Text

Insp Repts 50-245/93-24,50-336/93-19 & 50-423/93-20 on 930818-0928.Violations Noted.Major Areas Inspected:Plant Operations During Periods of Backshifts & Deep Backshifts
	ML20058D364
Person / Time
Site:	Millstone
Issue date:	11/18/1993
From:	Doerflein L; NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:	;
Shared Package
ML20058D316	List: IR 05000245/1993024; ML20058D311; ML20058D337;
References
	50-245-93-24, 50-336-93-19, 50-423-93-20, NUDOCS 9312030139
	Download: ML20058D364 (50)
	v • d • e

-

,

.

l

)

'

.

U.S. NUCLEAR REGULATORY COMMISSION

REGION I

Docket Nos.:

50-245 50-336 50-423 Report Nos.:

93-24 93-19 93-20 License Nos.:

DPR-21 DPR-65 NPF-49 Licensee:

Northeast Nuclear Energy Company P. O. Box 270 Hartford, CT 06141-0270 Facility:

Millstone Nuclear Power Station, Units 1,2, and 3 Inspection at:

Waterford, CT Dates:

August 18,1993 - September 28,1993 Inspectors:

P. D. Swetland, Senior Resident Inspector K. S. Kolaczyk, Resident Inspector, Unit 1 D. A. Dempsey, Resident Inspector, Unit 2 R. J. Arrighi, Resident Inspector, Unit 3 J. Carrasco, Reactor Engineer, NRC Region I L. Kay, Reactor Engineer, NRC Region I H. Kaplan, Reactor Engineer, NRC Region I P. Habighorst, Resi (4nspector,3Haddam Neck Approved by:

C$ohe k th ll!ig 93 s

lawrence T. Doerflein, Chief

Ddte '

Reactor Projects Section No. 4A,

Scope: NRC resident inspection of core activities in the areas of plant operations, maintenance, surveillance, security, outage activities, licensee self-assessment, and periodic reports.

The inspectors reviewed plant operations during periods of backshifts (evening shifts) and deep backshifts (weekends, holidays, and midnight shifts). Coverage was provided for 162 hours0.00188 days 0.045 hours 2.678571e-4 weeks 6.1641e-5 months during evening backshifts and 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months during deep backshifts.

Results: See Executive Summary 9312030139 933122 PDR ADDCK 05000245 G

PDR,

!

l-

.

l i

.

[ -

EXECUTIVE SUMMARY Millstone Nuclear Power Station Combined Inspection 245/93-24; 336/93-19; 423/93-20

,

l l

Plant Operations Unit 1 operated safely at full power for essentially the entire inspection period. Short power reductions were accomplished for scheduled maintenance and testing.

Unit 2 began the inspection period at full power. On September 14, the plant was shutdown due to problems with feedwater isolation valves and a leaking switchgear room cooler.

During the shutdown, other problems with auxiliary feedwater (AFW) piping were identified and corrected. The plant remained shutdown at the end of the period pending completion of the feedwater isolation valve repairs. A weakness was identified involving the lack of testing

to address the back-up use of the fire system as a water supply for the AFW system. This

!

remained unresolved at the end of the inspection.

Unit 3 remained shutdown for refueling during this inspection period. A violation of containment closure procedures during fuel movement was not cited due to prompt licensee identification of the problem and superior corrective actions. The refueling outage was extended due to urexpected problems with steam generator feed water nozzle cracking and reactor coolant pump (RCP) turning vane bolts.

l I

Maintenance Plant maintenance and testing activities were generally well implemented at each unit during this inspection. Unit 2 identified a failure to follow a calibration test procedure for a radiation monitor. This violation was cited because of continuing problems in this area and the licensee's inadequate corrective action in response to their findings. Unit 2 also identified that inservice inspection had never been conducted on some pipe supports in the auxiliary feedwater system. This violation was cited because the problem had existed for years despite several required reviews of pipe support adequacy during that period. The inspector determined that the status of equipment needed to shutdown Unit I following a i

severe fire was not tested and maintained in a manner commensurate with its importance to safety. This concern remained unresolved pending licensee corrective action planned for the next refueling outage.

Engineering The licensee conducted generally strong engineering and technical evaluations of identified i

problems regarding RCP turning vane bolts at Unit 3 and electric brakes on motor-operated valves at Unit 1. Unresolved issues remained open for the final disposition of brake performance for Unit 1 Teledyne motor-operators, the cause of Unit 3 RCP turning vane bolt i

failure, and the extent of undocumented modifications during maintenance at Unit 2. In i

ii

!

l

[

!

-

.

,

'

i l

Executive Summary addition, open items remained to follow the formalization of quality assurance requirements for station black-out equipment, the appropriateness of enhanced monitoring of Rosemount

transmitters which are only periodically under high pressure conditions, and the licensee's reassessment of high energy line break potential for Unit 2.

Safety Assessment The inspectors observed inconsistent safety assessment performance dming this inspection.

Several concerns were promptly identified and well corrected, including the Unit 3 containment closure issue and a Unit I service water branch line which was not seismically

!

mounted nor isolated during operation. However, the violations cited for Unit 2 indicated l

inadequate investigation and correction of instrumentation problems, and inservice inspection l

discrepancies which had existed for a prolonged period.

l l

i j

iii

_

l

-

.

!

SUMMARY OF FACILITY ACTIVITIES Millstone Unit 1 operated at 100% of rated thermal power for the majority of the report period. Minor power reductions were periodically accomplished to facilitate plugging of leaking condenser tubes and to test the main steam isolation and turbine stop valves. During this report period, NRC administered operator license requalification examinations were given to three operating crews. Preliminary NRC and licensee training center results indicate that all personnel successfully completed the requalification examinations.

Millstone Unit 2 was operating at full power at the beginning of the inspection period. On September 14, at 7:45 p.m., a plant shutdown was started when the licensee entered the technical specification action statements for the main steam isolation (MSI) system and for safety-related switchgear due to equipment vulnerabilities in automatic feedwater isolation valves, and service water leakage in a switchgear room heat exchanger, respectively. The plant was shutdown to Mode 3 (Hot Standby) and feedwater isolation valves were shut at 1:20 a.m. on September 15, satisfying the limiting condition for operation (LCO) for the MSI system. At 7:20 p.m. that day, the switchgear room heat exchanger was restored and the associated LCO was met. On September 16, the licensee determined that inservice inspection program requirements had never been implemented for piping between the auxiliary feedwater pumps and the condensate storage tank. Subsequently, on September 17, the auxiliary feedwater system was declared inoperable and the plant was cooled down to Mode 4 (Hot Shutdown). The unit was maintained in hot shutdown for the remainder of the inspection period.

Millstone Unit 3 was in mode 5 (cold shutdown) for a refueling outage at the start of the inspection period. Mode 6 (refueling) was entered on August 18 and cavity fill was completed on August 19. A complete core off-load was completed on August 26. Core reload resumed on September 3 upon completion of the inspection of the lower core support plate and plenum and retrieval of the debris found. Rufueling activities were completed on September 11. Cavity drain down and head bolt tensioning (Mode 5) were completed on September 15. The licensee extended the outage by 21 days to perform steam generator feed water nozzle repairs and to allow disassembly, inspection, and change out of reactor coolant pumps.

2.0 PLANT OPERATIONS (IP 71707,93702)

2.1 Operational Safety Verification (All Units)

The inspectors performed selective inspections of control room activities, operability of engineered safety features systems, plant equipment conditions, and problem identification systems. These reviews included attendance at periodic plant meetings and plant tour.

.

The inspectors made frequent tours of the control room to verify sufficient staffing, operator procedural adherence, operator cognizance of equipment and control room alarm status, conformance with technical specifications, and maintenance of control room logs. The inspectors observed control room operators response to alarms and off-normal conditions.

The inspectors verified safety system operability through independent reviews of: system configuration, outstanding trouble reports and incident reports, and surveillance test results.

During system walkdowns, the inspectors made note of equipment condition, tagging, and the existence of installed jumpers, bypasses, and lifted leads.

The accessible portions of plant areas were toured on a regular basis. The inspectors observed plant housekeeping conditions, general equipment conditions, and fire prevention practices. The inspectors also verified proper posting of contaminated, airborne, and radiation areas with respect to boundary identification and locking requirements. Selected aspects of security plan implementation were observed including site access controls, l

integrity of security barriers, implementation of compensatory measures, and guard force response to alarms and degraded conditions.

The inspectors determined these opentional activities were adequately implemented. Specific observations are discussed in Sectim 2.2 to 2.7 below.

2.2 Seismic Qualification of Auxiliary Feedwater System Branch Line - Unit 2 On August 28,1993, with the plant operating at full power, operators recognized that a temporary fill connection had been installed in place of a normal bonnet on primary makeup water system check valve 2-CMW-2. The temporary rig consisted of a circular, flame cut

,

piece of one-inch steel plate, in the center of which was fillet welded a two-inch mechanical pipe connection. A "T"-shaped branch line terminated by two brass gate valves was threaded into the connection. The assembly was mounted on the valve body with the permanent studs.

Valve 2-CMW-2 is located in a three-inch branch line connected to the eight-inch condensate storage tank supply header (one of two separate headers) to the motor-driven auxiliary feedwater (AFW) pumps. The licensee documented the discovery in a plant information report (PIR) to determine when the rig had been installed and to evaluate its effect on AFW system operability. Manual isolation valves upstream of valve 2-CMW-2 were verified shut and danger tagged, and operators cycled manual isolation valves on the eight-inch suction header to verify the ability to isolate the line from the condensate storage tank (CST).

The safety function of the AFW system is to provide makeup water to the steam generators for removal of sensible and decay heat from the reactor coolant system if the normal condensate and feed system is inoperable. It also is used during normal plant startup and shutdown when the steam generator feed pumps are unavailable. The system includes two 50% capacity motor-driven pumps and one 100% capacity turbine-driven pump, supplied, respectively, from the CST by an eight-inch and a ten-inch supply header. The motor-driven and turbine-driven pump suctions can be cross-connected by a normally-closed manual

-

.

isolation valve. Final Safety Analysis Report Table 1.4-1 identifies the AFW system as seismic Class 1. Technical specification (TS) 3.7.1.2, applicable in operating modes 1,2,

and 3, requires all three AFW pumps to be operable. However, operation may continue up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months with one pump inoperable.

On August 31, at the request of plant personnel, corporate engineering walked down the branch line including valve 2-CMW-2, and evaluated its conformance with design documents and seismic requirements. Based on satisfying ANSI Code requirements for dead weight and pressure stresses, and the apparent rigidity of the valve, the licensee judged valve 2-CMW-2 to meet seismic requirements. However, the engineers determined preliminarily that the line originally had not been designed, and was not, seismically qualified. In addition, the line was not included in the licensee's ASME Code Section XI Inservice Inspection (ISI)

program. The licensee then focused its efforts on restoring the valve and determining the origin of the valve modification. At this time, the licensee appeared not to have considered the effect of the lack of seismic qualification of the branch line on the operability of AFW system.

On September 3, corporate engineering notified the plant that the lack of seismicity of the branch line, was an operability concern, but expressed confidence that the issue could be resolved through a system integrity evaluation. Licensee management then refocused efforts toward providing an opembility justification for the branch line, restoring the valve, exploring alternate methods of supporting the three-inch pipe in the short term, and developing a permanent solution to the problem. The inspector discus ed system operability with the licensee and was informed that a catastrophic failure of the three-inch line in a seismic event was not considered to be credible. The licensee based this judgement on its verification that the pipe supports complied with original design standards (ANSI Code B31.1), and industry experience contained in the Seismic Qualification Utility Group (SQUG)

data ' ase, with similarly supported piping systems. The inspector found the licensee's o

qualitative, non-analytical approach to system operability to be questionable and initiated a conference call with NRC Region I and Headquarters management and staff for the licensee to present its evaluation. The licensee established a parallel-path approach to the problem by continuing to justify the operability determination while preparing to implement a design change to disconnect the line from the eight-inch header. The licensee also issued an Operations Department night order which instructed the operators to isolate the eight-inch header and enter the 72-hour action statement of TS 3.7.1.2. While isolated, all three AFW pumps would be aligned to the CST through the ten-inch suction line, but, due to flow limits associated with net positive suction head requirements, the turbine-driven AFW pump would be considered inoperable (but available).

The inspector verified that licensee operators were familiar with the contents of the night order, and that preparations were being made to isolate and tag out the eight-inch header.

IIowever, the shift supervisor did not know why the header was being isolated, and was unaware that system operability was being evaluated. The inspector concluded that the

-

- --

.

-

.

i

1 purpose of and priority for the tagout had not been communicated effectively by licensee

,

!

management to the operating shift. Notwithstanding this, the header was isolated and the TS l

action statement was entered at 9:32 p.m. on September 3.

On September 4, at 9:00 a.m., the license presented its operability determination to NRC Region I and Headquarters management and technical staff, and discussed plans to cut and cap the branch line. The NRC informed the licensee that its position regarding header operability was unacceptable for the following reasons:

No nondestructive examinations of the three-inch pipe welds had been performed.

No data was presented matching the plant configuration to the SQUG data base.

No analyses were performed to compare system stresses with ANSI B31.1. allowables

(The licensee stated that ANSI allowables would be greatly exceeded, since existing supports could not be credited).

,

'

No analysis was performed using the methodology in Section III, Appendix F of the

ASME Code, as recommended in NRC Generic Ixtter 91-18.

.

Following the discussion, the licensee wrote another PIR regarding the seismic qualification of the AFW header and initiated a reportability evaluation. At 4:02 p.m., the licensee

-

notified the NRC of the event in accordance with 10 CFR 50.72. The inspector attended a subsequent meeting of the Plant Operations Review Committee during which plant design l

change record (PDCR) 2-27-93 to cap this line was discussed and approved. Four procedure changes eliminating reference to the CMW makeup line were also approved, including a change to the emergency operating procedure (EOP) for reactor trip recovery. The inspector reviewed the safety evaluation for the EOP change, and the licensee's work implementation

,

and contingency plans for the modification, and had no further questions. At 6:00 p.m. on l

September 5, following implementation of the modification and successful completion of a hydrostatic test of the pipe cap, the licensee declared the AFW system operable. The licensee intends to modify and utilize the three inch PMW line as a water source for maintenance activities. The generic impact of undocumented modifications, similar to the one on valve 2-CMW-2, is discussed in Section 3.5 of this report.

i The licensee attributed the unqualified branch line to a design error during plant construction and noted that the pipe qualification class boundary had not been identified properly on system drawings. The error was compounded by the licensee's failure to incorporate the pipe into the ISI program. NRC Generic letter 81-14, " Seismic Qualification of the Auxiliary Feedwater Systems," dated February 10, 1981, required licensees to identify the extent to which AFW systems were seismically qualified, and to walk down non-seismically qualified ponions of the system to identify apparent and practically correctable deficiencies.

The effort was to include all branch lines up to and including the second normally closed isolation valve and any portion of branch piping structurally coupled to the system boundary.

In its response to the generic letter dated June 4,1982, the licensee stated that all branch piping connected to the system had been accounted for during a seismic analysis. The inspector concluded that the drawing error may have contributed to the incorrect statement.

-

l-

,

.

,

i f

To prevent recurrence, the licensee reviewed the seismic qualification of the remaining AFW system piping. Walkdowns also were conducted of other systems to verify the accuracy of r

ISI boundary drawings. The results of these reviews are documented in Section 2.3 of this report.

l The inspector assessed the licensee's activities based on the operability guidelines contained

'

in NRC Generic Letter 91-18, "Information to Licensees Regarding Two NRC Inspection l

Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability." An operability determination must be made promptly, commensurate with the l

potential safety significance of the system being evaluated. The allowed outage time permitted by TS provide a reasonable guide to safety significance. An initial determination l

l of operability must be based on a reasonable expectation that the prompt determination process will be validated; otherwise the system should be declared inoperable. The NRC expects that, in most cases, an initial operability decision can be made within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of discovering a nonconforming or degraded condition. Where an event could cause the loss of function of a system needed to mitigate the effects of that event, the system must be declared inoperable. Regarding pipe supports, licensees may use the criteria in Section III, Appendix F of the ASME Code to justify operability.

l The inspector noted that the AFW system is designed to provide makeup to the steam generators after a complete loss of offsite power, which could occur following a seismic event. The licensee continued to consider the eight-inch AFW suction header operable three days after determining that the branch line was not seismically supported or qualified. The licensee was aware that a quantitative analysis of the branch line would result in exceeding Code stress allowables and sought to justify operability through a qualitative assessment based solely on engineering judgement. The inspector concluded that the amount of time taken by the licensee to arrive at its operability determination exceeded the 72-hour action statement guideline for the AFW system and that the licensee's preliminary justification of operability had been inadequate because it was not reasonable to assume that a rigorous, analytical seismic evaluation of the system would corroborate the preliminary determination.

i As corrective action, the Millstone Station Vice President issued a memorandum to all three units establishing the expectation that initial operability detc.rminations be completed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months upon identifying degraded or nonconforming conditions. In addition, for potential operability issues identified at the corporate engineering offices, the affected unit is to be notified immediately to assure issuance of a plant information report. Training also was provided to unit department heads and selected supervisors regarding the contents of Generic Letter 91-18. The inspector concluded that these corrective actions appropriately addressed the concern regarding timeliness of operability determinations.

As noted above, the licensee cut and capped the branch line. The licensee also walked down the AFW system to verify no other non-qualified lines existed, and committed to update their GL 81-14 submittal. On October 1,1993, the licensee submitted licensee event report (LER)

50-336/93-022, which stated that the AFW system may not have been capable of performing its decay heat removal function following an earthquake, due to the attached non seismic j

-

.

-

.

branch line. The LER stated generally that operator action could be taken to isolate the 8-inch suction header, but did not quantify the expected loss of AFW make up inventory.

Also, the licensee did not specify their assessment of the likelihood of seismic failure of this branch line. The inspector concluded that sufficient information was not provided to determine that the AFW system had been operable with regard to its safe shutdown function following an earthquake. The Site Vice President committed to reevaluate AFW system operability during prior plant operation and revise the LER to address this issue and provide a more detailed basis for concluding that the system had been capable of performing its

function. That revision will be submitted within sixty days. This issue remains unresolved I

pending NRC review of the licensee's submittal. (50-336/93-19-11).

2.3 Auxiliary Feedwater System Suction Piping Operability - Unit 2 As a result of finding in early September 1993 a non-seismically qualified branch line connected to an auxiliary feedwater (AFW) pump suction header, the licensee performed a review of its ASME Code Section XI Inservice Inspection (ISI) program. On September 10, with the plant operating at full power, the licensee determined that the AFW pump suction pipe supports were not included in the ISI program plan. A plant information report (PIR)

was generated to investigate whether the supports were required to be in the program. On September 13, an additional PIR and a reportability/ operability evaluation form (REF) were initiated to resolve other potential AFW system operability concerns identified by the NRC in a conference call with the licensee on September 4, including:

Seismic qualification of the condensate storage tank (CST) pipe trench.

e

'

o Potential for interaction between seismic and non-seismic piping in the trench and turbine buildings (Seismic II over I).

Qualification of piping from the CST to the AFW pumps.

e

High energy line break (HELB) protection of turbine building AFW piping.

i The inspector reviewed the licensee's basis for continued operation pending resolution of the concerns, documented in memorandum MCE-SA-93-326, dated September 14,1993. The inspector found the bases for the Seismic II over I and HELB to be inadequate and communicated this concern to licensee management, who agreed that more detailed followup was warranted.

On September 14, the unit was shutdown to Mode 3 (Hot Standby) when four main feedwater isolation valves were declared inoperable. On September 16, at 12:00 p.m., the licensee concluded that the AFW suction pipe supports between the CST and the pumps had been omitted from the ISI program and that the first 10-year interval examinations had not been performed. The 24-hour action statement of Technical Specification 4.0.3 was entered and inspections of the 49 suspect supports were initiated. On September 17, the inspector attended the licensee morning meeting at which AFW system technical specification operability requirements, which are applicable in Modes 1, 2, and 3, as well as, the safety implications of transitioning the plant to Mode 4 (Hot Shutdown) with the AFW system

__

~

.

,

-

\\

inoperable were discussed. During the discussions the licensee noted that TS 3.7.1.3.b (CST inoperable) permitted operation for seven days with AFW pumps supplied by the fire water l

system, provided the operability of the fire water system was demonstrated. The licensee I

was not aware of any tests having been performed to verify the flow capacity of the fire main. Licensee follow-up on this issue will be tracked by NRC as an unmsolved item (UNR i

50-336/93-19-001). At 9:29 a.m. the licensee concluded that it could not complete the i

support inspections within the allowed outage time, and initiated a plant cooldown to Mode 4. Though inoperable, all three AFW pumps remained available for makeup to the steam generators. The inspector also noted that a steam generator level greater than 44% provided sufficient inventory to place the plant in cold shutdown with no feedwater addition. The inspector verified that both steam generator levels were greater than 65%.

From September 16 to 29, the licensee performed inspections of the 49 supports added to the ISI program. Operability evaluations were based on calculations and drawings developed by the licensee in response to NRC Bulletins 79-02 and 79-14 regarding seismic qualification of safety-related pipe supports. The Bulletins require licensees to demonstrate the capability of pipe supports to withstand safe shutdown earthquake stresses with a safety factor greater than 4.0. Plant operation may continue with a safety factor between 2.0 and 4.0 provided accessible supports are restored to full qualification expeditiously. Most of the discrepancies identified by the licensee involved minor items such as addition of shims, adjustment of spring cans, verification of anchor bolt torque values, and replacement of corroded parts.

The inspector confirmed these results through direct examination in the field and review of design documents. During the reviews the licensee found that the calculations for three ganged supports had not considered the added loading for adjacent nonsafety-related pipes.

.

Two of the ganged supports required modification to restore the required safety factor of 4.0.

The licensee walked down two other safety-related pipe trenches and confirmed that the error was limited to the CST trench. The inspector walked down portions of other safety-related piping systems in the enclosure and auxiliary buildings and found no discrepancies. In summary, the licensee found no pipe supports with a safety factor of less and 2.0, ard concluded that the AFW system had not been rendered inoperable by the support discrepancies.

l While examining the CST trench, the inspector noted that many supports had been considerably corroded. The licensee attributed this condition to prolonged submersion of the

,

hangers due to a failed sump pump. The condition was exacerbated by the presence of minor auxiliary steamline leaks which caused local boiling of the drainage in the trench. The inspector verified that the licensee was now exerting a reasonable effort to replace the pump, and that a temporary pump was installed in the trench. In addition, the inspector noted that the licensee initiated a major effort to clean and coat the supports and to replace damaged pipe heat tracing. The inspector had no further concerns regarding the current condition of j

AFW piping in the CST trench. However, the prior inattention to environmental conditions

'

and sump pump failures was noted as a management oversight weakness.

.

-

.

e

The inspector reviewed the licensee's resolution to the remaining REF operability concerns, documented in memorandum MCE-SA-93-355, dated October 1,1993. The CST trench was verified to be seismically qualified through calculation, and nonsafety-related piping in the trench was bound to be restrained adequately to prevent seismic interaction with adjacent AFW piping. The licensee walked down the turbine building and identified no seismic II over I concerns, as nonsafety-related piping in the vicinity of the AFW system was seismically restrained. The inspector confirmed these results through independent observations. Regarding HELB concerns, however, the licensee was not able to determine if piping in the CST trench had been included in the original HELB design reviews for the unit.

The inspector also noted that a licensee mini-review performed in 1990 left unanswered several issues for the turbine building. This matter is unresolved pending NRC review of the licensee's HELB program for Unit 2. (UNR 50-336/93-19-002)

The licensee completed its review of the Unit 2 ISI program on September 20. The inspector reviewed the results documented in memorandum CST-93-339. The review consisted of a comparison of operations critical piping and instrumentation diagrams, ISI boundary diagrams and isometric drawings, and ASME Code requirements. The licensee found missing and added to the program several main steam welds associated with the steam generator atmospheric dump valves, and identified 17 minor drawing errors. No additional inspections were required to be performed. The inspector concluded that the review was acceptable.

The inspector reviewed the licensee's response to NRC Generic 12tter 81-14, " Seismic Qualification of Auxiliary Feedwater Systems," dated February 10, 1981. The letter required licensees to specify whether the AFW system was designed, constructed, and maintained (and included within the scope of seismic related NRC Bulletins 79-02,29-04, 79-07,79-14, and 80-11) in accordance with Seismic Category I requirements to withstand a safe shutdown earthquake. In letters dated July 24,1981 and June 4,1982, the licensee stated that the AFW system had been reanalyzed and that all piping had been found by walkdown to be supported in compliance with original design seismic specifications. The letters were the basis for an NRC Safety Evaluation Report dated September 17,1982, which noted that 35 supports had been modified and that eight remaining support modifications were scheduled for completion by the end of the 1981 refueling outage. The inspector requested the licensee to verify that the eight support modifications had been completed as described. The licensee was unable to identify the supports involved, but responded that they were included in the current inspection effort, and that no inoperable hangers had been identified. The inspector noted the licensee's intention to supplement its response to the NRC and had no further questions regarding the Generic Ixtter pending NRC licensing review.

TS 4.0.5 requires the licensee to establish and implement an ISI program in accordance with 10 CFR 50.55a(g) and Section XI of the ASME code. During development of the ISI plan for the first ten-year interval, the licensee inadvertently omitted the AFW pump suction pipe supports from the component inspection list. This error then was carried over into the

-

.

present ten-year interval plan. The inspector noted that the licensee took six days (during four of which the plant operated at full power) to determine the applicability of the ASME Code ISI requirements, and concluded that the determination was not timely. Licensee corrective actions regarding timeliness are covered in Section 2.2 of this report.

The licensee's failure to include AFW system pipe supports in itsSection XI ISI program was a violation of Technical Specification 4.0.5. The inspector noted that the condition was identified by the licensee and that major effort was expended to complete the inspections and correct the nonconforming conditions revealed by the support examinations. The inspector also acknowledged licensee performance of an independent ISI program review. Since all of the supports were found to have been operable, the significance of the nonconformances was minor. However, notwithstanding the successful outcome of the evaluations, the inspector considered that the omission of AFW supports from the ISI program since initial plant operation had placed into question the long term reliability of this safety-significant system.

In addition, the error persisted despite the prior notice provided by several NRC Bulletins and a Generic Letter which specifically addressed seismic qualification programs for safety system pipe supports. The violation therefore will be cited (VIO 50-336/93-19-003).

2.4 Inoperable Feedwater System Isolation Valves - Unit 2 On September 13, 1993, the Unit 2 Inservice Test Coordinator became aware through review of an industry experience report of an event at Crystal River Nuclear Power Station involving problems with motor-operated valve actuators equipped with electric brakes.

Subsequently, through testing, the licensee concluded that the actuator motor brakes on feedwater isolation valves 2-FW-38A and B and 2-FW-42A and B may not disengage under worst case undervoltage conditions, preventing the valves from closing fully. Closure of the valves is credited in the Unit 2 main steam line break accident analysis to maintain the containment building less than the design pressure of 34 psig. On September 14, at 7:45 p.m., having declared both trains of the main steam isolation system inoperable and entered the action statement of Technical Specification 3.0.3., the licensee commenced a plant shutdown from full power. Pursuant to its emergency plan implementing procedures, the licensee declared an Unusual Event and notified the NRC in accordance with 10 CFR 50.72.

At 1:20 a.m. on September 15, with the plant in Mode 3 (Hot Standby), the feedwater i

isolation valves were closed and the Unusual Event was terminated.

The feedwater isolation valves are 18-inch Chapman-Crane Type L-900 gate valves equipped with Limitorque Type SMB-4T actuators. The actuators are unusual in that conversion of motor torque to valve thrust takes place in the stem (yoke) nut which transfers the load through the yoke to the valve. The short (10.0 seconds) valve stroke time generates large inertial thrust loads. The valves were set up to operate on the limit switch with the torque switch bypassed for the majority of valve stem travel. During the 1992 refueling outage, the nonsafety-related valves were modified to close on a main steam isolation engineered safety features signal; and in February 1993 the valves were added to the licensee's motor operated valve (NRC Generic Letter 89-10) program.

i

'

.

,

-

,

Resolution of several technical problems associated with removal of the actuator brakes took i

place from September 16 to October 10. Inspection activities included field observations of valve maintenance and diagnostic tests; review of plant design change records (PDCRs),

automated work orders, nonconformance reports, and safety evaluations; attendance at licensee management and plant operations review committee (PORC) meetings; and

'

participation in several telephone conferences between the licensee and NRC Region I and Headquarters staffs.

The licensee removed the actuator brakes on September 16 under PDCR 2-29-93, Revision 0. At the PORC meeting during which the PDCR was approved, the licensee identified two technical concerns to be resolved by testing: (a) that inertial overshoot of the valve disc into the seat may generate excessive thrust (overthrust), and (b) that the valve not drift open under dynamic conditions. The latter concern derived from the fact that the actuator did not have a self-locking gear set. During static tests performed on September 17, the valves i

overthrusted and nonconformance reports were initiated. Linear indications were discovered during liquid penetrant examinations of three valve stem nuts, and the fourth, on valve 2-FW-42A, was broken when the valve position limit switch failed to deenergize the motor operator prior to seat contact. On September 18, the licensee made a 10 CFR 50.72 notification to the NRC that the isolation valves had been set to thrust values in excess of the maximum structural limits (allowables). The licensee also identified errors in the valve vendor weak link analysis which, when corrected, lowered the stem nut allowable thrust limit from approximately 200,000 psi to 109,000 psi.

i On September 21, the PORC approved a change to the PDCR to modify the valve limit switch settings. Based on valve flow characteristics provided by the vendor, the licensee calculated a leakage rate of 167 gallons per minute (gpm) with the valve 10 percent (%)

open. Accounting for the published limit switch accuracy of plus or minus three percent, the licensee chose to set the switches to deenergize the actuator at the seven percent (10% - 3%)

'

open position. By changing the volumetric expansion multiplier user input to the main steam line break analysis computer code, the licensee was able to show that the 54 psig containment pressure limit was maintained with the assumed 167 gpm valve leakage. The PORC also approved a design change which eliminated a stress riser between the barrel and flange sections of the stem nuts, thus restoring the original thrust capability. Following the PORC meeting, the inspector questioned the licensee regarding the potential for overthrust if the limit switch tripped at the 4% open position (setting of 7%, -3% accuracy). The licensee determined that this condition would overthrust the valves. Also, the licensee determined that leakage through the isolation valves of both feedwater trains (334 gpm) would have to be considered. This latter problem was resolved by another computer code input change which eliminated a conservative assumption involving steam generator heat transfer coefficients.

A meeting among the unit and corporate engineering staffs was held on September 22 to examine these problems and to consider replacing the existing actuators with Limitorque Type SB-4 actuators. On September 26, while evaluating the structural compatibility of the valve yokes with SB-4 actuators, the licensee determined that the vendor weak link analysis

_ _

_ _ _ _ _ _ _ _ _ _ - - _

_

..

,

.

I

i l

had overpredicted the thrust allowables for the yokes, and that the yokes also had been I

subjected to excessive thrust. Based on this finding, the licensee initiated operability determinations for suspect valves at all four ofits nuclear units. Unit 2 visually inspected the yokes, found no damage or deformities, and implemented a modification which stiffened

'

the valve yokes. NRC review of the licensee's analysis of the structural capabilities of the yokes is documented in Section 4.2 of this report.

The licensee ultimately achieved operation of the valves within thrust limits with the limit switches set at the 5.5% to 6.0% open position. This was accomplished, in part, by reducing the published accuracy limits of the switches to plus or minus 0.5%. The reduction was justified by limited testing of the switches and statistical analysis. In discussions with the NRC staff, the licensee committed to verify the repeatability of the limit switches by testing during the next outage of sufficient duration. The inspector reviewed the diagnostic test data for the valves and verified operation within the thrust allowables. On October 10, the inspector witnessed the test which demonstrated that the valves would not drift open under design line pressure conditions. Following the test, the licensee declared the valves operable. The inspector had no further questions regarding the valve modifications.

Assessment The identification and prompt confirmation of the problem with the valve actuator electric

-

brake demonstrated good attention to industry experience and a conservative approach to potential safety issues on the part of the plant engineering staff. However, the inspector found that the licensee had identified in a June 1992 independent assessment that the motor-operated valve program did not include evaluation of motor brake coil operability in undervoltage conditions. This item was added to the program manual in December 1992.

The feedwater isolation valves formally were added to the program in February 1993.

Information from field walkdowns indicating the existence of the brakes was available to the licensee, but was not reflected in the electrical drawings. As a result, an opportunity for earlier identification of the problem was missed. The licensee received the valve vendor's weak link analysis in May 1993. By August, the licensee had identified potential discrepancies regarding the analysis and planned to resolve the technical issues by the 1994 refueling outage. The need to evaluate the ability of the valve yokes for compatibility with the proposed replacement actuators accelerated the process. The inspector concluded that the licensee's discovery of the structural problems was fortuitous, and that the motor-operated valve program's technical review process had not been effective in identifying and resolving technical problems within a time frame commensurate with the safety significance of the valves. The inspector noted that the licensee's self-assessment of the motor-operated valve program effectiveness included this observation and that enhancements to the process for prioritization and timely resolution of emerging design discrepancies is being developed.

The NRC staff will continue to closely monitor licensee developments in this are _ _ _ _ _ _ _

_ _ _ _ _ _ _ _ - - _ _ _

-

l

.

l

'

2.5 Inoperable Vital Switchgear Room Cooler - Unit 2 On September 13 at 2:20 p.m., with the plant operating at full power, a plant equipment operator discovered a small service water leak from the west 480 Volt AC switchgear room

'

cooler X-181 A. The cooler is not included in the Unit 2 technical specifications, but is credited in the Final Safety Analysis Report to maintain room temperature less than 104 i

degrees Fahrenheit (*F) in order to assure operability of emergency electrical bus 22E. Most of the spray from the leak was deflected into the cooler's cofferdam by a normally-installed sheet metal cover, and no electrical equipment was affected. Preliminary inspection of the leak by engineering characterized the leak as coming from a 1/16-inch diameter pinhole in one of the copper-nickel heat exchanger tubes. A nonconformance report was initiated to evaluate the leak and to develop a repair plan. Pending permanent repairs, the operators increased their surveillance of heat exchanger performance. I2ter in the evening the leak was stopped by installing a temporary patch under automated work order M2-93-10961.

During the licensee's morning status meeting on September 14, the operations shift supervisor requested management guidance regarding the operability of emergency bus 22E in the event that room temperature exceeded the 104*F limit. The inspector previously documented in NRC Inspection report 50-336-/90-03, Section 3.1, an observation that applicable licensee procedures did not provide clear guidance regarding the operability of safety-related equipment in the 480 volt switchgear room when the room cooler was out of service. The inspector also noted that the technical specification status of the cooler was not clearly understood by the operators. As evidenced above, the licensee still had not yet resolved this issue. On October 4,1993, the licensee issued a revision to procedure OP 2315D, " Vital Electrical Switchgear Cooling," which upgraded the required compensatory measures and refers the operators to the technical specification action statement upon loss of normal switchgear cooling.

At 7:15 p.m. on September 14, based, in part, on concerns regarding the structural integrity of the heat exchanger tubes, the licensee declared bus 22E inoperable and entered the action statement of Technical Specification 3.8.2.1. Applicable in operating modes 1 through 4, the specification requires that the bus be restored to operability within eight hours, or the plant be placed in cold shutdown within the next 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . At 7:45 p.m. the licensee commenced a plant shutdown due to the inoperability of bus 22E ar.d the main steam isolation system (see Section 2.4 of this report). The licensee declared an Unusual Event in accordance with its emergency plan. The inspector noted that bus 22E continued to supply normal plant electrical loads and remained available throughout th: event, although catastrophic failure of the heat exchanger tubes could have affected bus 27E continuity. The licensee terminated the Unusual Event at 10:02 a.m. on September 15 with plant conditions stable in Mode 3 (Hot Standby).

On September 15 the licensee completed a structural evaluation of the room cooler based on guidance contained in NRC Generic Letter 90-05 and using the branch reinforcement method. The evaluation concluded that the cooler was operable. The licensee also removed i

..

._______ - _______ - - __

,.

,

.

!

-

the cooler from service to perform eddy current and boroscopic inspections of the heat exchanger, and verified the integrity of the remaining tubes. The leaking tube was repaired j

using expandable plugs and successfully retested under automated work order M2-93-11060.

The inspector witnessed portions of the tube inspections and verified that the repairs were conducted within the tube plugging limits of the licensee's service water system operability guidelines (NRC Generic Letter 89-13) program. The inspector also confirmed that the l

proper room temperature was being maintained by the licensee's temporary compensatory measures which included: portable fans using pre-planned power sources; temporary ducts; and both permanent and temporary room temperature monitoring devices. The inspector j

identified no problems with these activities.

The inspector concluded that the licensee's engineering and repair activities were performed in a timely fashion, commensurate with the safety significance of the room cooler.

j Coordination of the activities among the maintenance, engineering, and operations staffs

'

effectively minimized the outage time of the cooler. The licensee's decision to declare the

'

cooler inoperable evidenced a conservative approach toward operation of the unit. The j

inspector discussed with the shift supervisor and Operations Manager the basis and timing of the decision to terminate the Unusual Event while the plant remained in a mode in which

]

operability of bus 22E was still required. The decision was based on the fact that the plant was in a stable condition with the reactor shutdown. The inspector found through discussions with the NRC Headquarters emergency planning staff that termination of an i

Unusual Event is not strictly mode-dependent, and concluded that the licensee's decision was

]

acceptable. However, the inspector noted that the lack of guids in the licensee's procedures appeared to result in some confusion at the operations shift level and resulted in

,

inconsistent implementation among the three Millstone units. The licensee stated that this issue would be addressed in emergency plan procedure changes scheduled for implementation i

in January 1994. The inspector had no further questions regarding this event.

2.6 Refueling Activities - Unit 3 The inspector reviewed fuel handling activities throughout the inspection period. The review was conducted to verify that the licensee had established the necessary controls to conduct the refueling activities safely, and to verify that the refueling activities were being controlled and conducted as required by technical specifications (TS) and approved licensee procedures.

The inspector observed core off-load, spent fuel pool activities and core reload activities, verifying that; prerequisite and initial conditions were met; a senior reactor operator was in charge of core alterations; communications were established between the control room, i

containment, and the spent fuel pool; source range instruments were operable and being monitored; containment building penetration closure requirements were met; and that i

refueling procedures were available and in use. The inspector also verified that good housekeeping and loose object control were being maintained in the refueling areas and that refueling equipment surveillances were being performed as required by TS.

.- -

l

-

'

.

The inspector determined that personnel were knowledgeable of the procedures and observed good procedural adherence by the operators with exception of containment closure requirements (see Section 2.7).

During fuel offload activities on August 24,1993, the SIGMA refueling machine gripper assembly failed and would not release from the fuel assembly at core location F-38. With the fuel handling crane stuck to the fuel assembly, all refueling activities were halted and a recovery team was appointed to investigate the problem, develop recovery procedures, and provide oversight of the recovery activities. The team's investigation revealed that one of the four gripper mechanisms had malfunctioned and could no longer be operated from the SIGMA machine platform. Two special procedures were developed to provide methods to release the gripper using remote tooling. The second procedure was successfully completed on August 25 by a team of operations, maintenance, engineering and vendor personnel. The gripper was released, the SIGMA machine was repaired, and the core officad was completed on August 26.

The inspector observed recovery team troubleshooting activities, attended portions of Plant Operating Review Committee (PORC) deliberations on the special recovery procedures, attended team briefings for the recovery effons, and observed the successful implementation of special procedure SP 93-3-19, " Procedure for Releasing SIGMA Gripper Mast From Fuel Assembly F-38." The inspector determined that team activities were carefully thought out, adequately supervised, and thoroughly reviewed by management. The team briefing on August 25 was a noteworthy strength in the licensee's performance, as was the overall

!

teamwork demonstrated during most of the recovery efforts. The inspector had no further l

questions in this area.

'

2.7 Containment Closure During Fuel Movement - Unit 3 The inspectors reviewed licensee controls to maintain containment closure during core alterations. The inspector review included: technical specification (TS) 3.9.9, Containment Purge Exhaust Isolation System; TS 3.9.4, Containment Building Penetrations; surveillance procedure (SP) 3613F.3, " Containment Integrity During Core Alterations or Movement of Irradiated Fuel"; and a review of selected work orders potentially affecting containment closure.

During refueling, containment closure is established to mitigate the potential consequences of l

a postulated accident involving a dropped, irradiated fuel bundle. To satisfy containment closure requirements during core alterations or irradiated fuel movement, the equipment hatch must be closed, at least one door of the personnel air lock must be closed, and all penetrations must be isolated or capable of being closed by a containment radiation actuated automatic isolation valve. These requirements must be confirmed prior to the start of and at least once per seven days during core alterations or movement ofirradiated fuel within the containment building.

l

-

-. - -

. -

l-

.

l

.

l-l

Reactor refueling operations were in progress with fuel movement ongoing in the containment and in the spent fuel pool during the periods of August 20 through August 26 for core offload, and from September 3 through September 11 for core reload. The inspector verified that the licensee performed the required survaance procedures as specified in TS, that the equipment hatch and one personnel air low door were closed, that the work performed on the containment purge supply and exhaust valves was performed during the time frame when containment closure was not required, and verified that various

,

containment boundary penetrations were closed.

The inspector noted that although procedure SP 3613F.3 requires that the containment closure be established prior to fuel movement and verified once every seven days during fuel movement, there were no positive controls in place which would prevent operation of or work to be performed on the closure devices that are used for containment closure boundaries during the interim. The inspector notified the operations manager of this l

concern. The operations manager stated that the procedure would be strengthened and

!

committed to revise the procedure to require that at least one valve used as containment closure for each penetration would be tagged to alert the operators that the closure device is l

potentially being used as a containment boundary.

The inspector reviewed plant information report (PIR) 3-93-222, which documented a loss of containment closure during fuel movement. The PIR documented a September 5 incident in which the shift supervisor (SS) secured fuel movement due to concerns with the closure for the 'A' steam generator (S/G). Specifically, a one-half inch piece of hard plastic, which was installed on an upper handhole of the 'A' S/G in support of S/G pulse cleaning, was thought to be unacceptable because the handhole cover did not have a bypass jumper (BJ) evaluating it's closure acceptability as required by procedure SP 3613F.3.

The SS had just moved containment closure for the'A' S/G penetration from outside containment to inside containment to allow work to recommence on the steam admission

'

valve (MSS *AOV31 A) from the 'A' S/G to the turbine driven auxiliary feed water pump, when he was informed that the work on the 'A' S/G upper manway wasn't completed. The SS immediately secured fuel movement and established containment closure by reinstalling the flange cover on MSS *AOV31 A, which was evaluated and did have a BJ.

l i

Investigation by the licensee revealed that the plastic cover was secured in place by two hand tight bolts and had plastic to metal contact. The licensee stated that a BJ evaluation wasn't processed for the cover because containment boundary closure was expected to remain at the MSS *AOV31A flange until the handhole cover was replaced. Subsequent licensee evaluation concluded that the plastic cover had provided a sufficient barrier to preclude the release of airborne radioactivity to the environment for the expected containment pressure following a fuel handling accident, and therefore containment closure had been maintaine.

.

e

The inspector reviewed the completed surveillances and the BJ log and noted that a containment closure evaluation had not been processed for the steam generator pulse cleaning equipment installed on the steam generator manways. The inspector informed the operations j

manager that procedure SP 3613F.3 specifies a BJ to be processed for all covers which are used to satisfy containment closure. Therefore, when the closure boundary was shifted to the steam generator manways, the administrative control provided by procedure SP 3613F.3 was violated. The inspector noted that bypass jumpers had been processed for the main steam isolation valves and the auxiliary feed water steam supply valves when used for containment closure.

The operations manager stated that the failure to recognize that a BJ was required for the S/G manways was an oversight by the tagging senior reactor operator and that he had incorrectly assumed that a review for containment closure was addressed in the procedure which installed the S/G pulse equipment. The S/G pulse equipment was subsequently controlled with a danger tag to prevent removal of the equipment in order to maintain containment closure.

As immediate corrective actions, the licensee counselled all individuals involved on the need for attention to detail and on the use of BJs for non-permanent equipment, and expanded the tagout for containment closure to include tags for all containment boundary penetrations. In addition, the licensee evaluated the S/G pressure pulse equipment and determined that it was

,

sufficient to maintain containment closure. To prevent recurrence, the licensee committed to develop a new procedure that provides more guidance to the operators regarding use of BJs for containment closure control; to include a note in all refueling work orders that may affect containment closure to require tagging of all containment boundary valves; and to schedule a

,

review of the PIR with all the operating department shifts, stressing attention to detail and the use of BJs for non-permanent plant equipment. The inspector determined that the corrective actions proposed would appropriately strengthen the controls for maintaining containment closure.

The inspector concluded that bypass jumpers had not been procest.ed for the 'A' S/G manways in accordance with procedure SP 3613F.3. However, containment closure had been maintained during fuel movement. The inspector determined that the event was of minor safety significance, and because adequate corrective actions were taken by the licensee, enforcement discretion per section VII. B of the Enforcement Policy would be exercised.

3.0 MAINTENANCE (IP 62703,61726)

The inspectors observed and reviewed selected portions of preventive and corrective maintenance to verify adherence to regulations, procedures and codes and standards; proper QA/QC involvement; proper use of bypass jumpers and safety tags; adequate personnel protection; and, appropriate equipment alignment and retest. The inspectors reviewed portions of the following work activities:

,

_-

.

-

..

-

!

.

e M2-93-11060, Plug tube in west switchgear room cooler

M2-93-10654, Remove and cap non-seismic makeup water line j

e M2-93-11090, Remove actuator brake from valve 2-FW-38A l

M2-93-11131, Inspect auxiliary feedwater pump suction pipe support e

M2-93-11223, VOTES test valve 2-FW-38A e

M2-93-11246, Fabricate stem nut for valve 2-FW-42A M3-93-14762, Replace N15 power supplies e

e M3-93-09550, Disassemble / Repair / Reassemble 3 MSS *AOV31B e

M3-93-16883, Static Test 3RSS*MOV38B i

i

,

l l

The inspectors observed and reviewed selected portions of surveillance tests and reviewed test data to verify; adherence to procedures and technical specification limiting conditions for j

i operation; proper removal and restoration of equipment; and, appropriate review and

'

l resolution of test deficiencies. The inspectors reviewed portions of the following tests:

i

!

e SP 3612B.4, local Leak Rate Test 3SIH*MV8835 OP 2613, Diesel Generator Operability Test, Facility 1 e

e SP 2401E, Calibration of Excore Nuclear Instruments to Incores Except as noted below, the inspectors determined that the maintenance and surveillance sciWities observed were performed adequately. Details of the inspector's observations are provided in report Sections 3.1 to 3.7.

3.1 Failure of Gas Turbine Temperatum Control Element - Unit 1 On July 8,1993, during a monthly surveillance of the Unit I gas turbine, a high lubricating oil temperature alarm was received. Upon receipt of the alarm, operators secured the gas turbine and commenced an investigation of the event. The licensee's investigation revealed that the high gas turbine lubricating oil temperature was caused by a loose sensing bulb which was not acctrately measuring the temperature of the lubricating oil. When the temperature of the lubricating oil increases, the sensing bulb will detect the increase in temperature and stan a fan which will cool the lubricating oil. The high lubricating oil temperature condition occurred because the sensing bulb was not located in the thermowell.

Therefore, the bulb read only the ambient air temperature of the gas turbine room, and not the increase in lube all temperature when the turbine was started. To restore the gas turbine to an operable status, the bulb was reinserted into the well and the gas turbine was successfully surveilled. The licensee documented the event per Plant Incident Report 1-93-75.

The inspector attended a Plant Operations Review Committee (PORC) meeting on September 8,1993, where licensee engineering personnel discussed the July 8,1993, gas turbine event and their root cause determination. The inspector noted that licensee personnel did not determine a specific root cause why the sensing bulb was found outside ofits thermowell.

Rather, engineering personnel postulated that maintenance personnel who were working in

_

__

_-,

__ _

.

-

.

the general area of the lubricating oil system prior to the surveillance test probably dislodged the sensing bulb unknowingly, which rendered the gas turbine inoperable. To ensure the

,

sensing bulb did not dislodge again from the thermowell, the licensee secured the wire from the sensing bulb to the lubricating oil system. The engineering department root cause was subsequently accepted by the PORC committee and the PIR was closed.

Following the PORC meeting, the inspector examined the gas turbine lubricating oil system and the sensing bulb. The inspector observed that the sensing bulb extends approximately six to ten inches vertically into the thermowell. The wire from the sensing bulb is approximately two feet long. The inspector noted that a vertical support is located approximately four inches outside of the sensing bulb thermowell. Given the depth of the thermowell, the confined space of the area and length of the sensing wire; it would be highly unlikely for an individual to dislodge the sensing bulb unknowingly. Therefore, the inspector observed that the licensee's postulated explanation for the inadvertent dislodging of the sensing bulb was not likely, and did not consider other plausible explanations such as maintenance work outside of the job scope or improper work activities. However, by securely fastening the thermocouple to the heat exchang:r, additional unauthorized removal would be less likely. Therefore the corrective action was adequate to prevent recurrence of this event.

3.2 Reactor Plant System Area Leak Detection System - Unit 1 Millstone Unit I monitors the integrity of reactor plant systems that are located in the reactor building through use of a leak detection system. The system consists of 24 reactor building resistance temperature detectors which are located in nine specific plant areas, and an snnunciator panel in the back of the main control board. Each monitored area has an individual annunciator window. If the temperature rises above a set level in an area, the i

'

individual area annunciator will alarm together with a common annunciator located in front of the main control board. Upon receipt of an annunciated signal, a control room operator is required to identify the affected area and read the temperature.

The leak detection system at Unit 1 is not listed in plant technical specifications (TS) nor is it a quality assurance (category 1) system. The inspector noted that in boiling water reactor plants of a later design, the leak detection system is classified as a TS safety-related system.

In those plants, in addition to providing indication, the system is also designed to automatically isolate the monitored area on receipt of a high temperature signal. Although

'

the leak detection system at Unit 1 is not safety-related, the inspector noted that the teinperature readings which the system provides are used by operators as decision points in the secondary containment control emergency operating procedure. Therefore, the inspector concluded that the system is important to safe operation of the plant. Accordingly, the inspector performed a review of the system maintenance and testing progra.

.

The inspector noted that the resistance temperature detectors are calibrated once per refuel cycle. Testing consists ofinstalling a resistance box to the detectors and verifying that an annunciator illuminates when the required setpoint is reached. A review of the system maintenance history revealed that the performance of the system has been good. Only 12 work orders had been written to repair deficiencies in the detection system. However, the inspector noted that a recent trouble report initiated in July 1993, identified that the area leak detection system alarm panel push buttons did not work properly. The push buttons are used by the operators to locally read the temperatures of the individual rooms in which the detectors are located. According to the Instrumentation and Controls manager, recent troubleshooting revealed that the defective push buttons can cause intermittent false high temperature alarms to annunciate on the main control panel when the local temperature readings are taken by the operators. To restore the panel to operability, the defective switches were cleaned. The licensee stated that since the panel is obsolete and spare parts are not available. The licensee is considering procuring a replacement panel. The alarm function at the panel was not affected.

The inspector noted that if the area leak detection system failed during an accident scenario, the licensee has diverse safety-related instrumentation such as the reactor building exhaust duct radiation monitor, which would warn operators of a potential leak in the reactor building. Therefore, an unreliable area leak detection system would not prevent an operator from detecting a leak in the reactor building. In conclusion, the inspector determined that the area leak detection system at Millstone Unit 1 is adequately tested and maintained at a level which is commensurate with its importance.

3.3 Reactor Vessel Yarway Level Indicating System - Unit i The inspector observed the performance of a functional test and calibration of the Unit I reactor vessel narrow range yarway level indicating system. The functional test and calibration of the instruments is required to be performed monthly and quarterly per plant technical specifications (TS) 4.1.1 and 4.1.2, respectively. In addition to providing level indication for the operators, the yarway system provides initiation signals to the emergency

'

core cooling, reactor protection, and containment isolation systems. The licensee tests the trip signals which are generated by the yarway level indicating system by simulating high and low reactor vessel level signals, using pressurized water from a demineralized water storage tank which is mounted at the instrument rack.

Testing of the yarway level indicating system is performed by procedure SP408C, " Reactor Vessel Iow Water level Scram and Low-IAw level Isolation Functional Test / Calibration."

The procedure instructs instrumentation and controls (I&C) personnel to isolate the instrument to be tested from the reactor vessel and connect it to the demineralized water storage tank. The storage tank is then pressurized with air to simulate vessel level signals.

The amount of differential pressure (dp) that has been applied to the instrument is determined

_ _ _ _ _ _ _ _ _ _

*

.

i

.

j

4 by reading a locally mounted Heise dp gauge. Once a specified differential pressure (as read

'

]

on the Heise gauge) has been generated, I&C personnel verify that the appropriate trip signal has occurred.

During the performance of the surveillance test, the inspector verified that I&C personnel

'

were knowledgeable of test requirements, the surveillance procedure was properly followed,

and I&C coordination with control room personnel was good.

]

Following performance of the test, the inspector examined the relationship between the j

differential pressure which was indicated on the heise gage and the level trip setpoints.

j

The inspector verified that the calibration values which were contained in procedure SP408C

,

'

were based upon level calibration curves which were supplied by the system manufacturer.

i The inspector recalculated values which were established by the licensee through interpolation. No inadequacies were identified. Based upon observation and review of the

'

this reactor vessel level calibration procedure, the inspector concluded that level instrumentation is appropriately calibrated and tested.

3.4 Stuck Air Operated Pressure Control Valve 1-CU-10 - Unit 1

!

i During a September 8,1993 reactor downpower to perform routine turbine stop valve testing, operators noted that valve 1-CU-10 operated sluggishly when operators tried to reduce RWCU system pressure. 12ter, operators informed the oncoming day shift that

'

although the valve was controlling pressure adequately it appeared to be stuck. The apparent

sticking of valve 1-CU-10 was documented in Plant Incident Report 1-93-079.

,

Valve 1-CU-10 is an air operated pressure control valve in the Reactor Water Cleanup

.

(RWCU) system. The valve is designed to reduce the pressure of reactor coolant water from j

1035 pounds per square inch (PSI) to less than 140 PSI. The pressure reduction is caused by changing the position of the valve which throttles the flow from the reactor coolant system.

Valve 1-CU-10 is not safety-related. However, the Unit 1 Appendix R fire hazards analyses report requires this valve be capable of isolating the RWCU system from a remote panel

,

J located outside of the main control room by removing power from the valve.

l The removal of electrical power from valve 1-CU-10 ensures the valve will not spuriously

'

-

reopen in the event a hot short occurs on the electrical power feed to the valve. Spurious opening of all the RWCU system valves would cause the loss of reactor coolant system

.

'

inventory as the higher pressure reactor coolant flows into the lower pressure RWCU system i

piping. The inflow of the higher pressure water could lift the relief valves in the RWCU system piping before a reactor water makeup path has been established and possibly lead to core uncovery.

When the degraded status of valve 1-CU-10 was discussed at the morning meeting, the inspector noted that licensee planning personnel had been aware that the valve had been performing sluggishly over a previous two week period and were in the process of

. -

-

_

-

.

~

.

,

-

+

21

developing a repair strategy. However, the planning department accelerated plans for repair of the valve based upon the unit director's cor.cerns regarding the timely repair of degraded plant equipment. Accordingly, the planning department agreed to develop a plan to repair the valve the following week. However, at no time during the meeting did licensee personnel indicate that the continued operability of valve 1-CU-10 is necessary to ensure l

Appendix R commitments can be met.

i

-

The inspector subsequently discussed the status of 1-CU-10 with the licensee. The inspector asked the licensee if it was proper to wait several days to repair the valve since it may not be able to isolate the RWCU system from the remote panel in the event of a control room fire.

J The licensee conducted further tests of the valve following the inspector's observations and

determined that although the valve was opening sluggishly, it was not stuck. The licensee determined that the repair schedule for the valve should be accelerated further.

On September 10,1993, Unit 1 personnel removed the RWCU system fmm service and examined valve 1-CU-10. The inspector observed portions of the repair effort.

Disassembly was conducted in two phases. Phase one involved the removal of the operator by the instrumentation and controls department (I&C). Phase two involved the removal and j

inspection of the valve internals by contractor maintenance personnel.

Valve 1-CU-10 is located in a locked high radiation area with local radiation levels from 25 to 50 millirem per hour. Prior to entry into the area, personnel received a briefing from j

their respective department supervisors and the health physics office. The inspector observed the maintenance department and a health physics department briefs and considered

'

them to be thorough.

Inspection of the internals of valve 1-CU-10 revealed that the sluggish performance was due to a scored seat. According to the licensee, the scored seat was due to excessive valve cavitation. Inspector review of the valve history revealed that the valve has had a history of sluggish performance and excessive seat leakage which could be attributed to cavitation

'

induced wear of the valve. The poor valve performance has necessitated repair of the valve approximately once every two years. The licensee intends to replace the valve with a model which is less susceptible to cavitation induced wear during the next refueling outage which is currently scheduled for January 1994. The inspector noted that in addition to causing poor pressure regulation of the RWCU system, the scored seat would have prevented the valve from isolating the RWCU system flow if required. To restore the valve to an operable status j

the licensee replaced the degraded internals with similar components. Later that day, the RWCU system was restored to an operable status.

While reviewing this issue, the inspector had the following observations. The licensee does not periodically verify that the remote Appendix R shutdown panels, which are installed in various plant areas, work as required. Therefore, the licensee does not know if the remote panels become inoperable. Licensee personnel also appear to be insensitive to the special performance characteristics which some plant valves are required to have in order to meet

.

, -

,

l.

Appendix R commitments. Specifically, during this cycle of operation, licensee personnel allowed the performance of valve 1-CU-10 to degrade until it was no longer an effective isolation valve as committed to in the Appendix R fire hazards analyses report. Additionally, once the degraded performance was recognized by the licensee, personnel did not l

l immediately recognize that untimely repair of the valve could impact Appendix R l

commitments.

l The inspector discussed the observations with the unit director. The director stated that the licensee is currently developing procedures to test the remote switches which are required by

,

10 CFR 50 Appendix R during the next shutdown period. He also indicated that the special l

requirements which are attached to some plant components to ensure Appendix R requirements are met will be included in the plant technical requirements manual by the end of the next refueling outage. Accordingly these components would then receive augmented attention.

The inspector noted that the implementation of an Appendix R equipment surveillance test program should ensure the remote operating panels are operable. The addition of the Appendix R equipment to the technical requirements manual should also increase the awareness of personnel to equipment which is credited in the Appendix R analyses.

This item will remain unresolved pending inspector review of the Appendix R equipment surveillance test and maintenance programs (UNR 50-245/93-24-004).

3.5 Radiation Monitor Seismic Brackets - Unit 2 i

On September 13, 1993, during the performance of an annual calibration of spent fuel pool

'

area radiation monitors, an instrumentation and controls (I&C) technician discovered a seismic bracket missing from the count rate monitor module of radiation monitor RM-8156.

The bracket normally is bolted across the module to restrain the circuit cards in the module.

The next day, a replacement bracket was installed in the module and a plant information report (PIR) was generated to document the condition. A personnel questionnaire attached to the PIR also noted that the foam backing on the brackets of several other modules was missing. At the request of the shift operators, the licensee inspected the other three spent fuel pool monitors and found the brackets properly installed.

On September 24, the inspector attended plant operations review committee (PORC) meeting 2-93-142 at which the PIR was presented for closeout. The results of the licensee's investigation and the proposed corrective actions were discussed. On July 12,1993 an out of specification condition was found during performance of a monthly functional check of RM-8156. Under automated work order (AWO) M2-93-08837 a circuit calibration was performed using surveillance procedure SP-2404AO, " Spent Fuel Pool Area Radiation Monitors Calibration," on July 13-14. At this time the seismic bracket was removed and not replaced. Thus the seismic capability of the radiation monitor (RM) was degraded for approximately two months. The licensee identified the root cause of the event as personnel error / procedures not followed and no self-checking. The technicians involved were

-

.

'

,

.

l.

l

'

disciplined as action to prevent recurrence. The licensee identified no trends associated with l

the PIR. The inspector was concerned that the PORC failed to discuss the following aspects l

of the event:

i e

Status of seismic brackets on other safety-related RMs.

Seismic capability of the RM with the bracket missing.

l

Missing foam on several other seismic brackets.

Record ofinadequate procedure adherence at Unit 2.

Previous examples of inadequate PIR closecut review by the PORC were documented in NRC Inspection Reports 50-336/93-09 and 50-336/93-11. The licensee established a PIR Task Force to address the inspector's concerns. Through attendance at subsequent PORC meetings, the inspector noted improvement in the quality of PIR reviews. Overall, however, licensee performance has been inconsistent. The inspector will continue to monitor licensee progress in this area.

The inspector discussed these issues with the PIR investigator after the PORC meeting and subsequently, on September 29, with the I&C and Operations Department managers. The inspector identified a potential violation of procedure adherence requirements and discussed the need to inspect the remaining RMs and address the degraded seismic brackets.

Surveillance procedure SP-2404AO, steps 6.3.3 and 6.12.9 specifically cover removal and reinstallation of seismic brackets from the spent fuel pool radiation monitor modules.

Licensee failure to perform these steps on July 14 is a violation of licensee procedures and NRC requirements. Procedure adherence violations involving the I&C Department at Unit 2 previously were documented in NRC Inspection Reports 50-336/93-06 and 50-336/93-11.

Similar violations involving other departments were documented in NRC Inspection Reports 50-336/93-03 and 50-336/93-11. Corrective actions for these violations have included counseling and disciplinary action, and discussions by licensee management at department meetings. As a result of the PORC discussion monitored by the inspector on September 24, the inspector concluded that the scope of the licensee's corrective action for this PIR was inadequate. Therefore, this violation will be cited. (VIO 50-336/93-19-005)

The inspector concluded on October 1 that the licensee had not checked the remaimng

'

modules and requested that the licensee perform the examinations with the inspector in attendance. On October 5, the inspector examined the modules for containment particulate and gaseous radioactivity (RM 8262A/B and RM 8123A/B), control room area radioactivity (RM 7899), and condensate recovery liquid effluent radioactivity (RM 9327). All seismic brackets were installed. However, the inspector noted degraded and crumbling foam backing on one bracket and heat shrink tubing installed on three others.

The inspector discussed the results of the examination with the I&C Department manager and questioned when and under what administrative design controls the heat shrink tubing had been installed. The licensee was unable to document the installation of the tubing and stated

i

.

that it appeared to have been installed by I&C technicians as a " good work practice" to replace the degraded foam backing. As corrective action the licensee initiated a review of the threshold for initiation of a plant design change record, which involves an independent engineering design review, for " minor" changes to installed field equipment, and initiated a j

nonconformance report for the modified brackets on October 14, 1993. The licensee j

contacted Nuclear Measurements Corporation, the RM manufacturer, and was informed that the brackets were considered to be an insignificant factor in the seismic capability of the j

modules. The foam backing was installed to help restrain the circuit cards and to mimmize

-

Wear.

The inspector reviewed NRC requirements and industry standards regarding design changes.

10 CFR 50, Appendix B, Criterion III, Design Control, is implemented by the Northeast Utilities Quality Assurance Topical Report. The licensee is committed to utilizing the guidance of ANSI N18.7-1976, Administrative Controls And Quality Assurance For The Operational Phase Of Nuclear Power Plants. These standards require that measures shall be provided for verifying the adequacy of design, such as by the performance of design reviews.

The measures shall be applied to items such as maintenance and repair. Design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design.

The inspector noted that undocumented and unreviewed " minor" modifications to safety-related plant equipment had been performed at Unit 2 in the past. For example, a concern regarding drilling an access hole in a plastic case for circuit cards in the reactor protection system core protection calculator was documented in NRC Inspection Report 50-336/91-31.

That case also was dispositioned after the fact by a nonconformance report. The inspector requested the licensee to determine the extent to which undocumented design changes to safety-related equipment had been performed and to provide a schedule for resolution of the

,

plant design change record procedure threshold issue. These matters are unresolved. (Uh1 i

50-336/93-19-006)

3.6 Containment Purge Supply / Exhaust Valve Maintenance - Unit 3 The inspector reviewed work orders for work performed on the containment purge supply and exhaust valves to verify that technical specification (TS) applicability and operability were met, the system isolation was adequate, and the maintenance personnel performing the tasks were properly trained.

The inspector reviewed the tag clearance and verified that the equipment was properly isolated, and that the applicable TS action statement was entered prior to work release. The inspector noted that work on the containment purge supply and exhaust system occurred during a period of time when the system was not required for containment closure. The inspector performed a walkdown of the system and verified that maintenance on the system was complete, the equipment was retested, and that system surveillances had been completed as required by TS prior to fuel movement. During the system walkdown, the inspector noted

<

-

.

!

'

l that the air breather and air supply lines to valve pneumatic actuators were not installed in the same orientation for all four of the purge supply and exhaust valves. Specifically, the air

!

supply line was installed on the top of the actuator for the supply and exhaust valves located l

outside of containment, and the breather was on the bottom of the actuator for these valves.

!

But, on the two valves located inside containment the air breather was installed on the top of l

the supply valve actuator and on the bottom of the exhaust valve actuator. The inspector l

notified the maintenance manager of this observation. The licensee notified the vendor and l

was informed that the operation of the valves is not affected by the orientation of the air

'

supply line and the air breather. The inspector noted that the valves operated properly when cycled every seven days as required by the TS surveillance interval.

The valve work was performed by five contract valve technicians supervised by a licensee maintenance mechanic. The inspector reviewed the training records of the mechanics performing the maintenance activity and noted that only the licensee's mechanic was qualified to work on the pneumatic valves. Administrative control procedure (ACP) 2.28, i

" Qualification Of Non-site, Non-permanent Personnel Who Perform Maintenance Related Functions," requires that non-permanent personnel who perform work related functions independently on the nuclear units must successfully complete the licensee's test-out or validation process to demonstrate adequate technical and practical knowledge. However, the ACP also allows fct work to be performed by non qualified employees if the activity is overseen by a qualified individual. The inspector questioned the workers and management to ascertain if adequate oversight was provided for the job, and determined that proper oversight was provided. The inspector had no further questions.

3.7 Steam Generator Feedwater Nozzle Defects - Unit 3 On September 6,1993, in part as the result of NRC Information Notice 93-20, the licensee performed ultrasonic testing (UT) of the 16" diameter feedwater (FW) nozzle-to-pipe joints in steam generators (SG) 'B' and 'C' and found suspected circumferential linear indications in the counterbore areas of the subject joints. The nozzle and pipe material were A-508 Class 2 alloy steel and A-106 carbon steel, respectively. The defects, as measured by UT, were.130" deep in a 0.74" - 1.00" wall and ranged in length between 28" and 32". Their presence in both the nozzle and pipe sections was subsequently confirmed by radiography, and magnetic particle testing (MT) after the FW joints were cut to expose the inner surfaces.

Inspection of the FW nozzles in SG's 'A' and 'D' (which were welded to elbows instead of pipe) was limited to radiography because of geometric constraints. After cutting SG 'A' and confirming the presence of cracks by means of eddy current testing and a metallurgical examination of a boat sample removed from the nozzle, SG 'D' was cut open and found to exhibit similar cracks. The cracks were believed to be due to thermal fatigue. Repairs of all four SGs FW nozzle joints were completed by removing the defects in the nozzles by machining, weld overlaying the new machined surfaces, filling in the weld preps to eliminate the counterbore, and replacing the original pipe and elbows with new material. Completion of the nozzle to pipe or nozzle to elbow repair was accomplished by manual and automatic

. _..

..

.

-

.

_.

-

!

'

.

!

.

l

l l

processes using qualified ASME Section IX welding procedures (WP2 and WP3), and j

employing both preheat and post-weld heat treatment where welding to the nozzle was

'

required. The regirs were radiographed and inspected using MT without any rejectable indications. Althcugh the assemblies were not hydrostatically tested, leak testing as i

permitted by Code Case 416 is scheduled to be performed prior to reactor startup. In addition to the SG nozzle joints, the licensee inspected twelve other joints upstream of the

>

nozzle by mdiography or MT. No defects were found.

,

4.0 ENGINEERING (IP 37700,37828)

i 4.1 Potential Valve Operator Deficiency Investigated - Unit 1 l

In response to an issue which was identified at another nuclear facility which concerned how motor operated valves would perform during a loss of coolant accident, the licensee reviewed

,

the scenario for applicability for Millstone unit 1. The specific concern involves how the

braking mechanism that is installed in the valves would operate during a loss of coolant

,

accident coincident with a degraded offsite grid voitage. The valve braking mechanism is l

designed to hold the valve gear mechanism in the closed position when it is deenergized.

When the valve must be opened, the braking mechanism is disengaged from the gear

,

assembly by energization of a coil. The issue involved whether the braking coil would

'

generate sufficient magnetic force to lift the brake from the gear mechanism if a degraded

'

grid voltage occurred. According to the manufacturer of the vnive brake, Ding Dynamic

,

Group, the valve brake could deenergize if an air gap of 0.110 inch existed between the coil and brake assembly and bus voltage decreased to 10 percent below the rated 440 nominal bus i

voltage or 400 volts. The 0.110 inch air gap is the theoretical maximum air gap that could occur for the brake.

l

.

A licensee examination of the installed plant motor operated valves revealed that eight

'

actuators which were manufactured by Tehxlyne had Ding braking mechanisms installed. Of

the eight valves, the licensee determined that four are required to change position during l

various accident scenarios. The four valves of concern are installed in the low pressure

!

coolant injection (LPCI), the isolation condenser (IC) and the reactor water cleanup (RWCU)

l systems. The valves which are located in the LPCI and RWCU systems (valves LP-43A(B)

'

and 1-CU-28), are similar in design and therefore have identical braking mechanisms which

'

are rated at 3 pounds of pullout torque. Valve IC-4 is a larger valve and has a brake which is rated at 6 pounds of pullout torque. The licensee calculated that the lowest bus voltage for

'

the subject valves of concern would be 356 volts during a degraded grid scenario.

To determine when the valve brakes would disengage, the licensee tested valves LP-43A(B),

CS-4B and two other valves which were obtained from the training department. The brak.e

ir gap which existed for valves LP-43A(B) and CS-4B was 0.065,0.070 and 0.060 inches, respectively. The licensee did not test valve IC-4 since the valve is located inside the drywell and is inaccessible during plant operation. Therefore, the licensee tested valve CS-4B which is similar to valve IC-4. Valve 1-CU-28 was not tested by the licensee since it is l

l

_,

--.

_

.

_ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _

-

.

located in a high radiation area. Testing revealed that the braking mechanisms for valves CS-4B and LP-43A(B) successfully disengaged at voltages above 332 and 317 volts, respectively. Therefore, the licensee determined that the valves were operable.

The inspector determined that the licensee's initial testing methodology was acceptable to verify valve operability for the immediate term. The licensee indicated that the manufacturer stated that the 10 percent voltage limit which was established for valve brakes was conservative and the brakes should perform acceptably at much lower voltages. However, the inspector noted that the licensee is still evaluating if the valve brakes would be otherwise affected (e.g., high temperature) by operation at the reduced bus voltage of 359 volts.

Additionally, the licensee had not received written assurance from the manufacturer that the testing methodology which was utilized by the licensee acceptably demonstrated the performance of the brakes. This issue is unresolved pending NRC review (UNR 50-245/93-23-007).

4.2 Structural Analyses for MOVs 2-FW-38A&B and 2-FW-42A&B - Unit 2 During this inspection, the licensee completed a structural evaluation of the main feedwater system, motor-operated valves (MOVs) Nos. 2-FW-38A&B and 2-FW-42A&B at Millstone Point Unit 2. The need for the eva5ation arose from concerns regarding the valves'

qualification discovered during operability determinations described in section 2.4 of this report. The inspector verified that these MOVs were qualified in accordance with the Millstone Point Unit 2 Final Safety Analysis Report (FSAR) requirements which meet the intent of the American Society of Mechanical Engineen (ASME) Boiler and Pressure Vessel Code (BPVC),Section III, Subsection NC,1971 Edition with addenda through 1974. This criterion was used to qualify all components except the modified yoke, stem nut and disc cars. The review of calculations described below was supplemented by several conference calls with the licensee.

The inspector noted that for the non-pressure retaining modified yoke and stem nut components the criterion used was to maintain membrane plus bending stress levels below thc material yield strength at temperature. In addition, the licensee demonstrated that remaining fatigue life is adequate based on the provisions of the ASME BPVC Section III, Subsection NB-3228.5 " Simplified Elastic-Plastic Analysis."

To ensure safe closure of the valves under the required thrust load, the licensee performed three separate analyses. The inspector reviewed critical attributes of these analyses as detailed below:

In calculation No. 93141-C-17, the licensee documented weak link thrust values for the motor operated valves (MOVs) 2-FW-38A&B and 2-FW-42A&B. Each component limiting value when subjected to an open and closing thrust of 200,000 pounds was determined. The inspector verified that the subjected valve was evaluated for the worst case, with the valve in i

____ _ -___ _ ___

__

'

.

the horizontal position. This assessment revealed that the yoke was the weak link. These results prompted the licensee to initiate an in-depth analysis of the yoke to determine the

'

valve yoke capacity to resist target closing thrust.

In calculation No. 93141-C-18, the inspector verified that applicable industry standards, current engineering practices and a logical analysis approach were used in this calculation to assess the four yoke legs for a valve representative of MOVs 2-FW-38A&B and 2-FW-42A&B. The inspector verified that the valve yoke was evaluated i'i the worst case with the valve in horizontal position and that the mathematical model used as input for the ANSYS finite element code used to determine stress levels under the target thrust loading matched the actual configuration of the yoke. Two models were evaluated. An elastic model with all loading applied and a plastic element model, subjected to thrust and torque.

The table below shows the results of licensee calculation No. 93141-C-18. These results showed that each yoke leg for all four valves exceeded the ASME code allowables. The results revealed in this calculation prompted the licensee to a modify the present configuration of these yokes.

COMPONENT MEMBRANE ALLOWABLE *

MEMBRANE ALLOWABLE (PSI)

PSI

+ STRESS

PSI YOKE LEG 21,983 1.0S = 12,600 67,725 1.0Sy=30,000 YOKE LEG 20,723 1.0S = 12,600 64,418 1.0Sy =30,000 YOKE LEG 20,723 1.0S = 12,600 67,303 1.0Sy=30,000 YOKE LEG 21,983 1.0S = 12,600 64,469 1.0Sy =30,000

Based on ASME code case N62,Section III Subsection NC/NB 1971 with addenda, Millstone Point FSAR and valve specification.

Due to the results of calculation No. 93141-C-18, a modification of the yoke arrangement was developed. In this modification, the Tee shaped yoke leg members were modified by adding a cover plate to the flange. The purpose of this modification was to permit the valves to safely operate in their present configuration with the existing (SMB-4T) operators in place.

The analysis for this modification is documented in calculation No. 93141-C-20.

The inspector reviewed calculation No. 93141-C-20, Revision 0, and verified that the criteria used in this analysis was in conformance with the ASME Section III, Subsection NB of the code. The licensee explained that ASME Code was used to analyze the yoke.

Furthermore, the allowables from the ASME code case N62,Section III Subsection NC/NB 1971 with addenda are more conservative than using the steel construction manual AISC.

j i

.

-

m.

- -

.___

__

' '

.

i c

l The modification was evaluated in an ANSYS finite element model for a thrust of 200,000 Lbs. and a friction between stem / stem nut of 0.2, and an actuator SMB-4T. All components were evaluated to be within the material yield strength at temperature. The highest stressed component was approximately 70% of the yield strength, as shown below.

l COMPONENT MEMBRANE ALLOWABLE MEMBRANE ALLOWABLE *

l (psi)

+ BENDING

l (PSI)

(psi)

Yoke Legs 9492

< 1.0S = 12600 20706

< 1.0Sy =30000 '

.

'

Cover plate 9483

< 1.0S = 12600 21285

< 1.0Sy=30000

,

The fatigue analysis was limited to 6000 open and close thrust cycles. However, the licensee explained that even at one cycle / month for the remaining life of the plant, the number of cycles will be less than 300 cycles. Therefore, the valve will not see the 6000 cycles limit.

I I

The inspector fotmd this explanation acceptable and had no further questions in this regard.

Based on the assessment described above, the inspector concluded that the above analyses

adequately addressed and resolved the material concerns related to the overthrusting of the l

yokes.

4.3 Foreign Object on Lower Core Plate - Unit 3 On September 2,1993, while performing an inspection of the lower core support plate, in preparation for core reload, a foreign object was discovered. The object was a one and one half inch square piece of metal located between core location A10 and All. As a result of the finding, a full foreign object search and retrieval inspection was performed both above and below the core support plate using a submersible TV camera. Three additional pieces of

,

material were identified and all four were successfully retrieved. The licensee, with assistance from Westinghouse, determined that the pieces were from a locking cup for a turning vane hold down bolt in a Westinghouse model 93Al reactor coolant pump (RCP).

l

!

The RCP turning vane casting is held to the RCP thermal barrier flange by 23 hold down bolts which are locked in place by locking cups. The locking cup is a 1.5 inch high

,

cylinder, open at both ends, that surrounds the bolt's head and whose function is to lock the bolt such that it will not loosen during operation. Without some type of retaining device, the hold down bolts could come loose due to vibration resulting in leakage of primary coolant to the RCP bearing and seal area. The increased temperature could lead to a pump seal failure and a resultant loss of coolant accident (LOCA). In addition, if a bolt broke free, its potential impingement on rewtor coolant system components could be hazardous. Following Unit 3's first fuel cycle, ducing core inspection, seven locking cups were identified and

I

,.

,

-

.

retrieved from the lower fuel plate (see inspection report 50423/87-24). As a result, a modification to the locking cups was performed in accordance with plant design change record 3-87-063 to assure the retention of the bolts in the event of a locking cup failure.

Two types of new locking clips were designed and welded to the diffuser of the RCPs during the first refueling outage. For the bolts where the locking cups were missing, a locking clip with a retainer plug was installed to prevent the bolts from rotating. For the remaining hold down bolts, a locking clip with a retainer tab was installed to prevent further disengagement l

of the locking cups. An analysis performed by the licensee in 1987 concluded that the loss

of the remaining RCP locking cups would not damage the RCP or the reactor vessel -

internals.

As a result of the recent finding, the licensee reviewed the loose parts monitoring indications

,

for all impact like events and concluded that all the events could be accounted for. The j

licensee also reconfirmed that of the seven locking cups identified missing during the first

,

refueling outage that seven total cups had been retrieved. In addition, by comparison of the

'

isotopic ratio of cobalt-38 to manganese-54 from the material retrieved, the licensee

,

concluded that the locking cup pieces had most likely been in the core for only one fuel cycle.

In response to verifying that a locking cup had been dislodged and noting the recent deteriorating thermal performance (increased bearing and seal water inlet temperatures) of the 'B' and 'C' RCPs during the last fuel cycle, the licensee decided to remove, inspect, and change out the 'C' RCP with a spare in an attempt to determine the failure mechanism of the i

locking cup. IAss of locking cups and loosening of the diffuser hold down bolts could account for the increased bearing and seal water temperatures noted. Inspections of the other RCPs would be predicated upon indications identified in the 'C' RCP.

,

Inspection of the 'C' RCP by the licensee revealed that all locking cups and retainer tabs were installed and no apparent pump damage was noted. Since the results from the 'C' RCP i

were inconclusive in determining the failure mechanism, the licensee pulled the 'B' RCP and identified two locking cups missing, two cups loose, a few locking tabs bent, and one turning

,

vane bolt was noted to be backed out slightly. As a result of these findings, the licensee

.

elected to pull the remaining two RCPs for inspection and removed several bolts from the 'B'

'

RCP for inspection.

No missing locking cups were identified during inspection of the 'A' RCP; however, two locking cups were loose, and two locking tabs were found to be damaged. Inspection of the

,

'D' RCP revealed that one cup was missing and several locking tabs were loose. Inspection of the 'B' RCP turning vane bolts revealed cracking of the bolts at thejuncture of the bolt head and body (sce Section 4.4).

,

r

!

i

!

- - -

-

--

-

.

As a result of the RCP inspection findings during this refueling outage, the licensee elected to replace all four RCPs. The replacement RCPs are manufactured by Westinghouse and are the same model number as the pumps that were removed. The replacement RCPs were installed with turning vane bolts that are of a different material and the locking cup was a different design than the original. These modifications were recommended by Westinghouse to be performed whenever a RCP was removed and the turning vane bolts were accessible.

The inspector was informed by Westinghouse that Unit 3 is the only plant to experience detachment of locking cups and that the design of these cups was unique to Unit 3. The failure mechanism of the locking cup / locking clip design and the turning vane bolt cracking has not been determined by the licensee. Westinghouse evaluation is ongoing. The NRC will continue to follow these concerr.s as indicated in Section 4.4 below.

4.4 Cracking of Reactor Coolant Pump Turning Vane Bolts - Unit 3 On September 21, with the plant in Mode 5, during the cycle 4 refueling outage, the licensee found cracking of several reactor coolant pump (RCP) turning vane bolts. Four bolts from the 'B' RCP, Westinghouse model 93A-1, were removed and inspected subsequent to pump removal. Cracks were identified in three of the four bolts at the transition between the bolt head and body. One bolt head was almost severed from its body (held on by two ligaments)

and fell off when the locking tab was removed, one had a tight one inch long crack, and the other had a 1/64 inch crack 360 degrees around the transition.

The RCP turning vane bolts hold the turning vane casting to the thermal barrier flange.

There are 23 bolts per RCP. The bolts are approximately 10 inches long, with a nominal size of 1.5 inches in diameter, and the material is made of Alloy 286, (SA-453) grade 660 stainless steel. Westinghouse issued memorandums NEU-88-606, NEU-88-641, and NEU-90-531 dated May 5,1988, June 30,1988, and March 21, 1990, to the utility indicating that the turning vane bolts in models 93A and 93A-1 have experienced cracking. The vendor stated that bolts were susceptible to intergranular stress corrosion cracking (IGSCC) in the bolt head to shank transition radius and stated that they believed the cracks to be self arresting. The vendor stated that this was not a safety issue and required no special inspections or operating restrictions. They stated that if fracturing of several consecutive bolts had occurred, that an internal leak path past the thermal barrier would open resulting in increased RCP bearing and seal water inlet temperatures. The vendor had recommend that new style bolts, ASTM A-479 type 316 stainless steel, condition 1 (strain-hardened), be installed if the RCPs were removed and suggested that the RCP bearing and seal water temperatures be monitored for indications of bolt relaxation.

During the first refueling outage in 1987, seven locking cups were found in the reactor vessel (see Section 4.3 above). All the RCPs were removed and inspected. Two more locking cups were identified to be loose. All turning vane bolts were observed to be in place. The bolts with loose or missing locking cups were checked for loss of torque and eight of the nine were determined to have less than 500 ft-lbs load. Two of the eight loose bolts were

'

removed, sent to Westinghouse and replaced with new bolts. The remaining six were re-

-..

-

--

-

.

,

tightened to 2000 ft-lbs. Of the four bolts removed and inspected in the 'B' RCP during the l

current outage, three were chosen from these locations. Of the two bolts sent to Westinghouse in 1988, only one was observed to have cracked.

As a result of the current findings and the historical performance of the turning vane bolts

,

'

and locking cups, the licensee replaced all four RCPs. One was replaced with a Unit 3 available spare that had been previously upgraded with the new turning vane bolting material and the other three replacements were purchased from Seabrook and upgraded with the new

.

(

bolting material. The diffuser cap screws were also replaced in the replacement RCPs with the upgraded 316 stainless steel material due to documented occurrences of fractures attributed to IGSCC.

The damaged bolts were sent to Westinghouse to perform an analysis to determine the root

~

cause of turning vane bolt failure. The licensee determined that had a bolt head broken off during operation and fallen into the reactor coolant system (RCS) flow stream that it may cause the resistance temperature detector thermowell inserted in the cold leg to break or may damage an incore thimble tube resulting in a leak from the RCS pressure boundary. This size of leak would be within the capacity of one charging pump and is bounded by the small break LOCA analysis. The licensee has initiated a substantial safety hazard analysis to determine if a 10 CFR part 21 report is required. The licensee determined the event to be non-reportable in accordance with 10 CFR 50.72 or 10 CFR 50.73. This item will remain unresolved pending licensee completion and NRC review of the failure mechanisms and generic implications of the locking cup and bolt cracking concerns (UNR 50-423/93-008).

4.5 Plant Design Change Reviews - Unit 3 The inspection objective was to verify licensee commitments regarding review and approval of plant design change records (PDCR's). NRC report 50-336/92-36 documented licensee

commitments for review and approval of PDCR's. The inspector reviewed the following five (5) randomly selected Millstone Unit 3 PDCR's:

e PDCR 3-93-034, Reactor Cavity Seal Over the Reactor Annulus

.

e PDCR 3-91-075", Set Point Change for Relief Valves 3-S1H*RV8853A, *RV8851, and 'RV8853B e

PDCR 3-92-109, Motor Driven Auxiliary Feedwater Pump Trip Circuit Modification e

PDCR 3-92-096, Phase II, Alternative AC Diesel Generator Integration e

PDCR 3-93-023, IUTC Probe and Cable Replacement i

- PDCR short form pursuant to Administrative Control Procedure (ACP)-QA-3.10 step

'

4.1.5.

The inspector reviewed the PDCR's against the following two licensee commitments as documented in NRC report 50-336/92-36:

'

_

-

,_

__

.

-

. -

.

..

(1)

When the PDCR is presented to the Plant Operations Review Committee (PORC) for approval, the administrative control procedure requires the responsible engineer to identify procedure changes, preoperational training, and licensee / permit changes requiring approval prior to operation.

(2)

All Design Change Notices (DCN's) to PDCR's will require PORC approval prior to implementation. PORC will access the significance of the change and ensure the appropriate design change vehicle and reviews are being performed.

The inspector verified that, in the selected PDCR's procedmal changes, the operations critical drawing, the pre-operational training requirements, and the licensee / permit changes were identified prior to PORC approvals. The inspector learned that PORC approved PDCRs with DCNs prior to imp:ementation. The inspector noted that on May 7,1993, the Vice-President of Millstone station documented via an internal memorandum, a change in the commitment concerning DCN approvals. The change required PORC approval of DCNs prior to releasing the PDCR to operations, instead of prior to implementation.

The inspector also assessed the basis of the plant modifications, the technical evaluation scope, and the safety evaluation conclusions. Plant Design Change Review 3-91-075 replaced two (2) Rosemount differential pressure transmitters in the safety injection system.

The transmitters were initially subjected to an enhanced monitoring program pursuant to licensee procedure SP 3440R04, "Rosemount Transmitter Loss of Oil Monitoring Program."

The licensee's response to NRC Bulletin 90-01, Supplement 1 on March 4,1993 stated that the transmitters were removed from the enhanced monitoring program since their normal operating pressure was less than 500 psig. The inspector questioned licensee personnel on the " intent" of the enhanced monitoring program. Specifically, the transmitters are normally at atmospheric pressure; however, during periodic surveillance testing of the safety injection system, differential pressure could exceed 1500 psig. Rosemount transmitters with a normal operating pressure greater than 500 psig would require an enhanced monitoring program.

Resolution of this issue will be followed in conjunction with NRC review of NRC Bulletin 90-01 and tracked as open item 50-423/93-20-009.

The inspector also questioned the implementation of the PDCR short form for PDCR 3-91-075. Procedure ACP-QA-3.10, " Plant Design Change Records," allows a PDCR short form to be used if the change does not adversely affect system / component pressure or material compatibility. The modification raised the thermal relief valve setpoint from 1750 psig to 2235 psig. The inspector noted that the technical evaluation for this question appropriately evaluated pipe and pump stresses. The assigned engineer concluded that the change did not affect system / component pressure or material compatibility based on the technical evaluation, whereas the short form is intended to be completed without the benefit of a formal evaluation. The licensee was reevaluating the acceptability of a short form PDCR for this modification at the end of the inspection perio i

\\

.

j The inspector noted that the purpose of PDCR 3-92-109 was to remove a temporary modification that was part of corrective actions required by licensee event report (LER)87-004. The inspector discussed with licensee personnel his concern over having temporary modifications on engineered safety feature equipment in excess of six years. The inspector learned that the licensee adhered to the program requirements of procedure ACP-QA-2.06B,

.

" Jumper, Lifted Lead and Bypass Control," for the temporary modification depicted in documented corrective action for LER 50-423/87-004. The inspector noted the Unit Director has recently placed emphasis on reducing the number and age of temporary modifications.

The inspector noted that the licensee approved PDCR 3-92-096 without a process or procedure to specify quality assurance (QA) criteria for station blackout (SBO) equipment.

The assigned project engineer used fire protection QA criteria as a measure of acceptance.

The PDCR was approved based on the fire protection QA criteria. The project engineer said that once draft procedure NEO 5.26 is approved, a review of the quality control requirements for SBO equipment under PDCR 3-92-096 will be completed. The inspector considers this issue open pending the results of the licensee's review and will be tracked as open item 50-423/93-20-010.

The inspector noted that a good questioning attitude by the licensee's probabilistic risk

'

assessment (PRA) group resulted in a revision to the original safety evaluation for PDCR 3-

,92-096. The revision resulted in an integrated safety evaluation to review cabling effects

'

between the alternative AC generator and the reserve station service transformer.

l 4.6 Loose Parts and Monitoring System

,

The loose parts monitoring system (LPM) is designed to detect loose parts within the reactor coolant system (RCS). Detection is accomplished by accelerometers placed in specific locations to translate transient acoustic signals produced by loose part impacts. These i

impacts cause high frequency vibrations which are detected by the LPM system. These detections are recorded and alarmed in the control room to capture data for analysis.

A loose part in the RCS could result from a failed or weakened component or from an item inadvenently left in the system during refueling or maintenance. A loose part can contribute to component damage and material wear by frequent impacting with other parts in the j

system. Additionally, a loose part can pose a serious threat of partial flow blocking causing j

departure from nucleate boiling, increasing the potential for control rod jamming, or i

l increamd accumulation of radioactive crud in the primary system.

The LPM system consists of several externally mounted accelerometers located where loose parts are most likely to collect. This sensor generates a charge which is sent to a charge converter which transforms the signal to a voltage which is then amplified. This amplified voltage signal is sent to a signal conditioner which filters the signal for analysis and

-___

-___ _ _ _ _ _ _ _ _ _ _ _ _

'

.

recording. Cabling and grounding are electrically isolated from the signal and signal reference to maintain circuit integrity and reduce noise interference. The system includes audible and visual annunciation and automatic and manual signal recording.

RCS background noise masks the noise generated by loose part impacts, making the detection ofloose parts difficult. In addition, noise caused by hydraulically generated vibrations due to valve and pump operations must be considered., Therefore, system sensitivity must be set on the basis of background noise and to achieve a maximum sensitivity commensurate with

an acceptable false alarm rate. Impact signals do, however, provide significant information about the size of a loose part and the force and energy present. System design and

installation requirements are provided in NRC Regulatory Guide 1.133 and ASME Operation and Maintenance Standards and Guides, Chapter 12.

Unit 2 LPM System The inspector reviewed the design, installation, and testing of the Uni 2 LPM system. This review included procedures for funcdonal testing and calibration of the system, a walkdown of this system outside containment, recorded vibration data, and the plant design change record (PDCR) for the recently completed system redesign and upgrade.

During the last refuel outage, the licensee redesigned and upgraded the LPM system due to degraded equipment. This change was performed under PDCR 2-071-91 and involved the installation of upgraded sensors, conduit, cables, charge amplifiers,'and monitoring electronics in the control room. Design and installation of the system was performed in accordance with the guidance established in ASME OM-12 and subsequently Regulatory Guide 1.133. A test plan was established by the licensee to verify proper installation and calibration of the system for determining proper impact energy sensitivity.

The system consists of eight channels. The inspector reviewed recorded vibration data and noted the absence of any grounding noise, implied matched system impedance, and amplitudes within the band for detection ofimpact-like events required by the ASME-OM-12 standard. System design included an optoisolator on each output logic from the signal conditioner and shielded cable to provide isolation. Cable routing and penetrations were installed in accordance with the requirements presented in IEEE 317-1983, " Electrical Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations."

The inspector reviewed the manufacturer's specification sheet for determining power supply ratings and capabilities and found it to be adequately sized and configured for its application.

At the time of this inspection the licensee was investigating a loose part alarm received in the control room on September 17,1993. Investigation by the licensee of this alarm revealed the possibility of an isolation valve closing as the source of this recorded vibration. However, at this time the plant was operating on two reactor coolant pumps in lieu of the normal four pump opemtion at full power. The plant was in a shutdown condition during this time. The licensee is currently collecting a complete set of startup data beginning with two pump l

i

!

_

-

_.

-

__

_ _ _ _

.

_

__.. _

_

-

_

_,

i

'

.

,

L l

'

.

36 operation. Analysis of this data will be used to develop setpoints and determine the interface '

between primary plant equipment operation and LPM system signals. Discussions with operations personnel demonstrated a confidence in the system's reliability.

The inspector concluded that the LPM system provided good. detection of impact signais.

System design and capabilities were determined to be adequate. Procedures for performing :

j calibration and functionality of the system were found to be sufficient for verifying system operability. Based on this review, the inspector determined the LPM system was capable of '

performing its intended functions as described in the FSAR.

Unit 3 LPM System

'

A review was made of the' design and testing of the Unit 3 LPM system.-- This system consists of twelve channels for loose part detection.. Technical Specifications require that a :

q Special Report be submitted to the NRC 10 days following one or. more channels being-l declared inoperable for more than thirty days while in Mode 1 or 2. Based on several '

reports being issued by the licensee, PDCR number MP-92-106 was issued. ~ This PDCR involved a configuration upgrade that involved installing a new accelerometer. and cabling for.

channel number 10, removing two undocumented grounds in channel number 12, and new?

DC-to-DC converters to reduce high noise levels and false triggering of alarms.. These.

changes made the system comparable to the system installed at Unit 2. mW on these.

j I

changes, the licensee noted improved system performance. To further improve the LPMf

'

system performance, the licensee intends on replacing the preamplifier and respective input cable.

'

The inspector reviewed Surveillance Procedures SP-3451-R01 and -R11 for the channel'

!

functional test and calibration test, respectively, and Operating Procedure 3301H,- Revision 4, j

for placing the system in service following an alarm. ' The inspector concluded based on this l

review that procedures were adequate for testing the system and determining system operability.

j i

!

l The inspector concluded that the LPM system provided adequate detection of impact signals.

!

Procedures were foimd to be sufficient for verifying system operability.- mW on this

.

review, the inspector determined the LPM system was capable'of performing its intended ~

safety function.

'

5.0 SAFETY ASSESSMENT / QUALITY VERIFICATION (IP 40500,90712,92700)

5.1 Review of Written Reports The inspector reviewed periodic reports, special reports, 'and licensee event reports (LERs) '

for root cause and safety significance determinations and adequacy of corrective action. The inspectors determined whether fuither information was required and verified that the i

-

__

____ _ _ _ _ _ _ _ _ _ _

___________

________ _ _

_____

.

reporting requirements of 10 CFR 50.73, station administrative and operating procedures, and technical specifications 6.6 and 6.9 had beea met. The following reports and LER's were reviewed:

Unit 1 Monthly Operating Report dated September 9,1993 for August 1993.

.

e

'

Unit 2 Monthly Operating Report dated July,9,1993 for June 1993 e

Unit 2 Monthly Operating Report dated August 10, 1993 for July 1993 which aiso e

included a revised report for June 1993 Unit 2 Monthly Operating Report dated September 2,1993 for August 1993 e

Unit 3 Monthly Operating Report dated August 11,1993 for July,1993

Unit 3 Monthly Operating Report dated September 9,1993 for August 1993 e

LER 50-245/93-0940 reported the failure of valve 1-LP-9B to open during the e

performance of a surveillance test. This event was reviewed in NRC Inspection Report 50-245/93-19.

e LER 50-336/93-004-02 discussed two reactor trips on low steam generator level l

which were reviewed initially in Section 2.4 of NRC Inspection Report 50-336/93-03.

{

I During review of a subsequent LER update, documented in NRC Inspection Report 50-336/93-11, the inspector noted a discrepancy regarding the number of operators who had received additional training on steam generator level controls. This update corrected the discrepancy.

e LER 50-336/93-012-01 was an update to the original LER which discussed a turbine and reactor trip which occurred during thermal backwashing of the main condenser.

The event was reviewed in Section 2.2 of NRC Inspection Report 50-336/93-11. The update satisfied a licensee commitment to report, to the NRC, operation of the reactor building closed cooling water system above the design basis temperature limit established in the Unit 2 Final Safety Analysis Report.

LER 50-336/93-013 discussed a reactor trip on high pressurizer pressure which

occurred on June 3,1993. The event was reviewed in Section 2.4 of NRC Inspection Report 50-336/93-11.

e LER 50-336/93-015 discussed a plant shutdown due to feedwater block valve inoperability. The event is discussed in Section 2.4 of this report.

LERs 50-336/93-017 and 93-021 discussed operability of pressurizer power-operated e

relief valve block valves. The event was reviewed in Section 6.1 of NRC Inspection Report 50-336/92-27; Section 2.0 of NRC Inspection Report 50-336/93-13; and NRC Inspection Report 50-336/93-22.

i

!

_ _ - - _ _ _ _ _ _ - - - _. - - _

l

.

-

.

LER 50-336/93-018 discussed a shutdown required by technical specifications which

occurred on August 5,1993. The event involved excessive reactor coolant system unidentified leakage which resulted while attempting to repair a body-to-bonnet leak on charging and letdown system isolation valve 2-CH-442. The event was reviewed in NRC Inspection Report 50-336/93-18.

LER 50-336/93-019 discussed a reactor trip on low steam generator level which

occurred during plant startup on August 12, 1993. The event was reviewed in Section 2.3 of NRC Inspection Report 50-336/93-14.

LER 50-336/93-020 discussed a licensee determination that the vital switchgear room cooling and reactor building component cooling water systems were outside the plant design basis. The event was discussed in Section 3.3 of NRC Inspection Report 50-336/93-81; Section 2.2 of NRC Inspection Report 50-336/93-11; and i

Section 2.5 of this report.

LER 50-336/93-022 discussed auxiliary feedwater system seismicity and failure to

include pump suction piping with ASME Code Section XI inservice inspection i

'

program. The event is reviewed in Sections 2.2 and 2.3 of this report.

LER 50-423/93-12-00 dated September 3,1993 discussed the inoperability of the 'A'

service water system train due to construction debris. This event was discussed in

,

Inspection Report 50-423/93-15.

l

Safeguards Event Report 50-423/93-002-00 dated September 7,1993. This event was discussed in Inspection Report 50-423/93-15.

5.2 Turbine Building Secondary Closed Cooling Water System Pressure Boundary Integrity - Unit 1 (LER 50-245/93-007)

On June 23,1993, the licensee determined that a 3/4" branch line in the Turbine Building secondary closed cooling water (TBSCCW) system was non-quality assurance (QA) and non-seismic qualified downstream of its normally open isolation valve. The 3/4" branch line which ties into the TBSCCW system through normally open isolation valves provides a source of make-up water to maintain a keepfill function on the chilled water system return line from the HVAC-4 condensing unit. The HVAC-4 ventilation unit cools the switchgear area. The licensee postulated that, as a result of the normally open TBSCCW isolation valves (SC-169 and SC-183), the loss of pressure boundary integrity of this 3/4" piping during a seismic event, coupled with a loss of normal TBSCCW system make-up capability, could have resulted in a loss of the TBSCCW system. The TBSCCW system at Unit 1 provides cooling to the diesel generator coolers and equipment supporting the safety-related feedwater coolant injection syste *

.

The 4" TBSCCW supply and return piping headers to the HVAC-4 condensing unit were installed in 1981 as non-QA/non-seismic, with the normally open manual isolation valves being the boundary between the safety related and non-safety related portions of the TBSCCW system. The 3/4" branch line was part of this design change. The 4" piping headers were upgraded to QA, Category I status after evaluations and walkdowns of the 4" headers per I&E Bulletin 79-14, " Seismic Analysis for As-Built Safety-Related Piping Systems," program requirements. Since the Bulletin did not address piping under 2 and 1/2", the 3/4" branch line was not evaluated. At the time of this design change, operator action was credited with being able to isolate the non-safety related portion of the safety related system. Since 1981, the licensee has upgraded the plant design change process, as well as the safety related/non safety related piping / equipment interface isolatica criteria. As a result, the licensee no longer takes credit for operator action to isolate non-safety related portions of safety related systems.

The licensee discovered this safety /non-safety related interface problem as a result of a Material Equipment Parts List (MEPL) system boundary evaluation. The MEPL and Bill of Material lists are being reviewed and updated as part of Performance Enhancement Program (PEP) Action Plan 4.1.1. The currently used data bases will be integrated into the Production Maintenance Management System (PMMS). As a result of the MEPL system boundary evaluation, the licensee generated a Reportability Evaluation Form (REF) to review the pressure boundary integrity of the TBSCCW system. This review (REF 93-11) led to the inoperability determination on June 23,1993, as documented by LER 93-07. The inspector reviewed the REF and determined its scope was sufficient to ensure the pressure boundary integrity of the TBSCCW system would be verified.

The inspector reviewed the immediate corrective actions related to this event. The LER stated that valve SC-184 was closed to isolate the non-safety related chill water system from the safety-related TBSCCW system. The valve is being controlled in the closed position via the station tagging system. The inspector verified the valve position and tag and determined that they were acceptable.

The inspector reviewed the licensee's procedure for plant design changes (NEO 3.03). The procedure requires a seismic qualification review be performed in accordance with NEO 5.19, " Seismic Qualification Review." NEO 3.03 also asks the question: Does this plant

!

design change involve systems, components, or structures that are: QA Category I, Radwaste QA, Fire Protection QA, or ATWS QA7 It also requires the project engineer to determine if the change contains boundary points between QA and non-QA sections of the system. The l

inspector concluded that NEO 3.03 is adequate in determining if a safety /non-safety boundary

is involved in a design change and could prevent a safety related/non-safety related interface problem from occurring in the future.

-

.

,

l

.

Through discussions with the licensee and review of LER 93-07, REF 93-11, PEP Action i

Plan 4.1.1, and the applicable procedures, the inspector determined that the current procedures and ongoing corrective actions were acceptable and should ensure the pressure boundary integrity of the TBSCCW system.

The licensee is utilizing a contractor to review other small bore piping to ensure similar safety related/non safety related interface deficiencies do not exist. This review is scheduled for completion by November 1993.

Overall, the inspector considered the licensee's corrective action to be acceptable. The inspector noted that if the non seismic branch connection failed during a seismic event, licensee personnel would have been informed of this event by a low level alarm in the TBSCCW system expansion tank. Although the leak rate from the connection may exceed the TBSCCW makeup capability, operators would have been alerted to the low TBSCCW level and would have time to take other compensatory actions, i.e., isolate the leak.

Therefore, the discovery is of minor safety significance. Enforcement discretion was exercised in accordance with Section VII.B of the NRC Enforcement Policy.

5.3 Evaluation ofIndustry Experience The inspector became aware of a concern which existed at another facility which involved the operability of the plant emergency diesel generators. The specific concern involved the proper reset of the mechanical trip mechanism for the fuel racks on a Fairbanks Morse diesel generator following a surveillance test. At the other facility, the diesel generator trip mechanism was not properly latched which rendered the diesel generator inoperable for an extended period of time. Since Millstone Unit I has a similarly constructed diesel, the inspector reviewed the issue for applicability to Millstone Unit 1.

The inspector discussed the potential for improper setting of the trip mechanism with the Unit 1 diesel system engineer. The inspector noted that the engineer was already aware of the issue through review of industry information event reports. The engineer informed the inspector that he tried to replicate the incorrect placement of the mechanism at a Fairbanks Morse diesel generator school which he had recently attended but was unable to due so.

Therefore, the engineer concluded that the event was unlikely to occur at Millstone Unit 1.

However, through subsequent conversations with the engineer, it was determined that the Unit I diesel generator surveillance procedure would be modified to include a caution step to reverify,% ' rip mechanism is properly set following a surveillance test. The inspector

concludec dis was an example where the licensee was aware of industry events, had performed an wequate investigation, and was taking appropriate actions.

1

-

_

_ _

__

_

.-

__

,

___

_

_ _. - - -

,

_

'

.

e4 l

l

- ]

5.4 Safety Evaluation Review - Unit 1 Introduction

'

During this inspection, the licensee's program for performing plant changes,~ tests, and experiments, under the provisions of 10 CFR 50.59, Changes, Tests and Experiments,= was -

reviewed for Unit 1. The inspector reviewed aspects of the program including procedures and specific examples of 10 CFR 50.59 determinations.

,

Procedures

,

i The licensee has established formal procedural guidance and controls to evaluate each'.

l change, test, and experiment (CTE), for which 10 CPR 30.59 is applicable, and to ' determine whether an unreviewed safety question (USQ) exists or a change to the Technical

~

Specifications is required. The licensee bases the determ* ation on an assessment of the -

~i m

impact of the proposed CTE according to the criteria of 10 CFR 50.59. Formal procedum j

guidance is contained in Administrative Control Procedure (ACP), ACP-QA-3.08, " Safety:

_

Evaluations (NEO 3.12)," and in Departmental Instruction No.1-ENG-1.13,." Format for j

Safety Evaluations." These procedures contain safety evaluation formats which enable the.

!

preparer to address the 10 CFR 50.59(a)(2) criteria by asking the seven questions fmm NSAC-125.

,

The licensee has established a process to determine if a safety evaluation is needed for all.

j proposed plant design changes;' jumper, lifted lead, and bypass control changes; setpo' t--

_ _

!

m changes; and station procedure changes. Procedure ACP-QA-3.10,." Preparation Review and l

Disposition of Plant Design Change Records PDCRs (NEO 3.03)," provides formal :

ll procedural guidance for determining if a safety evaluation or an integrated safety evaluation

must be performed per procedure ACP-QA-3.08 for plant design changes. Jumper, lifted

'

lead and bypass control changes are addressed in procedure ACP-QA-2.06B, " Jumper, Lifted l

Lead, and Bypass Control Changes." For these changes, a safety evaluation must be.

,

performed per procedure ACP-QA-3.08 if any technical and safety assessment questions on -

the jumper device control sheet are answered "yes" or " don't know." Setpoint change evaluations have been incorporated into procedure ACP-QA-3.10 and now undergo the same ~

process as PDCRs. Procedure changes are addressed in procedure NEO 8.06, " Safety ?

Evaluations for Station Procedures." Changes to test procedures are also covered under-i procedure NEO 8.06.

During the 10 CFR 50.59 inspection conducted from December 7 to December 11,1992, the inspector noted that procedure ACP-QA-3.10 allows the licensee to complete either a lorag-form or short-form PDCR. Short-form PDCRs are utilized for simple changes oflimitcd scope and may or may not require a safety evaluation to be written. : At that time, the -

.

inspector noted that in some instances, the licensee answered all the questions to whether a

_

safety evaluation should be written "no", but in some instances, still wrote a safety -

evaluation. Although this was not a safety concern, it did point to the adequacy of the :

,

- - -,-

-

.

k

, - -.

. _.,

m

-.

.

,

w w

w

.+

w

,mw -

'

.

..

.

b

questions in the short-form. During the December 1992 inspection, the licensee stated that it had formed a review team which was looking at this issue in a wider sense, specifically, when should a safety evaluation be written for any change. During this inspection, the inspector inquired about the status of the review team. The licensee's internal commitment to complete the review is March 1994. The inspector considers this a good initiative and will review the team's findings during a future inspection.

In summary, the inspector verified that the licensee has established formal procedural guidance and controls to evaluate each CTE, for which 10 CFR 50.59 is applicable, to determine whether an USQ exists or a change to the Technical Specifications is required.

The inspector concluded that adequate guidance exists and that the licensee's initiative to further define the quality of written safety evaluations is needed to improve the overall process.

Reviews of 10 CFR 50.59 Determinations The inspector selected specific examples of 10 CFR 50.59 determinations from those reported to the NRC by letter dated February 26,1993. This letter transmitt:d the NNECO's annual report of plant changes and tests for 1992. Safety Evaluations were reviewed from each change category (PDCRs, procedure changes, jumper, lifted lead and bypass changes, and tests).

The inspector determined that all the reviewed safety evaluations complied with the requirements of 10 CFR 50.59. The inspector did note, however, that one procedural change and two jumper, lifted lead and bypass control changes could have been enhanced to answer one or two of the seven questions pertaining to 10 CFR 50.59 more completely.

However, the overall conclusion of the safety evaluations were adequate in determining whether an USQ existed.

Conclusion The inspector concluded that Unit I complies with the evaluation process of 10 CFR 50.59 for changes, tests, and experiments. No immediate safety significant concerns were identified and the inspector noted continued licensee attention to the overall 10 CFR 50.59 process. Licensee performance in this area will continue to be reviewed as part of future 10 CFR 50.59 and resident safety inspections.

5.5 Independent Safety Engineering Group The inspection objective was to gather information to assist the NRC in determining whether Independent Safety Engineering Groups (ISEGs) have been effective in improving unit safety and to determine if there would be any significant adverse safety impact in allowing licensees to discontinue the function. As an input to assist in making this determination, a survey (Attachment 1) was performed for all utilities who perform an "ISEG-like" function.

l l

i

. -

!

'

..

.

6.0 MANAGEMENT MEETINGS Periodic meetings were held with various managers to discuss the inspection findings during the inspection period. Following the inspection, an exit meeting was held on November 15, 1993, to discuss the inspection findings and observations with station management. Licensee comments concerning the issues in this report were documented in the applicable report section. No proprietary information was covered within the scope of the inspection. No written material regarding the inspection findings was given to the licensee during the inspection.

l

'...

~

ATTACHMENT

)

SURVEY OF INDEPENDENT SAFETY ENGINEERING EFFECTIVENESS j

)

l 1. Detestnine which licensees have ISEGs (or other groups / organizations that are l

"1SEG-like" - e.g., review groups that are independent of the line organization and

)

composed primarily of technicalindividuals.

]

.:

Millstone Unit 3 does have an ISEG. This group, as required by technical specification, is to be composed of a minimum of four full-time individuals. Unit 3's ISEG presently is

)

composed of five full time employee's. The present ISEG does on occasion review issues for the other Millstone units. The licensee is considering additional individuals who's sole

responsibilities would be to focus on assessing the performance of the other Millstone units.

j i

2. Determine if there is an adequate basis to judge the effectiveness of the organization in enhancing safety and licensee performance.- The " yardstick" that we should use to j

measure the effectiveness should consider the following attributes:

l I

a.

Is ISEG looking at the right (significant events, both in-plant and across the

-

industry; significant modifications for improving, safe plant operation; etc.)

Issues?

The inspector reviewed the ISEG evaluation reports for 1991,1992, and 1993 and noted that a high number of topics for review were perceived area's of weakness that

_

.

had been identified by the licensee and NRC. Most of the areas evaluated originated i

from management request. The ISEG does not programmatically review' NRC issuances, licensee event reports, or plant incident reports. Another Nuclear Safety l

Engineering (NSE) group (an ISEG-like organization) reviews these reports and

{

conveys any programmatic concerns to be reviewed to'the ISEG. An example of issues that have been reviewed by ISEG included: engineering backlog, the ability for the Unit to handle potential transformer failures, human error events, inter-system LOCA, and shutdown risk.

b.

Are ISEG products in a form that is useful to the line organization and well done? Are recommendations sound and properly justified?

The inspector determined through review of the reports and discussions with various licensee managers that the evaluation reports issued by the ISEG were of high quality

,

and in a form that is useful to the line organization. The purpose of the report and the recommendations were clearly stated and justified by observations made by the j

group.

i l

.-

-

--

-

u

'

...

.

.~

Attachment

c.

Is ISEG respected by the line organization? Are recommendations implemented?

Are ISEG opinions welcome? Is it truly independent of the line organization and traditional QA functions / organizations?

A review of ISEG report E92-009, "Self-Assessments," revealed that nearly all of ISEG's customers appreciated ISEG's independent perspective and viewed it as a beneficial contributor to overall plant safety. The inspector questioned various plant managers on their opinion of ISEG and was informed that ISEG's function is necessary, however, one manager stated that they believed that the function could be included under the QA umbrella.

Most of ISEGs recommendations have been implemented. The ISEG has recently

,

I begun to track all their recommendations; in the past, only nuclear safety-related concerns had been tracked for implementation. After an ISEG report is issued, a

.

!

controlled routing is opened and the station vice president sets a priority for

,.

implementation. The controlled routing remains open until the ISEG group has j

reviewed and concurred in the method of implementation. A semi-annual report is issued to the station vice president for those recommendations that haven't been implemented and are past the specified controlled routing date.

I The N3" group (including ISEG) and line organizations report to different vice i

presidents. The NSE, QC, and QA managers report to the same manager.

,

d.

Is ISEG performance / contribution recognized in a positive light by outside entities (INPO/NRC/other)?

NRC IR 50-423/92-04 stated that the ISEG contributed to safe operation of MP3.

The inspector considers this to still be the case.

e.

Is ISEG sought out by the plant organization to participate in special assignments / activities (e.g..." playing" in annual EP exercise)?

The ISEG has participated in various special assignments such as the PEO falsification of logs issue, S/D risk assessment, reportability evaluation process, and the Unit 2 letdown isolation valve 2-CH-442 root cause investigation.

f.

Does the Une organization proactively request ISEG to investigate issues and provide thezu feedback?

>

Unit 3 managers and the other Millstone Station managers have requested ISEG to investigate issues. A high percentage of issues investigated were originated because of management request.

v t e Inspection Report - Millstone - 1993024
80 \| 81 \| 82 \| 83 \| 84 \| 85 \| 86 \| 87 \| 88 \| 89 \| 90 \| 91 \| 92 \| 93 \| 94 \| 95 \| 96 \| 97 \| 98 \| 99 00 \| 01 \| 02 \| 03 \| 04 \| 05 \| 06 \| 07 \| 08 \| 09 \| 10 \| 11 \| 12 \| 13 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24 \|
1993 Quarterly Integrated 1Q (0) 2Q (0) 3Q (0) 4Q (0) Assessments Mid Cycle End of Cycle 23(0) 7(0) 8(0) 9(0) 10(0) 11(0) 12(0) 13(0) 14(0) 15(0) 16(0) 17(0) 18(0) 19(0) 20(0) 21(0) 22(0) 23(0) 24(0) 25(0) 26(0) 28(0) 80(0) 12(0) 18(0) 21(0) 81(0) 11(0) 16(0) 24(0) Security Operator Exams Emergency Planning Other

IR 05000245/1993024

Text

REGION I

Navigation menu

Search