IR 05000373/1988016

Insp Repts 50-373/88-16 & 50-374/88-16 on 880627-0722. Violations Noted.Major Areas Inspected:Risk Significant Aspects of Plant Operation

ML20154C578
Person / Time
Site:	LaSalle
Issue date:	09/07/1988
From:	Bjorgen J, Bongiovanni A, Hasse R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20154C561	List: IR 05000373/1988016 ML20154C557 ML20154C569
References
50-373-88-16, 50-374-88-16, NUDOCS 8809140417
Download: ML20154C578 (23)

Text

,

.

' '

.

,

U.S. NUCLEAR REGULATORY COMISSION

REGION III

Reports No. 50-373/88016(DRS); 50-374/88015(DRS)

Docket Nos. 50-373; 50-374 Licenses No. NPF-11; NPF-18 Licensee: Comonwealth Edison Company P. O. Box 767 Chicago, IL 60690 Facility Name: LaSalle County Station, Units 1 and 2 Inspection At: LaSalle Site, Marseilles, Illinois Inpsection Conducted: June 27 through July 22, 1988 Inspectors: R s d 9fbf Date ( #

J. C. B or en

/ /o 7/ 7/ 80

/ /

Date GM Resqwa_n$u A. M. Bongiovanni 9fb f N f Date

/ [h 6 /&s 9 2l00

/ (,,0.Y . H

< Dat6 /

$1f,4w L F. A. Maura 9 7"ff i . escheske OY Date

~

l Va el

! Date l

Accompanying Personnel: J. M. Chung, NRR, USNRC i

'

O. M. Rasmuson, RES, USNRC i i

8009140417 880909

! PDR ADOCK 05000373 o PDC i, 1 i

!

-- ___ _

___.___.._._____.__.___._,_.__-_,____._______...___.._,_______'

-

.

Q LOP ct -

Approved By( M. P. Phillips, Chief Operational Program Section 7h/[

Date Inspection Suninary Inspection on June 27 through July 22,1988 (Reports No. 50-373/88016(DRS);

No. 50-374/88015(DRS))

Areas Inspected _: Special announced inspection of risk significant aspects of plant operation as identified in the LaSalle Probabilistic Risk Assessment (PRA) currently being performed. This inspection utilized portions of inspection modules 41701, 71707, 42700, 61700, 61726, 62705, 62702, 62703, 62704, and 7171 Results: Two violations were identified during this inspection:

The LaSalle Station was notified in 1984 by both the Station Nuclear Engineering Department of industry problems with Potter-Brumfield relays used in the closing circuits of the output breakers for Diese's Generators

"O," "1A" and."2A." The station failed to take corrective action until three failures of these relays occurred at LaSalle in 1987. This failure to take prompt corrective action was particularl because of the c mmon mode failure implicationParagraph (y safety significant 3.d.(3)).

Due to an inadequate procedure for tracking the number of failures of the Unit 1 diesel generators to start during surveillance tests, the Technical Specification testing frequency was not maintained (Paragraph 3.f.(4)).

The inspectors also identified other concerns during the inspection:

The corrective maintenance level appeared-to be high for the instrument air and drywell pneumatic systems, indicating poor reliability. Further, the gas streams produced by these systems were not being monitored for particulate or oil content (Paragraph 3.a.(2)(b)).

'

Other concerns with the diesel generators included the poor reliability of the air start systems and the potential lack of insulation of the diesel from the generator (Paragraph 3.f.1)).

• The failure to perform a root cause analysis of the failure of an under-voltage relay in the 242Y bus system, precluding the determination of implications for other similar relays in the plant (Paragraph 3.d.(2)).

Although overall training and qualifications of the staff appeared to be good, several specific concerns were identified: (1) The operating crew did not follow the emergency operating procedure exactly during the simulation of a severe accident sequence; (2) not all licensed operators interv ewed were aware of ths need to reset the RCIC inboard steam supply valve upon recovery of AC power 'ol kwing the loss of offsite power; (3) the station staff may need training in identifying significant safety issues as evidenced by the first violation noted above (Paragraph 4).

The effectiveness of the o.uality oversight groups could be improve Only one of the concerns identified by the inspectors had been addressed by one of the oversight groups (Paragraph 5).

- ~ .-

_ . _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . - _ _ _ _

<

,

. .

. . ,

-

.

1 l The inspectors also identified several strengths during the inspection:

• Plant cleanliness was impressiv * Plant equipment was well labelled and easily identifiabl l t

l * Equipment outage times for maintenance and surveillance activities i were minimize ,

• Vendor recommendations were generally incorporated into the PM progra l l,

t t

i t

I

,

l

'

!

t

,

I k

i

!

L

!

i

[

a

,

L

!

i ,

l

'

>

I 3 I t

r

-

.

' '

.

DETAILS Persons Contacted Commonwealth Edison (CECO)

G. Diederich, LaSalle Station Manager

• Huntington, Services Superintendent

• J. Renwick, Production Superintendent

+*J. Ahlman, Technical Staff Engineer

• J. Gieseker, Technical Staff Supervisor

• J. Peters, Technical Staff Engineer

• J. Klika, Technical Staff Engineer

• D. Ulrich, QA Engineer T. Hammerick, Regulatory Assurance S. Dileto, BWR Engineering J. Kolonowski, BWR Engineering R. Raguse, LaSalle Simulator Supervisor Sergeant and Lundy (S&L)

H. Bar, Senior Electrical Project Engineer J. Pabich, Senior Electrical Engineering Analyst C. Furlow, Senior Electrical Project Engineer United States Nuclear Regulatory Commission (USNRC)

• Phillips, Chief, Operations Section, Region III

• S. Dupont, SRI, Dresden

• Ring, Chief, Projects Section, Reg'on III

• Jones, Project Inspector, Region III Other personnel were contacted as a matter of routine during the inspectio * Designates those personnel attending the exit interview held on July 22, 198 +Partic',7ated in telephone call on September 8, 1988 (See Paragraph 7). Introduction This inspection was based on the results as of June 1, 1988, of the LaSalle, Unit 2 Probabilistic Risk Assessment (PRA). This PRA is being performed under the Risk Methods Integration and Evaluation program (RMIEP). The objectives of RMIEP are to:

• Integrate internal, external, and common cause methods to achieve greater efficiency, consistency, and completeness in PRA * (valuate PRA technology developments and lay the basis for improved PRA procedure _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

.

• '

,

.

• Identify, evaluate, and effectively display the modeling and data uncertainties in PRA result * Conduct a PRA on a BWR 5, Mark II nuclear power plant including offsite consequence LaSalle was selected for this study because it met the requirements of the fourth objective and its simulator provided a good engineering model of the plan The importance of this last point is highlighted in the discussion in Paragraph 3.c.(2) of this repor In this case, a design weakness in the plant was identified during an evaluation of the plant's

, response to accident sequences conducted as part of the PRA developmen Fundamentally, a PRA identifies sequences of events (event trees) leading to core damage (Level 1), containment failure or bypass (Level 2), and offsite consequences (Level 3), This inspection focused on the Level 1 sequences (with one exception discussed in Paragraph 3.k). The Level 1 sequences consist of an initiator (plant transient or event leading to a plant transient), followed by a series of failure of systems (sequence events) to perform their design function in returning the plant to a stable and safe condition. The causes of sequence events are identified by fault trees constructed under each sequence event. These faults or failures may be system unavailability due to a maintenance outage, specific (identified) component faults, operator error, or an unspecified i local fault of a system componen Probabilistic data (from a variety of i sources) is then assigned to these faults and propagated through the fault and event tree Finally, this data must be modified to reflect

the probability that the plant would recover from a fault or system failure (interrupt the event sequence). This could be as simple as

! manual operation of a motor operated valve whose operator was assumed to have faile While the absolute probabilities of the occurrence of given faults (and hence, event sequences) have relatively high uncertainties, the relative probabilities are considered to be less uncertain. Thus, the PRA identifies those faults that contribute most to plant ris This inspection focused on initiators and faults identified by the PRA as encompassing s98% of the total plant risk, although only a sample of

.

this population could be examined. While the PRA is not yet complete.

l little change in the primary contributors to plant risk is anticipated.

!

'

Although the PRA was specific to LaSalle Unit 2, Unit 1 was included j in the inspection. This was done because of plant similarities and the

increased data base.

,

l Inspection Results

. Initiating Events Initiating events are plant transients or events which lead to plant transients which challenge the ability of plant systems

,

!

l and the operating crew to return the plant to a stable and safe

'

condi t.i o s

i

'

.

'

.

l (1) Operator Response The inspectors reviewed normal operating, annunciator, and emergency procedures with respect to operator response to initiating event Control room walkdowns were conducted and operator response to the events were discussed with the licensee. The following initiating events were evaluated from this operations perspective:

• Turbine trip with or without bypass

• Loss of condenser vacuum and feedwater e Relief valve opening (fails or leaks)

• Loss of 125 VOC

• Loss of instrument air

• Loss of drywell pneumatic

• Loss of reactor level instrumentation

• Loss of 4160 VAC The inspectors determined that operator knowledge and procedures were adequat (2) System Reliability The corrective maintenance and surveillance histories since 1985 and the preventive maintenance programs for three of the systems involved in initiating events were reviewed to assess system availability and reliabilit The results of these reviews are discussed in the following paragraph (a) 125 VDC System The review of the corrective maintenance history for the 125 VDC batteries indicated no recurrent maintenance or availability problem The PM and surveillance programs were reviewed against the Technical Specification requirements, and IEEE-450 (1980) and vendor manual recommendation One concern was identified in this are Prior to June 1988, LaSalle station procedures (e.g.,

LOS-DC-07, "Battery Equalizing Charges"), required an equalizing charge be put on the Division III batteries on a quarterly basis. These batteries are C and D Type 0 (lead-calcium). The vendor's manual recommended that the batteries not be placed on an equalizing charge

s

?

'. .'

when floated between 2.20 and 2.25 volts as was the case at LaSalle. Placing these batteries on an equalizing charge can cause electrolyte stratificatio The Technical Specification operability requirements are based, in part, on the specific gravity readings. Thus, a Technical Specification operability determination can be impacted by the equalizing chang The discrepancy between the vendor manual recommendations and station procedures was identified by the station technical staff in May 1987 and brought to the attention of the corporate DC Task Forc The discrepancy was also highlighted as a concern is the result of the QA Safety System Functional Inspection conducted by the licensee QA organization in September 1987. Final corrective action (revision of station procedures) was completed in June 198 The impact of this discrepancy on battery operability or reliability was minor. However, the inspectors were concerned that the vendor recommendations were not incorporated into the original station procedures and that it took over 12 months to correct the discrepancy af ter it had been identified.

'

(b) Instrument Air and Drywell Pneumatic Systems The instrument air system provides air to operate instruments and air operated valves outside the drywel The drywell pneumatic system provides nitrogen to perform the same functions inside the drywel The review of the corrective maintenance history for the compressors in these systems indicated relatively poor reliabilit The station air compressors had bearings replaced twice in 1985 and once in 1986. Motor bearings were replaced twice in 1987 and once in 1988. The nitrogen "A" compressor was rebuilt in 1986, 1987, and 1988. The "B" compressor was rebuilt in 1985, 1986, and 1987. The licensee shared the inspectors concern and indicated during the exit interview that actions were being planned to correct the problem. In the interim backup systems had been installed to preclude loss of instrument air or nitrogen in the event of system failur A concern was also identified during the review of surveillances for these systems. Neither the air nor nitrogen provided by these systems were monitored for particulate content. Also, the station did not monitor the gas streams for oil content; however, the corporate technical cent?- did monitor the instrument air system for condensable hydrocarbons on a semiannual basis for

I * .

!

'

. o'

breathing air purposes. The consequences of particulate and oil contamination in instrument air systems are documented in NUREG-1275, Volume The licensee took immediate action to address this concer Completion of corrective action will be tracked as an open item (373/88016-01; 374/88015-01).

,

(3) Core Instability On March 9, 1988, LaSalle Unit 2 underwent a dual recirculation pump trip event. After the pump trip, the unit experienced a large diverging neutron flux oscillation while it was on natural circulatio The event is described in NRC Information Notice No. 88-39,

"LaSalle Unit 2 Loss of Recirculation Pumps With Power Oscillation Event," dated June 15, 1988. Additional details of the event have been documented by the NRC augmented inspection team (AIT) in Inspection Reports No. 50-373/88008 and No. 50-374/8800 Since this event was not considered in the LaSalle PRA, the NRR consultant to the inspection team evaluated the

-

event to determined if it had significant impact on plant risk as an initiator of a severe accident semenc The conclusion was that this event, while not unimportant, did not represent a substantial increase in overall plant risk. This conclusion was contingent on completion of actions to be taken by the licensee described in the Confirmatory Action Letter (CAL-RIII-88-03) issued as a result of the event and NRC Bulletin No. 88-07,

"Power Oscillations in Boiling Water Reactors," issued on June 15, 198 b. Recovery Actions The ability of the plant to recover from an initiating event is an important factor in determining the overall plant risk. The ability of the plant to recover from oi? of the dominant initiating events, loss of offsite power, was assessed by the inspection tea Licensee procedures, activities and site involvement in reestablishing power were reviewed by the inspectors through discussions with licensee personnel and a review of station procedure The following LaSalle administrative procedures were reviewed:

• LOP-AP-01, Revision 4, June 1, 1985, "Restoring the System Auxiliary 'iransformer SAT 142(242) to Service with Unit 1(2)

Shutdown"

, _ _ _ _ _ _ _ - _ _

. *

! ,

, a'

• LOP-AP-02, Revision 3, May 29, 1987, "Restoring System Auxiliary Transformer to Service During Unit Operation"

• LOP-AP-07, Revision 7, June 10, 1987, "Loss of Auxiliary Electrical Power"

• LOP-AP-08, Sevision 7, July 31, 1987, "Total Loss of AC Power"

• LOP-AP-16, Revision 2, August 6, 1985, "Returning 4160 Volt Bus 141Y(241Y) from Diesel Generator 0 Power to its Normal Source of Power" During discussions with licensee personnel, the inspectors were provided the following information:

'

• Commonwealth Edison Company controls power generation and load handling for their entire system by the Load Dispatcher l'cated at the Glenbard Dispatch Center and, in conjunction with the Mid-American Interpool network (made up of regional utilities), the midwest grid distribution syste * LaSalle personnel maintain contact with the Load Dispatcher at the Glenbard Dispatch Center through a dedicated phone line located on the "center desk" of the control room. This assures prompt access for cooperative effort in restoration of offsite power when require * The LaSalle 345kV substation has two independent 345kV loops and four outgoing transmission lines that normally carry the power being generated to the grid. These four transmission lines, two to the Plano substation and two to the Braidwood substation, are carried by two lines per set of transmission poles to each substation. The LaSalle station would be dependent on this same system to provide its offsite power if a site blackout condition would occur. Offsite power is considered available when any one of the four feeders is functioning. Therefore, total loss of off site power would only happen when all four lines are dow * The most likely event to cause all transmission lines to come down and be out of service would be a tornado. In northern Illinois, the path of a tornado occurs in a southwest to northeast path. Since the two transmission lines go in different directions, the probability of affecting both lines would seem minimal. The substation itself and the two independent loops would also seem to have minimal susceptibility; however, given the loss of offsite power, its restoration is not controlled by station personne The administrative procedures reviewed were designed to aid plant operations in the event of loss of power, to adjust to essential loads only, or in the event of restored power, to return to normal power operation No procedures existed dealing with those action

/

. i

,

,'

'.

and activities required to restore offsite power. Ttese activities are directed by the load dispatcher via the dedicated telephone lin Further, damage to the 345kV substation and/or the transmission lines would be responded to by personnel not located at the site who would also be under the direction of the Load Dispatche Thus, the inspectors could not fully assess the adequacy of plans to restore offsite power; however, the procedures for adjusting to the loss of offsite power and its restoration were determined to be adequat c. Operator Errors or Failures Because of their high consequence level, certain operator errors can contribute significantly to plant risk even if the probability of occurrence is lo Two risk dominant operator errors / failures were evaluated during this inspectio (1) Failure to control condensate syste Caution statements existed in the appropriate station procedures alerting the operator to the actions to be taken when reactor pressure is Miow the condensate booster pump discharge pressur The required valve lineup and method for level control was state In addition, the operators were routinely trained on this function. The inspectors concluded that the procedures and training were adequate to minimize the probability of occurrence of this even (2) Failure to reset RCIC Valve F063. During a station blackout, RCIC is isolated. When the diesel generators auto start, it is necessary to reset the isolation in the event that the diesel generators are los If the isolation is not reset, the RCIC isolation would be non-reversible (locked-out) because the inboard steam supp' isolation valve (F063) is closed and not accessible. This event sequence was identified in the LaSalle simulator in 1985. It was determined that the "timer window" of the time delay relay, which would prevent this event sequernce, may not be adequate. The licensee stated that a modification to the relay was under consideration. In the all of 1985, this scenario was included in the licensed operator requalification trainin Discussions with the licensee indicated that no caution statements in station procedures regarding the RCIC isolation valve existed. No formal training on this scenario has been given to licensed operators since the Fall of 1985; however, the licensee stated that this event sequence was routinely discussed during station blackout scenario The inspectors determined through interviews, that not all control room operators were familiar with this event sequence. The licensee committed to include information regarding this scenario in the required reading package for all licensed personnel, to be completed in September 198 __ _ _ _ _ _ _ . _ _ _ - _ . _ - _ _

.

!

,

o o *

,

l

!

d. Electrical System Faults l Many dominant faults contributing to event sequences identified I in the PRA are related to electrical systems. Faults or failures !

of the station auxiliary power Divisions 1, 2, and 3 system's 4.16kV switchgear and bus system were selected for revie '

The faults reviewed are summarized belo (1) local Fault of Circuit Breaker The 4.16kV ITE metalclad switchgear utilized for the f Divisions 1 and 2 systems was selected for revie The documentation review included the following: {

• The ITE (Brown-Bavari) type IB-8.2 SkV medium voltage ,

switchgear manufacturers manual was reviewe Recommendations for maintenance and testing were ;

identified and compared to the requirements and acceptance '

criteria included in the relevant station surveillance test procedure i

• Five separate Station Surveillance Procedures for I circuit breaker testing were reviewed including Procedure i No. LES-GM 103, Revision 6, March 21, 1988, used for the [

testing of the ITE Medium Voltage circuit breaker * A maintenance history computer printout of completed electrical breaker work requests was reviewed. An additional computer printout of plant reliability data for three separate ITE 4.16kV circuit breakers was also reviewe I

• An overcurrent relay coordination study, obtained during l a visit to the Sargent and Lundy corporate offices, was #

reviewed. This review included comparison of the settings !

identified in the study to actual relay settings of selected Divisions 1 and 2 circuit breakt: relay l l

A walk-down of the switchgear rooms for both units was conducted !

arJ the following was observed:

• Both switchgear rooms were clean, orderly, and free of debri .

!

• The ITE switchgear appeared very well cared for and in i good condition. One breaker, rolled out of its cubicle [

of the 141X gear, was observed to be clean and in good }

conditio !

i I

l

?

i I

- _-_ __--_:

. - _ -

l

- .

,

'.

• A breaker test panel, used for the surveillance testing of breakers, was available in each switchgear roo Both appeared to be adequate to successfully perform the required testin * Breakers of Unit 2, Division 1 and 2 busses, in Cubicles 1, .

,

4, 12 and 2, 5, 13 were inspected to confirm that the l overcurrent relay settings correspond with the Sargent -

and Lundy relay coordination stud Based on this inspection, the inspectors determined that:

• Breaker surveillance testing was in compliance with Technical Specification Section 4.8.3.2.b regarding ,

frequency of testin * Overcurrent relay tap and time dial settings were as prescribed by Sargent and Lundy relay coordination study, i

• The review of Deviation Reports, maintenance histories,

'

i and plant reliability data established that the switchgear was free of frequent or recurrent problems.

.

• The frequent preventive maintenance (wipe down cleaning of breakers) minimized any potential ground fault No concerns regarding availability or reliability of equipment were identified in this are (2) local Fault in Under Voltaae Circuit Relay i The documentation reviewed included the following:

) ,

l

• Unit 2 Technical Specifications Table 3.3.3-2, "Emergency l l Core Cooling System Actuation Instrumentation Set Points," '

j was consulted for the required trip set point and ;

i

'

allowable values for the under voltage (loss of voltage) ;

control on busses 241Y, 242Y, and 24 ;

!

'

A surveillance test procedure (No. LES-GM-219. Revision 0, l June 7, 1988) and a completed surveillance test performed '

on January 22, 1987, were reviewed. During this test, of bus 242Y, undervoltage relay No. 2427-APO40A was found to be out of technical specification values for trip set point !

and delay time and exceeding the LCO limit. Additionally, [

j the relay 'ould not be re-calibrate The licensee replaced l this relay under work request L64539 and issued a Deviation ;

Investigation Report (DVR) tio. 01-02-87-004 evaluating the !

operational consequences of the failure. However, neither >

root cause nor prevention of recurrence were addresse l l

t

'

l l

l 12 l

_ _ _ _ _ _

• .

' '

.

-

• Computer print outs of the calibration history and plant reliability data for under voltage relays were reviewed with no additional problems being identifie While only one instance of a failed u/v relay was identified, the inspectors were concerned that the licensee had not determined the root cause of the failure. In the absence of a root cause determination, the implication for other similar relays in the plant could not be determine (3) Fault of Relays in the 0/G Closina Circuit A major concern was identified in this are NRC Inspection R* ports No. 50-373/88006(DRS); 50-374/88006(ORS) outlined, it. Daragraph 3.3.3, the failure of Potter and Brumfield (P&B)

MOR relays used in the closing circuit of the Diesel Generator (0/G) output breakers. The inspectors reviewed two Commonwealth Edison Co. internal letters concerning these relays, one issued by Station Nuclear Engineering Department (SNED) dated June 1, 1984, and the other issued by Station Electrical Engineering (SEED) dated August 1, 1984. Both provided information regarding their evaluation of an INPO notice No. OPEX83-29 (normally energized P&B type HOR 137-8 relay failures) noting that these failures could occur at LaSalle. However no action was taken by the statioa at that time. Subsequently, three failures attributed to P&B relays (LERs87-002, 87-033 and 87-040)

occurred at LaSalle in 1987 during surveillance testing of 0/G Units "0" (one failure) and "1A" (two failures).

An Engineering Change Notice (ECN) package was prepared for replacing both Unit 1 0/Gs, "0" and "1A," P&B relays during the Unit I refueling outag This was completed for "1A" on April 17, 1988, and for "0" on May 16, 1988. Similarly, an ECN package has been prepared for the Unit 2, D/G "2A" and it is planned to be implemented during the Unit 2 refueling outage scheduled for October 198 .

In response to questions, relating to the failure to take action based on the SNED and SEED letters, the inspector was informed that the station had not recognized the P&B relay failures to be a common mode failure. They did agreo that 0/G "O," "1A" and

"2A" could fail commonly and fail to close onto the eastgency busses at the same time. This would prevent emergency power from reaching Divisions 1 and 2 of both unit In such an event, only 0/Gs "1B" and "2B" supplying power to Division 3 HPCS loads for both units would be operabl The licensee had been aware of industry problems with these relays since 1984. However: no corrective action was taken until the three separate failures in 1987 emphasized the serious-ness of the problem. This is considered to be a violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action,"

(373/88016-02; 374/88015-02). The need for the licensee to identify and promptly correct common mode fait *t problems

.

,

. 1

e

,

c' l i

cannot be overemphasized, i t

I e. Core Standby Coolina System (CSCS)

The inspectors reviewed the operating, maintenance, and surveillance I history of the RHR train A and B strainers, the HPCS cooling water !

pump and strainer, and the "0" diesel generator cooling water !

strainer for the period of January 1,1987 to June 1,198 The review included Work Requests, a comparison of the lubrication history against vendor recommendation, and a visual inspection of the equipment. No Licensee Event Report covering the above ,

i equipment was found. No recurring problems, significant trends, nor excessive time out of service were noted. The lubrication program followed vendor's recommendation f. Emeroency Diesel Generators The inspectors reviewed the operating, maintenance, and surveillance history of the five emergency diesel generators (Unit 1: 1A and 18, Unit 2: 2A and 28, and "0" swing diesel) and supporting subsystems such as starting air and service cooling water. The review covered the period from January 1, 1987 to June 1, 1988 and included the following records:

• Work Requests

• LERs and DVRs

• Lubrication History

• Surveillance History In addition the inspectors witnessed the uperability surveillance test on the "0" diesel generator, and interviewed members of the maintenance (mechanical ard electrical), operations, technical, and Operational Analysis Department (OAD) staf The result of the inspection are as follows:

(1) Work Requests Of the 79 work request summaries (January 1, 1987 to June 1, 1988) approximately 45% involved corrective maintenanc With the exception of the air start system air compressors, no recurrence of a specific equipment failure were noted. In the case of the air start system, at least 15 Work Requests for corrective maintenance had been written, ten of which involved work on tt.e motor driven air compressors. The licensee is presently preparing a modification to replace the diesel driven air compressors with electric driven units because of the difft:ulty experienced in repairing tne Potter d(esel which drives the compressors. Since the record seems to indicate that most of the problems have occurred with the existing motor driven units, the inspectors recommended that the licensee review the records to determine what additional

- - _ _ , - _ _ . __

-

,

'

• - ,

,

• ,

e'

steps should be taken to reduce the problems experienced with  ;

these critical unit The licensee's action will be tracked as an open item (373/88016-03; 374/88015-03).  ;

blork Requests covering emergency diesel generators were reviewed for timeliness of work completion and equipment  !

returned to iArvic Except for cases when the nuclear unit -

was shutdow.'. for refueling, all work was completed within two  !

days after the component was taken out of servi: The i'

equipment was returned to service within two days af ter (in several instances the same day) the work was complete No problems with equipment availability were found as a result of this revie l The inspectors reviewed the post-maintenance test performed l on the diesel generators following replacement of air start motors. The test is performed in accordance with LOS-DG-M1, 2, or 3 "Diesel Generator Operability Test." The inspectors

' determined that the testing guarentees the capability of each  ! '

,

redundant pair of eir start motor With regards to preventive maintenance, the inspectors inquirea wh6tter the diesel is insulated from the generator, and if not, whether generator resistance to ground ineasurements are takan to ensure that a breakdown of the insulating capabilitics of the generator bearings has not occurre Such a breakdown

,

would permit stray current to travel through the shaft and the 1 diesel main bearing, damaging the latter. The licensee does not take generator to ground measurements, but stated they would ,

i review the proble Considering the problems experlenced by  !

anoi.her Region III facility in this area (Prairie Island Unit 1 ,

LER 87-011) this will bw tracked as an open item (373/88016-04; ,

374/88015-04).

.

I (2) LERs and DVRs ,

!

A total of sixteen Deviation Reports, nine of which were also  ;

LERs, covering the period from January 1,1987 to June 6,1988 l were reviewe Three appeared to have been caused by human error with the remaining being the result of either mechanical >

'

'

or electrical failures. Only the failure of the diesel output breakers to close due to the failure of a Potter and Brumfield

,

auxiliary relay was repetitive in nature (3 occurrences) and  :

common to three of the diesel generators (0, 1A, and 2A), t

'This item is discussed in Paragraph 3.d.(3). l I

'

On August 16, 1986, the license 6 experienced a HPCS diesel generator start failure due to the failure of an Agastat time [

,

delay relay in the start circui The relay failure was caused :

by one of the three screws keeping a diaphrage from dislodgin t The licensea 13 working on a modification to the start circuitry of the five diesel generators which when implemented will

!

F

,~ - . . , _-- - - - - - - - - - . , _ - - - - - --. --- - . , . . - - . - - . - --_

_ _ _ _ _ _ _ _

.

+

s

. o eliminate two of the time dalay relays in the present circuitry and upgrade the relays to a new model which has six screws holding the diaphragm. This modification will also prevent the failure to start event described in LER 374/87-001 by allowing the diesel to start once the lobe oil pressure switch resets indicating the diesel has stopped rotatin (3) Lubrication The inspectors reviewed the lubrication history of the emergency diesel generators (EDGs) and auxiliary equipment, and the lube oil sample results of the EDGs. The lubrication program meets the recommendations of the specific equipment vendor. For the diesels the program follows the recommendations found in Electro-Motive Division maintenance instruction M.I. 1742 Revision E. The lube oil sample results were compared against M.I.1760. Revidon G, and the oil vendor specifications for Mobilgard 446 anu 45 No problems were identifie The last revision of M.I. 1760 added a lube oil analysis for tin with a corrective action to be taken if higher than 40 pp Presently, the licensee is not testing for tin, however, CECO is testing for tin at some of its fossil stations to develop a data base from which to determine if analyzing for tin as a precursor of equipment failure is worthwhil According to the licensee, lube oil samples are taken from the diesel sump after the diesel had been shutdown for days. The inspector recommended that the licensee consider taking the sample shortly after the diesel operational monthly surveillance test to ensure good mixing of the oil in the sump ensuring a representative sample of the lubrican (4) Surveillances The inspectors reviewed the General Surveillance System History File being maintained by the technical staf The file is used to maintain a record of the dates when a specific test was perfor9ed satisfactorily and to schedule future tests based on the Technical Specification requirements, regulatory commitments, or station polic During the review, it was noted that the frequency of Unit 1 diesel generators operability testi had been increased to weekly due to recently experienced valid start failure A review of diesel generator logs maintained in the control room, and interviews with station personnel, showed that no accurate system existed to track the number of diesel generator failures in the last 100 valid tests as defined in Regulatory Guide 1.108. The licensee's program depended to a large extent on the staff's memory of when failures had occurred and tha log's function was to keep track of how many successful valid starts were needed to return to the normal testing frequenc _ _ _ _ _ _ _ _ _ _ _ _ - _

• .

\

, Using the LERs submitted since January 1,1986, the inspectors determined the dates and number of failures for each unit. For Unit 1 four valid failures had occurred as follows: August 10, 1986, September 17, 1987 December 18, 1987, and June 8, 198 The present testing frequency of once per 7 days was based on the last three failure At the time of the September 17, 1987, failure the licensee established that it was the first failure in the last 100 valid start A record review showed that only 74 valid tests for the Unit 1 diesel generators had occurred between the August 10, 1986 and September 17, 198 As a result, what the licensee had considered to be the first valid failure in the last 100 valid tests was actually the second failure. The review also showed that from August 10, 1986 to December 18, 1987 only 85 valid tests had occurre Therefore, the December 18, 1987 event was the third valid failure instead of the second in the last 100 valid test Technical Specification 4.8.1.1.2 requires that the diesel generators be demonstrated operable in accordance with the frequency specified in Table 4.8.1.1.2- The table specifies that the test frequency after 2 failures in the last 100 valid tests be at least once per 14 days, and after 3 failures it be at least once per 7 day Because of the licensee's failure to include the diesel generator 1A failure experienced on August 30, 1986 its testing frequency between September 17, 1987, and December 18, 1987, was once per 31 days (normal frequency) and after the December 18, 1987, failure on diesel generator 1A the test frequency was only increased to once per 14 days. Failure to adequately track the number of Unit diesel generator failures resulted in a violation of Technical Specification 4.8.1.1.2 (373/88016-05).

The inspectors reviewed three QA Audit and tw- QA Surve111ances conducted during 1987 to determine if the licensee had identified a problem with the method being used to comply with TS Table 4.8.1.1.2.1. Based on the review and interviews of QA personnel the inspectors determined that no audits in this area had been performe During the inspection, the licensee developed a method of tracking, on a per Unit bases, the number of valid tests and failures per the last 100 valid tests which should prevent the violation from recurring; however, the licensee has decided not to incorporate this new method into the station procedures because it plans to submit a Technica' Specification change to determine the testing frequency based on an individual diesel generator's history instead of a per Unit basi On July 13, 1988, the inspectors witnessed the startup, loading, and operation at 2600 kw of diesel generator "0" during the performance of surveillance procedure LOS-DG-H No problems were identifie _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ .

<

• . .

4 l

. *.  ;

i f

j g. Hiah Pressure Core Spray (HPCS)

The ins,,ectors reviewed the operating, maintenance and surveillance history of the motor driven HPCS pump and the southwest ECCS room (HPCS room) heat removal equipment for the period of January 1987

'

to June 1988. The review included nine Work Requests, two Licensee i

'

Event Reports, three surveillance procedures (LOS-HP-M1, LOS-HP-R1, i and LTS-500-10), a comparison of the lubrication history against the i vendor recommendations, a visual inspection of the equipment in the i HPCS pump room, and a review of the licensee's trending progra No recurring problems or significant trends were identifie Work requests were completed and the equipment returned to operable status within a few days. The lubrication program agreed with the

vendor recommendation j h. Reactor Core Isolation Cooling System I i  !

l The inspectors made the following observations:

i l' * Approximately twenty LERs were issued between January 1986 and ,

July 1988 pertaining to the RCIC system. No recurring problem

'

{

or significant trend was identified except for a water leg pump t l bearing problem (see Inspection Reports No. 373/88006; j 347/88006(DRS)) which had been corrected.

l * Nine work requests were initiated between January 1988 and June 198 The work included preventative maintenance, lubrication, and corrective maintenance. Except during outages i the work was completed and the system was declared operable i within a few day .

I * While reviewing LOP-RI.01M, "Filling, Venting and Draining i the RCIC System," the inspectors noted an error in P&ID M.101,

{ Sheet I regarding the standby position of the IE51-F004 and

1E51-F005 valves. The procedure correctly positioned these

'

l

'

valves as opened and closed, respectively. The inspectors [

notified the licensee of this discrepancy, i

!

! Based on this review, the inspectors concluded that the reliability f I and availability of the RCIC system was adequat !

L

) No problems or concerns were identifie l i

!

1. Residual Heat Removal System (LPCI Mode)

The PRA identified local faults of the motor driven pumps and the  ;

heat exchangers and unscheduled maintenance as dominant failure i

! modes of this system. The inspectors reviewed the histories to i j assess the availability of the equipmen The inspectors made the f following observations: l l l

'

!

l l

b  ?

'

1

'

- --- --_----_ -

- _ _ -- - -.___ _-

o .

,- * The licensee was following the vendor recommendations regarding lubrication of the speed reducer and the bearing guides on the three RHR pump * No significant trends or recurring problems were identified during the review of LERs and DVR * A majority of the maintenance work performed on the RHR pumps and heat exchangers was completed during outage conditions. Other work performed included lubrication and preventive maintenanc * The inspectors observed the completion of LIS-RH-301, "RHR (LPC1 Mode) Pump Discharge Pressure Permissive Functional Test" and verified that the testing was performed in accordance with procedure No deficiencies were identified during the testin Based on this review, the inspectors concluded that the licensee had adequate controls to ensure the reliability of the LPCI pumps and heat exchanger No problems or concerns were identifie j. Event Simulation The team reviewed the ten most dominant sequences in the LaSalle PRA study, and f om these, two severe accident sequences were selected for simulation on the LaSalle Simulator: loss of all injection capability and a MSIV isolation followed by a failure cf the containment and primary system heat removal system The ability i

of the plant operational staff was observed in responding to and l recovering from the selected accident sequences on the simulator.

l Two accident sequences were simulated and the following activities were considered:

• Demonstration of equipment and system operations

• Utilization of station normal, abnormal, alarm, and emergency operating procedure * Ability of the plant specific simulator to duplicate these event (1) Preparation Simulator scenarios were developed based on the PRA stud The sequences were reviewed for specific component / system failures and these were collated into scenario event Plant conditions assumed in the sequences were duplicated to the extent feasible on the simulator. The simulator malfunction document was used to develop the component overrides and determine the plant response to event _ _ - - - - _ . _ ,

O .

, \.

-

The Emergency Operating Procedures and the Abnormal Procedures were used to predict operator response to the scenarios and the expected responses were documented for use by the inspector The crew consisted of one Shift Engineer, one Shift Control Room Engineer, and two Nuclear Shift Operator The crew was briefed on their tasks and was then asked to respond to the simulations. The simulator exercise lasted about four hour Confidential discussions and trial simulations of portions of the selected sequences were conducted with training department personnel prior to the exercis These discussions were conducted to allow the facility staff to review and comment on the predicted plant / operator response to events. Modifications suggested by the training department personnel were incorporated into the scenarios in order to accelerate plant response such that '.he exercise could be completed within a reasonable time frame. Collectively, the inspectors reviewed the expected responses of the plant / operators on the simulator, familiarizing themselves with the control board layout and the roles of the various operators involve (2) Loss of All Injection Sequence The loss of all injection sequence was initiated by a loss of condenser vacuum followed by successful reactor scram and SRV operatio All injection systems failed except the RCIC syste AC power was available initially but both AC power and RCIC subsequently faile Observations from the loss of all injection simulation scenario were as follows:

Upon the failure of AC power (and thus loss of the remaining available injection systems), there was no useable indication of reactor water level in the control room. (Harrow range indication was the only reactor water level indication still receiving power in the control room and actual reactor water level was already below this range.) Useable reactor water level indication was available elsewhere (shutdown panel) in the plant but there was no attempt by the crew to obtain this information for approximately ten minutes. During this time interval, the crew instead assumed what they considered to be worse case conditions (that reactor water level had dropped below -275 inches) and initiated steam cooling with one open SR (The crew had already been depressurizing with multiple SRVs prior to the loss of AC power in anticipation of the use of the condensate system for injectio Thus, upon the loss of AC power and the realization that no injection systems were available the crew just closed all but one of the SRVs.) The Emergency Operating Procedures (EOP) do not require steam cooling with one open SRV until -275 inches reactor water level (Minimum

_ _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _

%. o .

,

, - .

Zero - Injection RPV water level) is reache During the

'

sequence, reactor water level dropped to only -192 inche Opening a SRV before RPV water level decreases to the Minimum Zero - Injection RPV water level results in less effective steam ,

cooling due to lower fuel temperatures and reduces the time over which the core remains adequately cooled with no injectio In actuality, when the crew attempted to initiate steam cooling with one open SRV the reactor pressure was at 460 psig due to the previous depressurization. The Emergency Operating Procedures require all ADS valves to be opened when RPV pressure is below 700 psig with no injection systems. (Below 700 psig RPV pressure, steam cooling with one open SRV is no longer effective.) The crew had failed to check available RPV pressure indication (RCIC Turbine Steam Pressure av,ailable in the control room) prior to taking this actio Approximately one minute later the crew checked RPV pressure, realized their error, and opened all ADS valves in accordance with the E0P '

The het effect of these errors in this particular case was just a slight delay in opening all ADS valve These errors do however indicate that operator training needs to better emphasize the use of alternate indications of plant parameters upon the loss of powe (3) MSIV Isolation Followed by a Failure of Containment and Primary System Heat Removal Systems  !

This transient was initiated by an inadvertent closure of all ;

'

MSIVs with successful scram of the reactor and SRV operatio Only RCIC worked for the higi pressure injectio A loss of all AC power except Emergency Diesel Generator (EDG) 1A followed. Those containment and primary system heat removal systems powered from EDG 1A also faile ;

"

Observations from this simulation scenario were as follows:

i The crew properly entered and executed the E0Ps during this !

scenario. Actions taken by the crew were determined to be adequat (4) Other Findings

'

• The ability of the plant specific simulator to duplicate these events was determined to be adequat '

• D ei,tg the second scenario, the output breaker to the operr, ting Diesel Generator did not automatically clos ,

This was due to another breaker supplying the bus for some

'

unknown reason failing to open upon the loss of AC powe This necessitated the operator to manually line up AC power to the bu l 21 j

7_ _ - - - - _ _ . . _ _

' .

,

N

, * The simulator capability for overrides is very extensiv All desired overrides were accomplished without difficult * Recognizing that the simulator was not designed to model core melt sequences, the sequences selected were beyond that expected for the simulator capability. The longer term decay heat removal operations and core-melt conditions were not incorporated due to this limitatio * The operators involved in the simulation appeared to be familiar with PRA scenarios and thus seemed to expect these types of events (which may have led to the worst case assumptions made in the first scenario).

• The second scenario on the simulator had to be stopped and later restarted due to a failure of the "Executive." This was described by the simulator personnel as a recurrent problem with the simulato k. Containment Leakage Rate While this inspection focused on Level 1 events (events leading to core damage), one Level 2 event (containment response) identified in the PRA as risk significant was reviewed. This event was containment leakage. While no additional inspection effort was expended in this area, the results of the initial containment leak tests are discussed below for perspectiv The first periodic Type A test (CILRT) on the Unit 1 primary containment us performed on June 1986 (See Inspection Report No. 50-373/86004). The as-found leakage rate was 0.538 wt %/ day which exceeded the maximum allowable (.75 la) of 0.476 wt %/ da The as-left leakage rate was 0.269 wt %/ da The first periodic Type A tes' on the Unit 2 primary containment was performed in Mr/ 1987 (See Inspection Report No. 50-374/87033).

The as-found le W ge rate was 1.247 wt %/ day exceeding the maximum allowable of (,.4.'d wt %/ day. The as-left leakage rate was 0.399 wt

%/ da In summary, bocn units have failed their first periodic test as-found condition. The main contributors to the failures were the feedwater and RCIC steam exhaust isolation valves (check valves) for Unit 1, and the feedwster check valves and TIP purge supply stop valve for Unit 2. Thus, the identification of containment leakage as a dominant release mechanism is not unfounde Both units remain on the normal test frequency of 3 CILRT's in ten year [

_ _ _ - - _ _ _ _ _ _ _ _ _ .

0 ,

,

, ok PRA Flood Scenarios During the inspet. tion, the consultant from the Office of Research evaluated the incomplete flood scenarios for the PR The two flood scenarios occur on separate floors in the reactor building, but initiate from rupture of low pressure service water pipin The flood propagation was reviewed and the affected equipment was rechecked to make sure of the assumptions used in the analysi It was found that some additional analysis will be needed before the final flood sequences are quantifie In addition, venting flow paths from ihe steam tunnel into the turbine building were reviewed and verifie . Trainin; and Qualification Effectiveness With the exceptions noted in Paragraphs 3.c.(2) and 3.j.(2), the licensed operating staff and meintenance staff appeared well trained and qualifie While the technical staff also appeared to be generally well qualified, the violation discussed in Paragraph 3.d.(3) (Potter-Brumfield relays)

indicates the staff needs to be better trained in recognizing safety issue . Quality Verification Effectiveness Only one of the various concerns identified by the inspection team had been previously identified by an oversight group (Paragraph 3.a.(2).(a)).

Of particular concern is the failure of any oversight group to identify those concerns resulting in the violations described in Paragraphs 3.d.(3)

and 3.f.(4). The licensee should exert more effort in this are . Open Items Open items are matters that have been discussed with the licensee, which will be reviewed further, and involve some action on the part of the NRC or licensee or both. Open items identified during the inspection are discussed in Paragraphc 3.a.(2).(b), and 3.f (1).

7. Exit Interview The inspectors met with licensee representatives (denoted in Paragraph 1)

on July 22, 1988, and summarized the purpose and findings of the inspectio The inspectors discussed the likely content of the inspection report with regard to documents or processes reviewed by inspectors during the inspection. The licensee did not identify any such documents or processes as proprietary. Additional communication with the licensee was conducted by telephone on September 7, 1988 informing them that the Patter-Brumfield relay problem (Paragraph 3.d.(3)) was considered a violation, l

l 23