ML20236M758
| ML20236M758 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 07/08/1998 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20236M748 | List: |
| References | |
| 50-285-98-11, NUDOCS 9807140246 | |
| Download: ML20236M758 (18) | |
See also: IR 05000285/1998011
Text
L.
.
ENCLOSURE 2
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
~ Docket No.:
50-285
License No.:
Report No.:
50-285/98-11
Licensee:
Omaha Public Power District
Facility:
Fort Calhoun Station
Location:
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 399, Hwy. 75 - North of Fort Calhoun
Fort Calhoun, Nebraska
Dates:
May 21-June 5
Inspectors:
V. Gaddy, Resident inspector
C. Skinner, Resident inspector
Approved By:
W. D. Johnson, Chief, Project Branch 8
ATTACHMENT:
Supplemental Information
l
l
9907140246 990708
~
ADOCK 05000285
Y
G
L
'
)
- _ _ _ _ _ _ _ _ _ _ _
_-_
t .
EXECUTIVE SUMMARY
Fort Calhoun Station
NRC Inspection Report 50-285/98-11
Operations
The inspectors identified several examples of inconsistent wording between several plant
.
,
procedures, the procedure basis documents, and associated references. None of the
inconsistencies affected the licensee's abilities to perform the procedures in a
satisfactory manner (Section O3.1).
Operators responded to the fault on House Service Transformer T1 A-3 in a expeditious
.
manner and properly characterized the event (Section O3.3).
The inspectors concluded that management expectations and the training provided to
.
the operators were inconsistent with the procedural guidance. Proceoural guidance
required operators to implement abnormal operating procedures whenever entry
conditions were met. Operators were trained to, and management expected them to,
implement the highest-order abnormal operating procedure first. Also, operators
performed a step out of sequence and did not provide justification in the control room
logs. While licensee management stated that this met their expectation because all
steps in the abnormal operating procedure were performed, it was inconsistent with the
guidance provided in Standing Order SO-O-1 (Section O3.3).
Two examples were identified where the Updated Safety Analysis Report was not
.
accurate in the description of plant systems. The first example was that the Updated
Safety Analysis Report did not clearly state that the automatic bus transfer will not occur
when the main generator is not in service. The second example was that the fire
protection system was modified and in service for approximately 10 months, and the
description in the Updated Safety Analysis Report had not been revised to reflect the
new configuration (Section 08.1).
Maintenance
The root cause of the inadvertent deluge of House Service Transformer T1 A-3 was
.
determined to be the failure to perform preventive maintenance on the entire deluge
system. This was considered a weakness in the preventive maintenance program
(Section M8.1).
Operations personnel did not initiate a maintenance work document to document a
.
,
deficiency with Alarm Test Valve FP-230 in accordance with Standing Order SO-O-1.
j
l
This was a violation of 10 CFR Part 50, Appendix B, Criterion V (Section M8.1).
l
\\
!
U-___-______________
_ _
_
_ _ _ _
_.
_ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
-2-
Enaineerino
..
The electrical distribution system was designed such that a single fault could cause the
loss of both vital buses. This design protects the electrical distribution system by
clearing faults as quickly as possible. The design met General Design Criteria 17
- requirements (Section M8.2).
t
4
The inspectors concluded that the root cause analysis performed by the licensee
.
properly identified the cause of the loss of power to the vital buses. The corrective
actions taken and proposed were appropriate (Section E7.4).
<
4
{
l
i
!
9
L J_-
- ___ __-__-_ :_- _
J
___:--_-___
__
__
1
-
l
.
Reoort Details
Backaround
On May 20,1998, at approximately 2:11 p.m., an electrical fault occurred on 161kV/4160V
House Service Transforrner T1 A-3. This transformer provided the normal source of power to
Vital Bus 1 A3. House Service Transformer T1 A-4, similar to T1 A-3, provided the normal source
of power to Vital Bus 1 A4. Two feeder breakers, Breakers 110 and 111, normally provide
parallel paths for 161kV power to Transformers T1 A-3 and T1 A-4. Breaker 110 was out of
service for maintenance and both transformers and vital buses were being supplied by 161kV
via Feeder Breaker 111 through their respective house service transformers. Both house
service transformers are located on pads inside the protected area outside the turbine building.
l
When the fault occurred, the plant was in the 50th day of a refueling outage with a new core
loaded, the reactor vessel head in place but not tensioned, and the reactor coolant system filled.
Shutdown cooling was in service, and reactor coolant system temperature was approximately
105 F. Unit Auxiliary Buses 1 A1 and 1 A2 were energized and providing power to nonvital plant
loads from the 345kV offsite power supply through the main Transformer T1.
1
When the transformer fault occurred, Feeder Breaker 111 opened, and 161kV power was lost to
l
both vital buses. Both emergency diesel generators started and connected to their respective
vital buses. The shutdown cooling pumps, which are supplied by vital power, were deenergized
{
for approximately 10 seconds while the emergency diesel generators started and connected to
l
the vital buses. All plant equipment operated as designed.
l
The plant declared a Notification of Unusual Event based on Emergency Action Level 6.1, " Fire
or Explosion inside the Protected Area."
!
At 3:33 p.m. the licensee completed the process of backfeeding Vital Buses 1 A3 and 1 A4 from
the 345 kV offsite power supply through the main trailtormer and the Notification of Unusual
Event was terminated at 3:57 p.m.
This inspection examined the circumstances surrounding the electrical fault on House Service
Transformer T1 A-3. Specifically, the inspectors evaluated the response of plant equipment and
operators during the event,
,
l
03
Operations Procedures and Documentation
1
03.1 Adequacy of Procedures
'
a.
Insoection Scooe (93702)
The inspectors reviewed Abnormal Operating Procedure AOP-32, " Loss of 4160 Volt or
480 Volt Bus Power," Revision 3.2, and Emergency Plan Implementing
i
Procedure EPIP-OSC-1, " Emergency Classification," Revision 28, which operators
l
entered as a result of the electrical fault on Transformer T1 A-3.
l
._
_ _ _ ____ A
_ _ - _ _ _ - _ _ _ _
_ _
_ _ _
'
- '
l
-2-
l
.
b.
Observations and Findinas
!
4
Technical Basis Document for Abnormal Ooeratina Procedure AOP-32
The inspectors reviewed the Abnormal Operating Procedure Technical Basis Document
]
TBD-AOP-32, " Loss of 4160 Volt or 480 Volt Bus Power," Revision 3.2. The purpose of
this document was to provide reference information for the procedures, an overview of
the procedural strategy, and the intent of the individual steps. Operators performed the
abnormal operating procedure steps as written with regard to exiting the procedure.
However, there appeared to be inconsistent information between the technical basis
j
document and the procedural steps of the abnormal operating procedure.
'
The purpose section of the technical basis document contained a sentence which stated
that the procedure should not be exited until all power supplies were returned to their
normal lineup. The Updated Safety Analysis Report stated that the normal source of
power for Vital Buses 1 A3 and 1 A4 was from Transformers T1 A-3 and T1 A-4,
respectively. Operators exited Abnormal Operating Procedure AOP-32 when power was
restored to Vital Buses 1 A3 and 1 A4 from the 345 kV offsite power source, which is the
alternate power source. The procedure indicates that it is complete when offsite power is
restored to the affected buses.
Based on the Technical Basis Document, the abnormal operating procedure should not
be completed until the vital buses are realigned to Transformers T1A-3 and T1 A-4.
Basis Document for Emeraency Action Levels 4.1 and 4.3
The verification criteria for Emergency Action Level 4.1, " Loss of Offsite Power for >
15 Minutes," was that offsite power (345 KV and 161 KV) is not available to energize
Buses 1 A3 and 1 A4 for greater than 15 minutes. The licensee's basis document for the
emergency action level stated, in part, that 15 minutes was allowed to exclude transient
or momentary power losses and to allow automatic or manual recovery actions.
The basis document referenced NUREG-0654, " Criteria for Preparation and Evaluation
of Radiological Emergency Response Plans and Nuclear Power Plants," Appendix 1,
Notification of Unusual Event initiating Condition #7, " Loss of Offsite Power or Loss of
Onsite AC Power Capability." NUREG-0654 did not specify a duration for the loss of
offsite power, only that offsite power was lost.
NUMARC/NESP-0007,"NUMARC Methodology for Development of Emergency
Action Levels," Revision 2, Initiating Condition SU1, discusses a loss of all offsite power
to essential buses for greater than 15 minutes. The basis provided by NUMARC stated
!
that a prolonged loss of AC power reduces required redundancy and potentially
degrades the level of safety of the plant by rendering the plant more vulnerable to a
complete loss of AC power, and 15 minutes was selected as a threshold to exclude
l
k
transient or momentary power losses.
-
_.
. _ _ _ _ _ - _ _ _ _ -
l
l
.
l
l
-3-
Therefore, the licensee's Emergency Action Level 4.1 appeared to be more consistent
with the NUMARC guidance rather than the NUREG-0654 guidance which was listed as
the reference for the emergency action level.
The verification criteria for Emergency Action Level 4.3, " Buses 1 A3 and 1 A4 are
deenergized (<= 15 minutes)," was that Busses 1 A3 and 1 A4 are deenergized for
15 minutes or less. The basis document for the emergency action level stated, in part,
that 15 minutes was allowed to exclude transient or momentary power losses and to
allow automatic or manual recovery actions. Emergency Action Level 4.3 does not allow
15 minutes to elapse prior to declaration of the action level.
The wording in the basis document was not consistent with the direction provided by
Emergency Action Level 4.3.
The basis document referenced NUREG-0654, Appendix 1, Alert initiating Condition 7,
" Loss of offsite power and all onsite AC power." NUREG-0654 did not specify a time
duration for this alert initiating condition, but the associated initiating condition for a site
area emergency indicated a duration of greater than 15 minutes. Therefore, the
licensee's Emergency Action Level 4.3 was consistent with NUREG-0654; however, the
wording in the licensee's basis document appears to be inconsistent.
The licensee stated that these documents would be reviewed to determine if either
should be changed. The licensee also stated that they would consider reviewing other
basis documents to ensure that no other potential conflicts exist.
c.
Conclusion
The inspectors identified several examples of inconsistent wording between several plant
procedures, the procedure basis documents, and associated references. None of the
inconsistencies affected the licensee's abilities to perform the procedures in a
satisfactory manner.
O3.2 ControBoom Loa Error
a.
Insoection Scoce (93702)
The inspectors reviewed the control room logs to assess the operator actions taken
following the electrical fault on Transformer T1 A-3.
b.
Observations and Findinas
l
The inspectors identified that operators incorrectly logged that Emergency Diesel
Generators DG-1and DG 2 were shut down per Emergency Operating
l
Procedure / Abnormal Operating Procedure Attachment 17 " Restoring Off-Site Power to
Bus 1 A3," Revision 3.3, and Attachment 18, " Restoring Off-Site Power to Buses 1 A4,"
j
_ _ __ -_ - -
_ _ _ - _ - ..
_ -_
_
_
_
?
.
I
L.
1
-4-
- Revision 3.3, respectively. During discussions with the inspectors, the licensee stated
that Emergency Operating Procedure / Abnormal Operating Procedure Attachments 19,
" Shutdown of Diesel Generator D1," and 20, " Shutdown of Diesel Generator D2," were
used to shut down the diesel generators.
l
i
c.
Conclusion
!
The inspectors identified a minor logging error in the control room log, where the
operators logged the incorrect attachments used to shutdown the diesel generators.
03.3 Instructions to Ooerators Different frorn Manaoement's Expectations
)
a.
Insoection Scoce (93102)
]
The inspectors reviewed operator response and procedural guidance to verify all actions
were completed as required following the electrical fault on Transformer T1 A-3 which
occurred on May 20,1998.
b.
Observations and Findinos
)
,
i
The response of operations personnel during the transformer fault was good. Operators
{
properly characterized the fault and responded in a professional, expeditious manner.
j
i
Operations personnel were originally informed that Transformer T1 A-3 had exploded.
This misinformation did not appear to impact the ability of operations personnel to
mitigate the event. Once the event was properly diagnosed, the plant was stabilized and
operations personnel quickly established backfeed from the 345 kV offsite power source
through the main transformer to supply the vital buses.
The inspectors verified that appropriate notifications to governmental agencies were
made.
~
However, the inspectors did note a few discrepancies. The inspectors reviewed the
control room log and identified that Spent Fuel Pool Cooling Pump AC-SA was started
"
prior to energizing station lighting. Specifically, at 2:15 p.m. operators started the spent
fuel pool cooling pump and at 2:38 p.m. station lighting was restored. Abnormal
Operating Procedure AOP-32, " Loss of 4160 Volt or 480 Volt Bus Power," listed the
restoration of station lighting prior to starting the spent fuel pool cooling pump. No
l
justification was provided in the control room log as to why the spent fuel pool cooling
'
pump was started prior to returning station lighting to service.
Standing Order SO-O-1, " Conduct of Operations," Step 12.1.2.A(1), stated that
emergency and abnormal operating procedures are offered as guidance to mitigate the
consequences of an accident or an unanticipated occurrence, During these occasions,
l
verbatim compliance is recognized as potentially impractical, depending upon the event
,
_ _ _ _ _ _ _ - _ _ _ _ .
. _ - _ .
5
circumstances. However, when at all possible, the guidelines offered should be followed
as written. Deviation from these procedures requires shift supervisor or licensed senior
operator judgement, approval, and justification in the cont,al room log. Technical Basis
Document TBD-AOP-32 stated in the purpose section that steps are placed in order of
importance to plant safety and availability.
Discussions were held with the licensee on what was expected from the operators with
regard to the order of performance of steps in the abnormal operating procedure. The
licensee stated that it was operation management's expectation that the appropriate
abnormal operating procedure be entered and that the operators were allowed to
perform steps in any order as long as all of the steps were performed. The licensee also
indicated operator training was consistent with management's expectations. In this
particular case, control room operators' performance of the steps out of sequence met
management's expectation. No justification was provided in the control room log
because this was not viewed as a deviation by the operators.
The inspectors noted that the entry conditions for Abnormal Operating
Procedures AOP-17, " Loss of Instrument Air," Revision 4, AOP-18, " Loss of Raw Water,"
Revision 4, AOP-19, " Loss of Shutdown Cooling," Revision 3, and AOP-36, " Loss of
Spent Fuel Pool Cooling," Revision 1, were met following the loss of power to the vital
buses, but operators did not enter these abnormal operating procedures or log why it
was unnecessary to enter them. Since the entry conditions had been met, the inspectors
asked if operators had referenced the abnormal operating procedures to determine if
they provided guidance in addition to that provided in Abnormal Operating
Procedure AOP-32. Operators did not reference the additional procedures. Step 12.4.3
!
of Standing Order SO-O-1 stateo that abnormal operating procedures shall be
implemented whenever the entry conditions are met.
Discussions were held with licensee management regarding this apparent difference
between Standing Order S0-0-1 guidance and observed operator actions. Licensee
managemcnt stated that they expected operators to enter the appropriate, and highest-
order, abnormal operating procedure, and in this instance Abnormal Operating
Procedure AOP-32 was the appropriate procedure. The licensee also stated that
operators had been trained to enter the highest order abnormal operating procedure and,
.
at the completion of that procedure, if additional abnormal conditions warranted entry into
l
other procedures, they would be entered at that time.
i
The inspectors concluded that management expectations and operator training did not
agree with the wording in Standing Order SO-O-1.
c.
Conclusion
j
Operators responded to the fault on House Service Transformer T1 A-3 in a professional
manner and properly characterized the event. The inspectors concluded that
management expectations and the training provided to the operators were inconsistent
!
i
l -
l
1
I
!
I
-______
_ - - _ _ _ _ _ _ _ . -
.
-6-
with the procedural guidance. Procedural guidance required operators to implement
abnormal operating procedures whenever entry conditions were met. Operators were
trained to, and management expected them to, implement the highest-order abnormal
operating procedure first. Also, operators performed a step out of sequence and did not
provide justification in the control room logs. While licensee management stated that this
met their expectation because all steps in the abnormal operating procedure were
performed, it appeared inconsistent with the guidance provided in Standing
Order SO-O-1.
i
08
Miscellaneous Operations issue
08.1
Uodated Safety Analysis Report Weaknesses
,
a.
Insoection Scooe (93702)
l
!
The inspectors reviewed the Updated Safety Analysis Report regarding plant electrical
)
systems and fire protection systems.
b.
Observations and Findinas
)
i
Section 8 of the Updated Safety Analysis Report described the electrical systems.
l
Power for the 4.16 kV station auxiliary system is available from two separate systems,
the main generator 22 kV bus and the 161 kV offsite power source. The 22 kV power
'
source is the preferred power source for Nonvital Buses 1 A1 and 1 A2 and the 161 kV
offsite power source is the preferred source for Vital Buses 1 A3 and 1 A4. Section 8.4 of
the Updated Safety Analysis Report described two modes of automatic transfer, fast and
slow, from the preferred to the alternate sources. It stated that the automatic transfers
are inhibited when there is a source under-frequency or excessive voltage angle
difference, no alternate source voltage available, uncleared faults on the transferred bus,
or failure of the preferred source circuit breaker to open. The automatic transfer can also
be manually inhibited. The Updated Safety Analysis Report text does not clearly state
that the automatic transfer will not occur when the main generator is not producing
electrical power.
Section 9.11 of the Updated Safety Analysis Report contained a paragraph which stated
that the fire protection system was flushed and filled from the clarifier surge tank by
utilizing one or both of the demineralized water system clarifier booster pumps after any
system actuation and prior to the system Deing returned to operation. The inspectors
questioned if this paragraph was still valid. The licensee stated that Design Modification
MR-FC-94-023 changed the system such that Blair Municipal Water was the source for
flushing and filling the system. The modification was open with all work completed,
except a section to increase the capacity of the storage tanks. Operations personnel had
been using Blair Municipal Water for flushing and filling the system since July 1997 when
that section of the modification was completed and appropriate procedures were revised.
The inspectors verified that the modification package contained a markup page of the
j
- _ - _ _ _ - _ _ - _ _ _ _ _ _ _ _
.
.
-7-
Updated Safety Analysis Report. The licensee had an internal administrative limit of
12 weeks from the final closecut of a modification to revise the Updated Safety Analysis
Report. The inspectors questioned if it was appropriate to wait until final close out to
update the Updated Safety Analysis Report, especially since operations personnel had
been using Blair Municipal Water since July 1997. The licensee indicated that the
modification to increase the storage capacity of the tanks was on hold and that the
modification package would be closed soon. During the 10 month interval that the
modification package was open, the Updated Safety Analysis Report had been revised
on January 30,1998, but the revision did not include information pertaining to the fire
protection system modification.
c.
Conclusion
Two examples were identified where the Updated Safety Analysis Report was not
accurate in the description of plant systems. The first example was that the Updated
Safety Analysis Report did not clearly state that the automatic bus transfer will not occur
when the main generator is not in service. The second example was that the fire
protection system was modified and in service for approximately 10 months, and the
description in the Updated Safety Analysis Report had not been revised to reflect the
,
new configuration.
II. Maintenance
M8
Miscellaneous Maintenance issues
M8.1 Cause of Electrical Fault on House Service Transformer T1 A-3
a.
In.soection Scoce (93702)
The inspectors reviewed the licensee's evaluation to determine the cause of the
electrical fault on Transformer T1 A-3.
b.
Observations and Findinas
At or near the time of the fault, several witnesses stated that they saw a flash from
Transformer T1 A-3 and the deluge system operating. However, witnesses could not
conclusively state which occurred first.
During the evaluation to determine the cause of the fault on House Service
Transformer T1 A-3, the licensee used data from the plant computer and determined that,
approximately 12 seconds before power was lost to the vital buses, Bus 1 A1, which
supplied power to nonvital loads, voltage decreased from 4146 volts to 4142 volts.
1
I
_
_
_ _ _ _ _ _
_ _ _ _ _ - - - _ _ - - - - - - - - - - - - - -
.
e
-8-
Concurrent with the 4 volt decrease, Bus 1 A1 picked up approximately 180 kW of load.
The licensee concluded that the voltage decrease and load increase was due to the
i
starting of the electric fire pump. The electric fire pump was powered from Bus 1A1.
Since the plant computer indicated that the fire protection system was operating before
voltage was lost to the vital buses, the licensee focused their evaluation on determining if
the electrical fault could have been caused by the actuation of the deluge system.
To confirm this hypothesis, the licensee conducted a test on May 21,1998, to determine
whether the fault was an electrical or mechanical malfunction of the fire protection
system. Specifically, the tests were designed to detect any failures in the deluge system
for House Service Transformer T1 A-3.
Data gathered indicated that there was no valid signal for the deluge system to have
automatically actuated. The licensee stated that there were only three ways to electrically
initiate the deluge system. These were:
Operation of the fire suppression manual pull station. This did not occur because
.
the pull station was inspected and observed to be intact.
Local temperature indication. Temperature indicators were located in a ring
.
around the transformer. A temperature increase to approximately 165 F would
cause an electrical circuit to be completed and actuate the system. Inspection of
the local temperature indicators determined that none had been actuated.
Operation of the manual actuation pull valve. This valve was inspected and
.
verified to be intact.
The inspectors noted that there was no electricalinterlock to prevent a deluge actuation
when the transformers were energized.
The transformer deluge system was controlled by Deluge Valve FP-754. The valve was
kept closed by maintaining priming pressure on the valve's top chamber. When the top
chamber of the deluge valve is vented, flow is actuated, and greater than 6 psig is
sensed in the piping downstream of the deluge valve by a reset prevent valve, pressure
is continua!!y vented off the top chamber of the deluge valve and the valve would remain
open. If the deluge valve were closed, and the reset prevent valve sensed 6 psig in the
deluge valve discharge header, it would open, vent the deluge valve upper chamber, and
allow the deluge valve to open.
The testing was intended to prove that a valid electrical actuation signal did not cause
the deluge valve to operate and spray down House Service Transformer T1 A-3. The
licensee shorted the manual pull station leads together to simulate its operation. The
deluge valve opened, system pressure decreased, and both fire pumps started on low
system pressure. The deluge system sprayed down Transformer T1A-3 as designed.
- _ _ _ _ _
- _ - _ _ _ - - - ___- _ ______.
.
.
-9-
Since the electrical portion of the circuitry operated as designed, the licensee concluded
that the actuation was not due to an electrical malfunction. The licensee then suspected
the deluge valve may have suffered a mechanical failure.
The licensee determined that several hours before the electrical fault on the transformer,
operations personnel had performed a system flush of the deluge system. The test was
conducted in accordance with Preventive Maintenance Procedure OP-PM-FP-1000,
" Quarterly Fire Protection Drain Valve Flush and Alarm Test." To verify the operability of
Transformer T1 A-3 Deluge Valve FP-754, the procedure directed operators to open
Alarm Test Valve FP-230, verify its associated control room alarm actuated, close Alarm
Test Valve FP-230, and verify the alarm clears. Alarm Test Valve FP-230 was a
manually-operated ball valve. Following the alarm check, that portion of piping was
drained.
The licensee removed and inspected Valve FP-230 on May 23,1998. The licensee
determined that the external mechanical stop of the valve had been bent, which allowed
the valve to travel past its fully closed position. This resulted in leakage past the valve
seat. The licensee verified this leakage by hydrostatically testing the valve. Directly
upstream of Alarm Test Valve FP-230, Check Valve FP-342, which separates the deluge
valve discharge piping from the Alarm Test Valve piping, was also found to leak. With
both of these valves leaking, the water column to the sprinklers and to the reset prevent
I
valve was allowed to slowly fill. With the water columns being filled, the pressure sensed
by the reset prevent valve increased until, at 6 psig, the reset prevent vane opened,
vented the upper chamber of the deluge valve, and allowed the deluge valve to open.
When the deluge valve opened, fire main pressure dropped, both fire pumps started on
low system pressure, and Transformer T1 A-3 was sprayed. The deluge system sprayed
the energized transformer with river water, causing Phase B to ground and Phase B to
Phase C faults on the primary side of the transformer. The conductivity of the river water
was subsequently measured to be approximately 550 micrombos/cm.
In following up on the alarm test, the inspectors noted that the input into the annunciator
was a pressure switch. With Alarm Test Valve FP-230 open, fire system pressure was
detected and an alarm in the control room was received. When pressure decreased, the
alarm cleared. The inspectors reviewed the annunciator response procedure to verify
the alarm setpoint. No setpoint was listed for the alarm nor did the licensee know exactly
what the setpoint was for the pressure switch. The inspectors then reviewed the vendor
data for the pressure switch and determined that the pressure switch setpoint was set by
' the vendor and could vary from 2 psig to 20 psig and was adjustable. Based on the
testing and findings by the licensee, the setpoint of the pressure switch was most likely
greater than 6 psig, or a control room annunciator would have been received prior to the
l
reset prevent valve opening.
L
_J
_ _ _ _ _ _ _ _ - _ - - _ _ _ _ - -
>
.
l
'
i
1
-10-
The inspectors reviewed the training that operations personnel had received regarding
ball valve operation. The training covered how ball valves operated and provided
adequate information to alert operators that a valve was not functioning properly if it was -
allowed to travel past its 90 degree stop position.
The inspector reviewed Standing Order S0-0-1, " Conduct of Operation." Step 5.5.3.B
stated that in many cases the failure of a valve to operate in either direction may result in
serious consequences; therefore, every deficiency must have a maintenance work
documerit written. No work document or deficiency document was initiated addressing
the bent stop on Alarm Test Valve FP-230. Failure to follow this procedure and
document the deficient ball valve is a violation (50-285/9811-01).
The inspectors asked about the maintenance history on Check Valve FP-342. The
licensee stated that the check valve was vendor supplied and was not in the preventive
maintenance program. No maintenance had ever been performed on the valve. The
valve had been in service since plant startup. The check valves in the other four
transformer deluge systems, as well as other components in each of the transformer
deluge systems, were not in the preventive maintenance program and no preventive
maintenance had been performed on these components. Failing to perform any
preventive maintenance on the components in the deluge system is a weakness in the
preventive maintenance program.
!
As interim corrective action, on May 23,1998, the operations department issued
Memorandum FC-OPS-130-98. This memorandum directed turbine building operators,
during their rounds, to open drain valves on each of the five deluge valves twice per shift
and to monitor the leakage from the drain line. During the first evolution, approximately
1-2 cups of water was drained from the deluge piping for Transformer T1 A-1. No water
was drained from the other deluge piping. No additional leakage was noted during
subsequent draining operations.
c.
Conclusions
The root cause of the inadvertent deluge of House Service Transformer T1 A-3 was
determined to be the failure to perform preventive maintenance on the deluge system.
This was considered a weakness in the preventive maintenance program. Operations
l
personnel did not initiate a maintenance work document to document a deficiency with
'
Alarm Test Valve FP-230. . This was a violation of Standing Order SO-O-1 and 10 CFR Part 50, Appendix B, Criterion V.
M8.2 Switchvard Resoonse Durino Transformer Fault
a.
Insoection Scoce (93702)
The inspectors evaluated the response of switchyard equipment during the transformer
- fault.
__
_ _ _ _
_J
_
___ __
_ _ _ _ _ - - - - -
.
.
-11-
b.
Observations and Findinos
When the fault on House Service Transformer T1 A-3 occurred, Feeder Breaker 110, one
of two parallel breakers which can supply 161 kV to the vital buses, was out of service for
maintenance. As a result. 4160 volt power was being supplied to Vital Buses 1 A3
and 1 A4 via Breaker 111 through Transformers T1 A-3 and T1A-4. Unit Auxiliary Nonvital
Buses 1 A1 and 1 A2 were being backfed from the 345kV system via the Main
Transformer (T1) and Transformers T1A-1 and T1A-2.
At the time of the electrical fault, the substation fault recorder detected a bushing fault on
Transformer T1 A-3. The fault lasted for approximately 11.5 cycles. A Phase B to
ground fault occurred during the first 5.25 cycles. A Phase B to Phase C fault occurred
during the last 6.25 cycles. When the fault occurred, Differential Relay 87/161-2,
i
external to Transformer T1A-3, sensed an approximately 7550 amp current differential
l
during the first 5.25 cycles. During the final 6.25 cycles, Differential Relay 87/161-2
l
sensed an approximately 9000 amp current differential. This relay monitored Phase B of
j
Circuit 1587. Circuit 1587 was the 161 kV line connecting Feeder Breakers 110 and 111
i
to Transformer T1 A-3 and T1 A-4. Due to the magnitude of the differential current, the
J
differential relay tripped Feeder Breaker 111 which isolated 161kV power from
3
Transformers T1 A-3 and T1 A-4.
l
The differential relay also sent open signals to Breakers 1 A31,1 A33,1 A42, and 1 A44.
These breakers separate Nonvital Buses 1 A1 and 1 A2 and Vital Buses 1 A3 and 1 A4
l
from Transformers T1 A-3 and T1 A-4. On the loss of power to the vital buses, both
I
emergency diesel generators started and restored power to Vital Buses 1A3 and 1A4.
Nonvitalloads continued to be supplied by Unit Auxiliary Buses 1 A1 and 1 A2 via the
l
The inspectors asked if the Fort Calhoun breaker scheme was designed such that a
single fault could cause a loss of both vital buses. The licensee responded that the
breaker scheme operated as designed because the 161 kV supply is subject to common
mode failure (one fault can cause the loss of the 161 kV supply to Buses 1A3 and 1 A4).
The licensee stated that the system was designed in this manner to protect the electrical
,
distribution system from any real fault and to clear a fault as quickly as possible. If high
'
amperage faults were not cleared quickly, damage to the 161kV/4160V distribution
system could occur.
Had the fault occurred with the main generator in service, a fast transfer of vital bus
power from the 161 kV supply to the 345 kV electrical supply would have occurred.
This fast transfer would have prevented the vital buses from losing power and the
emergency diesel generators would not have started.
Following the fault, engineering personnel performed an evaluation to determine if the
inadvertent deluge, and resulting power loss, placed the plant outside its design basis.
The plant was designed to meet General Design Criteria 17, which required the
. , _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _
_
-_
-
,
.
..
-12-
!
The plant was designed to meet General Design Criteria 17, which required the
following:
An onsite and offsite electrical system, each of which was capable of safely
.
shutting down the reactor.
The onsite electrical system was to have sufficient independence, redundancy,
.
and testability to accomplish safe shutdown assuming a single failure.
Th'e transmission system was to be supplied by two physically independent
.
circuits.
Each offsite power supply was to be available in sufficient time to assure safe
..
reactor shutdown, assuming the loss of both onsite supplies and the other offsite
supply.
!
One offsite supply was to be available within a few seconds to mitigate the
.
consequences of a loss of coolant accident.
The design will minimize the probability of the loss of any of the remaining
.
sources as a result of or in coincident with the loss of power generated by the
nuclear unit, the loss of power from the transmission network, or the loss of power
from the onsite electrical supplies.
The inspectors reviewed the licensee's response to each of the design requirements and
verified that General Design Criteria 17 requirements were met and that the plant met its
design basis even though the 161 kV and 345 kV offsite power supplies are not single
' failure proof.
c.
Conclusions
The electrical distribution system was designed such that a single fault could cause the
loss of both vital buses. This design protects the electrical distribution system by
. clearing faults as quickly as possible. The design met General Design Criteria 17
, , .
requirements.
M8.3 Transformer Damaae Assessment
a ..
Insoection Scoce (93702)
The inspectors evaluated the damage assessment the licensee performed on the faulted
)
l
transformer.
,
,
__.____._.__.__________.____..__-_.___.._._____________w
_ . . _ _
_ _ - _ _ _ _ _ _ _ _ _ - _ _ - _ _ - _ _ _ _ _ - _ _ - _ _ _ _ _ - _
.
.
-13-
b.
Observations and Findinos
On May 20,1998, the licensee performed their initial damage assessment of
Transformer T1 A 3. During the external damage assessment, the licensee noted burn
marks on the Phase B and Phase C bushings. On Phase B, one burn mark was located
on top of the bushing and two burn marks were located at the base of the bushing. The
Phase C bushing had one burn mark on top of the bushing. No other external damage
was noted.
The licensee performed Doble transformer power facts testing to identify any internal
damage to the transformer. The test results were satisfactory. Additionally, the licensee
performed oil analysis for dielectric, checked transformer oil level, performed transformer
turns ratio tests, and checked lightning arrestecs. All test results were satisfactory,
Excitation current was also measured and compared with testing conducted earlier
during the outage. The readings were equivalent.
The license filed rough surfaces on the bushings to reduce corona potential and cleaned
the glazing damage that had occurred on the bushings.
Since testing and external damage assessments did not identify any internal problems
with the faulted transformer, the licensee did not perform any testing on
Transformer T1 A-4. Visualinspections were performed and no damage was noted.
c.
Conclusions
The testing performed by the licensee was adequate to detect any internal problem with
the transformer.
M8.4 Other Onooino Switchyard Activities
i
(
a.
Insoection Scone (93702)
l
The inspectors reviewed the other work being performed in the switchyard when the
'
electrical fault occurred to determine if it could have caused the transformer fault.
1
b,
Observations and Findinos
)
1
When the fault of Transformer T1 A-3 occurred, maintenance was being performed in the
I
switchyard. Specifically, licensee personnel were performing maintenance on Feeder
j
Breaker 110. Breaker 110 is one of two breakers that supply 161 kV to
i
I
Transformers T1 A-3 and T1 A-4. The breaker was isolated and out of service to perform
l
timing testing and breaker adjustments. This was the only work authorized in the
l.
switchyard at the time of the event.
l
l
!
w
_-
-
i
_ _ _ _ _ _ _ _ - _ -
1
I
.
-14-
The inspectors verified that the work being performed in the switchyard did not contribute
to the electrical fault on Transformer T1 A-3.
c.
Conclusions
None of the work in progress in the switchyard prior to the electrical fault on Transformer
T1A-3 contributed to the event.
1
M8.5 Maintenance Rule implications
a.
Inspection Scoce (62707)
,
The inspectors followed up on potential implications of the deluge system failure with
regard to 10 CFR 50.65, " Requirements for Monitoring the Effectiveness of Maintenance
at Nuclear Power Plants."
b.
Observations and Findinas
The 10 CFR 50.65 implications of the transformer fault were addressed in Condition
Report 199801214. Prior to the fault, the DELUGE functional group of the fire protection
system was monitored under Category (a)(2) of 10 CFR 50.65. The performance criteria
for this functional group was no functional failure. A functional failure was defined as the
spurious actuation of any suppression system, structure, or components, which causes
the unavailability of any component reportable under 10 CFR 50.65. The inadvertent
actuation of the deluge system was considered a functional failure and caused the
performance criteria to be exceeded. As such, on June 11,1998, the DELUGE
functional group of the fire protection system was placed into Category (a)(1) of
10 CFR 50.65. As a result of being placed in Category (a)(1), corrective actions and
monitoring goals were established.
c.
Conclusions
The inadvertent actuation of the deluge system caused 10 CFR 50.65 performance
criteria to be exceeded. This resulted in the DELUGE functional group of the fire
protection system being placed in Category (a)(1) of 10 CFR 50.65.
E7
Quality Assurance in Engineering Activities
E7.1
Insoection Scops
The inspectors reviewed the licensee's root cause analysis and corrective actions
l_
implemented and proposed.
!
- _ _ - _ _ _ _ - _ _ _ _ _
_ _ - _ _ _ _ _ _ _ _ _
.
.
!
-15-
l
l
E7.2 Adeouacy of Root Cause Analysis
On June 4,1998, the licensee completed their root cause analysis of the inadvertent
actuation of the deluge system and resulting transformer fault. The root cause was
determined to be a lack of a preventive maintenance program on the deluge system.
Several contributing causes were identified. These included:
Lack of initiation of a maintenance work document for manual ball Valve FP-230
.
which had a bent mechanical stop;
Mishandling Valve FP-230 in such a manner which allowed travel beyond its
.
90 degree fully closed position resulting in valve leakage;
Lack of identification of the damaged ball valve during flushing / alarm testing of
.
the system and shutting the valve past the fully closed position and allowing it to
leak;
Crowded and poorly lit area around the transformer deluge valve; and
l
.
i
Conductivity of the river water.
.
The inspectors concluded that the root cause performed by the licensee properly
identified the cause of this event.
E7.3 Corrective Actions to Prevent Recurrence
To prevent recurrence, several corrective actions were recommended. The first, which
was a short-term corrective action, required operators to check and drain as necessary
the appropriate portion of the deluge piping during normal rounds. This action will
continue until evaluation indicates it is no longer necessary. The second, which was a
long-term corrective action, involved a review of preventive maintenance activities for the
fire protection system to assure the system will operate without inadvertent actuations.
This review was scheduled to be completed by November 20,1998.
E7.4 Conclusions
The inspectors concluded that the root cause analysis performed by the licensee
properly identified the cause of the loss of power to the vital buses. The corrective
actions taken and proposed were appropriate.
J
. _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ , - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ ___._-___ - . . ,
1
(.
-.
l..
-16-
V. Manaaement Meetings
l
l
V1
Exit Meeting Summary
!
The inspectors presented the inspection results to members of licensee management at an exit
meeting on June 18,1998.
- .
'
i.
No propriety information was identified.
l
L-
,
. I
l
1
L
l-
-
l
l'
!
H
P
l-
- f. .,
'
_
-
p.
-
_ _ _ _ - .
_o_____
_ _. ___ _ _ ___ _ _ _ ____ ___ _____ _ _ _ _ _ _ _ ___
_ _ - - _ _ _ _ _
- _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ ___________________-_____________ _ __- _ __ _ _ - _ - _ - _ _
a
.
ATTACHMENT
i
i
SUPPLEMENTAL INFORMATION
'
PARTIAL LIST OF PERSONS CONTACTED
Licensee
R. Clemens, Manager, Maintenance
J. Chase, Plant Manager
S. Chomos, System Engineering
A. Christensen, Operations Engineer
'
O. Clayton, Manger, Emergency Planning
M. Core, Manager, System Engineering
B. Hansher, Supervisor, Station Licensing
R. Ridenoure, Operations Supervisor
R. Short, Assistant Plant Manager
W. Walker, Senior Resident inspector
INSPECTION PROCEDURES USED
IP93702:
Prompt Onsite Event Response
ITEMS OPENED. CLOSED. AND DISCUSSED
Ooened
50-285/9811-01
Failure to initiate a maintenance work document
i
<
I-
!.
p
w
_ ---- --- --- ----