IR 05000245/1993019

Insp Repts 50-245/93-19,50-336/93-14 & 50-423/93-15 on 930630-0817.No Violations Noted.Major Areas Inspected:Plant Operations,Radiological Controls,Maint,Surveillance, Security,Outage Activities & Licensee self-assessment

ML20057F465
Person / Time
Site:	Millstone
Issue date:	10/04/1993
From:	Doerflein L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20057F464	List: IR 05000245/1993019 ML20057F463
References
50-245-93-19, 50-336-93-14, 50-423-93-15, NUDOCS 9310180036
Download: ML20057F465 (37)

Text

.

.

U.S. NUCLEAR REGULATORY COMMISSION

REGION I

Docket Nos.

50-245 50-336 50-423 Report Nos.

93-19 93-14 93-15 License Nos.

DPR-21 DPR-65 NPF-49 Licensec:

Northeast Nuclear Energy Company P. O. Box 270 Hartford, CT 06141-0270 Facility:

Millstone Nuclear Power Station, Units 1,2, and 3 Inspection at:

Waterford, CT Dates:

June 30,1993 - August 17, 1993 Inspectors:

P. D. Swetland, Senior Resident Inspector K. S. Kolaczyk, Resident inspector, Unit 1 D. A. Dempsey, Resident Inspector, Unit 2 R. J. Arrighi, Resident Inspector, Unit 3 P. J. Habighorst, Resident inspector, Haddam Neck R. S. Barkley, DRP, Region 1 J. W. Andersen, NRR, Headquarters e

s t

Approved by:

W

'

04A JLu 10 q 9 3 Lawrence T. Doerflein, Chief bate Reactor Projects Section 4A, DRh Scong: NRC resident inspection of core activities in the areas of plant operations, radiological controls, maintenance, surveillance, security, outage activities, licensee self-assessment, and periodic reports.

The inspectors reviewed plant operations during periods of backshifts (evening shifts) and deep backshifts (weckends, holidays, and midnight shifts). Coverage was provided for 64 hours7.407407e-4 days <br />0.0178 hours <br />1.058201e-4 weeks <br />2.4352e-5 months <br /> during evening backshifts and 46 hours5.324074e-4 days <br />0.0128 hours <br />7.60582e-5 weeks <br />1.7503e-5 months <br /> during deep backshifts.

Results: See Executive Summary 9310180036 931006 PDR ADOCK 05000245-O PDR

._

..

-

.

.

_.

-

.

__

_

l

~

.

EXECUTIVE SUMMARY Millstone Nuclear Power Station l

Combined Inspection 245/93-19; 336/93-14; 423/93-15 Plant Operations For the most part, Unit 1 operated at full power during the inspection period. Several j

scheduled power reductions for roatine testing and maintenance were implemented without

incident.

Unit 2 operated at essentially full power until August 5,1993, when the plant shutdown and cooled down because of an unisolable leak in a letdown system isolation valve. During the shutdown, the leaking valve was replaced. However, several incidents including a reactor coolant draindown event, a main steam leak inside containment, and a reactor trip due to

<

operator error occurred during the start-up from this outage. These events demonstrated a lack of attention to detail on the part of Unit 2 personnel, and weaknesses in the plant

!

configuration control and work control processes. Several task groups were formed to

determine the root cause of these issues and interim corrective actions were promptly

)

implemented. The reportability of the main steam leak was unresolved at the end of the I

inspection pending NRC clarification regarding the applicability of 10 CFR 50.72 to this event. The unit returned to full power operation on August 16.

-

Unit 3 operated at full power until July 31,1993, when the plant was shutdown to begin its fourth refueling outage. Planned outage activities in addition to the refueling included emergency diesel overhauls, installation of a third diesel generator to address station black-

)

out concerns, replacement of a reactor coolant pump motor, steam generator eddy current

'

testing, modi 0 cation of the refueling cavity pit seal, and upgrade and testing of many motor-j operated valves. A failure to maintain adequate foreign material accountability at the spent

'

fuel pool was not cited due to the licensee's prompt and effective corrective action.

Maintenance Generally good maintenance and testing practices were observed throughout the inspection.

The licensee identi6ed deficient work control practices for the Unit 3 service water system which resulted in two non-cited violations for which adequate corrective action was implemented. The need for overall improvement in work control formality and corrective

'

action follow-up at Unit 3 remained unresolved at the end of the inspection. The effectiveness of leak repairs for the Unit 3 turbine driven auxiliary feed water pump steam supply valves also remained unresolved.

ii

'

i

-

_

_

-

,--

.--

r

-,.

...,

.. -,_

.

.

..

--.

.-

..

.-

Safety Assessment / Quality Verification The licensee was slow to react to the declining performance of Unit 2 which resulted in a series of events related to the August 1993 maintenance shutdown. Licensee actions regarding twelve previously open inspection findings were determined to be sufficient to close those items. A few of these items, however, had remained open for a prolonged period. The licensee identified and conected four violations of NRC requirements for which enforcement discretion wasjustified.

i

l

.

>

,

'

i

>

!

I i

I

r P

iii

.

.

... -

.

.

-.-

-

.. _...

.

.

..

.

t

.O

'

,

'

,

r SUMMARY OF FACILITY ACTIVITIES

'

I Unit 1 operated at 100% of rated thermal power for the majority of the report period. Minor

)

power reductions were periodically performed to facilitate plugging ofleaking condenser tubes and to test the main steam isolation and turbine stop valves. On August 17, 1993,

NRC Commissioner Remick visited the Millstone Site. He was accompanied by the NRC i

Region I Deputy Director, Division of Radiation Safety and Safeguards. During the visit, i

the licensee made several presentations to the Commissioner concerning Unit 1 training i

program initiatives and the site performance enhancement program. Following the

!

'

presentations, the Commissioner toured the Millstone training center, and the Unit 3 containment, control room and auxiliary buildings.

Unit 2 was operating at full power at the beginning of the inspection period. On August 5, at 4:11 p.m., the reactor was shutdown due to reactor coolant system (RCS) leakage in i

excess of technical specification limits. Cold shutdown was attainc~ :n August 6, by which time RCS leakage had been reduced to acceptabic limits. On August 12, the reactor was taken critical following replacement of a leaking letdown system isolation valve. At 1:33 p.m., while holding at 2% power for main turbine warmup, the reactor automatically tripped on low steam generator level. The reactor was restarted at 10:33 p.m. At 10:02 a.m., on August 13, during main turbine warmup, reactor power was reduced from 2% to the point of adding heat when a main steam system leak from the steam generator

'

nitrogen system was identified in the containment building, power ascension commenced at 5:00 a.m., on August 14, and full power operation was achieved at 11:55 a.m., on August 16.

Unit 3 began the inspection period at full power. On July 30, at 7:00 p.m., the licensee started a plant shutdown for the Cycle 4 Refueling and Maintenance Outage. The plant was in cold shutdown (Mode 5) on August 2. At the end of the inspection period, the unit

'

remained shutdown in Mode 5 with maintenance activities ongoing. Major outage activities scheduled during the outage include reactor refueling, 'D' reactor coolant pump motor

-

'

replacement, installation of a permanent reactor cavity pit seal, upgrade and testing of motor operated valves, steam generator eddy current testing, installation of an alternate AC power

source for station blackout, and emergency diesel generator overhauls. Additionally, both i

service water trains will be drained down and inspected for evidence of biofouling and i

erosion / corrosion induced wear.

!

2.0 P1, ANT OPERATIONS (IP 71707,71710,93702)

i

-

2.1 Operational Safety Verification (All Units)

.

,

The inspectors performed selective inspections of control room activities, operability of

-

cngineered safety features systems, plant equipment conditions, and problem identification

~

systems. These reviews meluded attendance at periodic plant meetings and plant tours.

j

'

i i

!

-.

-..

...

.

_

_

_ _ _

,

,

a

'

The inspectors made frequent tours of the control room to verify suf0cient staffing, operator

!

procedural adherence, operator cognizance of equipment and control room alarms status,

conformance with technical specifications, and maintenance of control room logs. The

inspectors observed control room operators response to alarms and off-normal conditions.

'

b The inspectors verified safety system operability through independent reviews of: system configuration, outstanding trouble reports and incident reports, and surveillance test results.

!

During system walkdowns, the inspectors made note of equipment condition, tagging, and the existence of installed jumpers, bypasses, and lifted leads.

The accessible portions of plant areas were toured on a regular basis. The inspectors observed plant housekeeping conditions, general equipment conditions, and fire prevention practices. The inspectors also verified proper posting of contaminated, airborne, and radiation areas with respect to boundary identification and locking requirements. Selected aspects of security plan implementation were observed including site access controls,

'

integrity of security barriers, implementation of compensatory measures, and guard force response to alarms and degraded conditions.

The inspectors determined these operational activities were adequately implemented. Specific i

observations are discussed in Section 2.2 to 2.7 below.

j 2.2 Plant Shutdown Due To Iligh Reactor Coolant System Unidentified Irakage -

Unit 2 On August 5,1993, at 2:09 p.m., while attempting to seal a body-to-bonnet leak on letdown

system manual isolation valve 2-CH-442, leakage suddenly increased. Using containment sump level indication, the operators con 0rmed at 2:32 p.m., that reactor coolant system (RCS) leakage exceeded technical specification limi;s (unidentified leakage greater than 1.0

'

gallon per minute) and commenced a plant shutdown per Abnormal Operating Procedure 2568, " Reactor Coolant System Leak." At 2:46 p.m., the licensee declared an Unusual Event in accordance with its emergency plan implementing procedures, and the NRC was

'

noti 0ed pursuant to 10 CFR 50.72 at 2:53 p.m. On August 6, at 9:33 a.m., the plant reached cold shutdown (Mode 5) and RCS leakage was reduced to 0.89 gallons per minute.

The licensee terminated the Unusual Event at 9:52 a.m.

.

The inspector witnessed the reactor shutdown from the control room. The operations shift supervisor exercised good command and control during the evolution, and communications j

were very good. RCS leak rate was monitored continuously for degradation during the j

shutdown and the applicable procedures were followed properly by the operators.

Classification of the event and NRC notification were performed in a timely manner. The inspector concluded that the shutdown was performed safely and expeditiously. Unit 2 Inspection Report 50-336/93-18 documents licensee activities associated with the maintenance performed on valve 2-CH-442 prior to the event.

i

.

.

2.3 Reactor Trip on Low Steam Generator Water Ixvel - Unit 2 On August 12,1993, at 1:44 p.m., an automatic reactor trip occurred due to low level in the

1. 2 steam generator. At the time of the trip, reactor power had been raised to approximately two percent for main turbine warmup and start-up of a turbine driven main feed pump. One auxiliary feed pump was in operation supplying feedwater at 100 gallons per minute to each steam generator. The licensee carried out the standard post-trip actions of the emergency operating procedures, and plant conditions were stabilized in hot standby condition (Mode 3).

The trip was reported to the NRC promptly in accordance with 10 CFR 50.72 and the licensee's emergency plan implementing procedures.

The inspector veriHed from the control room that plant systems had responded to the trip as designed. The inspector also attended the operator de-briefing of the event conducted by the licensee. The licensee determined that feed flow to the steam generators had not been adjusted as reactor power was increased, and that steam generator levels slowly declined over the 20 minute period prior to the trip. The shift operating crew appeared to have been distracted by a high flow condition in tbc 'B' service water system, and erratic operation of the 'A' condenser steam dump valve. None of the operators recalled receiving a steam generator level setpoint deviation alarm which had occurred about 15 minutes prior to the trip. The licensee attributed the event to operator inattention and poor communication of the status of alarms. Short term corrective actions included briefing the on-coming operating crews on the event; requiring that all alarms be communicated to and acknowledged by the supervising control operator; trending steam generator levels on the control room display monitor; and establishing a dedicated level control operator. The inspector conc 6ded that the short-term corrective actions were adequate.

The reactor was restarted at 9:03 p.m., on. August 12 and criticality was achieved at 10:33 p.m. The inspector observed portions of the start-up and verified that the licensee's corrective actions had been implemented, and that procedures were being followed correctly.

The inspector particularly noted improvement in communication of alarm status. The inspector had no further immediate concerns regarding the event.

2.4 Main Steam leak in Containment - Unit 2 On August 13,1993, at 8:05 a.m., with the reactor at two percent power, the control room operators were informed by engineering that an apparent steam leak in the vicinity of the 'A'

reactor coolant pump had been observed on the closed circuit television which monitors the containment. At about the same time a containment sump high level alarm was received in the control room, a leak rate of approximately four gallons per minute (gpm) was calculated.

At 8:23 a.m., the licensee entered the action statement of Technical SpeciGcation 3.4.6.2.b for unidentified reactor coolant system leakage, and reduced power to one percent. A team entered the containment at 8:30 a.m., and found a steam leak from the secondary side of the steam generators through a ruptured low pressure nitrogen system flow instrument. Six normally-closed nitrogen system isolation valves were found to be open. At 8:52 a.m., the

___

..

W

.

.

valves were closed and the leak was stopped. In response to finding the valves out of their expected positions, plant management directed reactor power to be reduced to 10E-4 percent power pending completion of an engineering walkdown of the nitrogen system and a detailed review of reactor and secondary plant system configurations. A team reviewed automated work orders, component safety tagouts, and valve lineups which had been performed during the maintenance outage which had just been completed in order to establish confidence that plant systems were aligned properly for power operation. At 3:45 a.m., on August 14, following completion of the reviews, licensee management authori7ed power to be increased.

Full power operation was achieved on August 16.

A previous configuration control event involving inadvertent draining of the reactor coolant system prompted the licensee to establish an event evaluation team to identify the causes of both incidents. The team identified the root cause of this event to have been ineffective communication of nitrogen system restoration between the operations shift supervisor and the work control organization operator. Contributing causes were lack of verification that the restoration had been performed and lack of a formal system status tracking system, either in the form of shift turnover logs or the existing plant heatup check list. In discussions with the unit director the inspector acknowledged these findings, but indicated that reliance on ineffective communications as the root cause of the event may mask other problems including procedure adequacy and compliance, attention to detail, and the role of the work control center operators in controlling the alignment of plant systems.

For example, the inspector found that Operating Procedure OP 2316A, " Main Steam System," did not provide clear guidance regarding restoration of the steam generator. from the inerted, wet layup condition.

In addition, Procedure OP-2201, " Plant Heatup," corains a series of caution notes prior to Step 4.12. including one regarding the need to ensure that steam generators are not cross-connected through the containment nitrogen system. The inspector noted that the procedure had no action steps to ensure performance of the caution note, and that the actions contained in the note had not been performed prior to performing Step 4.12. The inspector also noted that Procedure OP-276/2276/3276, " Conduct of Operations," does not provide adequate guidance to ensure that the operating shift tracks the configuration of plant equipment and systems through positive means such as valve lineups, tagouts, procedures, or logs. Thus, the configuration of the steam generators inerted with nitrogen was not recognized by the operating crew which initiated the plant heatup.

The licensee has developed some Performance Improvement Initiatives in response to recent operational events. These initiatives address declining performance in Unit 2 and establish action plans for the areas of configuration control; attention to detail; management and supervisory oversight; communications; roles, responsibilities, and management expectations; resources; and work control and accountability. The effectiveness of these initiatives will be reviewed by NRC during subsequent routine inspections.

.

.

_

__

---

-

__

_ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _

_____ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

.__

_

..

l l

.

,

The inspector also questioned the licensee regarding the reportability per 10 CFR 50.72 of the cross-tied steam generator condition. The licensee had determined initially the condition was not reportable as an unanalyzed condition which significantly compromised plant safety, or as a condition that is outside the design basis of the plant. The inspector considered that the condition nonetheless placed the plant outside its design basis and in a condition not covered by the plant's operating and emergency procedures. The Fcensee concluded that due to the small size of the nitrogen lines, the inability to completely isolate a faulted steam generator would not significantly affect post-accident containment conditions, and reaffirmed its initial assessment. The reportability of this event is unresolved (50-336/9314-001)

pending further review of the licensee's position.

2.5 Spent Fuel Pool Material Accountability - Unit 3 On August 2, the inspector observed the licensee performing the pre-refueling check out of the spent fuel pool bridge in accordance with Operating Procedure (OP) 3271, " Spent Fuel Pool Operation." The inspector noticed that the spent fuel pool area was posted as a foreign material exclusion (FME) area and as such, all material brought into and removed from the area must be logged in the foreign material accountability log. The inspector questioned the reactor engineering (RE) job leader as to the use of a foreign material accountability log for the spent fuel pool bridge. The job leader stated that an accountability log was required, however, one was not being used. The job leader stated that he was aware of all items on the bridge. The inspector notified the individuals supervisor of the observation and the RE supervisor directed the reactor engineer to place all equipment in a safe condition and to stop all work in the fuel building.

The inspector questioned the RE technician who was responsible for fuel receipt and transfer of the new fuel into the spent fuel pool regarding foreign material accountability and whether that individual had used the FME log during those evolutions. The individual stated that they had not used the foreign material accountability log for items brought onto the spent fuel pool bridge during the fuel transfer into the spent fuel pool, however, one was used for the transfer of new fuel into the new fuel vault. The individual performing the new fuel transfer

!

stated that she wasn't sure whether the spent fuel pool bridge was inside the FME area or not and that she made a mental note of all items brought on the bridge.

The RE supervisor immediately convened a meeting with all members of the RE group and informed them of his expectations with regard to procedural and administrative requirements, work control, job leader responsibilities, and material accountability requirements. As further corrective action, the event was discussed with all Unit 3 engineering department personnel, disciplinary action was taken for the individuals involved, a memorandum was issued to all station personnel, and a sign was placed on the spent fuel pool bridge stating that items carried onto the crane area shall be logged. In addition, the licensee stated that a briefing will be given to all personnel involved in the upcoming refueling sequence. The inspector considered the corrective action to be appropriate.

._

__ _ -__

_

_ _ _.

__

__.

__

_

_._.

i

=

,

.

.

I

Administrative Control Procedure (ACP) 4.01, " Plant Housekeeping,* and Operating l

Procedure (OP) 3271 state that the spent fuel pool is a designated FME area and that a

!

material accountability log will be established and placed at the entrance of the spent fuel

)

pool. The failure to log material into an FME area is a violation of ACP-QA-4.01. The

'

inspector determined that the job leader mentally noting the items brought onto the spent fuel pool bridge provided some assurance that items inadvertently entered the spent fuel pool.

Since the event was of minor safety significance and extensive corrective actions were taken

!

'

by the licensee, ec.forcement discretion per Section VII.B of the Enforcement Policy was exercised.

,

t 2.6 Observation of Non-Licensed Training

The inspector observed the conduct of non-licensed operator training. The training involved

a review of controlled wiring diagrams (CWDs) and symbols. Additionally, troubleshooting was performed on motor-operated valves. The inspector noted that the instructor was knowledgeable of the subject matter and presented the information in a logical manner.

Frequent references to plant experiences by the instructor added realism to the training. The i

handouts which were provided to the students, and the overhead displays which were used during the lecture were useful and contributed to the understanding of the subject matter.

!

During the lecture, the students in the class actively participated and displayed a willingness j

to learn. Overall, the inspector considered the training to be an appropriate overview of CWDs and motor-operated valve electrical troubleshooting approaches.

,

l 2.7 Severe Weather Preparations j

,

i

"

As a result of severe weather which was experienced at another nuclear plant site, the i

inspector reviewed the licensee's storm contingency plans. The inspector noted that the

)

licensee has plant specific and one site-wide procedure which provides guidance to operators

]

,

prior to the onset of severe weather. The site engineering and Maintenance Procedure 1.16.

" Hurricane / Winter Storm Procedures." includes instructions to bring indoors or secure objects that may become airborne during a storm, organize a site restoration crew, and evacuate buildings which may become vulnerable during a storm. The Unit specific procedures contain guidance on when the plants should be shutdown before severe weather arrives, how to prevent the flooding of site buildings, and how to protect safety-related equipment. The inspector considered the licensee severe weather procedures to be adequate.

The inspector noted that the licensee is reviewing the experience of a Florida nuclear power station which experienced severe weather during a hurricane. Once the review is comple'ed, recommendations will be made where required to further strengthen the plant severe weather procedures. The inspector considered the licensee actions to be appropriate.

!

.

$

.

e

.

_

_.

,

_

.

.

l

!

3.0 M AINTENANCE (1P 62703)

The inspectors observed and reviewed selected portions of preventive and corrective I

maintenance to verify adherence to regulations, administrative control procedures and appropriate maintenance procedures; adherence to codes and standards; proper QA/QC involvement; proper use of bypass jumpers and safety tags; adequate personnel protection; and appropriate equipment alignment and retest. The inspectors reviewed portions of the following work activities:

• M2-92-05235 Vital switchgear room cooler preventive maintenance

• M2-92-00186 Calibrate refueling water storage tank level instrumerets

• M2-93-09534 Troubleshoot and repair vital switchgear room cooling fan

• M2-93-07225 Leak seal repair of valve 2-CH-442

• M2-93-07864 Leak seal repair of valve 2-CH-442

• M2-93-09522 Perform dye penetrant examination of valve 2-CH-442

• M2-93-09534 Perform dye penetrant examination of valve 2-CH-442

• M2-93-07227 Replace valve 2-CH-442

• M2-93-09557 Install freeze seal on letdown line

• M2-93-09588 Install freeze seal on letdown line

• M2-93-01582 Weld repair cooler X1818 service water pipe

• M3-93-00217 6 year preventive maintenance, replace battery 301B-1 charger capacitors

• M3-93-07837 3 month preventive maintenance, emergency diesel air compressor

• M 3-93-14081 Visual inspection of ' A' service water large bore piping in the auxiliary building

• M3-93-13061

'A' train service water piping modifications to 3HVQ* ACUS 2A

• M3-93-14420 installation of permanent reactor cavity pit seal ring Except as noted below, the inspectors determined that the maintenance activities observed were performed adequately. Details of the inspector's observations are provided in Sections 3.1-3.5.

3.1 Failure of Gas Turbine To Start - Unit I l

i On July 8,1993, the Unit I gas turbine failed to start during the performance of a routine surveillance test. Analysis of data from recorders which monitor several system parameters on the gas turbine, revealed that the start sequence was stopped when air was not supplied to

the gas turbine air start motor. Licensee troubleshooting consisted of checking the electrical j

logic relays which are required to change position during the start sequence and verifying that the mechanical valves in the air system operated as required. No deficiencies were identified during the troubleshooting.

i

-

..

-

-

.

-.

,

.

!

!

Once the troubleshooting was finished, additional monitoring instrumentation was installed in l

the air start system. The gas turbine was then successfully started. No deficiencies were l

identified by the monitoring instrumentation. The licensee subsequently declared the gas

'

turbine available to support plant operation but not operable.

!

On July 9,1993, further troubleshooting was performed. The air start system was blown

!

down and filters in the system were removed and checked for particulate. No contaminants

'

were found. Several air rolls of the gas turbine were then successfully completed. A second i

successful start of the gas turbine was then accomplished and following completion of the i

surveillance test, the gas turbine was declared operable.

The inspector noted that prior to the July 8,1993, failure to start, an air conditioner which is located in the gas turbine operating enclosure was not working. Although the air conditioner was not working prior to the test failure, licensee personnel who witnessed the test stated that

the ambient air temperature in the operating enclosure was not excessively warm. Further, the relays in the enclosure are rated for temperature excursions of up to 104 degrees

.

Fahrenheit. Licensee personnel believe that the temperatures in the enclosure were not

,

greater than 80 degrees during the test. Age related degradation of the relays does not

,

appear to be a factor since the contacts were replaced during the 1989 refuel outage,

'

At the close of the report period, the licensee had not identified a root cause for the gas turbine failure. Several possible causes include high contact resistance in the starting

!

circuitry and a failure of the operators to hold the start switch long enough for the start

.

sequence to commence. The inspector noted that high relay contact resistance in the starting

!

circuitry was measured approximately one year earlier following a similar gas turbine start i

failure. The inspector also noted that the licensee is continuing to investigate the failure and will conduct more frequent starts or air rolls of the gas turbine to verify component

'

operability. Since the July 8 failure, all gas turbine components have operated as designed.

,

The inspector considered the licensees initial troubleshooting of the failure to be appropnate.

'

3.2 Replacement of Letdown Isolation Valve 2-CII-442 - Unit 2

Following the Unit 2 shutdown on August 5,1993, the licensee elected to cut out and repine letdown isolation valve 2-CH-442 with an equivalent valve manufactured by Anchor Darling in accordance with plant design change record (PDCR) 2-093-93. The work was performed under automated work order (AWO) M2-93-07227. The inspector reviewed the PDCR and

verified that the design, technical, and safety evaluation requirements of Administrative

!

Control Procedure ACP-QA-3.10. " Plant Design Change Records (NEO 3.03)," had been

'

satisfied. In addition, the inspector noted that consistent with licensee commitments in response to NRC Gndings documented Millstone 2 Inspection Report 50-336/92-36, the plant operations review committee had considered the need for procedure and drawing changes,

,

training requirements, and operating license modifications prior to release for operation.

.

L i

_

_

.

-

.

!

The inspector witnessed portions of the valve / pipe assembly pre-fabrication in the maintenance shop and verified that proper materials, procedures, weld maps, and ASME i

Section XI repair and quality control inspection plans were used. In the containment, the maintenance area was isolated from the reactor coolant system (RCS) by two freeze seals.

.

The seals were installed under AWOs M2-93-09557 and M2-93-09588 and evaluated and

controlled as a temporary modification per Procedure ACP-QA-2.06B, " Jumper, Lifted Lead, and Bypass Control," which included a contingency plan for failure of the seals.

Additional guidance and controls for freeze seal operation were provided by Maintenance

_,

Procedure MP-2721E, " Free 7e Sealing of Nuclear Piping Systems," and an Operations l

Department night order which referenced the abnormal operating procedure for RCS leakage.

!

The inspector verified through walkdown of the main control boards that redundant and diverse methods of RCS makeup were available, f

On August 8, following establishment of the freeze seals and removal of the original valve,

the inspector walked down the maintenance area in the containment, inspected the freeze seal apparatus, and discussed the seals with operators and the freeze seal vendor specialists. The following attributes were found to be satisfactory:

!

Procedures ensured an adequate supply of nitrogen for the seals.

Each freeze plug was supplied by an independent nitrogen source.

Seals were installed and maintained by specially trained and knowledgeable personnel.

• A documented contingency plan for seal failure was available and personnel were i

briefed on its contents.

Adequate communications were established between the containment and the control

room.

Pipe surfaces were inspected for defects prior to installation of the seal jackets.

Adequate instrumentation to verify the condition of the seals was provided and

operable.

!

Freeze jackets were located properly away from piping discontinuities.

!

'

The free 7e seal area was ventilated adequately and air quality monitoring equipment

was provided to personnel in the containment.

Notwithstanding the controls and procedures listed above, on August 9, following installation

,

of the new valve and authorization to melt the freeze plugs, low pressuri7er level and high

containment sump level alarms were received in the control room. Operators promptly

restored level by starting one charging pump. Upon entering the containment, the licensee discovered that four letdown system drain valves had been left open. The valves were immediately closed. Two of the drain valves had been used to verify free 7e plug integrity, and two had been used to drain the system prior to cutting out the original valve.

,

Approximately 650 gallons of coolant were drained prior to closing the valves. The licensee

initiated a plant incident report to identify the root cause of the incident. The inspector

!

,

performed an independent root cause determination of the event in order to evaluate the quality of the licensee's self-assessment. The licensee attributed the cause of the valve misalignment to poor communications between operating shifts and within the work control i

!

_

__

.

,

t

'

f unit. The inspector concluded that the configuration control of plant systems should not rely on verbal communication between individuals and that more formal controls were needed.

The licensee implemented interim corrective actions to both improve communication of work-related information and more formally control out-of-position components. In response i

to a number ofindications of degrading performance at Unit 2, the licensee initiated an independent review which reassessed this event among others. The results of this asessment will be documented in Millstone Inspection Report 50-245/93-24; 50-336/93-19-50-423/93-20.

i 3.3 Security Barrier Breach - Unit 3

,

On August 5,1993, at approximately 8:30 p.m., a security officer, during routine rounds, discovered a breach had been created when a spool piece in the discharge header of the 'A'

train service water system was removed. The spool piece was removed by construction

,

personnel on August 5, between 4:00 and 5:00 p.m., to allow service water erosion / corrosion inspections. As immediate corrective action, the area was inspected for unauthorized personnel and a security of6cer was posted in the area as a compensatory t

action. No unauthorized personnel were identified in the area. At 11:05 p.m., after investigation by the licensee, the licensee determined that a path for a security breach had existed. The licensee reported the event at 11:14 p.m., in accordance with 10 CFR 73.71.

The inspector discussed the event with the licensee and was informed that construction and security personnel had reviewed all work boundaries that were scheduled to be opened during the present refueling outage to determine when security personnel would be rcquired to be

posted. The inspector was informed that these work items were flagged on the outage

schedule to indicate that security would be required prior to opening the system. The t

inspector reviewed the outage schedule and noted that the schedule did indicate that securay was required to be posted prior to removing the 'A' train spool piece. The inspector discussed the event with the construction representative who was in charge of thejob activity

'

and was informed that he was aware of the requirement to notify security and that he spoke with the security supervisor that morning. The construction representative stated that he

thought that during his conversation with the security supervisor that morning, he

communicated the need to establish a security watch. However, due to miscommunication j

between the two individuals a security post was not established.

,

The inspector reviewed the work order specifying removal of the 'A' train discharge header spool piece and noted that the security block on the work order was not marked yes nor did

,

the cautions section of the work order indicate that a structural barrier would be breached and the need for the job leader to notify the security shift supervisor prior to opening the

barrier. The inspector was informed by the licensee that two of Ove work orders that

I

-l

.

J

-.

-

A

r required security to be noti 0ed did not contain any information indicating that security would

be required. These work orders were subsequently updated to reflect the need for security to be notified. The inspector noted that security had been posted for the other work activities which would result in security breaches prior to the opening of the systems.

As corrective action, the licensee stated that for the remainder of the refueling outage single work orders will be generaied for piping spools which require security coverage when removed to increase the visibility of the requirement, that spools which require security coverage will be labeled to alert the remover of the need to notify security prior to removal, that personnel involved were counselled on the importance of ensuring that documentation accurately reDects the work to be done, and that appropriate personnel including the integrated teams for each unit were advised of the event and lessons learned. As action to prevent recurrence, the licensee stated that modifications will be made to the computerized work order system so that for specifically identiGed systems and components the field on the work order used to indicate security requirements will be modified to alert the work order preparer to evaluate security implications prior to the work order being approved. The l

licensee stated that the modification to the computerized work order system is expected to be completed by December 1993.

Administrative Control Procedure (ACP)-QA-2.02C, " Work Orders," states that if the work scope will involve breaching or disabling structural barriers, a caution note for the job t

supervisor to notify the shift supervisor and/or the security shift supervisor should be included and documen! the noti 6 cation of the security department on the work order. The

,

inspector noted that if the work order had contained the required precautions that the r

construction personnel actually performing the work at thejob site would have been aware of the requirement and therefore may not have removed the spool piece until a security officer was posted. Although the outage schedule did contain a caution stating that a security post would be required, the failure of the work orders to contain the required information is a violation of ACP-QA-2.02C.

!

The inspector concluded that since the event was identified and reported by the licensee; and adequate corrective actions were implemented to correct and prevent recurrence, enforcement discretion per Section VII.Il of the Enforcement Policy would be exercised.

3.4 leaking Auxiliary Feed Pump Turbine Steam Isolation Valves - Unit 3 Unit 3 utilizes two half capacity motor-driven auxiliary feedwater (AFW) pumps and one full capacity steam turbine-driven AFW pump. The licensee has noted that leaking AFW turbine steam isolation valves (valve numbers 3 MSS *AOV31 A Il and D) can result in the steam turbine maintaining a slow spin (" idling") with the governor in the stop position. Sub<.cquent

,

starting of the AFW turbine from the idling condition has led to overspeed trip and temporary unavailability of the AFW steam turbine. Until satisfactory repair of the subject valves, the licensee is periodically conGrming that the AFW steam turbine is not idlin.

.

The inspector reviewed the maintenance history of the subject valves and found that these valves have had a chronic internal leakage problem. It appeared that typical remedial action, including replacement or repair of plug / seat surfaces had not been completely successful in eliminating valve leakage. A discussion with the responsibic Unit 3 maintenance supervisor indicated that a recent inspection of valve 3 MSS *AOV31D found that the spring seal (k>cated below the valve cage) was cut in half. This observation together with observed pitting below the spring seal indicated that steam leakage is occurring which bypasses the plug / seat surfaces.

The inspector con 6rmed that the subject valves are scheduled for maintenance during the current refueling outage. The maintenance is expected to include weld material deposition and machining to restore the seating surface below the spring seal.

The item is considered unresolved pending demonstration of satisfactory steam isolation performance of valves 3 MSS *AOV31 A, B and D (50-423/93-002).

3.5 Foreign Material Control in the Service Water System - Unit 3 On August 5,1993, with the plant in mcxle 5 for refueling, the licensee discovered a plywood disk wedged in a horizontal position inside the 'A' train service water (SW) piping.

The plywood was 28.5 inches in diameter and was wedged in a tee connection in the 30 inch supply header. One branch of the tee is 26 inches and supplies the 'A' train containment recirculation spray system (RSS) and the other branch is 30 inches and supplies the 'A' train reactor plant component cooling water (CCP), reactor plant ventilation (HVR), and charging pump coolers (CCE). On August 10, a second plywood disk,24.5 inch diameter, was identiGed in the 26 inch SW supply header to the 'A' train RSS coolers. These plywood disks represented a potential loss of a portion of the 'A' train SW header and thus the potential loss of the above speci6ed 'A' train emergency core cooling system con ponents.

Subsequent to the identiGcation of the plywood, the licensee removed the disks from the SW system and initiated plant incident reports. No immediate corrective action was required because the 'A' train of SW was already inoperable for inspections. The licensee stated that a similar problem in the 'B' train of SW was unlikely due to the unique configuration of the

'A' train header which prevented visual inspection of the dam location from the pipe opening. The licensee informed the inspector that a licensee event report would be issued in accordance with 10 CFR 50.73 as a condition prohibited by technical specifications.

During the July 1991 service water / mussel cleaning outage, large sections of SW piping were disassembled, cleaned of biofouling, repaired, and coated with a protective epoxy coating in an effort to minimize the extent of erosion / corrosion in the large bore SW piping system.

The licensee determined that the identified plywood disks were originally installed with wedges m the 'A' train SW supply header for grit blasting and coating work on the piping tee in accordance with work order AWO M3-91-18526. The licensee stated that the plywooci e

_ _ _ _______ _

.

.

.

'

disks normally are removed by construction personnel prior to pipe coating activities; however, they were left in place due to air Dow in the piping which was causing debris to enter the area thus affecting the coating application. The disk removal sequence change was overlooked prior to spool piece installation in accordance with AWO M3-91-17701.

The inspector reviewed work orders M3-91-18526 and M3-91-17701 and noted that a cleanliness class E inspection was specified in work order M3-91-17701 for the installation and removal of the SW spool piece; however, an inspection was not specified in work order M3-91-18526 for the sandblast and coating evolution. The area of interest for the cleanliness class E inspection in AWO M3-91-17701 was the area immediately adjacent to the spool piece Ganges and the line of sight down the SW pipe. No internal inspection was required.

The plywood disks were out of sight beyond two 45 degree elbows and thus not observed.

The licensee stated that subsequent to the 1991 outage, the SW system had been flushed.

The licensee postulated that the plywood disks were driven to a point where they wedged into the piping and could no longer move. The purpose of the SW system flush was to remove construction debris, verify system resistance, and conduct performance testing prior to retuming the SW system to service. As part of the cleanliness verification of the system, temporary strainers were installed during the Gush, and the RSS CCP, and HVR heat exchangers were opened following the flush to conduct cleanliness inspections. Minor debris was discovered and removed and Plant Incident Report (plR) 3-91-278 was generated.

Licensee inspection of the SW headers upstream of where the disks were originally placed did not reveal any damage nor was there marking which would indicated that the disks had moved since the cleanliness Bush was performed. Subsequent system surveillance testing performed since the 1991 outage had not identified system flow degradation nor has any other construction debris been found in the routine inspections of the heat exchangers sup' lied by the SW system.

The resolution to the PIR concluded that the Cusning efforts had adequately cicaned the system of any debris which could have impacted system performance and ensured system cleanliness. The licensee did not reconcile the collected debris with specific job-related equipment. As action to prevent recurrence, the PIR recommended that, for quality related components or systems, it was necessary that a final cicanliness inspection be performed for all areas worked. The PIR was assigned to the generation construction, quality control, and maintenance departments for revicw to ensure that the incident was taken into account when specifying and approving cleanliness inspections for future work orders. The inspector reviewed work orders processed for the 'A' train of SW for the current outage and noted that a cleanliness class E inspection was specified for spool piece removal; however, one was not specified for piping repairs. The inspector was concerned with the ineffectiveness of the 1991 PIR corrective actions and the inconsistency in work controls specified to maintain the cleanliness of safety-related system.

_

_ -_ _-

,

!

-

..

Administrative Control Procedure (ACP)-QA-4.01 A, " System and Component Housekeeping," lists the SW system as a Zone V system and specines a cleanliness class E inspection for maintenance ofinservice components. A class E inspection requires identifying the as found internal condition of the system and requires that an inspection is to be performed after work is completed and prior to closure to arsure the system is returned to its as found or better condition. The failure to specify and cor duct cleanliness inspections j

for all SW pipes worked during the 1991 outage was a violation of ACP-QA-4.01 A.

.

!

There was no indication that the dams had moved since the 1991 system Dush. Had the plywood dams become dislodged, they would have been stopped by valves further downstream in the SW system and could have resulted in reduced flow and/or increased temperature. Control room annunciators would have alerted operators to the abnormal condition. Technical Speci0 cation (TS) 3.7.4 requires that two independent SW systems be operable. With only one train operable, the other train must be restored to service within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant be placed in hot standby within the next six hours and cold shutdown

within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. Although system performance did not appear to have been

'

compromised by the existing position of the plywood disks, they could have become

'

dislodged and resulted in a stoppage of flow to safety related components. Therefore, the licensee considered the 'A' train of the service water system inoperable for greater than 72 consecutive hours during the previous operating cycle. This was reported in Licensee Event Report 50-423/93-12 on September 3,1993.

As corrective action, the licensee stated that for the remainder of the current refueling outage any plywood placed in the SW system would be labeled and a work order issued to track the

installation and removal of plywood dams. In addition, a 100 percent inspection of all SW piping would be performed prior to system closure. As long term corrective actions, the '

licensee issued a memorandum to engineering, construction, maintenance, and quality services regarding clarification of piping cleanliness inspection requirements. In addition, Procedure ACP-QA-2.02C, " Work Control Process," has been revised to include a more formalized approach to foreign material exclusion during maintenance. The licensee committed to implement Revision 32 to ACP-QA-2.02C at Unit 3 in January 1994. The inspectors reviewed the revised procedure and concluded that the revised controls provide for material accountability during work activities, as well as, inspections following completion.

The proposed corrective action was acceptable.

-

The inspector concluded that the safety significance of the event was mitigated because only

'

the 'A' train was affected, and because flushes performed after the 1991 outage and all subsequent surveillance tests have not identified any degradation in system performance.

,

The inspector determined that since the event was of minor safety significance and adequate corrective actions will be taken by the licensee, enforcement discretion per Section VII.B of

the Enforcement Policy would be exercised. However, the inspector was concerned regarding the inadequate implementation of the original PIR corrective actions and the poor

,

.

h

.

-.n.,

r aw

-.

-.

,-

i-

15 I

work control oversight by department supervision in not specifying consistent work order

!

guidance for the cleanliness inspections. As noted in Section 3.3, control of security requirements in work orders was also de6cient. The implementation of PlR corrective action and revised work order controls will be evaluated during NRC follow-up of unresnited item 50-423/93-15-003.

4.0 SURVEILLANCE (IP 61726)

The inspectors observed and reviewed selected portions of surveillance tests, and reviewed test data, to verify adherence to procedures and techmcal specification limiting conditions for operation; proper removal and restoration of equipment; and, appropriate review and resolution of test deficiencies. The inspector reviewed portions of the following tests:

• SP 2403E Refueling Water Storage Tank Level Sensor Calibration

• SP 21134 Main Steam System Valves Operational Readiness Test i

• SP 2604B High Pressure Safety injection Pump Operability Test, Facility 2

'

• SP 3441F01 Intermediate and Power Range Detector Plateau Test

• SP 3450Fil Waste Neutralization Sump Radiation Monitor Analog Channel Operational Test Except as noted below, the inspectors determined that the surveillance activitics observed were performed adequately. Details of the inspector's observations are provided in report Sections 4.1-4.5.

4.1 Standby Liquid Control Pump Monthly Operability Test - Unit 1 l

l On August 3,1993, the inspector observed the monthly operability test of the 'A' Standby Liquid Control (SLC) pumps conducted per Procedure SP 661.4, " Standby Liquid Control Operational Readiness Test." The purpose of this test was to verify that the SLC pumps can deliver 40 gallons per minute at 1225 pounds per square inch discharge pressure.

'

Additionally, during this test, vibration readings of the SLC pumps were scheduled to be i

taken. The test is accomplished by pumping demineralized water from the boron test tank to l

the boron storage tank.

Prior to the test, the inspector verified that the monthly test requirements contained in plant Technical Speci6 cation (TS) 4.4.A.1, " Standby Liquid Control System," were met. The inspector also verified that the surveillance procedure was listed in the Master Test Control List, Procedure ACP-QA-9.02A, and the test was scheduled on the daily production schedule and surveillance tracking systems.

l l

__-__

m

.

While observing the test of the 'A' pump, the inspector verified that personnel adhered to the procedure. While pumping down the test tank to verify the capacity of the SLC pump, the inspector noted that the SLC system began to vibrate more than normal. A licensee inservice test (IST) technician stated that the vibration was not emanating from the 'A' SLC pump.

Rather, the technician stated that the vibration appeared to be coming from check valve 1-SL-10 which is located at the outlet of the test tank. According to the technician, during previous tests of the SLC system some vibration has occurred but it had not been as pronounced. The inspector noted that the system vibration did not appear to affect the performance of the pump since the How surveillance acceptance criterion was met. The licensee stated that when the 'B' SLC pump was tested later in the day the vibration occurred again but was less pronounced. The licensee stated that the performance of the system will be monitored during the next test for signs of excessive vibration.

The inspector noted that check valve 1-SL-10 is valved into the system only when testing the SLC pumps. Therefore, a failure of the valve would not affect system operability when the system is performing its safety function. However, a failure of the check valve when the system is being tested could cause extensive damage to a SLC pump. The inspector was concerned that licensee personnel may have observed the excessive vibration in the SLC system during previous surveillance tests but failed to evaluate the significance. The inspector considered this inaction to be an example of operator inattention to abnormal equipment performance.

Following the test, the inspector reviewed other sections of Procedure SP 661.4. During this review, the inspector noted that the procedure did not work as written. Specifically, when testing the 'B' SLC pump, the procedure referred to a non-existent step in the procedure; and the restoration section incorrectly positioned valves. These deficiencies were apparently not identified by the three operators who were observing and or performing the surveillance test.

Through conversations with one of the operators, the inspector was informed that the defective section of the restoration procedure which adjusted water level in the test tank was not performed since the level in the test tank was adequate. Therefore, the operator did not have ankportunity to discover this procedure error. The operator indicated that she apparently overlooked that the procedure erroneously referred to Step 6.2D rather than Step 6.20 when testing the 'B' SLC pump. The inspector verified that the procedure deficiencies were corrected. Since many operators had utilized the procedure and had not noticed the deficiencies, the inspector considered the failure of operators to identify the procedure deficiencies to be an example ofinattention to detail and ofinadequate procedure review and adherence at Unit 1.

During the test, the inspector also noted that one pump of the SLC system at a time would be rendered inoperable when placed in a test configuration lineup. The operations department did not log into the appropriate TS LCO to identify the system condition. However, the allowed outage time for the SLC system was not exceeded, nor did the pump outage

_ _ _ - _

_

.

transgress a shift turnover. The operrt:ous manager informed the inspector that it was his intention for operators to log into TS LOO action statements when systems are rendered inoperable during the performance of a te:.t. Therefore, the manager indicated this the test procedure would be revised. The inspect (r had no further questions at this time.

4.2 Failure of LPCI System Valve to Operate - Unit 1 On July 6,1993, during the performance of Surveillance Procedure SP-623.8, ' Containment Isolation Valve Operability Demonstrations," which verifies the operability of containment isolation valves; valve 1-LP-9B failed to open when it received an electrical signal from the control room. Valve 1-LP-98 is a normally open motor operated valve which is located in the 'B' train of the low pressure coolant injection (LPCI) system. The valve was closed from the control room during the performance of Procedure SP-623.8 to allow cycling of the upstream valve 1-1.P-10B which is normally closed and changes position in response to an accident signal. These valves are equipped with a Teledyne model T-40 actuator.

i The Unit 1 LPCI system is des:gned to preferentially inject into the 'B' loop following a design basis loss of coolant accident (LOCA) provided that the system does not detect a leak in the 'B' loop. The failure of valve 1-LP-93 to reopen rendered both LPCI trains incapable of responding to LOCAs at locations other than those which would shift the injection line-up te e 'A' loop. Accordingly, the licensee declared both LPCI trains inoperable and entered the appropriate technical specification (TS) limiting condition for operation (LCO) 3.5.A 6.

This LCO requires the plant to be placed in cold shutdown within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if the LPCI system cannot be restored to an operable status. The licensee reported to the NRC that both trains of the LPCI system were rendered inoperabic. The failure of valve 1-LP-9B was subsequently reported in Licensee Event Report 50-245/93-09, dated August 5,1993.

The inspector observed portions of the troubleshooting operations which were conducted on j

valve 1-LP-98. The inspector noted that appropriate radiological controls were established,

'

the valve disassembly procedure was at the work site for guidance and first line supervision was present. Examination of the valve revealed that the manual actuator had shifted and prevented movement of the valve both electrically and manually. The shift occurred when a snap ring which holds the manual actuator in position became disengaged from its retaining groove. The licensee was not able to repair the manual actuator for the valve since spare parts were not available. To restore the valve to an operable status, the licensee removed the damaged portions of the manuni operator which prevented the valve from operating l _

electrically. The valve was then cycled electrically, placed in the normally open position and i

declared operable. TS LCO 3.5.A.6 was exited. Parts were ordered from the manufacturer and a caution tag was placed on the valve which identified the missing components.

,

_

.

.

. _.

-.

.-

.

_.

..

'!

.

!

'.

!

l

,

'

To ensure the snap rings of similar valves were properly installed, the licensee verified that

!

the snap rings of the three remaining valves of similar construction were properly seated in l

their respective retaining groove. The inspector noted that the snap ring failure appeared to i

'

be random and not related to any ongoing or previous maintenance activity. At the close of

.

the report period, the licensee had not determined why the snap ring moved out of its

!

retaining groove. The licensee intends to inspect the soy cing to determine the cause of the

failure once the spare parts for the manual actuator arive on site. The inspector considered l

the licensee initial response to the event to be adequate pending determination of the cause of

!

the snap ring movement.

!

!

4.3 Vacuum Breaker Surveillance - Unit 1 I

The inspector witnessed surveillance testing of the ten torus to drywell vacuum breakers at Unit 1 on August 9,1993. The purpose of the test, was to verify that the vacuum breakers l

opened and closed freely and their position was accurately indicated by the valve limit I

switch. The test is performed monthly per plant Technical Speci6 cation 4.7. A.5.A,

!

" Containment Systems." and is controlled by plant Procedure SP 632.4, " Suppression Chamber Vacuum Breaker Exercise."

!

Prior to performance of the test, the inspecto. veri 6ed that the procedure met the intent of f

TS 4.7. A.5.A and was listed in the surveillance master list, administrative control procedure l

ACP-QA 9.02. During the test, the inspector verified that the operators accurately

communicated to the control room the posi* ion of the valves as displayed on a local panel

when the valves were tested. The operators who opened the valves indicated that no external

!

force was applied to the valves to assist in their closure. The inspector al o verified that the

'

control room entered the appropriate TS Limiting Condition for Operation (LCO) which l

governed drywell to torus differential pressure when pressure decreased below the TS limit

of 1 pound per square inch due to the opening of the vacuum breakers. The inspector verified that the TS LCO was cleared within the allowed outage time when the differential pressure was restored. The inspector determined that the surveillance was performed well.

The inspector reviewed two General Electric Ser ice Information Letters (SILS) which were l

.

applicable to the vacuum breakers installed at Millstone Unit 1. The purpose of the review was to ascertain if the licensee properly evaluated the Sil.s for applicability to Unit 1. Both

,

SILs did not appear to have been answered adequately by the licensee since no written

response was found for the first SIL and the second SIL response addressed only one of the j

three areas of concern. The first SIL recommended modifying the vacuum breaker counterweights to improve valve seating. The licensee stated that the improvements which

,

the S1L recommended were not made at Unit I since the valves have historically seated

'

properly when tested. The inspector agreed with this assessment since a review of the work

history for two valves revealed that no corrective maintenance had been performed on the valves for seating deficiencies.

!

i b

!

.

-

a

_

... -.

.

.. -.

- _ _

- _

_

__-

f.

,

i

.,

The second SIL noted that the vacuum breakers can be damaged during a Loss of Coolant

!

Accident (LOCA) as components vibrate loose due to excessive valve cycling. To reduce the possibility of valve damage, the SIL recommended that valve components be restrained from vibrating loose through a combination of techniques which included the use of lockwire, pin j

dowels and anti-rotation setscrews. Further, the SIL recommended that vacuum breaker-stufGng Mxes be inspected more frequently, and emergency operating procedures (EOPs) bc

modified to reduce vacuum breaker valve cycling. The SIL noted that if the reactor safety

!

relief valves have to be opened, they should be opened so that the heat distribution of the torus would be evenly distributed throughout the structure.

,

!

The inspector reviewed a drawing of the Unit I vacuum breakers and noted that most of the internal components susceptible to vibration induced damage were secured. The inspector

was informed that during the 1986 refuel outage, the limit switch mounting was strengthened to improve switch rigidity. The inspector examined two vacuum breakers in the torus area

and noted that the limit switches for the breakers appeared to be adequately attached. The j

inspector also noted that the licensee met the second recommendation of the SIL by l

performing inspections of two vacuum breakers each refuel outage per Procedure MP 712.1,

!

" Pressure Suppression Chamber Torus to Drywell Vacuum Breaker Valve inspection and

Repair." During the inspection, the vacuum breaker stuffing box is removed and inspected.

The inspector reviewed the EOPs for controlling reactor plant pressure and noted that the l

licensee does try to evenly distribute the heat load throughout the torus structure. Therefore,

the inspector concluded that the licensee adequately addressed the concerns contained in the

second SIL. The need for improvement in the licensee's evaluation and documentation of action for industry experience was reported in NRC Inspection Report 50-245/93-10. The i

licensee implemented a new process for handling this type of information. The inspector had l

no further questions regarding the vacuum breaker issues.

)

i i

4.4 Main Steani Code Safety Valve Testing - Unit 3 On July 31 the inspector observed portions of Surveillance Procedure (SP) 3712G, " Main Steam Code Safety Valve Surveillance Testing." The surveillance is performed every

,

refueling outage and the object is to verify the steam generator (SG) safety valves lift

!

setpoints. Ten of the twenty SG safety valves failed the +/- one percent tolerance band as specified in technical speciGcations (TS). The largest deviation observed on the safety valves that failed was (+)3.1 percent and (-)2.19 percent. All ten of the out-of-tolerance SG safety valve lift setpoints were reset and tested to be within the one percent tolerance.

The licensee reviewed the test data and determined that the as-found setpoints did not result in any safety implications since the setpoints are bounded by the safety analysis. The inspector verified that the applicable TS limiting condition of operation was entered and noted that the maintenance job supervisor who directed the surveillance was knowledgeable

and followed the procedure. The inspector also noted that drifting of SG safety valves has

previously occurred at Unit 3 and had been attributed to inadequate design. The licensee r

stated that the manufacturer has been unable to identify any specific cause of the drift.

l t

i I

,

.

,

_

l

<

P

,

t i

4.5 Procedural Discrepancy - Unit 3 i

During review of Surveillance Procedure (SP) 3449E02, " Containment Area Purge and

Exhaust Isolation Calibration Procedure (3RMS*RE42)," the inspector noted a discrepancy

between the body of the procedure and the data sheet. The procedure specified to verify radiation monitor 3RMS*RE42 setpoint by verifying that the outer containment purge and exhaust isolation valves (3HVU*CTV33A/B) go close whereas the data sheet listed the ' inner containment purge and exhaust isolation valves (3HVU*CTV32A/B). The inspector was

,

concerned that valves 3HVU*CTV33A/B may not have been verified every 18 months as

required by technical specifications. The inspector notified the licensee of this discrepancy.

In response to the inspector's concerns, the licensee changed the data sheet to be consistent with the body of the surveillance procedure. The licensee informed the inspector that they I

had identined the discrepancy and had stamped the cover sheet of the procedure "do not

!

use". The licensee stated that the steps contained in the body of the procedure were performed and followed as written and that the data sheet error was overlooked. The i

inspector noted that the inner and outer containment area purge and exhaust isolation valves were tested, in accordance with Operating Procedure 3613F.3, to verify that the valves go closed on a high radiation alarm. The inspector had no further questions.

,

5.0 ENGINEERING (IP 37700,37828)

5.1 Low Pressure Coolant Injection System Design - Unit 1 While following up on the failure of low pressure coolant injection (LPCI) system valve 1-LP-9B to operate (described in Section 4.2 of this report), the inspector questioned the vulnerability of the LPCI system to a single failure. SpeciGcally, the LPCI system is designed to preferentially inject into the 'B' loop following a design basis loss of coolant accident (LOCA) if the system fails to detect a leak in either the 'A' or 'B' loop. The inspector noted that if valve 1-LP-10B, which is the last valve in the 'B' train of the LPCI system prior to entering the 'B' loop, failed to open on an engineered safety features signal, both LPCI trains would be rendered inoperable unless the Icak is located and detected in the

'A' loop. This vulnerability would also apply to valve 1-LP-10A with the a leak detected in the 'B' loop and 1-LP-10A failed to open.

To examine this issue, the inspector reviewed the relevant portions of the Unit 1 Technical Specifications, the Updated Final Safety Analysis Report (UFSAR), the Probabilistic Safety Study, the Individual Plant Evaluation report, and a July 25, 1975, LOCA analysis which was submitted to the NRC. In the 'UFSAR, the licensee stated that no single failure prevents either the starting of the emergency core cooling system (ECCS) when required, or the delivery of coolant to the reactor vessel Table 6.3-1 of the UFSAR discusses the summary of provisions for emergency core cooling following a design basis event and a resultant

_

_

.-

I

.,

-

,

single failure. The inspector noted that for a large break 1.OCA, the licensee credits either two core spray subsystems or one core spray subsystem and one LPCI subsystem.

Therefore, if the LPCI system is rendered inoperable due to a failure of valve 1-LP-10A or 1011, the licensee can still credit both core spray subsystems to supply cooling water to the core to prevent fuel clad melting.

In a letter, dated July 9,1975, to the NRC, the licensee submitted its LOCA analyses using an acceptable model as set forth in 10 CFR 50, Appendix K, ECCS Evaluation Models. The analyses included a single failure study on ECCS manually controlled electrically operated valves. The study showed that with a LPCI injection valve failure, the core spray system would supply enough cooling water to prevent fuel clad melting following a LOCA.

The inspector noted that the importance of the core spray and LPCI systems to mitigate core damage following a LOCA has been incorporated into the plant technical speci6 cations by limiting system out of service time. Specifically, if a core spray subsystem is inoperable, the LPCI system must remain operable and the licensee has 15 days to restore the system or be in cold shutdown or the refuel condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. If a LPCI subsystem is found inoperable, the licensee has 30 days to correct it and both core spray subsystems must remain operable. The inspector noted that the more restricted allowed outage time for the core spray system is appropriate since the licensee places greater reliance on that system to mitigate core damage.

The inspector concluded that the single failure vulnerability of the LPCI system injection valves has been thoroughly investigated by the licensee and is adequately compensated by the core spray system. Further, there are adequate administrative controls in place in the Unit I plant TS to ensure that sufficient emergency cooling is available to mitigate core damage following a LOCA.

6.0 SAFETY ASSFSSMENT/ QUALITY VERIFICATION (IP 40500,90712,92700)

6.1 Review of Written Reports The inspector reviewed periodic reports, special reports, and licensee event reports (LERs)

for root cause and safety signincance determinations and adequacy of corrective action. The inspectors determined whether further information was required and veri 6cd that the reporting requirements of 10 CFR 50.73, station administrative and operating procedures, and Technical Specifications 6.6 and 6.9 had been met. The following reports and LER's were reviewed:

Unit 1 Monthly Operating Report for June 1993, dated July 9,1993. This report

contained an administrative error in that the amount of fuel which is in the spent fuel pool was reported as 784 assemblics vice the actual 2116.

l i

.

.

Unit 1 Monthly Operating Report for July 1993, dated August 9,1993.

LER 50-245/93-06-01 was a revision to a report which identified unsealed fire penetrations during the performance of a surveillance test. The LER revision included the discovery of another unsealed penetration. This LER was submitted one day late and change bars were not placed on the report were the revisions were made.

The licensee stated that the report would be revised. The technical aspects of the report are discussed further in Section 6.1.1 of this inspection report.

• LER 50-423/93-005 reported inadequate overlap testing. This issue was previously discussed in Inspection Report 50-423/93-13.

i LER 50-423/93-006 reported inadequate testing of high pressure safety injection check

valves. This issue is discussed in Section 6.1.2 of this inspection report.

LER 50-423/93-009 reported the inoperable supplemental leak collection and release

system potentially during the last cold weather periods. This issue was previously discussed in Inspection Report 50-423/93-13.

6.1.1 Unsealed Fire Penetrations identified - Unit 1 Licensee Event Report (LER) 93-06 reported the discovery of two unsealed fire stops at Millstone Unit 1. The unsealed penetrations were identi6cd during the performance of

,

eighteen month Technical Specification (TS) Surveillance 4.12.F.1, " Penetration Fire Barriers." Plant TS's require the licensee to inspect all Gre seals once every eighteen months. The unsealed penetrations were located in a wall between the diesel generator day 1:mk and station battery room, and a wall between the machinery shop and the boiler room.

Licensee immediate corrective action consisted of establishing a Ore watch at the unsealed penetrations. Long term action consisted of repairing the missing degraded seals with appropriate scalant material.

According to the licensee, the unsealed penetration in the boiler room was not identified on the wall penetration drawing and was consequently never inspected. The penetration in the

,

day tank room was obstructed by an electrical junction box on one side. Therefore, personnel apparently thought the seal was properly installed when light could not be seen through the penetration. The inspector noted that out of approximately 1800 penetrations which have been examined during the surveillance 83 discrepancies had been identified. The type of discrepancies were varied and ranged from degraded seals to inaccurate labeling. The licensee stated that the two missing seals were identi6cd during this inspection cycle because of an improved surveillance procedure, better training provided to operators before they commenced the inspection, and improved attention to detai.

'

.

'

The inspector examined the areas in which the missing seals were identified. One seal was located high in an overhead and could only be reached by a ladder. The other seal was in a more accessible area above the entrance door to the diesel generator day tank room but was obscured on one side by an electrical junction box. Neither penetration was part of a recent i

installation and therefore had been unsealed for an extended period of time. The inspector reviewed the surveillance procedure which operators used to perform the inspections (SP 680N, "18 Month Fire Barrier Penetration Inspection") and compared it to the previous

-

revision in which fire seal inspections were performed. The inspector noted that although the revie ! procedure contained greater detail concerning seal acceptance criteria, both

pro.dures and the accompanying drawings were adequate to enable proper inspection of the

'

seals. Additionally, neither procedure specifically required licensee personnel to examine a l

wall for unidentified penetrations. Therefore, the inspector concluded that the seals were not identified during previous inspections because of poor personnel performance and an inadequate inspection procedure.

i To ensure personnel will specifically examine a wall for penetrations that are not on plant drawings, the licensee will revise Procedure SP 680N to require operators to check the wall j

for unidentified seals. Additionally, the licensee will examine one other fire barrier wall

during this inspection cycle and verify that all seals are listed on the wall map drawing. The

.

'

licensee stated the missing seals were of minor safety significance since the missing seals were located in a common fire zone. Therefore, fire propagation through various fire

-

barriers was not a concern. Additionally, the areas are protected by Orc detection equipment, and Gre suppression equipment was available in the areas. The inspector agreed with the assessment. The inspector noted that Unit I has identiGed only six other missing

,

seals since 1990 during previous surveillance inspections. Therefore, unsealed penetrations does not appear to be a programmatic concern. The inspector considered the licensee's

,

corrective action to be appropriate. Therefore, enforcement discretion was exercised in accordance with Section VII.B of the NRC Enforcement Policy.

6.1.2 Inadequate testing of Iligh Pressure Safety injection Check Valves - Unit 3

-

The inspector reviewed Licensee Event Report (LER)93-006, which reported that on May 25,1993, with the plant at 100 percent power, the licensee determined that the 'B' train high pressare safety injection (HPSI) system was inoperable due to the failure to perform the

,

quarterly partial stroke test for two train 'B' HPSI discharge check valves. The in-service test (IST) manual requires a quarterly partial stroke test of these check valves but the surveillance procedure incorrectly had been revised in 1986 to delete this surveillance requirement. The licensee determined that the root cause of the event was personnel error; in that a verbal commitment to submit a relief request was used as the basis to delete the surveillance requirement. The licensee documented this event in LER 93-006 as required by 10 CFR 50.73(a)(2)(i).

,

_

-.

l

.

As corrective action, a surveillance test was written and performed to demonstrate the operability of the check va'ves. As action to prevent recurrence, the need to ensure surveillance procedures are changed only after IST manual test requirements have been changed was reinforced to the operations and engineering departments. Additionally, the

,

licensee committed to perform an audit of the IST manual to ensure that all testing requirements have been incorporated into the surveillance procedures. The event had minimal safety significant since the valves operated properly when partially stroked and the valves have operated properly during the required 18 month full stroke surveillance test. The inspector considered the corrective actions to be appropriate. Since the event was identified, reported, and was of minor safety significant, enforcement discretion per Section Vll.B of the Enforcement Policy was exercised.

6.2 Employee Concerns Program The inspection objective was to understand the characteristics of the licensee's employee

'

concerns program. The inspection consisted of reviewing licensee Procedure NEO 2.15

" Nuclear Safety Concerns," and discussion with licensee nuclear safety concerns program personnel. This program applies to both the Millstone and Haddam Neck sites. The characteristics of the program are documented in NRC Inspection Report 50-213/93-16. The scope of this inspection did not assess the effectiveness of the licensee's program.

NRC inspector review of the program concluded that it provides a level of independence from line management based on organizational structure, and final resolution authority for a concern. However, the proposed resolution of a concern may involve line management.

According to Procedure NEO 2.15, the licensee's nuclear safety concerns program staff i

coordinates, but does not develop proposed resolution to a nuclear safety concern.

)

l The licensec's nuclear safety concerns program provides various means for employees to discuss a nuclear safety concern. The program provides for confidentiality and anonymity for concerned individuals. Finally, the licensee's measure of program effectiveness includes alleger satisfaction with the resolution of concerns.

6.3 Review of Previously Identified Issues

)

6.3.1 Improper Testing of a Standby Gas Treatment Fan - Unit 1 Unresolved Item (50-245/92-12-02) involved a technician who leaned on the fan bearings of a Standby Gas Treatment (SBGT) fan to lower vibration readings within the acceptance criteria. The corrective actions surrounding this event as well as the disciplinary actions tabn regarding the individual in question were detailed in NRC Inspection Report 50-245/92-12. The corrective actions were determined to be comprehensive and effective at the time, but the issue. was left unresolved pending review of the implementation of the licensee's incident Investigation Team (llT) recommendations. Subsequently this item was later determined to be a violation of NRC requirements and a severity level IV violation

.

.

.

.

.

-

..

.

_.

,

.

issued on July 14, 1992. Based on the low safety significance of the violation, the individual's position and the licensee's disciplinary and corrective actions, the NRC elected not to pursue enforcement action directly against the individual involved. The licensee provided its response to this violation on August 19,1992, listing additional details regarding their corrective measures and disciplinary actions in this matter.

The inspectors reviewed the licensee's response to the violation as well as the IIT recommendations. The response was acceptabic as was the approach and progress with implementing the key IIT recommendations. Based on the isolated nature of this event and the corrective and disciplinary actions taken, this item is considered closed.

'

6.3.2 Failure to Follow Procedures for Environmentally Qualified (EQ) Splices - Unit 2 Violations 50-336/91-05-02/03/04 were the subject of an enforcement conference with the NRC on March 27, 1991. In addition, the NRC Office of Investigations (01) reviewed this t

issue after the NRC received information claiming that: 1) false information was provided

during the enforcement conference and 2) someone possibly altered or tamp ( ed with the EQ splice in question. Neither claim reviewed by OI was substantiated. These mree violations and the results of the C investigation were presented to the licensee on December 20,1991; no civil penalty was i al. The licensee's response to the violations was provided on January 22,1992, a

, usequent submitta: followed on February 6,1992, which provided the details of their internal inve'..igation conducted on this issue.

The first violation involved the installation by an electrician of an EQ splice on the No. 2 steam generator atmospherb dump valve (valve 2-MS-1908) without removing the braided cable jacket material from the splice area. The defective splice was promptly removed and replaced with a quali6ed splice. The electrician who performed the work was counseled regarding this work by his supervisor. However, the electrician refused to discuss this work further or in any detail with his supervisor nor would he cooperate in the other elements of the licensee's investigation of the matter.

The second violation involved the procedural signoff by a quality control inspector that the

braided cable jacket material was removed prior to installation of the splice. The quality control inspector was counseled and formally disciplined for this matter. In addition,

'

management emphasized in meetings and in writing to plant maintenance personnel their expectation of perscaal veri 0 cation of work performed and in-field use of work order

packages.

l The last violation involved the procedural signoff by the electrician (pb supervisor) that the braided cable jacket material was removed prior to installation of the splice. The precise

-

reasons for this violation could not be determined by the licensee. Due to the unwillingness of the electrician to cooperate in their review of the matter, the licensee was unable to

'

reconstruct the sequence of events leading to this violation. In response to this violation, job'

supervisors were reminded of their responsibilities to ensure that work under their direction i

!

.

_ _ _

_

_ _

-l

..

!

l

.

t

!

is completed in an accurate manner before they sign off on any work order. The electrician in question was not disciplined nor compelled to cooperate in this rnatter because: 1) he had

previously filed numerous Department of 12bor complaints under Section 210 of the Energy

Reorganization Act and 2) his charge that the incident was an effort to retaliate against him

!

by management. The inspectors noted that this individual was subsequently terminated in November 1991, for other reasons and his Department of Labor complaints dismissed as part of a settlement agreement made with the licensee in March 1992.

The inspector concluded that the subject violations were an isolated incident that was not

-

condoned by management. The corrective actions taken in this matter were comprehensive and effective at preventing a recurrence of the problem. Senior management's expectations in this area were clearly communicated to the station staff. In addition, concurrent with i

these corrective actions, the licensee pursued a broad program to improve procedure compliance through a work observation program. While procedure compliance at the station i

stili merits improvement (as noted in the NRC Systematic Assessment Report 92-99),

i improvements in procedure compliance since late 1991 have been noted.

l t

In addition to the corrective actions previously noted, the licensee conducted a series of i

" workmanship" inspections of environmentally qualified (EQ) splices, installed by various members of the electrical department, to verify the adequacy of original installations. The results of the effort were reviewed by the inspectors who noted that of the 41 items inspected, the workmanship on 36 were rated as either " good" or " excellent." The five remaining items inspected had some aspects of the work which were unacceptable and

required rework, one involving an improperly installed Raychem splice over a braided cable j

jacket (this installation was not performed by the electrician in question). The findings of these inspections indicated a need for close attention to detail during the conduct of safe:y-related electrical maintenance, particularly regarding the use of non-QA Category I material where QA Category I material is mandated. However, the inspectors noted that the workmanship problems were minor and none were so egregious as to have led to the associated components failing or becoming otherwise inoperable. Also, the quality of work was determined to be consistent throughout the electrical group in the maintenance department versus confined to the electrician in question. In addition, the licensee performed j

workmanship inspections on other maintenance activities. A sample of those inspections was

,

observed by the NRC previously and documented in inspection Report 50-336/91-18; no major problems were noted. Based on the isolated nature of this event, the comprehensive correction actions taken (both programmatically and in the area of communicating management's performance expectations), these violations are considered clowd.

l l

.

._

,,

s

-

6.3.3 Degraded Anchor Bolts on the "C" RBCCW IIcat Exchanger - Unit 2 Unresobed Item 50-336/90-22-07: The licensee identined in 1989 degradation of a number of anchor bolts on the reactor building closed cooling water (RBCCW) heat exchanger due to salt water induced corrosion. This issue was reviewed in detail during NRC Inspection 50-336/90-22 during which time questions were raised regarding: 1) the impact of this corrosion on system operability,2) the adequacy of the RBCCW operability assessment, particularly the engineering evaluation of the adequacy of the system under seismic loading,

.

3) the need to report this event to the NRC and 4) the resolution and reporting of dc0ciencies subsequently identined with service water support #60027 during follow-up inspections of other supports exposed to salt water.

The inspectors reviewed LER 90-17-03 that documented the corrective actions taken in response to the licensee's discovery that seismic Class I hangar #60027 did not comply with

,

the requirements of NRC (IE)Bulletin 79-02. These corrective actions appeared satisfactory.

The operability assessment detailed in REF 90-45, dated September 11,1990, indicated that the RBCCW heat exchangers and associated piping would have remained operable during a design basis carthquake (DBE), although design code allowables would not necessarily be satisfied. The anchor bolts were promptly replaced and the RBCCW base plates coated with a sealant.

The inspectors reviewed the Engineering Procedure (EN 21216, Revision 0) implemented to periodically examine for corrosion the anchor bolts and base plates of supports exposed to sea water. This procedure also included a check of the coating on the RBCCW heat cxchanger base plates. The procedure was implemented during the 1992 Unit 2 refueling and steam generator replacement outage. The Unit 2 engineering department selected a representative sample of bolting arrangements for disassembly and inspection based on k> cation and ongoing work. All discrepancies identi6cd were dispositioned via nonconformance reports (NCRs). The inspectors reviewed 3 of 5 NCRs (292-848,930 &

945) written during the 1992 outage documenting bolting and support plate corrosion. These NCRs provided detailed inspection reports and calculations of the examination results, as well as, disposition of the identified discrepancies. All three NCRs indicated that the level of corrosion had in no way approached the minimum bolt or support plate thickness required to handle the load that would be experienced under all design basis loading conditions. Thus, none of the identified discrepancies were determined to be reportable.

The inspectors noted that the experience gained from this event was disseminated to Unit 3, although limited corrective actions were taken due to differences in the design of anchor plate and bolting arrangements which make similar salt water induced anchor bolt corrosion far less likely. Unit 1 previously had identified corroded anchor bolts. The NRC follow-up of that concern was tracked by unresolved item 50-245/91-24-03, and closed in NRC Inspection Report 50-245/93-16. Based on the limited safety significance of this event, the corrective actions to date and the lack of signi6 cant new findings from recent inspections, this item is considered closed.

-.

,

-

.

.

.

_

_

_

9-I

6.3.4 Classification of Atmospheric Dump Valves - Unit 2 Unresolved Item 50-336/91-05-01 was established to determine whether the atmospheric dump calve (ADV) solenoid operated valves (SOVs) can be removed from the Environmental Qualification Master List (EQML). The licensee had determined that the operation of the SOVs had not been credited in the safety analyses and removed the SOVs from the EQML.

'

The Millstone Unit 2 Final Safety Analysis Report (FSAR) states that, "The atmospheric steam dump system consists of one automatically actuated dump valve for each steam generator which exhausts to the atmosphere. The total atmospheric dump system capacity is 15 percent of 2700 MWt." The ADVs utilize the SOVs to operate in a quick-open mode following a plant trip (at Tavg above 557 degrees F) to prevent the lifting of the main steam safety valves. Only the main steam safety valves are credited for over-pressure protection.

In addition, the ADVs operate in a pressure modulating mode to limit steam Ime pressure following a plant trip. The pressure modulating function of the ADVs, which does not require operation of the SOVs, is credited in the EOPs for post-trip heat removal.

The ADV SOVs are designed to fail in the closed position. Failure of the SOVs to operate l

would result in failure of the quick-opening function of the ADVs following a plant trip.

The resulting secondary pressure transient would be mitigated by the credited main steam safety valves. Spurious operation of the SOVs, which results in the opening of the ADVs during plant operation, would result in a steam generator water level transient. Although lifting of an ADV during plant operation resulted in a plant trip in early 1993, both fle NRC and the licensee concluded that the resulting transient should have been within the capability of the operators to prevent the plant trip. Thus, neither failure of the SOVs to operate, nor spurious SOV operation, would create a signincant safety risk.

The NRC's requirements for the environmental qualification (EQ) of electrical equipment are specified in 10 CFR 50.49. These requirements would result in the need for EQ of the SOVs if: (1) the SOVs were safety-related as defined in 10 CFR 50.49(b)(1)(credited for protection of the reactor coolant pressure boundary, required for safe shutdown, or mitigation of post-accidert releases); (2) the failure of the SOVs could prevent accomplishment of a

safety function; or (3) the SOVs were required for post-accident monitoring. Since the SOVs do not meet any of the above requirements, the SOVs are not required to meet the EQ criteria of 10 CFR 50.49 and need not be maintained in the EQML. This item is closed.

6.3.5 Procedural Changes Resulting from Design Changes - Unit 2

,

Unresolved Item 50-336/91-20-01 was established in order to review the licensee's plant design change process (PDCRs) with regard to procedural changes which result from PDCRs. Specifically, the licensee had added three pressure indicators to the emergency diesel generator air start system without incorporating these instruments in the relevant Instrument Calibration Procedure IC2434, " Diesel Generator Instrumentation."

U

-

_

,

,,,

. -. -

__

n

.

The inspector reviewed Revision 3 to Procedure IC2434 and confirmed that the instruments in question (PI-8833,33A and 34) had been incorporated in Procedure IC2434 together with suitable acceptance criteria. A more general question concerned how the licensee assures that all relevant procedures are modi 6ed when a PDCR is undertaken. De6ciencies concerning procedural changes resulting from PDCRs was also addressed as part of the NRC staff's Operation Safety Team inspection (OSTI) that was conducted during the restart of Unit 2 following the steam generator replacement outage. That issue was resolved as one of the OSTI concerns. This item is considered closed.

6.3.6 Fvent Classification - Unit 2 Unresolved Item 50-336/91-18-01 was initiated to review the licensee's remedial action in determining a definition of "significant transient." On July 26,1991, Unit 2 sustained a loss of all control room annunciators as a result of failure of redundant DC power supplies. The event was classified as an " Alert," in accordance with Plant Procedure EPIP 4701, with potential escalation to a " Site Area Emergency" should a "significant transient" occur.

During a subsequent inspection it was determined that the licensee had not defined the term

"significant transient" in Procedure EPIP 4701; thus, the criteria for event classification escalation were unde 6ned.

The inspector reviewed the licensee's definition of "signi6 cant transient" which has been incorporated in Attachment 8 to Procedure EPIP 4400 (revised Procedure EPIP 4701). For Unit 2, the licensee has defined "significant transient" as a transient where program values are "... moving away from normal program values beyond the ability of operators or control systems to correct." The following examples of "signi6 cant transients" are provided in Procedure EPIP 4400:

i Plant trip j

e RCS inventory decrease beyond the capability of normal makeup j

• Excess steam demand e Steam generator tube rupture

• Uncontrolled ramp or step change in power.

The inspector noted that the definition of "significant transient" includes a broad range of accidents and transients that are addressed in the Unit 2 Final Safety Analysis Report. The licensee's definition is also similar to guidance in NUM ARC /NESP-007, Revision 2,

" Methodology for Development of Emergency Action Levels," regarding the definition of

"signi6 cant transient." The inspector concluded that the licensee's definition of "signi6 cant transient" provides adequate guidance for escalation of event classification concerning loss of control room annunciators, and is acceptable.

'

-

___

-

p:

'O

In the course of reviewing the licensee's remedial action to address this concern, the inspector identified an incorrect reference in Procedure OP 2387A, " Annunciator System."

Section 5.3 of the subject procedure refers the user to Procedure EPIP 4701 upon loss of control room annunciators during any transient or for more than 15 minutes. The correct reference is new Procedure EPIP 4400. The licensee was informed of the incorrect reference

'

'

and promptly resolved the error by changing Procedure OP 2387A. The inspector had no further questions.

,

Based upon the above, this item is closed.

'

'

6.3.7 Work Outside Job Scope - Unit 3

,

These items (Violation 50-423/91-16-01 and Unresolved item 50-423/91-22-01) involved

,

work performed outside of the approved work scope and the adequacy of work package

!

guidance. In March 1991, power operated relief valve (PORV) 3RCS*PCV455A was rendered inoperable for a three month period because an electrician incorrectly removed the

,

PORV control switch from the control board instead of the arm block switch specified in the j

work scope. Although the electrician discovered his error and reinstalled the switch, he did l

not restore the circuit completely. Because the work scope was not modified, the system

{'

retests were inadequate to detect the electrician's error. In October 1991, mechanics working on the 'C' service water pump discharge strainer removed and replaced defective packing gland studs and nuts which were not included as part of the job scope. When informed of their mistake by the inspector, the mechanics stopped the work activity and modified the existing work order to include the increased job scope.

Licensee corrective actions for these events included: reorienting the PORV switch, retesting the applicable components for proper operation, counseling the individuals involved, and

>

incorporating the PORV event into departmental training. The examples were discussed in i

maintenance, instrument and controls, and support groups by department supervision to ensure that job supervisors understand the expectation of management to stop and expand the

authorized work scope when a mistake is made. These discussions were led by department

.

supervisors so that the events were related to the type of work performed by each group.

l The inspector reviewed the memos from the various departments documenting the completion of these discussions, and questioned various licensee personnel to ensure they understand the required actions to be taken when work is performed outside the specified job scope. The inspector concluded that the licensee's corrective actions were adequate. This item is closed.

,

!

,

t W

h

.. _. _ _,. ~.

.

.

.

6.3.8 Failure to Control PASS Cooler Isolation Valves - Unit 3 Violation 423/92-04-06: Post accident sample system (PASS) cooler isolation valves had not been repositioned as required by modi 6 cation package instructions. The inspectors reviewed the licensce's response, dated April 16,1992, which detailed the cause of the program failure / procedure dc6ciency that led to this violation. As corrective action, OPS Form 3326-15 was revised to indicate the correct position of the isolation valves in question. The inspectors confirmed that this procedure change was implemented and inspected the position of the valves ir. the field. To ensure valve lineups are proper:y implemented in the future, the licensee implemented a change to Operations Department instruction (ODI) 3-OPS-3.08,

" Control of Changes to PORC-Approved Procedures and Farms." The instruction includes guidance that any change to a procedure or form that requires action by Operations subsequent to PORC approval, such as valve lineups or a new policy, will have a form notifying the shift supervisor of the requisite action; however, discussions with Operations personnel indicated that this form has not been frequently employed. Most changes are

,

initiated by the engineering turnover memo to Operatiors (as part of the modification process), in accordance with Procedure ACP-QA-3.10. " Plant Design Change Records."

j This memo requires changes to affected drawings and procedures, and conveys valve lineup

or design changes. A review of several recent modiGettion turnover memos indicated that

'

drawings and procedures requiring revision were comtrunicated to Operations and changed as requested. This item is considered closed; NRC folhw-up of the correct closecut of modifications was also discussed in NRC Inspection Rep,rt 50-336/92-36.

6.3.9 Enclosure lluilding Integrity Ilreach - Unit 3 This item (Violation 50-423/92-13-04) involved the supplems ntary leak collection and release system (SLCRS) being inoperable due to an unplanned and uncompensated containment I

building breach when lagging was removed as part of the secondary crosion/ corrosion inspections. The licensee determined that the cause of the event was inadequate work planning. The event revealed that the plant engineer in charge of the job marked the section of lagging to be removed during a pre-job walkdown with contractor personnel and informed them to remove enough lagging as necessary so that sufficient inspection of potentially damaged piping could be performed. The engineer did not speci6cally identify the secondary enclosure boundary material (which is similar to lagging material) to the workers nor was the boundary labeled and identified as a SLCRS boundary.

The licensees corrective action to the event included scaling the boundary breach and walking down other work locations to verify that no other boundary breaches existed. As action to prevent recurrence, the licensec performed walkdowns of similar SLCRS boundaries and identified locations where seal material could be mistaken for lagging. These locations are scheduled to be marked during the current refueling outage to indicate that they are SLCRS boundaries and that prior control room authorization is required prior to removal. The event was also discussed in department training to stress the importance of specifying job responsibihties for work activities, the need for clear communications, and to ensure that the i

_

v

,

roles of individuals are fully understood. In addition, the Unit 3 engineering department training procedure, EN 31051, was revised to require that engineers receive training on the job leader's contribution to effective work practices prior to being assigned as job leaders.

The inspector verified that the SLCRS boundaries have been walk.ed down and tags were available for installation during the week ending October 1,1993; that departmental training has been completed; and that Procedure EN 31051 has been revised to require training of plant engineers prior to being assigned as job leaders. The inspector concluded that the licensee is taking adequate corrective steps to address this violation. Therefore this item is closed.

7.0 M ANAGEMENT MEETINGS

'

l Periodic meetings were held with various managers to discuss the inspection Gndings during

'

the inspection period. Following the inspection, an exit meeting was held on October 4,1993, to discuss the inspection Gndings and observations with station management.

Licensee comments concerning the issues in this report were documented in the applicable report section. No proprietary information was covered within the scope of the inspection.

No written material regarding the inspection findings was given to the licensee during the inspection.

l