IR 05000245/1993005
| ML20035D286 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 04/02/1993 |
| From: | Doerflein L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20035D277 | List: |
| References | |
| 50-245-93-05, 50-245-93-5, 50-336-93-03, 50-336-93-3, 50-423-93-04, 50-423-93-4, NUDOCS 9304130036 | |
| Download: ML20035D286 (30) | |
Text
U.S. NUCLEAR REGULATORY COMMISSION
REGION I
Report / Docket Nos.: 50-245/93-05
,
'
50-336/93-03 50423/93-04 License Nos.:
Licensee:
Northeast Nuclear Energy Company P. O. Ibx 270 Hartford, CT 06141-0270 Facility:
Millstone Nuclear Power Station, Units 1,2, and 3 I
Inspection at:
Waterford, CT t
Dates:
February 3,1993 - March 2,1993 i
Inspectors:
P. D. Swetland, Senior Resident Inspector A. A. Asars, Resident Inspector K. S. Kolaczyk, Resident Inspector, Unit 1
!
D. A. Dempsey, Resident Inspector, Unit 2
R. J. Arrighi, Resident Inspector, Unit 3
,
,
!
l Approved by:
oEu i K c2
lawrence T. Doerflein, Chief Date
'
Reactor Projects Section 4A, DR j
Scope: NRC resident inspection of core activities in the areas of plant operations,
radiological controls, maintenance, surveillance, security, outage activities, licensee self-l assessment, and periodic reports.
!
!
The inspectors reviewed plant operations during periods of backshifts (evening shifts) and l
deep backshifts (weekends, holidays, and midnight shifts). Coverage was provided for 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br /> during evening backshifts and 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> during deep backshifts.
r Results: See Executive Summary
!
!
,
I f
~!
a
.
!
..
.
.
.
-
-
_
_
_
.
,
f
.
!
EXECUTIVE SUMMARY
!
Millstone Nuclear Power Station Combined Inspection 245/93-05; 336/93-03; 423/93-04 Plant Operations Unit 1 operated at full power during the inspection period with the exception of power reductions for routine maintenance and testing. The inspector noted the need for improved
~
operator attention to detail with regard to an isolated equipment tagging error and the administrative control of certain accident monitoring instruments during surveillance tests.
Unit 2 was operating at full power at the beginning of the inspection period. On February 22
'
and 23, two reactor trips occurred due to operator inability to maintain steam generator level control following transients initiated by a failed open main steam atmospheric dump valve and a manual main turbine trip, respectively. The plant returned to full power on February 26.
'
Unit 3 operated at full power during the inspection period with the exception of power reductions for routine maintenance and testing.
Maintenance / Surveillance
'
The maintenance and surveillance activities observed during this inspection were generally conducted satisfactorily. A violation was cited with regard to procedure adherence deviations which occurred during maintenance and surveillance of Unit 2 switchgear room coolers and high pressure safety injection system throttle valves. The operability of safety-related
.
'
switchgear equipment when the respective room coolers are out of service for maintenance was unresolved pending licensee evaluation of the acceptability of the compensatory measures implemented during this inspection period.
Inspector review of the licensee's preparation, monitoring and control of equipment subject to cold weather conditions at each unit found satisfactory system performance. A weakness was
.
!
identified with regard to preventive maintenance on Unit 2 temperature monitoring circuits.
!
Routine monthly testing of local emergency warning system performance was observed during
,
'
this inspection. Some operational / system deficiencies were noted by the licensee and local officials. These issues were effectively corrected.
.
ii
,
-
-
_.
-
.
Safety Assessment / Quality Verification The licensee identified and effectively responded to a missed surveillance test on 4160 volt bus undervoltage protection devices for Unit 3. Also, Unit 3 corrected an inadequate procedure which placed two redundant trains of the residual heat removal system out of
,
service simultaneously. Unit 1 found and replaced a snubber with incorrect performance settings which had been installed in the safety relief system. Enforcement discretion was exercised for these licensee identified and corrected problems due to their low safety consequences and the effective licensee response to these issues. Five open items from previous inspections were closed during this inspection.
'i
!
1 j
iii I
.-
-
-
.
.
r SUMMARY OF FALILITY ACTIVITIES Millstone Unit 1 entered the report period at 100 percent of rated thermal power. Minor power reductions to 80 percent power were conducted on a planned basis to perform turbine control valve, turbine stop valve, and main steam isolation valve testing. During the week of
February 21, drywell floor drain leakage (operating limit 2.5 gallons per minute (gpm))
'
began to trend upward from 0.5 to 0.8 gpm. Following routine cycling of isolation j
condenser valves, the leakage decreased to about 0.56 gpm. The licensee believes that packing leakage from those valves was the principle contributor to the increased drywell leakage. On February 24,1993, power was reduced to 60 percent to repair a leak in a main condenser waterbox. Power was increased to 100 percent on February 25, following
'
plugging of the leak.
i Millstone Unit 2 was operating at full power at the beginning of the inspection period. On February 22, at 1:51 a.m., the reactor tripped automatically on low steam generator level j
when the #1 steam generator atmospheric dump valve failed open. The plant was stabilized J
in mode 3 (Hot Standby). On February 23, fo!!owing repair and testing of the dump valve, the reactor was restaned. At 8:37 p.m., with the reactor at 18 percent of rated power, the operators commenced a rapid power reduction when high vibration was experienced on the main turbine. At 8:40 p.m., the main turbine was tripped manually. Three minutes later the
'
reactor tripped automatically on low steam generator level. The plant was stabilized in Mode 3. Following inspections and consultation with the turbine vendor, a reactor startup commenced on February 24, at 6:26 a.m. The reactor was taken critical at 8:27 a.m., and the main turbine was placed on the grid without incident at 8:46 p.m. Full power operation j
was achieved on February 26, at 2:30 a.m. The unit remained at full power for the balance j
of the inspection period.
Millstone Unit 3 entered the report period at 100 percent of rated thermal power. On Fe5ruary 15, reactor power was reduced to 95 percent for a short period of time while back' lushing condenser water boxes. Power was reduced to 95 percent on February 24 while performing monthly turbine control valve testing. The unit returned to 100 percent later that day and remained there through the end of the inspection period.
2.0 PLANT OPERATIONS (IP 71707, 71714, 93702)
2.1 Operational Safety Verification (All Units)
The inspectors performed selective examinations of control room activities, operability of engineered safety features systems, plant equipment conditions, and problem identification systems. These reviews included attendance at periodic plant meetings and plant tour '
i
..
-
i l
The inspectors made frequent tours of the control room to verify sufficient stafGng, operator procedural adherence, operator cognizance of control roona alarms and equipment status, conformance with technical specifications, and maintenance of control room logs. The inspectors observed control room operators' response to alarms and off-normal conditions.
l The inspectors verified safety system operability through independent reviews of: system configuration, outstanding trouble reports and event reports, and surveillance test results.
The selection of safety systems for review was made using risk-based inspection guidance developed by NRC. During system walkdowns, the inspectors made note of equipment condition, tagging, and the existence of installed jumpers, bypasses, and lifted leads.
l l
The accessible portions of plant areas were toured on a regular basis. The inspectors observed plant housekeeping conditions, general equipment conditions, and fire prevention practices. The inspectors also verified proper posting of contaminated, airborne, and j
radiation areas with respect to boundary identification and locking requirements. Selected J
aspects of security plan implementation were observed including site access controls,
!
!
implementation of compensatory measures, and guard force response to alarms and degraded conditions.
.
J The inspectors determined these operational activities were adequately implemented. Specific observations are discussed in Sections 2.1.1 to 2.2 below.
l 2.1.1 Improperly Positioned Valve - Unit 1 l
While performing a walkdown of tagout 1-82-93-9 on the 'B' drywell nitrogen compressors, the inspector noted that valve 1-AC-1858 was improperly positioned. Specifically, valve 1-AC-185B was in the open position yet the danger tag installed on the valve required the valve to be closed. Valve 1-AC-185B is a 0.25 inch diameter NUPRO valve which is used to isolate the interstage unloader valves located on the nitrogen compressor. When the i
inspector informed the Supervisory Control Operator of this observation, the valve was repositioned to the closed position. The instrument nitrogen compressor was originally tagged out to facilitate compressor disassembly.
l l
The inspector noted that if the piping downstream of the valve was disassembled, nitrogen i
from the drywell compressor receiver could discharge through the valve and into the reactor l
building. However, the inspector considered this issue to be of minor safety significance since any nitrogen leakage through the valve would be limited by the small size of the piping.
The inspector concluded that the slow leak rate should give operators ample time to isolate the leak in the event the piping downstream of the valve was disassembled. Therefore, in this case, the mispositioned valve had negligible effect on personnel and equipment safety.
i
.
__
.
f h
-
The inspector considered the improperly positioned valve to be an tolated occurrence since
,
other valves which the inspector examined were properly positionea and tagging errors have not been previously noted. Nevertheless the inspector's observation is an example of poor attention to detail while tagging out a component. Future examples may result in further NRC action in this area.
- 2.1.2 Emergency Condensate Transfer System Walkdown - Unit 1 The inspector performed a walkdown of the emergency condensate transfer system at
,
Millstone Unit 1. The emergency condensate transfer system at Millstone Unit I supplies a
makeup source of water to the hotwell from the condensate storage tank on receipt of an engineered safety feature signal.
During the walkdown, the inspector verified that valves in the major flow path were properly
positioned, that the condensate transfer pump did not exhibit signs of unusual oil leakage, and
~
that housekeeping in the corner room where the transfer pump is located was adequate.
Based upon the walkdown, the inspector concluded the pump was operable.
2.1.3 Containment Isolation Valve Checks - Unit 3 The inspector checked the position of ten containment manual isolation valves located in the
-
auxiliary building. The inspector verified that the valves were correctly labeled and positioned as required by the applicable system drawing and system valve lineup. The inspector also verified that the monthly surveillance regarding valve position was being performed as required by plant technical specifications. No discrepancies were identified.
2.2 Reactor Trips On Low Steam Generator Ixvel-Unit 2 On February 22, at 1:51 a.m., with the unit operating a full power, an automatic reactor trip
on low level in the #1 steam generator occurred. The event stanu! at 1:44 a.m. when the
'
"A" steam generator atmospheric dump valve (ADV) failed open. Operators promptly reduced main turbine load in order to stabilize reactor coolant system temperature, and unsuccessfully attempted to close the ADV from the main control board and the 10 CFR 50 Appendix R isolation panel. The ADV finally was closed locally by bleeding operating air from the valve positioner. The combination of excess steam demand from the open ADV, which is not sensed by the steam generator level control system, and the main tmtine power reduction decreased feedwater flow to the #1 steam generator and caused level to decrease rapidly. The operators were unable to restore level through manual control of feed regulating valve position and feed pump turbine speed before the reactor tripped on low steam generator
,
level. Level ultimately recovered when the auxiliary feed system automatically initiated. At
!
2:30 a.m., the plant was stabilized in hot standby and auxiliary feed was secured. During the i
i transient, a high voltage condition on the D" linear power ange nuclear instrument generated local power density, variable high power, and thermal margin / low pressure reactor
trip signals on one of four reactor protection system channels. All other safety-related equipment responded as designed.
,
The inspector responded to the control room and veriDed that operators took adequate l
emergency operating procedure post-trip and trip recovery actions. The inspector noted that a professional atmosphere in the control room was maintained. The inspector attended operator debrienngs conducted by the licensee's Duty Officer and On-Site Director of Station Emergency Operations, attended event evaluation team meetings, and discussed licensee findings and root cause evaluations with team members. The inspector concluded that there was appropriate management oversight of the event, that administrative procedures had been
followed, and that the licensee had identified and corrected the cause of the event prior to
authorizing restart of the reactor.
The ADV failed open when the valve positioner range spring became separated from the input diaphragm assembly. This caused control air to open the valve. The break occurred due to a combination of spring misalignment, positioner vibration, and bending of the range spring attachment during installation. The licensee replaced and tested the positioners on both
of the ADVs. The inspector witnessed the retest of the failed ADV and identified no discrepancies. The licensee also inspected six other air-operated valves which utilized similar i
range spring mechanisms and corrected similar misalignment on two of the valves.
The licensee identified the cause of the "D" channel RPS trips to be failure of a high voltage
-
bistable card. The card was replaced and retested satisfactorily.
The inspector witnessed the reactor startup on February 23 and independently verified the licensee's estimated critical control element assembly (CEA) position calculation and pre-startup check lists. During withdrawal of the first CEA regulating group, the primary control operator noticed that he had not recorded initial CEA positions as required by the procedure.
The CEAs were inserted and the data was obtained from the plant computer prior to continuing with the startup. The inspector considered this response to be appropriate, and observed no further procedure deviations during the evolution.
At 8:10 p.m., on February 23, with the reactor at 18% power, a main turbine vibration alarm was received in the control room. By 8:37 p.m., operators had successfully reduced turbine and reactor power belcw the turbine trip / reactor trip setpoint, and then tripped the
.j turbine. This caused the feedwater regulating valves to close and the feedwater regulating bypass valves to start to open toward a programmed 75% open position. Steam generator pressure increased. The operators took manual control of the bypass valves but were unable
to adjust steam generator feed pump speed and feed regulating valve bypass valve position quickly enough to prevent a low level condition in the #1 steam generator. During the licensee's post-trip debriefing, the operators observed that steam generator level had
,
_
'
decreased much faster than expected. The licensee attributed the steam generator level response to the changed level of the new steam generator moisture separator platform and briefed all operating shift crews on the change. The inspector attended two of the briefings and considered them to be adequate. However, the inspector observed that the minimal level t
of training on refueling outage modifications may have contributed to the event.
i The inspector concluded that licensed operator compliance with procedures during these events was adequate. However, more training on feedwater system transient response appeared to be necessary, as both transients appeared to be generally controllable without causing a reactor trip. The licensee has established a task group to review the trips for lessons leamed. In addition, the licensee also has initiated a Human Performance Enhancement System evaluation of operator performance during the trips. The inspector considered these initiatives to be appropriate and had no further questions regarding the events at this time.
.
3.0 MAINTENANCE (IP 62703)
,
The inspectors observed and reviewed selected portions of preventive and corrective maintenance to verify compliance with regulations, use of administrative control procedures and appropriate maintenance procedures, compliance with codes and standards, proper QA/QC involvement, proper use of bypass jumpers and safety tags, adequate personnel
-
protection, and appropriate equipment alignment and retest. The inspectors reviewed portions of the following work activities:
- M1-93-01936 -
Visual Inspection of 4.16 kV Breaker
- M2-93-02399 -
Install cap around 'B' steam generator feed pump casing vent plug
+ M2-93-03018 -
Troubleshoot and Repair thermal margin low pressure trip setpoint drift.
- M3-92-14967 -
PM, 6 Month - inspect 3HVR*FLT2A Filter
+ M3-92-03868 -
PM, required annual inspection of 'B' EDG i
+ M3-93-00949 -
PM, Monthly inspection of 'B' EDG
+ M3-93-01268 -
Troubleshoot 3FWL*SOV104 turbine trip and throttle valve The inspectors determined the maintenance activities observed were performed well. Details of the inspectors' observations are provided in report Sections 3.1 - 3.2.
3.1 Inoperable Vital Switchgear Room Coolers - Unit 2 On January 29,1993, the licensee informed the inspector that west vital 480 volt switchgear
'
room coolers X181 A and X181B had been placed in service in a degraded condition in that a weld on a two-inch service water supply pipe had failed a hydrostatic test on January 25.
Based on the location and initial licensee characterization of the weld defect, the inspector did not consider that an immediate safety concern existed. The inspector reviewed licensee activities regarding the coolers' return to service and identified the findings summarized belo t
.
I l
'
System Description and Requirements The west 480 volt switchgear room contains vital load center 22E, the remote hot shutdown panel, and the main turbine electro-hydraulic control (EHC) monitor cabinets. The load center supplies various vital post-accident loads and is required by Technical Specification (TS) 3.8.2 to be operable in operating modes one through four. The allowable outage time for this TS limiting condition for operation (LCO) is eight hours. The EHC system control
'
cabinets contain temperature-sensitive electronic equipment which can cause reactor coolant system temperature or reactor power level limits to be exceeded due to turbine control valve drift.
The west switchgear room is cooled by a closed cycle subsystem utilizing the service water system as a heat sink. The piping is classified by the ASME Boiler and Pressure Vessel Code as Class 3 pipe, subject to TS 3.4.10, Reactor Coolant System Structural Integrity.
There are no direct TS operability requirements for this ventilation system, and the licensee does not track its operability by a specific LCO. However, the system is part of the current design basis of Unit 2 as described in Final Safety Analysis Report (FSAR) Section 9.9.15, and would be required to function following a loss of normal power event and under post-accident conditions where the maximum allowable room temperature of 104 degrees Fahrenheit (F) could be exceeded. TS 1.6, Operability, requires that auxiliary equipment required to assure that TS systems perform their safety functions must also be capable of performing their related support functions. Therefore, the switchgear room cooling system must be operable, or equivalent compensatory actions taken, to meet the requirements of TS 3.8.2.
Event Details The west switchgear room coolers and piping were replaced during the last refueling outage under automated work order (AWO) M2-92-17685. While the coolers were isolated, the west switchgear room was cooled by opening the adjoining door to the east switchgear room.
Door watches needed to meet security and fire protection requirements were implemented as specified by the licensee. Work inside the west switchgear room was completed on December 30,1992. However, system retest and restoration were deferred pending replacement of cooler outlet piping located outside of the switchgear room, which was delayed while procuring a new pipe elbow. Plant startup was commenced on January 6,1993. The coolers remained out of service. The main turbine was placed on-line on January 13, effectively precluding welding in the west switchgear room due to the
presence of electrically noise-sensitive turbine control systems. The outlet pipe work was
completed on January 21. A hydrostatic test of the service water supply piping was performed in accordance with Section XI of the ASME Code under AWO M2-92-12257 on
-__. _ _ _ _ _ _ _ _
___--__ _.
January 25,1993. One weld on supply pipe 2"-HUD-130 developed a " weeping" pinhole l
leak at test pressure which was documented in nonconformance report (NCR) 2-93-026. On l
January 27, an NCR disposition of "use as-is" (pending plant conditions conducive to repair)
was recommended by the maintenance engineer because the noise-sensitive equipment in the
'
EHC control cabinets precluded performance of Code repairs during power operation.
In order to preclude drift of the turbine control valves due to higher than normal room temperature, and to remove the watches on the switchgear room door, the licensee expedited returning the coolers to service. AWO's were returned to the work control center for review in order to facilitate this effort. On January 28, following restoration of system piping, safety tags were lifted and operational leak checks at normal system pressure were performed.
Noting no leakage from the failed weld, the tags were cleared, the coolers were placed into service, and the watches were removed. On January 29, the engineering supervisor tasked with reviewing the NCR notified the inspector that the NCR was still open and that the need for NRC relief from ASME Code requirements was being evaluated in accordance with Generic Letter 90-05, " Guidance For Performing Temporary Non-Code Repairs of ASME Code Class 1,2, And 3 Piping." The inspector visually examined the leak location, reviewed the proposed NCR disposition, and had no immediate concerns regarding the l
i integrity of the pipe. The inspector also informed the licensee that a relief request was needed. The licensee also stated that a preliminary, informal evaluation of the piping by i
I corporate engineering supported considering the piping to be operable. A revised NCR containing this information was approved by the unit director on February 2. A plant incident report also was initiated to determine the cause for placing the coolers in service with unsatisfactory retest results and an unapproved NCR. The licensee initiated a relief request on February 3, and submitted it to the NRC on February 24.
The inspector reviewed the AWO, test forms, and administrative procedures governing work l
control, safety tagging, and performance of retests, and discussed the incident with operations i
l and engineering personnel. Work order M2-92-17685 indicated that the normal pressure checks had been satisfactory and that the hydrostat c test had been unsatisfactory. Though the i
NCR was referenced by number, it was not incluaed in the work package. A work control center operator noted this condition and sent the AWO back to the maintenance department since it could not be accepted by opentb. Subsequently, another work control center operator, unaware of this retest concern, informed the shift supervisor / senior control operator that tags had been cleared and that the system was ready to place into service. The operator interpreted step 6.5 of ACP-QA-2.06A, " Station Tagging," which permits lifting of tags for systems awaiting retest, to permit clearing the tags and placing the system in service. The operator incorrectly stated that the coolers were not covered in TS and were not considered a support system essential to the operability of safety-related equipment in the switchgear room.
l The shift supervisor was aware of the failed retest and the NCR, but was informed by a l
mechanical engineering supervisor that the disposition was being discussed with corporate engineering and that interim operation of the system was acceptable.
l i
i j
r
.
The operations work control center is staffed with NRC-licensed operators. Licensee administrative procedure ACP-QA-2.02C, " Work Orders," states that a component which fails a retest should be tagged when additional work needs to be performed. The shift supervisor / senior control operator / senior reactor operator must review the AWO package to assure that retest results support system operability and document acceptance by signing the AWO (step ACP-QA-2.06A permits tags to be cleared with open items, e.g., NCR's)
provided that they are dispositioned as acceptable. Procedure ACP-QA-2.02B, " Retest,"
makes the shift supervisor / senior control operator responsible for reviewing retest results and ensuring that components which have failed retest are tagged out of service. An exception permits operation of a system under an NCR disposition approved by the unit director. Step 6.4.3 of the ACP states that if a component which fails a retest cannot be made to pass a subsequent retest within a shon period of time, the component either is to be safety tagged out of service or caution tagged to indicate that it is not available to satisfy TS requirements.
The inspector concluded that these conditions were not met when the coolers were placed into service without further administrative / engineered controls to assure the operability of the vital equipment located in the west switchgear room.
Additional Findings In NRC Inspection Report 50-336/87-25, dated January 1988, the NRC identified a violation involving the inoperability of the vital DC switchgear emergency ventilation system. The functional requirements of that system similarly are described in the FSAR, but are not embodied directly in TS. The NRC found that the licensee had evaluated alternate methods of vital DC switchgear room cooling and had provided instructions in a procedure approved by the plant operations review committee. The licensee responded to the findings and the Notice of Violation in letters to the NRC, dated December 4,1987, and February 10,1988, respectively. In the letters the licensee emphasized its continual awareness of the importance of support systems in evaluating the operability of systems defined in the TS and considered the violation to be an isolated case. The licensee committed to provide generic guidelines in the emergency operating procedures (EOPs) for actions to be taken in the event of loss of support systems.
The inspector reviewed EOP 2525, " Standard Post Trip Actions," and noted that step 2.24 directs operator verification that all vital support equipment is in service by review of shift turnover report form OP-2619A-4. The contingency action refers the operator to system-specific operating procedures for additional actions for out of service equipment. The inspector reviewed form OP-2619A-4 (three per day) for the period of January 6, when the plant entered operational mode 4 (hot shutdown), to January 31, and found no reference to the west 480 volt switchgear room coolers. Tht; inspector also reviewed operating procedure CP-2315D, " Vital Electrical Switchgear Coolin;;." The procedure states that in the event of a loss of offsite power during post-incident and emergency shutdown conditions, room temperature could exceed 160 degrees Fahrenheit, and that the emergency cooling system
___
_ - - __ -_.
i
J
must be available to maintain the rooms less than 104 degrees Fahrenheit. The procedure contains no provisions for alternate methods of room cooling. In addition, the licensee was unable to provide the inspector with an evaluation or calculation showing the efficacy of the alternate methods of cooling which customarily had been used when the room coolers were unavailable.
Conclusion The inspector concluded that the coolers were returned to service inappropriately on January 28, due to a combination of miscommunication among operations and engineering department personnel, misinterpretation of administrative requirements, and lack of clear
!
understanding of the TS status and operability requirements of the ventilation system.
Inadequate licensee review of safety-related work and retest control requirements were noted by the NRC as an unresolved item (50-336/91-04-02) in a previous inspection report. There may have been reasonable assurance that a detailed evaluation of the weld defect would conclude that the integrity of the service water pipe was acceptable. Nonetheless, the licensee returned the west 480 volt switchgear room coolers to service without approved compensatory measures from January 28 until February 2 with a failed retest and an unapproved NCR. This is contrary to procedure ACP-QA-2.02B, which requires that components that fail a retest be either tagged out of service or caution tagged, indicating it is not available to satisfy TS requirements and deviation from design document acceptance criteria be resolved by a properly dispositioned NCR. This is one example of the violation (50-336/93-03-001) of TS 6.8.1, which requires procedures covering station activities be established and implemented. The previous traesolved item (50-336/91-04-02) is closed.
,
The inspector also concluded that existing procedures do not provide guidance to assure the operability of the safety-related equipment in the west 480 volt switchgear room when coolers X181 A and X181B are out of service. Since the TS status of the coolers was not clearly understood by the operators interviewed, the inspector considered that the prior EOP change did not effectively address NRC concerns regarding the need for this vital support equipment.
.
Finally, since the licensee has not provided a technical basis for the acceptability of altemate cooling methods, the operability from January 6 to January 28 of the electrical equipment located in the west switchgear room, required by TS 3.8.2, is unresolved (50-336/93-03-002).
3.2 Cold Weather Preparations The inspector performed a review of the licensee's programs to protect safety-related systems against seasonal and sudden cold weather elements. The inspection included a review of
'
associated surveillance and work authorizations; walk down of portions of exposed piping; and verification of system alignment.
I i
.
Heat tracing is used to help protect exposed safety-related instrumentation and piping from freezing up and thus disable the supply of water or give inaccurate instrument readings. The
>
three Millstone units use a combination of heat tracing (heated wire), piping insulation, heated enclosures, and recirculation of storage tanks with supplemental heat to guard against freezing of equipment lines and tanks exposed to cold weather conditions. Control room annunciator alarms are provided for Units 2 and 3 to provide an early warning of system malfunctions or decreased fluid temperatures.
,
During September of each year, work orders to inspect outside freeze protection heat tacing circuits are generated for each unit. In addition, heat tracing circuits are checked as part of plant equipment operator (PEO) daily rounds. The degree of inspection between the units varies slightly.
Heat tracing at Unit 1 is self regulating. There are no thermostats which monitor piping temperature to energize heat tracing when a specified setpoint is exceeded. The circuits are constantly energized; as temperature changes, the wire resistance changes which changes the degree of heat generated by the wire. The annual check of this circuit includes a visual and operational check of the heat tracing controller, circuitry, and wiring. As part of PEO rounds, the operators inspect piping insulation for damage. In addition, in the event that outside air temperature drops below 10 F, the PEO performs a walkdown of the heat tracing
'
panels in accordance with off normal procedure (ONP) 514B, " Freezing Temperatures."
This inspection includes monitoring of various tank temperatures and verification that the heat trace circuits are energized.
The majority of Unit 2 heat trace circuits are controlled by thermostats which energize whenever the associated piping temperature drops below some preset value. The annual inspection of this system includes inspecting exposed insulation for damage and bypassing the various thermostats to observe that the circuit indicator lights energize to verify continuity.
As part of PEO rounds, the operators perform a general visual inspection of the assigned areas. This includes spot checking for insulation damage, and verifying power supplies to heat tracing panels are energized, space heaters for various enclosures are energized (winter only), and applicable storage tank temperatures are within specified limits. In addition, Unit 2 has control room annunciators which alarm whenever the monitored refueling water storage tank (RWST) and condensate storage tank (CST) piping temperature drops below some preset limit. These annunciators provide early warning that would allow operators sufficient time to repair the heat tracing or install portable heaters in the trenches to prevent these pipes from freezing.
Heat tracing at Unit 3 is controlled by thermostats. The annual inspection of this system includes a calibration of all temperature indicators and thermostats, and a continuity check of the circuit. As part of PEO rounds, insulation is inspected for damage and heat trace panels are verified energized and checked for any abnormal alarms. Unit 3 also has control room heat trace trouble annunciators which alarm due to system grounds or when any of the r
i
!
I i
thermostat temperatures drop below any preset limit. In addition, every September as part of operating procedure (OP) 1.04, " Cold Weather Preparation," operations department personnel verify system operability and document system status for operations department manager review.
The inspector walked down portions of exposed piping at all the units and verified that exposed piping was heat traced and there was no indication ofinsulation damage. The inspector verified that Unit 1 fire pump house heat trace panel was properly aligned.
However, of the seven indicating lights which verify the system energized, four were de-energized; only one had an outstanding trouble report. The inspector notified the Unit I shift supervisor of this discrepancy and was informed that a panel walk down in accordance with ONP 514B would be performed to verify system operation. The inspector was informed that a walkdown of the panel was performed and that the darkened indicating lights were the result of blown bulbs and that the circuits were operating properly.
The inspector reviewed Unit 3 work orders and verified that all PM programs for cold weather protection had been completed. The inspector monitored the fuel building heat trace panel and the control room annunciators and noted no abnormal alarms.
During a review of the Unit 2 refueling water storage tank enclosum, the inspector noted that eight of the seventeen heat trace indicating lights were not energized. One of the darkened lights had an outstanding trouble report; the inspector was unable to determine if the other circuits were faulty or if they weren't energized due to not exceeding the thermostat setpoint.
The inspector reviewed Unit 2 work orders and noted that work order M2-91-10668 identified seven inoperable heat trace circuits, three were for the RWST; this work order had been generated in October 1991. The inspector questioned the status of this open work order and was informed that it remained open due to problems with material quality classification.
The licensee had assigned a low priority for resolution of this matter.
The inspector reviewed the material, equipment, and parts list (MEPL) evaluations MP2-CD-1273 and MP2-CD-1248 for the condensate storage tank (CST) and refueling water storage tank (RWST) heat tracing circuits. The licensee concluded that the heat tracing and freeze protection for the CST /RWST piping are not credited in any design basis accident analysis nor are they required to support any safety related functions. Instead, the MEPL evaluations credit the control room annunciator alarms. However, the inspector identified that there is no preventive maintenance (PM) program in place at Unit 2 for the temperature sensors which provide input to the control room annunciators. Except for one CST temperature sensor, the temperature sensors were last calibrated in 1976. In addition, the inspector noted that the temperature sensors are calibrated to 40 F whereas operating procedure 2350, "RWST and containment sump," indicated the setpoints to be 50 F for the instrument lines and 70 F for the suction lines. The inspector informed the acting operations manager of these discrepancies and was informed that the applicable operating procedures would be modified to indicate the actual temperature sensor calibration setting The inspector noted that historically the Unit 2 RWST and CST suction lines have not frozen due to cold weather conditions and that on a monthly basis the RWST/ CST suction lines are circulated back to their applicable storage tanks during monthly pump surveillances.
However, the inspector was concerned that a failure to test the temperature sensors or the thermostats on some preventive maintenance schedule could result in the failure to detect and prevent the RWST/ CST suction lines from freezing thus rendering a train or trains of engineered safety features actuation system equipment inoperable. The inspector was informed by the licensee that I&C engineering would evaluate and develop a preventive maintenance program for the temperature sensors by June 1,1993. The inspector determined that Unit 1 and Unit 3 cold weather preparations were acceptable.
4.0 SURVEILLANCE (IP 61726)
The inspectors observed and reviewed selected portions of surveillance tests, and reviewed test data, to verify compliance with: procedures; technical specification limiting conditions for operation; removal and restoration of equipment; and, review and resolution of test deficiencies. The inspector reviewed portions of the following tests:
IC 409C ATWS Recirculation Pump Trip / Alternate Rod Insertion System Functional
Test
- SP 2604A Borated Water Source and Flow Path Verification
- EN 21004A Inverre Count Rate Calculation and Evaluation
- SP 2401)
Thermal Margin / Low Pressure Calculator Test SP 3446B11 Train A SSPS Operational Test
SP 3622.3 Auxiliary feed water pump 3FWA*P2 Operational Readiness Test
The inspectors determined that the surveillance activities observed were performed well.
Details of the inspectors' observations are provided in report Sections 4.1-4.5.
4.1 Failure to Recognize Technical Specincation Required Equipment - Unit 1 On February 4,1992, the inspector observed an Instrumentation and Control (I&C)
technician and the midnight shift Supervisory Control Operator (SCO) discuss the performance of surveillance procedure SP 411R, " Wide Range Pressure Instrument Calibration," on the drywell wide range pressure instrumentation transmitters. Following discussions with the I&C technician, the SCO authorized performance of the test. Before the technician left the control room, the inspector asked the SCO if a Technical Specification (TS) action statement should be entered for performing the test since the surveillance procedure data sheet contained a reference to TS 3.7.A.8, " Containment Pressure Monitors."
Following the inspector's question, the SCO discussed the test further with the I&C technician, and after examining TS 3.7.A.8 concluded that the transmitter that was going to be tested was not contained in the TS. The inspector agreed with this assessment.
..
.
However, the inspector noted that other drywell pressure transmitters which were tested on February 3, per procedure SP 411R, were required by TS to be operable and the applicable Limiting Condition for Operation (LCO) was not entered. The inspector discussed this issue with the day shift SCO who authorized performance of the surveillance test. Apparently the day shift SCO did not look at the surveillance procedure data sheet when authorizing the test.
Additionally, the inspector concluded that both SCO's were unaware that the instruments
-
were required by TS to be operable.
TS 3.7. A.8 requires both containment wide range pressure transmitters be operable when primary containment is required. If one transmitter is out of service, reactor operation is allowed for seven days. If both transmitters are out of service, reactor operation is allowed for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Each pressure transmitter was out of service for less than I hour so TS 3.7.A.8 was not violated. Therefore, the safety significance of the observation was minimal. However, the inspector was concerned that operators were unaware that tne pressure transmitters were required to be operable by plant TS and therefore did not understand the consequences of the test before authorizing its performance. Additionally, the two operators did not closely review the surveillance procedure data sheet befo e authorizing the test. If they had, the inspector concluded that the operators would have seen the reference to TS 3.7.A.8 on the sheet and they would have understood that the surveillance procedure affected TS required equipment.
The inspector discussed the observation with the Unit 1 operations manager who said that this issue will be discussed with Shift Supervisors and SCOs. They will be informed that they are
-
expected to fully understand the scope of a work or test item before authorizing its performance. The inspector determined that this corrective action should be adequate to prevent recurrence.
4.2 Incorrect Snubber Installed - Unit 1 On January 8,1993, the licensee determined that an incorrectly adjusted snubber that was previously installed in Unit I was a reportable event per 10 CFR 50.73(a)(2)(i)(B), Violation of plant Technical Specification (TS) 3.6.I, Snubbers. The snubber which had improper lockup and bleed rate settings was installed in the 'B' Safety Relief Valve (SRV) discharge line during the 1991 refuel outage when the originally installed snubber failed a functional test. The installation of the incorrect snubber was detected in January 1992, when that snubber was retested because of the previous functional test failure. Upon discovery of the incorrect settings, the snubber was removed and readjusted to its correct setpoint.
Following the discovery of the incorrect snubber installation, the licensee conducted an operability assessment of the SRV tailpipe as required by TS 3.6.I. In an evaluation, dated February 11,1992, the licensee concluded, based upon visual examination and engineering analyses, that the SRV blowdown piping was not damaged by the installation of the incorrect snubber assembly. At the time of the evaluation, the licensee concluded that the event was not reportable per 10 CFR 50.73 because the system had not been affected. However, the
'
.
licensee failed to consider that the installation of an inoperable snubber during the refuel outage was a violation of TS 3.6.I. Specifically, TS 3.6.1 requires an engineering evaluation
'
to be made within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of discovery of an inoperable snubber. Since the snubber was installed during the refuel outage, and a subsequent engineering evaluation was not performed within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, TS 3.6.I was violated. The licensee determined the event to be reportable
'
on December 16,1992, while conducting an additional evaluation of how the SRV blowdown piping would have responded during a seismic event. The additional evaluation was requested by an engineering technician who questioned the operability of the SRV system with an inoperable snubber while undergoing seismic loading. The licensee concluded that the SRV system would have remained operable lollowing a seismic event.
Licensee corrective action included revising the snubber maintenance procedures for the removal and testing of snubbers to specify that the snubber performance data should be checked prior to installation to ensure it meets the specific performance requirements for the location where the snubber will be installed. Additionally, a more formalized program for the inspection, evaluation and reportability of snubbers will be developed prior to the next refuel outage currently scheduled for January 1994.
The inspector reviewed the snubber maintenance procedures and verified that they were adequately revised. The inspector determined the licensee showed a proper safety perspective by reevaluating the snubber operability in response to the engineering technician's question regarding the operability of the snubber during a seismic event. The licensee failed to evaluate the inoperable snubber within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> as required by TS 3.6.I. However, based upon the corrective action implemented by the licensee, and the fact that the incorrect snubber installation did not affect component operability, no violation will be issued since the
,
criteria specified in Section VII.B of the enforcement policy was met.
4.3 Surveillance Resulting In Inoperable IIigh Pressure Safety Injection System -
Unit 2 On February 17, 1993, with the plant at 100 percent power, licensed operators mispositioned high pressure safety injection (HPSI) system throttle valve 2-SI-647 following the incorrect performance of a weekly surveillance test of baron injection flow paths to the reactor coolant
,
'
system. This degraded the system performance and rendered the 'A' train of the HPSI system technically inoperable. The emergency power source for 'B' train safety systems subsequently was taken out of service for regularly scheduled preventive maintenance which degraded the 'B' train of the HPSI system. Unaware that valve 2-SI-647 was not in the proper position, operators did not perform the compensatory actions required by Technical Specification (TS) 3.0.5, resulting in a violation of the LCO for approximately one and one-half hours.
l
-
-
-
-
-
-
.
\\
\\
Event Details
.
)
Licensed operators were performing surveillance procedure SP-2601 A, " Borated Water i
Source and Flow Path Verification," to satisfy the requirements of the applicable TS. The procedure includes tests of the four boron injection flow paths applicable to various plant operating modes. The procedure is written to accommodate testing only during the applicable
'
modes of operation. Operators tested the fourth flow path, applicable only to modes 5 and 6, which required shutting the four normally open HPSI system injection throttle valves. Upon completing the surveillance, the operators found that the procedure contained no steps to reopen the valves. Procedure SP-2604E, " Facility 1 High Pressure Safety Injection System Alignment Check," implements the requirement of TS 4.5.2.e.1 that proper position of the HPSI throttle valves be verified within four hours of stroking the valves, and operators recognized that this was an appropriate vehicle for restoring system operability.
As originally designed, the HPSI injection throttle valves were normally closed and opened to a pre-set throttle position on receipt of a safety injection actuation signal (SIAS). Since the valves historically did not stroke fully to the required positions under static conditions, the plant now operates with the valves normally open to the throttle position. The proper throttle
,
position of the valves is verified every refueling outage in accordance with procedure
!
SP-2604Q, " Emergency Core Cooling System Flow Verification." For all HPSI pump combinations, as necessary, the throttle positions are obtained, motor-operator limit switches are adjusted, and the actuator housing and rotating stem nut lock nut are marked with yellow
'
paint to indicate the correct setting (1 - 3/4 turns of the stem nut lock nut from the closed position). The process of marking the valve position is not definitively described in procedure i
SP-2604Q During the last refueling outage, the valve motor-operators were overhauled, modified, and dynamically tested as part of the licensee's Generic letter 89-10 program for
motor-operated valve operability. Procedure SP-2604Q was performed on December 2,1992, at which time new marks were placed at a different actuator housing cover location. The old marks were removed and the area above the valve stem and around
'
the stem nut lock nut was filled with grease.
Procedure SP-2604E requires that if a valve does not open electrically to the ' marks,' the j
valve is manually positioned to the ' marks' and retested. If the valve moves from the
!
required position, it again is manually positioned to the ' marks' and deenergized. At approximately 3:30 a.m., on February 17, the operator at valve 2-SI-647 had difficulty i
finding the expected ' marks' (old location) on the indent sections of the stem nut lock nut.
After cleaning away the grease, he found what appeared to be a yellow dot of paint on one j
indent, which he believed to be the appropriate ' mark.' When the valve was operated from
'
the main control board, the valve traveled one-half turn past the ' mark.' When positioned (closed) to the mark, the control room operator received dual position indication which was
.
abnormal. When remotely operated, the valve again traveled one-half turn past the mark. At 5:05 a.m., after discussing the condition with control room personnel, the decision was made to position and deenergize the valve to the mark in accordance with the procedure, and to i
initiate a plant incident report and trouble record. In this condition the valve was no longer i
fully able to respond to a SIAS.
At 6:10 a.m., the 'B' train emergency diesel generator was taken out of service for normally scheduled preventive maintenance and the 72-hour LCO of TS 3.8.1.1.a was entered. At 9:36 a.m., enJneering and operations personnel determined that valve 2-SI-M7 had been positioned to the incorrect marks and was closed one-half turn too far. The valve immediately was repositioned to the correct position, and another plant incident report was initiated. At 11:35 a.m., the 'B' diesel generator was declared operable, and at 11:41 a.m.,
the correct positions of the remaining HPSI system throttle valves were re-verified.
,
Assessment Flow path number 4 of procedure SP-2601 A, from the refueling water storage tank to the reactor coolant system via the HPSI system, is required to be veiified weekly by TS 3.1.2.1.b. This TS is applicable only to operating modes 5 and 6, and was performed in error. Performance of the surveillance was discussed between the control operator and the senior control operator prior to conducting the evolution, but neither recognized that the test was not required to be performed. The inspector found that the fact that the procedure contained no steps to restore the throttle-valves to their normal positions led to some discussion among the operators concerning the adequacy of the procedure. The inspector
,
'
concluded, however, that the operators correctly identified procedure SP-2604E as the appropriate vehicle to affect system restoration. The inspector also found that procedure SP-
,
2601 A contained no guidance regarding the mode applicability of the four flow paths tested, and discussed with operations department management the concern that other surveillance procedures similarly may lack this guidance. The licensee stated that while operator training and experience is relied upon to assure proper performance of the tests and that this incident was considered to be an isolated case, other surveillance procedures would be reviewed as part of the plant incident report process. The inspector considered this response to be acceptable.
The correct position of valve 2-SI-647 is 13/4 turns of the stem nut lock nut from the closed position. When opened electrically, the valve moved to the proper position. The operators mistook the old throttle marks, concluded that the valve had overtravelled one-half turn, and closed the valve to the incorrect marks. This reduced the header flow from approximately 160 gallons per minute (gpm) to approximately 115 gpm, thereby degrading the performance of this safety injection subsystem. The sum of the three lowest header flows would have been reduced below the 471 gpm required by TS 4.5.2.f.1. At 5:05 a.m., when the valve was deenergized, the 'A' HPSI train was rendered technically inoperable and the 48-hour LCO of TS 3.5.2.a would have become applicable. When the opposite train emergency power source was removed from service at 6:10 a.m., the 'B' HPSI train also became
.
i
inoperable. TS 3.0.5 states that when a train or subsystem is inoperable solely due to an inoperable emergency power supply, it may be considered to be operable for the purpose of satisfying the requirements of its applicable LCO provided that (1) the corresponding normal power supply is operable, and (2) all of its redundant trains and subsystems are operable.
Unless both conditions are met within two hours, action shall be taken to place the plant in a mode in which the applicable LCO does not apply. Since valve 2-SI-647 was not reopened until 9:36 a.m., the LCO was exceeded for about 86 minutes, in violation of the TS. The inspector noted that the 'A' emergency diesel generator had been demonstrated operable prior to removing the 'B' diesel generator from service, and that both off-site power sources had been operable. Also, the TS minimum flow requirement assumes single failure of one of the four train injection lines. Therefore, absent a single failure, approximately 600 gpm would have been available from the 'A' HPSI train to mitigate an accident. Prompt licensee
)
followup of the plant incident report and trouble record limited that time in which both HPSI trains were technically inoperable. The inspector concluded that the safety consequences of the event were minimal. Since the criteria of Section VII.B of the NRC Enforcement Policy was satisfied, this licensee-identified TS violation will not be cited.
The inspector was concerned that between 3:30 a.m. and 5:05 a.m., when the correct position of valve 2-SI-647 was uncertain and the accuracy of the marks on the valve was m i
question, licensee personnel did not consult the appropriate technical support personnel necessary to resolve the issue definitively. The inspector also was concerned that the emergency power source for the opposite HPSI train was rendered inoperable while questions regarding the valve were unresolved. The licensee operations manager also recognized these i
concerns and stated that this performance would be evaluated and corrective actions taken through the plant incident report process.
Regarding the mispositioning of valve 2-SI-647, the inspector found that the method of marking the correct throttle position was not formal or controlled adequately by procedure.
In addition, following maintenance on the motor-operator a new method of marking the valve I
was used and this was not communicated to plant operators formally or effectively. By the end of the inspection period, the valve position marks were enhanced and operators were briefed on the new locations. However, the licensee had not developed a longer term action plan which addressed the concerns stated above. These process and procedural inadequacies contributed to the inoperability of the 'A' HPSI train without the knowledge of plant operators. This is contrary to procedure ACP-QA-3.02, which requires detailed station procedures and forms to address preventive and corrective maintenance and modifications which could affect the safety of the plant. This is a second example of the violation of TS 6.8.1, which requires that procedures covering station activities be established and implemented (50-336/93-03-001).
l I
l
-
- - -
- - - -
-
,
,
4.4 Inadequate 4160 Volt Undervoltage Surveillance Procedure - Unit 3 The inspector reviewed Licensee Event Report (LER) 50-423/92-023, which reported that on October 3,1992, the licensee identified that the monthly surveillance testire, for the i
i emergency 4160 volt undervoltage relays did not satisfy all the technical specification (TS)
requirements. A footnote to the TS surveillance requirement for the trip actuating device
[
specified that on a monthly basis an undervoltage condition would be initiated at the sensing
!
device to verify operability of the trip actuating device and verify that the associated logic and alarm relays operate. TL TS was not being satisfied in that the associated logic which
"
consists of the relays between die undervoltage relays and the circuit breakers were not being tested. The licensee determined that the cause of the event was an incorrect interpretation of the footnote and incomplete review of the surveillance procedure after the TS footnote was added to TS.
Since all TS surveillance requirements were not met the licensee declared the relays
.
inoperable. No immediate corrective action was required because the undervoltage relays were not required for the applicable plant conditions (Mode 5). A test of all associated logic was completed on October 6, and no failures were experienced. The entire relay logic scheme is tested every 18 months and has shown no failure of any component over the past five years. A proposed change to the TS was submitted by the licensee and approved by the
!
NRC in December 1992. The change was necessary since the specified testing of the associated logic could not be performed safely at power due to the design of the circuitry.
The licensee committed as part of their corrective actions that surveillance procedures for i
other devices which require trip actuation device operational tests will be reviewed by June 1,1993, to ensure that they meet TS requirements.
The inspector considers that the licensee corrective action should prevent recurrence of this type event. In addition, although this missed surveillance constitutes a TS violation, it was
identified and reported by the licensee and had minor safety significance. Therefore, per Section VII.B of the NRC Enforcement Policy, enforcement discretion was exercised and no violation will be issued.
4.5 Both Trains of Residual Heat Removal Inoperable - Unit 3 l
The inspectc. reviewed Licensee Event Report (LER) 92-18, which reported that on
'
July 22,1992, with the plant at 100 percent power, the licensee determined that both trains of residual heat removal (RHR) system were rendered inoperable for two minutes while performing the quarterly technical specification (TS) required operational readiness test surveillance procedure. The licensee revised the surveillance procedure in March 1992, to place the 'B' train RHR pump in pull-to-lock to prevent it from inadvertently starting and thus possibly damaging the pump since the minimum flow recirculation line valve for the 'B'
train pump is closed and de-energized to support the testing of the pump discharge check valve. This resulted in the 'B' train being inoperable and entry into the applicable technical specification action statement as directed by the surveillance procedure. In a subsequent step
z
,
the 'A' train RHR heat exchanger flow control valve was throttled to 30-40 percent; as soon as the valve came off its open seat the bypass annunciator alarmed on the main control board which indicated that the 'A' train of RHR could be inoperable. The operators immediately noted that bypass annunciators were in alarm for both RHR trains and restored both trains of RHR to a fully operable condition. The surveillance was previously performed in i
April 1992; however, no problems were reported during the surveillance. The operators who j
performed the April surveillance believed that the required discharge flow could still be i
available with the outlet valve throttled. They assumed that the procedure writer had verified the adequacy of the throttled position. The licensee documented the event in LER 92-18 as i
'
required by 10 CFR 50.73(a)(2)(i).
l The licensee determined the root cause of the event to be procedural deficiency. As corrective action, the applicable surveillance procedures were revised to prevent both trains from beconiing inoperable. Action to prevent recurrence is implementation of the licensee's new writer's guide that requires a verification and validation process and the development of individual bases documents for each procedure. While both trains of RHR were
'
administratively inoperable the accident function would have been fulfilled by operator action as directed by the immediate action steps in the emergency procedures. The inspector considers the corrective actions to be appropriate. In addition, since the event was identified, reported, and was of minor safety significance, enforcement discretion per Section VII. B of the Enforcement Policy was exercised.
5.0 EMERGENCY PREPAREDNESS (IP 71707,82203)
5.1 East Lyme Emergency Preparedness Siren Test in response to a concern raised by an individual during an NRC public meeting on November 5,1992, the inspector monitored the performance of the monthly emergency preparedness (EP) siren test on February 3,1993. The concern raised involved the audibility and clarity of the EP system voice page feature during the routine operability test on
'
November 4,1992, as heard from an area about one half mile south of the interstate 95 (interchange #74) on route 161 in East Lyme, CT.
Prior to the February 3 test, the inspector reviewed the applicable portions of the Millstone Emergency Plan and interviewed the East Lyme Civil Preparedness Director. Section 1.5 of the Emergency Plan describes the credited concept for the system for public alerting and notification as a combination of the emergency broadcast system (EBS) (designated radio and j
television stations) and sirens located within the 10 mile emergency planning zone. In the event of a nuclear emergency, following determination of public protective actions, the EBS message is released in coordination with the actuation of the local sirens. The sirens are
intended to notify the public of an emergency situation and alert them to tune into the EBS j
for information. There are no plans for use of and no credit is taken for the voice page
'
feature of the local siren syste o
l
+
)
The East Lyme Civil Preparedness Coordinator re-iterated these provisions of the EP plan.
l He further stated that in the town of East Lyme, the voice page feature of the siren system i
has been used to announce the monthly siren test and other cases of non-nuclear emergency, l
such as to evacuate the shore / beach areas during Hurricane Bob (August 1991). No
complaints had been received regarding the subject siren (EL-51) which is located at the
Flanders Fire Hall about one half mile north of interchange #74 on route 1.
On February 3,1993, at 11:00 a.m., the inspector monitored the monthly EP siren test from
the location cited during the public meeting to ascertain the audibility of the voice page and siren. The inspector heard clearly the siren but not the voice page message. The inspector
heard a second (unplanned) siren annunciation at about 11:30 a.m. The test results were i
'
discussed with the East Lyme Coordinator. The inspector was informed that the voice page
,
feature of the siren was keyed to announce the beginning of the test and conclusion of the
,
test. However, the voice page did not function properly during the announcement of the test conclusion. Additionally, the 11:30 a.m. siren actuation was spurious.
j The inspector discussed these test results with the responsible licensee EP personnel. The
licensee had initiated troubleshooting of the voice page system shortly follow'mg the
[
l1:00 a.m. test. No equipment problems were found; however, the licensee observed that -
the East Lyme dispatcher may have misoperated the siren actuation system when initiating
!
silent tests in support of the troubleshooting. This could account for the unplanned actuation
'
of the siren. The licensee stated that the procedures for system activation were reviewed with the town dispatcher, and that licensee personnel will observe from the dispatch office during the next monthly test on March 3, to verify proper system actuation.
,
Regarding tl'.e concern received about audibility and clarity of the voice page system, the inspector agreed that the voice page was inaudible. However, the inspector concluded that this does not compromise the EP plan for Millstone because the voice page system is not i
credited for public notification of a nuclear emergency.
!
6.0 SAFETY ASSESSMENT / QUALITY VERIFICATION (IP 40500,90712)
!
6.1 Review of Written Reports
The inspector reviewed periodic reports, special reports, and Licensee Event Reports (LERs)
i for root cause and safety significance determinations and adequacy of corrective action. The
,
inspectors determined whether further information was required and verified that the reporting
requirements of 10 CFR 50.73, station adminisaative and operating procedures, and technical specifications 6.6 and 6.9 had been met. The following reports and LER's were reviewed:
LER 50-336/92-003 and update 92-003-01 discussed an error in the Millstone 2 spent fuel j
pool criticality analysis. This event was reviewed previously in Section 6.5 of NRC Inspection Report 50-336/92-10 and Section 8.3.4 of NRC Inspection Report 50-336/92-14.
l
!
i
,
!
,
.
_
-
I
,
-
LER 50-336/92-004 and update 92-004-01 discussed a technical specification violation involving changing operating mode with an inoperable emergency core cooling system. The event was reviewed previously in Section 3.6 of NRC Inspection Report 50-336/92-04; Section 7.4.2 of NRC Inspection Report 50-336/92-27; and Section 2.1 of NRC Inspection Report 50-336/92-36.
LER 50-336/93-02 discussed a technical specification violation involving certain accident monitoring instrumentation. The event was reviewed previously in Section 2.5 of NRC i
Inspection Report 50-336/92-35.
LER 50-423/92-018 discussed a technical specification violation due to rendering both trains of the residual heat removal system inoperable. This event is discussed in Section 4.5 of this report.
LER 50-423/92-022 discussed an event in which both trains of the supplemental leak
)
collection and release system were inoperable. This event was reviewed in Section 3.0 of NRC Inspection Report 50-423/92-23.
LER 50-423/92-023 described a technical specification violation due to an inadequate 4160 i
undervoltage surveillance procedure. This event is discussed in Section 4.4 of this report.
LER 50-423/92-025 described an event in which the limiting condition for operation was not entered for exceeding the pressurizer heatup rate.
LER 50-423/92-027 documented a reactor trip caused by loss of non-vital power. This event was previously reviewed in Section 3.8 of NRC inspection 50-423/92-28.
LER 50-423/92-028 documented a reactor trip actuation while shutdown due to an unblocked high intermediate range level test signal.
LER 50-423/92-029 discussed a reactor trip due to degraded 120 VAC bus voltage. This event was reviewed in Section 3.9 of NRC Inspection Report 50-423/92-28.
LER 50-423/92-030 discussed an event in which the outside air temperature fell below the outside air temperature design basis for the charging system. This event was reviewed in Section 3.10 of NRC Inspection Report 50-423/92-28.
Unit 1 Monthly Operating Report for January 1993, dated February 11, 1993.
Unit 2 Monthly Operating Report for January 1993, dated February 8,1993.
Unit 3 Monthly Operating Report for January 1993, dated February 5,199 _
- _ _ _ - _ _.
_ - _ _ _ _.
,
l
.
6.2 Review of Previously Identified Issues 6.2.1 Administrative Controls for Upgraded Category I Components / Systems - Unit 1 Unresolved item 50-245/91-24-002 documented NRC concerns regarding the adequacy of licensee administrative controls to ensure upgraded structures, systems, and components can meet their new design requirements. Specifically, Material, Equipment, and Parts List (MEPL) determination CD-1872, dated June 1986, concluded that no Unit I air handling unit (AHU) failures would result in loss of safety-related systems or equipment, and classified all units as non-QA. However, during the development of house heating steam system modifications to address high energy pipe break concerns, the quality status of the AHUs at Unit I was questioned by licensee engineers. The units were reevaluated and, in MEPL evaluation CD-0075, dated March 1990, the licensee concluded that the emergency diesel generator and reactor feed system area AHUs must remain operable to maintain their respective area temperatures within design limits. These AHUs were reclassified as Quality Assurance Category I. However, a walkdown of the AHUs was not performed by the licensee following the reclassification. Therefore, when the inspector performed an independent walkdown of these safety related AHUs several potential seismic deficiencies were noted.
Procedure ACP-QA-4.03B, " Material, Equipment and Parts List (MEPL) for Inservice Generation Facilities," requires a nonconformance report (NCR) to be generated only when the quality status of a component is originally unknown, work on the component is in progress, and the subsequent evaluation establishes the component to be Category I. The procedure is silent regarding what reviews, if any, need to be performed when a component previously classified as non-QA is upgraded during design review. Procedure ACP-QA-4.03C, "Use of the PMMS Data Base to Indicate Quality Assurance or Special Program Applicability," requires that all Category I structures, systems, and components be seismically qualified. In this case, no reviews or system walkdowns were performed, nor NCRs
'
generated, on the AHUs as a result of the status upgrade. This item remained open pending evaluation of the procedure revisions.
To correct the deficiency, the licensee initiated and finalized a revision to procedure ACP-QA-4.03B, which requires that a technical review of the existing installation should be performed when a component previously classified as non-QA is upgraded during a design review. The inspector reviewed the revision to the procedure and determined that administrative controls to assure the quality of upgraded structures, systems, and components are adequate. Therefore, this item is considered closed.
\\
a
-
. _.
..
. _.
-
,
6.2.2 Failure to Follow Procedures as Written - SLC/ SCRAM - Unit 1 Violation 50-245/91-03-002 involved personnel errors associated with the conductivity transient on April 7,1991. On that date, after completing several surveillance procedures on the standby liquid control (SLC) system, reactor coolant system conductivity increased to approximately 3.5 micromhos per centimeter (normal conductivity is 0.25). The reactor was manually scrammed after the Unit I chemist confirmed the high coolant conductivity, pursuant to off-normal procedure ONP-515C, "High Conductivity Reactor Water." At the time of the event, the reactor was suberitical at intermediate range five.
Licensee investigation into the event revealed that the high conductivity resulted when approximately 70 gallons of sodium pentaborate were injected into the reactor coolant system
from the SLC test tank. Further investigation showed that procedural steps were missed during performance of the surveillance procedures which would have prevented discharge of the chemicals into the reactor if the procedures were performed correctly.
During the previous review of this event, the inspector concluded that by performing three distinct SLC surveillance procedures together in order to promote efficiency, several operator errors resulted in the boron solution injection. Regarding the scram, the inspector noted an inconsistency between the requirements of the technical specifications (TS) and the off-normal procedure. Specifically, TS 3.6.C.2 states that, for steaming rates less than 80,000 pounds-
<
mass per hour, and during startup and hot standby, "do not exceed a reactor coolant system
conductivity of 2.0 micrombos per centimeter for greater than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />." If this condition cannot be met, an orderly reactor shutdown is required. However, procedure ONP-515C requires an immediate reactor scram when conductivity reaches the TS limit.
The licensee corrective actions included: (1) issuing a memorandum from the Operations Department to all Operation personnel which emphasized management's expectations regarding procedural compliance, (2) the three SLC surveillance procedures were formally combined into one comprehensive procedure, and (3) off-normal procedure 515C was revised to be more consistent with the TSs. During this inspection, the inspector reviewed the revisions to the SLC surveillance procedures and the off-normal procedures and determined that the licensee has taken adequate corrective steps to address this violation. Therefore, this item is closed.
6.2.3 Licensee Response to Issues Regarding Isolation Condenser - Unit 1 Unresolved item 50-245/92-22-001 was opened following an inadvertent isolation condenser (IC) initiation. On September 2,1992, while performing surveillance testing of the isolation condenser initiation logic per procedure SP412C, " Reactor low-Low Water Ixvel Functional Test / Calibration," the IC inadvertently initiated. Surveillance Procedure SP412C, which verifies the isolation condenser logic to initiate the condenser when a low-low reactor water vessel level occurs, requires the operator to reset one train of the initiation logic before testing the other train. During the event, the operator who was assisting instrumentation and
!
controls technicians in the performance of the test, tumed the IC reset switch to the outboard
'
position but did not turn the operating switch for IC-6 and IC-7 to close. The operator also failed to recognize that relay 903-595-ll8A was not energized indicating that the logic was not reset as required by SP412C. Therefore, the logic for that train was not reset.
Consequently, when testing was commenced on the second logic train, an unplanned isolation condenser actuation occurred.
In addition to operator error, the inspector identified the following additional issues while conducting followup to this event: First, poor procedure format contributed to the inadvertent initiation; Second, the IC vent high radiation monitor alarmed during the event, yet the alarm response procedure for the monitor did not provide recommended actions for the operator if the monitor alarms while at power; Third, procedure SP 627.3, " Isolation Condenser Heat Removal Capability Determination," states that an IC heat capacity check is to be performed whenever the IC is automatically initiated. However, the licensee did not test the IC heat capacity following the initiation. This procedure requirement was made in the licensee response to NRC Bulletin 76-01, which required all BWRs with ICs to provide a description of the steps taken or planned to assure integrity of the IC tubes; Fourth, the design bases reconstitution document for the IC did not reference a licensee letter to the NRC staff, dated March 27,1984, deleting specific IC testing commitments. Therefore, the inspector was concerned that the design basis program was not capturing all relevant information. Finally, licensee engineers were not able to inform the inspector how many times the IC could be cycled and who was tracking reactor vessel lifetime cycles.
The licensee addressed the inspectors first observation by making procedure changes which moved two prior change sheets, which were attached to the front of the procedure, to the body of the procedure. This change improved the procedure format to guard against future operator errors. Current station policy now requires changes to be included in the body of the procedure vice being attached to the front of the procedure as had been the practice. The inspector noted that subsequent procedure revisions conducted during the biennial review process should incorporate other poorly arranged changes. The licensee addressed the second concern by revising the IC vent high radiation alarm procedure to clarify the operator actions necessary if the IC is advertently or inadvertently initiated while at power. The inspector has reviewed the licensee's procedure changes regarding this event and determined that they are adequate.
The licensee addressed the third issue by submitting a change to the commitments made
,
regarding Bulletin No. 76-01 in a September 22,1992 letter to the NRC staff. By letter, dated February 19, 1993, the NRC staff found the licensee's procedural change to eliminate the heat removal capability test following each automatic initiation of the isolation condenser acceptable. In response to the fourth concern, the licensee stated that the current design basis i
reconstitution program would not be expected to recover all correspondence to the NRC concerning IC testing since the current program is meant to capture system or component design parameters only. The inspector noted that the effectiveness of design bases
reconstitution program could be reduced since the licensee did not intend to recover items like
-
.
.
.
the March 27,1984 letter to the NRC in this design basis program. However, the lack of testing correspondence in the design basis documentation packages was not unexpected by the licensee since such information was outside the program scope.
The last issue was the subject of an NRC inspection conducted during the period of November 16-20, 1992. NRC Inspection Repon 50-245/92-30, dated January 26,1993, stated that operating data which could be used to reconstruct equipment cycles is being compiled on a regular basis, consistent with TS 6.9.1.6. However, the number of operational transients acting on components designed for specific numbers of cycles have not been evaluated since 1982. Unresolved item 50-245/92-30-01 was opened to track this issue.
Since the licensee satisfactorily resolved the other concerns, unresolved item 50-245/92-22-001 is closed.
6.2.4 Post Accident Reactor Coolant System Temperature Indication - Unit 2 This item (Unresolved 50-336/91-16-01) involved the ability to connect nonsafety-related reactor coolant system cold leg temperature detectors to safety-related display devices through switches on the main control board. This unprotected interface between safety-related and non safety-related circuits is prohibited by Regulatory Guide 1.97, " Instrumentation for Light Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," which classifies cold leg temperature as a Tync 1, Category B variable. The inspector verified that during the 1992 refueling outage, hr;id switches HS-111 and HS-121 on control board CO3 were removed from these circuits, Gius assuring the qualification of this instrument loop. This item is closed.
6.2.5 Inadequate Work Control Practices - Unit 2 and 3 This item (Violation 423/92-23-02) involved inadequate work control practices in that job description and retest requirements were not adequately provided, lifted lead control was not maintained, and post maintenance retest was neither specified nor performed. This item also included inadequate post-maintenance verification of ventilation system boundary integrity at Unit 2. The latter could lead to degradation in safety system performance which might not be detected by routine surveillance testing. The licensee provided guidance to station personnel stressing the need for proper documentation of work and the need for an adequate review of the work completion prior to releasing the work order to operations and stated that de-authorization of work orders is no longer permitted. In addition, the licensee is reviewing Unit 3 scheduled preventative maintenance practices to ensure that they include a complete and accurate job description. Unit 2 maintenance procedure MP-270lX, " Maintenance Retest Guidelines," has been changed to require leak testing of ductwork and flexible fan connections following maintenance on these components. The inspector reviewed these corrective actions and considered them to be adequate. This item is close _
O
,
'
7.0 MANAGEMENT MEETINGS Periodic meetings were held with station management to discuss inspection findings during
the inspectica period. Following the 'nspection an exit meeting was held on March 19, 1993, to discuss die inspaion findings and observations. No proprietary information was covered within the scope of the inspection. No written material regarding the inspection findings was
given to fae licensee during the inspection period.
l i
i t
.
I f