IR 05000245/1989018

Insp Repts 50-245/89-18,50-336/89-18 & 50-423/89-15 on 890807-11.No Violations Noted.Major Areas Inspected:Util Compliance W/Atws Rule (10CFR50.62) & QA Annual Review, Including Procurement Program & Matl Receipt & Storage

ML20247L042
Person / Time
Site:	Millstone
Issue date:	09/13/1989
From:	Blumberg N, Dev M, Oliveria W NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20247L036	List: IR 05000245/1989018 ML20247L032
References
50-245-89-18, 50-336-89-18, 50-423-89-15, NUDOCS 8909220100
Download: ML20247L042 (20)

Text

{{#Wiki_filter:_-_ __ _ _ _ . - t

  .
       *
 .
  ,
  .~

U.S. NUCLEAR REGULATORY COMMISSION

REGION I

Report No /89-18 50-336/89-18 50-423/89-15 Docket No License No DRP-21 DRP-65 DRP-49 Licensee: Northeast Nuclear Energy Company P. O. Box 270 Hartford, Connecticut Facility Name: Millstone Units 1, 2, and 3 Inspection At: Waterford, Connecticut

,

Inspection Conducted: August 7-11. 1989 Inspectors: wwM I // W. Oliveira, Reactor Engineer, OPS, 08, /D'aie DRS, Regd nI Yh -

     -b L M. Dev, ReactorjjEngineer, OPS, OB,
       /h D6Ye'

DRS, Region I V Approved by:  % NYi N. J. Blumberb, Chief, Operational Programs Date Section, Operations Branch, DRS, RI Inspection Summary: Routine unannounced inspection on August 7-11, 1989 (Combined Inspection Report Nos. 50-245/89-18,50-336/89-18,50-423/89-15).

Areas Inspected: Review of the licensee's compliance to the Anticipated Tran-sient Without Scram (ATWS) Ru'.e (10 CFR 50.62), and the Quality Assurance Annual Review (Procurement Program; Receipt, Storage, and Handling of Equipment and Materials Program; and Document Control Program).

j{j O

   {[[[[ !$ 5
     ~

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - . _ _ - . -

        .j

__ _ _ _ - _ _ - _ _ - _ - - _ _ _ _ - _ _ _ _ - _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ __ _ - _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ - - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ -

 ..
,
  .
.'

,, 2

Results: . Millstone Nuclear Power Station, Unit Nos. 1, 2, and 3,.are in compliance with the ATWS Rule (10 CFR 50.62). Verification of the systems-approved in the respective safety evaluation reports show that engineering (design), procurement, installation, testing,' training, operations, and maintenance of. systems were performed in accordance with approved procedures

'

by trained and qualified personne Quality assurance review of the three selected programs indicate.that the-programs are formally written, implemented and documented by trained and quali-fied personnel. Management, however, has not until recently, been responsive to QA audit findings as evidenced in their response to the audit on Purchasing (paragraph 4.2).

l i

-        _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _    ________.__

    - . -- --  -- . __

!

+% -    #
.
:

Details 1.0 Persons Contacted

  *E. Abolafia, Staff Engineer, Unit 1 R. Armour, Senior Control Operator, Unit 3
  *R. Asafaylo, Quality Services Supervisor D. Ashinghurst, Senior Control Operator, Unit 3 T. Cleery, Instrument and Control Engineer, Unit 3
  *C. Clements, Superintendent, Unit 3 G. Closius, Quality Services Department Supervisor J. Coleman, Procurement Inspection Services Supervisor
  *K. Deslanders, Staff Engineer, Unit 2
  *F. DiCarlo, Quality Assessment Engineer
  *R. Enkeboll, NUMARC Representative
  *K. Jensen, Assistant Reactor Engineer, Unit 3 R. Joshi, Licensing Engineer
  *J. LaWare, Quality Assessment Engineer C. Libby,' Quality Assessment Supervisor D. McDaniel, Assistant Engineering Supervisor, Unit 3
  *E. McNatt, Material Control Gro*>p Engineer, Unit 2
  *R. Palmieri, Operations Supervisor, Unit 1
  *S. Scace, Station. Superintendent J. Scheeler, Reactor Engineer, Unit 2
  * Sforza, Quality Services Department Engineer
  'W. Vogel, Engineering Supervisor, Unit 1
  *W. Varney, Plant Quality Services Manager United States Nuclear Regulatory Commission W. Raymond, Senior Resident Inspector
  * Denotes those attending the exit meetin The inspectors also contacted other administrative and technical personnel during the inspectio .0 Licensee's Actions on Previous NRC Concerns 2.1 (Update) Unresolved Item (50-245/89-08-0I):  Inadequate procedures and training for control of degradable material shelf lif The licensee actions to improve the control of degradable material shelf life were observed during the initial inspection. These actions included: identifying degradable items and assemblies as well as non stock items for disposition; revising the affected procedures; initiating additional training for stock handlers and maintenance personnel; and establishing a new material control grou _ _ -__-.___- -_ __-___-_________ . -____ _- _ .

r___-__ _ _ _ _ _

-
. .
'

The disposition of the degradable material is recognized as a continuing task. The-affected procedures have been revised and address the necessary controls for degradable material. They will be submitted to the Station Operations Review Committee (SORC) for approval _in late August 1989. The procedures are STP 1705, Shelf Life Program; ACP-QA-4.02, Preparation and Revision of Purchase Requisitions; and ACP-QA-4.06, Degradable Material Control Progra The additional training is scheduled to.be completed in October 1989 and will include the changes to the revised procedures. This item remains open pending the implementation of the revised procedures, completion of the additional training, and the establishment of the new material control grou .0 Millstone Nuclear Power Station ATWS Rule Implementation (10 CFR'50.62)

 (IP 25020)

3.1 Background Or. July 26, 1984, the Code of Federal Regulations (CFR) was amended to include Section 10 CFR 50.62, Requirements for Reducti)n of Risk from ATWS Event far Light-Water-Cooled Nuclear Power Plants. ATWS is an expected operational transient (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) which is accompanied by a failure of the reactor trip system (RTS) to shutdown the reacto In accordance with the ATWS Rule different sets of conditions and requirements were assigned to Millstone Units 1, 2 and 3 to prevent or mitigate the consequences of an ATWS event depending on-the plant type and previous plant modifications which are discussed in the paragraphs that follow The systems and equipment required by 10 CFR 50.62 are not designated as safety-related. However, the equipment is part of the broader class of structures, systems, and components important to safety defined in 10 CFR 50, Appendix A, General Design Criteria (GDC).

Accordingly, they are designed, fabricated, erected and tested to quality standards commensurate with the importance of the safety functions they perform. In addition, NRC Generic Letter (GL) 85-06, Quality Assurance Guidance for ATWS Equipment that is not Safety-related details quality assurance requirements applicable to such equipmen .2 Scope The scope of this inspection was to ascertain if the licensee has adequately implemented ATWS Rule at Millstone (MP) Units 1, 2, and 3, and to verify the effectiveness of the QA control applied to ATWS related design changes and plant modification _ - - _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ _ . _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - - _ -

_ _ - _ _ _ _ _ _ - _ _ - _ - 1 .

 ,
 ,
:
      ,

3.3 Millstone Nuclear Power Station, Unit No. 1 (MP1) 3. Introduction Paragraph (c) of 10 CFR 50.62 specifies the ATWS mitigating system requirements for bolling water reactors (BWRs). .Each BWR must have an alternate rod injection (ARI) system that is diverse (from the reactor trip system) from sensor output to final actuation device. Each BWR must also have a standb liquid control system (SLCS) and equipment to trip the reactor coolant recirculating pumps (RPT) automatically under conditions indicative of.an ATWS. The ARI, SLCS, and the RPT must perform

  ' their functions in a reliable manne MP1 has a Standby Liquid Control System (SLCS) that'was part of the original design and construction of MPI. The Alternate Rod Injection and the Recirculation Pump. Trip Systems (ARI/RPT) were installed in compliance with the ATWS Rule. A safety evaluation by NRC of the licensee's submittals for complying with the ATWS Rule was issued on July 30, 1987 for the SLCS, and October 6, 1989, for the ARI/RPT. Th2 evaluations concluded that MP-1 was in compliance with the ATWS Rula with the provision that the documented test results for the ARI System Function Time be verified during a post implementation review by the NRC. Refer-ences and documentation reviewed during this inspection are listed in Attachment .3.2 Standby Liquid Control System (SLCS)

3.3.2.1 Description The standby liquid control system provides an independent, emergency reactivity control system capable of bringing the reactor to a shutdown condition at any time during core life independent of the control rod system capabilities and maintaining it shut down with sufficient added negative reactivity margin to ensure against all longer-term reactivity uncertaintie The system, is comprised of a storage tank containing a neutron absorbing boron solution, two pumping and accumu-lator systems in parallel, two explosive valves in parallel, a test tank and its associated recirculation piping network. The liquid flow path to the reactor vessel is through a single lin Injection of absorber solution is an off-normal or emerg-ency operation. Injection is used only under specific conditions and or when required by emergency operating procedures. Once initiated, injection continues until all

.
.. _ _ _ _ _ _ _  ___ ________ _ _ _ ____--___________ _______ _ ___ _

      - _ _ _ _ - _ _ _ - _ _ _ - - _
.
'4
.
#

available absorber solution has been transferred, or until adequate shutdown margin using control rods.is ensure .3.2.2 Review for Compliance to the ATWS Rule On July 30, 1987, the NRC issued Amendment 5 to the Technical Specifications (TS). Amendment 5 reflected the

      ~

licensee's plan to enrich the boron in the SLCS to a minimum of 50 atom percent Boron-10.to satisfy the ATWS Rule. The SLCS has been operating satisfactorily as evidenced by reviewing the following:

 -
  -A September 1986 calculation for the amount of sodium pentaborate for cold shutdown, A recommendation.to increase the minimum flow from 32 gpm to 40 gpm was included in a TS change in Amendment Four monthly and five operating cycle TS surveillance by Operations personne Tweive monthly surveillance, and two 18 month surveillance by chemists. The 18 month samples are sent to an approved vendor laboratory for analysi System verification in the Control Room with operators, a staff engineer, and an equipment operator (EO) for equipment verificatio Training provided to Operations personnel such as lessons ID No. 304 and MPI-NLCT-304. Training schedules and attendance sheets were also reviewe Review indicates that SLCS activities were performed and documented in accordance with approved procedures by trained and qualified personne .3.3 ARI/RpT System i

3.3.3.1 System Description The plant has installed the ARI/RPT system which is composed of two independent divisions. The trip logic is one-out-of-two taken twice; that is, any two higher reactor pressure or low reactor water level or a combination of cne high reactor pressure and one low reactor water level j indications in channel A and C or B and D will initiate a recirculation pump trip and alternate rod injectio The system can be manually initiated, l L____ _ _ _ _ _ _ _ _- - -- - -------- - - - - - - - _ - _ - - - - - - - - - - - _-- 9

_ - - _ - _ - _ _ _ _ . .. ____-_ __ ___ _ - .

r

  '
.
   ,
   .
 . n       ;
*

7 The ARI/RPT logic trip systems can be tested while the plant is operating. The test checks.the system operation from the sensor output L through the logic to the final .

q actuation devices. The:ARi/RPT sensors, logic, actuated devices and the circuits are separated from the RTS, and environmentally qualified to the anticipated operational occurrence condition The ARI function can be reset by the ARI reset switches after a 30 second. time delay to ensure'that the ARI scram goes to completion. The RPT function can be reset by the RPT reset switches, provided the permissive signal is presen .3.3.2 Review for Compliance to the ATWS Rule The inspector reviewed the design, procurement, installa-tion, and operational documentation, and verified that the ARI/RPT System was in compliance with the ATWS Rul Documentation reviewed included:

    --

Special procedure 81-1-11, CRD Scram Air Header Tes This procedure provided the tests results requested in the safety evaluation report (SER)-for post implemen-tation review by NR Three annual and 13 quarterly surveillance. Also reviewed was a cold shutdown surveillance. The licensee is awaiting NRC guidance for incorporating the surveillance requirements into the Technical Specifications (TS). Pending review of the adequacy and effectiveness of the implementation of the NRC guidance for TS ARI/RPT surveillance requirements, this issue is considered an unresolved item (50-245/89-18-01).

-- Nineteen Production Maintenance Management System Work Orders (W0s) including preventive and corrective maintenances as well as surveillance and QC coverag Selected material procurement and receipt documenta-tion such as Purchase Order (PO) 815536 for the procurement of two cabinets to house the two divisions of the ARI/RPT System (see paragraph 4.2).

-- Installation drawings such as 25202-29139 to verify installation, separation, independence, diversity, and testabilit _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

__ ._ ,

*
, .
 -

           '
.-

g u

      -

Plant Design Change Record (PDCR) 1-71-80, ATWS Installation. .The PDCR noted that the~ licensee used the "Monticello" design that was approved by NR Training for Operations personnel such as. lesson ID N , MPI-LOR-8911s through 15s, and LORT-89 cyclic training. Training for the Instrument and Control (I&C) personnel were also reviewed such as lesson ID No. 1408, MPI-1981, 86-548, and M1-TT-ICCT-RXTRIP-T0301 The following equipment was verified to be configured and installed in accordance with the UFSAR, PDCR 1-71-80, drawings and procedures:

      -
       ' Pressure transmitters PT-165A-D and lever transmitter LT-266A-D. These transmitters were installed in the Rack 2205 room to ensure environmental and seismic qualification Solenoid operated valves S0V-302-19A & B (DC Back Up)

and SOV-302-20A & B (Scram Discharge, Vent and Drain).

- ATWS/RPT Division Cabinets CRP-980-1 and 2 in the Control Room. Components verified.were: 125VDC to 125VAC inverters, analog meters, manual test panel, sensor power supplies, bistable trip modules, logic / relay drivers, and 15VDC supply (test) and power supplies. These cabinets are physically separated from each other as well as from the Reactor Protection System pane ATWS manual trips and reset and SLC switches on the Control Room panel 905. During the walk down, the operators and the staff engineer explained that the ARI manual initiation " seals in" (completes its cycle) in 30 seconds to ensure a complete CRD scra They also explained that a recirculating pump interlock prevents accident restart of the recirculating pump after RPT. An additional RPT operational safeguard is the fact that it takes two minutes to reposition the recirculating pump's suction and discharge valves after a RP The review indicated that the activities are performed by trained and qualified personnel and are adequately documente _ _ _ _ _ _ - _ _ - _ _ - _ - _ _ _ _ _ _ _ - _ - _ - _ _ - - - _ _ - _ _ - _ _

_ _ - _ _ _ _ _ _ -

 *
,
 ,
  .
       -
-.

E 9 3.4 Millstone Nuclear Power Station Unit 2 (MP2) 3. Review Criteria; The ATWS Rule, as' applicable to Millstone Unit 2, required installation of diverse scram system (DSS), diverse circuitry to initiate turbine trip (DTT), and diverse circuitry for initia-

,
  . tion of auxiliary feedwater (DAFW). This equipment and systems are diverse from the existing RTS ar.d are capable of preventing _or mitigating the consequences of an ATWS even The failure mechanism of' concern is a common mode failure (CMF)

of identical components within the RTS (e.g. logic circuits, actuation devices, and instrument channel components excluding sensors) that could result in an ATWS leading to unacceptable plant condition .4.2 ATWS Rule Implementation Review and Findings The licensee installed a diverse scram system and an ATWS mitigating' system actuating circuitry (AMSAC) during the 1989 refueling outage. Millstone Unit 2 is a Combustion Engineering (CE) pressurized water reactor. Combustion Engineering has performed an analysis of selected transients which provide sufficient characterization of the CE_NSSS design to ATWS events. -Accordingly, the worst case consequences of a failure to scram is overpressurization of the reactor coolant system exceeding emergency safety limit (3200 psia) due to loss of feedwater. The inspector reviewed licensee's documentation pertaining to the implementation of the ATWS Rule. The plant design change record (PDCR) 2-027-87, ATWS (listed in Attachment-A) provides QA scope of the ATWS related plant modifications. The inspector also discussed Millstone Unit 2 ATWS modifications with cognizant licensee's personnel, and interviewed operations staff to verify licensee compliance to the ATWS Rule. Following observations and examinations were made:

  -

Four pressurizer channels, each containing logic for high pressure trip, feed the diverse scram (DS) matrix located on panel C100. Two nuclear instrument channels, which indicate reactor power level, are interlocked in the auxi-11ary feedwater (AF) initiation facilities 21 and Z2 to ll provide a redundant AF initiatio The DS matrix combines l four channel trip contacts in a two-out-of-four voting i matrix. In case one of the channel is out of service the voting matrix automatically converts to two-out-of-three voting configuration. The output from the DS matrix directly drives the DS relays 94A/ DSS which provide isola-tion between the DS matrix, the AF initiation facilities L______-_-_______________ -_-

F-s

'
.

L

.
.
'

and the motor generator (M-G) contactors, and ensures a diverse scram in the event of a single relay failure. Both relays provide the closed contacts for the redundant AF initiation and the open contacts to-trip the M-G output contactors.

l - Foxboro SPEC 200 cabinets RC30A, B, C and D, provide for i the mounting of the channel conditioning cards. A signal wired to the SPEC 200 2AP-ALM alarm card is electrically ' scaled to provide high alarm corresponding to 2400 psi The high alarm contact drives four relays on SPEC 200_2AO-12C relay isolator card which provides train isolation and interconnections for use in the DS matri SPEC 200 instrument loop logic contains two neutron monitor-ing channels JI-009 and JI-010. These. channels are isola-ted by the SPEC 200 alarm and relay cards in cabinets RC30A ! and B. The alarm card is scaled to provide a contact r:losure at approximately 20% power and, in turn, causes the control contact on the relay card to open. The relay contact is used for the redundant AF initiation in ATWS - Mitigating System Circuitry (AMSAC).

-

Two contacts from the DS relay 94A/ DSS are used in the AF ' initiation scheme. The first contact parallels the exist- , ing contactor 94A* from the existing AF initiation relay L and functions to start the three minute 25 second timer.

l The second contacts starts a 10 second timer which is used i to conditionally start initiation 10 seconds after receiv-l ' ing a DS signal. The existing AF initiation matrix uses steam generator low level as the control signal. The three minute 25 second time delay allows the operator to deter-mine if the low steam generator level is caused by e loss of of feedwater or main steam line break. The second timer conditionally tests the reactor power leve' In accordance with the CE analysis the reactor power should drip from 100% to less than 5% power within 10 second of shutdown initiatio In case of a diverse scram, the 10 second timer is started when the DS signal is actuated. When the timer expires, the power level, as indicated by the two channels of nuclear instrument (NI) JI-009 and JI-010 are tested. If the power level is below 20%, the reactor power relay contact opens to indicate a successful scra In this case AF is not initiated when the 10 second timer expires; instead, AF is initiated when the three minute 25 second timer expire If the reactor power is above 20%, the reactor power contact remains closed to indicate a failure to scram. In this case, AF is initiated after the 10 second timer expire _ - - _ _ - - . - _ _ _ - _ _ _ _ ._ . - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ . . _ _ _ _ - _ _ - _ _ - _ _ _ _ _ _ _

.

Pw

   .
 .
 *

     -

The DS contacts are in series connected to the existing M-G circuitry through normally closed contacts. .Two contacts from each DS relay are in series connected and run.to both M-G contactor circuits. For. a postulated single failure in a DS relay or its contacts, this control scheme ensures that the redundant DS contact will trip both contactor The'AFWS design at Millstone Unit 2 was upgraded in accord-ance with TMI Action Plan Item II.E.1.1, auxiliary feed-water system evaluation; and III.E.1.2, auxiliary feedwater ' system automatic initiation and flow indication per NUREG-0737, Clarification of TMI~ Action Plan Requirement Accordingly, the Technical Specifications operability and surveillance requirements,. maintenance and operating bypasses, and the indication of bypass conditions provided to the control room operators were in compliance with NUREG-0737 requirements. As such,-the existing AFWS actuation circuitry contained significant diversity from , the RPS circuitry.

l - Both RPS and DSS share four pressurizer sensor channel Each channel output is isolated between output to the RPS and output to the DSS.

l - The DSS is designed to operate in a normal containment environment during anticipated operational occurrence All components that interface with Category IE systems are seismically restrained and designed to ensure against electrical degradation of Category 1E interface equipmen The DSS processing power-supplies are nuclear qualified and operated from vital AC buses. The actuation power supplies I are redundant and operated from vital AC sources, and as such, for a loss of an offsite power, the DSS would remain ' functional. The DSS logic is set up to " energized to actuate" configuration. Failure of both actuation DC power supplies or failure of processing DC power supplies will not cause a DSS activatio The DSS is designed as a four channel system with indivi-dual bypass switch for each channel. The bypass switch permits individual channel testing while the reactor is operating at powe The DSS status and bypass indications are provided in the control room. Trip alarm and bypass are annunciated on the main control boar _ _ _ - - _ _ _ _ _ _ - _ - _ _ _ _ - _ _ _ _ - - _

_ - _ - _ - _ _ - _ _ _ _ _ _ _ _

     -. - _ - . _ _ _ - - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ - _ _ _   _ _ _ _ _ _ _ _ _ _
 ,
.
 .   .

    -
     .The licensee has established and implemented test proce-dures for testing of the ATWS equipment and system. In general, equipment operability and surveillance require-ments provided in the facility's Technical Specifications assure that the equipment would perform its intended safet functions in a reliable manner. As mentioned in the NRC/

NRR Safety Evaluation Report dated December 13, 1988, the NRC is evaluating the licensee's surveillance and testing capability and surveillance requirements for DSS, DTT, and DAFW, including appropriate actions when these operability requirements could be met, to ensure that equipment' installed per ATWS Rule.is maintained in an operable condi-tio Pending verification of the adequacy and effective- - ness of the licensee implementation of NRC guidance for the ATWS equipment operability and surveillance requirements through the facility's Technical Specifications, this issue is considered an unresolved ite (50-336/89-18-01)

    -

The licensee has established ATWS training lessnn plans, upgraded facility's simulator, and conducted training for the plant operations' staf Personnel responsible for supervising and implementing ATWS related modifications are knowledgeable and capable of implementing the pla .5 Millstone Nuclear Power Station Unit 3 (MP3) 3. Review Criteria Paragraph (c)(1) of 10 CFR 50.62 specifies the basic ATWS miti-gation system requirements for Millstone Unit 3 Westinghouse l NSSS type Pressurized Water Reacter design. Accordingly, equip-ment diverse from the RTS is required to initiate the auxiliary feedwater (AFV) system and a turbine trip for A1VS events. The Westinghouse Owners Group (WOG) developed a set of ATWS mitigat-l ing system actuation circuitry ( AMSAC) design, and issued Westinghouse Topical Report WCAP-10858 (listed in Attachment-A) l and its addenda which provided information on the various Westinghouse designs. For a Westinghouse designed Pressurized Water Reactor the limiting transients are determined to be the loss of all normal feedwater flow and the loss of electrical load without the protection system initiated function of reactor trip, turbine trip and start of auxiliary feedwater. These transients result in a substantial increase in primary coolant system pressure due to the loss of secondary heat sink. The acceptance criteria established by the NRC for this event is that the primary coolant system pressure should not exceed the l ASME stress limit of 3200 psig. The Westinghouse analysis supported that by tripping the turbine within 30 seconds and initiating auxiliary feedwater within 60 seconds, there exists i a spare margin to meet the ATWS Rule acceptance criteria without

-  __ _ _ _ _ __--_______-_- _ _ - _ . i
              >

- _ _ _ _ _ _ _ _ _ _ _ .

If .

 '
:s  -
  .
,
*'

13-

   . tripping the rtactor. The tripping of the turbino and initiation of auxiliary feedwater flow by a system which is diverse and independent from the existing reactor protection system known'as AMSA .5.2. ATWS Rule Implementation Review and findings The Millstone Unit 3 AMSAC system is designed to provide the plant with a- non-safety class turbine trip, auxiliary feedwater-actuation, and steam generator blowdown and blowdown sample line isolation in the event of'a loss of normal' feed and an ATWS event. The licensee installed the AMSAC system during the 1989~

refueling outage. The' inspector reviewed licensee documentation pertaining to the implementation of ATWS Rule. The PDCR MP3-99-008, AMSAC System (listed in Attachment-A) provides QA scope for the'ATWS related modifications at Millstone Unit The inspector discussed the AMSAC modifications with cognizant licensee personnel, and interviewed operations staff to verify licensee compliance to the ATWS Dule. Following observations and examinations were made by the inspector:

   -

The AMSAC . logic circuit uses Westinghouse . microprocessor 7300 series which is diverse from the logic circuit of the RPS in the areas of design, equipment, and manufacturin AMSAC detects loss of all feedwater flow on initiation of low-low steam generator water level when the turbine load is above 40% of nominal loa AMSAC consists of two subsystems, an actuation logic system and a test / maintenance system. The actuation logic system provides actuation output to. trip the turbine and start auxiliary feedwater flow, and provides status information to the test / maintenance system. The test / maintenance system provides output to the plant computer and main control room for indicating the status of the actuation , logic system, and performs automatic and semiautomatic test l of the actuation logic system. Two sets of output relays are provided to interface with the redundant train related turbine trip, auxiliary feedwater start circuits and steam l' generator sample and blowdown line isolation circuits.

l - The AMSAC system is powered by a non-Class 1E power supply (3VBA-PNL-SC) which is provided by an uninterruptible power source and backed by a battery (38YS-BAT-5) both of which I are independent of the RPS power suppl The AMSAC design interfaces at its input with the existing Class 1E circuits of the steam generator narrow range water level instrumentation and the turbine impulse chamber pressure instrumentation. At its output, the AMSAC inter-l

  . _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _

.. ,

  *
 .,
  .
  .
  .
  '

faces with the Class IE circuits of the AFW pumps. Connec-tions with the AFW control have been made downstream of the approved Class IE isclation device The AMSAC equipment was procured, installed and tested in accordance with the licensee's QA requirements applicable to non safety-related AMSAC equipment and complies with the guidance of NRC Generic Letter (GL) 85-0 The AMSAC design has provided for permanently installed maintenance and operating bypasses consistent with the human factors consideration for the control room design and ATWS Rule requirements. Continuous indication of bypass status is provided in the control roo The maintenance bypass allows maintenance of the system at power by in-hibiting the operation of AMSAC output relays which block the output signal and, thus, prevent it from reaching the final actuation devices. The operating bypass (C-20) has been incerpcrated to bring the plant up in power during startup and to avoid spurious AMSAC actuations at power below 40% reactor power. Above 40% reactor power, the C-20 automatically arms the AMSAC logics. The C-20 permissive signal originates from existing turbine impulse chamber pressure sensors and is maintained for 260 seconds by a timer upon a turbine trip. The C-20 permissive signal is taken downstream from qualified isolators and thus, do not interfere with the RPS signa The AMSAC equipment is located in the mild environment and designed to function during anticipated operational occurr-ences. The equipment cabinets, aad cable routing and cable trays are restrained to meet the seismic qualification requirement The AMSAC circuitry is physically separated and the cable routing is independent from the RPS circuitry. The AMSAC trains A and B and non-Class IE circuits within the AMSAC cabinets have been installed consistent with industry standards and the licensee's procedures (listed in Attach-ment A).

- The licensee has established and implemented a quarterly surveillance test of the AMSAC system. Procedure to conduct a complete end-tu-end test of the AMSAC system, including the AMSAC output through the final actuation devices during each refueling outage, is currently being reviewed by the station staf In general, equipment operability and surveillance requirements provided in the facility Technical Specifications assure that the equipment would perform its intended safety functions in a reliable _ _ _ _ _ _ - - _ _ _ _ _ _ _ - _ _

_ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ i

'
 .
.
 -

T

'

  . manner. The_ licensee is awaiting the NRC guidance an recommendation as mentioned in the NRC/NRR Safety Evalua-
       ~

tion Report dated July 17, 1989, to-incorporate the AMSAC operability and surveillance requirements in the Technical' Specifications. Pending review of the adequacy and effec-tiveness of the licensee implementation of the NRC guidance for'the AMSAC operability and surveillance requirements through the Millstone Unit 3 Technical Specifications,.this

>

issue is considered an unresolved item (50-423/89-15-01).

- The . training department has conducted a preliminary train-ing sessions for the plant operating personnel on the AMSAC related plant design changes and modifications. A formal' lesson plan and simulator upgrade are underway and expected to be completed by December 1990. The facility FSAR and system drawings. are currently being revised' to reflect ATWS system as-built plant configuration. The inspector did not have any further questions at this tim .6 Conclusions The Millstone Units 1, 2, and 3 ATWS systems are in compliance with the ATWS Rule,10 CFR 50.62, except as stated in paragraphs 3.3.3.2, 3.4.2, and 3.5.2. The ATWS related design changes and plant modifi-cations, including procurement, installation and testing were conducted in accordance with approved procedures by qualified personntl, under the purview of the licensee QA program. The licen-see is awaiting NRC guidance and recommendation to incorporate ATWS equipment operability and surveillance requirements in the facilities Technical Specifications. Effectiveness of its implementation will be verified in future NRC inspection (see paragraphs 3.3.3.2, 3. and 3.5.2).

Millstone Units 1 and 2 have revised and updated ATWS operating procedures, associated plant drawings and FSARs to reflect as-built system configuration. Procedures for routine testing and surveillance of ATWS system have been established and implemented. The Units 1 and 2 simulators were upgraded and lesson plans were developed to provide training to the Units operations staff. The operations staff are adequately trained to implement ATWS action plan The Millstone Unit 3 ATWS operating procedures, associated plant drawings and FSAR are currently being revised and updated. The ATWS lessons plans have not been completed yet, and upgrading of the facility's simulator to reflect the olant's as-built configuration is scheduled for completion by the end of year 1990. However, personnel responsible for supervising and implementing ATWS related activities have been adequately trained and indoctrinated, and are capable of implementing the pla _ _ _ _ _ _ - _ _ - . -_-_

_ _ - _ _ _ _ _ _ _ _ -

  ,    O
     .
   .-

In general, the licensee response to the NRC initiatives for the ATWS Rule implementation is appropriate, and the management involvement in assuring quality of ATWS related plant modifications appears adequat .0 Quality Assurance Program Annual Review (IP35701) 4.1 Scope Three areas were selected to ascertain whether the implementation of the licensee's quality assurance (QA) program was in conformance with the Technical Specifications and regulatory requirements. The areas selected were procurement program; receipt, storage and handling of equipment and materials program; and the document control progra .2 Procurement Program (IP38701) The program is described in the licensee administration procedure ACP-QA-4.02C, Preparation ard Review of Purchase Requisitions. The purchase requisitions (prs) are reviewed and approved by the Procure-mer.t Quality Services personnel in accordance with Quality Services Department procedure QSD-3.01. AWTS procurement discussed in para-graph 3.0 were used to assess the implementation of the licensee's program. The assessment included the following:

      -

Twelve Purchase Orders (P0s), for example PO 815536 for the ATWS cabinets, prepared as safety related procurement. PO 815536 requirements included: environmental and seismic response documentation to IEEE 323-1974 and 344-1975; engineering reports regarding the test reports and qualification test for ATWS Pump Trip System; and certificate of conformance Application of the Approved Suppliers List (ASL). The vendor who supplied the ATWS cabinet in 1983 was removed from the ASL in June 1988. Spares supplied by this vendor were procured prior to June 198 Review of NUSCO Audit 60455, P,urchasing, and Audit A41003, Procurement Quality Services. Further review and discussion with management regarding delays in responding to Audit 60455 was followed. The status of the audit that was conducted in October 1987 and issued in December 1987 is that only five of 20 findings have been closed. Requests for extension date back to January 1988 and the last request asked for extension to August 30, 1989. A Combined Utility Assessment of the licensee conducted in June 1989 also indicated similar problem of the licensee lack of responsiveness to audit findings. The Senior Vice President and the Station Superintendent are currently taking corrective actions. One action was to establish a Material Control Group. The bost recent action was an August 10, 1989 memorandum from the Station Superintendent. The - _ _ _ _ _ _ _ _ - _ - - _ _ _ - _ _ _ - - _ _ - _ _ _ _ - - _ _ _ _ _ _ _ _ _

       -__ _ _______-___ ______ _ _ _
'
.
.
'

subject of the memorandum was " Extension of Response to Audits" which instructed the station management to take immediate and I positive corrective action. This is an unresolved item pending completion of the actions by the station management to correct the untimeliness of responses to audits. (50-245/89-18-02, 50-336/89-18-02, and 50-423/89-15-02).

i The review of the procurement activities indicates that the activities were documented and performed by trained and qualified personne .3 Receipt, Storage, and Handling of Equipment and Materials Program (IP38702) The program is administered by the Stores Supervisor and the QA Supervisor in accordance with administrative procedure ACP-QA-4.04, Instructions for Packaging, Shipping, Receiving, Storage, and Handling. Implementation of the program was assessed by reviewing and/or observing the following:

 -

Thirteen Material Receipt Inspection Reports (MRIRs). Each report contained a completed QC inspection checklis Two nonconformance reports (NCRs). The corrective action response to the NCRs were timely and complet Five Material Issue / Return Forms (MIRFs).

- Storage of material in the warehous Six purchase orders (PO's) were selected that included the location of material in the warehous The documents reviewed were processed in accordance with procedure ACP-QA-4.04 by trained and qualified stores personne .4 Document Control Program (IP39702) The Office Supervisor and the Nuclear Records Supervisor are respons-ible to the Station Service Superintendent for the implementation of the document control program. The procedures for administering the program are ACP-QA-3.03, Document Control, and ACP-QA-10.04, Nuclear Power Plant Records. In assessing the implementation phase of the program, the inspector reviewed and/or observed the following: l

 -

Search by the staff engineer of installation drawings such as ' 25202-29139, sheets 138-14 The drawings are on 35mm cards in the Unit 1 Engineering Department reference library. They were readily retrievable, properly filed and stored, and were , current. A viewer and copier was available and used to view and I make copies of some of the drawing I _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ - - _ _ _ - - . _ - _ - - - - _

__ _- - --__ .- -- _. _ _ _ .

 .    \
. ,-
 .
'.

  -

Search of records in the Nuclear Record Office. Work Orders, MRIRs, MRIFs, P0s, prs, PDCR, and Surveillance records were reviewed. Most of the recceds were stored on 16mm fil Administrative Control Procedures Overall Index. Using this index, the inspector noted that procedure ACP-QA-4.04 in a manual of control'ed administrative procedures had a revision 10 issue. The index indicated the latest revision to be 12. The Station Quality Services Supervisor immediately took corrective action to provide the latest revision 12 of the procedur NUSCO Audit A60485, Document Control. The audit was conducted from December 1987 to March 1988 and the report was issued in April 198 The audit identified one finding and the licensee subsequently implemented corrective action satisfactor Training Department documentation was properly filed, access-ible, and copies were available for NRC revie Activities reviewed and observed were well documented and performed by trained and qualified personne .5 Conclusion Management is involved in ensuvirg that the quality assurance effort is properly implemented ir, the Document Control and Receipt inspec-tion areas. Management however, has not been equally involved in resolving the untimely responses of audits until recently. Continued attention by management is need to correct this proble .0 Unresolved Items Unresolved items are matters about which more information is required in order to ascertain whether they are acceptable items or violation Four unresolved items identified during this inspection are discussed in paragraphs 3.3.3.2, 3.4.2, 3.5.2 and .0 Management Meetings l Licensee management was informed of the scope and purpose of the inspec-l tion at the entrance interview on August 7,1989. The findings of the inspection were discussed with licensee representatives during the course ' of the inspection and presented to licensee management at the August 11, 1989 exit interview (see paragraph 1.0 for attendees).

At no time during the inspection was written material provided to the l licensee by the inspectors. The licensee did not indicate that any proprietary information was involved within the scope of this inspectio ' L---__---___--

- _ . . _ _ - - _ _ _    . _ . _. . - _ _ _ _ _ _ - ______ _ __
     ,

1 y-s l :' I-l . l ATTACHMENT A Requirements 10 CFR 50.62, ATWS Rule Technical-Specifications and Amendment 5 UFSAR-Plant Design Change Records 1-71-80, ATWS Installation NRC Safety Evaluation Reports of July 30, 1987 and October 6, 1989 (MP-1), December 13,1988 (MP-2) and July 17, 1989 (MP-3) IEEE 323-1974, and 344-1975 and 384-1981-SP-EE-076, Standard Specification for Electrical Installation, Rev. 3 Procedures-Special Procedure GI-1-11, CRD Scram Air Header Test Administrative procedures ACP-QA-3.03, 4.02C, 4.04, and 10.04

  : Quality Service Department procedure 3.01 Drawing 25202-29139, RPS Instrument Rack
  ~25202-30027, PNL 905 QA/QC QA Audit Nos. A41003, 60455, A60485
  - Approved Supplier's List (ASL)

Combined Utility Assessment QC Inspection Reports 89-06025, 89-01228'- Miscellaneous Lesson plans ID Nos. 304, 409, 1408, 86-548, MP1-1981, MP-1-NLCT-304, MP1-LOR-8911s through 15s, LORT-89, M1-TT-ICCT-RXTRIP-T03010 Licensee Event Report (LER) 88-009-00 Purchase Orders (P0s) 700387, 718454, 72614, 8G4575, 815536, 909168 Material Receipt Inspection Reports (MRIRs) 1854154 & 203, 187-157, VI-21-79, 804575, 815536 Work Orders / Material Issue / Return Form:,/(W0s/MIRFs) 86-007787, 89-06025, 89-01228 Station Superintendent Memorandum of August 10, 1989 Plant Design Change Record (PDCR) 2-027-87, MP-2 Antit.ipated Transient Without Scram ( ATWS), Rev 0 PDCR MP3-88-008, Millstone Unit 3 AMSAC System, Rev 0 IC 3472E01, AMSAC Operability Test, Rev 0 E0P 3.5, FR-5.1, Response to Nuclear Power Generation ATWS, Rev 2 A0P-3571, Instrument Failure Response, Rev 1 A0P-3350, Turbine Generator Trip, Rev 2 OP-3350, AMSAC, Rev 0 - - _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _

,. - _

'
  . .'
*
 *

Attachment A 2 Miscellaneous (Cont'd.)

OP-3208, Plant Cooldown, Rev 4 12179-EM-123A-8, P&ID, Main steam and Reheat 25203-26014, P&ID, Reactor Coolant System Incorporating DCR M2-P-067-89, Rev 4 l l

- - - - _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ -  __ ___-_-_ .- _ _ -

}}