ML20094G966

Responds to NRC 911218 Ltr Re Technical Findings Noted in Electrical Distribution Sys Functional Insp Repts 50-338/91-17 & 50-339/91-17 on 910729-0830.Util in Process of Revising & Updating Voltage Profile Calculation

ML20094G966
Person / Time
Site:	North Anna
Issue date:	02/28/1992
From:	Stewart W VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
91-765A, NUDOCS 9203050220
Download: ML20094G966 (55)

Text

Vil'OINIA 81.I CTHIC AND l' OWE H CONWANY llICit MOND, Vilf 0!NI A UllM 61 February 28, 1992

\

l U.S. Nuclear Regulatory Commission Serial No. 91 -765A Attn: Document Control Desk NLP/RMN R10 Washington, D.C. 20555 Docket Nos. 50-338 50-339 License Nos. NPF-4 NPF-7 Gentlemen:

VIRGINIA ELECTRIC AND POWER COMPANY l NORTH ANNA POWER STATION UNITS 1 AND 2

[NSPECTION REPORT NOS. 50-338/91-17 AND 50-339/91-17  ;

We have reviewed Inspection Report 91-17, dated December 18,1991 which  ;

transmitted the results of the Electrical Distribution System Functional Inspection (EDSFI) conducted at North Anna from July 29,1991 through August 30,1991. We responded to the Notice of Violation by letter dated January 16,1992 (serial number 91-765). This response addresses the 23 technical findings identified in the inspection report. In a telephone conversation between Mr. M. Bowling of Virginia Power and Mr. P. Fredrickson of Region ll, it was agreed that a response to these findings would be provided by February 28,1992. l l

I The executive summary of Inspection Report 91-17 noted that management controls and interface of all design basis calculations were not well defined or implemented.

Our response to this issue is discussed below, Our responses to each of the specific technical findings are provided in the attachment.

Subsequent to the inspection, we have rev. awed the index of North Anna design calculations, identified approximately 200 calculations applicable to electrical distribution system design, and are now in the process of more completely cross indexing that information. A continuing calculation update effort will further consolidate those calculations into a more manageable set for Icag term use. We have also developed additional administrative controls which provide further guidance for control of electrical distribution system design calculations. Identified electrical distribution system design restrictions have been transmitted to North. Anna, in addition, as discussed during the inspection, calculation control measures have been enhanced as part of our configuration management effort. The new Data Management Information System (DMIS) currently being implemented provides a means of calculation indexing and establishes the interrelationships for those calculations. Controls are in place to assure that information placed in DMIS is accurate and complete.

p ,7 r> -

9203050220 920228 h PDR ADDCK 05000338 i o PDR j1 1

As you are aware, the Design Basis Documentation (DBD) program has preparad system design basis documents and conducted design information reviews for r.me, but not all, of the systems covered by this inspection, in preparing the documents and in the associated reviews, a large number of open items, including calculation a deficiencies, were identified. Many of the deficiencies identified during the EDSFl had l previously been identified as open items under our program ' Jut had not yet been dispositioned. Our preliminary screening of those open Nms identified no issues of 4 safer / significance. Efforts to usolve the open itemt, particularly the upgrade of calculmions, are underway, if issues develop during this review which could potentially affect operability of plant systems or equipment, they will be promptly documented and evaluated. We continue to believe that the current scope and schedule of our DBD program is appropriate, but will continue to review the program as DBD production and review proceeds.

l Also, we are initiating several tests and studies to resolve concerns identified during

. the EDSFl and our own self-assessments. The testing willinclude emergency diesel generator (EDG) tests to validate the EDG dynamic model and 480 VAC molded case circuit breaker tests to document fault current interrupting capability. - The studies will include adequacy cf lightning protection of the 4 Kv reserve station service transformer 4

overhead bus, EDG reverse power relaying protection, vital bus load analysis, DC grouna fetection analysis, and the use of two test point overcurrent relay calibrations.

I The C ation Emetrical 1.oad List (SELL) was developed from station drawings and first-issuuJ in June 1988. Since the original issue, periodic revisions or addenda have been made to address both load changes and correct ions based on' additional design inputs including review by station operations. This is a conservative calculation, therefore, successim revisions have tended to lower estimated loads. The majority of 4

work has been directed toward the safety related 4160 and 480 volt levels. Most recently, the loading calculation for the emergency diesel generators, based on the SELL, was revised requiring additional scrutiny of the low and medium voltage buses.

Based on the EDG calculation, we can quantitatively state that the current SELL is i overly conservative. The concerns identified about the SELL are being addressed as discussed in the attachment.

l Our schedule for addressing the technical findings-is provided with each of-the individual responses in the attachment. These schedules reflect the results of our

, initial safety significance and reportability screening. Each of the technical findings has been reviewed, and none has been found to have immediate safety significance.

Finally, the same Electrical Distribution System Self Assessment process which we

. undertook at North Anna will be conducted at.the Surry Power Station. This assessment is currently scheduled to begin in May 1992 and will apply the lessons teamed from the North Anna eifort, in turn, any new issue identified during the Surry assessment will be evaluated for applicability to Nodh Anna.

i

, ., , . . . _ . . . , , , . . _ ~ , .,, . , . _ , - , , . , - . , , , -

4

If you have any further questions, please contact us.

Very truly yours, l

\

I TN xe w .yy N '

W. L. StewNrt' Senior Vice President - Nuclear Attachment cc: U. S. Nuclear Regulatory Commission c

101 Marietta Street, N.W.

Suite 2900 4-Atlanta, Georgia 30323 Mr. M. S. Lesser NRC Senior Resident inspector North Anna Power Station f

l

i i

U i

Attachment i

d i

a t

t i

i 1

i e

i Discus::lon of Findings Electrical Distribution System Functional inspection North Anna Power Station 4

i 4

8 i

4 4

s a

i-

, Virginia Electric and Power Company i

l t

k i

i

i FINDING 91-17-01: Degraded Grid Voltage Relays. (paragraph 2.2.2) i

. DESCRIPTION:

l The team determined that the degraded grid voltage relay calculations failed to.

i include all possibis errors in the determination of the relay setting, and of the ' +

allowable value for relay periodic surveillance.

The licensee procedure for relay setting specified an allowable range for relay dropout of 3794 Vto 3704 V.

The team noted that no margin existed between the minimum voltage of 3704 V l required for proper operation of motor starters and the minimum allowable value for ,

the relay setting.

1 In addition, the licensee did not consider other errors, such as calculation errors, l calibration equipment errors, calibration method errors, surveillance errors, drift errors, and potential transformer errors.

l I

i SAFETY SIGNIFICANCE:

The lack of error accountability may result in relay operation beyond the acceptable i voltage conditions for safety related equipment.

i i RESPONSE:

During the EDSFl inspection we submitted a- Nonh. Anna Technical Specification

{ change to NRC to clarify the degraded voltage relay setpoint and tolerance values.

The Technical Specification change was approved on November 29, 1991. The

required degraded voltage setpoint is 374617 volts for 7.511 seconds. This range j takes advantage of the minimum discernible variance of the calibration 4

instrumeatation, of i 0.1 volt. Bus voltage is measured by a potential transformer with

! an effective voltage ratio of 60.6 to 1. Therefore, a change of +~ 0.1 volts on the i secondary corresponds to an approximate variance of + 7 volts on the primary.

h During the EDSFI inspection the degraded voltage setpoint calculation EE-0373, Rev.

O, was revised via Addendum 1, to provide a new allowable range, including relay .

tolerance, of 3687 to 3793 volts [3746 +47/-59 volts or (+1.3%/1.6%)]. This range readily accommodates the manufacturer's published relay tolerance of less than 1%,

in addition to the calibration instrument error of 17 volts.

L

in addition, the_ current setpoint is biased slightly toward the upper end of the allowable range. The'setpoint must be high enough such that.during sustained reduced voltage

. conditions (i.e., slightly higher than the trip setpoint), adequate voltage is provided to :

the ESF equipment for continued operation. The setpoint must be low enough to:

minimize the possibility.of disconnecting the emergency buses fro... ihe offsite power source during short term voltage transients, such as those caused by energizing large.

L electrical loads. Of these two considerations the more important from the standpoint of

avoiding partial loss of ESF actuation is to ensure that a sustained low voltage will be j high enough for ESF equipment to continue to operate.

i Page 1 i

One aspect of this finding is that our setpoint control standard, STD-GN-0030, Rev. 2 (Nuclear Plant Setpoints), which was in effect when calculation EE 0373, Rev. O, was prepared in April 1991, did not clearly specify which of the setpoint methodologies should be used for protective relays. The " single element setpoint" methodology specified in the standard was used, which was consistent with the methodology previously use for developing protective relay setpoints. However, the reference to the standard was not made in the calculation, and, because of a programmatic weakness in implementation of the standard, the determination of the applicability of the standard to all setpoints was not made. This methodology specifies the setpoint value as the " normal operating value plus a margin of conservatism, to include the manufacturer's recommendation, good engineering practice, etc." The standard also provided a methodology for " protection systems," which specified the calculation of a channel uncertainty in accordance with the guidance in ANSI /ISA S67.04-1988 (Setpoints for Nuclear Safety Related instrumentation Used in Nuclear Power Plants).

During the EDSFI inspection, when the NRC team questioned the applicability of the standard to protective relay setpoints, we promptly submitted a station Deviation Report to document the programmatic deviation. The corrective action for the Deviation Report was to revise STD-GN-0030 to clarify its applicability to protective relay setpoints and to provide training on the use of the standard. These actions were completed by November 8,1991. Rev. 3 of STD-GN-0030 identifies protective relays as single element /ssif actuated devices, or devices that measure a process variable or signal at a single point (e.g., voltage). The setpoint calculation methodology is identical to that specified for " single elements" in STD-GN 0030, Rev. 2. ANSI /ISA S67.04-1988 is referenced in STD-GN-0030, Rev. 3 and is used for guidance in developing engineering standards and procedures, but is not considered part of the licensing basis for the our nuclear stations. The " protection systems" methodology of Rev. 2 has been clarified as applicable to " instrument protection systems" in Rev. 3 of STD GN-0030.

Use of channel uncertainties for the establishment of setpoint limits is most useful when applied to complex instrument loops, with " active" process sensors (RTDs, transmitters) and multiple series loop devices, some of whose sensors have the potentia _I to be exposed to harsh environmental conditions. In the case of the degraded voltage protective relays, however, there are no intermediate devices between the passive sensor (PT) and the final active relay. The elements of this loop are located in the Emergency Switchgear Room, a mild environment, which is temperature controlled by a safety related HVAC system. Experience to date indicates that setpoint drift between calibrations of these relays has been within the specified relay tolerance.

As discussed in the response to Finding 91-17-03, we are in the process of revising and updating the voltage profile calculation for the North Anna electrical distribution system. We believe that this work may result in the quantification of additional available margin for the degraded voltage relay setpoint limits, and the current limits can be relaxed further as that quantification becomes available. Calculation EE-0373 will be revised by November 30,1992 to document more completely the engineering justification for the adequacy of the existing setpoint margins.

Page 2

FINDING 91-17-02: Inadequate Lightning Protection of the 4 kV Safety Circuits. (paragraph 2.2.3)

DESCRIPTION:

The team found that there was no lightning protection for the overhead 4 kV distribution system which originates at the RSST.

The licensee indicated that the following actions would be taken:

- installation oflightning arresters on the RSSTlow side terminals, review the degree of protection afforded by the overhead ground wire, which was found to provide adequate protection.

The team disagreed with the adequacy of the overhead ground wire because during a direct lightning strike to the overhead shielding, the likelihood of high induced potentials on the 4 kV system could still exist, even in the absence of a direct lightning strike to the 4 kVleads.

The licensee agreed to further evaluate the condition.

SAFEW SIGNIFICANCE:

The lack of adequate lightning protection could result in safety equipment being disabled.

RESPONSE

Lightning arresters will be installed on the RSST low side terminals. This modification is proposed for the 1993 refueling outages, when the RSS transformers can be removed from service.

In response to the EDSFl questions, we concluded that the 4KV overhead bus was protected from a direct lightning strike by the proximity of the turbine building and the 500KV overhead lines and associated shield cables and that the 4KV cables in trays routed across the turbine building roof were protected from a direct lightning strike by the masts erected on the roof for that specific purpose. This conclusion was based on the accepted method in NFPA 78, Lightning Protection Code.

We will resiew, by February 1993, the lightning protection of the 4KV system with regard to a direct lightning strike to the overhead shielding- cable and the accompanying induced voltages on the 4KV leads. This analysis is warranted because the magnitude of the induced voltage is undefined. However, there is no significant immediate concern, since the 4KV buses and cables are shielded from direct lightning strikes.

Page 3

FINDING 91-17-03: Inadequate Control of Design Calculations.

(paragraphs 2.4.1, 2.4.2, 2.5.1, 2.5.2, 3.4, 3.$)

DESCRIPTION:

The licensee's document NDCM 3.7 provides general guidelines and requirements for the preparation, review and approval of calculations for North Anna. The team's review of design calculations during the inspection indicated that these guidelines and requirements were not always followed.

Specifically:

1. The calculations for the RSST output power cables only consisted of "SWEC (informal) Job Book - 14x,12050.42" calculation. However, this document lacked pertinent information to assure that the information was correct or properly reviewed or verified.

2. No objective evidence existed to substantiate the UFSAR statement on page 8.2.1, that each one of the 500/34.5 kV transformers could supply all three RSST's. The licensee response demonstrated the capability claimed in the UFSAR; however, no documentation (aside from that generated by the licensee response to team's question) existed.

3. The team noted that the licensee had not evaluated the voltage profile at the EDG bus for the case of faults in NSR circuits, during the time between fault inception and fault clearing. Since NSR circuits would be connected to the EDG bus under accident mitigation events, a fault in these circuits could depress the voltage at the EDG bus to levels which might affect safety related equipment operation. The licensee indicated that for faults not on the bus, the EDG would maintain 100 percent bus voltage. However, there was no objective evidence of an analysis for faults at the bus and for faults at the 480 V level.

4. Licensee's calculation EE-0373 was intended to determine new setpoints and allowable valuc5 for the 4.16 kV degraded voltage relays. The calculation determines the lowest voltage (3704 volts) needed for all contractors to pickup and to support continuous running of Class 1E motors. The setpoints for degraded voltage relays were then established based on a 1 percent error allowance for relay tolerance plus 5 V for added margin. In discussions with the licensee conceming specific instrument errors (PTinaccuracies, relay drift, relay drift, repeatability, temperature effects, etc.), the licensee stated that these were not includedin the calculation and had never been quantified. But, ifinstrument errors were to be quantified, they would be more than offset by extra margin used in the determination of the 3704 V limit. The team finds it unacceptable to ignore known instrumentation errors and to, in effect, assume them to be zero without properjustification. The licensee's STD-GN-0030 specifies that setpoint calculations shall be performed and documented in accordance with NDCM 3.7 which, in turn, requires that all engineering judgment and assumptions be documented.

Page 4

_________2 _ _ _ _ _ . _ _

FINDING 91 17-03: (continued)

5. Section 5.3 of NDCM 3.7 assigns the responsibility of listing calculations to the calculation preparer. The licensee has no system for tracking interrelated calculations.

6. In calculation EE-012 dated September 12,1989, there was no basis given for Assumption Number 5 as required by Section 4.15 of Attachment 3.7.1 to NDCM 3.7.

7. In the calculation supporting EWR 89 233 there are handwritten comments in the margin with illegible and contradictory notes. Also, the following inadequacies were noted:

7.1 Overcurrent relay setting did not consider coordination with downstream devices and failed to refer to withstand characteristics of the generator.

7.2 No analysis / justification for the lack of ground detection / protection.

7.3 tl0 analysis / justification for the lack of motoring, underexcitation or negative sequence protection.

7.4 Calculation for CT accuracy is incorrect / incomplete.

7.5 No reference for fault values used.

7.6 Assumption for differential relay is incorrect.

8. Calculation EE-0324, Revision 1, dated July 26,1991, contained errors in the input data pertaining to values of X/R for several motors. Licensee has acknowledged these errors.

9. Licensee current voltage analysis dated May 10,1v90, for the EDG, neglected transient current in the calculations for damage to the EDG under negative sequence fault conditions with no justification.

10. Calculation EE-345, Revision 0, dated April 9,1991, covering protective relay settings contained relay coordination curves which were extrapolated beyond the manufacturer's published values. The extrapolation was labelled

" estimated" with no justification given.

11. Instrumentation Calibration Procedure ICP-P-MI-1 has a supporting calculation which determined a setpoint for the high day tank level to be 7.75"

, from the top of the tank and 50.50" from the bottom. Since the tank is only 54" tall, this was in error. Also the calculation did not account for instrument drift and repeatability and fuel oil density range.

12. In review of the documentation for previously unresolved item 50-339/89-200 the team noted the following calculational deficiencies:

Page 5 JN

FINDING 91-17-03: (continued) 12.1 The failure to include service factor values for large motors.

12.2 The omission of as built data for motor starting and running power factors.

12.3 The possible overloading of MCC buses.

12.4 The possibility of worse case startiag loads or worse case load sequences that have not been analyzed.

12.5 The possibility of lower than minimum required voltages at safety related loads.

12.6 Justification for conservatism S.E.L.L. calculation, and example where loads exceeded ratings.

12.7 The possibility of miscoordination at 480 V branch circuit breaker circuits with upstream devices (paragraph 2.4.2).

12.8 The possibility of unacceptable voltages at safety related equipment below 480 V level.

13. The team reviewed calculation EE-0009, Rev.1 and noted that the calculation assumed that the voltage drop between the battery and the dc distribution switchboard was negligible. Battery I 01 and 1-03 have cable runs approximately 200 feet long therefore the calculations should consider the voltage drop.

j

14. Calculation EE-0009, Rev.1, concludes that the vital bus inverters would operate down to 101 V dc input. That conclusion was based on an incorrect interpretation of a telephone memorandum (attached to the calculation) between the licensee andinverter vendor. The vendorindicatedin the memo that any operation below 105 V DC must be justified by actual tests. The licensee indicated that operations of the inverter at voltages less than 105 V DC had been demonstrated during a battery charger capability test. The focus of that operation / test was not the performance of the inverter. The test would -

1 not qualify as an inverter test as prescribed by the vendor, since several parameters, such as inverter load current, were not monitored.~

15. Calculation 14258.08 E 3, Rev. O, dated August 11, 1983, used measured loads, taken during normal station operations to represent accident loads, without justification. Use of correct values for accident loads are needed to assure proper sizing and operation of the inverter and battery charger.

Page6

FINDING 91-17-03: (continued)

16. The battery charger calculation assumes an accident loading for the vital but inverters to be equivalent to a load that has been measured during normal station operation. The ability of the battery chargers to carry the bus load and recharge a discharged battery to full capacity in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was highly dependent on the value used for inverter accident loading. The licensee had submitted a preliminary analysis based on an earlier load study of inverter accident loading (reference Calculation 14258.08-E-3).

That preliminary analysis failed to account for voltage drop between the battery and the 125 V dc distribution switchboard. Further, it did not provide a basis for the 0.8 value used for load power factor. Further the referenced calculation being used for load inputs (Calculation 14258.08-E-3) delineates .

a load power factor of 1.0. It also concluded that for battery charger 1-BY-B-04 its associated DC System load requirements are greater than the batterf charger's rated output current capability 225A. However, the battery charger can operate at 250 Amps but it was not tested a. that value. The concern was compounded by the fact that the chargers wers 'ested at approximately 90 percent (200A) of their rated current output. 'he licensee had identified Projects EA-91-0704 and EA 91-0705 (duc July 31, 1992, and October 30, 1992), to address inverter accident loac,.ng and verify charger sizing, respectively.

17. The originalpurchase specification called for a design basis to be provided by the emergency diesel generator vendor (also supplier of the EDG dc system) for the batteries and the battery charger. Documentation could not be provided by the licensee and may not exist.

18. The team reviewed calculation E-2, Rev. O, dated April 28,1984, and noted that the calculation did not address the potentialimpact on dc short circuit current of replacing the C&D battery with a larger Exide battery.

19. Th3 HVAC calculations were inadequate design documents. Calculations did not state purpose, assumptions, or references. They contain inadequate information to determine design of ventilation for safety related electrical equipment to maintain ambient conditions recommended by equipment vendors.

20. The team reviewed voltage and short circuit calculations for the class 1E 480 V distribution system, the 120 V vitalbus system, and the 125 VDC distribution system. The following generic calculationaldeficiencies were noted:

20.1 The calculated voltage for 480 V MCCs for both starting and running cases was less than minimum required voltage for attached loads.

The licensee stated that the duration of time below minimum required voltage would not be detrimental to equipment and further, the problem would be minimized because the calculation was conservative in its estimate of system loads. Calculations did not support these statements.

Page 7

9 l

FINDING 91-17-03: (continued) 20.2 The calculated short circuit ratings for some class 1E molded case circuit breakers exceeded their breakers ratings.

20.3 Calculated loads at MCCs would exceed their bus ratings under.

. design basis accident conditions.

20.4 480 V load centerimpedances used in calculations did not agree with name plate' equipment impedances.

20.5 All motor starting cases had not be. n addressod in the transient analysis.

20.6 Analysis had not considered worst case starting loads or properly.

considered load sequencing. I 20.7 Calculations used assumed values of motor-starting and running power factors rather than actualLvalues for large motors. ; Motor efficiency in calculations should be based on as built data sheets. l 20.8 Calculations for load and voltage analysis assumed motor. service factors were adequate. The motor service factor should be evaluated for adequacy.

21. Calculations for the EDG Iouvers loading due to a tomado were not available.

22. The team reviewed the power required for the major salety related pumps on the diesel buses as presented in the licensee's Vital Bus Loading Calculation  :

EE-025. The load assumed:for the component cooling water pump and ,

service water pumps were not the maximum power operating load conditions. )

The calc lation had assumed a nominal flow of 8000 gpm to arrive at a pump motor power requirement of 345 Kw for the component cooling water pumps.

The licensee confirmed that system flows of 11000 gpm were possible, which would result in the motors drawing 400 Kw. The service waterpumps actually has peak power requirement of 427 Kw at shutoff. -However, the load calculation used the valve of 395 Kw. This operating condition would be an unlikely event and therefore no potentialimpact on bus loading exists..

SAFETY SIGNIFICANCE:

Design calculations which are not properly controlled, inadequate and inaccurate can lead to unclear design bases and to improper equipment design, performance, and

~

modification.

Page 8 i

.yr

i

RESPONSE

We have been conducting an extensive design basis review and documentation effort for our nuclear stations since April 1989. This effort has involved the indexing of all known design calculations, the physical walkdown and relabelling of plant components, the updating of vendor manuals and the preparation of System Design Basis Documents (SDBD) and Plant Design Basis Documents (PDBD - preparation currently scheduled to start in 1992) to identify more completely the system and station design basis.

Part of this effort has involved the identification of " critical" design calculations. A

" critical calculation" is a calculation that substantiates or supports the assumptions or impacts the plant's safety analysis. These calculations are listed in Section 16.0 of each SDBD. Further, during the draft SDBD review, if a potential operability concern should become evident, this issue is captured as a Potential Problem Report (PPR) and reviewed by engineering management under the Problem Reporting System (Nuclear Design Control Manual Procedure NDCM 6.1).

The Problem Reporting System provides for formal potential problem identification, while allowing time for further development of engineering information if an actual deficiency is not immediately apparent. If during the review, the PPR is deemed to constitute a stetion deviation, under the guidance of station administrative procedures, Engineering will submit a station Deviation Report, and operability and reportability under 10 CFR 50 and 10 CFR 21 will be assessed in accordance with the existing station procedures.

f The above process was in use during the preparation and review of the North Anna electrical distribution system SDBDs in 1989 - 1991. Critical calculations were identified and deficiencies noted in the SDBD Open items section, section 24.0.

Although calculational deficiencies were identified, few potential operability concerns arose, and those were subsequently resolved through the Problem Reporting System.

In parallel with the DBD effort, in 1990 we developed a plan for the systematic review and upgrade of all applicable electrical distribution system design basis calculations for both nuclear stations. This process was ongoing at the time of the EDSFl

. inspection.

4 The lists of open items from the SDBD review and the EDS Self Assessment were available to the NRC team during the EDSFI inspection. Although some new calculational deficiencies were identified during the EDSFI inspection, the NRC team had no operability concerns requiring immediate attention at the conclusion of the inspection. We plan to continue with the calculation upgrade effort in a systematic, controlled manner. Calculational upgrades have been prioritized and will be worked accordingly.

In the area of electrical calculation deficiencies, we have reviewed the index of design calculations, have identified approximately 200 calculations in this- set that are directly/ indirectly applicable to distribution system design, and are in the process of more completely cross-indexing these 200 calculations in the Document Management i

information System (DMIS). The continuing calculation update effort will further consolidate these calculations into a more manageable set for long term design use.

In addition, we have developed a new procedure, EE-029 (Calculation Controlling Page 9

Procedure [ NEE-Power)), which provides further guidance for control of design calculations. This procedure will be implemented by February 29,1992. Further, we have formally communicated known electrical distribution system design restrictions to North Anna via an Engineering Technical Bulletin .

Each individual concern of this finding is addressed below.

1. During the EDSFI, we provided a copy of an original plant design calculation performed by the A/E. Questions arose regarding the portion of that calculation portaining to the ampacity of the Reserve Station Service Transformer secondary cables. We indicated that the subject portion of the calculation was known to be in error. We determined that the design basis for the ampacity resided in an informal calculation maintained by the A/E. While no concern exists with the design of the cables, we will revise the calculation by April 1,1992.

2. Either of the two 500/34.5 KV transformers, rated at 112 MVA, could supply three 33.6 MVA RSST's (i.e.100.8MVA). Recent installation of the third 34.5KV source transformer (230/34.5 KV) alleviates the need to operate with three RSST's supplied by a single 500/34.5 KV transformer. The two 500/34.5 KV transformers comprise the two independent offsite power supplies required for GDC-17 and the Technical Specifications (the 230/34.5 KV "ansformer is a spare). Accordingly, operation with all three RSST's supplied from a single transformer is not a normal configuration necessitating extensive analysis. Therefore, calculations are not warranted to support the qualitative UFSAR statement.

3. Non-safety related loads are separated from the safety related power system by qualified isolation devices. These devices (typically safety-related load center or MCC breakers) protect the emergency bus from voltage degradation due to a fault on a non-safety related load. There are no non-safety related loads on the 4.16KV emergency buses for a DBA, therefore, the concern resides on the 480V buses and MCCs. At this voltage level,it can be shown that the EDG is capable of maintaining adequate voltage on the 4.16KV bus for a 480V fault not directly on the bus (see Conceptual Engineering Report, NP-2122A, " Load Center Circuit Breakers - North Anna Power Station", dated May 15, 1990) which was provided to the team.

Calculation EE-0394 "EDG Fault Current and Voltage" is being developed to formally document the EDG fault current / voltage response conclusion of the conceptual report. This calculation will be complete by April 30,1992.

By standard methodology, voltage at the location of a circuit fault is assumed to be zero. Therefore,480V bus voltage can be postulated to be severely reduced for non-safety (or safety) related 480V circuit faults until the fault is cleared regardless of the power source.

The finding implies that non-1E loads should be tripped in the event of an Si in accordance with Regulatory Guide 1.75, 1974. North Anna was not licensed or designed to this Regulatory Guide and does not meet all provisions of the Regulatory Guide.

, 4. See response to Finding 91-17-01. Calculation EE-0373 will be revised to j document more completely the justification for the existing setpoint margins.

Page 10 l

.h

5. This issue has been addressed in the latest revision to NDCM 3.7 " Calculations" and the implementation of the new Document Management Information System (DMIS). NDCM 3.7 was revised and issued on September 25,1931. It has several significant enhancer.1ents including the following: 1) a standardized method for formatting calculations; all engineering disciplines use a standard format. 2)a standardized and enhanced cover sheet and reference information sheets to facilitate data entry into DMIS; 3) provisions for a document relationship to be established for all references so that interrelationships will be maintained, tracked,.

and kept retrievable; 4) provisions for a standardized document status indicator with documented definitions for the various statuses. This calculation procedure has the requirement that the preparer document and assign a relationship to all design inputs and references used in the preparation of the calculation.

6. Assumption 5 states that the cable resistance from the battery to the distribution panel is negligible. The corresponding battery,1-1, is located above the control room, and the panel,1-EP-CB-12A, is located in the emergency switchgear room.

Based on review of the calculation, the battery to panel feed cable resistance is relatively low since the remaining circuit length (to the close coil) is several thousand feet in length compared to approximately 100 feet for the main battery feed. Because calculation EE-0012 " Control Circuit Voltage Analysis North Anna H Diesel Generator Breakers" concludes that operating voltage is marginal, assuming aged batteries, assumption 5 becomes important. However,it should be noted that the North Anna batteries are relatively new. Accordingly, no immediate concern exists. Calculation EE-0012 will be reviewed by February,1993, including the summary of results which provide recommendations for improvement, and appropriate actions will be initiated.

7. Engineering Work Request (EWR) 89 233 was an engineering study to evaluate possible modifications to the installed differential relay for the EDG, to which no-modifications have subsequently been made. The completed EWR is a draft conceptual engineering report and not a calculation at all. The intent was to investigate the differential relay instantaneous unit utilization only and not to address allitems enumerated by the NRC in this finding.

7.1 See response to finding 91-17-09.

7.2 See response to finding 91-17-09.

7.3 Loss of excitation relaying already exists on the EDGs. We willinvestigate the need for motoring (reverse power) relaying by February 1993.

The adequacy of negative sequence protection provided by existing voltage restraint overcurrent relaying was verified in the conceptual engineering report (NP-2122A) discussed in Section 3 of this finding response. The existing EDG protective relaying calculations will be revised by February,1993 to incorporate verification of negative sequence protection. See also section 9 of this finding response.

7.4 See response to Finding 91-17-09.

Page 11

7.5 The fault values are based on machine reactances. These values will be documented formally in Calculation EE 0394 "EDG Fault Current and Voltage," by April 30,1992 as stated in section 3 of this finding response.

7.6 See response to Finding 91-17-09.

8. See response to Finding 91-17-07.

9. The report, NP-2122A dated May 15, 1990, verified negative sequence fault protection using steady state current values and determined that protection in accordance with NEMA MG-1 " Motors and Generators" via the voltage restraint overcurrent relay,51V, was adequate. EDG protective relaying calculations will be revised in accordance with industry standards to include analysis of unbalanced faults. (See section 7.3 of this finding response for completion date).

10. Extrapolation of curves below the published values assisted in visualizing the coordination curves. It is clearly stated in the calculation that the information is an assumption and therefore, contrary to the NRC team's concern expressed during the EDSFI, this information should not mislead anyone. Based on the relay manufacturer's information, the relays will operate within approximately 105% of the minimum relay pick-up even though the published curve is nnt shown below 150%. See response to Finding 91-17-11. We believe that properly documented extrapolation of the manufacturer's curves is acceptable.

11. The use of the procedure and the supporting calculation were correct. The instrument technician used the term " bottom of the tank" for the tank drain centerline. Although this is confusing, the important point is that the fuel height and the pressure switch height were measured from the same datum. The effects of instrument drift and repeatability and fuel oil density range were not explicitly accounted for because they are much less than the required accuracy. These effects will be explicitly addressed in a new calculation, which will be issued by April 30,1992,

12. During a previous NRC SSOMI (February 1989) inspection, a concern (Unresolved item 50-338/89-200) was identified regarding miscoordination of the 4KV feeder breaker relays with the 480V load center main circuit breakers. Each 4KV feeder supplies two load center transformers such that this miscoordination may rasult in loss of both rather than a single transformer for a 480V load center bus fault. The miscoordination is clearly documented in North Anna's 10CFR50 Appendix R report. The two transformers in each case are associated with the same safety train. No concerns were identified during previous Appendix R-inspections. We believe that the miscoordination does not violate Appendix R, nor is it a significant enough concern to warrant modifications. However, we agreed to review the setpoints for the associated relays / trip devices.

The preliminary review performed and documented in a conceptual engineering report, NP-2122A, dated May- 15,1990, determined that the miscoordination could be corrected with setpoint changes. The NRC was informed of this conclusion. However, further review indicated that setpoint changes would not Page 12 l

l I ~_ ., ,_.

1 a

be sufficient, as documented in Addendum 1 to the report dated December 7, 1990. Again, we determined that the problem did not warrant additional investigation of modifications.

The results were discussed with the NRC team during the EDSFl and coordination curves associated with a draft calculation were provided. During this review, a branch circuit coordination problem was identified, as discussed in

section 12.7 of this finding response it wa

: agreed that no safety concern exists j due to these breaker miscoordinations because the consequences are bounded by the single failure criteria. Resolution of the entire issue was deferred until we i could complete associated calculations and provide proposed resolutions which are presently underway. (See section 12.7 of this finding response for schedule.)

a 12.1 This finding asserts that we improperly failed to include service factors for large motors. We did not and do not utilize such factors becauso we explicitly determine horsepower requirements of the motor-driven device.

i Calculation EE-0025 " North Anna Station Load List" provides the expected required brake horsepower for all large motors for both accident and non accident conditions. The calculated values do not typically indicate motor operation above nominal ratings requiring use of the service factors. Other calculations, such as the voltage profiles, EDG loading, and fault current analysis correctly utilized these values. For large motors, both rated HP and maximum expected running KVA based on calculation EE-0025 have been included.

i 12.2 A large number of starting power factors are excluded from calculation EE-0008 " North Anna Voltage Profiles" because the associated motors i never start in the analysis, in other cases, assumed power factors may have been utilized in lieu of retilevable values as stated in the finding.

The next revision will incorporate the as built data available. The short circuit calculations utilize as much motor data as is available. The calculation of record for as built motor data will be reviewed as part of the -

scheduled December 31,1993 revision to the voltage profile calculation.

The impact on the calculation results will be minimal.

12.3 See response to section 3 of Finding 91-17-23.

12.4 See response to Finding 91-17-08 for EDG. No other known problems

exist.

12.5 See response to section 1 of Finding 91-17-23.

12.6 See response to section 3 of Finding 19-17-23.

12.7 During the EDSFI, a review identified potential miscoordination between the 1E 4KV load center feeder breaker relays and several 480 volt branch circuit breakers. Though undesirable, it was agreed that no safety concern existed since the consequences are bounded by the single failure criteria. We agreed to further investigate this concern and l propose a solution.

Page 13

The EDS Self Assessment identified the lack of formal calculations documenting 480 volt relay protection and coordination. Calculations were in progress during the EDSFl. Calculation EE 0395 "SR 480V Load Center Coordination," has been issusd as a draft. Setpoint changes and modifications are being analyzed. Recommendations for corrective action, as appropriate will be issued by June 30,1992.

12.8 The finding asserts the possibility of degraded voltage for safety-related equipment below 480 volts. We performed a review during the EDSFI to identify the existence of safety related power supplies below 480 volts, excluding 125VDC,120VAC Vital buses, and 120VAC control power circuits. No such power supplies were identified and the NRC team was advised accordingly. Thus, calculation EE-0008 " North Anna Voltage Profiles" correctly analyzes only down to 480 volts.

13. Our review of Calculation EE 0009 (125Vdc System Analysis) indicates that the voltage drop for the cables between the battery and switchboard was taken into account. The concern expressed in this finding appears to correspond to calculation EE-0012 " Control Circuit Voltage Analysis North _ Anna H Diesel Generator Breakers" discussed in section 6 of this Finding response.

14. See responso to section 5 of Finding 91-17-23.

15&16. Calculation 14258.08-E-3, Rev. 0 (North Anna 1 and 2 Vital Bus Load Study) provides vital bus loading analysis for Normal, SI, and LOCA conditions and does not assume measured vital bus loading would be equal to accident loading.

However, the calculation indicates that accident and non-accident loadings are ,

similar. Calculations EE-0009 "125 VDC System Analysis" and EE-0057 "DC System Equipment Sizing" justified assuming that accident and non-accident loading are equivalent based on these results.- The NRC team was uncomfortable with this analysis because the calculated and measured non-accident values differ substantially. We are reevaluating this assumption for both EE-009 and EE-057. This calculational weakness was identified during the EDS Self Assessment and will be corrected by February,1993.

This issue is not a safety concern, but impacts the battery charger's capability to recharge the batteries within the UFSAR specified time. Since all of the batteries, except 2-IV, have been replaced, the duty cycle will not result in a total discharge for the next several years as would be expected near the end of battery life.

17. The finding is correct. The Unit 1 EDG batteries have been replaced and the Unit 2 EDG battery replacement is planned. A design basis calculation has been completed for the new batteries and existing chargers.

18. The finding is correct. We failed to update calculation 14258.79-E-2 "Short Circuit Currents - 125VDC - Appendix "R" Evaluation," to address batteries previously installed but have since been replaced with Exide 2GN-23 cells. This Appendix "R" evaluation will be analyzed by February 1993 to address the Exide 3

Page 14 l

batteries. We expect the difference to be small because of the significant cable resistance.

19. The EDG room HVAC calculation is being revised. The draft of this revision confirmed the technical adequacy of the current design. The revised calculation will be issued by June 1,1992. The technical review of the adequacy of the HVAC systems in the safety related pumphouses is scheduled to be completed by February 1993. We do not believe this to be a significant safety issue. For further information on our current assessment, see the response to Finding 91-17-16.

20. The following responses address this finding.

20.1 See response to section 1 of Finding 91-17-23.

20.2 See response to section 2 of Finding 91-17-23.

20.3 See response to section 3 of Finding 91-17-23.

20.4 Of the eight 1E load center transformers, one impedance value was determined to be in error in calculation EE-0008 " North Anna Voltage Profiles." An average value for that transformer had been utilized because as built data was unavailable. The as built data was later obtained but had not been incorporated. During the EDSFI, we determined that adequate voltage margin exists to alleviate immediate concern over the error. Calculation EE-0008 will be corrected in the next revision scheduled to be completed December 31,1993.

I 20.5 EE-0008 "Nonh Anna Voltage Profiles" does not currently consider all motor starts because in past analysis, the initial load block consisting of numerous motors starting has proven to be the most critical. Therefore, this calculation did not model or analyze some less severe motor starts.

This concern is more appropriate for limited power supplies such as the EDGs. For completeness, the next revision of-calculation EE-0008 (scheduled to be completed December 1993) will demonstrate all motor starts for at least a single case.

20.6 See response to Finding 91-17-08.

20.7 Calculation EE-0025 " North Anna Station Load List" includes all known-motor data for large~ motors. That calculation is the basis for others with regard to this type of information. When EE-0008 " North Anna Voltage Profiles" was developed, EE-0025 was in development. The fault current calculations do include information from motor data sheets. Starting power factors for motors are discussed in Finding 91-17-03, Section 12.2 (above). The next revision of EE-0008 (scheduled to be completed by December 1993) will include all known data for large motors. The impact will be minimal.

20.8 This issue is addressed in section 12.1 of this Finding response.

Page 15 l

21. A design basis calcula"on (SWEC calculation number 02070.1210-US(B)-272) has confirmed that t'.; expected differential pressure across the louvers during a design basis tornado is acceptable.

22. The Service Water pumps are not normally operated with the outlet valve closed.

By procedure (Operating Procedure 1-OP-49.1 " Service Water System Operation"), the valves are only closed when pumps are manually started or stopped, but the valves are then opened to ensure that the pump is operable for ESFAS automatic actuation. Calculation EE-0025 does not need to consider such short duration procedurally controlled transitional conditions in bus loading analysis.

The Component Cooling pumps have a nominal flow of 8000 gpm which equates to 435 BHP (345 KW). Under pump runout conditions (which is considered unlikely), the flow would be 11,000 gpm which equates to 500 BHP. During a Safety injection, the Component Cooling pumps remain running. Even if one of these pumps is at runout conditions, the increased load will not have any adverse impact on EDG loading, since this case is enveloped by the CDA case which l includes the Recirculation Spray and Quench Spray pumps while the CCW l pumps are stripped from the bus by the CDA signal.

I 4

f h

Page 16  :

3

FINDING 91-17-04: UFSAFi Deficiencies (paragraph 3.3)

DESCRIPTION: ,

There was no objective evidence that the licensee had evaluated the effects of the reduced voltage on the connected loads. The licenses provided an informal analysis, which addressed some of the low voltage conditions. However, the team determined . ,

that the deviation from the UFSAR commitment of minimum voltage should have been fully developed and properly documented in an analysis or calculation.

Section 9.5.4 of the UFSAR states that although compliance with ANSI H195 was not required, the EDG fuel oil system satisfies the requirements of ANSI N195-1976 with three exceptions.^ This statement was inaccurate as the items below are a additionalNorth Anna exceptions:

The fuel oil system piping and components shall be classified as Safety Class 3

[ requirements of ASME Section III Subsection ND (class 3)]

No interconnection with auxiliary boilers is allowed.

Seismic qualification of vent lines is required.

Flame arresters are to be provided on tank vent lines (the team considered the open overflow line as a day tank vent).

Provision shallbe made to make soundings of actual fuellevelby a dip stick.

One differential pressure indicator is required for the duplex strainer. This is provided to prevent overloading of the engine fuel filter.

The team found several discrepancies'between the UFSAR and FDG design-documentation, as summarized below.

.UFSAR oaae Discrecancy .

8.3 11 The description of containment recirculation cooling fan-Ioading'of the bus Iollowing a loss of power is incorrect.

The UFSAR did not reflect the design change DC 79-SBO.

8.3-19 The stated EDG rated load is incorrect.

9.5-47 The EDG jacket water cooling system is not capable of removing the required heat load at -105*F outside  ;

temperature. The design basis airinlet temperature of the  ;

radiator has been reduced from 105*F to 101*F. .

Page 17 -1

FINDING 91 t7 04: (continued)

UFSARoaae Discreonncy (continued) 9.S 48 Lube oil and Jacket water operating temperatures have been increased.

9.S 49 Pressure switch for low facket water pressure alarm is not consistent with the sotpoint document.

The Jacket water and lube oil temperature alarm setpoints are not consistent with the manufacturer's recommendations.

9.5 52 Air start system relief valv0 set pressures are incorrect.

9.S 54 Lube oil thermostat has been reset to a higher temperature.

9.5 56 Lube oil high and Icw temperature setpoints are not consistent with the setpoint document.

The high differentla! pressure alarm for the lube oil filter is 18 psid on 9.5 55,15 psid on 9.5 56a, and 13 psid on the actual calibration log for the instrument (ICP-P-t MI 2 Rev.

2 for Ot EG PS 609H). This parameter is blank in the station setpoint document.

9.S57 EDG room fan capacity is given as 50,000 cim. When in fact it is only 5000 cim.

9.5 58 There is no indicator on the chain to show the position of the EDG exhaust butterfly valve.

• The team found that, the UFSAR, states that there was no anrunciation in the control room for signals that could render the EDG incapabla of responding to an automatic start signal, i.e., Air Gtart ManualIsolation Valves closed. Cnntrol Room selector switch in ' Manual Local."

The UFSAR was in error, because the air start iso,ation valve was locked in the open position and an alarm has been installed in the control room for the selector switch.

SAFETY SIGNIFICANCE:

l Inadequate design and licensing documentation may prevent evaluation of design modifications.

Page 18

RESPONSE

This finding addresses three different issues.

A. Fuel Oll:

This item cites several additional exceptions, beyond those stated in Section 9.5.4 of the UFSAR, to the EDG fuel oil system being in full compliance with the requirements of ANSI N1951976

• Fuel Oil Systems for Standby Diesel Generators." We will review the system by July 31,1992, and submit a UFSAR change request, if appropriate, to accurately describe the EDG fuel oil system as it relates to compliance with the requirements of ANSI N1951976.

B. Discreoancies between UFSAR and EDG desion documentation:

UFSARoqqe Discrocancy 8.3 11 The UFSAR has been rev; sed to correct the description of containment recirculation cooling fan loading of the bus following a loss of power.

8.3 19 The UFSAR has been revised to entreet the EDG rated load.

9.5 47 thru 9.5 58 This item citos several discrepaneles between the UFSA.R and the EDG design documentation. We will review the specified case by February,1993 and submit a UFSAR change request to resolve the discrepaneles with the EDG design documentation if requirci No operability concerns exist.

C. Annunciation for conditions that would orevent an EDG start:

A UFSAR change is being processed to correct the statements that there is no annunciation in the control room for signals that could render the EDG incapable of responding to an automatic start signal,i.e., Air Start Manual isolation Valves closed, Control Room selector switch in

• Manual Local".

l Page 10 l

_ . _ . _ ~_ _ ___ __ . - _ __

FINDING 91 17 05: Procedures that were not Complete. (paragraph 2.2.4.1, 2.3.2)

DESCRIPTION:

The team identified that the Proventive Maintenance Procedure for RSST LTC did not provide detailed instructions for checking the voltage bandwidth and the procedures contained no acceptance criteria. The licensee indicated that the procedure would be revised.

The Icam noted that the acceptance criteria for protective relay settings for 4 kV safety related equipment could result in sf'Jrious relay trips. The criteria for protective relay settings for 4 kV safety related equipment allowed for a trip setting of 125 percent of motor fullload current. With the use of the full service factor value of 1.15 and a 10 percent overvoltage condition undesired relay tripping may occur.

The licensee indicated that a revision of the acceptance criteria would be initiated to provide suitable margin for relay trip settings.

The team noted that the testing of time overcurrent protective relays were performed by verifying only one point along the relay characteristic curve, without an acceptanca criteria that related back to the protection requirements.

When a relay was found out of tolerance, no specific direction was provided except for resetting the relay and retesting at the original test point. Therefore, after the resetting, the test did not include a chcck of at least two points along the relay characteristic curve. Also, no referenco was made to the required protection limit.

This may be used to establish corrective action relative to frequency of testing and/or relay inspection.

The team noted that the licensee testing practice for initial testing of relays included at least the checking of two points along the relay curve.

SAFETY SIGNIFICANCE:

Procedures should be complete to ensure that proper actions are taken to conduct surveillance.

RESPONSE

We have written and implemented procedures to provide detailed instructions for checking the voltage bandwidth and specifying acceptance criteria for the RSST LTC.

As noted by the NRC team during review of 4KV protective relaying calculations, the

, criteria for the minimum relay trip setting is 125 percent of motor full load current. This l criteria was identified as a concern based on possible use of the 1.15 service factor and a possible 10 percent undervoltage combining to cause an undesired relay trip.

The criteria used is consistent with that recommended in ANSI /IEEE 242-1986 (IEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems) and the EPRI Power Plant Reference Series for Station Protection.

Page 20 l

- - - - - - - _ - _ - _ . - - .-~

Based on a review daring the EDSFl of class 1E 4KV motors, no more than one motor per train had the potential to operate above 100 percent rated horsepower, and its relay trip setting exceeded 125 percent. Accordingly, no operability concern exists.

Additionally, it should be noted that the 4KV class 1E electrical distribution system is operated at or above 4160 volts, resulting in lower current d9 mand for 4000 volt (i 10 percent) rated motors.

The present trip setting of the 4KV protective relays was established based on the current transformer ratio and the relay tap setting. Therefore, the setting is incremental and not continuously adjustable. Based on the existing criteria, it would be rare that a trip setting could be established at the minimum 125 percent value. This is shown based on our review of calculations for North Anna class 1E motors where trip settings generally range from 130 to 150 percent of nominal rated current.

The criteria for 4KV protective relaying, including motors, is contained in our Circuit Calculations Methods Manual, procedure P 1 entitled '* Power Station Protective Relaying Guide." We ensure that relay settings meet the criteria specified in that procedure, with justified exceptions. We will revise the procedure by May 1,1992 to address the :oncern. There is-no plan to revise existing calculations to reflect the change in enteria since no concerns have been identified. As existing calculations are revised for other reasons the change will be reflected. Pending the procedure change, new calculations will reflect the latest methodology.

We have not incurred problems or mis operations due to lack of coordination resulting from the maintenance testing of only one point on the relay characteristic. We do however concur that testing two points does have the advantage of better verification of the ovact shapo and location of the relay characteristic.

We will initate a program to identify how to best select the second point on the characteristi to use for second point verification. This program will begin March 1, 1992. Relr.y manufacturers and other utilities that utilize this method will be contacted for input. Values will be verified in our lab to determine difficulty of testing, compatibility with existing t(st equipment, percentage of variation associated with the second point and other perti1ent data.

Once a method of identifying a second point has been determined, we will begin using the method to issue settings with the second test point as well as plus/minus values that will be acceptable. The plus/minus values will reflect variation that will not interfere with the coordination of upline devices. Relays associated with critical feeds, feeds associated with penetrations, and motors above 1500 HP will receive the two test point settings first with the remaining relays to follow as setting maintenance is performed.

The program to identify the method of selecting the second test point will be completed by March 1,1993. The settings for relays associated with critical feeds, feeds associated with penetrations, and motors above 1500 HP will be issued with two test points and plus/minus values within two years. These settings will be used for maintena .m testing during the refueling outage following the issue of the settings.

The remali ' settings will be issued with the second setpoint within five years. Those Page 21  !

1 relays will be tested utilizing the second test point during the refueling outage following the issue of the new settings.

l b

i I-I l

. Page 22 l

FINDING 91 17 06: Inadequate Supervision, Surveillance, and Analysis of the Automatic Fast Bus Transfer. (paragraph 2.2.5)

DESCRIPTION:

The team noted that the automatic fast bus transfer scheme was not supervised by synchronism check relays, no periodic testing was performed, and no analysis was performed of the transfer transient conditions.

The lack of a synchronism check relay could result in a fast transfer with sources out of synchronism to a degree that serious harm could be done to the connected motors and systems. The safety buses are not directly involved in the fast transfer, but they could be exposed to the effects ofit, since they are connected to the offsite source.

The lack of periodic testing of relays and breaker controls that are involved in the transfer scheme do not provide assurance that they will perform properly during a -

synchronism transfer.

The lack of an analysis of translent conditions, such as those existing after system faults, precludes the assurance of adequate operation of the transfer.

SAFETY SIGNIFICANCE:

The lack of adequate surve!Ilance/ testing / analysis of the fast bus transfer scheme could potentially subject the EDS (including safety related systems) to undue stresses which could precipitate failures andJeopardize safe plant shutdown.

RESPONSE

The blind fast transfer used at North Anna is the original design by Stone and Webster.

No test results are on file to show the performance of the fast transfer. However, in 1985 and 1986, two actual transfers were recorded, one on each North Anna unit. The data recorded during these transfers have been used to verify thrt the transfer takes place with' the limits specified by ANSI C50.41 1982-" Polyphase mduction Motors for Power Germating Stations".

Unit i station service buses are not routinely transferred because the generator breaker precludes the need. Transfer would occur only for the failure of the breaker or other electrical abnormalities. Should installation of the Unit 2 generator breaker be completed, the-need to transfer associated station service buses will be greatly reduced.

The fast transfer design at North- Anna is consistent with plants of its vintage.

6 Acceptability criteria for fast transfer designs have been the subject of NRC and utility discussion in recent years and overall guidance in this area is not well established.

We will develop a periodic test procedure to demonstrate that the transfer occurs as:

designed. The test will allow for either an actual functional test of the station service bus fast transfer scheme or analysis of recorded data from an actual transfer operation.

- Page 23

lnitial testing or analysis is proposed to occur prior to er during the 1993 refueling outages.

Page 24

FINDING 91-17 07: Inadequate 4.16 kV Safety Related Duses Short Circuit Cutront Rating. (paragraph 2.3.1)

DESCRIPTION:

The team noted that the 4.16 kV safety related breaker short circuit current interrupting rating was approximately 2.2 percent lower than the calculated short circuit fault current. The breaker rating should be higher than the calculated fault current.

It was also noted that the short circuit current calculations performed by Virginia Power for the 4.16 kV safety related buses contained assumptions that allowed for extrapolation of the motor current contribution beyond those values indicated in industry standards and contained errors for values of X/R ior several of the motors.

The licensee acknowledged these er~nts and performed a new computer calculation with revised values. The revised computer calculations showed no improvement.

SAFETY SIGNIFICANCE:

Tne lack of adequate short circuit current rating for the safety related 4.16 kV circuit could prevent the breakers from properly interrupting a fault. This could result in the loss of one safety related train.

RESPONSE

Calculation EE 0324, Rev.1 (4KV and 480V Emergency Switchgear and MCC Fault Currents) determines the available fault currents at the 4KV emergency switchgear buses and concludes that these currents are within the range of the circuit breakers' interrupting and momentary capabilities. The circuit breaker interrupting ratings are evaluated based on reduced motor contributions to fault currents. The reduced motor contributions result from time delays associated with auxiliary (HFA) relays above those normally factored into industry standards. The reduction inctors for motor contributions were determined using an extension of the methodology outlined in ANSI /IEEE standard C37.0101979 " Application Guide For AC High Voltage Circuit Breakers Rated On A Symmetrical Current Basis." This methodology was not accepted by the NRC team due to the fact that it is not specifically spelled out in ANSI /IEEE standard C37.0101979. This disallowance results in the calculated available fault current exceeding the circuit breaker nameplate rating by a maximum of 2.2%

Yve believe that the methodology used is justifiable and the breaker ratings are not exceeded. We are discussing the methodology with the appropriate IEEE working group members. Should the methodology not be confirmed, the 4KV motor contributions will be re-calculated using calculated reactance multiplying factors, as outlined in the ANSI /IEEE standard, based on motor time constants determined explicitly for the North Anna Power Station motors as was done in original design calculations. Calculation EE 0324 will be revised by October 31,1992, if necessary, to include the findings.

In the existing calculation, the motor contribution is calculated based on a total of 4.5 cycles breaker contact parting time. This parting time is conservative since a) the only timing published for the HFA relays is 5 Cycles and b) in house tests on a randomly l

Page 25 l

j I selected relay concluded that a minimum of 3 Cycles is required to operate the HFA ,

relay alone. We conservatively used 3 Cycles as the total relay delay time for the HFA '

relay and the overcurrent relay instantaneous unit and therefore obtained 1.5 Cycles (breaker time) + 3 Cycles (relay delay time) = 4.5 Cycles as the total contact parting time. Using the 4.5 cycles as total parting time results in a maximum calculated fault <

current 18% less than the circuit breaker name plate rating.

The error regarding motor X/R (reactance / resistance) values for numerous 4KV motors  !

resulted from misapplication of values extracted from the manufacturers data sheets.

Preliminary analysis performed during the EDSFl indicated that calculated fault currents are unaffected and correction can be deferred to the next revision of

calculation EE 0324 to be completed by October 31,1992.

l Page 26

Flt1Dit1G 91 17 08: Unanalyzed Condition of EDG Steady State LoadinglUnverifled EDG Transient Analysis Software. (paragraph 2.3.3.1, 2.3.3.2)

DESCRIPTION:

ThG team noted that the EDG ioading calculations, failed to analyze loading events which could potentially result in overloading the EDG. It was also determined that the EDG transient loading analysis was performed using unverified and unvalidated computer software.

The reasons for the potential EDG overloading concems relate to the fact that the loading calculations showed a very small margin relative to the rating of the EDG and the unanalyzed conditions for randomly connected loads to the EDG bus under accident mitigation events. The EDG loading calculation considered these random loads; however, they were assumed to be present at given time periods after the initiation of accident mitigation, while in fact, the accident initiation does not relate to the connection of the random loads. The connection of the random loads was related to the loss of offsite power. Should an accident occur after the random connection of these loads, the EDG may be overloaded.

Some of the randomly connected loads were non safety related. For example, loads associated with Ilw main turbine generator are automatically connected at various speed values as the turbine speed decays after a unit trip. Other loads, which were not required for accident mitigation, were considered to be manually connected at various time intervals after the initiation of accident mitigation. The calculation failed to consider the possibility of other randomly connected loads, which could occur prior to the accident, such as those essociated with systems which operate under the automatic control of pressure and temperature switches, such as HVAC equipment and air compressors.

The EDG transient loading analysis also failed to consider the condition of having to start the largest load (or otherwise the worst case load) when the EDG bus was fully loaded. The licensee indicated that they would perform the analysis when validation of the software for the computer analysis was completed.

SAFETY SIGNIFICANCE:

Lack of EDG capability to successfully start and accelerate accident loads or EDG overloading could impact safe plant shutdown.

{

Page 27

RESPONSE

Existing analysis includes the Design Basis Accident, a simultaneous LOCA and LOOP, as well as a LOOP after a LOCA. We de not have an analysis which models EDG loading for an accident occurring after a loss of offsite power. However, the Emergency Operating Procedures (EOPs) administretively limit EDG loading in this event. Furthermore, the Technical Specifications place the station in a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> LCO ,

during a loss of one (1) offsite power source and a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> LCO during a loss of both offsite power sources. The need to develop diesel loading calculations specifically for a DBA occurring after a loss of offsite power was identified during the April 1991 Electrical Distribution System Self Assessment conducted at North Anna. We will analyze this condition by February,1993, for enhancement to our design. ,

We have a preliminary calculation (to be finalized by October 31,1992) which ,

analyzes the condition of starting the largest load (charging pump) with the EDG fully loaded. The calculation was performed by the EDG vendor, Colt Industries, and the results indicate this condition is acceptable. The vendor used the same software to model the EDG that was used in our existinj calculation EE 0026 Revision 0 *EDG Voltage & Frequency Response."

Colt developed the computer model to represent the North Anna EDG model type and utilized significant in house data to confirm it. W6 agree that further verification 'o the installed EDGs is prudent. Data to validate this software model will be collected during the 1993 station outages so that the model can be validated for the installed North Anna EDGs.

Page 28

_ . _ . . . _ _ . - . . _ . _ _ . . _ . ~ . . _ . _ _ _ _ _ , , _ . . . - _ _.

1 l

l FINDING 91 17 09: EDG Electrical Protection. (paragraph 2.3.3.3)

DESCRIPTION:

The existing EDG electricalprotection included only voltage restraint overcurrent and differential protection. The overcurrent protection was set at over 200 percent generator full load current, therefore, providing practically no protection against overloads. The differential protection was implemented with an overcurrent relay, which may result in the likelihood of spurious tr'ps or the lack of desired tripping. The differential relay was set to trip with a time delay, which is highly detrimental to the need for providing fast tdpping on Internal faults. The licensee had been studying the possibility of connectir,g the instantaneous trip element, which is presently oypassed, however, the implementation of instantaneous trip may give rise to the possibility of spurious trips in case of current transformer saturation. The differential circuit accuracy calculations were provided to the team, but only general type critoria, applicable to bus differential schemes, andInconclusive data from IEEE Std. 446 was noted. Therefore, there was no objective evidence that the differential protection could perform as desired, since no formal current transformer (CT) accuracy calculations for the CT secondary burden conditions were available. The licensee Indicated that they were not presently re evaluating thu advisability of reconnecting the instantaneous trip on the difforentialprotection, but they may in the future.

In addition, the voltage restraint overcurrent protection scheme was not bypassed during an accident, which could cause spurious trips. The overcurrent protection trips the generator breaker but does not stop the engine. The licensee indicated that an estimated restoration time after a spurious trip of the EDG breaker was two minutes.

The team noted that the restoration time of two minutes may be too long, but the safety analysis should be reviewed to support this time period.

The team determined that the relay coordination curves were extrapolated beyond the manufacturer's published values. While the extrapolation was labelled " estimate", il portrayed an unsuppor;ed expectation of relay performance, which could lead to erroneous conclusions.

In addition, the EDG did not have any ground detection equipment. If a ground fault were to occur, during accident mitigating conditions, no knowledge of a possible electrical ground condition would be available to the operator. Since most electrical faults begin as ground faults, ground conditions should be detected. If a ground fault was allowed to continue, the entire system connected to the EDG bus could be subjected to possible severe overvoltages to ground, which could be as high as six to eight times phase voltage.

SAFETY SIGNIFICANCE:

The current protective features and the lack of ground detection may increase the risk of damage to the EDG during testing and when operating under accident conditions.

Page 29

RESPONSE

Per the Emergency Diesel Generator Sets Specification, NAS 155, the original design for the EDGs is based on Proposed IEEE Criteria for Diesei Power Generating Stations Draft 4A June 1970. The existing protective relaying for the EDGs meets the requirements of this standard, in fact, the differential overcurrent relay and the phase overcurrent relay with voltag' astraint are required to initiate a trip signal to the generator, anr: are not bypassed in automatic modo per the standard. The original design philosophy emphasized that the need for standby power during an accident condition outweighed the need to protect the EDG from damage or degradation.

The following discussion addresses each item specified in the finding:

1.

Overcurrent relav trio settino > 200 oercent oenerater full load current - This relay is designed to provide fault protection on the 4kv emergency bus and is not overload protection for the EDG. This relay does not trip the EDG but only trips the EDG output breaker. The overeurrent relay is set in accordance with IEEE STD 242 "lEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems" and EPRI guidance.

i

2. Differential overcurrent relav This was the relay typically utilized during the l time of the plant design and was specified it' IEEE DRAFT 4A referenced above.

This relay may respond slightly slower than a percent differential relay for internal faults. However, should this trip condition occur, the EDG will be l unavailable for a significar.t duration before the fault is located.

t 3.

Differential overcurrent relav CT saturation calediations - This is the only relaying on the cts and does not pose a burden problem. The CT saturation i

l issue was identified as a concern for properly setting the relay's instantaneous unit, which is not presently used.

4. Overcurrent relay byoassed is discussed above, the overcurrent relay is designed to provide fault protection. We are committed to Safety Guide 9

" Selection of Diesel Generator Set Capacity For Standby Power Supplies" issued March 10, 1971. This guide does not require redundant relays nor bypass of the trip. Additionally, this relay trips only the EDG breaker and not the EDG itself.

5.

Extranolation of Relav Cgym - For a discussion of this topic, see the response to Finding 91 17-11.

6. EDG oround detection We willinvestigate the addition of ground detection lights on the 4kV syMem by February 1993. It should be noted that the 4kv system is only ungcounded when only the EDGs are supplying the emergency buses, during which time elimination of a ground would be of a lesser concern than ensuring safety load operation. The Reserve Station Service Transformers serve as the normal source to the 4kv emergency buses and they are high resistance grounded.

Page 30

In summary, we believe the protective relaying scheme is appropriate for accident conditions when the EDG will be isolated from the system. Refer to our response to Finding 91 1710 for relaying when the EDG is in test conditions.

t l

l 1

l Page 31 l

i l

. . . . - . _ . , . _ _ . . . _ . . . . . . ~ . . _ _ _ _ . . ..,, . . _ ... .._ ._...___._ . _ . , . _ . . _ . . . . _ . . . . _ _ _ _- - . . , - .

FINDING 91 17-10: Potential for EDG Overloading and for Undesired Disabling of safety Signals when Paralleling the EDG with the Grid. (paragraph 2.3.3.3)

DESCRIPTION:

The team noted that the present EDG test approach included paralleling with the grid, which under certain conditions may lead to EDG overloading and disabling of safety signals.

When either EDG 1H or 2J are periodically tested, paralleling with the grid involves paralleling of the 1H and 2J safety buses, because these two buses are normally fed from the same RSST transformer C. Under these conditions, if the offsite source (transformer RSST C) fails, the EDG under test could be overloaded by the additional load of the opposite safety bus. In addition, the opposite bus EDG may not get a signal to automatically start, as required by the loss of offsite power.

The team found no objec:ive evidence of an analysis by the licensee for such a scenario. The team also found that there was no effective protection against the EDG potentihl overloading, since the voltage restraint overcurrent relay is set to trip at 230 percent of full bus voltage. The licensee provided an analysis that concluded that the potential for EDG overloading and starting signal disabling trad a small probability of occurrence.

SAFETY SIGNIFICANCE:

The potential overloading of the EDG under test conditions could result in disabling of ths

• 0 G.

flESPONSE:

The failure of RSST C was reviewed during the EDSFl and it was shown that this failure would result in the isolation of the emergency buses from the transfer bus.

Specifically, since the RSST load side breaker,15F1, is interlocked with the 34.5KV RSST C 1eeder breaker and with emergency bus feeder breakers 15F3 and 15F4, l

operation of either 15F1 or the 34.5KV RSST feeder breaker will result in the trip of both 15F3 and 15F4, isolating the 1E buses from the system and each other.

As re:ognized by the inspection team, the likelihood of losing offsite power while the EDG is paralleled to the grid is very remote. A probability risk assessment was done to estiniate the frequency of having a LOOP occur while an EDG is loaded to the system.

This estimated frequency is 1.24 x 10 3 events per calendar year. The potential for overloading the EDG when running parallel to the grid was identified during the April 1991- Electrical Distribution System Self Assessment conducted at North Anna. This situation will be evaluated by February 1994 and appropriate actions initiated.

For a discussion of the voltage restraint overcurrent relay setting, :afer to Response to Finding 91-17-09.

Page 32

FINDING 91 17-11: Inadequate RCP Motor Electrical Penetration Assembly Overload Protection / Surveillance.

(paragraph 2.3.4 and 2.4.2)

DESCRIPTION:

The team noted that the setting for continuous rating of the EPA overload relay for the RCPs could lead to EPA overloading.

The EPA rating under LOCA temperature conditions was 1070 Amps, with the associated relay protection set to pick up at 1200 Amps. The relay utilized was an induction overcurrent type. which can not be guaranteed to operate for current values of less than 1.5 times pick up sotting. As a result, the pick up setting had a minimum value of 168 percent of the EPA rating, affording no protection for RCP motor overloads.

In addition, the team determined that the EPA rating under normal operating conditions (at 40*C) was 1200 Amps, which resulted in a guaranteed minimum pickup of 150 percent over the EPA rating. The licenseo contacted the EPA manufacturer and obtained information that indicated the EPA could have a higher rating at 40*C in excess of 1500 Amps. No objective evidence of relevant testing to support the alleged uprating was provided. There was no indication provided of the possibility of an uprating at LOCA temperature conditions. The team concludod that if the RCP's were running, the EPAs may be damaged in the event of overloads induced in the RCP motor by the LOCA environment.

The surveillance period for RCP EPA protection was longer then typically recommendedin industry standards for the type of circuits involved. The licensee did not have any back up data to support the longer surveillance periods.

During the course of review of containment penetration protection for Unit 2, it was identified that penetration types IIB 1 and IIB-4 appeared marginally protected for the case of fullload continuous current on the penetrations. The licensee's response indicates that the manufacturer had subsequently performed and developed now thermal capability values for these penetrations. The licensee indicated that they would incorporate these new thermallimit curves in the protection analyses study for Unit 2.

SAFETY SIGNIFICANCE:

The integrity of the containment could be jeopardized due to failure of the electrical penetration assembly.

Page 33

)

~_____

4 l 1

i j

RESPONSE

Electrical penetration assembly protection for North Anna Power Station was l presented to the NRC during the licensing of Unit 2. This information was reviewed and approved by the NRC at that time. New test data from Conax, the electrical penetration assembly manufacturer, has recently been received and this data will be used to calculate continuous

• tings for all of our containment electrical penetrations at l North Anna by February,1E A test performed by Conax specifically for this type of l electrical penetration assen / (IPS 1393) resulted in the penetration being re rated to 1560 Amps for the 40 year life at a continuous temperature of 50'C. The relay  !

setting is 1200 amps, which is verified by test each refueling outage. RCPs are not utilized during a DBA LOCA, however, an evaluation of the impact of using the RCPs  :

3 during non DBA events will be performed by February,1994.  :

Conax report IPS 701 provides thermal capability curves for all electrical penetration assemblies based on feed through conductor size. This information is currently used for design changes which involve circults that may impact electrical penetrations. We t will incorporate these thermal limit curves in the protection analysis study for Unit 2 by -

February 1994.

It should be noted that during the Conax' testing which established the thermal capability curves (in IPS 701), seal integrity failure was defined as leakage in excess of 1 x E 6 standard cubic centimeters per second of helium through the inner O ring seal, with a_ differential pressure of 75 psig. This restrictive acceptance criterion serves  ;

to ensure that the outer O ring seal, and thus the containment integrity, would remain t intact. For example, this size of a leak would require over:10 days to pass one see through the inner 0 ring sealinto the cavity between the seals. The North Anna ESF systems are designed to return the containment to subatmospheric pressure within one hour after the initiation of a DBA event. The maximum calculated peak pressure during the event is approximately 45 psig. ,

Surveillance periods for RCP electrical penetration relay protection are based on-refueling cycles. As we told the EDSFl team, General Electric, the relay manufacturer, i provided a letter stating "...it is suggested that the points listed under acceptance test be checked at an interval of from one to two years " Since our refueling cycle is 18 months, this interval is appropriate.

The NRC team's contention that the guaranteed minimum relay pickup is 150% of the relay setpoint does not apply to our overcurrent relays. The manufacturer (GE) states that the relays " pick up at tap value 15% of tap value." Periodic testing verifies that these relays consistently pick up at the tap setting. No operability issues have been identified to date. We will address potential operability' issues by the problem reporting system as the review progresses.

Page 34 t

r -~.-w r- e , e , eve-w ,w m- --. re-,----,--r,-o,-----,---. . a nn-r w----- -v - , n w e - un.-,-,,m e,e m e-,. m n-mnw ,, r~ - - - - ,- , - ---w -.~,,s w w- o n- w

FINDING 91 17-12: Tap Settings on the 4.16 kV 480 V Load Center Transformers Unit 2. (paragraph 2.4.1)

DESCRIPTION:

During the course of the team's review of voltage profile calculation EE 0008, Rev. O, the inspector inquired if the tap setting for the load centers, as specified in the calculation, correspond to the present plant condition. The licensee identified that the laps were not set as delineated by the voltage analysis calculation. A deviation report was initiated and an operability evaluation performed by the licensee.

The results of the evaluation indicated that the voltages would be adequate if some compensatory action were taken. The compensatory actlon identified was to not use the bus tie breakers. They could not use the existing voltage profiles for 480V until the next outage when the transformer tap settings could be changed.

SAFE 7Y SIGNIFICANCE:

Voltages at required safety related equiparent may be B 12 volts less than analyzed, in some cases, analyzed voltages are already less than minimum required,-as indicatedin calculation EE 0008, Rev.1.

RESPONSE

As indicated above, the tap settings on the Unit 2 4.16 kV - 480 V load center transformers were not set as specified in voltage profile calculations. As a result, an

, evaluation was performed and it was determined that the voltages would be adequate as long as the tie breakers were not used. Administrative controls were implemented to prevent the use of the tie breakers until the tap settings could be changed. The changes to the tap settings have been scheduled into the Unit 2 outage schedule.

Currently, the Unit 2 outage is scheduled to begin in February 1992. Tap setting changes will be made prior to startup from the Unit 21992 refueling outage. As discussed in Finding response 91-17 23, the lower than required voltages existing prior to identifying the transformer tap error have been analyzed. The review verified the operabi'ity of safe shutdown equipment.

Page 35

FINDING 91-17-13: Elimination of Grounds from DC Systems. (paragraph 2,6)

DESCRIPTION:

There were three things identified during the review of the licensee approach to dealing with electrical grounds on the dc systems: 1) the ground detector used illuminated lights to determine the presence of a ground, however, this method was not quantitative as to the magnitude of the ground, 2) the light circuit reduced the ungrounded system design to a partially grounded system, (2100 ohms to ground) which had been discussed in NRC Information Notice 88 86 and supplement 1 thereto, and 3) if a ground were identified on the dc system it was not clear that its effect on the operability of the system would be evaluated. DC systems are designed as ungrounded systems for enhanced system reliability (i.e., two specifically located faults are needed before system / component performance would be effected). The

' ground detection system was always energized on the dc system. If a single ground fault occurs, the ungrounded system becomes, in effect, a grounded system, thus negating a design objective. The UFSAR for North Anna indicates that the dc systems are ungrounded.

SAFETY SIGNIFICANCE:

Operation of an ungrounded DC system with a ground is a reduction in the fault tolerance of the design, which could lead to unpredictable system / component I operation.

RESPONSE

We reviewed NRC Information Notice 88 86, including Supplemerd 1, and prepared

• Surry and North Anna DC Ground Detection" Technical Report No. EE 000, Rev.0 dated 6 29 90. The concerns presented in IN 88-86 are largely addressed in the Technical Report, which was rev 9wed with the team during the inspection. The report recommended enhancements to the North Anna DC ground detection systems to meet the intent of the Information Notice. The specifics for implementing those recommendations have not been fully identified and further study is required. This study will be initiated in 1992.

Page 36

FINDING 91-17 14: Maintenance Engineering EDG Experience.

(paragraph 3.2)

DESCRIPTION:

The team reviewed the design, testing, maintenance, operation and performance of the dieselgenerators and their support systems. The licensee had taken extra steps to monitor the condition of the diesels by installing a solid state data acquisition system.

This system is installed presently on one EDG. The monitoring system could be used to diagnose current symptoms and to provide historical data for trending a wide range of EDG operating paramcters. Maintenance engineering demonstrated a strong working knowledge of the EDGs. The team considered this strength to be reficcted in the high reliability of the dieselgenerators.

SAFETY SIGNIFICANCE:

High level of knowledge related to EDGs and increased diagnostic capability improves EDG reliability.

RESPONSE

Response not required.

Page 37

FINDING 91-17 15: Maximum Ambient Temperature for Continuous EDG Operation. (paragraph 3.2)

DESCRIPTION:

The purchasing specification, NAS ISS, required that the Jiesel generators be capable of operating in an ambient air temperature of 120*F. This is confirmed by the supplier in section 36 of the specification, Design Data by Seller. Section 16 of this specification however, states that the engine cooling system is to be designed for outdoor temperatures between 93*F and 12*F. Section 9.5.5.2 of the UFSAR states that the cooling system dissipates the heat generated at rated load for ambient temperatures up to 105*F. A design change was made in 1979 to alter the radiator fan blade pitch to increase cooling flow. The Colt report states that the normal maximum operating temperatures, lube oil out of engine 215cF, jccket water out of engine 185cF, air from after cooler 145*F, can be maintained with a radiator inlet air temperature of 101*F, and that special short term tcmperatures (up to 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />),

tube oil out of engine 223*F, Jacket water out of engine 193*F, air from after cooler 153'F, can be maintained with a radiator inlet temperature of 110*F.

The licensee agreed to review the design documentation (design basis document, procedures, UFSAR, etc.) and include the limitation on operating times with air temperatures at the radiator inlet in excess of 101*F. The licensee agreed that the outdoor temperature limitations for EDG operation at 3000 Kw must also account for the temperature rise across the EDG toom before reaching the radiator (typically 10 to -

30 percent of the radiator heat load). The licensee will generato documentation to support a more representative value that will be used to determine the maximum allowable outside temperature for operation at the continuous and 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> ratings.

SAFETY SIGNIFICANCE:

The EDG may be required to provide emergency power with outdoor temperatures in the range of 100*F. Limitations on the length of EDG operating time may be applicable under these conditions. These limitations were not noted in design documentation or operating procedures.

Page 38 )

i 1

1 I

I i

! HESPONSE:

We will perform an analysis or test to determine the temperature rise across the EDG rooms to the radiator during EDG operation by February,1993. Following completion s of this activity, we will revise the appropriate design documentation and operating procedures to reflect any ambient temperature based limitations upon EDG operation, 1 if required. This is not considered to be an operability issue.

L l

l Page 39

. . - . .,_;_. _, __ , _ _ _ , c_ .,. - - . . , . . _ . _ . . . _ . _ . _ . . - , . . , _ . . . . _ _ , _ , . , , _. ___.

FINDING 91-17-16: EDG High Temperature Alarms above Vendor Recommended Values. (paragraph 3.2)

DESCRIPTION:

The high temperature alarm setpoints for the Jacket water and lube oil, exceeded the manufacturer's maximum allowable limits for normal operation (185cF and 2tScF respectively), and also exceeded the short term limits. A review of the last calibration log for the temperature switches confirmed that the instruments were 3ing set in accordance with the station setpoint document: 195'F alarm, 205'F shutdown for Jacket water and 225*F alarm, 230'F shutdown for tube oil. The alarms do not provide the manufacturer's intended protection for the EDG. The licensee stated they would review these setpoints and consider an allowance for instrument error in selecting revised setpoints.

SAFETY SIGNIFICANCE:

The current alarm setpoints do not provide protection for the EDG in accordance with the manufacturer's recommendations.

RESPONSE

This finding asserts that the current alarm setpoints do not provide protection for the EDG in accordance with the manufacturer's recommendations. We have verified that the current setpoints aro the appropriate setpoints for EDG jacket cooling water and tube oil high temperature alarms.

Presently, several documents including the SDBD, UFSAR, NAPS setpoint document, and information developed during the EDS self assessment give inconsistent maximum engine parameters for jacket coolant and lube oil temperature.

Based on review of the above mentioned documents, the information contained in EWR #81316, and the manufacturer's shop test report, it is concluded that the present setpoints for: (1) Jacket coolant temperature alarm and shutdown trip setpoints, and (2) lube oil temperature high alarm and temperature shutdown trip setpoint are correct.

The setpoints recommended in the shop test report are as follows:

1. High Jacket coolant temperature alarm. Set normally open contacts to close at 195 F on increasing temperature and re open at 190 F cn decreasing temperature. Actual setpoint is 195 F and reset is 185 F.

2. High Jacket coolant temperature simultaneous shut down and alarm switch.

Set normally open contacts to close at 205*F on increasing temperature and re open at 200 F on decreasing temperature. Actual setpoint is 205 F and reset is 195 F.

3. High lube oil temperature alarm switch. Set normally open contacts to close on increasing temperature at 225 F and re-open at 220 F. Actual setpoint is 225 F and reset is 215 F.

Page 40

4. High lube oil temperature shut down switch. Set normally open contacts to close on increasing temperature at 230 F and re open on decreasing temperature at 225'F. Actual setpoint is 230 F and reset is 220'F.

An internal memorandum written in 1979 did not reference the manufacturer's shop test report which recommended the present setpoints for lube oil and jacket coolant temperature trips and alarms. The concern with high Jacket coolant water temperature is the potential for " leakage of the seal which Ir between the lower cylinder block and the cylinder liner associated with elevated cuolant temperatures". The practical limit for coolant temperature to prevent seal leakage is in the range of 193'F 207*F.

In addition, experience has shown that when the diesel generators (EDG) are in operation the ambient air temperature is approximately equal to the diesel room temperature due to the high cooling air flow into the EDG's room. While a 4'F temperature rise has been quoted for air entering the inlet of the radiator, there is no calculational basis for this value. If a 4'F rise were to occur the resulting diesel rating is bounded by the short term (18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />) rating of 110 F since maximum radiator. Inlet operating temperature is expected to be about 100.75'F. This is based on a maximum observed arnblent temperature of 100.75'F at NAPS from 19741991.

It is established that the current setpoints are adequate based on the above mentioned documents. The ambient temperature limit for the EDG's 3000 KW,2000 hr. rating is for a diesel inlet radiator temperature of 101 F or lower. The short term limits for higher radiator intet air temperatures (from 101'F to 110 F) are consistent with the information provided by the EDG manufacturer and based on his test results to specifically determine high radiator inlet temperature operating limb.

The remaining actions required to resolve this issue are as follows:

We will measure the actual temperature rise across the diesel generator room during a scheduled surveillance EDG run. This will permit the confirmation of the maximum expected inlet air temperature to the radiator.

Based on this information, we will update all relevant station documentation to reflect the current setpoint values which have been established to be correct.

We will also update any relevant station documentation to reflect the results of the test measuring the air temperature rise from the inlet to the diesel room to the inlet to the radiator. Any potential operating limits for the EDG based on the ambient air temperatures relationship to the inlet temperature to the radiator will be noted in appropriate station documentation.

These remaining actions will be completed by October 30,1992.

Page 41

. . - . . - . - -.. - ~ , . . . ., , .-

FINDING 91 17-17: Biological Growth in Fuel 011.

(paragraph 3.3)

DESCRIPTION:

Deviation Report 89-726 identified biological growth in a fuel oil sample taken underground tank. As corrective action to this DR, procedures were to be rev the purchase specification was to include a blacide requirement.

fuel oil tanker truck before unloading fuel to the abo Procedure 1-OP 53.3, which provides instructions for filling the above .

tank, does not refer to the procedure for chemical addition. The station statt wa the impression that the purchase order for the fuel had been updated to inclu requirement for biocide included on the purchase order. to be added to the fuel oil by the vendor; however, this The licensee stated they would revise the purchase order to require:

The vendor growth, to provide fuel oil which provides protection against microbial shippers bill of material to clearly identify that this biocide is included in th requirements of the purchase order are satisfied. vendor to ana the shipper's bill of material, that the fuel oil has bee ,

treated, then to contact the Chemistry Department forperformance of 1 CP-OP 2 -

SAFETY SIGNIFICANCE:

Biological growth could compromise fuel capacity and EDG performance.

RESPONSE

Due to a misunderstanding between North Anna and Fuel Procurement pe ,

time that the inhibitor was not being added to the fue sampled both the above ground and underground fuel oil tanks on a periodic b addition, in 1989, the underground storage tanks were cleaned.

Since the growth. Also, beginning in January 1992, fuel oil shipm inhibitor to control biological growth.

Operating procedure 1-OP-53.3, Above Ground Fuel Oil Storage and Tra has been torevised been added to verify on the bill of material that Microbial Growth inhibi the fuel oil.

Department is contacted for performance of chemistry procedur Chemical Addition to Fuel Oil Tanks. ,

Page 42

FINDING 91-17 18: Solsmic issues (p::rkgraph 3.0)

DESCRIPTION:

Seismic Class 2 Over 1 examples The team identified examples in which non qualified structures in the EDG and battery rooms could impact safety related EDS equipment. The following examples were identified.

Battery Rooms:

Light fixtures above batteries could fall on battery terminals causing short circuit (especially room 2 4).

EDG Rooms: \

I Overhead light fixtures impacting, day tank level switches, air start tank relief i valves and pressure gauges, control panels, batteries, steam piping and space heaters.

The licensee indicated that all 2/t seismic interaction issues would be addressed as pat of a plant wide assessment as a commitment to the NRC as part of NRC Generic Letter 87-02 response. The licensee was awaiting approval of the procedure before embarking on the plant wide evaluation. The licensee has committed to complete this evaluation within two refueling outages after approval was received. The licensee confirmed that the concerns raised by the team would be addressed in the evaluation.

Seismic Qualification of Buried Fuel Oil Piping The UFSAR and the system flow 5heets indicate that the bur,'&d fuel lines between the underground storage tank and the EDG rooms were seismically qualified. No calculations for seismically induced loads had been performed for these lines. The licensee demonstrated that the lines could withstand the site design basis earthquake.

SAFETY SIGNIFICANCE:

These structures could potentially impact the function of safety related EDS equipment.

Page 43

RESPONSE

Seismic adequacy of the EDG auxiliary fuel oil pump and lube oil pump control panels was identified as item number 170 of the self assessment. We are in the process of performing a walkdown and an evaluation of these control panels in accordance with SOUG criteria. This evaluation, which is scheduled for completion February 28,1992, addresses the class 2 over class 1 interaction issues for the control panels. The remaining 2 over 1 seismic interaction issues will be addressed as part of a plant wide assessment we committed to in response to Generic Letter 87-02.

Calculation CE 0886 was prepared and issued to document the seismic qualification of the buried EDG fuel oillines.

7 6

Page 44

FINDING 91-17-19: Fallure to implement or Adequately Establish Calibration and Testing Procedures to Verify Compilance with T.S. (paragraphs 4.3.1, 4.3.2 and 4.3.5) Idsntified as a Potential Violation.

DESCRIPTION:

Procedures for T.S. required testing and calibration were inadequately established in that: procedures utilized for response time testing of the undervoltage circuit tested the 74 percent undervoltage relay versus the required 72 percent undervoltage relay, procedures used for the calibration of the loss of voltage relry time delay specified 2.0 seconds versus the 2.210.03 seconds specified in T.S. and the procedures utilized for calibration of the degraded voltage relay time delay had not established an '

acceptance band consistent with the T.S. required tolerance of13.0 seconds. The procedure forperforming fuse resistance testing was not implemented. The procedure l

was identified as completed satisfactorily even though five fuses had resistance values outside the acceptance critoria. l REQUIREMENT:

T.S. 6.8.1.c requires in part that procedures be established and implemented for surveillance and test activities of safety related equipment.

SAFE 7Y SIGNIFICANCE:

The safety significance of the values not being within the limitations established by Technical Specifications was minimal. The actual "as found" settings were either

\

conservative or did not deviate significantly from the required values.

RESPONSE

Our letter dated January 16,199P provided the response to the Notice of Violation.

i Corrective actions taken are delineated in that response.

l l

l l

Page 45

FINDING 91-17 20: Failure to Follow Procedure (paragraph 4.3.3)

Identified as a Potential Violation.

DESCRIPTION:

Virginia Power Administrative Procedure VPAP-1501, Station Deviation Reports, states that a Deviation Report is required for any conditions that exceed TS allowable values. The team identified as found settings on Emergency Diesel Load Sequencing Tests (PT 83.3) which were outside the TS specified tolerances. Since deviation reports were not issued, this conflicts with the licensee progran, for identification and processing of pl ant deficiencies.

REQUIREMENT:

to CFR 50, Appendix B, Criterion 5, requires activities affecting quality be prescribed by documented procedures and shall be accomplished in accordance with these procedures.

SAFE TY SIGNIFICANCE:

Failuru to follow the appropriate procedure for station deviation reports compromises the haensee's capalaility to determine operability impact of identified deficiencies, accomplish root cause analysis, address potential generic concerns, provide trending, and assess reportability.

RESPONSE

Our letter dated January 16,1992 provided the response to the Notice of Violation.

Corrective aw taken are delineated in that response.

l l

l l

l l

Page 46

1 FINDING 91 17-21:-  : allure to Promptly Correct or Evaluate Conditions Adverse to Quality identified in EDG l.oad Sequencing Timer Tests. . (paragraph 4.3.3.1)

Identitled as a Potential Violation.

DESCRIPTION:

A Station Deviation Report (89-1586) was written to document emergency dieselload sequencing timer setpoints being outside TS allowed values. This Deviation Report was closed without adequately evaluating the cause of the timer drift or providing corrective action to prevent recurrence. This has resulted in continued instances of these timer setpoints drifting outside of their TS allowed values over the 18 month period between tests.

REQUIREMENT:

10 CFR 50, Appendix B, Criterion 16 requires for significant conditions adverse to quality, measures shall be taken to assure that the cause of the condition is determined and corrective action taken to preclude recurrence.

i SAFETY SIGNIFICANCE:

I i Timer drift can degrade the load sequencing function such that the EDGs may not be able to perform their intended function. For the period 1987 to 1991, the timer drift was subsequently evaluated and determined to be such that the EDGs safety function was not adversely affected.

RESPONSE

Our letter dated January 16,1992 provided the response to the Notice of Violation.

Corrective actions taken are delineated in this response . We will evaluate long term recommendations to resolve the timer concerns by February,1993.

1 L

Page 47

l FINDING 91-17 22: Identification of Equipment Prior to Exceedirig Service Life. (paragraph 4.3.6)

DESCRIPTION:

P On March 5,1991, the feeder breaker for a service water isolation valve was discovered inoperable. The subsequent Cause Determination Evaluation determined ,

that this breaker had exceeded its service life. From a review of this item, it appears

. that thero is not a program to identity circuit breakers prior to exceeding their service life.

SAFE 1Y SIGNIFICANCE:

d Failure to identify and replace a safety related circuit breaker prior to it exceeding its service life could result in the breaker being unable to perform its intended function.

RESPONSE

North Anna does not have a program in place to identify and replace circuit breakers prior to exceeding their service life. However, a program is being developed to track and trend breaker history for normally energized breakers and breakers that are important to safety. Data entered into the data base will be gathered from data sheets that will be included in breaker maintenance procedures. The condition of the breaker and its service life history will be entered into the data base following corrective or preventive maintenance. We have determined that exceeding the service life did not cause the breaker failure and a wholesale changeout of breakers is not warranted.

The trending program for circuit breakers will be implemented by April 30,1992.

Page 48

FillDING 91-17-23: Improperly Sized Equipment and Less Than Required Applied Voltage. (paragraph 2.4.1, 2.5.2, 2.5.3)

DESCRIPTION:

The team noted that the following equipment may not be properly sized at have adequate voltage.

1. The calculated voltage for 480V MCCs for both starting and running casec was less than minimum required voltage for attached loads.

2. The calculated short circuit ratings for some class 1E molded case circuit breakers exceeded theh breaker ratings.

3. Calculated loads at MCCs would exceed their bus ratings under design basis accident conditions.

4. Calculations showed that for fullload conditions of the vital bus inverters the 125 vdc battery chargers would be undersized.

5. Calculations incorrectly concluded the vital bus inverters were adequate to operate with an input voltage as low as 101 vdc. The vendor rates this equipment for a minimum operating voltage of 105V and states that further testing would be necessary to conclude that the equipment is capable of operation at 101V.

Details of these issues appear in Finding 91-17-03.

SAFETY SIGNIFICANCE:

Improperly sized equipment or less than required applied voltages may prevent safety related equipment from operating properly.

RESPONSE

1. The calculation EE-0008 (North Anna Voltage Profiles) summary sheet shows calculated voltages available at each 480 Volt MCC for both normal and accident conditions. The value for the minimum required running voltage for a given MCC that is listed on the summary sheet is the highest of the minimum running voltage requirements for any of the loads on that MCC regardless of function. This voltage requirement is a function of both the minimum voltage requirement for that particular load and the voltage drop in the cable from the MCC to that load. A load that is the most remote from the MCC is typically, though not necessarily, the load with the most restrictive running voltage requirement of all the loads on that MCC.

For sorne MCC's, the minimum running voltage requirement for the most restrictive MCC individual load, which is the value listed on the calculation summary sheet for the MCC, is greater than the available voltage listed on the summary sheet for that MCC. In these cases, we have evaluated the specific critical loads on the particular MCC (e.g., motors and MOV's that are required to operate automatically upon ESF actuation conditions) and have determined that adequate voltage would be available to operate those loads.

Page 49

in some cases, the minimum MCC starting voltage requirement for the most restrictive ESF actuated Motor Operated Valve (MOV) exceeds the available voltage listed on the summary sheet immediately following the ESF signal. In each case, adequate voltage will be available within 5 seconds. This situation has existed since development of the original GDC-17 analysis and has been analyzed and deemed acceptable.

These apparent calculation conclusion deficiencies that were identified by the NRC team had been previously reviewed and analyzed when the calculation was originally issued in 1989. Several of the most remote MCCs, such as those in the Service Water Valve House, were additionally analyzed in 1991 in Calculation EE-0373 (undervoltage, degraded voltage relay setpoints) for adequate voltage during degraded voltage conditions.

The System Design Bas!s Document for the Emergency Power System also identified similar calculation deficiencies. It has determined that no operability concern exists, however the existing explanation could be supplemented and clarified.

We now perform our own GDC 17 analysis (Calculation EE-0008). Previous analysis was performed by A/E's. Accordingly, the magnitude of the task almost certainly had the potential for documentation questions.

The additional explanation required to clarify these issues will be incorporated in the next revision of calculation EE 0008, which is scheduled to be completed by December 1993. Needs for enhancement of the voltage profile calculation were identified during the EDS Self Assessment and the work was deferred to the scheduled revision.

2. Deviation Report 89-1439 and JCO #89-17, originated in July 1989, address the potential for overdutied'480V class 1E molded case circuit breakers. Subsequent to the initial Deviation Report, calculations for both the 1E and non 1E systems were initiated to ensure that the entire scope of the concern could be determined.

Those calculations have now been completed. Original design calculations identify maximum fault current values similar to those recently found, but the assumed higher circuit breaker interrupting ratings can not be verified. This issue '

is addressed in the self assessment report with resolution provided by an ongoing project. The Emergency Power System Design Basis Document identifies this concern as an open item. Testing of these breakers is being performed to evaluate their acceptability under fault conditiens. The testing and evaluation will be completed by August 1992.

3. The issue of accident loading on MCC's 1J1-1 and 2J1-1 was previously identified in SDBD-NAPS EP. A reevaluation of the accident loading on MCC's 1J1-1 and-2J1-1 was performed. The MCC loading originally calculated in the North Anna Station Electrical Load List indicated that the bus rating would be exceeded under accident conditions. For the reevaluation, more refined loading of i MCC's 1J1-1 and 2J1-1 was utilized, and the results indicated that the MCC bus ratings would not be exceeded under accident conditions. The Station Electrical l Page 50 l

Load List (Calculation EE-025) will be updated by February 1993 to document this conclusion.

4. The issue of battery charger sizing was addressed in response to section 16 of finding 91-17-03.

I

5. The issue of inverter operability at reduced de voltages was identified during the Electrical Distribution System Self Assessment which was performed in April, 1991. It should be noted that this is not an immediate operability concern since the batteries are relatively new, operation is at less than full load, and the present duty cycle will not discharge the new batteries to 105V.

To resolve the issue of inverter operability at reduced dc input voltage, an actual test of the inverter is proposed for the 1993 refueling outages. The necessary parameters will be measured, and this test will be used to verify inverter operability at 101 Vdc input as recommended by the manufacturer.

Page 51

_ _ - _ _