ML17228B369

Responds to Violations Noted in Insp Repts 50-335/95-18 & 50-389/95-18.Corrective Actions:Location of Key 21 Was Verified & Valve/Switch Deviation Log Entry for Afas Bypass Switch Closed Out on 951004

ML17228B369
Person / Time
Site:	Saint Lucie
Issue date:	12/15/1995
From:	Goldberg J FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
L-95-336, NUDOCS 9512270114
Download: ML17228B369 (13)

Text

MA~MJ.j.7!ACCELERATED RIDS PROCESSli REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)CCESSION NBR:9512270114 DOC.DATE: 95/12/15 NOTARIZED:

NO FACIL:50-335 St.Lucie Plant, Unit 1, Florida Power&Light Co.50-389 St.Lucie Plant, Unit 2, Florida Power&Light Co.AUTH.NAME AUTHOR AFFILIATION GOLDBERG,J.H.

Florida Power&Light Co.RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)

SUBJECT:

Responds to violations note'd in insp repts 50-335/95-18

&50-389/95-18.Corrective actions:location of key 21 was verified&valve/switch deviation log entry for AFAS bypass switch closed out on 951004.DISTRIBUTION CODE: IE01D COPIES RECEIVED:LTR ENCL SIZE-TITLE: General (50 Dkt)-Insp Rept/Notice of Vio ation Response NOTES DOCKET FT 05000335 05000389 RECIPIENT ID CODE/NAME PD2-1 PD INTERNAL: ACRS AEOD/SPD/RAB DEDRO NRR/DISP/PIPB NRR/DRPM/PECB NUDOCS-ABSTRACT OGC/HDS3 EXTERNAL LI TCO BRYCE I J H NRC PDR COPIES LTTR ENCL 1 1 2 2 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 RECIPIENT ID CODE/NAME NORRIS,J AEOD/DEIB AEOD/TQC PI'hE CENTE~R NRR/DRCH/HHFB NRR/DRPM/PERB OE DIR RGN2 FILE 01 NOAC COPIES LTTR ENCL 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 NOTE TO ALL"RIDS" RECIPIENTS; PLEASE HELP US TO REDUCE iiVASTE!CONTACI THE DOCL'CLIENT CONTROL DESK.ROOM PI-37 (EXT.504-2083)TO E LI XII.'CATE YOUR.CAME PROD!DISTRIBUTIOi J LISTS I'OR DOCl MEN'I'S YOU DON"I'EED!

OTAL NUMBER OF COPIES REQUIRED: LTTR 20 ENCL 20 Florida Power 8>>Light Company, P.O.Box 128, Fort Pierce, FL 34954.0128 December 15, 1995 L-95-336 10 CFR 2.201 U.S.Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C.20555 Re: St.Lucie UnitS 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 Florida Power and Light Company has reviewed the subject inspection report and pursuant to 10 CFR 2.201 the response to the notice of violation is attached.Very truly yours, J.H.Goldberg President-Nuclear Division JHG/FPS Attachment cc: Stewart D.Ebneter, Regional Administrator, USNRC Region II Senior Resident Inspector, USNRC, St.Lucie Plant'r>>512270114

'751215 PDR ADOCK 05000335 9 PDR an FPL Group company Re: St.Lucie Un s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 Violation A Technical Specification 6.8.1.a required that written procedures be established, implemented, and maintained covering the activities recommended in Appendix A of Regulatory Guide 1~33, Rev 2, February 1978.Appendix A, paragraph 1.d includes administrative procedures for procedural adherence.

Procedure QI 5-PR/PSL-1, Rev 62,"Preparation, Revision, Review/Approval of Procedures," Section 5.13.2, stated that all procedures shall be strictly adhered to.Contrary to the above, procedures were not adhered to strictly in the following examples: AP 1-0010123, Rev 99,"Administrative Controls of Valves, Locks, and Switches," required: that"All valve or switch position deviations or lock openings shall be documented in Appendix C Valve Switch Deviation Log...".[step 8.1.6];that"The NPS/ANPS/NWE shall ensure that the verification of the status of all valves, locks and switches under Administrative Control is performed at the required intervals specified in AP 1-0010125...[step 8.3.1]which"Verifies that log entries are current and valid".[step 8.3.2.3];and that"A log of keys issued shall be maintained by the ANPS for the Controlled Key Locker...Appendix B, Rack Key Log"...[step 8.2.2].On September 30, 1995, during a Steam Generator draining evolution on St.Lucie Unit 1, operators failed to make an Appendix B log entry when the AFAS AB BYPASS SWITCH (Key N21)was issued and returned.Further, the NPS/ANPS/NWE verification of the status of the AFAS AB BYPASS SWITCH Appendix C log entry performed on the midnight shifts of October 1 through October 3, 1995, failed to verify that the log entry was current or valid.2.AP 2-0010123, Rev 68,"Administrative Controls of Valves, Locks, and Switches," required: that"All valve or switch position deviations or lock openings shall be documented in Appendix C Valve Switch Deviation Log...".[step 8.1.6];and that"The NPS/ANPS/NWE shall ensure that the verification of the status of all valves, locks and switches under Administrative Control is performed at the required intervals specified in AP 1-0010125...[step 8.3.1]which"Verifies that log entries are current and valid"...[step 8.3.2.3].OP 2-0400050, Rev 16,"Periodic Test of the Engineered Safety Features," required that"The following logs will be reviewed prior to the performance of applicable test sections...The Valve Switch Deviation Log."[step 5.3.1]

Re: St.Lucie U s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 Contrary to the above, on October 7, 1995, during troubleshooting of AFAS Channel D on St.Lucie Unit 2, operators failed to make the appropriate Appendix C log entries when the AFAS CABINET DOOR (Key 5202)was restored at 2:00 PM.or when the AFAS CABINET DOOR was reopened and restored at 2:35 PM and 4:10 PM, respectively.

Further, the NPS/ANPS/NWE verification of the status of the AFAS CABINET DOOR performed on the midnight shifts of October 8 through October 10, 1995, failed to verify that the Appendix C log entry for the AFAS CABINET DOOR was current or valid.This is a Severity Level IV violation (Supplement I).FPL Res onse 1.CONCURRENCE AND REASON FOR THE VIOLATION FPL concurs with the violation.

The root cause of this event was as follows: (1)failure to follow procedures in that the shift operators failed to adequately maintain the Rack Key Log and, (2)failure to follow procedures in that the operators did not adequately maintain the Valve/Switch Deviation Log.A contributing factor was that the procedure/check sheet used for maintaining status control of the Valve/Switch Deviation Log did not provide instructions with respect to ensuring that the Valve/Switch Deviation Log entries were current and.valid.As stated above, the operators are required by Administrative Procedure AP 1-0010123,"Administrative Controls of Valves, Locks, and Switches," to maintain a log of keys issued from the Controlled Key Locker.The log is described in Appendix B, Rack Key Log.On September 30, 1995, shift operators failed to make an Appendix B log entry when the AFAS AB Bypass Switch key was issued from (and subsequently returned to)the Controlled Key Locker to allow for the AFAS Switch to be placed in the Bypass position for work associated with steam generator cooling and wet layup.The requirement for maintenance of this log is clearly defined in the subject procedure.

A lack of attention to detail on the part of the operators resulted in a failure to meet the procedural requirements.

AP 1-0010123 also requires that valve and switch position deviations be documented in Appendix C, Valve/Switch Deviation Log.This AP also requires that a verification of the status (e.g., position)of all valves, switches, and locks under administrative control be performed at intervals (specified in AP 1-0010125) to be each midnight shift while in Modes 1-6.

Re: St.Lucie U s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 On October 7, 1995, shift operators failed to make the appropriate Appendix C entries when the AFAS Cabinet door (Key g202)was restored, reopened, and restored again.This failure was the result of a lack of attention to detail on the part of the operators.

In addition, the operators'eview of the Valve/Switch Deviation Log, performed on the midnight shifts of October 8-10, 1995, failed to verify that the Appendix C log entries for the AFAS Cabinet door were current and valid.However, the checklist for the implementing AP (AP 1-0010125) for the midnight shift verification only required that the operators review the Valve/Switch Deviation Log to ensure that no valves or switches were in an alignment which could cause a Tech Spec LCO to be exceeded.No direction was given in this AP to verify that the log entries were current and valid.A contributing factor to the failure to adequately verify the status of the log entries was a procedural deficiency in Check Sheet 2 of AP 1-0010125.

2~CORRECTIVE STEPS TAKEN AND RESULTS ACHIEVED A.The location of Key 521 was verified and the Valve/Switch Deviation Log entry for the AFAS Bypass Switch was closed out on October 4, 1995.B.The location of Key 5202 was verified and the Valve/Switch Deviation Log entry for the AFAS Cabinet Doors was closed out on October 11, 1995.3.CORRECTIVE STEPS TO BE TAKEN TO AVOID FURTHER VIOLATIONS A Night Order was issued on November 10, 1995 that required the ANPS to review the Valve/Switch Deviation Log each shift to ensure that the verification of the status of all valves, locks, and switches under Administrative Control is performed at specified intervals and that the log entries are current and valid.B.A Temporary Procedure Change to AP-0010125 has been implemented to incorporate the following changes: 1.The NPS will review the Valve/Switch Deviation Log each shift.2.The ANPS will review the Key Rack Log each midnight shift., 3.The STA will review the Valve/Switch Deviation Log once per week.C.A Procedure Change Request has been submitted to permanently incorporate the changes listed in (3B)above.

Re: St.Lucie U s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 4.DATE OF FULL COMPLIANCE Full Compliance was achieved on October 11, 1995.VIOLATION B Technical Specification 6.8.1.a required that written procedures be established, implemented, and maintained covering the activities recommended in Appendix A of Regulatory Guide 1.33, Rev 2, February 1978.Appendix A, paragraph 1.c includes administrative procedures for equipment control.Procedure QI 14-PR/PSL-1, Rev 25,"Inspection's, Test and Operating Status," Section 5.5, stated that equipment clearance tags be attached to the isolating switch fuse or valve according to OP 0010122, Rev 59,"In-Plant Equipment Clearance Orders." Step 4.1 requires that a clearance shall be required when operation of equipment could create a hazard to personnel or equipment.

Contrary to the above on September 15, 1995, during the cleaning of Unit 2 condenser water boxes, the 2B2 waterbox manway was removed to replace a leaking gasket without implementing a clearance.

When the maintenance foreman and mechanic attempted to remove the manway cover, the negative pressure that existed across the manway sucked the cover back on the waterbox and severed a portion of the mechanics finger.This is a Severity Level IV violation (Supplement I).FPL Res onse CONCURRENCE AND REASON FOR THE VIOLATION FPL concurs with the violation.

The root cause of the event was a failure to follow procedures in that the parties involved failed to obtain the proper work clearances in accordance with OP 0010122,"In-Plant Equipment Clearance Orders." On September 15, the Unit 2 2B2 waterbox manway was observed to be leaking following the start of 2B2 circulating water pump after waterbox cleaning.A decision was made to replace the manway gasket.The Mechanical Maintenance foreman working this job informed the ANPS that the gasket replacement would be a short duration task.The ANPS and maintenance foreman decided that a clearance would not be required as long as operators were stationed at both the local circulating water pump pushbutton station and at the control switch on RTGB 202, to prevent inadvertent pump start.

Re: St.Lucie U s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 At ll:41 p.m., the 2B2 CWP was stopped.OP 2-0620020, Rev 26,"Circulating Water Normal Operating Procedure," Step 4.14, stated that, if CW pumps were being shutdown one at a time for waterbox cleaning, section 8.8 of the above procedure was to be used.Step 8.8.4 stated that a green flag on the CW pump control switch in the control room indicated that the waterbox vacuum breaker would open and the steam supply valve to the waterbox primer would close.Based on the above guidance, the CWP control switch was green flagged and permission was granted by operations to mechanical maintenance to begin manway gasket replacement.

The manway cover bolts were removed and the mechanical maintenance foreman and a mechanic attempted to remove the manway cover.When the pressure seal was broken, the mechanic allowed his right index finger to come between the cover and the waterbox.A negative pressure developed and sucked the cover back onto its flange and severed part of the mechanics finger.A subsequent review of the control wiring diagrams for the vacuum breaker found that the CWP breaker'control fuses had to be removed to open the vacuum breakers.A review of the event found that:~Neither the maintenance workers nor the ANPS anticipated that a vacuum would exist once the CWP was secured.~The steps in the procedure for CWP operation indicated that when the CWP control switch was green flagged, no other precautions were required.~The maintenance workers, after discussions with the ANPS, did not verify that the system was de-energized prior to starting work.2.CORRECTIVE STEPS TAKEN AND RESULTS ACHIEVED 3~A.The injured employee was transported to the hospital.B.Work was completed and the system restored to service.CORRECTIVE STEPS TO BE TAKEN TO AVOID FURTHER VIOLATIONS A.Disciplinary action was'taken against the Operations and Maintenance supervision involved in the decision to work without proper clearances.

Re: St.Lucie U s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 B.A Safety Incident/Accident Report was completed by the Local Joint Advisory Safety Committee.

This report evaluated the safe work practice requirements for this type of maintenance.

Expectations for safe work practices were disseminated through the"Safety Alert" process.C.OP"1[2]-0620020,"Circulating Water Normal Operating Procedure," was revised to clarify the requirements associated with opening the vacuum breakers.D.OP 0010122,"In-Plant Clearance Orders," was revised to provide more specificity with respect to what maintenance activities can be performed without an , equipment clearance.

E.The maintenance procedure for condenser waterbox cleaning and repair, M-0921, was revised to add a caution statement about the removal of manways.Also, the standard Nuclear Plant Work Order for waterbox cleaning has been revised to exercise caution when opening the condenser cooling system.F.The Site Training Department will present this topic at a future In-House Events training class.4.DATE OF FULL COMPLIANCE Full compliance was achieved on September 16, 1995.VIOLATION 10 CFR 50 Appendix B Quality Assurance Criteria for Nuclear Power Plants and Fuel Processing Plants required, in part: that"Measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in 5 50.2 and as specified in the license application, for those systems, structures and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions."..."The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program."[III DESIGN CONTROL]

Re: St~Lucie U s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 that"A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed..."[XI TEST CONTROL]Contrary to the above, the licensee implemented a Unit 2 Emergency Diesel Generator (EDG)control logic design that did not trip the EDG output breaker on receipt of a CSAS or CIAS signal when parallelled with offsite power.This inadequate design resulted in shifting the governor to the isochronous mode, bypassing all protective relays except overspeed and differential current during integrated safeguards testing on October 12, 1995.This resulted in operating the EDG as a synchronous motor for approximately 45 seconds until the CIAS signal was reset.Operation in the isochronous mode while paralleled with offsite power could expose the engine and generator to excessive mechanical stress or electrical overcurrent conditions.

This is a Severity Level IV violation (Supplement I).FPL Res onse CONCURRENCE AND REASON FOR THE VIOLATION FPL concurs with the violation.

The root cause of the violation was a failure to identify a design deficiency during initial design and testing and to adequately review the revised Integrated Safeguards Test procedure prior to implementation on Unit 2.The performance of a revised Integrated Safeguards Test identified an equipment concern in which an undesirable logic response could occur from a spurious CIAS signal without its accompanying SIAS signal.The original plant design of the Unit 2 EDG SIAS/CIAS/CSAS logic was arranged such that during a surveillance run with the EDG connected to the offsite power grid, the EDG could have been potentially damaged upon receipt of a spurious CIAS signal.The revised Integrated Safeguards Test, which had been recently enhanced to more fully test discrete circuit logic paths, inadvertently created this condition on the 2A EDG, resulting in a reverse power condition until the CIAS signal was reset after approximately 45 seconds.A subtle difference between Unit 1 and Unit 2 was discovered as a result of the reverse power incident and is considered the main contributing cause.The Unit 1 EDGs use the same Re: St.Lucie U s 1 and 2 Docket No.50-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 frequency reference for both droop (follows grid frequency) and isochronous (internal frequency reference) modes;thus, switching from droop to isochronous modes would not change the speed of the EDG.The Unit 2 EDGs use different frequency references for droop and isochronous modes;switching of the frequency reference is done using contacts from the same relay that provides the EDG start signal.The actual governor change from droop to isochronous for both Unit 1 and 2 EDGs is controlled by the 4160V bus feeder breaker position.In the case of a Unit 2 SIAS actuation, the EDG output breaker is opened,'f closed, and the EDG runs at the isochronous speed.However, for a CIAS or CSAS without SIAS, the EDG output breaker would not open but the EDG speed would switch to the isochronous speed.With a preset isochronous speed lower than the grid frequency, the Unit 2 EDG would try to slow down, resulting in a reverse power condition (as occurred during the test).If the preset isochronous speed is higher than the grid frequency, the EDG would try to speed up and a generator overcurrent condition would result.Either condition exposes the EDG to potential damage.While the original design satisfied the EDG design intent for the various Design Basis Accident scenarios, it failed to recognize the potential negative impact to an EDG should a spurious CIAS occur when running in parallel with offsite power.As a result of the St.Lucie Units 1 and 2 service water system operational performance inspection audit performed in 1991, the Unit 1 Integrated Safeguards Test procedure was revised to address enhanced testing of the swing busses (C busses).The revised procedure was reviewed to ensure that all required Technical Specifications had been included, that load shedding and sequencing of A and B Train ESF components were verified, that the swing bus components were tested with the swing busses alternately aligned to both A and B Train busses, and that all control logic pathways necessary for safeguards equipment to perform their safety functions were adequately tested.Section 8.6 performs manual CIAS, SIAS and CSAS actuation verification with the EDGs synchronized and fully loaded in parallel with offsite power.This section was changed in order to ensure that those components which received multiple ESF signals are fully tested for each signal.Specifically, components which change state for CIAS alone would need to be tested independent of SIAS, as SIAS initia'tes a CIAS signal.The CIAS test was performed prior to the SIAS test;therefore, the EDG breaker remained closed until tripped by SIAS.The Unit 1 Integrated Safeguards Test was performed during the 1994 outage using the revised procedure.

No anomalies occurred regarding EDG operation while performing Section 8.6 of the test procedure.

Re: I St.Lucie U s 1 and 2 Docket No.5-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 The Unit 2 Integrated Safeguards Test procedure was revised prior to the 1995 Unit 2 refueling outage.This revision essentially duplicated the Unit 1 test procedure, with changes as necessary for Unit 2 plant specific loads.The Unit 2 Integrated Safeguards Test procedure was given an extensive review similar to that done for the Unit 1 procedure.

In addition, a majority of the test procedure was modeled on the simulator, including the section leading to the reverse power condition, with no anomalies detected.Prior to this change, CIAS had not been actuated with the EDG running in parallel with offsite power;SIAS was actuated first, which tripped the EDG output breaker.However, in order to test components which change state for CIAS alone, the Unit 1 methodology to intitiate CIAS before SIAS was used.The Unit 2 Integrated Safeguards Test was performed on October 12, 1995, with the resulting EDG reverse power incident and termination of the test.Although the Integrated Safeguards Test procedure review was very involved, the difference between the Unit 1 and 2 EDG governor speed control circuitry was not identified.

Based on the numerous identical operating features between the Unit 1 and 2 safeguards responses and the relative obscurity of the design differences as shown on the control wiring diagrams and vendor drawings, the inappropriate response to a CIAS signal was neither identified nor expected.The revised Integrated Safeguards Test procedure, which was enhanced in anticipation of the more stringent test requirements discussed in the NRC Information Notice 95-15, discovered this undesirable condition.

2.CORRECTIVE STEPS TAKEN AND RESULTS ACHIEVED A.Immediately following the incident, EDG 2A was inspected and test run under load and found to be undamaged.

B.Unit 1 EDG start logic circuitry was reviewed to ensure that no similar failure modes existed on Unit 1.No similar failure modes were identified.

C.PCM 156-295,"Deletion of EDG Automatic Start on CIAS and CSAS," was implemented on the Unit 2 EDGs.Post modification and ESFAS testing was completed on December 6, 1995 with no anomalies occurring in EDG function.3.CORRECTIVE STEPS TO BE TAKEN TO AVOID FURTHER VIOLATIONS A.Design modifications currently produced undergo rigorous multi-discipline design review, verification, and post-modification testing with the intent of detecting and eliminating potential'esign flaws such as this.Therefore, any future design modifications would be reviewed and tested under our present design control process to ensure that the affected component and plant responses are appropriate.

Re: St.Lucie U 1 and 2 Docket No.5-335 and 50-389 Reply to Notice of Violation Ins ection Re ort 95-18 B.Engineering has determined that future test procedure revisions which change the order of initiating signals must be reviewed for the potential to adversely impact design functions.

The methodology for ensuring that initiating signal order changes receive increased review will be completed by March 15, 1996.4, DATE OF FULL COMPLIANCE Full compliance was achieved on December 6, 1995.10