .

19

--

complete documentation of applicable evaluations, corres-

pondence, etc., between the various licensee departments,

NRC and G.E. was maintained

During the review of the relay installation data sheets, the

inspector identified a discrepancy between the pick up voltage

recorded on the data sheet and the acceptable pick up voltage

range as specified in the procedure, PT1402L, Revision 5. The

PT Supervision stated that G.E. SIL 44, Supplement 4, Revision

2, July 10,1984, identified changes to the pick up voltage

range after the initial installation of the relays in late 1982.

Subsequently, the procedure was revised to reflect these changes i

as noted in Revision 5; however, plant conditions had todate '

prevented any readjustment of the pick up voltage. Plans have

been made for readjustments to be performed during the upcoming

refueling outage. The inspector reviewed Production and Test

Memorandum, PT-29-85 that stated that readjustments would be

rade to any relays that were not presently within the pickup

voltage range as r.:.e specified in the procedure (PT1403L,

Revision 5). The in:pector had no further questions.

The inspector's review of those relays involved in a loss of

normal power and subseauent FWCI initiation indicated that they

had been type HFA51 relays with lexon coil spools. A subsequent

review of their replacement with HFA151 type relays with tefzel

coil spools included: procurement packages, receipt inspection,

related job orders, installation procedures, calibtation data

sheets, quality control involvement, and technician training.

The replacement of LNP HFA51 relays performed under J.0.

182-378, started on September 25, 1982 and was completed on

October 7, 1982. Installation was performed by the Production

,

Test Department with direction and assistance provided by

j' Engineering. During the inspector's review of the job order, it

was noted that plant conditions were established as to the con-

} duct of the work; special precautions were established; tags

l were hung as required, QC performed an installation inspection

! (viiual); specific " Job Instructions" were written and included;

!

written approvals for commencemnt of work were provided; system

-

retest was performed; and appropriate reviews of completed work

l were performed.

l 5.4 Availability of FWCI System Pumps

,

l The objective was to ascertain that the FWCI trains and pumps,

! including the condensate pumps, condensate booster pumps, and

j associated valves and breakers, were available for their intended

operations, and to assure that the Service Water System (SWS) would

! provide cooling water to the FWCI train pumps.

l

.. ..

20

5.4.1 Availability of FWCI Pumps

Proper operation of at least one of the two FWCI trains is essential

to provide makeup water to the reactor in the event of loss of normal

power (LNP). Failure of any of the following components in the FWCI

trains could result in the subsequent failure of the FWCI trains:

Feedwater Pump A or B

Condensate Pump A or B

Condensate Booster Pump A or B

Feedwater Control Valves

The inspector visually inspected the above components to ascertain

their general condition and the operational readiness including valve

lineups, power supplies, and proper positions of control switches.

No unacceptable conditions were identified.

In addition, the inspector reviewed the preventive maintenance,

corrective maintenance, and surveillance activities which signifi-

cantly contribute to the operational availability of the components.

The scope of review and inspection findings for each of these

activities is discussed below.

Preventive Maintenance

The preventive maintenance review consisted of an examination of

schedules and records, a review of the program and procedures, and

interviews with personnel and an actual " talk through" of selected

procedures. The licensee is committed, in the Administrative Section

of the Technical Specifications, to Regulatory Guide 1.33 and thus to

ANSI N18.7 (1976). The licensee's maintenance program is described

in their Administrative Control Procedure ACP-QA-2.02C, Work Orders,

Revision 2, December 28, 1981. The review verified that:

Preventive maintenance procedures exist for the selected compo-

nents,

The licensee is performing the maintenance per procedural

requirements for the selected components

Technical Specification Requirements of Limiting Conditions for

Operation are properly documented.

The preventive maintenance and frequency are adequate

The preventive maintenance procedures are clear and technically

adequate, and components are properly returned to service

.. ..

21

The maintenance personnel are knowledgeable

No unacceptable conditions were identified.

Corrective Maintenance

The corrective maintenance review consisted of an examination of

corrective maintenance records for the past two years, a review of

corrective maintenance procedures, and interviews with selected

maintenance personnel. The review verified that the requirements

specified in the Administrative Section of the Technical Specifica-

tions, ANSI 18.7 and licensee's Administrative Control Procedure

ACP-QA-2.02C, were met, and that:

Corrective maintenance is performed on the selected components

The maintenance is performed per procedural requirements

Technical Specification Requirements of Limiting Conditions for

Operation and Surveillanct are properly documented

The maintenance procedures are clear and technically adequate

and components are properly returned to service

The corrective maintenance is adequate as evidenced by the

number of repetitive failures

Surveillance

The surveillance inspection consistt:d of witnessing simulated sur-

veillance testing, a review of test procedures, discussions with

operators and a review of test results.

The survefilance test review verified the following:

That surveillance testing is performed on the selected compo-

nents, and, if Technical Specification Requirements are

involved, that these requirements are met;

That the surveillance testing is performed per procedural

requirements;

Surveillance test procedures are clear and technically adequate;

Testing meets its intended oh'ectives and that components are

properly returned to service after completion of the test;

The test results are within the required range and that appro-

priate action is taken; and

1

. . ..

f

I

!

22

The performance and knowledge of the test personnel

were adequate.

The documents reviewed, to verify that the above criteria were met,

are listed in Attachment C.

In addition, on June 20, 1985, portions of Surveillance Procedure SP

628.1 Integrated Simulated Automatic Actuation of FWCI, CS, LPCI, CG,

and GT, Revision 5, were simulated. The objectives of the simulation

were to verify that the procedure was clear and adequate and to

evaluate the performance and knowledge of the test personnel.

No unacceptable items were identified.

5.4.2 Availability of Service Water System (SWS)

The inspection objectives were to verify that the cooling water for

the FWCI pumps is available, and to ascertain that MOVs, circuit

breakers and the SWS flow strainer are reliable and operable should

their services be demanded.

The inspection efforts were focused on surveillance, preventive

,

maintenance, and corrective maintenance.

Service Water Sy. stem Oescription

The Service Water System (SWS) is a continually operating system

designed to supply cooling water from Long Island Sound to the

station closed cooling systems and other direct cooling loads.

Essential equipment serviced by this system during accident condi-

tiens includes the Reactor Building Closed Cooling Water (RBCCW) heat

i

exchangers, the Turbine Building Secondary Closed Cooling Water

(TBSCCW) heat exchangers and the diesel generator cooling system.

The TBSCCW system provides cooling to the FWCI pumps.

The SWS is essentially a manually operated system consisting of four

motor driven pumps, normally open manual and butterfly isolation

valves, check valves and associated piping and instrumentation.

During tormal full power operation, any three of the SWS pumps can

maintain plant cooling loads with the fourth pump being used as a

,

spare. Under accident conditions only one pump is required to main-

'

tain cooling of the essential loads.

With the occurrence of a loss uf normal power (LNP), all four SWS

pumps load shed if they were running at the time. After a brief

interval, to allow the emergency generators to run up to speed, two

of the four pumps are automatically restarted off the emergency power

sources. Failure of both pumps to restart would result in the

l

i

. __-- . _ _ _ _ -. . - _ _ - - - _ -

. . ..

I

23

-

following: inability of the TBSCCW heat exchanger to provide cooling

to the FWCI system pumps, failure of the diesel generator heat

i exchanger to provide cooling to the diesel, and failure of the RBCCW

i to provide heat removal capability for the shutdown cooling system

(SDCS).

Preventive Maintenance, Corrective Maintenance and Surveillance

'

r

The preventive and corrective maintenance documents reviewed are

listed in Attachment D and include components associated with the SWS

pump operability, such as the strainer, butterfly valves, and pump

drive motors,

i

No unacceptable items were identified.

! 5.4.3 Availability of FWCI pump Permissive pressure Switches l

The IREP study identified that one of the major contributing factors

for FWCI failure and a subsequent core melt accident sequence was

failure of the pressure permissive switches, preventing FWCI pump

operation during the loss of normal power accident.

FWCI Pump Suction Pressure Switches PS-2-16 and 54 provide low

suction prassure, start prohibit interlocks for FWCI Pump A; similar

switches PS-2-20 and 56 provide the same interlocks to FWCI Pump B.

j

'

A single failure of one of the two pressure switches in the open

'

position will prevent starting of the associated FWCI pump and,

therefore, could result in loss of FWCI flow.

To ascertain the operational availability of these pressure switches,

the inspector reviewed the calibration reports for the May 1984

period. The pressure switches are calibrated every refueling outage.

The calibration data for each pressure switch is recorded using

" Calibration Report" data sheet. However, there was no written

procedure to perform the calibration activity which requires isola-

tion of the pressure switch and valving it back after calibration is

completed. If the technician forgets the later action, the pressure

,

switch remains isolated and could prevent initiation of the asso-

l ciated FWCI pump under an accident condition. Therefore, it is

i

important to have a written procedure which will include valve E

j verification upon completion of a calibration (or maintenance)

activity on the pressure switches.

Technical Specification (TS) 6.8.1.a and referenced Regulatory Guide

1.33, Appendix A, Paragraph 9.a. require that written procedures

shall be established for all safety related activities which include

the calibration and maintenance of safety related instruments.

Millstone Unit 1 QA Category I Material, Equipment, and Part List,

Revision 0, March 15, 1984, Section I-7.1, lists those pressure

t

i

!

,

.. ..

24

switches as Category I (safety related). Therefore, the above

requirement of TS 6.8.1.a applies to these pressure switches. This

requirement is further defined and specified by the following NRC

requirements and licensee commitments:

10 CFR 50, Appendix B, Criterion V, Instructions, Procedures,

and Drawings.

Licensee Commitment to RG 1.33 and ANSI N18.7-1976/ANS 3.2 as

contiined in their Quality Assurance Program Topical Report,

Revision 6, August 1, 1984, Appendix D.

ANSI N18.7-1976/ANS 3.2, Administrative Control and Quality

Assurance for Operational Phase of Nuclear Power Plants, Section

5.3.7., Calibration and Test Procedures.

Adninistration Control Procedure ACP-QA-1.06, Quality Assurance

Program, Revision 8, December 24, 1984.

Administration Control Procedure ACP-QA-9.04, Control and Cali-

bration of Measurement and Test Equipment, Revision 16.

The failure to provide a written proredure for calibration and main-

tenance for FWCI pump suction pressure switches is contrary to TS 6.8.1.a and constitutes a violation collectively with the item

discussed in Section 10. (245/85-15-01).

However, the licensee had an internal memorandum 5784, Revision 0,

dated May 15, 1985, directing the I&C Department to review the sur-

veillances to ensure that the Technical Specifications requirements

are met and complete this action by December 31, 1985. Further, the

inspection team noted that the operability of the pressure switches

is periodically (every refueling outage) tested using station proce-

dure SP 628.1, Integrated Simulated Automatic Actuation of FWCI, Core

Spray, LPCI, Diesel and Gas Turbine Generators, Revision 5, August

25, 1983, and that the valve lineup of the pressure switches are

periodically (quarterly and prior to plant startup) verified using

station procedure SP 440A, Quarterly Instrument Isolation, Bypass and

Vent Valve Position Check, Revision 2, July 13, 1983. In general,

instructions are not clearly provided to assure that the safety

related instruments are returned to operational status after calibra-

tion / maintenance activities.

To improve the calibration procedures, the licensee committed to

evaluate the need for written procedures for safety related instru-

ments, and to have the required procedures in place by October 31,

1985.

X

. . . .

25

On June 2J, at 10:00 a.m., the inspectors observed the performance of SP

625.4, Emergency Condensate Transfer Pump Operational Readiness Test

(ISI), in the control room in the plant. The operator completed the

appropriate prerequisites, monitored the hotwell level, and measured and

recorded the opening time of valve 1-FCX-5, as required. However, due to

a faulty flow indicator, the system flow could not be verified and the

test could not be completed. The licensee issued instructions to repair

the gage and reperform the test at a later date. The operator was very

krowledgeable of the procedure and equipment.

6.0 Availability of Emergency AC Power System

A major contributing factor during the selected core melt sequence was

failure of the emergency gas turbine and associated breakers which

prevented the loading of vital buses onto the gas turbine. The inspection

focussed on the hardware availability of the gas turbine and associated

vital breakers and relays.

6.1 System Description

!

j The emergency AC power system is designed to supply power to selected

i emergency loads during periods when normal power is unavailable,

i f.e., during a loss of normal power (LPN). Under these abnormal

'

conditions, the system provides both generation and distribution of

power until normal plant conditions are restored. The emergency AC

power system is a subset of the normal AC power system and consists

of the following systems

1 --

4160 volt AC system

j --

480 volt AC system

--

)

480 volt motor control centers (MCC)

i

--

vital AC system

--

instrument AC system

,

--

reactor protection AC system

1

,

The 4160 volt AC system distributes emergency AC power to large motor

j loads fed directly off the 4160 volt buses. It also provides the 480

1

volt AC system through stepdown transformers.

i The vital AC system is a 120 volt system which generates power for

essential loads, primarily the feedwater system control circuitry,

] through an AC/DC powered Motor Generator (M/G) set. Power to the M/G

j set may be provided by either one of several 480 volt AC MCC or by a

j 125 volt DC bus, depending on source availability.

,

l The instrument AC system provides a source of 120 volt AC power to

i

.

plant instrumentation by stepping down the voltage on power supplied

.

'

i

h

i

T

.. ..

26

by either one of two 480 volt MCCs. Similarly, the reactor protec-

tion AC system transforms 480 volt power to 120 volt, feeding reactor

protection equipment.

Emergency AC power is provided by two emergency generators which feed

separate portions of the 4160 volt AC system. These two generators

are a gas turbine generator, rated at 10,000 KW continuous load

and 11,500 KW peak load; and a diesel driven generator rated at

2700 KW base load and a two-hour emergency load rated at 3000 KW.

The emergency AC power system operates in two modes. In its first

mode, both the diesel and gas turbine generators are started auto-

matically upon a complete loss of normal AC power. Coincident with

this, all of the 4160 volt bus loads are shed so that both emergency

generators can be loaded onto dead buses as soon as they reach

operating speed. Upon successful restoration of power to all 4160

volt emergency buses, essential loads are picked up' sequentially to

avoid large voltage drops. Restoration of the 480 volt buses and

their associated loads is concurrent with restoration of their

respective 4160 volt feeder buses through stepdown transformers.

In the second mode of operation, both the emergency generators are

started upon indication of plant accident conditions, even if normal

AC power is available. This is desirable in the event there is a

loss of normal power (LNP) subsequent to the accident.

6.2 Gas Turbine Operations

The inspection objective was to ascertain the operational readiness

of the Gas Turbine Generator. The inspection included a review

of Operating Procedure OP 339, Gas Turbine Generator, Revision 11,

August 25, 1983, to verify its technical adequacy and the clarity of

the procedural instructions. In addition, the inspector observed the

operational simulation of Section 7.2 of OP 339, conducted on June

26, 1985.

6.2.1 Operational Simulation

The objective of the simulation was to evaluate the adequacy of the

procedure and the performance and knowledge of operating personnel.

Section 7.2 of OP 339 involved starting of the GTG from the local

panel, manual and automatic synchronization, and manual loading and

excitation control of the generator.

During the operational simulation of Section 7.2 of Operating Proce-

dure OP 339, as described in Section 6.2 of this report, the inspector

noted that certain clarifications are required at procedural steps

7.2.1.5.J. and 7.2.7 to provide numerical values for the recommended

incremental rate for increasing the generator excitation (MVAR) and

load (MW).

.. ..

27

The procedural steps, as presently written, do not specify the

values. The licensee promptly initiated an interim procedure change,

Revision 11, Change no. 2, dated June 27, 1983, to specify these

values. The inspector reviewed the change and found it acceptable.

The item was resolved and closed.

No unacceptable conditions were identified except as noted.

6.3 Gas Turbine Availability

The Gas Turbine Generator (GTG) provides emergency power to the FWCI

pumps and therefore proper operation of the GTG is essential to

provide makeup water to the reactor in the event of a loss of normal

power (LNP) event. The GTG consists of following compenents:

=

Gas Turbine

=

Generator

Lube Oil System (AC and DC Oil Pumps, Heaters, Vapor Extractor,

Thermostats and Controllers)

Fuel Oil System (AC and DC Fuel Pumps, Heaters and Controllers)

DC Battery Charger

= Air Compressor

The failure of any of the above components could result in a failure

of the GTG.

The inspector visually inspected the above components t ascertain

their general condition and the operational readiness, including

proper system lineup, power supplies and proper positions of con-

trol switches.

The Systematic Evaluation Program (SEP) on Millstone-1, initiated by

the NRC and published in NUREG-0824, Integrated Plant Safety Assess-

ment Systematic Evaluations Program - Millstone 1, February 1983,

reported a number of gas turbine generator failures and documented

licensee commitments to certain backfit requirements. The licensee

actions, related to these commitments are being followed by the

Resident Inspector (see Resident Inspection Report 50-245/84-27,

Paragraph 3.k, Inspector Followup Items 245-84-27-06, 07 and 08). In

an April 5, 1984 letter to the licensee, the NRC accepted deferral of

licensee corrective actions on some of these SEP items.

I

.. ..

28

To make an independent assessment of the operational availability of

the GTG, the inspection focussed on preventive and corrective main-

tenance and surveillance.

The scope of review and inspection findings for each of the above

activities are discussed below.

Preventive and Corrective Maintenance

The preventive and corrective maintenance procedures and records of

the GTG components were reviewed in accordance with the criteria

described in Section 5.4.1 of this report. To verify that these

criteria are met, the inspector reviewed the documents listed in

Attachment E.

The inspector verified that sufficient preventive maintenance pro-

cedures for the GTG components exist, the procedures are technical-

ly adequate, the maintenance personnel are knowledgeable in the

procedures, and the maintenance performed on the components is

adequate.

Surveillance

The surveillance inspection consisted of a simulation of selected

surveillance procedures and review of selected surveillance test

results, in accordance with the criteria described in Section 5.4.1

of this report.

Surveillance Simulation and Test Results

On June 25, 1985, portions of Surveillance Procedure SP 668.2,

Gas Turbine Emergency Fast Start Test, Revision 9, February 1,

1985, were simulated. The objective of the simulation was to

verify that the procedure was clear and technically adequate and

to evaluate the performance and knowledge of the test personnel.

The inspector reviewed the test results of tha surveillance procedure

SP 668.2, Gas Turbine Emergency Fast Start Test, performed during the

last 2 years. This surveillance test is required to be performed

monthly in accordance with Technical Specification 4.9.A.2.a. The

review ascertained that the test was performed in accordance with the

procedures, the specified acceptance criteria are being met, and the

frequency and other requirements of the Technical Specification were

satisfied.

I

i

- _ _ _ _ _ __ __ . - _ _ - _ _ _ ___ _ __ _ . _ _ _ _ __

. . ..

!

29

i

! The inspector also reviewed the licensee's program to plot the result l

of this test (the time elapsed from the start signal to initiation of

different components in the starting sequence until the generator

breaker is closed). This effort is to monitor the effectiveness of

the improved preventive maintenance program, in accordance with the

i SEP commitments in Section 4.28.3 of NUREG - 0828, as discussed

.

earlier in this section. The performance of the gas turbine gener-

! ator as observed from these trending plots appears to be generally ;

! improving.

No unacceptable items were identified.

6.4 Availability of Emergency AC Bus Breakers / Relays

! Upon loss of normal AC power (LNP), it is necessary to transfer the

! vital loads from the normal sources to the emergency diesel generator

or gas turbine. The LNP accident sequence identified that failures

of breakers prevented the loading of vital buses onto the gas

!

.

turbine.

The inspection focussed on those vital 4160 volt and 480 volt AC

breakers to ascertain that preventive and corrective maintenance

i programs were established and implemented, and that post maintenance

l testing was performed properly in order to maintain a high degree of

'

availability of the breakers and relays. Surveillance of these

breakers and relays was already included in the previous sections of

'

gas turbine and LNP relays / logic tests.

.

Power to the vital components is provided through the use of 4160

voit or 480 voit AC breakers. The licensee maintains all 4160 volt

!

AC circuit breakers as Category I equipment, thus ensuring QA/QC

involvement and enabling the transfer (substitution) of one breaker

j for another. This increases the longevity of the breaker and

decreases the maintenance problems that may occur by providing for

,

more equalization of time in which all breakers are energized. 480

volt AC breakers are solely dedicated to a particular component and

j those 480 volt circuit breakers examined that were part of the

accident sequence reviewed included those breakers providing power to

!

the "A" Reactor Feed Pump Lube Oil Pump, and motor operated valve,

MW-96A (discharge valve for the emergency condensate transfer pump).

The maintenance history for-all 4160V AC breakers and those 480V AC

breakers identified above was reviewed and discussed with licensee

representatives. The inspector verified that any maintenance per-

formed was in accordance with the administrative controls which

included:

'

a

i i

a

4

k

_ _ _ _ _ _ _ _ _ _ _

.. - - . _ - - - _ _ -- .- -_

i

,

.. ..

,

30

i

f

$ * use of preapproved maintenance procedures

adequate equipment control during maintenance

a post maintenance testing was performed

QC involvement commensurate with the maintenance performed

proper reviews were made of completed work

All. maintenance work for the 4160/480 AC circuit breakers is per-

, formed under Maintenance Procedures, (MP) 772.1, "4160 Magne-Blast

Circuit Breakers and Metal-Clad Switchgear Cubicles" and MP 772.3"

! 480-volt AC Power Circuit Breaker and ADK-5 Switchgear Circuit

, Breaker Compartments". The inspector reviewed the above procedures

l and verified that they provided appropriate references, adequate

prerequisites, and detailed job instructions.

The inspector noted that a functional test is performed prior to

placing a component back into service or standby. This functional

test is an integral part of, what was titled the Maintenance Request

(MR) and is now called, the Work Order. Operations personnel are

responsible for the satisfactory completion of all functional tests

4

prior to completion of the Maintenance Request (Work Order).

The inspector reviewed completed Maintenance Requests for

.

4160/480 volt AC circuit breakers. It was noted that primarily all

corrective maintenance activity on the 4160V AC system dealt with the

j switchgear and not the circuit breaker itself. Switchgear mainte-

nance generally involved lubrication, inspection and general house-

cleaning. Completed 4160 volt circuit breaker data work sheets, as part

of MP 772.1, were reviewed for preventive maintenance that was per-

i formed on all 4160V AC breakers. This maintenance was last performed

during the time period of December 1983 through March 1984 (General

Electric's recommended maintenance interval is approximately every 5

years.)

Preventive measures were adequate and the corrective maintenance

records reflected the adequacy of these measures.

The breakers and relays for vital buses were well maintained pro-

viding a high degree of availability, indicated by post-maintenance

testing, administrative controls of the activities, and QC involve-

ment.

No unacceptable conditions or deviations were observed.

i

u

_. . _ , . _ , _ . , _ , . . _ _ . , , - _ _ ,, _ , _ _ . , -,-.,_,_,_,,,_,.____,...,,,,,,___m-.

_

y , _ . _ .. .w. m ,, , , y, _ , , , ,..._-y_..-

--. - -- - . - .- .- . _ _ - - _ . - . - .

.

.. ..

"

31

!

4 7.0 Isolation Condenser

The Isolation Condenser (IC) is the core heat removal system upon a Loss

of Offsite Power (LOOP) and subsequent loss of the power conversion

i

system.

7.1 System Description

The isolation condenser (IC) system is designed to remove fission product

decay heat via natural reflux circulation. It consists of the following

components:

1. A condenser containing two tube bundles immersed in water.

<

2. Two motor operated isolation valves, normally open, on the steam

inlet line.

.

3. Two motor operated isolation valves, one normally open and one

,

normally closed, on the condensate return line.

4. Makeup water supply from either the fire protection system (normal

'

supply) or the condensate storage system (alternative supply requir-

ing local manipulation of manual valves) and water level control via '

a motor operated valve and level switches.

! 5. Associated piping and instrumentation and controls.

-

Actuation of the system is initiated by sustained high reactor pressure

(15 second delay to prevent actuation in the event of a turbine trip that

causes short term high pressures) or low-low reactor water level. Under

either of these conditions the normally closed isolation valve, 1-IC-3,

l receives an open signal. The valve opens one and five eighth inches +

initiating a throttled flow that allows primary steam to enter the tube '

bundles and condense. Water on the shell side is heated to 212 F and ;

i boils off and is vented to the atmosphere. '

i

7.2 Equipment Availability

!

j The two major concerns regarding equipment availability that were

reviewed during the inspection were

! 1. That, when needed, the steam / condensate flow path is opened and

i remains open as required.

!'

2. That the shell water level is maintained as needed during IC

i operation.

--

_ , _ _ _ _ - . _ , . _ _ _ _ - _ _ . . . . _ _ , _ . _ . _ _ . _ , _ - -_-- - .. .

-

. . ..

i

32

Specific faults that were identified as potentially significant in

the IREP analyses were as follows:

(1) One of the four isolation valves would be closed and out-of-service

for test or maintenance.

(2) Isolation condenser initiation logic relay contact fails to operate.

(3) Failure of the isolation condenser make-up valve 1-ICM-10.

(4) Operator failure to manually open valve 1-ICM-10.

The above hardware failures and operator error were evaluated during the

course of the inspection.

The 14 maintenance requests (MRs) for the IC system for a period between

March 1983 thru May 1985 were reviewed. No major equipment failures were

found to have occurred during this period.

OP307, " Isolation Condenser System", Rev. 17, effective date September 28,

1984 was reviewed for clarity and safety implications. Comments made at

the end of each observation indicate utility changes in the draft proce-

dure, Rev. 18, initiated in response to inspection findings. The follow- i

ing observations were made:

Inconsistent Shell Side Water Level Measurement Units

OP307, Sections 4.2, 6.2 and 7.4.3 indicate level in inches whereas

Control Room gauge on Panel 903 reads in feet. (Subsequent procedure

changed to read both in feet and in inches).

Concern Involving IC Level Control anc Alarm

Based on the review of the following documents a concern was

identified involving the IC level control and alarm function:

(1) OP 307, Rev. 17

(2) Annunciator Alarm and Response Panel 903A-2, Window 6-3, dated

i

February 16, 1984

l (3) CWD Isolation Cond. Sys. Make-Up 1-IC-10(V16-5), Rev. 9, dated

August 1983

i

Level Control and Alarm Operations

Level Switch Make-Up Valve

l Shell Level Designator Alarm Initiation Operation

95" Hi-Hi Hi-Hi/Lo Level close signal

80" Hi close signal

69" Low Hi-Hi/Lo Level open signal

i

. . __ . - _ . . _ ._ _ _ _ _ __

. , ..

33

!'

In both OP 307 and the alarm response procedure, the following immediate

actions are indicated:

(1) If a low level occurs ensure make-up valve 1-IC-10 opens. Dispatch

the operator to the valve, if the 12E bus or MCC-E3 is not energized

,

as would occur with LNP and gas turbine not available.

(2) If the high level cannot be attributed to make-up valve operation,

I.C. valve surveillance or suspected and verified leakage past system

valving, isolate the condenser.

The above immediate actions were reviewed for accuracy and acceptability,

under the high operator stress levels in the control room during a LOOP /

loss of emergency electrical supplies, where IC operation becomes vital.

The first observation is that a low level alarm will occur every 30

minutes to an hour af ter IC initiation, regardless of whether the system -

1

is operating normally or not. In order to actually assure that make-up

is initiated the operator would have to observe level over a period of

time. As the alarm will annunciate under normal conditions, the operator

, may consider the alarm a nuisance alarm and not take the required time to

assure that the level begins to move upward. This is a distinct possi-

bility given the other pressing operator activities during a LOOP situa-

tion.

The second observation concerns a Hi-Hi level alarm. Unlike the low

level alarm, which is expected to normally occur during IC operation,

a Hi-Hi level alarm should be characterized as a definite off-normal

, alarm. Note that mcke-up valve 1-IC-10 should have received a close

signal when level reaches 80" and thus, if operation is normal, the level

should never reach Hi-Hi.

.

IC Vent Hi-Radiation Alarm Requires System Isolation ,

OP 307 and the alarm response procedures require manual IC system isola-

tion upon receipt of a high level radiation alarm greater than 10 mr/hr.

This would cause the system to be unavailable. If this were to happen at

a time when system operation was vital, the operating staff would be

forced to make decisions to restart the system without formal guidance.

The possible causes of a high radiation alarm upon system activation were

examined. The following possibilities were identified:

(1) Small tube leak caused by thermal shock and water hammer upon IC

activation.

(2) Malfunction or miscalibration of a detector or alarm affecting one or

both detector circuits.

t

_ _ _ . _ _ _ _ _ _ _ __ e - -. . - _

- - - , . - - . - _ - . . . , __ _ - , _ , ., .- ,

7 .-- - , - -- y,..

.- _ _ - --. . .. - . -- - -- - - . . _ _ . . _ - - - - _ _ - - -

. . .

.

!

34

!

'

(3) Contaminated make-up (e.g. if condensate system were used and

happened to contain sufficient activity to trigger alarm.)

(4) High area activity unassociated with vent.

Equipment availability, especially the condensate return valve and

the make-up valve was determined to be adequate based on the mainte-

nance history and surveillance testing. Also in the event of failure

j of these valves to function automatically, the staff is adequately

trainea to recover through local actions.

-

!

]

7.3 Visual Inspection

j A visual inspection of the IC structures, heat exchanger, valves,

'

piping instrumentation, electrical control and electrical power

equipment was conducted. The housekeeping of all associated spaces

was generally excellent. However, the visual inspection did identify

the following:

1. Improperly installed steam inlet pipe snubber. (Refer to

Section 10.1.2 for details and disposition).

I'

2. Several heavy tool cabinets located against IC Piping, creating

a potential seismic hazard. (Cabinets were removed and secured

'

by chain elsewhere).

f 3. Loose gasket on IC-1, 4 breaker cabinet (MCC F-3). This cabinet

'

and others have been installed to protect controls against a

potential steam environment. A loose gasket could compromise an

entire control center. Also these cabinets do not-have warnings

,

to keep the cabinet doors closed.

7.4 Operations

During the inspection, a valve functional test was witnessed and IC

recovery actions simulated.

!

4

Station procedure SP 627.5, Rev. 3, effective date August 27, 1981,

" Isolation Condenser Initiation Valve Functional Test" checks the

closure time for 1-IC-3, the normally closed isolation valve. The

- inspector witnessed the surveillance test, which requires valve

opening time, valve total stroke, and valve closing time to be

!

recorded. All prerequisites and precautions were satisfied and the

testing, logging, and restoration conducted as required.

,

Valve 1-IC-3 and all safety related valves are included in the ISI

l valve trending program that trends valve opening and closing times.

SP 627.5 is used in this trending program where deviations can tur

detected and preventive maintenance recommended. The inspector found

no discrepancies during the witnessing of the test,

i

-

e==-- - - - - -----e-w, w a -?e- w wmte e e.we-

-

= = *O F*+" F"W'P'wN --""w Y W***'T'--*-*"WT*rev v-T"*"'='eTNV

'

wW7'-+4'=='m*N**T-4 v -*T-'*C * MwP w'W $$wr'-$*T*-' WST"m----V'

_ . _ _ - -

._ _ _ . _ . _ . _ _

_

. ..

!'

.!

!

< 35

1

!

)

i

On three separate occasions, operating staff personnel were asked to

, simulate recovery from:

!

l' *

Failure of condensate. return valve 1-IC-3 to open upon actuation

of the IC, and

a

Failure to maintain IC water level

In each case the operator was thoroughly familiar with the control

room indications, the alternate control via remote manual switch in

! the control room, and the local manual manipulation of both 1-IC-3

and 1-IC-10, including the manual switching to the alternate make-up

supply. The IC equipment is within a three minute walk from the

control room with ready access in most cases. Valve 1-IC-3 requires

! donning of protective clothing, unlocking of a high level radiation

zone and climbing of a ladder. However, this activity is required

during surveillance and at shutdown, so that the staff has experience

i

in reaching and manually manipulating the valve. Based on these

walkthroughs, the inspector concluded that the operating staff can

,

properly respond to off-normal situations involving IC valve malfunc-

4

tions.

l 8.0 Administrative Controls

The NRC staff reviewed, on a sanpling basis, the administrative control

procedures listed in attachment F. The staff also verified the implemen-

tation of the station administrative control procedures to ascertain that

1 the requirements in Section 6 of Technical Specifications, ANSI N18.7 and

Regulatory Guide 1.33, Appendix A were met.

i

!

Based on the foregoing reviews, plant tours and inspector observations,

the following observations were made:

Housekeeping was consistent wif.h the station procedures and the physical

plant was maintained in an excellent state; emergency lighting was gen-

erally good. However, one area had some trash and metal bars which were

, found during a routine plant tour as detailed in the section 10.1.3 of

j this report.

J ~ Tagging: Color-coded tags and chain-locks were observed, and safety

tagging practices were good.

QA/QC: The inspector verified by review of maintenance records on relay

installations that QA coverage during the installation activities were

good and QC inspected the maintenance activities.

Posting: In general, station practices on posting were good for personnel

, safety, radiological, and warning signs for seismic walls and confined

j spaces.

!

i

.

!

\

- . , , , -, .---,----, ,-n .-. ,, n ,.-,,, . - - - ~ , . . - , , , . - . - - . . . , , , - - - - - , , - ,.,,.--,n. _. - -,...,.,-wn,,-n,,_.~... .e, ...,-. _ ,\ e _ .,,-r, n-

. ,,

36

As per letter to NRR dated October 19, 1981, the licensee instituted an

initiative based on the site PRA study results and upgraded the isolation

condenser from non-safety grade to safety grade, which resulted in chang-

ing the power supply of the isolation valves 2 and 3 from AC to uninter-

ruptible DC power. Administrative setpoints were more conservative than

the Technical Specification requirements; the licensee implemented several

preventive measures including trending of vital equipment performance,

such as gas turbine start times and installation of a humidity meter for

the gas turbine generator exciter.

9.0 Human Factors Engineering

9.1 Equipment / Facility Identification

During reutine "walkthroughs" and visual inspection, the inspector

noted that the vital bus breakers on the switchgear room cabinets had

two separate identification (ID) numbers for each breaker. Subse-

quent discussions with the licensee representatives revealed that the

station was using three different identification numbers: station

ID, Ebasco ID and GE drawing ID. Even though the station personnel

were familiar with three different identification systems, the

inspector raised a potential safety concern for possible confusion by

the less experienced plant personnel, particularly during emergency

situations. The station management stated that the potential

problems associated with the different ID systems were recognized

and that the station was in the process of consolidating into one

station ID system. Meanwhile, management was providing extensive

training on the system / equipment identification systems as a part of

the normal qualification program.

During a " hands-on" operational simulation of the APR system and

manual depressurization operations, the inspector identified the

following discrepancies between the operating procedure, OP 337,

" Auto Pressure Relief System", Revision 7, and the identification

numbers on the control room panel:

Identification No.

Equipment OP 337 (Para.8.6.2 and 8.7.3) Control Room Panel

Panel CRP 932 CRP 932-F

Plugs 2E-J1A 287-J1A

2E-J2A 287-J2A

2E-J1B 287-J1B

2E-J2B 287-J28

The licensee subsequently revised the equipment identification

numbers in the procedure to reflect actual ids on the equipment prior

to the inspection exit meeting; this item is closed.

- - . _ .- - . . -. - . , . . . . - - - -

. ..

37

The inspector also noted that the control room level indicator for

the isolation condenser was given in " feet", as opposed to " inch" in

the surveillance procedure OP 307. Even though no safety implication

was observed, this was an example which could induce operator error

under stress during emergency situation.

During operaDility test witnessing of the emergency condensate

transfer pump, the inspector noted that the pump did not have the

identification label posted on or by the pump, contrary to the normal

plant practices. Since the emergency condensate transfer pump was

the only pump housed in the cubicle, there was no safety concern.

However, the licensee stated that the pump identification label would

be posted by the pump.

9.2 Protective Covers for Relays

During simulated " hands-on" demonstration of the LNP relay surveil-

lance test on June 20, 1985 (Procedure SP617.1 and SP 628.1), and

subsequent visual inspection of the vital relays in the control room,

the inspector verified that eleven relays in the panel CRP 608 did

not have the protectivte relay covers. The relay covers are provided

to protect against accidental actuation of the relays by bumping

the unprotected relays.

Subsequent review of minutes of PORC (Plant Operations Review Commit-

tee) meetings and Plant Incident Report (PIR) No.11-85 revealed that

on April 17, 1985 a production test electrician inadvertently bumped

relay 110-RX with his leg, and momentarily closed the relay during

battery charger alarm circuit modification in the rear of panel 908.

The relay 110-RX was one of the eleven relays which were not pro-

tected with a cover. These relays are General Electric HGA relays

for the 4160 volt breakers. The accidental closure of the relay

caused closure of 14A to 14G tie breakers, feeding excess power to the

ESS.

To prevent future recurrences, the PORC endorsed installation of

protective covers for the relays. The licensee issued a PMMS Nuclear

Work Order on June 27, 1985 and committed to install the protective

covers for all 11 relays by November 19, 1985.

This is an unresolved item, pending licensee's action on the protec-

tive relay covers and subsequent NRC inspection (50-245/85-15-02).

9.3 Other Emergency Measures

During periods when the security computer is down, which happened several +

times, operators must call for security guards to unlock doors or get

a key from the control room to gain access to several vital areas

with key card locks. Should emergency entry to these rooms be

.

.w- - -,- _,

- - - - - _ - - , - - m -

v ,

. . .

38

necessary, then entry may be delayed several minutes until a security

guard with a key arrives to open the door. At the Millstone station,

sets of master keys are provided with large master key rings and

stored in the shift supervisor's room. Under emergency situations,

these master key sets would reduce time delays of waiting for

security personnel to provide access.

Beside hand-held flash lights carried by each plant operator, the

inspectors observed such hand-held emergency flash lights stored

conspicuously in several locations, includin, the control room and

gas turbine building.

10.0 Facility Tours

10.1 Areas Toured

a The inspector observed Control Room operations for shift turnover,

log sheets, and facility operations in accordance with the admini-

strative control procedures and Technical Specifications. Several

inspection tours and visual system "walkthrough" observations were

conducted based on the pre-scoped inspection plan, which included

equipment tagging, lock-out, housekeeping, local panels, indicators,

posting, equipment qualification, fire protection equipment, radio-

logical controls, and plant operations. The areas toured included:

--

Turbine generator

--

Feedwater Regulating Valve room

i

'

--

Switchgear room

--

Motor Control Center

,

--

Condensate and condensate booster pumps

' --

Emergency Diesel Generator and gas turbine rooms

--

Reactor feedwater pumps

--

Scram Discharge Volume and Hydraulic Control Units for control

rods

--

Emergency condensate transfer pump

--

Turbine building close cooling heat exchanger

--

Service water system

--

Refueling floor

--

Isolation condenser

--

I&C, Maintenance shops

Details are discussed in the corresponding appropriate sections of

this report.

.

g rew -----t-- -m-=--' -e- w =----e- - ------ - --w -- - - , -e -- w - -e

_ _

, ..

39

10.2 Findings

Radiological Controls

During a plant tour on June 27, 1985 at approximately 1:00 p.m., the

inspector found that the door to the Scram Discharge Volume high

radiation area had been left unlocked and unattended. This area is

located on the south side of reactor building, elevation 14', and is

posted "High Radiation Area, RWP Required for Entry" and " Door Must

Be Locked At All Times". The padlock had been left hanging from the

hasp, unlatched, and no licensee personnel were present in the area.

The inspector contacted an HP technician, and returned with the

technician about ten minutes later to lock the high radiation area

door. No other plant personnel were in the area at that time. The

inspector contacted the Unit 1 HP supervisor who confirmed that the

area was required to be locked or guarded. The supervisor had a new

radiation survey performed approximately one hour later which con-

firmed that 2,000 mrem /hr hot spots existed in that area. In addition,

the supervisor reported that due to the presence of the Control Rod

Unit Scram Discharge Volume, the general radiation levels in the area

could be expected to exceed 1,000 mrem /hr following a scram. Failure

to lock or guard this area is a violation of Technical Specification 6.12.2 which requires that locked doors shall be provided to prevent

unauthorized entry into each high radiation area in which the inten-

sity of radiation is greater than 1,000 mrem /hr. Failure to lock this

door also violates the licensees procedure SHP 4906, Posting of

Radiological Controlled Areas, Section 8.4 which states that "...High

Radiation Areas with the general area dose rates greater than 1000

mrem /hr. shall have all entrances locked or shall be continuously

guarded to prevent unauthorized entry into these areas". The

foregoing is a violation (245/85-15-03).

Isolation Condenser

During an examination of the Isolation Condenser on June 18, 1985,

the inspector noted that the self-aligning rod end bushing on a

Pacific Scientific PSA-10 Snubber on pipe support ICHR-8 had slipped

partially out of the rod end. This bushing connects the snubber to

the rigid pipe support via a ball and clevis pin. With the bushing

partially disengaged from the snubber, the load carrying capability

of the snubber (during a seismic event or water hammer) is reduced.

Similar problems were reported in IE Circular 81-05.

The inspector also examined other accessible snubbers and identified

that two other snubbers, PSA-35, ICSN-4A and 4B, SN-6001 and SN-5450

had, what appeared to be an excessively large (approximately h")

clearance between the bushing and the clevis. The inspector notified

the licensee's maintenance engineer who examined the snubbers. At

i

.- - , _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . . . .- _ . - . _ __ _ _ _ _ .

\

. ..

40

1620 hours0.0188 days 0.45 hours 0.00268 weeks 6.1641e-4 months on June 18, 1985 the licensee declared the Isolation

Condenser System inoperable in accordance with LC0 3.5.E., due to the

bushing on ICHR-8, and issued Plant Incident Report PIR-28-85.

Repairs were made by reentering the bushing, staking the rod end

material to hold the bushing in place, and adding washers to take up

the excess clearance between the clevis and the bushing. The Isola-

tion Condenser System was declared operable at 1705 on June 18, 1985.

The inspector re-examined the repair and verified that it appeared to

be satisfactory, but questioned the licensee about the remaining

safety related snubbers in the plant. The licensee agreed to inspect

the remaining, accessible, safety related snubbers in the plant and

determine if the bushings were in place, and if the clearance was

within the .050 .100 inch acceptance criteria specified in the

recently issued procedure MP 739.3, Mechanical Snubber Installation

and Removal, dated May 16, 1985. The licensee reported that there

were only 32 safety-related mechanical snubbers in the plant. Ten of

these 32 snubbers were already scheduled for removal during the next

refueling outage (as a result of a re-analysis completed recently)

and six of these snubbers were in high radiation areas and were not

accessible. The sixteen remaining snubbers were inspected; excess-

ively large clearances were found on several other snubbers, and a

misaligned bushing was on one additional snubber.

The inspector reviewed the records for installation of the pipe

supports on the Isolation Condenser which was per' -med in 1981.

Review of the Construction Work Permit package 1-E ;-81, for pipe

supports ICHR-8 and ICSN-904, revealed that there were no detailed

instructions or acceptance criteria for installing the snubbers or

shimming the rod end bushings. These snubbers were installed prior

to the issue of procedure MP 739.3, " Mechanical Installation and

Removal" which specifies that the clearance be shimmed to .050 .100

inches.

The inspector reviewed procedure MP739.6, Mechanical Snubber Visual

Inspection, (which was performed during the last refueling outage to

meet Technical Specification 3.6.I) and noted that the inspection

procedure was inadequate to identify the problems with the rod end

bearings. The procedure requires that the condition of the snubber

and the strut be inspected for clamp and bolt tightness and loose

parts, no specific instructions are provided to inspect the rod end

bushing for alignment or proper shimming.

The Technical Specification, Section 6.8, requires that procedures be

developed to comply with Appendix A, Regulatory Guide 1.33 - 1978.

The Regulatory Guide, paragraph 9, requires that, " maintenance that

can affect the performance of safety related equipment should be

properly preplanned and performed in accordance with procedures...

appropriate to the circumstances." Further, 10 CFR 50, Appendix B

_ _ _ _ . - . - - - _ - - - - ~ -- - - _ . - -

h

. ..

41

,

i~

r

Criterion V requires that procedures shall include appropriate ;

quantitative or qualitative acceptance critiera for determining that

'

-

i

important activities have been satisfactorily accomplished. This a

violation and is considered collectively with the item discussed in

Section 5.6.3. (245/85-15-01)

i

During this plant tour, the inspector also noted that three large

] (3'x3'x4") tool boxes, on wheels, were storeo under isolation ,

i condenser and up against the isolation condenser piping. The inspec- ;

i tor expressed his concern to the licensee that the tool boxes might '

!

damage the safety related equipment in a seismic event or as a result

i of water hammer. Subsequently, the licenseo moved the storage area

) for these tool boxes away from the safety related piping. The

1 inspector had no further concerns regarding these tool boxes.

f (

i Pipe Support Anchor

l

{ On June 27, 1985 the inspector noted that one of the four Hilti

,

anchor bolts which attach pipe support CEH-139 to the concrete floor

1

was missing. This provides support for LPCI Injection Valve 1-LP-10A.

i The licensee issued a work request to replace the missing bolt. The

j inspector had no further concerns about this item.

t

Motor Operated Valve L

On May 15, 1985, a MOV housing of LPCI spray valve fell off the MOV

i along with the valve operator. Subsequent review of PIR No. 19-75 ;

!

and a discussion with a licensee representative revealed that the

valve housing loosened as a result of cracks and a routine visual

,

'

i surveillance checks did not identify the problem. The licensee

1

stated that the surveillance procedure would be reviewed and if

necessary, be revised to provide adequate instructions for visual

i

inspection of the cracks or loose parts. This is an unresolved item

i

pending licensee's action and subsequent NRC inspection

! (245/85-15-04). -

i

i Missing Cable Tray i

,

On June 27, the inspector noted a 10' section of cable tray appeared

i to be missing in a cable run above the Drywell Compressors at ;

approximately elevation 35' in the Reactor Building. At the exit

l meeting, the maintenance supervisor reported that the section of

j cable tray, which was not safety related, had been removed to accommo-

j date a modification, but had never been replaced. The licensee

4

issued work instructions to replace the cable tray. The inspector

l had no further questions regarding the item.

l, 11.0 Unresolved Items

l Unresolved items are matters about which more information is required to

determine if it is a violation, a deviation or acceptable. Unresolved

items are discussed in paragraph 9.2 and 10.

.

3

i

_ _ _ _ _ _ . _ _ . _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _

-

. . .

42

12.0 Exit Meetings

The inspector met with the licensee representatives denoted in paragraph I

on June 21, 1985, and June 28, 1985, and summarized the purpose, scope

and findings of the inspection. The attendees are listed in paragraph 1

of the report details.

No written material was provided to the licensee by the inspector.

t

i

. .. . .

. - . - . _ . - _ - .

_ .- . - _ __. - - . - ..--__ --. -- .

< . .

i

ATTACHMENT

'

DOCUMENTS REVIEWED

A. FWCI Pumps Preventive Maintenance Documents

l * Administrative Control Procedure ACP-QA-2.02C, Work Orders,

Revision 2, December 28, 1981.

l

! * Maintenance Procedure MP 712.2, Disassembly / Reassembly of 1573

) Pressure Seal Tilting Disc Check Valve (Feedwater Check Valves),

Revision 3, January 3, 1985.

Maintenance Procedure MP 716.3, Disassembly and Assembly of Feedwater

, Control Valves, Revision 2, July 23,1980.

i

1 * Maintenance Procedure MP 716.5, Disassembly and Assembly of Feedwater

4 Regulating Bypass (10*s) Valves, Revision 0, April 20,1984.

j_ *

Maintenance Procedure MP 716.6, Disassembly and Assembly of the

Reactor Feed Pumps Minimum Recirculation Valves, Revision 0, ,

May 3, 1984.

).

l

,

Maintenance Procedure MP 719.3, Maintenance of Anchor / Darling

i Pressure Seal Gate Valves, Air Assisted Swing Check Valve and Their

l

Actuators, Revision 0, August' 12, 1982.

'

Maintenance Procedure MP 720.2, Main Condensate Pump - Replacing

Pumping Stages, Revision 2, December 9, 1982.

Maintenance Procedure MP 720.3, Ingersoll - Rand, Horizontal Single

Stage Centrifugal Split Casing Pumps (FWCI Booster Pumps),

r

,

Revision 5, September 19, 1984.

,

Maintenance Procedure MP 720.4, 12C Reactor Feed Pumps (Ingersoll -

1 Rand), (Equipment Nos. M2-10A, M2-10B and M2-10C), Revision 3,

Januar; 3, 1985. ,

!

Maintenance Procedure MP 720.6, KRVL Auxiliary 011 Pumps (For Reactor

i Feed Pumps), Revision 3, January 3, 1985.

!

3

-Maintenance Procedure MP 720.7, Main Condensate Pump Rebuilding Of

l Pumping Stages, Revision 2, January 3, 1985.

i

Maintenance Procedure MP 724.1, Alignment Procedure (Reactor Feed '

{ Pumps), Revision 2, December 22, 1982. ,

4

i

!

i

!

i _-_ __- . _ . , . _ . _ , _ _ _ _ _ _ . _ _ _ . _ _ _ _ _ . , _ . _ _ _ _ _ _ _ . _ . . _ _ _ _ . . _

, _ _ _

- . _ _ - . . .. - . . _ _ . _ -. . .

. _ - - __ ~-

. .

. Attachment 2

i

Maintenance Procedure MP 724.2, Coupling Fit-up (Reactor Feed

Pumps), Revision 2, August 2, 1978.

1

Maintenance Procedure MP 741.2, Mechanical Seal Repair of Horizontal

Pumps (Condensate Bocster Pumps), Revision 2, January 23, 1985.

1

Maintenance Procedure HP 770.2 Condensate Booster _ Pump Motor

.

(General Electric Model SK63117A2-2000HP), Revision 2, June 4, 1980.

!

Maintenance Procedure MP 770.3, Horizontal Squirrel Cage Induction

,

Motors / Generators, Revision 3, January 23, 1985.

,

Maintenance Procedure MP 770.4, Tri-Clad Vertical, High Thrust

Polyphase Inductions Motors, Revision 4, January 23, 1985.

Maintenance Procedure MP 770.5, Vertical High Thrust Induction

i Motors - Type K, Revision 3, January 23, 1985.

Preventive maintenance records of FWCI pumps (Condensate, Booster

i

and Reactor Feed Pumps), and Motor Operated Valves (MOVs) as

contained in the licensee's Production Maintenance Management System

j (PMMS), for the period October 1984 through June 20, 1985.

*

Preventive maintenance schedules of the above system components

l.

as contained in the PMMS as of June 20, 1985.

i B. FWCI Pumps Corrective Maintenance Documents

!

Maintenance Procedures listed under the title " Preventive

Maintenance" above. (These procedures apply to corrective mainte

j nance also.)

,

Corrective maintenance records of FWCI pumps (Condensate, Booster

i

and Reactor Feed Pt.mps) an MOVs as contained in the PMMS for the

period October 1984 through June 20, 1985.

l

C. FWCI Pumps Surveillance Documents

l

,

Surveillance Procedure SP 608.13, Condensate and Feedwater Systems

i

Pump Discharge Check Valve Readiness Test (ISI), Revision 4,

i

,

February 1,1985.

i *

Surveillance Procedure SP 608.15, Reactor Feedwater Power Operated

j Valve Readiness Test (ISI), Revision 5, February 1, 1985.

i *

Surveillance Procedure SP 608.26, Reactor Feedwater Pump Rotation

Check Valve Readiness Test (ISI), Revision 2, August 25, 1983.

l

.

. .

\

Attachment 3

Surveillance Procedure SP 608.28, Reactor Feed Pump Recirc. Mint-Flow

Valve Readiness Test (ISI), Revision 1, August 25, 1983.

Surveillance Procedure SP 623.6, Simulated Automatic Initiation of

Operating Power Operated Valves, Revision 2, August 24, 1979.

Surveillance Procedure SP 628.1, Integrated Simualted Automatic

Actuation of FWCI, CS, LPCI, DG and GT, Revision 5, December 2, 1982.

D. SWS Preventive Maintenance Documents

Maintenance Procedure MP 713.1, Butterfly Valve Repair, Revision 2,

September 16, 1982.

Maintenance Procedure MP 720.8, Pump / Fan Driver Alignment and

Coupling (Generic-Procedure), Revision 2, January 3,1985.

=

Maintenance Procedure MP 722.2, Worthington Vertical Double Suction

Pumps, Revision 4, January 3,1985.

Maintenance Procedure MP 736.1, Kinney Self-Cleaning Strainer,

Revision 3, January 28, 1985.

Maintenance Procedure MP 791.1 Controlled Lift of Emergency / Service /

Water Pump / Motor (Generic Procedure), Revision 2, Janaury 23, 1985.

Preventive maintenance records of SWS pumps and MOVs as contained

in the PMMS for the period October, 1984 through June 20, 1985.

Preventive Maintenance schedules as in the PMMS on June 20, 1985.

E. GTE Preventive Maintenance Documents

Maintenance Procedure MP 742.1, Gas Turbine Power Plant Hot Section

Inspection, Revision 2, March 13, 1985

Maintenance Procedure MP 742.2, Gas Turbine Power Plant Cold Section

Inspection, Revision 1, August 2, 1978

Maintenance Procedure MP 723.3, Gas Turbine Power Plant Reduction

Gear Inspection, Revision 1, August 2, 1978

Maintenance Procedure MP 723.4, Gas Turbine Power Plant Vapor Extrac-

tor Vacuum Pumps, Revision 1, August 2, 1978

Maintenance Procedure MP 742.5, Gas Turbine Compressor Blade Wash,

Revision 1, August 2,-1978

'

l

. .

Attachment 4 ;

l

i

Maintenance Procedure MP 742.6, Gas Turbine Generator Rotating

Field Removal and Replacement, Revision 4, July 23, 1980

Maintenance Procedure MP 742.7, Gas Turbine Generator Rotor End

Wedge Staking, Revision 2, January 9,1985

,

Maintenance Procedure MP 742.8, Gas Turbine Generator Load Gear

Alignment, Revision 3, January 23, 1985

Maintenance Procedures MP 742.9, Gas Turbine Inlet and Transfer

Gear Box Removal and Replacement, Revision 1, August 2, 1978

Maintenance Procedure MP 742.10, Gas Turbine Exhaust Frame Assembly

and Coupling Guard Assembly, Revision 0, April 7, 1978 t

Maintenance Procedure MP 773.3, Load Test of Gas Turbine Batteries,

Revision 1, January 3, 1985

Preventive maintenance records of the GTG as contained in the PMMS

for the period October 1984 through June 20, 1985

1

Preventive maintenance schedules of the GTG as contained in the PMMS

as of June 20, 1985

Maintenance Procedures listed under the title " Preventive

Maintenance" above. (These procedures apply to Corrective

Maintenance also).

Corrective maintenance records of the GTG as contained in the PMMS

for the period October 1984 through June 20, 1984

F. Station Administrative Documents

Millstone Unit No. I, "QA Category I Material, Equipment, and Parts

List.

,

Production Maintenance Management System, Program Manual.

Proceedings of International Topical Meeting, Probabilistic Safety

l Methods and Applications, Sessions 17-23, February 24-March 1, 1985,

San Francisco, California.

.

ACP-QA-1.05, Site Operations Review Committee, Revision 14.

! *

Minutes of Plant Operations Review Committee Meetings, 1985.

f

ACP-QA-1.06,. Quality Assurance-Quality Control Programs, Revision 8.

l *

ACP-AA-2.06B, Station Bypass / Jumper Control, Revision 5.

.

l .__ . . _ _ _ . . __ , _ - .

- - - - - - - ,

. .

Attachment 5

= ACP-QA-3.03, Document Control, Revision 26.

ACP-QA-9.02A, Unit 1 Surveillance Master Test, Revision 11.

ACP-QA-9.03, Inservice Plant Testing, Revision 5.

ACP-QA-9.02, Station Surveillance Program, Revision 12.

ACP-QA-9.04, Control and Calibration of Measurement and Test

Equipment, Revision 16.

ACP-QA-10.10, Corrective Action, Revision 0.

Millstone Unit 1 Site Organization Chart.

I

!

l

t

l

i

ML20133G579

Text

Navigation menu

Search