U. S. NUCLEAR REGULATORY COMMISSION REGION I REPORT/DOCKET NOS: 50-272/93-82 50-311/93-82 LICENSE NOS: LICENSEE: FACILITY NAME: INSPECTION DATES: INSPECTOR: NRC CONSULTANTS: TEAM LEADER: DP:J_l-70 DPR-75 Public Service Electric and Gas Company Salem Generating Station Units 1 and 2 August 6 through September 3, 1993 September 29, 1993 - Telecon October 27, 1993 - Telecon R. Summers, Project Engineer, DRP (part-time) H. Leung, Electrical Engineer M. Schlyamberg, Mechanical Engineer Leonard S. Cheung, Sr. Reac r ngineer Electrical Section, EB, DRS APPROVED BY: William H. Ruland, Chief Electrical Section, EB, DRS 9312070051 931130 PDR ADOCK 05000272 0 PDR·· _,._ Date
Transcript
U. S. NUCLEAR REGULATORY COMMISSION REGION I
REPORT/DOCKET NOS: 50-272/93-82 50-311/93-82
LICENSE NOS:
LICENSEE:
FACILITY NAME:
INSPECTION DATES:
INSPECTOR:
NRC CONSULTANTS:
TEAM LEADER:
DP:J_l-70 DPR-75
Public Service Electric and Gas Company
Salem Generating Station Units 1 and 2
August 6 through September 3, 1993 September 29, 1993 - Telecon October 27, 1993 - Telecon
R. Summers, Project Engineer, DRP (part-time)
H. Leung, Electrical Engineer M. Schlyamberg, Mechanical Engineer
Leonard S. Cheung, Sr. Reac r ngineer Electrical Section, EB, DRS
APPROVED BY: U-~.&-/ William H. Ruland, Chief Electrical Section, EB, DRS
ATTACHMENT 1 - PERSONS ATTENDING ATTACHMENT 2 - ABBREVIATIONS ATTACHMENT 3 - SALEM ELECTRICAL DISTRIBUTION SYSTEM DIAGRAM
111
EXECUTIVE SUMMARY
During the period between August 16 and September 3, 1993, a Nuclear Regulatory Commission (NRC) inspection team conducted an electrical distribution system functional inspection (EDSFI) at the Salem Generating Station, Units 1 and 2. The inspection was performed to determine the adequacy of the licensee self assessment EDSFI and whether the electrical distribution system (EDS) at Salem was capable of performing its intended safety functions as designed, installed, and configured. This inspection also included the review of the August 19, 1993, event on i25V vital battery IC (the cell voltage dropped below the technical specifications limit). The team reviewed the self assessment report and selected questions of the licensee self assessment EDSFI, conducted on September 14, 1992, through· October 23, 1992. The licensee self assessment EDSFI covered a scope similar to an NRC EDSFI. Sixteen potentially significant issues were identified in the licensee's EDSFI. The team determined that the licensee EDS FI was adequate. However, some NRC inspection findings were not identified by the licensee's team. These findings were: 1) EDGs were tested with two hour loads greater than two hour rating; 2) EDG protection against tornado generated missile; 3) EDG test procedures permitted output voltage to be below the minimum acceptable voltage; and 4) missiles generated by the flywheel of a nonsafety-related MG set may damage two 4160 vital buses. The review of the licensee's EDSFI is discussed in Section 5.0 of this report.
In addition, the team selected samples from the EDS in the electrical and mechanical design, and maintenance and test areas for independent review. The scope included a plant walkdown, technical reviews of studies, calculations, design drawings, and station procedures pertaining to the EDS. Interviews were conducted of corporate and plant personnel.
Based on the sample documents reviewed and equipment inspected, the team concluded that the electrical distribution systems at Salem Units 1 and 2 are capable of performing their intended functions and that the licensee's actions in response to the August 19, 1993, event on 125V vital Battery lC were appropriate. The team identified one violation, two deviations, and 13 unresolved items, as discussed in the inspection finding summary paragraph.
The violation pertains to failure to follow the station procedure as a result of licensee actions in response to the August 19, 1993, event on vital bus lC. One of the deviations, which relates to the EDG fuel supplies, was originally identified by the licensee's EDSFI team. The other deviation pertains to EDG equipment protection against a tornado-generated missile.
Six unresolved items are in the electrical design areas, and three are in the mechanical and HV AC design areas. Two of these unresolved items (93-82-10 and 93-82-15) were originally identified by the licensee's EDSFI team.
The NRC team determined that, in general, adequate maintenance and testing were provided to the EDS equipment, although two unresolved items were identified in these areas. The other unresolved item (93-82-11) pertains to equipment installation, and was identified during the equipment walkdown. All of these items are discussed in Section 4.0 of this report.
iv
The inspection findings are summarized as follows:
Discussed in One Violation Paragraph Item Number
Failure to follow station 6.2 50-272/93-82-14 procedure of single cell battery charge
Two Deviations
1. Insufficient EDG fuel 3.2 50-272/93-82-07 supply for 7 day operation at 50-311/93-82-07 full load.
2. EDG protection against 3.2 50-311/93-82-09 tornado generated missiles
13 Unresolved Items
1. Class lE transformers 2.4 50-272/93-82-01 subject to voltage surges 50-311/93-82-01 higher than BIL.
2. EDG loading calculations 3.5 50-272/93-82-02 need to be revised. 50-311/93-82-02
3. EDG test procedure permitted 2.6 50-272/93-82-03 output voltage to be below the 50-311/93-82-03 degraded voltage setting.
4. High voltage effect on 2.6 50-272/93-82-04 safety-related motors and 50-311/93-82-04 control relays.
5. Class lE transformers 2.7 50-272/93-82-05 overcurrent protection setting 50-311/93-82-05 too high.
6. UPS output voltage total 2.8 50-272/93-82-06 harmonic content needs to be 50-311/93-82-06 verified.
v
.. Discussed in Paragraph Item Number
7. Safety-related storage 3.2 50-272/93-82-08 tanks calculations to include 50-311/93-82-08 level instrument inaccuracies and unusable portion of fluid.
8. Switchgear areas 3.3 50-272/93-82-10 temperature higher than design 50-311/93-82-10 temperature.
9. Missiles generated by 4.1 50-272/93-82-11 nonsafety-related MG set flywheel 50-311/93-82-11 may damage two vital buses.
10. EDGs were tested with 4.2.1 50-311/93-82-12 two-hour loads greater than two-hour rating.
11. Periodic testing of 4.2.3 50-272/93-82-13 safety-related MCCB. 50-311/93-82-13
12. High temperature effect 6.2 50-272/93-82-15 on the aging of batteries 1 C 50-311/93-82-15 and 2C.
13. EDG transient loading test 2.5 50-272/93-82-16
Two Observations
1. No detailed analysis for 2.3.2 the residual voltage transfer scheme.
2. Housekeeping issue in 4.1 switchgear areas.
VI
DETAILS
1.0 INTRODUCTION
During inspections in the past years, the Nuclear Regulatory Commission (NRC) staff observed that, at several operating plants, the functionality of related systems had been compromised by design modifications affecting the electrical distribution system (EDS). The observed design deficiencies were attributed, in part, to improper engineering and technical support. Examples of these defidencies included: Unmonitored and uncontrolled load growth on safety-related buses; inadequate review of design modifications; inadequate design calculations; improper testing of electrical equipment; and use of unqualified commercial grade equipment in safety-related applications.
In view of the above, the NRC developed an electrical distribution system functional inspection (EDSFI) program for operating plants. The licensee conducted a self assessment EDSFI at Salem Units 1 and 2 on September 14, 1992, through October 23, 1992. The scope of their inspection covered similar areas as an NRC EDSFI. Sixteen significant issues were identified during that inspection. Some of these issues were not yet resolved when this inspection started.
This inspection was conducted to supplement and follow up on the licensee's EDSFI. During this inspection, the team reviewed the licensee's EDSFI report and selected questions and answers from that inspection. In addition, the team also selected areas that they considered important to safety for detailed reviews, using techniques and past experience developed during previous EDSFis.
The team's review covered portions of onsite and off site electrical power sources and included the 13.8 kV buses, station auxiliary transformers, 4.16 kV power system, emergency diesel generators, 480V Class lE buses and motor control centers, station batteries, battery chargers, inverters, 125 Vdc Class lE buses, and the 120 Vac Class lE vital distribution system.
The team verified the adequacy of the emergency onsite and offsite sources for the EDS equipment by reviewing regulation of power to essential loads, protection for calculated fault currents, and circuit independence. The team also assessed the adequacy of those mechanical systems that interface with and support the EDS. These included the air start, lube oil, and cooling systems for the emergency diesel generator and the cooling and heating systems for the electrical distribution equipment.
A physical examination of the EDS equipment verified its configuration and ratings and included original installations as well as equipment installed through modifications. In addition, the team reviewed maintenance and surveillance activities for selected EDS components.
2
In addition to the above, the team verified general conformance with General Design Criteria (GDC) 17 and 18, and appropriate criteria of Appendix B to 10 CFR Part 50. The team also reviewed the plant technical specifications, the Updated Final Safety Analysis Report, and appropriate safety evaluation reports to ensure that technical requirements and licensee's commitments were being met.
This inspection also included review of the August 19, 1993, event on the 125V vital battery lC (the cell voltage dropped below the technical specifications limit).
The details of specific areas reviewed, the team's findings, and the applicable conclusions are described in Sections 2.0 through 6.0 of this report.
2.0 ELECTRICAL SYSTEMS
The team reviewed Section 2.0 of the licensee-performed EDSFI and the inspection findings in these areas. The scope of their inspection was similar to an NRC EDSFI. Significant issues identified by the licensee in these areas included:
1) I3.8 to 4.16 kV station power transformers operating in an overloaded condition;
2) 4.16 kV system degraded grid voltage could cause insufficient voltage at motor terminals;
3) Minimal diesel generator capacity for future load growth;
4) 4.16 kV system breaker momentary rating has minimal margin against a short circuit fault; and
5) No design criteria for 115 Vac system cable ampacity.
Additional details of this review are discussed in Section 5.0 of this report.
The team also reviewed a sample of the key features and components of the Class lE electrical distribution system (EDS). The areas included in this review were:
I) EDS design: Class IE load analysis and load flow; cable sizing and voltage drop studies; first and second levels of degraded voltage protection; residual voltage transfer schemes of the Class IE buses; Class IE 480 Vac, 240 Vac, 115 Vac systems; I25 Vdc, and 28 Vdc systems;
2) EDS equipment ratings: including motor ratings; 4160/480/240V transformer ratings; vital bus inverter ratings; 125 Vdc and 28 Vdc batteries and battery chargers; de switchgear and de motor control centers;
.. 3
3) EDG loading: EDG load sequencing; load shedding and protection schemes; steady-state and transient load profiles under normal and abnormal operating conditions; and
4) Cable sizing and voltage drop during motor running and starting.
2.1 Offsite Power and Grid Configuration
The electric power outputs of Salem main generators were rated for 1100 MV A each. The 25 kV output power is stepped up via the main generator transformer to the station 500 kV switchyard where there are three transmission lines feeding into the New Freedom and Deans Substations and to the Hope Creek 500 kV switchyard, which eventually connect to the Pennsylvania-New Jersey-Maryland (PJM) 500 kV transmission power grid.
The offsite power supply for the plant is fed through the 500 kV system via the 13.8 kV bus. Each Salem unit is separately fed by two station power transformers (SPT) of 25 MV A each. Each unit has three independent 4160V vital buses; normally, two vital buses are fed by one SPT, and the third bus is fed by the other SPT.
The team noted that the licensee planned a major modification to the Salem offsite power supply system, and the 10 CPR 50.59 Review and Safety Evaluation of this modification were documented in NC.NA-AP .ZZ-0059(Q). The scheduled completion date for Unit 1 is the end of 1993, and for Unit 2, the end of 1994.
This modification is expected to separate Unit 1 vital bus 4160V in-feeds from station power transformers 11 and 12 and connect them to two new station power transformers. A complete review of this change was excluded from this inspection.
2.2 Bus Alignments During Start-up, Normal, Abnormal, and Shutdown Operations
The station 4160V electrical distribution system is divided into four nonclass lE bus sections and three vital bus sections. During normal plant operations, the nonclass lE loads were powered by the auxiliary power transformer, and all the vital Class lE loads are powered by the station power transformers (SPTs). During plant shutdown and start-up, both nonclass IE and Class IE loads are powered by the 13.8 kV bus via two SPTs.
Each Salem unit had three independent vital buses, designated as Channels A, B, and C. Each channel had its own emergency diesel generator, which provides an emergency power supply during a loss of power condition. Two channels are required to provide power for a safe shutdown following accident conditions.
4
Each 4160V vital bus provides power to its 480V and 240V power transformers. There was no interconnection between the redundant 480V or 240V vital buses. Control power of each . channel was provided by its own 125 Vdc, or 28 Vdc, and 115 Vac control power buses. The team noted that there were a number these 125 Vdc, 28 Vdc, 115 Vac, class lE, and nonclass lE buses that had feeder breakers connected to more than one 4160V channel. Some of them had mechanical interlocks, and the others were controlled by administrative procedures.
Within the scope of this review, no unacceptable conditions were identified.
2.3 Bus Transfer Schemes
2.3.1 Effect of Nonvital Bus Transfer on Vital Buses
The nonclass lE buses are powered by the 13.8/4 kV station power transformers during start-up and shutdown. After the generator is synchronized to the 500 kV system, the nonvital buses are manually transferred to the 25/4 kV auxiliary power transformer. When the unit generator trips, all 4160V nonvital buses automatically transferred from the auxiliary power transformer to the station power transformer. This transfer scheme does not transfer any vital 4 kV bus from one source to the other, and the nonvital bus transfer has little voltage transient effect on the vital buses. Furthermore, the future switchyard arrangement as a part of the upcoming modification would further separate the nonvital buses from the vital buses. The nonvital bus fast transfer scheme should have even less effect on the voltage transient of the vital buses. The team did not identify any voltage problem on the vital buses as a result of this nonclass IE bus transfer.
2.3.2 Vital Bus Transfer Scheme
During normal operations, two of the vital buses are supplied from one SPT, and the third vital bus is fed from the other SPT. The in-feed breakers on each vital bus from the two station power transformers are electrically interlocked to prevent paralleling both sources through the vital bus. These in-feed breakers provide means for transferring between sources in the event of an interruption of power from one source. This residual-voltage-transfer scheme is initiated by the undervoltage detection at the low voltage side of the 13.8/4 kV transformer, the undervoltage relay was set at 70% with about 0.5 seconds inherent relay time delay. There was only one undervoltage measurement at the low voltage side of each SPT.
The first level degraded-voltage relay was also set at 70% of nominal voltage with about 2.5 seconds inherent relay time delay, but this degraded-voltage relay monitors the voltage on the vital bus. There are three relays for three buses (one per vital bus), and 2 out of 3 logic is used to initiate this first level degraded-voltage protection.
5
If the alternate SPT is not available, the bus loss-of-voltage detection scheme and the Safeguards Emergency Loading Sequencer Control logic is designed to trip all vital loads connected to the bus, and start the EDG. After the EDG is up to voltage and frequency, the· Safeguards Emergency Loading Sequencer Control logic will reconnect all the vital loads onto the bus according to their predetermined sequence.
The team noted the bus residual.:..voltage transfer permissive relay was set at 35 % of nominal voltage. After opening the normal supply breaker, it would take 0.5 to 1.0 second for the bus voltage to decay to 35 % voltage. To achieve a successful residual-voltage transfer of th~ 4 kV vital bus from one SPT supply to the other SPT supply, the design was based on a 70% voltage recovery in 1 to.2 seconds. In conjunction with the degraded voltage protection scheme, the team noted that on loss of a SPT supplying two vital buses and, if the bus voltage recovering back to 70% of nominal was longer than 2.5 seconds, it would cause a total loss of all offsite power to all three vital buses. The licensee did not have a detailed analysis on this scenario, nor a formal test to verify the recovery voltage timing.
The licensee stated that they had performed tests involving a single bus, but did not test the full transfer scheme involving two buses to verify the design logic. However, there was a two-vital-bus-residual-voltage transfer that occurred in 1991 due to an operator error. The transfer was successful; the recovery voltage on the vital bus back to 70 % was less than the 70% undervoltage relay inherent time delay, i.e., about 2.5 seconds. The licensee stated that testing the design logic (involving undervoltage on two buses) required both Salem units to be shutdown and could cause a voltage transient in the switchyard. Since the worst case would be to cause a healthy source to be abandoned, resulting in transferring all safety loads to the EDGs, the team agreed that there were no safety concerns in this issue. However, the team considered this issue to be an observation.
2.4 4160 Class lE System
Each Class IE 4160V bus (channel) was designed to provide power to the 480V system and to the 240V system via two dry-type transformers. The 4160V/480V transformer was rated for 750/1000 kVA for Channels A and B, and was rated for 1000/1333 kVA for channel C. The 4160V/240V transformer was rated for 330 kVA for each channel. The maximum loading following a LOCA on the 4160V I 480V transformer was about 780 kV A and at about 0.88 power factor. The maximum loading following a LOCA on the 4160V/240V transformer was about 350 kVA and at about 0.88 power factor. Although, such a demand could last for one to two hours; it falls within the capability of the transformers. The team did not identify any sizing problem on the 480V transformers.
6
The team noted that two transformers of each channel were fed by the same breaker at the 4 kV bus. These two transformers would not be electrically independent, and each of them· is susceptibie to unnecessary high switching voltage surges generated by the other · transformer. This voltage surge could exceed the Basic Insulation Level (BIL) of these transformers (25 kV at the 4 kV side and 10 kV at the low voltage side). There was no surge protection on the 4 kV vital buses, and no voltage surge study.
The licensee stated that there were four failures on the nonclass lE transformers and one failure on the vital transformer between 1990 and 1992. As a result of an analysis, the licensee determined that there was a lack of layer insulation between the high voltage winding layers 3 and 4, and planned to replace both the vital and nonvital transformers with higher BIL transformers. The replacement would have 60 kV and 20 kV BIL, respectively on the high and low voltage sides of the transformers. This item is unresolved pending Class lE transformer replacement and NRC verification (50-272/93-82-01; 50-311/93-82-01).
The team also reviewed the sizing of the 4 kV Class lE safety injection pump motor, containment spray pump motor, service water pump motor, residual heat removal pump motor, and component cooling service water pump motor. The team considered these motors to be properly sized.
2.5 Emergency Diesel Generator Loading
The emergency diesel generator (EDG) design data were as follows:
The team reviewed the loading demands of the EDG under various postulated design basis events. The worst EDG loading given in the licensee's EDG loading calculation was EDG 2A in case B, LOCA plus loss of offsite power (LOOP) scenario. The EDG loading for the first 20 minutes was about 2814 kW and followed by 2841 kW for the remaining 1 hour 40 minutes, with power factor about 0. 88 lagging. This loading was just within the EDG 2-hour rating of 2860 kW; the team did not see any spare capacity for any future load increases. The team noted the following deficiencies in the calculation:
a. the calculation did not include all the intermittent loads, e.g., motor-operated valves (MOVs), which could be running during the first two hours following a postulated accident;
b. the calculation did not include all the small motor loads, which were controlled by their process signals. These loads are: service water sump pumps (SWSP), EDG starting air compressors (EDG SAC), and RHR sump pumps (RHRSP);
7
c. the load of the 115 Vac inverter, which supplies power to the instrument buses, was assumed to be 110% of the walkdown readings of the inverters. There was no basis to support that these figures were the worst case inverter loadings during the accident condition; and
d. the EDG load calculation did not consider load variation due to voltage and frequency variations.
The licensee agreed to revise and finalize the EDG loading calcufation to include the above four items. This issue is unresolved pending NRC review of the finalized calculation (50-272/93-82-02; 50-31.1/93-82-02).
The team estimated that the total loading including all the above four items would be less than the 30 minute rating of 3100 kW. There was some oonservatism in estimating the 4160V major process motor loads, as discussed in paragraph 3.1, and on the input power to the de battery chargers. The team noted that the EDG had been tested up to about 2950 kW for 2 hours during the surveillance tests. Therefore, the team did not consider the EDG loading to be an immediate safety concern.
In examining the starting transient voltage and frequency traces of the surveillance test results on the Unit 2 EDGs, the team noted the frequency transient fell below the 95% minimum value recommended by Regulatory Guide (RG) 1.9. However, the licensee did not fully commit to RG 1.9. The transient voltage was above the 75% minimum value recommended by RG 1.9. In addition, the licensee provided the team with copies of the EDG surveillance test records on Unit 2 EDGs. The team compared the above test results with the load demand kW and kvar profile during EDG sequencing, and estimated that the EDG would be capable of picking up the Class IE loads as required. The license agreed to perform the auto-sequencing test of the Unit 1 EDGs in the next refueling outage surveillance test to demonstrate that the transient voltage and frequency profiles are within the acceptable limit. This item is unresolved pending NRC review of the test results (50-272/93-82-16).
2.6 Degraded Voltage on Class lE Buses
2.6.1 Second Level Degraded Voltage Protection
On vital bus degraded voltage, the isolation of the offsite power from the vital bus is accomplished by tripping the incoming offsite source breakers to the vital 4160V Class lE buses. The degraded voltage protection was provided in two voltage levels at the vital 4160V bus, i.e., 70% of nominal voltage for approximately 2.5 seconds, and 91.6% of nominal voltage for 13 seconds.
8
The second level degraded voltage relays were set at 91.6% of the 4160V with a 13 second time delay allowing for a voltage transient on the bus due to motor starting or a system . disturbance. There were three sets of degraded voltage relays on each vital 4160V bus. It required 2 out of 3 logic to confirm the second level degraded voltage condition. Upon receiving this degraded voltage signal, the safeguards equipment control (SEC) logic would trip all the breakers on the 4160V bus and selected loads at the 480V and 240V levels. After power was restored back to the vital bus by the EDG, the safeguards emergency loading sequencer logic would sequentially start the safety loads in a predetermined order on the 4160V bus, the 480V and 240V buses. ·
In Licensee Event Report (LER) 50-272/93-14, dated August 20, 1993, the licensee informed the NRC that while the 4160V bus was at 91.6% voltage, there would be insufficient voltage for some Class lE equipment at a lower voltage level to perform their safety functions. This was based on the assumption that the on-load tap changer of the SPT did not change position during and following the accident. The licensee determined that 93.2 % (3877V) was the minimum required voltage for the vital 4160V bus and used administrative controls to ensure that minimum voltage was maintained. The licensee did not change the setting of the second level degraded voltage relays; instead the voltage was checked every hour.
The licensee later determined that even with 3877V on the 4160V vital bus, there were several ac and de circuits that could not meet the general voltage acceptance criteria of -10 % voltage during running and -20% voltage during starting. The licensee identified all these circuits and evaluated them individually to be acceptable. The team reviewed the following three reports, and found them acceptable. The reports were: (1) S-C-230-EEE-0790-2, "Engineering Evaluation of Motor Starting and Running During a LOCA Initiated Block Motor Start;" (2) S-C-125-EEE-0275-0, "Engineering Evaluation of the Safety-Related 125 Vdc Electrical Circuits with Undervoltage Conditions for Salem Generating Station;" and (3) S-C-280-EEE-0271-0, "Engineering Evaluation to Verify Adequacy of 28 Vdc System Study - Batteries lA, lB, 2A, 2B - Utilized in Salem Generating Stations Units 1 and 2."
To have all components meet the general voltage acceptance criteria during running and starting, the licensee raised the second level degraded voltage setpoint to 94.6% (3935V). The licensee stated that the relay setpoint changes would be implemented during the next refueling outage and after the completion of the 500 kV switchyard modification.
The team identified that the current EDG surveillance test procedure and Unit 2 technical specifications allowed the EDG to operate at a steady state at as low as 90 % voltage (3744V), which is lower than the degraded voltage setpoint. The licensee agreed to revise the surveillance test procedure and request a change to the technical specifications. The team examined the past test results (s2.0P.ST.SSP-0003(Q) for EDG 2B, and s2.0P.ST.SSP-0004(Q) for EDG 2C) and found the steady-state voltage of the EDG had been consistently
9
maintained above the 95 % level, i.e., higher than 3952V. The Unit 1 technical specifications did not specify any limit on the EDG running voltage. This item is unresolved_ pending NRC review of licensee's revision of EDG test procedures (50-272/93-82-03; 50-311/93-82-03).
The team noted that the licensee specified the upper operating voltage limit of the 4160V vital bus to be 4500V. However, the licensee did not address the high voltage effect on the motor and control logic relays when the 4160V vital bus was at 4500V. The motors and control circuits could be exposed to higher than rated voltage; and, as a result, the equipment could be overloaded.
In reviewing the walkdown records enclosed in the EDG loading calculation, the team noticed that there were two 230V rated motors (Service Water Building Ventilation fan lA and 1 C) at 248V and at 115 % of the rated horse power. When the bus was at its upper limit of 4500V, the terminal voltage of these two motors could be higher than 248V, and the fanmotor load could be even higher than 115% of rated HP. The licensee agreed to review the overvoltage situation and would include an over voltage evaluation in the degraded voltage study. This item is unresolved pending NRC review of licensee's evaluation of the high voltage effect (50-272/93-82-04; 50-311/93-82-04).
2.6.2 First Level Degraded Voltage Protection
The first level of degraded voltage protection was initiated by the undervoltage detection scheme on the 4160V vital bus, and the voltage setpoint was 70% with about 2.5 seconds inherent relay time delay. There was only one undervoltage measurement per bus (channel); and it required 2 out of 3 voting undervoltage measurements to initiate this degraded voltage protection scheme. More discussion of this protection scheme is discussed in paragraph 2.3.2.
2.7 480V and 240 Vac Class lE Systems
The low voltage ac distribution system at Salem has three 480V vital buses and three 240V vital buses; they correspond to the 4160V vital buses and were designated as channels A, B, and C. The 480V system feeds most motors from 20 HP to 300 HP. The 240V system feeds smaller loads and all the rectifier loads to the 125V and 28 V de systems and to the 115 Vac instrument power systems via the inverters.
The team noted both 480V and 240V vital transformers were controlled by a single 4 kV supply breaker. To ensure the transformers were properly protected, the team reviewed the overcurrent protection scheme of the transformer supply breaker. Each transformer has its own overcurrent protection current transformers and overcurrent relays; and, in case the transformer was overloaded, the respective overcurrent scheme would independently send a trip signal to the 4160V supply breaker. The team found the 4160V/480V transformer overcurrent protection was set at 300 % . The protection scheme would trip the transformer
I. I
-
10
supply breaker for current at 300% or higher (due to tolerance of the relay). This protection scheme did not fully cover the full range of the transformer damage curve. The transformer. was not protected for any overcurrent below 300% of full load current. Furthermore, the operator had no means to know that the transformer was overloaded because there was no current measurement at the 4160V side nor at the 480V side of the transformer, on the bus or in the control room. In case such a failure occurred, the fault would not be isolated in time. Eventually, this fault would be isolated when it developed into a severe fault with fault current higher than 300%. It was the team's concern that transformer overloading could cause severe damage to or fire hazard in the 4160V switchgear cubicle. where the transformer: was located. The licensee agreed to evaluate this issue to determine whether the 300% setting should be revised. or other appropriate .corrective actions should be taken. This issue is unresolved pending NRC review of licensee's evaluation or corrective actions (50-272/93-82-05; 50-311/93-82-05).
The team selected the containment fan cooling unit (CFCU), containment sump to R.H. pump suction valves as a sample to verify the acceptability of the 480V system cable sizing, voltage drop, and motor terminal voltage. The team did not identify any unacceptable condition in this review.
2.8 115V Class lE System
There were four 10 kV A, 115 Vac vital instrument buses receiving power from individual uninterruptible power supplies (UPS) to form redundant channels for reactor control and protection, and instrumentation of safety-related equipment. Two 115 Vac vital instrument buses are powered from the channel A and channel C 240 Vac vital buses, the remaining two buses are powered from the channel B 240 Vac vital bus. Each vital instrument bus UPS rectifier normally received vital 240 Vac power which is converted to de power and then converted back to 115 Vac power. In the event of a 240 Vac power loss or an UPS rectifier malfunction, the 125 Vdc vital station battery power would automatically supply power to the UPS inverter.
The team reviewed the UPS purchase specification (No. 18310-E035A, dated November 4, 1988). Paragraph 3.6.3. of this document specified that the total output voltage harmonic content should not exceed 5 % of the fundamental voltage. Nonlinear load applied to the instrument bus could affect the amount of harmonic distortion. The licensee stated that the total output voltage harmonic content was never verified after installation. Recent inspections by the NRC on other sites that had the same requirement (5 % ) indicated that this value exceeded 10% because of nonlinear load applied to the output. The licensee agreed to verify this value; and, if the measured value exceeds the specified value, evaluate the adverse effect on safety-related instrumentation. This item is unresolved pending NRC review of the licensee's evaluation (50-272/93-82-06; 50-311/93-82-06).
11
2.9 125 V de and 28 V de C~ lE Systems
Each Salem unit Class lE de system consisted of three 125 V de Class lE batteries, each battery was rated 2320 AH for 8 hours, and two 28 Vdc Class lE batteries, each rated 825 AH for 8 hours. Both the 125V and the 28 Vdc were designed for a load duty cycle of 2 · hours following a LOCA and LOOP, and of 4 hours during a station blackout.
One normal supply battery charger and one backup battery charger were connected to each de bus. The input power supplies to these two battery chargers are from two different channels. Drawing 211357 B 9511-6 showed that battery lA could be powered by either 240V, lA channel or by.240V, IC channel; battery IB could be powered by either 240V, lB channel or 240V, IC channel. The licensee relies on administrative controls to prevent both battery chargers from feeding to the same bus. Unit 2 technical specifications prohibit the battery being charged by the charger from a different channel during normal plant operations, but Unit I technical specifications did not provide such a restriction. The. team was told that the licensee had requested a revision to Unit I technical specification to include such a restriction.
The team reviewed the battery charger sizing calculation and the battery sizing calculation and did not ideµtify any design problems. The team also reviewed the information of the fuse used in the 125 Vdc system, and the fuse used in the 28 Vdc system. Both interrupting capacities were higher than the short circuit fault current available in the 125V and 28 V de systems. The team determined ·that these fuses were adequately sized. . .
On a sample basis, the team selected circuits #8, #24, and #13 of IAADC-I25 Vdc distribution cabinet to review the voltage drop and end component terminal voltage. The team did not identify any design problem in this review.
2.10 Conclusion
The team concluded that the design of the ac and de systems was acceptable and conformed to the technical specifications and UFSAR and that the EDS components were adequately sized and configured. Seven unresolved items were identified by the team in electrical design areas: (I) EDG loading calculations to be revised; (2) EDG output voltage range to be revised; (3) Class IE 480V transformers overload protection setting too high; (4) Class lE 480V and 230V transformers connected in parallel, resulting voltage surge higher than insulation rating of the transformers; (5) Effects of high voltage on safety-related motors and control logic relays to be evaluated; (6) the total harmonic distortion of the instrument bus inverter output voltage to be verified; and (7) the EDG transient loading test to be verified. On the other hand, the team considered the station power transformers (13.8/4.16 kV) with on-load tap changers to be a good engineering feature because they continuously regulate the voltage of the 4160V buses. This feature enhanced the reliability of the Class lE system.
12
3.0 MECHANICAL SYSTEMS
To verify the loading on the emergency diesel generators, the team reviewed the power demands of major loads for selected pumps and the translation of mechanical into electrical loads as input into the design basis calculations. The team also conducted a walkdown of the supporting mechanical systems, including the diesel generator cooling water system, the starting air system, the lube oil system, and the heating, ventilation and air conditioning (HV AC) systems for the EDG rooms, the ac and de switchgear areas and battery rooms.
3.1 Power Demands for Major Loads
The team reviewed the power demands for the major pump motors on the emergency diesel generators (EDG) following a loss of coolant accident (LOCA) plus a loss of offsite power condition. This review was based on the information provided in the licensee's self assessment and review of the design calculations, procedures, studies and memoranda. A summary of the team's findings is given below.
• In EDG load Calculation ES-9.002, Rev. 1, the licensee conservatively assumed maximum (run-out) flow rates (for large break LOCA) coupled with maximum duration of 2-hours (for intermediate size break LOCA) for the safety injection load. This assumption resulted in higher EDG loading in their calculation. This conservatism was also discussed in Paragraph 2.5.
• Some of the major pump motor loads identified in Table 8.3.2 of the UFSAR were lower than the ones used in the EDG load calculation. The licensee stated that the data given in the UFSAR were incorrect and had prepared a 50.59 and FSAR Change Notice No. CN-93-22 to address this discrepancy and incorporate the up-to-date values in the next revision of the UFSAR.
• The calculated brake horse power loads for some of the major pump motors were in excess of their rating. The highest service factor from all of the reviewed motors was 111 % . Review of the licensee environmental qualification (EQ) files revealed that the motors in question were qualified up to a service factor of 115 % , which enveloped 111 %.
3.2 Diesel Generator and Auxiliary Systems
The team reviewed the licensee's calculations, procedures, and drawings to determine the design adequacy of the diesel generators and auxiliary systems. A summary of the team's findings is given below.
13
Each Salem unit has three EDGs. Each EDG has its own day tank sized to hold 550 gallons of fuel oil, which assures the minimum (technical specifications) volume of 130 gallons. Two fuel oil transfer pumps per unit are used to transfer fuel oil to the diesel day tanks from two 30,000 gallon storage tanks. Each storage tank provides the minimum (technical specifications) volume of 20,000 gallons. Salem Generating Station is also provided with a single 20,000 barrel tank that has a gravity feed connection to the Units 1 and 2 storage tanks. However, this portion of the fuel storage and transfer system is classified as nonsafety-related and nonseismically-qualified and was not taken credit for mitigating accident conditions.
The UFSAR, Section 9.5.4, stated that each 30,000 gallon fuel oil storage tank could supply one diesel with enough oil to run it for seven days at full load. To verify this commitment the team reviewed the following documents:
2. Emergency Diesel Generator Fuel Oil Consumption Evaluation for a Seismic-Induced Loss of Offsite Power - Salem Units 1 & 2, No. S-C-DF-MEE-0800-0, Rev. 0.
5. Memorandum To: J. Baily from F. X. Thomson, dated September 4, 1992, Subject: Use of Salem Bulk Fuel Storage EDG Fuel Storage Requirements.
6. Salem Unit 1/2 Operations Procedure No. SC.OP-DD.ZZ-OD26(Z), Rev. 4, Operations . Log 6 - Primary Plant Log.
The review of these documents led to a conclusion that the 30, 000 gallon fuel oil storage tank could not supply one diesel with enough oil to run it for seven days at full load. The actual duration for which one storage tank could supply one diesel to run at full load was not determined since the licensee's analysis took credit for the fuel available in the nonsafetyrelated 20,000 barrel storage tank to comply with the seven day commitment. This problem was further exacerbated by the erroneous and/ or nonconservative assumptions made in the calculations which form the basis of the analysis. This failure to meet the UFSAR commitment is a deviation (50-272/93-82-07; 50-311/93-82-07). This item was identified by the licensee and documented in their EDSFI, Item No. 7.
14
The tank volume curve calculation (document 3 above), which provided conversion of tank volume to tank height, failed to account for the unusable volume (vortex, imperfection of fabrication and installation, etc.) and level instrument error. Since this calculation also applied to other 28 tanks for both units, the licensee agreed to review the calculation to ensure that unusable volume and level instrument error were considered in obtaining the total usable volume for those tanks. This item is unresolved pending NRC review of licensee corrective actions (50-272/93-82-08; 50-311/93-82-08).
The team reviewed the design of the EDG with respect to tornado missile protection. Appendix 3A of the UFSAR indicated that Unit 2 complied with the requirements of the Regulatory Guide 1.117 - Tornado Design Classification. This regulatory guide designated the EDG as "structures, systems, and components ... to be protected against tornadoes" (Item 13 of Appendix). This regulatory guide further stated that, "protection of designated structures, systems, and components may generally be acc0mplished by designing of protective barriers to preclude the tornado damage ... If protective barriers are not installed, the structures, systems, and components themselves should be designed to withstand the effects of the tornado including tornado missile strikes." The review of the design and interviews of the licensee's staff indicated that for Unit 2 EDG combustion air exhaust pipe and intake louvers were capable to withstand the effects of the negative pressure associated with the tornado. However, the Unit 2 EDG combustion air exhaust pipe and intake louvers were not protected against the tornado-generated missiles, nor were they capable to withstand the effects of these missiles. The team concluded that failure to meet the UFSAR commitment for Unit 2 constituted a deviation (50-311/93-82-09).
3.3 Heating, Ventilation, and Air Conditioning (HV AC) Systems
The team reviewed the design of various HV AC subsystems that were part of the control room and control area HV AC system, the EDG area ventilation system, and the switchgear and penetration area ventilation system. The documents used for this review were the licensee's calculations, procedures, drawings, and the results of the self-conducted EDSFI. A summary of the team's findings is given below.
Section 9.4.6.1 of the UFSAR stated that the switchgear and penetration area ventilation system (SPA VS) is designed to maintain a temperature range of 65°F to 105°F year round for those areas served. The team review of the licensee's design information (available prior to the commencement of the EDSFI) led to the conclusion that the existing design documents do not support compliance with this commitment. The only calculations related to SPA VS (S-1-CAV-MDC-0678 and S-2-CAV-MDC-0696) were still in draft. However, these calculations indicated that SP A VS temperatures during the accident could be as high as 118 °F. The licensee maintained that these calculations (performed by a contractor) were unrealistically conservative, and the actual temperatures were significantly lower and wou~d be within the design commitments.
15
To support this position, the licensee performed temperature monitoring of the SPA VS during the second part of the week of August 16 and weeks of August 23 and 30. The temperatures were measured at 1 hour intervals to account for impact of concrete walls on the heat addition or absorption. The measured peak temperature was 99°F which took place during the week of August 23 in 84' Switchgear area. This was recorded on a design day (95°F outdoor temperature). The impact of the heat load difference between normal and accident operations in this area is estimated to be 5.2°F. The accuracy of the above measurements was compared with calibrated digital pyrometers. The noted deviation of the above was 0.5°F. Hence, the licensee estimated that the temperature during an accident in this area will be below 105 °F.
The team reviewed this evaluation and concluded that the equipment in the switchgear areas would be operable, considering that the ambient temperatures were expected to be below the design ambient temperature of 95°F in the coming months. The licensee made a commitment to complete the calculations, analytical/design evaluation, etc., prior to the month of May 1994 (before the onset of high sustained outdoor temperatures). Pending the NRC' s review of the subject calculations and evaluations, this is an unresolved item (50-272/93-82-1 O; 50-311/93-82-10).
The team also reviewed the impact of a tornado on the HV AC supply and exhaust ducts in the EDG and EDG control rooms. The team found that: (1) The HVAC supply and exhaust ducts in the EDG and EDG control rooms were protected from the impact of the tornado generated missiles; (2) The negative pressure associated with the tornado had no impact on the EDG HV AC, since there was no sheet metal ventilation duct to and from EDG rooms; and (3) The negative pressure induced by a tornado might collapse the ventilation duct of the EDG control room HV AC. At the team's request, the licensee evaluated the impact of this collapse and concluded that the flow path would not be completely blocked after the collapse, and the required flow of 279 cfm should be available through the damaged duct, considering that the measured air flow rate is 929 cfm. The team agreed with this conclusion.
3.4 Conclusions
The team's review of the design attributes within the scope of this inspection concluded that the mechanical systems supporting the EDG and other electrical equipment are capable of performing their design functions. Some of the information was not readily available to determine the operability of the systems. Two deviations and two unresolved items were identified:
1. Fuel oil storage for 7-day EDG operations did not meet the UFSAR commitment.
2. Tornado missile protection for the Unit 2 EDG combustion air intake and exhaust structures did not meet the UFSAR commitment.
16
3. The ability of the HV AC for the switchgear and penetration area ventilation system to maintain a temperature range of 65°F to 105°F year round for those areas served as committed in Section 9.4.6.1 of the UFSAR is unresolved.
4. The impact of the calculation No. S-C-V AR-CDC-095, Rev. 1, on the tank levels with respect to technical specifications and other licensing commitments is unresolved.
4.0 ELECTRICAL DISTRIBUTION SYSTEM EQUIPMENT
The scope of this inspection element was to assess effectiveness of the controls established to ensure that the design bases for the electrical system was properly tested and maintained. This effort was accomplished through the review of the results of the licensee's selfconducted EDSFI, field walkdown and verification of the as-built configuration of electrical equipment as specified in the electrical single-line diagrams, modification packages, and site procedures. In addition, the maintenance and test programs developed for electrical system components were also reviewed to determine their technical adequacy.
4.1 Equipment Walkdowns
The team inspected various areas of the plant to verify the as-built configuration of the installed equipment. Areas inspected included the emergency diesel generators (EDG), EDG control rooms, 4 kV switchgears, batteries, inverters, and 480V load centers. Class lE transformers were also examined.
The walkdown indicated that adequate measures were in place to control system configuration. All electrical equipment was found to be generally well maintained with surrounding areas clear of the safety hazards with the exception of the following concerns.
During the walkdown on August 16, 1993, the team observed that the nonsafety-related MG sets were located in the area which houses all three 4 kV vital buses. The team expressed concern that MG set flywheel failure could disable two out of three 4 kV vital buses. Two vital buses were required to achieve safe shutdown. The licensee did not have information to address this concern. The licensee agreed to perform an evaluation/study to address this issue. Pending the NRC's review of licensee corrective actions, this item is an unresolved (50-272/93-82-11; 50-311/93-82-11).
During the walkdown on August 16, 1993, the team observed, in the switchgear areas, malfunctioning temperature gages and ammeters, and mislabeled and unlabeled voltmeters. Some of these gages had not been functioning for a long time. Although these gages were not safety-related, they provided information regarding the status and condition of safetyrelated electrical equipment. The team considered this to be an observation.
17
In general, the electrical equipment installed adhered to the design requirements. The walkdown indicated that adequate measures were in place to effectively control the system configuration with the exception of the unresolved item related to the MG set and the housekeeping observation.
4.2 Electrical Equipment Maintenance and Testing
The team reviewed the results of the licensee's self-conducted EDSFI, various maintenance and testing procedures for equipment such as the emergency diesel generator, batteries, battery chargers, 4 kV switchgear, molded case circuit breakers, and protective relays. Licensee personnel were· interviewed to assess their understanding of the testing and maintenance programs. The team observations are described below.
4.2.1 Emergency Diesel Generator
' Periodic surveillance testing of the emergency diesel generators (EDG) was conducted to assure their operational availability and capacity to perform their shutdown functions. The technical specifications (TS) for Units 1 & 2, Sections 4.8.1.1.2.a.1 through 4 provided monthly test requirements for each EDG to demonstrate operational readiness. These requirements were implemented by the monthly surveillance tests. The TS Sections 4.8.1.1.2.b.1 through 5 (Unit 1) and 4.8.1.1.2.c.l through 9 (Unit 2) provided 18-month test requirements for each EDG to demonstrate operational readiness. These requirements were implemented by the 18-month tests.
The team reviewed monthly surveillance test procedures and 18-month test procedures and several completed monthly and 18-month surveillance tests. The team concluded that the test procedures included adequate acceptance criteria that were consistent with the TS requirements. Review of completed test records indicated that these test were conducted in accordance with the test procedures.
The 18-month test procedure for Unit 2 EDG specified an EDG load equal to or greater than . its 2 hour rating of 2860 kW for at least 2 hours. The team reviewed the test data of two 18-month (endurance) tests of EDG 2A. The test data indicated that the EDG was loaded consistently between 2920 and 2950 kW for two hours in each test. This issue was discussed with the licensee. The licensee's position on this issue was as follows. The temperature and. other variables observed during these tests were well within the normal operating range. The inspections, which took place 18 months after an endurance test, did not reveal any unexpected wear to the diesel engine parts that would be expected to indicate wear. Additionally, the licensee contacted the EDG vendor concerning the consequences of these tests. On October 27, 1993, the licensee called to inform the team that preliminary analysis, by the vendor, of the test data indicated no damage to the EDGs. The licensee was also considering a revision of the technical specification requirements and the test procedures implementing these requirements. Pending the NRC's review of the provided information and/or corrective actions by the licensee, this item is unresolved (50-311/93-82-12).
18
4.2.2 Station Batteries
The team reviewed the testing program of the station batteries to assure that adequate de power was available to operate the de equipment. There were three 125 V de and three 28 Vdc safety-related batteries. The team reviewed 18-month and 60-month test procedures for each battery type and their test results to assure that they meet the surveillance requirements stated in technical ·specifications, Sections 4.8.2.3.2 and 4.8.2.5.2. The team concluded that the test procedures included adequate acceptance criteria that were consistent with the TS requirements. Review of completed test records indicated that these tests were conducted in accordance with the test procedures. The team concluded that the 18-month and 60-month tests for 125 Vdc and 28 Vdc batteries at Salem Generating Station were properly implemented.
4.2.3 Circuit Breakers
The team reviewed the maintenance and test program of 4 kV circuit breakers and determined that Salem had an acceptable program for the 4 kV breakers.
The team also reviewed licensee maintenance and test program of molded case circuit breakers (MCCB). The team noted that the licensee performed routine maintenance and mechanical trip (manual operation) of the MCCBs as described in Station Procedure SC.MDST.22-0005(Q), "MCCB Maintenance," for all safety-related MCCBs. The licensee also performed periodic testing (thermal and magnetic trip tests) of containment penetration MCCBs, as required by the technical specifications. Station Procedure SC.MD-ST.22-0004(Q), "Containment Penetration MCCB Test, 11 was prepared for these tests. Other safety-related MCCBs did not receive periodic current-testing. The team noted that many of the safety-related MCCBs were also used as isolation devices, separating safety-related buses from nonsafety-related loads. If these MCCBs do not trip as required, a fault in the nonsafety-related load may cause the feeder breaker to trip, thus losing the whole train, affecting operation of many safety-related loads. Many of the safety-related MCCBs had not been current-tested ever since they were installed during the construction stage more than 15 years ago. Recently, the NRC issued an Information Notice (IN 93-64, "Periodic Testing and Preventive Maintenance of MCCBs, 11 issued August 12, 1993) discussing MCCB failures during testing and addressing the necessity of periodic testing of MCCBs. The licensee agreed to evaluate the situation at Salem to determine their position regarding periodic test programs of MCCBs. This item is unresolved pending NRC review of licensee's evaluation (50-272/93-82-13; 50-311/9~-82-13).
19
4.3 Conclusions
Based on the review of the documents, the team concluded that the licensee had an acceptable maintenance and testing program for the electrical distribution system equipment at Salem. However, three unresolved items and one observation were identified in these areas: (1) the concern associated with the potential of the MG set flywheel failure to disable two out of three 4 kV vital buses; (2) the impact of testing the Unit 2 EDGs at a power output greater than its 2 hour rating (2860 kW) for 2 hours is unresolved; (3) the licensee's position regarding periodic test program of safety-related molded case circuit breakers; and ( 4) the team observed broken and uncalibrated temperature gages and ammeters, and mislabeled and unlabeled. voltmeters in the switchgear areas.
5.0 REVIEW OF LICENSEE SELF ASSESSMENT EDSFI
The team reviewed the licensee self assessment EDSFI report and selected questions to determine the adequacy of their inspection. The self assessment was conducted from September 14, 1992, to October 22, 1992. The team consisted of seven team members (one team leader, two electrical design engineers, one mechanical design engineer, one management inspector, one operation inspector, and one procedure compliance inspector) from Gilbert-Commonwealth and United Energy Service Corporation. A copy of the inspection plan was transmitted to the NRC for review before the inspection was conducted.
The licensee self assessment EDSFI covered electrical system design, mechanical system design, electrical equipment testing and maintenance, and engineering and technical support (E&TS) areas. The electrical system design covered offsite and onsite systems, including off site grid stability, bus alignments, voltage studies, emergency diesel generator (EOG) load calculations, and station batteries and battery chargers. The mechanical system design covered EDG auxiliary systems (fuel oil, cooling water, lubrication oil, and starting air systems), HV AC for switchgear room, EDG rooms, and battery rooms. It also covered hydrogen accumulation in the battery rooms. The electrical equipment testing and maintenance included maintenance and testing of EDGs, protective relays, circuit breakers and fuses, batteries and battery chargers. E&TS covered staffing, training, plant modifications, root cause analysis and corrective action program, self-assessment program and design discrepancy controls.
The licensee self assessment EDSFI team identified 16 potentially significant issues. Five of these issues were in the electrical design areas, five in the mechanical design area, three in the electrical equipment testing and maintenance, and three in E&TS. The corrective actions for eight of these issues were completed at the time of the NRC inspection. The corrective actions for the other eight issues were not yet completed. Some of these issues were significant, e.g., the 4160V degraded grid voltage issue. As a result of licensee actions to resolve the issue, the licensee identified that the existing degraded voltage setting of 91.6% was insufficient for operation of certain motors. The licensee decided to raise the degraded voltage setting at the 4160 vital bus to 94.6% (additional discussion of this item is given in
20
paragraph 2.6.1 of this report), and subsequently issued LER 50-272/93-14 on August 20, 1993. The actual changes of the relay setting will not be implemented until the next refueling outage. Another significant finding was the EDG fuel oil issue. The licensee's EDSFI team found that there was insufficient fuel for 7-day EDG operation to fulfill the FSAR commitment. For this finding, the licensee determined not to take any corrective actions because they considered the nonsafety-related 20,000 barrel fuel tank could be used to resolve this issue. More discussion of this issue is given in paragraph 3.2 of this report. In addition, there was a significant issue identified by the licensee EDSFI team, but was not on the potentially significant issue list because additional data were not available at that time. This pertained to the temperature in switchgear areas as discussed in paragraph 3. 3 of this report.
Based on this review, the team concluded that the licensee's EDSFI was adequate. It covered sufficient areas for a normal EDSFI. The number and significance of their findings indicated an appropriate level of detailed review. However, certain significant issues were missed. These included: 1) EDGs were tested with two-hour loads greater than the EDG two-hour rating; 2) EDG was not protected against tornado generated missile; 3) EDG test procedure allows output voltage to be below the degraded voltage setting; and 4) missiles generated by nonsafety-related MG set flywheel may damage two vital buses. These additional findings identified by the NRC, but not PSE&G, suggest that additional review depth could have been performed in the EOG-related and external event areas.
6.0 FOLLOW-UP OF EVENT ON 125V VITAL BATTERY
6.1 Background
On August 19, 1993, the quarterly surveillance test for the No. lC 125 Volt vital battery was performed per station work order 930819034 and Salem Maintenance Procedure SC.MDST.125-0003(Q), Rev. 4, "Quarterly Inspection And Preventive Maintenance of Units 1, 2 and 3 125V Station Batteries." Because of the test, the licensee found that cell No. 47 (one of 60 total cells in the lC 125V battery) failed to meet the acceptance criterion of a minimum of 2.13 volts for the individual cell terminal voltage.
Unit 1 Technical Specification 4.8.2.3.2 (b) requires, in part, that each 125-volt battery shall be demonstrated operable at least once per 92 days by verifying that the voltage of each connected cell is greater than or equal to 2.13 volts under float charge. Technical Specification Limiting Condition for Operation 3.8.2.3 requires that with one 125-volt D.C. battery and/or charger inoperable, restore the inoperable battery and/or charger to operable status within 2 hours or be in at least Hot Standby within the next 6 hours and in Cold Shutdown within the following 30 hours. According to these specifications, when cell No. 47 was determined not to meet the acceptance criterion, the licensee declared the battery inoperable and began corrective actions. The system engineer began actions either to restore
2I
the cell to operable; jumper the bad cell out of the battery circuit; and/or to replace the cell with a new cell. Maintenance personnel began to charge the cell per station maintenance . procedures. Engineering began actions to decide whether to replace or jumper the cell out of service if the voltage could not be restored by maintenance.
Maintenance took the following actions in an attempt to restore battery voltage to above the required specification:
• raised the float voltage to I38.5 volts for about one hour;
• placed the IC battery on equalize charge (139.5 volts) for about one-half hour;
• returned the battery to normal float charge (131.95 volts) and measured cell voltage after waiting 10 to I5 minutes; (the cell voltage was still below allowable at 2.068 volts)
• returned the IC battery to an equalize charge (I39.07 volts) and commenced individual cell charging for Cell No. 47 for about one and one-half hours;
• restored IC battery to normal float charge and removed individual cell charger and measured cell voltage after waiting 10 to I5 minutes; (the cell voltage measured 2. I33 volts)
Plant operators were informed then that cell voltage was acceptable. Operators exited the Technical Specification Action Statement and the maintenance staff placed the individual cell charger back in service on cell No. 47 per vendor recommendation. According to interviews with plant personnel the battery remained in this condition for the next four days.
During the interim period, plant engineers were confirming with the battery supplier which alternative long-term corrective action was appropriate, i.e., jumper or replace. Plant engineers decided that replacing the cell was less risky than installing a jumper to take the cell out of service due to possible voltage fluctuations on the respective instrument bus, which could lead to plant transients, during the jumper evolution. This risk would not occur during cell replacement, but this alternative required a temporary modification and structural work prior to replacement. Preparations were made to support the battery replacement, which would occur when a spare cell was procured. Engineering conducted a safety analysis that justified continued operation with the potentially degraded cell in the IC battery. The analysis showed that the battery could perform all of its required safety functions with only 59 operable cells. Although cell No. 47 would provide some assistance to overall battery performance, no credit was taken in the licensee's analysis. Further, the licensee assessed various failure mechanisms for the bad cell and determined that the worst case credible failure would be for the cell to fail to a dead short condition (which would be no different from installing the jumper). Based on the repair actions taken, the analysis performed, and the plans to replace the cell, the licensee decided that it was acceptable to operate in this condition.
22
On August 23, 1993, the licensee contacted the NRC Region I Office and explained the actions taken and plans for the IC battery. At the time, there was concern that cell No. 47 would not be able to meet the cell voltage acceptance criterion. The licensee was requested to participate in a conference call with the NRC in which to discuss the operability of the battery, the functionality of the battery and justification of continued operation, and the potential for requesting enforcement discretion. During the conference call, the licensee informed the NRC that they had· approved the engineering evaluation providing justification for continued operation, and were also able to demonstrate that cell No. 47 was operable. To do so, they had taken the individual cell charger off the cell, raised the float voltage for the battery charger to 135 volts per vendor recommendation and measured cell voltage greater than 2.13 volts .. (This higher float charge was within the vendor's band of proper float, but above the setting used by the licensee per station procedure. A 10 CFR 50.59 evaluation was conducted and supported the management decision to use this higher than normal float voltage.) The licensee did not expect to need enforcement discretion then, but would continue to monitor the cell's performance and would ask for assistance if needed. They also informed the NRC that they planned to replace the cell the next day.
On the morning of August 24, cell No. 47 voltage again dropped below allowable; the licensee requested enforcement discretion to allow continued operation while completing the replacement of the bad cell. The licensee began a plant shutdown per their technical specifications while deliberations were made. At 9:30 a.m., the licensee was informed that their request for 24 hours of enforcement discretion, commencing at 9:04 a.m., to complete the replacing of cell No. 47, was approved. The temporary modification to replace the cell was completed at 10:45 p.m., on August 24. However, at 10:45 a.m., on August 25, the licensee requested an additional six days of enforcement discretion to allow the new cell to become fully charged and then to soak to ensure that it could be demonstrated fully operable. This was necessary because the new cell voltage was below the technical specification allowable voltage. The licensee had been assured by the battery vendor that this performance was expected and did not indicate that the replacement cell was bad. The licensee planned to place the 1 C battery on an equalizing charge for three days, and then return to a float condition for three additional days prior to measuring voltage for operability. The NRC approved the licensee's request for six more days to charge the battery fully and then demonstrate operability.
6.2 Inspection Findings
While the Unit 1 technical specifications states that the individual cell voltage should be measured "on float," it does not specify how long the cell should be on float prior to taking the measurement. However, the licensee's quarterly surveillance test procedure and the maintenance procedure for use of the individual cell charger both specify that the cell should be on float charge for 72 hours after having an equalizing charge (either by the battery charger or the individual charger) prior to taking individual cell terminal voltage measurements. The licensee did not follow the procedural requirement on August 18, when the licensee waited only 10 to 15 minutes after completing an equalizing charge prior to
23
measuring the cell voltage and declaring the battery fully operable. This failure to follow station procedure is considered a violation of Technical Specification 6.8.1, which required station procedure to be implemented (272/93-82-14). The licensee agreed to assess the impact of operating with an increased float voltage, as well as the impact of the equalizing charge operation on the ability to measure individual cell voltage accurately to ensure that station procedures are appropriate.
It was not clear from a review of the completed surveillance test and associated work packages that the maintenance staff informed the operations staff of the inoperable battery immediately upon discovery. Based on interviews with licensee personnel, the NRC team determined the licensee's actions to be acceptable; however, documentation of the actions taken upon discovery of the unacceptable voltage condition, including the time it was identified, initial informing of operations, and subsequent follow-up actions, was weak. The licensee did not assess the initial activities of the staff upon discovery of the battery condition to ascertain if procedure enhancements are necessary to improve communications with the plant operators or to improve the documentation of those communications. Notwithstanding the apparent procedure adherence violation discussed above, corrective actions were completed within the allowable time required by plant technical specifications, operators were informed of the repairs, and the associated Technical Specification Action Statement was terminated.
Previous surveillance test documentation for both Units 1 and 2 vital batteries were reviewed to ascertain prior plant conditions that could have prevented this event and the need for the request of enforcement discretion. The team found that this event was the first indicator of a problem with the station batteries.
During a review of past surveillance tests, as well as through direct observation of the station vital batteries, the team found that the lC and 2C, 125 Volt batteries operate at a temperature range much greater than the other station batteries. This is because these two batteries are in separate enclosures where the environment is not specifically controlled. From the surveillance test results reviewed, the lC battery had an operating range from 70°F to 96 °F. The 2C battery had similar operating temperatures. The other station vital batteries generally remained within a three or four degree band from the nominal operating temperature of 77°F.
The licensee's procedures stated that the acceptable operating temperatures for the batteries are from 60°F to 105°F. While no unacceptable condition was observed, the team was concerned that the extreme temperatures experienced by these two batteries may be leading to accelerated aging. The licensee's independent EDSFI also reviewed this issue; however, there were no battery failures at that time. Therefore, while the licensee's assessment noted the difference in operating temperatures for the station batteries, no significant finding was made and no corrective actions were deemed necessary.
24
Based on the failure of cell No. 47 and the operating characteristics of the lC battery, the team was concerned that accelerated aging may be occurring, warranting other actions by the licensee to ensure the continued operability of the battery. One indicator of this was the · build up of sediment in the jar bottoms for this cell, as well as for five other cells in the same battery. The licensee stated that actions would be taken to identify the root cause of the failure of cell No. 47, especially considering the effect of operating temperatures. In addition, the licensee stated that·the lC battery would be given a rigorous operability test during the upcoming refueling outage, commencing in October 1993. Meanwhile, the licensee committed to test individual cell voltages for the 1 C battery prior to the outage, at least for cells exhibiting similar physical evidence of sediment buildup in the cell jar as happened to cell No. 4 7. While not committing to replacing the entire 1 C battery this outage, the licensee stated that this also would be assessed. The licensee stated that the 2C battery is much newer than the 1 C battery (which is the oldest battery in the plant having been installed in 1984) and does not exhibit any signs of aging now. The long-term corrective actions for the IC and 2C, 125 volt batteries remain unresolved based on licensee assessment of the aging effects due to the operating temperatures experienced by these components (272/93-82-15; 311/93-82-15). This item is related to the other inspection concern regarding operating temperatures in the switchgear areas as discussed in paragraph 3 .3.
7.0 UNRESOLVED ITEMS AND OBSERVATIONS
Unresolved items are matters about which more information is required in order to ascertain whether they are acceptable items, deviations or violations. Unresolved items are identified in the Executive Summary of this report.
Observations are not regulatory requirements. They are presented to the licensee for their consideration. Observations are identified in the Executive· Summary of this report.
8.0 EXIT MEETING
The licensee's management was informed of the scope and purpose of this inspection at the entrance meeting on August 16, 1993. The findings of this inspection were discussed with the licensee's representatives during the course of the inspection and presented to licensee management during the exit meeting on September 3, 1993. The licensee did not dispute the inspection findings during the exit meeting. A list of attendees is presented in Attachment 1.
ATTACHMENT 1
PERSONS ATTENDING
Public Service Electric and Gas Company
* J. Bailey H. Berrick
* R. Brown M. Burnstein T. Carrier R. Chranowski T. Haehle L. Hajos A. Kao
* S. Karimian P. Kwok S. La.Bruna C. Lambert J. Lin
* K. Moore R. Pande K.Pike M. Ouadir J. Ranalti D. Smith R. Swanson B. Thomas E. Villar C. Vondra
Engineering Science Salem M~hanical Engineering Supervisor Principle Engineer, Nuclear Licensing Nuclear Electrical Engineering Manager Salem Maintenance Engineering Salem Technical Engineer Senior Staff Engineer Electrical Engineering Supervisor (Acting) Structural Engineering Supervisor Technical Consultant Senior Staff Engineer Vice President, Nuclear Engineering Manager, Nuclear Engineering Design Specialist Engineering Supervisor Safety Review Engineer Senior Staff Engineer Salem Technical Manager (Acting) Senior Project Engineer Nuclear Mechanical Eng. Manager Station Licensing Engineer General Manager, QA and Safety Review Licensing Engineer Station Licensing Engineer General Manager, Salem Operation
* Denotes those not present at the exit meeting of September 3, 1993
A or Amp ac ANSI ASME BHP or Bhp BIL CRF CB CFR CCR CVT DBA de DEMA ECCS EDG FLA FSAR FTOL GDC GE GM gpm HPSI HVAC IEEE kA kV kVA kW LC LOCA LOOP LPSI LV MCC MOV MS or ms MVA NEC NEMA
ATTACHMENT 2
ABBREVIATIONS
Amperes. Alternating Current Am~rican National Standards Institute American Society of Mechanical Engineers Brake Horsepower Basic Insulation Level Containment Recirculation Fan Circuit Breaker · Code of Federal Regulations Central Control Room Constant Voltage Transformer Design Basis Accident Direct Current Diesel Engine Manufacturers A~sociation Emergency Core Cooling System Electrical Distribution System Full Load Amps Final Safety Analysis Report Full Term Operating License General Design Criteria General Electric General Motors Gallons per Minute High Pressure Safety Injection Heating Ventilation and Air Conditioning Institute of Electrical and Electronics Engineers kiloamperes kilovolts kilovolt-amperes kilowatts Load Center Loss of Coolant Accident Loss of Offsite Power Low Pressure Safety Injection Low Voltage Motor Control Center Motor-Operated Valve Milliseconds Mega Volt-Amperes National Electrical Code National Electrical Manufacturers Association
Attachment 2
PR PSI or psi RCP RG rms SCR SEP SF SI Std TS UL UPS USNRC UST UV v Vac Vdc
2
Protective Relay(s) Pounds per Square Inch Reactor Coolant Pump USNRC Regulatory Guide Root Mean Square Silicone-Controlled Rectifier Self-Evaluation Program Service Factor Safety Injection Standard Technical Specification Underwriters' Laboratories Uninterruptible Power Supply· United States Nuclear Regulatory Commission Unit Service Transformer(s) Undervoltage volt(s) volts alternating current volts direct current
