ML20206C432

Notifies of Safety Functional Insp Scheduled for 870511- 0619.Encl Documentation Provided for Info

ML20206C432
Person / Time
Site:	Cooper
Issue date:	04/07/1987
From:	Gagliardo J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:	Trevors G NEBRASKA PUBLIC POWER DISTRICT
References
NUDOCS 8704130054
Download: ML20206C432 (2)

Text

,

w APR 7 1987 In Reply Refer To:

Docket: 50-298 Nebraska Public Power District ATTN: George A. Trevors Division Manager - Nuclear Support P. O. Box 499 Columbus, NE- 68601 Gentlemen:

The purpose of this letter is to inform you of our intention to conduct a Safety System Functional Inspection (SSFI) at the Cooper Nuclear Station during 1987.

Since the SSFI concept is relatively new, we have enclosed some reports of inspections of this type, which have been conducted at other facilities.

Tentative dates for the SSFI are:

Week of 5/11 - Advance Party (about 2 people) to brief NPPD Management and gather copies of procedures 5/26-29 - Inspection at Corporate Office 6/01-05 - Inspection at Site 6/15-18 - Inspection at Site 6/19 - Exit Meeting If you have any questions concerning this matter, please feel-free to contact me about it.

Sincerely, J. E. Gagliardo, Chief Reactor Projects Branch

-Attachments: as stated cc w/o attachments:

Guy Horn, Division ;ianager of Nuclear Operations Cooper Nuclear Station P. O. Box 98 Brownville, Nebraska 68321 Kansas Radiation Control Program Director Neb aska Radiation Control Program Director b (seenextpage)

A C:RP J

4/ /87 don:cs JEGa 4//,

iardo 7

Np\ o I i

t 1 .>

{

8704130054 870407 8 DR ADOCK 0500

L Nebraska Public Power District bec w/o attachments distrib. by RIV:

RPB DRSP RSTS Operator RRI_ R. D. Martin, RA RIV File-SectionChief(RPB/A) D. Weiss,-LFNB (AR-2015) J. Callan, IE R&SPB RSB MIS System Project Inspector

Lpu% _ {9 , dft' . ~ G %

2*4 N

~

E h tmlTED STATES p'* g NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20H6

,.. g .

%.....*/ December 22, 1986

' Docket No. 50-255

~M.

. ); jyy. .q r

Consumers Power Company x

ATTN: Dr. F. W. Buckman OEC 2 91986 n Vice President P "'~ ~ ~ -

Nuclear Operations L

' 212 West Michigan Avenue ~

Jackson, Michigan 49201 Gentlemen:

SUBJECT:

SAFETY SYSTEM FUNCTIONAL INSPECTION REPORT NUMBER 50-25 4

- This letter forwards.the report of the Safety System Functional Inspection performed by an NRC inspection team over the period September 22 to 1 October 24, 1986, involving activities authorized by NRC Operating License

. Number DPR-20 for the Palisades Nuclear Generating Plant. This inspection i was conducted jointly by members of Region III, the Office of Inspection and Enforcement, and NRC contractors.

the findings Nere discussed at an exit meeting with you and the members ofA your staff identified in the appendix in the enclosed inspection report.

i The NRC effort involved an assessment of the operational readiness and func-tionality of the high pressure safety injection (HPSI) system. Particular attention was directed to the details of system design and modification, maintenance, testing, and operations applicable to this system.

This report includes findings that may result in enforcement action, which would be the subject of subsequent correspondence. The report also addresses i other observations and conclusions made by the inspection team. Section 2 j .of the report is a summary of the more significant findings. The detailed findings are presented in Section 3.

The inspection team identified significant problems regarding the function-ality of your HPSI system. These problems included the failure to demonstrate adequate recirculation flow for both HPSI pumps, the lack of a seal-in feature for the recirculation ~ actuation signal (shifting HPSI suction to the contain-i ment sump), and multiple examples concerning a lack of capability of air- i operated valves to perform their safety function. These items, in addition

to other significant concerns potentially affecting the operation of your safety systems, are summarized in Section 2 of the enclosed report entitled,

" Summary of Significiant Inspection Findings." We request that you respond I

1 to this office within 30 days describing such actions that you have taken or intend to take in regard to those weaknesses identified in Section 2. Your

) response need not repeat the information provided in your December 1,1986, j letter to Mr. James G. Keppler but should provide any applicable update of the related issues.

I i

i

\

1

_S a 2 % f17f g, i

o Censumers Power Company ~

. l While planning corrective actions based on the weaknesses identified in the enclosed inspection was only on the HPSI system.

report, it is important that you realize that the focus of this Therefore, consideration should be given systems.to identifying and correcting similar problems in other safety-related Should you have any questions concerning this inspection, we would be pleased to discuss them with you.

Sincerely, J

hr es M. Taylor irector

[-

0 fice of Inspection and Enforcement

Enclosure:

Inspection Report 50-255/86-029 cc w/ enclosure:

See next page, J

l

4 Censumers Power Company cc w/ enclosure:

M. I. Miller, Esquire -

Isham, Lincoln & Beale 51st Floor Three First National Plaza Chicago, Illinois 60602 Mr. Thomas A. McNish, Secretary Consumers Power Company 212 West Michigan Avenue Jackson, Michigan 49201 Judd L. Bacon, Esquire Consumers Power Company 212 West Michigan Avenue Jackson, Michigan 49201 Regional Administrator, Region III U.S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn, Illinois 60137 Jerry Sarno Township Supervisor Covert Township 36197 M-140 Highway Covert, Michigan 49043 Office of the Governor Room 1 - Capitol Building

. Lansing, Michigan 48913 Palisades Plant ATTN: Mr. Joseph F. Firlit Plant General Manager 27780 Blue Star Memorial Hwy.

Covert, Michigan 49043 Nuclear Facilities Monitoring SectionandOffice Environmeatal Division of Radiological Health P. O. Box 30035 Lansing, Michigan 48909 Institute of Nuclear Power Operations 1100 Circle 75 Parkway Suite 1500 Atlanta, Georgia 30339

. 0FFICE OF INSPECTION AND ENFORCEMENT DIVISION OF INSPECTION PROGRAMS Report No.: 50-255/86-29 ~

Licensee: Consumers Power Company 212 West Michigan Avenue Jackson, MI 49201 Docket No.: 50-255 License No.: DPR-20 Facility Name: Palisades Nuclear Generating Plant Inspection Conducted: September 22 through October 24, 1986

~

Inspectors:

ton L

• T. O. IIartin, Inspection Specialist, IE, Team Leader alzds 0' ate O- - - - hof

• D. S. Butler, Reactor Inspector, Region III . l( h GlVic>

Date'

90. WA, Reac

• R.

A 4ee r In por, Region III n/26/a, Dhte' c

• A. T. How 1 III, Inspection Specialist, IE _/2l6b?$

Ddte'

k. Du

• R.

C. Pierson, Inspection Specialist, IE a(sit Date

'y

• A_)i.jSharkey, Ospection Specialist, IE _ // 4t/M Date Accompanying Personnel: *L. J. Callan, *C. W. Hehl Contractors: *E. T. Dunlap, *S. M. Klein, *G.

W. Morris *G. J. Overbeck Approved b'.

{f if Gx PhillipBranch, F. Myee, IE Chief, Operating Reactor Programs n/s/%Date

• Present during the exit interview on October 24, 1986, a?IonLV!28 n1 o i O J- & P if aJv g

SCOPE:

This special, announced team inspection was performed to pro in-depth assessment of the operational readinessress safety injection HPSI) system at Palisades.

of the high tional readiness a(nd management controls were r c-tional areas, primarily as they related to the HPSI system The functional areas reviewed were: .

• System Design and Modifications

• Maintenance

• Surveillance and Testing Operations RESULTS:

Fifteen potential enforcement findings, identified in this report as unresolved NRC Region III Office. items, and two open items will be followed up by the I

e 6

I

1.

INSPECTION OBJECTIVE The objective of the team inspection at Palisades was to assess the readiness whether: of the high pressure safety injection (HPSI) system by de i

(1) by its design basis.The system was capable of performing the safe (2) l all of the safety functions required. Testing was adequate (3) to ensure system operability under postulated a .

(4)

Operator and maintenance technician training was adequate to ensur proper operations and maintenance of the system.

(5) accessibility and labeling of valvesHuman factors considera

! procedures were adequate to ensure pr)oper system operation u i normal and accident conditions.

4 i

h i

i 4

f i

i 1-

- 2.

SUM 4ARY 0F SIGNIFICANT INSPECTION FINDINGS

Nuclear Generating Plant safety systems .

aresades Section 3 pro-summa vides ated. the detailed findings pertaining to the four major functional The observation numbers appearing in parentheses after u- the indi items 3.

Section summarized are provided for reference to the corresponding ussions in d

2.1 1

High Pressure Safety Injection System Functional Concerns 2.1.1 Lack of Seal-In Feature for Recirculation Actuation Signal j

i .The was notsafety designedinjection with a seal-in(SI) system recirculation actuation sign feature.

the high pressure safety injection (HPSI), low pressureonsafety (LPSI),

injecti and containment spray pumps sufficient source to a nearly empty source. may unintentionally shift from a reliable of air operated valves that were provided with The a lim i

air available reliable may not be sufficient to reposition these valves back to t water source.

l HPSI, LPSI, and containment spray pumps during a loss-o (LOCA). [3.1.1) 2.1.2 HPS'I Pump Operability Concerns developing the minimum recirculation flow ons.

requir This recirculation flow is needed to prevent pump damage resulting f

heating when the HPSI pumps are operated against a shutoff , a probable head -

occurrence during many small-break LOCA scenarios.

operability of the HPSI pumps questionable under c e The team was also concerned that the licensee had not taken step 4

the adequacy of the recirculation flow when confronted with evidence e and degraded have again in as March a result of1986 that the recirculation flow was not sufficie blockage. [3.3.1]

2.1.3 Air-Operated Valve Design Deficiencies

! (1)

The common recirculation header from the SI pumps to the safety i

' refueling water tank (SIRWT) contained two air operated valves in ser i

These air-to-open/

train of the high pressureair-to-close air system. valves received motive air from a s

' notpostulated.

was close on demand if a single failure of the high pressure air sys The result could be to recirculate highly radioactive water during a LOCA to the SIRWT which is vented to.. atmosphere. [3

' (2)

' HPSI subcooling air-operated isolation valves, CV-3070 and CV-3071 were normally shut and failed shut on a loss of air. Although these ,

3 the non safety-related instrument air system. valves served to be opened during a LOCA after primary system pressure dropped bel

) l l

e 7 230 psig to ensure an adequate net positive' suction head (NP HPSI pumps.

Thepumps a loss of the HPSI failure of the during a LOCA.air supply to these valves could result in

[3.1.3(1)]

(3) were normally shut and failed open on a loss of air. -

safety related instrument air system. served a safety related f -

Under certain conditions during a from achieving runout and to ensure adequate pumps. [3.1.3(2)] e NPSI p

(4) -Iodine removal tank air operated isolation valves were normally shut and failed shut on a loss of air., CV-0347A and CV-03478, served a safety-related function Although these valves safety-related instrument air sys, tem.their air supply originated from the non-During a LOCA, these valves must

open to provide iodine removal hydrazine from the containment solution to the suction of the SI pump atmosphere to open would adversely affect the consequences. The failure of these valves

- of a LOCA. [3.1.3(4)]

2.1.4 Misleading Information to Control Room Operators Misleading information'affecting the operation of the HPSI system on two engraved plaques mounted on a control room panel in the cont The instructions procedures on these plaques were not consistent with other lice an,d, if followed .

of the valves in the common, recirculation. header of the SI pum SIRWT.

radioactive

[3.4.2(1)] water to the SIRWT that is vented directly .

2.2 j Operation of Safety SystemsOther Programmatic and Functional Co

:. 2.2.1 I

Testing of Isolation Check Valves in Air Systems i

Check valves in air systems that isolate safety related piping e y-ability from n r i

related their design piping safety were not function. periodically tested to ensure their to p t

operation

[3.3.2] of safety-related air-operated valves under accident .

2.2.2

! Battery Surveillance Testing previous NRC inspection findings at Palisades, includ (1) 1 Performing an equalizing charge before conducting the battery servic test.

(2)

Failure design to correct temperature. battery service test discharge currents to minimum i

(3)

Failure to correct specific gravity readings for electrolyte levels .

battery is operable.These [3.3.3]

deficiencies could result in the licensee errone 2.2.3 Motor-Operated Valve Maintenance Program (1) .

Until recently (mid-1986), the licensee had no preventive maintenance program to lubricate motor operated valves (MOVs).

had been recently developed for periodic inspection and lubrication ofAltho M0Vs, the next most maintenance of these activities outage were not intended to be accomplished u in late 1987.

MOVs had not been relubricated in almost 15 years.Many of thefour Additionally, safety-related environmentally fied lubricant. [3.2.1] qualified MOVs were found to be lubricated with an u (2)

The program for control of MOV torque switch and limit switch setpoints was considered inadequate because of the reliance placed on the skill of the craft to establish switch settings, inadequate procedures, and lack of

~

establishing and verifying proper switch [3.2.2]

settings. consid 2.2.4 Failure to Update Controlled Documents Weaknesses were noted regarding the failure to update controlled documen following tier documents.either the completion of plant modifications or the revision o .

and a plant specific Numerous data base examples were found where plant drawings, the Q-Lis were not updated.

shedding was scheme was modified but the safety classification of three break not upgraded.

have inappropriate beenclassification.

of a lesser quality or maintained improperly as a

[3.1.6]

2.2.5 Maintenance Training Training weak. for mechanical and electrical maintenance personnel was consider to the site training organization.No technical training personnel in either of specific training for these technicians was limited.As a result, plant-specific and com

[3.2.5]

4

/

i

_ __ _ . _ . . - - - - - - - - - - - - ~ ~ - ~ ~ ~~ ~ ~

3.

1 t

DETAILED INSPECTION FINDINGS' t

3.1 System Desion and Modifications o

i l

electrical, and instrumentation and control. System design and anical, the capability of the safety injection (SI) system and the high presThis re sure safety flow throu L injection (HPSI) system, in particular, to deliver required a

.distribution loss ofsystem.ing coolantsystems accident (LOCA), (2) the such as the high pressure air system r-adeq

{

i and power-3.1.1 Lack of Seal-In Feature for Recirculation Actuation Signal t

actuation signal (RAS) was not designed As a con-with on a seal-in a reliable and sufficient source to a nearly empty source. seq All SI pumps (HPSI, LPSI, containment spray) take20amin injection refueling water tank (SIRWT) for about theu first suction t

from es following a LOCA sensors, until using the 1 out SIRW 1evel of-2-taken-twice logic).drops to the low level setpointr at 24 inc the containment sump as the suction .

source s providing for the SI The air used to are sized based on two strokes of the associated safety-rela pressure air compressors supplying these accumulators are noned A0Vs. The high are load shed following a design basis accident. safety related and If, at some time after the shift of suction from the SIRWT ment to the contain sump, nearly theSIRWT.

empty RAS clears, the system will attempt to realign itself back to the i system to again shift The resulttowill suction thebe an almost sump.

containment immediate response by the

~

may air not be possible accumulators. because it is beyond the design capacity of the high ressure The suction source for the SI pumps could then be stuck on a nearly empty containment spray pumps SIRWT resulting following a LOCA.in a loss of water supply, to the HPSI LPSI, and The RAS could clear either as a result of theevelfailure of on sensors suction hasorbeen an shifted oper atorto theattempting containmentto refill the SIRWT at some time after the sump.

plant, there from refilling the SIRW wereduringapparently a LOCA. no procedural precautions or to prevent an NRC Region III Office (50-255/86-029-01).The lack y theof RAS seal-in 3.1.2 HPSI Recirculation Valves Susceptible to a Single Failure The HPS1 system was not single failure proof in that the minimum flow recir-culation the valves high pressure CV-3027 and CV-3056 were both supplied air system. from the sam states that the safety injection system, including the fluid and instru subsystems, were designed to meet the single-failure criterion .

The common

• recirculation head 2r from the SI pumps contained these two valves in series On switchover to SI pump suction from the containment semp, .

se, these valves recirculation header isolation valves required a consequence

. As air to eith high pressure, air system is postulated.the valves may not close on demand if a unresolved pending followup by the NRC Region III Office (50-255/86 3.1.3 .

Reliance on Non-Safety-Related Air System did not receive motive power from a safety-related The following are ~

source.S examples of safety-related air-operated valves that relied upon a non-safet related valves. air system for motive power and the consequences of failure of those (1)

HPSI subcooling shut, and valves, failed shut on loss CV-3070 of air. and CV-3071, were air-operated

, normally  !

opened following switchover to the containment sump recirculation p approximately suction head (NPSH)23forminutesthe HPSI after pumps.a LOCA to ensure an adequate net positive Although these valves served a safety-related function, the motive power came from the non-safety-related instrument air system.

basis accident (DBA), air-operated valves will become inopera air.

assume their failed pusition in 1.4 minutes following a loss of instrument in HPSI pump cavitation, pump damage, and degrad capability.

i In spite of another statement in FSAR Section 9.5.3 to the contrary by the licensee in 1979 confirmed that HPSI subcooli med maintain NPSH under certain accident conditions.

(2) air operated, normally shutContainment spray 1 header

, were isolation valves, CV and held shut by instrument air. Following a containment the holding air. high pressure, condition, these valves would open by vent However, these valves also served a safety function to close if HPSI pump subcooling was required during single train o l

under certain conditionsof the SI system (one HPSI pump and one containmen

,Also, l to be closed by Emergency, Operating Procedureone of these air-operated valves.was r i Accident," to prevent a containment spray EOP)pump 8.1 " Loss-of-Coolant (from reac,hing a runout l

condition.

(

l (beyond design capacity) that could result in pump dam vibration and cavitation.

and CV-3002 would not close and, if closed, they would not remai The resulting multiple flow paths (two spray header branches and one .

ment spray pump that in turn, may cause cavitation d i

pumps 3.1.3(1), as a result of a loss of subcooling flow as explained in observation above.

(3) normally open, and failed open on loss of motive air. Instrume Although instrument air inside containment was nonessential during accident conditions, CV-121

) t

?

)

did not rcceive an automatic containment isolation signal. Operator action was required to recognize the need to isolate the instrument air line and to shut CV-1211. 1 is discussed in observation 3.4.2(4). Inadequate procedural guidance in this action,. isolation may not be accomplished because the instr.ument itsystem shut. was relied on to provide the motive air to shut the valve and hold energy.line break analyses, these lines may not be pro effects of high energy line breaks.

If a design basis accident were to occur causing the loss of instrument air piping inside containment and a then a vent path from the containment may exist. single ac (4)

Iodine removal tank isolation valves, CV-0347A and CV-03478, fai on loss of instrument air even though these valves must be open to permi the drawdown of hydrazine solution under accident conditions to enhance the removal of iodine from the containment atmosphere.

shut valves received a signal to open on containment high pressure.These The norm failure of these valves to open or remain open adversely affects the consequences of the design basis accident.

that the hydrazine solution would be available a minute after a maximu hypothetical accident to improve the removal rate of the elemental iodine.

Items'(1) and (2) above are examples of valves that provide a safety function in both the adequate open and shut positions for which the licensee had not provided design.

Items (3) and (4) above indicate a weakness in the application of original design criteria such that reliability concerns during normal opera may have taken precedence over safety-related concerns during a hypothetical accident.

The team was informed that the instrument air system containment normal or abnormal operation and, therefore, The of grea team was also informed that the consequences of accidentally emitting hydraz into the suction piping of SI pumps following a safety injection demand m

. haveoncontributed shut to designing a loss of motive air. the iodine removal tank isolation valves to fail Relying on the non-safety related instrument air system for safety-related valves will remain unresolved pending followup by the NRC Region III Office (50-255/86-029-03).

3.1.4 Failure of Voltage Study to Addrest Motor Control Center Loads The dynamic voltage regulation studies that were performed in November 1983 number of buses the computer program could handle.and July 19 i single bus load. loads fed from the motor control centers (MCCs) were grouped t review of the individual loads fed from the MCCs.This modeling technique The loadsinspection during transientteam reviewed the individual effects of some of the larger MCC conditions.

The licensee's studies assumed that the HPSI cold leg injection valve MO-3008 would drew 96 amperes on starting bas on applying single-line a standard conversion factor to the motor horsepower listed on the diagram.

However, the applicable vendor drawing indicated that the locked starting current for this valve would be 140 amperes based on the specified rotor current.

Independent analysis by the inspection team revealed l

\

l the resulting voltage drop, coupled with the voltage tran ,  :

I would produce a voltage less than 70% of the motor rated value. This type of ,

The team was concerned that at the reduced voltage th stall and may not operate after the voltage transient.

The failure to ade-the NRC Region III Office (50-255/86-029-04).quately review load 3.1.5 Overcurrent Protection for Motor-Operated Valves At Palisades, the thermal overload relays on safety related, motor-operated valve an overload circuits were not used to trip on overload but instead were used to alarm !

condition.

HPSI motor-operated valves A review revealed of the no overload heaters valid basis installed for their selection. for seven '

The inspection team determined that the overload devices selected would not pro a warning alarm until after the motors were damaged on locked rotor current.

This was particularly important for Palisades because the torque-switches were bypassed stroke. on many safety-related valves for the entire length of the valve It is the team's understanding that the selection of thermal overload relay heaters for safety-related motor-operated valves will be included as part of a plant-wide design basis assessment of electrical protection devices. The rical protection devices remains an open ites pending fol Region III Office (50-255/86-029-01).

3.1.6 ,

Controlled Document and Drawing Deficiencies Weaknesses were noted regarding the updating of controlled documents fo either the documents. completion of plant modifications or the revision of higher tier following examples pertain:In addition, various drawings were foundThe to contain erro (1)

Facility change FC-441-02, affecting the HPSI system, required the addition ment and, on closeout, should have resulted in additi This facility change was closed in 1983 without adequate revision of the 1 Q-list in that 23 components were not included in the data base and 28 components entered in the data base had no classification identified.  !

(2) j The Q-list identification of the equipment items that are safety related, exposed to a harsh environment, and required to function to mitigate a  !

equipment qualification file.LOCA or main steam line break did not agre Numerous motor-operated valves, pressure transmitters and solenoid valves were found to be incorrectly identified in the Q-list as exposed to a harsh environment and qualified for that environment.

It appeared that when various changes were implemented into the electrical equipment qualification file, the Q-list was not identified as a document affected by the changes.

(3)

Facility loads following changeanFC-562 accident. modified the load shedding scheme of non-Class IE This modification was required to maintain an acceptable voltage to Class 1E loads when fed from the startup transformer.

i i

~

for load shedding are considered to be Class 1E dev However, this Maintenance Management System (AMS)s- data ification of breakers 52-7701 152-303, and 52-7804 j

used for. load shedding.

quality fication. or maintained improperly as a result of The failure to correctly classify and treat these breakers as safety-related will remain unresolved pending followup by the NRC III Office (50-255/86-029-05).

(4)

MO 3011, MO 3013, MO 3062, and MO 3064. Facility chang positions of HPSI valves CV-3036 and CV-3037 wasThese also changed.

changes were required to ensure sufficient HPSI flow following a smal break LOCA concurrent with the failure of a single diesel.

This modifi-controlled documents had not been revised: cation was comp

- (a) ments instead of the new assignments.The plant specific Incorrect bus assignments in MO-3045, M0-3049, and MO-3052.the AMS were also found fo ,

(b)

Schematic E 244, Sheet IA, Rev. 4, dated December 19, 1984, indicated MO-3062, and MD-3064.the wrong control cabinet location for valves ,

the licensee as evidenced by a drafted note on the drawi identified an inconsistency for the control location of valves MO-306 and MO-3064),

was not revised. the correct location was not identified and the draw even though the locations identified were also incorrect.A s (c)

Drawing M-311, Sheet 30-6, " Instrument Index," Rev. 11, dated Ma 1986, incorrectly indicated that CV-3036 required air to open and C ,

required air to shut;~however, the operation of these valves was changed to air to shut and air to open, respectively.

(d) data base had not been updated for valves MO-30 .

(5) Drawings M-241, made by modification M-241A, and M-241BC were not updated SC-83-190. es to inc The modification package identified these drawings issued. as requiring change, but no document change request was (6)

Twenty-four new flow control valves (FCVs) installed as a part of modif-ication SC-83-190 were not incorporated into the plant Q-list The modif-ication package revision. erroneously did not identify the Q-list as a document requiring the modification incorrectly indicated that the equipment included the Q-list, had been updated. , which dat l

- ~

'(7) ' down Drawing CoolingM-204, S Shut 18, "P&ID Safety Injection Containment Spra

• normally open,ystem," Rev. 7, showed manual valves 3352ES and 3353ES as but these valves were normally locked open. This drawing as LS0323 when it should have been L50328.also shown on electrical schematic E-207, Sheet 1.The correct identification was classification. carried over to the Q-list in that LS0323 was listed, althou (8)

Walkdown," Rev. 1, AugustDrawing 13, 1986, M-212, Sheet 4, " Piping and In CV-1211 as a motor-operated valve _when it was actually air oper -

(9) Drawing M-208, Sheet IB

" Piping and Instrument Diagram Service Water System," Rev. 5, incorre,ctly showed the service water discharge control valve labelledassociated as CV 0825.with component cooling water heat exchanger E-548 (10) Drawing M-203, Sheet 2, "P&ID Safety Injection, Containment Spray a Cooling System," Rev. 3, incorrectly showed F10317A labeled as FT0317A .

(11) The Q-list identified HPSI flow transmitters FT-0308, -0310, -0312 and

-0313 as being safety related by virtue of their operation. However, the flow safety indicators driven by these transmitters were classified as non-related.

flow transmitters.This was not consistent with the classification of the -

(12) temperature Drawing E95, Sheet element 1, did not show the wiring scheme for the SIRWT TE-0332.

(13) Drawing E95, Sheet 4, showed incorrect as-built wiring for temperature The inspection team presumed that these instrum based on satisfactory calibration results.

~

(14)as Temperature transmitter referenced in drawing TT-0328 was not shown on section diagram M M201-59-28.

(15) Drawing E5, Sheet 1, Rev. 26, indicated that valve MO-3068 had a 1/2 horsepower (hp) motor; however, the motor nameplate data indicated I h .

The document and drawing deficiencies listed abov NRC Region III (50-255/86-029-06).

3.1.7 Control of Design Calculations The sideredinability to identify the design bases of a system or component was con-a weakness.

documents to determine the adeDuring the inspection, the team had difficulty in locat assistance from the licensee. quacy of modifications, in spite of extensive This difficulty was caused, in part, by not maintaining calculations. the original design bases and.by not maintaining readily retrievab Because of this lack of consistent design information, other sources including completed modifications and AM4S system files had to be searc ed to arrive at the design bases and requirements for any given system. The lack of available and well-defined design bases may result in incomplete N

arations of design modifications or procedure changes.

This condition was tained as living documents. aggravated in the mechanical area because design c filed with the modification package or in the AMMS system file.Instea For example, the Eteam found.no mechanical calculation file or index to id calculation storage location with the exception of pipe support calculations. y Critical found. design analyses for NPSH of the safeguards pumps could not The lack of a calculation index and the difficulty experienced in retrieving calculations contributed to a concern that previous calculations may designnot bases be reviewed by engineers when preparing a modification. to obtain an understanding of the original This may result in a lack of design traceability from design input through to design output and an in to determine the design bases of systems and components.

between a licensee calculation and the FSAR is described in observationAn inco 3.1.3(1).

The team was informed by the licensee that similar difficulty had been experienced during their self-initiated review of the auxiliary feedwater system design considered. and that the need for system design descriptions was being 3.1.8 Safety Evaluations The inspectiqn team reviewed the safety evaluations performed pursuant to th 4

requirements of 10 CFR 50.59 for eight plant modifications.

evaluations were found to be deficient. Three of these (1)

In July 1984, a safety evaluation was issued to justify operation with the open position.the motor operator for valve MO-3007 removed and the valv cold-leg injection lines for the HPSI system.MO-3007 is an injection val i

injection water assumed not to reach the core in the safety analysisWith for the HPSI system, FSAR Section 6.1.2.3 states, " Spillage is limited to a maximum of 25% by use of the flowmeters in each injection line and i the throttling capability of each safety injection valve."

evaluation for operating with an inoperable injection valve did notThe safety address this issue, and the basis for concluding that no unreviewed  ;

safety question existed was inadequate.

In February 1986, the safety evaluation for the inoperable safety injection to the throttling valve capability was revised of these to address valves.the FSAR statement relating The revised evaluation concluded that it would not be necessary to throttle these valves to maintain less than 25% spillage and that the discussion in Section 6.1 of the FSAR was misleading. The inspection team confirmed this conclusion.

Although it ultimately was determined that no unreviewed safety question the lack of a system capability explicitly addressed in th (2)

Modification SC-83-190 revised the method for controlling stroke times for air operated control valves (CVs). The original design utilized a t

(SV) to control the air exhaust rate from the actuating c t

- -_ . - _ _ _ , ~.,_,..__..__-.m___ , _ _ _ _ _ _ - _ - . . .,____.,-._,.._m ,.m... ..,,,.~ , . - ... ,_,,

CV.

This modification removed these FCVs and placed a

. valve between the SV and CV to serve the same purpose. flow control check The safety evaluation for this modification concluded that no unreviewed-and a more reliable CV operation would be achieved. safety It did not address potential introducednew failure by the modes or changes in overall system reliability modification. i A second deficiency in this safety evaluation was also identified. This modification involved approximately 24 individual CVs. '

required a unique piping design. Each installation considerations installations. would be addressed in the engineering analyses-accomplished. The team could find no evidence that these analyses were intent rather than final design.Thus, the safety evaluation was based in p (3)

Phase II of modification FC-516-1, completed in 1982, included the 4

installation of manual valves in the suction line of the auxiliary feed-water pumps and the removal of the internals of a Y-strainer in this line.

The portion of the safety evaluation addressing the removal of the Y-strainer internals stated that the removal of the internals wou i

auxiliary feedwater pumps. reduce the chances of the Y-strainer plugg reason basis was no forlonger installing valid. a strainer in this line and why this original i

pending followup by the NRC Region III Office (50-255 3.2 Maintenance The inspection team reviewed maintenance procedures, environmental equi

qualification files, vendor manuals, work orders, and the existing material

. condition of the high pressure safety inje tion (HPSI) system.

interviews and discussions with plant maintenance personnel were conducted.

To a lesser degree, the team reviewed the existing preventive maintenance a vities feedwater associated (AFW) systems. with the low pressure safety injection (LPSI) and auxiliar 3.2.1 Lubrication Program for Motor-Operated Valves i

Until recently (mid-1986), the licensee had no viable preventive maintenance program to lubricate motor-operated valves (MOVs).

Although procedures have been that most of these activities were not intended to be ac maintenance outage in late 1987.

containment MOVs were lubricated with an unqualified lubricant, SU i

-These MOVs were purchased with this lubricant as original equipment, but the

later.

lubricant specification was changed by the MOV vend in the early 1970s.

t

_. =. _ - . .. -._ -- .. . _ . - _ _ _ .

(1)

The team designed. became concerned about the present ability of MOVs to operate as Limitorque valve operators, with emphasis on HPSI and ducted.

The team noted that there had been no periodic program in the past to- inspect or relubricate MOV actuators even though Limitorque {

recommends that the main gear case lubricant be inspected on intervals of approximately 18 months or 500 cycles, whichever occurs first, and the 36 months or 1000 cycles, whichever occurs first. geared limit sw Most of the MOVs were purchased replaced. as original equipment and, for the most part, had not been in almost 15This means that many of these MOVs had not been relubricated years.

There was no licensee engineering evaluation avail-able tions. that justified not following the vendor's lubrication recommenda-

) The licensee addressed this concern partially as a result of one of the

. action items associated with the May 19, 1986, Trip Material Condition Task Force.

with the inspection of approximately 30 other MOVs in prep!

- rebutiding MOVs during the 1987 maintenance outage.

that four MOV operators wera not sufficiently lubricated.The licensee determined was M0-1042A, the power operated relief valve (PORV) block valve.The As noted most notable in Work Order 24606425, the lubricant was "very low and very thick." Because of the hardness of the grease, a vendor representative who was present for this maintenance remove the hardenedactivity grease.had to disassemble the Bellville spring pack to apparently caused by improper manual operation, were also noted. Be As stated in the section entitled " Summary of Work Performed,"

condition tenance. was caused by age, heat, and lack of adequate preventive main-the lub on August 3,1986, under Work Order Licensee inspection of the main gearbox lubrication for M0-3064 24605718, revealed that the grease had broken down to a liquid state and that no grease sample could be extracted because there was no grease in the gearbox. Additionally, interviews with

- licensee personnel also revealed at least one instance in which hardened

. grease in the geared limit switch compartment caused gear failure to the point of preventing proper limit switch operation.

(2)

A review of licensee records revealed that four Limitorque MOVs inside the containment were lubricated with an unqualified grease. The-i Limitorque vendor manual stated that Nebula EP-0 and EP-1 were the only

approved lubricants for MOVs inside the containment. However, licensee records indicated that the main gearboxes of the MOVs, listed below, were filled with SUN OIL SOEP.

Valve No. Description MO-3009 MO-3013 HPSI to reactor coolant loop, train 1 HPSI to reactor coolant loop, train 1 M0-3062 HPSI to reactor coolant loop, train 2

MO-3068 HPSI to reactor coolant loop, train 2 Based on environmental qualification test reports, the licensee should have been aware of this lubrication deficiency since at least 1980.

Environmental Equipment Qualification (EEQ) Specification, MOV-1, Revision 5, referenced Limitorque Test Report B0058, dated January 11, 1980.

App ndix A of 80058 providid lubrication data.

Appendix A cited that and Nebula EP-1 for containment units.the standard lubricants recommendations in the Limitorque vendor manual.This was consistent with'the A reference in the surveillance and maintenance section of MOV-1, Revision 5, stated that "all lubrication options for Nebula EP-0 substitutes shall be ignored " .

(3)

The inspection team found inconsistent and conflicting guidance regarding the different types of lubricants that the licensee intended to use in MOVs .

(a)

The " Mobil Lubrication Manual," used by the lice 28 in MOV gearboxes. .

test reports, and other licensee procedures.This was contrary to the (b)

In May 1986, the licensee changed the grease intended for use in the geared limit switches from Mobil 28 to Beacon 325.

Because of an apparent oversight, however, only the "consumables" section of Attach-

. ment 2 to procedures MSM-M-26, MSM-M-27, and body of all three procedures, still specified Mobil 28. Additionally, 24605717, and 24605719the team reviewed 10 completed work order ,

through 24605724) and noted that the grease specified for the HPSI MOV geared limit switches associated with these work orders was Mobil 28 (Stock Number 37-83818).

ligensee management personnel revealed, however, that the MOVs were stocked and has never been stocked.relubricated with Beacon 3 The discrepancies in the MOV lubrication program that are described a to degrade the environmental equipment qualification and operability of MOVs Interviews with plant engineering and maintenance personnel revealed that th .

i licensee had lubrication problems. initiated an MOV refurbishment program that would resolve these the next maintenance outage in 1987.This program was intended to refurbish all MOV

- may not provide for reliable MOV operation during the interim The period.Th pending followup by the NRC Region III Office (50-255/8 3.2.2 MOV Torque Switch and Limit Switch Setpoints Weaknesses limit switch setpoints. were identified with the licensee's control of MOV torque switch i' (1) point values were not usually recorded following MOV ment in the recording of these values, but the team of approximately 12 work requests reviewed where any settings were rec in which the as-recorded torque switch settings were outside the prescribed Actuator Data Sheet." range specified on drawing M1-NA. Sheet 4-1, Revision 1. "Lim Details are provided in the following table.

14 -

-'----.w - - - . . .-,-.w --2-.- w - - - -  %+-is ew .-.we,w , w-%,,- ------ ngy-- y+y mypr- y.--emm_ . _ . _ _ _ , w w -p. e g r p a rv hTe

Recorded Torque Work Order Switch Settings Valve a No. Number Open/ Closed Specified Normal / Maximum M0-3009 24605712 1/1 M0-3011 24605714 1/1 i\/2k M0-3013 24605715 1 /2%

MO-3062 1/1 24605717 1/1 1 /2%

M0-3066 24605719 1 /2% .

MO-3068 1/1.5 1\/2k i ~ 24605720 1/1 MO-3080 24605721 1.5/1.5' 1 /2k 2/2' t

M0-3081 24605722 M0-3082 1.5/1.5 2/2 24605723 3/3 MO-3083 24605724 1/2%

3/3 1/2%

The (MS-3009 torque switches for the HPSI system cold leg injection isolation valve 3011, 3013, 3062, 3066, 3068) were bypassed in the open direction; however,,the MO-3083, were not. HPSI system hot leg injection isolation valves, M Interviews with licensee personnel revealed that repair personnel could set the torque switches anywhere in the prescribed band and that there was no method to control any deviations from the normal se This was of particular concern because MOV torque switches and limit s .

were adjusted under static flow conditions and were not tested to determine whether they would operate under design differential pressures.

with licensee management representatives revealed thatDiscussions the licensee inten to provide tighter controls over MOV torque switch settings in the future .

(2)

The present settings of torque switches for safety related MOV operators did not appear to be based on expected design differential pressures a letter to Limitorque. dated July In 24, 1984, .

the motor operator number, order number, serial n

. The operate design had not differentialbeen provided. pressure at which these-valves were expected to .

Limitorque's response, dated November 8, 1984, provided a tabulation of the torque switch normal and maximum No discussion of the bases for these setpoints was included. .

As part of thef" response to IE Bulletin 85-03, entitled " Motor-Operated Valve Common-Mode Failure During Plant Transients Due to Improper Switch .

Settings," the licensee had developed a listing of the design differential pressures at which these valves are expected to operate. As stated in their response to this bulletin, the licensee plans to determine correct torque switch settings and adjust the valves accordingly by November 1987 .

(3)

Theinadequate.

was team noted that the procedural guidance for setting MOV limit switches set as described in Procedures MSM-M-26, MSM-M-27, an i

Revision 0 dated August 29, 1985.

These procedures govern Limitorque -

1 valve opera, tor maintenance and direct that closed limit switches be by fully closing the valve and then opening the valve one quarter turn by i use of the handwheel after the valve stem starts to move. These procedures further direct that the open limit switch be set by fully opening the valve, and then closing the handwheel one quarter turn after the valve g -v, nvw--v w-, w w -e r,--m vers,+---ew,e+- --vvii,,,-,,,,-w.m,---,-,-, , , - , . ~ ,w-----,e----e<,w_ ---------e,w=---m-+m.- - e eeuw-r-- e<-, r - r- w -

s i

stem storts te movo.

quarter turn may be necessary for larger valves.A procedural note guidance skill of the was craft.considered weak because it placed too much relianc limit switches one quarter turn off the shut and open s sufficient to ensure that the MOVs operate properly. ' Setting the clo limit switch too close to the shut seat may result in a valve trip on high torque before overcoming unseating forces.

switch too close to the open seat may result in a valve being stuc o.ickseat.

Discussions with licensee personnel revealed that the MOVs w backseating on occasion using this method of setting limit switches .

The weaknesses identified above were indicative of inadequate practices.

ce MOV or maintaining torque switch and limit switch setpoints. Licens provide The failure to Region III such Office guidance will remain unresolved pending (50-255/86-029-09). followup by the N 1

3.2.3 Material Deficiencies The inspection team conducted a detailed walkdown of portions of the system to verify that the system layout was as depicted (P& ids) and that.the system was aligned as required byures, licensee in theproce syst to evaluate the material condition and cleanliness of the system The team and found that the. system layout was as depicted in the system drawings a system was aM gned as required by the procedures. e -

of the HPSI components was considered average. Cleanliness in the vicinity General plant cleanliness was considered including the vicinity belowofaverage, the shutdown especially cooling in heat various exchangers areas of the aux tanks, and filtered waste monitor tanks. , the boric acid deficiencies were noted during the walkdown:The following plant material condition (1)

There appeared to be a general weakness in ensuring that lines to air operated valves were properly maintained. r oilers in The team was concerned their that this weakness may affect the valves' ability to perform safety functions.

noted with safety related air operated valves within the HP ,

two oilers for CV-3027 and CV-3071 were found empty; dirty oil was ob served in an oiler for CV-3036 -

and an oiler for CV-3029 was leaking.

The relubrication inspection team of these found no pr;ocedural guidance to accomplish oilers.

deficiencies will remain unresolved pending followup by NRC Office (50-255/86-029-10).

(2)

Numerous manual valves in small process lines and irstrumentation components were missing identifying label plates.

(3)

Boric acid precipitate, caused by apparent packir.g leaks or swa leaks, was evident on several valves and instruments, including CV-3

. HPSI isolationredundant valve. supply valve, and CV-3059, HSPI pump P-t36B dis ,

-(4)

Debris, materials, and tools were noted in the immediate vicinity of safety related components, particularly CV-3036, HPSI redundant su I

i t

i

,,, . _ . . . - , _ . - - . ~ . _ _ . , _ . _ _ _ . . _ . _ . _ _ ~ _ _ - . _ _ _ , _ ._ _ _ _ _ . _ . ._

valva, and CV-3037, HPSI pump P-66A discharge isolation valve.

material could not be attributed to an in progress cleanup or maintenanc activity.

1' i 3.2.4 Maintenance Procedure Weaknesses The teamswitchgear safety-related reviewed and maintenance and calibration activities a HPSI system instrumentation.

weaknesses were noted. Some procedural (1)

Maintenance procedure MSE-E-10, Revision 1, "480 Volt Breaker Insp

' and Repair," was used to perform maintenance on MCC molded case br and' starter /contactor inspection and repair (Section 5.1) and load center breaker inspection and repair This procedure not follow manufacturer guidelines on(contact care.Section 5.2).did Specifically, Section 5.1 stated, " Clean up with a fine file or replace with new cont if badly damaged."

stated, "Do not file starter contacts." Review of ITE MCC Technical Manua provide a satisfactory explanation for this inconsistency.The licensee w (2)

Maintenance procedure SPE-E-6, Revision 1, "ITE 480 Volt Breaker I and Repair," did not follow all of the technical manual recommendations This procedure specified a contact lubricant (Stock Number .

moving part grease (Stock Number 37-88502) and 37-88510). The lubricant was different from that specified by the manufacturer.

lubricant specified for 4160/2400-volt switchgear.The licensee was using the The manufacturer parts. There was no licensee engineering evaluati A

~

(3) fied the use of a different lubricant on the ITE 480-Volt breaker .

Maintenance procedure SPE-E-4, Revision 3, " Maintenance for 4160/2400 Volt Switchgear,"

adjustment. contained detailed instructions on lubrication and follow the manufacturer's guidelines.Two items on the General Adjustme

- Item 4.a stated that horizontal a horizontal alignment of no greater than 0.020 inc of the present procedure value of 3-11/16 inches minimum.

(4)

Calibration Procedure," used uncalibrated measuri '

(M&TE) in steps 5.7 and 5.9 to make quantitative measureneits. Although these measurements were not used directly to satisfy the surveillance test acceptance criteria, the inspection team considered that the instruments used should have been calibrated M&TE.

The resolution of these procedural deficiencies will remain unresolved followup by the NRC Region III Office (50-255/86-029-11). '

3.2.5 Maintenance Training

, No technical training personnel in either of these area .

1

1

-__.________-._..._i

site training organization.

plant specific and component-specific training.As a result, these technicia with performing a certain maintenance activity had component-specific training to perform the activity.

a particular problem in the mechanical maintenance department because o large number of technicians, approximately 56.

The licensee was in the process of seeking Institute of Nuclear Power O{

(INPO) team's accreditation, concerns. and a program was being developed to address n i During the course of the inspection, the electrical maintenance '

department had implemented a program for administering and documenting job" training, and the mechanical maintenance department was also in of developing particular types ofamaintenance matrix to identify specific repair personnel qualified to pe activities.

3.3. Surveillance and Testing The team reviewed the testing associated with assuring functionality of the safety related portions of the instrument air system, an system.

had been adequately tested to demonstrate that the functions under all

, conditions.

3.3.1 HPSI Pump Operability Concerns A review of HPSI pump inservice test results for 1986 revealed that the HPSI pumps may not be developing the minimum recirculation flow required by Technic Specifications.

by overheating when the HPSI pumps are operated ,a against a probable occurrence during many small-break LOCA scenarios.

The team considered made conditions.the operability of the HPSI pumps questionable u to demonstrate the adequacy of the recirculation flow when evidence, in 1984 and again in March 1986, that the recirculation flow was n sufficient or may have degraded as a result of blockage.

Performance testing of HPSI pumps 66A and 66B was conducted on a perio using Injection Safety surveillance Pumps." procedure MO-22, " Inservice Test Procedure-High Pressure The purpose of the surveillance test was to demonstrate pump operability by monitoring pump differential pressure, vibration, and bea temperature and comparing the results against reference values established in accordance Pressure Code, with Section the American XI. Society of Mechanical Engineers (ASME) Boiler and the ASME Code requirement to measure flow because the range instrumentation (FI-0404A) was too wide (0 to 400 gpm) and,, was consequently not responsive to low flow rates (see observation 3.4.2.(2) for further discus-sion on the unsuitability of the installed flow instrumentation). The vendor manual required a HPSI pump minimum recirculation Because flo adequate by recirculation flow was required to prevent damage to the pump caused overheating.

i i

_ _ . _ - _ _ . - . _ - . , . _ . . . _ _ _ _ - , _ . , - . . . , , _ _ - - - - . _ - . _ , _ , , - - . _m

Th2 ASME mance Code requires before component failure. trcnding test results to detect a decrease in pum 66B had shown an abnormally high pump differential pressure st 1986.

testing in March 1986 were in the ASME Code alert ra tested at twice the normal periodicity.

of high differential pressure. On March 24 Before 1986, neither pump had a history able requiredbecause action value. the pump differential pressure, exceeded the ASME C On the basis of an engineering analysis and without performing any physical repairs, HPSI pump 66B was declared operable on March 25, 1986.

analysis stated that the probable cause of the high differential pressureThe~enginee condition observed in both pumps was internal fouling of the recirculation piping but that existing flow was sufficient to safely operate the pumps. The analysis concluded that (1) pump 66B should be declared operable based on no indications of pump degradation and (2) a high pump differential pressure condition line blockage). was indicative After the of a hydraulic test circuit abnormality (recirculation accelerated test frequency. pump was returned to service, it remained pump the plantdifferential shutdown pressure in May 1986.exceeded the ASME Code alert range continued until The inspection team felt that the ifcensee had declaring HPSI pump 66B operable.not demonstrated the minimum recircu The team's concern regarding the adequacy of HPSI pump recirculation flow increased when it was determined that a special flow at onlytest coriducted in 1984 estimated individual HPSI pump recirculation flow 20 gpm.

This test was conducted in response to licensed operators' concern rates. that the installed flow instrumentation was not responsive to low flow ulation flow could not be obtained. Operating procedures required stopping the The special test procedure required starting a LPSI pump to obtain recirculation flow in the sensitive range of the installed flow instrumentation that was

, located spray pumps. in the common recirculation line for the HPSI, LPSI, and containment recirculation flow was attributed to the HPSI pump.A HPSI pump wa HPSI recirculation flow at approximately 20 gpm. The licensee estimated The HPSI pump vendor was then consulted recirculation to determine the acceptability of pump operation with reduced flow.

The vendor stated that the surveillance test could be safely conducted (greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />). with reduced flow but advised against continuous pump opera plant review committee consideration.Apparently, this safety concern had not received were not considered by the licensee when analyzing the implications of th 1986 ASME Code test results.

The Technical Specification definition of HPSI pump operability states that

" Acceptable levels of performance shall be that the pumps start, reach their ,

rated shutoff fifteen minutes." heads at minimum recirculation flow, and operate for at least The trending data for both HPSI pumps indicated that the engineering analysis. recirculation piping was possibly obstructed, as documen that the minimum recirculation flow requirement was satisfied, the considered both HPSI pumps inoperable.

The failure to fully demonstrate HPSI Office (50-255/86-029-12). pump operability will remain unresolved pending follow l _-- - - - -

3.3.2 Testing of Check Valves in Air Systems 4 .

Periodic testing of some isolation check valves in the instrument air pressure perform their airsafetysystems wasduring function foundabnormal to be inadequate events. to ensure that the valves wo related valves was dependent on isolation check valves that were located atP various points along the interface with a non-safety-related air system. These isolation check valves were not routinely tested and under normal ope conditions were open or experienced no differential pressure.

(1)

Isolation check valves between the non safety related instrument air cally function.tested to confirm their ability to perform their d The high pressure air system provides high pressure control air for air operated valves located in each of two engineered safe-guards rooms and the turbine butIding.

plant reliability reasons, many of the safety related air loads receiveT non-safety-related pressure air. instrument air in addition to safety related high The interface between these two systems typically contains a normally open manual isolation valve and a check valve.

i In general, the high pressure air system is at a higher pressure than shut and held shut by system differential pressures.the inst However, for some valves supplied by the high valves may be normally open. pressure air system, the isolation check This condition can exist because the instrument air supply penetration is downstream of the high pressure air system presssure reducing valves that have setpoints equal to or less than maximum instrument air pressure. Consequently, instrument motive air to the affected safety related air loads. air system valves in the instrument air supply lines for air-operated valvesUnlabeled check i

CV-3223, CV-3224, CV-3212, and CV-3213 are examples of such interfac performvalves check that were their design not periodically tested to ensure that they would function.

(2)

Isolation check valves between the non-safety-related instrument air tested function. to confirm their ability to perform their design saf shut containment isolation valves CV-0911 and CV-0940.The in These valves are containment isolation valves in the component cooling water (CCW) return line and automatically shut if a safety injection signal and

a CCW system low pressure signal are both present.

Because the instrument air system is not safety-related, each valve has an air air system. that is continuously maintained charged by the instrument accumulator On loss of instrument air, isolation check valves in the instrument air supply to CV-0911 and CV-0940 are required to seat 1

to prevent the accumulators from depressurizing.

j unlabeled check valves were not periodically tested.However, these Surveillance i

j of either the check valves to seat on demand or the air a to close the containment isolation valves and maintainAsthem shut.

t a consequence, one or both of these isolation check valves could be in an undetected failed condition so that the containment isolation

once closed, on loss of the non-safety-related ,

' (3) .

system and safety related nitrogen bottles were .

confirm their ability to perform their design safety function. The y tested to instrument air system normally provides air to the T rings of cont isolation butterfly valves CV-0813 and CV-0814. ent

' containment air purge room supply isolation valves.These valves are the require either air or nitrogen to pressurize the T-r seating surface between the 12-inch diameter disk andBecause valve body.

the instrument air system is bottle available to pressurize its seat.not safety related, each valve rogen has a nit from depressurizing following a loss of instrument airTo prevent the nitrogen b provided in the instrument air supply. , check valves are not periodically tested. These unlabeled check valves were not functionally test the ability of either the check valves

~ demand or stored nitrogen to pressurize the containments isolation j T rings sufficiently to maintain a seating surface. .

condition so that the valves may not remain seate safety-related instrument air system.

The failure to perform periodic testing of isolation check valves n will r an unresolved item pending followup by the NRC Region III Office 3.3.3 Surveillance Testing of Safety-Related Batteries Surveillance testing of safety-related batteries was found toOfbe weak .

! weaknesses identified by the team had been previou Inspection Report 50-255/85-009, yet remained uncorrected

. are discussed below. .

Specific weaknesses

{

(1) ,

A testweakness wasdefound of the 125 volt in the licensee's safety-related batteries. preparation for the v ce periodic adequate to supply and maintain all designThebasis loa .

{

izing charge before the service test instead of t the as-found condition. n i

izing charge just before a service test would not accuratel the capability of the battery to provide the design discharge current above minimum maintenance. voltage and would tend to mask the effects of inade i

(2)

Failure to correct battery service test dischar

, expected temperature was considered a weakness.ge currents for minimum Although the 125-volt dc 70* F, the service test was onlbatteries were sized based on a min cell rating temperature of 77* yF.corrected to the manufacturer's 1 The team was concerned that

feilure to correct the service test currents to the minimum design temperature would result in a 4 percent error in the service test results .

(3)

Battery room and cell temperatures were recorded only on a monthly bas and noinminimum tained the surveillance cell temperature criterion or action statement was con-procedures.

a minimum electrolyte temperature of 70* F, cell temperatures asAlthoug low as 65* F were observed in the 1986 battery surveillance records.

Consequently, the team was concerned that an ins .

(4)

Failure to correct specific gravity readings for electrolyte level was considered a weakness.

the electrolyte corrected for level. level, specific gravity readings did not appear gravity of as much as 30 points between high and low elec This could result in up to an approximate 9 percent deficit in battery and the specific gravity readings were low but still w The concerns discussed above regarding the licensee's failure to perform technically adequate battery surveillance tests and to correct testing discrepancies previously identified by the NRC will remain unresolved p followup by the NRC Region III Office (50-255/86-029-14).

3.3.4 Port-Modification Testing for FC 441-2 .

The post modification testing of the HPSI long term cooling modification lished in 1983 was determined to be weak in that the HPSI system configura used during the test differed from that expected following a loss-of-coolant accident.

Modification FC 441-2 provided a hot-leg injection path by which simultaneous injection of approximately even flow through the hot leg and the cold legsincan deposits the be core initiated region. to maintain core cooling and prevent boric acid

Post-modification test procedure 7502-502Q f the four cold-leg injection lines. required that cold-leg injection valves be throttled opened to establish a 50 percent flow split between the hot an cold legs. The throttled open position of the hot-leg injection valves were preserved by limit injection valves wereswitches, not preserved. but the throttled position of the cold-leg On an actual safety injection signal, Upon subsequent initiation of hot-leg injection, more .

the cold-leg injection valves than was established in the post modificetion testing.

A 50 percent flow split between the hot and cold-leg flow paths therefore the cold-legcannot injection bevalves. assured unless further operator action is taken to throttle such action by the operators. Emergency operating procedures did not specify The team was concerned that the licensee's post-m system operation.

to address the aboveItweakness.was the team's understanding that testing will be performed followup by the NRC Region III Office (50-255/86-029-02).This issue will r

l 3.3.5 Survaillance Test and Calibration Procedures i.

Routine surveillance test and calibration procedures were found to be ade for demonstrating system functionality, were clearly written in a consistent i adjustments for operations. that could be necessary, as well as releva .

for HPSI pump operability testing.A weakness was noted, however, with the !

The basis document for Surveillance Procedure MO-22, " Inservice Test Proce

- High Pressure Safety Injection System," Revision 28, contained out-of-date pump differential pressure reference values.

Major pump maintenance'had been ,

performed inmonitoring.

performance 1983/84, which resulted in establishing new reference values for Step 5.3.1 of procedure EM-09-04, " Inservice Testing of Safety Pumps," Revision 8, required revising the test basis document whenev new reference values were established. Although surveillance test procedure basis document had not been revised.MO-22 and the pump record wer technical data up to date is another example of the failure to update aT controlled document (see observation 3.1.6, unresolved item '

50-255/86-029-06).

3.4 Operations In the area of operations, the inspection team evaluated the adequacy of shift manning; control of ongoing maintenance and operations activities; normal op ating, emergency operating, and off normal operating procedures; operator familiarity with the physical location of various electrical and mechanical verifications; and operator training. components; equipment operation in This evaluation focused on how each of and abnormal conditions.these elements interfaced with operation of the HPSI s 3.4.1 Conduct of Operations The inspection team observed a number of licensed reactor operators and operators perform portions of their shift rounds and shift turnovers. On the basis of the sample reviewed, the team considered that these operations person i

were knowledgeable of plant conditions, electrical and mechanical equipment loca-

, tions, capabilities of the HPSI system, and plant operations in general.The

' a primary auxiliary operator shift turnover on Octoberinspection te 22, 1986. These turnovers were to be accomplished effective. in accordance with administrative requirements and appeared '

During shift monitoring in the control room, operators were both in answering questions related to the conduct The overall of plant o level of professionalism by the operators was satisfactory and access to the control room was controlled effectively.

3.4.2 Operations Procedure Weaknesses The team conducted a review of the normal operating and emergency procedures for the HPSI system and other related emergency procedures.

Several weaknesses were noted with the operating directions provided to control room personnel.

1

. . --- ~. . - - - - - =- .

J (1)

Misleading information affecting the operation room.

• Emergency Operating _ Procedure (EOP) 8.1, " Loss of Coolant I Accident," Revision 18, Step 4.14, said to " Place Handswitches

(**CV-3027) and **HS-3056A (**CV-3056) to closed position "

.These switches provided recirculation valves permissive signals that enabled the safety injec safety injection pump (suction from the safety injectio tank (SIRWT) to the containment sump.

valves closing was to ensure that, following a loss of-coolant ac (LOCA),

was vented highly radioactive directly to atmosphere. liquid was not recirculated to'the , which SIRWT Contrary to E0P 8.1, an engraved information HS-3027A plaqueoperation that enabled on the ofcontrol CV-3027 room stated:control panel adjacent c t

For LOCA after PS [ Primary System] press is less HS-A in close position to enable closure of CV-2027 A CV-3056.

similar plaque was adjacent to handswitch HS-3056A on that ena of This information on these plagues was misleading because during this casea LOCA primary system pressure could remainInabove 215 p if an operator followed the instructions on these plaques SI pump re, circulation valves to the SIRWT would remain o pump suction shifted to the containment sump.

, the fission broducts to atmosphere through the vented SIRWT.This could result in v (2) received, least 30 gpm." verify that, "Each running HPSI pump i

intended at to be flows this small. used to make this determination'could rately indication of.HPSI recirculation flow on this gauge would b

. deflection of the indicator and essentially nonquantifiable(See observation 3.3.1.) .

i i

(3) pumps only on the basis of the containment h This procedure was considered weak in that it pemitteday containme .

to be stopped atmosphere was no without longer aconfirmation consideration. that iodine removal from a nment the cont i

' of developing symptomatic based emergency procedures using "Com Engineering Emergency Procedures Guidelines," Revision 03.

This procedural

after the containment high pressure signal had clea evaluation revealed that iodine removal was no longer required.

(4) Alarm Response Procedure (ARP) No. 7

" Auxiliary Systems Scheme," was i

considered weak in that the response,to a containment instrument air low

' pressure alarm did not contain any provision for shutting valve CV-1211 the instrument air header containment isolation It is valve.

possible that during a LOCA non safety related instrument air piping inside n- the contai ment could be broken resulting in a depressurization of the instrument air header and a potential pathway for leakage from the containment to the environment.

Operators would have to manually shut CV-1211 in this

- - , - . . - . , - , ~ _ . . - - -

scenario loss of this b:cause air. it is operated by instrument air and fails open on a (See observation 3.1.3(3))

(5)

E0P 2.1, " Emergency Operating Procedure, Loss of All Immediately Ava AC Power," Revision 1, Step 4.9.2,-directed the operator to shed loads w battery discharge current exceeds 150 amperes.

be shed, identified in Step 4.9.2.c and Attachment 3(4) of the procedureT was the diesel generator control and start circuits. ,

almost entirely associated with the field flashing If required circuit.i The team considered that shedding the diesel generato .

would have a negligible effect on the total capacity of the de system and would reduce the potential for returning the diesel generators to service.

This study.procedural weakness was attributed to an error in the battery load circuit to be a constant 2-hour load.This study incorrectly assumed the The procedural weaknesses identified above will remain unresolved pendin i

followup by the NRC Region III Office (50-255/86-029-15).

9 m

3 5

)

4 h

i i

f 25 -

- - - -.,----reeew-ev - - * - - * - - - - - - - - - - - - - - - - - + , ~ - m-r -------w--iwer--e-e'32--- - -- -c --.-+ ---,%w- -w- ,- - r -

w-- -v ---=r,--- -r-- - --

4.0 MANAGEMENT EXIT MEETING An exit meeting Generating Plant.was conducted on October 24, 1986, at the Palisades Nuclear in Appendix A. The licensee's representatives at this meeting are identified The attendance: Mr. A. Bert following NRC management representatives were also in Davis, Deputy Regional Administrator Region III; Training Center Programs, Office of Inspection and Enfor Paperiello, Director, Division of Reactor Safety, Region III. The scope of the inspection was discussed and the licensee was informed that the inspection would continue with further in-office data review and analysis by team members. The licensee wasfindings.

enforcement informed that some of the observations could become potential and team members responded to questions from the licensee's rep

=

b

e APPENDIX

_ Persons Contacted The following is a list of persons contacted during this inspecti6n. Other technical and administrative personnel who were also contacted. All listed are Consumers Power Company employees unless noted otherwise. personne

• J.

• F. W. Reynolds, Executive Vice President, Energy Supply

• R.

W. Buckman, Vice President, Nuclear Operations B. Dewitt, Vice President, Engineering Support Services

• J. F. Firlit, Plant General Manager

• G.

• K.

B. Slade, Executive Director Quality Assurance W. Berry, Director Nuclear Licensing W. J. Beckius, Executive Engineer

• R.

• J. D. Orosz, Engineering Maintenance Manager

• R. D. Alderink, Mechanical Engineering Superintendent M. Rice, Operations Manager

• D.

• R. W. Joos, Administration and Planning Manager

• J. G. A. Vincent, Plant Safety Engineering Administrator Lewis, Palisades Technical Director

• H.

M. Esch, Plant Administrative Manager

• K. E. Osbourne, Licensing Engineer B. Johnson, Licensing Engineer M. Wade, Sertior Supervisory Engineer, Electrical, Instrumentation and Control R. Gilmore, Project Manager Palisades W. L. Ford, DC System Engineer K. Yaeger, Staff Engineer, Power Plant Auxiliary Group G. Brock, General Engineer, Power Plant Auxiliary Group W. Waudby, Staff Engineer, Plant Relaying and Control K. A. Toner, Nuclear Projects Supervising Engineer J. Eddy, General Engineer, Safety Analysis G. Pratt Staff Engineer, Safety Analysis J. Meincke, Administrator, Safety Analysis B. Young, Section Head, PRA Palisades D. A. Bixel, Staff Engineer, Engineering and Maintenance J. Kuemin, Staff Engineer, Palisades Licensing W. J. Axdorff, Inservice Inspection Engineer T. A. Buczwinski, Plant Projects Supervisory Engineer R. J. Corbett, Plant Projects Engineer C. S. Kozup, Plant Projects Engineer S. G. Kupka, Mechanical Engineering Associate Engineer K. J. Rigozzi, Plant Projects Scheduler R. O. Torp, Instrumentation and Control Supervisor J. K. Ford, Plant Projects Engineer B. D. Meredith, Plant Projects Technologist

• T. J. Palmisano, Plant Projects Superintendent R. E. McCaleb, Palisades Quality Assurance Director

• G. J. Ashworth, Senior Staff Supervisor

• Attended exit meeting on October 24, 1986 A-1

R. A. Fenech, Superintendent of Operations R. J. Frigo, Operations Staff Support Supervisor F. Ruble, Site Specific Training '

C. M. Grady, Plant Mechanical Supervisor B. A. Low, Engineering Safeguards Section Supervisor Mechanical

• Engineering Department D. W. Laneschwager, Operations Support Coordinator

• H.

C. Tawney, Mechanical Maintenance Superintendent J. J. Buckner, Electrical SupervisorP. F. Bruce, Electrical Enginee S. R. Oakley, Electrical Engineering Supervisor G. E. Watkins, Electrical Repairman T. J. Campbell, Electrical Repairman J. R. Lewis, Electrical Repairman J. W. Trantham, Mechanical Supervisor

0. C. Hill, Mechanical Repairman / Welder M.

P..

C. Sniegowski, Plant Projects Engineer M. Superintendent Brzezinski, Instrumentation and Controls Maintenance M. G. Genrich Shift Supervisor Operations Department J. Haumersen,, General Engineer,, Electrical W. Taylor, Combustion Engineering Site Services Ma

• R.

C. McMullin, Combustion Engineering F. Feriochio, Combustion Engineering -

J. Young, Combustion Engineering J. Dotson, Project Manager, Bechtel Power Corporation

• Attended exit meeting on October 24, 1986.

A-2

7'J f.

3

• a c y,o

/ g UNITED STATES

{; 2- , g 8

NUCLEAR REGULATORY COMMISSION WASHINGTON. D. C. 20555 4g w ,/

..... August 1,1906 3 -

j Docket Nos. 50-269. - --

50-270 I , ' ]8 and 50-287 AUG I 5 LM - d!

a b Duke Power Company  !

ATTN: Mr. H. B. Tucker, Vice President l Nuclear Production Department '

422 South Church Street '

Charlotte, North Carolina 28242 ,

Gentlemen:

SUBJECT:

SAFETY SYSTEM FUNCTIONAL INSPECTION REPORT NUMBERS 50-269/86-16, 50-270/86-16, AND 50-287/86-16 This letter forwards the report of the Safety System Functional Inspection performed by an NRC inspection team over the period May 5 to June 11, 1986, involving activities authorized by NRC Operating License Numbers DPR-38, DPR-47, and DPR-55 for the Oconee Nuclear Station. This inspection was conducted jointly by members of Region II, the Office of Inspection and Enforcement, and NRC contractors. At the conclusion of the inspection, the findings were discussed at an exit meeting with you and those members of your staff identified in the appendix to the enclosed inspection report.

The NRC effort involved an assessment of the operational readiness and functionality of the emergency feedwater (EFW) system. Particular attention was directed to the details of modifications and design control, maintenance, operation, and testing applicable to this system.

This report includes findings that may result in enforcement action, which would be the subject of subsequent correspondence. The report also addresses other observations and conclusions made by the inspection team. Section 2 of the report is a summary of the more significant findings. The detailed findings are presented in Section 3.

The team identified weaknesses regarding the functionality of your EFW system.

These weaknesses included concerns involving the availability of sufficient water supplies; the ability of the EFW system to function following a seismic event or a high energy line break; design problems, such as the susceptibility of EFW pumps to runout and inadequate design of the turbine-driven EFW pump steam supply; and maintenance problems, such as the use of incorrect greases in motor-cperated valves and repetitive equipment failures. On the other hand, Oconee was found to have versatile systems for supplying water to steam generators for post-accident decay heat removal. This versatility included EFW and main feed systems with the capability of being cross-connected between the three units and a separate high pressure feed system with the potential for supplying raw water to the steam generators of all three units. Notwithstanding this versatil-ity, this inspection identified significant problems to be considered by Duke

?

J Duke Power Company l

$!f !(

- management. These are s m arized in Section 2 of the attached report entitled,

" Summary of Significan (agpectionFindings." We request that you respond to ,

this office within 60 $: describing such actions that you have taken or intend to take in regard to the _ Jid esses identified in Sections 2.1 and 2.3 of the 1 enclosed report. j We recognize that you have either already taken or plan to take corrective actions relating to several of our concerns, including improving the availability of the condenser hotwell water supply in Units 2 and 3 to the suction of the motor-driven EFW pumps and improving your capability to perform a controlled plant cooldown or steam generator depressurization using the main steam atmos-pheric dump valves. Please include in your response the actions planned and the schedule for these improvements.

While planning corrective actions based on the weaknesses identified in the enclosed report, it is important that you realize that the focus of this inspection was only on the EFW system. Therefore, consideration should be given to identifying and correcting similar problems in other safety-related systems.

Should you have any questions concerning this inspection, we would be pleased to discuss them with you.

Sincerely, j

- < r J s M. Taylo Director fice of Inspection and Enforcement j

Enclosure:

, Inspection Report 50-269/86-16, i 50-270/86-16, and 50-287/86-16 i

• Duke Power Company cc w/ enclosure:

Mr. William L. Porter Mr. Paul F. Guill Duke Power Company Duke Power Company .

P. O. Box 33189 422 South Church Street 422 South Church Street Charlotte, North Carolina 28242 Charlotte, North Carolina 28242 J. Michael McGarry, III, Esq. Mr. Michael S. Tuckman Bishop Libeman, Cook, Purcell & Reynolds Duke Power Company 1200 Seventeenth Street, N.W. Post Office Box 1439' Washington, D.C. 20036 Seneca, South Carolina 29678 Mr. Robert B. Borsum Babcock & Wilcox i Nuclear Power Generation Division Suite 220 7910 Woodmont Avenue Bethesda, Maryland 20814 ,

Manager, LIS NUS Corporation ,

2536 Countryside Boulevard Clearwater, Florida 33515 Senior Resident Inspector U.S. Nuclear Regulatory Commission Route 2, Box 610 Seneca, South Carolina 29678 Regional Administrator U.S. Nuclear Regulatory Commission 101 Marietta Street, N.W.

Suite 3100 Atlanta, Georgia 30303 Mr. Heyward G. Shealy, Chief ',

Bureau of Radiolo91 cal Health r South Carolina Department of Health and Environmental Control 2600 Bull Street o Columbia, South Carolina 29201 Office of Intergovernmental Relations 116 West Jones Street Raleigh, North Carolina 27603 Honorable Jamcs M. Phinney County Supervisor of Oconee County Walhalla, South Carolina 29621 i

i

Duke Power Company .

DISTRIBUTION:

DCS NRC POR Local PDR -

ORPB Reading DI Reading VStello, EDO JMTaylor, IE HRDenton, NRR CJHeltemes, AEOD JGPartlow RLSpessard BKGrimes  :

JAxelrad ELJordan TMurley, Region I JNGrace, Region II JGKeppler, Region III RDMartin, Region IV JBMartin, Region V RDWalker,. Region II AFGibson, Region II VLBrownlee, Region II TPeebles,. Region II ,

. HPastis, NRR t.

JFStolz, NRR HRBooher, NRR . 4 All Licensees (Distribution GP)

NSIC NTIS INPO Regional Division Directors

./ h M1 Os/ _ , _, i I

1 /

OFC :IE:0RPB :IE:L RPB :I pl :IE:D  : IE:'D  :

____..........__....______..___.. .. __......... ........ ,. __....  : IE: DI[__

3 ,

_ __! __. .....!. __ __..._!__ ....__...!_..b_.'.'.____! ..... 5_._! ...__..__!.________.

DATE$7/L4/86 $7/fI/86

- $ 7A_%/86 $7/F/86 $7/.7/86 $7/s)'86

(

OFFICE OF INSPECTION AND ENFORCEMENT DIVISION OF INSPECTION PROGRAMS Report Nos.: 50-269/86-16; 50-270/86-16; and 50-287/86-16~ .

Licensee: Duke Power Company 422 Church Street Charlotte, NC 28242 Docket Nos.: 50-269, 50-270, 50-287 License Nos.: OPR-38, DPR-47, and DPR-55 Facility Name: Oconee Nuclear Station Inspection Conducted: May 5 - June 11,1986 Inspectors:

i TO.K4&~ _

• T. O. M&rtin, Inspection Specialist, IE, Team Leader hl8s Date l

l Aw J. E. Eyer, Inspection Specialist, IE

,haln, Date m %L,- ,hdu.

M. R. JohnWon Reactor Operations Engineer, IE Date 104 A kr

• F. R. McCoy, III, Reactor Inspector, Region II

,lmis Date' E.. G 9j i 'ilh ML R. C. Pierso Inspection Specialist, IE gate W khA- llEb!Ul' A. H. Saunders, Inspection Specialist, IE Date

/.SldC C.G.Walenga,yspectionSpecialist,IE 7/4/E D&te Accompanying Personnel: *L. J. Callan, *H. J. M011er Contractors: E. T. Dunlap, *G. W. Morris, *G. J. Overbeck Approved by:

9/26[M PhillipBranch, F. Mc @E, Chief, Operating Reactor Programs Date I

• Present during the exit interview on June 11, 1986.

& $$ I

~.

SCOPE: This special, announced team inspection was performed to provide an in-depth assessment.of the operational readiness of the emergency feedwater systems of all three Oconee units. The licensee's operation-al Teadiness and management controls were reviewed in five functional areas, primarily as they related to the emergency feedwater system.

The functional areas reviewed were: ~'

• Maintenance

• Operations

• Surveillance and Testing

• Design Changes and Modifications

• Quality Assurance x

, s RESULTS: Twenty-three potential enforcement findings, identified in this report as unresolved items, and four open items will be followed up by the NRC Region II Office.

'1 1

4

." g t

s

1. INSPECTION OBJECTIVE The objective of the team inspection at Oconee was to assess the operational  !

readiness of the emergency feedwater (EFW) system by determining whether:

1. The system was capable of performing the safety functions required.

by its design basis.

2. Testing was adequate to demonstrate that the system would perform all of the safety functions required.

3. System maintenance (with emphasis on pumps and valves) was adequate to ensure system operability under postulated accident conditions.

4. Operatorandmaintenancetechniciantrainingwasadeqhatetoensure proper operations and maintenance of the system.

5. Human factors considerations relating to the EFW system (e.g.,

accessibility and labeling of valves) and the system's supporting procedures were adequate to ensure proper system operation under normal and accident conditions.

2.

SUMMARY

OF SIGNIFICANT INSPECTION FINDINGS The more significant findings pertaining to the functionality of the Oconee Nuclear Station safety systems are summarized below. Section 3 provides the detailed findings pertaining to the five major functional areas evaluated.

- The observation numbers appearing in parenthesis after the individual items -

summarized are provided for reference to the corresponding discussions in Section 3. Figure 1 on page 17 shows the stea;n supply piping for a turbine-driven EFW pump. Figure 2 on page 22 shows a simplified EFW system arrangement.

2.1 Emergency Feedwater (EFW) System Functional Concerns 2.1.1 Use of the Motor-Driven EFW Pumps for Long-Term Cooling

(1) The motor-driven EFW pumps in Units 2 and 3 were able to directly access only about 3,000 gallons of water in the condenser hotwells at nominal operating level. The FSAR stated that the upper surge tank (UST) contains a nominal 50,000 gallons of water and that the condenser hotwell contains

, 120,000 gallons of water for EFW supplies. However, assuming for Units 2 i or 3 a loss of the turbine-driven EFW pump, a source of EFW cannot be

assured beyond approximately 100 minutes (at a nominal 500 gpm) without the

+

use of non-safety-related pumps to replenish the UST. [3.2.2(1)]

(2) The motor-driven EFW pumps in all three units were unable to take a suction on the condenser hotwell with a vacuum. However, if the condenser vacuum was broken, the steam the plant generators (SGs may)be. The condenser unable tosteam cool down by bleeding dump valves cannot steam dump from steam to the condenser without a vacuum, and the handwheel-operated atmospheric dump valves (12-inch gate valves) had apparently never been demonstrated to be capable of being opened at high differential pressures.

[3.2.2(2)]

2.1.2 Turbine-Driven EFW Pump Reliability I

(1) A portion of the steam supply piping to the turbine-driven EFW pump was designed for 350 psig. Steam regulating valve MS-87 upstream of this piping was designed to fail open on a loss of air and backup nitrogen supply, both of which were not safety-related. Relief valve MS-92 3

downstream of MS-87 was undersized such that if MS-87 failed open, the steam line could be pressurized above its design rating. [3.4.4]

(2) From April 1984 to February 1986, there were a significant number of corrective-maintenance work requests (11) relating to the speed control of the Unit 3 EFW pump turbine. [3.1.4(1)]

2.1.3 No Runout Protection for EFW Pumps An analysis conducted by the licensee during the inspection revealed that EFW pump runout (pump flow beyond design levels possibly leading to cavitation and high vibration) could occur during nonnal EFW actuation at SG pressures as high as 700 to 900 psig as long as EFW flow control valves FDW-315 and FDW-316 remained full open. Conditions leading to runout would be worse if the EFW

flow control valves failed open as designed or if a main steam or feed line 1 break were to occur. Such an analysis on pump runout had not previously been

performed by the licensee. [3.4.3]

1 2.1.4 EFW System Reliance on Non-Safety-Related Equipment Operator reliance on instrumentation and control equipment that is not safety related was extensive. UST level indication and alarus, pneumatic operators and supplies for the EFW flow control valves and steam regulating valves (for turbine-driven EFW pumps), and EFW system valve motor operators were classified as not safety related. The inspection team determined that the licensee's maintenance practices and design activities were significantly less rigorous for non-safety-related equipment. The inspection team was concerned that these lower standards were applied to the non-safety-related equipment important to

the operation of the EFW system. [3.4.10,3.1.2(1)]

2.1.5 Reliability of Nitrogen Backup System for EFW Air-Operated Valves (1) Backup nitrogen systems that are not safety related were pr'ovided for the l EFW flow control valves FDW-315 and FDW-316 and for the regulating valves MS-87, MS-126, and MS-129 that supply steam to the turbine-driven EFW pumps. The licensee committed to providing 2-hour backup nitrogen systems.

The nitrogen supply systems for flow control valves FDW-315 and FDW-316 were sized based on a 1-hour operating criteria. No design analyses were available providing the sizing basis for the steam pressure regulating valves. [3.4.6]

(2) Post-installation testing was considered inadequate for these backup nitrogen systems because this testing only demonstrated that the nitrogen systems were capable of positioning the control valves under no flow conditions. [3.3.5] ,

(3)

No periodic nitrogen testing3.3.5]

systems. [was done to demonstrate the capability of these (4) Unlabeled,undesignated,andapparently[uncontrolledisolationvalves were found in these nitrogen systems. 3.2.3]

, 2.1.6 Ability of EFW System to Respond to a Main Steam Line Break Check valves MS-83 and MS-85 in the turbine-driven ErW pump steam supply lines were not tested in the backflow direction. Normally open isolation valves MS-82 i and MS-84 had valve operators that were not safety related and, in some cases, 1

3MS-84 was not properly maintained [3.1.3(2)]. A main steam line break with a failure of check valve MS-83 or MS-85 to backseat could result in the blowdown of two SGs and the loss of the turbine-driven EFW pump. [3.3.2]

2.1.7 Ability of the EFW System to Respond to a Seismic Event (1) The FSAR stated that the EFW system is capable of withstanding a maximum hypothetical earthquake (equivalent to the safe shutdown earthquake). As identified by the licensee in LER 86-002 dated March 5,1986, substantial portions of the EFW system were not seismically qualified. [3.4.1]

(2) The safety-related batteries for the Keowee hydroelectric plant standby power supplies were found to be improperly installed to meet seismic requirements. The failure of these power supplies could result in a complete loss of emergency ac power. [3.4.2(1)]

4 i .

2.2 Other Decay Heat Removal Systems Functional Concerns Although an extensive review was not conducted of other decay heat removal systems, some concerns in this area were identified.

2.2.1 Primary System Feed and Bleed Cooling -

This heat removal process relies on a supply of water from the high-pressure injection pumps and a bleed path through the pressurizer power-operated relief valve (PORV) and the PORV block valve. Both the PORV and PORV block valve were found to be not environmentally qualified. [3.2.2(2)] The inspection team identified three instances where the PORV block valves were seated to prevent leakage during plant operations. This process used an insulated stick to manually shut the motor contacts, bypassing the torque switch, and applying full motor torque to. seat the valve. The inspection team was concerned that the PORV block valve could be damaged or stuck shut in the process. [3.1.3(3)]

2.2.2 Auxiliary Service Water (ASW) System (1) This single pump system was designed to supply lake water at low pressure (approximately 85 psig) to the SGs of all three units. The routine testing conducted on the ASW pump was considered inadequate. The performance test did not record suction pressure, discharge pressure, or flow. [3.3.7]

(2) The ASW system relied on the handwheel-operated atmospheric dump valves (12-inch gate valves) to depressurize the SGs. These valves had apparently never been demonstrated to be capable of being opened under high differential 4 pressure conditions. [3.2.2(2)]

2.2.3 Standby Shutdown Facility (SSF) ASW System (1) This single-pump system was designed to supply lake water at high pressure i to the SGs of all three units. Design analyses were not available and testing apparently had not been conducted to demonstrate that sufficient SSF ASW pump head was available to meet decay heat removal flow requirements to multiple SGs. [3.4.7(2)]

(2) The SSF ASW system was not single-failure proof. This was significant j

because theearthquake.

hypothetical EFW system 3.4.1]

may[not be capable of withstanding a maximum

l l

2.3 Programmatic and Functional Concerns Potentially Affecting the Operation of All Systems i

2.3.1 Motor-Operated Valve Maintenance Program

, (1) The lubrication program for motor-operated valves (MOVs) did not adequately control lubricants or provide coverage for all safety-related and environ-mentally qualified valves. [3.1.1]

(2) The program for control of MOV torque switch and limit switch set points was considered inadequate due to reliance on skill of the craft to establish

critical switch settings, inadequate procedures, lack of testing under

differential pressure conditions, and repetitive failures. [3.1.2,3.1.3]

l

~.

.l l

l (3) The overall maintenance program was considered weak because of the repetitive equipment failures that were identified and because the corrective maintenance activities did not appear to identify or correct the cause of the failure. [3.1.3,3.1.4]

~~

2.3.2 Design Change Process (1) Some modifications were done without related critical design analyses being perfomed or completed. [3.4.7,3.4.8]

(2) .The licensee's design engineering group, in some cases, did not provide post-modification testing requirenvents. Personnel performing post-modi-fication testing were not requireu to consult with the design engineers responsible for the modifications. Several examples were found of weak post-modification testing. [3.3.4,3.3.5]

(3) Examples were found of appa:ently incorrect or missing safety-related classification of instrun ntation. [3.4.11]

(4) The programmatic design requirements of ANSI N45.2.11 were not adequately implemented into the licensee's design change program. [3.4.9]

(5) The program governing safety evaluations perfomed in accordance with 10 CFR 50.59 was considered generally weak. Examples were found of inadequate safety evaluations. [3.4.12]

3. DETAILED INSPECTION FINDINGS 3.1~ Maintenance

.The team reviewed the maintenance procedures, equipment history, and the existing material condition of emergency feedwater (EFW) systems at all three -

, Oconee units. The inspection of motor-operated valve (MOV) maintenance was ,

expanded to include valves in other safety systems. Several deficiencies were l identified with the licensee's maintenance practices, particularly with MOV .

maintenance. i

, 3.1.1- Lubrication Program for Motor-0perated Valves s i The licensee's lubrication program for MOVs did not adequately control.lubri-cants or provide coverage for all environmentally qualified MOVs. Procedures

, had been developed for replacing grease during MOV refurbishment and for periodic inspection and lubrication of MOVs. However, these procedures appeared to have significant deficiencies and were not always implemented properly.

(1) The licensee had used improper grease to lubricate Limitorque MOVs inside the containment. The Limitorque vendor manual stated that Nebula EP-8

and EP-1 were the only approved lubricants for MOVs inside the contain-ment. However, licensee maintenance procedures for MOV refurbishment did not identify special lubrication requirements for containment MOVs and Procedure OP/0/A/1103/25, " Lubrication Procedure," Change 26, incorrectly i directed that MARFAK 8 grease be used for periodic lubrication of several

! containment MOVs with Limitorque operators. The team conducted a partial

review of the licensee's lubrication records and identified where MARFAK 8 grease had been added to the following containment MOVs

Date Unit Valve No. Description Added 3 CS-5 Quench Tank Suction. 8/30/85 1 FDW-105 SG 1A Sample 3/24/86 1 FDW-107 SG 18 Sample 3/24/86 1 HP-3 Letdown Cooler IA Isolation 3/24/86 1 HP-4 Letdown Cooler 1B Isolation 3/24/86 1 HP-20 RC Pump Seal Return Isolation 3/24/86 1 GWD-12~. Quench Tank Vent 3/21/86 3 GWD-12 Quench Tank Vent 8/14/85 3 RC-6 Pzr. Water Space Sample 8/30/85 3 PR-1 Reactor Bldg. Purge Outlet 8/30/85 3 PR-6 Reactor Bldg. Purge Outlet 8/30/85 3 PR-7 Reactor Bldg. Rad Monitor Sample 8/30/85 3 PR-9 Reactor Bldg. Rad Monitor Sample 8/30/85 The Limitorque vendor manual stated that specific operators with serial numbers up to 295809 were shipped with a standard lubricant of Sun Oil 50EP. The licensee stated that it had containment MOVs from this group and that the Sun Oil SOEP lubricant apparently had not been replaced. The basis for the licensee's deviation from the vendor manual apparently was a January 18, 1986, letter to the licensee from Limitorque Corporation.

This letter stated that irradiation of Sun Oil SOEP to 225 Mrad gamma had little significant effect on its lubrication qualities. The team was concerned that the letter did not address all aspects of environmental qualification and did not explicitly state that Sun Oil SOEP was approved for use in nuclear containment MOVs.

(2) The licensee had apparently mixed lubricants with different chemical bases in environmentally qualified MOVs. The Limitorque vendor manual prohi-bited adding greases with different soap bases without the lubricant manufacturer's permission and stated specifically that Sun Oil SOEP could not be mixed with Nebula EP-9. Limitorque MOVs apparently had been lubricated with three different greases, each with a different chemical base: Nebula EP with a calcium base, MARFAK 5 with a sodium base, and Sun Oil 50EP with a lithium lead base. Procedure OP/0/A/1103/25 provided guidance for periodically adding either MARFAK 8 or Nebula:EP grease to specific MOVs, but no evidence was available to demonstrate that the periodically added grease was compatible with the existing grease.

Additionally, the procedure provided no direction for adding Sun Oil 50EP grease to MOVs that were originally filled with this standard lubricant.

It appeared that the licensee implemented its periodic lubrication program for environmentally qualified MOVs with no apparent regard for mixing grease.

During the review of licensee lubrication records, the team also identified an instance where the existing lubrication procedure was not properly implemented, which resulted in an incorrect grease being added to safety-related, environmentally qualified MOVs. On August 14, 1985, the Unit 3 suction valves, 3HP-24 and 3HP-25, from the borated water storage tank for high pressure injection pumps A and C were lubricated using MARFAK 0 grease when Procedure OP/0/A/1103/25 required the use of Nebula EP grease.

The team was concerned that mixing greases with different chemical bases could react to form a compound that would not have sufficient lubricating qualities to permit proper MOV operation.

(3) The following environmentally qualified Limitorque MOVs were omitted from the licensee's periodic lubrication program described in procedure OP/0/A/1103/25:

Unit Valve Description 1, 2, 3 CC-7 Component cooling water return from reactor coolant pump (RCP) 1, 2, 3 LP-12 Low pressure injection cooler A inlet 1, 2, 3 LP-14 Low pressure injection cooler B inlet 1,2,3 LPSW-6 Low pressure service water supply to RCP coolers 1, 2, 3 LP-103 Boron dilution 1,2,3 LP-104 Boron dilution 1 LP-105 Boron dilution 1, 2, 3 PR-59 Hydrogen recombiner inlet 1, 2, 3 PR-60 Hydrogen recombiner outlet

1-

'l l The Limitorque vendor manual recommended that MOV gearcase grease be inspected for quality, quantity, and consistency approximately every 18 months or 500 cycles, whichever occurred first. It appeared that this inspection interval had been exceeded for these valves. During the ,

inspection, the licensee could not determine when these MOVs had last been inspected for their lubrication properties. ' ' ~ ~

f The discrepancies in the MOV lubrication program that are described above appear to degrade the environmental qualification and operability of MOVs within the station. Interviews with licensee maintenance personnel revealed that the licensee had initiated a MOV refurbishment program that would resolve these lubrication problems. This program intended to i refurbish all MOVs at the three Oconee units during the next 5 years and replace the various MOV lubricants currently being used with the Nebula EP grease. During the Unit 1 outage completed in March 1986, the lirensee refurbished approximately 45 safety grade and control grade MOVs. The team was concerned that this schedule would not aggressively correct the identified lubrication problems. Additionally, the current licensee maintenance procedures, which did not specify the exclusive use of Nebula EP grease during MOV refurbishment, seemed inconsistent with these inten-tions.

The overall inadequacy of the licensee's MOV lubrication program and the inspection team's resulting concerns regarding the operability of these MOVs were discussed at a meeting between NRC and licensee management on June 10, 1986 at the Oconee Nuclear Station. The licensee's justifica-tion for continued operation was discussed and further information for the evaluation of this issue was requested by the NRC Region II Office. The

apparent breakdown in the licensee's program for MOV lubrication will remain unresolved pending followup by Region II (50-269, 270, 287/86-16-01).

4 3.1.2 MOV Torque Switch and Limit Switch Set Points

, Significant weaknesses were identified with the licensee's control of MOV torque switch and limit switch set points.

(1) A review of several EFW system MOV work requests revealed that procedures were infrequently referenced for MOV switch maintenance. The licensee's detailed maintenance procedures were usually implemented only for safety-i related MOVs and the Oconee Nuclear Station Quality Standard Manual for

Structure, Systems and Components, Revision 11, classified all EFW system l MOV rperators as not safety related.

! (2) ToroJe switches and limit switches for safety-related MOV operators were adjtsted under static flow conditions and not tested to determine whether they would operate properly under design differential pressures. During

] the inspection, the licensee could not provide any evidence to indicete t'st current torque and limit switch set points were adequate based on t.ngineering analyses or test results.

(3) The closed limit switches for Limitorque MOVs were set based on when the maintenance technician felt the valve unseat as described in Procedure IP/0/A/3001/10, " Maintenance of Limitorque Valve Operators," Change 20.

This limit switch controls the amount of valve stem travel for the torque

! 1

-e - ---- --,--m----.---.-...-----,..-..e.--..-------,---,,o--,---, .-.-evm ,,,,w. rw----r-. _ww. _-

E switch bypass and allows the MOV to come off its shut seat without trip-ping on high torque. The setting of this limit switch is critical to proper MOV operation and requires additional criteria that should be based f

on engineering judgment or test results rather than skill of the craft.

(4) The closed limit switches for Rotork MOV operators were set to actuate .

~

either 1 turn or 1 inch off the valve seat as described in Procedure IP/0/A/3001/02, " Setting Torque and Limit Switches on Rotork Valve Operators," Change 5. The decision on which limit to apply was left to l the maintenance technician. Again, the team was concerned that this practice may not provide adequate torque switch bypass protection for the MOVs.

l (5) Torque switches for Limitorque MOVs were initially set as low as possible while still assuring tight shut off and proper valve travel under no flow 1

conditions as described in Procedure OP/0/A/3001/10. Interviews with licensee personnel revealed the switches would be subsequently adjusted higher during corrective maintenance after operational problems were identified. Consequently, it appeared that current torque switch set-

points had evolved to their existing values at the expense of operational problems.

The licensee had inititted a program for recording MOV torque switch set points as part of electrical preventive maintenance in accordance with Procedure IP/0/A/3001/1, " Electrical Preventive Maintenance Procedure for 1 Limitorque Operators," Change 15. However, interviews with maintenance personnel revealed that these values were not being compared to minimum recommended values based on the manufacturer's testing or analyses. This problemhadbeenpreviouslyaddressedinIEInformationNotice84-10,

, Motor-Operated Valve Torque Switches Set Below the Manufacturer's Recom-mended Value." The licensee's internal response to this notice stated that engineering analyses were used to determine minimum values for torque switches instead of vendor recommendations and that actual torque switch set points were made 1.0 units abcve this engineered value. Interviews with maintenance personnel and a review of existing procedures revealed that this response was not consistent with current or past licensee practices and procedures. Additionally, interviews with station maintenance

, personnel responsible for MOV torque switch settings revealed that they were not aware of this internal response to the IE notice.

l The weaknesses identified above were evidence of an inadequate program for maintenance and testing of MOVs. Licensee maintenance procedures did not provide adequate guidance for setting torque switch or limit switch set points.

This activity is not considered by the inspection team or general industry

practice to be within the skill of the trade for maintenance technicians. The failure to provide adequate procedures for setting torque switch and limit i switch set points will remain unresolved pending followup by Region II (50-269,270,287/86-16-02).

2 The licensee's response to IE Bulletin 85-03, " Motor-0perated Valve Common-Mode 1 Failure During Plant Transients Due to Improper Switch Settings," addressed some of the concerns raised by the inspection team. However, this response commits to a long-term improvement program to be implemented by November 1987 and applies to only 14 MOVs in each unit at the Oconee Nuclear Station.

Initial Motor-Operated Valve Analysis and Testing System (MOVATS) testing of

1

i i

nine safety and control grade MOVs during the last Unit 1 outage revealed approximately five torque switch problems and four limit switch problems.

These results appear to confirm the inspection team's concerns about the licensee's weak program for control of torque switch and limit switch set j

points. These results also identified problems outside the scope of the IE Bulletin 85-03 response that may require more immediate corrective action. -

3.1.3 Motor-Operated Valve Corrective Maintenance Work History A review of the history of corrective maintenance work revealed a significant number of MOV malfunctions that appeared to receive inadequate corrective action. When an MOV failed to operate, it was common practice for the licensee to " stick" the breaker to cycle the valve. This process used an insufated stick to manually shut the motor contacts and apply full motor torque ,to move the valve, thereby bypassing the torque switch, limit switch, and motor over-load protection. Maintenance personnel would monitor the motor for excessive

' current during the process. In several cases reviewed, the MOV would be cycled a few times and then returned to normal operation without the cause of the problem being corrected. This practice resulted in repeated failures of MOVs as evidenced by the following:

(1) The Unit 3 low pressure injection loop isolation valve 3LP-2 failed to operate five times from May 1984 to October 1985. For the first four failures, the licensee cycled the vaive using the " stick" process and returned the valve to operation. On the last failure, the licensee found that the torque switches were improperly set at their minimum possible values. The torque switch values were increased and valve 3LP-2 has operated properly since that time.

4 (2) Isolation valve 3MS-84 to the turbine-driven EFW pump from the Unit 3 SG B failed to operate three times from June 1984 through October 1985. The .

corrective maintenance for the first two failures consisted of sticking the valve until it operated satisfactorily. On the third failure, the licensee identified that the limit switches for the valve were improperly set and corrected the problem.

(3) The team identified three instances where the power-operated relief valve (PORV) block valves 2RC-4 and 3RC-4 were seated using the " stick" process to prevent leakage during plant operations. The team considered this practice unsafe because driving this valve into its seat could impair valve movement and prevent primary system feed-and-bleed operations as described in licensee Emergency Operating Procedure EP/*/A/1800/01

(* designates appropriate unit number).

As a result of the NRC resident inspectors' urging, the licensee has curtailed

,i the use of the " stick" process for corrective maintenance (Inspection Report 50-269, 270, 287/85-41, dated February 12, 1986 The team was concerned that problems previously resolved by this process may). not have been completely corrected and could cause future MOV failures.

3.1.4 Maintenance Problems With Other Components i

i 1 In addition to the MOV maintenance weaknesses, problems with other components also appeared to be inadequately corrected.

10 -

t

-rnwm - , - - ,r,w, _. __

---

g -,,,,_, amv.,r. v, .r~.-,---,

- ,-.---,.,-.--,-,-r.- ., ,.,.,,- n,.r--.,,- - , - - . - _ , , , -.,. -,--- --n__

i i

-(1) From April 1984 to February 1986, there were 11 corrective maintenance work requests relating to the control of the steam supply to the Unit 3 EFW pump turbine. Air-operated pressure control valve 3MS-87 regulated steam to the turbine governor. Collectively, 3MS-87 and the governor controlled turbine speed. Repeated failures were identified with improper steam supply pressure and sluggish turbine speed control during pump .

testing. The corrective maintenance perfomed apparently was not effec-tive and, in some cases, the system was started and stopped until it operated properly. The team was particularly concerned about the Unit 3

EFW turbine-driven pump operability during the following sequence of events:

(a) On June 7, 1984, the ifcensee performed PT/3/A/0600/12, " Turbine Driven Emergency Feedwater Pump Performance Test," Change 11, three times before achieving acceptable test results. On the first start,

. the pump only came up to half speed and was shut down after 5 minutes.

After 30 minutes, a second test was performed and the pump took 30-45 seconds to come up to speed. A third test was performed 10 minutes i later with acceptable test results. The pump was not declared inoperable. However, test personnel apparently suspected a governor problem and rescheduled the performance test to be conducted again in 1 week.

(b) On June 13, 1984, PT/3/A/0600/12 was performed twice before achieving acceptable test results; it was noted that the pump still responded 4 slower than expected. The pump was not declared inoperable, but a j work request was developed to investigate the problem.

(c) On June 22, 1984, the turbine governor was cleaned and some i

debris was found in the control oil lines. Interviews revealed that maintenance personnel did not think the small amount of debris that was found caused the ob erved problem, however, the pump tested satisfactorily after governor reassembly.

During this period, Oconee Unit 3 operated at power starting on June 9, i 1984. Oconee Technical Specification (TS) 3.4.2.b required that, in the case of an inoperable turbine-driven EFW pump, the pump be restored to an operable status within 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s-or the unit be placed in hot shutdown within an additional 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and reduced below 250*F in another 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The team was concerned that the Unit 3 EFW turbine pump did not meet TS operability requirements from June 7 through June 22, 1984. This item will remain unresolved pending followup by the NRC Region II Office

(50-269,270,287/86-16-03).

} (2) Corrective maintenance on the Unit 1 EFW systas flow control valves 1FDW-315 and 1FDW-316 was conducted on April 25, 1985, and appeared inadequate. After a reactor trip, operations personnel had to take manual

control of the EFW system flow control valves to maintain steam generator

! level because both of these valves would not function properly in auto-

! matic. The corrective action consisted of checking steam generator level i control cabinet output voltages for the existing plant conditions. It was

. determined that no problems existed. No maintenance or calibration procedures were used except for a general plant equipment troubleshooting l

procedure, measured voltages were not recorded, and no testing was conducted for this problem. These valve operators were considered not to be safety related by the licensee; however, the work request indicated that this was a safety-related maintenance activity.

3.1.5

~

Material Deficiencies -

The team identified the following material deficiencies:

(1) The Unit 1 EFW turbine-driven pump outboard gland leakoff cavity was filled with water. The team was concerned that this could allow water to leak into the oil reservoir of the outboard pump bearing and render the pump inoperable. During the ins.pection, the licensee cleaned the cavity drain and inspected the oil reservoir, finding no water contaminat. ion.

(2) The cable runs fEom the limit switch junction boxes for the EFW turbine steam isolation valves IMS-93 and 2MS-93 appeared to be improperly sup-ported. This was a concern because the open limit switch from MS-93 starts the auiliary oil pump to supply control oil to the turbine governor. The failure of this limit switch could prevent the turbine from starting on an automatic initiation signal.

(3). Approximately 15 feet of unsupported, interlocked armored cable was observed that fed into isolating diode cabinet 1ADA.

- (4) Flexible conduit was observed to be broken away from the fittings at the connections to valves 1C-391, ILPSW-18, 1HP-27, and the thermocouple

connection box on EFW pump 18.

The resolution of these discrepancies will remain open pending correction by the licensee and followup by the NRC Region II (50-269, 270, 287/86-16-01).

3.2 Operations i

In the area of operations, the inspection team evaluated the adequacy of shift manning; control of work and operations; operating, emergency operating, and

-; off normal operating procedures; operator familiarity with the physical location of various electrical and mechanical components; equipment operation in abnormal situations; routine system status verifications; and operator training. This evaluation focused on how each of these elements interfaced with operation of the EFW system under various normal and abnormal conditions.

3.2.1 Conduct of Operations l Several strengths were noted in regard to the routine conduct of operations. The j inspection team observed five different reactor operators and nuclear equipment operators perform portions of their shift rounds and turnover. On the basis of the sample reviewed, the team considered that these operations personnel were knowledgeable of electrical and mechanical equipment locations and capabilities

! for EFW and safe shutdown facility (SSF) components. The inspection team i

observed a shift turnover from night shift to day shift on May 23, 1986. The turnover was accomplished in accordance with administrative requirements and l

appeared to be effective. Communications equipment to support off-normal i

12 -

- ~.n .~ -.,--,---w.. -- m a e ,---,,,,,_v...,g,-,n---. - , , , . _ .,..,~,.._,..,,w ,-w_-w , , _ ,- n _....-.,,-ne,---- --,-v,_.,-m , , , - - , , , , , , , , _ _ , , _ , , ,

- - . . .__ ~_. . -_. - _ - _ - - - _ _ _ _ ._ - - - . - - _ _ .

operations, such as two-way radios, was available and observed to be effective.

Ladders for accessibility to overhead components were staged at numerous loca-tions within the plant. Operators were observed to be. familiar with procedures and drawings and could effectively use both in answering questions related to EFW operations. A limited overview of the qualification and requalification i training programs reflected that extensive classroom and on-the-job training-with task lists was provided for candidates to beceae or maintain their status

. as nonlicensed operators, reactor operators, and senior reactor operators.

4 Actual implementation of the training programs was not reviewed.

3.2.2 Operational Limitations of Important Plant Systems The inspection team was concerned about various operational lia'itations of important plant systems including the ability to use the condenser hotwell as a water source for the motor-driven EFW pumps and the ability to cool down the plant using the manually operated atmospheric dump valves (ADVs).

(1) The normal water source to the motor-driven EFW pumps was the upper surge tank (UST) that was required by Technical Specifications (TS) to contain 30,000 gallons, enough to supply about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of EFW flow. After deple-f tion of this supply, the 142,000 ga11on-capacity condenser hotwell could ,

be used. However, the suction piping for the EFW pumps for Units 2 and 3 was installed with the centerline of the 20-inch pipe at the 48-inch i level of the condenser hotwell, making only about 3,000 gallons directly

available to the motor-driven EFW pumps from this source based on normal j hotwell level of 58 to 65 inches. Procedurally, the use of the motor-i driven EFW pumps was limited to 60 inches in the hotwell (see Observation J

3.2.4(4)). The licensee stated that installation of a modification to extend the motor-driven EFW pump suction piping to near the bottom of the condenser hotwells in Units 2 and 3 was scheduled. The Unit 1 suction line had recently been modified to extend to about 12 inches from the

bottom of the hotwell. It appeared that the capability to take suction i from the hotwell with the motor-driven pumps in Units 2 and 3 had never been demonstrated (see Observation 3.3.3).

(2) Emergency operating and off-normal procedures required that the condenser hotwell be vented so that the motor-driven EFW pumps would not cavitiate

when the hotwell was used as an EFW water source. This action would result in closure of the turbine bypass valves because of an interlock, thereby restricting plant cooldown capability to either manual operation of the

atmospheric dump valves or primary system feed and bleed. Procedural guid-ance for use of the atmospheric dump valves appeared to be limited to contingency use of the low pressure auxiliary service water pump in accord-ance with Operating Procedure OP/*/A/1106/06, " Emergency Feedwater System",

1 Change 45, and shutdown in event of a fire in accordance with Operating Procedure OP/0/A/1102/25, " Shutdown Following a Fire," Change 0.

Interviews with operations personnel indicated much difficulty in opera-ting the atmospheric dump valves under low differential pressure condi-

, tions. Licensee management representatives indicated that these manually l operated 12-inch gate valves located about 10 feet off the floor had never been demonstrated to open under full system differential pressure.

Additionally, the inspection team questioned the ability of these valves l

• Asterisk designates appropriate unit number.

13 -

l

..n-,---- n----- ,, n,-,-- an,,,-.a-,,--,---,,_ .,,,-go.,,,v_ .. - ,mn ,---

to effect a controlled cooldown. Apparently, this also has never been demonstrated. Primary system feed and bleed was prescribed in Energency

, . Operating Procedure EP/*/A/1800/01, " Emergency Operating Procedure," Change 1, Section 502, for loss of heat transfer. This procedure relied on operation of the power-opsrated relief valve (PORV), RC-66, and PORV block valve, RC-4, for the primary bleed path. Neither of these valves was -

environmentally qualified.

3.2.3 Undesignated and Uncontrolled Valves in Backup Nitrogen Systems A walkdown of the backup nitrogen systems for valves MS-87 FDW-315, and FDW-316

, revealed that undesignated and uncontrolled valves were installed. Examples included the root valves from the nitrogen system to the valve actuators and, in-the case of the Unit 2 nitrogen system for valve MS-87, two isolation yalves downstream of the pressure regulators connected to the bottle. These valves were not labeled, did not appear on applicable system drawings, and were not 4 periodically verified to be properly aligned. The inspection team considered the existence of uncontrolled valves to be another factor which cast doubt on the reliability of the backup nitrogen system (see Observations 3.3.5 and 3.4.6).

Sometime between May 21 and June 2, 1986, one of these valves in the Unit 2 MS-87 nitrogen system was removed from the system and yet there was no indication that this was performed under the licensee's prescribed work control program. This

apparent uncontrolled modification to a plant system will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-04).

3.2.4 Procedural Weaknesses Regarding the EFW System l

A review and walkthrough was conducted of the normal operating and emergency procedures for the EFW system. Several weaknesses were noted

(1) EP/*/1800/01, " Emergency Operating Procedure," Change 1, Paragraph 5.0,

! step 5.4.1, did not require shutting the appropriate main steam inlet valve .

MS-82(84) to the turbine-driven EFW pump on first indication of a main steam line rupture. The inspection team recognized that the appropriate valve would be eventually shut, if required (such as for a failure of check-valve MS-83(85) to seat, see Observation 3.3.2), as an operator i progressed to the excessive heat transfer section of the procedure, Section 503; however, this would be accomplished later in the transient as a result of required actions to completely isolate both steam generators to deter-eine which one was affected. This would complicate corrective actions assoc-isted with the transient and could increase the severity of the casualty.

, (2) EP/*/A/1800/01, Paragraph 5.0 (step 5.4.1), Section 503 (step 3.3), Section 1 504 (step 10.1), and Section 506 (step 7.1) require shutting the EFW flow control valves FDW-315 or FDW-316, as appropriate, to isolate an affected steam generator from EFW flow in the event of a main steam line rupture, excessive heat transfer, overcooling transients, or a steam generator tube

. rupture. This was considered to be inadequate since flow control valves

! FDW-315 and FDW-316 are air-operated valves that fail open on loss of air l and are backed up by a non-safety-related nitrogen system that was not i designed in accordance with the licensee's commitments and not periodi-

! cally tested (see Observations 3.'J.5 and 3.4.6). The significance of one i of these flow control valves failing open was considered to be the potential

{ for overcooling the primary system and runout of one motor-driven and one turbine-driven EFW pump by feeding a ruptured, depressurized steam genera-l tor with the EFW system (see Observation 3.4.3).

i Asterisk designates appropriate unit number.

14 -

._ .. ._ _ _. _ _ __ __ _ _. _ ~ _ .

Interviews with operating personnel and a walkdown of the control room panels indicated that the potential existed for this condition not to be immediately recognized. If feedwater flow indication to the isolated

. steam generator was not being monitored, as could be expected in this

. situation, a likely indication for this failure would be overcooling of l

4 the primary system. Interviews with operating perNnnel revealed varied actions to compensate for this failure. Some operators indicated they would shut the appropriate motor-operated valves FDW-372(382) and FDW-368(369) or stop the appropriate EFW pump. Most operators interviewed indicated that they would dispatch a nuclear equipment operator to the penetration room to manually shut the appropriate flow control valve FDW-315 or FDW-316. The inspection team considered that a significant

amount of time could be required to identify and resolve this failure.

4 (3) OP/*/A/1106/06, " Emergency Feedwater System," Change 45 did not contain limitsandprecautionswithrespecttocyclingmotor-drIvenEFWpumps.

This was considered to be a weakness because design data indicated that there are time limitations associated with cycling these pumps and this information was not readily available or known by operations personnel, i

(4) OP/1/A/1106/06, " Emergency Feedwater System," Change 45, Enclosure 4.9

. step 2.8 note, limits motor-driven EFW pump operation when taking suction from the condenser hotwell to a minimum hotwell water level of 60 inches.

This procedure did not reflect accomplishment of nuclear station modifi-cation (NSM) 12493 to lower the motor-driven EFW pump suction point in the hotwell. The post-modification testing for this NSM was conducted on April 11, 1986.

(5) OP/*/A/1106/06, " Emergency Feedwater System," Change 45, Enclosure 4.9, step 2.8 and substeps, required opening valve IV-186 to break main conden-ser vacuum to allow the motor-driven EFW pumps to take suction from the main condenser hotwell. Additionally, step 2.4 of this procedure contained a precaution not to take suction from the hotwell with the motor-driven EFW pumps without first breaking vacuum. There was no caution within the pro-cedure to warn personnel that this would result in loss of turbine bypass valve cooldown capability. The inspection team considered this to be an action of potentially significant consequence as discussed in Observation 1 2

3.2.2(2) above.

i The procedural weaknesses identified above will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-05).

j 3.2.5 Improper Implementation of Independent Verification l 1 During observation of a night shift to day shift turnover on May 23, 1986, the l l

inspection team noted an example of improper implementation of independent i verification. The pressurizer was being cooled down in accordance with operating procedure OP/1/A/1102/10. Enclosure 4.3 step 2.7, substeps 4 to 6, of this procedurerequiredvalvemanipulationswIthindependentverification. The valves were manipulated at 0443 on May 23, 1986. At 0530 on May 23, 1986, pressurizer cooldown was commenced as noted in step 2.9 of Enclosure 4.3 of the procedure.

At approximately 0700 on May 23, 1986, the oncoming shift relieved the offgoing shift. At that time, the inspection team observed that Enclosure 4.3, step 2.7, substeps 4 to 6, had not been independently verified as required by the operating i

! Asterisk designates appropriate unit number.

_ ~ . - _ - , , _ _ _ , . _ _ . _ _ _ _ . . _ _ _ _ _ . , . _ _.. _ ___ _ .. , , . _

grocedure. This was contrary to Oconte Nuclear Station Directive 2.2.2, Independent Verification," and will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-06).

- 3.3 . Surveillance and Testina . _ . _

The team reviewed the testing associated with assuring functionality of the emergency feedwater system, the standby shutdown facility (SSF), the low pressure auxiliary service water system, the backup nitrogen supply system for pneumatic valves in the EFW system, and the steam supply system to the turbine-driven EFW pump. In particular, the team sought to determine that system components had been adequately tested to demonstrate that they could perform their safety functions under all conditions. ,

3.3.1 Surveillance Test and Calibration Procedures i Routine surveillance test and calibration procedures (referred to as PT and IP procedures, respectively) were found generally to be adequate for demonstrating system functionality, were clearly written in a consistent fonnat, and contained detailed reference information pertaining to equipment adjustments that could be necessary.

3.3.2 Testing of Check Valves MS-83 and MS-85 Periodic testing of some check valves was found to be inadequate to ensure that the valves would perform their safety function during abnormal events. Valves MS-83 and MS-85 were not periodically tested in the reverse flow direction. These valves are the nonreturn check valves in the main steam branch lines that merge to supply steam to the turbine-driven EFW pump from SG A and SG B, respectively.

Although these valves were periodically tested in the flow direction during turbine-d.iven EFW pump surveillance testing, the valves were not tested to ensure that they would perform their design function to prevent backflow through the steam line in the event of a steam line break. Figure 1 on page 17 shows the piping arrangement at the time of the inspection. Normally, motor-operated isolation valves MS-82 and MS-84 would be open so that steam could be applied to the EfW turbine pump by opening normally closed MS-93. MS-87 was a pneumatically operated pressure control valve that maintained steam turbine inlet pressure to 300 psig. Therefore, steam pressure was applied up to MS-93 during standby operation. Steam traps in the line remove any condensate that may build up, and MS-87 may open periodically to maintain downstream pressure. Although the steam flow would be expected to be small during standby operation, low steam flows have been known to cause degradation of check valves in similar applications (IE Information Notice 86-09).

Because these check valves were not tested in the backflow direction, an

undetected failure could exist where, for example, the disc had broken off and become cocked in the valve, preventing full closure (thus defeating the check feature) and full opening (thus restricting steam flow). If such a l failure were to occur, the plant may not be adequately protected assuming an

unisolable line break in one SG and a single failure. The following example

is provided to illustrate the team's concern. An unisolable high-energy line

break is assumed to occur in SG 8 concomitant with a single failure of the overhead lines from the 230 kV switchyard. SG 8 depressurizes. Because it i was not adequately tested, MS-85 is assumed to have an undetected failure

! l

ws J-t2\

ere-stan-s.y FROM MAIN STEAM HEADER 1A

$o-e2en n f 1MS-82

[1AS-38 1 -83 -- IMS-92h 3 k[1AS-34 IMS-87 EXHAUST 1 IMS-91 IMS-93 ATM0 HERE

/

EMERGENCY FDV i ,_

PUMP TUR81NE .

IMS-85 I ~

1MS 84 C jus e-i2\

e pesan-s.y FROM MAIN STEAM IMS-97]-"EI HEADER 18 EXHAUST TO CONDENSER LEGEND 03 l><] NORMALLY OPEN Q

>4 NORMALLY CLOSED y FLOW JNDICATOR , , - -

D <! ELECTRIC

o g

[1.MPNEUMAT!C

C>lTILTING DISC CHECK VALVE t a t><] SHUT 0FF VALVE LEVEL INDICATOR N SulNG CHECK VALVE i

F!GURE 1.

STEAM SUPPLY FOR.TURB1NE DRIVEN EFW PUMP (UNIT 1.)

i i

before the initiating event, causing SG A to be susceptible to depressuri-2ation through the cross-connected 6-inch main steam branch lines. Operator ,

action would be required to shut either MS-82 or MS-84 to isolate the break from the unaffected SG; however, the motor control centers for these valve operators would be load shed with the loss of the overhead line from the 230 kV switchyard. If this were to occur, the operator would either (1) have to '

rearrange the electrical lineup to supply these load centers from the Keowee

' hydroelectric plant underground line and close the breakers supplying power to MS-82 or MS-84 or (2) manually shut these valves which are located 20 to 30 j

feet off the floor in the turbine building. Access to these valves, if not prevented by the accident, would require the operator to climb over steam

! piping. During the intervening time, both SGs may be blowing into the. con-tainment or the turbine building. Because of the extensive problems with the licensee's motor operated valve (MOV) program and the specific documented problems regarding the operation of 3MS-84 (see Observation 3.1.3(2)),'the inspection team considered that the ability to shut these non-safety-related MOVs could not be assured even assuming electrical puwer was available. The failure to adequately test check valves MS-83 and MS-85 will remain unresolved j

pending followup by the NRC Region II (50-269, 270, 287/86-16-07).

{ 3.3.3 Testing of Check Valves 2C-568 and 3C-568 Full cycling and flow verification of check valves 2C-568 and 3C-568 were not performed in accordance with the provisions of the ASME Code,Section XI, Subsections IWP, IWV (1980 Edition through Winter 1980 Addenda) as required by Technical Specification 4.0.4. The licensee had not requested relief for these valves in the Oconee Nuclear Station Inservice Inspection Program, Revision 10,

. dated January 13, 1986. Check valves 2C-568 and 3C-568 are located in the

} motor-driven EFW pump suction Ifne from the condenser hotwell for Units 2 and 3,

' respectively. A licensee representative stated that full flow verification for these check valves was not performed because of the possibility of air binding the motor-driven EFW pumps. Check valve IC-568, located in the motor-driven EFW pump suction line from the condenser hotwell for Unit I was tested on April 11, 1986, during the performance of TT/1/A/0600/03, " Motor Driven Emergency Feedwater i Pump Refueling Test." This temporary test procedure was performed following the

! installation of NSM 12493 on Unit 1. This modification extended the motor-driven EFW pump suction piping to near the bottom of the condenser hotwell. The failure to test check valves 2C-568 and 3C-568 will remain unresolved pending followup by NRC Region II (50-269, 270, 287/86-16-08).

! 3.3.4 Post-Modification Testing for NSM 12493 Unit 1 post-modification testing for NSM 12493 was determined to be weak in that the design intent of the NSM was not verified. This modification extended

• the suction piping of the motor-driven EFW pumps to near the bottom of the -

i condenser hotwell in Unit-1 to make 115,000 gallons of water available to the ,

motor-driven EFW pumps while still allowing the condenser to be used for bleeding steam. The licensee's design engineering staff had recommended that post-modification testing be performed to confirm 12 inches as a safe minimum hotwell level to maintain the pump suction and to determine the feasibility of controlling condenser pressure at partial vacuum values. Testing to substantiate these design criteria was not incorporated in the post-modification testing.

The post-modification test, as conducted by the Performance Group, was used to validate full-flow verification for IC-568. Hotwell level was not reduced below l 26 inches and condenser pressure was maintained at atmospheric pressure. As l

---,-.~~.n.. . - , .nr - - - - - , - - - - - , - - ~ ~ - - - , - - - - , _._~-,--.----m.-----,-

,-- n,---

_ - .- -. - - . - = -_ _ - .-_

conducted, the post-modificaton test did not establish the availability of the 115,000 gallons of water in the condenser hotwell for the Unit 1 motor-driven EFW 3 pumps. Additionally, subsequent to this test the licensee's operating procedure for this system was not updated to indicate that the Unit 1 motor-driven EFW pumps could take a suction on the hotwell below 60 inches (see Observation 3.2.4(4)). .

3.3.5 Post-Modification and Periodic Testing for Nitrogen Systems Weaknesses were noted with the licensee's post-modification testing and periodic testing for nitrogen bottle backup systems for pneumatically operated valves FDW-315, FDW-316, MS-87, MS-126, and MS-129 affecting the EFW system. In a letter to the NRC dated April 3, 1981, the licensee stated that nitrogen bottle l

backup systems for these valves would be functionally tested to assure that the associated air-operated valves could be cycled to meet the 2-hour minimum avail-ability requirement. The inspectors reviewed the post-modification testing for the nitrogen backup supply system for valves FDW-315 and FDW-316 and the system for MS-87, MS-126, and MS-129 as installed by NSM-1293 and NSM-1367, respectively.

, These modifications were applicable to Units 1, 2, and 3.

i In February 1981, testing and calculations were performed on the backup nitrogen supply to FDW-315 and FDW-316 to determine required nitrogen pressure and volume for the backup nitrogen tanks. ihis test was not unit specific and it was unclear

to the inspection team which unit was tested. This test was insufficient to i

provide adequate post-modification testing because these valves were only stroke tested without demonstrating that they could regulate fluid flow while being supplied with nitrogen. The functional tests for MS-87, MS-126, and MS-129,

', which regulate steam to the turbine-driven EFW pumps, were also not considered f

sufficient to provide adequate post-modification testing of this nitrogen backup system because these valves were only stroke tested without steam flow in the lines. Pressure regulation by the nitrogen system during turbine-driven EFW 3 pump operation was not demonstrated. No testing was performed to demonstrate i

that either backup nitrogen supply system was capable of operating their >

respective valves for the required 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Additionally, the licensee had not

' implemented a periodic survelliance test program for these nitrogen systems and was conducting no periodic testing of their performance. The failure to perform adequate functional testing of these backup nitrogen systems appeared to be contrary to a licensee commitment and will remain unresolved pending followup

by the NRC Region II (50-269, 270, 287/86-16-09).

i 3.3.6 Testing of the Standby Shutdown Facility A weakness was noted with regard to the testing of the standby shutdown facility (SSF) that housed the systems and components necessary to provide an alternate and independent means to achieve and maintain a hot shutdown condition for one i or more of the Oconte units. This facility housed an independent power supply and a pump that was capable of supplying raw water at high pressure to the SGs of all three Oconee units. The SSF was designed to resolve safe shutdown require-

ments for fire protection, turbine building flooding, and physical security.

l Inadequate corrective action had been taken as a result of unsatisfactory SSF 4

HVAC service water pump test results. A review of the SSF HVAC service water 4 pump performance tests performed in accordance with Procedure PT/0/A/0400/06,

conducted from October 30, 1984, through March 4, 1986, revealed pump flows of 1

l -

i

- , - . , . - , , - ...-,,-..,..-_-___-_w-_,__-- - - - .-

27 gpm for tests conducted on July 18 and again on September 12, 1985. These values were significantly less than the required action values of 37.4 gpm for pump 1 and 36.0 gpa for pump 2.

4 The licensee's procedure stated tt.at if test results fall in the required action range, maintenance will be performed and a post-maintenance test will -

be completed or an analysis will be performed to demonstrate that the condition

}

does not impair pump operability. The licensee concluded that the HVAC system was maintaining acceptable temperatures in the SSF control room and computer room; therefore, the system fulfilled its required function. However, no analysis

, was available to support this conclusion assuming worst-case heat loads in the 4

SSF. In addition, ASME Section XI, IWP-3230(c) requires that a new se,t of test

! reference values be established after such an analysis. This also was not perforced. The licensee indicated that the pump performance was considered '

, acceptable and the low flows were attributed to blockage in the downstream piping. The most current measured pump flows at the time of the inspection were 36 gpm for pump 1 and 35.5 for pump 2. These values were just below the required action values noted in the test procedure. This apparent failure to take adequate corrective action as a result of unsatisfactory test results will remain unresolved pending followup by NRC Region II (50-269, 270, 287/86-16-10).

3.3.7 Auxiliary Service Water Pump Testing i The routine testing conducted on the auxiliary service water pump was considered inadequate. As described in the FSAR, this pump is to be capable of providin; a

, low pressure supply (85 psig) of raw water to the steam generators of all three

! units in the event that the normal EFW system becomes disabled as a result of a tornado or missile hazard. The auxiliary service water pump performance test PT/2/A/251/10 did not record suction pressure, discharge pressure, or flow, as required by ASME Section X1, IWP-300. The Oconee Nuclear Station In-Service i

Inspection Program, Revision 10, submitted January 13, 1986, requested exemption i from these requirements on the basis that suction pressure or flow instrumenta-l tion did not exist for the pump. This pump was found to be monitored only for i

vibration and bearing temperature. The failure to adequately monitor the performance of this pump will remain unresolved pending the outcome of the

! licensee's exemption request and followup by NRC Region II (50-269, 270, t 287/86-16-11).

l 3.3.8 Surveillance Testing of Batteries i

i The surveillance testing performed on the Oconee instrument and control bat-teries, the Keowee batteries, and the 230-kV switchyard batteries was considered deficient. Technical Specification (TS) 4.6.10 stated that a 1-hour discharge service test at the required maximum load shall be performed annually on the t

instrument and control batteries, the Keowee batteries, and the 230 kV switch-yard batteries. TS 3.7 described the required capacity of the de systems in terms of 1-hour profiles.

Initial Inrush Next 59 Minute Ampere Hours Battery (Amperes) (Amperes) Removed Oconee I&C 1160 506 516.9 Keowee 1031 179.4 193.6 230 kV Switchyard 130 10 12

i However, surveillance test procedures described the annual 1-hour discharge test as a constant current discharge as follows:

Capability Rate

Battery Test Procedure (Amperes)

Oconee I&C IP/0/A/3000/3 600 Keowee IP/0/A/400/11 400 230 kV Switchyard IP/0/A/3000/15 25

, In explaining the difference between the Technical Specification values and i those of the surveillance test procedures, the licensee stated that the discharge rates appearing in the test procedures were based on the ampere-hours

removed, as defined in the Technical Specification, with some additional j discharge added for margin.

t

, Following a design-basis event requiring the batteries, current demands will be the highest initially. As a result, battery voltage would drop to its i

lowest value during the initial inrush current and would return to a higher  !

value for the remainder of the discharge. The team confirmed that the size of the original instrument and control batteries and the Keowee batteries '

1 were determined by the initial inrush current and not by the total ampere-hour removed during a 1-hour discharge. The Oconee test procedures did not confirm l the capability of the battery to meet the required inrush currents identified ,

in TS 3.7. The failure to test the station batteries in accordance with s

Technical Specifications requirements will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-12).

a l

3.4 Desian Changes and Modifications  ;

Design changes and modifications were reviewed in the disciplines of mechanical, electrical, and instrumentation and control. This review concentrated on those design changes and modifications that affected: the capability of the emergency feedwater (EFW) system to deliver required flow under various accident and

, transient scenarios, the design adequacy of the backup nitrogen supply to

pneumatically operated valves, the capability of the standby shutdown facility

(SSF) auxiliary service water pump to deliver required flow following complete loss of feedwater scenarios, the adequacy of instrumentation and control equip-ment associated with EFW equipment, the design adequacy of supporting systems 2 such as the electrical power distribution, and the interaction of the integrated control system (ICS) with the EFW system.

! Figure 2 on page 22 illustrates the EFW piping configuration for Oconee Unit 1

at the time of the inspection. The EFW piping configuration for Units 2 and 3 i were similar to Unit 1 in most significant details.

! 3.4.1 Deviation from FSAR t

The FSAR stated that the EFW system was capable of withstanding the maximum j hypothetical earthquake (equivalent to a safe shutdown earthquake) and that the failure in the nonseismic portion of attached piping would not cause the loss i of function to the EFW system because automatic and remote manually operated seismic /non-seismic boundary valves are used. Contrary to this commitment in

the FSAR, substantial portions of the EFW system were not designed to be capable I i i

i t____________.___ _ _ _ _ . ___ _ . _ _

I3 y 8 D A" u O: N  :>+-.-- -

[ .b 372J 373 FE-153 385 317 , 345 0 232 3

Ch Og -

o MOTOR DRIVEN E- Ru x Y rDW PUNP A 374 y*375

3,, FRO,8 FEEDWA TER---C

4-CCW-IO5f(g g 8

g h-STEAM GENERATOR A

g3 /, Sysygn .yg ,

g CCW-IO4 ,

C-15e C-572 O

g4 N368 *y )(I i 70 *tJNI TS 1 r

• FEEDWATER I -g CCW-269 313 d C-153 k [C-ISO F CCW 4 k C-I52 AUK. SERVICE WATER

_[C-t63 /{93 PUMP ($ HARED) 33

,, W TO E FROM g g IJNIT 2 2 3

>C ' '

V95 + EMERGENCY FEED. 3 C-I56 --

CCW-100) [3 l !o 7

I' hfyg*IN) y 1 r 88 E DWATER S ' '& I f pg,p a g SYSTEM 432 , CCW-321 I g 70

• FEEDWATERN312 N'

3e N , M"C G--C:st------

% 442 , 34s 347 233 (IJPPERSURGE TANK 8 96 SYSTEM 3 4) [ , (SSF)

STEAM Ag = gg GENERATOR N388 ~~ a 4 p k395 0- l316 CCW-207 j

~

k [384 CCW-269 70

• OTER UNII5

• C-575 , FROM CCir L. O. --

N >C ( 3*I N n

FE-154 55F INTAKE

$sy syy,3ggyggg ygygg C-568 C-569 .

pgny (SHARED)

,_ MOTOR DRIVEN

,I ~^^i-,~.'f'..-- EMRGENCY FDW

~~ e.~a d PUMP 8

,1 . -

j/,0*

~ ~ .=

~ ~= ~- --

y... .

\ FIGURE 2.

~

SIMPLIFIED EMERGENCY FEE 0 WATER SYSTEM ARRANGEMFNT FOR IINTT 1 i

of withstanding the maximum hypothetical earthquake. This deviation was recognized by the licensee before this NRC inspection as documented by LER 86-002, dated March 5, 1986.

3.4.2 Seismic Design and Installation of Safety-Related Equipment The team observed a number of instances where it appeared that certain elect'ical r components may not have been seismically designed or installed.

(1) The Keowee safety-related batteries and racks were replaced with equipment from a manufacturer different than the original battery and rack. These batteries were required to start and control the Keowee standby power supplies. The team observed that the'end stringers on the battery rack that restrained cell movement had not been Installed in accordance with the manufacturer's installation drawing. Specifically, the drawing notes stated that the end stringer should be within 1/4 inch of the cell or spacer material should be added between the end stringer and the cell to reduce the free gap to equal to or less than 1/4 inch. The drawing identified the spacer material by specific bill of material number. Contrary to the above instructions, no spacer material had been installej in either Keowee battery. Although not pre-cisely measured before the licensee's corrective action, the inspectors observed gaps of approximately 3 to 5 inches between each battery and its end stringers. The licensee subsequently reported this deficiency to the NRC Operations Center as required by 10 CFR 50.72.

(2) The Oconee instrumentation and control batteries were found to contain interstep connections made up of two pieces of bus bar with a simple bolted connection. Relative motion between the end cells located on the upper and lower steps of the rack could loosen this connection, resulting in excessive heat and voltage drop at this juncture. The team could not confirm the seismic adequacy of the existing connection because the seismic test for these batteries did not document the method of interstep connection.

The deficiencies identified above regarding the inadequate seismic design and installation of safety-related equipment will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-13).

3.4.3 Runout Protection for EFW Pumps The EFW pumps were found to be susceptible to damage from runout conditions following anticipated transients or high-energy line break events. Runout is a term used to describe a condition of high flow (beyond design capacity) that could result in pump damage due to vibration and cavitation.

(1) For loss of main feedwater events concurrent with a trip of all reactor coolant pumps, the EFW system initiates on loss of main l; feedwater. Flow control valves FDW-315 and F0W-316 open fully to fill SG A and 8 to the natural circulation level. These valves will move to a throttle position only after SG natural circulation levels have been reached. While filling to these levels SG pressures will tend to decrease. As a result, EFW flow will increase because the

. _ _ . .- -- .. ..- - - .-. - .- . - =_. _ - - .-.

1

system resistance curve is very flat and flow is essentially dependent on SG pressure plus the pressure drop across FDW-315 and FDW-316. If either or both FDW-315 or FDW-316 fail open after SG 1evels reach the natural circulation point, then SG pressure will continue to decrease and EFW flow will increase until operator action is taken to stop 1

.feedwater addition. The EFW pumps associated with the failed-open flow -

control valve will reach runout and the potential will exist for pump damage as a result of vibration and cavitation. FDW-315 and FDW-316 have pneumatic actuators that are not safety related and that are designed to fail open on loss of pneumatic supply. The pneumatic sources for these i valves were from non-safety-related sources of instrument air and backup nitrogen bottles. s (2) Design analysis was completed during the inspection by the licensee to i arrive at a best-estimate of maximum and minimum EFW flow rates at various SG pressures for (1) motor-driven pump A to SG A, (2) motor-driven pump B to SG B, and (3) turbine-driven pump to either or both SGs. This

, design analysis concluded that EFW flow rates must be monitored when the

system is in use to prevent pump runout, that it is possible for the turbine-driven pump to experience runout when the control valves are 100 l percent open and SG pressures drop below 900 psia, and that it will be necessary for operators to take manual control of these valves to prevent this from occurring. The analysis also indicated that for the turbine-driven

' pump feeding both SGs, runout would occur at steam pressures of 850 to 900 psia. For the motor-driven EFW pumps, the worst runout condition would occur

in train A because of the reduced piping losses. For motor-driven pump A l feeding SG A, runout would be reached at steam pressures of 700 to 750 psia.

! Plant operating procedures contained no references or cautions to assist j operations personnel from exceeding EFW pump runout conditions.

l (3) For a loss of main feedwater scenario with all three EFW pumps running, the j licensee indicated that SG pressure would decrease to 800-850 psia in approximately 10 minutes and repressurize once FDW-315 and FDW-316 l started to throttle. However, if FDW-315 and FDW-316 failed to throttle i then the turbine-driven pump would reach runout at roughly 700 to 750

! psia. It should be noted that the operators would expect FDW-315 and FDW-316 to remain open for approximately 10 minutes while the SG 1evel is raised to the natural circulation point and that pump runout would not be obvious because the pumps were located in the turbine building.

(4) The potential for severe runout conditions would be increased for i high-energy line break events. Because high-energy line breaks would i

tend to decrease SG pressure more rapidly, the EFW pumps would reach l runout conditions sooner and less time would be available for operator i corrective action.

I In summary, the team found that design features were not provided to protect EFW pumps from damage caused by runout conditions. Further, the team concluded that

operator action alone may not be adequate or timely enough to prevent conditions that could degrade pump performance, particularly since the operators had neither l the training nor the procedural guidance to assist them. The potential for runout l was considered to be a significant design consideration that should have been i addressed as part of the modification to add the two motor-driven EFW pumps to j each unit. The apparent failure to conduct adequate design analyses in accordance f

i j  :

i

with ANSI N45.2.11 was discussed with the licensee and will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-14).

3.4.4 Piping Design Analyses EFW turbine steam supply relief valve MS-92 did not have sufficient capacity, to prevent piping between valves MS-87 and MS-93 from exceeding piping design pressure assuming that MS-87 failed open as designed. Figure 1 on page 17 shows the layout of this piping. Independent analysis by the team concluded that piping between MS-87 and MS-93 could be pressurized to approximately 450 psia. This analysis assumed 1065 psia in the SGs, MS-93 shut, and MS-92 o and discharging at a capacity consistent with the overpressure condition. pen During the inspection, the licensee acknowledged that MS-87 wassnot physically restrained from failing fully open. Analysis by the inspection team concluded that MS-87 would have to be restrained from opening beyond approximately 80% to eliminate this condition. Review of maintenance history indicated that MS-87 had failed open in the past. However, the effects of overpressurization were not addressed because the relief valve was thought to be adequately sized by the licensee's operations and maintenance personnel.

The apparent failure to conduct adequate design analyses in accordance with ANSI N45.2.11 was discussed with the licensee and will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-15).

3.4.5 Adequacy of Design of Safety-Related Inverter VoltageattheUnit3 safety-relatedinverter30IDcoulddropbelowithminimum input voltage of 105 V when fed from Unit 1, its alternate source of power.

This situation could occur automatically on a loss of voltage from the Unit 3 instrumentation and control battery. In rtsponse to the team's concern regarding the capability of one unit's de system seFving as the backup source for another unit's load, the licensee performed a de system voltage calculation. The results showed that the voltage at the Unit 3 safety-related inverter could drop as low as 95.7 V when fed from Unit 1. The potential to operate safety-related inverters below their specified and tested minimum input voltage of 105 V had not been previously recognized by the licensee, and the effect that this low input voltage would have on an inverter output or on loads connected to the inverter-fed buses had not been analyzed.

This item was discussed with the licensee's electrical engineering staff who indicated that it was a potential concern that would require further review.

The adequacy of the design of safety-related inverter 30!D will remain open pending(50-269,270,287/86-16-02).

review followup by the NRC Region i II of the results of the 3.4.6 Backup Nitrogen Supply Systems ThebackupnitrogensuppliesfortheEFWflowcontrolvalveswaIresizedonthe basis of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of operation instead of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> as committed to in an April 3 1981 letter to the NRC. The licensee committed to perform a functional test to assure that EFW flow control valves FDW-315 and F0W-316 and steam pressure regulating valves MS-87, MS-126, and MS-129 could be cycled to meet the 2-hour minimum availability requirement. The inadequate testing of these valves is described in Observation 3.3.5 of this report. The team reviewed a February 23, 1981 internal Duke letter which provided the results of testing and calculations

performed on the backup nitrogen supply to FDW-315 and FDW-316. These calcula-tions demonstrated that the backup nitrogen supply was sized on the basis of I hour of operation. This calculation was not checked or verified.

The April 3, 1981 letter to the NRC also committed to install nitrogen bottle backup supply to the control air systems for steam pressure regulating valves -

MS-87, MS-126, and MS-129. These nitrogen bottles were to be sized to provide a 2-hour supply of nitrogen in the event of loss of station air caused by a i

complete loss of ac power. Although these valves were required to modulate during a 2-hour period, no design analyses were available to establish the capacity of the nitrogen supply.

l The failure to meet licensing commitments with regard to the EFW systb backup

nitrogen supply systems was discussed with the licensee and will remain un-i resolved pending followup by the NRC Region II (50-269, 270, 287/86-16'-16).

3.4.7 Design Analyses Not Performed Design control activities did not ensure that critical mechanical design analyses were performed or existing analyses were revised during the preparation and closeout of modifications. In some cases, the team was concerned that the licensee did not refer to the original or modified design bases when preparing and approving a design change. The following examples were noted:

! (1) For modification NSM-1275, total discharge head (TDH) and net positive suction head (NPSH) calculations were not performed even though new motor-driven EFW pumps were added to the system in 1979. The failure i

to perform these calculations should have been detected and corrected during the closeout of this modification and when the EFW system was

! subsequently modified to interface with the auxiliary service water pump

associated with the standby shutdown facility (SSF).

During the inspection, analyses for NPSH and TDH were completed by the licensee. This calculation identified a potential for runout of the EFW

! pumps if flow control valves FDW-315 or 316 remain open. (See Observation

! 3.4.3.)

(2) For modification NSM ON-1012, a TDH calculation was not performed to l confirm that the SSF auxiliary service water pump could deliver required flow to six SGs as described in system description drawing ONS0-176-30.

(3) Orifice sizing calculations were either not done or not documented during modifications to install crossover flow paths and safety-related flow indication in the high-pressure injection system.

(4) For modification NSM-1275, design analyses were not prepared to confirm that the motor-driven EFW pumps from other units could supply both SGs at full secondary system pressures. The capability of the EFW system to meet this requirement was stated in FSAR Section 10.4.7.3.d. The team was >

shown an uncontrolled engineer's file which contained flow network computer runs; however, the file information was not in a form suitable for review without recourse to the originator and the results were not. identifiable.

I

~

The information in the file appeared to be generated after the modification was completed. The file was considered by the team to be a working file.

It appeared that design engineering personnel recognized that such an analysis was needed to confirm statements made in licensing documents but never completed the analysis by having it verified and documented.

(5) For modification NSM ON-2245, a QA Condition 1 (safety-related) calculaf. ion was perfomed, reviewed, and approved in November 1985. The calculation documented the selection of components for replacement of steam relief valve MS-92 and the addition of a solenoid valve to the control scheme of pressure regulating valve MS-87 to make it close simultaneously with MS-93.

Because the existing steam relief valve was to be replaced with a new valve of the same size, engineering personnel concluded that the'same design parameters as the existing valve would be used. As a consequence, engineer-ing personnel did not identify that the installed relief valve in the steam i l supply piping to the EFW turbine had insufficient capacity to prevent over- I l

pressure of the piping if the upstream pressure control valve MS-87 should fail open (see Observation 3.4.4).

As the above examples illustrate, the team found that the licensee's design

! control activities did not ensure that critical mechanical design analyses were performed or that existing analyses were revised during the preparation and close out of modifications. ANSI N45.2.11 requires that design activities be prescribed and accomplished to ensure that design inputs are correctly translated into design output documents. Design analyses such as those described in 3.4.7(1) through 3.4.7(5) are required to be performed in a planned and controlled manner. This item has been discussed with the licensee and will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-17).

3.4.8 Design Analysis Deficiencies Several examples were found where analyses for safety-related equipment were not performed in a controlled manner.

(1) The orifice sizing calculations for safety-related flow transmitters FT-153 and FT-154 were not performed in accordance with a controlled design process. Modification NSM-1275 Part A added orifice flanges to each EFW line in response to a post-TMI action item. Design activities performed as part of the modification included sizing calculations for the primary flow elements to establish the orifice plate diameters.

Analyses performed were not checked or verified and the preparer was not identified. In addition, the design analyses did not have file identifiers and were not identified as QA Condition 1.

(2) A design analysis completed during the inspection determined the best-estimate minimum and maximum flows the EFW pumps could deliver to remove reactor decay heat. This analysis contained errors which should have been detected and corrected during the design verification process.

(a) This calculation assumed that the piping was clean and flow was in the zone of complete turbulence. This assumption was used to establish the friction factors for calculation simplicity at 0.015 for 6-inch pipe, 0.017 for 4-inch pipe, and 0.018 for 3-inch pipe. The adequacy of this assumption was not justified nor confirmed later in the calculation after the minimum system flow rate was calculated. Specifi-cally, the calculation determined that the minimum flow rate could be as low as 466 gpa when steam generator pressure is at 1100 osia. For the largest sized pipe (6 inches), the -

corresponding friction factor was actually 0.0168. There-fore, the assumption of a friction factor of 0.015 for 6-inch, schedule 80 pipe was not conservative for determining minimum flow. This assumption resulted in approximately a 5 percent i nonconservative error in the friction loss at low flows.

(b) The calculation used piping isometric drawings which did not reflect the as-installed condition. Specifically, the calcula-tion referenced Duke isometric drawings which were not updated to reflect the addition of piping and valves associated with the interface of the SSF auxiliary service water pump.

Engineering personnel recognized that additional valves were indicated on the flow diagram that were not located on the isometric drawings. To compensate, flow losses associated with these additinna! valves were added to the line losses, but the effect of the altered piping was not addressed. In essence, it was assumed that the new valves had been added to existing piping and that the piping arrangement had not been altered. This assumption was essentially true for train A; however, it was not true for train B because the piping arrangement was altered significantly through the addition of an increased run of piping and a number of elbows and tees.

(c) The calculation assumed that valve FDW 318 was a tilting disc check valve; however, it was a 6-inch swing check valve.

Instead of using an UD of 40, an UD of 50 should have been used.

During the inspection the licensee performed additional analyses to confirm that the line loss errors would not substantially alter the conclusions concerning minimum feedwater flow. The licensee concluded that the operation of the EFW system was assured even though the calculation contained the errors identified above.

(3) Dynamic analysis of the motor starting capability of the standby power supply fed through the underground feeder from the Keowee hydroelectric plant was considered inadequate to address the etfacts of undervoltage conditions on class IE motor control centers and the motors fed by those cer.ters. In 1980 dynamic analysis was performedafterastaticanalysishadindIcatedthatanundervoltage condition existed with the addition of the six motor-driven EFW pumps in 1979. The following deficiencies were noted:

(a) Although the analysis consisted of a detailed summary of system impedances from Keowee through the distribution system and down to the 4-kV motors and the 600-V buses, it did not address impedances from the 600-V buses to the terminals of the various 600-V loads. Some of the larger loads on the 600-V system, i

l such as the reactor building cooling fans, had lead lengths that approached 400 feet. The additional impedance could be significant.

l (b) Reactor building cooling fan B was not included in the analysis.

This load was apparently overlooked when the analysis was .

performed. The addition of this load would approximately triple the kVA load assumed on motor control center 3XS3. As a consequence, the voltage drop to the motor control center would increase, further reducing the voltage at the motor terminals.

(c) The analysis was not treated as a design calculation ind was apparently not checked or design verified. ,

It appeared that the weaknesses identified above did not adversely affect the design of installed hardware but could have affected the assumed design margin.

ANSI N45.2.11 requires that design analyses be performed in a controlled and correct manner. This requires that analyses contain sufficient detail as to purpose, method, assumptions, design input, references and units so that a person technically qualified in the subject can review and understand the analyses and verify the adequacy of the results without recourse to the origin-ator. ANSI N45.2.11 also requires that design analyses be verified to confirm or substantiate their adequacy. The apparent failure to conduct adequate design analyses in accordance with ANSI N45.2.11 was discussed with the licensee and will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-18).

3.4.9 Design Program Implementation of ANSI N45.2.11 Requirements The team reviewed the general design process implemented by the Design Engineering Quality Assurance Plan (DEQAP) and found that the applicable procedures for design control of nuclear station modifications (NSMs) did not adequately implement ANSI N45.2.11 requirements for design process, design inputs, and design verification te ensure a properly documented and verified design package. As discussed in Observations 3.4.3, 3.4.4, 3.4.7, and 3.4.8, the team found that the requirements of ANSI N45.2.11 had also not been implemented for specific NSMs. The team noted that Duke Power Company (DPC) had committed to ANSI N45.2.11. The following concerns were identified:

(1) Design inputs associated with NSM packages were not required by DEQAP Procedure PR-160, " Nuclear Station Modification," to be documented as required by ANSI N45.2.11. In most cases, NSM packages reviewed by the team did not have design inputs documented and did not reference associated calculations. The team did note that PR-101, " Engineering Calculations," required documentation of design inputs such as methods, assumptions, and criteria used in accomplishing calculations. However, the team considered that a calculation war only one part of the design analysis for an NSM and documentation of design inputs for calculations did not necessarily satisfy documentation of design inputs for a complete NSM. The team also considered that unless NSM design inputs were clearly identified, the design verification process could not be accomplished in accordance with ANSI N45.2.11 requirements.

(2) DEQAP Procedures PR-160, " Nuclear Station Modification;" PR-101, " Engineer-ing Calculations;" and PR-130, " Engineering Drawings," did not address specific guidelines, technical responsibilities, or documentation require-ments for design verification; consequently they did not adequately imple-ment ANSI N45.2.11 requirements. PR-101 and PR-130 required design activ-ities to be checked for completeness, clarity, and accuracy by a qualified -

checker. PR-160 had no statements regarding design verification. The team noted that some individual design groups used checklists for design checking but this policy was neither widespread nor required by DEQAP procedures.

1 (3) The team found that NSMs were basically a compilation of transmittal sheets referencing applicable drawings. There appeared to be no organized treatment of problem and solution with appropriate analyses and supporting 1 documentation referenced. The packages reviewed by the team could not be design verified or audited without recourse to the originator, which is r.ot in accordance with ANSI N45.2.11 requirements.

i (4) The team noted that no reference was made to ANSI N45.2.11 in procedures i for design process control, design inputs, or design verification. '

The above weaknesses regarding the apparent failure to implement the design control requirements of ANSI M45.2.11 were discussed with the licensee and will remain unresolved pending follovup by the NRC Region II (50-269, 270, 287/86-16-19).

3.4.10 Operator Reliance on Control-Grade Equipment 1

4 The team was concerned that excessive reliance was placed on the operation of control grade equipment (not safety related) within the EFW system for the successful functioning of the system. The only safety-related indication in the EFW system was the train A and B header flow indication, and the only r safety-related controls were associated with the automatic start signals for 4

the EFW pumps and the solenoid valves on the various EFW flow control valves

! that allowed them to fail open. Design engineering had treated design analyses and modifications associated with the remainder of the EFW system instrumen-tation as not safety related and had generally not applied the design require-ments of ANSI N45.2.11. The inspection team detemined that the licensee's maintenance practices and design activities were significantly less rigorous for non-safety-related equipment. The inspection team was concerned that these lower standards were applied to the non-safety-related equipment important to  !

the operation of the EFW system. The following are examples of control grade equipment associated with the EFW system and the consequences of failure of that equipment.

l (1) SG 1evel instrumentation and control solenoids for the EFW flow control valves were considered to be safety-related equipment, but the electro / pneumatic devices, manual loaders, and pneumatic actuators that fail open on loss of pneumatic supply were not safety related. The pneumatic sources for these valves were from non-safety-related sources of instrument air and backup nitrogen bottles. As described in l Observation 3.4.3, if FDW-315 or FDW-316 remain open after SG 1evels reached the natural circulation point, pump runout could be reached.

(2) MS-87 was a control grade pressure control valve in the steam supply to the EFW turbine. It received a control signal from control-grade i

t. , ~ . . . - - - - -- - - - - -

pressure transmitter PT-0057. On loss of non-safety-related pneumatic supply, MS-87 would fail open and relief valve MS-92 would then open to prevent overpressurization of the EFW pump turbine steam supply piping.

However, MS-92 was undersized such that if MS-87 failed open, this piping could be pressurized above design values (see Observation 3.4.4). Addition-ally, failure of the pressure transmitter could cause MS-87 to remain shut in spite of an EFW system initiation, thus causing the potential loss of the turbine-driven pump. 1 (3) Although the upper surge tank (UST) was considered safety related and its j contents were required to mitigate the consequences of a loss of main feed-  ;

water event, the level indication for this tank was contral grade. Two differential pressure transmitters provided redundant level indication in the control room. One of the differential pressure transmitters was a pneumatic transmitter which provided the control room annunciator alarm (2 feet), a remote indicator, and a computer input for monitoring and

, alarm (7 feet). The other differential pressure transmitter used to monitor UST level was a Rosemount electronic transmitter which provided a redundant input to the computer for monitoring and alarm (7 feet). i Upon loss of non-safety-related air, the pneumatic level transmitter would ,

fail to a zero level and the low UST level alarm (less than 2 feet of level l remaining) would actuate. The operator must then rely on the Rosemount level indication, and no UST level alarm would be available to alert the operator that water was about to run out and that an alternate source of water for EFW pumps must be found. In this situation, the next alarm available to the operator would be the low suction pressure alarms associated with the motor-driven EFW pumps. These alares were provided to alert the operator that the potential exists for loss of net positive suction head (NPSH) to an operating pump. However, the alarm set point was set so low (2 psig decreasing) that these instruments alarm at a water level in the suction piping near the pump. Consequently, a low suction pressure alarm would occur almost simultaneously with loss of NPSH. The original set point for these pressure switches was established at 1 foot when the motor-driven EFW pumps modification was prepared. No set point calculations were available even though the pressure switches were used to assist the operator in protecting the safety-related EFW pumps. In 1981 a modification was performed to change the UST low-level alarm from 1 foot to 2 feet. This modification was treated as a non-safety-related 1 change and set point calculations were not documented and apparently not  !

performed. l

' The team was concerned that incorrect level indication could mislead <

the operator and prematurely cause the shift from a preferred source

, to a non preferred source of water. The team also was concerned that the lack of design analysis and documentation of an adequate design process was not consistent with the importance that the control grade  :

instrumentation has in the successful performance of the EFW system.

The failure of this instrumentation during transients and accidents l would only further increase operator action time. The team considered '

that excessive reliance may have been placed on the proper functioning of control grade equipment and operator action.

The licensee had conducted no analysis demonstrating that sufficient time existed for the operator to recognize and compensate for malfunctioning or degraded performance of control grade instrumentation associated with the EFW system.

-.-----,,,.._-----.--,---,.,,-----.-,.-,n._,,,,_..--.,-,,,,,,,,,,-,,,,,,--,,,,,-.,,-,-v,- -

,,,e.-----,,_,,,_-,----,----,,-.,,~--s- - - , , . - - - , - - - - -

The potential lack of accurate and reliable instrumentation and control was considered to be a weakness which could adversely affect the functional performance of the EFW system.

3.4.11 Safety-Related Classification of Instrumentation . ~ .

The team reviewed safety-related classifications of instrumentation and the methods for determining proper classifications of equipment. Oconee flow diagrams (OFDs) were the principle documents used for determining safety related classifications. However, OFDs did not indicate classification of instrumentation systems. It was necessary to consult instrument detail drawings to determine proper QA condition because a comprehensive list of safety-related ins,trumentation did not exist. The following weaknesses were found in this review.

(1) The team reviewed a sample of instrumentatien detail drawings and found the following errors:

Instrument Detail Drawing Number Problem 422CC-1, Rev. la OTSG 1evel transmitters LT-80, 81, 82, and 83 that provide flow control control signals for positioning the EFW flow control valves FDW-315 and 316 were incorrectly shown as not safety related.

422M-37, Rev. 4, and EFW flow transmitters FT-129, 130, 1422M-37, Rev. 4 153, and 154 were incorrectly shown as not safety related.

42288-18, Rev. 5, and Reactor coolant flow transmitters 1422B8-1, Rev. 7 FT-14 and 15 that provide RCS flow signals to the RPS were incorrectly shown as not safety related.

(2) The team also reviewed engineered safety feature system instrumentation for safety-related classification and found the following instruments were classified as not safety related per the design engineering instrument detail drawings.

l Drawing Number Instrument Detail Instrument l

422X-3, Rev. 9 High pressure injection flow (FT-7A/8A) 422X-6.01, Rev. 7 Low pressure injection flow (FT-4A) 422Y-2, Rev. 7 Reactor building spray flow (FT-2A/3A) 422FF-1, Rev. 13 Core flood tank level (CFLT-11/14) 422X-13 Rev. 10 Borated water storage tank level (LT-2A/6) i

1 l

The team found that the plant was calibrating all of the above-listed  !

instruments, except reactor building spray flow, with a safety related  !

procedure even though the design engineering drawings indicated that the  !

instrumentation was not safety related. Based on the function of this instrumentation for assuring that engineered safety features are operating i at required flow rates and tank levels, the team considered that these -

items should be considered safety related by design engineering and ,

calibrated as such at the plant. The importance of this instrumentation 1 for assurance of system function was further substantiated by the fact that Oconee Emergency Operating Procedures required operators to verify )

and maintain flow and levels using the above instrumentation.

(3) Design Engineering Department Supp"lementary Procedure ECPI'-PR-4, " Mechanical Instrumentation Drawing Checklist, required that instrument detail drawings stamped "QA Condition 1" (safety-related) also be stamped with a safety-related exclusion stamp indicating whether all or part of the instruments were QA Condition 1 on the drawing. The team found the following drawings were stamped QA Condition 1 but did not have the required safety-related exclusion stamp. All of these drawings had been recently revised by the document upgrade program.

Drawina Number Subject 42288-3.01, Rev. 3 RC pressure transmitter 42288-4, Rev. 13 Pressurizer level 422EE-1A, Rev. 7 Reactor building pressure ,

1422X-31, Rev. 1 HPI pump suction pressure gage 1422X-32, Rev. 1 LPI pump suction pressure gage 1422X-43, Rev. 3 SSF RC makeup pump discharge flow 1422X-48, Rev. 6 HPI pump crossover flow ,

1422Y-1, Rev. 1 Reactor building spray pump suction pressure gage On the basis of the above drawing errors, the team considered that accurate safety-related classification of instrumentation systems was inadequate. The above weaknesses have been discussed with the licensee and will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-20).

3.4.12 Safety Evaluations Safety evaluations in accordance with 10 CFR 50.59 were reviewed during this inspection as a part of the design engineering design change process for NSMs.

Since about 1984, design engineering safety evaluations were found to be originated by the Research and Projects Section (RPS) on DPC Form 160.2 of l

the DEQAP Procedure PR-360, " Nuclear Station Modification." Before this time, 3 design engineering safety evaluations were accomplished by the design engineer.

(1) Safety evaluations reviewed by the team did not sufficiently document the bases for the determinations that unreviewed safety questions did not exist as required by 10 CFR 50.59. The following examples are typical of those safety evaluations reviewed.

-(a) The safety evaluation for NSM ON-2346, replacement of RCS loop drain '

valves, did not discuss such items as equivalency of the replacement valves, code requirements, pressure ratings, or pipe configuration changes needed.

)

(b) The safety evaluation for NSM ON-2422, replacement of vent stack radiation monitors, did not discuss such items as equivalency of the replacement monitors with regard to flowrate, range, temperature, and power requirements. -

(c) Modification NSM ON-1754 changed the UST low-level alarm from 1 foot to 2 feet. The safety evaluation concluded that no unreviewed safety question was involved because the alarm set point change is a reminder to the operator and the set point is more conservative. In the team's view the safety evaluation did not address all of the safety concerns.

Technical Specification 3.4 required that 5 feet of level be maintained in the UST. This level corresponded to approximately 30,000 gallons of water. Although the level was normally maintained at least 2 feet above this level, the EFW system design basis required 30,000 gallons of water be available from a safety-related storage tank. If the low UST level alarm set point is reached, the operator could shift to nonpreferred water sources such as the condenser hotwell. If the transfer were to occur rapidly, less than the 30,000 gallons of preferred water would be used. The volume between the Technical Specification level of 5 feet and the 2 feet alare/

switchover point was approximately 23,000 gallons. The safety evaluation also did not consider the accuracy of the non-safety-related level instrumentation which could alarm at a higher value with even less water used. The team concluded that raising the set

, point to 2 feet may not be conservative. The team considered that I

insufficient information was provided in the written safety evaluation to determine whether an unreviewed safety question existed.

(d) Modification NSM ON-1012 revised the safety-related electric power feed to reactor building cooling fan B by removing the load center X10 breaker and wiring directly from the substation transformer to the motor control center XS3. This indirectly changed the location of the protection for the 600-V feeder cable from the 600-V load center to the 4160-V switchgear. The effect of this change on associated electrical components was not addressed in the safety evaluation even though it was an apparent conflict with FSAR subsection 8.3.1.5.1, which stated that cables were sized in coordination with the trip elements selected for that particular breaker.

This same safety evaluation stated that power was normally removed from valves FDW 347 and CCW 269. However, the team found the circuits

i for these valves were normally energized. This change was apparently made by operations personnel without concurrence from design engineer-ing.  !

(2) Discussions with RPS personnel responsible for performing safety evaluations revealed that an unapproved instruction was used to describe bilities and the process for accomplishing these evaluations. general This document responsi-did not address the vecific responsibilities and requirements necessary to ensure uniform, cons; stent, and adequately documented safety evaluations.

(3) A sample of approximately 20 RPS safety evaluations were reviewed during +

this inspection. Two of these, associated with NSMs ON-24Q1 and 2346, did not have the "FSAR sections reviewed and changed" section filled out as

required by Part B of DPC Form 160.2. Also, the team noted that the FSAR sections reviewed by RPS were not required to be documented in Part A of Form 160.2. The team considered that this information should be recorded 1

for informational purposes as well as for adequate review and approval of safety evaluations.

The above weaknesses regarding implementation and documentation of safety evaluations as required by 10 CFR 50.59 and DEQAP PR-160 will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-21).

3.4.13 Drawing Deficiencies Controlled design documents and drawings were found to contain mistakes and drafting errors or omissions. The following examples pertain:

(1) _ Drawings OEE-147, Revision 3, and OEE-147-1, Revision 4, elementary

diagrams for valves MS-82 and MS-84, show the position indication lights for the steam admission valves for the turbine-driven EFW pump. These drawings show the indicating light circuits wired to incorrect valve limit switches so that neither position indicator light would be lit in the intermediate valve position. The valve position indication for these valves was apparently wired incorrectly as shown in these drawings. This design was in conflict with the rest of the plant design in which both indicating lights would be lit in the intermediate position. The team was concerned that an operator could misinterpret both lights being out as a failure of the actuator.

The correction of the valve position indication wiring for these valves will remain open pending followup by the NRC Region II (50-269, 270, 287/86-16-03).

(2) Drawing 0-702, Revision 15, " Unit 1 6900V and 4160V Station Auxiliary System One Line Diagram," indicated that the EFW pumps have 600 hp motors. While this is true on Units 2 and 3, the Unit 1 EFW pumps are 1

driven by 500 hp motors.

(3) Drawing 0-705-A, Revision 32, " Unit 1 240/120 Vac Station Auxiliary Circuits One Line Diagram," identified the cables between the ICS

] inverter and the 1KI panelboard and between the ICS inverter and the Static Switch 1KI with the wrong cable numbers.

35 -

.a.- -e - - .--- ,yy, = --g--=,m.,--,--cy- .-,.---i.,e,mewy-,,,- ,mm-y,,,.,,w-,,m,.,w,.,_, .w-..-,,,,e----.,,,r--,m+rw- *w- - * . , --- w-,----+,%-w.-,------ ,- -e.--., w

4 l

(4) Drawing 0-705, Revision 30, " Unit 1 120 Vac and 125 Vdc Station Auxiliary Circuits One Line Diagram," incorrectly identifies the battery charger normally connected to the dc distribution center number 10C8 as charger number ICA. It should have been shown as 108.

(5) Drawing DEE-317-1Z, Revision 2, " Elementary Diagram 4KV and 7KV Load Shed

• under Emergency Conditions," stamped QA Condition 1, was not updated to show the EFW pump motors. This was typical for all 3 units. Unit I drawing ,

OEE-117-1Z, Revision 2, did not have the required QA Condition stamp. I (6) Drawing 121D-1.1, Revision 3, " Flow Diagram of Emergency Feedwater System," l failed to include the turbine-driven EFW pump discharge pressure, switch  !

FWD PSO420. The team confimed that the pressure switch is shown on the instrument detail drawing 0-422M-10, Revision 3.  ;

(7) Manufacturer's drawing OM 245-0682 provides the installation details for valve item 9J-280 corresponding to valves FDW-347 and CCW-269, identifies the electric operator for these valves as a Rotork type 14NA1, and provides its electrical characteristics. In contrast, the manufacturer's assembly drawing, OM-245-0654, identifies the motor operator as a type 40NA1 and does not provide it's electrical characteristics.

It appeared that the selection of the themal overload protection for these valves, as documented on the motor control center unit specification drawing OM 308-0311, was based on a type 40NA1 operator.

(8) Examples of conflicts between the mechanical valve data list and motor control center drawings were noted.

MCC Data Valve Data List -

Valve (Amperes) (Amperes)

MS-84 7. 9 0.8 - 1.6 C-156 3.6 2.1 - 4.2 C-391 1.6 3.9 (9) Drawing 0FD-133A-25 Revision 2 " Flow Diagram of Condenser Circulating Water System (SSF Aux. Service)," indicates that valves ICCW-268, 2CCW-268, 3CCW-268, ICCW-287, 2CCW-287, and 3CCW-287 are normally open. These valves were actually normally closed as confirmed during a system walkdown.

(10) Drawing 0FD-122A-1.4, Revision 1, " Flow Diagram of Main Steam System (Emergency FDW Pump Turbine Steam Supply & Exhaust)," indicates that design flow to the EFW turbine-driven pump steam line was 33,000 lbs/ hour.

Review of the steam flow versus shaft horsepower curve at 3400 rpm and 300 psig steam inlet pressure indicated that steam flow did not exceed 28,000 lba/ hour at 1000 horsepower. Because this horsepower corresponds to the lowest point on the pump head curve, it appeared that the steam design flow rate was overstated.

(11) Drawing 0FD-121D-3.1, Revision 3, " Flow Diagram of Emergency Feedwater System," incorrectly showed that pressure gage 3FDWPG-0054 taps off downstream of flow transmitter 3FDWPT-0060. Instead the pressure gage came off a common sensing line before the pressure transmitter.

l

(12) Instrument Detail, 0-422M-34, Revision 7, " Emergency Feedwater Bypass Valve Control." contains an incorrect functional description of how valves FDW-315 and FDW-316 work. In addition, the drawing has incorrect train designations for instruments IP271 and IP273. The drawing also does not indicate which steam generator level transmitter was associated with which P/I controllers. ~-

(13) Instrument Detail, 0-0422M-37 Revision 4, " Emergency Feedwater Header Flow to Steam Generator," has an incorrect Rosemount model number for flow transmitters 1FT153 and 1FT154. The model number should be 1152DP5E92PB.

The drawing deficiencies identified above are contrary to ANSI N45.2.11 require-ments and will remain unresolved pending followup by the NRC Region II (50-269,270,287/86-16-22). ,

3.4.14 Temporary Lead Shielding Weaknesses were identified in the program for control of temporary lead shielding.

The use of shielding for ALARA considerations was evaluated to determine whether adequate design evaluations had been made. Thirteen lead shielding installations on safety-related piping were reviewed in this inspection. Twelve of these had been installed and removed on reactor coolant system (RCS), high pressure injection (HPI) system, decay heat removal, and pressurizer spray piping since January 1986.

The other installation reviewed was installed on RCS piping at the time of this inspection. The following four concerns were identified in this review.

(1) No documented 10 CFR 50.59 evaluations had been accomplished for the temporary shieldi'ng installations reviewed during this inspection.

Further, the team noted that Maintenance Directive V.B. " Shielding of Piping and Equipment," did not address the subject of 10 CFR 50.59 evaluations. IE Information Notice 83-64, " Lead Shieldin Safety-Related Systems Without 10 CFR 50.59 Evaluations,"g dated Attached to September 29, 1983, addresses lead shielding installations and indicates that failure to analyze for possible seismic and structural effects (both dynamic and static) of lead shielding on safety-related systems potentially constitutes an unreviewed safety question.

(2) Maintenance Directive V.B did not address installation requirements or approved techniques to ensure that shielding was safely and correctly installed with approved installation materials and procedures. This information was apparently not available in other procedures as well.

(3) Maintenance Directive V.B required station engineers to determine and i document the seismic classification of piping for temporary shielding applications. It did not require that analyses be accomplished to ensure that piping or structures were not overstressed when shielding was installed. No documented engineering calculations were found by the team to support lead shielding installations prior to January 1986. In January 1986, Maintenance Directive IV.N, " Determining Maximum Loads That Can Be Supported By Pipes or Other Structures," was issued to provide a standard method for determining maximum loads that could be supported by pipes and structures. However, the load tables and computational methods provided in Maintenance Directive IV.N were apparently not backed up by an official design engineering calculation to adequately document and support the methods and assumptions used in the calculation. The calculation appeared 37 -

N b

-,w- w---.,*-

(

to be based on an analysis for simply supported, uniformly loaded, straight beams but.was used for complicated piping configurations without considering seismic loading, torsional stresses, effects of concentrated loads, or positive anchors at the supports.

, (4) Two shielding installations were identified where more lead'b'l'nkets a -

had teen installed on safety-related piping than had been authorized by the foms for Maintenance Directive V.B " Record of Temporary Shielding l Installation and Removal." These were:

(a) Serial Number 228, which authorized 20 blankets, but 42 were actually t installed on reactor coolant system (RCS) piping. s (b) Serial Number 221, which authorized 96 blankets, but 100 were actually installed on high pressure system (HPI) letdown cooler piping.

The team found no documentation approving the additional shielding or analyses proving the piping or restraints had not been overstressed by the additional shielding.

The team noted that Maintenance Directive V.B allowed installation of temporary shielding on safety-related piping and components only that had been removed I from operation. Based on the team's review of procedures and installations, the team considered that the potential existed for piping, restraints, and components to be overstressed or degraded while in a nonoperational condition

' and possibly affect system reliability during plant operation even though the temporary shielding had been removed. The above inadequacies in the program for control of temporary shielding were discussed with licensee management and will remain unresolved pending followup by the NRC Region II (50-269, 270, 287/86-16-23).

3.4.15 Document Upgrade Program The document upgrade program was considered to be a strength. This effort consisted of preparing new revised flow diagrams, electric one-line diagrams, system descriptions, valve lists, an instrument list, and load lists. These documents were completed from original plant drawings and documents and those generated since Oconee started operation. The team considered this a positive effort by DPC to provide design information in a more readily accessible and useable manner. However, the team did find some errors in the mechanical and i,

electrical system descriptions reviewed. For example, the following errors were found in the SSF electrical system description.

(1) The system description stated that electrical power to the SSF motor-operated isolation valves was normally removed when actually power was maintained to these circuits so that valve position could be monitored from the SSF. [See Observation 3.4.12(1)(d)].

(2) The system description indicated that the motor horsepower for these SSF isolation valves were 1/4 of the actual rating indicated on the electrical and mechanical drawings.

(3) The system description stated that no electrical protection was provided to components in the SSF systems when actually electrical protection was provided.

1

(4) The automatic interlocks described for the SSF auxiliary service water (ASW) pump control contained the following errors:

(a) The system description identified the wrong 4-kV breaker which is tripped by an engineered safeguards signal. .

I (b) The low flow trip interlock did not exist.

(c) The 4-kV feeder breaker OTS1-1 interlock in the starting circuit of

the SSF ASW pump did not exist in the actual pump circuit.

3.4.16 Battery Design Capability ,,

TS Section 3.7 bases were not consistent with the design basis for the station 125-V de instrumentation and control batteries. The licensee stated the design basis for each unit's battery was based on one battery of any unit supplying its own load plus one additional panelboard (3 panelboards total). However, the TS stated that one unit's battery was capable of carrying the load for one entire unit (4 panelboards total). The team discussed this issue with licensee representatives who indicated that the applicable TS would be reviewed to determine if a change would be necessary. This item will remain open pending followup by the NRC Region II (50-269, 270, 287/86-16-04).

3.5 Quality Assurance The Oconee quality assurance (QA) program was assessed to determine if the pro-

, gram, as implemented, was effective in identifying and correcting significant technical and operational deficiencies. This assessment was based on interviews with QA and supervisory personnel and on a detailed review of the documentation from eight of the most recently conducted audits during the period from February 1985 through April 1986 for the areas of design engineering, maintenance, oper-ations, station modifications, and corrective action. Also included in the review were four surveillance reports, ten incident reports, and the qualifi-cations of twelve QA auditors and four members of the QA surveillance group.

The team concluded that although the written QA program appeared to be adeiuate, it was not effective in providing significant technical feedback to management.

This conclusion was drawn from the following identified weaknesses:

(1) The QA audit and QA surveillance staffs lacked significant technical and

-nuclear plant operations experience. Audit plans and checklists typically lacked the detail needed to compensate for this lack of experience.

(2) Even when the QA audit and QA surveillance groups were augmented with technical specialists, significant technical and operational deficiencies, similar to the concerns identified in this NRC inspection report, were seldom identified.

(3) The corrective action program was considered superficial in causal analysis, the specification of required corrective action, corrective action verification, and the followup of the generic implications of issues.

i 39 -

- . - . - - . . - - - . - . - ~ . - - . - - - . - . . _ - - _ . . - - . - - _ - _ - - -

(4) QA supervision and the Nuclear Safety Review Board (NSRB) did not appear to provide a critical review of audit reports, surveillance reports, and incident reports. Additionally, these QA program output documents often le, tad sufficient detail to permit critical analysis.

~

An example of the weaknesses in the implementation of QA program'w'as found in -

audit report NP-85-20(0N), conducted between October 14 and November 7, 1985, where the auditors, assisted by a technical specialist, examined the station lubrication program. The objective of the review was to " assure station equipment is being lubricated properly with the correct lubricants, and at specified intervals." The auditors identified 23 discrepancies while conducting a comparison between equipment listed as required to be lubricated in.,an uncontrolled maintenance department lubrication manual and Operations Procedure OP/0/A/1103/25. The audit report identified an unresolved item (URI).in relation to this issue. The URI stated, "It appears that no clear lubrication program exists . . . there is no assurance at this time that all components are being adequately lubricated." URIs were defined as items "that establish concern (and are not clear deficiencies) . . . and do not require . . . a written response" from management. Even though the auditors were able to draw a conclusion about the appearance of the lubrication program, the serious implications and consequences of an inadequately implemented lubrication program were not identified. The QA group performed no further followup and eventually accepted a corrective action commitment from the maintenance group to revise the operations procedure by August 1, 1986. No apparent in-depth investigation of the problems of the existing lubrication program was conducted as evidenced by the significant deficiencies identified in this area by the NRC inspection team (see Observation 3.1.1).

1 i

l l

l l

l l

i

. _ . . . _ _ _ - . - _____..- - - .- _-. . _ _ _ _ _ - _ - . - . ~ _ . . ..

4.0 MN!AGEMENT EXIT MEETING An exit meeting was conducted on June 11, 1986, at the Oconee Nuclear Station.

The licensee's representatives at this meeting are identified in the attached Appendix. The following NRC management representatives were also in attendance:

Mr. James M. Taylor, Director, Office of Inspection and Enforcement; Mr. Roger D. Walker, Acting Deputy Regional Administrator, Region II; Mr. John F. Stolz, Director, PWR Project Directorate #6, Office of Nuclear Reactor Regulation; Mr. Vince Panciera, Deputy Director, Division of Reactor Safety, Region II; and Mr. Virgil L. Brownlee, Branch Chief, Division of Reactor Projects, Region II.

The scope of the inspection was discussed and the licensee was informed that the inspection would continue with further in-office data review and analysis by team members. The licensee was informed that some of the observations could become potential enforcement findings. The observations were presented for each area inspected, and teant members responded to questions from licensee's representatives.

i

- - , . _ , - - . - . . - . , _ . - - - - - ---.~-.--..,.,-n. -- --- . . - - . - . -.- ,.

. APPENDIX Persons Contacted The following is a list of persons contacted during this inspection. There -

were other technical and administrative personnel who also were contacted.

All personnel listed are Duke Power Company employees unless noted otherwise.

• H. B. Tucker - Vice President, Nuclear Production

• G. E. Vaughn - General Manager, Nuclear Stations

• G. W. Grier - Corporate QA Manager s

• J. M. Frye - QA Manager, Audit Division

• J. O. Barbour - QA Manager, Operations -

• C, Harlin - Oconee Compliance

• T. Barr - Oconee Technical Services Superintendent

• S. Nesbit - Mechanical Design

• J. Peele - Design Engineering

• H. Hammond - Design Engineering

• R. Matheson - Oconee Maintenance Services

• R. Sweigart - Operations Supervisor

• D. Murdoch - Station Support Principal Electrical Engineer

• T. McMeekin - Chief Engineer Electrical Division

• T. Wyke - Mechanical and Nuclear Design Engineering

• K. Canady - Nuclear Design Engineering

• N. Pope - Operations Superintendent

• T. Owen - Maintenance Superintendent

• P. Guill - Licensing Engineer

• W. McAlister - Maintenance Engineer Supervisor

• D. Compton - Licensing Engineer

• N. Rutherford - Licensing Manager

• M. Tuckman - Station Manager

• T. R. Dinriery - Supervising Design Engineer

• D. W. Murdock - Electrical Design Engineering

• E. G. Frampton - Supervising Design Electrical Engineer

• C E. Kneeburg - Engineering Support Senior Electrical Engineer

• T. P. Harrall - Project Support Supervising Design Electrical Engineer

• W. A. Houston - Design Engineering

• J. E. Snyder - Supervising Engineer

• D. M. Hubbard - Supervising Engineer

• L. M. Coggins - Senior QA Engineer B. Thompson - Maintenance Engineer R. Entrekes - Maintenance B. Carney - Maintenance Engineer Supervisor A. Benge - Electrical Systems Engineer J. E. Stoner - Controls Design Engineer J. V. Boehme - Controls Engineer M. H. Miller - Controls Engineer G. D. Chronister - Layout Design

• D. Betts - Manager, Quality Audits, Florida Power Corporation

• T. Catchpole - Senior Nuclear QA Specialist, Florida Power Corporation l

• Attended exit meeting on June 11, 1986.

A-1  ;

I

J. S. Tannery - Electrical Engineer C. Hope - Electrical Engineer R. Gillespie - Nuclear Maintenance Group F. Sevria - Nuclear Maintenance Group R. E. Howell - Electrical Engineer -~ ~

R. F. Wardell - Design Engineering E. M. Weaver - Design Engineering R. A. Knoerr - Project Services Supervisor s

i l

A-2

1

.aaug#(

• UNITED STATES fiECEWED

[ g NUCLEAR REGULATORY COMMISSION H30

• ~a 3 wAsHWGTON, D. C. 20655

...;.

• March 31, 1986 '

$33 APR -3 FH I: 03 '

Docket No. 50-313 -

• EGIDH VI;F 1

Arkansas Power & Light Company ATTN: Mr. Jchn M. Griffin l Senior Vice President - Energy Supply P. O. Box 551 Little Rock, Arkansas 72203 l

Gentlemen:

SUBJECT:

SAFETY SYSTEM FUNCTIONAL INSPECTION REPORT 50-313/86-01 This letter forwards the report of the Safety System Functional Inspection perfomed by an NRC team over the period January 6-31, 1986 involving activities authorized by NRC Operating License Number DPR-51 for the Arkansas Nuclear One-Unit I facility. This inspection was conducted jointly by members of Region II, Region IV, the Office of Inspection and Enforcement, and NRC contractors. At the conclusion of the inspection,  ;

the findings were discussed at an exit meeting with those members of your staff identified in the appendix to the enclosed inspection report.

This NRC effort at Arkansas Nuclear One represents a new inspection approach

. involving an assessment of the operational readiness and functionality of selected safety systems. Particular attention is directed to the details of modifications and design control, quality of maintenance and surveillance, and adequacy of testing applicable to those safety systems. At ANO, the team selected the emergency feedwater (EFW) system as the primary focus of its review.

The report includes findings that may result in enforcement action, which would be the subject of subsequent correspondence. The report also addresses other observations and conclusions made by the inspection team.Section II

, of the report is a summary of the safety effects of the more significant

findings on 1 he operational readiness of the selected safety system.

t In gener;;, tFe inspection team found the design of the ANO-Unit 1 EFW system to l be sot.nd nowe,3r, several aspects of your programs for modifying, testing, and maintaining this system were considered to be deficient. The inspection team

identified significant concerns in the areas of mechanical design changes and i modifications, seismic interaction, torque switch settings of motor-operated valves, and testing of EFW system components. We request that you respond to

, > this office within 45 days describing the actions that you have taken or intend i to take to improve management controls over the specific licensed activities

described in Section II of this report as significant findings. In the area of motor-operated valves, consideration should be given to providing an expedited o / s n a o A -7 q O 9o -

mf { } I /s D l

T

. Arkansas Power & Light Company response to IE Bulletin 85-03. In the area of testing EFW system components, consideration should be given to conducting a comprehensive review of the adequacy of the test programs covering EFW system components at ANO-1.

While planning corrective actions based on the weaknesses identified in the enclosed report, it is important that you realize that the focus of this inspection was only on the emergency feedwater system at ANO-1. Therefore, consideration should be given to identifying and correcting similar problems in other safety-related systems.

Should you have any questions concerning this inspection, we would be pleased to discuss them with you.

Sincerely, J s M. Tay1 , Director ffice of Inspection and Enforcement

Enclosure:

Inspection Report 50-313/86-01 cc w/ enclosures J. M. Levine, Director, Site Nuclear Operations Arkansas Nuclear One P. O. Box 608 Russelville, Arkansas 72801 Arkansas Radiation Control Program Director e

i

Arkansas Power & Light Company Distribution (w/ report):

DCS ORPB reading DI reading W. J. Dircks, ED0 H. R. Denton, NRR C. J. Heltemes. AE0D J. M. Taylor, IE R. H. Vollmer, IE J. G. Partlow, IE R. L. Spessard, IE B. K. Grimes, IE J. A. Axelrad, IE All NRC Regional Administrators JZ E.T Gagliardor:.RV2 D. M. Hunnicutt, RIV W. D. Johnson, RIV G. S. Vissing, NRR H. R. Booher, NRR E. H. Johnson, RIV All licensees (Distribution GP)

DCS PDR LPDR NSIC

, NTIS INP0 I : PAS:0RPB IE: PAS:0RPB IE1 r

.0RPB IE:DI D IE.W D T0 Martin:jj LJCallan PF l cKee RLS ssard JGP trtlow 03/5/86 03/[/86 03/ri/86 03 /86 03/ /86

} IE IE RF mer JP a lor po 0 86 0 Q /86

4 0FFICE OF INSPECTION AND ENFORCEMENT DIVISION OF INSPECTION PROGRAMS Report No.: 50-313/86-01 Licensee: Arkansas Power & Light Company P. O. Box 551 Little Rock, Arkansas 72203 Docket No.: 50-313 License No.: DPR-51 Facility Name: Arkansas Nuclear One, Unit 1 Inspection Conducted: January 6 - 31, 1986 Inspectors: [O &_

T. O. Mhrtfn, Inspecolon Specialist 3f4f86 Date' Team Leader, IE f o & t _ rcve J' E. Dyer',~ Inspection Specialist, IE 2/r/ss Dets TnhA-D'.

foR Falconsr, Reactor Inspector, Region II als}86 Dite' (O FOA 3[5'#6 C. C. Hafbu:R, ANO Resident Inspector D& te' '

O.4 1 G. W. Morri's, NRC Consultant, Westec roa a/s/sc.

Dite fnsh&

R. P. Mullik' axe n, Reactor Inspector, Region IV 2k/s Date'

[ O //n N Fok M.' E. Mufphy, Reactor Inspector, Region IV 3/r/86 Da~te '

CDMaS rm it G. J. Oter>eck, NRC Consultant, Westec als/w D#te'

/ I J. M S arkey, Ins w CV $3 Y on Specialist, I Dhte b

D. J. Sul iv'a)r,' Jr., InspFction Spec /glfst, IE A 3)//pr Da~te/ '

a Qn1muw'l t ~r l

2lfffg L. L. Wh'eeler, In';pection Specialist, IE Datd nDM&

C.'

ra G. W&lenga, Inspection Specialist, IE sMes Date' Accompanying Personnel: *J. Auchland, Westec

• L. J. Callan, IE

• A. T. Howell, IE

• G. Vissing, NRR Approved by: .3/W/ar, Phillip F. McKee, Chief Date Operating Reactor Programs Branch, IE

• Present during the exit interview on January 31, 1986 SCOPE: This special, announced team inspection involved 756 inspection hours to perform an in-<apth assessment of the operational readiness of the emergency feedwater system.

RESULTS: The licensee's operational readiness and management controls were reviewed in six functional areas, primarily as they related to the emergency feedwater system. The functional areas reviewed were:

Design Changes and Modifications Maintenance Surveillance Testing Operations Quality Assurance Training Training is not addressed separately in this report; rather, it is incorporated within the other functional areas as appropriate.

Eleven potential enforcement findings, identified in this report as Unresolved Items, and five Open Items will be followed up by the NRC Region IV.

f

I. INSPECTION OBJECTIVE The objective of the team inspection at Arkansas Nuclear One - Unit I was to assess the operational readiness of the emergency.feedwater (EFW) system by determining whether:

o The system was capable of performing the safety functions required by its design basis, o Testing was adequate to demonstrate that the system would perform all of the safety functions required.

o System maintenance (with emphasis on pumps and valves) was adequate to ensure system operability under postulated accident conditions.

o Operator and maintenance technician training was adequate to ensure proper operations and maintenance of the system.

o Human factors considerations relating to the EFW system (e.g., acces-sibility and labelling of valves) and the system's supporting proced-ures were adequate to ensure proper system operation under normal and accident conditions.

6 1

i

II.

SUMMARY

OF SIGNIFICANT INSPECTION FINDINGS This section summarizes the safety effects of the more significant findings on the operational readiness of Arkansas Nuclear One (ANO)-Unit 1 emergency

- feedwater system.Section III provides the detailed findings pertaining to the major functional areas evaluated.

A. Safety Effects on the Emergency Feedwater (EFW) System

1. The inspection team identified design concerns regarding the ability of the EFW system to perform its safety function during abnormal events,

a. For steam line break accident scenarios, given a single active failure within the electrical power system (i.e., vital power), the emergency feedwater initiation and control (EFIC) subsystem did not 1

' have the capability to isolate the affected steam generator (SG) from the unaffected SG. It appeared that this could result in the loss of all EFW flow to both SGs. For a nonisolable steam line break in SG A with a concurrent loss of offsite power, the EFW system and EFIC sub-system rely on onsite power sources. If the loss of " red" ac power is assumed as the single active failure (i.e., failure of " red" diesel to

start, fault on bus, etc.), the EFW motor-driven pump is unavailable and motive power is lost to operate CV-2667 (the isolation valve between SG A and the EFW turbine-driven pump). As a consequence, CV-2667.could not be closed and EFIC would have unsuccessfully attempt-

ed to isolate SG A from SG B. Instead, the unaffected SG B would have i been cross-connected to the affected SG A through CV-2667 and CV-2617.

As a consequence, both SGs could have depressurized through the nonisol-able break, and the steam supply to the turbine-driven EFW pump may have been insufficient, causing a complete loss of EFW. In addition, the blowdown of two SGs through a nonisolable break inside the contain-ment building was outside the design basis for the containment build-ing (See figure 1, page 6).

Subsequent to the inspection, the licensee provided information indi-cating that, for the main steam line break accident postulated above, sufficient steam would have been available to the EFW turbine until SG pressure dropped to approximately 80 psia, f b. No design analysis was found evaluating the consequences of 4 high-energy line breaks (such as a main steam line break within the l penthouse area) on the EFW system concurrent with a single active failure even though the steam supply piping and valve arrangement was modified. Likewise, the team found no design analysis performed to assess the impact of high-energy breaks within the EFW steam supply piping on other safety-related equipment.

The team found that the EFW system will function properly in response to

! anticipated transients such as loss of offsite power concurrent with a j turbine trip and loss of main feedwater events. However, as evidenced by i

the deficiencies identified above, the team found that the system may not i- have been adequately protected from abnonnal events such as high-energy i

line breaks and earthquakes (see observation II.B.2).

( -

l l 2 l i

2. The team identified the following safety concerns with the licensee's program for maintenance and-testing of EFW system motor-operated valves (MOVs).

a. Licensee personnel were generally unaware that EFW M0V torque switches for ANO-Unit I were only bypassed during initial valve movement and that, as a consequence, improper torque switch operation could prevent the EFW system from completing its safety function.

This lack of understanding was apparently due to a design difference in MOVs between Unit I and Unit 2. In ANO-Unit 2, MOV torque switches are typically bypassed for full valve travel,

b. Torque switch settings were made without reference to the minimum recomended values provided by the vendor. The team reviewed selected MOV torque switch settings and found them to be set low; in one case, the setting was below the minimum value used for manufacturer tasting.

c. MOV limit switches appeared to be set to bypass torque switches for an insufficient amount of initial valve travel. The purpose of these limit switches was to bypass the torque switch until the valve was fully off its shut seat, thereby providing some assurance that the torque switch would not prematurely stop valve motion.

d. EFW system MOVs located in the pump discharge piping were not tested under flow conditions to ensure that they would operate as expected in emergency situations.

e. Several discrepancies in the M0V maintenance procedures were identified. These discrepancies could cause confusion among personnel performing maintenance.

In summary, the licensee could not verify, by test results, engineering evaluation or vendor input that current torque switch and limit switch settings were adequate to permit proper MOV operation under expected flow conditions for all operating scenarios. Most EFW system MOVs are not required to reposition under nonnal circumstances for EFW initiation.

However, EFW system M0Vs would be expected to operate against design differential pressure if a steam generator isolation signal was received during EFW operation, if EFW water supply sources were required to be shifted from the condensate storage tank to service water, or if EFW initiation occured during system flow testing.

3. In addition to the concerns described above relating to the testing of l

motor-operated valves, the inspection team identified other electrical and mechanical equipment in the EFW system that had not been tested.

a. The condensate storage tank (CST) level indication transmitter, l LIT-4203, had apparently not been calibrated after installation during the 1984 refueling outage. The licensee also had no routine l surveillance procedure to ensure that this instrument is periodically l

3

calibrated. This instrument is used by operators to make the detemination to manually shift EFW pump suction from the non-safety-related CST to the safety-related service water backup.

b. Eight valves in the EFW system that required routine in-service testing were not periodically tested. These valves included four check valves in the EFW pump suction line from the CST, one check valve in each EFW pump minimum recirculation line, and one 3-way valve downstream of each EFW pump that allows recirculation flow when the EFW pump is discharging at high pressure. The proper operation of these valves apparently cannot be verified without the installation of additional instrumentation.

B. Effects on Other Safety Systems In addition to the specific concerns discussed above that relate directly to the operational readiness of the EFW system, the team also identified several general concerns that have the potential to affect the proper operation of other safety systems.

1. Problems were noted in the AN0-1 mechanical design-change process. The team identified instances where modifications were done without significant mechanical design activities being performed, completed, or documented.

The team believes that these oversights should have been corrected during the design verification and supervisory reviews. The fact that these omis-sions were not detected indicated an apparent lack of design experience and/or a lack of supervisory attention.

2. ANO-Unit I did not routinely consider the effect of equipment that is not designed to meet maximun; design basis earthquake requirements (seismic Class 2) on equipment that is designed to meet maximum design basis earth-quake requirements (seismic Class 1). The team detemined that evaluations of potential seismic interaction, seismic Class 2 over Class I situations, were not being routinely considered when preparing the civil portions of design-change packages. The lack of consideration for seismic interaction could have a significant effect on the operability of all safety systems at ANO-Unit I during a seismic event. Seismic Class 1/ Class 2 interaction is apparently fully considered at ANO-Unit 2.

3. The team found several samples of controlled design documents with incor-rect or misleading infomation. Based on the number and types of discrep-ancies, the team believes that the implementation of configuration control activities was weak.

l III. DETAILED INSPECTION FINDINGS A. Design Changes and Modifications The inspection team examined design aspects of design-change package (DCP) 82-D-1050. This design change was to replace the EFW pump 7A turbine driver, I

4 ,

' to add new steam admission valves, to reroute the turbine steam supply piping, and to modify the turbine pump suction and discharge piping. In addition, DCP 80-10838 was examined. This modification was to replace the discharge piping of the EFW pumps, and to add modulating control valves, automatic recirculation control features, and a full flow test loop, and to change selected valve actuators from ac to de power. The following observations were made:

1. The team determined that the implementation of DCP 82-D-1050 failed to ensure that it met the single-failure criterion. Specifically, for steam line break scenarios, given a single failure within the electrical power system (vital power), the emergency feedwater initiation and control

! system (EFIC) would not have the capability to isolate the affected steam l generator (SG) from the unaffected SG. It appeared that this could result j in the loss of all EFW flow to both SGs.

Figure 1 on page 6 illustrates the main steam system supply configuration to the EFW turbine pump at the time of the inspection. The steam supply to EFW pump 7A is supplied from both SGs through normally open ac motor-operated control valves CV-2617 (SG B) and CV-2667 (SG A). Like the motor-driven pump, the EFW turbine pump supplies feedwater to either or both SGs depending on the EFIC vector signals. For a steam line break, the EFIC system will isolate the depressurized SG in order to isolate that affected SG from its associated main steam and main feedwater lines. If isolation of the affected SG does not isolate the break, the EFIC system will provide EFW only to the intact SG. For a nonisolable steam line break in SG A with a concurrent loss of offsite power, the EFW system relies on onsite power sources. If the loss of " red" ac power is assumed as the single active failure (i.e., failure of " red" emergency diesel to start, fault on bus, etc.), the EFW motor-driven pump is unavailable and motive power is lost to CV-2667. As a consequence, EFIC would have unsuccessfully attempted to i close CV-2667, and therefore the unaffected SG B would have been cross-connected to the affected SG through CV-2667 and CV-2617. Both SGs would have then depressurized through the nonisolable break and the steam supply /

} to the turbine-driven EFW pump could have been insufficient, causing a i complete loss of EFW. p i t Subsequent to the inspection, the licensee provided information indicating that, for the main steam line break accident postulated above, sufficient steam would have been available to the EFW turbine until SG pressure dropped to approximately 80 psia.

i Review of DCP 82-1050 (the design change to install the new EFW turbine, new dc steam admission valves, and to modify EFW suction and discharge

, piping) indicated that a single-failure analysis was not performed.

Specifically, question 15 of the DCP asked, "How was the impact of failure j of the systems, components, and structures considered in the design?" In response, the Project Engineer indicated that the question was not applicable by answering "NA." This response was checked and approved without comment. Procedure 1032.01, " Design Control," Revision 7, required an independent reviewer to verify that responses to the Design Evaluation Questions had been properly addressed and that the discipline portion of the design change was complete and technically accurate.

c 5

I ,'

^

ICS ICS (LOW VACUUM) TRAIN A TRAIN B (Low VACUUM)

TRAIN A NSLI CONTROL CONTROL TRAIN 8 NSLI CV 2676 CV 2668 CV 2618 CV 2619 TRAIN A NSL)

OR TRAIN B MSLI B

3, >4 z ATMOS : >f4 Q

?, 8 TRAJN A MSLI CV 2691 SAFETY SAFETY OR VALVES VALVES TRAIN B HSLI HAIN -

• cy pgg7 CV 2692 STEAN ' d CV 2617 AC ,

~ T f nAIN AC d = STEAM CV 2666

u

, TRAIN B EFU -

-TRAIN A EFW STEAM

( .

g

• 3 r SV SV 3 r STEAM GEN CV2613h}{ ]hCV 2663 GEN DC DC 1

TRIP THROTTLE VALVE GOVERNOR VALVE

~ U

) EFW TURBINE PUHP FIGURE 1 ANO-1 MAIN STEAM SUPPLY

• TO EMERGENCY FEEDWATER TURBlNE PUMP

, The team noted that the final design of the EFW system upgrade was submit-ted to the NRC for approval by an AP&L letter dated December 1,1981. The design described in that letter and subsequently approved by the NRC contained check valves to prevent blowdown of the unaffected SG through the affected SG. However, because a similar application of steam check valves had not proven reliable, the licensee subsequently decided to eliminate the check valves from the design and did not perform an adequate 10 CFR 50.59 review to determine if an unreviewed safety question existed.

At the completion of the onsite inspection activities, the licensee was in the process of installing check valves in the steam supply lines to the EFW turbine to correct this deficiency.

Contrary to the requirements of 10 CFR 50, Appendix A, General Design Criterion 34, the EFW system did not have suitable redundancy in components and features and isolation capabilities. Assuming a single failure, no assurance was provided for proper safety system function for onsite electric power system operation (assuming offsite power is not available) and for offsite power system operation (assuming onsite powar isnotavailable). In addition, contrary to the requirements of 10 CFR 50.59, the licensee failed to perform an adequate analysis to determine the existence of an unreviewed safety question.

This item was discussed with the licensee and will remain unresolved pending followup by NRC Region IV (50-313/86-01-01).

2. The licensee had not routinely considered the effect of equipment that is not desi Class 2)gned to meet maximum on equipment design that is designed to basis earthquake meet maximum requirements design (seismic basis earth-quake requirements (seismic Class 1) at ANO-Unit I when preparing the civil portions of design change packages. The team was informed by the licensee's engineering personnel that no requirements existed to perform seismic Class 2-over-1 evaluations, either as part of the AN0-Unit I design change process or original design. In scope, licensee Procedure CEQN-00002-0 indicated that all AN0-Unit 2 DCPs are evaluated for poten-tially hazardous seismic Class 2-over-1 interactions but that Unit I design changes are evaluated only at the direction of the lead engineer.

This approach appears to be contrary to FSAR commitments. The FSAR states in a description concerning the design of seismic Class 1 piping systems that:

"Where Class I seismic structures are directly connected to or in close proximity to Class 2 seismic equipment and piping systems, the failure or excessive movement of the Class 2 seismic systems are restrained in such a way as not to cause a failure of Class I structures."

The licensee had interpreted this statement to mean that seismic Class 2 equipment and piping systems will not interfere with seismic Class 1 structures. The licensee did not consider safety-related seismic Class I systems and components to fall under the domain of seismic Class I structures; therefore the licensee did not routinely consider seismic Class 2-over-1 interaction.

o 7

l

The team observed no documentation of instances where seismic Class 1/

Class 2 interactions were evcluated, with the exception of minor statements in response to DCP Design Evaluation Questions and redesign of the support system for the EFW pump room chiller (DCP 80-10838). The inspection team considered a seismic Class 1/ Class 2 evaluation of service water piping located in the EFW pump room to be inadequate because it appeared to assume I that the initiating event was a pipe break and not a seismic event. The l potential for pipe movement (i.e., seismic shake space) or hanger pullout l considering dead weight and seismic accelerations was not addressed. The analysis concluded, without documented justification, that two hangers provided at both ends were adequate to support the weight of the pipe.

The lack of consideration for seismic interaction will remain unresolved pending clarification of the requirements for ANO-Unit 1 (50-313/86-01-02).

3. Civil design calculations of structures with multiple degrees of freedom did not always consider the effects of seismic forces acting simultaneously.

Specifically, the team found that the seismic support design of the EFW pump room chiller was a structure with two degrees of freedom in the horiz-ontal direction but, in the analysis (Calculation 80-D-10838-01), it was assumed that seismic movement can only occur in one direction at a time.

The following discrepancies and errors also were noted:

a. The calculation did not combine the maximum values of responses for each of the two applicable orthogonal spatial components of an earth-quake to obtain a combined representative maximum value. In addition, a nonconservative section modulus was used because of an assumption to consider seismic movement in only one degree at a time. The analysis used a section modulus of 1.07 from the AISC Steel Construc-tion Manual for the angle iron use. 4 e support design; however, trans-fonnation about the principal axis was apparently not considered to evaluate bending stress. The team determined that the correct section modulus would be approximately 0.714, indicating a less conservative design.

b. The analysis did not include a design evaluation of the connection between the angle iron and the frame of the chiller. The team was informed that the connection was welded and that the design adequacy of the connection was performed by inspection without docuinentation.

c. In conducting the design verification of the calculation, the checker performed an alternate calculation which applied inappropriate design equations. The checker used AISC Steel Construction Manual equation 1.5.1.4.5.2 which dealt with struts in compression and not angles in compression and/or tension.

l

d. Design input was incorrectly stated and, in one instance, an incorrect reference was identified. A critical damping value of 2 percent was used in the calculation instead of 0.5 percent as indicated. Addition-ally, the reference identified as the source of the maximum peak vert-ical acceleration was incorrect because it referred to a seismic response spectrum for horizontal accelerations.

4 8

. Although the team found the design of the EFW pump room chiller i seismic supports to be adequate when the two horizontal degrees of freedom were considered, the team was concerned that similar seismic calculation errors may exist for the design of other seismic

l. supports. This item will remain open pending further NRC review of the licensee's method for performing seismic calculations (50-313/86-01-01).

4. Post-modification testing in the form of an adequate service test was not performed on the recently replaced station batteries to conclude that these batteries had sufficient capacity under design conditions to perform their safety function. The following observations pertain:

a. DCP 83-1032 was issued to replace the Class IE station batteries.

As part of this replacement, the design change included the require-l ment to perform a 2-hour service test using the duty cycle from l calculation GE-83D-1032-01. In response to this requirement, a i service test was performed for battery D07 under ANO Job Order 058396 l

on March 24, 1984. The team reviewed the test data and determined l that this initial service test did not include all the necessary f

design requirements, such as corrections for minimum design tempera-ture. In addition, it did not appear that the test discharge current was corrected for the average cell electrolyte temperature at the start of the test. Temperature affects the response of the battery so that test temperature must be accounted for in order to have a

' common reference point. Additionally, the team could not confirm.

what the actual test current was because the test data sheet did not record the actual test current but instead referred to a specific sheet of the battery sizing calculation for the test profile. The calculation sheet that was referenced for both the D07 and D06 bat-teries did not contain any test profile.

Another problem with the test currents was that the licensee measured battery voltage at half-hour increments, completely missing the critical discharge period at 1 minute into the test where the battery sizing calculation indicated the voltage would be most limiting. The test results indicated less than one-half volt difference in battery voltage during the test. A discharge voltage profile calculation for the latest duty cycle (which was similar to the original duty cycle for the first 30 minutes) indicated voltages should be 5 to 12 volts below what the test results showed.

b. DCP-83-119 was issued to modify the de system components, including removal of two cells from each of the station batteries to reduce the de system voltage. The newly configured battery was then tested per Special Work Plan'1409.29 using a performance discharge test to meet the Technical Specifications requirements for battery testing.

During the performance of this test, the average battery temperature was determined to be 82 F. To determine the actual test discharge current, the battery current for an 8-hour discharge was corrected for temperature. However, the team had the following concerns:

o 9

(1) The temperature correction factor used was not for 82*F.

The procedure permits the use of battery room temperature if many hours have passed since the average electrolyte temperature was determined. The data sheet did not record if room temperature was used or what that value was.

(2) The temperature correction factor that was used was incor-rectly applied by multiplying the rated discharge current-by this factor to give, in this case, a lower test current.

This method was in disagreement with industry standard IEEE 450-1980, which was included as a referenced document.

IEEE 450-1980, Section 5.3, states that the rated discharge current should be divided by the temperature correction factor. This would have increased the required discharge current instead of decreasing the current, resulting in a lower capacity in the battery than what was determined in the perfomance test.

ANSI N18.7-1976, " Administrative Control and Quality Assurance for the Operational Phase of Nuclear Power Plants," Section 5.2.19.3, requires that modifications that affect functioning of safety-related systems or components be inspected and tested to confirm that the modifications or changes reasonably produced expected results and that the change does not reduce safety of operations. Contrary to the above, the modification acceptance tests for the station batteries did not confirm the expected results because the tests included incorrect discharge currents and the service test did not have an appropriate acceptance criteria (i.e., it failed to measure the voltage at the critical period). This issue was discussed with the licensee and will remain unresolved pending followup by NRC Region IV (50-313/86-01-03).

5. In some cases, mechanical design change packages were found to be reviewed and approved without completion of all design calculations or design evaluations for critical design attributes. The following examples pertain:

a. No design analysis was performed to evaluate the consequences of high-energy line breaks when DCP 82-D-1050 was reviewed and approved. Although this design package modified and extended the boundary between high- and low-energy conditions, the consequences of high-energy line breaks (such as a main steam line break within the penthouse area) on the EFW system con-current with a single active failure were not analyzed. Similarly, the team found no design analysis perfomed to assess the impact on other safety-related equipment of high-energy line breaks within the EFW steam piping. In response to this observation, the licensee showed the team a March 12, 1981, letter to the NRC, written before the design package was prepared. Without apparent design analysis, this letter concluded that a break in the steam supply piping for the turbine-driven EFW pump would not adversely affect other critical 10

, ._m. _ . _ . . - ., .2." "

• 6 EFW components and that once the break is isolated, the plant could be brought to a safe shutdown condition, assuming a concurrent failure of the motor-driven E N pump by using the normal feedwater system or the high-pressure injection system. The team concluded that the design configuration being assessed by the licensee in the

- March 1981 letter was not the same as that described in the actual design package (i.e., check valves not installed, see observation 1 of this section). The single failure postulated by the licensee may not have been the most severe (i.e., loss of bus resulting in loss of motive power to isolate the break and loss of the motor-driven pump). The team also concluded that the assessment did not address the consequences to EFW piping and components of other high-energy

line breaks.

b. Although the EFW system was upgraded to be safety-related by the design change packages reviewed, design analysis was not performed nor was an engineering review of original architect engineering analysis performed to determine if safety-related room cooling was required while both EFW pumps were operating. In response to the team's concern, the licensee provided design analysis used to establish the environmental equipment qualification pressure and temperatures. Review of these analyses indicated that they are for three high-energy line breaks outside containment. These breaks are two letdown line breaks and a main feedwater line break. Although

. the consequences of high- energy line breaks outside of containment ,

need to be considered in developing equipment environmental conditions 4

for qualification purposes, those consequences may not be the most severe condition under which safety-related EFW equipment must operate.

The lack of design analysis in the cases cited above appears to be contrary to the requirements of ANSI N45.2.11, Sections 4.1 and 4.2, which require that design analysis be performed in a planned, controlled, and correct manner and that there exist traceability from design input through to design output. This item was discussed with the licensee and will remain unresolved pending followup by the NRC Region IV (50-313/86-01-04).

6. Numerous calculations and design analyses reviewed failed to meet the design l control requirements of ANSI N45.2.11 by not documenting inputs and assumptions, l by not ensuring a correct niethodology was used, and by not ensuring that the '

calculations were sufficiently completed to permit verification without recourse to the originator. The following examples pertain:

a. Calculation GE-830-1032-01, dated January 25, 1984, established an emergency duty cycle for the station batteries and determined 4

the battery size required to replace the existing batteries.

This calculation referenced industry standard IEEE 485 for sizing large lead storage batteries; however, it only included a correction factor for aging and neglected any correction factors for operation at minimum temperature. Procedure 1307.006, "D07 1

4 l s 9

11

}

4 v-v v - - v w w e-- -w- -3=--a-v=--=-w W- s- --t--w--- e?---'--&-w- r ewa=* * - -e ww --wr--vr- w-r, r-we-t-w-- -e- m-i- e y a su r- '- -e> s' e*'=v- r-":r- t-ri- r v~+- ---r

Quarterly Surveillance," monitors cell electrolyte temperature and contained an acceptance criteria of 60 F as the minimum battery temperature. Manufacturers normally rate their batteries at 77*F. This 17'F temperature difference would result in a loss of capacity of approximately 11% according to the industry ,

l standard referenced in the calculation. This calculation l concluded that the battery was sufficient for an 8-hour discha rge. The following additional weaknesses were observed in this calculation:

(1) No justification was included in the calculation to permit the reduction of the safety-related inverter loads from 75 amperes to 10 amperes after 30 minutes into the design discharge.

(2) M0V starting currents had not been considered as part of the first minute discharge loads.

' The team reviewed the battery sizing performed by the manufacturer on March 17, 1984, and noted:

1 (1) The manufacturer's sizing calculation used cell discharge current capabilities that were substantially lower than those for the same size battery cell used by the licensee in both the 1983 or 1984 calculations.

1 (2) The manufacturer's calculations were based on a different l 4-hour profile than what was used by the licensee.

(3) The manufacturer's calculation noted that no correction factors were included for temperature compensation because no minimum operating temperature requirement was specified by AP&L.

b. Calculation 83D-1032-05, dated July 9, 1985, revised the battery sizing calculation (discussed in observation 6.a) to include a de power panel load study, a revised inverter de load demand based on actual measured inverter loads, and MOV motor inrush currents. The calculation again concluded that the batteries would adequately supply an 8-hour duty cycle. The team noted that temperature correction again was not included in the calcu-lation of the required cell size. The following weaknesses were noted with the determination of the new inverter loads:

(1) These loads were based on a measured inverter loading during normal plant operation and did not appear to consider maximum design values.

(2) The de loads were not measured but calculated from the inverter output ac load using assumed inverter efficiencies.

These calculated de loads were 20 to 30 amperes less than the values the team read from the inverter dc input current anneters while the plant was in a normal shutdown mode.,The licensee initially stated that the team's readings were in error because of the inaccuracies of the inverter dc meter 12

but then agreed that the assumed inverter efficiencies were in error.

c. Battery sizing calculation 83-1032-06, dated January 24, 1986, was developed in response to the team's concerns and was performed to verify that the AN0 batteries would meet the Unit-1 FSAR minimum requirement for a 2-hour discharge.

The team noted that a new manufacturer's cell discharge charac-teristic curve (D-699-1A, 6/84) was attached to this calculation to justify the latest cell discharge capability. These new cell capabilities were greater than those used by the manufacturer in the 1984 calculation but less than those used by AP&L in its 1983, 1984, and 1985 calculations. This most recent calculation also included the correction factors for aging and minimum operating temperature. The inverter load valas used were based on a measurement taken during plant shutdown without justification as to why a margin should not be used for meter inaccuracy or increased load during a design-basis event.

d. Calculation 80-1083A-02, dated January 14, 1986, was developed to determine the voltage at the terminals of newly installed de motor-operated valves. This calculation assumed that the voltage available for operating the valve motor was solely a function of the capacity removed from the battery; no consideration was given to any loss of the battery's capability because of aging or minimum acceptable operating temperature. This calculation was superseded by Calculations 80-1083A-04 and 83D-1032-07, both dated January 24, 1986, and prepared in response to the concerns of the inspection team. These calculations correctly developed a battery voltage profile based on the corrected rate of discharge and the actual capacity removed from the battery. The voltage drop from the batteries to the motor control centers had also been factored into the calculation of motor terminal voltage. New feeder lengths, based on the cable pull slips from the motor control centers to the valves (longer than these used in the original calculation, 80-1083A-02) were also beluded.

The original tiOV terminal voltage calculation acceptance criteria was based on a telecon between AP&L and the valve actuator manufac-turer. These latest calculations (80-1083A-04 and 83D-1032-07) did not reference any new acceptance criteria but concluded that the resulting lower torque developed was still sufficient even with the lower voltage at the valve motors. The team noted that these latest calculations showed the torque developed at valve CV-2870 was 7.32 ft-1bs and that the acceptance criteria used in the original calculation for this valve was 10 ft-lbs. The team requested con-firmation that the acceptance criteria referenced in the original calculation was sufficient to operate the ANO valves under design requirements. AP&L was not able to produce a valve-actuator sizing analysis during the inspection to confirm the required motor starting torque.

13

4

e. Calculation 83D-1032-02, dated February 17, 1984, was prepared to show the acceptable short' circuit withstand capability of the existing dc distribution system components with the new larger batteries. This calculation justified a potential problem that

-the power panels that were rated only for 10,000 amperes could

-potentially experience a short circuit slightly higher than rating. The team identified other de components, such as the battery chargers, that were not included in the analysis but l could add to the short_ circuit. The licensee noted that the '

calculation did not include consideration of the existing fuses or additional cabling to the new battery disconnect switches that would ensure that current would remain below the panel rating.-

r

f. Calculation 84E-0083-12, dated November 19, 1985, included a

. protective relay study for breaker A311 feeding the EFW pump motor. This calculation failed to document the source of the safe stall time, starting time, or locked rotor current used in the calculation.

g. No calculations were performed by the licensee to detennine motor-operated valve overload heater sizing. The team noted that the heaters that were installed for the de motor-operated valves were selected by the motor control center vendor, apparently based upon a continuous duty motor. The de motors used on the ANO-1 valve actuators are short-duty-rated motors.

The team estimated that heaters selected in accordance with the valve actuator manufacturer's recommendations could be approximately five sizes smaller than those presently installed I

at ANO. These smaller heater sizes would still permit a valve stroke time approximately twice the acceptance time required by

the valve surveillance procedures. -

Calculations did not consistently identify inputs and assumptions or provide sufficient detail to permit technical review and verification without recourse to the originator. These calculation deficiencies, as discussed in subparagraphs 6.a through 6.g above, appear to be contrary to the design control requirements of ANSI N45.2.11, Section 4.2. Similarly, contrary to the design control requirements of i' Section 6.2, the verification process did not consistently confirm j that inputs were correctly selected, that assumptions were reasonable

' and appropriate, and that an appropriate design method was usnd. '

i This item will remain unresolved pending followup by NRC Region IV (50-313/86-01-05).

7. A large number of controlled design documents and drawings contained errors and omissions. Based on the number and type of discrepancies identified, the implementation of configuration control activities were considered weak. The following examples pertain:

L a. Piping and instrumentation diagrams were found to have incorrect valve positions, incomplete locked positions indicated, and

. missing instrumentation bubbles.

4 14 i

- . - - , - ,, ,n,. , , , , , - - - - , , - , - r, ,,n- n - n . - - , - ,,,-,.,,,,... _. n -.,-,-,n - _.n ,n,__. .. ,,_ ,,, n -------,-e.- ,n,m--

9 The following deficiencies pertain to drawing M-204, Sheet 3 of 4, " Piping & Instrument Diagram, Emergency Feedwater," Revision 2:

(1) Manual valve CS-2802C was indicated as normally open; however, the valve was actually normally closed.

(2) Manual valves FW-11A and FW-118 in the pump recirculation lines to EFW pumps 7A and 78 were shown as normally open valves; however, these valves were actually locked open valves.

The following deficiencies pertain to drawing M-206, Sheet 1 of 2 " Piping & Instrument Diagram, Steam Generator Secondary System," Revision 45:

(1) EFW turbine steam supply valves CV-2617 and CV-2667 were indicated as normally closed; however, these valves were actually normally open.

(2) CV-2619 and CV-2676, block valves for atmospheric dump valves associated with steam generators B and A, respectively, were indicated as normally open; however, the valves were actually normally closed.

(3) When CV-2617 and CV-2667 were changed from normally closed to normally open valves, Note 4 of the P&ID was not revised or deleted. Note 4 states, with respect to the bypass valve around CV-2667, that a " single failure analysis requires only one bypass valve. A bypass around CV-2617 is not required."

The following deficiencies pertain to AP&L Drawing M-232,

" Piping & Instrument Diagram, Main Steam," Revision 33:

(1) Instrument bubbles were not shown for the handswitch and selector switch for CV-2613 and CV-2663 (EFW turbine steam admission valves).

(2) CV-2613 and CV-2663 were shown as normally open valves; however these valves are actually normally closed.

The following deficiencies pertain to AP&L Drawing M-212, Sheet 1 of 2 " Piping & Instrument Diagram, Plant Makeup Domestic Water Systems," Revision 29:

(1) Condensate storage tank supply isolation valve CS-19 was shown as a normally open valve; however it was actually a

, locked-open valve.

(2) CV-4201, the heating steam supply valve to the condensate

, storage tank, was shown as normally open when it was actually normally closed.

15

b. The piping design specification for ANO-Unit 1, M-84, " Piping Class Drawing," Revision 22, contained errors and was not adequately controlled. The following deficiencies pertain:

(1) DCP-80-10838 identified that a revision to the piping design specification was required to add a new piping classification identified as Class DBD. Drawing control records did not indicate that a change was in progress as would be indicated by assignment of a modified drawing revision number for the affected pages as required by AP&L Design Document Control Procedure 1032.11.

(2) Pages 1 and la, the list of effective pages, of the pipe design specification M-84 were compared with the Document Control copy of M-84. Eight errors were identified corresponding to missing pages or incorrect revision numbers. The team also found an uncontrolled copy of M-84 in use which differed from the controlled copy by one.page.

c. The Instrument Index, a controlled design document, contained errors and omissions. In particular, the document omits approximately 22 safety-related EFW instruments and does not identify 30 other items as safety-related. The following safety-related EFW instruments were not listed in the Instrument Index:

CV 2869, CV 2870, F0 2800, F0 2801, HS 2869, HS 2870, I/P 2618 I/P 2668, SS 2613, SS 2617, SS 2619, SS 2620, SS 2626, SS 2627, SS 2663, SS 2667, SS 2670, SS 2676, ZS 2613-1, ZS 2663-a, ZS 2869, and ZS 2870.

The following safety-related EFW instruments were in the Instrument Index but were not identified as safety-related:

CV 2613, CV 2619, CV 2626, CV 2627, CV 2663, CV 2666, CV 2676, CV 3850, CV 3851, HS 2619, HS 2676, HS 2800, HS 2802, HS 2805, HS 3850, HS 3851, SV 2613, SV 2663, ZS 2617, ZS 2619, ZS 2626, ZS 2627, ZS 2667, ZS 2676, ZS 2800. ZS 2802, ZS 2803, ZS 2806, ZS 3850, and ZS 3851.

The team noted that the licensee was currently in the process of identifying all safety-related plant equipment on a component level basis to create a new Q-list. This effort appeared to be extensive and should resolve any future concerns of safety-related component classification.

d. The following drafting errors or incorrect infomation were noted on controlled drawings.

(1) On drawing M-206, Sheet 1 of 2, " Piping & Instrumenta-tion Diagram, Steam Generator Secondary System," revision 45, a cloud around a portion of the drawing that was i previously revised was not removed (see H-7 of the drawing) . The licensee used clouds on drawings to indicate the area of the drawing that was last changed.

16

b (2) Drawing M-402, Sheet 3 of 4, " Functional Description &

Logic Diagram Condensate Feedwater System," Revision 14, contained the following incorrect statement: " Suction lines are furnished with 5 motor-operated valves, CV-2800, CV-2801, CV-2802, CV-2803, and CV-2806, and a solenoid operated valve CV-2804." However, CV-2801 and CV-2804 did not exist in the current system configuration.

(3) The logic diagram for CV-2869 was described as " Emergency F.W. Pump 7A Auto Recirc Valves" when in fact it was the EFW pump 78 full-flow test isolation valve. Auto recirculation valves were FW-10A (pump 7A) and FW-108 (pump 78).

(4) Drawing M-402, Sheet 3, " Logic Diagram Condensate Feedwater System," Revision 15, showed a seal-in feature for EFW valves CV-2620 and CV-2627. This did not agree with schematic E-293, Sheet 1, Revision 8, which showed this

, seal-in feature deleted.

(5) Drawing M-402, Sheet 3. " Circuit for EFW Pump Suction

. Valves," incorrectly showed the indicating light at the full travel position in disagreement with all other circuits and the schematic E-296. This drawing also did not include a seal-in circuit around the momentary switches in disagreement with the schematic E-296.

(6) Drawing M-404, Sheet 3, "MS ATMOS Dump Valve Logic,"

Revision 3, showed seal-in around manual switch HS 2676 which did not agree with schematic E-442, Revision 5. This drawing also incorrectly showed a high closing torque

switch shown in opening circuit.

(7) Drawing E-442, "MS ATMOS Dump Valve Schematic," Revision 5, incorrectly references drawing E-84, Scheme A, which was for a 480-Vac reversing starter with no engineering safeguards relays.

(8) Drawing E-A6, Sheet 1, " Schematic Diagram EFIC Trip Relay Assembly," Revision 0, incorrectly identified the right scheme as a IE to IE trip module assembly, it should be IE to non-1E.

(9) Drawing E-293, Sheet 1, " Schematic Diagram EFW Steam Generator Isolating Valves (DC)," Revision 0, referenced E-96 for internal wiring of the de reversing starter. The wire numbers shown did not agree between the drawings for the negative leads for the series winding or the remote indicating lights so that one cannot determine if the remote lights will indicate an open thermal overload relay contact (device 49). The hand switch contact development did not indicate the reference circuit for the switch contacts. This was typical of most circuits reviewed by the team.

17

• (10) Drawing E-293, Sheet 2, " Schematic Diagram EFW Steam Generator Isolation Valves (AC)," Revision 1, incorrectly referenced drawing E-96 for internal wiring of this ac reversing starter. Drawing E-96 was for dc starters.

(11) Drawing E-294, " Schematic Diagram Emergency FW Motor Driven Pumps," Revision 10, did not indicate 'an immediate start signal if the offsite power is available through breaker A-309, as indicated in the logic diagram on M-402, Sheet 3. The alarm circuits for this drawing included a pump low-discharge-pressure alann but not the high-discharge-pressure alarm indicated on logic diagram M-402. Additionally, the setting of the time delay of relay 174-311 of 65 seconds disagrees with the setting of 110 seconds indicated on logic diagram M-402.

(12) Drawing E-295, Sheet 1, " Schematic Diagram EFW Turbine MOVs," Revision 21, referenced motor starter internal wiring scheme A on drawing E-84. Scheme A2 on drawing E-84 referred to this circuit.

(13) Drawing E-295, Sheet 3, " Schematic Diagram EFW Turbine MOV's," Revision 1, included a pump low-discharge-pressure alarm but not the high-discharge-pressure alarm indicated on logic diagram M-402.

(14) Diagram E-295, Sheet 4, " Schematic Diagram EFW Turbine MOVs," Revision 1, was found to be in error. An interlock in the valve open circuit from the 42R auxiliary contact was shown to use terminals 8 and 9. According to drawing E-96, these terminals are actually wired to the 42F auxiliary contact.

(15) Drawing E-295, Sheet 4A, "EFW Turbine M0V's " Revision 0, incorrectly referenced a " green" power supply panel for a

" red" circuit. However, the circuit was actually wired correctly. The adapter table for this drawing did not identify the power supplies, and the contact development for relay 42X-M084 failed to identify the applicable

, circuit for contact IH-1G.

(16) Drawing E-315, Sheet 1, " Schematic Diagram Steam Genera- '

tor Isolation Control," Revision 15, had the following errors: The contact for relay 63X1/1 was incorrectly shown

' as relay 63X/1. The coil for relay 62-3 was incorrectly labeled 63-3. The time delay for relay 62-3 was shown as two different valves on the same sheet. The time delay for relay 62-2 conflicted with the time delay for same relay shown on drawing E-317-3.

(17) Drawing E-318, Sheet 1, " Schematic Diagram EFW Recircuit i Test Isolation Valve," Revision 22,3/5/85, indicated that j

, valve CV-2870 had a 1/3 hp motor. The valve data sheet indicated that CV-2870 had a 0.72 hp motor.

I 18 l

(18) Drawing E-331, Sheet 31, " Schematic Diagram," Revision 1, 1/3/85, incorrectly identifies power panel RS2 as a 120-Vdc power source. This power panel was actually an ac supply.

The team was concerned that inaccurate design drawings could cause.

design engineers to perform design activities incorrectly. For example, the incorrect depiction of valve position and the lack of correct locked indication can cause a design engineer to perform single failure analyses and safety evaluations incorrectly. In at least one instance, the team noted that drawing errors appeared to have an adverse effect of safety-related activities performed by an AP&L contractor. Specifically, a contractor performing Q-List determinations did not identify instruments SS 2619 and SS 2663 as safety-related apparently because the piping and instrumentation diagram had those instrument bubbles missing from the drawing.

ANSI N45.2.11, Section 7.1, requires that personnel be made aware of and use proper and current instructions, procedures, drawings and design inputs. Design documents and changes to them are to be controlled to ensure that correct and appropriate documents are available for use. Contrary to this requirement, drawings affected by design change packages had not been consistently revised to accurately reflect the as-installed condition. The drawing deficiencies identified above will remain an unresolved item pending followup by NRC Region IV (50-313/86-01-06).

8. The licensee considered the FSAR to be a design document and a suitable source of design input; however, the FSAR was not maintained as a design document and was found to contain errors. Energy Supply Department Procedure 202, " Design Process Procedure," contained a form to be used to ensure that all appropriate design documents were revised to reflect design changes. This fonn identified the FSAR as a controlled design input document. The team was informed that the FSAR was considered to be a design document suitable as a source of design input for calculations. However, the team determined that the FSAR was only updated yearly and that engineering and design personnel were not in a position to readily know what design changes were pending incorporation between updates.

The team identified the following errors in the FSAR:

a. FSAR Section 7.2.3 described i.he integrated control system (ICS) and stated in subsection 7.2.3.2.4, "...upon loss of all reactor coolant pumps, and/or both main feedwater pumps, the ICS starts the emergency fee 6ater pump and positions control valves to control flow to the emergency feedwater header." This incorrect statement should have been revised when the EFIC system was installed as indicated in Amendment 3 of the FSAR.

b. FSAR Section 9.9 described the compressed air system and states,

" Tables 9-27 and 9-28 list all the air-operated seismic Category 1 valves and ventilation systern dampers." However Table 9-27 did not include the atmospheric dump valves CV-2618 and CV-2668.

These valves were seismic Categort I and received air from the instrument air header or instrument air accumulators.

c. FSAR Section A.7.2 "MS To Emergency Feedwater Pump Turbine Driver," described the evaluation perfomed to'detemine the effects of a high-energy line break in the steam supply to the EFW turbine pump. The piping and valve arrangement described did not account for the modification perfomed for the EFW system upgrade. Specifically, the arrangement described indicated that CV-2667 and CV-2617 were nomally closed isolation valves such that high energy (conditions above 275 psig and 200*F) did not exist downstream. When DCP 82-D-1050 was issued, this arrangement was changed so that CV-2667 and CV-2617 were made nomally open causing high-energy line conditions to exist downstream of these valves.

d. FSAR Table 1-1 described design parameters for various >

components at ANO-Unit 1. In describing the EFW pumps, the design head was listed as 1100 psi and the corresponding design flow was 760 gpm. However, Technical Specification 4.8.1.a indicated that the pumps must produce 500 gpm at 1200 psi discharge head. Design conditions based on Calculation 80-D-10838-102 indicated that the operating point for EFW pump 7A was 720 gpm at 1295 psi discharge pressure and for EFW pump 78 it was 610 gpm at 1250 psi discharge pressure.

Although the team observed that the FSAR was not normally used as a source of design input, the team was concerned that it was apparently procedurally pemitted. The team found one instance where the FSAR was used as a reference for design input instead of appropriate design documents like drawings and design calculations. Calculation MB-1-22, " Emergency Feedwater Pump Switchover To Other Water Sources," Revision 0, referenced the FSAR Section 10 instead of appropriate design analyses or vendor drawings as its source to obtain the condensate storage tank depth when 107,000 gallons are remaining in the tank.

The use of the FSAR as a design document and a source of design input was considered a weakness. The errors in the FSAR identified above were discussed with the licensee. This issue will remain open  :

pending the correction of these errors in the next routine FSAR l revision (50-313/86-01-02).

B. Maintenance

1. Several weaknesses were noted with the licensee's program for conducting maintenance and testing on motor operated valves (MOVs) in the emergency feedwater (EFW) system. These weaknesses included:

Licensee personnel were generally unaware that M0V torque switches for ANO-Unit I were only bypassed during initial valve movement and that improper torque switch settings could prevent the EFW system from completing its safety function.

This lack of understanding was apparently due to a design difference in MOVs between Unit-1 and Unit-2. In ANO-Unit 2, PiOV torque switches are bypassed for full valve travel.

o 20

Torque switch settings were made by licensee personnel without reference to the minimum recommended values provided by the vendor. The team reviewed selected MOV torque switch settings and found them to be set low; in one case, the setting was below the value used for manufacturer testing.

MOV limit switches appeared to be set to bypass torque switches for an insufficient amount of initial valve travel. The purpose of these limit switches was to bypass the torque switch until the valve was fully off its shut seat, thereby providing some assur-ance that the torque switch would not prematurely stop valve motion.

EFW system MOVs located in the pump discharge piping were not tested under flow conditions to ensure that they would operate as expected.in emergency situations.

Five MOVs were found to be missing valve stem housing end caps and a significant amount of debris was found in the stem cavities. This increases the potential for valve binding that could result in premature torque switch actuation to stop valve motion.

Several discrepancies were identified with the MOV maintenance procedures that could confuse personnel performing maintenance.

Details regarding these weaknesses are provided below:

a. Interviews with licensee personnel revealed that they were generally unaware that torque switches were only bypassed during initial valve movement in an automatic initiation of the EFW system. This is significant because torque switches improperly set with low values could actuate prematurely, causing the MOV to stop in mid-stroke during an automatic initiation. The ANO-Unit 2 auxiliary feedwater system valves appear to have their torque switches bypassed through full valve stem travel during an automatic initiation to ensure that MOVs complete their safety function. However, this was not the case for the ANO-Unit 1 EFW system. Discussions with training instruc-tors, operating personnel, electricians, maintenance engineers and supervisors indicated that this difference was not widely known. This issue was of particular concern because of the other weaknesses discussed below regarding the setting, testing, and bypassing of MOV torque switches.

b. Interviews with licensee personnel revealed that torque switches initially were set by electricians and field engineers during MOV installation and later were adjusted by electricians during valve maintenance. These interviews also revealed that engineering judgement was the basis used to initially set the torque switches and then actual valve operation under no-flow conditions typically became the basis to readjust the settings.

Limiter plates were installed to prevent setting torque switches '

too high and MOV maintenance procedures specifically cautioned against setting torque switches above the upper limit. However, MOV maintenance procedures did not address lower torque switch I i

21

limits and vendor recomendations for minimum set points were not referenced when the torque switches were set. The torque switch settings were recorded on Job Order (J0) data sheets and reviewed as part of the nomal JO closeout, but lower limits for torque switches settings were not available for the reviewing parties to compare to the actual settings.

The team reviewed actual torque switch settings for eight EFW system MOVs. The significant data from this review is provided below:

Actual Torque Valve No. Description Operator Switch Settings

_0p_en Close CV-2613 P7A Stm Admission SMB-000 1.5 1.5 CV-2617 OTSG B Stm Supply SMB-000 3.5 3.0 CV-2620 P7A to S/G B Isol. SMB-000 2.0 2.0 CV-2626 P78 to S/G B Isol. SMB-00 1.5 1.5 CV-2627 P7A to S/G A Isol. SMB-000 1.5 2.5 CV-2869 P78 Test Recirc Isol. SMB-C0 1.5 1.5 CV-2870 P7A Test Recirc Isol. SMB-00 1.5 1.5 CV-3851 Loop II SW Supply SMB-000 2.0 2.0 The torque switch adjustment scale ranged from a minimum of 1.0 to a maximum of 5.0. As illustrated by the data in the above table, the torque switch settings were typically set at the low end of the scale for the EFW system valves. This was a particular concern for the EFW discharge valves (CV-2620, CV-2626, CV-2627, CV-2670,CV-2869,CV-2870). During the onsite inspection, the licensee was unable to provide recommended minimum torque switch settings for these MOVs.

After completion of the onsite inspection, the licensee provided the following manufacturer test data for the selected valves:

Manufacturer's Torque Valve No. Test Press Switch Setting 10 en Close CV-2613 1100 ps19 1.5 1.5 CV-2617 1050 psid 2.0 2.0 CV-2620 1792 psig 2.0 2.0 CV-2626 1792 psig 1.25 1.25 CV-2627 1792 psig 2.0 2.0 CV-2869 1792 psig 1.5 1.5 It is not clear that all the manufacturer's test data was obtained under flow conditions because the test pressure was recorded in psig for several valves and the motor run current measurements were inconsistent with ifcensee test data obtained when the valves were installed. However, it does appear from these data that the CV-2627 torque switch open setting was set 22

I

, below the manufacturers testing set points. Additionally, no l manufacturer test results were available for CV-2870 and CV-3851 ,

because the operators and valves were connected by the licensee l without vendor recommendations for minimum and maximum torque switch set points. The apparent failure of the licensee to i translate the vendor-supplied MOV design basis data into applicable controlling documents appeared to be contrary to 10 CFR 50, Appendix B, Criterion III. This issue will remain an unresolved item pending followup by NRC Region IV (50-313/86-01-07).

IE Information Notice 84-10. " Motor-Operated Valve Torque Switches Set Below The Manufacturer's Recommended Value " raised issues that were similar to the findings outlined above. The inspection team reviewed the licensee's internal memorandum regarding this notice. It stated that this issue was not a problem at ANO because torque limiter plates were used; additionally, any changes to torque switch settings were i reviewed in the JO closeout process. This reasoning appears i inadequate because the limiter plates did not prevent setting torque switches too low and the licensee did not maintain a list of recommended minimum torque switch set point values for comparison at JO closeout.

c. Interviews with licensee personnel and a review of the MOV maintenance procedures revealed that limit switches were set to bypass torque switches for only a minimal amount of initial valve travel. Licensee procedures for operator models SMB-00 and SM8-000 directed that the limit switches should be set 1-2 turns off the fully open or closed position. This minimal amount does not appear to be adequate to compensate for the effects of coast or backlash in the operator. This could result in excessive valve backseating or the limit switch actuating before the initial starting torque is fully removed from the operator, which could cause the torque switch to prematurely stop the valve motion. The licensee stated that this issue was currently under review as part of their response to IE Bulletin 85-03, " Motor Operated Valve Common Mode Failures During Plant Transients Due To Improper Switch Settings," but no short-term actions had been initiated to correct this potential deficiency.

d. Interviews with licensee personnel, reviews of maintenance and periodic testing procedures, and inspection of post-modification test packages revealed that not all EFW system MOVs have been tested to ensure they will operate properly under flow conditions.

During the 1984 outage, new steam admission and pump discharge MOVs were installed as part of DCP 80-1083. It appeared that no tests were conducted to verify proper MOV operation during flow conditions nor were any engineering evaluations conducted to verify that torque and limit switch settings were adequate.

An exception to this was the EFW turbine steam admission valves

, (CV-2613, CV-2663) which were tested routinely under system flow conditions during both manual and automatic EFW system initiation.

23

However, the EFW pump discharge valves (CV-2620, CV-2626. CV-2627, CV-2670, CV-2869, CV-2870) had apparently never been fully tested 4

under system flow conditions either by post-modification tests, post-maintenance tests, periodic surveillance checks, or by

actual system initiation. The EFW steam generator isolation valves (CV-2620, CV-2626. CV-2627, CV-2670) and the full-flow test isolation valves (CV-2869, CV-2870) are not nonnally repositioned for EFW system initiation. These valves are expected to operate against full-flow conditions only when an'EFW initiation occurs 3 during system flow testing or if a steam generator isolation

! signal is received during EFW system operation.

10 CFR 50, Appendix B, Criterion XI, requires that components be tested to demonstrate that they will perform satisfactorily in service. This testing shall include proof tests prior to

' installation, pre-reperational tests, and operational tests, as appropriate. The apparent failure to adequately test the EFW system discharge piping MOVs under flow conditions either by pre-installation, . post-modification, periodic surveillance, or post-maintenance tests was considered to be contrary to 10 CFR 50, Appendix B, Criterion XI. This issue will remain an unresolved item pending followup by NP,C Region IV (50-313/86-01-08).

e. During the walkdown of the EFW system, the team identified five MOVs that were missing stem housing end caps. Three valves (CV-2617, CV-2667, CV-2870) appeared to be missing the screw cap, and two valves (CV-2800, CV-2802) had their end caps sheared off.

A significant amount of dirt and foreign material was observed i in the stem cavities of these valves. Debris in the stem cavity could work down into the operator and foul gears or affect bearings, preventing proper valve operation.

f. The team reviewed three MOV maintenance procedures: Procedure 1402.160, "Limitorque Motor Operated Valve SMB-000 Maintenance,"

Revision 3; Procedure 1402.161, "Limiterque Motor Operated Valve i

SMB-00 Maintenance," Revision 1; and Procedure 1402.71, "EIM Motor Operated Valve Maintenance," Revision 2. The following inaccuracies were noted with these procedures:

(1) All three procedures referenced drawing E-195 for a des-l cription of the MOV limit switch (LS) operation. This drawing did not show the Limitorque LS contact scheme and the EIM LS scheme incorrectly showed contact "LSO/G" as j being closed continuously throughout valve travel.

(2) The procedures failed to identify CV-2663, CV-2620, and CV-2870 as dc-powered M0Vs. Further, the procedures failed to include CV-2663, CV-3850, CV-3851 CV-2627, CV-2626, CV-2869 and CV-2870 as Q-listed valves. (See Design Changes, observation 7.c for further discussion ,

of the licensee's Q-list.) '

l (3) Procedurer. 1402.160 and 1402.161 had an incorrect drawing l showing a reversed position of the open and closed I adjustments for torque switches. ,

i 24 i

. (4) Procedure 1402.161 incorrectly listed CV-3851 and CV-2620 as model SMB-00 operators when they were actually model SMB-000.

(5) All three procedures incorrectly stated that closed limit switches should be set to operate off the shut seat to allow for coastdown. This was incorrect because in the closing direction the motor is stopped by the torque switch and the limit switch should be set to provide adequate bypass of the torque switch when unseating the valve or to indicate valve position.

(6) Procedure 1402.71 incorrectly stated that CV-3850 can be modulated when the valve was actually designed with a seal-in feature to prevent throttling.

(7) Procedure 1402.71 had no requirement for independent verification of removal of a test jumper. The test jumper, when installed, bypassed the seal-in feature of the M0V and would interfere with normal valve operations.

At the exit meeting the licensee stated that these procedures were in the process of being corrected. This item will remain open pending inspector review of the licensee's corrective action (50-313/86-01-03).

Collectively, the weaknesses described in observations 1.a through 1.f were evidence of an inadequate program for maintenance and testing of MOVs. Based on the infonnation available to the team during the inspection, the licensee could not verify by testing or engineering evaluation that the current limit and torque switch set points for MOVs in the EFW system were adequate to permit proper valve operation under flow conditions.

2. The team reviewed mechanical and electrical maintenance training and on-the-job training (0JT) for technicians who worked on EFW/EFIC com-ponents. The emphasis of this review was on MOV training. Mechanical maintenance training consisted of generic pump and valve training with no special emphasis on EFW components. Electrical maintenance training was conducted in a laboratory where hands-on motor control center and MOV work could be accomplished. The electrical maintenance laboratory had eight MOV actuators installed (Limitorque, Rotork, and Electrodyne),

six of which were wired and operable. Technicians were able to gain i

hands-on practice in setting limit and torque switches and in making other actuator adjustments and settings. Maintenance training was considered good overall; the presence of operable actuators in the electrical maintenance laboratory was considered a strength.

The licensee was in the process of initiating a new OJT program for maintenance technicians. At the time of the inspection first-line

' supervisors in the electrical maintenance shop were using the records from the old 0JT program to record and determine technician qualifica-tions for assignment to a maintenance task. Both the old and the new

, OJT program appeared adequate for this purpose.

25

3. The team noted weaknesses with the maintenance and testing of EFW system pump P7A conducted at the conclusion of the 1984 outage. During a 1-month period the pump was disassembled and reassembled three times as follows:

December 23, 1984 - Pump P7A was reassembled after outage maintenance and testing (JO 76916).

January 7-8,1985 - Pump P7A thrust bearing was replaced after overheating during surveillance testing (JO 81212).

January 11, 1985 - Pump P7A balance drum shims were replaced at the direction of the mechanical maintenance superintendent (JO75648).

The following deficiencies were noted with the maintenance and testing of EFW pump P7A during this sequence:

a. A new thrust bearing and balance drum shims were installed as part of JO 76916; however, the steps of Section 7.2 of Procedure 1402.09, " Emergency Feedwater Pump Maintenance," Revision 1, which described this process, were marked N/A by the maintenance technician. It appeared that the prescribed maintenance proce-dure was not followed for this involved maintenance activity.

b. The post-maintenance testing conducted on pump P7A during this period appeared incomplete. Procedure 1402.09 provided detailed guidance for taking post-maintenance vibration readings in the horizontal, vertical, and axial directions and required that they be compared to a set of pre-maintenance vibration results.

Despite this detailed guidance, the following post-maintenance testing deficiencies were identified:

(1) The testing documented for the December 1984 maintenance (JO 76916) was not conducted until January 17, 1985.

These data were not representative of the pump configura-tion after JO 76916 since the thrust bearings and balance drum shims were replaced again before testing was conducted.

(2) The testing documented on JO 81212 was missing some axial measurements and there were no pre-maintenance data for comparison. A note at the end of the test data sheet stated that operations personnel had conducted the test as a surveillance test and axial readings were omitted because they were not required for the surveillance test.

(3) There were no post-maintenance test data recorded on J0 75648 for maintenance conducted on January 11, 1985.

Interviews with licensee maintenance personnel revealed that there may be inadequate coordination of post-maintenance and surveillance tests. The survet11ance tests were conducted in all cases to determine operability; but post-maintenance tests apparently were not always performed in accordance

. with procedural guidance. The team was concerned that post-maintenance testing 26

, requirements may not always be satisfied by surveillance tests and that both test programs should be accomplished to ensure equipment reliability. '

The apparent failure by the licensee to follow procedures for the main-tenance and testing of EFW pump P7A will remain an unresolved item pending followup by NRC Region IV (50-313/86-01-09).

4. The inspection team conducted a detailed walkdown of the EFW system to verify that the system layout was as depicted in the system drawings (P& ids), that the system was aligned as required by licensee procedures, and to evaluate the material condition and cleanliness of the system. The following references were used:

System Drawings (P& ids):

i M-202, " Main Steam," Revision 33 M-206, " Steam Generator Secondary System," Revision 45

M-204, " Emergency Feedwater," Revision 2

, Procedures:

1106.06, " Emergency Feedwater Pump Operation," Revision 25 1102.01, " Plant Preheatup and Precritical," Revision 32 The team found that the system layout was as depicted in the system

~ drawings and that the system was aligned as required by the proce-dures. The team considered plant cleanliness and material condition to be generally acceptable. However, several weaknesses were noted during the walkdown:

a. Inconsistencies were found between the system drawings and Procedure 1106.06 concerning the position of four valves:

Position Per Position Per Valve No. Procedure 1106.06 P& ids M-202, M-206 CV-2613 Shut Open CV-2663 Shut Open CV-2617 Open Shut CV-2667 Open Shut The valves were found in their correct positions as specified in Procedure 1106.06. Additionally, the system drawing (M-202) identified one steam trap as "ST-75" instead of "ST-60" as identified by the component label plate and the valve lineup procedure.

b. The team noted the following as related to material condition and cleanliness:

(1) A significant amount of dirt and foreign material was noted in the steam cavity of several MOVs as discussed in maintenance observation 1.e.

1 i

! 27

W we (2) Valves CS-2803 and CS-28048 had missing operator handwheels.

' 1 (3) Numerous vent and drain valves had no pipe caps.

(4) Valves MS-6886, MS-6872, and MS-1053 had no label plate identification.

-(5) . Valve HV-166 was mislabeled as HV-160.

(6) Valve MS-1053 had a body-to-bonnet steam leak. This condition was not previously documented by the licensee.

(7) The cleanliness of the penthouse room containing the l EFW system main steam piping was poor in comparison to the generally good appearance of other spaces containing EFW system components.

c. Several of the concrete expansion anchor bolts associated with these seismic pipe supports in the EFW system were noted to be nonperpendicular to the surface into which they were installed. Additionally, the washer on an installed concrete expansion anchor on pipe support 3-EFW-116-H2O .

was noted to be so loose that it would rotate easily by hand. A later review of this pipe support installation by the licensee revealed that I seven of the concrete expansion anchors had less than the required imbedment depth. The details of these issues regarding concrete expansion anchors will be followed up by NRC Region IV and documented in NRC inspection report 50-313/86-02.

C. Surveillance Testing

1. The licensee was unable to provide the team with calibration data docu-menting the initial post-installation calibrations and functional checkout of condensate storage tank (CST) level indication transmitter LIT-4203.

A detemination of the set point and set point accuracies for the CST low level annunciation function of CST 1evel indicator switch LIS 4203 also was not available. Additionally, surveillance procedures were not developed to periodically calibrate condensate storage tank (CST) level instrumentation. This instrumentation is used by the licensee to verify that greater than 16.3 feet of water is available in the CST as required by Technical Specification (TS) 3.4.1.3. It also provides indication that alerts the control room operators to manually switch-over the EFW water supply from the CST to the service water system, if necessary. The CST level instruments'were installed by DCP 80-1083 and DCP 84-1045 as part of recent EFW upgrade modifications and were considered by the licensee to be functional following the 1984 refueling outage.

Subsequent to these findings, the licensee conducted calibrations on all CST level instruments and initiated Plant Engineering Assistance Request 86-301 to determine set point and set point accuracies for LIS-4203. The apparent failure to calibrate the CST level indicator after installation is contrary to 10 CFR 50, Appendix B, Criterion XI, which requires that testing be perfomed to demonstrate that components will perfom satis-28

I l

1 l

l factorily in service. This issue was discussed with the licensee and will remain an unresolved item pending followup by NRC Region IV (50-313/86-01/10). l

2. Several components were identified by the inspection team for which 18- '

month test requirements were not incorporated into surveillance test pro- l cedures. However, in all examples (except for the CST level instrumen-tation discussed in observation 1, above) post-installation functional testing performed at the completion of the 1984 refueling outage and before restart constituted sufficient initial surveillance testing. The licensee had no apparent administrative controls to ensure the incorpora- '

tion of these surveillance requirements. The team considered that the licensee's failure to maintain administrative tracking of omitted 18-month surveillance requirements constituted a programatic weakness a

that could result in the incomplete surveillance testing of EFW components during the next refueling outage. Specific weaknesses with EFW component surveillance procedures were found in the following areas:

a. Surveillance procedures were not developed to functionally verify j

that the steam admission valves (CV-2667 and CV-2617) to the turbine-driven EFW pump actuate to the required position on an emergency feedwater initiation and control (EFIC) vector logic valve comand.

These vector logic valve commands function to isolate a faulted steam i

generator and to align EFW to the good steam generator. Adequate testing of this function was conducted by Special Work Plan (SWP) 1409.44 during post-modification testing of the EFW system upgrades; however, the licensee had not written a surveillance procedure to periodically perform this functional demonstration as part of the surveillance test program.

b. Surveillance procedures were not developed to functionally demonstrate the adequacy of steam generator isolation valve responses to an EFIC main steam line isolation signal. An EFIC generated main steam line i

isointion signal results in closure of the main steam ifne isolation valves and the main feedwater isolation valves. Testing of these

' responses at least once every 18 months is required to demonstrate component operability pursuant to TS 3.4.1.5. A review of approved periodic surveillance procedures revealed that the response of these valves to an EFIC isolation signal was not tested. Post-installation i functional testing of the EFIC system performed in accordance with l SWP 1409.44 before unit restart following the 1964 refueling outage

provided a sufficient initial demonstration of these functions.

l Retesting of these functions was not required until the next refueling

outage.

The weaknesses in the surveillance testing program discussed in this

! observation will remain open pending followup by NRC Region IV

(50-313/86-01-04).

i

3. Additional instrumentation testing and calibration weaknesses were noted in regard to EFW system components. The following items pertain:

a. Instrumentation and Control Periodic Test, 1304.05 " Emergency

. Feedwater Pressure and Flow Instrumentation," Revision 3, did not 29 i

v . - - - - - - - , . - - , - - . . - - - - , , . , _ _ . _ - . - - , - - - , , _ _ _ . . - - . _ . _ - - - _ - . - _ _ . - . - - - . -

.. verify that control room annunciators PAL-2811 and PAL-2812 (EFW discharge pressure low) annunciate when EFW discharge pressure indication switches PIS-2811 and PIS-2812, respectively, are actuated at the low pressure set point. The test procedure instructed the technician to remove the pressure indication switch from service before calibrating the indicator; as a result, the annunciator was not verified to respond when the switch low-pressure contacts change state during the calibration.

b. The licensee had not developed a procedure to routinely functionally

~

test HS-2646, the Appendix 'R' disconnect switch. HS-2646 is located in the lower south electrical penetration room and provides a method for operators to remove de power from CV-2646 and CV-2648. This ensures that a method is available to remove power from CV-2646 and CV-2648, when required for an alternate shutdown, thereby failing these valves to the open position to ensure an EFW flowpath to the steam generators.

c. The monthly and the 18-month calibration surveillances of EFIC use an internal, hardwired self-test to demonstrate proper operation of the followir.g control module functions:

• Steam generator pressure of 1020 psig

• 31-inch low range level with reactor coolant pumps (RCPs) running (forced flow)

• 312-inch full range level with no RCPs running (natural circulation)

• 378-inch full range level for reflux boiling

• variable steam generator fill rate based on steam generator pressure The team considered that this self-test constituted an appropriate monthly functional verification of control module operability.

However, there was no provision for periodic validation of self-test adequacy. Although the self-test was hardwired into the individual control module, the circuit was composed of components that may be subject to instrument drift or incorrect setting.

Because this internal test circuitry represents measuring and test equipment, the Ifcensee must provide a means to periodically validate the test results.

Additionally, the team did not consider the self-test to be an adequate 18-month channel calibration of the EFIC control module.

In response to this concern, the licensee committed to develop a more conventional 18-month calibration procedure that will input test signals to the EFIC control module and verify appropriate control module responses. Furthermore, after this calibration method has been completed, the self-test will be performed to validate its acceptability for continued use as a monthly functional verification of control module operability.

The weaknesses discussed in observations 3.a. 3.b, and 3.c will remain an open item pending followup by NRC Region IV (50-313/86-01-05).

30

1

. 4. Weaknesses were identified in the in-service testing program for mechanical 1 equipment associated with the EFW system. Specifically, certain check l valves listed in Attachment 2 to Procedure 1022.06, "ASME Code Section XI 1 Inservice lesting Program," Revision 4, as requiring in-service testing were not identified in the supplements to Procedure 1106.06, " Emergency Feedwater Pump Operation," Revision 24. Therefore, these check valves were not documented as having been routinely tested. The following deficiencies were noted:

a. Valves CS-98, CS-99, CS-261, and CS-262 are check valves in the EFW pump suction line from the condensate storage tank (CST). These valves exist two each in parallel lines coming from the CST.

Adequate flow has been demonstrated through these valves in routine pump flow tests. However, since these two lines are in parallel,  ;

the operability and full stroke response of each individual valve 1 has apparently not been demonstrated.

b. Valves FW-55A, FW-55B, FW-56A, and FW-568 are check valves in the EFW pump discharge headers. Adequate flow has been demonstrated through these valves during routine pump flow tests. However, routine testing of these valves was not documented.

c. Valves FW-10A, FW-108, FW-61, and FW-62 are in the EFW pump minimum recirculation flow paths. FW-10A and FW-108 are three-way recircu-lation control check valves that function to provide a recirculation flow path when steam generator pressure exceeds pump discharge pressure. Valves FW-61 and FW-62 are check valves installed down-stream of FW-10A and FW-103. Flow and stroke for these valve combinations is not routinely demonstrated.

The licensee agreed that Procedure 1106.06 will be revised to identify 4

specific testing and documentation for these valves. The failure to provide adequate testing for these valves will remain unresolved pending followup by NRC Region IV (50-313/86-01-11).

D. OPERATIONS

1. The procedures and drawings related to the normal and abnormal operation of the EFW system were reviewed. The following weaknesses were noted:

a. Procedure 1106.06, " Emergency Feedwater Pump Operation," Revision 24, contained inaccurate guidance regarding the operation of motor-operated valves for steam admission to the P7A pump turbine.

Specifically, step 9.3.2 stated that operation of those valves was

. . . the same as the EFW isolation valves." When operating in the manual mode, momentary actuation of the switch in the control room 4

will cause the EFW isolation valves to travel momentarily, but momentary actuation of steam admission valve control switch will cause that valve to operate to full travel as a result of a seal-in feature designed into the motor control circuitry,

b. During a review and walkdown of Procedure 1203.02 " Alternate Shutdown,"

, Revision 12, nothing was identified that would clearly prevent achieving reactor shutdown, but it was noted that substantial 31

- . -- - .- = --. - - - - - - - - - - .. .

4 difficulty would probably be encountered by the operator attempting to control the atmospheric dumps valves (ADVs) for decay heat removal.

In some cases cosuunications facilities were located significant distances away from the alternate shutdown components, such as the EFW flow control valves and the ADV station. Additionally, the battery-powered lighting system at the ADV station failed to operate

. when the test button was pushed. The licensee had corrective action l in progress, initiated before and during the inspection, to correct these conmunications and lighting deficiencies.

2. Procedure 1000.27. " Hold and Caution Card Control " Revision 5, and associated equipment control legs were reviewed. One deficiency was identified: there was no record of an independent verification of i equipment status for the initial hanging of tag 11 (breaker 5116) for tagout 86-1-043 (emergency diesel generator). This was found to be an isolated instance and the licensee took prompt corrective action to verify the status of the equipment.

3. During daily tours of the control room, operations crew personnel were observed to be maintaining plant parameters within specified limits according to approved procedures. The overall level of professionalism i

displayed by the operatorc was satisfactory, with the exception of relaxed

control of nonessential personnel in the control room. On several occasions, 1

non-operations personnel were observed to either remain in the control room after completing official work-related business or were allowed to enter the control room with no apparent work-related reason for being there.

! This condition was observed with the plant both operating and shutdown.

Although no cases were observed of on-watch operators being distracted from their duties, the potential for such distraction was clearly present.

4. Operator training for the EFW system and the EFIC subsystem was combined

into one module which comprised the lesson plan (AA-21002-040, Rev. 2), a i handout, viewgraphs, a slide presentation and a short video tape explaining operation of the turbine-d h.en EFW pump. This material was reviewed for adequacy and technical c: curacy. Minor weaknesses were noted:

a. Page 22 of the handout showed a tabular summary of the EFIC vector valve commands which was incorrect. However, an identical table on page 82 was correct.

b. Figure 66.1 of the handout contained several errors. Yalves CV-2646 and CV-2645 were not labeled, CV-2648 was mislabeled as CV-2621, and CV-2647 was mislabeled as CV-2672.

5. The team examined the effectiveness of operator training for alternate

! shutdown. This training had most recently been conducted as part of l operator requalification and initial qualification training in October 1985. The training consisted of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of classroom instruction, a walk-through of operator actions at each station, and a simulated shutdown with shift operators working at the appropriate stations. Overall, the training for this activity appeared satisfactory. Interviews with operators revealed operational difficulties at some stations (see paragraph 1.b of 4

, this section).

1

) 32 1

6.

.The team examined shift technical advisor (STA) training. The present .

STA training program appeared to meet only the minimum requirements.

One member of the plant engineering staff was assigned to be STA for both units on a rotating basis. This individual would usually conduct his normal job assignments and respond to control room activities on an on-call basis.

l ANO plans to implement a new STA policy and procedure in mid-1986. The new program will consist of trained, dedicated STAS on shift rotation assigned specifically to Unit 1 or Unit 2. The licensee intends for the i STA to have a senior reactor operator license on either Unit 1 or 2. At i the time of this inspection, there were 12 engineers in training for these STA positions. A review of the new STA program and training material revealed that it met the NRC requirements for such training. This new

,t STA program is expected to be a significant improvement over the existing program.

4 E. Quality Assurance '

i The QA audit program was considered weak in determining the effectiveness

, of the ANO-Unit 1 QA program. Similar weaknesses to those found in this

} inspection report were not identified during a review of the more recent

ifcensee audits conducted in the areas of training, operations, surveillance i

test, design control, corrective action, quality control, and engineering services. Also included in this review were two overview audits of the ANO-1 plant staff and the ANO-1 QA program conducted by Middle South Services.

+

The following observations were made relative to the QA audit program: '

I 1. Current guidance in the QA audit / activity plan limits the scope of all audits to a review of audit areas for regulatory compliance and program i implementation. This guidance appeared to be interpreted by QA through

! the conduct of the audits to mean program and procedural compliance without

emphasis on assessing the quality of the end product.

} 2. The last two design control audits and an audit of the licensee's corporate engineering staff in Little Rock provided no technical assessments to evaluate the effectiveness of the licensee's design control program. No significant findings were identified by these audits.

i

3. The training audits consisted of programmatic reviews with specific

observations, such as the following, highlighted in the audit reports

a. Lesson plans were found to be consistent in format.

b. Lesson plans are being maintained in locked storage. >

c. The HP Supervisor reviews general employee radiation protection i training quarterly.

I No assessments, such as determining the adequacy of the training plans,

the effectiveness cf any training accomplished, or the capability of the p-l instructors presenting the training, were made.

l .

33 j

~

+ 4. The quality control document management system audit did not provide technical assessments of the QC group's performance.

5. The corrective action audits appeared to have been a superficial review of the adequacy of the actions taken by the plant in response to identified deficiencies. It was not apparent that any assessment of the root causes for the significant deficiencies adverse to quality were perfomed. The auditors appeared to have focused on the timeliness of the corrective action taken and the ability of the plant to close a backlog of noncon-formance reports.

6. Recent staff increases through contractor hirings and permanent staff additions have provided the QA group with important technical and operational expertise that could serve as a foundation for future performance-oriented assessments.

7. The QA staff lacked technical design expertise.

8. The QA manager and QA supervisor exhibited an understanding of the need for perfomance-oriented assessments and stated that consideration is being given to conducting more performance-oriented assessments.

In summary, the AN0-Unit 1 QA audit program had not provided technical and operational reviews of site quality activities; thus it had not provided plant and corporate management with important feedback on the quality of the activities performed that affect the safe operation of the plant.

IV. MANAGEMENT EXIT MEETING An exit meeting was conducted on January 31, 1986, at Arkansas Nuclear One.

The ifcensee's representatives are identified in the Appendix. In addition, Mr. James G. Partlow, Director, Division of Inspection Programs, IE, and Mr.

James E. Gagliardo, Branch Chief, NRC Region IV, attended the exit meeting.

The scope of the inspection was discussed, and the licensee was informed that the inspection would continue with further in-office data review and analysis by team members. The licensee was informed that some of the observations could become potential enforcement findings. The team members presented their observations for each area inspected and responded to questions from licensee's representatives.

34

r APPENDIX -

Persons Contacted The following is a list of persons contacted during this inspection. There were other technical and administrative personnel who also were contacted.

l *J. D. Vandergift, Training Manager l *R. Tucker, Electrical Maintenance

• H. Carpenter, Instrumentation and Control Maintenance

• D. Jones, Instrumentation and Control Maintenance

! *W. H. Jones, Modification Manager

• J. T. Enos, Manager Nuclear Engineering and Licensing

• D. G. Horton, QA Manager

• G. D. Provencher, QC Supervisor

• A. J. Wrape Electrical Engineering Supervisor

• D. Howard, Special Projects Manager

• J. Levine, Site Director

• T. Cogburn, General Manager Nuclear Services

• D. B. Lomax, Plant Licensing Supervisor

• C. N. Shively, Plant Engineering Superintendent ,

• P. Campbell, Plant Licensing Engineer  !

• B. A. Baker, Operations Manager

• M. Drost, QC Engineering Supervisor

• J. McWilliams, Operations Superintendent

• V. Pettus, Mechanical Maintenance Superintendent

• E. L. Sanders, Maintenance Manager

• R. P. Wewers, Work Control Center Manager

• D. R. Sikes, Engineering Services General Manager

• J. G. Dobbs Engineering Services Electrical Engineer

• W. Cottingham, I&C Engineer

• V. Bardwaj, Electrical Engineer

• R. W. Howerton, Civil Engineering Manager

• W. Greeson, Civil Engineering Supervisor

• D. Williams, Mechanical Engineering Supervisor

• R. Lane, Mechanical Engineering Manager

• W. M. Cawthon, Electriel "cgineering C. Cole, Surveillance Test: : Coordinator W. Garrison, Operations Technical Staff S. Burris, Staff Administrative Assistant S. Capehart, Shift Operator J. Clement, Shift Operations Supervisor S. Fullen, Shift Operator M. Goad, Training Department Instructor C. Zimmerman, Operations Technical Support

• Attended exit meeting on January 31, 1986.

t .-

_ _ _ _ _ _ _ _