ML20235G785
| ML20235G785 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 09/22/1987 |
| From: | Crutchfield D Office of Nuclear Reactor Regulation |
| To: | Trevors G NEBRASKA PUBLIC POWER DISTRICT |
| Shared Package | |
| ML20235G790 | List: |
| References | |
| TAC-66723, NUDOCS 8709300216 | |
| Download: ML20235G785 (4) | |
See also: IR 05000298/1987010
Text
- _ _ _ - _ _ _ _ -
"
. J,.
,
~ '
/ @MQyk UNITED STATES
I f, NUCLEAR REGULATORY COMMISSION I
- s e j WASHINGTON, D. C. 20555 -
~\....+ September 22, 1987
,
Docket No.'50-298
Kebraska Public Power District
ATTN: Mr. George Trevors, Manager
Nuclear Support Division
Nuclear Power Group
P.O. Box 499 j
Columbus, Nebraska 68601 q
Gentlemen: f
SUBJECT: SAFETY SYSTEM FUNCTIONAL INSPECTION REPORT NUMBER 50-298/87-10
This letter forwards the report of the Safety System Functional Inspection
performed by an NRC inspection team over the period May 11 to June 19, 1987,
involving activities authorized by NRC Operating License Number DPR-46, for
the Cooper Nuclear Station. This inspection was conducted jointly by members . .'
of Region IV, the Office of Nuclear Reactor Reguistion, the Office for Analysis
and Evaluation of Operational Data, and NRC contractors. At the conclusion of
the inspection, the findings were discussed at en exit meeting with you and
those members of your staff identified in the appendix to the enclosed inspec-
tion report.
The NRC effort involved an assessment of the operational readiness and
functionality of the emergency electrical system and auxiliary support i
systems. Particular attention was directed to the details of modifications
and design control, maintenance, operation, and testing applicable to the
systems. Additionally, the programs for assuring qJality in these areas were
reviewed to determine their effectiveness. ,
The' team ident'ified weaknesses regarding the functionality of your emergency
electrical; heating, ventilation and air conditioning (HVAC); and service water
systems. These weaknesses included concerns that the station batteries,
emergency transformer, startup transformer and 4160 Vac switchgear may not be
properly sized to perform their safety function during design basis accidents;
the HVAC system may not provide adequate temperature control for the ac
switchgear, de switchgear and battery rooms during both normal operating and
accident conditions; and the operating procedures, training and testing of the
service water system did not ensure that adequate cooling would be provided to
essential safety loads during design basis accident scenarios. Additionally,
significant deficiencies were noted with the implementation of your program
for identifying, reporting and correcting significant conditions adverse to
$[
0
boo $ 0
I
_ ._-.-_ .___-__ _ _____ _ - _ -
__ ___ - _ _ _ _ _ ___ - - _ _ _ _ . _
l
..?'
Je
. N'ebrasks Public Power District -
2-
l
l
quality. Theso issues are summarized in Section 2 of the enclosed report and
Section.3 of the report provides the detailed inspection findings. Some of q
these items may be potential enforcement findings. Any enforcement actions 1
will be identified by our Region IV Office.
We recogn'ize that you have either already taken or plan to take corrective
actions relating to several of our concerns. At the Management Meeting held 4
at our Region IV Office on June 30, 1987, you addressed your corrective action .I
program for some of the more significant functionality issues. The status of !
this program was documented further by your letters dated July 24, 1987 and i
August 14, 1987. While planning corrective actions based on the weaknesses j
identified in the enclosed report, it is important that you realize that the
focus of this inspection was only on the emergency electrical system and
auxiliary support systems. Therefore, consideration should be given to .1
. identifying and' correcting similar problems in other essential systems.
Further meetings and inspections will be scheduled to pursue resolution of the
,
significant. issues. To assist with the scheduling of these followup actions, '
! we request that you respond to the significant findings identified in Section 2-
of this report within 60 days. Given the numerous weaknesses identified with
your engineering programs, your response should specifically address your ,
g
intentions for assessing the design adequacy of additional systems and actions
I planned for providing greater assurance that the design bases for all plant
systems are maintained during future modifications.
In accordance with 10 CFR 2.790(a) a copy of this letter and the enclosure will
be placed in the NRC Public Document Room. {
'I
l Should you have any questions concerning this inspection, we would be pleased
to discuss them with you.
Sincerely,
~
c '
~~)){
Den s M. Crutchfield, rector
Division of Reactor Projects III/IV/V
and Special Projects-
Office of Nuclear Reactor Regulation
Enclosure: Inspection Report 50-298/67-10
cc: See next page
i
_ _ _ _ _ _ - -_ - _ . - . _ . _ _ _ -_
- -
..
,
'
Nebraska Public Power District -3-
cc: w/ enclosure
Guy R. Horn, Division Manager
of Nuclear Operations
Cooper Nuclear Station
P. O. Box 98
,
Brownville, Nebraska 69321
Kansas Radiation Control Program Director
Nebraska D.cciation Control Program Director
Institute of Nuclear Power Operations
1100 circle 75 Parkway
Suite 1500
Atlanta, Georgia 30339
Senior Resident Inspector
Cooper Nuclear Station ,
P. O. Box 218
Brownville, Nebraska 68321
Distribution
DCS (Docket No. 50-298) FMiraglia, NRR
Local PDR DCrutchfield, HRR
DRIS R/F FSchroeder, NRR j
SIB R/F BGrimes, NRR -
P. Boehnert, ACRS LNorrholm, NRR
NTIS WLong, llRR
Regional Administrator EJordan, AEOD
Regional Division Director LSpessard, AE0D
SECY JJaudon, RIV
OCA (3) JGagliardo, RIV
JTaylor, EDO RHall, RIV
TMartin, ED0
TMurley, hRR i
JSniezek, NRR
RStarostecki, NRR
- See previous concurrence
OFC :RSIB:DRIS:NRR :RSIB:DR15:NRR:5Ib:DRIS:NRR:DD: M F 1R :D 1
AY / h
-V
/
5:hRR:Dy-I :
.....:..............:.............:.............:. 3. .. ... . . ......: 4
NAME.:*JDyer/vjj :*LNorrholm :*CHaughney : G A , r low :Ddrd
/b.:
ie
....:...............:.. ..........:............:........... :............:............:........
DATE :09/ /87 :09/ /87 :09/ /87 :09////87 :09/f[/87 :09//?/87 :
j)O%O 1A 1lrif t1 :
_ _ _ _ _____ a
___.
'
l
-Hebraska Public Power District -2-
-
L I
i quality. These issues are summarized.in Section 2 of the enclosed report and i
Section 3 of the report provides the detailed inspection findings. Some of
these' items may be potential enforcement findings. Any enforcement actions
will'be identified by our Region IV Office.
We recognize that you have either already taken or. plan to take corrective
actions relating to several of our concerns. At the Management Meeting held a
at our Region IV Office on June 30, 1987, you addressed your corrective action
program for some of the more significant functionality issues. The status of
this program was docunented further by your letters dated July 24, 1987 and
August 14, 1987. Further meetings and inspections will be scheduled to pursue
resolution of the significant programmatic issues. To assist with the scheduling
of these followup actions, we request that you respond to the significant findings
identified in Section 2 of this report within 60 days.
While planning corrective actions based on the weaknesses identified in the
enclosed report, it is important.that you realize that the focus of this
inspection was'only on the emergency electrical system and auxiliary support
systems. Therefore, consideration should be given to identifying and correc-
ting similar problems in other essential systems.
In accordance with 10 CFR 2.790(a) a copy of this letter and the enclosure will
'be placed in the NRC Public Document Room . j
Should you have any questions concerning this inspection, we would be pleased
to discuss them with you.
Sincerely,
Dennis H. Crutchfield, Director
'
Division of Reactor Projects III/IV/V
and Special Projects
Office of Nuclear Reactor Regulation
Distribution
DCS (Docket No. 50-298) Regional Administrator FMiraglia, NRR EJordan, AE0D
hkC PDR Regional Division Director JPartlow, NRR LSpessard, AE0D
Local PDR SECY DCrutchfield, NRR LCallan, AE0D
DRIS R/F OCA (3) FSchroeder, NRR JJaudon, RIV
SIB readin JTaylor, EDO BGrimes, HRR JGagliardo, RIV
ACRS (10) g TMartin, EDO CHaughney, NRR RHall, RIV
l
P. Boehnert, ACRS TMurley, NRR Lhorrholm, NRR
NSIC JSniezek, NRR JCalvo, NRR
NTIS RStarostecki, NRR WLong, NRR
OFC :RbIb:DRIS:NRR :RSIp : JR15:NRR:518:DR :Db:DRIS:NRR :DIR: :NRR:D:DRP-III-V :
.....:..............:..... .w ..:..... . :............: ...........: .........:........
holm :CHa ney :BGrimes :JPartl :DCrutchfield:
NAME-:JDyer/vj
' grl4,s fe7 5T5[ ,~Y ;:LN
,ii ~ ;01 ; V ;;i ~ ;5;; ;ii ; rs> M ;ii- ;5i r ;;i ;-
. _ _ - _ - _ _ _ . _ - - _ - _
h-
.
.
- '
0FFICE OF NUCLEAR REACTOR REGULATION
DIVISION OF REACTOR INSPECTION AND SAFEGUARDS
Report No.: 50-298/87-10
Licensee: Nebraska Public Power District
P. O. Box 499
Columbus, Nebraska 68601
Facility: Cooper Nuclear Station
Inspection At: Nebraska Public Power District General Office
and Cooper Nuclear Station I
1
Inspection Conducted: May 11 - June 19, 1987 )
Inspectors: b tV 6/2.Y/87 j
J.E.Dy6r,SynorOperationsEngineer,NRR(TeamLeader) Date I
' Y
'H.
A. Bailey, Spion Chief, AEOD / Date
$/6V * bit W/l87 l
J. D. Smdth, Operations Engineer, NRR Date 1
9 B-3/-87
R.' L. Lloyd, A4 actor Operations Engineer, AEOD Date
Y0 D-tJ~ Ehk/
Date i
R.gemar6ReactorOperationsEngineer,AE00
1h Y 8-3l~6l
W; R.' Jones, Weactor Operations Engineer, AEOD Date j
An n6 k, 1
(/A.~Isom Reactor Engineer, NRR Date'
Ntity 'kt S/26l87 l
A. R. Johnson, Reactor Engineer, Region IV Date
3//)tw bc 8/24/87
E. Plet".ner, Resident Inspector, Region IV Date
1
Accompanying Personnel: *J. Partlow, NRR; *C. Haughney, NRR; *J. Calvo, NRR; )
. Rub'in AEOD; *S. Kobylarz, WESTEC; *E. Poletto, WESTEC;
I * s
- Pre atte, ST
Reviewed By: % ! [ ,
L.'Norgholp/ Chief, ars Ins ~pection, Appraisal and ' Date
DeveTop nt Sec o , NRR
Approved By:
C. [ Haugh Chief S cial Inspection Branch, NRR at
- Attended Exit Meeting on -6 P, L .
'
8709300220 070922 ,
PDR ADOCK 05000299 l
0 PDR
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - _ _ - _ _ _ _ _
- - __ ._
l%
i a
1
_
i
o Scope:
A special, announced inspection was performed of the operational readiness
of the emergency electrical systems and supporting systems at Cooper Nuclear
,
l- Station. The licensee's programs were reviewed in five functional areas as
l they applied to selected systems. These functional areas were: .,
- Maintenance
- Surveillance and In-Service Testing
- - Design Changes and Modifications
l - Operations
1 - Quality Assurance
Results: The inspection team identified significant concerns about the 3
i ability of the service water system and emergency electrical system to j
l function as required during accident scenarios. Additionally, deficiencies j
.
were identified with the licensee's program for identifying, reporting and i
l correcting significant problems with essential equipment and systems. ]
1
,
l
l
_ _ _ _ _ - _ _ _ _ _ _ _ _ .
_ - _ _ - _ _ _ _ - __
.'
1. INSPECTION OBJECTIVE
The objective of the team inspection at the Cooper Nuclear Station was to
assess the operational readiness of the emergency electrical systems and
corresponding auxiliary support systems by determining whether:
(1) The system was capable of performing the safety functions required by
its design basis.
(2) Testing was adequate to demonstrate that the system would perform all
of the safety functions required.
(3) System maintenance was adequate to ensure system functionality under
postulated accident conditions.
(4) Operator training was adequate to ensure proper operations of the system.
(5) Human factors considerations relating to the system (e.g., accessibility
and labeling of valves) and the system's supporting procedures were
adequate to ensure proper system operation under normal and accident
conditions.
The inspection team reviewed the applicable portions of the following systeras:
(1) 4160/480/120 Vac
(E) 125/250 Vdc
(3) Emergency Diesel Generator
(4) Diesel Fuel Oil
(5) Diesel Air
(6) Service Water
(7) Station Ventilation I
i
i
_-
'
.
2. SUMMARY OF SIGNIFICANT FINDINGS
The more significant findings pertaining to the operational readiness of the
emergency electrical systems and their auxiliary support systems and the
effectiveness of programs to ensure continued safe operations are summarized
below. Although some strengths were identified in each of the areas inspected,
the following sunnary focuses on the significant weaknesses identified during
the inspection. Section 3 provides detailed findings, both strengths and
weaknesses, in each of the areas inspected. The observation numbers in
brackets after the individual summary items are provided for reference to
the corresponding discussion in Section 3. The tracking numbers in
parentheses after each summary paragraph identify the unresolved items from
the inspection which will be followed up by the NRC in future inspections.
2.1 Functionality Concerns
2.1.1 The service water system may not be capable of providing adequate
cooling to the emergency diesel generators and to other essential loads during
worst-case accident scenarios for the following reasons:
(1) The actual heat removal capabilities of the service water system were not
measured. Instead system flows were measured which did not account for
heat exchanger fouling and the resultant loss of heat transfer capabili-
ties [3.2.1(1)](50-298/87-10-01).
(2) During system testing the required flows were not achieved to each essen-
tial service water system load. Instead, pump flow was measured and
compared to the total heat exchanger flow requirements. It appeared that 1
adequate testing has never been performed to ensure that adequate flow
could be provided to the emergency diesel generators under the design
basis scenario of one pump supplying all heat exchanger loads [3.2.1(2)]
(50-298/87-10-02).
(3) Inadequate operating guidance and training existed for casualty responses
such as service water system flow balancing, operation with a loss of
nonessential air or manual isolation of nonessential loads. Incorrect
operator response to the design basis scenario could result in inadequate
flows to essential loads, a pump runout condition for the one remaining j
pump, and loss of all service water system cooling [3.3.1]
(50-298/87-10-03).
(4) Auxiliary systems to prevent fouling of the intake structure were not
designed to ensure adequate post-accident cooling. Fouling of the travel-
ing screens could cause clogging of the pum ]
of service water system cooling [3.1.2(2)] p suction and result in a loss
(50-298/87-10-04).
2.1.2 The emergency electrical system may not be able to function as in- !
tended during a design basis accident. 1he licensee performed preliminary j
analyses which indicated the following concerns.
i i
l (1) The startup and emergency transformers may not be properly sized to J
! provide adequate voltage to start all the emergency core cooling system l
l loads as designed [3.1.1(1)] (50-298/87-10-05). ,
I
'
i
i
-2- !
- _ _ -
.
.
,
l; (2) The station batteries may not be properly sized to provide adequate l
voltage to the closing coils for the output breakers of the emergency I
diesel generators and the emergency transformer [3.1.1(2)]
(50-298/87-10-06).
(3) The heating, ventilation, and air conditioning system may not be able to
provide adequate cooling to the ac switchgear, de switchgear and station
battery rooms. Excessive temperatures could prevent proper operation of
essential electrical equipment and systems located in the rooms
[3.1.2(1)] (50-298/87-10-07).
(4) There was no analysis to demonstrate that the 120 Vac electrical system {
would function as intended during accident conditions [3.1.1(1)] l
(50-298/87-10-08). {1
2.1.3 The 4160 Vac electrical system did not appear to be adequately ,
designed to accommodate emergency diesel generator testing. The 4160 Vac )
switchgear appeared to be undersized for short circuit conditions that could l
occur during test configurations. The circuit breaker overload settings to 3
{
protect the emergency diesel generator during testing were also set above the
stall rating of the diesel generator [3.1.1(3) and 3.1.1(4)] (50-298/87-10-09).
2.2 Programmatic Concerns
2.2.1 The team identified several instances where events were not reported !
to the NRC and inadequate corrective actions were taken for significant defi- I
ciencies with essential equipment [3.5.1 and 3.5.2] (50-298/87-10-10).
1
2.2.2 Examples of deficiencies were noted in the design analyses performed
by the licensee, including the use of incorrect calculation methods, assump-
tions, and design inputs. Additionally, drawings and design bases were not j
always updated to reflect station modifications [3.1.3] (50-298/87-10-11). l
2.2.3 Instances were identified where inadequate post-maintenance testing
occurred after maintenance on essential systems. In one case, an incorrectly !
l
sized residual heat removal pump gland seal water pump remained installed for
10 months because inadequate post-maintenance testing was conducted after pump
installation [3.4.4(3)] (50-298/87-10-12).
!
2.2.4 The trending program for the service water system inservice test data j
appeared inadequate. The team identified instances where service water pumps j
were operating in the alert range without the increased monitoring or correc- l
tive actions being accomplished as required [3.2.1(5)] (50-298/87-10-13).
i
l
-3-
l
I
- - _ _ _ _ - _ _ _ _
._ _
l
.
-
3. DETAILED INSPECTION FINDINGS
3.1 Systems Design Changes
The inspection team reviewed modification packages and associated reference
documentation for the selected systems. A complete list of these documents is
provided in Appendix B to this inspection report. Additionally, system walk-
downs were performed to verify system construction in accordance with design
documents and a review of the overall design control program was conducted.
The reviews concentrated on the adequacy of the electrical and mechanical engi-
neering disciplines and the overall impact on the functionality of the selected
i: systems.
3.1.1 Electrical System Design
.The team identified the following instances in which the station electrical
i systems appeared to be inadequately designed or had inadequate documentation
to support their design:
(1) AC Voltage Regulation
The inspection team identified a number of non-conservative errors in
Calculation 2.15.01, " Critical AC Voltage Regulation Study," Revision 1,
that rendered the results of the study invalid. The most significant
errors included incorrect entry into the computer program of the impedance
for the normal station transformers, incorrect modeling of the motor
starting conditions during a design basis accident when fed from offsite
power, incorrect omission of the source impedance of the offsite trans-
nission systems, and incorrect transmission system voltage ranges. The
preliminary results of a new ac' voltage regulation study performed by the
licensee during the inspection were reviewed by the team revealing the
following concerns:
(a) Simultaneously starting all emergency core cooling system (ECCS)
loads on the startup transformer, as designed, a)peared to lower the
4160 Vac system voltage sufficiently to actuate )oth levels of
undervoltage protection for critical buses 1F and 1G. The prelimi-
nary analysis showed that bus voltage would drop to approximately
2600 Vac for longer than 13 seconds, while the ECCS motors were l
accelerating to rated speed. As described in Section VIII-3.6 of the
Updated Safety Analysis Report (USAR), the first level of under-
voltage protection actuates instantaneously at 2900 Vac and a second
celayed trip occurs if the voltage remained below 3600 Vac for 10
seconds. Actuation of either of these trips isolates the critical
4160 Vac buses IF and 1G from the startup transformer making it a
non-viable source of off site electrical power.
(b) Sequentially starting all ECCS loads on the emergency transformer,
as designed, also appeared to actuate the undervoltage devices and
to isolate the 4160 Vac buses IF and 1G from the transformer. The
licensee's preliminary analyses revealed that bus voltage could
decrease to 3040 Vac assuming an incoming voltage of 66.7kV from the
69kV off-site source. However, the contract with Omaha Public Power
District (OPPD), that supplied the 69kV source, specified a minimum
voltage of 62.1kV, which would result in an analyzed bus voltage
below both instantaneous and delayed undervoltage trip devices. A
-4-
_ _ _ _ _ . _ _
- (
.....
- '
review of the history of the grid voltage on the 69kV line r6vealed
that bus voltage had never dropped below 66.7kV.- The licensee
' initiated action during the inspection to revise its contract with
'OPPD to ensure that minimum voltage would be greater than 66.7KV.
(c) The preliminary ac voltage regulation study did not address the.
adequacy of voltages supplied to the 120 Vac essential load panels
fed from critical 4160 Vac buses 1F and 1G through the critical 480
Vac system. These panels were fed from essential 480 Vac motor
control centers LX'or TX through either'of two unregulated 75 kVA
transformers. Consequently, the licensee did not know whether the ac
power system feeding the critical 120 Vac panels was able to provide
adequate voltage for the essential loads fed from the panels or
whether the loads on.these panels could be expected to perform their
safety function.
At the management meeting held in the NRC Region IV office, the licensee
committed to verify all design inputs and finalize the preliminary _
analyses for the ac' voltage regulation study. This verification involved ,
measuring and recording individual loads of the applicable plant systems. I
and performing the necessary modeling calculations. In a letter dated
August 14, 1937, the licensee concluded that the startup and emergency
transformers were adequately sized to support post-accident loads. Analy-
ses were still in progress to determine w1 ether the 120 Vac and 480 Vac 4
systems design were adequate. The inspection team did not review the i
final analyses. )
l
(2) DC Voltage Regulation 1
The Heensee was unable to demonstrate by analysis that existing 125 Vdc I
and 250 Vdc batteries would supply adequate voltages to required loads -l
during accident conditions. At the beginning of the inspection, the )
licensee did not have a current de system voltage regulation study.
During'the inspection a preliminary analysis was performed by the licensee
and reviewed by the team revealing the following concerns:
(a) 'The closing coils of the critical 4160 Vac circuit breakers for the
energency transformer (1FS, 1GS) and the emergency diesel generators i
(1FE, 1GE) appeared to have marginal pickup voltage. The worst' case ]
was the emergency diesel generator's main circuit breakers, where the i
minimum available voltage to the closing coils determined in the 1
J
calculation was 61 Vdc. This was well below the rated minimum
pickup voltage of 90 Vdc provideo by vendor specifications. During 1
the inspection, the licensee performed a test on a closing coil from !
'
an identical spare 4160 Vac circuit breaker that closed at a minimum ,
voltage of 58 Vdc. The inspection team concluded that further
testing, analysis, or system design modifications were needed to provide
assurance i. hat the diesel generator circuit breakers were capable of
closing with the minimum expected voltage.
(b) The analyzed minimum voltages to several motor-operate-valves (MOVs)
appeared to be marginally acceptable. Valves MS-51-MV and H0-02-53B
appeared to have margins of 0.7 percent and 1.5 percent above the
minimum required voltages, respectively.
,
The team was concerned about the minimal design margins for these compo- )
-5-
i
- _ _ _ _ _ _ _ _ . -
_.
.
...
.
s
nents because battery capacity'was' based on a~ minimum temperature of
- 70*F. Initially, this temperature value appeared to be unsupported by
analysis as discussed'in Section 3.1.2(1)(b). Any reduction in the
. minimum battery temperature used in the calculation would result in
- decreased battery capacity and lead to undervoltage conditions at the
components.
(3) Critical-Switchgear Design
The 4160 Vac system switchgear may not be the correct size. The manufac-
turer's momentary rating of the 4160 Vac critical switchgear was 60,000-
amperes asymmetrical. In the original equipment sizing calculation, the
_
licensee-did not consider the asymmetrical current contribution during
diessi generator testing. A calculation performed by the licensee dated
June 12, 1987, indicated the potential for 66,948 amperes asymmetrical,
which exceeded the switchgear. momentary rating by over 11 percent. If a
fault were to occur during diesel generator testing, the switchgear could
fail, resulting in a fire or explosion. Additionally, since both the 1F
ano 1G buses were in the same room, the licensee had not demonstrated that
a postulated failure of one 4160 Vac switchgear, would not jeopardize the
redundant electrical train.
-After the inspection, the licensee finalized the preliminary analyses
that indicated a potential fault current of 63,600 amperes. Based on
vendor information and further analyses, the licensee concluded that the ,
j
probability of a fault of such magnitude was low and that it could not~
-damage redundant essential switchgear. The inspection team did not review
these final analyses.
(4) Emergency Diesel Generator Overload Protection
The protective trip for critical 4160 Vac bus feeder breakers (1FA and
1GB) from the noncritical buses (1A and'1B) appeared to be incorrectly set
to protect the emergency diesel generator. As described in Section 5.3.2
of the USAR, the purpose of the trip setpoint was to protect the emergency
diesel generators from overloading when supplying balance of plant loads ;
through the feeder breakers. The trip set point was designed to be set at i
135 percent of generator full load current, but was found to be actually
set at 138 percent of the full load current. This 138 percent setting I
corresponded to a load of 6917 kVA which was considerably greater than the
estimated emergency diesel generator stall rating-of 6000-6435 kVA. The
inspection team did note that licensee operating and casualty procedures
did not permit the emergency diesel generators to supply balance-of-plant
loads and specific interlocks were installed to prevent this practice.
Only during emergency diesel generator testing, when the normal trans-
former and diesel generator were in parallel, would this trip device be
protecting the emergency diesel generator. However, the inspection team
was still concerned that these overloads were not properly set to protect
the emergency diesel generator.
3.1.2 Mechanical Systems Design
I
The inspection team identified the following instances in which plant mechani-
cal systems appeared to be inadequately designed or had inadequate documenta-
tion to support system design: ;
l
!
~6- l
l
= _ _ _ _ _ - - _ _ _ _ _ -
.
. _ - - _ _ _
. .
- ~
,
-
(1) Heating, Ventilation and Air Conditioning (HVAC) System i
The HVAC system for the ac switchgear, de switchgear and battery rooms
appeared to be inadequate to support both normal operating and accident
conditions. The HVAC system was. nonessential and consequently, could be 3
lost during design basis accidents. Also, loss of HVAC to certain spaces j
could go unnoticed because of inadequate alarms. At the beginning of the -
inspection, the licensee could not demonstrate that the HVAC system could
,
maintain temperature control to any of the rooms being reviewed. During
the inspection, the licensee performed preliminary calculations that were
reviewed by the inspection team. .The results of this review and other i
evaluations of the HVAC system revealed the following concerns:
(a) The preliminary calculations performed during the inspection predicted
the maximum steady-state ambient temperature to be 126*F in the
critical ac switchgear room, 134'F in the de switchgear room, and
109'F in the battery rooms. The licensee could not demonstrate that
.the equipment in these rooms would function at these temperatures.
If the essential electrical equipment in these areas cannot be shown
to be qualified to operate given these ambients, the potential could
exist for common-mode failure of the critical Class 1E equipment and
switchgear.
At the management meeting held at the NRC Region IV office, the
licensee connitted to develop and finalize the thermal transient
evaluations for the HVAC system in the control building. The study 1
concluded that should the ventilation fail during accident or normal !
operation, the temperatures in the battery, ac switchgear, and de i
switchgear rooms would be maintained within equipment specifications
if portable HVAC equipment was used. The inspection team did not
review these analyses.
(b) During the inspection, the licensee was unable to demonstrate that
the minimum required temperature in the 125 Vdc and 250 Vdc battery
rooms could be maintained without the nonessential HVAC system.
Design calculations for both the existing and proposed 125 Vdc and
250 Vdc batteries assumed a minimum ambient temperature of 70*F. If
the ambient temperature were to drop below 70'F, the emergency diesel
generator breakers, emergency transformer breakers ano essential
MOVs identified in secton 3.1.1(2) as having minimal voltage margin
may not be able to perform their safety functions. After the onsite
inspection, the licensee performed calculations which predicted
that the minimum temperature in the battery rooms would be 71'F. The
inspection team did not review this analysis.
(c) There was no direct indication in the control room for failure of the
diesel generator room ventilation systems or certain failure modes of
the battery room exhaust fans. The failure of the emergency diesel
generator room fan motors, belts, bearings, blades, etc. could go
undetected in the control room. This lack of indication in the
control room was particularly important when considering the specific
design features of the cooling system in the diesel generator room.
Key components in the room cooling system failed to the unsafe
condition; that is, the cooling water valves failed shut, the dampers
failed shut, and the heating system valve failed open. The design
-7-
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ -
..
u.;
a for the exhaust fans in the 125 Vdc and 250 Vdc battery rooms incor-
porated a feature which provided an alarm in the control room only if
the fan motors failed electrically.- All other failure modes for the-
battery exhaust fans would go undetected in the control room. In
addition, the battery exhaust fans were incorrectly classified as
nonessential.
(2) ' Service Water System Intake' Structure Systems
The service water system did not appear to be adequately designed to
prevent fouling of the-intake structure during postulated accident condi-
- tions. The service water system was the ultimate heat sink for the
- reactor and the only source of cooling for all plant equipment during
normal operation, shutdown, and eccident conditions. .The service water
system was designed as essential however, supporting subsystems at the'
river intake structure were not designed as essential. Consequently,
these subsystems were not supplied by Class 1E electrical systems,
provided with redundant trains or constructed to withstand natural
phenomena. The particular subsystems of concern were:
(a) Traveling screens used to remove debris which could clog the service
water pump suction. If these screens became inoperable, they could !
become fouled and possibly collapse due to high differential pressure
drop across the screen. This could lead to further fouling of the -
3
service water pump suction and potential loss of the pumps.
'
The licensee's position was that the traveling screens were not
required to be essential and that the design was adequate. The-
following were the individual points of the licensee's position and
the inspection team's concerns about this position: j
(1) The licensee maintained that the flow area through the screens l
was so large relative to the flow rate that clogging could not
take place for a very long time. However, complete clogging was
not necessary to incapacitate the pumas. Partial clogging
could create a pressure drop across tie screens sufficient to
cause their collapse. The data presented by the licensee did
not consider realistic worst-case accident conditions. When
such conditions were considered, there was strong indication
.that clogging and failure could occur within a matter of hours.
The team was also concerned that lower water velocity could
increase ice and silt formation in the bay and on the equipment,
causing clogging and eventual stalling of the screens.
(2) The licensee maintained that flows could be increased to the
service water pumps by opening the sluice gate between the
circulating water bay D and the service water bay E, thereby
making the flow area of two more screens available. However,
this would not eliminate the problem of screen loading; it
would only increase the time factor. Additionally, since the
sluice gate was normally closed, not seismically designed, and
not covered by the surveillance program, the D bay was not
I considered a reliable source of water.
(3) The licensee maintained that the intake bay could not freeze
solid from top to bottom. However, as has been discussed above, l
i
1
-8- j
- _ _ - - -
...,
.
e,
+ it is not necessary for the intake to freeze solid from to) to
bottom for.the service water pumps to be threatened. It ssould
also be noted that service water system fouling caused by
freezing has occured at the intake structure of other plants-
having milder climater than exist at Cooper Nuclear Station.
. (b) -Screen wash system used to clean debris from the traveling
screens. Loss of the screen water system would expedite fouling of
the traveling screens and their resultant failure.
.-
(c) Silt sparging system used to prevent accumulation of silt at various
locations in the service water intake structure. The river water
was agitated to maintain the silt in suspension and then was pumped
through the service water system. Loss of the sparging system could
result in silt accumulation and fouling of the service water pump
suction.
-(d) Freeze protection used to prevent ice formation in the intake struc-
ture by routing the circulating water system discharge to the intake
structure. Loss of the nonessential circulating water system could .
result in ice buildup and fouling of the service water pumps during i
the winter.
There were no procedures or training guidance for manually performing the
fouling prevention activities should these subsystems be lost. The
inspection team was concerned that the loss of any of these subsystems
could have the potential for fouling the service water pump suction and
creating a coninon-mode failure of the system.
It appeared that original licensing documents did not require these
subsystems to be essential. Preoperational testing revealed silt buildup
which required the installation of the sparging system. Further testing
performed with all anti-fouling systems secured revealed that significant
fouling would occur in a matter of hours, but that acceptable flows could
be maintained. The team was-concerned that this preoperational test did
not represent the worst-case set of circumstances postulated under acci- ,
dent conditions and that fouling could prevent proper service water system I
operation during accident conditions.
(3) Emeroency Diesel Generator Fuel Oil Tank Level Instruments
1
The 'ow level alarm setpoints for tanks in the emergency diesel generator .
L
fuel oil system appeared to be improperly set. Discussions with licensee l
'
personnel revealed that the purpose of these alarms was to alert operators
when the tanks were approaching the limits specified by the USAR or the
Technical Specifications. The inspection team identified the following :
instances in which the tank setpoints die not appear to be properly set:
(a) The diesel fuel oil day tank low level alarm was intended to ensure
that each day tank will provide sufficient fuel for at least 0 bsurs
of fully loaded emergency diesel generator operation. The low level
alarm for the fuel oil cay tanks was set at 42 inches as measured
from the bottom of the tanks, corresponding to approximately 1580
gallons. The Technical Specification Bases stated that the diesel
generator fuel consumption rate at full load was approximately 275
gallons per hour. At this rate, the fuel in the day tank would be
.g.
L
. _ _ _ _____ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _
.
,
'
sufficient for only approximately 5-3/4 hours at full-load operation.
Therefore, the amount of fuel in the tank may be less than.the USAR
comitment without the operator being alerted. The root cause for
this problem appeared to be that an incorrect fuel consumption rate
was utilized in design calculations for determining the low level
setpoint.
(b) The low level alarms of the diesel fuel oil storage tanks were
intended to alert operators when fuel oil quantities were approaching
the Technical Specification limit of 45,000 gallons. The low level
alarms for the two main fuel tanks were set at 3 feet, 6 inches as
measured from the bottom of the tank, which corresponded to approxi-
mately 8200 gallons. Even if only one of the tanks is at the alarm
setpoint and the other is full (best case), this would correspond to
approximately 41,600 gallons, which is still less than the minimum
allowable. The inspection team concluded that these alarm setpoints
were incorrect for their intended purpose.
However, the operators appeared to have reasonable assurance of
meeting Technical Specification requirements for the fuel oil tanks.
Procedures require that the diesel fuel oil availability in the
storage tanks be verified on a monthly basis to be at least at the
45,000 gallon level required by Technical Specifications. Addi-
tionally, once each shift the fuel level in the storage tanks was
verified to be greater than 8 feet 4 inches, which corresponds to
approximately 24,700 gallons per tank or 49,400 gallons total.
The team was concerned about these' discrepancies since critical post-
accident judgments may be made based on the understanding of the fuel
remaining in the tanks. Based on these levels incorrect decisions could
possibly compound accident situations through loss of emergency diesel
generator electrical power to the essential loads.
(4) Service Water Pump Room Floor Drains
The team was concerned about the ability of the floor drain system to 1
prevent flooding in the service water pump room in the event of a ruptured
line. The service water gland seal supply pumps were mounted in the
service water pump room approximately 6 inches off the floor. Any signi-
ficant flooding in this room would subject all four of the gland seal
water pump motcrs to failure, which could lead to failure (' all four
service water pump seals and possible service water punp degradation er
failure. This situation was exacerbated because no flooding alarm
existed for the room and because previous openings in the floor were
plugged to satisfy security and fire protection requirements.
During the inspection, the licensee calculated that the flooding which
could be expected from a crack in the 14-inch service water lines in this
room would never reach the level of the gland seal water pumps. However,
the analysis was not conservative and failed to consider plugging of the
floor drains which would be realistic considering the hoses and debris
observed in the service water pump room. It also did not address the
unsupported lines discussed in item 3.1.2(5), which have a total flow area
approximately four times the area used in the crack leakage analysis. The
team concluded that for the licensee's analysis to be valid, the problems
with cleanliness and inadequately supported lines noted in the room would
-
have to be corrected.
-10-
- _ - _ _
_ _ ____-__ _ _-_ .
.
.
[ (5) Inadequately Supported Piping and Equipment
The team identified the following instances in which some equipment and
piping did not appear to be adequately supported:
(a) In both battery rooms A and B, lighting fixtures and associated
conduit were located directly over both batteries in each room.
Additionally, in battery room A a vertical cast-iron drainpipe and
one 3-inch line were located close to the 250 Yde battery and two
vertical 3-inch lines were located very near to the 125 Yde battery.
(b) On both emergency diesel generators, instrumentation and control
tubing trays were supported by the air operator assemblies for
service water supply valves SW-279A-AV and SW-279B-AV. Failure of
the tubing trays or service water valves could cause a loss of the
diesel generator.
(c) On each of the service water system motor operated strainers there
was a 3-inch drainline with a manual valve cantilevered for approxi- I
mately 6 feet, which was supported only by a rope. Failure of these
lines could pose a significant flooding threat to the service water
pump room.
(d) The cooling unit for the control building basement was mounted on a
steel structure suspended from the ceiling by concrete epansion
anchor bolts. At one corner empty anchor bolt holes were very close
to the anchor bolts supporting the structure. Calculations performed
by the licensee during the inspection indicated that this cooling
unit was inadequately supported when the effects of the empty holes
were considered. Failure of the supports could cause failure of the
cooling unit and the service water supply piping. This could cause
the room temperature to exceed the qualification temperature of the
residual heat removal (RHR) system service water booster pump motors
and prevent them from fulfilling their safety function.
'
(e) Service water system root valves SW-199, -200 and -201 located
immediately downstream of the service water pumps were inadequately '
.
supported to gage standards. The licensee evaluated the supports
and concluded that they should be removed since the supports could
cause the line to break during an event. The licensee could not
locate the design change documents that initially determined how the
supports were installed. Failure of these root valves and lines
during a seismic event would contribute to the previously mentioned
flooding concern in the service water pump room.
The inspection team was concerned that failure of the piping or equipment
described above coulo cause loss of essential equipment during a seismic
event. Partial corrective action for these deficiencies was identified in
the licensee's letter of July 24, 1987 and further corrective actions were
in progress.
3.1.3 Programmatic Design Change Concerns
The inspection team identified several instances in which the licensee's
program for controlling plant design changes was inadequate. Some of these
inadequacies resulted in system design prcblems in the plant as discussed in
-11-
- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
- - _ - _ _
y
4
, -.
3
F
'
, ' section 3.1.1 and 3.1.2 of the report. This section of the report discusses
- those progrannatic deficiencies identified during the inspection which may.not
H - have resulted in a system problem, but have the potential for causing problems
in other areas not reviewed by.the inspection team.
(1)~ Design Analyses
The.following were instances where inadequate design analyses were
conducted:-
(a) Calculation 86-105, " Critical AC Bus Coordination Study," did not
include the short circuit contribution from both induction and
. synchronous motors. The error understated the short-circuit current
'by more than 50 percent at half-cycle and the resultant coordination
of fuses and molded case circuit breakers was underestimated. This
calculation error did not result in inadequate coordination within !
l
the plant because other aspects of the ac bus coordination study
necessitated the more conservative fuse and breaker coordination.
(b) Calculation 7683-01-E2, " Station Batteries," Rev. O, incorrectly l
neglected all de motor current contribution and underestimated the {<
battery charger current contribution when determining the available
short circuit current for 125 Yde and 250 Vdc systems with the new
batteries. The large motors fed from the 250 Vdc system represented
a significant amount of short-circuit contribution. The calculation
also used 115 percent of the charger's full-load current rating when
IEEE Standard 946-1985, " Recommended Practice for the Design of )'
Safety-Related DC Auxiliary Power Systems for Nuclear Power Generat-
ing Stations," stated the appropriate value is 150 percent of the
full-load current rating. Although the methodology was incorrect,
adequate margin was provided in the purchase specification for the i
breakers. {
(c) The loads calculated for USAR Table VIII-5-1, " Diesel-Generator
Essential Emergency Loads - Standby AC Power System," appeared to be
out of date ano did not consider motor efficiency in the determina-
tion of diesel generator loads. The table was not revised in 1985
when an additional load was added and the horsepower ratings of loads
were directly converted to kilowatt loads without consideration of
motor efficiency. The team estimated that these errors resulted in
the diesel generator load being underestimated by approximately 11
percent. However using this approximation, it appeared that all
automatically sequenced loads would be adequately supported by the
emergency diesel generators. The additional manually added loads
could bring the total diesel generator load to greater than 4400 kW
which would cause the emergency diesel generators to be operating
above the 2-hour overload rating of the diesel. This condition
would require operator control of the manual loads to prevent
exceeding diesel generator loading.
l
The team was also concerned that USAR Table VIII-5-1 was used as an )
input for subsequent load studies for the diesel generator. For i
example, Calculation 85-071, " Emergency Diesel benerator 1A and 1B l
Load Study", evaluated the ability of the diesel generator to provide l
power to the computer system HVAC and PMIS uninterruptable power j
supply based on the load input fror.i Table VIII-5-1. Incorrect input j
l
-12- l
.-
- -_ _ -__ _ _ _ _
j
.a
- to the various emergency diesel. load study calculations'could render
- the calculations invalid.
During the inspection, the licensee connitted to; revise o>erating l
procedures to ensure that the diesels are not overloaded wien j
manually starting loads, validate the loads on USAR Table VIII-5-1; {
and review those diesel generator load studies using Table VIII-5-l' q
as a design input. !
l
(2) Design Input and Output Control
In the following instances design inputs and outputs were inadequately ,
controlled:. '{ l
J
(a) 'The sizing study for the new station batter'ies, SL-7076, used voltage
acceptance values for de HOVs that were inconsistent with the speci-
fication for the. installed valves.. To select the size for future
replacement station batteries for the 125 Vdc and 250 Vdc systems,
calculated terminal voltages for DC MOVs were compared to an assumed
voltage rating of 125 Vdc +15/-30 percent and 250 Vdc +15/-30 per-
cent. The licensee failed to verify this assumption before issuing
the procurement specification for the proposed replacement station
batteries. The original MOV contract specification required a
voltage rating of 120 Vdc+15/-15 percent and 240 Ydc+15/-15 percent..
As a result, 8 of 19 MOVs hac an unacceptable mininem terminal
voltage when compared to the calculated terminal voltage. During the
inspection, the licensee performed a preliminary analysis to show
that even though the minimum terminal voltage at the'de MOVs was less
than the rated minimune, the motor operator could still produce
adequate' torque at this lower voltage to operate the valve properly. 1
(b) The 125 Vdc and 250 Vdc systems load profile had.not been updated l
to reflect load changes since the initial calculation in 1969. l
Additionally the batteries were sized, as required, to support post- I
accident loads for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, but the USAR and training guidance l
incorrectly stated that the battery was designed to support loads for
8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. As a result, operators and engineering personnel were
misinformed that these batteries would carry post-accident loads for
8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when they were designed for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of support.
(c) The control of the current overload settings for circuit breakers 1FA
and 1GA a)peared inadequate. These breakers were the tie breakers
between tle critical 4160 Vac buses (1F/1G) and noncritical 4160 Vac
buses (1A/1B). Minor Design Change (MDC) 79-59 was issued in May
1980 to change the overload setting based on analyses to 135 percent ,
of the emergency diesel generator full load current, which cor-
responded to a shunt trip setting of 3.9 amps. Since then, design
dccuments for the overload settings have been changed four times
without any analytical justification. The nest recent change, DCN
87-131, authorized raising the setpoint to 4.0 amps which corres-
ponded to 138 percent of emergency diesel generator full load cur-
rent. In summary, poor control of the overload settings resulted in
design data being promulgated that exceeded the analyzed value.
Additionally, the team was concerned that the overload setting
appeared to exceed the stall rating of the emergency diesel generator
as discussed in Section 3.1.1(4). j
l
-13-
)
.
'[l
.
.
(c) It appeared that no mechanism was in place or was being used to
ensure that flexible hose f.ilures were reported, evaluated, and
trended, or that modifications were fully implemented. Design
Modification 82-037 " Diesel Generator Flex Hoses," replaced one
iflexible metal fuel supply? hose on both diesel generator units with
upgraded wire braid reinforced hydraulic hoses. The original hose
had developed leakage apparently from vibration. No other flexible
hoses on the engine were replaced with the upgraded hydraulic hose by
the modification. It was observed that flexible metal hoses similar
to the original hose replaced by Modification 82-037 existed at
numerous other locations on the engine.in the lube oil, jacket water,
and starting air systems,-and also elsewhere in the fuel system. On
further investigation it was found that four of these other. hoses had
been replaced due to leakage, one on each unit in the lube oil system
and two in the starting air system in Unit 1. In all other cases,
the failed hoses were replace with parts similar to the original
equipment, rather than being replaced with the upgraded hose.
(3) Control of System Modifications
!
The team identified the following instances in which permanent modifica- l
i
tions to essential systems were being accomplished without adequate
control, documentation or analyses: {
(a) The tap settings for the startup and emergency transformers were (
apparently changed without station management knowledge or approval.
'The inspection team found that the taps for the primary windings of {
j
both transformers were set at 1.025 instead of the original design
value of 0.95 specified in the ac voltage regulation study. There ]
was no documentation for this change and an investigation performed
by the licensee revealed that the offsite transmission group
j
apparently changed the settings in 1981 to support higher grid I
voltages. These changes did not appear to affect the overall safety
of the plant since the elevated grid voltage offset the different
settirigs; however, the ac voltage regulation analysis was not revised
to accurately reflect station cesign.
f
(b) Emergency diesel generator control air piping was modified to provide
a temporary solution to a design problem without addressing the
root cause of the problem. The team found that small control air
copper tubes located in front of the forward rightmost engine cylin-
der on both engines had been bent downward.across a sharp metal edge.
The tubes appeared to have been bent by being stepped on. On one 1
engine, the tube had been wrapped with what appeared to be black
electrical tape; the other had bA n wrapped with a spongy rubber
material. These measures did not appear to address to the actual
problem, that the tubing was still in a position that was likely to
be stepped on again.
1
(c) 'The diesel fuel oil system was permanently modified by a special l
test procedure that appeared to violate licensee procedures. Proce- ;
dure 3.5, "Special Test Procedures /Special Procedures," Revision
.2, provided methods for controlling special tests or non-routine
l
4
-14-
- _.
- _ _ -
l
1
1
- i
,
operation of equipment. Special test procedures (STP) and special
procedures (SPs) allowed temporary changes to be made to plant equip- )
ment and systems for the duration of the test or non-routine opera-
tion of equipment and/or systems. Procedure 3.5 required all changes
to essential components and systems using STPs or SPs remaining
in effect beyond the duration of the test to be documented by The a
design change (DC) or equipment specification change (ESC).
inspection team reviewed only two STPs (85-007 and 86-14) thatSTP ;
involved the diesel generators and found one to be deficient. l
85-007 was written to troubleshoot a problem concerning inadeqsate i
flow from a fuel oil transfer pump. On April 25, 1985, STP-007 was '
performed, modifying the orifices in the fuel oil float valves to
increase the fuel oil flow to meet Technical Specification require-
ments. The system met the flow requirements with the 30,drilled-out
1985. A
orifice and was declared ready for service on April 10, 1986 and was .
permanent design change was not initiated until July There was
still not closed out at the termination of the inspection. l
still no analyses to determine the adequacy of the fuel oil system l
design with the modified orifice. The Station Operations Review }
Comittee (SORC) approval for modifying the orifice was predicated on l
the completion of any permanent design changes recomended by the l
test results; however this did not occur.
The inspection team was concerned that any modifications to essential j
equipment including material changes, mustcontrol,
Without such be controlled by a formal of
the functionality 'j
design modification program.
the system can be impaired or new problems can be created by modifications
whose total effects have not been properly considered. In the cases cited
above, there apparently have been no deleterious effects observed to date.
However, the solutions that were furnished for those problems did not ,
aapear to be the optimum solutions that could have been reached through l
the formal process. In other cases, where uncontrolled modifications may l
have been performed, the potential existed that such modifications may j
degrade plant safety without being detected.
l
(4) Design Change Control Procedure i
The team revieweo the Cooper Nuclear Station design control procedures l
listed in Appendix B of this report and identified the following concerns: 1
i,
"
(a) The basic duties and responsibilities of systeu engineers and engi-
neering specialists outlined in Procedure 3.2, " Systems Engineers and
Engineering Specialists," Revision 1, did not appear to be properly
implemented. Procedure 3.2 indicated that system engineers and
l
engineering specialists would be knowledgeable about their assigned
plant systems or area and be responsible for maintaining an overview
of system activities. Specific duties included evaluation of system .
design modifications, maintenance and testing, approval of technical '
end training documentation, trending of performance characteristics,
l and maintaining the design bases for the systems. As identified in
l other sections of this report, these duties were not being
l
l
effectively accomplished. The inspection team identified that the
performance characteristics for the service water system ,
battery rooms were not defined; an STP was not adequately controlled; l
1
-15- 1
f
L _ _-_
- - - _ _ _ - _ _ _ __
.
.
.
.
design basis calculations, drawings and other system reference
~
documentation were not updated after system modifications; and alarm
setpoints for diesel fuel tanks were improperly set. Each of the
above concerns either directly or indirectly affected the design
basis of the Cooper Nuclear Station. Consequently, it appeared that
the system engineers and engineering specialists were not adequately
performing their assigned duties.
(b) The methods used to control permanent design changes described in
Procedure 3.4 " Station Design Changes," Revision 4, did not appear to
meet the requirements of ANSI N45.2.11-1974 " Quality Assurance
Requirements for the Design of Nuclear Power Plants." In Procedure
3.4, changes were classified as either a design change (DC) or an
equipment specification change (ESC). Procedure 3.4, stated that
ESCs were used for simple modifications that were functionally
equivalent to the installed or original equipment and that did not
3 require the level of approval, implementation controls, and
documentation needed for design changes (DCs). Specifically,
detailed checklists to ensure that design change inputs were
adequately considered, incluaing an independent design verification
and performance of design calculations were not required to be
completed when accomplishing an ESC, ANSI N45.2.11-1974 Section
6.1, required not only a design verification but also required that
those efforts be clearly documented and auditable. It did not appear l
that the intent of ANSI N45.2.11-1974 was fulfilled when design i
'
changes were accomplished as ESCs. A limited review of ESCs indi-
cated that this type of design change was used to modify supports, l
l
change valve types (gate to globe), procure replacement parts from a
different vendor, perform equipment qualification upgrades of com- l
ponents and to modify valve actuators. In addition, Procedure 3.4 l
i
allowed using an ESC to replace a welded pipe joint with a flanged
joint without the benefit of appropriate engineering analysis and l'
review. Each of the above examples has the potential to modify the
original design basis unexpectedly because of the minimal reviews
required by ESCs.
(c) The program for the control of changes to approved design change
packages did not appear to be adequate. Procedure 3.4 discussed
three types of changes: (1) on-the-spot changes (OSCs) (minor pen
and ink changes); (2) revisions (changes requiring more reviews than
pen and ink changes); and (3) amendments (changes requiring a
complete review). The criteria for how to classify a proposed change
into one of the three categories were not discussed. The inspection
team was concerned that changes could be incorrectly classified and
would not receive adequate review, analyses and approvals. ANSI
h45.2.11-1974, Section 8.0, required that design changes be justified
and subjected to design control measures commensurate with those
applied to the original design. Design Control Audit f87-01 recog-
nized a similar concern and indicated that a potential programmatic l
problem existed wherein significant changes could be incorrectly
classified as OSCs. During the review of the selected systeus, the l
inspection team reviewed only one design change amendment; DC 85-110, !
Amendment 2, " Installation of PMIS Augmentation." This DC was
complete except for the final completion report. This amendment
allowed partial completion of the modification by rerouting 12 cables
-16-
- - - _ _ _ _ - _ _ _ _
.
.
4
!
and not connecting them to their intended terminals. Procedure 3.4
required that the same review and approval process applied to the ,
original design change also be applied to amendments. The amendment
package was incomplete and it appeared that the engineering analyses
and design input considerations were either inadequate or omitted.
The inspection team was concerned that by bypassing the procedural
steps, some logistic consideration such as training, operating proce-
dures or drawing revisions may be omitted.
(5) Drawing Control
The inspection team identified the following drawing deficiencies during
their reviews:
(a) The configuration of the 3-inch drain lines off the motor operator
strainers for the service water system did not match the configura-
tion shown on a piping and instrumentation drawing (P&ID) 2000, sheet
1 of 5. Revision 24. 3
'
(b) General arrangement drawing 2056, Revision 5, of the service water
intake structure did not reflect that two of the three fire pumps ,
that were located there originally had been removed.
(c) P&ID 2077 showed the fuel oil system for the diesel generators. On
this drawing the motor driven tuel oil pump was shown inacurrately as
a centrifugal pump and the engine mounted pump was shown as a vane .
'
pump; both are vane pumps.
(d) Inlet and outlet pressure gages mounted on the main lube oil filters
and strainers for both diesel generators were not shown on the lube
oil system drawing KSV-46-5, Revision 2. The gages were used to
perform periodic surveillance tests to determine filter and strainer
plugging. They were also not numbered or covered by the plant's
instrument calibration program.
(e) Design change 74-94 installed a shutoff valve in the oil supply line
to the diesel generator turbocharger bearings. This valve was not
shown on the lube oil drawing KSV-46-5, Revision 2.
(f) Design change 80-69 added a vent off the suction piping to the diesel ,
generator jacket water pump for each unit and added a constant vent
on the jacket water circulating pumps. Neither of these changes was
reflected on the jacket water drawing KSV-47-9, Revision 3.
(g) On diesel generator starting air drawing KSV-48-5, Revision 3, a
branch line to the pressure control for diesel generator cooling does
not appear on the corresponding P&ID 2077, Revision 9.
(h) On diesel generator starting air compressor drawing P&ID 2077,
Revision 9, a branch line was shown in each unit going to the air
compressor unloaders. This line was not shown on drawing KSV-48-5,
Revision 3.
The inspection team could not determine the root cause for the relatively
large number of errors found in the drawings reviewed, but was concerned
that there was a significant deficiency in the process for revising
-17-
- _ _ _ - _ _ .
- - - _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ . _ _ _ _ _
.'
.
'
drawings. The licensee had previously recognized similar problems with
their drawings and had instituted a verification program to improve the
overall quality of station drawings.
The inspection team also checked that the correct revisions to controlled
drawings were distributed within the station and at the corporate loca-
tions. Twelve drawing sheets were checkea in the control room, technical
support center, and in the master file used for issuing drawing and no
deficiencies were identified.
'
(6) Quality Level Classification
The licensee incorrectly classified numerous components associated with
the emergency diesel generator system as nonessential. Examples included
the starting air compressors, compressor motors, compressor auto start
controls and selector switches, and muffler bypasses. Other examples were
noted which involved the omission of components from the "Essentibl/
Nonessential Equipment Classification Program," P158-30-1, Revision 1,
such as DGSA-REL-DG1 (SC), " Air Compressor DG1A engine starter motor
contactor" and DGSA-SW-43 SAC 15. " Control switch for DG1 air compressor
1B." The above list is not intended to be all inclusive, but only a
representative sample of incorrectly classified components. It appeared
that the engineering evaluation of the air system incorrectly determined
that the air system was only required to start the diesel generator and
incorrectly classified all system components upstream of the air receivers
as nonessential. The licensee's emergency diesel generators were
pneumatically controlled and required air to be provided throughout
caeration. Consequently the entire system, including the compressors
should have been classified as essential. Initial reviews performed by
the licensee indicated that these components were classified incorrectly
only recently and that the installed components were originally purchased
correctly as essential.
The inspection team was concerned that there were other essential systems
and components which also may have been incorrectly classified as
nonessential. Systems or com3onents that are improperly classified and
inproperly maintained cannot ae relied on to perform their safety
functions.
3.2 Surveillance and Inservice Testing
The inspection team conducted a technical review of the surveillance and
inservice test (IST) programs as implemented on the emergency electrical,
service water, and emergency diesel generator systems. This review included an
evaluation of the technical adequacy of the testing procedures, and test
results to verify system components functioned as required by Cooper Nuclear
Station Technical Specifications and USAR. The scheduling and accomplishment
of testing to meet the periodic requirements of ASME Code Section XI and
Technical Specifications were not reviewed.
3.2.1 Service Water System Testing
The following service water system test procedures and data were reviewed
during the inspection:
- 6.3.18.1, " Service Water Pump Motor Operability Test," Revision 07
-18-
- _ - _ _ _ _ - _ - _ _ _ _
L
!..
l.
.
- 6.3.16.2, " Service' Water Motor Operated. Valve Operability Test," ;
Revision 11 -:
!
- 6.3.18.3, " Service Water Surveillance Operation," Revision 18
The team evaluated the system test procedures and results for the service water !
system to determine its ability to provide adequate cooling to the emergency
ciesel generators and other essential components under the design basis acci-
dent scenario of one pump supplying all required loads. The required flows
specified in Section-8.1.5 of the USAR identified total post-accident flow
requirements of 8992 gallons per minute (gpm), consisting of flows to one
reactor equipment cooling (REC) heat exchanger (1000 gpm), two emergency diesel
generator heat exchangers (1600 gpm each), one residual heat removal (RHR) heat
exchanger (4000 gpm) and the control room ventilation system (792 gpm). The
team identified the following concerns regarding the ability of the service
water system to adequately provide the required heat removal for these loads:
-(1) Service Water System Heat Transfer Capacity Measurement
The actual heat removal capabilities of the service water system have
apparently never been measured. The team reviewed the surveillance and
preoperational test data provided by the licensee and determined that
previous service water system testing was limited to measuring system
pressure and flows. The licensee asparently concluded that if adequate
flows were provided to the various neat exchangers, there would be suffi-
cient heat removal capabilities. The coefficient of_ heat transfer for the
various system heat exchangers was not measured .nor was any trending for
heat exchanger fouling performed. This practice was contrary to Section
6.1.5 of the USAR which stated that flow, pressure and temperature data
from the critical heat exchangers was periodically monitored to detect any
trends from silt accumulation. The inspection team was concerned that a
minimal amount of fouling, not detectable by flow measurement, could
significantly reduce.the heat transfer coefficient of the heat exchanger
and prevent it from fulfilling its design function.
(2) Service Water System Flow Measurement
The service water system has apparently never been demonstrated to be
l
capable of providing the flows required by the USAR to each essential load
during the design basis accident scenario of one pump supplying all loads.
The periodic surveillance tests only measured pump head and total flow to
all system components. The preoperational test, performed in 1973 with
pumps capable of delivering the design flow rate (8000 gpm at 125 feet
lead), was designed to verify that the required flows to components could
be achieved. However, the test was stopped prematurely before the i
required' flow to the emergency diesel generator was achieved. The test
documentation was annotated to state that the test engineer was convinced ;
'
that required flows could be achieved to all components through flow
balancing because the observed total system flow was adequate. The
inspection team disagreed with the conclusion that adequate flows to
individual components could be achieved by the operators. It appeared l
that flow to the emergency diesel generator heat exchanger was limited by
a restriction orifice in the line. Therefore, flow could not be increased
to the diesel generator heat exchanger by opening a throttle valve in the
line and reducing the overall system resistance. Flow to the emergency
diesel generator could only be increased by throttling down on flows to
the other components, thereby increasing the system's resistance and
reducing total system flow.
-19- i
,
17
,
- (3) Service Water System Pump Acceptance Value
o _The acceptance-value (6090 gpm at 125 feet head) for the service water
pump tests. appeared to be inadequate. The value was provided to the
licensee by their architect-engineer based en an analysis of system and
pump design head curves. The design basis accident scenario required one 1
pump to supply the required flows through one service water system train.
Adequate flow to the emergency diesel generator heat exchangers could not
be achieved during the preoperational test with pumps operating at'their
design values. The team concluded that pumps performing at the acceptance
value levels would not be able to provide the flows required by the USAR
to the individual safety-related components under the worse case scenario.
(4) Service Water System Preoperational Test Deficiencies
t
The following additional deficiencies were identified by the inspection ;
team during its review of the preoperational test data for one pump l
supplying loads through the one service water system train:
!
(a) The valve lineup did not appear to be adequately controlled during
the test. The team could not determine whether the cross connect
valve downstream of the pump discharge, SW-M0-37, was open or closed.
The worst-case accident scenario has this valve closed. With the
valve open, coolant would flow to the loads through both system
trains which would prove less restrictive to system flow and would be
non-conservative from the accident scenario.
(b) System flows did not appear to be fully accounted for during the
test. The team compared the pump design flows for the observed
pressure with the total measured flows and found that the measured
values had not accounted for approximately 1000 gpm. The team
suspected that these unaccounted flows could be caused by leaking or >
misaligned valves.
(c) The test did not appear to cor. sider the potential for system flow
degradation caused by fouling or silt buildup. The test was per-
formed under clean strainer conditions as indicated by the measured
low strainer pressure drops. Additionally, the licensee's analyses
for the system indicated that silt buildup would resch equilibrium
within hours after the pump lineup was altered and that the buildup
was greater at lower service water system flows. There was no 1
'
indication that the test was performed so that the silting was
allowed to reach equilibrium for the single pump configuration. The
team was concerned because the licensee's analyses indicated that 4
silt buildup could cause a significant pressure loss.
(5) Service Water System IST Program i
1
The inspection team hao additional concerns about the impicentation of
the overall IST program based on the review of the test program for the
service water system. It appeared that the licensee was not fully imple-
menting the requirements of ASME Code Section XI for the IST program in
the following instances:
(a) New acceptable, alert, and required action ranges for service water
punp head were not always calculated after new reference values were
established as required by both ASME Code Section XI, Article ;
l
IWP-3111 and Engineering Procedure 3.9, " Inservice Testing of Pumps
-20-
- _ - _ _ _ _ _
.
.
General Procedure," Revision 01. Using.the latest reference values,
.the team determined during the inspection that service water pump 1C
was operating in the alert range and the licensee had not increased
the' testing frequency as required by'ASME,Section XI Article 3230.
In addition, when the team reviewed the historical pump data using 1
the correct-reference values, it appeared the service water
,
was operating in the alert range during the monthsJune, of March, pump ]1 1
i
and September of 1986. Because an incorrect reference value was
used, this error was not detected; monitoring was not increased; the ]
cause of the deviation was not determined; and no corrective actions j
were performed.
- (b) IST program tests were not always utilized to determine the adequacy
of maintenance. After maintenance on February 21, 1986, the
]
reference value for service water pump 1B was established in the
, previous alert range without adequate justification. The test was .)
annotated that the pump lift could be adjusted to correct the defi- !
ciency; although no action was taken. The test frequency was
increased. Pump performance subsequently declined until it reached
the~ action range and the pump lift was adjusted to improve pump 1
performance to the alert range values. The team concluded that j
further maintenance adjustments to the pump lift could have been made
to allow the new reference values to be established within the'
acceptable range, as required by AStiE Code Section XI, Article
IhP-3111.
(c) -Adequate guidance was not provided for the trending of IST program.
data. Procedure 3.9 required that historical pump data be recorded
in tables in chronological order of performance without regard for
i segregating data.for the various pumps. There was no requirement to
graph or otherwise trend data for the same pump over its operating
life. Interviews with the system engineer revealed that' pump data
was graphed anc trended informally by the engineers, but there was no
requirement or standard to follow for trending.
The team was concerned that the licensee has apparently never demonstrated that
the service water system would adequately supply its essentisl loads during the
design basis scenario. Additionally, there did not appear to be an adequate
periodic testing program to ensure that the system could continue to perform
its design functions.
During the inspection, the licensee identified that the USAR minimum flow
requirements for the one-pump scenario appeared to be in excess of the flow
actually needed for the plant. Service water flow to a disabled emergency
diesel generator could be secured, thus reducing the minimum flow requirements
'by 1600 gpm. The team concurred with this preliminary estimate, but noted that
to formally change this flow requirement, the USAR must be amended. As a
result of the team's findings, the licensee committed to conduct the necessary '
.
testing and analyses to demonstrate that the service water system flows ana
heat removal capabilities were adequate. In a letter of July 24,1987, the
licensee outlined a plan for testing and analyzing the system and provided a
~
revised " Service Water System Design Basis Document" which identified a new
minimum flow requirement of 7355 gpm'to the heat exchangers. This minimum flow
requirement assumes no flow will be diverted from the heat exchangers due to
valve leakage. Additionally, the licensee committed to perform the necessary
-21-
- .
-
.
.
l
testing during any outage that lasted longer than five days. The team still
remained concerned that the system may not be able.to achieve adequate. flows to i'
the individual service water system loads and that the actual heat removal
capabilities of the system have not been measured.
3.2.2 Emergency Diesel Generator Systems
The inspection team reviewed the technical adequacy for the following diesel :
generator systems test procedures: i
- 6.3.10.16, " Check Valves in Cooling System of Diesel Generator )
Integrity Verification," Revision 0 J
- 6.3.12.1, " Diesel Generator Operability Test," Revision 19
)
- 6.3.12.2, " Diesel Generator Starting Air Compressor Operability Test,"
Revision 12 i
- 6.3.12.3, " Diesel Fuel 011 Quality Test," Revision 9
- 6.3.12.4, " Diesel Fuel Oil Availability," Revision 11
- 6.3.12.5, " Fuel Oil Day Tank Level Switches Functional Test,"
Revision 12
- 6.3.12.6, " Diesel Generator Annual Inspection," Revision 20
- 6.3.12.7, " Diesel Generators Auto Start Circuit Integrity Test," ,
Revision 11 j
i
- 6.3.12.8, " Diesel Generator Fuel Oil Transfer Pump Flow Test, Revision 4 l
- 6.5.12.9, " Diesel Operability Test With Isolation Switches in Isolate
Position," Revision 04
The following concerns were identified as a result of this review:
(1) Emergency Diesel Generator Starting Circuit Test
The emergency diesel generator starting circuit did not appear to be
adequately tested. There were eight contacts, each of which corresponded
to a logic sequencer that automatically started the diesel generator.
Procedure 6.3.12.7 only tested three of the sight contacts. Those tested
included the contacts that sensed loss of voltage to the two 4160 Yac
critical buses and a low water level in the reactor vessel. The remaining
five contacts, which sensed an undervoltage condition on the emergency and
startu) transformers and for tripping of any one in the string of the
three areakers which provided power to the two critical buses from the l
normal transformer, apparently were not tested. The team was concerned l
that all eight contacts should have been periodically verified from its j
sensing point via its logic chain to the emergency diesel generator
starting circuit.
(2) Emergency Diesel Generator Air Compressor Test
The standby and lead feature of the emergency diesel generator air ;
compressors did not appear to be adequately tested. The lead and standby l
l
!
_ _ - _ .-_ _
_ _ . _ - _ _ _ _ _ _ _ _ _ - _ _ _ _ - - _ _ _ - _ _ _ . _ - _ _ - _ _ _ _ _ _ . - - _
L :' !
. ,
-
-
-
diesel generator starting air compressors were designed to start at 225
However, Procedure 6.3.12.2 required
psig and 230 psig, respectively. verification that both the lead and standb
220 psig. . Additionally, the test procedure did not require that the
as-found or as-left setting of the pressure switch for starting the
compressors be recorded.
As a result, the diesel starting air
compressors' switches could drift out of alignment so that they would not
start as designed and the periodic surveillance testing procedures would
not have identified this deficiency.
I
3.2.3 4160/480 Vac Systems Testing
The following procedures and test data for the critical 4160 Vac and 480 Vac
systems were reviewed for technical adequacy:
- 6.3.13.1, " Low Voltage Relays 27x3/1A and 27x3/1B Functional Test" f
(4160 Yac), Revision 17 (
4
- 7.3.1, " Protective Reicys Setting and Testing," Revision 9
l
- 7.3.2, " Low Voltage Circuit Breaker Setting Testing, and Maintenance," I
Revision 9
- 7.3.3, " Ground Relays Setting and Testing," Revision 4
- 7.3.7, " Testing Timing Relays," Revision 5
- 7.3.8, " Diesel Generator Field Ground Relay Maintenance and Functional
Check," Revision 1
- 7.3.17, " Checking 4160v Breakers," Revision 8
These procedures were determined to be adequate for demonstrating sy
functionality and operability.
data reviewed.
3.2.4 125 Vdc and 250 Vdc Systems
.
!. The inspection team reviewed the technical adequacy and test data for the
following de system surveillance procedures:
- 6.3.15.2A, " Station Battery Performance Test," Revision 2
-
- 6.3.15.6, "125V/250V Battery Charger Performance Test," Revision 0
- 7.3.31.2, "125V Station Battery Intercell Connection Testing and
Maintenance," Revision 0
- 7.3.31.3, "250V Station Battery Intercell Connection Testing and
Maintenance," Revision O.
The procedures listed above appeared adequate to450-1580, test the"IEEE de system exce
the inspections reconnended in Section 4.3 to IEEE Standard
-23-
- --_-__ __
- - _ _ - ______
'
~
..
Recommended Practice for Maintenance, Testing and Replacement of Large Lead
Storage Batteries for Generating Station and Substations," wer
performed. conduct the monthly and annual inspection of intercell resistances and cell
connector tightness checks, but these procedures had never been performeo.
This oversight appeared to be contrcry to USAR Section 6.5 which stated that
the periodic testing of the station batteries conformed with the
450-1980.
recommendations of the vendor manuals and IEEE Standard
3.3 Operations.
The inspection team evaluated the adequacy of operator shift manning and
experience; control of ongoing activities; normal, a hrm, abnormal, and
emergency operating procedures; equipment operation in abnormal and emergency
situations; and routine system status verifications. This evaluation focused
on how each of these elenents was related to the emergency electrical systems,
including the emergency diesel generators, and their required support systems.
3.3.1 Service Water System Casualty Operations
At the time of the inspection, no casualty procedures existed for the service
water system, and station operators did not appear to be adequately trained on l
the possible indications of or imnediate actions required f
This weakness was significant because there were a
service water system loads.
number of operating and design features that
The could confuse
following operators
issues were and to
of concern
complicate recovery from an accident.
the inspection team:
(1) Operator Immediate Actions Durint Casualty
On loss of ho. 1 emergency diese' generator, power would be lost to the
MOV (SW-MO-117) which automatically isolated the nonessential service
water loads on low discharge pressure and thus redirected flow to the i
essential loads. If this occurred, control room operators would have to j
shut valve SW-H0-37 to redirect flow to the essential loads upon receiving
the low-pressure alarm and realizing that power to Valve SW-MO-117 was
lost. There was no procedural guidance for these actions and interviews ,
revealed that operators had not been trained for recognizing andvalve
Until respond- J
ing to this scenario involving the service water system. j
SW-M0-37 was shut it appeared that there would be inadequate flow to the l
essential
condition.
loads and that a single pump could be operating in a ri a
loss of all service water system cooling capabilities. This issue was ;
discussed in Anendment 14 to the USAR, Question 10.11, but was apparently l
not implemented in station procedures or operator training programs. 1
(2) Service Water System Flow Balancing !
l Flow balancing of service water system essential loads could be compli-
( cated by the following design and operating features:
l
(a) The air operated flow control valves for the REC and energency diesel
generater
system.
heat exchangers were supplied from a nonessentl 1
to be redirected to the improper loads.
-24-
- - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
__ _ _ _ ________
- a,
- ..
~
(b) The normal; service water system operating lineup was to have all
cross-connect valves ~ opened to. improve system flows. Some of these
valves may have to be shut locally by operators tc provide adequate
L flow to essential: loads.
_
(c) The 190Vs in 'the service water. system line to_ the REC and RHR systems
were powered from 480 Vac load centers which.could be. lost along with'
'
their respective emergency diesel generators.. Upon. loss of the load
center, repositioning these valves to direct service water system
flows would require manual operation of the valve locally.
(d) Communication between the' control' room and the emergency diesel
. generator rooms for balancing flow could be hampered because of noise
interference from the diesel engines. Nonconformance report (NCR)-
.6379 of October 27, 1986 documented that when the diesel generators
operated,;there was-too much background noise _to adequately =
consunicate between the control room and diesel room where service'
water flow control valves were located. Tne licensee had not taken
the corrective action of installing the. sound isolating boxes in the
diesel room, as recommended by the NCR evaluation.
The_ team was concerned that the combination of system design features requiring
operator action to control service water flows coupled with the absence of ,
casualty procedures and training to manage these actions could compound a
station accident. As a result of the team's findings, the license committed to ;
develop operating guidance for post-accident operation of the service water
system. Procedure 2.4.8.3.1, " Loss of Service Water System Pumos," was ;
reported in the licensee's letter of July 24, 1987 as being revised to provide I
the'necessary guidance for post-accident service water system operation.
3.3.2 Operating Procedures
- The inspection team reviewed the normal and emergency procedures listed in "
Appendix B for the emergency electrical and auxiliary support systems. During
this review, the team identified the following deficiencies: j
(1) There was no operating procedure for the diesel air compressor in the l
emergency diesel generator air system. This compressor was used as a
backup for the electric motor air compressor and required manual starting
and control when charging the air receivers. The vendor manual was .
1
located at the compressor, but the guidance provided in this document was
'not adequate for system operation. ;
)
(2). Emergency Operating Procedure 5.2.5.1, " Loss of All Site AC Power-Station j
Blackout," Revision 3, contained some ambiguous wording which could lead J
an operator to incorrectly believe that the startup and emergency trans- J
formers could be energized by the emergency diesel generator. The station
was designed with interlocks in the 4160 Vac circuit breakers to prevent ;
this operation. The licensee initiated a procedure change during the
inspection to correct this ambiguity.
(5)' Operating Procedure 2.2.20 " Standby AC Power System (Diesei G2nerator),"
Revision 23, incorrectly stated that in order to prove the readiness of ,
the cmergency diesel generators, it was necessary to parallel the units
with the startup or eneergency transformers. As stated in USAR Sectiun
1
-25-
>
__ __ ___ -___
,
',
.
4 VIII-5.5, the emergency diesel generators were only load tested in paral-
1el with the normal station transformer. Circuit breaker interlocks were
. installed to preclude operating the emergency diesel generators in paral-
1el with the startup and emergency transformers.
'(4) Procedures 2.2.24, "250 VDC Electrical Systera." Revision 13, and 2.2.25,
"125 VDC Electrical System," Revision 16, contained references to breakers
and switches on the battery charger that. disagreed with the com)onent
labeling. This mislabeling could confuse personnel following tie
procedure.'A procecure change was initiated during the inspection to
correct this discrepancy.
-(5) The ground ammeters for each of the 400 Vac critical buses in the switch-
gear rooms were not labeled. These instruments were used for daily
surveillance and fault detection on the 480 Vac buses. A work request was
initiated during the inspection to label the instruments correctly.
The inspection team was concerned that incorrect procedures and the lack of
labels on instruments and switches cause a problem for system operaticn. The
licensee had previously identified a similar concern and had initiated a
program to improve procedures and labeling in the station.
3.3.3 Conduct of Operatiors
The inspection team considered the overall conduct of routine operations within
the plant to be a strength. This evaluation was based on interviews with staff
personnel, walkthroughs of system procedures and reviews of the operators'
implementation of administrative procedures. The following specific attributes
were noted:
(1) Operators were very familiar with station drawings and technical reference
documentation related to the systems being reviewed. The team's questions
were answered correctly, and the proper reference materials were cited.
(2) Control room logs for shift turnover, Technical Specification surveillance
tracking, temporary modifications, and clearances were reviewed, and no ,1
discrepancies were noted.
(3) This issue of independent verification was well understood by the opera-
tors interviewed and appearea to be effectively implemented based on the
team's review of station procedures and logs.
(4) Operators were knowledgeable with two events chosen by the team for review
and the resultant corrective action implemented to prevent future occur-
rences. Those operators interviewed by the team had been adez.;ately
trained and were responsive to the team's questions concerning an
inadvertent energency diesel generator start that occurred on October 27,
1986 and an unanticipated reactor scram that occurred on February 18,
1987.
3.3.4 Operations Staff Training
The program for operator training appeared to be effectively implemented to
improve personnel qualifications. A program was functioning to ensure that
operating reactor events within the industry and at Cooper Nuclear Station were
-26-
- - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
,
-
included in the training program as required. A training work request tracking
system appeared to be effective in ensuring that required training efforts were
achieved. The training manuals reviewed were effective and useful. Lesson
plans were based almost entirely on the training manuals and appeared to
adequately convey the relevant information to the operators. Four design
changes were reviewed to determine if appropriate training was given when
design changes were made. In all four cases, training work requests were
initiated to evaluate need for training and, where appropriate, training took
place.
'
.
3.4 Maintenance
The inspectior .eam reviewed maintenance procedures, vendor manuals, equipment
histories, and the existing material condition of the 125 Yde and 250 Vdc
station batteries, emergency diesel generator and diesel auxiliary systems. To
a lesse.r degree, the team reviewed the equipment histories and the existing
material condition of the 4160/480 Vac electrical and service water systems.
5
Addithnally, interviews and discussions with plant maintenance personnel were
conducted to determine how the maintenance program was being implemented.
3.4.1 125 Vdc and 250 Yde Station Batteries
The inspection team reviewed the maintenance related activities and the exist-
ing material condition of the station batteries: The following observations
were made:
(1) Numerous battery cells in both trains of the 125 Vdc and 250 Vdc systems
exhibited advanced stages of deterioration including plate swelling,
flaking of plate materials, and significant deposits of sediment in the
bottom of the cell jars. Discussions with licensee personnel revealed
that cell deterioration became most pronounced during the past two years
of battery operation, and that two cells had failed within the past year
in 125 Vdc battery 18. The licensee plans to replace the 125 Yde station
batteries during the next scheduled refueling outage in December 1987, and
the 250 Vdc st; tion batteries are scheduled to be replaced during the 1988
refueling outage.
(2) The ambient temperatures observed by the team in the station battery rooms
appeared to exceed the values recommended by battery vendor manual 69-8-2,
" Battery, Charger and Inverter Composite Instruction Manual for Consumer
Public Power." The battery vendor manual stated that everage battery
temperature should be maintained at 77'F, and that no cell temperature
should exceed 90*F for more than 30 days per year. Temperatures in the
battery rooms were noted to be 89'F and 88'F for battery rooms A and B
respectively, during the inspection when outside ambient temperature was
80-85'F. A review of battery records and discussions with the licensee
staff indicated that ambient temperatures in the battery rooms have
exceeded 100'F several times each year depending on the ambient
temperatures of the outsice areas surrounding the plant. The team was
concerned that these elevated operating temperatures would decrease the
overall life expectancy of the station batteries and reduce their
reliability to perform their oesign function. Maintenance and engineering
personnel attributed the recent signs of cell deterioration and cell
failures to the length of service of the batteries and to the elevated
battery operating temperatures.
-27-
- _ - ______ _
- _ _ _ _ _
'*
,.
.
.
As discussed in Section 3.1.2(1), the team was further concerned that the
licensee did not plan to improve the HVAC system for the battery rooms
commensurate with the scheduled station battery replacements at the station.
Continued operation of the station batteries at these elevated temperatures
appears to significantly degrade their life expectancy and overall reliability
to perform as designed.
3.4.2 4160/480 Vac Critical Transformers
The inspection team was concerned about the overall reliability of the 4160/480
Vac critical transformers to' provide powcr to the loads operating during .
accident conditions due to high ambient temperatures in the critical switchgear !
room, and the reliability of the transformer's freon gas cooling system. The i
following observations were made:
(1) The freon gas aressure for the transformer cooling system was not being
maintained witiin the recomended vendor specifications. Vendor manual
69-12-2, " Low Voltage Metal-Enclosed Switchgear" specified that at full
transformer load, the freon pressure should be maintained between 6 to 8
psig. During the inspection, the team noted the gas pressure to be 3.8 l
psig and 4.8 psig for the transformers in the 1F and 1G critical buses,
respectively. A review of the maintenance equipment history file revealed
that there has been a repetitive problem in maintaining adequate freon gas
pressure because of gas leaks in the cooling system for the 4160/480 Vac
critical transformer F. The licensee had identified this problem pre-
viously and an overhaul of the freon system during the last outage had not ,
corrected the leakage problem. Although the licensee had.taken periodic !
readings of the cooling system pressure, it appeared that gas pressures
were allowed to bleed down significantly out of the normal operating range l
before the cooling system was recharged. Discussions with licensee
personnel revealed that plans existed to perform extensive maintenance
work on the 4160/480 Vac transformers to resolve freon gas leak problems
during the next outage. i
Additionally, the freon gas low-pressure alarm setpoint appeared to be set
too low when compared to the recommended vendor normal operating pressure
range. The low-pressure alarm for the transformers was set at 1 psig
decreasing, indicating that a total loss of gas pressure was imminent. I
According to vendor manual 69-12-2, on a complete loss of freon gas, the I
available transformer capacity was reduced to 60 percent. The licensee
intended to load the transformers to approximately 75 percent of rated
capacity during accident conditions and did not have an analysis available
to demonstrate that operation with the reduced freon pressure was
-
satisfactory. l
l
(2) The 4160/4b0 Vac critical transformer operating temperatures were I
apparently not being maintained within the recommended vendor manual
s)ecifications. According to vendor manual 69-12-2, ambient temperatures
s1ould never exceed 104'F, and the average over 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should not exceed
86 F. During the inspection, the team noted that ambient temperatures in
the critical switchgear room were consistently in excess of 100*F.
Interviews revealed that these temperatures were normal for the critical
switchgear room. As discussed in Section 3.1.2(1), the team was further
concerned that the licensee did not plan to improve the HVAC system during
the next scheduled outage.
-28-
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .
M
.
.
~
3.4.3 Instrument Calibration
The licensee's program for calibrating installed instruments appeared inade-
quate. The inspection team identified several instruments monitoring safety-
related parameters that were not calibrated. Procedure 14.0.1, " Instrument
Record System," Revision 2, required the periodic calibration of essential
l
instruments and those instruments used to control the plant activities. When
'
the team raised this concern to licensee management, a review of the instrument
calibration program was performed by the licensee. liore than of 700 instru-
ments were reviewed and approximately 5 percent were not covered by the
periodic calibration program. These instruments were subsequently calibrated
and added to the licensee's aeriodic calibration program. The team was
concerned that instruments t1at were out of calibration could provide false
information to personnel operating the plant.
3.4.4 Maintenance Program Administration
The inspection team reviewed the licensee's program for administrative control
cf preventive and corrective intenance. This review included maintenance
schedules, documentation of approximately 75 work requests, equipment his-
tories, and trending of equipment maintenance. The team reviewed the following
maintenance procedures for administrative control of preventive and corrective
maintenance:
- hP 7.0.1., " Work Item Tracking - Corrective Maintenance," Revision 6
- MP 7.0.2., " Work Itern Tracking - Preventative Maintenance," Revision 1
- HP 7.0.4., "Special Maintenance Procedures," Revision 1
- HP 7.0.5., " Maintenance Quality Control Program," Revision 3
- HP 7.0.6., " Work Item Tracking - Equipment History," Revision 0
During this review, the team identifies the fc11owing concerns:
(1) Procedure MP 7.0.1 did not appear to provide adequate controls over
nonessential work on essential components or systems. This work was
defined as that which would not degrade the safety function of the system
or component and did not require the quality assurance (QA) program
practices such as procedural compliance, retesting, or quality control
(QC) reviews. The team was concerned that there were no reviews of this
work to ensure that the proper classification was made and that essential
work did not take place outside the control of the QA program.
An example of this was maintenance work request (HWR) 86-5360, completed
December 24, 1986, which was issued to perform minor maintenance on No. 1
emergency diesel generator jacket water bypass pump motor. This HWR was
initially classified correctly as nonessential. However, the work was
expanded to include a pump overhaul which crossed into the essential
portion of the system. No procedures were used for this maintenance, no
post-maintenance testing was conducted and there was no QA involvement in
the maintenance activity. Subsequently, on May 6, 1967, this pump failed
again and MWR 87-1523 was issued to correct the problem. In this
instance, the work was properly classified as essential, procedures were
used and adequate post-maintenance testing was conducted. No further
maintenance problems were noted with this pump.
(2) Procedure MP 7.0.5 did not provide adequate control over maintenance
-29-
- - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
O
< troubleshooting activities. Normal corrective maintenance activities are
reviewed by maintenance. engineers, operations, quality assurance,
. maintenance planners and shop supervisory personnel before accomplishment
to ensure that adequate quality control review and technical instructions
were provided to maintenance personnel. However, with troubleshooting I
activities, the workers were allowed to proceed beyond identification of
the problem once the shop supervisor had determined what was required.-
<
Therefore, it appeard that only one person replaced.the functions which I
were normally performed by the QA, operations, maintenance engineer,.and i
maintenance planning: personnel. The team was concerned that there were
apparently no second checks on the technical adequacy of the proposed
maintenance and that the decisions could all be made by one individual. J
For example, MWR-4514 was issued to troubleshoot and correct a problem
'
with No. 2 emergency diesel generator exhaust bypass butterfly valve
, pressure switch. The cause of the problem was identified as lube oil in 1
the. pressure switch and the switch was replaced. However, there was no
. quality control or post-maintenance testing for the activity and the ];
source of the lube oil was apparently not found and corrected.
(3) The licensee did not adequately perform post-maintenance testing to ensure
that the equipment was correctly repaired. The team found the following
two. examples of inadequate post-maintenance testing, in addition to the
example cited in Section 3.4.4(2):
(a) MWR 86-0292 was issued to replace the gland water supply pump for the ,
RHR service water booster pump in January 1966. There was no
documented post-maintenance testing of the pump after installation.
Some months later, the licensee identified that it had installed the
wrong sized pump. The installed pump could only provide 20 gpni flow
instead of the 70 gpm flow required by the design specification. MWR
86-4432 was then issued to replace the small pump with the correct
pump, but again no post-maintenance testing was documented for this
activity.
(b) MWR 66-2919 was issued to adjust the pressure switch for diesel
generator starting air compressor 1B after a surveillance test
determined that the switch was set too high. The switch was adjusted
but no post-maintenance testing was indicated. In fact, the
surveillance test was not performed again for 26 days. It was not
clear to the inspection w am how the licensee determined that the
diesel air system was operable after it failed its surveillance test
and the maintenance was performed. !
P
(4) The overall quality of documentation contained in the MUR's reviewed was
considered to be marginally acceptable. Procedure MP 7.0.1 provided
insufficient guidance about the required supporting information and/or i
documents necessary to ensure overall adequacy and completeness of NWRs.
This guidance was necessary in order to ensure that individuals L
responsible for review, approval, and documentation of corrective 1
maintenance work were provided with necessary information to effectively j
carry out their responsibilities. Deficiencies in documentation were
noted in the following areas:
1ack of references to and/or attachment of supporting documentation ,
!
i
-30-
!
_ _ _ _ _ _ _ _ _- I
1
p
..
.
.
.
- 1ack of documentation of the as-found condition of components prior
to corrective maintenance-
- 1ack of riocumentation of post-maintenance testing requirements and )
acceptance criteria
poor documentation of results of quality control inspections j
The team was concerned that because of the poor quality of documentation,
recurring equipment problems over a period of a few years that would be
indicative of an undesirable trend or generic component deficiency could
go undetected because of poor equipment history. In addition MWRs that '
did not adequately describe the details of the maintenance work to be per-
formed would not provide sufficient information to personnel responsible
for ensuring the adequacy of quality control, especially if the work in- ,
volved troubleshooting. Licensee personnel stated that poorly documented
MWRs have been a problem and the licensee is evaluating ways to improve
the quality of documentation of completed maintena..ce work and quality
control inspections.
3.5 Quality Programs
The inspection team initiated a review of the licensee's organization and
program for QA auditing, quality control (QC) and corrective actions to compare
the QA findings with the results of the SSFI. During the review of NCRs,
several safety issues were identified that did not appear te be receiving
adequate management attention and corrective actions. The team concentrated on
fully developing these safety issues and their potential safety significance.
3.5.1 Inoperable Containment Isolation Valve
The licensee failed to take ad;quate corrective actions upon finding the core
spray pump 1B suction valve CS-MO-7B inoperable. This valve was classified by
Section VII-3-1 of the USAR and Technical Specification 3.7.4 a dual-function
MOV that was normally open to supply pump flow, but must be capable of shutting
to maintain containment integrity. The following sequence of events applied to
this issue:
- On March 21, 1985, IE Information Notice 85-22, " Failure of Limitorque
hotor Operated Yalves Resulting from Incorrect Installation of Pinion
Gears," was issued advising the licensee of recent events and recommending
corrective actions to prevent future problems with the MOVs. Addi-
tionally, Limitorque provided similar information to the licensee for its
MOVs. The Station Operations Review Committee (SORC) reviewed the MOV
maintenance history records and determined that this concern was not a
problem at Cooper huclear Station.
- On October 23, 1985, during an outage, the core spray pump 1B suction
valve CS-MO-7B failed surveillance test 6.3.4.2, "CS Motor Operated Valve
Operability Test," because of an incorrectly installed pinion in the motor
operator. The licensee issued NCR 4759 to document the failure, and the
50RC determined that the failure was not reportable since the plant was
shut down and the system was not required to be operable. Valve CS-M0-7B
was repaired and satisfactorily tested during the outege.
-31-
_ _ _ _ _ _
- _ - _ _ _ _ _ _ _ - _ _ __ _ _ _ _ _ _ _ _ _ - _ _ _ - ______- _ _ _ _ _ _ - - _ _ - - _ _ _ _ _ _ _ _ __
-
'
,
b
d -
' On November 22, 1985, the plant was restarted after the 50RC identified
.that there were no restrictions to startup because of open NCRs.
- On January.20, 1986, the engineering evaluation of NCR 4759 was completed
and the reconsnendation was made to inspect all MOVs that may have been
susceptibic to the reversed pinion problem. The SORC agreed.with this
recommendation and scheduled these inspections for the next outage in late
1986.
- From October 6, 1986 to January 4, 1987, the licensee inspected the
susceptible MOVs and found three additional MOVs with incorrectly
installed pinions, none of which had failed. Additionally, during the
inspection, at least three MOVs were also found to have missing lockwires
in the operator that hold the pinion gear locking screws in place. If
this screw should back out, the pinions could become misaligned causing
valve failure..
- On January 4, 1587, the plant was restarted again after the SORC reviewed
the open NCRs and found no restriction to startup.- The licensee subse-
quently reviewed and closed out NCR 4759 on April 6, 1987.
The inspection team had the following concerns about the licensee's actions and
evaluation during this sequence of events:
(1) The licensee failed to report to the NRC that it found valve CS-MO-?B
inoperable as required by 10 CFR 50.72 and 10 CFR 50.73. The report
should have been made even though the plant was shut down when the problem
was discovered. For example, 10 CFR 50.72(b)(2)(1) requires that reports
be made for events found during shut down that would have resulted in the
plant's principal safety barriers being seriously degraded if found when
the plant was operating. An inoperable primary containment isolation
valve, normally in the open position, is a serious degradation of a
principal safety boundary. Additionally, since the valve was found
inoperable during the test, it was presumed to be in the failed condition
since last operated during its previous surveillance test. This test was-
before plant shutdown, consequently the plant was operating with an in-
operable containment isolation valve. Additionally, 10 CFR 50.72(b)(2)
(iii)(6) and 10 CFR 50.73(a)(2)(v)(6) both require reports for any event
that could have prevented the fulfillment of safety function of structures
needed to control the release of radioactive material. An inoperable con-
tainment isolation valve would be in this category regardless of whether
-the plant was operating or shutdown.
(2) The licensee did not perform a timely evaluation of NCR 4759 and the SORC
j allowed the plant to restart without the benefit of the evaluation or
l consideration of the potential common mode failure mechanism to other
l systems with Limitorque MOVs. Valve CS-M0-78 was also on the licensee's
Equipment Qualification Master Equipment List and, consequently, the
,
' failure should have received a prompt determination of operability and
justification of continued operation to satisfy the requirements of 10 CFR
i
50.49 ano as outlined in Generic Letter 86-15. This evaluation was
l apparently not done, and the 50RC reconsnended plant restart without
! adequate justification.
l
-32-
l 1
_______.______ _______._.______ _ _ __ _ _;
- _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ __ _ __ _ ____ _ _ _ _ _ _ _ _ _ _ _ __ _ _
.
.
.
.
- On November 22, 1985, the plant was restarted after the 50RC identified
that there were no restrictions to startup because of open NCRs.
- On January 20, 1986, the engineering evaluation of NCR 4759 was completed
and the recommendation was made to inspect all MOVs that may have been
susceptible to the reversed pinion problem. The SORC agreed with this
recommendation and scheduled these inspections for the next outage in late
1986.
- From October 6, 1986 to January 4, 1987, the licensee inspected the
i susceptible MOVs and found three additional MOVs with incorrectly
installed pinions, none of which had failed. Additionally, during the
inspection, at least three MOVs were also found to have missing lockwires
in the operator that hold the pinion gear locking screws in place. If
this screw should back out, the pinions could become misaligned causing
valve failure.
- On January 4, 1967, the plant was resterted again after the SORC reviewed
the open NCRs and found no restriction to startup. The licensee subse-
quently reviewed and closed out NCR 4759 on April 6, 1987.
The inspection team had the following concerns about the licensee's actions and
evaluation during this sequence of events:
(1) The licensee failed to report to the NRC that it found valve CS-MO-7B
inoperable as required by 10 CFR 50.72 and 10 CFR 50.73. The report
should have beer. made even though the plant was shut down when the probicm
was discovered. For exmple,10 CFR 50.72(b)(2)M) requires that reports
be made for events found during shut down that would have resulted in the
plant's principal safety barriers being seriously degraded if found when
the plant was operating. An inoperable primary containment isolation
valve, normally in the open position, is a serious degradation of a
principal safety boundary. Additionally, since the valve was found
inoperable during the test, it was presumed to be in the failed condition
since last operated during its previous surveillance test. This test was
before plant shutdown, consequently the plant was operating with an in-
operable containment isolation valve. Additionally, 10 CFR 50.72(b)(2)
(iii)(6) and 10 CFR 50.73(a)(2)(v)(6) both require reports for any event
that could have prevented the fulfillment of safety function of structures
needed to control the release of radioactive material. An inoperable con-
tainment isolation valve would be in this category regardless of whether
the plant was operating or shutdown.
(2) The licensee did not perform a timely evaluation of NCk 4759 and the 50RC ,
allowed the plant to restart without the benefit of the evaluation or i
consideration of the potential common mode failure mechanism to other
systems with Limitorque MOVs. Yalve CS-MO-7B was also on the licensee's
Equipment Qualification Master Equipment List and, consequently, the
failure should have received a prompt determination of operability and
justification of continued operation to satisfy the requirements of 10 CFR
50.49 ano as outlined in Generic Letter 86-15. This evaluation was
apparently not done, and the 50RC recommended plant restart without
adequate justification.
-32-
- _-____ ___ ____ - __________
- - - - _ _ _ - _ ___ ___ _ - - __________- _ - ________ __ ___ _ _ _ _
.
.
.
'
(3) The licensee failed to issue an NCR to document the missing lockwires on
the three MOVs found during the pinion inspect' ions. An evaluation for
deportability and the effects of the failure for similar MOVs was not
performed even though IE Information Notice 84-36 (Supplement 1),
" Loosening of Locking Nut on Liniitorque Operators," was issued on
September 11, 1984 advising the licensee of identified problems caused by
missing lockwires on set screws in the MOVs.
(4) Maintenance Procedure 7.250, "Limitorque SMB Valve Operators Removal.
Overhaul and Replacement," did not appear to have adequate guidance as
recomended in IE Information Notice 85-22 for ensuring the proper instal-
lation of the pinion or that the lockwire was installed properly for the
set screws in the motor operator as identified in IE Information Notice
84-36.
The inspection team considered that this sequence of events derenstrated
several weaknesses at all levels of the organization for identifying, correct-
ing, and reporting significant deficiencies. The failure to assess the poten-
tial common mode failure effects of a component failure when information from
both the NRC and vendor has been made available is a significant deficiency in
the licensee's corrective action program.
3.5.2 Inadequate Station Operations Review Comittee (SORC) Reviews
Procedure 5.1, "Nonconformance and Corrective Actions," Revision 0, required
that the 50RC chairman and at least two SORC members review NCRs to determine
their safety significance and deportability requirements to the NRC. Based on
the team's review of NCRs, it did not appear that the 50RC was adequately
performing this function. In adaition to the breakdown of the 50RC in its
initial review and subsequent handling of the MOV failure discussed in Section
3.5.1 of this report, the following examples further illustrate team concerns
about the adequacy of 50RC overview of safety activities:
(1) NCR 5227, dated December 26, 1985, documented the failure to perform
annual emergency diesel generator inspections within the period required
by Technical Specification 4.9.A.2.f. The allowable variance for the
annual inspection was 25 percent, making 15 months the maximum period
allowable between tests. The annual inspection period of emergency diesel
generator No. 1 was 21 months and emergency diesel generator No. 2 was 19
months for the period ending in 1964. Although the SORC reviewed this
NCR, no report was made to the NRC for exceeding the maximum test period
specified in the Technical Specifications as required by 10CFR50.73.
(2) NCR 5056, dated August 22, 1986, documented the installation of an RHR
service water booster pump gland water pump that had a 20-gpm capacity
instead of the design capacity of 70 gpm similar to the replaced pump. As
discussed in Section 3.4.4(3)(a), the error was not discovered in January
1986 when the maintenance was conducted since no post-maintenance testing
was performed. Additionally, although NCR 5056 was issued on August 22,
1986, it was not corrected until November 1986. The only programmatic
corrective action taken was to assign different stock numbers to the
pumps, since both initially had the same number. The SORC failed to (1)
evaluate whether the system was inoperable, (1) determine whether this
event was reportable to the NRC, (3) recognize that failure to perform
post-maintenance testing was a contributing cause, and (4) take timely
-33-
-. ..
- - _ _ _ _ _ _ _ - _ _ - _ _ _ _
j
. j
i
'
corrective action to replace the pump. !
(3) NCR 4600, dated September 22, 1986, documented that the air operators for '
the primary containment vacuum relief valves, PC-243-AV and PC-244-AV,
were missing the spring required to open the relief valves. These vacuum
relief velves were required to spring open on loss of either their elec- ,
trical supply or air supply as stated in Table VII-3-1 of the USAR.
Without t1e spring in the air operators, the valves would fail-as-is, ,
which was the normally closed position. The failure of these valves to l
relieve excessive internal vacuum in the containment could cause buckling
of the steel containment vessel and a loss of containment integrity. The '
team was concerned that the SORC allowed reactor operations to continue
until the outage in October 1986 with the inoperable valves and the NRC )
was not notified of this significant deficiency. i
I
(4) NCR 6392, dated November 28, 1986, was written to document that a control
rod drive mechanism (CRDM) found during maintenance did not conform to its
design specifications. It was found that the cooling water orifice of
the CRDH (flange 1950) could thread through the flange and drop into the ,
insert port. This could prevent the ball check valves from working )
properly and could degrade the scram time of the CRDM. The flange was j
specified by General Electric (GE) design to be threaded only partially i
through the sleeve and thus provide a stop for the set screw orifice. The I
licensee actions appeared to have been to contact GE by telephone for
resolution. According to NCR documentation, GE recommended that the stop <
for the cooling water orifice should be provided by peening the excess
flange threads. The licensee inspected the spare CRDHs and determined
that no other problems existed, but did not evaluate whether the .
deficiency should have been reported to the NRC in accordance with 10 CFR
21. The team was particularly concerned that the QA recommendations ,
concerning the deportability of this NCR were not implemented.
l
(5) NCR 6383, dated October 31, 1986, documented a reactor protection system
(RPS) actuation that occurred unexpectedly while shutdown during the
performance of surveillance procedure SP 7.5.2.18 " Rod Block Monitor Gain l
Check Test." A half-scram signal was inserted on axial power range meter I
(APRM) channel B for testing and a momentary upscale occurred on APRM
channel E causing a full scram. The final determination of the cause for
this event was that the spike to APRM channel E was caused by work being
performed under the reactor vessel. This determination appeared to
contradict the initial investigation of the event which indicated that no
personnel were under the reactor vessel at the time of the spike. Addi-
tionally, the SORC determined that this event was not reportable even
though 10 CFR 50.72(b)(2)(ii) and 10 CFR 50.73(a)(2)(ii) both require
reporting any unplanned RPS actuations.
,
j
3.5.3 Untimely Corrective Actions
'
The inspection team had concerns about the adequacy and timeliness of the l
following corrective actions taken in response to NCRs: '
(1) NCR 5034, dated April 8, 1986, documented the failure to obtain design
engineering review and approval of work-in-progress design changes before 1
implementation. At the time of the inspection, this NCR was not resolved
and no corrective action had apparently been taken. The team considered
-34-
_ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ -
o
.
.
..- this delay of 14 months to correct a programmatic problem affecting safety
to be excessive.
(2) The licensee has repeatedly issued NCRs identifying problems with battery
ventilation as the root cause for poor battery performance:
(a) NCR 3543, dated January 24, 1985, diagnosec the low specific gravity
found in 24 Vdc battery 1A2 to be caused by high battery room
temperatures.
'(b) NCR 3264, dated February 14, 1985, identified excessive battery room
temperatures as the cause of low battery water levels in 24 Vdc
batteries 1A1, 1A2, 1B1 and 1B2.
(c) HCR 3288, dated March 21, 1985, diagnosed low battery specific
gravities in 24 Vdc batteries 1A1, 1A2 and 1B2 to be caused by high-
room temperatures.
During the inspection, the team found battery room temperatures to be
excessive for 125 Vdc and 250 Yde batteries and interviews with licensee
personnel revealed that this has been a long standing problem [see
Sections 3.1.2(1) and 3.4.1]. Design Change 85-71 was issued in 1985 to
correct the temperature problem with the 24 Vdc battery room, but
neglected the other battery rooms. Maintenance Work Request 87-086 was -J
written on April 13, 1987 requesting a design change to improve ventila-
tion in all the battery rooms to maintain temperature within the ;
J
prescribed limits. The 24 Vdc batteries were subsequently replaced and '
the 125 Vdc and 250 Vdc batteries are scheduled for. replacement in future
outages. The ventilation system, however, has not been scheduled for any l
modification to ensure it could maintain the environment in accordance
with the battery manufacturer's recommendations.
(3) NCR 2968 dated June 14, 1984, identified recurring drift problems (5 times '
in 1964) with the torus level narrow-range instrument. Each time the
level instrument was declared inoperable and recalibrates. A significant
unoerlying cause for the drift problem was identified in NCR 2988 as a
design deficiency. The normal chemistry sample point is the torus level
transmitter PC-LT-13 low level sensing leg's drain valve. This design
alone would appear to be capable of causing problems with the level
transmitter. The corrective action recommended by the NCR was to install
a sample isolation valve. This corrective action had not yet been
performed at the time of the inspection, approximately 3 years later I
despite the fact that drift problems were still being experienced with the j
!
instrument.
(4) NCR 6379, dated October 27, 1986, documented a noise interference problem
with communication between the control room and the diesel generator rooms
during diesel o>erations. In this instance, an operator misunderstanding
an order from tie control room inadvertently tripped No. 1 emergency
diesel generator. The corrective action section of the NCR stated that
difficult communications with the diesel generator room was a recurring
problem and recommended installing a sound isolation booth next to the
Gaitronics Communication System in the diesel generator rooms. At the
time of the inspection, these corrective actions had not been
accomplished.
-35- ;
_ _ _ - _ _ _ _ _ - - _ _ _ _ _
_ - _ _ _ _ _ _ _ _ . ____- __ _ ______ _ _ _ __ _ - __ - _
y
,:
..
a
APPENDIX B
DOCUMENTS REVIEWED
1. System Design Changes (Section 3.1)
Design Change' Package No. Subject i
J
73-007- Breaker Close Circuit Monitoring
74-094 Diesel Generator Oil Shutoff Valves76-011 Relocation of Diesel Generator Control
Valves
77-015-I Diesel Generator CO2 Annunciation
77-015-P Move Fuel Oil Lines78-023 Diesel Generator C0 2
Ratification
78-024 Addition of Two Substations78-026 Annunciation of Conditiota Preventing
'
Auto Start of Diesel Generators78-028 Modification of Control Air Line
78-061 Modification of Diesel Generator Circuits78-065 Replacement of Trip Coils for Westinghouse
Breakers79-016 Battery Room 1A/1B Ventilation
79-026 Alarm for Doors Between Diesel Generator
Rooms
- 79-058 Replacement of Trip Coils on 125 V Breakers
79-59 Overcurrent Releys for Breakers 1FA and 1GB
l
l 60-013 modification of Fuel Oil Storage Tank
Manhole Covers-80-020 Diesel Generator Silencer Bypass
Modification-
80-069 Addition of Vents on Diesel Generator
Water Jacket
80-153 Seismic Upgrade of Circuit
82-037 Diesel Generator Flex Hoses
j
B-1
L - _ - - - - - - _ - - - - - - - - - - - - - - - - - - _ - _ _ -
- _ _ _ _ _ _ _ ,
- m. .
', .
)
-. j
. 1
l
,
APPENDIX B
l;
DOCUMENTS REVIEWED (Contd.)
1
'l
Subject
Design Change Package No.04-035 Modification of DC Control Power Failure
Uninterruptable Power Supply System
84-037G
Upgrading Westinghouse Type DB-50 Breakers84-134
l
Addition of 1 solation Switches to Diesel ]
Generator Panels
Replacement of Underrated Fuses84-243
Installation of Bars in Diesel Generator
Air Supply
85-023 Installation of a 250 KVA Transformer in
Diesel Generator Room
{
85-074 Modification of Float Valves for Diesel l
Generator Fuel Oil
Installation of PHIS Augmentation
Amendment 2
Critical AC Bus Breaker and Fuse
Diesel Generator Auto Start f
86-133 f
j
' STP 85-007
Modification of Diesel Generator l
Fuel Oil Float Valves
J
STP 86-14
Modification of Diesel Generator 1
B-2
- - - - - - - - - - - - - - - - 1- )
- _ _ _ _ _ _ - _ .
...
.;
..
.
APPEND 1X B
DOCUMENTS REVIEWED (Contd.)
- Design Change
Procedure No. Subject Revision
Engineering System Engineers and Engineering 1
Procedure 3.2- Specialists
Engineering Station Safety Evaluations S
Procedure 3.3
Engineering Station Design Changes 4
Procedure 3.4
Engineering Temporary Design Changes 1
Procedure 3.4.4
Engineering Special Test Procedures /Specici 2
Procedure 3.5 Procedures
Engineering Drawing Change Notice 1
Procedure 3.7
Engineering Equipment Classification 3
Procedure 3.13
Engineering New Drawing Preparation 0
Procedure 3.16
Calculation No. Subject
66-105 Critical AC Bus Coordination Study
66-071 Emergency Diesel Generators lA and 1B
Load Study
B&R Contract I69-7 125/250 VDC Station Batteries
B&R 2.15.01, Rev. 1 Off-site Power Sources
S&L 7683-01-E1, Rev. O Station Batteries
S&L 76B3-01-E2, Rev. O Station Batteries
l
l
B-3
_ _ _ _ _ _ _ _ - _ _ _ _ _ -
___
.o >
'
l s* =j
,r
l.
APPENDIX B
'
DOCUMENTS REVIEWED (Contd.)
2. Operations (Section 3.3)
Procedure No. Subject Revision
CNS Procedure 0.9 Equipment Clearance.and Release 5
Orders (
Conduct of Ops 2.0.2 Operations Logs and Reports 9
Conduct of Ops 2.0.3 Control Room Conduct and Manning 3 1
Conduct of Ops 2.0.7 Plant Temporary Modifications Control 2
Conduct of.0ps 2.0.9 Control of Operator Aids 0
a
-System Ops 2.2.12 ' Diesel Fuel Oil Transfer System 6
System Ops 2.2.15 5tartup Transformer 9
System Ops 2.2.17 Emergency Station Service Transformer 9
System Ops 2.2.10 41C0 V Auxiliary Power Distribution 25
System
System Ops 2.2.19 480 V Auxiliary Power Distribution 7
System
System Ops 2.2.20 Standby AC Power System (Diesel 23
Generator)
. System Ops 2.2.24 250 V DC Electrical System 13
System Ops 2.2.25 125 V DC Electrical System 16
System Ops 2.2.71 Service Water System 19 ,
Alarm Proc. 2.3.2.8 Panel C - Annunciator C-1 9 {
l
Alarm Proc. 2.3.2.9 Panel C - Annunciator C-2 8 i
l
Alarm Proc. 2.3.2.11A Panel C - Annunciator C-5 3 1
.
1
I Alarm Proc. 2.3.2.11B Panel C - Annunciator C-6 4 !
I
) I
'
Abnormal Proc. 2.4.6.1 Normal Station Service Transformer 5
Failure
Abnormal Proc. 2.4.5.2 Startup Station Service Transformer 8 ;
Failure / Loss of 161-XV Line 1
B-4
!
- _ = _ - - _
-. _ _ _ _ _ _
..
-
,
??-
,
~ AFFEND1X D
. DOCUMENTS REVIEWED (Contd.)
2. Operations (Section 3.3)
Subject Revision
' Procedure No.
4
Abnormal Proc. 2.4.6.6 480 V Transformer or Electrical
Distribution Failure
'
125 Y DC System Failure 5
. Abnormal Proc. 2.4.6.10
Loss of Service Water Pumps 6 i
Abnormal Proc. 2.4.8.3.1
15
Emergency Proc. 5.2.1 Shutdown from Outside the Control Room
8
Emergency Proc. 5.2.3 Loss of All Service Water
Emergency Proc. 5.2.4 Loss of Reactor Equipment Cooling 5
(REC) Water
Loss of AC Power.- Use of Standby AC 12
Emergency Proc. 5.2.5 ,
Power
5 ;
Emergency Proc. 5.2.5.1 Loss of All Site AC Power Station
Blackout _
450 V Switchgear Fire 7
Emergency Proc. 5.4.2.8
9 j
Emergency Proc. 5.4.2.10 Emergency Diesel Generator Room Fire
i
l
4
l
I
!
I
l
B-5
LL _ ___-__ _ _ _ _ _. _ _ _ _ _ _
,