IR 05000219/1993081
| ML20059B642 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 12/22/1993 |
| From: | Haverkamp D, Kaufman P NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20059B627 | List: |
| References | |
| 50-219-93-81, NUDOCS 9401040205 | |
| Download: ML20059B642 (65) | |
Text
____
_
,
.
i i
.
U. S. NUCLEAR REGULATORY COMMISSION
REGION I
e i
Report No.
93-81 Docket No.
50-219
License No.
DPR-16 Licensee:
GPU Nuclear Corporation
'
1 Upper Pond Road Parsippany, New Jersey 07054 Facility Name:
Oyster Creek Nuclear Generating Station Inspection Period:
September 27 - October 15, 1993
!
Team Leader:
Paul Kaufman, Project Engineer, Division of Reactor Projects (DRP)
Maintenance / Surveillance:
Pete Habignorst, Resident Inspector-I Haddam Neck Art Burritt, Operations Engineer (Examiner), Division of Reactor Safety (DRS)
Engineering:
Larry Briggs, Senior Operations Engineer (Examiner), DRS
,
Al Imhmeier, Senior Reactor Engineer, DRS
,
Management / Corrective Harold Eichenholz, Senior Resident Inspector -
Actions:
Vermont Yankee Dave Jaffe, Project Manager, Office of Nuclear Reactor
!
Regulation (NRR)
,
General:
Vonna Ordaz, Reactor Engineer, NRR Approved By:
M
,
,
Paul Kaufman, Team Leader, D Date-
,
IkW$l w Is.-b 17/n /43
'
Donald R. Haverkamp, Team Madager, DRP Date
$$ O$b$$j,y PDR.
I
_
'
.
.
EXECUTIVE SUMMARY Oyster Creek Nuclear Generating Station Report No. 50-219/93-81
>
EDilacCIing
.
The Oyster Creek on-site plant engineering and technical functions staff and the GPU
,
Nuclear (GPUN) corporate technical functions staff provide high quality support for plant
'
modifications and design control. Plant design changes are well prepared and thoroughly documented with good safety evaluations and 50.59 reviews. All modifications are prepared in-house by GPUN engineering personnel who have a strong interface with the various disciplines including plant operations staff. Weakness was identified in several instances l
when safety evaluations / justifications were not adequately performed or documented to verify
'
operability and to justify continued use of possibly defective plant equipment, components,
and materials.
An initiative to monitor reactor coolant system transients and operational cycles, targeted for data collection completion in January 1994, is considered an unresolved item (URI 50-
219/93-81-01), pending additional NRC review.
'
Maintenance
,
Overall, the team's observation of ongoing maintenance activities noted excellent interdepartmental communications, good coordination and good worker knowledge. The team noted minor deficiencies such as no training dccumentation for ajob foreman and inconsistent controls for electrical troubleshooting activities.
The critique process is used effectively by the maintenance director to identify program deficiencies. However, no formal evaluation of the maintenance program has been completed for approximately five years. The quality assurance audits and quality control surveill;nces of maintenance activities were considered a strength because they were critical and solicited appropriate response and action from the maintenance department.
.
The component trending program is generally effective in identifying trends in the identification and resolution of significant equipment deficiencies. However, a number of
cases were found of ineffective corrective actions resulting in recurrence of corrective maintenance. The component rework evaluation process focused on global peacntages and did not assess commonality of recurrences or specific corrective action effectiveness.
l Engineering support to maintenance processes was evident, however, examples existed of
'
incomplete or untimely technical assessment of equipment failures and facility-specific
.
!
evaluation of industry experience information to establish justification for continued operability of potentially deficient components and equipment. The failure to review and i
ii i
i n
-
.
.
'
document the engineering basis for operability for electrically backscating the isolation condenser valves is an example of inadequate procedural reviews associated with a plant modification and is considered an unresolved item (URI 50-219/93-81-02).
j
.
Surveillance Good inter-department communication during sutveillance testing activities was observed.
I The calibration of test equipment was up-to-date, test acceptance criteria was specified appropriately, and technicians effectively used repeat backs and self-checking.
l The licensee does not follow the guidance provic'u! in NRC Generic Ixtter 91-18 and has
!
inadequate administrative controls for performance of Technical Specincation-required i
,
surveillances that render systems inoperable.
While conducting required core spray surveillance testing, operations personnel failed to j
reduce the average planar linear heat generation rate (APLHGR) resulting, on a number of
.
'
occasions, in operating the plant outside the design basis and exceeding the core thermal limitations specified in the Technical Specifications. Funber, applicable surveillance
,
I procedures were not modined when it was determined in 1988 that one core spiay system loop would not provide adequate post accident flow without implementing a thermal limit
penalty (APLHGR). These issues are considered apparent violations and an enforcement conference is planned to further discuss them. (eel 50-219/93-81-03 and 93-81-04)
i The emergency service water pumps have a history of operating in the required action range while conducting the inservice-testing (IST) surveillance, because of low differential pressure caused by fouling of the anubar flow instrument, which in turn decreases pump availability.
This is considered a corrective action weakness for repetitive failures of the IST program
,
without providing actions necessary to improve pump reliability.
,
>
Management and Corrective Actions A constructive and progressive approach on the part of management and workers was evident
'
in the identification and use of initiatives being employed to improve plant operations and organizational effectiveness.
,
l i
Management involvement in the day-to-day operation of the plant was evident in daily meetings and communications, safety assessment and self-assessment activities. This
involvement focused on the material condition of the plant and human performance attitude i
and behavior. The vigor in which the management observation teams are involved in on-going activities reflect positively on management's involvement and oversight of licensed
!
I activities. The deviation report trending was particularly noteworthy as a demonstration of management's effectiveness in monitoring the identification and timely resolution of j
signi6 cant equipment denciencies.
l
!
t 55$
i
!
!
.
_
.
..
.
t
.
An assessment tool developed by GPUN called Organizational Culture and Nuclear Plant Safety (OCANPS) investigates organizational factors in the measurement of the relationship between organizational processes and nuclear power plant safety. The initiative involves changing the way things are done (the culture) for the purpose of improving organizational performance and is considered a positive initiative. This process appears effective based on its use by the licensee's Independent Assessment Team that investigated the Oyster Creek shutdown cooling event that occurred on January 25,1993.
,
Quality assurance activities identified performance-related insights that contributed to improving the effectiveness of audited and monitored programs and plant safety. The QA program is being used as a management tool to assess and improve licensed activities and is considered a strength.
The Ombudsman, operator concerns, and potential safety concerns programs represent
,
diversc elements to effectively resolve employee concerns, and in the aggregate, is
considered a licensee strength. However, the potential safety concerns program is being used for issues involving operability determinations and resolving design deficiencies instead of the required corrective action programs.
The operations department did not have an "act of nature" procedure for combating l
significant events (e.g., tornado, flood, earthquakes, etc), which is considered an unresolved item (URI 50-219/93-81-05).
The licensee's corrective action programs and processes procedure did not provide an acceptable method for implementation of 10 CFR 50, Appendix B, Criterion XVI, as applied
,
to utilization of the material nonconformance report process, which is considered an unresolved item (URI 50-219/93-81-06).
- A number of concerns in GPUNs implementation of the licensee event reporting system were identified by the team. These concerns involve failure to perform independent safety reviews
,
'
of LERs as required by the plant's technical specifications. In responding to these concerns, the licensee determined that similar TS-required reviews of NRC violations had not been performed. Collectively, this is considt A a violation (VIO 50-219/93-81-07). Another
,
concern is failure to perform trending analysis of LEPs and the lack of timely issuance of supplemental LERs. Oyster Creek does not have a&.:quate administrative controls in place to assure timely issuance of supp!emental licensee event reports.
,
The plant and corporate divisions used a generally informal approach when making
,
operability determinations. Determining operability was not observed by the team to be a continuous and ongoing decision-making process.
I i
.
'
Iv i
.
.
.
Non<onforming conditions are being identified by engineering that warrant use of corrective l
action systems to obtain proper resolution, and this is not always occurring. A similar
,
programmatic weakness dealing with operability determinations was identified by the NRC diagnostic evaluation team. The team concluded that a significant weakness exists in the
,
.
operability and reportability determination process which warrants GPUN attention.
t
,
,
s
!
.
h
!
i i
i i
l l
Y
l
.
--,
- I
,
.
TABLE OF CONTENTS
.!
PAGE EXECUTIVE SUMMARY ii
......................................
1.0 INSPECTION SCOPE AND OBJECTIVE
,
........................
l 2.0 ENGINEERING
........................................
2.1 Engineering Personnel Interviews I
.........................
s 2.2 Licensee Review Activities Related to Plant Safety............... 2 2.3 Prioritization of Organizational Activities..................... 2 2.4 System Engineer Evaluation _............................. 2 2.5 Modification Review
.................................
2.6 Comm unications.................................... 4 2.7 Modification Deferral Review............................ 4 2.8 Engineering Support of Operations and Maintenance.............. 5
'
2.9 Engineering Initiatives
................................
2.10 Transient and Operational Cycle Monitoring................... 6
-
3.0 MAINTENANCE
.7
...........
......................
3.1 Maintenance Observations.
..........................
3.2 Maintenance Self-Assessraeni A.tivities...................... 9 3.3 Quality Assurance and Quality Control involvement In Maintenance l
Activities
......................................
3.4 Preventive Maintenance Program.........................
3.5 Component Maintenance Program
........................
3.6 Post Maintenance Testing
.............................
'
3.7 Configuration Control........,.......................
3.8 LCO Maintenance..................................
3.9 Equipment Failure Trending............................
4 3.10 Rework
..........................................
,
3.11 Maintenance Involvement in the Safety Issues Assessment Program....
.
3.12 Engineering Support to Maintenance - Maintenance Perspective......
3.13 Electrical Backseating of Isolation Condenser Valves
............
4.0 S UR V EI LLA N CE......................................
4.1 Observation of Surveillance Activities......................
.
4.2 Equipment Operability During Surveillance Testing
.............
4.3 Core Spray Operability During Surveillance Testing.............
4.3.1 Operability.................................. 22 4.3.3 Procedure Revisions............................
l
4.3.4 Conclusions
.................................
4.4 In-Service Testing.................................. 26
4.5 Control of Troubleshooting Activities......................
t vi
,
.
\\
- ~,
-
.
>
Table of Contents PAGE
4.6 Human Performance Deficiency Corrective Actions
.............
5.0 MANAGEMENT PROCESSES AND CORRECTIVE ACTIONS
.........
5.1 Management Processes............................... 29
.
5.1.1 Licensee Initiatives.............................
l 5.1.2 Management involvement and Oversight................
5.1.3 Tracking and Trending
..........................
5.1.4 Plan For Excellence
................
..........
'
5.2 Safety Assessment.................................. 31 5.2.1 Safety Review Program..........................
5.2.2 Independent Safety Review Division
.................
5.2.3 Safety Review Process...........................
l 5.2.4 Functionally Chartered Review Groups.................
5.2.4.1 Plant Review Group.......................
5.2.4.2 Independent Onsite Safety Review Group..........
.
5.2.4.3 General Office Review Board.................
'
5.2.4.4 Nuclear Safety and C smpliance Committee.........
5.2.5 Nuclear Safety Concerns Program (Employee Concerns)......
'
5.2.6 Safety Assessment Summary.......................
-
5.3 Quality Verification................................. 45
5.3.1 Operational Quality Assurance......................
46 5.3.2 Audit Program
...............................
5.3.3 Material Non-Conformance Reports...................
5.3.4 Quality Assurance Department Activities Audit
...........
5.3.5 Quality Verification Summary......................
5.4 Corrective Actions.................................. 48 5.4.1 Program and Processes
..........................
5.4.2 Licensee Event Reports..........................
5.4.2.1 Safety Reviews of Licensee Event Reports.........
5.4.2.2 Trending of LERs........................ 50 5.4.2.3 LER Supplemental Submittal
.................
5.4.2.4 Licensee Event Report Summary...............
5.4.3 Deviation Reports.............................. 52 5.4.4 Industry Experience Information.....................
5. 4. 5 Relays..................................... 55-5.4.6 Operability and Degraded Conditions..................
6.0 EX IT M EETI NG....................................... 58 vii
~/
. -
.
.
1.0 INSPECTION SCOPE AND OBJECTIVE
'
.
From September 20 through October 15,1993, a team of eight NRC inspectors performed an operational safety team inspection (OSTI) at the Oyster Creek Nuclear Generating Station.
l The purpose of the inspection was to assess GPU Nuclear Corporation's effectiveness in identifying, examining, and resolving program weaknesses, which affect the control and l
support of safe plant operations at Oyster Creek. The functional areas reviewed included
.
engineering and maintenance / surveillance activities. Also, in these eas, management l
processes and corrective actions were evaluated to assess the resolu: n of technicalissues l
l and self-assessment capabilities. The team fm' dings and conclusior -
ere discussed with l
licensee managenent at a public exit meeting in the GPU Nuclear vergy Spectrum at Oyster l
l Creek on October 30 1993.
,
2.0 ENGINEERIN G 2.1 Engineering Personnel Interviews The team interviewed selected engineering and technical support personnel to determine their perceived responsibilities, program strengths and weaknesses, and recommendations to improve the program. As a result of these interviews, the team found that engineering and technical support responsibilities were clearly de6ned and understood.
l The organizational strengths perceived by the interviewed personnel included good technical resources at Oyster Creek with assistance by headquarters specialists, good communication between site and headquarters personnel, attention given to schedular processes, development of a teamwork concept, management strength, backup assistance available when required, emphasis on root cause evaluations, availability of training, establishment of common goals, and focus on the new system performance team concept.
The team found the weaknesses perceived by engineering and technical support personnel to include dif6culties in some technical areas, such as preventive maintenance and vibration monitoring. Other weaknesses expressed during the interviews included work prioritization, delays in corrective action, commercial grade dedication, timeliness of paperwork closecuts, financial limitation of activities, and limitations of the training program.
Recommendations expressed by engineering and technical support personnel included increased involvement of engineering in maintenance activities, increased emphasis on safety, initiation of a backlog reduction program, development of problem recognition ability, emphasis on the systems performance team concept, and continued improvement of management's ability to listen.
,
i The team recognizes the abundance of perceptions of strengths, weaknesses, and suggestions
)
for improvement as indicative of a staff sensitive to concerns related to the safe and effective operation of the plant.
i
!
'
l l
l
.
.
.
--,
'
,
i m
.-
2.2 Licensee Review Activities Related to Plant Safety The team reviewed the licensee's procedures and activities related to individual and committee decisions pertaining to plant safety. The procedures reflecting licensee actions related to safety determinations are reflected in Technical Functions Division procedures 5000- ADM-1291.01 (EP-016), Rev. 440, " Nuclear Safety / Environmental Impact I
Determinations and Evaluation," and 5000-ADM-1291-02 (LP-009), Rev. 4-00, " Safety Reviews." These procedures designate responsibilities of the originator, responsible technical reviewer, interfacing sections / divisions, independent technical reviewer, licensing manager, and engineering data configuration control. A nuclear safety review and approval matrix is provided to target the specine responsibilities for the wide range of potential safety issues.
The team reviewed the standard form " Technical Functions Safety / Environmental Determination and 50.59 Review (EP-16)," Document OCMM-402996-001, Rev. O, for the
-
Core Spray System Relief Valve Replacement and found the documentation to be in accordance with procedures. The safety evaluation form, together with a comprehensive discussion, provided a full consideration of the safety issues related to the modification.
,
On the basis of this inspection, the team concluded that the licensee retains a comprehensive procedure for review of decisions related to plant safety. The team verified satisfactory implementation of the procedure in safety reviews of several safety related plant modifications.
,
2.3 Prioritization of Organizational Activities The team discussed with the licensee the methods used by the licensee in prioritization of modification activity. Prioritization of capital and speciDe operations and maintenance
,
'
(O&M) work is the responsibility of the Nuclear Planning and Nuclear Safety Division.
Factors (weighting factor significance values are in parenthesis) involved in the prioritization decision are based on the attributes of nuclear /public safety (10), plant availability / reliability (8), personnel safety (7), direct O&M cost impact (6), and general working conditions (4).
A composite score is based on the summation of the positively or negatively adjusted weighting factors.
The team noted that the highest weighting factor is that of nuclear /public safety, which is consistent with the importance of the protection of public health and safety.
I 2.4 System Engineer Evaluation I
The team reviewed the implementation of six modifications of three systems with system
'
engineers responsible for those systems.
i D
-
e
..
-
,
.
.
l The system engineers responsible for the core spray system, the turbine building closed cooling water system (TBCCW), and the pcst-LOCA H,/0 monitoring system modifications
were interviewed.
The team noted some differences in the system-specinc knowledge of the engineers l
interviewed, but there was a general impression that the overall system knowledge of system
engineers was good. They expressed a generally positive attitude toward their i
i responsibilities.
l The function of the system engineer is to provide or coordinate all technical support to
,
operations and maintenance on assigned systems by providing close contact with operations and maintenance personnel in discussing and responding promptly to requests for technical t
assistance. He is aware of the design basis, FSAR, and PRA assumptions for the system, analyzes performance history, leads the systems performance team (SPT), develops strategic plans, assists a project manager in programs related to the system, and acts as spokesman on scope and concept for system projects.
The system engineer maintains proficiency in the status and function of assigned systems and
,
is held accountable by quarterly verbal evaluations by his/her supervisor and an annual
'
appraisal. The evaluations of system engineers are compared against a list of eight
>
"Accountabilities and Projects" that ensures their involvement, their system assessments and demonstrated knowledge of their assigned systems. There is no specific procedural requirement that system engineers walk-down or assess system operation on a prescribed frequency. Discussions with system engineer supervisors indicate that the frequency is left to the engineer due to their different levels of knowledge and experience. The quarterly evaluations do include a system (s) walkdown with the supervisor, 2.5 Modification Review
{
Members of the team reviewed several modification packages at the GPU corporate office to determine whether the sequence of initiation, review, and implementation is consistent with corporate- (GPU) and Oyster Creek site procedures. The modification packages reviewed
'
included the following major, minor, and temporary modifications:
Core Spray System Upgrade (Major Mod MDD-OC-212-B DIV)
Core Spray System Relief Valve V-20-24 and V-20-25 Replacement (Mini Modification OCMM-402996-001 Rev 0)
Core Spray System Temporary Monitoring Instrumentation (Temporary Mod OCMM-328316-001)
Temporary Installation of Monitoring Instrumentation On Core Spray System II (Mini Mod OCMM-328316-001)
J
&
j
.
l
.
~
- ost LOCA H2/02 Monitoring System Modification (Mini Modification OCMM-402951-001)
TBCCW, SFF, and.SDC Heat Exchanger Differential Pressure Gauges (Mini
,
Modification OCMM-312400-007)
At the GPU corporate office, core spray system modifications were reviewed by the a
inspection team and the modification documentation was found consistent with Technical Functions Division requirements for modifications, conective changes, ad facility changes reficcted in 5000-ADM-7350.05 (EMP-002). Revision 3. The documentation includcd design requirements, technical description, installation specification, preliminary engineering design review, operability, maintainability, testability review, safety evaluation, fire hazards analysis, construction release, and bill of materials. All required approval sign-off sheets were completed. After review of all the selected modification documents at the Oyster Creek
'
site, the team concluded that the documentation was complete, well prepared, and provided for good safety evaluations and 10 CFR 50.59 reviews.
As part of the corporate review of the above modifications, the team verified that any field change notices (FCN), field change requests (FCR), design change notices (DCN), and field questionnaites (FQ) that had been issued against the modifications had been satisfactorily implemented. The team determined that all changes had been properly dispositioned and
.;
implemented.
2.6 Communications
,
'
Based on observations of morning meetings and discussions with plant and corporate personnel, communication between the on-site and off-site engineering staffs was good.
Meetings were held on-site each morning to discuss plant status with all plant departments
'
present. Separate meetings were then held between on-site plant engineering and technical functions personnel with a subsequent conference call between corporate, Three Mile Island, and Oyster Creek. These meetings and conference calls ensure engineering management at all locations is aware of plant operational and engineering needs and status.
2.7 Modification Deferral Review The inspection team reviewed the 13R and 14R outage reports to determine if large numbers
of scheduled modifications and repairs were being either deferred or cancelled. Both outages had about 80 plant modifications scheduled with an additional 1800 (approximate) corrective, preventive, and surveillance activities to be conducted. The 13R outage had portions of 14 modifications deferred to the 14R/15R outage and five were-cancelled. The 14R outage had
'
10 modifications deferred to operating cycle 14 and 16 and to outage 15R. Three modifications were cancelled.
i
,
.
.
The outage modifications are frozen about one year in advance of the outage. Cancellations, deferrals and additions are also identified about one year in advance of the outage.
Cancellation or deferral does not usually occur just prior to or during the outage unless extenuating circumstances such as material unavailability or a design deficiency is identified.
A review of the deferred and cancelled modifications indicated that they were improvements or enhancements which would make the system (some were safety-related systems) perform better but were not necessaiy to ensure proper system operation.
The team concluded that modification deferrals were being properly reviewed to ensure minimum impact on plant safety prior to their being deferred.
2.8 Engineering Support of Operations and Maintenance - Engineering Perspective Based on interviews with system engineers and observations of maintenance and surveillance activities, the system engineers appear to be responsive to operations and maintenance activities. System engineers responded to both operations personnel during surveillance activities and electrical / mechanical maintenance personnel during corrective maintenance
~
activities. Operations personnel felt that engineering was more responsive under the new systems engineering organization. In addition, consistent with the system performance team concept and process re-engineering program (PREP) improvements, the operations and maintenance manager is involved very early in the design and modification process. This will ensure that engineering activities appropriately support plant operations.
'
2.9 Engineering Initiatives The process re-engineering Program (PREP) is an organizational enhancement initiative that provides, in part, for formalization of the system engineer program. While the system
'
engineering process is presently evolving, many organizational changes have been
.
implemented together with reassignment of engineers at GPU headquarters and Oyster Creek site to meet the needs of the new systems engineering organization.
Central to the PREP system engineering initiative is the direct involvement of the system engineer in the design and modification process. Also, the PREP initiative ensures involvement of operations and maintenance personnel through a three-function system performance team (SPT), including the system engineer, an operations representative (usually SRO licensed), and a maintenance department representative. The SPT is responsible for the efficient operation of the assigned system (s) and the modifications implemented within that system, which greatly improves the interface between the three organizational groups.
Included in SPT responsibilities is the development of a six-year plan for the assigned system.
.
,
6 The system performance team is the receptor and/or initiator of modification program suggestions. Should the modification project become significantly large, the project will be given to the project engineering section to form a project team for implementation. The project manager, thus chosen, will coordinate SPT activities and functional organizations such as licensing, materials, design, radiological controls, quality assurance and training.
,
The team believes the PREP system engineering initiative will provide for a more efficient'
.
plant organization.
2.10 Transient and Operational Cycle Monitoring The UFSAR for Oyster Creek indicates in Section 5.2.2.1 and Table 5.2-2 the number and types of reactor coolant system (RCS) transients for which the reactor pressure vessel has been designed for the duration of its 40-year licensed operating life. Technical Specification section 6.10.2(f) requires that records of transient or operational cycles for those facility components designed for a limited number of transients or cycles be retained for the life of the facility. The licensee is required to operate the RCS within the limits of the design basis expressed in the UFSAR.
Although it appears that the licensee has retained operating cycle data in storage covering the i
life of the plant, the team found that a running total of the numbers of cycles of the operatirig
.
transients identified in the UFSAR since the beginning of plant operation had not been
.
maintained. As a consequence of this, the licensee cannot evaluate the current fatigue life usage of those components designed for limited numbers of cycles.
,
In General Electric (GE) SIL 318, issued in December,1979, it was recommended that GE BWR owners monitor reactor vessel duty cycles and duty cycle frequency and to predict the numbers of duty cycles to which the plant will be subjected during its 40-year life. In Supplement 1 to SIL 318, issued June 2,1993, GE cancelled this request and advised that thermal duty margins can be demonstrated more accurately by performing fatigue evaluations
-
based on actual operating data obtained through on-line fatigue monitoring devices. GE recommended that GE BWR owners perform fatigue usage calculations based on more
realistic thermal duty cycles than those used in the original fatigue evaluation of the equipment.
,
Subsequent to the concern of GE in 1979, the GPU manager of mechanical components j
!
indicated, in a July 26,1990 letter, concern for the fact that the 120 startup/ shutdown cycles on which the vessel fatigue analysis was based had been exceeded by 46 cycles (166 cycles).
A justification was given, at that time, which showed the design to be adequate if a less conservative assumption is made of the characteristic of the thermal duty cycle.
_
_
i
.
i
Reactor stud bolting was found to have high fadgue usage and consideration was given to replacement of the studs. In a subsequent internal letter dated October 8,1990, justification of the stud fatigue usage was given by the heat exchanger and pressure vessel manager such that stud replacement was not required. The justification was based on a more realistic, although less conservative interpretation of the thermal duty cycles.
.
A September 28,1990 letter provided for a recommended thermal transient / cycle logging program as a goal for Oyster Creek technical functions department, and a June 2,1992 letter indicated that a log would be kept of 14 transient cycles including heatup/cooldown, power
!
increases / decreases, turbine generator trip, reactor scram, loss of feedwater, loss of AC
'
power, MSIV isolation, loss of feedwater heater, hydrostatic tests, and safety / relief valve i
blowdown.
At the time of this inspection, the team noted that the data from initial plant startup through the initiation of the logging procedure started in 1992 would be necessary to evaluate the fatigue life us9ge of critical plant components. The licensee stated that they would be searching the operational data since initial plant startup and have the completed operating -
.
'
numbers of transients for each cycle by January 1,1994. The team considers this to be an unresolved item (URI 50-219/93-81-01).
3.0 MAINTENANCE 3.1 Maintenance Observations The team observed the performance of four maintenance activities involving corrective maintenance and troubleshooting. The review considered skill of the trade, work order description, control room briefings and approval, training of the craft, and first line supervision participation.
JO 00049080. Relay Replacement in the Fire Pump Battery Charger-The team observed portions of job order (JO) 00049080. The scope of the work was to replace a non-safety related relay in the fire pump battery charger. The job order was initially approved on August 6,1993, to investigate and repair. During the work reauthorization process, the control room staff requested administrative controls to maintain
'
positive control of the battery charger. The JO was changed to require use of a generic relay.
procedure, A100-SME-3922.01, " Control Relay Replacement". Based on the JO change, the replacement relays were subjected to a bench test. The relays failed the bench test.
The team reviewed three other electrical maintenance troubleshooting job orders to learn if incorporation of the generic procedure on relay replacement occurred. Two of the activities reviewed resulted only in replacement of the contacts while the third was a relay
!
.
I
-
'
,
replacement. Two of the three job orders used the generic relay replacement pro:edure, while the third job order had neither specific guid nce to perform the work nor reference to the generic relay procedure.
,
The team concluded that A100-SME-3922.01 " Control Relay Replacement, Adjustment and Tests" is not being used consistently. Work activities that did not include the relay replacement procedure provided no guidance or documentation for bench testing, nor assurance that the new or repaired relay met the appropriate acceptance criteria. The inconsistent application of the generic relay replacement procedure is an administrative weakness.
30 00049549. Adiustment of the Limit Switch for the Core Sorav Test Valve
,
The team observed JO 00049549 that adjusted the open limit switch for the core spray test
'
valve (V-20-26). The corrective maintenance was based on a technical specification surveillance failure, in that the core spray booster pump discharge pressure was found to be i
Iow (less than 243 psig). Licensee investigation concluded that a misadjusted open limit switch allowed excessive core spray flow, resulting in core spray booster pump discharge pressure being below the acceptance criteria. The team questioned the licensee on continued operability of the core spray system since surveillance procedure 610.3.225, " Core Spray System 2 Instrument Channel and Level System Operability," acceptance criteria was not achieved. The licensee concluded that the system was operable, since the test valve is normally de-energized and closed during normal operation, and the valve serves no safety function, but only to provide for routine testing of the core spray system. The team concluded that the licensee's justification of operability was appropriate.
]
,
I The performance of the corrective maintenance activity was appropriate. - First line j
supervision supported the electricians, by making inquiries to plant engineering on the need
]
for bypass switch adjustments based on the limit switch adjustments. The team noted occurrences of good communications betwen the electricians, auxiliary operator, and thejob supervisor.
During the performance of JO 00049549, the team noted that a quality control (QC)
inspector was present, and performed a QC inspection report. The team observed good.
interaction of the QC inspector with the job supervisor and the electricians. The QC report of the maintenance activity was an accurate description of the observation,' and the QC inspector was knowledgeable of the activitie.; associated with 30 00049549.
JO 00049527. Electrical Jumner to Remove Voltage Tap Changer on Station Blackout Transformer
)
-
The team observed portions of JO 00049527 that installed an electrical jumper to remove a j
voltage tap changer alarm on the station blackout transformer. During preparation to j
implement the JO, licensee electricians noted that the JO reference drawings were i
.
-
-
..
e
,
.
incomplete. The electricians identified the appropriate drawings. The team noted a good walkdown of the on-site location prior to replacement of the jumper wire, and good job supervisor involvement.
JO 00049894. Troubleshoot and Repair of Hydrogen Injection Flow Controller The team observed troubleshooting and repair of the hydrogen injection flow controller (FIC-567-0023) under JO 00049894. The team concluded that the JO description was appropriate
,
for the respective maintenance activity. The instrument and controls first line supervisor observed the entire process, a project engineer provided input to the technicians, and a QC inspector was present for parts of the activity. The technicians were not qualified to this system, however based on discussions with thejob supervisor, thejob foreman evaluated the
,
technicians as part of "on-the-job" training. The team noted that no training documentation i
existed for thejob foreman. The team noted that the skill of the craft was effective considering the I&C technicians involved were not specifically qualified to the system. The team noted that control room briefings and approval of the JO were appropriate. The basis of the post-maintenance test was the vendor manual and was applicable for the activity. The team noted very good communication between operations, I&C supervision, and the I&C technicians.
!
Overall, the team noted that licensee performance was appropriate and professional. The team noted good inter-department communications. Minor weakness were identified including no training documentation for a job foreman, JO drawing deficiencies, and inconsistencies in electrical troubleshooting activities considering the use of a generic relay replacement procedure.
.
3.2 Maintenance Self-Assessment Activities The following self-assessment inputs and indicaters are used to monitor the organization's performance on a day-to-day frequency: preventive maintenance (PM)/ corrective maintenance (CM) ratios, numbers of skipped PM's, work request issuance rate, CM backlog, deviation reports for plant deficiencies and human deficiencies, management critiques, human performance evaluation system (HPES) reports, failure trend program as it relates to PM upgrades, documentation of work order history, quality assurance audits, and the outage
" lessons-learned" program.
The team evaluated six critique forms initiated by the maintenance director from mid-1992 until the inspection period. The team noted that the critiques were self-critical and thorough.
Management support of the proposed corrective actions was evident, and the corrective actions addressed the deficiencies within the critique. The team verified that identified coirective actions had been implemented.
,
J
!
.
'
The team also reviewed the outage " lessons-learned" program, which solicits informal input on outage activities that could be improved or enhanced. The program provides feedback to the initiator of the item, with proposed actions to attain improvement. The team's review of the program concluded that this was an effective means of improving outage performance.
The team concluded that the maintenance director effectively used other performance monitoring techniques, including the management critique process and outage " lessons learned" program, to identify performance deficiencies and initiate corrective actions.
The team noted that no formal department level self-assessment of mamtenance activities has been performed since the 1988-1989 time frame. The maintenance director was considering a self-assessment team prior to the next refueling outage (September,1994).
3.3 Quality Assurance and Quality Control Involvement In Maintenance Activities The team reviewed quality assurance (QA) audits and quality control (QC) surveillances related to the maintenance program and evaluated line management response and actions to correct QA/QC findings. The inspection included observation of QC's role during QC surveillance activity and review of the 1992 annual quality assurance assessment and a QA
'
monitoring report.
The licensee's 1992 annual quality assurance assessment in the maintenance area concluded that an increased amount of management attention is required to address identified areas of improvement. The QA assessment stated that procedural adherence continues to be a problem that has resulted in commercial grade dedication deficiencies, an inadvertent actuation of the electro-mechanical relief valve (EMRV) due to a lack of self checking, and
!
JO deficiencies (i.e., scope changes, lack of concurrent signatures, root cause determination
]
not being documented).
l Management response to this audit was the development of a procedural use and adherence initiative by maintenance in March 1993. The initiative was completed in July 1993 and focused on worker training on the job order piocedure, and 2400-ADM-1218.03, "Use and Adherence Policy for Maintenance Work Controlling Documents." Procedure 2400-ADM-1218.03 implemented the " procedure owner" and " maintenance reviewer" definitions, reevaluated the supporting maintenance administrative procedures to eliminate confusion, and defined clear responsibilities. The procedural use and adherence initiative identified several issues, including: work practices that did not agree with the issued procedure, administrative procedures that were written with excessive verbage and did not include accountability,_
procedure changes that were not communicated back to the users, and adherence requirements of procedures that were spread out among various procedures. Licensee actions were being implemented to address the maintenance initiatives to the QA audit at the end of
'
the inspection period. The team concluded that maintenance response to the QSD annual audit was comprehensive and that appropriate management conducted a methodical approach to deal with procedural adherence issue.
. _.
-
.
.
}
l
The team's observations of QC inspectors involved in maintenance activities concluded that
.
good interaction occurred between the QC inspectors and the job supervisor, the QC surveillance report accurately depicted the observations, and the QC inspectors were knowledgeable of the specific job task. The QA monitoring report 9221005 evaluated the maintenance department actions being taken to address open NRC diagnostic evaluation team (DET) repon findings. The monitoring report was critical and insightful regarding the rework process.
,
The team concluded that the QA audit and QC surveillances of maintenance activities was a strength.
3.4 Preventive Maintenance Program
The team evaluated implementation of the preventive maintenance program. Specific program elements reviewed were use of the critical component list, the role of the component maintenance group in developing preventive maintenance (PM) tasks, the PM revision
process, and tracking of overdue PMs.
,
At the time of the inspection, the licensee was continuing development of a final critical component list. The utility goal is to evaluate cach component on the critical component list to determine if a PM task is necessary. The team noted aggressive progress in identifying
,
new PM tasks for critical components by the review of monthly status reports.
The component maintenance group is primarily responsible for long-term upgrades to PM tasks and significant revisions to existing PM tasks. The group was fully staffed in October, I
1992, and the specific program requirements were initiated in December,1992, with
,
procedure 2400-WMS-1220.18, " Preventive Maintenance Program."
The team reviewed selected new and revised PM tasks. An example of a new PM task was the periodic overhaul of main steam isolation valves. The PM request was initiated on February 5,1993 based on industry information (GE SIL 329). The PM task was developed and completed in August,1993. The team reviewed three PM task change revisions, and j
concluded that the changes involved safety evaluations that were appropriate and complete.
The PM task revisions were made to better define post-maintenance test requirements or to accommodate changes in component maintenance procedures directly affecting the method of the PM task. The licensee implements a good tracking and accountability system of PM tasks planned and accomplished. A monthly report documents the number of PM's performed, the number of PM's not coinpicted, and the reason why the PM was not j
accomplished. The team reviewed the last six monthly PM reports. The team noted that on a monthly basis less than three percent of all PM's were missed. Program accountability of missed PM's was reflected in maintenance management aiscussions with job supervisors to determine actions to preclude not completing PM tasks as schedule.
e
.
The team concluded that the licensee adequately addressed the 1990 NRC DET observation that skipped PM's were poorly controlled. The component maintenance group was actively involved in PM task upgrades, and the licensee has a good process for evaluating and tracking skipped PM tasks.
3.5 Component Maintenance Program The team evaluated aspects of the maintenance program for the EMRV's. The EMRV's were selected based on a 25.7% contribution to core damage frequency on a system basis
,
'
when modeled in the Oyster Creek individual plant examination (IPE). Valve failures dominate the system failure rate for most cases. The licensee's IPE concluded that the risk associated with the EMRV's highlights the importance of preventive maintenance. The team evaluated incorporation of vendor information into the preventive maintenance program, equipment failure trends, past job order (JO) documentation, and proposed maintenance for the next scheduled refueling outage.
Based on a selected review of PM's the team concluded that vendor information was
'
appropriately incorporated. The team noted that the first quarter of 1993 critical component failure trend report stated that three of the seven EMRV's had experienced either pilot valve leakage or valve seat leakage. The team concluded that appropriate changes to preventive maintenance tasks and attention by the maintenance department existed to minimize
,
'
recurrence of either pilot valve leakage or valve seat leakage The team noted a recurrence of pressure sensor repeatability problems as documented in LER 92-012 and deviation report 93-303. Engineering evaluation of this issue concluded that setpoint drift is not uncommon, and no actions of replacing the switches exist to improve the drift characteristics. At the time of this inspection the licensee was considering expanding the tolerance acceptance
.
criteria. However, as referenced in report section 3.9, the team concluded that the licensee has failed to take aggressive corrective action in response to instrument drift issues.
The team noted a significant number of quality control " hold point" inspections during periodic EMRV replacement. Various hold point inspections include visual inspections of flange mating surfaces, torque values and rotation cross pattern; post-maintenance test verification; and, traveler review of the replaced valve. The team considers this to be positive QC involvement in the EMRV replacement program.
,
The team noted that for the cycle 15 refueling outage the licensee plans to increase the
number of EMRV's tested and refurbished from two to five. This is considered a positive i
step to improve valve reliability.
In summary, the maintenance program for the EMRV's is maintained at a good level.
Vendor information was incorporated into the preventive maintenance program. Recurrent pressure instrument drifting is considered a weakness in that aggressive actions have not occurred to prevent recurrence. There was good QC involvement during valve replacement.
.
--.
'
.
i
-
>
3.6 Post Maintenance Testing The team evaluated the effectiveness of the post-maintenance testing (PMT) program. The PMT process is defined in procedures AOOO-WMS-7175.01, " Post Maintenance Testing,"
and COOO-WMS-1220.08, " Job Order." The PMT's are developed primarily by
,
maintenance department planners. The planners use post-maintenance matrices and guidelines, and surveillances as a data base for the determination of the appropriate PMT for
-
a particular job order. The maintenance plannerr also rely on input from various
'
departments (i.e. engineering, operations) to develop the PMT. Based on program descriptions, if the job order (JO) scope changes, the JO (and associated PMT) is required to be evaluated by the work supervisor, and approved by the general shift supervisor (GSS).
Engineering support to the post-maintenance testing program has involved periodic updates to the post-maintenance matrices and guidelines. Although no specific safety concerns were
-
identified, the team noted the rather untimely actions to update and potentially improve the PMT program. Matrices and guidelines were last updated in July,1986. Licensee efforts are ongoing to incorporate updated industry information guides for PMT. Start-up engineering routinely develops the PMT for plant modifications, and plant engineering routinely provides recommendations for motor-operated valve, in-service test equipment, and in-service inspection PMT's.
The licensee measures the effectiveness of PMT using failure trend reports, deviation report l
root cause determinations, and feedback from the GSS and maintenance superintendent in the review of job orders. The team noted that procedure AOOO-WMS-7175.01, step 4.2.3.,
'
states that the division's designated technical support function should establish a process to -
randomly select completed work controlling documents for review of the PMT requirements to ascertain the quality and consistency of the process and initiate any programmatic actions
,
required to maintain / improve the process. The team noted that the maintenance department
does not have a designated technical support function, nor have they completed the spot
selection of work order's to assess the activity. On September 21,1993, the Maintenance Assessment Manager initiated action items to review electrical,1&C, and mechanical PMT's.
I The random review is scheduled for completion at the end of 1993.
i The team reviewed a random selection of nine completed safety-related job orders to verify that the stated job scope was consistent with the completed PMT. The review concluded that the PMT's agreed with thejob scope and were satisfactorily completed.
3.7 Configuration Control
t The team reviewed plant procedure 124, " Plant Configuration Change Control," and
>
procedure 108.4, " Control of Plant Modifications and Major Maintenance Work In Critical Plant Areas While the Plant is in Operation." Also, the team evaluated examples of past work activities involving implementation of each of the procedures.
,
.
.
The team noted that, as corrective actions to licensee event report (LER)92-011, the licensee committed to modify six motor-operated valves subjected to electrical " hot shorts" during a postulated control room fire. The control room fire potentially could render the valves inoperable at the 10 CFR 50 Appendix R remote shutdown panel. The licensee implemented the modifications during cycle 14 refueling outage. The team verified that the modifications to the motor-operated valves were completed under JO 43340, and were consistent with the expectations in procedure 124.
Licensee procedure 108.4 specifies the requirements for controlling major maintenance activities performed in critical plant areas at the Oyster Creek facility while the plant is in operation. The procedure requires additional oversight during the maintenance activity, and approval for implementation resides with the director, Oyster Creek.. Job order 0004246 was completed in June,1993 to replace / rebuild the rotating element on the "A" control rod drive (CRD) pump. The 30 was controlled properly, consistent with the provisions of procedure 108.4.
3.8 LCO Maintenance The team reviewed the licensee's control of voluntary entry into technical specification limiting conditions for operation (LCOs) during performance of preventive and discretionary corrective maintenance. The facility stated the process was controlled by a recently issued
" Plant Operations Work Performance Standard - Voluntary Entry into a Limiting Condition for Operation (LCO)". This document had an effective date of September 23,1993 and a subsequent approval date of September 28,1993. The purpose of the standard is to provide administrative guidance for control of work to be conducted during an LCO restriction.
Licensee representatives stated that the applicable screening checklists have been in use in draft form since the end of the 14R outage. This is supported by the section of the guideline titled " Methods of Communication."
The team reviewed the LCO log to identify preventive or corrective maintenance activity out-of-service times. No excessive LCO entry times or other problems were noted, with the exception of a packing adjustment on an isolation condenser containment isolation valve (V-14-33), which was completed within nine minutes of the four-hour allowed outage time.
The team reviewed the last ten voluntary entries and determined that the draft forms have not been used consistently. The appropriate checklists have been used only ten out of the last twenty-seven voluntary LCO entries, dating back to May 28,1993. Three examples were identified in which the guidance was not used, including two cases prior to the effective date of the standard, and one case after the approval date. Further, when the guidance and checklists were implemented, the documented basis for performing the task generally did not provide a clear description of the safety enhancement. In one case, the emergency diesel generator description of work did not match the basi I
.
.
.
In summary, the licensee's implementation of LCO maintenance controls pursuant to the performance standard was noted by the team to be inconsistently applied. The process and applicable forms have been used for less than one half of the appropriate cases, and for the majority of examples reviewed, the safety enhancement is not evident. Although no significant problems were identified, the dissemination and implementation of this
administrative control is considered weak.
.
!
3.9 Equipment Failure Trending Plant personnel trend equipment failures for selected critical components. The basis for selection as a critical component is defined in procedure 2400, " Maintenance Assessment and Component Maintenance Team Responsibilities Guideline. The procedural selection criteria for critical components are: (1) if failure of the component would reduce nuclear safety,
'
cause a plant trip or result in a plant shutdown; and, (2) if regulatory requirements are -
imposed on the component. The failure data are compiled and the information is provided in a quarterly summary. The information is displayed in several different sorts for various applications. The report was modified in the second quarter of 1993, to include two
~,
additions, an open action items section and a component failure analysis report section. The Director of Plant Maintenance included a letter which identifies the individual responsible for follow-up and current status for items with unnecessarily high failure rates.
The component failure trending is effective in Mentifying significant equipment deficiencies.
In most cases appropriate corrective actions were mken to reduce failure rates. The actions range from initiation or revision of PM tasks, to upgiade of plant equipment. Examples of plant modifications include upgraded emergency service water pump packing, drywell fan belts, and intermediate range monitor (IRM)/ average power range monitor (APRM) bypass switches. Additionally, a number of deviation reports and memoranda have been wTitten recommending actions be initiated due to high equipment failure rates.
!
In contrast, a number of instances of recurring failures were identified by the team, due to i
the licensee's failure to take aggressive corrective actions. Examples of repeated failures include the electromatic relief valve pressure sensors, the drywell hydrogen / oxygen analyzer, isolation condenser isolation valves and the nuclear instrumentation system.
In summary, the trending program has been effective in identifying significant trends in system reliability. The team noted process improvements through the addition of two new I
!
failure trend report sections. Efforts to enhance individual system performance are evident, however, a number of cases identified prolonged or ineffective corrective actions resulting in
.
recurrence of problems.
I
,
w-
, -
-
.
.
.
~
,
3.10 Rework
,
The team reviewed the rework system to determine how programs or maintenance practices are altered due to repetitive corrective maintenance activities. The team determined that procedure A000-WMS-7100.01, " Control of Rework", documents the criteria for i
identification of rework. The procedure assigns the responsibility for rework identification to all personnel involved in the planning or implementation of work activities. The licensee stated that the work authorization group has the primary responsibility for rework identification.
,
!
The team discussed and reviewed examples of the rework investigations performed and learned that corrective actions are being implemented to prevent recurrence. However, the
team concluded that the licensee has no provision to group or compare rework for a focused conclusion on process effectiveness. The licensee does not review the effectiveness of
'
corrective actions specified as a result of the rework investigations. Instead, to address the procedural requirement to assess process effectiveness, the licensee trends total rework reported as a function of completed corrective and preventive maintenance. The licensee has
maintained rework less than the established goal of one percent. The licensee considers the process effective based on rework less than the established goal. The team noted that the licensee plans to modify the rework process by incorporating it into the deviation report system. This will result in deletion of the A000-WMS-7100.01, ' Control of Rework", and shifting of process responsibility to the safety review group.
The team concluded that corrective actions are implemented to prevent recurrent rework, however, process effectiveness reviews are weak. The reviews focus on global percentages and do not assess the commonality of recurrences or specific corrective action effectiveness.
3.11 Maintenance Involvement in the Safety Issues Assessment Program The team evaluated the maintenance director's involvement and participation in the safety issues assessment program (SIAP). This program is described in Section 5.2.4.2 of this
report. The director of maintenance is an active member of the SIAP oversight committee.
i The team concluded that the director's understanding and participation in SIAP was consistent with the procedural expectations within 1100-ADM-1010.3, " Safety Issues Assessment Program."
Also, the team reviewed maintenance department actions to SIAP issue OC-105, which concerns maintenance program inadequacies in root cause capability, procedure training to foremen, and integration of a reliability-centered maintenance process into the current maintenance program. The team concluded, based on review of licensee maintenance j
department actions, that they were systematic and appropnate.
'
--
,
.
.
.
3.12 Engineering Support to Maintenance - Maintenance Perspective-
,
The team evaluated engineering support to maintenance based on observation of surveillance activities (Section 4.1), post-maintenance test program review (Section 3.6), in-service testing
!
!
program review (Section 4.4), industry experience program review (Section 5.4.4), and evaluation of electrical backscating of isolation condenser motor-operated valve (Section 3.13). The team determined that acceptable engineering support existed for the development of post-maintenance testing plans concerning plant modifications, motor-operated valve maintenance, and in-service testing and inspection activities.
.
The team noted good coordination between the system engineer and operations during
!'
surveillance procedure 607.4.005. The coordination was useful for the root cause deterrnination of the failed emergency service water (ESW) pumps. However, the team
'
noted deficiencies in engineering support to maintenance. Engineering department staff failed to identify a specific corrective action to minimize ESW flow element fouling, wiiich l
resulted in reduced ESW reliability, as indicated by failures during inservice testing and
'
operability surveillances. The licensee also failed to review and document a timely engineering basis for operability on electrically backseating an isolation condenser valve.
i The team also noted that the system engineer evaluating the programmatic relay replacement
'
program failed to consider a corrective action process and issue a deficiency report when confronted with relays exceeding recommended vendor service life that could seriously jeopardize the safety system logic operation.
The team concluded that engineering supported operations and maintenance well during observed surveillance and post-maintenance testing activities. However, the team noted
,
untimely engineering evaluations to support operability of the isolation condenser valves, lack
'
of specific corrective actions to improve ESW reliability, and failure to consider a corrective
,
action process when confronted with relays exceeding recommended vendor service life.
!
3.13 Electrical Backscating of Isolation Condenser Valves r
The team noted that isolation condenser steam isolation valve (V-14-30) was being
!
maintained on the electrical backseat due to a steam leak from the valve packing. Valve'
backseating is controlled by procedure 225.0 "Backseating and Unbackseating Station Valves". The procedure specifically allows the isolation condenser steam valves to remain operable following electrical backseating. Since this is an exception to the normal practice of i
declaring a valve isolation function inoperable when electrically backseated and because this
,
!
practice is not recommended by the valve manufacturer, the team questioned the basis for considering the valve operable. The license initially could not provide an engineering
.
I evaluation to support the determination that the currently installed isolation condenser steam isolation valves were operable when electrically backseated. The licensee had not reviewed or verified operability considerations for electrically backseating these valves when the
,
f
,
-
,
,
.
- !
!
,
system was modified and new style isolation valves were installed during refuel outage 13R.
,
In response to the team's concern, the licensee performed an engineering evaluation that supported the continued operable determination for the currently installed isolation condenser j
steam isolation valves when electrically backseated.
l
!
The team also determined that no provisions or controls existed, prior to the inspection to ensure electrically backscated isolation condenser valves were surveilled in the "as-found" condition. This would require the valve to be stroke tested from the backseated position.
The team identified that only one of the three satisfactory tests, in which valve V-14-30 was
!
electrically backseated and an operability test performed, were conducted when the valve was
'
timed starting from the "as-found" condition. The single satisfactory surveillance test was the licensee's basis for operability at the time the issue was first identified by the team. In response to the team's concern, the licensee issued a temporary change notice to procedure 609.4.001 revision 31, " Isolation Condenser Valve Operability and In-Service Test," that added a precaution to ensure the valves are timed from the "as-found" condition.
.
The licensee engineering department recommended reducing the backseating voltage and recording maximum current and voltage applied to the motor operator. The recommendation
.
was based on evaluating the backseat torque versus acceptable torque. The licensee stated that the engineering recommendations should be implemented by the end of the year.
The licensee initiated a deviation report on October 19,1993, that identified excessive packing leakage and valve stem galling as a recurrent problem with the horizontally-mounted isolation condenser valves discussed above. Although the team concluded that the licensee has taken a number of steps to correct apparent valve design deficiencies, it does not appear that the need for valve backseating will be alleviated in the short term.
The licensee's failure to review and document the engineering basis for operability for electrical backseating of the new style isolation condenser valves is an example of inadequate procedural reviews associated with a plant modification and is considered an unresolved item (URI 50-219/93-81-02). The problem is compounded since the "as-found" isolation testing was not being routinely performed. The licensee has developed engineering
,
recommendations to verify acceptable backseat torque. The recommendations are expected to be implemented by the end of the year.
i I -
l~
.
'
.
.
4.0 SURVEILLANCE 4.1 Observation of Surveillance Activities The team observed five safety-related equipment surveillances during the inspection to assess
-
the satisfactory attainment of procedural acceptance criteria, calibration of test instruments, qualification of personnel, interdepartmental communications, and evidence of administrative approvals.
The team observed surveillance activities for procedure 610.03.225, " Core Spray System 2 Channel and Level Test and System Operability" on September 29. The surveillance was performed by five instrument and control (I&C) technicians while being intermittently supervised by an I&C supervisor. The test equipment was within calibration and the surveillance test acceptance criteria were met. The team verified that all technicians were qualified to perform the surveillance and knowledgeable about procedural requirements. The team noted that the surveillance was well controlled by the lead technician. The team observed consistent three-way communication, independent verification and self-checking techniques.
The surveillance was coordinated well with operations for both operator-required actions and system status. However, a scheduled corrective maintenance item assigned to electrical maintenance was not performed as planned in conjunction with the system operability portion of this surveillance. The corrective maintenance was an adjustment to the open limit switch for the core spray test return valve (V-20-26). The corrective maintenance could not be performed, because the required scaffolding was not installed. The failure to coordinate the corrective maintenance with the normally scheduled surveillance resulted in an additional running of the core spray system.
The team noted that the licensee did not enter the technical specification limiting condition for operation (LCO) 3.4.A, when the surveillance activity inhibited the system safety function. This issue is discussed further in Sections 4.2 and 4.3 of this report.
The team observed post-maintenance testing / surveillance activities for the core spray pump on September 30. The team witnessed the cycling of the test flow return valve in the core spray system in the control room. Communications were clear between technicians and operations; no problems occurred with cycling the test flow return valve while performing
'
the surveillance.
The team observed surveillance activities for procedure 607.4.005., " Containment Spray / Emergency Service Water Operability and In-service Test," on October 6. The team observed good communications between control room operators and the auxiliary operators.
The operators implemented repeat backs, and the reactor operator used self-checking effectively. One minor procedural adherence issued was identified by the team when the i
i
-
,
I
.
auxiliary operator mispositioned an emergency service water heat exchanger instrument root valve. The operator recognized his actions immediately and repositioned the valve. The error did not detract from the performance of the surveillance. The team noted good coordination between the system engineer and operations personnel to add in the surveillance the inservice testing data for the 'C' and 'D' ESW pumps, to define additional insights for pump performance anomalies. The data was rXmately proven useful for root cause
'
determination on pump failures.
The team questioned the operability of the ESW and containment spray system, when the surveillance testing data failed to meet the acceptance criteria (section 7.0 of 607.4.005).
Based upon previous testing experience, the operators conducting the test suspected that the test failure occurred as a result of debris blockage in flow instruments. The group shift supervisor (GSS) stated that he would consider the system inoperable when the tag out of the system occurred for inspection of the suspect flow instruments. The GSS stated that if the flow instrument showed indication of debris, inoperability would continue until post-maintenance testing. The GSS also stated that if the flow instrument was clean, the GSS would back-date the inoperability of the system to completion of the surveillance. The Operations Manager, who had interceded with the GSS, directed that the inoperability determination should be initiated based on failure of the surveillance acceptance criteria. The system then was declared inoperable by the GSS, and the licensee issued deviation report (DR)93-537 to document the surveillance failure. Licensee actions were t ken to clean the flow instrument, and restore the system to an operable condition. Upon issuance of the DR, the licensee provided a list of similar DR's since 1990. The team reviewed the past DR's which documented repetitive deficiencies, such as dirty flow instruments and low heat exchanger differential pressures. DR 93-467 issued on August 4,1993 stated that system 1 of ESW was declared inoperable based on the pump surveillance test results. The licensee cleaned the flow instruments and passed subsequent testing. The issue of continuing recurrence of the fouled flow instruments was assigned to the plant engineering department for resolution. The engineering evaluation stated that changes to the anubar system (flow instrumentation) were evaluated and considered not to be cost effective, since any type of flow element would experience the same type of fouling phenomenon. The team concluded that recurrent inoperability of the containment and ESW systems due to system fouling represented reduced reliability for the safety-related system. The licensee engineering department had not identified a corrective action to minimize system surveillance testing failures due to flow instrumentation anomalous conditions.
The team observed surveillance activities for procedure 610.3.006, " Core Spray Isolation Valve Actuation Test and Calibration," on October 5. The team concluded that the procedure was completed in its entirety with no discrepancies noted. All test acceptance criteria were satisfied, and communications were very good between the technicians and operations. Repeat-backs and self-checking were evident. The surveillance was completed by qualified personnel, and the test instruments were calibrate._
_
.
.
.
>
.
.
.
The team observed procedure 609.4.001 " Isolation Condenser Valve Operability and In Service Test," on October 14. The team observed that the surveillance met the acceptance criteria. Communications were very good between the reactor operators, auxiliary operators,
and radiological control technicians. The team noted good verification and review of a tempor, ry procedure change by control room operators (Section 3.13) and observed good self-checking by the reactor operator.
Based on the team's observation of surveillances, good interdepartmental communication existed. The equipr. ent was within calibration and test acceptance criteria were met.
Repeat-backs and self-checking were evident to the team. One instance was noted where corrective maintenance retest and scheduled surveillance were not performed in parallel as planned resulting in an additional core spray system test.
4.2 Equipment Operability During Surveillance Testing While reviewing surveillance activities, the team noted that licensed operators did not routinely enter technical specification (TS) limiting conditions for operation (LCOs), when the performance of a test rendered the equipment inoperable. NRC Generic Letter 91-18, entitled "Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degrading and Nonconforming Conditions and Operability", states that, unless specifically prohibited otherwix, the TS LCO statement shall be entered when equipment is removed from service and andered incapable of performing its safety function. The team discussed this issue with &: operations manager who observed that this position was contrary to normal practices at Oyster Creek.
The team was concerned that the Oyster Creek operating philosophy could be a safety concern for the following reasons. Compensatory actions required when a safety system function is inhibited may not be implemented, and technical specification (TS)-required i
equipment may be left inoperable for greater than the allowed outage time, if the appropriate TS LCO is not entered. Additionally, operators may unknowingly allow both trains of redundant TS-required equipment to be rendered inoperable by allowing LCO-required maintenance to be performed on one train and a surveillance that inhibits the system safety function on the other train.
The licensee does not follow guidance provided in NRC Generic Letter 91-18 and has
inadequate administrative controls for performance of TS-required surveillance that render systems inoperable. This issue is discussed further in Section 4.3.
,
.
-
-
-
.
i
.
'
,
4.3 Core Spray Operability During Surveillance Testing 4.3.1 Operability As described in Section 4.1, the team observed that the facility did not enter technical
.
specification 3.4.A limiting condition for operation during performance of surveillance
610.3.225, " Core Spray System 2 Channel and Level Test and System Operability". The core spray system 2 loop was not declared inoperable nor were any special provisions taken i
while performing the logic functional test portion of the surveillance, which renders the system safety function inoperable. The surveillance requires removal of control power fuses in the pump start logic which in turn prohibits the core spray system loop from responding to an accident initiation signal.
The licensee's stated position was that the system remains operable during technical specification required surveillance testing, even though it's recognized that the system loop is not capable of performing the designed safety function.
The technical specification (TS) action statement 3.4.A.3, requires in part, if one core spray
-
system loop becomes inoperable during the run mode, continued reactor operation is allowed
-
providing two additional conditions are met. One of these two conditions is 3.4.A.3.b which states, in part, that the average planar linear heat generation rate (APLHGR) of all rods in any fuel assembly, as a function of average planar exposure, at any axial location shall not exceed 90% of the limit. Additionally, the specification states, "the action to bring the core to 90% of the APLHGR limits must be completed within two hours after the system has been
'
determined to be inoperable." In accordance with the associated technical specification basis, these actions are necessary to ensure the remaining loop of core spray is capable of supplying
'
the minimum bundle flow rate to ensure core cooling following a design basis accident.
.
Surveillance procedure 610.3.225, had no specific requirement to monitor or maintain APLHGR less than or equal to 90% of the limit. Further, no specific provisions existed to limit the amount of time a train of core spray is disabled.
4.3.2 Corrective Actions
.
Ilased on concerns raised by the team, the licensee performed a review of all core spray surveillance and identified six additional core spray surveillance test procedures that would prohibit the system safety function. Three of the seven surveillance procedures are duplicates, since a separate procedure is developed for each of the two system loops.
A deviation report,93-573 was initiated on October 6,1993 to document the resolution of
,
this issue. The licensee's multi-disciplinary review group evaluated this issue for reportability, and subsequently referred the issue to the safety review manager.
l
)
.
!
.
On October 18,1993 the safety review manager concluded that if a surveillance disables both main pumps in either core spray loop and APLHGR is greater than 90% of the limit, this would be reportable under 10 CFR 50.72 as a condition outside the design basis of the plant.
On October 7,1993, operations management issued interim guidance 2100-93-296 to ensure APLHGR is equal to or less than 90% prior to performing any of the smveillance identified as defeating the system safety function.
On October 21,1993, the licensee nnde an immediate notification per 10 CFR 50.72, as a condition that is outside the design basis of the plant. The report identified four separate occasions ranging in time from May 8,1992 to October 5,1993 in which a core spray surveillance was performed and APLHGR was greater than 90% of the limit. Based on the notification and further reviews, the team established the date, time, APLHGR values and surveillance procedure being performed in each of the four cases as follows:
1.
May 8,1992; 10:00 a.m. to 2:00 p.m.; APLHGR 90.9 to 91.8%; 610.3.105, " Core
'
Spray System 1 Instrument Channel Calibration, Test, and System Operability" 2.
October 31,1992; 9:27 a.m. to 2:45 p.m.; APLHGR. 91 to 94%; 610.3.225, " Core Spray System 2 Instrument Channel and Level Bistable Calibration and Test and System Operability" 3.
October 1,1993; 9:52 a.m. to 11:00 a.m.; APLHGR 90.1; 510.3.125, " Core Spray System 1 Instrument Channel and Level Test and System Operability" 4.
October 5,1993; 9:35 a.m. to 11:25 a.m.; APLHGR 90.1; 610.3.006, " Core Spray Isolation Valve Actuation Test and Calibration" r
.
The values of APLHGR for the first two exampics are ranges based on several data points during the performance of the specified surveillance.
The licensee stated that they reviewed all data back to the time that TS amendment 153 was issued. This amendment modified the core spray LCO actions to include the APLHGR conditional limitation. The four occasions of being outside the design basis are based on a
core spray system being inoperable due to conducting a surveillance with APLHGR above 90%. The time intervals reported were based on the group shift supervisors log entries for start and completion times for each of the surveillances. However, the times recorded do not necessarily reflect that the system was inoperable for the entire period.
I The team reviewed surveillance times along with record keeping practices and determined
!
that there was no conclusive way to identify exactly how long the safety function was inhibited for the four cases reported. However, the team also determined that the provision allowing two hours to bring the core to 90% of the APLHGR limits after the system has I
been determined to be inoperable was not applicable for these circumstances. Since the performance of the surveillance and the associated action which renders the system
--.
._
.
l
i
inoperable is pre-planned action, the APLHGR should be verified within 90% of the limits I
prior to the surveillance. Otherwise this could result in operation beyond the design basis of the plant.
The licensee also stated that the core spray system work scope and surveillance records had been reviewed for the period subsequent to technical specification amendment 153. The licensee determined that there were no cases in which one system loop of core spray was in a
LCO, while performing surveillance on the other system loop that would have prevented the -
system from performing its safety furction.
Additionally, the licensee plans to review and evaluate all technical specification surveillance
to determine if a similar problem exists for other systems during surveillance testing.
!
4.3.3 Procedure Revisions
The facility did not implement the necessary surveillance procedure changes. The need to
implement a thermal limit penalty was established in Topical Report 053," Thermal Limits With One Core Spray Sparger," dated 12/88 by GPU-Nuclear. The facility drafted a Technical Specification Amendment and used licensing action items (LAls) for implementation of procedural changes. The LAls initiated in response to the technical
-
specification amendment request are as follows:
.
LAI 89006.1 (1/31/89) requested changes to procedures based on the technical specification amendment request. The assignment was given to core engineering, which developed three procedures needing revisions based on the
!
amendment. The procedures were 202.1, " Power Operations", 1001.22,
" Power Distribution Control During Power Operations", and 2000-RAP-3024.1, " Alarm Response Procedure - Sparger DP HI."
LAl 89006.2 (10/24/90) again requested procedural changes by core engineering.
Core engineering provided the same procedures.
LAI 89006.3 (7/21/91) requested safety engineering review of the proposed technical spec" cation amendment request (Revision 2) pursuant to procedure 1000-ADM-
,
'
12C el. The review was completed on July 23,1991.
The above actions demonstrated that the licensee had performed multiple reviews and did not identify the need to modify the core spray system surveillance procedures. The procedure
.
reviews were assigned to only core engineering instead of using a multi-disciplinary approach. Further, the operations department was not notified of the pending change to the TS action statement.
i
.
.
a
!
,
4.3.4 Conclusions
,
The team determined that no technical specification violation occurred during the surveillance observed by the team. APLHGR was less than 90% of the limit during the applicable
'
portions of the surveillance. However, the four cases in which the licensee identified that
-
they had not reduced APLHGR to equal to or less than 90%, as required, prior to defeating the system safety function, are considered an apparent violation of technical specification
3.4.A.3 requirements. (EEI 50-219/93-81-03)
!
The licensee did not modify applicable core spray surveillance procedures when it was
'
determined that one core spray system loop would not provide adequate post accident flow without implementing a thermal limit penalty (APLHGR). This determination was documented in Topical Report 053, " Thermal Limits With One Core Spray Sparger, dated
,
12/88 by GPUN. This is an example of inadequate establishment of measures to assure that l
applicable regulatory requirements and changes in the design basis, are correctly translated into technical specifications and all appropriate procedures, which is considered an apparent violation of 10 CFR 50, Appendix B, Criterion llI (EEI 50-219/93-81-04).
t
The initial corrective measures taken were not adequate. The licensee performed a l
'
surveillance on October 5,1993, that prohibited the core spray system safety function, with APLHGR greater than 90% of the limit. This surveillance, which is one of the four examples reported, occurred four days after the concern was raised by the NRC team.
,
During an OSTI debriefing on October 1,1993, the team leader discussed this issue with the director of operations and maintenance and the licensing manager. This represents a lack of aggressive follow-up necessary to address a potential safety issue.
The interim corrective actions that were taken to assure operation within the plant design basis during core spray system surveillance testing, following the October 6,1993, meeting between the operations manager and OSTI team members, have been timely and adequate.
,
The interim guidance should prevent the seven identified surveillance procedures from being conducted with APLHGR greater than 90%, however, the licensee appears to be addressing only the very specific core spray /APLHGR issue.
,
The duration that this issue has not been addressed adequately with appropriate procedural barriers is at least five years. The need to implement the thermal limit penalty was clearly established in Topical Report 053, " Thermal Limits With One Core Spray Sparger, dated 12/88 by GPU-Nuclear. Although the technical specifications were not amended until 1991, the surveillance procedures should have been modified immediately after the topical report
>
was issued. This would have ensured that plant operations were maintained within design basis limits when one core spray system loop was out of service for surveillance testin. _.
. -.
.
t
,
!
Additionally, the licensee had an opportunity to identify this issue when Generic Ixtter 91-18 was issued November 7,1991. The licensee did not perform any significant or specific actions in response to the re-stated NRC position on operability during surveillance testing.
.[
Since the licensee practice was contrary to the NRC position, the licensee should have ensured, as a minimum, that the administrative controls for performance of TS-required
+
surveillances that render systems inoperable were adequate.
4.4 In-Service Testing
!
The team selected safety-related pumps, based on risk significance from the licensee's individual plant examination (IPE) report, to assess implementation of the inservice test
'
program, the basis for any pump baseline changes, and the licensee's trending program. The inspection references used for the evaluation were procedure 125.1, "In Service Test
Program Administration," NRC Generic Letter 89-04, " Guidance on Developing Acceptable Inservice Test Programs," observations of on-going surveillances, Oyster Creek IPE submittal, and discussions with the licensee's inservice test (IST) coordinator.
,
The team selected four pumps based, in part, on the licensee's IPE, including containment spray, service water, core spray, and emergency service water pumps. The team's
,
evaluation of the containment spray pump testing concluded that the quarterly frequency was being met, pump reference data has been unchanged in the last five years, and none of the i
four pumps were in the required action range or alert range for the last year. Service water
pump 1-1 had undergone a baseline change in mid-1991. The basis of the baseline change
was replacement of the pump due to casing leaks, and the change wa consistent with the procedure 125.1. In March,1992 service water pump 1-2 was in the alert range for vibration levels in the horizontal direction. The team confirmed that pump test frequency was adjusted to monthly consistent with procedure 125.1 and ASME Section XI (1986
'
edition) Subsection IWP-3230, " Corrective Actiont" The team's review of core spray IST data indicated that testing was performed as required, and no alert or required actions ranges were noted.
The team's review of the emergency service water pump IST data concluded that both ESW
'
pumps have a history in the required action range for low differential pressure. The majority of the reasons for a low differential pressure have been from fouling of the anubar flow instrument. During observation of testing per procedure 607.4.005, " Containment Spray and Emergency Service Water Operability and In-service Test," on October 6,1993 the directed differential pressure measurement of both the "C" and "D" pump was in the required action range-based on debris-induced clogging of the anubar instrument. This is considered a weakness in corrective action for repetitive failures of the IST program without providing actions necessary to improve the pump reliability. Based on the IPE system approach l
review, the ESW/ containment spray failure contributes 4.0% of the core damage frequency.
l l
-
.
-.n
..,. --
,.
. -,.
,
-
..
. - - - - -
!
.
.
The team's conclusion is that a majority of safety-related pumps are performing well, surveilled when required, and appropriate justification for baseline changes existed. The ESW pumps continue to become inoperable due to low pump differential pressures (i.e. _
below the required action range). The primary reason for the IST pump failures is due to l
debris induced clogging of the anubar flow instruments. The repetitive inoperability of the pumps decrease pump reliability, which in turn contradicts IPE recommendations.
t 4.5 Control of Troubleshooting Activities j
The team observed maintenance troubleshooting activities using procedure A100-ADM-3660.01, " Conduct of Installed Instrument Troubleshooting, Calibration and Maintenance" to evaluate procedural adherence, the applications of risk assessment and the process of using 10 CFR 50.59 determinations. The team also reviewed several job orders that were
'
previously performed which involved troubleshooting activities, and spoke with cognizant l
individuals involved in the troubleshooting process.
The I&C superintendent developed procedure A100-ADM-3660.01, to provide control of
-
troubleshooting activities. The procedure intent is to assess the risk level and to communicate the risk level to the appropriate maintenance and operations personnel.
Technicians were trained on the procedure after the 14R outage in February 1993.
The troubleshooting procedure requires a risk assessment for components that are within the
~
critical component or system list. The team reviewed job order (JO) # 00049294 which was
'
initiated to troubleshoot and repair the cause of the "C" fuel zone run light not being illuminated. The component involved was a fuel zone level / pressure programmable controller which is within the reactor vessel instrumentation system, a critical system.
However, a risk assessment was not performed on this job order. The team also reviewed i
30# 00047805 which involved troubleshooting and repairing the reactor wide range fuel zone level indicator, also part of the reactor vessel instrumentation system, which cycled several
-
times from upscale to downscale rapidly for no apparent reason. A risk assessment was performed, since it was considered to be within the critical component and system list. The risk was determined to be medium which means performing this job could have a risk on plant equipment, but should not present a risk of an unexpected load reduction, a plant transient, or a reportable event. The team determined that a risk assessment should have been performed on JO# 00049294, since both of the job orders involved components within the reactor vessel instrumentation system, which is among the critical system list. However, the licensee stated, although the fuel zone level / pressure programmable controller is within the reactor vessel instrumentation system, it will not have any affect on the nuclear safety of the plant. The licensee believes that the training that the technicians and supervisors receive i
on troubleshooting is adequate in determining which components are within the critical
!
component and system list. The team concluded that an inconsistent application exists for determining risk assessments.
?
.
.
~
.
l
1 i
l The team reviewed several I&C and electrical job orders for the application of 10 CFR 50.59 l
safety determinations. Troubleshooting procedure A100-ADM-3660.01 states to obtain l
necessary approval signatures and safety determination if required and that a safety determination may be waived with the permission of the GSS. The I&C department intention is to perform a safety determination on every job order dealing with troubleshooting. The i
electrical depanment does no: include a safety determination sheet with each of the job order
i packages. However, the 50.59 safety determination sheet states that it must be documented l
if the document type is listed on the matrix in corporate procedure 1000-ADM-1291.01. The l
electrical department staff believes that the responsible technical reviewer's (RTR's) signature j
is adequate documentation for doing a safety determination. The team found two instances i
where safety-related electrical job orders did not include safety determination sheets, and
!
they were corrective maintenance activities which are within the matrix in corpomte procedure 1000-ADM-1291.01. The team spoke with the GSS to determine the i esis for when the GSS waives a safety determination. The GSS stated that he usually waives a safety determination when the job involves components that are not within the critical system list in the troubleshooting procedure. The team noted that this practice contradicts the definition and need for a safety determination.
The team concluded that there is an inconsistency between the I&C and electrical l
'
l depanments in performing and documenting 50.59 safety determinations. The 10 CFR 50.59 I
safety determination should be documented in accordance with corporate procedure 1000-
'
ADM-1291.01.
The team observed JO# 00049894 which was conducted in accordance with troubleshooting procedure A100-ADM-3660.01, " Conduct of Installed Instrument Troubleshooting,
-
Calibration and Maintenance." The scope of the job order was to perform corrective maintenance to troubleshoot and repair the hydrogen injection flow controller, FIC-567-0023 which was not working in the manual and local setpoint modes. A 10 CFR 50.59
.
determination was completed in accordance with corporate procedure 1000-ADM-1291.01.
Overall, the team concluded that there have been no performance concerns with the control of troubleshooting activities, based on inconsistent risk assessments. A lack of consistency between departments was noted by the team in the performance of 10 CFR 50.59 evaluations
'
for troubleshooting.
4.6 IIuman Performance Deficiency Corrretive Actions The team determmed that the facility is effectively using the HPES program to enhance personnel performance. The team identified one case, per DR 93-364, in which a critique, 2 '2 493-007, was performed for an event in which a control rod was inadvertently scrammed while a system outage was being cleared. This event had been preceded by a number of
'
other operations personnel errors in a relatively short period of time. One of the corrective I
actions from the critique was for each operating shift to develop a plan for the elimination of l
personnel errors. The action plans developed by each operating shift were varied, but
!
l l
.
I
.
generally appropriate. Operations management determined it necessary to capture the best attributes from each shift's effort and institutionalize this as management expectations and thuc minimize the potential for diversity between shifts. Although the effectiveness of the mart ; ment expectations could not be assessed, since they have not been formally issued, the operations manager noted that the operations department has been mistake-free since this event.
The team viewed this approach as positive, in that it solicits crew input for the solution and provides the necessary ownership for corrective measures which will ultimately be implemented by the operating crews.
5.0 MANAGEMENT PROCESSES AND CORRECTIVE ACTIONS 5.1 Management Processes 5.1.1 Licensee Initiatives The licensee continues to use existing initiatives, as well as identify new ones, to address organizational and plant performance / equipment-related issues and concerns. Many of these initiatives are mentioned in various areas of this report, and include: (1) maintenance department's procedural use and adherence initiative; (2) use of the component maintenance group in addressing preventive maintenance program weaknesses; (3) process re-engineering program activities, including the development and use of the system engineer program; (4)
teamwork and leadership concepts and group initiatives involving system performance teams, management observation teams, the multi-disciplinary review group, the plant review group, the safety review group, the safety issues assessment program, and the operational experience program improvement team; (5) the ombudsman and operator concerns programs used in addressing employee concerns; (6) the development of work performance gqndards, such as those used for the implementation of self-checking techniques, and (7) the use of the human performance evaluation system and the organizational culture and nuclear plant safety
'
evaluation technique as assessment tools.
Based upon interviews with management representatives, information obtained from routine document reviews, and interactions with licensee personnel, it became evident to the team that a number of other initiatives were occurring that were impacting licensee performance in j
a positive manner to various degrees. These initiatives included: (1) the procedure upgrade program (PUP); (2) the professionalism program; (3) the GPUN vision and core values i
declaration; and (4) labor-management cooperation that resulted in the development of common goals by the union / management task force.
'
Regarding the PUP, the team noted that this program did not appear to be keeping pace with the organizational changes and alignments that had occurred recently. This became evident to the team as it reviewed procedures in use at all organizational levels. The team determined that some procedures were obsolete because they did not reflect current
.
..
.
.
i
organizational alignments and changes in reference procedures. This condition complicated the understanding of licensee administrative control processes that are very complex in,
nature. Inordinate amounts of detail were contained in procedures, in part, due to the need to describe the many organizational responsibilities, which was found to be confusing by the
-
team. The PUP has not focused on the issues of complexity and inaccuracies.
A constructive and progressive approach on the part of management and workers was evident to the team in the identification and use of initiatives being employed to improve plant operations and organizational effectiveness. The team found this to be a strength.
,
5.1.2 Management Involvement and Oversight Management involvement in the day-to-day operation of the plant was evident in daily meetings and communications, safety assessment and self-assessment activities. This involvement focused on the material condition of the plant and human performance attitude
,
and behavior, and the team determined this to be a strength. The team was impressed by the routine involvement of senior corporate managers and members of the board of directors in plant performance, safety assessment and self-assessment activities.
The team reviewed site management involvement in observing and documenting work practices. One of the programs used by the licensee to accomplish this involvement and oversight function is the management observation teams program. These teams consist of
,
one OC management team member or senior manager accompanied by one or two exempt personnel not on the management team. In May,1993, the radiological controls / safety director-OC, provided a general guidance update document to all management observation team members. This document called for a renewed commitment to the OC program and documented, in detail, the more commonly observed problem areas, including the lack of
,
enforcement by first line supervision. The team reviewed a number of management observation reports and noted a good level of documentation on the details of work performed and performance-related '.servations. The obvious vigor in which the observation teams are involved in the on-going activities at the plant was considered by the
,
team to reflect positively on management involvement and oversight of licensed activities.
l 5.1.3 Tracking and Trending s
Tracking and trending activities were reviewed by the team to assess their use in management oversight activities. Ample evidence of the licensee trending of plant, program,
'
and personnel performance was found by the team. Corrective action systems, safety assessment activities, quality assurance activities, and routine operational and maintenance activities were all subjected to periodic analysis and review by management. The nature and type of trending performed by various elements of the organization was viewed as being'
generally good by the team, however, a weakness in the trending of LERs was identified
,
r
_
_
_
_
.
-
.
(
(Section 5.4.2.2). The trending activities associated with plant deviation reports and the
,
maintenance department's component failure trending were particularly noteworthy as a.
"
demonstration of management's effectiveness in monitoring the identification and resolution of significant equipment deficiencies.
.
The team determined that the licensee continues to rely on a complex system of individual tracking programs. The team noted that DET con : erns related to inadequate tracking of routine work activities was not a recurrent problem. However, the large number of
'
individual tracking systems in use acted as an impediment to the team in being able to fully assess the licensee's capabilities or performance in this area. A specific concern identified
'
by the team was the lack of a tracking system that integrated and prioritized, for management
review and assessment, all important OC issues that warrant routine monitoring and attention. Notwithstanding, the team did note that the station action item tracking system maintained by the director, OC was the one activity that best reflected the global nature of items and issues, as well as the identifying organization, associated with plant and personnel
'
performance.
5.1.4 Plan For Excelleace
.
The plan for excellence (PFE) was established in 1989 to achieve excellence in all phases of operations in a reasonable period of time. The plan for excellence consists of a mission
,
statement, key objectives, goals, action plans, and measurement standards or guidance, where applicable. Action plans are prepared to meet the specific objectives and suggest the annual goals for each year covered by the Plan. A status review of open items is to be conducted every six months on the PFE items.
There were ten issues that were a result of the 1990 diagnostic evaluation team (DET) that the licensee tracked in their PFE. The team reviewed the PFE items for these ten issues I
which included the objectives, goals, and action plans. The team addressed the applicable PFE items that were within the scope of the inspection in their respective functional areas.
The licensee has addressed most of the DET issues in the PFE with the exception of
'
formalizing individual department action tracking systems.' The licensee intends to integrate the action tracking systems as a result of the corrective action systems review in progress.
The team also noted that the PFE was relegated to functioning as essentially a bi-annually reviewed tracking system for plan items. The team found that there was not complete and updated documentation in the PFE for all of the items that resulted from the 1990 DET.
5.2 Safety Assessment 5.2.1 Safety Review Program A GPUN-Wide nuclear and radiation safety program, or the safety review program (SRP),
controls the safety assessment processes associated with the operation of Oyster Creek. A comprehensive program has evolved out of effons by the licensee in the early 1980s to
.
.
.
l i
.
establish a safety review organization and program which could effectively monitor and respond to problems experienced at GPUN plants, as well as trends in the nuclear industry.
The features, characteristics, and elements of the program are described in a program plan document,1000-PLN-1291-01, and consist of three categories: (1) functionally chartered review groups charged with the responsibility to look into matters affecting GPUN nuclear and radiation safety; (2) safety review processes applied by individuals or groups on specific documents, events or conditions; and (3) functions performed within the organization that are intended to assure safe conduct of nuclear and radiation control activities.
Based upon the results ofinterviews and reviews of administrative procedures, safety review
-
activities and associated documentation, the team determined that GPUN was effective in incorporating proper safety principles in the program; including: the recognition of risk, the need for extraordinary care and attention, the acceptance of personal accountability and commitment, the implementation of the nuclear safety defense-in-depth principle of providing multiple barriers, and the need for a competent, well-trained staff. Additionally, many 6f the on-going corporate and plant initiatives; including the GPUN vision and core value; declaration, management observation teams, professionalism program, and operator concerns program, embrace these safety principles. However, the team noted that the administrative controls for many SRP elements, which describe organizational interfaces and responsibilities, were complex, contained inordinate amount of detail and were confusing.
Recognition of the comprehensive and inclusive nature of the SRP in operational activities is evidenced by the licensee specifying that safety reviews are included in the assurance
,
activities that fall within the scope of the operational quality assurance plan (QAP) and are considered part of the quality assurance program. The SRP description in the QAP properly represents the comprehensive and diverse nature of the programs elements.
'
5.2.2 Independent Safety Review Division The independent safety reviev ;iSR) Division is responsible for performing independent review and assessment at GPUN operating facilities. The ISR Division staff provides oversight of the corporate policy and procedures which implement the nuclear safety review
process. The director, independent safety review functions as the chairman of the general office review board (GORB), has cognizance over a nuclear safety assessment department (NSAD), the independent onsite safety review group (IOSRG), and the ombudsman Program.
The director, ISR submits a monthly report to the president-GPUN that discusses technical assessments and activities that the IOSRG was involved in, including ombudsman concerns.
The team reviewed the monthly report of independent safety review for July 1993 and conducted a follow-up review of an issue involving the IOSRG questioning the qualification of new battery support racks installed during the 14R refueling outage. Specifically, an IOSRG safety review engineer provided to the team detailed documentation of his review of an ABB Impell qualification test report and his concerns that the replacement racks were not
qualified because they sustained damage during the qualification tests. There was no damage i
or loss of functioninr, of the batteries. The team noted good follow-up on the issue that i
i
.
i
.
.
I
included ISORG communications with Technical Functions and the systems engineer, the
-
issuance of a deviation report to initiate corrective action for a possible design deficiency,
,
and the use of the system performance team for continuing review of the issue.
Subsequently, Standing Order No. 49 was issued by the operations department for the i
inspection / replacement of battery locks (the components identified as being damaged during the qualification tests) following a seismic event which is reportable to the NRC under the
Technical Specifications. However, as a result of this review, the team identified a concern that the operations department did not have an "act of nature" procedure for combating
,
significant events (e.g., tornado, flood, earthquakes, etc). This matter warrants further NRC review and is considered an unresolved item (URI 50-219/93-81-05).
t The team reviewed the activities of the NSAD and determined that it is essentially a single person department whose director acts as the corporate ombudsman, and who leads independent assessment teams (IATs). For the shutdown cooling event that occurred on January 25,1993, the director, OC requested an IAT, which was in addition to the reviews
-
conducted by the post-transient review group and the independent technical review group.
Besides the use of the human performance enhancement system (HPES) to identify the human performance factors that contributed to the event, the IAT investigated organizational factors as well. The latter point is related to developmental work being done by GPUN. This work involves research being performed by universities and national laboratories in the measurement of the relationship between organizational processes (or factors) and nuclear power plant safety. The NSAD developed an assessment tool called organizational culture and nuclear plant safety (OCANPS), which was used by the IAT. The GPUN initiative involves changing the way things are done (the culture) for the purpose of improving r
organizational performance and was considered by the team to be a positive initiative.
The team also reviewed the 1992 annual trend of nuclear safety assurance report developed by the ISR Division. Thit orporate level document incorporates assessment reports from the GPUN division directors, and includes the ISR's own annual nuclear safety assessment.
The latter assessment, which reviews equipment performance, human performance and organizational effectiveness is derived from IOSRG activity reports and plant Division
,
performance indicator monitoring reports. The team noted that trends and critical self-assessments were contained within the document, which is sent to the president, GPUN. The report focused on nuclear, radiological and industrial safety perspectives and concluded that a positive trend in the level of assurance was occurring. The depth, detail, and openness of the self-assessments documented in the trend report were viewed by the team as an indicator of the positive influence that the established safety philosophies have at GPUN corporate and Oyster Creek divisions.
,
,
5.2.3 Safety Review Process
-
The Oyster Creek safety review process utilizes a system involving responsible technical
-
reviewers (RTRs) and independent safety reviewers (ISRs) performing the safety overview
functions which would otherwise be performed by a plant operating review committec
,
d
'
L
"
,
L
!
,
(PORC). The requirement to maintain a PORC was deleted from the Oyster Creek technical specifications (TS) by Amendment No. 69, which was issued on January 12,1984. The roles of the RTR and the ISR are defm' ed in Oyster Creek TS 6.5.1 (" Technical Review and Control") and technical specification 6.5.2 (" Independent Safety Review").
l Oyster Creek Procedure 1000-ADM-1291.01, Rev.10, implements key features of the safety review process. The focal point of the procedure is the review and approval matrix (the l
matrix) which lists subjects, and corresponding corporate organizations, for areas requiring
'
l safety review. For subjects not listed in the matrix, the originator of the activity under consideration exercises judgement as to need to conduct a safety review. The safety review l
process begins with the originator performing a safety determination. The safety l
determination, is designed to determine if documents, document changes, facility changes, or tests and experiments have any potential safety significance. If the subject under review is within the scope of the matrix (or is othe.rwise significant) but the impact of the subject is low, the originator provides written justification which must receive concurrence by an RTR (a certified individual independent from the originator). The subject may then be I
implemented. If the originator determines that a subject has potential safety significance via the safety determination process, a written safety evaluation is required.' The purpose of the safety evaluation is to determine if the change will adversely affect nuclear safety and if prior NRC approval is needed. The safety evaluation receives the concurrence of an RTR and an ISR (a certified individual independent of the originator and the RTR). The RTR/ISR function can be performed by more than one individual (in the case of multidisciplinary reviews), however, a single individual signs the safety determination and/or the safety evaluation to certify the satisfactory completion of the respective PTR/ISR function.
The team revbwed the safety review process with regard to those provisions of TS 6.5.1 and 6.5.2 for RTR/ISR qualifications and scope of review. The RTR qualifications contained in TS 6.5.1.14 requires the RTRs to be qualified to the requirements of "... ANSI N18.1-1978, l
section 4.6 or 4.4 for applicable disciplines or have 7 years of appropriate experience...".
The reference to ANSI N18.1-1978 is incorrect, as no such document exists. The implementing procedure,1000-ADM-1291.01, references ANSI /ANS-3.1-1978 as the
,
qualification standard for applicable RTR disciplines, which is an acceptable reference. The licensee should submit an application for license amendment to correct the error in TS 6.5.1.14. With regard to qualifications, the team interviewed six RTRs and six ISRs from a j
represatative cross-section of onsite divisions. The results of the interviews indicated that the RT ts and ISRs were well-qualified for their review responsibilities.
,
Both R'lRs and ISRs receive initial training and refresher training every two years thereafter.
The team reviewed training material prepared for the Oyster Creek division which is the j
model for RTR/ISR training in all GPUN divisions. The training material incorporates
,
definitions and an approach to safety which agrees with industry document NSAC-125, j
" Guide Lines for 10 CFR 50.59 Safety Evaluations", with minor exceptions. The team l
l concluded that the training provided for the RTR/ISR personnel does a good job in preparation for the RTR/ISR role and in maintaining requisite knowledge and skills.
i
i
A sample of safety determinations and safety evaluations, which support the 10 CFR 50.59 process, was reviewed from the technical functions, site services, and Oyster Creek divisions. The safety determinations and safety evaluations covered such activities as procedure changes, plant design changes, temporary modifications, and work control. The
'
documentation was generally of high quality. Those activities which were safety-significant received substantial attention from the standpoint of 10 CFR 50.59, and relevant safety issues were addressed. less safety-significant activities often had marginal documentation of the review content. A significant fraction of the marginal documentation contained within the
,
review sample involved the work control process implemented by site services and Oyster Creek divisions via procedure A00-WMS-1291.01. In the case of the work control process, the " Standard Safety Review Process" allows the responsible maintenance or construction supervisor or manager (a certified RTR) to certify with a signature that no safety concerns exist and that applicable requirements (e.g., Technical Specifications) are adequately addressed without further documentation (no formal safety determination). In all cases that were reviewed in the sample, the activity received RTR/ISR review where required and compliance with the relevant requirements of 10 CFR 50.59 was demonstrated. In the case i
of the work control process, no form similar to Exhibit 7 of procedure 1000-ADM-1291.01 for documenting the conduct of a safety determination existed. An issue involving instances I
where ISR review of documents (e.g. LERs and Notices of Violations) was not accomplished is discussed funher in Sections 5.4.2.1 and 5.4.2.4 of this report.
From a performance standpoint, Procedure 1000-ADM-1291.01 and the division-specific implementing procedures, perform well in assuring that activities that could potentially i
impact nuclear safety are subjected to a screening process and a safety review, as needed.
,
The cross-disciplinary RTR/ISR reviews, provided for in 1000-ADM-1291.01, which would be characteristic of more compicx safety reviews provides the necessary safety decision-making process. The plant review group provides the selection of personnel for the conduct i
of cross-disciplinary RTR/ISR reviews. Moreover, the existence of RTR and ISR certified j
personnel in the individual GPUN Divisions broadens the " ownership" of the safety review process. The implementation of the safety review process among the various GPUN divisions, via division-specific procedures, was determined by the team to result in high quality 10 CFR 50.59 determinations. The issue of informal 50.59 safety determination documentation, as it applies to the work control process, is considered by the team to be a weakness.
5.2.4 Functionally Chartered Review Groups 5.2.4.1 Plant Review Group The plant review group (PRG)is comprised of all OC division personnel qualified to be RTRs and ISRs. The OC technical specifications specify the administrative controls associated with the conduct of RTRs and ISRs, however, the PRG is not chanered in the TSs; The OC safety review manager is designated as the PRG chairman and is responsible for fulfilling the OC division safety review coordinator responsibilities assigned by procedure
-
l
'
.
l
,
'
1000-ADM-1291-01, " Safety Review Process". Plant procedure 130, Rev. 6, " Conduct of Technical Review and Safety Review by the Plant Review Group," specifies the administrative controls exercised over the PRG, including the requirement that its chairman
,
shall possess or have possessed a senior reactor operator license for OC. Material submitted
'
for RTR or ISR review is distributed to the proper members by the chairman, who also determines the proper PRG members to be called upon in order to perform a review, and if a group meeting needs to be called in order to perform a review. Cross-disciplinary reviews are assigned by the chairman in the case of a responsible RTR or ISR determining that such a review is needed.
The team observed the conduct of a PRG meeting that reviewed proposed procedure changes,
.
a proposed TS change, an LER, and a potential safety concem. Non-PRG members were in attendance to support the safety reviews conducted by the PRG. The various subjects had good technical representation for their respective RTR or ISR reviews by members of the plant staff and supporting divisions. In-depth probing of the issues was observed. The PRG chairman tailored the PRG members selected to be those that were most knowledgeable, independent, and could provide a collegial aspect to the discussions. Although OC does not
have a plant operations review group, as many NRC licensees have, the PRG chairman articulated the importance that group discussions have in conducting safety reviews on such matters as LERs and proposed changes to TSs. The team concluded that the PRG was effective in conducting TS-required safety reviews, and determined that good review methodology was applied. This performance reflects well on the licensee's safety review philosophy being implemented at the operating staff level.
5.2.4.2 Independent Onsite Safety Review Group The independent onsite safety review group (IOSRG) provides an additional level of safety oversight. The IOSRG reports to and takes direction from the director-independent safety
_
review. The IOSRG, required by TS 6.5.4.2, reviews significant procedures, evaluates t
facility operation and nuclear safety programs, and assesses facility conformance to safety
,
requirements. The IOSRG performs many of the review functions of an independent safety engineering group, which was required by the NRC at facilities licensed following the accident at Three Mile Island, Unit 2. The IOSRG, whose members have no responsibilities in other divisions, consists of the manager, nuclear safety OC and three professional staff.
The qualification requirements for the IOSRG are a bachelor's degree in engineering or appropriate physical science and three years of professional level experience, or eight years of appropriate experience. The team determined that IOSRG members exceeded the required j
experience level. The ombudsman progmm, which is also considered one of the functionally
'
chartered review groups and is discussed is Section 5.2.5 of this report, uses the manager, nuclear safety OC to perform the duties of the ombudsman at OC.
j i
I
.
)
.
The IOSRG meets frequently to discuss plant safety and meets on a monthly basis to discuss industrial safety. The team attended an IOSRG meeting at which the following was
'
discussed: recent deviation reports (emergency lighting and drywell H/0 analyzers),
operations logs, and the plan of the day meeting. The team found the IOSRG meeting to be informative and noted an independent questioning attitude among the members.
.
The IOSRG administers the safety issues assessment program (SIAP) as described in procedure 1110-ADM-1010.03. The SIAP review group, a committee of Yn senior individuals representing the key GPUN Divisions, receives input from IOSRG in the form of
,
a draft catalogue of safety issues which may include new issues. These issues come from a wide range of sources including operational experience at Oyster Creek, NRC concerns (bulletins, generic letters, etc.), industry experience, and GORB action items. The introduction of new safety issues, prioritization, and ranking takes place at the SIAP review group meetings which are held approximately two times per year. While SIAP review is not actually the vehicle for resolution of the subject safety issues, which takes place within the GPUN divisions, it does serve to track the progress toward resolution and to guide priorities and lines ofinquiry for the IOSRG. The SIAP enjoys a good level of management attention.
-
At a March 9,1993, senior GPUN staff meeting, which was attended by the president, The IOSRG manager provided a report on SIAP activities and the results of their assessments.
This presentation is in addition to that given to the general office review board. Additionally, the director, OC provides an assessment of the SIAP process. The team attended a SIAP meeting and observed the conduct of critical and comprehensive self assessments in the manner in which the members judged the effectiveness of issue resolution and the identification of potentially new issues for cataloging. Maintenance department involvement and participation in SIAP is documented in Section 3.11 of this report.
'
The IOSRG communicates the results of its inquiries in several ways. Monthly status reports contain such information as plant status and critiques of operational problems, progress concerning various IOSRG inquiries, industry experience in various areas, and human factors developments including insights developed by use of the human performance enhancement system (HPES) and employee concerns. Technical assessments contained in the report include equipment or performance trends identified by its panicipation in the monthly review of deviation reports (one of the corrective action systems discussed in section 5.4.3) by the plant's safety review group (SRG). The monthly IOSRG reports also provide the status of the most important, " key", SIAP issues.
Another form of IOSRG communication is reports that critique significant operational events.
One example of such a report is Report No. 92-10, dated July 24,1992, which reviewed a May 25,1992, pressure transient which occurred during a control rod diagnostic test. The report, which included a performance evaluation utilizing HPES, noted problems with equipment response, prior procedural review, and work practices. The report also noted the positive contribution of the STA who identified the pressure transient in progress and assisted
'
the operating crew in restoring stable plant conditions. The report presented eight
,
.
.
'
recommendations, including suggested changes to work practices, procedures, and equipment, which were added to the IOSRG recommendation tracking report. The team reviewed the contents of the tracking report and found that the GPUN organizations tasked
.
!
with responding to ISORG recommendations had done so, generally, in a prompt and complete manner. A review of a sample of responses indicated that not all responses showed agreement with IOSRG views, although most responses were positive.
From a performance standpoint the team concluded that the IOSRG is a strength in the Oyster Creek SRP. The IOSRG has the requisite experience and management support to act as an independent advocate for safety. The IOSRG reports are well prepared and insightful, with wide-ranging recommendations that are well supported. Based on evaluation of the seismic issue in section 5.2.2 of this report and the control rod diagnostic test above, the team determined that the GPUN organizations tasked with resolving IOSRG
.
recommendations have been responsive, generally, in schedule and the technical content of their proposed resolution.
5.2.4.3 General Office Review Board The Oyster Creek safety review program utilizes a general office review board (GORB).
The GORB is not required by the TSs. The primary responsibility of the GORB is to independently consider potentially significant nuclear and radiation safety matters, including related management aspects of those matters, and. to advise the president of GPUN corporation. A secondary responsibility is to consider potentially significant industrial safety
'
matters. The Oyster Creek GORB, chaired by the director ofindependent safety review, consists of three GPU employees, five outside members, and an NSSS consultant (a General Electric employee). The GORB members are recommended by the president of GPUN and approved by the board of directors; the chairman is selected by the president of GPUN. The Oyster Creek GORB is divided into the following Committees: QA committee; risk control;
,
radcon, chemistry, industrial safety and environmental; operations, maintenance and i
surveillance; and engineering. Each committee has a chairman (a GORB member), members (need not be GORB members) a charter, and means of reporting. The GORB has scheduled meetings at least quarterly; special meetings are held as needed. The GORB conducts an independent assessment of the implementation of the QA Program for the president, GPUN on an annual basis. The cumulative result of the GORB's reviews provides the basis for this annual assessment and includes assessments of: (1) QA audits; (2) the third-party cooperative management audit program; and, (3) the QA department annual assessment of the QA program implementation. Recommendations, when developed, are made to the office of the president.
The team attended selected portions of a GORB meeting that was held at Oyster Creek on
.
October 13 and 14,1993. The team observed various presentations on October 13: IOSRG, QA, radcon/ industrial safety, environmental overview, and strategy-fuel failures. The GORB toured the Oyster Creek plant following the meeting. On October 14, the team attended the presentations made by selected GORB committees. The team was impressed by the quality j
,
.
.
.
,
of the presentations made to the GORB and the level of the subsequent GORB discussions.
'
The team found the GORB discussions to be probing and very candid. GORB recommendations must be approved by two-thirds of the GORB participants. These recommendations, relatively few in number (nine recommendations and five action items in five years) range from specific hardware considerations to general policy issues. The team
.
found that half of the open items were closed within six months of initiation.
The GORB, like the IOSRG, is a strength within the Oyster Creek SRP. Much of this strength comes from the extensive background of its members (the ten Oyster Creek GORB participants have a cumulative nuclear experience of 322 years) and that six of the
participants are from outside GPUN, thus bringing broader industry experience to the GORB proceedings. The GORB composition explains the self-critical and candid nature of the GORB proceedings. However, the team's review of the most recent GORB Annual assessment of the QA program noted that the assessment contained neither recommendations to the office of the president nor highlighted significant insights or concerns derived from board reviews of QA activity. Their assessment failed to reconcile or even comment on the introspective and critical commentary contained in the annual assessment done by the QA department. Specifically, the QA self-assessment contained an important QA department conclusion that, of fifteen functional areas, seven are being implemented in a manner as to require an increased amount of management attention to address identified areas for improvement.
5.2,4.4 Nuclear Safety and Compliance Committee The nuclear safety and compliance committee (NS&CC or the committee) is a group comprising at least three outside members of the GPUN nuclear board of directors, formed in 1984, to help ensure nuclear and radiation safety at GPUN facilities. The NS&CC became a required GPUN Committee as a result of the TMI-l conditions of operations allowing restatt. The NS&CC monitors GPUN nuclear operations and reports to the board of directors on, at least, a semiannual basis. The subject reports, available to the NRC, are responded to by GPUN management. An onsite staff of one independent contractor and two GPUN employees reports to a staff director located off-site. This working level staff facilitates a daily review of ongoing site activities and is an important conduit of independent information and insights for the committee members. The team reviewed the NS&CC reports dated October 26,1992, (Report No.17) and April 29,1993, (Report No.18) to ascertain the nature of their findings and to determine GPUN's management responsiveness to them.
The reports characterized issues involving maintenance and plant material conditions, human performance deficiencies, radiological controls, and ti e procedure upgrade program. Both positive and weak performance in these areas were highlighted.
,
.
.
The team concluded that the NS&CC demonstrated the ability to identify signincant performance problems at Oyster Creek that were appropriate to be brought to the attention of the board of directors through their own independent means. Over the period covered by Report Nos.17 and 18, the most significant performance problems identified by the committee involved material conditions and human performance deficiencies (poor workmanship and human errors in surveillance and operations). Report No.18 found a significant improvement in material conditions while human performance deficiencies appeared to persist. Management response to the NS&CC concerns was good. Items of, concern that reflect on-site activities are included in the station action item tracking system maintained by the director, OC. The team found that the NS&CC is a valuable self-assessment process and that GPU management is responsive to the committee's findings.
5.2.5 Nuclear Safety Concerns Program (Employee Concerns)
The team reviewed the programs available to employees, including contractors, for addressing nuclear or radiation safety concerns. This review included an examination of the licensee's philosophy and views on promoting the access for employees to express their concerns. Three distinct, but diverse programs were identified by the team that relate to this area, namely: the ombudsman program, the operator concerns program, and potential safety concerns. These programs have different degrees of formality and also different levels of employee familiarization due to the manner in which their use is communicated by the licensee. They were nevertheless found to have proper attributes to effectively address employee concerns.
The team noted that the GPUN philosophy was strongly oriented toward providing access to employees to express their safety concerns through the normal management chain, through line organizations or oversight groups (such as radiation controls or QA/QC), or through the employee concerns programs. The licensee has stated in various documents and training sessions that employees who bring any safety concerns that they have to their attention helps improve nuclear safety, does the company a service, and is consistent with their number one objective of protecting the health and safety of the public, employees and the environment.
The team observed that the philosophy is evident in: (1) the use of postings at the OC site for the employee concerns program that state" If an employee has a concern, it is a concern;"
and (2) technical functions division (TF) procedure 5000-ADM-7370.03 encouraging individuals to appeal, with management support and without fear of retaliation in any form on the part of the individuals involved, review comments for a satisfactory conclusion when professional opinions differ.
OMBUDSMAN PROGRAM This program was developed to provide a confidential mechanism for employees and contractors to identify any nuclear or radiation safety concern they believe is not being i
adequately addressed by the normal management chain. As detailed in GPUN procedures, the ombudsman investigates reported complaints, repons findings and helps resolve the
.
.
l concern. This includes, where possible, communicating with the individual raising the concem results of the investigation and the action taken or planned. The responsibility for implementing the program at OC is delegated to the manager, nuclear safety OC. The team found that the program was both formally controlled, well publicized, and was independent of the line organization. High level management visibility of program use is accomplished by the inclusion of activity in the IOSRG monthly report, which includes distribution to the office of the president.
The NSAD recently completed a corporate wide self-assessment report of the ombudsman program. For OC, seven concerns involving either equipment, human performance, or organizational performance occurred in the period 1991-1993. The origin of the concerns
,
involved one anonymous, one exempt, one bargaining unit, and four contractor employees.
The frequency of concerns has decreased in the last three years. A number of enhancements to the process were identified, including: (1) increasing efforts to ensure that no contractor i
who identifies an issue and then leaves will miss direct feedback on the outcome of an issue;
,
and (2) providing annual formal trending and tracking of program experience. The team concluded that the NSAD conducted an in-depth assessment of the ombudsman program, and it was apparent that the licensee provides an excellent level of commitment and support to this program.
OPERATOR CONCERNS PROGRAM The OC division developed the operator concerns program in 1989 to address SALP and QA audit issues involving concerns raised by operators about poor communications and feedback
,
between operating shifts and operations management. This program is informally administered by the operations support group in the plant's operations department. An operator concern report (OCR) form documents the issue, assigns responsibility for resolution, and documents feedback to the originator of the concern on the actual or proposed
'
resolution. The program has evolved to address concerns originated by individuals other than operators, such as trainees, engineers, mechanics, and technicians. Program tracking
and trending by the operations department indicates that from its inception a total of 1250 concerns were identified and 91% were closed. The team reviewed a number of OCR forms. They demonstrated the diversity in the originating departments and the nature of
,
concerns raised. Resolution of concerns identified by this program have resulted in process and physical plant modifications.
)
A notable example was OCR No. 91114, which resulted in the development of a computerized fuel tracking board implemented during the last refueling outage. The specifics involve a concern by a control room operator regarding the fuel status boards, which were utilized to monitor the fuel movements during refueling operations, that were obstructing the operator's view of control room panels. Documentation in the concern file allowed the team to conclude that the operations support group provided a good level of involvement and communications with the originator, training department staff, and technical function's core engineering personnel in obtaining resolution of the concern. The team concluded that the
. -.. -
-
_ _ _
!
.
.
!
lack of a formal administrative process has not detracted from the viability of this employee concerns program. Furthermore, the program's status was reviewed in May,1993, by the
'
GORB indicating that the program is receiving a good level of independent oversight.
!
POTENTIAL SAFETY CONCERNS A potential safety concern (PSC) is an issue that a GPUN employee or contractor, believes t
could potentially negatively impact nuclear or radiological safety. This program is administered by the licensing and regulatory affairs department of the services division and
'
the process is controlled by procedure 1000-ADM-7330.01, Rev. 6, " Management of i
Potential Safety Concerns". The program was established to identify, resolve, and, if
.
'
appropriate, report PSC evaluation results to the NRC. However, it was not intended that the program would be used in lieu of recognized corrective action programs, such as: quality
deficiency repons, deviation reports, LERs, etc.
The procedure contains instructions that an originator of a PSC, who disagrees with m
evaluations and management determinations as to whether or not a safety concern exists, may use the ombudsman function to resolve their concern. The team noted that PSC activity oversight is provided by line organizations in their receipt and review of the PSC monthly
>
status repon, and an independent review of PSC activity conducted by the GORB. The monthly report contains the status, history, and current schedule for closeout of each l
concern. The September 9,1993, report listed four open PSCs for OC. Quality assurance conducts a review of the use of PSCs during their annual audit of corrective action programs.
Funhermore, the team noted concern by licensee management for program viability in their
development of a SIAP issue (No. OC-043) in December 1986 involving a lack of confidence
'
in the PSC system. Program changes were made in 1988 to address the SIAP issue.
The team reviewed licensee activities associated with two PSCs:
r PSC NO.93-002. Reactor Building Blowout Panel As a result of a design basis document review of the standby gas treatment system, the licensee identified in December 1991 the apparent non-existence of blowout panels in the reactor building. On August 18,1992, technical functions (TF) assigned an action item to verify the existence of the blowout panels that were stated to exist in the updated FSAR.
The PSC was issued by TF on March 1,1993, due to the concern that the plant was
.
'
operating in an unanalyzed condition. This condition involved the original high energy line break (HELB) analysis and environmental qualification pressure and temperature profiles that
had been developed using the assumption that blowout panels existed and would relieve
,
'
building pressure at 0.25 psig.
i l
l l
i
-
i
i Following a determination by the licensee's engineering organization that there was no
physical or design evidence that blowout panels exist, deviation report No.93-297 was issued by systems engineering (SE) on April 14, 1993. An engineering evaluation issued on April 15, 1993, indicated the normal metal siding is expected to fail at 0.95 psig. Further,
,
engineering evaluations identified that the isolation condenser HELB was the limiting
.
'
condition with a 1.37 psig value, which would result in a torus overpressure condition.
,
According to a time line contained in the PSC file, TF's safety analysis and plant control (SAPC) department informed the engineering mechanics (EM) department in the period between May 3-5,1993, about the torus overpressure finding. A conference call on Ma'y 20, 1993, involving representatives of licensing (OC and Corporate) and TF (Mechanical Engineering, EM, SAPC, and SE) discussed the concern that the 1.37 psig value would exceed the external pressure on the torus (1.0 psid design value assuming 0 psig in the torus). On may 28,1993, SAPC issued their official documentation of the external torus
pressure concern, which also specified that two possible solutions were available: (1) operate OC with a minimum internal torus pressure of 0.4 psig; or (2) perform additional structural analysis to demonstrate greater external pressure load capability. The SAPC memorandum recommended that until the structural re-analysis could be performed the torus should be maintained at or above the 0.4 psig internal pressure. The licensee determined on June 2, 1993, that the torus overpressure condition was outside the plant's design basis and made a
!
one-hour report in accordance with 10 CFR 50.72. Additionally, the torus internal pressure was to be procedurally maintained at or above 0.4 psig. Later in the day, the EM
Department determined that the torus could meet ASME Code allowable pressure for a 1.37 psig condition.
!
Recent QA audits reviewing corrective action activities have identified concerns involving
,
TF's use of PSCs. The manner in which these audit findings were dispositioned, and associated team concerns, is detailed in Section 5.3.2 of this report. Additionally, the team was concerned that for this PSC the engineering and licensing organizations did not provide timely resolution of an indeterminate condition and did not perform an immediate operability determination when warranted by the condition. Also, it appeared to the team that an excessive amount of time passed wherein sufficient information was available to have made a reportability determination prior to when it was actually made. The team questioned the appropriateness of using the PSC program to resolve design deficiency issues.
,
PSC No.93-004. Hydroren/ Oxygen Monitoring System Reagent Bottles This PSC was initiated on July 19,1993 by operations QA (OQA) to address a concern identified by a monitoring activity which involved operator tours. Specifically, the reagent gas bottles in the hydrogen / oxygen (H,/OJ system have been routinely found since February 10, 1993, to have pressures less than the values specified on the OC reactor building tour sheets. The monitoring activity, conducted on July 6,1993, was initiated at the request of the equipment operator who was concerned about the neglect of the system's reagent gas bottles even though operators were continually documenting the out-of-specification readings.
Subsequently, after reviewing a related engineering memorandum, OQA raised a question
-
_
.
.
.
about the relationship between the amount of reagent gases and system operability. Shortly before the OQA monitoring activity, a deviation report (DR) to address the out-of-specification readings that were not being corrected, was generated on July 1,1993, by the
'
cognizant SE. The DR required that an evaluation by Plant Engineering Depanment was required by January 2,1994, to address the concern and provide corrective actions, if required. According to the SE, the DR resolution was waiting for the disposition of the
.
PSC.
!
An engineering evaluation performed to address the PSC stated that a reagent gas supply sufficient to support a 50-day post-accident operating period was needed. This engineering evaluation determined the operability requirement was based upon a 48-day environmental qualification requirement plus two days to replace the bottles upon reaching the low pressure limit. A reportability evaluation was made by corporate licensing that concluded the PSC
!
was not reportable. In part, this reflected their view that the 48-day reagent gas supply
!
design parameter / feature is not based upon an evaluation which determined the minimum required post-accident operating duration, but rather represents a conservative bounding time period.
Following the team observation of a PRG meeting that reviewed the reportability disposition of the PSC, and a review of related documentation, the team concluded that the engineering and licensing groups failed to adequately address the concern, in that their efforts did not result in establishing a minimum value for reagent gas bottle pressure that would be used by operators to declare an H/0 monitor inoperable, and therefore cause them to enter the
i appropriate TSs action statement. The team noted that the emergency operating procedures require the initiation of the H/O: system operation soon after the onset of accident
<
conditions, and was concerned that the licensee was unable to specify actual post-accident
!
operability expectations for the installed TS equipment. In response to the team's concerns, the licensee addressed the issue by defining the operationally required post-accident performance of the monitors and related it to TS operability considerations. The team verified that this information was transmitted to operating personnel and applicable station
procedures were in the process of being revised. The team concluded that, although there i
was a good level of licensing and technical effort to address the PSC, the organizations initial evaluations to address an " operability" concern represented a weakness in the area of conducting operability determinations.
5.2.6 Safety Assessment Summary The team noted that the safety review program has extensive staff involvement in all divisions participating in OC activities and the program enjoys a good level of management visibility. However, documentation of responsible technical reviews involving work control processes was found to be lacking. The performance of the IOSRG and the GORB was identified to be a strength. Additionally, the team found that the ombudsman, operator concerns, and potential safety concerns programs represented diverse elements of an effort by the licensee to effectively resolve employee concerns, and in the aggregate is considered a i
.
.
.
.
!
..
licensee strength. The team identified issues involving operability determinations and the use of the potential safety concerns program for resolving design deficiencies.
,
l 5.3 Quality Verification 5.3.1 Operational Quality Assurance
The team reviewed operational QA activities being conducted at OC. These activities, which are the responsibility of the operations QA manager, included the QA monitoring program.
l The monitoring program is used broadly to provide surveillances of activities that occur at the site. The operations QA (OQA) group uses QC inspectors to perform the monitoring function. The team reviewed completed monitoring reports and observed that they contain a very good level of detail about the surveilled activity and demonstrate that the QA personnel are knowledgeable in their assigned area. Where appropriate, findings were generated that used appropriate safety or quality concerns processes.
The team observed that plant departments request the conduct of surveillance activities and that operating personnel freely communicate their concerns about apparent deficiencies tLat they have observed or are concerned about these observations indicate that operational QA programs and personnel are well integrated into the routine operations of site activities. An example that was considered by the team to exemplify this strength was the issue associated with the H /0 monitors reagent gases. This issue was identified by operations QA as a 2 2 potential safety concern and is discussed further in Section 5.2.5 of this report. Additionally,
the OC operations QA manager develops a comprehensive monthly plant assessment report that is sent directly to the operations and maintenance director, which provides a summary of
-
station activities monitored by the operations QA group. Additionally, the team noted that
OQA activities and findings are incorporated into annual QA assessments and monthly QA deficiency trend analysis reports.
.
As discussed above, performance-based QA assessments are being stressed by QA management. The review of monitoring reports indicated that QA personnel are sensitive to
the need to identify the relationship of their findings, or concerns, to safety or programmatic issues. The team concluded that monitoring reports were effective in addressing performance issues.
Strong performance of the OQA group was observed by the team in the manner in which j
they contributed to plant safety and overall site activities by performance of effective self-assessments.
J i
.
.
,
5.3.2 Audit Program A number of recent and past audits were reviewed in the areas of safety review, corrective actions, radwaste management, plant operations,and technical support. Team comments pertaining to auditing activities in the area of maintenance are contained in Section 3.3.
Procedures controlling the activities, organizational interfaces, and communication relative to activities were evaluated.
The team determined that the licensee's current performance in implementing their auditing program was strong. Safety reviews of audits were being accomplished; open audit finding status was being controlled by a tracking system; audit findings were being assessed as part of the quality assurance department's deficiency trend analysis report; procedural controls were good; findings were critical, insightful, and reflected proper technical knowledge of the areas being audited; and appropriate responses to audit findings occurred. Most audits reviewed contained assessments of performance in the areas of corrective actions and QA monitoring activities, and was considered by the team a good approach to obtaining a comprehensive self-assessment. Another notable licensee initiative involves a re-orientation of the auditing program towards a performance-based approach. The team noted a good level of review and support by the GORB for the conduct of performance-based assessments.
The quality assurance department (QAD) has incorporated the GORB input into a guidance memorandum that clarifies QA management % expectations on how to apply performance-based QA.
j The licensee has self-identified an auditing program concern pertaining to the timely issuance of audit reports. Again, the team observed good GORB oversight and an effective
]
implementation of corrective actions established to resolve the deficiency. GORB Action Item No. 86 addressed this issue. Notwithstanding the overall positive assessment that the team made in this area, there were two particular issues that warrant licensee attention. The first issue concerns the practice by the auditing groups of relying on previously identified audit findings to envelope recurrent deficiencies without specifically assessing the status and effectiveness of the prior established corrective actions. The team considers this assessment as being necessary for the QAD to ascertain use of the management escalation program for QA deficiencies, which is controlled by procedure 6100-QAP-7216.01. Although the team did not identify any cases of failure by the audits to escalate repetitive audit findings, this did not diminish the team's concern.
The second issue involves audit deficiencies in the area of corrective action system implementation and the performance of the technical functions division. Specifically, a number of non-conforming conditions are being identified by engineering that warrant the use of CA systems to obtain proper resolution, and this has not always occurred. The team's concerns here are part of the operability /reportability issues documented in Section 5.4.6 of j
this report. The team determined that this issue has received appropriate escalation to higher
.
.
.
4 levels of management within and between divisions. The TF division has established a number of efforts to manage this issue. The team met with senior TF and QA division directors to discuss the issue. The team concluded that licensee management understood the significance of the issue and would aggressively pursue its resolution.
5.3.3 Material Non-Conformance Reports The team reviewed the licensee's use of material nonconformance reports (MNCRs).
Procedure 1000-ADM-7215.01, material nonconformance and receipt deficiency notices controls the issuance and resolution of MNCRs. The licensee uses the MNCR for both material nonconformances as well as potential design deficiency issues. The MNCR appeared to the team to reflect an attempt to control 10CFR50 Appendix B, Criterion XV,
" Nonconforming Materials, Parts, or Components" related concerns. While the establishment by the licensee of processes and program controls dealing with features and characteristics like " indeterminate" and " conditional release" are appropriate for Criterion XV issues, the team was concerned that the far more extensive manner in which the MNCR is currently being employed is inappropriate. A related team concern pertaining to the MNCR not being considered a corrective action system is documented in Section 5.4.1 of this report. Further, team concerns involve the MNCR's conditional release process, which is directly related to operability. The team noted that MNCRs initiated to identify deficiencies on operating plant equipment are required to be evaluated by the operations department within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, however, the licensee has no established time clocks for operability determinations. The use of the indeterminate term, as defined in Section 8.2.3 of the operational QA plan is not consistent with existing NRC guidance on this issue. Section S.4.6 of this report provides further team discussion on this concern.
5.3.4 Quality Assurance Department Activities Audit The cooperative management audit program (CMAP) is a cooperative of up to ten utilities whose purpose is to perform independent audits as requested by member utilities. Annually, each participating utility supplies an audit team leader and team members for two audits per audit received. For example, if a utility receives two audits in a given year, it would supply two team leaders, and four auditors during that year for participation in CMAP audits at other member facilities. An audit team would not normally have more than one team member from a CMAP participant in order to maintain a broad perspective. The CMAP audit scope is determined by the organization being audited. The audit is conducted in accordance with ANSI N45.2.12 with panicipants being qualified in accordance with ANSI N45.2.23. Annually, during the fourth calendar quarter, representatives of the CMAP participating utilities meet to discuss the previous year's audits, suggest any needed changes to the CMAP guidelines, and plan the audits for the upcoming year.
During the period from May 10 to May 21,1993, a CMAP audit was conducted of QA department activities as applied to OC. The audit involved elements of procurement QA, quality control inspection, monitoring and auditing. The results of the CMAP audit were
.
.
.
documented in a letter dated June 14, 1993. With two minor exceptions, the QA program, within the scope of the audit, was found to be implemented effectively. The licensee's QA
'
personnel were also found to be experienced and knowledgeable. The QA department issued one quality deficiency report and om audit finding as a result of the audit. The audit report also contained nine recommendations which are considered to be opportunities for performance and implementation improvements. Although no response to the CMAP audit report was required, the director-QA developed corrective action responses to address the recommendations.
The team considers the licensee's CMAP participation to be a positive activity involving a third-party assessment. The auditing of the licensee's programs by CMAP brings to the process a wide range of outside industry experience, that represents an opportunity to strengthen QA activities. Good follow-up to the audit's findings and recommendations was noted by the team.
5.3.5 Quality Verification Summary Quality. assurance activities identified performance-related insights that contributed to improving the effectiveness of audited and monitored programs. The team determined that
-
the QA program is being used as a management tool to assess and improve licensed activities and plant safety and is considered a strength.
5.4 Corrective Actions I
5.4.1 Program and Processes
In 1989, the QA department initiated an effort to evaluate GPUN's problem identification and corrective action (CA) systems that were in use (to implement 10CFR50, Appendix B, Criterion XVI, " Corrective Action" requirements). The purpose of the evaluation was to identify areas that can and should be standardized to increase efficiency and management awareness of problem identification within GPUN. Thirty-seven CA systems created during 1977-1989 were in existence at the time, as well as forty-two tracking systems utilized by QA during their conduct of routine assurance activities. A CA system task force compared the systems identified to 10CFR50, Appendix B, Criteria XV and XVI, Nonconformances and Corrective Actions, and evaluated the feasibility of combining and reducing the GPUN CA and problem identification systems into one document.
This effort culminated with a memorandum issued by the Director-QA on October 3,1991 j
that stated that corporate level procedure 10000-ADM-7216.01, Rev. O, "GPUN Corrective Action Programs and Processes", has been issued with an effective date of December 31, 1991. This memorandum specified that: (1) the procedure identifies those procedures / programs which comply with 10CFR50, Appendix B requirements for CA programs; (2) the procedure allows the use of other programs to document deficiencies provided significant deficiencies are elevated to a CA program; (3) in order to meet the
_ _ _ _ _
_______ __ - _-__-_ ____________ _ _ ___
_-___
__ - _ _ ____ - -
.
.
requirements of the procedure, each division was to identify any programs that they utilize to document deficiencies and revise them to meet the requirements of the new procedure; and, (4) that these other programs shall conduct trending ofidentified deficiencies with results periodically reponed to management and the documenting of significant adverse trends in one of the CA programs contained in 1000-ADM-7216.01.
.
The stated purpose of procedure 1000-ADM-7216.01 is to define acceptable methods for implementation of 10CFR50, Appendix B, Criterion XVI, "CA" requirement. Further,.the procedure's scope states that it includes all programs used to identify, document, and resolve deficiencies that occur in activities that are within the QA Plan scope. Section 4.2 of the procedure states, in part, that "other programs that exist to document deficiencies are to be subordinate to corrective action programs." The procedure listed the licensee event report program (OC procedure 106.1), deviation reports (OC procedure 104), quality deficiency reports, audit findings, surveillance nonconformance reports for vendor items, and survey (vendor audit) findings as the CA programs to document and resolve significant deficiencies.
The team determined that the licensee's efforts to standardize the CA system was noteworthy. As a result of the team's review of utilization of the MNCR process, as enumerated above in Section 5.3.3, and the licensee's stated CA process, the team identified i
a potential concern that the procedure did not provide an acceptable method for implementation of Criterion XVI. This is principally due to: (1) Criterion XVI requires that CA measures shall be established for both conditions and significant conditions adverse to quality, and within the context of the licensee's processes should include both a deficiency and a significant deficiency; (2) the programs used to identify, document, and resolve deficiencies that occur in activities that are within the QA plan scope are also required to fall within the CA procedures's scope, and does not in the case of the MNCR program; and (3)
the team's understanding of the licensce's view, as developed from personnel interviews.and document reviews, is that only significant deficiencies fall within the domain of Criterion XVI. The issue of the MNCR Program not being considered a 10CFR50, Appendix B, Criterion XVI, "CA", program is considered an unresolved iiem (URI 50-219/93-81-06).
5.4.2 Licensee Event Reports 5.4.2.1 Safety Reviews of Licensee Event Reports
_;
Some licensee activities involving CA systems include the conduct of safety reviews.
Accordingly, the team reviewed the relationship and performance of responsible technical reviews (RTRs) and independent safety reviews (ISRs) as they relate to licensec event reports (LERs). Responsible technical reviews of LERs are performed by the PRG prior to report.
issuance. The team reviewed minutes of the PRG meetings and determined that the responsibilities for technical review of LERs, as contained in the GPUN review and approval
_
.
..
.
.
r
matrix and the TSs were being accomplished. The team attended a meeting of the PRG, which performed a RTR on LER 93-005, and ooserved an in-depth and probing discussion by the PRG and technical specialists presenting the LER issue.
The responsibility for the conduct of ISRs for LERs is assigned to the appropriate departments by the OC licensing department. The team requested documentation from site licensing on the conduct of ISRs for LERs issued in 1992 and 1993. A total of fifteen (15)
LERs were issued in 1992 and four (4) were issued in 1993 prior to the stan of the team inspection. On September 29, subsequent to the team's request, the OC licensing department manager informed the team that ISRs were not performed on some 1992 and IP LERs. It was also determined by the licensee that violations contained in NRC irspettion reports for the,,vo-year time period did not receive ISRs. Technical specification 6.5.2.5.d requires that ISRs be conducted on both violations and reportable events.
.
A deviation report and an incident critique were initiated by the OC licensing department.
The licensee's investigation determined that there were four LERs that were without an ISR and that these were isolated cases. The team review identified a number of concerns with
the licensee's conclusion. Although there were two 1992 LERs (92-010 and 92-011) and two 1993 LERs (93-001 and 93-002) that had never been assigned by licensing to have an ISR r
conducted, there were three 1992 LERs (92-002,92-003, and 92-005) that had assignments
made but the ISRs had not been performed to date. The ISR assignments for LERs92-002 and 92-005 were made approximately 17 months ago and had been reassigned due dates five times, with the last due dates being November 30,1993. On September 28,1993, LER 92-003 (report date May 20,1992) was assigned an ISR due date of March 15, 1994, which if completed on the established schedule would result in a 20-month interval. The team considers that these cases reflect a lack of reasonable timeliness in the completion of ISRs and therefore constitutes a failure to meet the technical specifications requirement.
!
Similarly, as discussed in section 5.4.2.3 below, LERs92-008,92-013, and 92-014 had been waiting 14,9, and 8 months respectively for the LER supplemental submittal. According to the licensee, the ISR would be assigned for performance only after the issuance of the
supplemental LER, no matter how long that might take. The team considers this practice
.
unacceptable. Based upon the time period involved for these LERs, which reflected a lack of
'
reasonable timeliness, the team determined that these were three more examples of failu'e by r
i the licensee to conduct required ISRs. In total, the team identified that the licensee failed to perform ISRs on 10 LERs. The significance of not performing ISRs of LERs is documented in Section 5.4.2.4 of this report.
5.4.2.2 Trending of LERs
The licensee had established in Section 7.1 of procedure 106.1, Rev. 6, Licensee Event Reports that LERs would be analyzed periodically to detect adverse trends. This analysis
was to be based upon severity, number, frequency of occurrence, cause and the timeliness of
!
i
,
.
.
'
i reporting and resolution of the LER. The team was informed by the OC licensing
department manager that it was his department's responsibility to perform the task and it was intended that they perform the trending activity on a yearly basis.
The team determined that no trending was conducted by the licensee for 1992 LERs.
i Although a report titled " Review of 1991 LERs and Violations" was issued on February 7, 1992, it only contained trending information on the number of LERs due to human performance. The team concluded that the trending conducted on human performance LERs was addressing the licensce's plan for excellence, item No. A.1.B.6, which involves minimizing personnel error LERs and requires them to analyze the LERs for cause, and not the trending intended by pmcedure 106.1. Additionally, the team noted the 1992 LER repon required by the plan for enellence did not meet the March 15, 1993 scheduled due date.
5.4.2.3 LER Supplemental Submittal The team determined that the facility has not provided timely updates to licensee event reports (LERs). The team identified three examples where the listed submission dates for
'
supplemental reports were exceeded. LERs92-008,92-013,92-014 had lapsed time from the expected submittal date to present, ranging from 4 to 10 months. In two of the three cases the supplemental submittals have not yet been issued. However, the supplemental
report to LER 92-013 was issued during the later part of this inspection.
The supplemental LERs in the examples above are necessary primarily due to no root cause determination and incomplete corrective actions in the initial LER. The facility acknowledged the concern over timeliness, but stated that their position is that the " expected submission date (15)" block on the LER form is not a regulatory commitment. The facility identified NUREG 1022, Supplement 1, answer to question number 25.8 as a reference for this position.
The team also identified that no LER had been submitted for main steam isolation valve
'
(MSIV) NS03B local leak rate failure prior to the inspection. The licensee stated this failure
,
would be captured in the supplemental report for LER 92-013 identified above. This
,
supplemental LER was issued on October 8,1993, and addressed the apparent cause, safety
[
assessment and corrective actions, as well as the subsequent failure of MSIV NS03B.
The team was concerned again with timeliness since the local leak rate testing failure was
,
identified on December 24,1992 and the testing was a refueling outage activity which ended in the first week of February of 1993.
!
The licensee position in this case is that for subsequent test failures, only the one initial LER
needs to be submitted, provided it is followed by a supplemental report that identifies all
subsequent test failures at the conclusion of the test. The licensee again identified NUREG J
1022, Supplement 1, answer to question number 14.3 to support this position. Further, the
licensee added that there is no firm time limit on LER updates.
i i
E
'
.
'
!
The team concluded that the licensee does not have adequate administrative controls in place
to assure timely issuance of supplemental LERs.
5.4.2.4 Licensee Ev.ent Report Summary
>
The team verified that RTR reviews for LERs were being accomplished well by the plant review group, however a number of concerns in GPUNs implementation of the licensee event reporting system were identified. These concerns involved a lack of timely issuance of'
supplemental LERs where the expected update times had lapsed by 4 to 10 months, failure to perform trending analysis required by procedure or the plan for excellence, and failure to
perform an ISR on LERs as required by the plant's TS. Besides the failure to identify the need to perform an ISR on four LERs; there were three ISRs that were identified as being required for LERS (clapsed time since LER issuance ranged from 17 to 20 months) that have not been performed to date, and three ISRs that had not been assigned because the licensee was waiting for the issuance of the supplemental LERs. The later six cases were considered
<
by the team to represent examples of failure to perform ISRs because they exceeded reasonable timeliness expectations. The team determined that these deficiencies indicate a weakness in the LER corrective action process. Additionally, GPUN identified failure to r
conduct TS-required ISRs for NRC Notices of Violation during 1992 and 1993. Failure to perform the ISRs of LERs and NRC Notices of Violation is a violation of Technical
!
Specifications 6.5.2.5.d (VIO 50-219/93-81-07).
t 5.4.3 Deviation Reports At OC, the deviation report (DR) is a frequently used means to identify deficiencies.
- Procedure 104, " Control of Nonconformances and Corrective Action," provides the administrative controls for the issuance and processing of DR issues. The key features of the DR process include operability and reportability considerations, significance and visibility
.
determinations, evaluations to determine root cause, the identification of actions to remedy
.
the deficiency and those necessary and appropriate to preclude recurrence, a tracking mechanism for assigning corrective actions and response due date, and a trending mechanism p
for identification of repetitive failures or adverse trends.
Coordination and control of DR activity are principally the responsibility of the OC safety j
review group (SRG) engineer, the SRG manager, and the multi-disciplinary review group.
'
The SRG manager and engineer develop the monthly report, with participation by the IOSRG. The site QA manager provides concurrence that CA has been implemented and that
.
the root cause determination is complete for DR deficiencies that were either originally
{
identified by the QA department or determined to address a significant deficiency. The team reviewed a number of activities and documents that were associated with the DR process.
l These included daily and weekly meetings of the multi-disciplinary review group, monthly reports of the safety review group, QA and IOSRG involvement, DR tracking and trending auditing of the program, and DR initiation and closecut.
l l
I l
_
_
-
,
.
%
The team noted that the SRG reviews selected DR categories for potential trends and also specific trends or problems from past SRG meetings. The latter trend evaluation is performed to identify the effectiveness of the corrective action taken to disposition the problem and prevent recurrence. Also, improvements in the DR program, as implemented by the latest revision to procedure 104, occurred as a result of incorporating lessons leamed by the industry in addressing the principal causes of human performance problems that cause plant events, as documented in Significant Operating Experience Report 92-1. The team noted a strong licensee focus on the investigation and determination of human performance related aspects of deficiencies identified by the DR program. A specific example of effective performance was documented by the team in section 4.6. Another process improvement resulted from management's request to initiate trending of the frequency that assigned CA due dates were being revised.
The team found improved effectiveness in the resolution of problems and attributed this'to efforts to clarify the CA processes and the conduct of root cause analyses using the root
'
cause standard. The CA process employing the DR program was considered a strength, in part, because of its low threshold for initiation, the use of the multi-disciplinary review group for assignment of the root cause level, and management attention to the tracking data and
,
monitored trends developed by the safety review group.
5.4.4 Industry Experience Information The scope of this inspection consisted of the licensee's response to randomly-selected NRC Information Notices (ins) and industry informational letters. The team reviewed licensee
,'
actions in response to the following industry experience information:
GE Potential Reportable Condition (PRC) 92-04, dated October 30,1992, Safety Related Residual Heat Removal Fan Failure at a BWR/4 Plant
,
NRC Information Notice 93-65, dated August 13,1993, " Reactor Trips Caused By Breaker Testing With Fault Protection Bypassed" NRC Information Notice 91-27, dated April 10,1991, " Incorrect Rotation of
-
Positive Displacement Pumps" NRC Information Notice 93-61, dated August 9,1993, " Excessive Reactor Coolant leakage Following a Seal Failure in a Reactor Coolant Pump or Reactor Recirculation Pump"
,
IE Information Notice 84-20, dated March 21,1984, " Service Life of Relays in Safety-Related Systems"
,
NRC Information Notice 9244, dated January 6,1992, " Potter & Brumfield Model
MDR Rotary Relay Failures"
.
.
The team noted that a technical functions assigned action item (TFAAI) request was issued for action on GE PRC 92-04 on April 21,1993. Plant engineering evaluated the safety-related pumps at Oyster Creek and concluded that none were affected by the GE PRC notice.
However, the team noted that engineering recommended to the maintenance assessment department to review preventive maintenance to assure that the requirements to perform a i
thorough visual inspection are incorporated into documents during the next biennial review or revision. The target completion was scheduled for June 1,1995. Additionally, the GE PRC
,
'
92-04 was required reading for plant maintenance personnel. The team verified that Oyster Creek motor model numbers did not correspond to GE PRC 92-04 motors and that actions planned by the licensee appeared appropriate.
l The team's evaluation of the licensee's response and actions to IN 93-65, IN 91-27,and IN
t 93-61 were appropriate and well documented. Licensee actions in response to NRC IN 93-61 resulted in a procedural revision to 2400-SMM-3226.03 to include methods of
,
depressurizing the seal following a hydrostatic test. Additionally, the licensee upgraded the
reactor recirculation pump mechanical seals and mock-up training for seal replacement. The j
team toured the reador recirculation seal mock-up facility and discussed the continuing
training program with maintenance assessment personnel.
'
The team concluded that an insufficient and untimely review was conducted of NRC IN 84-20, that resulted in potential operability issues from Agastat relays installed in safety-related '
applications. Specifically, NRC IN 84-20 informed the industry of potentially significant problems pertaining to the service life of relays in safety-related systems. Testing performed by General Ecctric (GE) and Amerace (vendor of Agastat) determined that relay failures were end-of-service-life failures resulting from aging of continuously energized relays in
combination with mechanical configuration and tolerance of the internal parts specific to the
!
Agastat GP series relays. The qualified service life, on the basis of GE test data, for all Agastat GP series relays that are operated in a continuously energized state is stated to be 4.5 i
'
years. The service life for all Agastat GP series relays operated in the de-energized state is 10 years as stated by Amerace.
Licensee initial actions in 1984 under licensing action item (LAI) 84044.01 were consistent
,
with the expectations of NRC IN 84-20. In late 1992, the licensee was in the process of upgrading the relay replacement program. As put of the program, the licensee identified forty-nine safety-related Agastat relays needing replacement during the Cycle 15 refueling outage. The replacement was based on either exceeding the energized lifetime, or the lifetime of the Agastat relay was unknown.
The team noted that system engineering performed engineering evaluations'in August and i
September,1993, for 6e emergency condenser control relays, stand-by gas system, and the core spray / reactor building closed cooling system drywellisolation relays. The engineering evaluations noted the number of relays in the system, date replaced, and the safety function
,
I
- -,
.
,
,
,
i b
l of specific relays. The evaluations also assessed the failure of the relays and the potential to
,
seriously jeopardize the logic operation of the system. The engineering evaluations did not consider a corrective action process for resolution at the time of the inspection, but, subsequently, the licensee issued a deviation report to address the relay failures.
-
i The team evaluated four normally energized Agastat relays, the purpose of the relay, periodic testing of the relays to verify acceptable operation, and the consequence of failure of the relays. The team concluded that, of the four selected relays, the failures would be self-
,
disclosing to control room operators. However, the team recognized that in some cases the specific relay failures may not be self-disclosing (i.e. control room alarm), but rather remain undetected until the next scheduled surveillance.
The team concluded that control of relay operability, and system operability, as a result of the licensee's failure to maintain s :ndor service life for safety-related Agastat model GP relays, is an industry experience assessment weakness. Additionally, NRC Generic Letter 83-28 requests licensees to maimain a program that includes specifications on the quahfication testing for expected safety service conditions to support the limits of life recon..nended by the supplier of corr.ponents in safety-related systems. Preventive maintenance programs should recognize the application-dependent (energized /de-energized)
service life of these relays and service life of relays supplied by other manufacturers.
The team's assessment of the organizational response to IN 92-04 is discussed in the section below. Notwithstanding the concerns identified by the team in this area, the licensee has self-identified the need for an improvement program. Using team power methodology, an
'
operational experience program improvement team initiative has been actively pursuing this issue. The initiative includes the participation of the IOSRG, and has the sponsorship of senior managers. Eleven utilities' operating experience programs are being assessed, including staffing requirements, by the team power initiative.
Additionally, management of NRC generated operating experience information and the
<
coordination of industry experience information wiWin GPUN were recently the subject of a review by the GORB's risk control committee. The 90RB indicated that follow-up action was warranted.
5.4.5 Relays
,
While reviewing the licensees responsiveness to failure trending data and various team selected omponent failures, the team identified a number of concerns. First, the team deterriaul that the facility dNa not have a formally documented relay replacement program.
,
The licensee noted that, in th past, batch relay change outs had been performed, but could
'
not specify the basis or j Mification for the relay replacements. Additionally, in many cases i
service life history of specific relays was indeterminate. Further, the team determined that some installed relays identified in several information notices have either exceeded the
'
manufacturers recommended life or are known to le defective. The licensee had not
_
e e
performed an operability determination for these known problems. However, the relays identified as having exceeded the manufacturers recommended service life were scheduled for replacement in the 15R refueling outage. Second, the team observed that, when relay failures were occurring that reflected similar experiences that had been identified by published industry experience information, the engineering organization did not aggressively pursue the resolution of the issue, and both the operating and engineering organizations did not pursue what should have been an apparent need to perform operability determinations.
The licensee performed a subsequent operability determination for all identified relay problems and none of the deficiencies resulted in the inoperability of any component.
AGASTAT GP TYPE RELAY
'
One case was identified in which an Agastat GP type relay was recommended for inclusion in the relay replacement program per memorandum 24604192-0161, dated October 27, 1992. This corrective action was the maintenance assessment group's response to a high rate of circuit breaker failures identified by failure trending in the second quarter of 1992.
i Additionally, the team identified in review of deviation report 91-560 a previous failure of the same relay, vvhich provides automatic start sequence timing for the control rod drive (CRD) pump. This deviation report identifies the final root cause as, in part, "no procedure or maintenance which would maintain the item in specification." The team could not identify any specific action taken to address either sewice life or periodic inspection of this relay at the time of the inspection, which is more than two years from the initial failure identification. Further, it does not appear that the senice life concerns with this relay will be addressed in the near future, since, generically, no program is in place to address this issue. Responsible licensee representatives stated they are in the process of developing a program to address service life of relays, including documentation to support the basis for each relay being included in the program. However, the licensee also noted that Agastat model (GP) and CR120 type relays would be addressed first, based on the information notice
and observed failure rates.
The team concluded that the licensee has not applied the necessary resources or oversight to
!
ensure that relay service life is appropriately addressed. Further, in the case of the CRD j
sequence timing relay, the licensee missed several opportunities to implement corrective action to ensure continued system reliability.
j POTTER AND BRUMFIELD MODEL MDR ROTARY RELAY -
A number of failures associated with Potter and Brumfield (P&B) Model MDR relays occurred during the 14R refueling outage. These failures were documented in DR No.s93-029,-l13,-110,-122, and -211, and reflected intermittent relay operation. NRC IN 92-04, dated January 6,1992, P&B Model MDR Rotary Relay Failures," describes similar relay failures involving intermittent continuity of electrical contacts. In addition, IN 92-04 describes a failure of normally energized relays due to mechanical binding caused by coil I
vamish outgassing.
l l
l
i i
'
~
-
- The failures at OC principally involved Appendix "R" remote shutdown equipment, which had been tested for the first time in seven years. Because of these failures, the SIAP opened
a safety issue catalog item (OC-121) in February,1993. The SIAP catalog comments included: (1) TF will soon issue a draft report to address this relay problem; (2)
approximately 80 relays are involved at OC; (3) it may take up to 30 weeks to qualify
,i replacement relays; and, (4) recommendations on continued use of existing relays, testing requirements, and qualified replacements will be made by TF.
Regarding the licensee's response to IN 92-04, the team noted that LAI 92014.03 was issued to plant engineering on February 12, 1992. Following a determination that the subject relay failures appear to be applicable to OC, the evaluation and disposition was assigned to TF with a due date of December 30,1992. However, the due date was revised four times for
completion of the item, with the last being October 30,1993. The deviation report listing specifies that DR 93-211 will remain open pending the resolution of LAI 92014.03, with a due date for resolving DR corrective actions of October 15,1993. At the SIAP meeting attended by the team, a renewed interest in this item was observed. This interest included potential operability concerns, which was shared by the team.
Technical functions memorandums 5350-93-123 and 5350-93-180, issued on July 23,1993,
!
and SeptemMr 23,1993, respectively, provided a draft of the p&B MDR relay replacement plan and an analysis for providing resolution to the relay failure problem. A table was
.
'
provided that listed 86 relays that were installed at OC, with the vast majority stipulated as being used in Class IE safety-related circuits. It appeared that many important safety functions were involved with the circuits that had the P&B relays installed. With the
exception of providing recommendations for continued use of the relays, the team determined that the TF efforts were responsive to the SIAP commentary. Accordingly, the team requested the licensee to establish operability justification of the installed relays. The team
,
concluded that the licensee demonstrated weaknesses in identifying the need to escalate the resolution of equipment issues occurring at Oyster Creek, which also had extensive industry experience information that demonstrated a lack of reliability for the subject equipment, and laxness in addressing and documenting operability justifications.
'
5.4.6 Operability and Degraded Conditions The NRC diagnostic evaluation team (DET) inspection identified that there was no systematic
,
means to ensure that, when deficient conditions were identified, timely evaluation of
operability or functional capability of affected equipment would be performed to determine
how soon corrective action would be necessary. The OSTI team identified that the operability determination process used by the plant and corporatc divisions was generally an
informal approach. Determining operability was not observed by the team to be a continuous
,
'
and ongoing decision-making process. The team was unable to identify any systematic use of NRC generic letter (GL) 91-18, "Information to Licensees Regarding Two NRC Inspection
,
Manual Sections on Resolution Of Degraded and Nonconforming Conditions and
Operability." In fact, the team identified a concern that the licensee's views on
{
i
a
.
.
.
i v.
indeterminate conditions and their resolution by the corrective action systems, which evolved out of Section 8.2.3 of the QA Plan, is in complete opposition to the NRC position stated in the GL. An indeterminate state of operability is not considered a recognized state by the NRC.
l A number of observations were made that suggests that the role of engineering in providing input into the operability decision making process needs to be clarified. This latter concern is related, in part, to engineering activities that identify degraded and non-conforming conditions (including potential design deficiencies identified during design basis reconstitution efforts) that warrant use of corrective action systems. The failure to identify and document the engineering basis for operability of an isolation condenser valve being electrically backseated, Agastat and P&B relay malfunctions and associated generic issues, the design deficiency involving the reactor building blowout panel, and the H /0 monitoring system's 2 2
. reagent bottles, provide evidence of an inadequate operability determination / documentation process. The team concluded that a significant weakness still exists in the operability and reportability determination process. The corrective actions implemented by GPUN to address the NRC DET finding in this area were determined to be inadequate because deficiencies recurred.
6.0 EXIT MEETLNG On October 30,1993, the director, division of reactor projects, the team manager and team leader of the OSTI, and other NRC staff members met with you and your managers and staff from Oyster Creek to review the results of the inspection. This OSTI exit meeting was open for public observation. Representatives from the State of New Jersey and members of the public attended.
.
l
.