IR 05000293/1992081

Probabilistic Risk Assessment Based Insp Rept 50-293/92-81 on 921130-1218.Violation Noted.Major Areas Inspected:Review of Emergency Diesel Generators & Hpcis.App a Encl

ML20128E018
Person / Time
Site:	Pilgrim
Issue date:	02/02/1993
From:	James Trapp NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20128D950	List: IR 05000293/1992081 ML20128D945 ML20128D991
References
50-293-92-81, NUDOCS 9302100289
Download: ML20128E018 (37)

Text

.. ,

,

'9 '

U. S. NUCLEAR REGULATORY COMMISSION

REGION I

PILGRIM NUCLEAR POWER STATION =

-PROBABILISTIC RISK ASSESSMENT BASED INSPECTION REPORT / DOCKET NO.- 50-293/92 81 LICENSE N DPR-33 LICENSEE: Boston Edison Company 800 Boylston Street Boston, Massachusetts 0~2199 FACILITY: _ Pilgrim Nuclear Power Station INSPECTION AT: Plymouth, Massachusetts INSPECTION DATES: November 30 - December 18,1992 TEAM MEMBERS: L. Prividy, Asst.- Team Leader A. Burritt, Operations Engineer D. Moy, Reactor Engineer W. Olsen, Resident Inspector - Maine Yankee -

R. Plasse, Resident Inspector FitzPatrick

- C. Woodard, Reactor Engineer TEAM LEADER: S'M w I - 24 - W James M. Trapp, Team Leader, Date -

Engineering Branch, DRS N

APPROVED BY:- Id-sot # f% M )- a[vs f facqu(P. Durr, Chief,'TnginBering / /Date Branch, Division of Reactor Safety c_ -Areas Insoected: Announced team inspection by Region I personnel to review the emergency diesel generators and the high pressure coolant injection syste Results: Refer to Executive Summary 21g2ye %3 (

_

___ _ __ _ _ _ _ - _ _ .

.

.

SUMMARY During the period between November 30 and December 18,1992, a Nuclear Regulatory Commission (NRC) inspection team conducted a probabilistic risk assessment (PRA) based inspection at the Pilgrim Nuclear Power Station. The team selected the systems for inspection based on the lleensce's probabilistic risk assessment. The emergency diesel generators (EDGs) and the high pressure coolant injection (HPCI) system were both identified as having a reladvely high importance to safety in the PF Overall, the team concluded that a strong safety per:pective and sound engineering was evident in operating, maintaining and changing the plant design. Several strengths were identified in each functional area revle*W In the area of operations, the team noted that the operators demonstrated excellent profic. ncy in conducting routine surveillance tests and in performing simulated tasks. In general, written operations procedures were available for all evolutions reviewed and were technically accurate. The mated wadition of the EDGs and the HPCI system were determined to be good with the exception of missing overspeed trip reset levers on the EDGs. In the maintenance area, aggressive corrective actions had been taken to replace the EDG air system relief valves basul on the information provided in a generic NRC communication. The surveillance testing procedures for the daily, monthly and logic relays functional testing of the EDG were also noted as being particularly detailed and

_

technically sound. In the area of engineering, the plant design changes reviewed were well documented and the associated safety evaluations were thorough. The performance of the system engineers was also noted as being stron The team identified two violations of NRC requirements. The corrective actions taken to repair the repetitive failures of the EDO fuel oil booster pump V-belt were ineffective. This was demonstrated by the V belt failure, on December 12,1992, after only approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of service. The second violation is the failure to provide adequate control of the EDG ventilation system dampers. The team identified that the "B" EDO west side plenum exhaust damper had been inadvertently left closed. The position of the ventilation system dampers was not controlled by plant procedure In four areas, the team had insufficient information to assess the safety significance of the issues and have designated these items as NRC unresolved items in the inspection repor The first item was the lack of a documented technical basis for the current practice of testing the plant emergency lighting for 90 minutes rather than for the required 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> supply capacity, The cognizant engineer stated that a 90 minute test was adequate and that a technical basis would be documented. The second unresolved item was the lack of adequate post modification test documentation following a modification to the EDG jacket water radiator fan blade angle. The capability of the jacket water system to remove EDO heat, during design-basis conditions, was not adequately demonstrated by tbc post modification test. The system engineer stated that additional testing of the EDG jacket water system perfrwmance would be conducted following the installation of test equipment. The third unresolved item was the apparent lack of an established service life program for Agastat relays. Several generic NRC communications have indicated the necessity to limit the service life of energized Agastat relays. A problem report was initiated to evaluate this ite ..

. _ . _ . .. . - . . . .. .. -. .- ..

.

i

.

The fourth item is the identification of an apparent weakness in the problem report proces The team identified one case where a problem report was not issued for an identified discrepancy with a motor-operated valve torque switch setting and a second case where a problem report was closed prior to completing the designated corrective actions. This item remains unresolved pending further review of these discrepancies and the administrative controls for the problem report process,

_- -

- -- _ - - - - _ _ - - - - . - - - - _ _ - . - - _ .- . _ . _

. .

i

<

.

4 INTRODUCTION (NRC Inspection Procedure 93804)

j The team selected the two systems for inspection based on the licmsee's Individual Plant

~

Examination. The emergency diesel generators (EDGs) and the high pressure coolant injection (HPCI) system were tWh identified as having a high relative importance to safety I.n i the Pilgrim Independent Plant Examination. The inspection was divided by reviewing the F emtrgency diesel generators during the first week onsite and the high pressure coolant inje.: tion system during the second week. Two team members were assigned to revie y each of the areas of operations, maintenance and surveillance, and engineering and technical l support. The team members used the information provided in NRC NUREG/CR 5924,

"High Pressure Coolant injection (HPCI) System Risk Based Inspection Guide," while developing the inspection plan for the HPCI system. The team was also provided instruction in the Management Oversight and Risk Tree (MORT) analysis, which was used in developing individual inspection plans and developing inspection team Andings.

, EMERGENCY DIESEL, GENERATORS 4 Operations The three areas assessed by the team in the area of operations were operator performance, procedure quality and technical content, and system material condition. Operator performance was evaluated by simulating operator tasks using the training department job performance measures and by observing operator actions during the performance of routine plant activities. Several operating procedures were reviewed by the team to verify that the technical content of the procedures was adequate and to assess the procedure quality. The emergency diesel generators (EDGs) material condition was evaluated during detailed walkdown The operations personnel observed and interviewed were knowledgeable of EDG operation and demonstrated excellent proficiency in conducting simulated system evolutions. Overall, the EDG procedures contained adequate direction and appmpriate detail. The EDGs material condition was good with the exception of the missing overspeed trip reset handle .1.1 Operator Performance Licensed operator performance was evaluated during walkdowns of several plant evolutions and by observing operator performance during EDG siirveillance tests. The operators -

demonstrated strict procedure compliance, a sound knowledge of system component locations, and the ability to operate the systems. The team conducted simulated walkdowns of several operations procedures and evolutions. The licensed operators demonstrated excellent proficiency in conduct of all the simulated evolutions. - The following are the team findings for the evolutions evaluate P

, -__ _

- - - - - -- - - _- - - - _ - ___ _ _ _

.

.

.

~

Monthly EDG Sury.dllancs

The team witnessed one monthly EDG operations :urveillance test. This test included locally starting the EDO, paralleling the dicsci to the bus, and loading the EDO from the control ' '

room. Surveillance Test Procedure 8.9.1, " Emergency Diesel Generator Surveillance," was used to conduct this test on the "B" EDO. The team noted that the procedure alternated air- ,

start motors when starting the EDO for the monthly surveillance test. Altemating the air-start motors ensured that either of the air start systems were capable of starting the ED Operator performance was witnessed during the pre-start checks, the local start from the EDG room, and the synchronization and loading from the contwl room. A licensed control room operator and an auxiliary operator were dedicated to perform this surveillance. Both operators continuously monitored the EDO operation during the test. The team verified that the test procedure provided adequate detail to perform this task and that the operators conducted the test in accordance with the procedure. Operator performance during diis test was strong. The operators conducted the test in a controlled manner and in accordance with the appropriate test procedur Daily Surveillance The team witnessed a daily surveillance of the EDG. Surveillance procedure 2.1.12.1,

" Emergency Diesel Generator Daily Surveillance," was used by a station auxiliary operator to conduct this surveillance. This procedure verified proper system switch and valve lineups, quantity of fuel oil, and the starting and turbo-boost air systems availability. The team

,

verified that the procedure provided adequate detail to perform the surveillance and that the operator conducted the surveillance in accordance with the procedure. The operator performance during this surveillance was strg as indicated by a questioning attitude and strong safety perspective evident thrnughout the performance of the surveillanc Safe Shutdown From Outside TiRControl Room ne team and a licensed operator conducted a walk through of the EDG section of the safe shutdown from outside the control room procedure to evaluate the procedure adequacy and operator knowledge. The administrative controls that ensured alternate shutdown panel switches were properly positioned during plant operation were also reviewe Procedure 2.4.143, " Shutdown From Outside the Control Room," provided instructions for this task. Operator performance was evaluated using job performance measure LOJPM4 The operator performance was determined to be strong. The operator was familiar with the procedure and appropriately completed the procedure instructions. The selected sections of the procedure reviewed were technically sound and provided the operator adequate detail to properly perform this duty. The tools required for this task were readily available to the operato _ _ -________

. _ _ _ _ _ . _ _ _ _ _ . _ . _ _ _ _ _ _ . _ _ _ __ _ .. _ _ _ _ _._ . _ __

'

,

,

i 6

!

he d!sconnect switches which disable main control room control of the EDGs were located in locked alternate shutdown panels. These panels were locked to prevent inadvertent switch

'

manipulation. Keys for the panels were located in break glass enclosures located near the alternate shutdown panels. Entry into the alternate shutdown panels actuates a tamper annunciator in the control room. Surveillance procedure 8.9.13, " Diesel Generator Alternate Shutdown Panel Test," is required to be performed once per cycle to verify the ability to control the EDO at the alternate shutdown panel. The team concluded that the controls regarding the remote alternate shutdown panel switch positfora were appropriate.

EDG Manual Start A walk through was conducted of the manual EDG start and manual EDG field flashing to evaluate the procedure adequacy and operator performance, ne training department job performance measure LOJPM-76 was used as guidance for this evolutio The team identified that not all the required tools to perform C.is procedure were readily available. Only two of the three required jumper cables were located in the pre-staged tool box. However, the operator was able to obtain the third jumper cable from the tool depo Without the required jumper cables readily available, a delay could result in starting the EDO. The licensee stated that a third jumper cable would be added to the pre-staged tool box and the inventory list contained in procodure 1.3.4-4 would be revised to include a third jumper cabl Procedure 2.4.16, " Distribution Alignment Electrical Systems Malfunctions," did not provide instructions on how to locally close a 4160 volt breaker. Imcally closing 4160 volt breakers may be required when performing this procedure. Guidance for manually closing these breakers was available in procedure 2.4.143, " local Operation of 4160 volt Breakers";

however, procedure 2.4.16 did not reference this procedure. The licensee stated that the procedure 2.4.16 would be revised to include instructions for locally closing 4160 volt l breakers or to reference the guidance provided in procedure 2.4.14 When flashing the EDG field locally using batteries, procedure 2.4.16 instracted the operator to remove the jumper cables when voltage began to increase; however, the procedure did not distinguish whether the field or the EDG output voltmeter is to be used. The licensee stated that the procedure would be revised to identify which voltmeter should be used to cue jumper remova During the walk through of the EDG field flash, it appeared difficult to land the positive lead inside the EDG control cabinet. The opentions staff reviewed the difficulty involved in i

landing the jumper and stated that the procedure would be revised to change the landing point to an accessible locatio _ .__. _ _ -

m--ryrw s ' 4 --+v - ==

.

The team determined that the operator performance demonstrated during this task to be strong. The operator readily conducted this task and quickly established acceptable alternatives for the missing jumper and correctly established which voltmeter should be used for jumper removal. The operations staff stated that the procedure enhancements would be incorporated into the operations procedure Air Comoressor Occration i The team and a licensed operator conducted a walk through of exchanging the air start and turbo-boost compressor belts from the electric motor to the gasoline engin The swapping of the compressor belts from the electric motor to the gasoline engine was i

!

conducted in accordance with procedure 2.2.8, " Standby AC Power Systems (Diesel Generators)," section 7.6. The operator described the steps necessary to perform this j t

evolution and generally demonstrated a thorough knowledge of the tasks involved. However, the procedure did not describe loosening the aligning bolts on the gasoline engine pedesta The operator also appeared to be untware that these bolts would have to be loosened to allow engine movement. The procedure provided limited details on task performance, but would be adequate for personnel familiar with the evolution. The licensee stated that maintenance personnel were more familiar with this evolution and that the procedure would be revised to require that maintenance personnel swap the air compressor belt .1.2 Operations Procedures The team assessed the technical adequacy and quality of several EDG procedures. The adequacy of operations procedures was also evaluated during the operator performance assessments described in section 2.1.1 of this report, in general, the operations procedures reviewed were of high quality and provided detailed and technically sound instructions for conducting the desired tasks. However, a few procedure enhancements were identified by the team. The operations staff stated that these enhancements would be incorporated into the

'*

operations procedure Operations procedures were reviewed to verify that the procedures provided adequate guidance on the EDO loading limitations. Operation procedure 2.2.8, " Standby AC Power Systems (Diesel Generators)," was recently revised to incorporate a EDO load limitation and an EDG loading table. The procedure contained a 2750 kW load limitation in the discussion Section 7.2, " Auto Response." This limitation was based on the manufacturer's maximum recommended 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> per year rating. Emergency diesel generator loading of up to 3000 kW for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> per year is acceptable, based on the manufacturer's recommendation The 2750 kW limitation in procedure 2.2.8 appeared to be overly conervative and could cause operators not to start or to trip desirable EDG loads during accident conditions. The licensee stated that procedure 2.2.8 would be revised to include the 3000 kW and the 2750 kW limits in the precautions and limitations section of the procedure. Procedure 2.4.16,

" Distribution Alignment Electrical Malfunctions," did not address EDG leading limitation . _ . -

.

. l 8 i Procedure 2.4.16 should address EDG load limitations since this is the first procedure that requires EDG operation following a loss of off-site power. The licensee stated that procedure 2.4.16 would be revised to include the 3000 kW and the 2750 kW limits in the precautions and limitations section of the procedure, as well as required actions if the EDO exceeds 3000 k The team reviewed the basis for the operability determination that allowed removal of one air receiver from the air-start and/or turbo-boost air subsystems while the associated EDO remained operable. Each EDO has an air-start system and a turbo-boost system with each of these systems containing one air compressor. Each air start system has two air rec.nvers and each turbo-boost system has three air receivers. Temporary Procedure (TP) 92-0351 allowed removal of one air receiver during preventive maintenance to the starting air and/or turbo-boost subsystems. There was no time restriction for performance of the maintenance, thereby allowing removal of the air receiver indefinitely. Safety Evaluation 92-20 documented the lleensee's safety assessment of this procedur A statement in the Final Safety Analysis Report (FSAR) credited the air start system as having two redundant air-start systems cach capable of independently starting the EDG. 'D.is feature is routinely tested by surveillance 8.9.1, " Emergency Diesel Generator Surveillme,"

which required the EDO to be started with only one of the two redundant air-start rystem The team concluded that the basis for allowing the removal of one air-start systerr was adequat The FSAR described the configuration of the turbo-boost system, but did not state that this system was redundant. The safety analysis referenced Nuclear Engineering Department (NED) analysis NED 92-215 as the basis for the safety analysis conclusion that tha turbo-boost systems were redundant. The NED analysis was based on discussions with tre vendor and documented in a letter, NEDL 92-20. Several inconsistencies between vendor sistements and the NED analysis could not be resolved by the technical staff. The analysis cred.ted the turbo-boost system with providing 10 jet assists with only half of the system air capacity.

l

'

Based on the vendor information it appeared only 7 to 8 jet assists were available. The criterion forjet assists per the vendor was a load of 700 kW and the facility spedlic setpoint was 325 kW. The licensee stated that they did not have specific acceptance test data on the turbo-boost system. The team concluded that the design-basis of the turbo-boost system was not well define The safety evaluation for Temporary Procedure TP 92-038 regarding the removal of one turbo-boost air receiver from service was weak. The evaluation did not clearly establish the design-basis for the turbo-boost system. The safety evaluation relied on the vendor's generic calculations and assumptions. Therefore, the conclusion that the turbo-boost system would l

l l

l

,

.

.

not be adversely affected by removing one turbo-boost air receiver from service was not adequately documented. Upon further review by the licensee, additional documentation was provided which conGrmed that it was acceptable to remove one of the turbo-boost systems from service. Based on the review of several other safety evaluations (see Sections 2.3.1 and 3.3.1), the team concluded that this was an isolated example of a weak safety evaluatio .1.3 System Walkdowns The team conducted detailed walkdowns of the EDGs to assess the material condition and to verify valve and switch line-ups. The piping and instrument drawings for the EDG fuel oil supply system were also verifie The overall system material condition was good; however, the team noted several loose debris such as tubing fittings, pipe plugs, bolts and other hardware in the EDG area. In addition, the team identined that the overspeed device reset handles were missing on both EDGs. These handles are important to provide the plant operators a means of resetting the EDGs following an overspeed trip. The absence of the reset handles could result in a delay in reestablishing EDG operation. The licensee stated that the', would replace the overspeed trip reset handles or attach handles to the EDO using lanyvds. A walkdown of the EDO fuel oil supply system verified that the drawing correctly described the installed plant equipmen The valve and equipment labeling of EDG components was generally good Most EDG equipment was labelled and the labels provided a good description of the plant equipmen However, the team identified that local hand switches for solenoid operated valves SV-4521 and 4522, the diesel fuel oil transfer pumps, end the crank case pressure trip device test valve were not labeled. The licensee installed temporary dyno-tape labels on these components and stated that they would permanently label this equipmen .2 Maintenance and Surveillance The maintenance programs were reviewed to verify that the EDGs were being maintained such that they were reliable and would perform their intended safety function if called upon to operate. The assessment consisted of a review of maintenance procedures and practices, plant walkdowns, surveillance testing, and discussions with maintenance personne Overall, the maintenance procedures contained good guidance for adequately maintaining EDG equipment. The logic system functional test performed on the EDGs was detailed and thorough. Plant personnel were knowledgeable in testing activities. The team identified a deficiency concerning the control of an exhaust damper for the "B" EDG. The licensee took adequate corrective actions to resolve identified failures but certain corrective actions such as improving the EDG fuel oil booster pump performance were not timel _ _ _

. . -

_ _ _ _ _ _

.

.

10 l 2.2.1 Check Valves  !

Each EDG has an air-start system and a turbo-boost air system with each of these systems containing one air compressor. Each air-start system has two air receivers and each turbo-boost air system has three air receivers. A check valve is provided at the inlet to each air receiver to prevent loss of receiver air pressure in case of a compressor or upstream piping failur In June 1991, nine of the ten check valves for both EDGs failed during the first leak rate testing of these valves. Several of these valves also failed during subsequent leak rate testing

'

between June 1991 and June 1992. These failures resulted in periods of inoperability for the associated EDO. The team reviewed the operating experience, the maintenance activities, the root cause analyses and the corrective actions fr these valve failure The check valve failures in June 1991, we.c experienced during the performance of the first leak rate testing of these valves conducted as part of the licensee's inservice test (IST) '

program. While the licensee may have been slow in identifying these component problems, the team noted that the licensee took short and long term corrective actions to achieve permanent solutions. For example, new soft seated check valves were installed fer the "A" EDG in June 1991, since these were the original construction valves. The "B" EDO valves had previously been replaced in 1987 and new soft seated check valves were installed in August 1991. The valve vendor indicated that the soft seated check valves have a better seating capability for pulsating flow and pressure applications. However, the licensee recognized that the check valve failures had to be evaluated from both component and system aspects. Their system evaluation concluded that the plant piping configuration, which included an undesirable loop seal arrangement at some check valves, permitted the l accumulation of moisture at the check valves that promoted an environment for piping corrosion. The licensee proceeded to install temporary and permanent modifications to resolve the moisture problem The licensee installed Temporary Modification (TM) 91-59 for the "B" and "A" EDGs in October and November 1991, respectively, to provide strainers and water traps upstream of the check valves. However, check valve failures continued to appear during quarterly IST checks until June 1992, with most of the failures occurring in the "B" EDO turbo-boost check valves. The licensee stated in TM 91-59 the intent to perform testing of the check valves every 2 weeks; howevet the testing did not occur due to inadequate work coordination among operations, maintenance and system engineering personne The licensee prepared, on a high priority basis, Plant Design Change (PDC) 91-61 to permanently eliminate the moisture and corrosion problems. The PDC used stainless steel piping and eliminated the loop seals. PDC 91-61 was installed for the "B" EDG in November 1992 and was scheduled for installation for the "A" EDG during the 1993 refueling outag _ _

.

.

I1 The licensee took additional corrective actions in June 1992, when the "B" turbo-boost check valve failures continued to occur. A preventive maintenance progmm was initiated which required disassembly, inspection, cleaning, reassembly and retest of the check valves. Since these activities were intrusive to the system, special operating procedures were developed to do the work during power operation. No further check valve failures have occurred, in summary, while the licensee only recently identified these check valve problems. their corrective actions have been satisfactory in achieving short and long term solution .2.2 Relief Valves NRC Information Notice (IN) 90-18, dated March 8,1990, provided licensees information regarding problems with certain safety relief valves, manufactured by Crosby, on diesel generator air-start receiver tanks. Specifically Cooper Industries submitted a 10 CFR Part 21 report indicating that the JMBU and JRU style Crosby relief valves were not seismically qualified and that the bl >wdown rescat characteristics were not consistent with the functional requirements of 116 system in which they were installed. Site engineering review of IN 90-18 concluded that the same potential problem existed at Pilgrim. All the relief valves on the EDO air-start and turbo-boost systems were Crosby type JMBU safety relief valves. All safety-related Crosby relief valves located on the starting air and turbo-boost air receivers were replaced. However, the non safety-related Crosby relief valves installed on the air-start compressor discharge lines were not replaced. The failure of the non safety-related relief valves would not result in diesel inoperability provided the boundary check valves performed their intended function. To further improve the reliability of the diesel air system, the licensee stated that the non-safety related relief valves would be replaced. The licensee improved the check valve testing program as discussed in section 2.2.1. The team concluded that the licensee took timely action in replacing the safety-related relief valve .2.3 Ventilation During a walkdown of the EDG system, the team identified that an exhaust damper on the

"B" EDG west side was closed, when it should have been open. There are two exhaust dampcts for each EDG which accept exhaust air from the immediate area of the EDG to provide equipment cooling. Operations and maintenance personnel took immediate action to restore the damper to the open position. Upon further review, the licensee stated that this damper had been closed for habitability purposes while performing maintenance on the "B" EDG. The damper was not reopened after completion of this maintenance. Hence the damper was not administratively controlled on any system equipment check-off list as required for most safety-related components. The team determined that the failure to adequately control the position of this exhaust damper was a violation of NRC requirements (NRC Violation 50-293/92-81-01). The licensee stated that the position of this damper would be administratively controlled in the future. The licensee further stated that heating ventilation and air conditioning (HVAC) dampers in other safety-related appilcations would be reviewed to assure that proper administrative controls were present for a comprehensive

. _ . _ ___

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ __ _ -

.

.

plant wide resolution. Due to the lack of design-basis information for assessing the performance of the EDG ventilation system, with this exhaust damper closed, the licensee was unable to establish the specific safety significance of the degraded ventilation syste The ventilation system cools the EDO and the EDG electrical equipment located in the EDO room. The licensee stated that 'hese questions would be answered by conducting a test of the system and extrapolating the data to design condition .2.4 Fuel Oil System The fuel oil system has components that store, supply, regulate, and isolate the fuel to the EDG. Each dicsci engine has a main fuel oil storage tank. The fuel oil transfer pump transfers oil from the main storage tank to the diesel fuel day tank, and then to the diesel engine via a suction line from the day tank. Fuel is pumped to the EDG fu21 racks by an engine driven fuel oil booster pump. The booster pump is mounted to the engine base at the free end and is belt driven from the crankshaft extension shaft. The standby direct current (de) emergency fuel oil booster pump is available to supply the diesel with fuel oil should the c belt driven pump become inoperabic. The de pump has a 20 second time delay and, therefore, would not be available to supply fuel on an initial diesel start. Provided the belt driven pump remains operable during the first 20 seconds of a diesel run, the de pump would provide the backup function upon loss of the belt driven pum Belt Driven Fuel Oil Booster Pumo Design The fuel oil booster pump utilizes a spliced drive belt to allow for easy replacement installation. The V-belt is driven by the crankshaft extension shaft and therefore, a spliced replacement belt is necessary to allow installation without diesel crankshaft disassembly. The spliced V-belt ends are joined together by a metal alligator V-belt fastener clip arrangement stapled to each end of the V-belt. The two clips are joined together by a rocker pin which is held in place by normal belt tension. Plant maintenance history indicates that the alligator clip arrangement design was susceptible to significant wear and failure. The team reviewed the available belt failure history. Due to the age of some failures and lack of a formal method of tracking failures, the system engineer provided dates of several belt failures, however, additional failures may have occurred. Between December 1977 and May 1985, the "A" and "B" emergency diesel generators experienced fourteen documented failure Formal root cause analysis of these failures was not performed, however, based on the description of the failures, it appeared that most failures were due to wear of the V-belt cli Recent failures documented on failure and malfunction reports (F & MR) have included a detailed description of the belt failures. The team reviewed the documentation for the following failures:

=

_ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _

_

.

.

13 l F & MR 87 609, dated October 29,1987t During "A* EDG operation the fuel booster pump belt jumped off the engine shaft pulley. The lleensee determined the l

booster pump was not in alignment with the engine shaft pulley. Inspoction of the belt indicated the alligator V-belt fastener had not been installed correctl . F & MR 87-648, dated November 18, 1987; During daily EDG surveillance an operator identified the fuel booster pump belt was loose. The lic:nsee determined the belt had been installed new on November 4,1987, and had operated continuously for approximately 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> on November 12,1987, during a loss of offsite power event, and had simply experienced " initial stretch. The licensee issued a maintenance request to retention the belt and performed a satisfactory retest of the EDG, The EDG vendor was contacted and it was determined that a suitable gear driven pump design was being developed. The root cause recommended an engineering service request (ESR) be generated to request support for the pump replacemen . F & MR 90-88, dated March 28,1990; During EDO "B" operation the de pump running alarm was remived. The operator noted the booster pump belt had faile The EDO was secured and it was determined that the cause of the belt failure was wear of the alligator belt cli . F & MR 91-328, dated Ji'ly 18, 1991. During EDO "IP operation the fuel oil booster pump broke due to failure of the alligator belt cli Root Cause Analysis A formal root cause analysis was completed for the July 18,1991, belt failure. The root cause analysis was completed and accepted January 15,1992, approximately six months after the event date. The root cause analysis determined the following:

(a) The root cause identified the past failures addressed in F & MR 87-609,87-648, and 90-88 discussed above and concluded that the primary root cause of the failure wa:

less than adequate belt design. The root cause stated that the licensee recognized the weaknesses in the belt and had addressed the problem utilizing the preventive maintenance (PM) program by performing a visual check of the integrity of the fuel pump belt quarterly and replacing the belt every refueling cycl (b) A contributing cause of the belt failure was lack of spare parts in the warehous During the refueling outage (RFO)-8 (April-June 1991), the recommended PM to replace the belts was not performed due to a lack of replacement belts. The licensee failed to stock the replacement belts due to the plan to install the gear driven pump during the refueling outage. le gear driven pump was not installed during the RFO due to an inadequate design change revie ___ ___.___ _ _ -_ . _ _ _ _ __ __ - -.

.

.

The team noted the following regarding the root cause analysis: Although this root cause identified the inadequate design, engineering failed to fully develop the failure mechanism of the alligator clips. A more comprehensive review would have developed all previous failures and the length of EDO run time for the individual failures to determine the EDO reliability with respect to potential belt failures, and to determine the appropriate replacement frequenc . The root cause stated that a quarterly visual inspection of the belt would be conducted. However, the quarterly inspection is ineffective in identifying any wear on the alligator ellp fastener. A visual inspection of the clip requires disassembly of the belt. Therefore, the visual inspection was ineffective in preventing clip failur Belt Driven Fugl Oil Booster Pump Failure During Ooeration On December 12, 1992, the drive belt for the fuel oil booster pump failed during "A" EDO operation. The operations department secured the d!esel and initiated a maintenance request to replace the failed belt. The EDO was declared inoperable. A problem report was initiated cocumenting this event, PR 92-9275. At the end of the inspection period, the root cause investigation was not complete. The failed belt was installed during mid-cycle outage (MCO) 1992 on October 30,1992. The "A" EDO had approximately six hours of run time when the alligator belt clip failed. The team visually inspected the failed alligator clip. The clip exhibited significant wear and appeared to be misaligned. It appeared to the team that the clip on the belt replaced on October 30,1992, had not been installed as described in the installation procedur Maintenance Review

~

The team reviewed the records for the recent maintenance performed on the fuel oil booster pump belts during MCO-92 and visually inspected the last three belts irmalled on the "A" fuel oil booster pump. Based on discussions with the system engineer and review of EDO operating records, the following estimates of the service life for the three belts were made: Belt installed approximately 2.5 years with 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> of EDG run time. This belt clip showed signs of wear. This belt did not fall while in servic . Belt in service eight months between March and October 1992, with approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> of EDO run time. This belt clip showed similar wear points as the previously installed belt. This belt did not fall while in servic . _ . _ -.

.

.

15 Belt installed October 30 - December 14, 1992, with six hours of EDG run tim This belt clip showed signincant wear to the point of failure. The clip also showed deformation welch appeared to be the result of inadequate installation of the clip fasteners. The cdp abo appeared to be slightly misaligac The team reviewed and discussed the maintenance procedure steps with the system enginee The procedure 3.M.3-61.2, for the installation of the V belt fastener clips, had adequately detailed instructions to ensure proper clip installation. The team identified one minor discrepancy in the procedure. The procedure provided instructions to remove a back staple utilized for clip alignment; however, the procedure did not provide instructions to install the back staple. The system engineer stated that the procedure would be corrected. During visual inspection of the three belts, evidence indicated that the back staples were utilized during clip alignmen Based on thb review the team concluded the following:

• The procedure provided adequate instructions for installatio * The reliability of the belts and their estimatcri service life prior to failure could not be specincally determined. It appeared that the alligator clip lifetime depends on the resultant alignment of the clip when insulled, and any minor misalignment of this clip relative to the alignment of the belt could remit in a signincant wear rate. Even with proper alignment, the clip does exhibit a significant wear rate and the licensee had not determined an expected service life prior to failur Review of Plant Design Change (PDC)-19 Engineering Service Request (ESR)-88-178 was inillated to replace the belt driven booster pump with a gear driven booster pump. The problem statement on PDC-19 described the reason for the modi 6 cation was that the belt driven pump was obsolete and no replacement pumps were availabic. No mention of the susceptibility of the belt failures was made an the PDC. The licensee prepared and approved the modi & cation for RFO-8. Just prior to the RFO-8, engineering review of this modification determined that the gear driven pump would be mounted where an existing air-start motor was installed. The licensee was reluctant to complete the design change with an unanticipated compromise to another EDG subsystem (i.e. loss of one air start motor). The design analysis, however, determined this change was adequate. The EDGs are provided with four air-start motors, two air-start motors are required to meet the EDG startup requirements. The analysis concluded the elimination of one air-start motor would still leave three air-start motors which was adequate to start the EDG within its ten second time requiremen _ _ _ _ _ _ - _ _ - _ _ _ - _ _ - . _ _ - _ _ - __

_ _ _ _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ .

.

.

Conclusion Fourteen recorded failures of the fuel oil booster pump belts have occurred since 1977. The lic:nsee identified a weakness in the design of the V-belt fastener clip as early as August 1988. The de emergency backup pump function is limited to supporting the diesel after a 20 second time delay. Therefore, a broken belt within the first 20 seconds of EDG operation or a diesel trip after a belt failure would result in EDO unavailability. Management delayed the gear driven pump modification from the mid-cycle outage (MCO) 1992 until MCO-199 The team concluded, based on the previous maintenance history, availability of a design change, the importance of the EDGs, and the recent belt failure on December 12,1992, that the failure to correct this design deficiency in a timely manner was a violation of NRC requirements (NRC Violation 50-293/92 81-02).

2.2.5 Emergency Lighting The team reviewed the surveillance testing conducted on the plant emergency lightin Appendix R, of 10 CFR 50, Section Ill.J. " Emergency Lighting," requires that emergency lighting units, with at least an eight hour battery supply, be provided in all areas needed for operation of safe shutdown equipment and in access and egress routes thereto. To meet the eight hour requirement, the licensee installed the Exide Electronics type LEC-36, Model F-100 batteries to supply power to the emergency lights. The units were designed to pmvide eight hours of light to 87.5% of the initial voltage with two 12-watt halogen lamps. The charger module is a solid state charger capable of restoring the battery to full charge following a rated discharge. The charger also contains a low battery voltage drop-out circuit and a brown-out protection circuit that energizes the lamps (connects the lamps to the battery) when the alternating current (ac) line voltage drops to below 85 volts. The model F-100 is equipped with a ready light, a red fast-discharge indicator light, a voltmeter and a test switc The vendor manual, " Electronic Emergency Lighting Unit Equipment," recommended monthly, quarterly, and annual testing to assure healthy emergency lighting units. The vendor manual states that frequent deep discharges can reduce battery life expectancy and that the batteries have between 40 and 50 deep discharges available in their lifetime. The vendor manual provides instructions to perform an eight hour discharge test and appropriate test acceptance criteria. The vendor operating instructions stated the Emergency Lighting Units (ELUs) should be tested periodically by interrupting all ac power and observing that all lamps remain lit for rated time period. The team reviewed the licensee's preventive maintenance and testing program as described in procedures 8 B-21 (monthly ELU battery checks) and 3.M.3-49 (ELU preventive maintenance procedure). The team determined the licensee met all recommended monthly, quarterly, and annual battery checks, however, an eight hour discharge test as described in the vendor manual had not been periodically performed. The licensee was currently performing a 30-minute discharge test monthly and a 90-minute discharge test annually. NRC Information Notice (IN) 90-69, " Adequacy of Emergency and Essential Lighting, dated October 31,1990, identified a condition at another

.. ..

.

. _ _ _ _ _ _ _ _ _

_ _ . _ _ -

.

.

utility where the emergency lighting system failed to perform its intended function due to a lack of adequate preventive maintenance and an inadequate eight hour ELU discharge tes The licensee's review of IN 90-69 determined that no action was required due to the existence of the previously discussed Phi procedure 3.ht.3-49. The IN determined that an eight hour "as found" condition discharge test was a key test in demonstrating operability of the emergency lighting syste The team concluded that the overall preventative maintenance and surveillance test program for emergency lighting were comprehensive and a maintenance program strength. However, based on review of the vendor manual, test and maintenance procedures, and IN 90-69, it appeared that the licensee had not adequately documented their justification for conducting a 90-minute test in lieu of a 8-hour discharge test. The cognizant engineers stated that the existing Phi program was adequate to ensure the required eight hour capacity supply and stated that a technical basis and justification to support this position would be documente This item remains unresolved pending the completion of an acceptable technical basis for the surveillance testing (NRC Unresolved Item 50-293/92-81-03).

2.2.6 Logle Functional Testing The team reviewed surveillance test 8.hi.2-2.10.8.7, " Diesel Generator 'A' Logic System Functional Test." The team verified that the surveillance test was adequate to ensure certain EDG trips, which would be bypassed during a loss-of-coolant accident (LOCA) were tested to ensure that the trips wculd not inadvertently shut down the EDO during a LOCA. The team determined that the surveillance test properly tested the logic circuit. The team reviewed the overall logic system functional testing performed on the EDGs and concluded that the testing was detailed and thoroug .2.7 Fuel Storage Tank Integrity Test The team reviewed surveillance procedure 3.ht.3-62, " Integrity Testing of Underground Tanks T126A and T1268." The design objective of the diesel oil storage and transfer system was to provide the EDGs with sufficient fuel to permit seven days of continuous operatio The test allowed isolation of the primary valves to the fuel oil transfer pumps, preventing transfer of fuel from the underground tanks during the integrity test. The licensee considered the EDGs operable since the day tank remained capable of supplying the EDGs during the

, integrity test. The procedure stated that the day tanks were a four hour supp!:' and that, in l the event the EDGs were called upon during the integrity test, compensatory measures were established to ensure operator action within two hours to restore the normal configuratio Based on calculations performed by the licensee during this inspection (See section 2.3.3),

the licensee established that the day tank capacity provided for an EDG full load operation of approximately 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The team determined that the controls established by the procedure (assuming a 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> fuel supply) were adequate. The licensee stated that the procedure would be corrected and the associated safety evaluation would be revised to reflect the hour day tank capacity.

,

- , ,e

-. . . - - - _ _ - ._ . _ . . __ -

.

.

2.2.8 Training The team reviewed the diesel generator training chapter 41670, dated August 1991. The team identified two minor errors: 1) The description for replacing EDO governor oil provided instructions to adjust the mechanical needle valve to bleed air from oil passages ,

each time the oil is changed. Air is not bled using the needle valve following an oil change; i 2) The description for the de emergency fuel oil pump logic stated that the pump auto starts when fuel oil pressure drops below 12 psil however, the logic circuit drawing indicated that the pump would auto start when fuel oil pressure drops below 20 psi. The team discussed the errors with the training department and questioned the normal revision process of training curriculum to ensure that the material reflected the station operation. Based on discussions l and the material provided by the training department, the team concluded that adequate i controls were in place. The lleensee stated that the two minor errors would be corrected during the routine curriculum revision proces .2.9 Prelube Pump Suetion The team reviewed maintenance work package (MWP) 19202599 which was completed on November 11,1992, during the mid cycle outage. The maintenance conducted was a modification to the "B* EDO prelube pump suction path. The purpose of the modification was to correct a prelube pump ccvitation problem which exic.ed due to an undersized pump suction line. In addition to the MWP, the modification package and the procurement paper work were reviewed. A walkdown of the EDO prelube system indicated that the modification had been effective in correcting pump cavitation. The commercial grade item evaluation 625 for the replacement flexible hose (Aeroquip hose) stated thr.t the shelf life for the hoses was eight years, llowever, the preventative maintenance program did not appear to establish a service life for these hoses. The maintenance staff stated that vendor information and hose failure history would be evaluated to determine whether a periodic replacement of the hoses was appropriat .2.10 Fuel Oil Cross-Tie Valves The Final Safety Analysis Report, section 8.5.1.7, states that there are manual valves which can cross connect the EDO fuel oil transfer systems. These valves are designated 38 HO-103 and 109. The team noted that these valves were not included in the licensec's inservice test (IST) program. Not including these valves in the IST program was acceptable since these valves would only be used during events which go beyond the design-basis assumptions for the plant. However, the lleensee did not periodically exercise these valves for assurance of reliability. The licensee stated that these valves would be periodically stroked and that this requirement would be administratively controlled to assure the valves would operat __

______-___- ____ - _ _ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ __

.

.

in further discussions concerning the operation of manual valves, the licensee stated that there were manual valves in the core spray, residual heat removal, and standby liquid control systems that had specific safety functions. These valves were included in the IST program and were periodically exercised. During these discussions the team noted that the plant personnel administering the IST program wen, knowledgeable in valve testing requirement '

These personnel worked well with the system engineers to develop component tests for improving system performance, such as the check valve tests noted in section 2.2.1 of this repor .2.11 System Walkdowns During walkdows of the EDO and associated support systems, the team had two material condition observations as follows: Four bolts connected the "A" EDO air silencer saddle support to the structural bas Two of these connections were regular bolted joints, while the other two joints consisted of slotted holes in both the silencer saddle and structural sicci base. The bolts at the slotted hole connections appeared to provide very little clearance for thermal expansion. The team referenced NRC Information Notice No. 85 25 that was issued regarding potential problems with the design and installation of EDO exhaust silencers due to lack of thermal expansion considerations. The licensee stated that these connections would be monitored during the next EDO monthly test. The licensee also stated that a detailed inspection would be performed at the next outage opportunity for the "A" EDO to assure that these connections were properly installe . Several minor equipment deficiencies were noted by the team. The "A" EDO outside air temperature indicator and associated pneumatic tubing were improperly mounted to the ventilation ducts. The duct flex connection for the "A" EDO radiator fan had an approximate 3 foot tear, and an air leak was identified on SV-4524. The licensee issued work requests to correct these deficiencie .2.12 Surveillance Testing The licensee conducted routine monthly surveillance testing of the emergency diesel generator in accordance with Procedure 8.9.1, " Emergency Diesel Generator Surveillance."

This test fulfilled the surveillance requirements of Technical Specification 4.9.A.l.a. The test verified the capability to start and to sustain a load of 2600 kW, at a power factor of 0.9, for one hour. The test did not verify the EDO units capability to sustain their rated load at the estimated accident condition power factor of 0.85. The team also noted that the Final Safety Analysis Report, Table 8.51, stated that the loss of coolant accident (LOCA) with a loss of offsite power (LOOP) would result in a 0-10 minute loading of 2917 and 2952 kW on the "A" and "B" EDOs, respectively. The team noted that the EDGs 0-10 minute load provided in the original FSAR was 2398 kW, which was significantly less than the 2f00 kW continuvus rated load of the EDO. The FSAR Table 8.5-1 was revised in July 1990, based

. .

'

.

on the results of Boston Edison Company calculation FS-79. The licensee cognizant engineer stated that the 010 minute EDG load values provided in FSAR Table 8.51 were

'

conservative and did not reflect the actual load on the EDGs during an accident. Four areas of conservatism were described by the licensce:

• Calculation PS-79 assumed that all automatic safety related motor-operated valves were operating at 50% of locked rotor current. The use of 50% locked rotor current was conservative because this current was in excess of the normal running current

which would be seen during most of the valve stroke, in addition, sinc: certain valves close and other valves open on a LOCA signal, all valves would not be seating or seeing locked rotor current simultaneously. The difference in valve timing had been coaservatively omitted from the calculation. All the safety related motor-r/perated valves would not receive the signals to open or close simultaneously. Valves such as the low pressure coolant injection valves would not roccive open signals until after the containment isolation valves had begun to close. Based on " realistic" ntsumptions, the motor-operated valve (MOV) loading could be reduced from the conservative FSAR value of.423 kW to 175 k * 'Ihe drywell cooler loads were not included in the original FSAR emergency diesel generator loading but were included in the revised calculation. The auxiliary relay which sheds the drywell coolers during a LOCA with a LOOP were non safety class IE. Calculation PS-79 conservatively assumed that these coolers would not be shed and included the 87 kW of drywell cooler load in the calculation. The licensee is currently planning to upgrade the drywell unit cooler auxiliary relay to class IE during the next refueling outag * The value used for the vital motor-generator load was conservative in that it included the process computer load which has been removed from the motor generator se * Calculation PS-79 made conservative assumptions for a number of miscellaneous load When the conservatism described above were removed, the 0-10 minute diesel loading was approximately 2650 kW. The continuous load (greater than 10 minutes) of the "A" and "B" EDO was 2308 kW and 2412 kW, respectively. There were still a number of conservatism included in this value such as in the load assumed for small motors. The licensee had insitu tested the EDGs in May of 1980, in response to NRC Bulletin 79-23, to a load of 2860 kW for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Based on the licensee's calculation of actual diesel generator load, the team concluded that the monthly surveillance test at 2600 kW is appropriat .

.

21 Pugineering and Technical Supped Engineering and technical support was reviewed to assure that the emergency diesel generator modifications, technical evaluations, and calculati ns were performed consistent with the system design basis. In addition, a review of the !it ensee's Quality Assurance (QA)

organization's role in verifying EDO quality was conducte De Nuclear Engineering D,partment modification process produced high quality plant design changes, ne safety evt.'uations written for the plant design changes were detaile However, one example of a weak post modification test for the blade angle change of the jacket water radiator fan, conducted in 1987, was identified by the team. The team also identined one example where a modification to the EDG start air system had not been installed in accordance with the plant design change. Engineering calculations reviewed for the fuel oil storage capacity were technically sound and provided thorough documentation of assumptions and references. The system engineer performance and the trending of EDG performance by the system engineer were determined to be program strengths. The EDO fuel oil quality monitoring program and the implementation of the program were strong. The quality assurance audit reports indicated that the quality assurance department was conducting comprehensive audits, which developed technically significant findings. Managements'

attention to resolve audit findings also appeared to be strong. The team did note that the inaccessibility of design basis information for the EDG ventilation system and the turbo-boost air system made technical evaluations difficul .3.1 Plant Modifications The team reviewed plant design change (PDC) package PDC 91-61, " Diesel Generator Air Supply Piping Rerouting / Replacement." Moisture collection in air supply piping to the emergency diesel generator air receiver tanks and turbo-boost air receiver tanks resulted in piping corrosion and check valve failures. This modification made three piping and valve modifications to the diesel generator air supply piping between the air compressor and receiver tank (1) To reduce the buildup of moisture trapped at the inlet to the air receiver tank, tank inlet piping was rerouted to climinate the loop seals at these locations, and (2) The old carbon stect piping k>cated between the compressor and receiver tank was replaced with stainless steel piping, and (3) Each tank isolation check valve was replaced with a soft seat, swing type check valv . _. _

. __

- _

.

.

The team verified that the above modifications had been completed. One deficiency was identified with the installation of this modification. The defielency was that the non safety-related piping was installed in contact with existing safety related piping. The team was

< concerned that the non safety related piping could adversely affect the safety related pipe during a seismic event. The licensee evaluated the pipe interaction and determined that the safety-related pipe would not be adversely affected. in addition, the licensee repositioned the non safety related pipe away from the safety related pipe. The maintenance staff stated that the cause for the installation discrepancy was that the maintenance supervisor did not verify the final installation process in detail before signing off the installation packag The team reviewed safety evaluation 2631, which was associated with this design change, and concluded that the safety evaluation was well written and technically adequate to form the basis to determine that an unreviewed safety question was not involved as a result of this design chang Review of Temporary Modificillions The team reviewed the following temporary modifications:

(1) Temporary Modification 89-03: Diesel generator anti motoring relay (2) Temporary Modification 91-59: Emergency diesel generator turbo-boost piping. This change was to preclude rust and moisture buildup in the check valve and hence to prevent component failur The documentation for the temporary modification was completed in accordance with the station administrative procedures. The team reviewed the safety evaluations for the above temporary modification packages and concluded that they provided adequate information to reach the conclusion that an unreviewed safety question was not involved; however, the safety evaluation did not concisely summarize the basis for this determination in the summary section of the safety evaluation. The licensee staff responsible for the safety evaluations for temporary modifications stated that a more concise summary would be included in future safety evaluation .3.2 Puel Oil Quality The team verified that the EDG fuel oil program and procedures satisfied the technical specification requirements. This was accomplished by the following:

• Verifying the fuel requirements for the engine by conducting a review of the EDG vendor (ALCO) fuel oil specificatio .

_ _ _ _ _ _ _ _ .

. _ _

.

. I

• Verifying that the licensee procured the proper fuel and treated it as a safety related l quality (Q) substance. This was accomplished by conducting a review of licensee fuel oil blanket purchase order No. 69910 to a quality assurance (QA) qualified supplie i The purchase order included fuel specifications which exceeded the ALCO l requirement l e Verifying that the licensee analyzed fuel oil prior to adding it to fuel oil storage tanks and also periodically analyzed stored fuel to assess quality. This was accomplished by conducting a review of licensee fuel oil sampling and testing procedures 7.1.55, 7.1.36 and 7.1.2 * Verifying licensee QA involvement in the fuel oil program and procedures. This was accomplished by conducting a review of completed procedures. Each procedure required QA approval and there was evidence of QA involvement in all phases of the fuel program - specification, procurement, sampling analyses, and fuel tank cleanin * Verifying that the licensee had no significant history of EDG problems which can be related to improper fuel oil. This was accomplished by a review of EDG cvent reports for the past eight year The team also reviewed the recent quality assurance audit of the fuel oil program, Audit Report 91-2.3-05. This report included an in-depth evaluation of all phases of the licensee's program. The audit included many observations and some recommendations for improvement. The team concluded that the licensee had a good program for ensuring proper fuel oil quality and that the program exceeded Technical Specification requirement .3.3 Fuel Oil Storage Capacity The Final Safety Analysis Report (FSAR), section 8.5.2(7.), states that the each main fuel oil storage tank provides sufficient fuel for seven days of operation of one EDG under postulated accident conditions. This section also states that the day tank provides enough fuel for approximately 4 hrs of full load operation of the EDG. The team reviewed the emergency diesel generator main fuel oil storage emacity in the fuel oil storage tanks and the EDG Jay tank to verify that the fuel oil storage was consistent with these FSAR statements. This review included a review of the design calculation and a verification of the calibration of instruments which were used to verify adequate capacit The NRC Electrical Distribution System Functional Inspection (EDSFI) (NRC Inspection Report 50-293/91-80) noted two concerns regarding the diesel fuel oil storage capacity. The first concern was that the storage tank low level alarm was set at 12,500 gallons of fue The bre,is section of the Technical Specifications stated that the low level alarm would be set to ensure a minimum supply of 19,800 gallons of fuel oil in each storage tank. The licensee revised the Technical Specification basis, in a letter to the NRC dated October 26,1992, to more accurately state that the level instrumentation provided operators the information

l

!

l

'

.

necessary to ensure a minimum supply of 19,800 gallons of fuel oil. The low level alarm ,

!

setpoint was maintained at 12,500 gallons and would provide indication of a decrease la fuel oil storage tank level. The alarm response procedures were reviewed for this alarm and the l recommended corrective actions in the procedure were consistent with the current alarm setpoin The second concern noted in the EDSFI report was that the current administrative limit of 80% storage tank level might be inadequate to provide 7-days of continuous operation under

" preferred" conditions. Preferred conditions included loads which the operator is allowed to manually add to the EDO per station procedures. Calculation S&SA-71, " Diesel Fuel Consumption - Preferrod Conditions," was performed to document the EDO fuel consumption under " preferred" conditions. This calculation concluded that under certain conditions the total fuel required for 7-days of EDG operation could be as high as approximately 21,500 gallons of diesel fuel, in response to the calculation, the licensee increased the administrative limit on the fuel oil storage tank to 85% tank level. The 85%

administrative limit was verified as being included in the Daily Surveillance Log. The team determined, by reviewing Calculation M-297, " Verification of instrument Level Readings v Tank Volume for Diesel Fuel Oil Storage Tanks," that the 85% limit was adequate to provide sufficient fuel for 7-days assuming " preferred" conditions. The calcolations reviewed were technically sound and the assumption and input data were well documente A detailed review of the calibration of the storage tank level transmitter (LT-4500 & LT-4545) indicated that the calibration method and procedures used for this calibration were appropriat The EDG day tank capacity was verified. The licensee had determined in June 1992 that a discrepancy existed between the FSAR statement that the EDG could operate for approximately 4-hours of full load operation on the day tank capacity and the actual full load operation tank capacity. The licensee had also identified that the 800 gallon capacity indicated in FSAR, table 8.5 3, was in error. The licensee determined that the actual volume in the day tank was 639.27 gallons which corresponds to a 3.31 hour3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> tank capacit However, this calculation failed to appropriately assume that the day tank level was at the fuel oil transfer pump start level of 27'-31/2" elevation. When this assumption was made, the total fuel in the day tank was determined to be 503 gallons which cor:esponded to a diesel generator run time of approximately 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The licensee stated that the FSAR would be revised to reflect the actual day tank capacity and EDO run tim .3.4 Performance Trendirg The team reviewed selected sections of the overall plant trending effort, including the information provided as weekly performance indicators to plant management. The information trended and the quality of the information provided to management on system performance was a strength. The EDO system engineer maintained trending data sheets and graphs for most EDG performance parameters, The system engineer stated that these trends had provided useful information for predicting diesel generator performance. The system

- __ _ _ - .__ -. -

.

l

.

engineer was knowledgeable of the EDG performance history, pending work and modifications. The system engineer was effective in initiating maintenance and modifications i to improve the EDG reliability. The team determined that the trending program and the !

I system engineer performance were strength .3.5 Quality Assurance Audit An audit of the emergency diesel generators was conducted by the lleensee's Quality Assurance Department during the period of March 8 through April 10,1991 (Audit No. 91-12). The purpose of the rt.:dit was to evaluate the adequacy and effectiveness of the quality assurance program as applied to the emergency diesel generators. Functional areas such as procurement, design /configuratior. maintenance and test control were evaluated using both a compliance End a performance-bavJ approach. The audit identified five dcHclencies which resulted in the issuance of two fanure and malfunction reports and three denciency reports. These deficiencies were identified in the areas of procurement, design /conHguration control and maintenance. Eleven recommendations for improvement / investigation were issued for enhancement of QA program, EDG system procedures and their applicatio The team reviewed the audit report and determined that the report was detailed and provk'ed a sound technical review of many aspects of the EDG performance. Furthermore, the team verified that most of the findings related to deficiencies and failure malfunction report were satisfactorily closed which was indicative of strong management attention to QA finding In addition to the above w:rincation, the team reviewed Quality Assurance Department Procedure No.18.01, t> reparation, Performance, Reporting and Follow up of Quality Assurance Department Internal Audits," Rev. 24, dated 1/23/91. The team interviewed quality assurance department staff regarding the above procedure for auditing, planning and scheduling, pre-audit preparation and audit performance. The team determined that the licensee's staff were knowledgeable of the QA audit procedure.

l 2.3.6 Jacket Water System The jacket water system transfers the heat from the EDG and the lubricating (lube) oil system to the jacket water radiator. The jacket water removes the heat from the lube oil system via a jacket water / lube oil heat exchanger. The jacket water radiator is an air / water heat exchanger with the forced air How driven by a EDG shaft driven radiator cooling fa In July 1987, while performing a one hour,100% load EDG test, with an ambient temperature of 85'F, elevated jacket water and lube oil temperatures were observed. To reduce the jacket water and lube oil temperatures, the licensee implemented a modification (Plant Design Change PDC 87-55) which increased the blade angle of the radiator fan blades from 15 to 19 degrees. The increase in radiator fan blade angle increased the air flow thorough the radiator and therefore reduced the jacket water and lube oil temperature _ _ _ _ _ _.__.__.___ _ ___. . _ _ _ _ _ - - ._ .. . .

'

.

l

.

Following the implementation of this modification, post modification tests were performe The tests were conducted with ambient temperatures between 60-68'F. Calculations i r

extrapolating the Jacket water and lube oil temperatures data to design basis conditions, assuming the design-basis ambient temperature, were not available for review during this inspection. The team concluded that the post modification testing performed in 1987 did not establish the jacket water radiator performance at design basis ambient condition The team reviewed a trend of Jacket water and lube oil umperatures for monthly tests conducted during 1991 and 1992. The data indicated that, with ambient temperatures between 85-95'F, that the tube oil and jacket water temperatures were approximately 205'F and 196'F, respectively. The emergency diesel generator manufacturer ALCO had published ratings for the Pilgrim EDO units which complied with industry standards. The published bases of these ratings in the ALCO manual for Pilgrim imposed specific operating conditions upon the licensee to achieve and maintain these ratings. These conditions included:

e External cooling to maintain the lube oil outlet temperature less than 185' e External cooling to maintain the jacket water outlet temperature to less than 180* e An ambient temperature environment for the EDO in the EDO room ofless than 104* Documentation which established that the EDO could provide its continuous rated load at the higher lube oil and jacket water temperatures was not available at the time of this inspectio The licensee stated that a test and calculations would be performed to establish the performance of the jacket water radiator with design-basis ambient temperatures. In addition, documentation of the EDG continuous load rating would be established for the design basis tube oil and Jacket water temperatures. -This item remains unresolved pending the completion of the performance test and the documentation of the EDO continuous rated load under design basis lube oil and jacket water temperatures (NRC Unresolved Item

- 50-293/92-81-04), HIGH PRESSURE COOLANT INJECTION SYSTEM Operations Plant operations were reviewed to assure that the high pressure coolant injection (HPCI)

system was being operated in accordance with the system design-basis,_-An assessment of the adequacy of the knowledge of the operators and accuracy and content of procedures for the HPCI system was made by the team. . The HPCI system review included detailed system walkdowns and assessment of the conduct of operations in the control room and field, i

l

.- _ _ __ _ . . _ _ . _ __ _ _, , _ ,_ _

.

.

The operations personnel interviewed were knowledgeable of normal and accident HICI system operation. Overall, the HPCI procedures contained adequate direction and appropriate detail. The team identified that the closeout of one problem report, associated with the closure of HPCI exhaust line drain pot isolation valve, was inappropriate. For this case, adequate procedure guidance had not been provided to the plant operators. The HPCI material condition was good. However, similar to the EDO area, the team note loose debris located in the HPCI are .1.1 Operator Performance Alternate hre Shnidawn Operation The team conducted a walk through with a licensed operator of HPCI operation from the alternate shutdown panels to assess procedure quality and operator knowledg Procedure 2.4.143, appendix A "HPCI Operation From Outside The MCR," is used to operate HPCI from outside the control room. The procedure contained adequate detail u operate the HPCI system from outside the control room. The procedure contained two duplicate steps, 3.1 [2] and 3.2 [2] which both directed starting the gland seal blower. The operation staft ;tated that this duplicate step would be corrected. Licensed operator performance for this evolution was determined to be strong. The operator was cognizant of the procedure and demonstrated the ability to correctly implement the procedure instruction Defanting Imic The team conducted a walk through with a licensed operator on defeating the HPCI low pressure isolation logic, the HPCI reactor pressure vessel level isolation logic, and the high torus water level HPCI suction transfer for motor-operated valve MO-2301-3 Procedure 5.3.21, " Bypassing Selected Interlocks," attachments 4,9, and 11, respectively,

.

are used to perform these tasks. The operator successfully demonstrated the implementation of this procedure. The procedure provided detailed instructions for completing these task While performing this procedure, the team noted that the designated emergency operating procedures (EOP) jumpers used alligator clips on pan head type terminal screws to fasten the _ H jumpers. _ This did not appear to allow for a secure installation of EOP related jumpers. The operations staff stated that an improved installation method for EOP jumpers would be implemented.

.

-

_ . .. . .

. .

_

d

.

.

Reactor Pressure vessel venting The team conducted a walk through with a licensed operator on reactor pressure vessel (RPV) ventinf, via the HPCI steam line drain. Reactor pressure vessel venting via the llPCI steam line drain is performed in accordance with procedure 5.3.24, " Alternate Methods for Venting and Depressurizing the RPV Under Emergency Conditions." Procedure 5.3.24 provided detailed instructions for conducting this task. The licensed operator was familiar ,

with the procedure instructions and demonstrated a strong knowledge of the llPCI system operatio %

3.1.2 System Walkdowns The team conducted detailed walkdowns of the safety-related sections of the IIPCI syste The overall system external material condition of the equipment was good. In general, the housekeeping in the area of HPCI was adequate; however, several loose debris such as inst.lation, bolts, and other materials were located in the llPCI roo .1.3 Event Review The team reviewed the lleensee's assessment and corrective actions documented in the licensee event report (LER)91-003. The licensec appears to have established an effective program for monitoring Rosemount transmitter performance, although documentation of this program was limited. The licensec identified the failure of pressure transmitter Irr-263 50B during a daily suiveillance instrument channel check and took prompt corrective action. The facility enhanced surveillance program had not predicted the response time failure that occurred following the charmel check failure, in response to the failure of the enhanced surveillance program to predict this failure, the facility ;ncreased the trending analysis frequency of the enhanced surveillance program. This increased analysis frequency will allow for earlier detection of potential transmitter response time problem The team verified that the interim corrective actions for Problem Report 92.9050, "IIPCI Drain Pot Isolation IAgic," were in place and that operators were cognizant of the required actions. This problem report described a licensee-identified logic problem, which could have resulted in a leakage path from containment to the IIPCI toom via a small diameter drain line, were a single failure to occu The team determined that the interim corrective actions were not completed promptl Problem Report 92.9050, signed off as completed on May 6,1992, identified that Standing Order 92-08 had been written to identify the logic problem and to provide interim corrective actions to shut the drain pot isolation valves. The Standing Order 92-08 was never issue On July 1,1992, approximately 7 weeks after the problem report was closed, a memorandum was issued to all licensed operators discussing the issue and providing required action l

_ _ - - _ - _ -

.

.

.

Upon further review, the licensee stated that the problem report was closed out prior to implementation of all the required actions. The Standing Order 92-08 was a draft document which was later rejected during the review process. This resulted in the delay of dissemination of information to the operating shifts. In this instance, the problem report process was weak in that the required corrective actions were not completed as stated in the problem repor The team determined that the corrective actions taken were not adequate in that a memorandum to the operators was not the appropriate method to document required operator actions. The operations staff stated that procedural guidance addressing the HPCI exhaust line drain pot isolation logic problem would be implemented until the logic was modifie The team interviewed a licensed senior reactor operator and a reactor operator to assess their knowledge regarding the interim corrective actions associated with the HPCI exhaust line drain pot isolation logic problem. The operators were cognizant of problems and were able to implement interim corrective measures. The licensee stated that additional training would be provided to the facility staff to ensure problem reports were not closed out prior to implementation of all corrective actions. The team determined that this action was adequat (See Section 3.2.4, NRC Unresolved item 50-293/92-81-06). Maintenance and Surveillance The maintenance programs were reviewed to verify that the HPCI system was being maintained such that it was reliable and would perform its intended safety function if called upon to operate. The assessment consisted of a review of maintenance procedures and practices, plant walkdowns, surveillance testing, and d;scussions with maintenance personne System engineering, test, and maintenance personnel were implementing the maintenance program for the HPCI system. The team's review of the HPCI gland seal system and the torus suction path indicated that appropriate actions were being taken to perform the necessary maintenance and testing. While testing of Agastat relays and motor-operated valves was adequate, areas for improvement were noted by the team. The licensee issued problem reports to initiate corrective actions for these improvement .2.1 Gland Seal System The HPCI gland seal system collects and directs steam leakage from the turbine stop and control valves, shaft seal leak-off, and other leak-off points. The steam is condensed and returned to the suction of the HPCI pump by the gland seal condensate pump. The team verified that the gland seal system was designated as safety-related. This system is considered safety-related because the HPCI room coolers are not capable of maintaining the required HPCI room temperature, if the gland seal system was not functional. The team reviewed the operating procedures and recent licensee event reports documenting HPCI

_ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ - - _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - -

. ._ . _ --

.

.

, .

inoperability due to an inoperable gland seal system. The team determined that the licensee had established adequate op: rating procedure controls to ensure that HPCI would be declared

.

inoperable when the gland seal system was inoperable. The team reviewed the corrective maintenance packages and the associated root cause analysis for gland seal system failures and determined appropriate actions had been take .2.2 Torus Suction Path The condensate storage tank and the suppression pool both provide a suction source for the HPCI pump. The condensate storage tank is the preferred source. If the level in the

'

condensate storage tank falls below a minimum level, the suppression pool suction valves open providing the alternate suction path. The swap-over setpoint for the HPCI suction path was reviewed. The team concluded that adequate net positive suction head would be availaisle for the pump and that the current setpoint was appropriate. The team also verified that the licensee had performed a test of the suppression pool suction path and inservice testing of the check valve in the torus suction line. The team determined that the testing was adequate to ensure operability of the HPCI suction paths.

,

3.2.3 Agnstat Relays The team reviewed the HPCI initiation logic analog transmitter trip system. This logic contains Agastat trip relays and are normally de-energized and energize to initiate HPC The team reviewed the monthly logie testing performed on the HPCI system and determined that the testing was adequate to verify system operability. While reviewing Agastat relays, the team n ted that there had been several documented Agastat GP series relay failures in the reactor protection system (RPS) annunciator circuits. These Agastat relays were normally energized in a low current application. Licensee investigation of the failures determined the relays exhibited increase contact resistance due to thermal aging. The excessive' contact resistance was a result of cumulative build-up of relay coil and bobbin offgas contamination and oxidation. At some point of thermal aging, the contact resistance becomes so great the annunciator circuit can no longer detect a change in contact state, resulting in the annunciator circuits inability to alarm when require An NRC Information Notice ON 84-20) and a NRC Bulletin OEB 84-02) discuss failures of relays. Specifically, IN 84-20 provided information on recommended service life for Agastat GP series relays (the same model as discussed above) and thermal aging effects on the relays when in a normally energized condition. The Information Notice stated the GP series Agastat relay may have only a 4.5 year service life. In addition, NRC Generic Letter 83-28, Section 2.2.5, dated July 8,1983, requested licensees to maintain a program that included specifications on the qualification testing for expected safety service conditions to support the limits of life recommended by vendors of components in safety-related systems. The team

.

.

W

performed a walkdown of the RPS relays and determined the relays did not appear to exhibit similar thermal aging degradation. The licensee initiated a problem report, PR-92-%27, dated December 15, 1992, to review this condition and recommend appropriate corrective actions. The licensee's lack of an established service life for these relays is an unresolved item pending the review of the corrective actions (NRC Unresolved item 50-293/92-814)5).

3.2.4 Motor-Operated Valve (MOV) Testing The team reviewed several maintenance activities associated with motor-operated valves (MOVs) MO-2301-6 and MO-2301-8 that occurred during mid-cycle outage 9. The motor shaft pinion key was replaced for both MOVs to address a concern with motor pinion key failure identified in NRC Information Notice 88-84. Prior to returning these MOVs to service, the licensee performed static tests with VOTES diagnostic test equipment per Procedure No. 3.M.3-24.12, " VOTES 100 Operating Procedure." During the review of the results of these tests, the team noted two discrepancies as follows:

1, A test discrepancy occurred for MO-2301-8 in that the as-found thrust value was less than the minimum required thrust value. The torque switch was increased from to 1.75 to meet the thrust acceptance criteria. However, a problem report (PR) was not issued to document and evaluate the conditions encountered when the thrust acceptance criteria were not me . The team identified instances where different minimum required and maximum allowable thrust values were included in Procedure No. 3.M.3-24.12 compared to design values listed on MOV information table drawings M-MOV-1 through The MOV engineer issued PR 92.0628 to address and resolve these findings. The licensee indicated that the comments would be resolved by a revision of Procedure No. 3.M.3-24.12 to require evaluations of as-found test data which did not meet the acceptance criteri The team identified two discrepancies which indicated a weakness in the problem report process. A problem report was not issued when the thrust acceptance criteria was not met for valve MO-2301-8 and Problem Report 92.9050 was closed prior to completing the designated corrective actions (see Section 3.1.3). This item remains unresolved pending a further review of these discrepancies and the administrative controls for the problem report process (NRC Unresolved Item 50-293/92-81-06).

3.2.5 HPCI Room Cooler Control Valves Air-operated valves AO-4044A & B are the reactor building closed cooling water (RBCCW)

system inlet valves for the HPCI room area coolers. These valves are normally open and fail open during a loss of instrument air. The local control switches for these valves are located in the reactor building outside the HPCI room. Based on a review of plant procedures and design documentation, the cognizant engineers were unable to determine the design

,

.

.

, requirements or function for the local control switches. The cognizant engineer stated that these valves had no safety function in the closed direction and the valves were treated as passive valves in the IST program with no periodic testing requirements. The plant physical configuration appeared inconsistent with the periodic test requirements for these valves. The team considered the plant design documentation for these valves to be weak. The cognizant engineer stated that the test requirements for these valves would be reviewe .3 Engineering and Technical Support The team reviewed several plant design changes of the HPCI system to verify that the modifications documentation was complete, the engir.eering was sound, safety evaluations were sound, and the installation was in accordance with the design. A calculation of motor-operated valves which documented the evaluation for an overthrust of a valve was also reviewe The plant design changes packages were detailed and of high quality. The engineering was technically sound. The safety evaluations provided a thorough assessment of the plant design changes impact on plant safety. The installation of design changes was in accordance with the plant design change package. The review of the engineering calculation for the overthrust of a motor-operated valve contained two minor errors. These errors, while they did not affect the final conclusion, indicate a weakness in the independent review of this calculatio .3.1 Plant Modifications The following high pressure coolant injection system modifications were reviewed:

(a) Reolacement of HPCI Turbine Exhaust Drain Pot Level Switch LS2369 (PDC 89-026)

-

This modification replaced the existing Robertshaw level switches with seismically qualified Magnetrol level switches._ Functionally, there was no change made to the HPCI system by this modification. This modification required minor changes to supports and piping

,

associates with the level switch being installed. The new level switch cerformed the same function as the existing level switch and used the same setpoint level. The setpoint of the switch was determined by the physical elevation of the switch. The team verified that the modification had been properly installed and that the switch was physically located at the correct elevation. The team also verified that the replacement switch was suitable to maintain pressure boundary integrity. The replacement magnetrol switch was rated for 1450 psig and 600*F, which was significantly greater than maximum system design pressure of 100 psig and maximum design temperature at 285 F. The team concluded that the PDC was technically adequate. The associated safety evaluation provided an adequate basis to determine that an unreviewed safety question was not involve '

.

.

(b) Relocate HPCI Room Temocrature Switch TSD43 and TSD44 (PDC-91-32)

The HPCI toom temperature switches (TSD43 and TSD44) provide a signal to start the HPCI unit cooler fans on an increase in room temperature. The function of the coolers is to maintain the temperature of electrical components, located in the HPCI turbine room, within their design range. The location of these temperature switches, over a valve bank and a radioactivity hot sump on the east wall of compartment, causes radiation exposure to the personnel conducting the quarterly calibration of these switches. In addition, the repeated removal of the instrument leads, during the calibration, causes the terminal blocks to break

'

and the temperature switch lead wires to wear. This modification relocated the temperature switches and eliminated the relanding of the instrument leads at the terminal block. The team reviewed the plant design change, the associated safety evaluation, and verified that the operating procedures had been updated to reflect &is modificatio The modification provided sound technical details and provided adequate information to install this modification. The safety evaluation was thorough and provided adequate information to conclude that an unresolved safety question was not invclved. Operating procedures 8.M.2-2.9, " Safeguards and High Temperature Functional and Calibration," had been appropriately revised to incorporate changes which resulted from this modificatio (c) HPCI Inlet Steam Drain Pot Steam Trap Bynass Valve LV-31 (Temocrary Modification 9'2-27)

A steam leak was identified at the stem / packing gland area for the HPCI inlet steam drain pot trap bypass valve (LV-31). The steam caused shorting of the valve position indicating -

switches and control room position indication for the valve was lost. The failed valve position indication did not affect the control function of the valve which is to open during a high drain pot level. This temporary modification removed the HPCI steam trap bypass valve LV-31 indication to eliminate the ground on the bus which powered the position indication limit switc The team reviewed the above temporary modification and the associated safety evaluation 92-31. The temporary modification was technically adequate. The safety evaluation provided an adequate basis to conclude that an unresolved safety question was not involve (d)- HPCI Flow Invertor The team reviewed the technical manual V-ll57, " Abacus Invertor," and drawings for the invertor (INV 2340-13). This invertor supplies regulated 120 Vac power to the HPCI flow indicator controller with an input voltage variation from 105 to 160 Vdc. The new invertor had been recently installed as Plant Design Change (PDC) 91-63. The new invertor had an automatic trip / automatic reset function which was calibrated by procedure 8.E.23, "HPCI

e

'

.

s

system instrumentation calibration." The invertor will not trip, provided the input voltage is between 105 Vdc and 160 Vdc. The invertor will reset after a three second time delay when the input voltage is increased to approximately 108 Vdc on the low voltage end and when decreased to approximately 158 Vdc in the high voltage en The licensec had identified a problem with the previous tripping on high voltage when

.tarang large ac loads (i.e., recirculation pumps). The load required by the pump start caused the battery charger that supplies de voltage to the invertor to overcompensate resulting in a voltage surge exceeding the trip setpoint. The team noted that the new invertor

-

increased HPCI reliability by providing an automatic reset functio .3.2 Engineering Calculations The team reviewed Problem Report PR 92-9251, which identified and resolved an overthrust condition experienced during a test of motor-operated valve MO.2301-6. Engineering performed Calculation No. 547 to evaluate overthrust conditions experienced on several MOVs during testing. The team reviewed this calculation and noted two errors regarding MO-2301-6 as follows: When evaluating the maximum thrust experienced during testing, engineering did not bound the calcu'.ation since the conclusions were based on measured thrust values and did not include diagnostic equipment inaccurac . The calculation for stem rejection load had a math error (< 100 #) due to omitting pi from the calculation of stem diamete The team noted that these errors had not been identified by the licensee's independent engineering review of the original calculation. However, after revising the calculation to correct these errors, the licensee conclusions in the calculation dd not change since the maximum allowable thrust, which was based on the valve body, was not exceeded. The licensee concluded that this MOV would perform its safety function. Based on this revised calculation plus a physical inspection and maintenance performed during MCO 9, the licensee's MOV overthrust evaluation was adequate. The licensee stated that MO-2301-6 would be modified during refueling outage 9 to permanently reduce the maximum thrus .0 EXIT MEETING The team met with those denoted in Appendix A on December 18, 1992, to discuss the preliminary inspection findings as detailed in this repor E

.

J APPENDIX A Persons Contacted BECO Persons Contacted

• J. Alexander, Training Manager

• J. Bellefeuille, Tech. Section Mg * E. Boulette, Vice President Nuclear Operations

• J. Calfa, Sr. Compliance En * P. Cafarella, Mech. System Eng. Div. Mg * W. Clancy, Deputy Plant Manager

• N. Desmond, Compliance Div. Mg R. Fairbank, NED Mg * F. Famulari, Quality Assurance Dept. Mg * D. Gerlits, Sr. Systems Safety Anal. En * S. Hudson, Elect. Systems Eng. Div. Mg K. Kee, Senior Systems Engineer E. Kraft Jr., Plant Mg P. Manderino, Code Test Supv.

,

• R. Mattos, lead System Engineer

• G. McCarthy, Sr. Systems Engineer

• H. Oheim, Regulatory Affairs Mg * L. Olivier, Dep. Nucl. Eng. Mg * G. O' Conner, Sr. Mech. Eng * J. Purkis, Acting Maint. Section Mg * L. Schmeling, Nuclear Services Dept. Mg * C. Sorensen, Elec. Maint. Sup * T. Sullivan, Operations Section Manager

• W. Whitaker, Maint. Training Nuclear Regulatory Commission

• A. Cerne, Resident Inspector - Pilgrim

• J. Durr, Chief, Engineering Branch

• R. Eaton, NRR-Project Manager

• J. Harold, PSI-3, NRR

E. Kelly, Chief- Projects Section 3A

• D. Kern, Resident Inspector - Pilgrim

• J. MacDonald, Sr. Resident Inspector - Pilgrim

• Denotes present at exit meeting held at Pilgrim Nuclear Power Station on December 18, 1992.