IR 05000213/1993016

Insp Rept 50-213/93-16 on 930725-0828.No Violations Noted. Major Areas Inspected:Plant Operations,Maint,Engineering & Technical Support,Plant Support Activities,Outage Assessment & Emergency Planning Drill

ML20057E666
Person / Time
Site:	Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png
Issue date:	09/29/1993
From:	Doerflein L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20057E663	List: IR 05000213/1993016 ML20057E662
References
50-213-93-16, NUDOCS 9310130013
Download: ML20057E666 (51)

Text

.

.

U.S. NUCLEAR REGULATORY COMMISSION

REGION I

.

Docket No.

50-213 Report No.

93-16 License No.

DPR-61 Licensee:

Connecticut Yankee Atomic Power Company P. O. Box 270 Hartford, CT 06141-0270 Facility:

Haddam Neck Plant location:

Haddam Neck, Connecticut Dates:

July 25,1993 to August 28,1993 Inspectors:

William J. Raymond, Senior Resident Inspector Peter J. Habighorst, Resident Inspector N

l a9 93 h

Approved by:

J

'

~

Lawrence T. Doerficin, Chief f

Date Reactor Projects Section No. 4A, DRP Areas Insoccted: NRC resident inspection of plant operations, maintenance, engineering and

"

technical support, plant support activities, outage assessment, and the emergency planning drill.

Fesults: Sw Executive Summary

i 9310130013 930929 PDR ADOCK 05000213 G

PDR

.

.

EXECUTIVE SUMM ARY llADDAM NECK PLANT INSPECTION 54213/93-16

,

Plant Ooerations Safe plant operation was noted throughout the period as the plant completed the startup from

'

the refueling outage and resumed full power operation. The licensee management decision to shutdown the steam plant to isolate and repair a steam leak was timely and appropriate. The control room operators performed well during the downpower and the shift supervisor controlled the associated activities well.

Maintenance The inspectot noted good maintenance controls during activities to isolate and evaluate a leak in extraction steam isolation valve MS-V-560. Licensee evaluations to substitute a temporary spool piece for the valve were adequately justined and acceptable.

Surveillance activities reviewed during the period were completed by knowledgeable plant staff with acceptable results. The coordination between operators, instrumentation and control (I&C) technicians and engineering personnel was very good during the conduct of a special test on July 26, to complete core measurements. The test was conducted accurately and ef6ciently.

Engineerine and Technical Support Reactor engineering personnel demonstrated very good knowledge of core operating limits and characteristics during the implementation of a special test to verify control rod coupling.

Engineering support to investigate a Gux tilt anomaly in a timely manner was excellent.

The use of Rosemount transmitters at Haddam Neck was reviewed to determine whether CYAPCo met the requirements of NRC Bulletin 90-01, "less of Fill Oil in Transmitters Manufactured by Rosemount," dated March 9,1990, and Bulletin 90-01, Supplement 1, dated December 22,1992. This review determined that the units installed were manufactured after July 11, 1989, and were thus not subject to the bulletin requirements. As l

such, the transmitters need not be subject to an enhanced monitoring program. A open item

!

will track further NRC review regarding the industry experience with the post-89 production transmitter failure rate, and to verify that the failure rate supports the assumptions for reactor protection system (RPS) reliability (Section 4.2).

ii

,

i

P

,-

i

.

Plant Supoort d

Deliberations by the Plant Operations Review Committee (PORC) were thorough and probing

,.

during reviews of the safety evaluation for a special test that verified control rod coupling.

I

i Licensee procedures for monitoring a primary to secondary system leakage were found to be

,

,

acceptable, and a conservative approach was noted in meeting the leakage limits specified m

the technical specifications. The abnormal operating procedure for steam generator tube leakage requires further review to determine whether licensee commitments to NRC Bulletin

j 88-02 were appropriately implemented. This issue is an unresolved item (Section 5.7)

Poor communications during a planned quarterly emergency preparedness drill resulted in the

improper manipulation of in-plant equipment. An open item will track the completion of the i

licensee's human performance review and corrective actions for this event (Section 5.8).

.

4

$$i

-

-.

i D

SUMMARY OF FACII ITY ACTIVITIES The unit began the inspection period at 80% rated thermal power, having just completed a refueling maintenance outage. On July 26, at 5:08 p.m., the unit achieved full rated thermal power. On August 3, at approximately 10:15 a.m., control room operators commenced a l

load reduction to repair an oil leak on the "A" main feedwater pump motor. After successful repairs, the unit retumed to full power at 9:43 p.m., that same day.

On August 23, at approximately 10:30 a.m., control room operators commenced a plant shutdown to operational Mode 2. The shutdown was initiated to repair a steam leak in the turbine building (report detail 2.2). At the end of the report period, the licensee had completed the necessary repairs, and the plant was at 30% rated thermal power.

2.0 PLANT OPERATIONS In addition to normal utility working hours, the inspectors routinely reviewed plant operations during portions of backshifts (evening shifts) and deep backshifts (weckend and night shifts). Inspection coverage was provided for 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> during backshifts and 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> during deep backshifts.

,

l i

2.1 Operational Safety Verification This inspection consisted of selective examinations of control room activities, operability reviews of engineered safety feature systems, plant tours, review of the problem identi6 cation systems, and attendance at periodic planning meetings. Control room reviews consisted of veri 6 cation of staf6ng, operator procedural adherence, operator cogni7ance of control room alarms, control of technical specification limiting conditions of operation, and electrical distribution verifications. Administrative Control Procedure (ACP)- 1.0-23,

" Operations Department Shift Staf6ng Requirements," identifies the minimum staffing requirements. During the inspection period, these requirements were met.

l The inspectors reviewed the onsite electrical distribution system to verify proper electrical line-up of the emergency core cooling pumps and valves, the emergency diesel generators,

'

radiation monitors, and various engineered safety feature equipment. The inspectors also

!

veri 6ed valve lineups, position oflocked manual valves, power supplies, and flow paths for the high pressure safety injection system, the low pressure safety injection system, the containment air recirculation system, the service water system, and the emergency diesel generators. No deficiencies were noted.

!

l l

-

i -

^

,

L l

2 Loc-Keepine and Turnovers I

The inspectors reviewed control room logs, night order logs, plant incident report logs, and crew turnover sheets. No discrepancies or unsatisfactory conditions were noted. The inspectors observed crew shift turnovers and determined they were satisfactory, with the shift supervisor controlling the turnover, All members of the crew discussed plant conditions and i

evolutions in progress. The information exchanged was accurate. The inspectors also reviewed control room trouble reports for age, planned action, and operator awareness of the reason for the trouble report. The majority of trouble reports reviewed were recent, with few longstanding items.

During attendance at daily planning meetings the inspector noted discussions on maintenance and surveillance activities in progress, and planned work authorizations. The inspectors

,

conducted periodic plant tours in the primary auxiliary building, turbine building, and intake l

structures. Plant housekeeping was satisfactory.

2.2 Plant Shutdown t

!

!

On August 23,1993, at approximately 9:00 a.m., the licensee identified a steam leak from the first stage high pressure turbine extraction steam line. The steam line is located in the turbine building, and the steam leak did not affect any adjacent equipment in the area. The l

leak was from a non-safety grade fourteen inch (14") Crane /Chatman gate valve (MS-V-560).

Initial licensee visual checks concluded that the valve body was cracked. Inspector observation of the steam leak concluded that no safety-related equipment was impacted by the steam.

,

At 10:30 a.m., licensee management decided to shutdown the steam plant and isolate steam l

to the main turbine. The action was based on a potential personnel safety ha7ard from the l

!cak, and the uncertain condition of the valve body. The licensee notified the NRC l

Operations Center at 12:17 p.m., pursuant to 10 CFR 50.72(b)(2)(vi).

l The inspector observed control room operators implement Normal Operating Procedure (NOP) 2.2-1, " Changing Plant Imad." Operators adhered to the procedure and controlled the evolution very well. At 2:30 p.m., the licensee isolated the main turbine-generator from the grid.

On August 24, the Plant Operations Review Committee (PORC) approved bypass jumper 93-036. The jumper removed the valve from the system and replaced it with a spool piece.

Northeast Utilities Service Company (NUSCo) engineering performed the technical evaluation for the bypass jumper. The technical evaluation reviewed the dead weight and thermal stresses on the adjacent pipe supports. The evaluation concluded that stresses due to dead weight loads decreased and were thus acceptable, and there were no changes in the loads due to thermal stresses on the support h i

!

h

!

(

!

CYAPCo concluded that removal of valve MS-V-560 from the extraction steam system was l

acceptable. The licensee's basis was that no emergency operating procedure steps refer to operation of the valve, and the NOPs only refer to the valve during steam system valve line-ups. Isolation of a postulated steam break is accomplished by tripping the main turbine since the valve is unisolable from the turbine. Removal of the valve results in a loss of dual isolation capability for the "l A" and "lB" feedwater heaters, and isolation of the downstream non-return valve (MS-NRV-2). The inspector reviewed and discussed the details of the bypass jumper with cognizant engineers. The inspector concluded there was acceptable justification for the bypass jumper. The bypass jumper requires that the spool piece be removed during the next mieling outage, scheduled for October 1994.

The spool piece was fabricated and installed in the system under authori7ed work order (AWO) 93-11509. The maintenance activity was successfully completed on August 27. At the end of the inspection period, the unit was at 30% rated power.

The inspector concluded that the licensee management decision to shutdown the steam plant to isolate and repair the steam leak was appropriate and timely. The technical evaluation was thorough. The control room operators performed well during the downpower and the shift supervisor controlled the associated activities well.

3.0 MAINTENANCE 3.1 Maintenance Observation The inspectors observed various corrective and preventive maintenance activities for compliance with procedures, plant technical specifications, and applicabic codes and standards. The inspectors also verified appropriate use of safety tags, proper equipment alignment and use of jumpers, adequate radiological and fire prevention controls, appropriate personnel qualifications, and adequate post-maintenance testing. Portions of activities that were reviewed included:

AWO 93 05338, inspection ofInsulated Ground Cables

AWO 9311509, Extraction Steam Valve MS-V-560 Body Leak

AWO 9311121, Leak Repairs to Main Feedwater Check Valve

AWO 9311254,389T399 Oil Circuit Breaker Preventative Maintenance No deficiencies were identifie !

l

!

n l

l Extraction Steam Valve MS-V-560 Body 1,cah l

The corrective maintenance activity was to replace high pressure steam extraction valve l

(MS-V-560) with a spool piece. The modification was controlled under bypass jumper l

93-036. The spool piece was fabricated and installed in the system on August 27. The valve j

was a new component installed during the recent refueling outage. Prior to replacing the l

valve, the licensee radiographed the valve body. The radiograph revealed a high number of localized internal discontinuities in the area of the "thru-wall" steam leak (report detail 2.2.).

CYAPCo believes that, as a result of the fabrication and welding processes and service l

conditions sustained by the valve, the individual discontinuities connected and resulted in a leak. The supplier subjected the valve to a hydrostatic and seat leakage test pursuant to l

ANSI B 16.34-1981. The hydrostatic and seat leakage test results were acceptable.

l l

Inspector observations of the on-going maintenance activity to replace the valve with a spool l

piece did not identify any discrepant conditions.

f l

3.2 Surveillance Observation

The inspectors witnessed selected surveillance tests to determine whether:

frequency and action statement requirements were satisfied; necessary equipment tagging was performed; test instrumentation was in calibration and properly used; testing was performed by qualified i

personnel; and, test results satisfied acceptance criteria or were properly dispositioned.

'

Portions of activities associated with the following procedures were reviewed:

!

!

SUR 5.3-40, Core Quadrant Power Tilt Determination The inspector reviewed the results of this test performed at 100% full power as part of the licensee's evaluation of an anomalous quadrant power tilt. No inadequacies were identified.

ENG 1.7-71, Plant Rotating Machinery Vibration Procedure (Balance of Plant)

On July 30, the inspector observed a CYAPCo inservice test (IST) technician perform Engineering Procedure ENG 1.7-71. The objective of the procedure was to acquire vibration data for critical plant equipment. The plant equipment consisted of safety and non-safety-related fans, pumps, motor generators, emergency diesel generators, and air compressors.

The inspector observed testing on the "A" and "C" component cooling water pumps. The l

technician was knowledgeable of the procedure and procedural objectives. No unacceptable conditions were noted.

,

-

• SUR 5.1-150, Containment Isolation Surveillance On August 10, the inspector observed an operator perform Technical Specification Surveillance SUR 5.1-150. The procedure objective was to verify that containment penetrations with manual valves which are required to be closed during accident conditions are closed and locked.

Prior to the surveillance observation, the inspector verified that non-intent Temporary Procedure Change (TPC)93-609 was properly incorporated into SUR 5.1-150. The TPC removed four containment isolation valves from the veri 6 cation which were deleted during Cycle 17 refueling outage plant modifications. The inspector also verined that the licensee satis 0ed a commitment to replace the nitrogen supply to primary relief tank trip valve (NG-SOV-470) during the Cycle 17 refueling outage. The commitment was documented in NRC safety evaluation report for Technical Speci0 cation Amendment #138, dated June 19, 1991.

During the surveillance, the operator noted that six (6) containment pressure transmitter tests and vent isolation valves were listed on Attachment 7.1 as being located in the blowdown room. The valves were actually located on the upper level of the Primary Auxiliary Building (PAB). The inspector questioned the operator if a TPC to SUR 5.1-150 was required. The inspector noted that the next time the surveillance is implemented an operator may spend unnecessary time in the blowdown room (a contaminated area) looking for the valves. The valves are k)cated in the upper PAB, a non-contaminated area. The operator was processing a TPC at the end of the inspection period. The monthly surveillance procedure was last revised on June 1,1993. The operator adhered to the surveillance procedure and observed appropriate radiological work condition. The surveillance met the acceptance criteria.

ST 11.3-4, Control Rod Coupling Veri 5 cation at Power

The inspector witnessed the performance of this test on July 26. The special test was conducted to verify the coupling of control rod numbers 7,16,17, 31, 36, and 37 by detecting the changes in neutron flux as the rods were individually driven into the core. The test was completed as part of the licensee's investigation of an anomalous quadrant power tilt noted as the reactor began power operation in Cycle 18 for the first time.

The inspector witnessed the conduct of this special test by engineering personnel, who were assisted by operators and 1&C technicians. Test personnel were very familiar with the incore system, the test procedure and the expected plant performance. The coordination between engineering and operators was very good to complete the core measurements accurately and efficiently. The inspector independently conGrmed by a review of the incore Oux traces as the control rods were inserted into the core that the rods were coupled to their drives. No inadequacies were identified.

!

l

!

.

- -

. --.- -.

--

. _ - -.

.-

-

--.

-

_ _ - -

..

-

,

,._

!

i

?

.

4.0 ENGINEERING AND TECHNICAL SUPPORT The inspectors reviewed selected engineering activities. Particular attention.was given to safety evaluations, plant operatior.s review committee approval of modifications, procedural

>

controls, post-modification testing, procedures, operator training, and UFSAR and drawing revisions.

4.1 Core Performance Monitoring - Quadrant Power Tilt Ratio

,

!

'

The inspector reviewed CYAPCo activities to monitor core performance as the plant was brought to power for the first time in Cycle 18. In particular, the inspector reviewed

licensee evaluations regarding core thermal hydraulic performance following the licensee's determination on July 25, that quadrant power tilt (QPT) was larger than expected.

.

Neutron flux maps taken at the 80% full power plateau as part of the power escalation test program for Cycle 18 showed a QPT ratio that was larger than expected,- but less than the -

l l

Technical Specification limit. A power tilt'of 1.0196% was measured in quadrant #2, along l

l with a corresponding flux depression in quadrant #4, as expected. The Technical Specifica-i

tion 3.2.4 limit of 1.02% was not exceeded. Reactor engineering personnel verified that the l

power peaking limits for the core were met. Specifically, the nuclear enthalpy hot channel

factor, FN(aH), was 1.55, as compared to its limit of 1.694; and, the linear heat generation

_

i rate was 9.51 KW/ft, which was less than its limit of 14.5KW/ft. The condition was i

documented in a plant information report, and an investigation was begun to identify the

'

source for the anomaly.

Several possible causes for the tilt were investigated and discounted by the licensee. The l

possibility of a fuel loading error was ruled out based on the previous verification of the core l

load map by four independent reviewers. The core parameters measured during the zero power physics tests were also very close to their predicted valves, which would also discount a core loading anomaly. Core inlet temperatures were uniform, and the rod drop test results showed that each control rod was coupled to its drive.

,

l

!

The licensee thus concluded that the tilt was due to either fuel enrichment variations that i

were within tolerances, or a control rod that had become decoupled from its drive. Since a dropped control rod would have the most severe consequences on core performance, the licensee determined that further investigation was warranted to rule out the possibility of a misaligned control rod. Special Test ST 11.3-4 " Control Rod Coupling Verification at Power," was written and implemented during the morning of July 26, to verify proper control rod coupling.

,

.

_.., -.

..--.

--

-.

---

,,

- -.- -. - - -.

-..,. - - - -

.

.

.

The positive flux tilt in quadrant #2 could be the result of a misaligned control rod in quadrant #4. An incore flux thimble is located at core location E5 in quadrant #4. The following six control rods are near the instrumented assembly: control bank B, rod #31; shutdown bank C, rods #16 and #17; and shutdown bank D, rods #7, #36 and #37.

ST 11.3-4 was written to verify through positive indication that the above six rods were coupled to their drives. This was accomplished by positioning a movable incore detector in l

assembly E5 at a location just below the assumed height of the tip of the control rods. The neutron flux was monitored as the rods were driven into the core one at a time. Rod insertion was limited to a maximum of 24 steps from its original position or until a flux change was indicated on the incore detector. In each case, a positive Oux change was noted during the rod movement prior to reaching the 24 step limit.

Based on the test and evaluations completed on July 26, the licensee concluded that the anomalous flux tilt was due to fuel enrichment variations that were within tolerances, and that no safety concerns existed with continued plant operation. The flux tilt was expected to decrease as the reactor was taken to full power, and the tilt was expected to decrease further as the power in each core quadrant redistributed and equalized in time as "the tilt bumed itself out." Thus, based on recommendations from site and NUSCo engineering, the licensee approved power escalation to full power as core monitoring continued.

Power distribution measurements taken on July 28 with the incore instrumentation system after the reactor reached full power showed a maximum QPT of 1.0184% in quadrant #2.

The other power peaking factors remained acceptable at 1,53 and 11.18 Kw/ft. The power tilt declined steadily during the subsequent month of power operation, as determined from the excore nuclear instrumentation. The maximum tilt (in quadrant #2) was measured on l

August 18, to 1.009%. QPT will also be monitored using the incore instruments at the end

'

of each full power month of operation. NUSCO and site engineering evaluation of the tilt l

and its causes continue.

!

l l

Conclusions I

Reactor engineering personnel demonstrated very good knowledge of core operating limits and characteristics. Special test 11.3-4, developed under severe time constraints, was of high quality as demonstrated during its implementation. The deliberations by the plant operations review committee (PORC 93-177) on July 26 were thorough and probing in review of the safety evaluation to assure the conduct of the ST would not constitute an unreviewed safety question. Plant personnel also performed very well when implementing the test on July 26.

The inspector independently verified core performance and safe operation within the limits specified in the technical specifications and the Updated Final Safety Analysis Report.

Future routine inspections will follow the ongoing engineering evaluation of the tilt and its causes. No inadequacies were identified in the licensee's evaluations, test methods or conclusions.

{

.

-

.

.

4.2 Rosemount Transmitters in Safety-Related Service

'

The inspector reviewed the use of Rosemount transmitters at Haddam Neck to determine whether CYAPCo met NRC requirements in this area. The NRC position on the use of Rosemount transmitters is specified in NRC Bulletin 90-01, "less of Fill Oil in Transmitters Manufactured by Rosemount," dated March 9,1990, and Bulletin 90-01, Supplement 1, dated December 22,1992. The purpose of the review was to determine whether the bulletin requirements were met, and specifically, whether the transmitters should be subject to an

,

'

enhanced monitoring program.

l Bulletin 90-01 Recuirements NRC Bulletin 90-01 was written to address failures in Model 1153 Series B, Model 1153 Series D, and Model 1154 transmitters. Transmitter failures were experienced throughout

'

the industry in the past and were attributed to manufacturing defects that resulted in a loss of the glass to metal seals in the transmitter sensing modules, and the consequent loss of fill oil.

The transmitters could fail in service in such a manner that the instrumentation channel would appear normal to the operator in a comparison with other channels, but would be incapable of performing its intended trip function in response to changes in the monitored (

parameter.

l l

Bulletin 90-01 and its supplement established requirements on the continued use of

'

Rosemount transmitters in safety-related applications at nuclear facilities. The requirements varied depending on: manufacturing date of the transmitter; whether the transmitters were used in RPS or engineered safety features circuits; and, the operating pressure experienced by the transmitter in its normal service.

The NRC found that transmitters with a normal operating pressure less than 500 psig were achieving a high degree of functional reliability. Further, there was a relationship between operating pressure and time-in-service in classifying transmitters most likely to fail.

Transmitters that had been in service for less that 60,000 psi-months (or 130,000 psi-months depending on the range code for the transmitter) showed a higher failure rate than those that had been in service for more than that period. Thus, transmitters that have a normal operating pressure between 500 psig and 1500 psig and which have reached the appropriate psi-month threshold were also achieving a high degree of functional reliability. The NRC required that any transmitter that was not in one of these categories for functional reliability should be either replaced or subject to an enhanced monitoring program (as described in Bulletin 90-01 and its attachments).

Based on changes made to the manufacturing process and improved screening tests prior to shipment from Rosemount facilities, the NRC concluded that transmitters manufactured after July 11,1989, were showing improved performance, had lower (and acceptable) failure rates, and were thus excluded from the requirements. Transmitters manufactured after July 11,1989, were those having a serial number greater than 0500000. Based on the best

.-

--

- -.

-

. -. -

.

.

.--

.

I H

l l-

information available at the time Supplement 1 was issued, Rosemount i152 transmitters were found by the NRC to have a high functional reliability and were thus also excluded from the action requirements of the bulletin.

Rosemounts In Service At Haddam Neck l

Prior to 1993, the single Rosemount transmitter in service at Haddam Neck was a series 1152 unit in instrument channel LT-1307B, which monitored level in the demineralized water storage tank. CYAPCo responded to the Bulletin by letter, dated July 3,1990 (A08686) and Supplement 1 by letter, dated March,1993 (B14381). In the responses, CYAPCo stated that Haddam Neck does not utilize any of the transmitters identified in the bulletin.

l Subsequently, in 1993, plant design change record (PDCR) 1331 was completed during the Cycle 17 outage as part of CYAPCO's ongoing effort to modernize the feedwater control system by replacing obsolete Hagan instrumentation with state-of-the-art Foxboro analog and digital equipment. The plant changes made as part of the PDCR resulted in the installation of 36 Rosemount transmitters in safety-related instrumentation channels, including engineered safeguards and reactor protection system applications. PDCR 1303 was also completed during the Cycle 17 outage and installed a Rosemount transmitter in channel FT-402D to measure reactor coolant system (RCS) Loop 2 flow. Thus, upon startup for Cycle 18 operation, a total of 38 Rosemount transmitters were in service at Haddam Neck.

Table 1 shows the channel identification, serial numbers and pertinent operating data for each l

transmitter. The normal operating pressure for 29 of the transmitters is low at either 0 psig

'

or 650 psig. Transmitters with low static operating pressures are less susceptible to failure due to loss of fill oil. Eight transmitters operate at moderate pressure of 950 psig, and one transmitter (loop #2 RCS) has a static pressure of 2000 psig under normal service conditions.

I l

The inspector verified, based on discussions with I&C Engineering and by direct observation of a sample of transmitters located both inside and outside the containment, that the associat-ed serial numbers for the Model 1153 and 1154 units installed at Haddam Neck were greater than 050000.

The inspector requested that CY address whether: (i) there was a need to provide an additional response to Bulletin 90-01 based on the new transmitters installed during the 1993 outage; and, (ii) whether there was a need to establish an enhanced monitoring program for the transmitters. Based on an evaluation presented in a letter, dated August 9,1993 (EN 93-422), CYAPCo engineering responded that the new Rosemount transmitters installed at Haddam Neck were manufactured after July 1989, and were thus not subject to the bulletin requirements. Each transmitter has either a serial or model number that made it exempt

,

l from the monitoring requirements in the bulletin. CYAPCo planned no further actions and I

no further response to the bulletin was required.

l l

,-.

-

,

,

,-

-,.,.,,

,

-..

.

-.-

.

.

l

The basis for the licensee's technical position was provided in Engineering Notice (EN)93-422. CYAPCo referenced data provided in a May 6,1992 letter, to the NRC staff as part of Rosemount's comments on the then proposed supplement to Bulletin 90-01. The j

data available to Rosemount as of May 1992, indicated that there was one loss-of-fill-oil failure after 8 million service hours for the post-89 production units. This corresponds to a failure rate of about IX10-7 per hour for units built and shipped since July 1989. This failure rate was less than the 5X10-7/hr failure rate assumed by the licensee that is needed to support PRA assumptions for RPS reliability of less than 1 failure in 100,000 demands (or an unavailability of 1X10-5).

l The inspector verified from independent sources (reference Rosemount reports D8900115 and l

D9200129) that transmitter failure rates have improved in general for the post-89 production l

units. The Rosemount data confirmed a general failure rate for all units built and shipped

!

since July 1989, ofless than 5X10-7/hr. This rate had decreased from the pre-89 failure rate i

that was as high as 3.5x10-6/hr prior to actions to successfully address the loss of fill oil problem. However, the inspector received information from NRC:NRR which indicated

!

that since May 1992. additional failures have been experienced in the post-89 production l

units, but that the tailure rate was still acceptably low since the cumulative service hours had j

reached 32 million. This matter was still under review at the conclusion of this inspection.

.

Conclusion The inspector concluded that CYAPCo had met the requirements of Bulletin 90-01. Thus.

the use of Model 1153 and 1154 transmitters was acceptable, and the use of an enhanced monitoring program is not necessary. The inspector noted that CYAPCo should continue to monitor industry experience with post-89 production units and if the associated failure rate increases, CY should reconsider whether an enhanced monitoring program should be initiated. Further, the inspector expressed his opinion that it would be prudent to closely follow the transmitter measuring RCS #'2 Cow (F1-402D) until its reliability is established by reaching the 60,000 psi-month criteria.

The inspector considers this item open pending further NRC review of the failure rate data for post-89 production units, and the conclusion that it is less than 5X10-7/hr. Further, the inspector will also review the basis for the licensee's conclusion that the PRA goals for RPS reliability (an unavailability of 1X10-5) are met for an assumed failure rate of less than

)

5X10-7/hr. The purpose of this review is to determine, regardless of the manufacturing date, whether the Rosemount transmitters at Haddam meet the intent of the Bulletin 90-01 by achieving a high degree of functional reliability (IFI 50-213/93-16-01).

.

_.,.

m

.

.

.

.

I1 5.0 PLANT SUPPORT 5.1 Radiological Controls During routine inspections of accessible plant areas, the inspectors observed the implementation of selected portions of the licensee's radiological controls program. The inspectors reviewed radiation work permit (RWP) utilization and compliance to ensure that detailed descriptions of radiological conditions were provided and that personnel adhered to RWP requirements. The inspectors observed access control to various radiologically controlled areas, and the use of personnel monitors and friskers by personnel exiting those areas. The inspector noted that posting and control of radiation areas, contaminated areas and hot spots, and laceuing and control of containers holding radioactive materials were in accordance with licensee procedures. The inspector determined that health physics technician control and monitoring of these activities was good.

5.2 Plant Operations Review Committee The inspectors attended several Plant Operations Review Committee (PORC) meetings. The inspectors noted that the Technical Specification 6.5 requirements for required member attendance were met. The meeting agendas included procedural changes, proposed changes to the Technical SpeciGcations, Plant Design Change Records, and minutes from previous nectings. PORC meetings were characterized by frank discussions and a questioning attitude towards proposed changes. In particular, consideration was given to assure clarity and consistency among procedures. The committee closely monitored and evaluated plant performance and conducted a thorough self-assessment of plant activities. The PORC deliberations on July 26 were thorough and probing in review of the safety evaluation to assure the conduct of the ST 11.3-4 would not constitute an unreviewed safety question.

5.3 Review,

ritten Reports

>

!

Periodic and Licensee Event Reports (LERs) were reviewed for clarity, validity, accuracy of i

the root cause and safety signi6cance description, and adequacy of corrective action. The j

inspectors determined whether further information was required. The inspectors also veri 6cd

that the reporting requirements of 10 CFR 50.73 and Technical Speci6 cation 6.9 had been l

met. The following reports were reviewed:

i Special Report, Wide Range Noble Gas Stack Monitor Inoperability e

.

j e

LER 93-011-00, Engineered safety Features Actuation Due to less of Vital Buses

"C" & "D" During Surveillance Testing

)

The licensee documented this event as an unplanned automatic actuation of an engineered j

safety feature. NRC Inspection Report 50-213/93-12 (report detail 3.5) documented the

' -

event description and licensee root cause analysis.

3

-,,-

-me-

- n-v

--,-

e

-

,., -

rn -,

_-,

.. -

n

--,

--e-w

. - +,

m,

-+ v

<m

h l

I

$

The inspector veri 6ed licensee corrective actions for this event. The corrective actions were

-

j to revise Annunciator Procedure (ANN) 4.9-36A, "C or D Vital AC Trouble " revise

'

SUR 5.1-153A and SUR 3.1-153B, and adjust the inverters' instantaneous overcurrent setpoints. The licensee completed the corrective actions. The inspector considers this LER

,

closed.

(

LER 93-13, Reactor Trip During Nuclear Instrumentation Testing

This report described the reactor trip while critical at 2:48 p.m., on July 19, during startup from the refueling outage. NRC review of the event and initial corrective actions is provided

!

in NRC Inspection Report 50-213/93-12.

The trip occurred with the plant in Mode 2 at 0.04 percent power as a control room operator l

was checking the nuclear instrumentation channels per NOP 2.18, " Nuclear Instrumentation Short Form." The cause of the trip was the operator's inappropriate work practice when he failed to exercise adequate self-checking and verification of his activities. The licensee's corrective actions included counseling the operator and enhancing Procedure NOP 2.1-8 by adding a caution for personnel to verify a trip is not present prior to proceeding to the next step in the check of the instruments. As long term corrective action, the licensee stated a

,

Human Performance Evaluation System (HPES) evaluation of the event will be performed.

l The results will be reported to in an LER supplement. The inspector veri 6ed the completion l

of tlie short-term corrective actions. No inadequacies were identined.

LER 93-09, Loss of Power Due To Protection Scheme Miswiring

This report described the circumstances that resulted in a temporary loss of offsite power during testing with the plant in Mode 5 on June 22,1993. The LER was reviewed and was found to accurately describe the event, and the licensee's corrective actions. The NRC followup of this event is described in Inspection Report 50-213/93-80. The inspector verified that the licensee's schedule for correcting the wiring error in the breaker trip scheme was acceptable. The inspector considers this LER closed.

• 1 ER 93-10, Loss of Power Due To Blown Fuse This report described the circumstances that resulted in a temporary loss of offsite power during testing with the plant in Mode 5 on June 26,1993. The LER was found to accurately describe the event and the licensee's corrective actions. The NRC followup of this event is described in Inspection Report 50-213/93-80. The inspector veri 6ed that the immediate and short term corrective actions were acceptable and completed as required. The inspector considers this LER closed.

.

P i

l

F

\\

LER 93-12, Inadvertent Isolation of High Steam Flow Transmitters l

e During routine inspections on July 14, Instrument & Control technicians noted that main steam line f!ow instruments FT-1202-1,1202-2,1202-3 and 1202-4 were isolated. The plant was in Operational Mode 3 at the time with the reactor coolant system at normal operating conditions of 532 F and 2000 psig. The technicians immediately notified the control room operator of the status of the instruments, and placed the instruments back in service at about 1:00 p.m., by opening the high and low side isolation valves, and closing the equalizing valve on each transmitter.

The licensee began an investigation to determine the cause of this loss of plant con 6guration control and what additional corrective actions were warranted. The incident was documented in Plant Information Report 93-166. The licensee reported the event under 10 CFR 50.73(a)-

(2)(i)(B) as a condition prohibited by the plant technical specifications. NRC inspection of this event was summarized in Report 50-213/93-12.

l l

The inspector reviewed the licensee's initial investigation of the event, including the management interviews with the I&C technicians, in addition to the immediate action

,

described above, the licensee also completed a review to assure RPS and ESF instrumenta-tion channels were properly aligned for service. Since the initial review did not identify how the transmitters became isolated, and because of the implications raised by the event on the I

adequacy of the administrative controls for controlling system status for plant mode changes, l

plant management directed that a formal root cause analysis and human performance i

evaluation system (HPES) review be performed. These evaluations were in progress at the j

l conclusion of the inspection. The licensee will report the results of its evaluations and additional corrective actions when completed.

'

The inspector verified the completion of the short term corrective actions. CYAPCo followup actions were prompt, appropriate and thorough. NRC review of further corrective actions will be included in subsequent routine inspections oflicense event reports for

,

Haddam Neck. No inadequacies were identi6cd.

l 5.4 Follow-up of Previous Inspection Findings Licensee actions taken in response to open items and findings from previous inspections were reviewed. The inspectors determined if corrective actions were appropriate and thorough and whether previous concerns were resolved. Items were closed where the inspector determined that corrective actions would prevent recurrence. Those items for which additional licensee action was warranted remain open. The following items were reviewed:

.

i

>

(Closed) Unresolved item 93-06-01: Verification of Licensee Event Report Correc-tive Action Commitments This item concerned the effectiveness of licensee actions to fulfill LER corrective action commitments. LER 92-20-01, dated April 16, 1993, documented CYAPCo's failure to meet a corrective action commitment in LER 92-20. The commitment was to install temporary manual trip switches for each steam generator wide range IcVel channel by September 10, 1992.

On June 14, the licensee completed a programmatic review of LER commitments dating back to 1988. The scope of the review was to verify that control routings (CRs) were initiated and closed within a committed date if applicable. The licensee concluded that they ful611cd past LER corrective action commitments. The only discrepancy noted was reported in LER 90-20-01. The inspector reviewed random LER commitments and confirmed the licensee's conclusion.

The inspector also evaluated recent changes in the CYAPCo administrative tracking of LER commitments. On July 15, CYAPCo revised Procedure ADM 1.1-150, " Preparation of Licensee Event Repons," to require the LER coordinator to assign CRs to all documented commitments. The inspector verified that CRs were issue to two recent LERs (LER 93-006 and 93-007) by the LER coordinator.

Based on the licensee's programmatic review of past LERs, the revision to ADM 1.1-b0, and verification of adherence to the revised procedure; the inspector considers this item closed.

(Closed) Unresolved item 92-04-03: High Pressure Safety Iniection (HPSI) Pump Seal Hose Failures This item concerned a verification by the licensee that no other components are affected by the changes in the safety function for the HPSI pumps during the sump recirculation phase.

Specifically, the inspector questioned if other conditions exist similar to the failure of the HPSI seal supply hoses. On April 23,1992, CYAPCo engineering reevaluated plant design change record (PDCR) 931, "HPSI Pump Miniflow Modifications," and PDCR 854, "Long-Term ECCS Modifications," and concluded that the engineering reviews were thorough and complete. The evaluation concluded that the engineering reviews performed for PDCR's 931 and 854 were complete and addressed function, flow, and system designs. The reviews completed for the PDCR's included environmental qualifications for the motor operated valves and HPSI motors, pump runout, stress analysis of the piping, structural loading of components, supporting accident analysis flowrates, and pump design specifications. The licensee concluded that failure to detect the inadequate design of the seal water hoses was an isolated event. Based on review of the PDCR's and CYAPCo engineering conclusions, the inspector considers this item closed.

e a--

l P

l

!

l

(Closed) Unresolved item 91-11-01: Failure to Incrroorate "As-Built" Drawings Within Ninety Days i

This item concerned an inspector identified issue that many "as-built" non-operations critical l

drawings were not incorporated into revised documents within the time interval stated in l

Nuclear Engineering and Operations (NEO) Procedure 2.13. " Nuclear Plant Records Program." NEO 2.13 required that the drawings be updated to final documents within ninety

'

(90) days of completion of construction and turned over to the licensee's Nuclear Plant

!

Records Facility (NPRF).

The inspector learned that NEO 2.13, Revision 5 now states that nuclear record change requests be transmitted to the NPRF within ninety (90) days. Administrative Control Procedure (ACP) 1.2-6.16., " Drawing Control," requires that Design Change Notices I

(DCNs) be initiated prior to engineering release of a modification to the operations department. Additionally, Step 6.1.1. of ACP 1.2-6.16 requires that drawings be verified against the latest revision using a licensee computer program (Generation Records Information Tracking System (GRITS).

The inspector randomly selected DCNs of the following plant modifications to verify that l

they were highlighted on the GRITS program, and/or incorporated into drawing revisions.

l

PDCR 861, Modernize RPS and Control System

PDCR 1125, Replace Charging Pump Mini-Flow Valves l

l

PDCR 1294, Adams Filter Bypass Valves PDCR 865, New Switchgear Buildmg j

The inspector noted that the selected DCNs were identified on the applicable GRITS program for the assigned drawing. Additionally, the licensee has a Performance Enhancement Program (PEP) action plan to reduce engineering backlog. Part of the scope of engineering backlog is to update and revise "as-built" drawings for past modifications. Based on the review of DCNs associated with PDCRs and the long-term PEP action plan, the inspector considers this item closed.

e (Closed) Violation 92-22-02. Cable Vault Ground Cable Connection

\\

l The licensee responded to this violation by letter, dated March 1,1993. The planned I

corrective actions and justification for accepting the existing cable ground configuration were accepted by the NRC, as documented in an NRC letter, dated April 14, 1993.

t

!

i

- -

- - -

o

,

F h

!

In its response, CYAPCo stated that inspections would be completed during the Cycle 17 refueling outage to verify that the other end of the ground cables were properly terminated.

i The inspector reviewed the licensee's actions to satisfy the commitment during this inspection. The cable inspections were completed on May 4,1993, and the results were documented in work order 93-5338. The insulated ground cables were properly tied to station ground. This item is closed.

5.5 Employee Concerns Program The inspection objective was to understand the characteristics of the licensee's employee concerns program. The inspection consisted of reviewing licensee Procedure NEO 2.15,

" Nuclear Safety Concerns," and discussions with licensee nuclear safety concerns program personnel. Documentation of specific questions and answers concerning the program are located in Attachment 1 of this report. Temporary instruction (TI) 2500/28 was used to complete this inspection.

,

t The nuclear safety concerns program provides various means for employees to discuss a nuclear safety concern. The program provides for confidentiality and anonymity of the

individuals. Finally, the licensee's measure of program effectiveness is individual

,

satisfaction with the resolution of a concern.

Based on his review of the program, the NRC inspector concluded that it provides independence from line management based on the organizational structure, and final resolution authority for a concern. However, the proposed resolution of a concern may

,

,

involve line management. According to Procedure NEO 2.15, the licensee's nuclear safety

concerns program staff are not involved in a proposed resolution to a nuclear safety concern.

The scope of this inspection did not assess the effectiveness of the licensce's program.

L

,

5.6 Outage Assessment Discussion l

The Cycle 17 refueling outage began with a plant shutdown on May 15, 1993, and was l

scheduled to last 65 days. The outage was essentially completed on schedule; the plant resumed operation at full power on July 26. CYAPCo staff successfully completed several

,

'

complex maintenance, modification and test activities during the shutdown. In spite of these successes and the generally excellent performance, the outage period was marked by several events which challenged both the plant and the staff. The inspector completed a review of the events and facility staff performance, and CYAPCo management response to the issues.

The objective of the review was to identify the underlying contributors to the events, and to identify issues where further management attention could improve performance.

l r

,

m-

l b

o

The inspector completed this review for twelve events, as described in the event summary sheets included with Attachment 2 of this report. The issues and the primary and contribut-ing causes are also summarized in Table 2. The EDG event involved two separate issues:

(1) the EDG loss of field; and (2) the discovery that the loss of field trip was never operable.

There are a number of root causes and contributing causes for the events. The events can be grouped under root cause into the following categories (in order of declining frequency):

personnel error (PE) - 5, equipment failure - 4, original construction error - 2, deGeient l

design - 1, and inadequate procedure - 1. Although no one cause dominates, the failure of personnel to satisfactorily perform routine duties can be linked to 5 of the events.

Assessment l

l A detailed review of each event and associated performance issue (s) shows that the actual impact on plant safety was low. None of the events seriously challenged critical plant safety functions, there was no damage to plant equipment, and the events caused little or no transient on plant systems or equipment. Similarly, the public impact from the classification error on June 27, was minimal. Thus, the potential impact on plant safety was also low, and collectively the recent events had minimal safety significance.

)

The issues involving personnel error were reviewed to determine whether underlying l

deficiencies (e.g., training, work hours, etc.) were a contributor to the error. None were found. Rather, the errors were almost totally due to the lack of thoroughness or self-checking in the performance of routine duties. Of the 5 events involving personnel error, the one involving the Shift Supervisor Staff Assistant (SSSA) stands apart from the rest because the individual erred while performing a task under severe time constraints. While the event tends to raise questions on the adequacy of the SSSA screening process, a full review of the facts surrounding this case indicates managements actions were reasonable.

!

Of the remaining 4 PE events, two involve operators, one involves engineering, and the last involves I&C personnel. Operator and engineering personnel performance is also linked as a (

contributor to the LTOP events, although the primary cause for those events is inadequate procedures. The personnel errors are not attributable to training or knowledge deGeiencies and are not otherwise causally related. All PE events could have been avoided had the l

individuals involved been more thorough or circumspect in the performance of the activity at I

hand. While 3 of the 5 errors were self-disclosing (issues #6,9, & 12), the licensee j

deserves credit for his timely identification of the two issues (SW test and isolated MSL instruments) and its aggressive followup and corrective actions.

j The inspector questioned whether schedule pressures or management focus on outage schedules contributed to the events. This question was examined in detail throughout the assessment. No overt management or schedule pressures were directly linked to any of the events. The facility staffis keenly aware of the need to keep plant outages as short as possible..nd on schedule. There is a self-induced pressure by the plant staff whose focus on the schedule stems from a desire to complete the outage in accordance with the established

!

,

.

>

I

goal. This focus causes the staff to become goal oriented, which has subtle effects on performance that may result in less thorough reviews, less than total concentration to the task at hand, etc. A focus on schedule by personnel responsible for an inadequate review of a test procedure was linked as a potential contributing cause for one event (#11 - LTOPs).

The inappropriate planning decision to move an IST on the SW system outside the outage contributed in part to event #1. In summary, no direct link was made between the events and the outage schedule or management actions.

Inadequate procedures were the cause of two LTOP events (issue #11), and weak procedures or preventive maintenance plans caused or possibly contributed to four other events. The best examples of procedure deficiencies include those associate with SW testing (event #1)

!

and EDG loss of field (event #2). Past inspector experience is that procedures at CY are j

generally good, and the procedure deficiencies were isolated cases.

l It is notable that three of the events are the result of licensee efforts to improve its test plans

-

and methodologies. These include the improved test of the MCC-5 ABT (event #5), the phased improvement of test procedures to verify the adequacy of the relay trip schemes

,

(event #3), and the verification that vital bus transfers would function as designed (event #7).

This should be considered a positive attribute in the licensee's performance. The inspector believes efforts to improve testing and inspections to uncover deficiencies should be l

encouraged.

l l

What remains then is the fact that there were a somewhat large number of events or issues that occurred during the last several months. Most occurred during the outage and in the late June to early July period, which was the busiest period in the outage as major outage work and modification activities were drawing to a close and the plant staff was preparing i

,

!

the unit for startup. Although CYAPCo staff was stressed during this period, they l

demonstrated considerable resiliency in responding to emerging issues and were highly

'

successful in briuging complex problems to satisfactory resolution.

The licensee sh vved good performance in identifying deficiencies and did a thorough job in following up on the issues, especially in those involving staff performance issues and critical safety equipment (MCC-5). Some longstanding discrepancies were revealed and corrected.

The licensee showed good initiative to find deficiencies through improved testing. Plant l

management was active in followup of each issue and stopped work activities where l

necessary to allow the staff needed time to respond to the issues. Significantly, this included l

actions to delay the completion of activities that were in the outage critical path (e.g., LNP testing). The failure of the MCC-5 automatic bus transfer scheme, its single failure vulnerability and contribution to the risk of core melt at IIaddam Neck, is a safety significant i

issue which will receive continued NRC staff evaluation. This issue is presently under review, as discussed in Inspection Report 50-213/93-80.

I

I l

!

l l

O I

O

?

The inspector noted plant management recognized that the personnel related performance issues are items under their control which could have been done better. Plant management is a proponent of further followup actions to address the issues. This is evident in ongoing root

cause analyses for several performance issues (e.g., event #8 - HMCP design work).

Management further recognizes the need for additional efforts to keep the staff focused on completing outage tasks correctly. Management concluded that its failure to address certain items well in advance of the outage also contributed to outage performance. The necessity of addressing this work contributed to the management distraction from the conduct of the outage. To enhance performance for Refueling Outage No.18 (scheduled to start on October 15, 1994), plant management has established the outage milestones (reference memorandum UD-93-072, dated May 29,1993) and has established schedules for completing outage preparatory work well in advance of the start of the outage.

In summary, CYAPCo staff was very successful in completing a significant outage work that was complex and challenging. Some longstanding discrepancies were identined and corrected due to improved test methods, and as a result of the plant staff's aggressive pursuit of deficiencies. Several events occurred that had minimal impact on plant safety, but which could have been prevented through better attention to detail in the performance of routine duties. Routine NRC inspections will continue to review plant activities for adverse trends in i

the personnel errors, equipment performance, and attention to detail in the performance of

routine duties.

j 5.7 Primary to Secondary leakage The inspection scope was to evaluate licensee efforts to track and monitor primary-to-secondary leakage during the inspection period. The inspector's review consisted of discussions with chemistry personnel, veri 6 cation of CYAPCo commitments to NRC Bulletin 88-02, " Rapid Propagating Fatigue Cracks in Steam Generator Tubes," and past CYAPCo actions in response to leakage.

The radiochemistry sampling program uses tritium as the primary isotope to evaluate primary-to-secondary leakage. Surveillances Procedure SUR 5.4-44, " Calculating Primary to Secondary leakrate Based on Tritium," provides the method of calculating leakrate.

CYAPCo's calculated total primary-to-secondary leakage between July 27 and August 23, slowly increased from 18 gallons per day (gpd) to 25 gpd. On August 24, the calculated leakrate value increased to approximately 85 gpd following a plant shutdown. At the end of the inspection period, leakage had decreased to 30 gpd. Technical Specification 3.4.6.2 states that the total leakage shall be less than 576 gpd, or less than 150 gpd in any one steam generator. CYAPCo chemistry personnel stated that significant increases and a subsequent decline in leakage rate following plant start-up and shutdowns are expected. The inspector questioned the personnel on the basis of this response. The licensee provided a technical explanation for the phenomenon, without the benefit of an explicit proof concerning the

!

l

.

_

.

O

'O

basis. The inspector noted that chemistry personnel track and provide the leakage rates to station management. Based on his discussions, the inspector concluded that the licensee would take appropriate action, in accordance with the technical specifications, for primary to secondary leakage during start-up or shutdown operations.

The inspector reviewed CYAPCo's actions in response to NRC Bulletin 88-02 (action C.I.)

on enhanced monitoring programs. NRC Bulletin action C.l. states that the enhanced monitoring leakrate program shall ensure a reduction in power level to 50% or less afeast five hours prior to a predicted tube rupture, assuming a rapid propagating fatigue crack under slow induced vibration. The NRC bulletin refers to a time dependent leakrate curve.

CYAPCo's response to the NRC Bulletin 88-02 states that based on the use of the technical speci6 cation limit, the operators have five hours to get to 50% percent rated power. The

,

licensee evaluation accounted for instrument uncertainties and the time for chemistry analysis

'

of the steam generators in the 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Abnormal Operating Procedure (AOP) 3.2-31,

" Reactor Coolant System Leak," Step 4.11 states, that if reactor coolant system leakage exceeds Technical Specification 3.4.6 values, and the leak cannot be repaired in four hours, commence a plant shutdown. The inspector questioned whether the AOP 3.2-21 actions met the commitments in the licensee's response to NRC Bulletin 88-02, action C.l. AOP 3.2-21 does not explicitly require a downpower to 50% or less within five hours of exceeding Technical Specification 3.4.6.2 limits. The difference is not considered significant by the inspector based on the licensee demonstrating appropriate actions in response to primary-to-secondary leakage in August of 1990 (rtference NRC Report 50-213/90-15). The licensee's response to this question during the exit meeting on September 3, indicated that commitments to Bulletin 88-02 are built into the action steps of AOP 3.2-21. This item requires further review to understand better the differences between the AOP and the bulletin response. This item is unresolved pending further NRC review of CYAPCo justification for this difference (URI 93-16-02).

In summary, the inspector observed that chemistry management provides the calculated leakrates to station management during the plan of the day (POD) meetings. The inspector noted that chemistry personnel were sampling within the expected frequency, and trending valves as required in SUR 5.4-44. The inspector will review licensee future actions as they relate to the understanding of leakrate changes during start-up/ shutdown operations.

5.8 Emergency Planning Drill On August 25, with the reactor critical and the steam plant isolated, the licensee commenced a planned quarterly emergency planning drill. The drill scenario had an operator simulate closing the auxiliary feedwater bypass isolation valves based on direction from the mock l

control room. At approximately 9:30 a.m., the control room was notified that the drill-designated auxiliary operator actually unlocked and throttled two of the four auxiliary feedwater bypass isolation valves (FW-V-137-2 and FW-V-137-4). The licensee entered into Technical Specification Action Statement 3.7.1.2., " Auxiliary Feedwater System," for tea minutes, until the two valves were restored to their correct line-up (locked open). As a

.

result of the operator's actions, steam generator levels decreased from 35% to 30% on the No. 2 steam generator, and from 35% to 32% on the No. 4 steam generator. The licensee initiated a plant information report (PIR) to document the event.

The inspector's review consisted of interviews with the drill-designated auxiliary operator, the operator's controller, the shift supervisor, and the emergency planning supervisor. The inspector concluded the following communication and control deficiencies contributed to the event: 1) the drill-designated auxiliary operator mistakenly believed that the control room requested that the auxiliary fwdwater bypass valves be throttled closed; 2) the controller was not present during the valve manipulations; and, 3) when the controller was notified of intended valve manipulations by the auxiliary operator, he did not question the basis of the action.

The inspector noted that the drill-designated auxiliary operator has not participated in emergency preparedness drills or exercises and was recently qualified as a turbine building auxiliary operator. These facts do not appear to be a factor in the event. The emergency preparedness drill critique referred this issue for investigation by the on-site NIISCo nuclear safety engineering group. The inspector will review the results of this investigation and implementation of any proposed corrective actions (IFI 93-16-03).

6.0 EXIT MEETINGS During this inspection, periodic meetings were held with station management to discuss inspection observations and findings. At the close of the inspection period, an exit meeting was held to summarize the conclusions of the inspection. No inspection material was given to the licensee and no proprietary information related to this inspection was identified.

In addition to the exit meeting for the resident inspection held on September 3, the following meetings were held for inspections conducted by Region I based inspectors.

Inspection Reporting Areas Report No.

Dates Inspector Inspected 50-213/93-15 7/26-30/93 Drysdale Motor-Operated Valve Inspection Followup G

-

- - __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _ _ _ _ _. - _

_ _

-_

e

!

l ATTACIIMENT 1 i

EMPLOYEE CONCERNS PROGRAM i

l

,

Plant Name: Haddam Neck, Millstone Units 1,2, and 3

Licensee:

Connecticut Yankee Atomic Power Company, and Northeast Nuclear Energy j

Company l

Docket:

50-213,50-245,50-336, and 50-423

.

A.

PROGRAM:

!

,

1. Does the licensee have an employee concerns program?

i i

l YES r

The licensee first developed the employee concerns program in August 1982. A i

i separate nuclear safety concerns program office was located off-site on January 1,1990

!

2. Has NRC inspected the program? Report #:

l

i YES l

l The NRC previously reviewed the licensee's Nuclear Safety Concerns Program in l

Report 50-213/90-82, 50-245/90-81. 50-336/90-81, 50-423/90-82, Special Review

Group report on March 6,1992, and Special Team Review, dated June 8,1993.

l The licensee presented the contents of the nuclear safety concerns program l

(NSCP) to NRC Region 1 on March 22,1990.

l

!

B.

SCOPE:

i

!

1. Is it for:

!

a. Technical?

!

l YES

!

l The principal focus of the program as documented in Procedure NEO

2.15, " Nuclear Safety Concerns," is to resolve nuclear and radiological

!

safety concerns. The licensee also has Procedure NEO 2.30, " Differing Professional Opinion Resolution," with an objective to evaluate differing l

judgements on matters of technical and safety significance that differ from l

the prevailing line management position.

i l

.

l l

'

-

,

,,

-

-, -,, -, - -. - -,,.

,

--

-

-v.,

,--,

-- -,

-,,-,,n,

.,

n,,,,n,-

,,-

..

.

.

Attachment 1

b. Administrative?

YES Procedure NEO 2.15 states that the licensee's NSCP will facilitate contact between the alleger and the appropriate Northeast Utilities management for non-nuclear concerns.

c. Personnel issues?

YES Procedure NEO 2.15 states that the licensee's NSCP will facilitate contact between the alleger and the appropriate Northeast Utilities management for non-nuclear concerns. Ilowever, it should be noted that administrative procedures exists for employee grievances and union grievances.

2. Does it cover safety as well as non-safety issues?

The licensee's definition of a nuclear safety concern is that it focuses on observations believed to violate regulatory requirements or Northeast Utilities (NU's) policy or procedure concerning nuclear safety, which have not been

?

adequately /promptly addressed by formal quality program reporting mechanisms or fall outside the scope of the formal reporting mechanisms (i.e., non-conformance reports, plant incident /information reports, drawing change requests, etc.)

3. Is it designed for:

Nuclear Safety?

'

YES Personnel Safety?

YES Personnel issues - including union grievances?

YES Ilouever, other administrative processes better define actions concerning union issues.

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ = _ _.

_ _ _ _ _ _ _ -

.__

. _ - _

- _ -

_.._ ___ _ ___

_.

__

_

-_

Attachment 1

4. Does the program apply to all licensee employees?

YES Licensee Procedure NEO 2.15 section 2.0, states that the Nuclear Engineering and Operations Group, including NoHheast Nuclear Energy Company and the Connecticut Yankee Atomic Power Company, suppoding organizations within NU, and all other personnel (including contractor personnel) working at Nonh-i east Utilities Service Company, Connecticut Yankee, or Millstone Station.

5. Contractors?

l YES See the response to question No. 4.

6. Does the licensee require its contractors and their subs to have a similar program?

NO Licensee Procedure NEO 2.15, Step 5.7 states that Nodheast Utilities Contractor Managers shall ensure that the requirements of contracts for nuclear work extend the requirements and protection of this procedure to all personnel directly_

employed by NU vendois/ contractors and subvendors/ subcontractors to perform nuclear work.

7. Does the licensee conduct an exit interview upon terminating employees asking if they have any safety concerns?

YES CYAPCo Procedure ADM 1.1-123, " Nuclear Safety Concerns Program - Exit Interview," requires that the department head / manager at the termination or transfer of an employee to an NU non-nuclear position, notifies the Administra-tive and Financial Control Supervisor or Designee to schedule an exit inteniew with the Nuclear Safety Concerns Program. The licensee added an exit interview with the Nuclear Safety Concerns Program by a inter-office memorandum, dated Fehrmary 22,1990. At NNECo, an exit interview with the NSCP is part of the employee termination /or transfer process. At NU corporate office, the exit interview is currently under revision to " formalize" the process.

..

..

.

.

. _

_

- _ _

_.

._ ___ - - _ _ __ -

,

Attachment 1

C.

INDEPENDENCE:

1. What is the title of the person in charge?

Director, Nuclear Safety Concerns Program 2. Who do they report to?

The Director, NSCP reports administratively to the Executive Vice-Parsident, Nuclear, and functionally to the NU Chairman of the Board 3. Are they independent of line management?

Oreanization YES The NSCP organization is independent of line organization based on the manage-ment reporting chain. The peer evaluators for the NSCP do not report to their respective line management when dealing with a nuclear safety concern from another individual.

Follow-up of Concerns YFE AND NO YES in that if the individual requests confidentiality the resolution of the issue may not rely on line management support (i.e., consultants). NO. in that the licensee's Nuclear Safety Concerns Program encourages communication between employee's and their direct line management for the resolution of a nuclear safety concern. If an individual does not request confidentiality the resolution of the concern may be from line management.

Final Resolution of Concern YES The NSCP Director makes the final decision for resolution of a concern. The decision may/or may not agree with line management's resolution.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ -

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _____

_ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _

___

s Attachment 1

4. Does the Employee Concerns Program use third party consultants?

The licensee Procedure NEO 2.15, Step 6.2.2. allows for third party consultants to be used for resolution of a nuclear safety concern when the program needs to protect the identity of the alleger, or the licensee does not have the available technical expertise.

5. How is a concern about a manager or vice president followed up?

Licensee Procedure NEO 2.15 states that confidentiality can he obtained. If a prospective alleger has a concern of management dealings of the nuclear safety concern the individual can go to progressively higher levels of management for resolution.

D.

RESOURCES:

1. What is the size of the staff devoted to this program?

The licensee has one Director, one staff consultant, one secretary, and thirty-two pecr evaluators at Millstone Station, the Connecticut Yankee station, and the NU Corporate Office.

2. What are employee concerns program staff qualifications (technical training, interviewing training, investigator training, other)?

Both the NSCP Director and staff consultant have each approximately twenty years of management experience. The staff consultant has received training by NU legal staff on 10 CFR 50.7 and business ethics. The peer evaluators undergo approximately sixteen hours of orientation training. The orientation training consists of the program expectations, legal aspects, and hypothetical scenarios.

Two of the thirty-two peer evaluators are NU supervisory personnel. The peer evaluators arr volunteers within the NU organization, that have assumed a collateral job function as a NSCP peer evaluator.

E.

REFERRALS:

1. Who has followup on concerns (Employee Concerns Program Staff, line management, other)?

Procedure NEO 2.15, Steps 6.1.4 through 6.1.7 state that the appropriate Nuclear Plant Operating Companies (NUPOC) (i.e., CYAPCo) and NEO functional management will assess the impact of the concern, assign resources, and set a plan in motion to evaluate and resolve the nuclear safety concern consistent with the severity of the concern. Results of the evaluation and

_

_

. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

_ _

Attachment 1

corrective actions required shall be provided to the appropriate NUPOC Director, Executive Vice-President, Nuclear and Division Vice Presidents. The supervisor shall provide the results of the preliminary evaluation in writing to the individual within 14 calendar ders.

When the individual chooses not to communicate the nuclear safety concern with the management chain-of-command: NEO 2.15, Section 6.2 states that upon receipt of the nuclear safety concern the NSCP Director will immediately notify the Executive Vice-President, Nuclear of the NSC in such a manner as not to disclose the individual's identity. The Nuclear Safety Concerns Program will work with the appropriate NUPOC and NEO management to evaluate all nuclear safety concerns. When necessary to protect an individual's identity, the NSCP will obtain an independent perspective, or secure technical expertise not available within NEO.

NEO 2.15, Section 5.0, " Responsibilities," state that the Director of NSCP, and the NSCP Peer Representatives are not involved in the resolution of the nuclear safety concern.

F.

CONFIDENTIALITY:

1. Are the reports confidential?

YES NEO 2.15, Section 6.6 states that documentation pertaining to the identity of individuals raising NSC shall be maintained in locked confidential files with limited access. The final resolution report of the concern is sent to the alleger's home address or other non-work related address.

2. Who is the identity of the alleger made known to (senior management, Employee Concems Program Staff, line management, other)?

NSCP staff. If the issue is of a non-nuclear matter, the NSCP may raise the issue with other NU departments (i.e. Iluman Resources Group).

3. Can employees be:

a. Anonymous? YES b. Report by Phone? YES NEO Procedure 2.15 provides a toll free "800" number.

..

..

.

..

.

_ _ _ _ _ _ _ _ _ _ _ _.

_ _ _ _ _ _ _ _ _ _ _

- __

..

,

Attachment 1

G.

FEEDBACK:

1. Is feedback given to the alleger upon completion of the followup?

YES If the nuclear safety concern is provided to line management by the alleger, the supervisor of the individualis required to in writing provide preliminary evaluation within 14 days. If the preliminary evaluation does not completely resolve the concern, the supervisor shall inform the individual of an action plan for resolution.

If the alleger seeks confidentiality of a nuclear safety concern. the Nucicar Safety Concerns Program will provide notification of the final resolution to the individual, if possible.

2. Does program reward good ideas?

NO Inspector review of NEO 2.15 concluded that no mention was provided for a reward system for good ideas. According to the NSCP staff, for non-confidential concerns, NSCP may encourage line management to initiate a performance reward.

3. Who, or at what level, makes the final decision of resolution?

NSCP Director 4. Are the resolutions of anonymous concerns disseminated?

NO 5. Are resolutions of valid concerns publicized (newsletter, bulletin board, all hands meeting, other)?

NO

_ _ _ _ _ _ _ _ _ _ _ _ _ -

,

Attachment 1

II.

EFFECTIVENESS 1. How does the licensee measure the effectiveness of the program?

According to the NSCP staff, the effectiveness of the program is measured on a case-by-case resolution of issues. Specifically, the NSCP requests alleger feedhack on the resolution by either agreement or disagreement. In addition the licensee measures the amount of concerns processed by the NRC to measure the effectiveness of the program.

2. Are concerns:

a. Trended?

YES b. Used?

According to the NSCP staff, if the concerns are beneficial to the organization, employee recognition by line management may he initiated, when recommended by the NSCP staff.

3. In the last three years, how many concerns were raised?

According to the NSCP staff, the number of concerns are available for NRC audit purposes.

Of the concerns raised, how many were closed?

As of August 1993, approximately 84% of the cases were closed.

What percentage were substantiated?

The NSCP staff does not consider if concerns were substantiated, but rather if

,

the alleger's were satisnea with the final resolution of the concern. Of the identified concerns approximately 91% of the alleger's were satisfied with the resolution.

4. How are followup techniques used to measure effectiveness (random survey, interviews, other)?

The NSCP program seeks feedback on the resolution from the alleger to measure program effectiveness. The NSCP staff has not initiated employee surveys related to the program and its objectives.

. _ _ _ _ _ _ - _ _ _ _ - _

_ _ _ _ _ _ _ - _ _ _ _ _ _ _ _

..

Attachment 1

5. How frequently are internal audits of the Employee Concerns Program conducted and by whom?

None according to the NSCP staff.

I.

ADMINISTRATION / TRAINING:

1. Is Employee Concerns Program prescribed by a procedure?

YES Licensee Procedure NEO 2.15, Nuclear Safety Concerns Program 2. How are employees, as well as contractors, made aware of this program (training, newsletter, bulletin board, other)?

Employees are raade aware of the program through general employee training (GET), posters, various " drop" boxes located within the NU system, annual letter to all employees by senior NU management, departmental meetings, administrative control procedure training, and by the existence and awareness of

" peer" evaluators.

ADDITIONAL COMMENTS:

1. According to the NSCP staff, all concerns are considered " valid".

2. According to the NSCP staff, during orientation training of the " peer" evaluators, the NU Chairman of the Board, President, and Executive Vice-President, Nuclear attended the sessions detailing their expectations from the program.

-

_ _ _ _ _ _ - _ _ _ _ _ _ _ - _ -

.

.

ATTACIIMENT 2 CY OUTAGE ASSESSMENT The twelve events selected for this inspection which were associated with the conduct of the Cycle 17 refueling outage are described on the event summary sheets below. The issues along with the primary and contributing causes are also summarized in Table 2.

The EDO event involved two separate issues: (1) the EDG loss of field; and (2) the discovery that the loss of field trip was never operable. There are a number of primary and contributing causes for the events. The events can be grouped under root caure into the following categories (in order of declining frequency): personnel error - 5, equipment failure - 4, original l

construction error - 2, deficient design - 1, and inadequate procedure - 1. Although no one cause dominates, the failure of personnel to satisfactorily perform routine duties can be linked to 5 of the events. NRC assessment of the issues and overall outage performance is l

provided in Section 5.6.

!

i Event / Issue Summary: 1 Service Water IIcader Inoperability With the plant at 100% power on May 12, during the performance of S"rveillance Procedure SUR 5.7-148B the control switches for the "B" and "C" service water pumps were placed in trip pullout (TPO) rendering both service water headers inoperable. The service water pumps were in TPO for forty-one (41) minutes. The licensee reported the event as a condition prohibited by technical specifications in LER 93-004.

Cause: Personnel Error

,

The shift supervisor recognized that two of the four pumps were in TPO, and were unable to automatically start on a safety injection signal. The shift supervisor incorrectly believed that having the secondary plant operator in attendance was acceptable to maintain operability of the system. Operations Department Instruction -1 states that manual action in place of automatic action for the purpose of maintaining operability without entry into a technical specification action statement is generally not appropriate; however, it maybe acceptable with a full consideration of all pertinent differences between manual and automatic response. The shift supervisor recognized the next day after the surveillance that full consideration of all pertinent differences were not considered.

Contributing Cause: Outage Planning & Procedural Deficiency The SUR was initially scheduled to be performed during the refueling outage in cold shutdown. This was implied in the " frequency" statement of SUR 5.7-148. The SUR was vague regarding the plant condition needed to perform the test and did not explicitly state the plant must be in cold shutdown or refueling. The outage manager together with the job supervisor decided to remove the surveillance from the outage due to schedule con 0icts.

Neither the job supervisor, nor the outage manager reviewed or appreciated the vague mode requirement stipulated in the frequency statement of Procedure Step 1.3.1. The procedure did not describe the service water system alignment needed to accomplish the test.

.

.

-

.

-.

-

-

.__

. _ _ - _ _ _ _ _ - _ _ _ _ _ _ - - - _ _ - _

I l

Attachment 2

Assessment The issue and reponable condition was self-identified by the SS involved in the activity.

Given the initial error, the self-criticism and openness demonstrated by the individual is notable. Further, the error was not simple, but was complicated by other circumstances:

(i) the procedure did not explicitly state the plant had to be in cold shutdown: (ii) there was prior history in which the surveillance was done with the plant not in cold shutdown; and, (iii) the operating crew believed that the surveillance had been appropriately scheduled as a planned activity.

The licensee added a prerequisite step to SUR 5.7-148, to require the surveillance to be performed in cold shutdown / refueling, and operations personnel were reminded of their responsibility to not enter TS 3.0.3 to accomplish surveillance testing. Additionally, the.

licensee is considering adding h summary sheet to IST procedures to describe the expected system response during the test. Licensee corrective actions were acceptable.

_ - _ _ - _ _ - _ _ _ _ _ _ - _ _ _

.__________ _ ___

l

>

Attachment 2

Event / Issue Summary: 2 Dnergency Diesel Generator less of Field Trip on May 25 On May 25,1993, at approximately 1:30 p.m., the "A" emergency diesel generator was manually tripped. The diesel was operating in parallel with off-site power pursuant to Special Test i1.7-108. The purpose of the test was to demonstrate the full-load carrying capability for twenty-four hours when operating in parallel with off-site power. The emergency diesel generator was operating for approximately twenty two hours, when control room operators noted various control room annunciators. The auxiliary operator was directed from the control room to trip the diesel generator output breaker. The licensee identined that the Geld breaker was in a " trip-free" condition.

Cause: Equipment Failure - Surge Suppression Diodes Licensee troubleshooting identified that two (2) suppression diodes had electrically shorted.

The diodes were part of the EDG field excitation circuitry. The suppressor failure resulted in a loss of recti 6ed direct current power to the generator Ecid.

Contributing Cause: Inadequate Maintenance Program on Excitation Cabinet Exhaust Fans The licensee determined that both emergency diesel generator excitation cabinet exhaust fans were not in operation as designed. No periodic maintenance was performed on the fans, nor any operator checks to verify successful operation. The fans are designed to cool the electrical components within the excitation cabinet. Additionally, poor cicanliness conditions existed based on the accumulation of dust and dirt on the surge suppressor diode heat sink plates.

Assessment The event disclosed a con 0guration control deficiency for the non-safety grade loss of field trip. A loss of field trip was thought to be included in the original design. Instead, the vendor had provided an alarm that was enabled only during engine startup. The loss of field trip should have tripped the diesel generator during the surveillance. Licensee investigation following the May 1993 event, determined that the trip was not enabled based on the actual circuit wiring. Thus, the loss of field trip would not have functioned in either the non-accident mode (as described in the UFSAR) and during the accident mode of operation.

Licensee short-term corrective actions (reference LER 93-006) were to replace the surge suppression diodes, provide an air stop between the generator and excitation cabinet, and periodically verify excitation fan operation. Long-term corrective actions include a modifica-tion to run the exhaust fan operation during diesel generator operation, programmatic review of periodic maintenance associated with instrument and controls cabinets, and engineering work request to restore the intended design function of the loss of field trip for the emergency diesel generators. Corrective actions were thorough and acceptable.

.....

n o

Attachment 2

Event / Issue Summary: 3 Loss of Power Event - June 22 On June 22,1993, while performing breaker failure trip logic testing on the offsite power tie breaker, the station experience a total loss of offsite power. In response to the loss of offsite power both emergency diesel generators automatically started and provided emergency power

,

to the station. The plant was in cold shutdown at the time of the event and shutdown cooling was restored. Operator performance in response to the loss of offsite power was good.

Cause; Original Plant Construction Error The root cause for this event has been identified to be a wiring error in offsite power tie breaker 12R-lT2 breaker failure trip logic. The wiring error occurred during or shortly following plant construction.

<

Contributine Cause;. Inadequate Test methods The subject breaker & trip scheme is located in the plant but is equipment that is under the l

jurisdiction of the NUSCo Transmission and Distribution System (T&D) and the Regional Test Department. The wiring error had not been previously identified since this was the first test conducted of this particular trip logic.

Assessment

,

l An evaluation of the wiring error's effect on plant safety concluded that the error did not degrade plant safety margins and could be left as is. The root cause was correctly identified

.

I and the corrective actions were acceptable.

CYAPCo has been working with NUSCo T&D to improve the scope and quality of the testing of equipment under NUSCo jurisdiction. This event resulted because improved test procedures identified long standing equipment problem.

1 l

l

,

l

!

l l

r h

-

.

-.

-_,

Attachment 2

Event / Issue Summary: 4 Loss of Power Event - June 26 On June 26,1993, while performing surveillance testing of the "A" train of the safety injection actuation logic with a partial loss of offsite power, a complete loss of offsite power occurred. In response to the loss of offsite power the emergency diesel generators automati-cally started and shutdown cooling was restored.

s Catg; Equipment Failure The root cause of this failure was determined to be a blown fuse to a bus voltage sensing relay. The fuse was likely blown during maintenance performed on associated equipment.

The fuse was replaced and the surveillance procedure was revised to verify that the bus voltage sensing relay fuses were not blown prior to conducting this test. The operator response to the loss of offsite power was good.

Contributing Cause: None A question initially raised about this event was whether CYAPCo personnel identi0ed a significant problem and then failed to address it. NRC review determined that GTS personnel missed an opportunity to identify the failed fuse about 2 weeks prior to the June 26 event, but the decisions made at the time were reasonable based on the symptoms of the problem presented to the workers.

Assessment The root cause for this event was positively identified and the corrective action taken were appropriate. The June 22 and June 26 events, were not related in that the corrective actions from the first event could not have precluded the second event from occurring. The corrective actions were acceptable and operator performance in response to the loss of offsite power was good.

-

_.

_ _ _ _ _ _ _ _ - _ - _ _ _

__

L

>

Attachment 2

Event / Issue Summary: 5 Loss of MCC-5 - Jime 27 i

On June 27,1993, while performing surveillance testing of the "B" train of the safety injection actuation logic with a partial loss of offsite power, a temporary loss of motor control center 5 (MCC-5) occurred, when the automatic bus transfer scheme failed to operate. Power was quickly restored to the motor control center by manually closing a breaker to an energized bus. This event was important to safety because MCC-5 provides power for the emergency core cooling system injection valves and the successful operation of MCC-5 is essential for the emergency core cooling system to function.

During this event, an erroneous event classification of an Alert was sent to the state and towns. The event classification was corrected to an unusual event a short time later. The event was properly classified by shift personnel, but was miscommunicated as an Alert. The reason for this error was determined to be a performance error by a non-licensed shift member who transmitted the message. See the SSSA issue sheet for a fuller discussion of this item.

Cause: Equipment Failure The probable cause for the failure of MCC-5 to properly transfer was determined to be either a failure of the Agastat undervoltage relay on Bus 6, or the failure of the 52X relay in the DB-25 supply breaker from Bus 6 to MCC-5. These components were replaced. The MCC-5 ABT was subsequently tested successfully.

Contributing Cause: None Assessment A detailed evaluation of this event failed to positively identify a root cause. The evaluation did identify two components which had the highest probability of having caused the failure.

Both these components were replaced and the ABT was successfully tested numerous times since the event. The CYAPCo formal root cause investigation for the failure was ultimately extensive and thoroughly implemented. Some NRC prompting was required to assure a portion of the investigation was completed prior to startup.

The MCC-5 event is appropriately considered an "on-demand" failure versus a " standby" failure. Thus, the PM program for the equipment had no bearing on the event. CYAPCo revised its test procedures starting this outage to test the MCC-5 ABT function as part of the LNP test, and to enhance the reliability of the function. The issue was raised as a result of improved testing plan for the ABT scheme.

- _ _ _ _ _ _ _ _ _ _.- - _ -

_

. _ _ _ _ _ _ _ _

_ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _

)

Attachment 2

Event / Issue Summary: fi SSSA Performance - Alert on June 27 On June 27,1993, while performing surveillance testing of tne "13" train of the safety injection actuation logic with a partial loss of offsite power, a temporary loss of motor control center 5 occurred, when the automatic bus transfer scheme failed to operate. The event was reported to the NRC as an Unusual Event, but was initially reported to the State of Connecticut and the towns within the Emergency Planning Zone (EPZ) as an Alert. The event classification was corrected to an unusual event a short time later. The event was properly classified by shift personnel, but was miscommunicated as an Alert. The incorrect Alert classification was identified by others in the control room who heard the event notification being broadcast over the pager system.

Cause: Personnel Error The communication error was a performance error by a non-licensed shift member who transmitted the message.

The event was properly classified as an Unusual Event by the Shift supervisor. The information was properly coded on the Incident Notification Form (INF), as approved by the shift supervisor. The SSSA incorrectly translated the incident Classification from the form to the emergency notification response system (ENRS). The error was made because the SSSA did not adequately verify the information as he was imputing it into the ENRS, and in spite of three subsequent opportunities to check the inputs for accuracy and to discover the incorrect Alert classification coded into the electronic massage.

The SSSA stated he was overly focused on getting the initial message out within the 12 minutes, and did so at the expense of assuring the accuracy of the information.

Contributing Causm None Assessment The root cause for the miscommunication of the June 27 emergency message, was personnel error in failing to follow procedures and exercisir.g attention to detail in the completion of an assigned task. Procedures were adequate, and training was not a factor in the event.

Licensee actions to address a personnel performance issue were appropriate.

i

- - _ - _ - _ - _ _ _ _ _ _ _

.

.

l Attachment 2

'

Event / Issue Summary: 2 less of Vital Buses On July 6, at approximately 1:12 a.m., the plant experienced a loss of two 120 volt AC vital buses. The loss of the two vital buses resulted in an unplanned ESF signal. The deenergized buses resulted in two of the four containment pressure channels failing to a

,

tripped condition, satisfying the two-out-of four logic, and resulted in a high containment pressure ESF signal. Both vital buses were lost for approximately 14 minutes. No safety consequences existed during the loss of the vital buses.

The licensee was performing PMP 9.1-35, " local load Testing of EG2B," for the first time to verify that emergency diesel generator 2B can be locally controlled and loaoed onto the emergency bus. The procedure functionally verifies the expected operator actions during AOP 3.2-50, " Operations Outside the Control Room."

Causel Equipment Failure l

No specific root cause was identified by the licensee on the failure of the C and D vital inverters supplying power to their associated buses. Probabic causes such as AC breaker

'

instantaneous current setpoints to low, and a fault on the inverter card could plausibly explain the event. The inverters were tested successfully under ST 11.7-127 that essentially verified the design function that one inverter could carry both vital buses, during a loss of the back-up power supply (MCC-12).

Contributing Cause: Inadequate Periodic Maintenance (possible)

The inverter preventive maintenance program previous to the event was a visual inspection

,

l and cleaning of the intemal components every refueling outage. During troubleshooting of l

the inverter failures, the licensee identified that the DC inverter input breaker setpoint was out-of-specification with no periodic verification of the setpoint required in the maintenance program. Additionally, the licensee identiGed a fault on the inverter control card, that is not under any periodic maintenance activity.

l Assessment i

!

Operator response to the loss of the inverters was appropriate. Based on the troubleshooting

'

efforts the licensee developed a method to set the AC instantaneous overcurrent setpoint, a need to periodically check the DC input breaker undervoltage setpoint, and to enable the automatic transfer switch with periodic operator veriGeation. The licensee was having the inverter supplier perform a failure analysis on the inverter control card at the end of the outage.

_

,,.-.

_

.

-.

h l

l P

Attachment 2

Event / Issue Summary-3 Safety-Related 480 volt Molded Case Circuit Breaker (MCCB) Trips During Pinnt Testing

,

i The licensee documented four events since May 1993, concerning 480 volt molded-case circuit breakers found in a tripped condition. 'Two of the events occurred during the loss of j

off-site power event on June 26, and during *n : MCC-5 automatic bus transfer testing on l

July 7. During the loss of cfi-site power event on June 26, operators attempted to close two safety injection mo:er-operated valves (SI-MOV-861 A & B) with a safety injection signal l

present. The valve breakers tripped off. On Jt0y 7, three safety-relued breakers tripped, l

and one control air compressor breaker tripped duing the testing ci the automatic bus transfer scheme for MCC-5.

l Causel Design Error - Insufficient Overcurrent Setting During a previous refueling outage, NUSCo engineering replaced breakers on MCC-5 from j

Westinghouse type HFA's MCCB's to Westinghouse circuit protection breakers (HMCP's).

The replacements were based on obsolete parts for type HFA's. In addition, the HMCP's provided an adjustable instantaneous current trip setpoint, lower instantaneous trip setpoints in the HMCP's, and in doing so provided improved motor protection.

The insufficient overcurrent settings on the replaced HMCP breakers were resulting in the unnecessary tripping of the breakers. NUSCo engineering determined that two causes resulted in raising the instantaneous overcurrent setpoint from 2.1 X Locked Rotor Current (LRC) to 4.6 X LRC. The causes were " plugging" and " jogging" of motor operated valves, and thc 11CC-5 automatic bus transfer scheme from the preferred source of Bus 6.

Contributing Cause: None The licensee stated that a lack of guidance existed in IEEE standard 242-1986, and from Westinghouse Corporation for the actual settings of the instantaneous overcurrent setpoints for HMCP breakers. Based on plant experience and knowledge gained during MCC-5 automatic bus transfer testing, the licensee chose a value that afforded protection to the motors and prevented unnecessary trips of the breakers.

Assessment The licensee evaluated the breaker tripping for operability and reportability. The initial conclusion was that the breakers were operable and not reportable. Plant management has initiated a formal root cause analysis of the NUSCo design work for the HMCP modi 0 cation.

-

-

-

i

!.

l

.

Attachment 2

Event / Issue Summary: 2 Main Steam Safety Valve Failures

'

!

Main steam safety valve (MS-SV-21) did not lift on July 13, during testing per SUR 5.5-2, j

" Main Steam Safety Valve Surveillance Testing." Subsequently, valve MS-SV-11 failed to

'

!

close for approximately four minutes after a successful lift. CYAPCo stopped main steam safety valve testing to investigate the cause of the failures.

,

Cm!El Personnel Error MS-SV-21 failed to lift due to improper maintenance. During valve overhaul earlier in the

,

outage, the valve stem was not fully engaged into the 6sc holder. Vendor personnel j

performing the work were aware of the stem to disc holder configuration, but he did not verify proper engagement. MS-SV-11 failed to close duc to a misaligned safety valve lifting device. The safety valve lifting device held the valve open, wiien the air pressure was reduced. Maintenance personnel removed the device and the valve rescated properly. Test personnel failed to verify correct operation of the test device when testing MS-SV-11.

Contributine Cause: None (Inadequate Procedure - possible)

During the refueling outage, the valve vendor (Crosby) personnel perform on-site overhaul on all sixteen main steam safety valves. The remaining fifteen valves were overhauled l

satisfactorily based on successful "as-left" test results pursuant to SUR 5.5-2.

l l

Enhancements were made to procedures that had been used successfully in the past. A l

possible contributing cause to both events was a lack of detail in the overhaul and surveil-lance procedures.

Maintenance Procedure PMP 9.5-210, " Main Steam Valve Preventative Maintenance," requires the worker to lubricate and thread the stem into the disc holder. No additional measures are required to check for axial clearance, or to ensure that the stem has been fully engaged into the disc holder. Additionally, SUR 5.5-2 for testing the safety valves describe how to install the device, yet no checks are taken to ensure that the device is aligned on top of the valve appropriately.

The licensce's corrective action to the events were to refurbish the test rig and to add details to the procedures. A revision to Procedure PMP 9.5-210 will provide better guidance on the stem to disc holder installation.

Assessment The licensee identified root cause of the failure of MS-SV-21 to lift at its setpressure was due to improper maintenance overhaul of the safety valve, and incomplete procedural steps to accomplish the overhaul. The failure of MS-SV-Il to rescat was due to a test device failure.

Licensee corrective actions to the failures were acceptable.

,

.

.-.

..

.

l i

f i

!

b

!

Attachment 2

Event / Issue Summary:.LQ Inoperable Main Steam Line Flow Instruments During routine inspections on July 14, of work they had performed under plant design change record (PDCR) 1331, Instrument & Control technicians noted that main steam line l

Dow instruments FT-1202-1,1202-2,1202-3 and 1202-4 were isolated. The *echnicians had placed the instruments in service when the channels were last tested on July 1, and expected to find the instruments in service on July 14. The technicians immediately notified the control room operator of the status of the instruments, and placed the instruments back in service at about 1:00 p.m., by opening the high and low side isolation valves, and closing the equalizing valve on each transmitter. Plant safety was not degraded, and the actual plant l

safety signiGcance of the inoperable transmitters was low.

i

'

!

Cause; Personnel Error t

CYAPCo concluded that the transmitters were inappropriately removed from service some time between July 1 and July 14.

The transmitters were manipulated during surveillances SUR 5.2-38.1 through 4, and ST 11.2-6 during the refueling outage. Both surveillances use independent verification to l

return the channels to service following each test activity. The last test conducted on the

'

channels was ST 11.2-6 which was completed on July 1. The plant was in operational Mode 5 upon completion of the PDCR 1331 test on July 1, which left the channels aligned for service and plant startup. The plant startup from the refueling outage began on July 11, when the plant was heated up to Mode 4, and the plant entered operational Mode 3 at 1:32 a.m., on July 13. The main steam line flow instruments were returned to an operable status at 1:00 p.m., on July 14.

Contributing Cause: Inadequate Procedure - Configuration Control

'

Because of its signiGcance and the implications raised by the event on the adequacy of the

administrative controls for controlling system status for plant mode changes, plant

.

'

j management directed that a formal root cause analysis and human performance evaluation l

system (HPES) review be performed. Additional long term corrective actions will be l

developed based on the results of the HPES evaluation.

)

i Assessment l

l CYAPCo followup actions were prompt, appropriate and thorough. No violation was issued since the violation was identified by the licensee; it was classified as a Severity level IV: it l

was not reasonably expected to have been prevented by the corrective actions for a previous violation; and, the licensee corrective actions taken or planned were appropriate and comprehensive.

l

,

.

._

--

.

_ _

Attachment 2

Event / Issue Summary: lla Low Temperature Overpressurization Event - July 7 At approximately 5:37 p.m., on July 7, the licensee was performing ST 11.7-127, " Test of C and D Inverters," when solenoid valve (CH-SOV-110) deenergized and charging Dow control valve traveled open. The intention was to deenergize the vital bus, but the developers of the ST failed to identify the effects of the loss of the vital bus on the charging Dow control valve. The unit was in a water solid condition with the RCS at 300 psig and 114 degrees F.

l The final pressure recorded on the RCS narrow range instrument was 430 psig. Operators

'

terminated the excessive charging ficw by energizing the "D" 120 volt vital bus and by closing the charging Dow control valve.

!

Cause Procedure Deficiency ST 11.7-127, Step 6.9.4 required that the "D" vital bus be deenergized. The developers of the ST did not alert the operator that deenergizing the loads on the vital bus (including

SOV-110) would result in the flow control valve failing open. This was the first time the l

special test was implemented. AOP 3.2-15, " Loss of Vital Bus," Step 3.4.2 does direct

!

operator actions in response to a loss of a vital bus, and directs the operator to control the i

charging system.

The procedure was developed and approved in less than one day. NRC review concluded that no pressures or demands from management were made to develop the procedure as expeditiously as possible.

l Contributing Cause: Personnel Error - Engineering l

The reviewers of the special test focused on preventing an inadvertent ESF signal since the loss of vital buses earlier in the outage resulted in an unplanned ESF actuation. The failure by the reviewers to consider all possible responses by equipment affected by the ST contrib-uted to the event.

Assessment i

!

Operator response was expeditious and proper. Prompt operator actions and the operation of l

the LTOP system mitigated the RCS pressurization. Site and corporate engineering support to evaluate the event was appropriate to show that the technical specification pres-sure/ temperature limits were not exceeded.

l l

t i

I i

.- -

. ~.

--

i 9-

Attachment 2

Event / Issue Summary: 1lb Low Temperature Overpressurization Event - July 9 On July 9, at approximately 3:00 p.m., the licensee was performing an post-maintenance test j

to verify acceptable operation of the boric acid strainer discharge check valve. The reactor j

'

coolant system was in a water-solid condition at 148 F and 300 psig. The operators aligned the charging system in a manner that unknowingly provided a flowpath from the operating charging pump through the non-operating charging pump piping and into the charging fill header. Prior to the system alignment, the operating charging pump was controlling pressure

-

through the charging header. The added charging flow through the fill header resulted in RCS pressure going to 455 psig. The operator immediately shut the charging fill header valve to stop the unaccounted mass addition to the RCS.

Cause, Inadequate Procedure The cause of the operator alignment with the charging pump and fill header was a result of a non-descriptive system alignment in Procedure SUR 5.7-31. The procedure details the suction path alignment, but does not provide details on the alignment of the discharge of the charging and metering pumps.

Contributing Cause: Personnel Error - Operator Operators aligned the system using the Piping and Instrument Drawings, and failed to recognize an additional charging flow path created through the non-operating charging pump.

,

This path was evident by a more careful review of the drawings. Licensee corrective actions were to depressurize the RCS and discuss this event with the first LTOP event with operating crews. A stop work directive was given for all maintenance associated with the#RCS. The next day the operators repressurized the RCS in preparation for plant heat-up.

Assessment The control room operators recognized the system alimment error and expeditiously terminated the mass flow imbalance. Site and corporate engineering support was appropriate to evaluate the event with the required pressure / temperature limits within the technical i

specifications. The licensee is preparing a special report pursuant to Technical Specification j

3.4.9.3.c.

i

. _ _,,

, _. -,

,

,

._

-.

,

e

.

,

t Attachment 2

Event / Issue Summary: J2 Reactor Scram on July 19

A reactor scram occurred at 2:47 p.m., on July 19, 1993, due to the inadvertent generation

'

of a wide range (RR) high startup rate (SUR) trip signal. The reactor was critical at the time

'

with a power of 4.0 X 10-2 on the wide range. The scram occurred while plant operators

l were testing the nuclear instrumentation in accordance with Procedure NOP 2.1-8, * Nuclear

'

l Instrumentation Short Form." The plant responded as expected following the scram and the plant transient was minimal.

,

,

Cause: Operator Error

,

i l

The scram occurred due to an error by the operator while performing Step 6.2.1 of NOP l

l 2.1-8. The operator had pressed and released the " calibrate" switch as required to check i

wide range channel 1 (WRI) indications and trips. The operator failed to reset the WR1

-

trips upon completion of the step as required, which left a WR high SUR rate trip in effect.

When the operator depressed the " calibrate" switch to perform Step 6.2.2 on WR2, the simulated hi SUR signal completed the 2-out-of-4 logic needed to cause a reactor scram.

'

Contributine Cause: None The procedure was acceptable as written and had been used successfully many times in the past. As a procedure enhancement, the licensee revised NOP 2.1-8 to add an additional

[

caution statement at the start of each check of a nucicar instrumentation channel. -The i

statement reiterated the requirement of precaution 5.3 for the operator to " ensure that no

,

l trips are present before pressing the " calibrate" switch."

]

l Assessment This appears as an isolated performance error by a single RO who failed to follow the procedure. The RO allowed himself to be distracted while performing the surveillance by going behind the panel to seek an 1+C technician in the middle of completing a test of WR channel 1. He failed to complete the procedure step when he came back to the front of the

,

control board. There are no procedure, program or management issues (i.e., staffing, CR distractions, schedule pressures, etc.) contributing to the error.

!

!

l

!

t l

l l

l l

,. _ _.., _ _ _, -.

,

_..,.. _

-.

.

.

-- -

- -

._.

.

_-

.

o I

b

!

+

l TABLE 1

!

l

!

Rosemount Transmitters In-Service at Iladdam Neck

'

Transmitter Model Static Serial No.

Description ID Number Press (PSI)

j i

PT-1201-1B 1154GP9RC

05%264 SG #1 pressure j

PT-1201-2B 1154GP9RC

05%265 SG #2 pressure

.

PT-1201-3B 1154GP9RC

0506266 SG #3 pressure j

PT-1201-4B 1154GP9RC

0506283 SG #4 pressure

[

i FT-1202-1 1153HB5RC 650 0506272 SL Break i

FT-1202-2 1153HB5RC 650 0506273 SL Break j

l

'

FT-1202-3 1153HB5RC 650 0506274 SL Break i

FT-1202-4 1153HB5RC.

650 0506275 SL Break FT-1301-1B 1153HB5RC 950 0506395 FDW Flow l

FT-1301-1C 1153HB5RC 950 0506396 FDW Flow

[

f l

FT-1301-2B 1153HB5RC 950 0506397 FDW Flow

!

FT-1301-2C 1153HB5RC 950 0506398 FDW Flow

FT-1301-3B 1153HB5RC 950 0506399 FDW Flow

[

FT-1301-3D 1153HB5RC 950 0506400 FDW Flow.

Fr-1301-4B 1153HB5RC 950 0506401 FDW Flow

FT-1301-4D 1153HB5RC 950 0506402 FDW Flow

!

FT-1201-1 B 1153HB5RC 650 0506403 Steam Flow FT-1201-lC 1153HB5RC 650 0506404 Steam Flow i

FT-1201-2B 1153HB5RC 650 0506405 Steam Flow FT-1201-2C 1153HB5RC 650 0506406 Steam Flow l

FT-1201-3B 1!53HB5RC 650 0506407 Steam Flow FT-1201-3D 1153HB5RC 650 0506408 Steam Flow FT-1201-4B 1153HB5RC 650 0506409 Steam Flow FT-1201-4D 1153HB5RC 650 0506410 Steam Flow

.

.

._ _ _ _., _

_,. - - _. - _ _. _ _. - _ -, _

.

-.

h L

F

>

Table 1

,

Transmitter Model Static Serial No.

Description ID Number Press (PSI)

LT-1301-1 A Il54HP4RC 650 0506227 SG NR Irvel LT-1301-lC 1154HP4RC 650 0506228 SG NR level LT-1301-ID 1154HP4RC 650 0506235 SG NR Ixvel LT-1301-2A 1154HP4RC 650 0506236 SG NR Ixvel

LT-1301-2C 1154HP4RC 650 0506254 SG NR level LT-1301-2D 1154HP4RC 650 0506255 SG NR Level i

LT-1301-3A 1154HP4RC 650 0506276 SG NR Level

!

LT-1301-3C 1154HP4RC 650 0506277 SG NR Level

,

LT-1301-3D 1154HP4RC 650 0506278 SG NR Level LT-1301-4A 1154HP4RC 650 0506279 SG NR Level LT-1301-4C 1154HP4RC 650 0506280 SG NR lxvel LT-1301-4D 1154HP4RC 650 0506281 SG NR level FT-402D 1154HP4RC 2000 0507246 RCS #2 Flow LT-1307B 1152DP5N2T

0422276 DWST Level B

,

,

b

s TABLE 2 OUTAGE EVENT / ISSUE This is a summary of recent issues at Haddam Neck. They are the significant equipment or personnel performance issues that have been reported in routine inspection reports over the last three months. A detailed description of each issue is provided in the Event / Issue Summaries of Attachment 2.

PRIMARY CONTRIBUTING l

EVENT / ISSUE CAUSE CAUSE 1.

SW Testing - Entry in TS 3.0.3 Personnel Inadeq Proc Error - RO Inadeq Planning 2.

EDG Loss of Field (LOF)

Equipment Inadequate PM Failure Cleanliness EDG LOF Trip Wiring Error Construction None Deficiency 3.

LNP on June 22 - wiring error Construction None Deficiency

---

4.

LNP on June 26 - bad fuse Equipment None Failure 5.

Ioss of MCC-5 on Tune 27 Equipment None Failure 6.

ilert on June 2 Personnel None Error - not RO 7.

Ioss of Vital Buses C/D Equipment Inadequate PM Failure 8.

HMCPs - Breaker setpoints Design Error None 9.

MSS Valve Malfunctions Personnel Inadequate Error - Mnte Procedure 10. Isolated MS Instruments Personnel Inadequate Error - I&C Config Control 11. LTOPs July 7 & 9 Inadequate Personnel Procedure Error - ENGR, OPS 12. Scram on July 19 Personnel None Error - RO l