IR 05000245/1993010
| ML20036A119 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 04/29/1993 |
| From: | Doerflein L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20036A104 | List: |
| References | |
| 50-245-93-10, 50-336-93-06, 50-336-93-6, 50-423-93-07, 50-423-93-7, NUDOCS 9305100068 | |
| Download: ML20036A119 (38) | |
Text
.
_
._
_. _ _
. - _
_
_
.. _
-
!
i
!
,
l l
U.S. NUCLEAR REGULATORY COMMISSION (
REGION I
Report / Docket Nos.: 50-245/93-10
,
i 50-336/93-06 I
50-423/93-07 l
License Nos.:
!
DPR-65 i
,
!
Licensee:
Northeast Nuclear Energy Company
-
P. O. Box 270 l
Hartford, CT 06141-0270
!
'
Facility:
Millstone Nuclear Power Station, Units 1, 2, and 3 l
Inspection at:
Waterford, CT l
Dates:
March 3,1993 - April 3,1993 l
!
Inspectors:
P. D. Swetland, Senior Resident Inspector
=
A. A. Asars, Resident Inspector
>
K. S. Kolaczyk, Resident Inspector, Unit 1 D. A. Dempsey, Resident Inspector, Unit 2 R. J. Arrighi, Resident Inspector, Unit 3
t
'
/
l
!
c29 9 3 Approved by:
W ORMh -
E
.
Lawrence T. Doerflein, Chief j
/ Date'
l Reactor Projects Section No. 4h i
'
i Scope: NRC resident inspection of activities in the areas of plant operations, radiological controls, maintenance, surveillance, security, outage activities, licensee 'self-assessment, and periodic reports.
The inspectors reviewed plant operations during periods of backshifts (evening shifts) and
)
deep backshifts (weekends, holidays, and midnight shifts). Coverage was provided for 70 j
i hours during evening backshifts and 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> during deep backshifts.
,
'
Results: See Executive Summary
't
!,
l
]
"
9305100068 930430
PDR ADOCK 05000245
[
PDR G
l
.
w
-
P.e-y g,
m-y-e--
a'--t-t*t t
=-?rw-
- =e*'
T P
e
.
.
EXECUTIVE SUMMARY Millstone Nuclear Power Station Combined Inspection 245/93-10; 336/93-06; 423/93-07 Plant Operations Unit 1 operated at full power for the majority of the repon period except for power reductions for routine maintenance and testing. A plant shutdown was commenced on March 14, when high winds damaged a damper on the reactor building roof negating secondary containment. The power reduction was stopped at 65% when the damper was repaired.
Unit 2 operated at full power for the report period. A violation was cited as a result of the reactor protection system actuations caused by failure to follow procedures for system testing. Another violation was cited for late reporting of one of these events. Discretion was exercised for the licensee-identified and corrected conduct of unauthorized testing.
Unit 3 operated at full power at the beginning of the repon period. Reactor power was reduced to 50% on March 14 because of heavy weather conditions. The reactor tripped on March 31 when a turbine stop valve went closed inadvertently.
Maintenance / Surveillance
Inadequate preventive maintenance of 4.16 kV circuit breakers was noted at Unit 1.
Additionally, a violation was cited for inadequate Unit I corrective action following multiple maintenance-related failures of auxiliary contacts in 480 volt motor control centers.
Continuing problems with proper overlap in Unit 3 instrument loop testing, and the investigation of vendor quality assurance issues related to incorrectly set main steam safety valves at Unit 3 remained unresolved pending further licensee review.
Safety Assessment / Quality Verification The effectiveness of the self-assessment groups at Millstone was inconsistent in 1992. The Nuclear Review Boards provided strong technical reviews; however, there is room for improvement in communication of board assessments to management. Independent Safety Engineering Group evaluations were of good quality and provided good recommendations for improving plant performance. The Quality Services Depanment critically assessed plant and corporate performance and clearly communicated findings to management. Weaknesses in corrective action programs and in compliance with administrative procedures were identified.
Station responses to audit findings generally required extensions and were often late.
Improvement was warranted in the identification of root causes and the development and timely implementation of effective corrective actions.
ii
.
.
Unit 3 adequately implemented procedures for the review of changes, tests, and experiments allowed by 10 CFR 50.59. The adequacy of current diesel generator fuel oil capacity calculations remained unresolved pending submittal of thd licensee's 10 CFR 50.59 determination regarding this issue.
,
i Discretion was exercised for an incorrectly performed Unit 3 surveillance test which the licensee-identified and corrected.
l
.
d l
.
iii f
O O
SUMMARY OF FACILITY ACTIVITIES
i j
Unit 1 operated at full power during the inspection report period with the exception of power reductions to facilitate preventive maintenance and testing. On March 14,1993, at a
!
1:30 p.m., Unit I declared an Unusual Event and commenced a reactor shutdown when it
,
was discovered that the a pressure relief damper located on the roof of the reactor building
j became dislodged due to high winds. The damper was repaired approximately four hours
!
i later and the Unusual Event was terminated with reactor power at 65 percent. Reactor j
power was returned to 100 percent later that day.
Unit 2 operated at full power during the inspection period. On March 25 the licensee
.
requested NRC relief from the required actions of Technical Specification 3.4.10, " Structural
Integrity," for a minor weld leak in a service water supply line to the west 480 volt vital AC
!
switchgear room cooler. The relief was required in order to fabricate and install an
,
i engineered clamp to restore the structural integrity of the pipe. NRC Region I granted the l
'
requested relief on March 25, to expire no later than April 1,1993. The licensee installed the engineered clamp on March 31.
<
i j
Unit 3 entered the report period at 100 percent power. On March 14 reactor power was i
reduced to 60 percent due to heavy weather (intake structure fouling) conditions. Power was further reduced to 49 percent in accordance with technical specifications due to the quadrant
,
power tilt ratio (QFTR) exceeding its specified limit. The Unit returned to 100 percent
,
i power on March 15 once weather conditions permitted and the QPTR was within j
specifications. On March 20, reactor power was decreased to 48 percent in order to test run
>
the 'A' turbine driven feedwater pump (TDFP) with a redesigned shaft coupling. This pump
,
j has not been fully operational due to high vibration. The power reduction was necessary in
)
j order to fully load the 'A' TDFP with backup pumps in standby should this pump fail in
service. The redesign was not successful and the pump was taken offline when it again i
exhibited high vibration during the test. The Unit returned to 100 percent power on March 21. On March 31, the unit experienced a rapid main turbine load decrease and
-
tripped on low steam generator level when the number two turbine stop valve went closed.
i, At the end of the inspection period the plant was shut down to replace a steam generator safety relief valve which failed to fully close during the transient and to perform troubleshooting operations on the main turbine control system.
l 1.1 Management Changes There were several management changes within the Northeast Nuclear Organization which l
became effective March 28,1993, that directly affect the Millstone Station.
Mr. F. R. Dacimo, formerly Millstone Site Services Director became the Millstone Unit 3 Director; Mr. G. H. Bouchard, formerly Haddam Neck Unit Director, was appointed Director, Nuclear Quality Services; and, Mr. C. H. Clement, formerly Millstone Unit 3
,
l Director, became the Director, Nuclear Maintenance.
.
i
.
-
i i
I 2.0 PLANT OPERATIONS (IP 71707, 93702)
'
2.1 Operational Safety Verification (All Units)
The inspectors performed selective examinations of control room activities, operability of engineered safety features systems, plant equipment condi,tions, and problem identification systems. These revkws included attendance at periodic plant meetings and plant tours.
The inspectors made frequent tours of the control room to verify sufficient staffing, operator procedural adherence, operator cognizance of control room alarms and equipment status, conformance with technical specifications, and maintenance of control room logs. The inspectors observed control room operators response to alarms and off-normal conditions.
Good operator performance was noted during the recovery from the March 31,1993, Unit 3 i
The inspectors verified safety system operability through independent reviews of: system configuration, outstanding trouble reports and event reports, and surveillance test results.
The selection of safety systems for review was made using risk-based inspection guidance developed by NRC. During system walkdowns, the inspectors made note of equipment condition, tagging, and the existence of installed jumpers, bypasses, and lifted leads.
The accessible portions of plant areas were toured on a regular basis. The inspectors l
observed plant housekeeping conditions, general equipment condition, and fire prevention l
practices. The inspectors also verified proper posting of contaminated, airborne, and radiation areas with respect to boundary identification and locking requirements. Selected aspects of security plan implementation were observed including site access controls, integrity of perimeter fence, implementation of compensatory measures, and guard force
!
response to alarms and degraded conditions.
The inspectors determined that operational activities were adequately implemented. Specific observations are discussed in Sections 2.1.1 to 2.5 below.
'
2.1.1 Emergency Service Water Walkdown - Unit 1 The inspector performed a walkdown of the Unit 1 Emergency Service Water (ESW)
System. The inspector verified that system valves were aligned per the licensee's ESW system valve lineup sheet and were properly labeled. Housekeeping was considered adequate in areas where the ESW system was located. System deficiencies were properly identified through use of the trouble reporting system.
l Unit 1 Technical Specification 4.5.B, " Surveillance of the Containment Cooling Subsystem,"
l requires the operability of the ESW system be verified in accordance with Section XI of the l
ASME Boiler and Pressure Code. Millstone Procedure SP 623.19, "ESW System Operational Readiness Test," was written to satisfy this requirement. The inspector reviewed
1
-
-
-
. -
-. -
___
.
.
__
_ _
'
.
.
I
procedure SP 623.19 and verified that it adequately tested the ESW system. The data msults -
'
of a previous performance of Procedure SP 623.19 performed on March 2,1993, were also reviewed by the inspector and no inadequacies were identified. The inspector attended a briefmg before Procedure SP 623.19 was performed on March 30,1993, and determined that it was appropriate in form and content. Based upon review of the system valve lineup and the surveillance procedure the inspector concluded that the ESW system was properly aligned and tested.
2.1.2 Engineered Safety System Walkdown - Unit 3
The inspector performed a review of the Unit 3 containment meirculation system (CRS) on March 28, to verify system operability. The inspection included a review of system i
alignment, equipment condition, associated operational stirveillances, and a comparison of the
)
I
plant system drawings to the as-built configuration.
The CRS is designed to work in conjunction with the quench spray system to mduce the containment pressure following a break in either the primary or secondary piping system inside the containment. In addi' don, sometime after accident initiation when the refueling water storage tank reaches its low-low level setpoint, the CRS is manually aligned for long term recirculation to supply cooling water from the containment sump to the low pressure safety injection system.
The inspector noted that the system was properly aligned, accer.sible valves wem labeled correctly, and the surveillance programs were implemented adequately. No discrepancies were noted which would degrade system operability.
2.2 Initiation of Plant Shutdown Due To less Of Secondary Contaimnent lategdty -
Unit 1 During the period March 13-14,1993, a severe winter storm caused high winds and mixed precipitation at the site. On March 14,1993, at 1:30 p.m., with the plant operating at full power, the licensee discovered that a reactor building pre'sure relief damper had blown open s
causing a loss of secondary containment integrity. The licensee concluded that the r mn damper could cause both trains of the standby gas treatment system (SGTS) to be inoperable.
At 1:40 p.m., pursuant to Technical Specification (TS) 3.7.B.5, " Standby Gas Treatment System," the licensee commenced a plant shutdown. The licensee declared an Unusual Event in accordance with its emergency plan implementing procedares and at 1:55 p.m., notified the NRC of the event pursuant to 10 CFR 50.72(b)(1)(i). Compensatory security measures
,
for the reactor building were implemented while the damper was open. At 5:02 p.m., with the reactor at 65% power, the dampei was closed, restoring the secondary containment. The Unusual Event was terminated at 5:40 p.m., and full power operation was restored at 6:55 p.m.
j l
l
,.
. l
.
.
The inspector responded to the site and verified that the technical specification and NRC notification requirements were being satisfied. The inspector toured the reactor building and noted that a compensatory guard had been stationed on the refuel floor of the reactor building, and that the normal reactor building ventilation system appeared to be maintaining a slight negative pressure in the building in spite of the open relief damper. In addition, the inspector observed that the refuel floor area was noticeably cooler than normal. While closing the relief damper, the licensee shifted reactor building ventilation to the SGTS in order to reduce the differential pressure across the opening to preclude personnel injury.
The inspector noted that while the damper was open, SGTS flow was approximately 300 -
400 standard cubic feet per minute (scfm) higher than normal (1100 scfm), and that the system flow immediately began to decrease to the normal value when the damper was closed.
This provided some assurance that the integrity of the secondary containment had been restored. The inspector attended a licensee management meeting during which the level of confidence that the SGTS was operable and the termination of the Unusual Event were discussed. The licensee considered the damper to be analogous to the normal reactor building access door and that a formal secondary containment tightness test need not be performed prior to declaring the SGTS and secondary containment operable. However, the licensee also decided to perform such a test as soon as weather conditions (wind speed)
permitted. The inspector had no immediate safety concerns regarding the event, and observed that the licensee had demonstrated a good regard for nuclear safety during its discussions.
The reactor building is designed to withstand an internal pressure of 7 inches of water gauge (" WG) without structural failure. Pre-loaded dampers installed on the roof of the building open at a differential pressure of 6" WG to relieve internal overpressure. The dampers are 3-foot by 6-foot flat plates with a 1/4-inch welded rim which seats onto a gasketed surface.
The dampers are hinged by means of a rod welded to the plates and passed through grommets. Thus the dampers freely rotate 180 degrees around this axis. The SGTS is required to draw a minimum 0.25" WG negative pressure in the reactor building at 1100 scfm. This maintains post-accident personnel radiation exposure at the site boundary within 10 CFR Part 100 guidelines by minimizing the ground level release of airborne radioactive materials from the secondary containment. During a performance review of the normal reactor building ventilation system on March 12, the licensee had measured a negative pressure of 1.6" WG in the building. This was also verified subsequent to the event on March 15. On March 19, at the first opportunity following the event, the licensee performed Surveillance Procedure SP-624.1, " Secondary Containment Tightness Test," with satisfactory results. The inspector reviewed the test data and concluded that the integrity of the l
secondary containment had been adequately demonstrated.
The inspector interviewed licensee personnel and discussed the cause of the event with the system engineer. During severe weather conditions on March 13 and 14, wind gusts of up to 65 miles per hour were recorded at Millstone. During the evening of March 13, freezing
,
rain and snow entered the reactor building ventilation supply plenum and apparently caused I
the heating coil protective devices to trip building supply fan HVS-4. When an operator l
l
l
'
,
'
.
reset the devices and restored the fans, inlet air flow momentarily exceeded the capacity of the exhaust system and created a positive pressure surge in the building sufficient to lift the relief damper. The licensee concluded that the damper then was caught and forced fully open by a strong wind gust. The inspector found that at approximately 9:00 p.m., on March 13, and 7:30 a.m., on March 14, respectively, a plant equipment operator (PEO) and chemist noticed that the access door to the reactor building opened easier than normal, indicating a lower than normal negative pressure in the building. Neither individual notified the control room of the observation. At 1:30 p.m., on March 14, a health physics technician also j
noticed this condition, but notified the control room, as a result of which the open damper was discovered. The inspector reviewed OPS Form 696.2-2, "Outside and Reactor Building Rounds Log," for March 13 and 14, and noted that PEOs had checked off as completed the required general visual inspection of the refueling floor each shift as required. The inspector
also noted, however, that the procedure provides no guidance on what to look for during the
)
'
inspection, and that the relief dampers are not included in PEO training for this activity.
Finally, the inspector noted that the PEOs comparatively were recently qualified to perform l
rounds, and may not have acquired the sensitivity to changed conditions in the building that more experienced operators possess. The inspector expressed this observation to the operations manager, who committed to review PEO training to address this concern. The l
'
licensee also issued an operations night order which requires inspection of the relief dampers once per shift and after every change in ventilation system alignment. Finally, the event was discussed in operations shift turnovers attended by chemistry and health physics support
,
personnel.
TS 3.7.C requires secondary containment integrity to be maintained during all modes of plant operation, except cold shutdown with the reactor verified to be subcritical and all control rods inserted, and when a fuel cask or irradiated fuel is being moved within the reactor building. TS 3.7.C does not have action statements defining an allowed outage time for reactor building penetrations. Therefore, the inspector concluded that operation of the unit while the reactor building relief damper was open was technically a violation of TS 3.7.C.
However, upon discovering that the relief damper had opened, the licensee recognized that a loss of secondary containment integrity and SGTS operability had occurred and promptly initiated a plant shutdown. The licensee properly classified the event in accordance with its administrative procedures and notified the NRC in a timely manner. Upon shutting the l
damper, the licensee re-evaluated the integrity of the reactor building and had reasonable assurance regarding SGTS operability. The inspector considered the licensee's interim and
'
proposed long-term corrective actions for the apparent performance weaknesses identified l
during the event investigation to be appropriate. This violation was not cited since the l
criteria for enforcement discretion described in Section VII.B of 10 CFR 2, Appendix C
]
l were met.
- i l
,
I
.
.
2.3 Review of Plant Cooldown Procedures - Unit 1 At several other boiling water reactor nuclear facilities, operators have inadvertently exceeded the reactor vessel bottom head temperature / pressure limits contained in plant Technical Specifications (TS) while bringing the plant to cold shutdown. To determine if the events could occur at Millstone, the inspector reviewed plant operating procedures and discussed cooldown operations with control room operators.
The inspector reviewed procedures OP 301, " Nuclear Steam Supply System;" OP 206, " Plant Cooldown to Cold Shutdown;" and OP 633.1, " Temperature legging During and Subsequent to Reactor Heatup and Cooldown." The inspector noted that none of these procedures cautioned the operator to monitor the temperature of the lower reactor vessel head during times of inadequate recirculation pump flow to ensure plant temperature / pressure limits are not exceeded. Although operators were aware that stratification could occur during periods of inadequate recirculation pump flow, they were not aware that the reactor vessel temperature / pressure limits contained in plant TS could be exceeded. Further, they were unaware of the excessive cooldown events which had occurred at the other nuclear stations.
The inspector discussed the possibility of exceeding reactor vessel temperature / pressure limits during a reactor plant cooldown with the operations manager. The manager indicated he would review the applicable station operating procedures and determine if they needed to be modified to minimize the possibility of excessively cooling the lower reactor vessel head.
The inspector noted that the licensee's Nuclear Safety Engineering Group (NSEG) has recently commenced reviewing this issue for applicability and significance to Unit 1.
The inspector noted that when the overcooling events occurred at the other nuclear stations, a cooldown on natural circulation was occurring. Unit I normally cools down the plant with recirculation pumps if possible. Therefore, stratification of water in the lower reactor vessel head is less likely to occur.
Based upon a review of this event at Millstone, the inspector concluded that the possibility of overcooling the lower reactor vessel head was low since plant cooldown is normally accomplished by forced circulation. However, current procedures do not provide adequate guidance to operators on the potential for an overcooling event if cooldown is accomplished using natural circulation. Therefore, the commitment of the operations manager to review station procedures is prudent.
2.4 Reactor Coolant System Cooldown and Reactor Protection System Trip Actuations in Mode 3 - Unit 2 l
With the plant in the hot standby condition (Mode 3) following a reactor trip on February 22,1993, automatic reactor protection system (RPS) trip actuation signals which opened the reactor trip breakers occurred on three occasions. At the time, none of these trips were recognized by the licensee as requiring NRC notification pursuant to
.
..
.
'
!
10 CFR 50.72(b)(2). The failure to report these trips was identified subsequently by the l
licensee on March 11 and 12, during an investigation of a February 22 post-trip cooldown event. The NRC was then notified of the RPS actuations. The inspector reviewed licensee activities regarding the reactor trip actuations and made the findings and observations detailed below.
At 1:51 a.m., on February 22, Unit 2 tripped from 100% power as a result of a steam generator feedwater transient initiated when a steam generator atmospheric dump valve failed open. (See NRC Inspection Report 50-336/93-03 for details.) At 8:11 a.m, on February 22, l
a low steam generator pressure RPS trip occurred during the performance of the follow-up actions of Emergency Operating Procedure 2526, " Reactor Trip Recovery." Operators were
'
cycling turbine intermediate stop valves, which requires the reactor trip breakers to be closed and the main turbine to be reset. As designed, when the turbine was manually tripped per procedure, the main feed regulating valves closed and the feed regulating bypass valves moved to the 75% open position. There is a procedure caution several steps prior to the turbine trip step which states that resetting and tripping the turbine will cause the feed regulating bypass valves to move to a 75% open position. Before licensed operators took manual control of the bypass valves, the steam generators were overfed, a rapid reactor coolant system cooldown occurred, and steam generator pressure fell below the RPS trip actuation setpoint, opening the reactor trip breakers. Although the supervisory control operator entered receipt of the trip and opening of the reactor trip bicakers in the shift operating journal, none of the shift operating crew appear to have recognized that a valid reactor trip actuation had occurred. The event was not evaluated for reportability pursuant to licensee administrative procedures. After discussing the cooldown event with the operations department manager and the duty officer, the shift supervisor initiated a plant incident report (PIR) on February 25.
The inspector reviewed plant response data and verified that the plant cooldown and the ensuing low steam generator pressure trip occurred when the feed regulating bypass valves opened following the turbine trip. In written statements contained in the PIR, the supervisory control and secondary control operators suggested as corrective action that a procedure caution regarding feed regulating bypass valve response to a turbine trip be placed immediately prior to the step which actually trips the turbine. The inspector concluded that the operators either had overlooked or forgotten the existing precaution listed earlier in the procedure.
At 6:51 p.m., on February 22, during performance of Startup Surveillance Procedure SP-2401C, "RPS Turbine IAss of Imad Test," on RPS channel 'C', the channel 'D' linear power range nuclear instrument high voltage bistable spuriously tripped. This inserted I
channel 'D' variable high power, thermal margin / low pressure, and local power density trips through the power trip test interlock (P'ITI). The instrumentation and controls (I&C)
technician took no action in response to this actuation. In addition, when the technician completed the test on channel 'C', he failed to reset that channel's high voltage bistable, leaving redundant RPS channels in the tripped condition. Thus, when the channel bypass key
_ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _
- _ _ _
O
I
was removed from the 'C' RPS cabinet, the two-out-of-four coincidence logic was completed
'
and a reactor trip actuation signal caused the reactor trip breakers to open. In accordance with the surveillance procedure, the technician discussed the trip with the control room i
operators, who failed to evaluate the occurrence for reportability per licensee administrative procedures. Receipt of the trip was not logged in the control room journal. The licensee discovered this trip during its review of the cooldown event and included it in its March 11 notification to the NRC.
!
Table 3.3-1 of Technical Specification 3.3.1, " Reactor Protective Instrumentation," requires the variable high power trip function to be operable in Mode 3 when the control rod drive mechanisms are energized (reactor trip breakers closed). This requirement was added to the
,
l Unit 2 technical specifications (TS) on response to NRC Generic letter 86-13, " Potential
!
Inconsistency Between Safety Analyses and Technical Specifications." The conclusions of l
the generic letter indicated that the TS may not provide sufficient restrictions to assure that, l
should a continuous control rod bank withdrawal occur from suberitical conditions, the consequences are within those predicted by the safety analysis. The inspector attributed the l
failure to evaluate the trip for reportability to a lack sensitivity to the operability requirements of the RPS system in Mode 3, and considered this to be an example of poor understanding of the technical specification operability requirements. The licensee has briefed personnel regarding this issue and plans to follow up with written guidance.
!
At 10:43 p.m., on February 22, a third RPS trip actuation occurred. Problems with a turbine control valve input to RPS channel 'C' had prevented completion of Procedure SP-
,
2401C earlier in the evening. The On-Site Director of Station Emergency Operations
'
(ODSEO) questioned why the surveillance could not be completed with the existing condition of the turbine electro-hydraulic control system. The ODSEO discussed the surveillance with
,
the supervisory control operator and an I&C technician. The technician then demonstrated the procedure on both channels 'C' and 'B' of the RPS. The trip occurred when the high voltage bistables on both channels again were not reset, as required by the procedure. The trip actuation was not logged in the control room journal. The demonstration was conducted without a procedure or work order authorization for the RPS channels. The inspector found that the licensee personnel involved in the event believed that the system was not required to be in service and that the activities thus did not require use of a procedure or a work order.
Since the RPS technical specification requires the variable high pressure trip function to be operable with the control rod drive mechanisms energized, the inspector concluded that this position was erroneous, and considered this to be another example of poor understanding of l
technical specification operability requirements.
j Assessment and Observations The inspector concluded that the first reactor trip resulted from a lack of attention to detail during the performance of the EOP. Placement of a non-specific caution note six action steps prior to the turbine trip action step contributed to the operator's failure to override the automatic feed control signals and take manual control of the feed regulating bypass valves in
.
.
l time to prevent overfeeding the steam generators. The licensee stated that the procedure would be reviewed and enhanced as necessary. In order to remediate the inability of the operating staff to manipulate the feedwater control system in response to controllable secondary plant transients, the licensee plans to focus classroom and simulator training on feedwater control issues during the current operator requalification cycle.
Concerning the failure of licensee personnel to recognize and evaluate the events for reportability, the inspector concluded that the operability requirements of the RPS system in Mode 3 were not clearly understood by licensee personnel and contributed to the apparent lack of sensitivity to the trip actuations. The licensee acknowledged this NRC concern and committed to provide guidance to its staff regarding this issue. The inspectcc considered this response to be acceptable.
The inspector concluded that the two RPS trips which occurred on the evening of February 22, were caused by the I&C technicians' performance of procedure steps out of sequence and/or failure to perform the steps as written. Since no automatic reactor trips due to personnel error in the performance of RPS surveillance activities have occurred recently, the inspector concluded that the fact that the reactor was shutdown may have contributed to these procedure adherence concerns. NRC Inspection Report 50-336/91-29, dated January 13,1992, documented several examples of licensee failure to perform I&C
!
surveillance procedure steps as written, including one failure to reset an RPS trip bistable.
These performance deficiencies resulted, in part, in a Notice of Violation (50-336/91-29-01).
In a response letter, dated February 26,1992, the licensee described its corrective actions, including: (1) emphasize to personnel the need to specifically comply with procedure steps; I
(2) revise Administrative Control Procedure ACP-QA-3.02E, " Procedure Compliance," to incorporate level of use designations to all procedures; and (3) revise the ACP to address specifically the subject of step sequence. The inspector verified that these actions had been implemented prior to the February 22 events.
The inspector noted that the licensee had designated Procedure SP-2401C as a " General Use" rather than a " Continuous Use" procedure. Procedure ACP-QA-3.02E defines a " Continuous Use" procedure as one which controls an activity that is critical, complex, or involves infrequent evolutions or activities; for example, a surveillance which, if not performed exactly as written, could trip / scram the reactor. This level of use requires a procedure to be used in-hand and that each step be read prior to performance and completed prior to l
performance of the next step. " General Use" procedures permit performance of several steps l
while referring periodically to the procedure to confirm that all steps have been performed.
The inspector discussed the designation of Unit 2 RPS procedures as " General Use" with the I&C manager who stated that the classification was adequate if greater than one personnel
!
error would be required to cause a reactor trip. The inspector observed that this interpretation appeared not to meet the intent of the ACP and was contrary to the practice at the other Millstone units. The licensee stated that this position would be reconsidere >
o
.
Since the variable high power trip function of the RPS is credited in the TS and FSAR for mitigation of certain accidents in Mode 3, the inspector considered the lack of adherence to RPS surveillance procedures to have been safety significant. Also, the inspector considered to be significant the apparent ineffectiveness of the licensee's corrective action for the previous procedure compliance violation. The multiple examples on February 22 of failure
!
to follow Procedure SP2401C are a violation of licensee administrative procedures and NRC requirements (50-336/93-06-01). Open item 50-336/91-29-01 is closed.
The performance of a " demonstration" of a surveillance test on two RPS channels without a procedure, and on one channel without proper authorization, while control rod drive mechanisms were energized and the RPS was required, in part, to be in service, is contrary to licensee administrative procedures and NRC requirements. The lixnsee has counseled personnel regarding this issue. The inspector was unaware of simi'.ar prior examples concerning the RPS and considered the activity not reasonably preventable by corrective action for a previous violation. The inspector also considered the licensee's interim and long-term corrective actions to be acceptable. Therefore, this licensee-identified violation will not be cited, as the criteria of Section VII.B of the NRC Enforcement Policy were met.
The inspector reviewed the RPS actuations for reportability in accordance with licensee Emergency Plan Implementing Procedure (EPIP) 4701-4, " Event Classification," and concluded that these RPS trips required NRC notification within four hours. The inspector l
noted that the events had not been evaluated for reportability promptly by the licensee. The PIR, which invokes additional levels of event review, was not initiated until three days after cooldown event, and the initial (Phase I) PIR investigation was not completed until March 8, l
fourteen days after the trip. The inspector considered that more timely initial operator assessment and aggressive prosecution of the PIR may have resulted in earlier identification and reporting of the RPS actuations.
Further, the inspector reviewed Procedure EPIP 4701-4 and noted that it did not reflect the latest NRC requirements concerning engineered safety features and RPS actuations. The EPIP requires all unplanned actuations to be reported, but does not recognize that invalid actuations which occur after completion of the required safety function need not be reported to the NRC. The second and third RPS actuations resulted from personnel error (invalid),
but occurred prior to the safety function (reactor trip breakers opened) for that operating mode being completed. The licensee questioned whether the required safety function had not been completed with all control rods on the bottom. The,reportability of the second and i
third RPS trip actuations will remain unresolved pending clarification of the safety function of the variable high power RPS trip in operating mode 3 (50-336/93-06-02). However, the failure of operators to recognize the applicability and follow the existing procedure remained the primary concern. The licensee stated that the new reporting requirements would be addressed in a revised EPIP which will become effective on May 1,1993. The licensee's failure to make a timely NRC notification of the RPS actuation is a violation of Procedure EPIP 4701-4 and NRC requirements (50-336/93-06-03).
.
.
In summary, on February 22, operator error during post-trip procedure followup actions resulted in an unplanned reactor coolant system cooldown and a valid RPS actuation.
Licensee incident followup activities revealed that operations personnel failed to evaluate the actuation and notify the NRC of the actuation in a timely manner. Subsequently, during the performance of RPS surveillance activities by instrumentation and controls (IAC) personnel, two additional RPS actuations occurred which were known to the operations staff. The licensee again failed to evaluate the actuations for reportability promptly. The inspector determined that several instances of procedure noncompliance by instrumentation and controls personnel had occurred. Another violation by the operations personnel of licensee procedural requirements for NRC notification also was cited. A third violation concerning performance of an I&C surveillance test without proper authorization and without using a procedure was not cited. A common element in these performance deficiencies was an apparent lack of sensitivity by licensee personnel to the operational requirements concerning the reactor protection system when the reactor is shutdown.
2.5 Reactor Trip due to Secondary Plant Transient - Unit 3 On March 31,1993, at 1:03 a.m., with the plant at 100 percent reactor power, the turbine stop valves went closed, prior to a turbine trip signal, resulting in a severe secondary plant transient. The resultant rapid decrease in steam demand to the main turbine caused the steam generator levels to shrink due to increased steam pressure. The reactor automatically tripped on 'B' steam generator low-low water level as designed.
All reactor plant systems responded as expected. There were no code safety valve actuations on the primary side. One of the primary system power operated relief valves lifted for a few j
seconds and then reseated. Several steam generator safety valves lifted, however, one of the l
five 'D' steam generator safety valves failed to rescat after pressure dropped below its lift setpoint. Steam generator levels were recovered by the automatic start of the auxiliary feed water pumps. The feedwater isolation system actuated on low-low reactor coolant system temperature. This feature functioned as designed to arrest the cooldown of the primary system. No other engineered safety feature signals were initiated or required as a result of the trip. The licensee reported the reactor trip to the NRC headquarters duty officer pursuant to 10 CFR 50.72-(b)(2)(ii).
Operations personnel responded well to the trip and stabilized the plant in the hot standby condition. The operators manually closed the main steam isolation valves and gaged the open steam generator safety valve to limit plant cooldown. The plant was subsequently cooled down to 204 degrees Fahrenheit (F) (hot shutdown mode) in order to allow replacement of the steam generator safety valve. There was no measurable offsite release caused by the stuck open safety valve based upon low steam generntor activity levels at the tim :.
l*
i
!
The licensee has subsequently prestaged steam generator safety valve gagging devices next to the valves and has approved an operating procedure to allow quicker gagging of the steam
generator safety valves should a more severe radiological condition exist. The licensee's
!
event investigation continues to look for failures in the EHC system to identify the cause of the turbine control valve closure. Additional review of the corrective actions concerning the
i steam generator safety valves is discussed in Section 3.4 of this report.
3.0 MAINTENANCE (IP 62703)
The inspectors observed and reviewed selected portions of preventive and corrective maintenance to verify compliance with regulations, administrative contml procedures and appropriate maintenance procedures, compliance with codes and standards, proper QA/QC involvement, proper use of bypass jumpers and safety tags, adequate personnel protection, and appropriate equipment alignment and retest. The inspectors reviewed portions of the following work activities:
eM3-93-03911 Disassemble, inspect, lap diesel air start control valve seat eM3-93-03160 Inspect zines and heat exchanger inspection of 'B' emergency diesel generator
- M3-93-03169 Remove end plug on 'A' train control room air bottle and inspect for water and corrosion The inspectors determined that the maintenance activities observed were performed adequately with the exception of certain detailed observations provided in Sections 3.1 - 3.4 below.
3.1 Inspectio: of 4.16 kV Breakers - Unit 1 NRC Inspection Report 50-245/92-33 documented a December 24,1992, failure of the Gas turbine output beaker to close during a routine surveillance test. Examination of the breaker by General Electric (GE) the vendor of the breaker and licensee maintenance personnel, revealed that the breaker failed to close because of a deformed "H" bracket. The "H" bracket was deformed because of a misalignment which allowed the bracket to contact the breaker sidewall during operation. The misalignment was caused by a combination of worn bushings and a less than optimal alignment of the breaker tripping mechanism when preventive / corrective maintenance was performed on the breaker during the 1987 time period.
During the inspection of the breaker, it was also noted that the grease on the breaker had become hardened. Additionally, the licensee determined that several GE Service Advisory L.etters (SALs) which concerned the breakers had not been adequately evaluated by the licensee. To ensure other 4.16 kV breakers were not susceptible to a similar failure, the
-
-
-
.
.
licensee elected to inspect additional 4.16 kV breakers. NRC unresolved item 50-245(92-33-03) was opened pending evaluation of the results of the breaker inspections and assessment of the breaker preventative maintenance program.
At the close of this current inspection, the licensee had checked the alignment of 38 out of 67 GE breakers. No other significant misalignment of the prop mechanism was noted.
However, the trip and close mechanisms of several breakers exhibited signs of sluggish operation due to missing or hardened grease. To improve performance of the breakers the mechanisms were relubricated or the breakers were replaced with spares.
Following completion of the breaker inspections, the licensee elected to send the defective gas turbine breaker to GE for cleaning, relubrication, rebuild and update. According to GE, depending on service application, the breakers should be rebuilt every 5-7 years to ensure optimal performance. Following rebuild of the gas turbine breaker, the licensee will periodically send breakers to GE for refurbishment. It is the intent of the licensee to have all breakers refurbished prior to restart from the scheduled 1994 refuel outage.
The inspector was informed by the licensee that the GE 4.16 kV breakers have performed well during the life of the plant. The December 29,1992 gas turbine breaker failure, was the first caused by misalignment or bushing deterioration. Therefore, prior to the December 29 failure, the licensee had concluded that overhaul and repair of the breakers was not necessary.
The inspector reviewed the vendor manual that was supplied with the 4.16 kV breakers. The inspector noted that the manual does not recommend that the breakers be overhauled every 5-7 years. Rather, the manual recommends that an overhaul be performed on a breaker every 2000 cycles. Currently only one breaker at Millstone Unit I which supplies power to the 'A'
reactor building component cooling water pump (RBCCW) has greater than 2000 cycles.
That breaker did not exhibit signs of significant misalignment. Additionally, the maw does not specify a service life for the breaker grease.
Notwithstanding the good performance of the breakers to date, the inspector noted that the licensee personnel appeared to be unaware that the grease on the breakers had deteriorated since the last preventive maintenance effort approximately 6 years ago. Additionally, the licensee was unaware that the GE vendor manual recommended that the licensee review breaker performance after 2000 cycles of operation and consider the necessity for refurbishment. The inspector considered that a good breaker preventive maintenance program would have evaluated the GE recommendations regarding breaker refurbishment contained in the vendor manual prior to the RBCCW pump breaker exceeding 2000 cycles.
Additionally, the grease on the breakers should have been maintained. Therefore, the inspector considered the licensees present breaker preventive maintenance program to be
]
weak.
I
_ _ _ _
.
.
The inspector noted that the licensee is in the process of refurbishing the installed GE breakers. Additionally, the licensee is in the process of developing an improved maintenance program which will ensure that the grease on the breakers will be maintained in an a good condition and the overall breaker condition is adequately evaluated. The inspector considered this corrective action to be adequate to prevent recurrence of the failures. Therefore, unresolved item (50-245/92-33-03) is closed.
While reviewing this event, the inspector noted that the licensee had not assessed vendor information pertaining to the breakers contained in the SALs, that had been supplied to the licensee. The information contained in the SALs recommended replacement of the prop bushings with an improved material and advised that the stop block be rewelded.
The lack of assessment could be attributed to a weak formal program which would collect and disseminate industry vendor information to responsible personne.1 in the licensee's organization. Specifically, the current Station Procedure NEO 2.01, " Implementation of 10 CFR 21 Reports of Defects and Noncompliances," states that vendor information is to be received by the supervisor of Procurement Vendor Services (PVS) who collects the information and sends it to the corporate Nuclear Operations Department (NOD) where the information is assessed and distributed to the applicable department for action. However, when the inspector contacted PVS and the NOD. Neither department had records of receiving the GE SALs of concern.
Weaknesses in the dissemination of vendor information hAd been previously identified in a nuclear safety engineering evaluation E91-011, entitled " Handling of Vendor Information,"
dated November 15, 1991. In that report, the nuclear safety engineering group (NSEG)
determined that vendor information was not being adequately controlled and distributed through the Millstone Units.
In response to the NSEG report, the NOD has commenced entering vendor information that has been received by the station into a tracking system since June of 1992. In that tracking system, the licensee was able to identify three GE SALs that had been distributed to the station since June of 1992. Nuclear Engineering and Operations Procedure (NEO) 6.13,
" Handling of Vendor Information," is being developed to fonnally document the NOD tracking processes. The procedure is scheduled to be implemented by June 30,1993.
Following implementation of NEO 6.13, the licensee will contact its vendors in an attempt to obtain previously issued vendor information.
The inspector concluded that the revised system for handling vendor information was necessary to fulfill the intent of previous commitments to evaluate vendor and operational experience.
.
_
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _
b
-
,
3.2 Failure of Valve to Operate - Unit 1 On March 2,1993, while performing a surveillance test on the 'B' train of the Emergency Service Water (ESW) system, valve 1-LPC-4B which is located on the discharge of the Iow Pressure Coolant Injection system heat exchanger, did not open when required. Investigation j
of the valve failure, revealed that auxiliary contacts located in the valve controller at the 480 l
'
volt motor control center had stuck in the open position which prevented the valve from operating. Once maintenance personnel had exercised and cleaned the contacts, they operated freely and the valve stroked as designed.
Examination of the contact revealed that the contact binding was caused by a grease residue which remained after a cleaning agent had been applied to the contacts during previous maintenance activities. According to the licensee, the grease residue was all that remained of a " Tale" based grease which had been applied to the contacts during original plant installation or previous maintenance activities. The dried grease residue prevented a bakelite bar in the auxiliary contact mechanism from moving in the contact assembly. Movement of the bakelite bar opens and closes the auxiliary contact switch as required. The licensee j
discontinued cleaning the 480 volt contacts with a cleaning agent in April 1991, when it was j
determined that the leftover grease residue from the cleaning operation prevented a safety i
related valve from operating during a surveillance test. A review of the licensee's maintenance data base revealed that since 1985, approximately 29 work orders have been written to repair sticking contacts in safety and non-safety related applications at Unit 1.
After consulting with General Eectric (GE), the manufacturer of the 480 volt controller assemblies, the licensee determined that inadequate preventive maintenance had contributed to the contact sticking problem. Specifically, GE recommends that the relay sliding surfaces be cleaned with a cloth every 3-5 years and lubricated. However, the licensee never included the contacts in as systematic maintenance program that cleaned and relubricated the contacts. Additionally, GE does not recommend that the contacts be cleaned with a cleaning agent. The application of the cleaning agent apparently caused the " Tale" based lubricant to solidify on the contacts' sliding surfaces which inhibited their movement.
The inspector determined that the lack of maintenance may be partially attributed to an inadequate maintenance manual that was originally supplied with the controllers.
Specifically, the inspector reviewed the vendor manual for the 480 volt controller assemblies and noted that GE did not specify that the contacts had to be cleaned and relubricated every 3-5 years. Further, use of a cleaner on the contacts was not specifically prohibited by the vendor manual.
The inspector noted that the contact failures were caused by a combination of problems.
First, the licensee did not ensure the contact cleaner was compatible with the contacts prior to applying it to the contact surfaces. Second, the GE vendor manual did not provide adequate guidance to the licensee concerning contact maintenance. In fact, prior to the
i
.
March 2 event, GE had informed the licensee, after previous failures, not to lubricate the contact surfaces. Therefore, if a contact failed, the licensee would clean the contact, ensure l
it operates freely, and return it to service. No lubrication would be applied.
To prevent similar failures, the licensee has commenced a program of cleaning and relubricating the auxiliary contacts when routine surveillances are performed on the equipment that the contacts are installed in. Additionally, due to the age of the 530 volt controllers, the licensee is considering replacing the installed motor control asse.nblies with controllers of a newer design. According to the licensee, the auxiliary con 2 cts in the new controllers should be less susceptible to binding since the auxiliary contacts are sealed and should therefore be less susceptible to dirt buildup from exterior sources and intrusion from a l
cleaner.
The inspector concluded that the licensee has now obtained adequate guidance from GE concerning maintenance of the 480 volt controllers. Therefore, performance of the GE auxiliary contacts should improve. The licensee intends to have the majority of the contacts in the plant cleaned and lubricated by April 17, 1993. The inspector concluded that the l
licensee's repair schedule was acceptable.
'
l l
However, when reviewing this event, the inspector noted a weakness in the licensee's j
l corrective action program and overall analysis of the contact failures. Specifically, followmg the previous contact failures, the licensee did not determine if the potential for a common l
mode failure existed and how that failure affected overall plant safety. Additionally, the l
corrective action which was recommended in Plant Incident Reports 1-91-42 and 1-92-109
'
following previous contact failures, cleaning the contacts and increasing the frequency of l
preventive maintenance, was not implemented on other safety-related 480 volt motor control centers. The inspector determined that the failure of the licensee to inspect, and clean other safety-related contacts and remove the deleterious grease residue allowed other contacts to stick and subsequent failures to occur. This is a violation of 10 CFR 50, Appendix B, Criterion XVI, which requires corrective action to assure that failures do not recur (50-245/93-10-04).
The inspecor noted that the failure of the licensee to consider the potential for a common mode fauure caused by auxiliary contact sticking was also a Plant Operations Review Committee (PORC) weakness. The inspector discussed this determination with the Unit Director who agreed that the potential for a common mode failure should have been evaluated when the events were discussed at PORC meetings. The director informed the inspector that the historical failures would be evaluated for their significar.ce during the Plant
Incident Report Investigation of the March 2,1993 event.
.
'
.
'
)
3.3 High Pressure Coolant Injection System Throttle Valve Maintenance - Unit 2 Following filling of a safety injection tank on March 15, the licensee tested the high pressure coolant injection (HPSI) system throttle valves in accordance with Technical Specification
]
4.5.2.e., "ECCS Subsystems." During performance of Surveillance Procedure SP-2604F,
" Facility 2 High Pressure Safety Injection System Alignment Check and Valve Operability Test," valve 2-SI-616 overtraveled the throttle position mark on the valve actuator. The correct throttle position of the valves is obtained by placing a specially marked tool on the stem nut lock nut and aligning the tool to a marked ring on the valve actuator housing.
Operators manually shut valve 2-SI-616 to the mark and initiated a plant incident report.
The valve limit switches were subsequently adjusted under automated work order (AWO)
M2-93-03970. The inspector verified that the technical specification requirements for the HPSI system had been met.
On March 16, the licensee checked the condition of the stem nut locking nuts of the HPSI throttle valves under AWO M2-93-03890. The inspector witnessed the work in the auxiliary
<
building penetration room to assess the coordination of the maintenance activity with the operations staff, to verify that technical specification requirements were met, and to evaluate radiological controls. The licensee found the locking nut on valve 2-SI-636 to be loose approximately one-third of a turn, and retightened and staked the nut. When tested, the valve traveled past the positioning marks. When positioned to the marks, dual position indication
)
was received in the control room indicating that the marks were no longer accurate and that the valve was not in the correct throttle position. The licensee initiated a nonconformance report (NCR) to correct the problem and a plant incident report to evaluate the programmatic implications of the occurrence. The valve was repositioned using temporary marks in accordance with the NCR disposition, restoring the operability of the HPSI system. On March 17 the positioning ring was readjusted to restore the accuracy of the local marks. 'lTic licensee also tightened and restaked the locking nut on valve 2-SI-647. The slight misalignment of the nut on this valve was not sufficient to have affected system operability adversely. No other discrepant valves were identified.
'
The inspector concluded that proper radiological controls had been implemented, that the maintenance activity had been well-coordinated with the operations staff, and that technical specification requirements had been satisfied. While in the penetration room the inspector identified to the licensee several housekeeping and material condition discrepancies including boric acid buildup on HPSI and charging system header vents, poor lighting, and uninstalled pipe insulation cans. The licensee promptly initiated trouble reports and AWOs to correct the items. Previous housekeeping concerns at Unit 2 were documented in NRC Inspection Report 50-336/92-35. The inspector discussed the latest observations with the unit director, who responded that a new program to upgrade conditions in the auxiliary and enclosure buildings was being developed by the Unit 2 radiation protection supervisor. Implementation of the program will be evaluated during NRC followup of unresolved item 50-336/92-35-00 __
P O
3.4 Failure of Steam Generator Safety Valve to Rescat - Unit 3 On April 3,1993, steam generator safety valve,3 MSS *RV23D, was replaced due to the failure to fully reseat subsequent to the March 31 reactor trip. The safety valve is i
manufactured by Dresser Industries. The licensee reviewed industry events for failures of steam generator safeties and examined the safety valve after removal from the system, and found no obvious defects that would have prevented the valve from rescating. The valve was
'
subsequently sent to Wyle l2boratories for testing.
Examination of the safety valve at the test laboratory revealed that the lower nozzle ring was misadjusted 47 notches high. This was concluded to have resulted in the failure of the valve to reseat properly after lifting. Full flow testing of the valve after adjustment of the lower
!
ring resulted in three satisfactory blowdown tests.
l Invest:gation by the licensee revealed that the relief valve that failed to rescat was last i
worked by Crosby Valve Company. A review of the sequence of events for the March 31 reactor trip revealed that thirteen of twenty steam generator safety valves had lifted, six of which had been refurbished by Crosby. The licensee subsequently examined two safeties that Crosby had reworked which did not lift during the transient and noted that the lower blowdown ring for both valves was out of alignment and had to be lowered. As a result of this finding, all steam generator safety valves which Crosby had refurbished which were installed in the plant were examined for lower blowdown ring setting. Of the eleven valves set or refurbished by Crosby, seven required adjustment of the lower ring in varying degrees. The inspector noted that the licensee's maintenance procedure contained guidance concerning setting of the blowdown ring. Checking the setting of the ring is a Quality Assurance (QA) attribute.
As corrective action, the licensee adjusted the lower blowdown rings to their proper setting and is investigating the question of the QA inspection attribute failure of the Crosby QA program. The licensee determined that lift testing of the valves is not required as a result of these adjustments since the valve lift setpoint is unaffected. The before and after testing of valve 3 MSS *RV23D performed at Wyle laboratory confirmed this assertion. Full flow testing would be required to confirm proper blowdown, however, this is not a normally performed test. The proper set position of the blowdown rings have been determined by component type testing.
The inspector concluded that the licensee's corrective actions were adequate and had no further questions at this time. The generic applicability of the apparent Crosby QA program
failure remained unresolved pending completion of the licensee's investigation (50-423/93-07-05).
,
.
.
.
l 4.0 SURVEILLANCE (IP 61726)
The inspectors observed and reviewed selected portions of surveillance tests, and reviewed.
,
test data, to verify compliance with: procedures; technical specification limiting conditions for operation; removal and restoration of equipment; and, review and resolution of test deficiencies. The inspector reviewed portions of the following tests:
,
ESP 3608.2
'B' safety injection pump operational readiness test eOP3361 Flux mapping system operation ESP 3622.3 Auxiliary Feedwater pump,3FWA*, Operational Readiness Test ESP 3886 P2 containment air operability test post accident sample system
Except as noted below, the inspector determined that the surveillance activities observed were conducted adequately. Details of the inspector's observations are provided in report Sections 4.1 - 4.2.
]
.
4.1 Emergency Diesel Generator Surveillance Testing - Unit 2
During a control room observation on March 17, the inspector noted that both emergency diesel generators (EDGs) were being operated in parallel with the offsite power source (the
'
grid). Through review of the operating shift joumal the inspector determined that the 'A'
l EDG had been operated in parallel with the grid for 71 minutes while the 'B' EDG was out i
of service. Later, both EDGs were operated at the same time in parallel with the grid for 75 minutes.
The licensee had been running the 'A' (operable) EDG to satisfy the requirement of
!
Technical Specification 3.8.1.1.a., which states that when one EDG ('B') was out of service, the operability of the remaining diesel generator must be demonstrated within one hour, and every eight hours thereafter, by verifying that the diesel starts from ambient conditions, and accelerates to greater than 90% of rated speed and to greater than 97% of rated voltage
,
within 15 seconds. Due to concerns regarding buildup of residual lubricating and fuel oil m
the exhaust headers when operating the machine without an electrical load, the licensee's practice had been to load the machine by paralleling the EDG to the off-site power supply.
Following the preventive maintenance on March 17, the '.B' EDG had been paralleled to the grid for testing prior to its return to service. At the same time, the operability verification l
run of the 'A' EDG (also paralleled to the grid) was in progress. The inspector questioned l
the licensee regarding what affect this pr' tice would have on plant safety equipment should l
an electrical fault occur on the grid or within the on-site electrical distribution system. The inspector also notified the team leader for the ongoing NRC electrical distribution system functional inspection (EDSFI) of the finding.
On March 26, the licensee determined that synchronizing an operable EDG to the grid makes the machine susceptible to disabling faults which could result in plant operation with no
!
operable on-site emergency power supplies to the 4160 volt and 480 volt safety buses. The
.
...
...
.
\\
'
licensee immediately issued an operations night order which prohibited operation of both EDGs in parallel with the grid at the same time. Surveillance schedules were changed to avoid this condition, and procedures were changed to start, but not to load, the operable EDG when required by technical specifications while the other EDG is out of service. The j
licensee also initiated a technical specification change request which would eliminate the requirement to start the operable EDG when the redundant machine is out of service for preventive maintenance. On March 29, the licensee determined that the practices described above were reportable to the NRC pursuant to 10 CFR 50.72 as a condition which alone
,
could have prevented the fuliillment of a safety function needed to mitigate the consequences j
of an accident.
l i
The inspector concluded that the licensee's interim corrective actions were adequate to assure i
the operability of at least one EDG during operation, a id that past inappropriate surveillance practices had been evaluated and reported to NRC. The results of the licensee's technical
evaluations and the review of previous practices regarding EDG operations will be discussed in the EDSFI team Inspection Report 50-336/93-80.
4.2 Failure to Test Slave Relays - Unit 3 On March 29,1993, with the plant at 100 percent power, operators identified that slave relays K610 and K626 had not been fully tested in accordance with technical specifications (TS). These relays provide actuation signals to components in the auxiliary feedwater and
emergency diesel generator systems following a safety injection or containment depressurization actuation signal, respectively. Slave rdays are required to be tested on a i
'
quarterly basis to satisfy overlap testing requirements of TS 3/4.3.2, " Engineering Safety j
Features Actuation System (ESFAS) Instrumentation." The licensee entered TS 3.0.3/4.0.3 for failure to adequately test the relays and determined the event to be reportable in accordance with 10 CFR 50.73(a)(2)(i). The surveillances for K610 and K626 were then performed satisfactorily and the TS action statement was exited within the 24-hour grace period allowed by TS 4.0.3.
During an independent review effort by control room operators, the effectiveness of relay testing for several other slave relays was questioned. As a result, on March 31, the Unit Director commissioned a task force to perform a 100 percent review of all slave relays i
installed in the plant. This review and the required corrective actions were to be completed prior to the restart from the March 31 unit trip. A comprehensive review performed by the task force revealed that 31 of the 180 slave relays had not been fully tested. These relays also receive actuation signals to realign ESFAS components. Existing smveillance procedures were modified and inservice tests developed to test the relays. No failures were identified upon the completion of testing.
,
As documented in Inspection Report 50-423/92-31, the licensee acknowledged that there have l
been additional overlap testing deficiencies in the instrument, process control, and solid state l
protection systems. The inspector discussed the issue with the Unit Director, who stated that f
l l
i l
l.
H
another task force will be established to review overlap testing deficiencies. This review is scheduled to be complete by the end of the next refueling outage. This item remains unresolved (50-423/93-07-06).
5.0 SAFETY ASSESSMENT / QUALITY VERIFICATION (IP 40500,90712)
5.1 Safety Evaluations - Unit 3 l
l The inspector reviewed the licensee's program at Unit 3 for performing plant changes, tests, l
and experiments (CTE's) under the provisions of 10 CFR 50.59 (50.59). The review included consideration of procedures and training for performing 50.59 determinations, and several specific examples of these determinations.
,
Procedures
!
The licensee established formal procedural guidance for performing 50.59 reviews in Administrative Control Procedure (ACP), ACP-QA-3.08, " Safety Evaluations (NEO 3.12)."
Safety evaluations are performed to evaluate the impact of proposed plant changes and to i
determine whether or not the proposed change is an unreviewed safety question (USQ).
i These safety evaluations are reviewed by the Plant Operations Review Committee (PORC)
and by the Nuclear Review Board (NRB) to determine that an USQ is not involved. Safety evaluations may be required by Plant Design Change Records (PDCR's); jumper, lifted lead, and bypass changes; and procedure changes. Unit 3 personnel are trained to use the questionnaire contained in ACP-QA-3.08 when performing safety evaluations. There are no specific Unit 3 engineering procedures which address safety evaluations, thus the difference in format for safety evaluations noted for Unit 1 in NRC Inspection Report 50-245/92-04 was not observed. The individual who prepares the safety evaluation answers seven questions which collectively address the criteria of 10 CFR 50.59 (a) (2). Also, ACP-QA-3.08 requires that an integrated safety evaluation be performed if there is an impact from the proposed change on the licensing basis accident analyses. Plant design change records can require either a long form, which asks many questions when there is a functional change in a system, or a short form which just asks what is going to be done and why.
In summary, the inspector verified that the licensee has established formal procedural guidance and controls to evaluate each CTE, for which 50.59 is applicable, to determine whether an USQ exists or a change to the Technical Specifications is required.
Training Training of engineers who perform 50.59 evaluations involves: formal classroom training, reading and acknowledging by initialing changes in NEO procedures; and attendance at a two week Westinghouse training cours l
.
.
Prior to this year, classroom training related to 50.59 determinations had been included in separate training courses which teach safety evaluation preparation, or PDCR preparation.
These two courses are still offered separately; however, 50.59 training is also included in the Engineering Support Initial Orientation Training course. The initial orientation training, offered by the newly-merged site and corporate training organization, is about a seven week course which was first presented this year, and is given to all new engineers at the plant during their first year of employment. Corporate engineers may take the course on a space available basis. The first course began February 1, and a second course is scheduled to begin April 5. The inspector reviewed the lesson plan for the class on safety evaluations.
Many illustrative examples of departure from 50.59 criteria are given. The training course
includes a two hour workshop in which the trainees break into teams of 3 or 4 to prepare a safety evaluation. The classroom training for Unit 3 personnel appears to adequately address
'
performing 50.59 evaluations.
In addition, about 30 employees attended a two week We'stinghouse course," Plant Transients, and System Design Basis." Included in the course was a discussion of 50.59 determinations and the basis of the Unit 3 plant design. Based on the above, the inspector concluded that j
the 50.59 training for Unit 3 engineers was adequate.
l Reviews of 10 CFR 50.59 Determinations The inspector selected specific examples of 50.59 determinations from a draft copy of the licensee's 1992 annual report, scheduled to be issued during the first week of March 1993.
Safety evaluations were reviewed from each change category (PDCR's, procedure changes, and lifted lead and bypass changes). The inspector agreed with the conclusion for all the determinations that he reviewed. The approach of using a standardized format resulted in all the 50.59 criteria being covered for all of the examples that were reviewed. No instance was discovered of a significant consideration that was overlooked in a 50.59 determination.
Diesel Generator Fuel Oil Storage Tank Capacity The NRC has recently become aware of a difference between the diesel generator fuel oil storage tank capacity as described in the NRC Safety Evaluation Report (NUREG-1031, and
,
!
supplement 4 thereto) related to the operation of Unit 3, and the diesel fuel oil storage tank capacity recently calculated by the licensee using a revised calculational methodology. The l
new calculation found that current diesel day tank capacity (45 minutes) and fuel oil storage capacity (6 days) do not meet the licensing / design basis commitments of 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and 7
'
days, respectively. The inspector discussed with the licensee whether any 50.59 determination addressed the changed value of the fuel oil tank capacity, and found no determination had been conducted. The licensee stated that the only load changes were changes that would not have increased fuel consumption, and thus did not require reevaluation of fuel storage tank capacity. The inspector was informed that differences in the newly calculated fuel storage tank capacity resulted from improved calculational methods, such as allowing for the possibility of lower density fuel oil, more accurate calibration of the
)
!
l
.
oil tank stomge level instrumentation, and allowance for vortexing in the fuel oil storage tank. The inspector informed the licensee that a formal 50.59 determination and Final Safety
,
l Analysis Report (FSAR) change would be required for the NRC to address the discrepancies l
between the current design basis (SER/FSAR) and the revised fuel capacity calculation. This issue remains unresolved pending licensee submittal and NRC review of the 50.59 determination (50-423/93-07-07).
Conclusion
!
l Within the scope of this inspection, the inspector concluded that Unit 3 properly implemented l
the requirements of ACP-QA-3.08 and 10 CFR 50.59 for the changes, tests, and experiments reviewed. No immediate safety significant concerns were identified. However, the inspector
'
found no 50.59 determination had been conducted to address the Unit 3 fuel oil storage tank capacity change. Licensee performance in the area of 50.59 determinations will continue to be reviewed as pan of future inspections.
5.2 Review of Written Reports The inspector reviewed periodic reports, special reports, and Licensee Event Reports (LERs)
for root cause and safety significance determinations and adequacy of corrective. action. The inspectors determined whether further information was re' quired and verified that the
.
reponing requirements of 10 CFR 50.73, station administrative and operating procedures, l
and technical specifications 6.6 and 6.9 had been met. The following reports and LER's were reviewed:
Unit 1 Monthly Operating Report for February 1993, dated March 8,1993.
Unit 2 Monthly Operating Report for February 1993, dated March 15, 1993.
Unit 3 Monthly Operating Report for February 1993, dated March 8,1993.
l LER 50-336/93-003 discussed an event in which high pressure safety injection was inoperable due to a mispositioned valve in one train while the emergency power source to the redundant train was out of service for planned maintenance. The event was reviewed
.
previously in Section 4.3 of NRC Inspection Report 50-336/93-03.
j LER 50-336/93-004 discussed two automatic reactor trips on low steam generator level which occurred on February 22 and 23,1993. The events were reviewed previously in Section 2.4 of NRC Inspection Report 50-336/93-03.
.
LER 50-423/92-032 discussed improperly performed radiation monitor smveillance. This issue is discussed further in Section 5.2.1 of this report.
!
l
._ ______________
.
LER 50-423/93-001 discussed the failure to verify testing of nuclear instrumentation inputs into the Westinghouse 7300 process control system. This event was reviewed previously in NRC Inspection Report 50-423/92-31.
LER 50-423/93-002 discussed the potential common mode failure of the control mom envelope pressurization system.
5.2.1 Radiation Monitor Surveillance Improperly Performed - Unit 3 With the plant at 49 percent power at 12:30 a.m., on December 19, 1992, the licensee determined that the daily surveillance channel check of the process flow monitor for the reactor plant ventilation radiation monitor was improperly completed. The operator who reviewed the video display for the radiation monitor mistakenly recorded the conversion factor for process flow (1.56 x 10E4) instead of the actual process flow (1.71 x 10E5 cfm)
and did not recognize that the value entered was outside of the limits listed on the surveillance form (3x10E4 to 2.8x10E5 cfm). The supervising control operator and shift supervisor (SS) reviewed the logs for the shift but also did not detect the error. The subsequent shift SS discovered the error at 7:18 p.m., while reviewing the control room logs. The licensee determined the cause of the event to be inattention to detail. The issue was reported in Licensee Event Report 50-423/92-32, dated January 15, 1993.
The licensee's immediate corrective action was to reperform the channel check and review the hourly average discharge concentration over the time period since the correct process flow should have been recorded. This review showed that no change in discharge concentration had occurred. The licensee's action to prevent occurrence was to counsel the individual and all other licensed members of the shift on the importance of attention to detail.
In addition, the operations department is in the process of strengthening the self-checking
'
performed by operators and have developed a self-verification program.
The inspector considers that the licensee's corrective actions were appropriate. In addition, although the incorrectly performed surveillance constitutes a technical specification violation, i
it was identified and reported by the licensee and had minor safety significance. Therefore, per Section VII.B of the NRC Enforcement Policy, enforcement discretion was exercised and no violation will be issued.
5.3 Plant Operations Review Committee - Unit 2
)
The inspector attended meetings of the Plant Operations Review Committee on March 24 and l
April 7. The inspector verified that the technical specification administrative requirements for the meetings were satisfied and that the committee discharged its functions in accordance with regulatory requirements. Items discussed included a draft licensee event report (LER)
concerning a reactor coolant system cooldown event and reactor protection system trip actuations which occurred following a reactor trip on February 22, and a plant incident report (PIR) concerning the return to service on January 28, of a vital switchgear room
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _.
.
.
i cooler with an unapproved nonconformance repon. Regarding the draft LER, the inspector observed that the root cause and corrective action discussions were hampered by the fact that
'
the related PIR investigation had not been completed. LERs must be completed within 30 days of discovery of an event, while licensee administrative procedures permit up to 90 days for final PIR resolution. The inspector concluded that the PORC deliberations would have been better served had the PIR investigation been completed within the LER time frame.
The inspector noted thorough discussions of the matters presented to the PORC, and a good regard for safe operation of the unit.
5.4 Review of Self Assessment Group Activities The inspectors observed the activities of the licensee safety assessment groups to determine the effectiveness of these self-assessment activities and to determine the quality of feedback of assessment findings to management. The inspectors reiviewed assessment group activities for the 1992 calendar year and interviewed key personnel from these groups. The specific groups reviewed included all three plant Nuclear Review Boards (NRBs), the Site Nuclear Review Board (SNRB), the Combined Utility Assessment Team (CUAT), the Unit 3 Independent Safety Engineering Group (ISEG), and the audit and surveillance groups of the
,
Quality Services Department (QSD). The inspectors evaluated the performance of these
groups against ANSI N18.7-1976, " Administrative Contml and Quality Assurance for the
,
'
Operational Phase of Nuclear Power Plants;" Northeast Utilities Quality Assurance Pmgram Topical Report, Section 18.0, " Audits;" Procedure NEO 2.02, "Chaner for Nuclear Review Boards;" Procedure NEO 3.01, " Conduct and Format of Nuclear Review Board Audits;"
Procedure ACP-QA-9.07C, " Quality Services Smveillance Program;" Procedure QSDI-AG-1.01, " Performance, Reporting, and Follow-up of Assessment Services Audits;" and the applicable portions of each units' technical specifications.
'
Nuclear Review Boards To develop an assessment of NRB effectiveness, the inspector attended several board
.
meetings, reviewed 1992 meeting minutes and the records for selected items carried forward
'
(ICF) for each board. The inspector also interviewed the chairman of each board to discuss performance of the board and the board's impressions of unit performance including areas of strength and weakness, and responsiveness to the board's recommendations.
The inspector concluded that the NRBs met the NEO 2.02 charter with varying degrees of effectiveness. The boards tended to focus their assessment activities more on specific technical issues rather than programmatic broad-scoping topics. As evidenced by the uniformly low ICF backlog, technical questions are answered to the boards' satisfaction in a reasonable time. However, ICFs were mainly technical in nature and programmatic ICFs took longer to complete to the boards' satisfaction. The primary example of this was Unit 3 ICF 90-15-2 (November 1990), which has remained open pending site-wide incorporation of procedural guidance for the use and control of dedicated operators, and pending incorporation into corporate engineering procedures guidance for use and crediting of
.
i dedicated operators for special tests and plant modifications. Significant progress has been made in implementing operational procedures; however, the corporate response was slow and has since been tied into the Performance Enhancement Program (PEP) development of a
'
corporate design control manual (DCM) which is projected for implementation in 1994. The effort to provide uniform definitive guidance for the use of dedicated operators was a good initiative of the Unit 3 NRB. However, more prompt guidance to the engineering departments could have prevented unnecessary confusion in this area as was experienced during special testing of the Unit 3 supplementary leak collection and release system and auxiliary building filter system in February and November 1992, respectively.
In addition to QSD audits for NRB, the boards' reviews of ongoing programs were limited to presentations by personnel responsible for the programs. The inspector observed three such presentations and noted contrasting performance by two of the boards. One board actively participated with questions and assessment in a presentation of the High Energy Line Break Program. Guided by the line of questioning, the presenter provided in depth technical details and management rationale for implementation strategies which celayed the implementation at the unit i1 question. Following the presentation, the board requested a written safety evaluation stating that the delay in implementation would not adversely affect safety of the unit. Conversely, another board was presented an overview of the licensed operator training program which lacked in information which would allow board assessment of program performance. Very few questions were asked and no assessment of program performance was made.
Communication of board assessments of plant performance to site and corporate management is accomplished by wide distribution of meeting minutes and the annual staff evaluation reports. The inspector reviewed the 1992 meeting minutes and the 1991 and 1992 staff evaluation reports for each unit. The inspector noted that meeting minutes adequately reflected the topics reviewed at each meeting; however, some minutes were lacking in details of the board assessment ofitems reviewed. Similarly, the annual reports were compilations of data and contained little assessment. The inspector acknowledged that the quality and content of these documents varied significantly between the three units. Notwithstanding, there is room for improvement in the quality of communication of board assessments to management.
Site Nuclear Review Board The inspector attended a SNRB meeting, interviewed the chairman and selected members, and reviewed the 1992 meeting minutes. The Millstone SNRB differs from the unit NRBs in that this board is responsible to review matters common to the site and to assess the effectiveness of the Quality Assurance (QA) Program and the QSD audit program. Although the meeting minutes are the primary documentation and method of communication of board l
assessment activities, little detail of audit assessments other than the audit number, topic, and l
number of findings was provided. There were no auditable documents with which to evaluate the board's assessment of the QA Program. During the board meeting, which the
_ _ _
.
.
inspector observed, no QSD audits were reviewed; however, the completed responses to the 1991 CUAT were reviewed. There was little assessment of the plant response to this audit except that the issues appeared to be " son" management issues rather than technical issues.
One board member raised the concern that most of the responses to this audit stated that the concern would be addressed by various PEP topics. The concern was voiced that in effect, this action transferred an issue from one tracking system to another but that there was no assurance that the individual responsible for each affected PEP topic was aware that items were added which could require additional validation and verification. The ensuing discussion of this concern was brief and unproductive. The SNRB appeared to accept this situation as common when PEP is relied upon to resolve issues.
The inspector concluded that there is significant room for improvement in the SNRB activities to assess QA Program performance, QSD audit activities, and site corrective action programs. The inspector acknowledged that site management is on the SNRB and would therefore receive the board assessment of station activities directly. However, this membership should not be relied upon due to frequent absences from board meetings.
Combined Utility Assessment Team The inspector reviewed the 1991 and 1992 CUAT reports. The complete licensee responses to the 1991 assessment were available; partial responses to the 1992 assessment were available. The CUAT reports provided critical assessment of the areas reviewed and suggestions for improvement.
The 1991 audit reviewed licensing tracking systems, the procurement audit program, self-assessment philosophy and initiatives, and philosophies on procedural compliance. As was noted by SNRB, most of the findings of this audit involved " soft" management issues. The responses focused on management initiatives to effect a culture change at Millstone; subsequently, these items were closed out based on similarity to PEP topics.
The 1992 CUAT reviewed the QSD audit program, tagging program, and MOV program.
The CUAT concluded that QSD effectively identified problems and communicated their findings to management. However, the corrective action program contained some weaknesses. The tagging program was assessed as adequate under normal workloads and stressed under plant outage conditions with significant personnel adherence problems related to a cumbersome procedure. The CUAT acknowledged that station management was aware of tagging program weaknesses and was working to resolve them through the ACP rewrite program. Staffing to support implementation of the MOV program was assessed as inadequate to meet the aggressive completion schedule. Since this audit was performed, the following corrective actions have been initiated. QSD reformatted the audit reports to a more clearly present the audit findings and assessments. QSD also revised the methods for determining corrective action deadlines and conduct of followup audits. Revisions were
.
.
.
.
made to the tagging procedure to address specific weaknesses. The MOV program has become better supported and funded by corporate management. The inspector concluded that these responses were good and addressed the nature of the CUAT concerns.
Indeoendent Safety Engineering Groun - Unit 3 The functions performed by the ISEG include independent review and evaluation of plant activities, operational analysis, and evaluation of plant operations and maintenance activities to provide independent verification that these activities are performed correctly and that human errors are reduced as far as practical. Their objective is to make detailed recommendations for revised procedures, equipment modifications, maintenance activities, operations activities, or other means of improving unit safety.
The areas chosen by the ISEG for review originated fron management request, plant or industry events, or other ISEG initiatives. The inspector noted that the normal ISEG activity level decreased slightly in 1992, due to work on special projects such as the plant equipment operator rounds root cause investigation and a review of the shutdown risk assessment program. A new engineer was hired and reported to the group in June 1992, to allow greater flexibility in performing these special projects for all of the Millstone units. The Nuclear Safety Engineering manager stated that the group was forced into more of a reactive
,
'
posture in 1992, and looked for the root cause of identified plant problems instead of evaluating the effectiveness of existing programs and processes.
The inspector reviewed several ISEG evaluations issued in 1992, and noted that the evaluations performed focused on perceived areas of weakness such as high pressure safety injection system availability and the tracking and dispositioning of NRC information notices.
i The evaluations reviewed were thorough and valid recommendations for improving performance were proposed. Evaluation E92-01, "lSEG Evaluation Follow-up Review," was conducted to determine if the ISEG evaluation program has been effective in resolving safety issues raised by original ISEG evaluations. This evaluation identified a weakness in the ISEG program in that many ISEG recommendations had not been fully addressed by the responsible group. As a result of this evaluation, new recommendations were opened concerning followup on the implementation of old recommendations; and the ISEG evaluation and observation program was revised to require the tracking of all ISEG recommendations.
In the past only nuclear safety-related concerns had been tracked for implementation. In addition, recommendations which exceed their original due date for response are now being forwarded to the Station Vice President for information.
Based upon the review of the ISEG evaluations, the inspector concluded that ISEG met the requirements of Technical Specification 6.2.3. The inspector determined that station management action to resolve ISEG recommendations was not timely in several cases, in part due to the lack of formal tracking of open issues. An improved tracking program has been developed.
- - -
-
.
,
<.
Ouality Services Deoartmen1 The QSD organization is split into two groups, one performs surveillances, the other performs audits. The inspector interviewed key personnel from both groups and reviewed many surveillance reports, eight audit reports, and the quarterly trend reports and station responses applicable to all three units over the last year. Both QSD groups critically assessed plant and corporate performance in planned audit areas and previously known problem areas at Millstone. Audit activities effectively assessed technical and administrative programs. The findings were described clearly in audit and surveillance reports. There was a noticeable improvement in report format and presentation of concerns in response to the CUAT recommendations.
The inspector identified a theme prevalent in the surveillance and audit reports and responses. Chronic weaknesses in corrective action programs and compliance with administrative procedures were identified frequently. These were also highlighted in the
'
QSD quarterly trend reports to corporate management. The unit responses to these surveillance and audit findings often required extensions and frequently were late. The quality of responses varied. Moreover, the corrective actions offered by the units generally addressed the specifics of the discrepancy rather than theassessment of the program weakness which allowed the error to occur. In addition, some root cause determinations were mere restatements of the Gding rather than an explanation of what caused the problem 4 occur.
In response to the continuing poor timeliness and quality of corrective actions in response to QSD audit and surveillance activities, QSD issued a Corrective Action Request (CAR 93-01)
to elicit station management action in this matter on March 3,1993. Station management response to the CAR is due by May 1,1993.
Conclusion The inspector concluded that the effectiveness of the self-assessment groups at Millstone varies. The NRBs provided strong technical reviews however, there is room for improvement in communication of board assessment to management. There is significant room for improvement in the SNRB activities to assess QA Program performance, QSD audit activities, and corrective action programs. The CUAT reviews provided critical assessments and recommendations for improvements. ISEG evaluations were of good quality and provided good recommendations for improving plant performance. NRC found that QSD critically assessed plant and corporate performance and clearly communicated findings to management. Chronic weaknesses in corrective action programs and compliance with administrative procedures were identified. Station responses to audit findings generally
'
required extensions and were often late. Improvements are warranted in station identification of root causes and development and implementation of effective corrective actions. Although
D O
PEP action plans exist to improve the effectiveness of licensee self-assessment programs, the inspector concluded that QSD took appropriate action in issuing a CAR to station management to elicit more timely management attention to these areas.
5.5 Self-Assessment Initiatives - Unit 1 To improve oversight of engineering issues at Unit 1, the licensee is in the progress of establishing new programs which will track the status of engineering work items, programs, and assignments on a daily basis. Reviews of the engineering issues will be conducted on a periodic basis by the engineering departments and in some instances by the Unit 1 PORC/NRB to ensure the established goals are maintained.
The inspector reviewed one such program which contained the engineering department assignments. The inspector concluded that the program should be a useful tool to assist in determining the status of engineering issues at the station. However, while examining the program, the inspector noted that not all work items were being entered into the program.
Specifically, several NRC items were not on engineering work lists even though engineers were assigned to the issue. The inspector discussed this issue with the engineering manager who indicated that the items were not added due to an oversight.
Unit 1 is also establishing a new unit-wide performance monitoring program. The program will review inputs from NRC inspection reports, PIRs, NRB and QSD audits, the work observation and surveillance monitoring programs and outside third party audits. The program will then assess the performance of the station against the NRC SALP criteria.
Results will be forwarded monthly to Unit department heads and the corporate office.
Quarterly meetings to review the data and develop action plans will be held with Unit department managers. Oversight of the program will be performed by an engineering supervisor. To ensure effective corrective action is taken when necessary, the data will also be sent to the senior vice-president nuclear.
The inspector considered the development of an assessment monitoring program to be a good initiative. Since the new monitoring programs have only recently been initiated, the inspector could not determine the effectiveness of the programs. When describing the program to the inspector, the licensee was not able to explain how the monitoring program would detect emerging weaknesses in plant performance based upon the present report l
inputs. For example, licensee personnel could not determine if the presence of such a i
program would have detected the decline in the Unit I licensed operator training program if it was in place during the previous years of plant operation. Without such a " benchmark" of performance, the inspector could not determine that the licensee's goals for the performance monitoring program would be met. The NRC will continue to monitor the implementation of these programs.
!
l
!
l I
.
.
-
- l 5.6 Review of Previously Identified Issues i
5.6.1 Emergency Diesel Generator Room Temperature Control - Unit 1
(Unresolved item 50-245/91-12-04) was opened pending evaluation of the licenseer :." w to address heating and ventilation issues in the emergency diesel generator enclosure.
Inadequacies in the diesel generator heating and ventilation systems were identified when the diesel generator tripped due to low lube oil pressure. Investigation of the trip revealed that low temperature in the diesel generator enclosure increased the viscosity of the oil, which reduced system flowrate and caused a resultant pressure decrease in the lube oil system.
i Licensee corrective actions consisted of installing a temporary thermometer in the enclosure and modifying station procedurcs to require starting the diesel generator if temperature in the enclosure drops below 70 degrees. The temperature of the enclosure is monitored twice per shift by Plant Equipment Operators. Long term corrective action will consist ofinstalling a permanent temperature detector in the diesel enclosure.
Another ventilation issue concerned the discovery that diesel r,perability is contingent on having both air coolers in the emergency diesel room operable. This determination was
,
reached during a test which monitored diesel generator room temperature while air coolers m the room were sequentially valved out of service. The nexus between diesel generator operability and the air coolers could have been misunderstood by the licensee since design information concerning the diesel generator ventilation system that was contained in several documents (Updated Final Safety Analyses Report (UFSAR), Final Safety Analyses Report, NUREG 0824, " Integrated Plant Safety Assessment for Millstone Unit 1," and NUREG 1143, " Safety Analyses Report to Support Full Term Operating License for Millstone Unit 1") was conflicting or incomplete.
,
,
To ensure operators were aware of the relationship between diesel generator operability and the room coolers, a June 4,1992, memorandum was placed in the plant technical i
specifications book stating the limitation of the diesel generator ventilation system. Later this information along with information concerning other system relationships will be incorporated into a plant technical requirements manual which is currently under development.
However, when reviewing this issue, the inspector noted that the licensee did not update the UFSAR to include the relationship between the diesel generator coolers and diesel operability. The inspector discussed this observation with the engineering manager who committed to revise the UFSAR to include the ventilation information. The inspector discussed with the manager the need for design information concerning critical system limitations and relationships be contained in the UFSAlR rather than memoranda which are not easily accessible by plant personnel. Further, the inspector stated that maintaining an up-to-date UFSAR is especially important to Millstone on this particular issue since several documents contained incorrect or conflicting information.
j
t
~
Q
-
The inspector noted that following the diesel generator trip and the testing of the air coolers, the licensee has obtained a better understanding of the diesel generator ventilation l
requirements. Based upon the licensee corrective action, this item is closed.
j 5.6.2 Failure To Assess NRC Information Notice 88-76 In a Timely Manner - Unit 1 l
Unresolved item (50-245/92-04-03) documented a failure of the licensee to assess industry
'
operational experience in a timely manner. The information of concern was reported in NRC Information Notice 88-76 entitled Recent Discovery of a Phenomenon Not Previously l
Considered in the Design of Secondary Containment Pressure Control. In that Notice, the l
NRC reported that the leak tightness of a secondary containment at another nuclear facility l
was not adequately tested since the utility failed to consider the effects of temperature induced differences in absolute pressure gradients inside and outside of the reactor building.
Although the Notice was received by the licensee in September 1988 it was not assessed for applicability to Unit I until January 1992.
Following the evaluation, the licensee concluded that once various differential pressure readings taken during surveillance tests were compensated for temperature effects, the j
j Technical Specification (TS) required differential pressure reading between the containment
'
l and outside atmosphere of 0.25" of water was not obtained. Consequently, the licensee l
declared the secondary containment inoperable and reported the event per 10 CFR 50.73(a)(2)(i), as any operation prohibited by the plant TS. Licensee corrective action to improve the tightness of the secondary containment was discussed in NRC Inspection Report 50-245/92-04.
l A review of previous surveillance tests by the licensee revealed that secondary containment vacuum could have been reduced to 0.20 inches of water by the failure to compensate for the temperature gradients. The licensee's Radiological Dose Assessment branch concluded that since the pressure in the secondary containment was negative,10 CFR 100 limits for fission product releases during a design basis event would not be exceeded. Therefore, the licensee concluded that the reduction in containment vacuum was of minor safety significance.
The licensee concluded that the Information Notice did not receive a timely distribution because it was not entered into a tracking system when it was received. Additionally, the licensee concluded that tracking and distribution of Information Notices was loosely controlled since one specific individual was not responsible for that area. To improve performance in this area, the responsibility of tracking Information Notices was transferred to from the Nuclear Operations Department to Nuclear Licensing. Additionally, one individual was assigned the specific task of tracking NRC information Notices.
The NRC reviewed the licensee's evaluation and agreed with the assessment. Therefore, the failure of the licensee to correct for temperature gradients when performing the secondary containment tightness test had minor safety sinificance. The inspector determined that the l
!o
o
revised Information Notice tracking system should improve performance since positive administrative controls have now been placed on Information Notice distribution. Therefore, this issue is closed.
5.6.3 Inoperable Containment Radiation Monitors - Unit 2 This item (Violation 50-336/89-24-004) involved plant operation in the cold shutdown
condition (Mode 5) with no operable containment radiation monitors. In this condition, open i
containment purge system isolation valves would not have closed automatically if high
)
airborne radioactivity levels in the containment had occurred. This condition was caused when a surveillance procedure change was processed while work on the radiation monitor i
was in progress. The change resulted in restoring the monitor to service with a sample line isolation valve closed. The licensee changed the surveillance procedure to require positive
.
verification of sample flow following system testing. In addition, the licensee provided additional guidance in Administrative Control Procedure ACP-QA-3.02, " Station Procedures and Forms," to assure that equipment and systems are placed in a stable condition should the need to change a procedum arise while work is ongoing. The inspector reviewed Millstone plant incident reports for 1992, and Licensee Event Reports for 1990 through 1992, verified that no similar events had occurred, and concluded that the licensee's corrective action had been effective. This item is closed.
5.6.4 Potential Final Safety Analysis Repod Discrepancies - Unit 2 This item (Unresolved 50-336/92-35-002) involved potential conflicts between safety injection tank operability requirements regarding minimuin level, nitrogen overpressure, and boron concentration contained in technical specifications and the accident analysis assumptions described in the Final Safety Analysis Report (FSAR). The licensee performed a loss of coolant accident reanalysis which confirmed that the technical specification value for boron concentration was valid and that the value in the FSAR was erroneous. An FSAR change request has been initiated to correct the error. The reanalysis also confirmed that the
!
technical specification limits for nitrogen overpressure and liquid level were valid. The l
licensee informed the inspector that the nominal values found in the FSAR reflected the l
range of acceptable values assumed in the accident analysis and were consistent with the
'
technical specifications. The inspector concluded that no FSAR change was required for those parameters. This item is closed.
5.6.5 Failure To Issue A Timely Licensee Event Repod - Unit 2
!
l This item (Violation 50-336/91-02-003) involved licensee failure to submit to the NRC a Licensee Event Report (LER) within the 30-day requirement of 10 CFR 50.73. The licensee attributed the cause of the violation to inadequate administrative oversight. The licensee instituted additional administrative controls over the LER process which includes periodic
.
i i
I l
.
,.
,
. -..... -
, _. -
. _ _ _ _ _ _ _ _ -
b F.o
- o O
monitoring by the plant operations review committee. The inspector found that no similar violations had occurred since 1991, and concluded that the licensee's corrective actions were effective. This item is closed.
5.6.6 High Motor Driven Feedwater Pump Lube Oil I2 vel - Unit 3 This item (Unresolved 50-423/92-28-05) involved a high lube oil level in the motor driven i
feedwater pump (MDFWP) which damaged the pump. Maintenance had added too much oil to the MDFWP speed increaser gearbox in response to a low oil level reading. The licensee l
determined that the root cause of overfilling the oil sump was personnel error and procedure l
deficiency. The work order did not specify the required oil level and there was no specific l
technique sheet for adding oil with the MDFWP in operation. The referenced instruction, I
lubrication maintenance technique sheet 3710AA-140G, was written to " sample / change lube oil." It included steps to fill the oil to the standing level mark on the oil sight glass. The oil sight glass level is marked with three levels (top to bottom): " shaft pump running,"
" standing level," and " auxiliary oil pump running." The technician had added oil to the shaft l
,
!
pump running level. This caused the oil to foam and damaged the pump. The MDFWP had l
not been routinely operated for long periods so a technique sheet for the addition of oil l
during operation had not been written. Normally both turbine driven feedwater pumps (TDFWP) are in operation at power and the MDFWP is in standby. However, due to high vibration problems with the 'A' TDFWP, the MDFWP had been operating since April 1992.
To prevent recurrence, a new lubrication technique sheet was written to address adding oil when the MDFWP is in operation. In addition, the licensee made a commitment to review other lubrication technique sheets to determine if other technique sheets, for equipment capable of causing a plant trip or transient, require modifications to provide specific instructions for adding of oil while the equipment is in operation. This review is scheduled to be completed by July 1993. The inspector reviewed these corrective actions and considers them to be adequate. This item is closed.
'
6.0 MANAGEMENT MEETINGS
'
Periodic meetings were held with various managers to discuss the inspection findings during the inspection period. Following the inspection, an exit meeting was held on April 20,1993, to discuss the inspection findings and observations with station management. Licensee comments concerning the issues in this report were documented in the applicable report section. No proprietary information was covered within the scope of the inspection. No
,
'
written material regarding the inspection findings was given to the licensee during the inspection.
.