IR 05000219/1993009
| ML20046A157 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 07/15/1993 |
| From: | Rogge J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20046A154 | List: |
| References | |
| 50-219-93-09, 50-219-93-9, NUDOCS 9307270029 | |
| Download: ML20046A157 (16) | |
Text
r:
.
.
U. S. NUCLEAR REGULATORY COMMISSION
REGION I
Report No.
93-09
-
Docket No.
50-219
,
License No.
,
Licensee:
GPU Nuclear Corporation 1 Upper Pond Road Parsippany, New Jersey 07054 Facility Name:
Oyster Creek Nuclear Generating Station Inspection Period:
May 18,1993 - June 28,1993
,
Inspectors:
Stephen Pindale, Resident Inspector Dave Vito, Senior Resident Inspector Approved By:
A m.
MA-r 7/M f3 John Rogge, Seftion Chi,'eV //
date
'
Reactor Projects Section 4B Inspection Summarv: This inspection report documents the safety inspections conducted during day shift and backshift hours of station activities including: plant operations; radiological controls; maintenance and surveillance; engineering and technical suppon; emergency preparedness; security; and safety assessment / quality verification. The Executive Summary delineates the inspection findings and conclusions.
i I
l
.i
,.
i
!
9307270029 930710'..
PDR ADDCK 05000219
!
G
.PDR
- - -
- -
-
.
,
>
.
.
EXECUTIVE SUMMARY
,
Oyster Creek Nuclear Generating Station Report No. 93-09
,
Plant Operations l
The licensee operated the plant in a safe manner. The licensee's immediate responses and
.
'
subsequent followup activities for two events caused by personnel errors were prompt and appropriate. The two events were collectively characterized as a non-cited violation.
Radiological Controls
,
Periodic observation of station workers and radiological controls personnel noted good
,
implementation of radiological controls and protection requirements.
Maintenance / Surveillance The licensee appropriately implemented the safety objectives of the maintenance and surveillance programs. Planned maintenance for the No. 2 emergency diesel generator (EDG) was well planned and executed. Maintenance personnel appropriately responded to a failed fan shaft on the No. 2 EDG.
i Engineering and Technical Support
'
GPUN identified a condition outside the design basis of the plant concerning reactor building peak pressure following a high energy line break (stress relieving blowout panels could not
,
be located). The inspectors are continuing a review of the related licensee's activities, and
'
the issue is an unresolved item. System engineering involvement with EDG planned and reactive activities was strong.
Physical Security
,
The inspectors determined that the licensee appropriately implemented security program requirements.
Safety Assessment and Ouality Verification
,
The inspectors found that the licensee's actions and existing programs, as related to a reactor water level cold reference leg instrument safety issue, were sufficient to ensure continued safe operation of the plant. Inspector review of an independent audit of the licensee's
,
Operational Quality Assurance Program found that the audit was well conducted and focused on plant safety.
>
ik
.
.
TABLE OF CONTENTS Page EXECUTIVE SUMMARY
............ ii
........................
1.0 OPERATIONS (71707, 93702)
'l
...............................
1.1 Operations S ummary................................. I 1.2 Operator Errors I
....................................
1.2.1 Inadvertent Individual Control Rod Scram................
I 1.2.2 Mispositioned Emergency Diesel Generator Mode Selector S wi tch...................................... 2 1.2.3 Conclusions
..................................
1.3 Facility Tours
.....................................
2.0 RADIOLOGICAL CONTROLS (71707).......................... 4 3.0 MAINTENANCE / SURVEILLANCE (62703, 61726).................. 4 3.1 Maintenance Observation............................... 4 3.2 Emergency Diesel Generator Maintenance.................... 5 3.3 Emergency Diesel Generator Fan Shaft Failure................. 5 3.4 Chemistry Surveillance................................ 6 3.5 Surveillance Observation............................... 7 4.0 ENGINEERING AND TECHNICAL SUPPORT (40500,71707,90713)...... 7 4.1 Blowout Panels..................................... 7 4.2 Containment Integrated Leak Rate Test Report
.................
5.0 SECURITY (71707)
....................................
6.0 SAFETY ASSESSMENT / QUALITY VERIFICATION (92701, TI2515/119)
..
6.1 Rea: tor Water Level Cold Reference leg Instrument Safety Issue.....
10.
6.2 Independent Audit of Operational Quality Assurance Program.......
7.0 EXIT MEETINGS (40500, 71707)............................
7.1 Preliminary Inspection Findings
.........................
7.2 Attendance at Management Meetings
......................
iii
-
l l
DETAILS P
1.0 OPERATIONS (71707,93702)
i i
1.1 Operations Summary
'
The plant operated at or near 100% for the entire inspection period, with one exception. On June 19,1993, power was reduced to about 60% to repair a leaking seal water line on the
"A" condensate pump. The repairs were successfully completed, and full power operation resumed later on June 19, 1993.
1.2 Operator Errors The inspectors evaluated the licensee followup to two events during the inspection period that involved operator errors.
1.2.1 Inadvertent Individual Control Rod Scram On May 19,1993, while plant operators were returning hydraulic control unit (HCU) No.
18-31 to service, the associated individual control rod inadvertently inserted from notch 48 (fully withdrawn) to notch 00 (fully inserted). Reactor power was at 100%, but decreased to approximately 95% due to the control rod insertion. Core engineering personnel completed a Maneuver Request Sheet, and operators subsequently recovered control rod 18-31 and returned the plant to full power operation. Overall plant response to the control rod insertion was normal.
The licensee had removed the HCU from service for maintenance earlier on May 19. As part of the standard HCU tagout, an individual control rod scram signal was applied to the
.
HCU by placing the associated toggle switch to the "on" position.
Maintenane.: personnel were unable to perform the intended HCU work due to leakage past the cnarging water isolation valve. Therefore, plant operators prepared and authorized a restoratior switching order (RSO) to return the HCU to an operable status. The third step of j
the 15-ste} RSO instructed the operator to place the rod scram toggle switch to the "off" position, llowever, the non-licensed equipment operator (EO) failed to perform that step.
He continue d with the switching order until the HCU accumulator was unisolated. Since the individual Icram signal was still applied, the control rod fully inserted (scrammed) into the reactor con:.
In response to the event, the licensee completed an operations critique to evaluate the event for root causes and to develop corrective actions. The licensee concluded that the root cause was operator error - failure to perform. Corrective actions included conducting a review of this event with each operating crew by the operations manager, stressing the importance of procedure adherence, self-checking, good communications, and attention to detail. In addition, each of the six operating shifts developed a detailed action plan for eliminating personnel error __
.
.
The inspector reviewed this event, which included evaluating the licensee's immediate actions to recover the inserted control rod, and reviewing applicable procedures, the Operations Critique and proposed corrective actions. In addition, the inspector interviewed the EO that performed the RSO. The inspector found that the EO had a copy of the RSO while performing the restoration; however, he did not have a pen or pencil to mark each step as it was completed. Oyster Creek Station procedure No.108, " Equipment Control," states that the qualified individual executing the RSO shall initial the RSO as each component is positioned. The inspector concluded that the failure to mark each completed step may have l
contributed significantly to the failure to place the local rod scram switch in the off position.
The inspector determined that the licensee's followup, investigation and corrective actions for this event were appropriate.
1.2.2 Mispositioned Emergency Diesel Generator Mode Selector Switch At 2:50 a.m., on May 18, 1992, during a control panel walkdown, a control room operator found that the mode selector switch for the No.1 emergency diesel generator (EDG) was in the incorrect position. The licensee later determined that the mode selector switch had not been returned to the " peaking" position from the " transfer" position after a diesel load test performed the prior morning. The inspectors assessed the licensee's immediate followup actions, reviewed the event critique, and interviewed personnel related to the occurrence.
After completion of the EDG No. I load test at about 11:00 a.m., on May 17,1993, the control room operator (CRO) secured the EDG by placing its start switch in the stop position. This causes the diesel breaker to trip and the diesel to drop to idle speed for 11.5 minutes before shutting down. After filling out the post-surveillance data sheet, the CRO failed to move the EDG mode selector switch back to peaking from the transfer position as specified in Step 6.7.4 of Procedure 636.4.003, " Diesel Generator Load Test," Revision 45, dated March 19, 1993. The mispositioned switch was not noted by operators completing the two subsequent control room turnover checklists (Attachment 3 to Procedure 106, " Conduct of Operations") at the end of the 8-4 shift and at the end of the 4-12 shift on May 17, 1993.
Once discovered on the morning of May 18, 1993, the group shift supervisor for the 12-8 shift was notified, the diesel mode switch was placed in the peaking position, and a deviation report was written. Engineering was immediately requested by operations to evaluate whether diesel operability may have been affected while the diesel mode switch was in the transfer position. The engineering evaluation concluded that the diesel was opemble during this condition. In an emergency diesel start condition with the mode selector switch in the deadline position, the EDG will accelerate to rated speed and the EDG output breaker will shut to energize its associated bus. In deadline, the 4 kv vital bus supply and tie breaker contacts in the EDG breaker control circuitry are bypassed, allowing the EDG to be placed on its associated bus with the 4 kv bus supply and/or tie breakers shut. Subsequent diesel loading is automatically controlled by the governo.
.
,
The diesel load test procedere requires that the mode switch be placed in the peaking position primarily for testing reasons. During the load test, the diesel is started in the peaking mode which initially causes the diesel to idle for about 90 seconds before acceleration. The diesel then comes up to speed, synchronizes with the line, and the output breaker closes. ' Die diesel then automatically begins to pick up load. The load test procedure then instructs the operator to switch to the transfer mode after the diesel has been automatically loaded to between 1000 and 2000 kw. In the transfer mode, the diesel load can then be manually increased, the test load (2750 f. 50 kW) by operation of the governor control switch.
.
After conading that the diesel had not been rendered inoperable, operations initiated an
-
event critique and root cause assessment of the two human performance aspects of this event, namely, the failure of the CRO performing the load test to reposition the switch and the failure of two subsequent shift turnovers to identify the mispositioned switch. Both problems were attributed to personnel error. The switch was not initially repositioned because the CRO performing the load test failed to refer back to the procedure after completing the surveillance data sheet. The current version of procedure 636.4.003 does not require a signoff for this action step. The licensee is in the process of rewriting this surveillance procedure in accordance with the procedure writer's standard that will include signoffs for action steps. The incorrect switch position was missed during the two shift turnovers due to a lack of attention to detail on the part of the operators completing that portion of the turnover checklist. In addition to issuing the critique as required reading, operations management held subsequent discussions with all operations shift personnel reemphasizing management's expectations for procedural compliance and self-checking. Also, each shift was asked to develop a proposed acdon plan for elimination of personnel errors.
J The inspectors concluded that the licensee responded to this issue with appropriate concern,
-
even though it had been determined that the fast start capability of the diesel had not been i
affected. The corrective actions were responsive and timely.
j 1.2.3 Conclusions These procedural compliance issues represent a violation of technical specification 6.8.1,
,
which requires that procedures be established and implemented. However, these two
)
incidents were identified by the licensee, were of low safety significance, and the corrective j
actions were prompt and appropriate. For these reasons, this violation is not being cited as j
provided in the NRC Enforcement Policy, Appendix C (1993) to 10 CFR Part 2.
While reviewing the critiques related to these events, as well as other recent licensee assessments of human performance issues, the inspectors have noted many references to the
concept of self-checking, both as a performance tool to be applied and as a reason for failure when it is not applied. Most site personnel have received training in the self-checking concept as a tool to help eliminate personnel errors over the past one to two years. The inspectors cautioned the licensee to assure that self-checking is used in the appropriate context when discussing root causes and corrective actions. Simply referring to the lack of i
self-checking as a root cause or the application of self-checking techniques as a corrective action may not provide a comprehensive enough description of the root causes involved or the actions taken. The inspectors have often found that more specific descriptions of root
.
.
causes and corrective actions are often brought out in discussions held between management and the workers involved after an event than in the critique or evaluation that documents event followup. The licensee acknowledged that simple reference to self-checking can be too broad of an assessment and that more attention should be paid to describing how the self-checking concept or lack thereof was manifested with regard to a particular event.
1.3 Facility Tours The inspectors observed plant activities and conducted routine plant tours to assess equipment conditions, personnel safety hazards, procedural adherence and compliance with regulatory requirements. Tours were conducted of the following areas:
e control room o intake area e cable spreading room o reactor building e diesel generator building a turbine building e new radwaste building a vital switchgear rooms e old radwaste building e access control points e transformer yard Control room activities were found to be well controlled and conducted in a professional manner. The inspectors verified operator knowledge of ongoing plant activities, equipment status, and existing fire watches.
2.0 RADIOLOGICAL CONTROIE (71707)
During entry to and exit from the radiologically controlled area (RCA), the inspectors verified that proper warning signs were posted, personnel entering were wearing proper dosimetry, personnel and materials leaving were properly monitored for radioactive contamination, and monitoring instruments were functional and in calibration. During periodic plant tours, the inspectors verified that posted extended Radiation Work Permits (RWPs) and survey status boards were current and accurate. The inspectors observed activities in the RCA and verified that personnel were complying with the requirements of applicable RWPs and that workers were aware of the radiological conditions in the area.
3.0 MAINTENANCE / SURVEILLANCE (62703, 61726)
3.1
- Maintenance Observation The inspector observed selected maintenance activities to ascertain that the licensee conducted those activities in accordance with approved procedures and drawings, technical specifications, and the appropriate industrial codes and standards.
I
i
\\
'
w
.
.
The inspector observed portion of the following activities.
YZoI}LErqindVR) No.
Desenption WR 760985 Repair and rework motor for "A" control rod drive pump (outboard motor bearing housing oil leak)
WR 759910 Repair commutators for "A" battery charger WR 761097 Clean containment spray system II heat exchangers i
WR 758274 Perform differential pressure diagnostic testing for motor operated valve V-21-0015 and V-21-0018 The maintenance activities inspected were effective with respect to meeting the safety objectives of the maintenance program.
,
3.2 Emergency Diesel Generator Maintenance On June 14, 1993, GPUN voluntarily entered the seven-day limiting condition for operation (LCO) action statement for technical specification 3.7.C for the No. 2 emergency diesel generator (EDG), to perform various preventive and corrective maintenance tasks. The voluntary LCO was properly justified as documented in the licensee's LCO Maintenance Screening Checklist. Included in the planned activities was an engine coolant system drain, flush and replacement. The inspector observed that good spill prevention and containment measures were implemented for that activity.
The inspector observed portions of work activities associated with the coolant changeout, a relay timing corrective change, and the lubricating oil pump motor replacement. Personnel performing the work were knowledgeable of the assigned tasks. Supervisory oversight and system engineer involvement was appropriate for the work performed. The planned activities were completed by June 15, 1993. However, a problem occurred during the EDG post-maintenance operability test, requiring additional attention (see section 3.3). The inspector concluded that the maintenance activities observed were conducted safely and in accordance with the applicable procedures.
3.3 Emergency Diesel Generator Fan Shaft Failure On June 15, 1993, during a post-maintenance operability test, the No. 2 emergency diesel generator (EDG) failed due to a broken cooling fan shaft. EDG engine coolant heat removal is accomplished by circulating the coolant through two radiators, where it is cooled by an engine-driven radiator cooling fan. The cooling fan shaft is coupled to the main engine driven shaft via a pulley and belt arrangement. Toward the end of the one-hour operability test, control room operators received an engine high temperature alarm due to degraded engine cooling, as a result of the shaft failure. The operators immediately shut down No. 2 EDG from the control room, securing the EDG without inciden.
.
The licensce inspected the fan shaft and adjacent area and found (1) the shaft had sheared between the grooved pulley and the first (of two) pillow block bearing; (2) the break point was at the pillow block bearing collar; (3) there was no significant structural damage due to the shaft break, nor were any adjacent components adversely affected; and, (4) the integral
'
fan belt was slightly torn. In addition, the system engineer evaluated the EDG with respect to the slightly elevated engine coolant temperature and determined that no consequential engine damage occurred.
The inspector monitored the licensee's investigative and corrective activities. Contractor personnel were onsite to support the previously performed corrective and preventive activities and effectively disassembled the damaged components and installed a spare shaft assembly.
The spare shaft assembly was inspected and tested (magnetic particle) prior to installation to ensure the absence of defects. The inspector noted system engineering involvement to be strong. The shaft assembly installation was completed on June 16, 1993, and the No. 2 EDG was satisfactorily retested and declared operable.
The system engineer contacted the EDG vendor to ascertain whether similar failures have been recorded; none were identified. In addition, when the No.1 EDG was removed from service later on June 16, 1993, for planned preventive and corrective activities, its fan shaft was visually inspected and ultrasonically tested to identify whether any defects were present.
No defects were identified.
The inspector observed that a portion of the break area appeared to be rusted, possibly indicating that a defect or crack may have existed prior to the failure. The licensee sent the damaged shaft offsite for failure analysis. Upon receipt of the results of the analysis, the licensee will evaluate whether additional corrective actions are warranted.
The inspector concluded that the licensee's overall efforts and response to the EDG failure were appropriate.
3.4 Chemistry Surveillance On May 27,1993, and June 2,1993, the inspectors observed the sampling of reactor water as performed by chemistry technicians at the reactor water sample sink on the 75 ft elevation of the reactor building. The inspectors observed sampling for conductivity and dissolved oxygen, as well as a periodic cross check of conductivity instrumentation accuracy.
The inspectors noted that appropriate precautions were taken by the technicians prior to sampling and that the sampling was performed in accordance with established chemistry
,
'
procedures. Sample valve lineups were established in accordance with procedure 827.1,
" Plant Systems Analysis: Reactor Water," Revision 16, dated January 7,1993. The sample bottles brought to the sample sink by the technicians were clean and distinctively labeled.
The sample flow rates were not altered during sampling. The technicians were knowledgeable of the radiation work permit (RWP) associated with chemistry sampling and complied with its requirements. The inspectors verified that the conductivity sample was being performed within the frequency specified in technical specification 4.3.F. Overall, the i
inspectors concluded that the chemistry sampling was performed properly, that the i
j
.
l
'
i
'
technicians demonstrated good knowledge of the task, and that appropriate precautions were taken for radiological and industrial safety.
3.5 Surveillance Observation
On June 16, 1993, the inspector observed the performance of Surveillance Procedure
')
636.4.003, " Diesel Generator Load Test," for the No. 2 emergency diesel generator (EDG).
'
The inspector verified that the appropriate test precautions were satisfied and that personnel performing the test were knowledgeable about the test procedure. The inspector concluded that this surveillance activity was effectively implemented.
i 4.0 ENGINEERING AND TECIINICAL SUPPORT (40500,71707,90713)
4.1 Blowout Panels
,
Satier, o.2.3.2 of the Oyster Creek Updated FSAR indicates that the reactor building was designed to withstand an internal pressure of 0.25 psid without structural failure. The FSAR also states that this pressure relief function is accommodated by blowout panels located above.
,
'
the 119 ft elevation of the reactor building (the refueling floor). In December 1991, engineering evaluation of this information for a standby gas treatment system design basis reconstitution effort found no clear documentation of either the existence of the blowout panels or verification of reactor building pressure relief at 0.25 psid. This prompted a request in August 1992 for the technical functions engineering mechanics department to perform a more detailed investigation into the possible physical location of blowout panels or other pressure relief design. Other evaluations were being performed concurrently by technical functions to determine whether reactor building pressure relief at greater than 0.25 psid constituted a safety issue.
Engineering mechanics concluded in late 1992 that the blowout panels could not be located.
Engineering mechanics also noted that if the refueling floor siding panels themselves were to be relied upon for pressure relief, a simplified calculation showed that the panels may not relieve until, at a minimum, a 0.9 psi differential pressure was reached. This information prompted the issuance of a potential safety concern (PSC) on March 1,1993, primarily because 0.9 psid was higher than the pressure assumed for reactor building relief in the calculations performed to generate equipment qualification (EQ) pressure and temperature profiles (0.5 psid).
To assess the PSC, GPUN initiated several subsequent actions. Oyster Creek site syste.m engineering performed additional walkdowns of the reactor building in a last attempt to determine whether there were any physically distinct blowout panels. A more detailed document search was initiated both within GPUN and at the offices of the Oyster Creek architect engineer (Burns and Roe) to look for more definitive information related to reactor building pressure relief design and the relief pressure. The technical functions engineering analysis department was also asked to prepare to perform a modified high energy line break (HELB) analysis using a higher reactor building pressure relief value, once a final value for reactor building pressure relief was decided upon. During the document search at Burns and Roe, a letter was found, dated July 10, 1968, that indicated that the refueling floor side wall
_ _ _ _ - _ _ _ _ _ _ _ _
.
.
panels would tear away at the panel fasteners at 0.95 psid. Since the letter was not signed and no formal verification of the 0.95 psid value was available, technical functions engineering mechanics performed a calculation to generate a verifiable value for refueling floor wall panel failure. The calculation concluded that the wall siding would relieve at 0.90 psi due to failure of the siding panel screws. The siding itself will begin to bend (ductile failure) at about 0.66 psid, but it was difficult to assess how long the siding would continue
,
to deform before breaking open. GPUN used the more conservative 0.95 psid Burns and j
Roe value for the subsequent recalculation of the HELB reactor building pressure and j
temperature profiles.
l l
The subsequent reevaluation of HELB response with reactor building relief at 0.95 psid
)
found the isolation condenser (IC) line break to be the limiting case. Peak values for
!
pressure and temperature were noted at the beginning (first 5 seconds) of the IC line break analysis due to the longer required time for reactor building pressure relief. These values were higher than previously calculated peak values. The results of the analysis prompted additional analysis to assess the effects of the higher pressure and temperature values on reactor building equipment, including EQ qualified equipment.
The analysis of the effect ofincreased pressure on equipment within the reactor building j
found that the calculated external pressure on the torus shell (1.37 psig) would be greater
'
than the torus external design pressure noted in the UFSAR (1.0 psig) for a period of about I
five seconds. A 10 CFR 50.72 notification was made on June 2,1993, because the analysis had demonstrated that an isolation condenser line break could generate an external pressure on the torus shell that was outside the stated design basis. An initial determination of torus operability was made because containment is normally maintained inerted with an internal pressure of between 1.1 and 1.3 psig during plant operation. This internal pressure would effectively minimize the differential pressure between the inside and outside of the torus in the event of a high energy line break in the reactor building. However, the containment is
,
not always maintained at 1.1 to 1.3 psig while operating, i.e., when inerting and deinerting.
'
The control room operators were instructed to follow normal operating guidance for monitoring internal containment pressure but to notify operations department management immediately if pressure approaches the lower end of the normal pressure band.
i Another calculation was then performed by the technical functions engineering mechanics department to determine whether the torus could withstand an external pressure greater than 1.0 psig. The calculation wu performed using ASME Section III, Subsection NE and ASME Code Case N-284. The calculation determined that the torus had sufficient design margin to withstand greater than 1.37 psig external pressure in combination with the dead weight of the torus. This calculation was completed the same day the 10 CFR 50.72 report was made, June 2,1993.
Reactor building EQ equipment was also evaluated against the recalculated reactor building pressure and temperature profiles. The licensee concluded that although the initial pressure and temperature for the isolation condenser line break were initially higher than previously calculated peak values for several EQ components, the duration of the peak values was very short (a few seconds) and that the equipment could not be adversely affected before the peak pressures and temperatures subsided. A design change notice was developed to change the
. _ - - - _
_
- - _ -
_
. _ _ -
_ _ - - _ _ _ - _ _ _ _ _ _
.
pressure and temperature effects and profiles in the EQ files for those components affected
!
by the new HELB calculation. The inspectors did not have an opportunity to review this documentation prior to the end of the inspection period.
The licensee also evaluated the effect of the higher pressure transient on structural components in the reactor building and found that some masonry walls were susceptible to failure. The block walls are not load bearing and do not affect the structural adequacy of the building. As such, block wall failures were assessed for loss of support for safety-related equipment and for wall collapse onto safety-related equipment. In the worst case, it was found that the enclosed stairwell wall leading from the southeast corner of the 23 foot elevation of the reactor building down to the corner room would collapse and fall onto containment spray pumps 1-3 and 1-4. Although the containment spray pumps are not relied i
'
upon to help mitigate an HELB outside containment, the prospect of damage in this conditica was not acceptable to the licensee. Therefore, the door at the bottom of the stairwell has been propped open to preclude pressurizing the stairwell in such an event. The door at the bottom of the stairwell is not a fire door.
The inspectors did not have the opportunity to review in detail the plant and equipment response calculations that were performed after the 10 CFR 50.72 notification was made.
The inspectors considered this issue unresolved pending more detailed review of the licensee's documentation supporting continued plant operation without blowout panels and review of the forthcoming licensee event report. (Unresolved Item 50-219/93-09-01)
4.2 Containment Integrated Leak Rate Test Report The inspectors reviewed the licensee's May 25,1993, summary report related to the i
containment integrated leak rate test (CILRT), conducted at the end of the 14R refueling outage for technical accuracy and compliance with 10 CFR 50, Appendix J, reporting requirements. The CILRT was completed on January 29,1993.
The report included test results from the CILRT and Type B and C local leak rate tests
(LLRT) performed during the 14R and 13R outages. As-found and as-left CILRT results were calculated incorporating appropriate adjustments for isolated penetrations and drywell sump level variation during the test. The as-found CILRT result also included adjustments for leakage savings accomplished by type B and C penetration repairs. Test acceptance criteria were appropriately modified to account for the reduced CILRT test pressure.
j Accurate descriptions of the test instrumentation and test method were also provided.
The approach used by the licensee to calculate the as-found CILRT result was somewhat unique due to higher leak rates observed on January 27,1993, after initial pressurization and temperature stabilization. Due to concern that the as-left CILRT acceptance criterion might not be met, leak searches were performed in an attempt to locate the cause of the higher than expected values for leak rate at the beginning of the test period. The leak searches continued and some penetration adjustments were made during the following 26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br />. The licensee acknowledged that the leakage adjustments had invalidated the test during this time frame and the CLIRT was restarted on the morning of January 29,1993. While the initial 26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br /> of test data could not be used for formal calculation of an as-left CILRT result, the licensee
.
.
determined that the initial data could be used to calculate an as-found CILRT result and concluded that the calculated value represented a valid and conservatively determined as-found integrated leak rate. A reasonable statistical evaluation was performed using test data before and after and adjustment was made in order to quantify the leakage improvement accomplished by the adjustment. This leakage improvement was added to the total as-found test result. Pressurization and temperature stabilization criteria were maintained during this initial 26-hour time frame.
The inspectors concluded that the CILRT report was comprehensive and accurate and that the as-found and as-left CILRT results were appropriately calculated. Both as-found and as-left CILRT acceptance criteria were met. The reporting requirements of 10 CFR 50, Appendix J, Section V.B were satisfied.
5.0 SECURITY (71707)
During routine tours, the inspectors verified that access controls were in accordance with the Security Plan, security posts were properly manned, protected area gates were locked or guarded, and isolation zones were free of obstructions. The inspectors examined vital area access points and verified that they were properly locked or guarded and that access control was in accordance with the Security Plan.
6.0 SAFETY ASSESSMENT / QUALITY VERIFICATION (92701, TI2515/119)
6.1 Reactor Water Level Cold Reference Leg Instrument Safety Issue The inspector conducted a review to verify licensee implementation of operator guidance and
training actions concerning reactor vessel water level instrumentation errors. As discussed in NRC Information Notice 92-52, " Level Instrumentation Inaccuracies Caused by Rapid Depressurization," and NRC Generic letter 92-04, " Resolution of the Issues Related to Reactor Vessel Water Izvel Instrumentation in Boiling Water Reactors (BWRs) Pursuant to 10 CFR 50.54(f)," the NRC staff was concerned that noncondensible gases may become dissolved in the reference leg of BWR water level instrumentation and lead to a false high level indication after a depressurization event. An NRC Special Safety Inspection (50-219/92-18) was conducted at Oyster Creek in August 1992 to review the facility's operational readiness with respect to the above concern. This review, combined with NRC Inspection 50-219/92-18, collectively assess the acceptability of the licensee's training and operator readiness relative to this safety issue.
The inspector determined that the licensee's simulator does not currently model a dynamic scenario for a rapid plant depressurization concurrent with reactor water level instrument failure. The Oyster Creek simulator was recently completed and implemented for training purposes in February 1992. The licensee stated that a simulator model is currently being developed which will simulate a reactor pressure vessel flooding scenario (no level indication available and rapid depressurization). However, the loss of reactor vessel level
'
instrumentation will not be the result of the noncondensible gas phenomenon. The licensee expects to complete the model and implement operator training by August 199.
.
The site specific simulator does not model consequential level instrument failures during either a slow or rapid depressurization. The BWR Owner's Group (BWROG) is continuing an evaluation of the issue of the noncondensible gas phenomenon. The inspector found that the Oyster Creek licensed operators were knowledgeable and capable of executing the j
'
guidance discussed in letters, dated August 19, 1992, and October 16, 1992, issued to BWRs by the BWROG. The licensee stated that they would continue to evaluate and implement proposed BWROG recommendations, including simulator training scenarios, as applicable to Oyster Creek. The licensee informed the inspector that Oyster Creek has not experienced any level instrumentation anomalies during depressurization as a result of the noncondensible pnenomenon.
The inspector reviewed the safety parameter display system (SPDS) to determine whether the system models level instrument failures. SPDS monitors the appropriate GEMAC and Yarway level instruments and provide an on-screen indication to operators (including
" reverse-video" displays) when the individual level instrument inputs reach predetermined values.
During a recent refueling outage (early 1993), the licensee implemented several actions to minimize the likelihood of level indication errors. Specifically, GPUN conducted a leak test of the cold reference leg instrument (GEMAC) equalizing valves. Those valves represent a potential leakage path for noncondensibles to reach the reference legs. No leaking equalizing valves were identified. In addition, the licensee installed temperature instrumentation on both the steam and liquid regions of the GEMAC reference pots. Convergence of the two temperature values is an indication of noncondensible accumulation in the monitored condensate pot. The licensee takes daily temperature readings for trending purposes; no significant adverse trends have been identified.
The inspector concluded that the licensee's actions and existing programs were sufficient to ensure continued safe operation of the plant relative to the reactor water level instrument concerns. On May 28, 1993, the NRC issued Bulletin No. 93-03, " Resolution of Issues Related to Reactor Vessel Water Level Instrumentation in BWRs." The NRC will continue to monitor the status of this safety issue, including the licensee's response and followup for NRC Bulletin 93-03.
6.2 Independent Audit of Operational Quality Assurance Program A Cooperative Management Audit Program (CMAP) audit of the Oyster Creek operational quality assurance (OQA) program was performed during the period of May 10-21, 1993.
,
The purpose of the CMAP audit was to provide an independent assessment of the performance of activities required by the OQA plan as required by Oyster Creek technical
-
specification 6.5.3.1.g and the OQA plan itself. The inspectors interviewed the CMAP I
auditors and reviewed the final CMAP audit report. Overall, the inspectors found the findings and recommendations of the CMAP audit to be insightful and focused on plant safety. The licensee has yet to propose or schedule followup actions in response to the findings of the CMAP audit report, which was issued on June 14, 1993.
,
.
l
.
The CMAP audit team consisted of three individuals, each from a different nuclear utility, with a range of experience in various aspects of OQA. The scope of the audit was developed as a result of a discussion between the CMAP team and GPUN QA personnel in March 1993. The inspectors noted that the audit scope was appropriately focused and demonstrated
'
a willingness on the part of GPUN to obtain an independent assessment of key areas. Some key audit areas were procurement QA, the effectiveness of issue resolution for QA audits and monitoring activities, software QA, and the extent and pace of the licensee's transition to
.'
performance-based aspects of QA.
Ovemil, the CMAP audit team concluded that the GPUN/ Oyster Creek OQA program met the requirements of the OQA plan and the facility operating license and was being implemented effectively. Several recommendations were made by the CMAP audit team that were portrayed as opportunities for performance and implementation improvements. Some of the more pertinent recommendations are noted below:
1.
The CMAP team recommended that a more formal tracking mechanism be developed for monitoring activities performed by Quality Control (QC) inspection personnel.
'
2.
The CMAP team noted the recent inclusion of " performance concerns" in QA audit reports and recommended that a formal response tracking program be developed.
Performance concerns have evolved from the licensee's recent efforts to incorporate performance-based observations into the audit process. The licensee has progressively incorporated more performance-based issues into its QA audit and monitoring activities but, as appropriately noted by the CMAP team, has yet to impose a formal response / corrective action process for these issues. The CMAP team also recommended that more effort be placed on defining and establishing a uniform approach to performance-based QA through discussions with audited organizations.
3.
The CMAP team noted that the GPUN audit program does not require formal response or QA followup of audit issues designated as recommendations. The CMAP team recommended that GPUN develop a formal process for disposition of audit recommendations.
4.
The CMAP team noted that the time between audit conclusion and the post-audit
'
meeting is often protracted by lengthy interim discussions between the auditors and the audited organization, causing cancellation or downgrading of findings before the actual audit report is issued. The CMAP team noted that important issue documentation is occasionally lost from the audit record, especially for issues that are cancelled. The CMAP team felt that this could detract from the completeness and overall message of the audit report and recommended that post-audit review guidelines be strictly adhered to.
,
.
- -
-
.
-
-
- -. -
I6
.
5.
With regard to the resolution of audit findings and monitoring issues, the CMAP team I
noted that audited organizations on a few occasions concentrated too much on i
challenging the validity or significance of an issue instead of focusing on the identified issue's impact on quality. The CMAP team recommended that GPUN management assure that issue clarification discussions be focused on quality impact and that defensive posturing should be discouraged.
The inspector concluded that the CMAP audit was well conducted and that its findings were.
insightful and focused on plant safety. The QA auditing department will coordinate the licensee efforts to respond to the issues of the CMAP audit. The licensee's actions in response to the CMAP audit will be monitored by the General Office Review Board (GORB)
to allow for independent assessment of the effectiveness ofissue resolution (i.e., so that QA
does not monitor the effectiveness of response to QA program issues).
7.0 EXIT MEETINGS (40500,71707)
7.1 Preliminary Inspection Findings j
A verbal summary of preliminary findings was provided to the senior licensee management on July 1,1993. During the inspection, licensee management was periodically notified verbally of the preliminary findings by the resident inspectors. No written inspection
,
material was provided to the licensee during the inspection. No proprietary information is included in this report.
The inspection consisted of normal, backshift and deep backshift inspection; 34 of the direct inspection hours were performed during backshift periods, and 10 of the hours were deep backshift hours.
,
7.2 Attendance at Management Meetings The resident inspectors attended exit meetings for other inspections conducted as follows:
.
May 18,1993 Report No. 50-219/93-07 June 11,1993 Report No. 50-219/93-10
,
At these meetings the lead inspector discussed preliminary findings with senior GPUN management.
,
,
h
)
,
,