IR 05000245/1992029

Insp Repts 50-245/92-29,50-336/92-31 & 50-423/92-28 on 921028-1222.Violations Noted.Major Areas Inspected:Plant Operations,Radiological Controls,Maint & Surveillance, Security & Outage Activities

ML20128D683
Person / Time
Site:	Millstone
Issue date:	02/01/1993
From:	Doerflein L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20128D540	List: IR 05000245/1992029 ML20128D535 ML20128D607
References
50-245-92-29, 50-336-92-31, 50-423-92-28, NUDOCS 9302100201
Download: ML20128D683 (38)

Text

. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

i i U.S. NUCLEAR REGULATORY COMMISSION

REGION I

Report / Docket: 50-245/92 29; 50 336/92 31; 50-423l .-28 License No DPR 21; DPR 65; NPP-49 Licensee: Northeast Nuclear Energy Company P. O. Box 270 liartford, CT 06141 0270 Pacility: Millstone Nuclear Power Station, Units 1,2, and 3 Inspection at: Waterford, CT Dates: October 28,1992 December 22,1992 Inspectors: P. D. Swetland, Senior Resident inspecto A. A. Atars, Resident inspector

'

K. S. Kolaczyk, Resident inspectot ' nit 1 D. A. Dcmpsey, Resident Inspector, Unit 2 R. J. Arright, Resident inspector, Unit 3 H. J. Kaplan, Sr. Reactor Engineer, Region I-J. Anderson, Project Manager, PD l-4 hu R/l/93

'

Approved by:

Lawrence T. DoerDein, Chipf Daic Reactor Projects Section No. 4A -

Scope: NRC resident inspection of core activities in the areas of plant operations, radiological controls, maintenance, surveillance, security, outage activities, licensee self assessment, and periodic report The inspectors reviewed plant operations during perious of backshifts (evening shifts) and deep backshifts (weekends, holidays, and midnight shifts). Coverage was provided for 91.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during evening backshifts and 43.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during deep backshift Results: See Executive Summary i

i 9302100201 930201 gDR ADOCK0500g5

i

'

,

} o

'

!

EXECUTIVE SUMMARY Millstone Nuclear Power Station Combined Inspection 245/92-29; 336/92 311423/92 28 l

l Plant Occiations ,

f

! Unit 1 operated at full power dur;ng this inspection period with the exception of power i reductions for routine preventive rnalntenance and testing, and a reactor trip which occurred on j December 3,1992. An operator inadvertently closed two main steam isolation valves during a surveillance test and the resultant transient caused a high power / main steam isolation reactor tri :

There were no anomalles following the trip. Enforcement discretion was exercised for the i

operator's failure to follow the surveillance procedure.

Unit 2 continued its refueling and steam generator replacement outage and preparations for the unit startup. There was a momentary loss of shutdown cooling on December 4 which resulted from the inadvertent repositioning of a reactor building closed cooling water header isolation i valve during system restoration. The failure to implement planned corrective actions to prevent recurrence of a similar event in 1990 was cited as a violatio .

Unit 3 was restarted on November 4 after the licensee corrected problems with the auxiliary building filter systems (ABFS). Reactor trips occurred on November 6 and 20 due to an t

"

'

inadvertent switchyard fault picection actuaHon and an undetermined electrical fault in the main turbine throttle valve limiter circuit, respectively. After detailed troubleshooting, definitive

! causes for these trips could not.be determined.. In each case, the plant was restarted after

. defeating the subject circuit to guard against subsequent spurious trips. Neither circuit is safety related or required by NRC. An Unusual Event was declared on December 9 when outside

'

ambient temperature dropped below the temperature restrictions assumed for the interim ABFS >

,

modifications, requiring a plant shutdown. NRC subsequently issued a technical specification change which approved continued plant operation with the interim modifications in place. The

'

motor-driven feedwater pump (MDFWP) failed on December 20 when it was overfilled with lube oil. Good operator actions to reduce power and trip the MDFWP prevented a plant trip. Plant .

'

operation was restricted to 50 percent power thereafter because one of the two turbine driven feedwater pumps was also not availabl The inspectors had unresolved concerns regarding the pioper entry into technical specification

,

action statements during surveillance tests, the containment isolation configuration of certain Unit I torus vents, the root cause of configuration problems with reactor vessel level indications

'

during Unit 2 mid loop operation on December 12, and the adequacy of maintenance activities to refill the Unit 3 MDFWP_ lube oil sum Maintenance / Surveillance

. The maintenance activities observed during this inspection were well conducted. Unit I reactor vessel surveillance capsules removed during the 1991 refueling outage were not analyzed

' ll

_

... - .- - - - . -- . - - - _ .

t 4 promptly following removal, violating the reporting requirements of 10 CFR 50, Appendix 1 linforcement discretion was exercised for this problem because it was licensee identined and l corrected, and because the analyses and technical specification changes can be implemented prior :

to expiration of the current reactor vessel operating curves. Unit 2 implemented a cor sprehensive I review and test program for heating, ventilation and air conditioning systems during tho steam j generator replacement >utage. The inspectors found the program to be a positive inidatl 'e that identined and corrected several safety significant discrepancies. The lleense also conduc'ed a well managed hydrostatic test of the new steam generators and associated secondary piping on Unit linginccring_ gad TechnicalSupp0Il Unit I safety evaluations conducted per 10 CFR 50.59 have improved during 1992. The licensee is reviewing their screening processes which specify when safety evaluations are necessary. The inspectors found this to be a needed initiative. Formal tmining of the corporate staff on the conduct of safety evaluations had not yet been fully implemented. The safety evaluation for the Unit 2 refueling machine control modincations was not comprehensive and needed to be rewritte The inspectors found that certain administrative requirements were not completed in a timely manner. Failure to promptly implement changes in design documents following modincations,

,

and failure to review and report on temporary modincations and scaffolding installed for l, prolonged periods were cited.

!

The inspectors reviewed the Unit 2 steam generator replacement post weld heat treatment program, and found it to be well controlled and satisfactor Safety Assessment /Ouality Verification The licensee promptly responded to NRC Information Notice 92 68 which indicated that substandard pipe flanges may have been supplied to the site. None of the subject flanges were found in safety related spares. The licensee is continuing its search of purchase orders and

,

physical installations to determine whether any of the Hanges could have been installed in one

'

of the units, i

(

111 l

,

. . _ . _ . _ , _

. _ _ . _ _ _ _ . .. ._ - -. _

. .

TAllLE OF CONTENTS Pagc 1.0 PRINCIPA LS CONTACTED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2,0 SUhthtARY OF FACILITY ACTIVITIES . . . . . . . . . . . . . . . . . . . . . . . . 1 3.0 PLANT OPERATIONS (IP 71707,93702) ....................... 2 Operational Safety Verification (All Units) ................... 2 Implementation of Limiting Conditions For Operation During Surveillances - Unit 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Reactor Trip During Surveillance Test Unit 1. . . . . . . . . . . . . . . . . 3 Torus Area Inspection Unit 1 .......................... 5 loss of Reactor Building Closed Cooling Water System Duc To inadequate Corrective Action for a Previous Event - Unit 2 . . . . . . . . . 6 Preparations for Refueling - Unit 2 . . . . . . . . . . . . . . . . . . . . . . . . 9 Reactor Coolant System Draindown for Steam Generator Nozzle Dam Re moval U nit 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Reactor Trip due to a Spurious Switchyard Pault Actuation - Unit 3 . . . . 12 Reactor Trip due to Secondary Plant Transient Unit 3 . . . . . . . . . . . . 13 3.10 Unusual Event due to low Outside Air Temperatures - Unit 3 . . . . . . . 15 3.11 Fecdwater Transient, less of the hiotor Driven Feedwater Pump Unit 3 ............................................ 15 4.0 hiAINTENANCE (IP 62703) .............................. 16 5.0 SURVEILLANCE (IP 61726) ............................... 16 Reactor Vessel Surveillance Capsule Results Not Submitted - Unit 1. . . . 17 Diesel Generator Failure to Start - Unit 1 . . . . . . . . . . . . . . . . . . . . 18 Performance Testing of Safety-Related Ventilation Systems - Unit 2 . . . . 19 Ilydrostatic Test of New Steam Generators - Unit 2 . . . . . . . . . . . . . . 21 6.0 ENGINEERING /TECilNICAL SUPPORT (IP 37700, 37828) . . . . . . . . . . . . 23 Safety Evaluation Review - Unit 1 ........................ 23 Refueling Equipment Upgrade hiodifications - Unit 2 . . . . . . . . . . . . . 25 Auxiliary Building Filter System hiodifications - Unit 3 . . . . . . . . . . . 27 Bypass Jumper Control - Unit 3 . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Incorporation of Plant hiodifications into Design Documentation - Units 1 an d 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , 30 Steam Generator Replacement Post Weld Heat Treatment Review - Unit 2 ............................................ 31 iv

, _ _ _

__ _ _ _ . _ - - _ _ _ _ _ _ _ . - - -- _ _ . . ._ _ -__ i

. .

'

i i

! SAFETY ASSESSMENT / QUALITY VERIFICATION (IP 40500,90712) . . . . 31 1 Review of Written Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31  !

f Search for Potentially Substandard Flanges (NRC IN 92 68) . . . . . . . . . 31 j Plant Operations Review Committee - Unit 2 . . . . . . . . . . . . . . . . . . 32  :

1 Followup of Previous Inspection items . . . . . . . . . . . . . . . . . . . . . . 32  ;

'

} 7.4.1 Control of Scaffolding . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

!

! M ANAG EM ENT M Elil'INGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 3

i The inspection procedures (IP) from NRC Manual Chapter 2515, Light Water Reactor Inspection  ;

! Program, that were used as guidance are listed parenthetically for each report section. . ,

- ,

,

i k

1-t i

't

J

+

-

v

,

i

,

I Y

. . , . - , - _ - . _ ....-,_,_,_ ,_,_-.-._ .. - .. _ ,_,. . . . . . _ , . _ _ . , _ _ , . . . . _ - . . . . _ , . , . . , _ - _ . , . . - . , , , _ . - . . _ _ .

_ _ _ _ _ _ _ _ _

. ,

DETAllE PRINCIPAIS CONTACTED Within this report period, the inspectors conducted interviews and discussions with members of licensee management and staff as necessary to support the inspectio .0 SUMMARY OF FACILITY ACTIVITIES Millstone Unit 1 entered the report period at 100 percent of rated thermal powe On November 4, the unit reduced power to 40 percent in an attempt to seal a steam leak located on a flange in the main steam line drain system. The unit returned to 100 percent power later that day. Ilowever, the repair was only partially successful and steam continued to discharge through the flange at a reduced rate. On November 9, reactor power was reduced to 75 percent for a brief period of time while maintenance personnel inspected condenser water boxes. On December 2, reactor power was reduced to 60 percent for a brief period of time while divers conducted inspections cf the intake bays. The unit tripped from 100 percent power on December 3 whee. an operator inadvertently closed two main steam isolation valves during a surveillance twi hifwing a post trip review, a reactor startup was commenced and the plant was taken to IN Mwt of rated thermal power on December 4. On December 10 and 11, reactor power was destased to 60 percent and 80 percent, respxtively, because of intake structure fouling due to adverse weather conditions and condenser backflushing operations. On December 22, reactor power was again reduced to 40 percent while maintenance personnel attempted to completely seal the leak on the main steam line flange and other leak.s located in the heater bay area.

,

Millstone 2 was in the defueled condition at the start of the inspection period Major activities

'

which occurred during the period included engineered safety features actuation system modifications; motor-operated valve upgrades pursuant to NRC Generic Letter 89-10; new steam generator installation and hydrostatic testing (steam drums and attached piping); vital and non-vital 120 Volt AC static inverter replacement; 'A' emergency diesel generator blower l modi 0 cations and governor replacement; and power-operated relief valve ectuation logic modincations. For station blackout mitigation, changes were made to permit paralleling of the emergency diesel generators to power sources at Millstone Unit 1. The plant entered Mode 6 and commenced fuel loading on November 22. Refueling was completed on November 29, and the reactor vessel head was installed on December 7. Mode 5 (Cold Shutdown) was entered on Member 9. On December 21 and 22 mid loop operations were conducted to remove steam generator nonle dams and fill the reactor coolant system. Preparations for the primary containment integrated leak rate test were completed, and the test commenced at the end of the inspection period.

'

Millstone Unit 3 entered the report period in cold shutdown while the licensee completed modifications to the auxiliary building filter system. Reactor startup began on November 4, 1992. On November 6 the plant tripped shortly after paralleling the main generator to the grid

._ . _ _ _ _

. _ _ _ _ _ _ _ _ _ __

. .

f due to an electrical fault in the switchyard. The plant restarted on November 7. Power was reduced to 30 percent on November 13 due to degraded intake structure conditions (excess seaweed) caused by a storm. The plant was returned to 100 percent power on November 14, 1992. On November 20 the plant experienced a turbine runback and tripped on low steam

generator level. After a licensee investigation and completion of modincations to the secondary plant, the licensee started up the unit on November 2 Full power was reached on November 23. On December 9 the licensee declared an unusual event when the required charging now path was declared inoperable due to low outside air temperature. The unusual

event was terminated after the NRC issued a temporary waiver of compliance. On December 10 power was reduced to 60% due to degraded intake conditions caused by another storm. Full power operation resumed on December 13 after cleaning of the intake bays. On December 20 power was reduced to 37% and the operators tripped the motor driven feedwater pump

(MDFWP) off line due to high lube oil temperatures. At the end of the inspection period the plant was at 50 percent while repairs to the MDFWP continue .0 PLANT OPERATIONS (IP 71707, 93702) Operational Safety Verineation (All Units)

The inspectors performed selective examinations of control room activities, operability of engineered safety features systems, plant equipment conditions, and problem identification systems. These reviews included attendance at periodic plant meetings and plant tour The inspectors made frequent tours of the control room to verify su(Delent staf0ng, operator procedural adherence, operator cognizance of control room alarms and equipment status, conformance with technical specincations, and maintenance of control room logs. The inspectors observed control room operators response to alarms and off normal condition The inspectors venfied safety system operability through independent reviews of system con 0guration, outstanding trouble reports and event reports, and surveillance test results. The selection of safety systems for review was made using risk based inspection guidance developed by NRC. During plant tours, the inspectors made note of equipment condition, tagging, and the existence of installed jumpers, bypasses, and lifted lead The inspectors toured accessible portions of plant areas on a regular basis, observing plant housekeeping conditions, general equipment conditions, and fire prevention practices. The inspectors also verined proper posting of contaminated, altborne, and radiation areas with respect to boundary ident!fication and locking requirement Selected aspects of security plan implementation were observed including site access controls, implementation of compensatory measures, and guard force response to alarms and degraded condition Within the scope of these inspections and except as noted below, no safety concerns were identified by the inspector __ __ _ _ _ .

_ _ . . _ _ _ _ _ . _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ . _

, .

l

!

, 3 i

,

' Implementation of Limiting Conditions For Operation During Surveillances - Unit 1 t

'

While observing surveillance testing at Millstone Unit 1, the inspector noted that the operations '

aptrtment does not routinely enter action statements for technical specification (TS) limiting conditions for operation (LCOs) when the performance of that surveillance test renders that '

i equipment inoperable. The inspector noted that if the licensee does not enter a TS action

-

statement (TS AS) when equipment is rendered inoperable, a possibility exists that the equipment may be left inoperable for periods of time which are greater than the outage time allowed by the LCO for that equipment. Additionally, the administrative process of entering into TSASs during surveillance testing may prevent the operations department from inadvertently rendering both safety trains inoperable by allowing surveillance testing to be conducted on both trains simultaneously, t

The NRC position concerning the use of TSASs during surveillance testing was outlined in Generic Letter 91 18 " Operable / Operability Ensuring The Functional Capability of a System or Component," dated November 7,1991. In that Generic Letter, the NRC stated, in part, that unless a TS specifically directs otherwise, licensec's should enter TSASs during surveillance testing if the performance of that surveillance test renders the equipment inoperabl The inspector discussed the operations department philosophy regarding TS usage with the Unit 1 operations department manager. According to the manager, the Unit 1 philosophy was predicated upon a statement contained in the protective instrumentation bases section of the Unit 1 TS. In that section, the TS bases state, in part, that protective instrument channels are allowed to be rendered inoperable for brief periods of time to perform surveillance testing. The inspector noted that since that statement was not specifically reficcted in any other applicable TS, it did not justify the practice of not entering TSASs as outlined in Generic Letter 91-1 '

The inspector did not find any occurrences where equipment has been rendcred inoperable for periods of time greater than the allowed outage time contained in the Unit 1 TS At the close of the inspection period, Unit 1 personnel were in the process of reviewing the NRC position regarding TS LCO usage contained in Generic Letter 91-18 and how' Unit I conforms to the NRC position on that subject. This issue is umesolved pending completion of the licensee's review (50 245/92 29-001), Reactor Trip During Surveillance Test - Unit!

On December 3,1992, Millstone Unit I tripped from 100 percent of rated thermal power due to operator error during the performance of surveillance procedure SP 412L, " Isolation 1 Condenser Isolation Instrument Functional Test / Calibration." The error occurred when the- ,

operator closed the 'A' and 'C' Main Steam Isolation Valves (MSIVs) instead of turning the control switches for Isolation Condenser (IC) valves IC-1,-IC-3 and IC-6/7 to the closed position as required by SP 412L. The operating switches for the main steam isolation and isolation condenser valves are located approximately six inches across from each other in two vertical rows. The operator indicated that prior to closing the MSIVs, he had placed his hand by the L

,

'

u

, ,,.,-.--.,,.e - - . -

,.e. _ . . w m. - ,--n-- -.-,.n..,~ , - . , ,, -- .m a +-,,,,rv, ,,n.. w---

- . . _ - - - . __ .- -

. .

control switches for the IC valves, liowever, his hand apparently drifted over to the MSIV control switches when he took his eyes off the control panel in anticipation of moving on to the

,

next step in the surveillance procedur Closing the 'A' and 'C' MSIVs caused a rapid increase in reactor power and in steam flow through the remaining open steam lines. The power and steam flow increase was terminated when the reactor tripped due to high reactor power and/or closure of the MSIVs when a Group 1 protective isolation occurred on high steam line flo Reactor plant systems responded to the event as designed. prompt operator action in response to the event mitigated the transient. Specifically, following the trip, operators quickly reopened the MSIVs, which restored the condenser as a heat sink for the reactor. This action limited the reactor plant pressure increase due to decay heat to 1083 psi and prevented the actuation of the lowest set safety relief valve (setpoint 1095 psi). To prevent inadvertent switch operation during future surveillance procedure tests, the licensee is considering installing plastic covers over the control switches for the MSIV The inspector conducted a review of this event using selected portions of the Management Oversight and Risk Tree (MORT) analyses in an effort to identify the root cause(s) of the tri The inspector reviewed procedure SP 412L and verined that the surveillance testing instructions were not ambiguous. Through interviews with the operator, the inspector determined that the operator was not under any undue pressure to complete the surveillance test. The individual who was performing the surveillance was experienced and had completed the test before. Therefore, the inspector concluded that these causal factors did not contribute significantly to this event and personnel error was the principle caus The Unit 1 operations department has tried to reduce the frequency of personnel errors by operators by expecting personnel to perform self-verincation during their work activities. Self-verincation as outlined in operations department instruction 1.15, " Operator Self-Verincation,"

includes the following: (1) locating the device, (2) placing a fmger on the device, (3) comparing

- the label on the device to the one listed on the procedure, (4) considering the actions and (5)

performing the task. It is apparer.t that the operator did not complete the self-verincation action when he was performing SP 412L and a reactor trip resulte The inspector noted that although operators are expected to use self verincation during the performance of their tasks, Unit I supervisory control room operators (SCOs) and Shift Supervisors (SS) do not routinely reinforce this expectation with control room operators (CROs)

during day to day plant operations. Specincally, SCOs and SSs tend to rely on a control room operator's reputation and overall competence when deciding on the level of self veri 0 cation that an individual should use, t

Although relying on past job performance is useful in many applications, the inspector concluded that it may not by itself reduce the frequency of personnel errors which have occurred at Millstone station. Specifically, the inspector noted that in an August 10,1992 teport issued by

. _ _ _ .

. .

the Nuclear Safety Engineering Group (NSEG) which examined events occurring at the Millstone and Connecticut Yankee plants during the 1991 time period, NSEO concluded that the majority of errors at both stations are due to inattention to detail. These errors are made primarily by experienced individuals, working day shift, performing routine tasks with an average work loa Since SCOs and SS do not routinely emphasize self verification to all personnel during work activities, they will not prevent the potentially greatest contributor to personnel errors at Millston Based on the NSEO report and the inspector's observations following the December 3,1992 trip, the inspector concluded that the Millstone Unit 1 program to reduce the amount of personnel _

errors is not fully effective. The inspector discussed this conclusion with the operations manager who acknowledged that the operator self verification program is not being effectively implemented at Unit 1. To improve implementation, the operations manager stated that operators would first have to be shown proper self verification techniques during regular operator training periods. Once this was accomplished, reinforcement of proper self verification could then be accomplished. The retraining is currently expected to be completed by April 199 The failure to follow procedure SP 412L during the surveillance test was a procedure violatio However, prompt operator response to the trip significantly mitigated the safety significance of the event. The installation of the plastic covers and improvement of the operator self verification program should be adeqerte corrective action to prevent recurrence. Therefore, no violation will be issued per Section VILD of the enforcement polic .4 Tonis Area Inspection - Unit 1 The licensee has embarked upon a program to paint the torus area and improve the material condition of the components located in the torus enclosure. The inspector performed a walkdown of this area to ascertain the status of housekeeping and radiological access controls which were being utilized during the painting process. Additionally, the inspector compared the position of several isolation valves to the position stated oi, the respective system valve lineup sheet. The inspector determined that overall, houscVecping was good and proper radiological access controls were utilized by the licensee. Valve lineups were determined to be correct. The inspector noted that in addition to improving the material condition of components, the painting of the torus enclosure had improved visibility and would case decontamination efforts. The inspector concluded that the painting program was a good licensee initiativ During the walkdown of the torts area, the inspector noted that a drywell penetration contained a nonstandard configuration. The penetration of concern, number X-217, provides a tap off the torus for the torus to-drywell differential pressure transmitters, and therefore communicates directly with the containment atmosphere. The penetration consists of a one inch test connection with a vent, isolated by a single, locked closed isolation valve and a pipe cap. The majority of similarly configured penetrations in the torus area contained two locked closed isolation valves in serie __ - - _ - - . - - .

j

- . . - . - -

. .

The adequacy of the Unit I containment penetration design was reviewed by the NRC as part of the Systematic Evaluation Program (SEP) under Topic VI-4, Containment Isolation Syste In this program, the Unit I containment penetrations were compared to the General Design Criteria (ODC) or section 6.2.4 of the Standard Review Plan. The comparisons were made in part based upon licensee submittats to the NRC staff which described Unit I containment '

penetrations. Documentation of the acceptability of the Unit I containment isolation design was discussed under Topic VI 4 in NUREG-0824, " Integrated Plant Safety Assessment Program,"

dated December 1983. In this NUREO, the licensec committed to modify three penetrations which did not have two locked closed isolation valves in series. later, that commitment was modified as outlined in an April 2,1985 letter to the NRC, to require locking the single isolation valves and installing blank flanges or pipe caps downstream of the valves. The inspector noted that in an April 14,1982 submittal to the NRC concerning SEP topic VI.4, the lleensec informed the NRC that penetration X 217 was seal welded. Since seal welded penetrations were not i

required to be reconfigured by the NRC in the SEP program, penetration X 217 was not modifie The inspector's discovery that penetration X-217 was a nonstandard configuration was of minor significance since the as installed configuration was tight as verified by the successful completion of Type "A" Integrated Leak Rate Tests during previous refuel outages. Additionally, due to the location of the penetration, it is unhkely that the valve would be inadvertently opened by an individual, llowever, the inspector was concerned that the licensee did not accurately report the status of penetration X-217 in the April 14,1982 submittal to the NR To clarify the status and ensure effective administrative controls are maintained on containment penetrations the licensee committed to perform the following actions: (1) other penetrations which were identified as being seal welded in the April 14,1982 submittal would be checked to

'

,

ensure their status was properly reported to the NRC; (2) if a penetration was not configured

as reported to the NRC in the submittal, the licensee would correct the submittal; and, (3) the

'

improperly configured penetrations would then be modified or would be controlled through the use of additional administrative controls. The additional modifications or administrative controls l to be utilized would be consistent with those applied to similar penetrations under the SEP/ISAP programs.

l The inspector considered the licensee's corrective action plan to be adequate. However, this item i

will remain unresolved pending completion of the actions and evaluation of the licensee's review of similarly configured penetrations (50 245/92-29-002). Loss. of Reactor Building Closed Cooling Water System Due To. Inadequate Corrective Action for a Previous Event - Unit T On December 4,1992, at 11:25 p.m., with the plant in Mode 6 (Refueling), reactor building closed cooling water (RBCCW) system flow to the shutdown cooling and spent fuel pool cooling systems was lost when the 'C' RBCCW pump tripped off on low suction pressure. The trip was caused when operating air was restored to valve 2 RB-211E, the normally-closed suction isolation

-- -

.- -

-.- . -- -- . -- . . - _ _ .

_ _ _ _ _ _ _ - _ _ __

-

. .

valve from the 'A' RBCCW header, causing the valve to open inadvertently. The 'A' RBCCW header was not full at the time of the incident and the resultant flow from the 'B' header to the

'A' header through valve 2 RB 211E starved the operating pump causing it to trip on low suction pressure. Operators closed the valve locally, and restored system flow by 11:35 p.m. No increase in reactor coolant or spent fuel pool temperature was observed. The licensee initiated plant incident report 2-92 139 to document the incident, evaluate it for reportability to the NRC, and track corrective action. Appropriate guidance for operation of valve 2 RB 2118 and other similar valves was provided to operators in night orders dated December 16 and December 2 The inspector considered this temporary corrective action to be adequate pending incorporation of the guidance into the operating procedure The inspector reviewed technical specifications (TS) 3.9.8.1 and 3.9.3.2, applicable to shutdown cooling and spent fuel pool cooling, respectively, to verify that license requirements had been satisfied by the licensee. TS 3.9.8.1 requires at least one shutdown cooling loop to be in operation in Mode 6. The associated action statement requires that all operations involving an increase in reactor decay heat load or a reduction in reactor coolant system (RCS) boron concentration be suspended, and that all containment penetrations providing access to the outside atmosphere be closed within four hour TS 3.9.3.2 requires the spent fuel pool bulk temperature to be maintained less than 140 degrees (*) Fahrenheit (F). There were no operations ongoing which would increase decay heat load or dilute the RCS. The loss of heat sink was sustained for only 10 minutes; and, there was no increase in spent fuel temperature. The inspector concluded that the plant remained within the technical specification requirements during the inciden The inspector reviewed the inadvertent opening of valve 2-RB 21IE. The licensee was restoring valve 2-RB 211E to service following replacement of its solenoid-operated pilot valves under automated work order M2 92-09279. The valve is designed to fail "as-is" on loss of operating air or electrical power to the pilot valves. However, the valve design is such that it will reposition when air is restored while the associated main control board switch is in the normal

" neutral" position. Operating procedure (Op) 2330A, " Reactor Building Closed Cooling Water System," Revision 15, dated July 22,1992, provides instructions for transferring the valve from manual to automatic operation, which entails restoration of operating air. The inspector noted that the design feature which causes inadvertent repositioning of the valve was not reflected in the operating procedure, and that conforming with the procedure would result in inadvertent operation of the valve. The inspector concluded that lack of adequate procedural guidance contributed to the misoperation of the valv The inspector reviewed previous Millstone 2 inspection reports and licensee event reports (LERs)

to determine if similar valve mispositioning events had occurred, and found that in November 1990 the plant had been operated for several days in violation of TS with service water system trains 'A' and 'B' cross-connected due, in part, to mispositioning of valve 2-SW-97A. Similar to valve 2-RB-211E, that valve had stroked open inadvertently from the closed position when operating air was restored. That event was documented in Millstone 2 special inspection report 50-336/91-02, dated February 1,1991, and in LER 50-336/90-022-01 (update), dated July 2,

. .

1991. That event resulted in escalated enforcement action by the NRC. In its reply to the notice of violation, the licensee identified the design anomaly of the service water valve and stated that it would continue to investigate the valve characteristics and report the results to the NRC. In LER 90-022-01 the licensee committed to review the control systems of other similar valves to ensure that a generic condition did not remain undetected, and to revise procedures to include information and cautions emphasizing the 6esign features of suspect valve At the time of the event on December 4,1992, an operations department night order dated April 19,1991 was in effect which provided appropriate guidance for restoration of air to valves 2-SW 97A and 2 SW-978. This guidance had not yet been incorporated into Op-2326A,

" Service Water System," Revision 15, dated October 23, 1992. Following the December 4 event, the inspector questioned whether the design anomaly existed for other valves at Millstone Unit 2. The licensee identified the following valves:

• 2-SW-3.1 A and 2-SW-3.1B, ' A' and 'B' service water header RBCCW heat exchanger inlet, respectively

• 2 RB-4.1 A and 2-RB-4.lB, 'A' RBCCW heat exchanger outlet to 'A' and 'B' RBCCW headers, respectively

• 2-RB-4.lC and 2-RB-4.lD, 'B' RBCCW heat exchanger outlet to 'A' and 'B' RBCCW headers, respectively

2 RB-4.lE and 2-RB-4.lF, 'C' RBCCW heat exchanger outlet to 'A' and 'B' RBCCW headers, respectively

2-RB-211 A through 2-RB-211F, Normal and Alternate suction isolation valves to 'A', 'B',

and 'C' RBCCW pumps ,

As of December 4, no guidance was provided to operators in procedures or night orders regarding the proper restoration of air to these valves. The inspector concluded that the root cause of the event was failure to perform the corrective actions outlined in LER 90-02 During normal operation, mispositioning of the listed valves could result in diversion of RBCCW system flow to an idle heat exchanger, isolation of flow to a running pump, or a loss of train independence. Indication of valve position and' system operating parameters and alarms are available in the control room to aid operators in identifying and correcting anomalous system configurations. The mispositioning of valve 2-RB-211E on December 4 had no safety consequences. However, the inspector was concerned that the design feature of the valves could unnecessarily challenge plant operators during recovery from an event involving loss of operating air. The failure to provide adequate guidance for proper restoration of actuating air to all of these important valves following the 1990 event is a violation (50-336/92-31-003) of 10 CFR 50, Appendix B, Cr.terion XVL This requirement states, in part, that measures shall be established to assure ti.at conditions adverse to quality are identified and corrected promptly and that actions are taken to prevent recurrence of significant deficiencies. Since the corrective

_

_ . _ - _ _ _ _ _ . . _ . _ _ _ . . _ _ _ _ _ - . _ _ _ _ . _ _ .

. .

,

i i

!

9 i

actions needed in response to this violation will address the adequacy of remedial actions for the

previous event, that item (50-336/91-02-01) is administratively closed, i

Preparations for Refueling - Unit 2 The inspector reviewed licensee administrative, operating. and surveillance procedures, and plant systems status, and observed licensee activities in preparation for and in support of refueling on November 22 and 23. The activities and controls verified by the inspector are included in the j ltems belo * Primary containment integrity was verified to meet the requirements of Technical Specification (TS) 3.9.4 by reviewing completed surveillances and direct observation oflocal

,

and control room indications.

i

• The containment purge valve isolation system was operable and the purge valves wcre shut.

The necessary complement of containment area radiation monitors which initiate purge

isolation were operable (TS 3.3.9 and 3.3.10).

i * Reactor vessel level was greater than 23 feet above the top of the vessel and boron

concentration of all filled portions of the reactor coolant system and the refueling canal i provided adequate shutdown margin (TS 3.9.1 and 3.9.11).

i i * Direct communications were established between the control room and the refuel machine

.

(TS 3.9.5). In addition, containment activities could be monitored in the control room by j closed circuit television, and refueling status was tracked on a computer-based ' display j syste * The minimum required electrical power sources were verified to be available by observation l of control room indications and walkdowns of accessible portions of the distribution systems i (TS 3.8.1.2, 3.8.2.3, and 3.8.2.4).

I * Greater than two source range nuclear instrumentation channels, with audible indication in i the containment, were operable. Channel functional tests were verified to have been j performed within eight hours prior to commencement of fuel movement by review of

'

completed surveillance procedures (TS 3.9.2). The inspector also observed portions of the i performance of special test SP 92-2-18, " Response of Wide Range Channels to a Neutron Source." The test directly confirmed instrument operability by exposing the excore detectors to a fuel assembly containing a neutron sourc .

• One shutdown cooling loop was verified to be in operation by observation of control room indications (TS 3.9.8.1).

. The inspector concluded that the licensee had satisfied the TS requirements governing fuel movement. Administrative and procedural controls were well-implemented. Personnel werc

!

j

,. . . . - -- . . - - . - - -. . - - . - , . , .- , _ - . _-- .- - --

-- .__ _ .

. .

knowledgeable of license requirements, equipment status, and plant system alignments. The inspector determined these activities were performed in a professional manner, adequate to assure nuclear and personnel safet .7 Renetor Coolant System Draindown for Steam Generator Nozzle Dam Removal-Unit 2 On December 12 the inspector observed drain down of the reactor coolant system (RCS) from a level slightly above the reactor vessel flange to the centerline of the coolant loop hot leg level was lowered to facilitate removal of the steam generator nozzle dams for RCS fill. The evolution was performed in accordance with operating procedure OP-2301E, " Draining e Reactor Coolant System," and OP-2218, " Reduced Inventory Operations." The alternate mes i d of draining was employed using a low pressure safety injection (LPSI) pump minimum flow path to the reactor water storage tank. The inspector reviewed the licensec's implementation of commhments to NRC Generic Letter 88-17, "1.oss of Shutdown Cooling," documented in letters dated December 23,1988; January 31,1989; and January 30,1991 as incorporated in OP 221 The inspector verified the following items:

• Five reactor vessel injection sources were available including both LPSI pumps, one high pressure safety injection (HPSI) pump, and two charging pumps;

• Alternate sources of power were available from the 'A' Emergency Diesel Generator and through a cross-tic to Millstone Unit 1;

• The pressurizer manway was removed providing an RCS vent path;

• A senior management representative was present in the control room for entry into the reduced inventory condition;

• Adequate administrative controls were provided to preclude work activities which could affect containment integrity, shutdown cooling system availability, or RCS inventory;

• Adequate instruments and alarms for core temperature monitoring were operable;

• Though not required, the containment equipment hatch was fully bolted for the duration of reduced inventory operations; and,

• Efforts were made to maximize the number of RCS level monitoring instruments available to support the draindow Procedure OP-2218, step 4.5, requires at least two independent RCS level monitoring systems to be in service during reduced inventory conditions. This step is incorporated by reference into l procedure CP 2301E steps 4.4 and 5.2.1 as a requirement for RCS draining. The level monitoring systems at Unit 2 are:

l l

_ . _ _

.- _ - _ - . . . - .

. .

• Level gauge LI l12, a standpipe containing 'Dags" activated by a magnetic float and monitored by closed circuit television in the control room;

• Wide range indicator L-ll2, in parallel with LI-ll2, a thermal dispersion continuous level monitor; e Narrow range indicator L-122, an ultrasonic device located on the opposite loop; and,

• One or both trains of the RVLMS, an unheated junction thermocouple level monitoring syste Any two of these indications satisfy the procedural requirement. The inspector did not consider L1 ll2 and L-ll2 to be independent devices, as both shared common system connections which can be affected by mispositioning of a common vessel head vent valve as discussed below. The inspector noted that, while independent, instrument L-122 is over-ranged until the top of the hot leg is reached. Also, the RVLMS does not provide continuous monitoring of reactor vessel level. Rather, the RVLMS shows the reactor vessel zone in which the level resides. Though not consistent with normal practice at Millstone Unit 2, procedure OP-2218 would permit RCS draining with only Ll-112 and L-112 which are subject to common mode failure. The occurrence described below demonstrates the importance of monitoring multiple level indications during mid-loop operation The evolution commenced at 4:32 p.m. from a level of 80 inches above the hot leg centerlin Shortly after the draindown began, the inspector and operators concurrently noted anomalies among the reactor vessel level indicators; the local gauge glass and thermal dispersion indications appeared to be decreasing more rapidly than warranted by the draining rate and were not consistent with the indication on the reactor vessel level monitoring system (RVLMS). Draining was stopped immediately and an operator was dispatched to the containment to investigat Subsequently, a valve in the RCS vent system was found to be shut, vice open, preventing the vessel head from venting properly. When the valve was opened, all vessel level indicators stabilized at approximately 60 inches. The draindown was restarted at 5:52 p.m. and completed with no further problems at 8:15 Through discussions with licensee personnel, the inspector found that the vessel head vent valve had been shut on December 12 to facilitate venting of the safety injection tanks to the enclosure building filtration system, and had not been restored to the open position at the conclusion of that activity. Further, the valve was not shown on the applicable figure of procedure OP-2301 The inspector reviewed procedure OP-2306, " Safety injection Tanks," and determined that the RCS vent system valves manipulated by that activity were not speciGed by their numerical designations, and that no restoration step was provided. Neither procedure OP-2301E nor OP-2218 provide system valve lineup sheets or require valve position verification prior to draining the RCS. Thus, system configuration appeared to be controlled only by the Ogure contained in procedure OP-2301E. Finally, the inspector learned that a plant equipment operator had notified

_ _ _ _

. .

licensee management in a memorandum drafted earlier in the day that a valve not identined in the procedure Dgure had been found. This was the valve that was found to be shu At the end of the inspection period, the licensee was evaluating the root cause of the mispositioned valve and the opportunity to correct it when an operator notined the shift of the presence of the unlabeled valve. This issue will remain unresolved pending NRC review of the licensec's evaluation and corrective action (50 336/92-31-004).

The inspector concluded that the RCS draindown was performed professionally with an appropriate level of licensee management oversight. With the exception of the mispositioning of the vessel head vent valve, preparations for and conduct of reduced inventory operations were performed in accordance with procodures and consistent with generic letter commitment Draining of the RCS was promptly stopped when operators alertly noted discrepancies between the vessel level indicators. The inspector determined that the licensec's immediate corrective actions were appropriat .8 Reactor Trip due to a Spurious Switchyard Fault Actuation - Unit 3 On November 5,1992, with the plant at approximately 16 percent power and the main generator syrichronized to the grid, an electrical fault protection signal in the zone between the main generator and the switchyard resulted in a generator trip, turbine trip, and reactor tri The fault protection signal also opened the two switchyard ring bus feeds to the main transformer to protect the transformer. As a result of the generator trip, the generator output breakers opened and the resultant loss of both the off site and onsite supplies to the normal station service transformer caused a loss of non vital and vital power supplies, The 4160 volt vital electrical distribution system was transferred automatically to the off site reserve station service transfo.mer (RSST). The non vital 4160 volt buses do not automatically transfer to a backup power sourc Loss of power on the non-vital 4160 volt buses resulted in a loss of power to the control rod I drive system. This caused a loss of power to the control rod stationary gripper coils resulting l in the control rods falling into the core; the reactor tripped on high negative rate. The 6.9 Kv busses, supplying power to the condensate and reactor coolant pumps, automatically transferred to the RSST. Power was restored to the 4160 volt non-vital busses 20 minutes after the event l when the tie breakers to the RSST were closed manuall Operations personnel responded well to the trip and cautiously returned the plant to a stable hot standby condition. A feedwater isolation actuation occurred due to low reactor coolant system

,

temperature following the trip. This feature functioned as designed to arrest the primary system

! cooldown. No other engineered actuation signals were initiated or required as a result of the transien During the transfer of the 6.9 Ky buses to the RSST, both the 'A' and 'C' condensate pumps and the 'D' reactor coolant pump tripped. The 'B' condensate pump automatically started following the trip of the other two condensate pumps. Operators manually trippc<. the 'B'-

_ -_ .- - ._ - .- .. ._. .

4 .

condensate pump in accordance with E0P 35 E-O " Reactor Trip or Safety injection," to avoid recirculating hot condensate back to the condenser.

The licensee determined that the condensate pumps tripped on current overload as a result of the transfer from the NSST to the RSST. The indicated cause of the reactor coolant pump trip was a locked rotor. However, the licensee's investigation determined that a mechanical shock to a contact in the locked rotor logic caused a spurious trip of the pump. The lleensee's root cause investigation of the electrical fault protection signal concluded that the most likely cause of the fault was a suspect out-of step" tripping relay. The relay is designed to protect the switchyard against instability in the event the main generator slips a pole. It is a backup to the loss of field relay. Improper operation of the out-of-step relay could not be repeate orrective action, the licensee re-calibrated the out-of-step relay and modified operating n .dures to defeat the relay during subsequent plant start ups up to approximately 20% reactor

,wer. With the relay defeated, the parameters sensed by the relay will be monitored in an attempt to identify spurious signals while at low power. The licensee indicated that the relay would continue to be defeated until the problem is identified. The lleensee expects that this will prevent similar low power trip The licensee reported the event in accordance with 10 CFR 50.72(b)(2)(li). Prior to restart, a visual inspection of the generator line and its connected components was performed. No external signs of damage were found. Oil samples taken of the main transformers and NSSTs indicated

,

that no faults occurred in any of the transformers. The licensee started up the plant on November The inspector discussed the event with operations and generation test service personnel, reviewed the sequence of events printout, and attended the plant operations review committee post trip review meeting. Although the licensee was unable to definitely identify the root cause of the trip, the inspector determined that the review was thorough. The return to power on November 7 was conducted smoothly without inciden .9 Reactor Trip due to Secondary Plant Transient - Unit 3 On November 20,1992, at 4:03 a.m. with the plant at 100 percent reactor power, the electo-hydraulic control (EHC) trouble alarm and the Inverter 5 trouble alarm were received in the control room. Within seconds, the turbine throttle pressure limiter circuit actuated which closed the main turbine control valves. The resultant rapid decrease in steam demand to the main turbine caused the steam generator levels to drink. The reactor automatically tripped on 'B'

steam generator low low water level as designed to preserve the steam generator heat sink for decay heat remova All reactor plant systems responded as expected. There were no code safety valve actuations on the primary or secondary side. The two primary system power operated relief valves did lift for a few seconds and then rescated. Steam generator leels were recovered by the automatic start

. _ _ - .

_ _ , ..

- _ _ _ _ _ _

d e

of the auxiliary feed water pumps. The feedwater isolation system actuated on low low reactor coolant system temperature. This feature functioned as designed to arrest the cooldown of the primary system. No other engineered safety feature signals were initiated or required as a result of the trip. The licensee reported the reactor trip to the NRC headquarters duty officer pursuant to 10 CFR 50.72(b)(2)(li).

Operations personnel responded to the trip by performing EOp 35 E-0, " Reactor Trip or Safety injection," and stabilized the plant in the hot standby condition. Within minutes of the trip an operator was dispatched to investigate the inverter trouble alarm and noted that the inverter had not switched to its alternate power supply. Sometime later in the trip recovery period, the inverter switched to its alternate source and the trouble (low voltage) alarm cleared. The low voltage alarm is generated if bus voltage drops from 1:0 to 105 VAC and the inverter transfers to its alternate power source once 95 VAC is reache The turbine throttle pressure limiter is designed to prevent water induction into the main turbine, it is a non redundant, non safety related circuit which monitors throttle pressure (between the turbine stop and comrol valves) and causes the main turbine control valves to close on low pressure. It is powered from the EHC system cabinet. Normally, with the main turbine above 90 percent rated speed, the EHC system cabinet is powered from the permanent magnetic generator (PMO) driven by the turbine shaft. The Inverter 5 - 120 VAC supply is used as a backup. However, the Inverter 5 supply also powers the AC transfer switch and ifit is lost, the output to the EHC cabinet is lost. The licensee believes that a temporary failure of the Inverter 5 and the PMG to supply the EHC system resulted in the generation of a false low throttle pressure signal which caused the turbine throttle pressure limiter circuit to actuate and close the main turbine control valve The Ikensee's ever t investigation looked for failures in the power supplies to the AC transfer swhch and checked the power supplies to the instruments powered by the EHC cabinet. No rmblems were identified. Because the cause of the suspected power supply problems and the resaltant turbine control valve closing could not be determined, the licensee decided to bypass the wrbine throttle pressure limiter from the EHC system to prevent a similar trip in the futur This is a turbine protection feature for which the low pressure and high level steam generator protection logic provide adequate protection. In addition, moisture carry over has not been a problem for Unit The feedwater isolation transient caused a pressure spike in the feedwater system which exceeded the ASME Code allowable pressure. Discharge pressure peaked at 2150 psig before decreasing below the design pressure of 1800 psig. The licensee determined that the feedwater system remained operable based ont no observable piping damage, the pressure spike was within the original hydrostatic test pressure, and ASME section III recognizes faulted (level C) pressure excursions to 120 percent of design pressure for limited occurrences of very short duratio Similar pressure excursions have occurred on previous plant trips with a feedwater isolation (Reference inspection report 50-423/92-11). The licensee is continuing with the development of long term corrective actions to resolve the feedwater pressure transient concem _ _ _ _ - .

. .

After management investigation of the event, a review of the post trip review report, and instrumenting the inverter power supply to the ElfC cabinet, the licensee started up the plant on November 21. The ins}ector observed the licensee's troubleshooting efforts and reviewed the sequence of events printout, the post trip review, and the bypass jumper for the turbine throttle pressure limiter. The inspector concluded that the operators response to the event was good and considered the licensee corrective actions to be adequat .10 Unusual Event due to Low Outside Air Temperatures - Unit 3 On December 9,1992, the licensee declared an Unusual Event due to a technical specincation (TS) required shutdown. The shutdown was required when required charging and boration flow path components were declared inoperable due to low outside air temperature. To address identified system vulnerabilities, modifications to the auxiliary building Glter system (see section 6.3 of this report) were completed on November 4, which allowed plant operation so long as outside air temperature remained above 17'F. Iklow that temperature, proper operation of the charging system during an accident could not be assured. The licensee had installed temporary heaters in the auxiliary building and requested a TS amendment to approve the use of the temporary heaters to allow continued plant operation when outside temperatures decreased below 17'F. On December 9 at 5:50 a.m., ouA air temperature dropped below 17'P. The licensee entered TS 3.0.3 and made preparations .o shut down the plant. At 6:50 a.m. the licensec declared an unusual event due to the TS required shutdown. The shutdown preparations and the unusual event were terminated at 8:07 a.m. when air temperature rose above 17'F. Shortly thereafter, the NRC issued a temporary waiver of compliance to allow credit for the use of the temporary local heaters. The NRC issued a formal TS amendment later in the day on December .11 Feedwater Transient, less of the Motor Driven Feedwater Pump - Unit 3 On December 20,1992, the licensee reduced power to 95 percent in preparation for performing turbine control / intercept valve testing. Shortly after reducing power, the motor driven feed water pump (MDFWP) low lube oil pressure alarm annunciated in the control room and the auxiliary tube oil pump started. An operator was sent to the turbine room to investigate the problem. The lube oil high temperature alarm was received in the control room and the operator reported that oil was spewing out of the MDFWP seals. Operators commenced an emergency load reduction by backing off on the turbine load limiter. Once power was reduced to less that 50 percent, operators tripped the MDFWP off line and stabilized the plant at approximately 40 percent powe Licensee investigation revealed that a work order had been processed and an operator had just added oil to the MDFWP gearbox. The licensee concluded that the oil level rose to the bull gear causing the oil to foam resulting in a low lube oil discharge pressure. The auxiliary lube oil pump started on receipt of the low lube oil pressure. With both the normal and auxiliary lube oil pumps running, a high discharge pressure developed causing the relief valve to lift. This resulted in the lube oil recirculating around the lube oil pumps causing it to heat up and j

_ _ _ _ _ __ _.. _ _ _ . . _ _ .- _ _. _ _. _ _ _ ._ _ _ _ _ _ I

'

, ,

l

i l

i 16

!

l eventually leak from the MDFWP seals. The licensee is continuing to evaluate the cause of the

high oil level, i

l The inspector reviewed the sequence of events printout and discussed the event with the license The inspector concluded that the operators response to the event was very good in that the oprators took prompt action to reduce power and prevented the plant from tripping on low

ste generator ievel. At the end of the inspection period the plant was operating at 50 percent

! pow, due to only one available feedwater pump. Pending further NRC review of the high lube oil level, this is considered an unresolved item (50-423/92-28-005).

1 MAINTENANCE (IP 62703)

'

The inspectors observed and reviewed selected portions of preventive and corrective maintenance

! activities to verify compliance with regulations, use of administrative control procedures and i appropriate maintenance procedures, compliance with codes and standards, proper QA/QC

'

involvement, use of bypass jumpers and safety tags, personnel protection, and equipment

,

alignment and retest. The inspectors reviewed portions of the following work activities:

• M2-92-17031 - Perform special test 'I92-57 for SRAS/ATI modifications j * M2-92-10852 - Vendor modify main steam isolation circuitry per field change procedure

• M2 92-05792 - Overhaul motor-operator for valve 2-SI-625 4 * M2-92-06237 - Install new 4T rotor limit switch for valve 2-St-625 4 * M2-92-15264 - Repower valve 2 FW-51A from VA-10 i * M2 92-15262 - Add redundant main steam isolation closure signal to valve 2-FW-51 A 4 * M2 92-15266 - Wire main steam isolation initiation relay coils per plant design change

_

record 2-114 92 l * M2-92-10852 - Main steam isolation containment pressure signal addition to ESAS

• M3 92-20751 - Replace 'C' charging pump bearings, align and dowel bearing housing

• M3-92-16849 - Disassemble, repair and reassemble 'C' reactor plant component cooling j water pump i

The inspector determined maintenance activities were well implemente .0 SURVEILLANCE (IP 61726)

The inspectors observed and reviewed selected portions of surveillance tests, and reviewed test

data, to verify compliance with

procedures; technical specification limiting conditions for

.

operation; removal and restoration of equipment; and, review and resolution of test deficiencies.

l The inspector reviewed portions of the following tests:

.

• SP 406KK -

Stack Gas Radiation Monitor Functional Test

,

• SP 406C - Main Steam Line Radiation Drawer Calibration

• SP 3610 Residual Heat Removal Pump 3RITS* PI A Operational Readiness Test

,

J

,-., . . .- , -- .. - , . . - , _-__ , , , - - , . -

_ _ __ _-_ _ _ _ _ . _ _ . - _ . .

. .

• SP 3630 Reactor Plant Component Cooling Water Pump 3CCP* PIB Operational Readiness Test

• T 92-37 - Dynamic Test of Safety injection Valves

• EN-92-2-18 - Response of Wide Range Channels to a Neutron Source

• T-92 57 - Functional Test of SRAS/ATI modifications to ESAS

• IST-91-04 - Replacement Steam Generator Secondary Hydrostatic Test

• SP 2613C -

Engineered Safety Features System Integrated Test The inspector determined the performance of surveillance activities was good; the following observations were mad .1 Reactor Vessel Surveillance Capsule Results Not Submitted - Unit 1 On August 21, 1992, the licensee informed the NRC that due to administrative oversight, a summary technical report concerning analyses of reactor vessel surveillance samples was not submitted to the NRC within one year as required by 10 CFR 50 Appendix II. The surveillance capsules were withdrawn from the Unit I reactor vessel by a contractor on April 20, 199 However, due to a lack of a suitable transport capsule, the specimens were not shipped off site

,

for analyses until June 18, 1992. During this time period, the licensee did not request a waiver l from the Appendix H submittal requirement.

l The reactor vessel surveillance capsules are analyzed per 10 CFR 50 Appendix 0 and Section

'

Ill of the ASME code to develop pressure-temperature curves for reactor vessel heatup and cooldown, pressure testing, and core operation. When the analyses of the specimens are complete, the curves are then incorporated into the Unit 1 Technical Specifications (TS) and j become operating limits. Since the operating curves currently contair.ed in Unit 1 TS remain I acceptable to 16 Effective Full Power Years (EFPY) of operation and Unit 1 is currently at 1 EFPY, the untimely analyses of the surveillance etpsules will not become safety significant until mid-199 In an October 16,1992 letter to the NRC, the licensee stated that the technical report would be l submitted to the NRC in December 1992, and a TS change which would incorporate the new operating curves would be submitted by March 31,1993. The licensee stated that this oversight should not recur since removal and testing of the reactor vessel specimens will now be tracked l by a designated corporate group under a separate program. Prior to this event, responsibility for l the reactor vessel material surveillance program was not maintained by a designated organization.

,

Therefore, tracking of surveillance capsule removal and testing was not rigidly accomplished.

The inspector reviewed the process by which the surveillance capsules were removed during the 1991 refuel outage and made the following observation. The Unit 1 master test control sheet Administrative Control Procedure 9.02, " Surveillance Master Test Control List," specifies engineering procedure 1053, " Neutron Flux Specimens", as the controlling document for surveillance capsule removal and testing. During the 1991 refuel outage, Unit i engineering personnel did not use procedure 1053, but instead wrote a special procedure to remove and cut

. -

- _ _- - -- . - _ _ - . .

. .

l

the surveillance specimens for transport. The inspector reviewed both procedures and made the following observations. Neither procedure specified when analyses of the surveillance capsules !

should be completed. Additionally, the special procedure which removed the capsules did not

!

contain a surveillance procedure completion form. This completion form is typically used at Millstone to track the status of a surveillance. The completion form also contains the j surveillance procedure acceptance criteria. Therefore, when the Unit I reactor engineering ;

personnel removed the surveillance capsules from the vessel, they were not reminded of the l

'

timeliness criterion for analysis of the sample. In addition, an approved station tracking system was not being utilized to remind personnel that a surveillance had not been completed. Based upon this review, the inspector concluded that inadequate administrative controls over the removal and testing of the capsule contributed to this issu To improve administrative controls over the removal and testing of the surveillance capsules, Unit 1 engineering decided to take the following action: (1) the Unit I surveillance procedure which governs removal and testing of the surveillance capsules will be revised to specify when analyses of the surveillance capsules should be completed; and (2) a surveillance procedure completion form that contains a required completion date for the surveillance would be added to the removal procedure. The completion form would be sent to the cognizant corporate individual when a capsule was removed and thereby serve as a reminder to that individual that the analysis and report have not been complete The inspector considered that the revised administrative controls and identification of a responsible grcup to track completion of the surveillances should prevent recurrence of the even The failure to submit the topleal report to the NRC within one year of removal of the surveillance capsules is a violation of 10 CFR 50 Appendix H. Ilowever, this event had minor safety significance since the operating curves for the reactor vessel had not expired. Additionally the licensee identified the problem and the corrective action should prevent recurrence of the event. Therefore per section VII.B of the enforcement policy, enforcement discretion was exercised and no violation will be issue .2 Diesel Generator Failure to Start - Unit 1 On November 17,1992, while stempting to run the Unit I diesel generator to verify operability following meter calibration activities, the diesel generator would not star Licensee troubleshooting operations determined that a test switch which is positioned during the monthly diesel generator operability tests to selectively test the two redundant diesel generator air start valves failed. The failure mode prevented the selected air start solenoid from receiving an open signal when a diesel generator start signal was supplied. The switch position also prevented the redundant solenoid from operating. According to the licensee, the switch of coacern was installed in 1983. Prior to installation of the switch, both air start solenoids valves would receive open signals when a diesel start signal was supplied. However, the test switch was installed when the licensee realized that testing methodology prevented identification of an individual solenoid valve failur ___ _ __

_ _ . _ _ _ _ - _ _ _ . _ __ _ _ _ _ _ _ _ _ - - _

. .

I

To restore the diesel generator to an operable status, the licensee replaced the switch and retested the diesel generator later that da The degraded switch was subsequently sent to the manufacturer, General Electric, for root cause analyses of the failure. At the close of the report

, period, the analyses had not been complete The inspector witnessed the majority of the troubleshooting operations conducted on the diesel generator and verified that the licensee applied a systematic troubleshooting approach and followed administrative control processes. The inspector noted that within minutes of the initial diesel generator start failure, engineering and production test personnel had developed a well thought out troubleshooting plan. The rapid response to the event limited diesel generator out l

of service time to about ten hour l

'

l

' Performance Testing of Safety Related Ventilation Systems - Unit 2 In early 1991, NRC evaluated the operability of the emergency diesel generator room ventilation systems and identified the lack of their performance mcaitoring as a deficiency. The findings are documented in Millstone 2 Inspection Report 50-336/91-04. In response, the lleensee

, initiated a program to inspect and test all safety-related ventilation systems during the 1992 refueling outage, l

The licensee performed detailed walkdowns of the ventilation systems to assure that plant configurations were adequately reflected in architect-engineer (Bechtel) drawings and piping and

,

instrumentation diagrams Minor discrepancies, primarily involving distribution registers, were found. Drawing change notices were initiated and 21 drawings were changed. The discrepancies

'

would not have affected system operabilit The licensee developed a comprehensive series of procedures (EN-21063) to implement the program. A generic flow calculation procedure provided uniform methods for calculation of

'

volumetric flow and velocity consistent with the standards contained in Sheet Metal and Air Conditioning Contractors National Association,11 eating, Ventilation and Air Conditioning (HVAC) System Testing, Adjusting and Balancing (1983). A contractor / vendor liVAC air balance procedure provided general guidance for test performance including requirements for interfacing with licensee engineering, operations, health physics, and quality control staffs, and disposition of discrepancies and nonconforming conditions. Generic acceptance criteria were provided for safety and nonsafety-related modes of operation. Nineteen data forms were provided to assure consistent documentation of the tests including logs, prerequisite sheets, test instrument calibration records, damper lineups, as found conditions, component performance data, and system restoration verification. Individual systems were tested in accordance with subtier procedures which contained detailed guidance for test performance and unambiguous acceptance criteria. Applicable Final Safety Analysis Report (FSAR) figures, drawings, process flow diagrams, and operating and surveillance procedures were referenced. Each procedure contained appropriate technical specification requirements for system operability, and included a detailed safety evaluation. The inspector found that the acceptance criteria were consistent with the FSAR and related design document _ _ _

___ ,

. _ _ __ _

. .

The licensee identified material and performance discrepancies in most of the seven major systems tested during the outage. Where appropriate, the licensec initiated plant incident reports (PIRs) to determine the cause of the problerns and to document and track corrective actio Where nonconforming conditions resulted in a PIR, plant management was briefed and the operability of the associated safety systems was evaluated using engineeringjudgement, operating experience, and surveillance test results, in most cases, the systems were not required to be operable by technical specifications when the conditions were discovered. The inspector reviewed the following PIRs:

• 2-92-074 and 2 92-138, Diesel Generator Room

• 2 92-040, Inoperable EDFS dampers

• 2 92-050, EBFS Fan Damper Stuck Open

• 2 92-084 and 2-92102, Control Room Ventilation

• 2 92-094 and 2 92-081, Control Room In-Leakage Tests

• 2 92-148, ESF Room Potential Design Deficiency The licensec repaired or replaced damaged equipment and restored system performance to design requirements. The inspector found that the licensec satisfied applicable license and regulatory requirement The licensee evaluated the performance test results and determined that the root cause of the discrepancies was lack of a formal maintenance and surveillance test program for system components, backed up by integrated performance testing. This resulted in failure of dampers and their actuators, the most common cause of the poor test results. The lleensee has developed, and management has approved, a preventive maintenance program which will include periodic flow tests, stroke tests of dampers, and a preventive maintenance program for dampers blades and bushing Two reportability/ operability evaluation forms (REFs) were initiated involving potential design deficiencies associated with the auxiliary exhaust mode of the EBFS and the ESF equipment rooms. NRC review of the EBFS discrepancies is documented in Millstone 2 Inspection Report 50-336/92-14 Other discrepancies caused the licensee to question the operability of the equipment in the 'C' (Swing) ESF equipment room _when aligned to the Facility 1 ventilation systems. The licensee has been aligning the affected equipment to the Facility 2 ventilation system during the outage. The licensee had not yet formulated administrative controls to prevent aligning the swing equipment room to the questionable Facility. This issue was reviewed in detail by the Operational Safety Team Inspection prior to the plant restart in January 1993, and is documented in Inspection Report No. 50-336/92-3 During the outage, the inspector walked down major portions of the control room, diesel generator room, and DC switchgear room ventilation systems, the containment air recirculation system, and the enclosure building filtration (EBF)/ auxiliary exhaust ventilation systems to assess material conditions and maintenance practices. Periodically, the inspector discussed the test

___

---e n - - -.,. ----d-,s1-- AK1- L--; -~- -+ - - + " - uAm

. .

21 program and its results with licensee and vendor personnel in order to assure that technical

specincation requirements and operability /reportability determinations were performed in a timely manne ,

The inspector concluded the licensee developed an aggressive and comprehensive program to recapture the design basis of safety related ventilatior. systems at Millstone 2. The program was implemented with high quality procedures with appropriate safety evaluations. Coordination among vendor and licensee staffs was excellent. All discrepancies were adequately documented and properly dispositioned. The inspector assessed the licensee's operability evaluations using technical speciDcations and the guidance contained in NRC Generic Ixtter 91-18, 'Information To Licensees Regarding Two NRC Inspection Manual Sections On Resolution Of Degraded and

.

Nonconforming Conditions and on Operability," and identined no dc0ciencies. The inspector

'

agreed with the root cause identined by the licensee and considered that the proposed corrective actions adequttely addressed i .4 Ilydrostatic Test of New Steam Generators - Unit 2

The licensee performed a hydrostatic test to 125 percent of design pressure (1250 psig) on the secondary side of the replacement steam generators and the affected portions of the main steam, main and auxiliary feed, steam generator blowdown and wet layup systems. The test also satisfied the requirements for the 10-year inservice inspection of secondary systems. The test was performed in accordance with sections 111 and XI of the ASME Doller and Pressure Vessel

'

Cod The inspector reviewed inservice test IST-91-04, " Replacement Steam Generator Secondary Side flydrostatic Test." The procedure included clear scope and objectives, appropriate technical references, system limitations and precautions, prerequisite signoffs, system lineup check sheets, data recording sheets, and unambiguous acceptance criteria. The procedure was of good quality overall. The inspector noted that the minimum metal temperature of the #1 steam generator was required to be maintained higher than the original equipment specifications due to an indication (considered to be due to weld porosity) at the top head dome. The elevated temperatures were

'

needed to assure adequate fracture toughness during the test. The temperature requirement was met by maintaining local metal temperature with heating blankets and using water heated to 190*F in the condensate storage tank (CST).

The licensee used auxiliary feedwater (AFW) system to fill the steam generators from the CS Since the required water temperature was considerably higher than normal, the inspector

-

questioned whether the CST liner, AFW piping, and the AFW pump had been analyzed for this condition. The inspector was concerned that the tank liner, pipe supports, or AFW pump bearings or glands might be damaged. The inspector found that only the CST liner had been considered in a safety evaluation accompanying the connection of an auxiliary boiler to the CST heat exchanger. The licensee contacted the AFW pump vendor and performed calculations to establish net positive suction head requirements for the pump. The calculation resulted in establishing a minimum water level in the CST which was incorporated into the test procedur _ - _ .

. .

1 Temperature limits were established for AFW pump bearings and glands and a watch was posted )

to monitor temperatures and pump performance. Licensee engineers performed a pipe stress analysis for the affected AIM piping and concluded that the system would not be overstresse The procedure was modified to require system walkdowns and temperature monitoring. Finally, the CST liner was inspected at the conclusion of the test. The inspector had no further concerns regarding the test procedur The inspector attended a pre test brienng in the control room on December 3. The brienng was conducted by the shift test director and attended by all personnel assigned to the test. The inspector noted that the briefing was comprehensive and covered operating limits, major evolution milestones, test boundaries, safety precautions, pressure control, acceptance criteria, and contingency actions. The inspector determined that the test director was well prepared for the brienng, and questions were addressed adequatel The inspector observed portions of steam generator fill and vent, pressuritation and de-pressurization, and draining. The operations staff performed the test in a professional manner and properly utilized normal and special procedures. Pressuriration of the steam generators was performed in a deliberate manner with holds at specified intervals for system inspections. The inspector observed good coordination and communication among the personnel involved in the test. The inspector accompanied a test engineer on a tour of the AFW system during system fill and noted no discrepancies. AFW pump and steam generator test pressure gauge watchstanders i knew the limits imposed in their areas of responsibility. When required, changes to the procedure were processed in accordance with administrative procedures prior to continuing with the test. Shift turnover briefings were thoroug Numerous prcblems considerably catended the duration of the test. Due to low temperature in the containment and the large mass of uninsulated metal involved, steam generator wall temperature requirements proved to be difficult to maintain. Many time-consuming drain and refill cycles were required to assure that the requirements were met. Boundary leakage through valve 2-MS-3A (manual isolation valve for #1 steam generator atmospheric dump valve) required replacement of the seal ring. The leakage wetted down the local cabinet of stack gas radiation monitor RM 5132, which was declared inoperable. Operators entered the technical specification action statement and performed backup grab samples as required. A plant incident report was initiated to evaluate the incident. The pressure gauge at the hydrostatic test pump froze up due to inadequate freeze protection. However, this gauge was for information only, and the pump operator was in constant communication with the control room and the official test gauge watchstanders. On the first attempt at pressurization, the temporary relief valves installed on the

1. 2 steam generator prematurely lifted at 1210 psig and had to be replaced. Since the valves had been tested successfully prior to installation, the inspector concluded that the setpoint may have been affected by the higher temperature of the water used during the test. The condition had no adverse impact on safety. Once these problems were resolved, the test was performed smoothly and successfully. The licensee demonstrated at all times an appropriate regard for equipment and personnel safet ..,e g .-,e -

_ _ _ _ _ _ _ - _ __ _ _ _ ___ - ___ _ _ _ _ -

. .

The inspection consisted of procedure review, independent verification of test prerequisites and system lineups, attendance at pre-evolution briefings, field walkdowns, observation of control room activities, and discussions with licensee and vendor personnel. The inspector concluded the steam generator hydrostatic test was directed and conducted properly using a good quality procedure. One concern noted by the inspector regarding AFW system design limits was addressed adequately by the licensee. The problems encountered dur!ng the test were appropriately resolved with due consideration for personnel and equipment safet .0 ENGINEERING /TECIINICAls SUPPORT (IP 37700, 37828) Safety Evaluation Review Unit 1

"

Introduction During this Inspection, the lleensce's program for performing plant changes, tests, and experiments, under the provisions of 10 CFR 50.59, " Changes, Tests and Experiments," was reviewed for Millstone Unit 1. The inspector reviewed aspects of the program including implementing procedures, training, and specific examples of 10 CFR 50.59 determination Procedures The licensee has established formal procedural guidance and controls to evaluate cach change, test, and experiment (CTE), for which 10 CFR 50.59 is applicable, and to determine whether an unreviewed safety question (USQ) exists or a change to the technical specifications is required. The licensee ba!.cs the determination on an assessment of the impact of the croposed CTE according to the criteria of 10 CFR 50.59. The licensir.g basis accident analyses and the technical specifications also provide guidance for making the determinations. Formal procedure guidance is contained in Administrative Control Procedure (ACP), ACP-QA-3.08, " Safety Evaluations (NEO 3.12)," and in Departmental Instruction No.1-ENG-1.13, " Format for Safety Evaluations." The preparer of the safety evaluation follows the safety evah m format (Figure 7.2 of procedure ACP-QA-3.08 or Attachment 1 of instruction 1 ENG 1.13). These guides enable the preparer to address (1) the 10 CFR 50.59(a)(2) criteria by asking the seven questions from NSAC-125, Section 3.1; and, (2) to deter nine if an integmted safety evaluation of the affect on the licensing basis accident analyses is required. The Departmental Instruction uses the requirements of procedure ACP-QA-3,08, but changes the format slightly. The inspector noted that two different formats were being used for safety evaluations and discussed this with the licensee. 130th the instruction 1-ENG-1.13 and procedure ACP-QA-3.08 formats adequately address the 10 CFR 50.59(a)(2) criteria. The licensee stated that it would investigate the possibility of using just one or whether both were ner: le The licensee has established a process to determine if a safety evaluation is needed for all proposed plant design changes; jumper, lifted leal, and bypass control changes; setpoint changes; and station procedure changes. Procedure ACP-QA-3.10 " Preparation Review and Disposition of Plant Design Change Records PDCRs (NEO 3.03)," provides formal procedural guidance for determining if a safety evaluation or an integrated safety evaluation must be performed per procedure ACP-QA-3,08 for plant design changes. The procedure allows the licensee to I

. _ _ _ _ _ - _ _ _

. .

complete either a long-form or short-form PDCR. Short-form PDCRs are utilized for simple changes of limited scope and may or may not require a safety evaluation to be written. The inspector reviewed several short form PDCRs and noted that in some instances, the licensee answered all the questions to whether a safety evaluation should be written no, but still wrote a >

safety evaluation. The inspector discussed the adequacy of the questions in the shor:-torm with the licensee who stated that it has formed a review team which is currently determining when 1 a safety evaluation should be written for any change. The team is putting together specific questions which would apply to all plant change: ;o better direct the licensee as to when to write a safety evaluation. The inspector considers this a good initiative which will be helpful for, not only PDCRs, but for other 10 CFR 50.59 determinations which may require a decision v/hether a safety evaluation should be writte Jumper, lifted lead and bypass control changes are addressed in procedure ACP-QA-2.06 B, Rey,12, " Jumper, Lifted Lead, and Bypass Control Changes." For these changes, a safety evaluation must be performed per procedure ACP-QA-3,08 if any technical or safety assessment questions on the jumper device control sheet are answered "yes" or " don't know." This sheet is used to help identify any adverse affects of the change. Setpoint change evaluations have been incorporated into procedure ACP-QA-3.10 and now undergo the same process as PDCR Procedure changes are addressed in procedure NEO 8.06, " Safety Evaluations for Station Procedures." Changes to test procedures are also covered under procedure NEO 8.0 In summary, the inspector verified that the licensee has established formal procedural guidance and controls to evaluate nch CTE, for which 10 CFR 50.59 is applicable, to determine whether an USQ exists or a change to the technical specifications is required. The inspector concluded that adequate guidance exists and that the licensee's initiative to further define when a safety evaluation is needed is a positive step in improving the overall proces Training The inspector reviewed the lesson plan used during the licensee's Safety Evaluation training course. Lesson plan SE.01 covers the overall licensing process and goes into depth on the specific wording of 10 CFR 50.$9. The Safety Evaluation course dso provides a period at the end when students write their own safety evaluations based on previous plant changes. The inspector concluded that lesson plan SE.01 adequately covers the subject material. The inspector noted, however, that the handout used for the course provides a copy of the safety evaluation format contained in procedure ACP-QA-3.08, but does not contain a copy of the format contained in Departmental Instruction No.1-ENG-1.13. This concern was presented to the licensee and was acknowledged. During an NRC inspection conducted from December 2 to 6, 1991, the inspectors noted that the lesson plan did not cover the topic " margin of safety" in sufficient duil. The licensee addressed this concern and the present lesson plan, SE.01, covers

" margin of safety" adequatel The inspector reviewed the training records to verify that individuals that had performed 10 CFR 50.59 deterininations, had received the Safety Evaluation training. Ti:e review showed that all of the site engineering personnel who wrote safety evaluations had received training and had

- ___-_

.

. .

proper documentation in their training jackets. However, the inspector noted that a significant number of corporate personnel who had written safety evaluations had not received the trainin The inspector discussed this with the licensee who noted that they are in the process of changing their training program at the corporate level. As part of this change. te licensee would require that each individual who writes safety evaluations to take the Safety Evaluation course or be exempied from the training by personal observation by the individual's supervisor who could verify that individual was qualified (experience plus knowledgeable of 10 CFR 50.59) to prepare safety evaluations, This is part of the licensee's initiative in response to the National Academy for Nuclear Training document, Guidelines for Training and Qualifications for Engineering Support Personnel. The inspector considered this a good initirtive on the licensee's part, but also stressed the importance of the training. Based on the & the inspector concluded that the training on 10 CFR 50.59 was adequate.

'

Reviews of 10 CFR 50.59 Determinations The inspector selected specific examples of 10 CFR 50.59 determinations from those reported to the NRC by letter dated February 27, 1992. This letter transmitted the licensee's annual report of plant changes and tests for 1991. Safety Evaluations were reviewed from each change category (PDCRs, procedure changes, jumper, lifted lead and bypass changes, setpoint changes and tests). In addition, severt' safety evaluations from 1992 were reviewed to evaluate the

'

changes the licensee made to the overall process since the NRC inspection of 10 CFR 50.59 conducted from Decembet to 6,1991.

'

While all of the safety eukations that were reviewed by the inspector complied with the requirements of 10 CFR 50.59, a few of the 1991 safety evaluations were of marginal qualit This was also noted in the previous inspection 50-245/92-04, which covered the safety

'

evaluations written during 1990. Due to the last inspection not being conducted until December 1991, the licensee's procedural changes to address the weaknesses did not go into full effect until 1992, The inspector reviewed several safety evaluations from 1992 and noted an improvement in both quality and conten Conclusions l The inspector concluded that Millstone Unit I complies with the evaluation process of 10 CFR 50.59 for changes, tests, and experiments. No immectate safety significant concerns were identified and the inspector noted that the change to the safety evaluation format and management

'

attention to the overall 10 CFR 50.59 process are positive steps and show good management oversigh .2 Refueling Equipment Upgrade Modifications - Unit 2 The inspector reviewed the licensee's modification to the containment refueling machine under plant design change record (PDCR) 2-087-91, " Refueling Equipment Upgrade Modifications."

The licensee made this modification to improve the reliability, maintenance, and operation of the refuel machine in containment. The existing refuel machine control console, power control center, and mechanical hoist were replaced with a new, removable, computerized control

l

. .

26 i console. The hoisting frame and related load cell components were replaced with a new analog load weighing system. Lastly, the licensee replaced a damaged section of the trolley track, cabling, and hardwar The inspector reviewed the design concept, safety evaluation, and test plan to assure that the 1 I

modification was prepared in accordance with the applicable procedures. This modification was prepared as a non safety-related PDCR short form and therefore a full safety evaluation was not required by procedure ACP-QA-3.10, " Preparation, Review, and Disposition of PDCRs (NEO

-

3.0.3)." Rather, the licensee prepared a "short form" evaluation consisting of seven questions designed to ensure that the design change did not require a safety evaluation and plant operations review committee (PORC) approval prior to implementation. The inspector noted that although

, the refuel machine movement controls were changed from analog to computer directed controls and interlocks, the licensee had not evaluated the impact of the new computer controls on the probability of occurrence of a previously identified malfunction (leading to a fuel handling accident) of equipment important to safety. The inspectors were concerned that the new computer controls presented the potential for an unevaluated failure of the fuel handling equipment to lead to a fuel handling acciden On November 20, the inspectors discussed with the licensee specifics of the design change relating to control of refueling bridge movements and interlocks, the potential for fuel handling accidents, and the assurance of the quality of the co:nputer software. The licensee agreed that these aspects of the design change had not been fully addressed in the short form evaluation and

'

.

prepared an additional safety evaluation in the format of a PDCR long form evaluation. This second evahiation was PORC approved and attached to PDCR 2-087-9 On December 2, a conference call was convened between the licensee and NRC's Office of Nuclear Reactor Regulation. During this call the licensee described the modification and console

-

computer controls, and addressed NRC questions regarding the bridge movement interlocks. The NRC concurred with the licensee that the probability of a fuel handling accident was not increase The inspector noted that the second (long form) safety evaluation was a significant improvement over the first (short form) evaluation in that the specifics of a change from manual control of the refuel bridge to computer controls were addressed. The inspectors observed selected portions of the post-modification testing and refuel bridge operations during reactor core reloa Refueling bridge operations were smooth and executed without incident. The inspectors had no further concerns.

.

.

. .

27 Auxillnry Building Filter System Modifications - Unit 3 Millstone Unit 3 started up on November 4,1992, after completing modifications and testing of the auxiliary building filter system (ABFS). The unit had been shutdown since September 29 due to both trains of the supplemental leak collection and release system (SLCRS) being declared inoperable (see NRC inspection report 50-423/92-24).

,

The SLCRS is designed to ensure that any containment leakage into the enclosure building and

'

contiguous buildings during a loss of coolant accident will be filtered prior to discharge to the atmosphere. The ABFS is designed to control the release of radioactive material from the area of the charging pump and reactor plant component cooling water pumps and heat exchangers in the auxiliary building by directing these releases through a filtered path. The ABFS also maintain these areas above 65'F. The system assists SLCRS in maintaining a negative pressure within the secondary enclosure around containment. The two systems work together to draw and maintain a negative vacuum (0.25 inch water gauge) inside the secondary enclosure buildings within 50 seconds of a design basis acciden i The licensee established a task force to resolve concerns identified with the SLCRS and the ABFS. As a result of their investigation, the licensee developed both short and long-term solutions to resolve the identified concerns. As part of the short-term solution, the licensee developed a plant design change ocord (PDCR) to modify the ABFS control circuitry, sequence timing, and control dampers such that the system will operate satisfactorily in conjunction with

, SLCRS to draw the required vacuum following an accident signal. The modified damper alignment necessitated additional heating in the auxiliary building to ensure that the charging and reactor plant component cooling water areas would be maintained above 65'F when outside air temperature is below 17'F. To accomplish this, the licensee installed temporary local heaters in the auxiliary building. However, because the local heaters were originally powered from non-emergency power sources, this heat source would not be available during a loss of power (LOP)

accident when only the emergency diesel generators (EDGs) are supplying the AC power sourc The licensee subsequently initiated a bypass jumper to change the heater power sources so they would be available following an LOP event. The licensee stated that final long-term solutions may require significant modifications to the system design and that this work is being scheduled to be completed during the next refueling outage (August 1993).

The plant started up on November 4 after modifications and testing of the ABFS were complete On November 12 the licensee requested an amendment to its operating license to allow credit for use of the temporary heaters in the event outside air temperature decreased below 17'F. NRC approval was necessary because the temporary wiring to the heaters could not be fully qualified to nuclear industry standards. On December 9 the NRC issued an amendment to Unit 3 technical specification (TS) to allow credit of the temporary heating source until the next refueling outag Long term corrective actions include fm' al plant modifications and revision of the system integrated surveillance procedure . .

The inspectors reviewed the PDCR, bypass jumpers, and procedure changes; monitored the inservice testing, and attended several related plant operations review committee (PORC)

meetings. The inspectors noted during a review of the PDCR that the licensee replaced the analog inlet plenum pressure instrument and control system with a digital system. After review and consultation with the NRC Office of Nuclear Reactor Regulation, the inspector determined that the modification did not pose an unreviewed safety question because it only involved one train (B) of the syste The inspectors reviewed the plant procedures which were affected by this PDCR to verify that appropriate and accurate revisions were made. The procedures affected included emergency and

'

normal operating procedures, and surveillance procedures. The licensee correctly incorporated all of the necessary procedure changes with the exception of changes to Operations Procedure 3314A, " Auxiliary Building Heating, Ventilation and Air Conditioning," Revision 10, dated November 2,1992. The inspectors identified several technical, administrative, and human factors deficiencies in this procedure which related to the PDCR specifically. Examples of the technical inaccuracies included the omission of low temperature monitoring of the 'B' charging pump cubicle, and the implication that the variable inlet vanes (VIVs) are closed on low temperature when in fact the VIVs are controlled by inlet plenum pressure indication Administrative and human factors errors existed in references to technical specification action statement entry when equipment is taken out of service; operator actions when high temperature conditions persist; and the use of procedure notes to state that several steps of the procedure are not to be used rather than deleting the steps during the revision process. The inspectors discussed these deficiencies with operations department personnel on November 24. The licensee acknowledged that errors existed in Revision 10 and stated that Revision 11 was issued on November 17 to correct these deficiencies. The inspectors reviewed Revision 11 with the licensee to verify the accuracy of this new revision; several technical deficiencies still existed, The inspectors' comments and questions were passed on to the engineering department, Engineering personnel responded to these questions by an internal memorandum dated December 11. The inspectors reviewed the responses to the questions developed during the review of Revision 10. All of the questions were addressed completely. The memorandum provided clarifications to the operations department for revision of procedure OP 3314A On December 21 the licensee informed the inspectors that Revision 12 was being prepared which will include the information provided by the engineering department. The inspectors noted that no appreciable changes to procedure OP 3314A are required as a result of the December 9 technical specification change associated with ABFS because procedure OP 3314A is reliant on charging pump cubicle temperatures rather than outside air temperature; these operating restrictions are still applicabl The licensee convened several PORC meetings during the development and approval of the PDCR. The inspectors observed that engineering was not always adequately prepared for the PORC presentations for the numerous testing and design changes for the ABFS, In addition, the PORC review of procedure OP 3314A did not identify and correct the deficiencies noted by the inspecto . .

The inspectors concluded that, considering the techmcal complexity of the ABFS/SLCRS design problems, the licensee fully identified the scopc of the problem and developed and implemented a thorough short term resolution to this problem. The period required for completion of this evolution was prolonged and the inspectors noted several areas for improvement. These included: clearer communication of design requirements and limitations for incorporation into the operating procedures; more accurate and complete preparation for PORC discussions; and better coordination between the organizations involved in the problem resolutio .4 Bypass Jumper Control - Unit 3 The inspector reviewed selected jumper devices and log sheets at Unit 3 to verify conformance with administrative control procedure (ACP)-QA-2.06B, " Jumper, Lifted Lead, and Bypass Control," with respect to plant operations review committee (PORC) review and approvals, timeliness of technical and safety evaluations, control of scaffolding, and implementation of administrative requirement The inspector verified that a record ofinstalled jumper devices for tempo ary modifications was being maintained by the shift supervisor in the control room. Technical and safety evaluations were being performed as required. The operations department manager audits the bypassjumper log on a monthly basis and identifies those jumpers installed for longer than three month However, the inspector noted that PORC had not reviewed all of those bypassjumpers installed over three months or whose expected removal date was exceeded, as required by procedure ACP-QA-2.06B. As of November 30,1992, there were 42 bypassjumpers installed at Unit 3 for over three months. Twenty-two of these were past the PORC due date for review. In addition, the inspector identified that the requirement to submit the quarterly summary memorandum to the Executive Vice President for jumper devices installed over six months had also not been performed since August 1991. The inspector informed the engineering manager of these discrepancies. The in:pector was informed that there appeared to have been miscommunication between the engineering and operations department on which department would generate the summary memorandum. The licensee stated that the quarterly summary memorandum would be generated within a couple of weeks and that the engineering department is working on the backlog of bypass jumpers for PORC revie A May 1992 revision to the ACP for control of scaffolding specified that if scaffolding is to be installed for greater than 90 days, a bypass jumper shall be initiated per proced ~e ACP-QA-2.06B. The inspector performed a walkdown of the scaffolding installed in Unit 3 ar.d reviewed the bypass jumper log. Bypass jumpers were not initiated for any scaffolding. During a tour of selected areas of the Unit 3 auxiliary and diesel generator buildings, the inspector identified six scaffolding installations which were greater than 90 days old. The inspector informed the maintenance engineer of the administrative oversight and was informed that bypass jumpers would be processed for the scaffolding which was installed for over 90 days. A mview of bypass jumpers for the other Millstone units indicated that this requirement was not being implemented throughout the site. The inspector concluded that there may be a problem'with dissemination of information to site personnel when new administrative requirements are im. pose . .

The lack of adherence to administrative procedure requirements was previously discussed in regards to the plant incident report backlog in NRC inspection report 50-423/92-24. Due to the

,

additional examples identified above, the failure to properly implement administrative requirements is a violation of Technical Specification 6.8.1 (50-423/92-28-006). Incorporation of Plant Modifications Into Design Documentation - Units 1 and 3 While reviewing the status of open Unit 3 Plant Design Change Records (PDCRs), the inspector noted that the changes implemented by Unit 3 PDCRs 1-91-45 and 1-91-75 were not yet incorporated into the Unit 3 design documents including the Final Safety Analyses Report (FSAR). The PDCRs were implemented during the February-April 1991 refuel outage and were utilized by the licensee to change a spring in three relief valves installed on the Safety Injection (SI) system, and to raise the operating pressure of the Unit 3 SI system. The SI system was turned over to the operations department and declared operable on April 11, 1991. According to the licensee, the PDCRs were not administratively closed since various licensee data bases such as the Production Maintenance Management System, and Material Equipment Parts List and the Unit 3 Final Safety Analyses Report (FSAR) had not been update The inspector was concerned that if design documentation was not updated in a timely manner, personnel who referred to those documents to make subsequent plant design changes or to evaluate the significance of an event may utilize the outdated information. Consequently, inaccurate assessments of events may result or improperly designed modifications may be installed. This administrative weakness wts not limited to Unit 3. In Unit 1, the inspector noted that PDCR l-88-24, which was used to re-rack the spent fuel pool in the 1988-1989 time period and turned over to the operations department on April 13, 1989, was still open and the FSAR had not been update The inspector reviewed procedure ACP-QA-3.10, " Preparation, Review and Disposition of Plant Design Change Records," and noted that the procedure did not restrict how long a PDCR package could remain open pending implementation of the documentation following the chang Therefore, the potential existed for a plant modification to be installed in a plant and not be incorporated into applicable design documentation for the remainder of the licensco life of that facilit The inspector noted that the NRC expects design documentation to be updated in a timely manner. This expectation is reflected in 10 CFR 50.71(e)(4) which requires the licensee to update the FS AR annually or 6 months after each refueling outage provided the interval between successive updates to the FSAR does not exceed 24 months. The revisions must reflect all changes up to a maximum of 6 months prior to the date of filing. Based upon the inspector's review, the changes implemented by the above listed Unit 1 and 3 PDCRs should have been incorporated into their respective plant's FSAR in subsequent FSAR update submittals dated November 3,1989, and February 25,1992, respectively. The failure to update the FSAR as I required by 10 CFR 50.71(e)(4) is a violation (50-245/92-29-007).

i

, .

31 , Steam Generator Replacement Post Weld IIcat Treatment Review - Unit 2 The inspector reviewed the post weld heat treatment (PWHT) history and appropriate documentation reharding the upper steam generator (SG) girth welds and the RCS cold and hot leg nozzle to piping welds. In addition, the results were discussed with the principal welding engineer for the steam generator replacement project. The PWHT for both girth welds and the RCS piping welds met ASME code requirements with regard to temperature (1150*F +/- 25'F),

time (6 hrs, girth,2-1/2 hrs piping), and heating and cooling rates. Thermal gradient deviations l were recorded for zones outside the girth weld zones in both SGs, but these were considered acceptable on the basis of finite stress analyses. The inspector had no further concern .0 SAFETY ASSESSMENT / QUALITY VERIFICATION (IP 40500,90712) Review of Written Reports Periodic and Special Reports, and Licensee Event Reports (LERs) were reviewed for root cause and safety significance determinations and the adequacy.of corrective action. The inspectors determined whether further information was required and verified that the reporting requirements of 10 CFR 50.73, station administrative and operating procedures, and technical specifications 6.6 and 6.9 had been met. The following reports and LERs were reviewed:

LER 245/92-26 Service Water System Rendered Inoperable Due to Degradation LER 245/92-27 Degraded Fire Barriers Not Reported as Required i

Unit 1 Monthly Operating Report for October 1992, dated November 17, 199 Unit 1 Monthly Operating Report for November 1992, dated December 11,199 Unit 2 Monthly Operating Report for October 1992, dated November 9,1992.

!

Unit 2 Monthly Operating Report for November 1992, dated December 10, 1992.

-

- Unit 3 Monthly Operating Report for October 1992, dated November 6,1992.

i Unit 3 Monthly Operating Report for November 1992, dated December 10, 199 The inspectors determined the reports reviewed were acceptable based on required information, content, and qualit .2 Search for Potentially Substandard Flanges (NRC IN 92-68) '

On September 10, 1992, the NRC issued Information Notice (IN) 92-68, "Potentially Substandard Slipen,- Welding Neck, and Blind Flanges," which informed the licensee of the

!

T

,

E _ .

_ _ _ s O

32 discovery of substandard flanges which originated from the People's Republic of Chin Numerous flanges have been identified throughout the country that contain cracks, inclusions, and slugged weld repairs, and/or were constructed from two pieces of materia On December 18, the inspectors met with licensee representatives to discuss the status of their search for these materials at Millstone. Procurement engineering personnel have completed a search of the site warehouse for carbon flanges from foreign manufacturers. The licensee found only one flange imported from China. Hardness testing was performed on this flange, as well as on sample of flanges from each exporting nation. All of the test results were satisfactor The China fiange was purchased as non-QA material for non safety-related us The licensee has initiated a review of purchase orders to determine if any China flanges were purchased and installed in the plants. So far, no purchase records for these suspect materials have been identified. The licensee is confident that none were purchased but is continuing the purchase order revie The licensee received notification from a vendor (General Electric) that the potential exists that the vendor supplied some of the suspect flanges. Accordingly, the licensee is pursuing a vendor supplied equipmen No significant deficiencies were identified.

. Plant Operations Review Committee - Unit 2 The inspector attended meetings of the Plant Operations Review Committee (PORC) on November 20 and December 16. Items discussed included update and closure of licensee event report 50 336/92-04 regarding entry into Mode 3 with a high pressure safety injection train inoperable; plant design change concerning steam generator atmospheric dump valve gasket modificaticas and replacement of heater drain system spargers; and proposed modifications to engineered safety features actuation cabinets modules to eliminate spurious electrical feedback signals to the loss of normal power sequencer timers. The inspector observed that the technical specification administrative requirements for the meetings were satisfied and that the committee discharged its functions in accordance with regulatory requirements. The inspector noted

, thorough discussions of the matters presented to the PORC, and a good regard for safe operation

'

of Millstone Unit .4 Followup of Previous Inspection Items 7.4.1 Control of Scaffolding Unresolved item 423/91-01-06 involved the apparent programmatic weaknesses in the licensee's scaffolding program. Some programmatic weaknesses identified included the lack of post-installation scaffolding inspection, the lack of time limits placed on unused scaffolding, the lack l of concise guidance on scaffolding clearance from safety related equipment, and whether an i

i

. _ . . .

~ o

unreviewed safety question (USQ) was created by the installation of the scaffoldin Administrative control procedure (ACP) 2.19, " Scaffolding Program," was revised in May 1992 to address these concerns. The inspector reviewed the new revision to the procedure and concluded that it was adequate to address the apparent weaknesses, with the exception of whether the installation of s.aaffolding creates a USQ. The insps.ctor noted that an engineering evaluation was required for some scaffolding; however, there was no guidance on how to perform the evaluation to ensure that an adequate 10 CFR 50.59 evaluation is performed when necessar This issue remains open pending NRC review of the licensee's efforts to enhance the performance of safety evaluations as discussed in section 6.1 of this repor .0 MANAGEMENT MEETINGS Periodic meetings were held with station management to discuss inspection findings during the inspection period. Following the inspection an exit meeting was held on January 26,1993, to discuss the inspection findings and observations. No proprietary information was covered within the scope of the inspection. No written material regarding the inspection was given to the licensee.

. .

.

. . . . .. .

.. .