IR 05000282/1999007
| ML20212J623 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 09/28/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20212J616 | List: |
| References | |
| 50-282-99-07, 50-306-99-07, NUDOCS 9910050220 | |
| Download: ML20212J623 (21) | |
Text
,
.
- .
r
!
U.S. NUCLEAR REGULATORY COMMISSION i
REGIONlli Docket Nos:
50-282, 50-306 License Nos:
50-282/99007(DRP); 50-306/99007(DRP)
Licensee:
Northern States Power Company Facility:
Prairie island Nuclear Generating Plant Location:
1717 Wakonade Drive East Welch, MN 550B9 Dates:
July 21 through August 31,1999 Inspectors:
S. Ray, Senior Resident inspector S. Burton, Senior Resident inspector, Monticello P. Krohn, Resident inspector S. Thomas, Resident inspector Approved by:
Roger Lanksbury, Chief Reactor Projects Branch 5 Division of Reactor Projects
,
9910050220 990928 PDR ADOCK 05000292 C
'
!
.
SUMMARY OF FINDINGS Prairie Island Nuclear Generating Plant, Units 1 & 2 NRC Inspection Report 50-282/99007(DRP); 50-306/99007(DRP)
The report covers a 6-week period of resident inspection and a followup Year 2000 readiness review conducted under Temporary Instruction 2515/141.
Inspection findings were evaluated according to their potential significance for safety, using the NRC's Significance Determination Process, and assigning colors of GREEN, WHITE, YELLOW, or RED. GREEN findings are indicative of issues that, while they may not be desirable, represent little effect on safety. WHITE findings indicate issues with some increased importance to safety, which may require additional NRC inspections. YELLOW findings are more serious issues with an even higher potential to affect safe performance and would require the NRC to take additional actions. RED findings represent an unacceptable loss of margin to safety and would result in the NRC taking significant actions that could include ordering the plant shut downc Those findings that cannot be evaluated for a direct effect on safety with the Significance Determination Process, such as those findings that affect the NRC's ability to oversee licensees, are not assigned a color.
i Cornerstone: Mitigating Systems
'
o To Be Determined. On August 12,1999, the licensee discovered that the doors to the 121 and 122 control room chiller rooms may never have been able to withstand a high-energy line break on either unit because the locking pins were inadequately designed. Failure of the doors could have resulted in the Unit 1/ Unit 2 control room special ventilation system being unable to maintain a habitable environment in the control room, requiring a control room evacuation, j
and in spurious operation or disabling of mitigating system equipment. This was considered a potentially risk significant finding for both units pending completion of Phase Three of the Significance Determination Process and was considered an apparent violation of Technical Specification 3.13.A, " Control Room Special Ventilation System." (Section 40A3)
GREEN. The inspectors identified that the licensee installed a substitute e
deadbolt locking mechanism on the 121 and 122 control room chiller room doors on July 30,1999, as a permanent modification and without preparing a formal design or modification package or performing calculations to verify that the deadbolts were the functional equivalent to the installed door locking mechanisms. Following questions by the inspectors on what engineering basis existed to demonstrate functional equivalence of the door bolts analysis by the licensee revealed that the deadbolts, as installed, were inadequate to perform their intended function to withstand a high energy line break. Failure of the deadbolts could have resulted in the control room special ventilation system being unable to maintain a habitable environme.it in the control room, requiring a control room evacuation, and in spurious operation or disabling of mitigating
'
system equipment. The finding was considered to be of low risk significance because the inspectors questioned the licensee's basis for the use of the deadbolts to establish operability of the doors prior to the need to do so. The inspectors identified a non-cited violation (NCV), assigned to both units, in the area of design control. (Section 1R03)
.'
..
.
e -
GREEN. The inspectors identified that an inadequate review of the temporary procedure change regarding the installation of deadbolts on the 121 and j
122 control room chiller room doors resulted in the approval and incorporation of the change into a procedure on July 30,1999. The procedure change could have led to a violation of Technical Specifications or operability requirements and the false belief that the doors would perform their intended safety function of withstanding a high-energy line break. Reliance on the deadbolts for operability could have resulted in the control room special ventilation system being unable to maintain a habitable environment in the control room, requiring a control room evacuation, and in spurious operation or disabling of mitigating system equipment. The finding was considered to be of low risk significance because the inspectors questioned the licensee's basis for the use of the deadbolts prior to the use of the temporary procedure change to establish operability. The inspectors identified an NCV, assigned to both Units, in the area of inadequate I
implementation of the licensee's temporary procedure change process.
l (Section 1R03)
l l
e GREEN. The inspectors identified that inadequate planning and control of Unit 1, D2 diesel generator work performed on August 23,1999, resulted in the diesel being out-of-service for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 20 minutes when the work should have taken only about 30 minutes. While the diesel was out-of-service, the core damage frequency was estimated to have increased slightly from 2.07E-5 per year to 3.01E-5 per year due to the increased probability of a loss of alternating current power. Thunderstorms passed through the area during the time the diesel was inoperable increasing the possibility of a loss of offsite power. While the overall change in risk was not significant, the increase was the result of a lack of risk sensitivity by the licensee's staff on the impact of work on safety-related equipment and inadequate planning. The finding was considered to be of low risk significance because only one train was affected and it was out-of-service for a shorter time than allowed by Technical Specifications.
(Section 1R13.1)
l i
l Cornerstone: Barrier Integrity I
i
'
GREEN. The licensee had previously identified, as reported in Licensee Event e
Report 1-99-05, that maintenance workers had moved the reactor upper internals over the open, fueled reactor vessel without prior isolation of the containment inservice purge system as required by procedure. The error could have led to a radioactive material release to the environment in the event that the load dropped onto the fuel. The NRC determined that the finding was of s. Msk significance due to a low estimated initiating event frequency, short exposure time, operability of two trains of mitigating equipment, and credit for manual actions, if necessary. The inspectors identified an NCV, assigned to Unit 1
,
regarding improper procedure implementation. (Section 40A4.1)
GREEN. The licensee had previously identified, as reported in Licensee Event e
Report 1-99-04, that surveillance testing of the spent fuel pool special ventilation system had been inadequate in that it did not verify that the containment inservice purge system would automatically isolate as required on high radiation from a fuel handling event in the spent fuel pool. Failure to isolate the system could have led to a radioactive material release to the environment in the case of
l
,
.
-
.
(
!
a fuel handling accident. Later testing proved that the isolation function w'rked I
for Unit 1. The function had not yet been tested for Unit 2. The NRC determined that the finding was of low risk significance due to a low estimated initiating event frequency, high probability that the system will prove to be operable for Unit 2, and credit for manual actions, if necessary. The inspectors identified an NCV, assigned to both Units, regarding failure to meet the surveillance test i
requirements of Technical Specification 4.15. (Section 40A4.2)
Performance Indicators Verification Cornerstone: Initiating Events Unplanned Scrams per 7000 Critical Hours. The inspectors verified that the i
licensee had properly reported the performance indicator for this comerstone for the time period covering the second quarter of 1998 through the end of the second quarter of 1999.
e Scrams With Loss of Normal Heat Removal. The inspectors verified that the i
licensee had properly reported the performance indicator for this comerstone for the time period covering the third quarter of 1996 through the end of the second i
l quarter of 1999.
i I
l
.
Report Details During this inspection period, both units operated at or near full power with the exception that Unit 1 was brought to about 50 percent power on August 28,1999, for turbine valve testing.
The Unit was returned to full power on August 29,1999.
. 1.
REACTOR SAFETY
._ Cornerstones: initiating Events, Mitigating Systems, and Barrier Integrity 1R03 Emeroent Work
.1 Installation of Deadbolts on the 121 and 122 Control Room Chiller Room Doors
- c.
Inspection Scope The inspectors reviewed the adequacy of the work control and engineering evaluation processes utilized to install deadbolts on the 121 and 122 control room chiller room doors.
d.
Observations and Findings The inspectors identified two non-cited violations (NCVs): one NCV for installing locking mechanisms on control room chiller room doors without preparing a formal design or modification package or performing functional equivalency calculations, which was contrary to Criterion ill, " Design Control," of Appendix B,10 CFR Part 50; and a second NCV for a failure to properly implement the temporary change procedure, which was contrary to Criterion V, " Instructions, Procedures, and Drawings," of Appendix B, 10 CFR Part 50.
On July 29,1999, the licensee reported an event from July 27 regarding the failure of a latch pin which was used to maintain closed one door of a two-door set to the 122 control room chiller room. The two-door set was made up of one passive door, and one active door that allowed access to the room. The passive door latch pin failure was subsequently repaired by installing a new lower latching mechanism. The latch pin failure, repair, and risk significance are discussed further in Section 40A3.
Since this was the second similar failure of latching pins associated with that door within the last month (see NRC inspection Report 50-282/99006(DRP); 50-306/99006(DRP)),
J the licensee chose to install a deadbolt on each passive door to the control room chiller
'
rooms, which would be used as a backup to restore operability, should any of the doors'
installed latch pins fail again, in parallel with the repairs, Temporary Change Notice (TCN) 1999-1096 to Maintenance Procedure D54, " Control of Openings in the
Auxiliary Building Special Ventilation Boundary," Revision 9, was prepared to provide j
instructions to plant operators on when and how to use the new deadbolts.
On July 30,1999, during the installation of the deadbolts, the inspectors questioned the completeness of the design package used to install this minor modification. The inspectors discovered that the TCN to D54 was issued prior to the deadbolts actually being installed, During the TCN process, senior engineers, a system engineer, and a senior shift manager were involved in the preparation, review and/or approval of the
. change and did not question the operability of the deadbolts. Additionally, the
I
-
..
inspectors also leamed that no formal design change package had been prepared for the modification, and no calculations were performed to determine functionality of the deadbolts. After the inspectors inquired about the operability of the deadbolts, fomial calculations were begun to verify the deadbolts' adequacy as a replacement for the installed latch pins. The installation of the deadbolts was completed later in the aftemoon of July 30.
On August 3,1999, licensee engineers informed the inspectors that the calculations performed to verify the adequacy of the deadbolts revealed that the deadbolts could fait during a high-energy line break event. The most likely failure mechanism would be due to bending stresses, but failure could also occur due to shear stresses or failure of the screws attaching the deadbolts to the door. The licensee promptly deleted the TCN from the D54 procedure. Because the inspectors questioned the use of the deadbolts prior to a need for them occurring they were never actually relied upon to restore operability to the 121 or 122 control room chiller room doore.
During subsequent discussions with the general superintendent of engineering and the superintendent of mechanical systems and programs engineering, the inspectors leamed that their expectation was that, as a minimum, a Substitute Pad / Component Equivalency evaluation should have been performed for the use of the deadbolts prior to installation.
Appendix B, Criterion lil, " Design Control," of 10 CFR Part 50 required, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that were essential to the safety-related functions of structures, systems, and components. Contrary to this, on July 30,1999, the licensee installed deadbolt locking mechanisms on the 121 and 122 control room chiller room doors without preparing a formal design or modification package or performing any calculations to verify that the deadbolts were the functional equivalent of the installed latch pins. This violation is being treated as a NCV, consistent with Appendix C of the NRC Enforcement Policy (50-282/99007-01(DRP);
50-306/99007-01(DRP)). This issue was in the licensee's corrective action program as Nonconformance Report 19992300.
The inspectors performed a risk significance screening of this issue in accordance with NRC Inspection Manual Chapter 06XX, " Significance Determination Process." Since the inadequate deadbolts were never relied upon to restore operability to the control room chiller room doors, the issue screened out from further review and was considered to be within the licensee response band (GREEN). The finding was assigned to the mitigation system comerstone for both Unit 1 and Unit 2.
Appendix B, Criterion V, " Instructions, Procedures, and Drawings,"of 10 CFR Part 50 required, in part, that activities affecting quality be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and be accomplished in accordance with these instructions, procedures, or drawings. Contrary to this, on July 30,1999, the licensee failed to property implement Administrative Work
' Instruction 5 awl 1.5.10, " Procedure Temporary Changes," a procedure affecting quality.. Specifically, prior to the issuance of TCN 1999-1096, the TCN approver did not j
adequately perform Step 6.3.9.c.1. That step, in part, directed the person responsible j
for approving the procedure temporary change to ensure that the change would not cause a violation of Technical Specifications (TSs) or other operability requirements.
i
l
I
.
l l
The procedure change could have led to a violation of TSs or operability requirements (
and the false belief that the doors would perform their intended safety function of l
withstanding a high energy line break. Reliance on the deadbolts for operability could have resulted in the control room special ventilation system being unable to maintain a
'
habitable environment in the control room, requiring a control room evacuation, and in spurious operation or disabling of mitigating system equipment. This violation is being treated as a NCV, consistent with Appendix C of the NRC Enforcement Policy (50-282/99007-02(DRP); 50-306/99007-02(DRP)). This issue was in the licensee's corrective action program as Nonconformance Report 19992300.
l The inspectors performed a risk significance screening of this issue in accordance with
' NRC Inspection Manual Chapter 06XX, " Significance Determination Process." Since the temporary change notice was never relied upon to restore the operability of the control room chiller doors, the issue screened out from further review and was considered to be within the licensee response band (GREEN).' The finding was assigned to the mitigation cornerstone for both Units 1 and 2.
The licensee was working on a formal design package to install new deadbolts on the control room chiller room doors. The design change was to include using larger deadbolts, installing them in a different location to minimize shearing and bending l
stresses _on the bolts, and modifying the manner in which the deadbolts were attached to the doors.
.2 Other Emeroent Work Activities a.
Inspection Scope
,
The inspectors reviewed and observed the following emergent work activities:
Work Order 9908077, " Investigate Problem with Steam Exclusion Circuitry"; and e
Work Order 9908297, " Emergency Response Computer System Remote e
Multiplexing Unit Power Supply Failure."
b.
Observations and Findinos There were no findings identified and documented during this inspection.
!
!
1R04 Eauloment Alionment a.
Insoection Scooe The inspectors performed a partial walkdown of the 121 control room special ventilation system while the 122 control room special ventilation system was out-of-service for the performance of preventive maintenance in accordance with Preventive Maintenance (PM) Procedure PM 3147-2-122, "122 Control Room Air Handler Annual inspection " Revision 12.
b.
Observations and Findinos There were no findings identified and documented during this inspection.
i
i
!
L
- ..
...
I
.1R05 Fire Protection a.
Insoection Scooe The inspectors walked down selected, risk-significant areas looking for any fire
. protection issues related to the control of transient combustibles, ignition sources, fire detection equipment, manual and autornatic suppression capabilities, and barriers to fire propagation. The following areas were examined:
c'
plant screenhouse, motor-driven and diesel-driven fire pump areas;
12 and 22 diesel-driven cooling water pump rooms; e
turbine building oil storage area; e
auxiliary feedwater pump rooms and remote shutdown panel areas; safety injection and containment spray pump rooms; and e
radiological waste building and barrel storage areas, b.
Observations and Findinas
.There were no findings identified and documented during this inspection.
1R09 Inservice Testina a.
Inspection Scope The inspectors reviewed the following procedures and observed the associated
- inservice tests:
Surveillance Procedure (SP) 2355A, 'AFW [ auxiliary feedwater] Pumps Suction w
Check Valves Quarterly Function Test," Revision 2; and
SP 2090, " Containment Spray Pump and Spray Additive Valve Quarterly Test,"
Revision 47.
b.
Observations and Findinos There were no findings identified and documented during this inspection.
- 1R10 Laroe Containment Valves a.
Inspection Scope The inspectors reviewed the following procedures and observed the performance of the associated local leak rate tests of large containment isolation valves:
SP 1132, * Unit 1 Personnel and Maintenance Airlock Door Seal Test,"
]
Revision 21; and.-
'
,
I L
~
7 '
-
.
SP 2132, " Unit 2 Personnel and Maintenance Airlock Door Seal Test,"
e-Revision 22.
b.
Observations and Findinas There were no findings identified and documented during this inspection.
1R11 Licensed Operator Reaualification a.
Inspection Scope The inspectors observed the performance of a training crew during a simulator exercise scenario which included a bomb threat, loss of electrical buses, and a loss of coolant accident.
b.
Observations and Findinas There were no findings identified and documented during this inspection.
1R12 Nlaintenance Rule implementation a.
Inspection Scope The inspectors reviewed the licensee implementation of the maintenance rule requirements, including a review of scoping, goal-setting and performance monitoring, short-term and long-term corrective actions, and current equipment performance status, for the following components and systems:
e 121 motor-driven fire pump; and e
12 and 22 diesel-driven cooling water pumps.
b.
Observations and Findinas
- There were no findings identified and documented during this inspection.
1R13 Maintenance Work Prioniketion
.1 D2 Diesel Generator Work a.'
insoection Scooe -
The inspectors observed the control and performance of preventive maintenance conducted in accordance with PM 3001-1-D2, "D2 Diesel Generator 6-Month Inspection," Revision 5.
b.-
Observations and Findinas The inspectors performed a risk significance screening of unnecessary out-of-service time for one of the emergency diesel generators. The issue was screened out from
. further review.
.
.
The inspectors noted that for the D2 inspection performed on August 23,1999, the work was not listed on the Weekly Planning Meeting Results schedule for the week. That schedule normally listed all significant work and provided the risk profile for the week.
The PM was listed on the Unit 1 Daily Plan for the day, but it was not noted that the diesel generator would be removed from service for the work. However, the D2 diesel generator was removed from service for the work at 8:15 a.m. in accordance with
!
PM 3001-1-D2, Steps 7.1 and 7.2.
The inspectors questioned the maintenance scheduler and risk analyst involved in planning the week's work and were informed that during the planning meeting the i
previous week, a maintenance supervisor had incorrectly stated that the PM did not involve taking the diesel out-of-service. Because of that misinformation, the risk profile for the week was not properly characterized. The Unit 1 core damage frequency l
estimate, shown as the baseline value of 2.07E-5 for the entire week, should have been shown as 3.01E-5 when D2 was inoperable, due to the increased risk of loss of
'
alternating current power.
The Unit i shift supervisor had also noted that the PM required that the diesel be removed from service despite the information not being in the schedule. The operators properly implemented the TS requirements including performing the required verification of availability of offsite power sources, the D1 diesel generator, and A train equipment.
The actual activity, performed in accordance with PM 3001-1-D2, consisted of simply sampling and replacing the D2 generator bearing oil (less than two liters). The l
inspectors observed that the maintenance workers had finished replacing the oil by about 9:30 a.m. but they did not bring the work order to the control room so that the diesel could be retumed to service until about 10:30 a.m. Other minor maintenance jobs were being accomplished at the same time on the diesel, but PM 3001-1-D2 was the only one that required the diesel to be removed from service. The maintenance workers were apparently unaware that their job was the critical path to restoring operability until they were contacted by the shift supervisor.
Overall, the D2 diesel generator was inoperable for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 20 minutes when efficient performance of the work should have taken no more than about 30 minutes.
The risk from this issue was probably somewhat higher than the risk profile estimate of 3.01E-5 because thunderstorms passed through the area while the diesel was inoperable, increasing the possibility of a loss of offsite power.
i
,
The inspectors performed a risk significance screening of the unnecessary out-of-service time in accordance with NRC Inspection Manual Chapter 06XX, " Significance
Determination Process." Since the D2 diesel generator outage affected only a single
trein of a multiple train mitigating system and the train was inoperable for only a small portion of the TS allowed outage time, the issue was screened out from further review and was considered to be within the licensee's response band (GREEN). The finding
,
was assigned to the mitigation system comerstone for Unit 1.
Failure to properly characterize the risk of the dieiel maintenance in the weekly risk
,
profile demonstrated a weakness in the maintenance planning process, but was
,
considered a minor issue. The outage manager submitted Employee Observation Form 19992518 to document the error in the weekly and daily schedules and the fact that the outage time was not well planned or controlled.
p
?'
\\
.
l
!-
'
u=htenance Work Prioritiration
>
.2 O_ther t risk and configuration control
. IDscar* ion Scoon l
The inspectors reviewed the licensee's evaluation of p an c. -
i iti :
associated with the following maintenance act v es t ly FunctionTest,"
SP 2355A,"AFW Pumps Suction Check Valves Quar er Revision 2; and ditive Valve Quarterly Test,"
SP 2090," Containment Spray Pump and Spray Ad
,
,
e Revision 47.
. _ Observations and FindElsi i
thisinspection.
.
There were no findings identified and documented dur ng b.
1R15 Ooerability Eva!uationg
.
Inanection Scoon l ations:
The inspectors reviewed the following operability eva u a.
t-ture Evaluation";
Safety Evaluation 244, " Cooling Water inlet Tempera ilit of Door 182 (Unit 2 Nonconformance Report 19992364,"PotentialInop'
e Auxiliary Building to Fuel Handling Building Area 2" e
Mechanisrn."
E Ohnemations_and Findinnaidentified and documented d b.
,
. There were no findings
.
1R16 OperatorWorkarounds
!
I Inspection Scope k rounds (OWAs)toidentify any The inspectors reviewed the following operator wor a a.
j tems:
potential effect on the function of mitigating sys L velRecordersRequire t
OWA 19992519," Steam Generator Wide Range e L
V l e";
Constant Operator Attention and Provide Little a u l
e Levelincreases OWA 19992520,"11 Safety injection A Check Valves"; and i
I e
OWA 19950898," Unit 1 Turbine ControlValvesul I
.
i e
The inspectors also performed a review of the cum l
,
i j
l
.
l b.
Observations and Findinas l
There were no findings identified and documented during this inspection.
i l
1R19 Post-Maintenance Testina l
l s.
Insoection Scooe
.
The inspectors reviewed and observed the following post-maintenance testing activities:
,
operation of the 22 charging pump following repair of a leak on the pump's e
suction block, replacement of a pump run time meter on the pump's power supply breaker, replacement of a pneumatic transmitter used in the pump's speed control system, and a spoed control calibration; and e
containment spray caustic addition valve CV-31939 operation following replacement of its air regulator, b.
Observations and Findinas There were no findings identified and documented duiing this inspection.
1R22 Surveillance Testina a.
Insoection Scooe The inspectors observed the performance of surveillance testing conducted in accordance with the following procedures:
SP 1112 " Steam Exclusion Damper Test," Revision 34; SP 1106B, *22 Diesel Cooling Water Pump Test," Revision 53; and e
e Sr.305, "D2 Diesel Generator Slow Start Test," Revision 17.
b.
Observations and Findinas There were no findings identified and documented during this inspection.
1EP1 Drill. Exercise. and Actual Events Cornerstone: Emergency Preparedness a.
Insoection Scooe The inspectors observed the petformance of an off-hour emergency preparedness drill conducted on August 4,1999. This inspection focused on the ability of the licensee to appropriately classify emergency events, perform timely notifications, and implement
)
appropriate protective action recommendations.
-
.
b.
Observations and Findinas There were no findings identified and documented during this inspection.
4.
OTHER ACTIVITIES 40A2 Performance Indicator Verification Comerstone: Initiating Events a.
Insoection Scooe The inspectors verified the following performance indicator data reported by the licensee:
unplanned scrams per 7000 critical hours covering the second quarter of 1998
through the end of the second quarter of 1999, and e
scrams with loss of normal heat removal covering the third quarter of 1996 through the end of the second quarter of 1999.
b.
Observations and Findings There were no findings identified and documented during this inspection.
40A3 Event Follow-up Comerstone: Mitigating Systems a.
Insoection Scooe On July 27,1999, the licensee discovered that the doors into the 122 control room chiller room were inoperable because the upper latch pin on the passive door of the double door set was not intact. On August 5, the lower latch guide plate was found detached from the same door. On August 12, testing of the material composition of the latch pins on the passive doors indicated that it was likely that the latch pins on both the 121 and 122 control room chiller room doors were not strong enough to have ever been able to perform their safety function. The inspector reviewed the licensee responses to these findings and conducted a preliminary estimation of their risk significance, b.
Observations and Findinas The inspectors identified an Apparent Violation of TS 3.13.A.1 for the failure to maintain operable both trains of the control room special ventilation system because of inadequate control room chiller room door latches.
This event was very similar to the event discussed in Inspection Report 50-282/99006(DRP); 50-306/99006(DRP), Section 40A3, which described a previous occurrence on June 25,1999, involving broken latch pins on the same door.
The 122 control room chiller room door consisted of a double door set with one side being pinned (latched) closed at the top and bottom to the door frame to prevent the door from inadvertently opening. The other side was used for normal ingress and
<_
,
.
.
egress and was connected to the pinned side via a door handle latch. Repairs completed on the passive door for the problem encountered on June 25 involved only the top latching mechanism (only one of the two latch mechanisms was considered necessary for the door to be operable).
On July 27 a door alarm was received in the control room and the auxiliary building
,
i operator was dispatched to investigate. The operator found that the passive door would not remained latched. This information was provided to the control room and a
'E maintenance worker was dispatched to correct the problem. The dcor, however, was never declared inoperable because the operator's report to the control room was misinterpreted as the door latches were merely loose, which allowed enough movement of the doors to trigger the alarm. The maintenance worker quickly replaced the lower latch's operating mechanism, but since he did not remove the door, could not verify the status of the locking plate located on the bottom edge of the door. Even though the operators did not recognize that the action requirements of TS 3.13.A, " Control Room
- Special Ventilation System," applied, the door was repaired well within the 1-hour allowed outage time.
On August 5,1999, as the result of insights gained while discussing the control room chiller room deadbolt installation (see Section 1R03.1) with the system engineer, the inspectors questioned whether the 122 control room chiller room door was operable in the degraded condition that had existed since the maintenance of July 27. The licensee concluded that the condition of the door was " indeterminate," declared the door inoperable, and started the 1-hour allowed outage time. The door was retumed to what was believed to be a fully operable status within 1-hour. Based on the results of the inspection of the door intemal latch mechanism, the licensee concluded that the door had been operable during the time period of July 27 through August 5,1999.
,
On August 12,1999, material composition testing and calculations by a licensee vendor l
indicated that the latch pins on the 122 control room chiller room door, as well as the
'
similar 121 control room chiller room door, had insufficient yield strength to have ever been able to perform their safety function. All of the latch pins were replaced with pins of a different material composition which had a significant margin to the required yield strength.
Significance Determination In the previously-referenced inspection report, the inspectors performed a preliminary estimation of the risk significance of having the latch pins broken on the 122 door for an estimated period of 3% days. The results of applying Phase Two of the Significance Determination Process indicated the issue was potentially risk significant and a Phace Three review was initiated by a regional risk analyst.
That specific risk estimation is no longer applicable because the potential risk exposure time for the finding was changed from 3% days to several years, and both chiller room doors were affected. However, the accidents reviewed, functions required, the assumptions, and the mitigation systems available that were discussed in the Phase Two review were still applicable. The Phase Three Significance Determination Process
,
being performed will be revised to include the longer risk exposure time. Pending completion of the risk estimation, the risk from this finding was classified as "To Be Determined." The finding was assigned to the mitigating systems comerstone of both
!
l
L L
i u
-
units. The issue was also considered an Apparent Vioiation (A'!) of TS 3.13.A.1 which
)
required that both trains of the control room special ventilation sy0 tem be ope;able at all times (50-282/99007-03(DRP); 50-306/99007-03(DRP)).
These events were reported by the licensee in Licensee Event Repott (LER) 1-99-07,
" Loss of Control Room Special Ventilation Function Due to Broken / Inadequate Door Latch Pins On Control Room Chiller Doors," Revision 1. The licensee was in the process of conducting a complete reanalysis of the doors as well as an analysis of the expected post-accident control room conditions if the doors opened during an accident.
40A4 Other Comerstone: Barrier Integrity
.1-(Closed) LER 50-282/99005 (1-99-05): Containment inservice Purge System not isolated During Heavy Load Movement Over Fuel.
a.
Inspection Scooe This licensee-identified event was previously discussed in inspection Report 50-282/99004(DRP); 50-306/99004(DRP), Section M1.2. It involved the movement of the reactor upper intemals over the open, fueled reactor vessel during a Unit i refueling outage. Movement of a heavy load, such as the reactor upper intemais, over the reactor vessel was only allowed if the containment inservice purge system was first isolated as required by a licensee procedure and as committed to in the Updated Safety Analysis Report. The event was reviewed by NRC regional and headquarters risk analysts.
- b.
Observations and Findinos The inspectors identified a NCV of Criterion V, " Instructions, Procedures, and Drawings," of Appendix B,10 CFR Part 50, for the failures of operators to follow a plant procedure during the movement of reactor intemals over the open, fueled reactor vessel.
The risk from this event was that fuel damage due to the upper intemals dropping into -
the core with the inservice purge system operating could have resulted in a release of radioactive material from the containment. The NRC determined that the risk significance of this occurring was low based on the following:
low estimated initiating event frequency for a heavy load drop over the reactor-e cavity; very short exposu:e time for the risk (for a few minutes on May 8,1999);
e operability of both trains of the automatic purge isolation system on high e
radiation; and
,
credit for manual actuation of purge isolation, if necessary, based on existing e
procedures, indications, controle, and training as discussed in the previously referenced inspection report.
_
.
The inspectors performed a risk significance screening of this issue in accordance with NRC Inspection Manual Chapter 06XX, " Significance Determination Process." Based on the above, the inspectors considered this finding to be within the licensee's response band (GREEN) and assigned it to the barrier integrity cornerstone for Unit 1.
As discussed in the previously referenced inspection report, operators failed to properly accomplish Maintenance Procedure D58.1.6, " Reactor Upper Internals Replacement,"
Revision 0, Step 7.6.3, a procedure affecting quality. Appendix B, Criterion V,
" Instructions, Procedures, and Drawings," of 10 CFR Part 50 required that activities i
affecting quality be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and be accomplished in accordance with these instructions, procedures, or drawings. The failure of operators on May 8,1999, to accomplish activities affecting quality as prescribed in Maintenance Procedure D58.1.6 is being treated as an NCV (50-282/99007-04(DRP)), consistent with Appendix C of the NRC Enforcement Policy. This issue was in the licensee's corrective action system as Error Reduction Task Force 99-10 under Action item 19991656.
.2 (Closed) LER 50-282/99004: 50-306/99004 (1-99-04): Surveillance Test Procedure inadequate to Demonstrate Operability of Spent Fuel Pool Special Ventilation System.
a.
Inspection Scope This licensee-identified event was previously discussed in inspection Report 50-282/99004(DRP); 50-306/99004(DRP), Section M8.1. It involved the licensee's discovery that existina surveillance test procedures for the spent fuel pool special ventilation system did not adequately verify that the inservice purge system would isolate as required on a high radiation signal. The event was reviewed by NRC regional and headquarters risk analysts.
b.
Observations and Findinas The inspectors identified a NCV of TS 4,15 for inadequate surveillance testing of the automatic initiation function of the spent fuel pool special ventilation system.
The risk from this event was that if fuel damage occurred due to a fuel handling accident in the spent fuel pool, the inservice purge system, if operating, may not have isolated.
This could have resulted in the special ventilation system being unable to draw a i
vacuum on the spent fuel pool area, resulting in a release of radioactive material to the environment. The risk exposure time was relatively long and consisted of the length of each refueling outage since initial plant operation. However, the NRC determined this issue to be of low risk significance based on the following:
low estimated initiating event frequency for a significant fuel handling accident in e
the spent fuel pool while the inservice purge system was operating;
operability, on Unit 1, of both trains of the automatic purge isolation system on e
high radiation when tested; high probability that the automatic purge isolation system on Unit 2 would be e
shown to be operable when tested (it cannot be tested until the next refueling outa;u); and
_
!.
i
!
I i
credit for manual actuation of purge isolation, if necessary, based on existing l
procedures, indications, controls, and training as discussed in the previously-referenced inspection report.
i The inspectors performed a risk significance screening of this issue in accordance with l
NRC Inspection Manual Chapter 06XX, " Significance Determination Process." Based
'i on the above, the inspectors considered this finding to be within the licensee's response band (GREEN) and assigned it to the barrier integrity cornerstone of both units.
As discussed in the previously referenced inspection report and the licensee event report, surveillance test procedure requirements did not completely satisfy TS 4.15,
" Spent Fuel Pool Special Ventilation System," Subsection A.2, which required that automatic initiation of each train be demonstrated with a simulated high radiation signal at least once per operating cycle or once every 18 months, whichever occurred first.
Isolation of the inservice purge system, a necessary part of the automatic initiation sequence, was not tested. Failure to satisfy the surveillance test requirements was a violation of the TS and had apparently existed since initial operation on both units. This violation is being treated as an NCV (50-282/99007-05(DRP)), consistent with Appendix C of the NRC Enforcement Policy. This issue was in the licensee's corrective action system as Commitments 19991435 and 19991436.
.3 Follow-uo Assessment of the Licensee's Status of Year 2000 (Y2K) Readiness of Computer Systems (Temoorary Instruction 2515/141)
Cornerstones: Initiating Events, Mitigating Systems, Emergency Preparedness a.
Insoection Scope On July 29, the inspectors performed a follow-up assessment of the licensee's Y2K readiness using Temporary Instruction (TI) 2515/141, " Status of Year 2000 (Y2K)
.
,
Readiness of Computer Systems." The review addressed aspects of Y2K management planning, documentation, implementation planning, initial assessment, detailed assessment, remediation activities, Y2K testing and validation, notification activities, and contingency planning. The inspectors used NEl/NUSMG [ Nuclear Energy Institute / Nuclear Utilities Software Management Group) 97-07, " Nuclear Utility Year 2000 Readiness," and NEl/NUSMG 98-07, " Nuclear Utility Year 2000 Readiness Contingency Planning," as the primary references for this review.
b.
Observations and Findinas Conclusions regarding the Y2K readines3 of this facility are not included in this summary. The results of this review were combined with reviews of Y2K programs at other plants in a summary report, NUREG-1706,"An Assessment of US Nuclear Utility Year 2000 Readiness," issued in September 1999.
'
l
l
r.
'
f
!
!
40A5 Meetinas. includina Exit
.1 Exit Meetina Summary
{
!
The inspectors presented the inspection results to Mr. J. Sorensen and other members of licensee management at the conclusion of the inspection on August 31,1999. The
{
licensee acknowledged the findings presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary.
-
No proprietary information was identified.
I l
,
fi, l-l PARTIAL LIST OF PERSONS CONTACTED
{
!
Licensee l
.
'
T. Amundson, General Superintendent Engineering J.' Goldsmith, General Superintendent Engineering, Nuclear Generation Services J. Hill, Nuclear Performance Assessment Manager A. Johnson, General Superintendent Radiation Protection and Chemistry
)
G. Lenertz, General Superintendent Plant Maintenance J. Maki, Outage Manager D. Schuelke, Plant Manager
!
l T.~ Silverberg, General Superintendent Plant Operations M. Sleigh, Superintendent Security J. Sorensen, Site General Manager NRC S. Burgess, Senior Reactor Analyst i
-
I ITEMS OPENED, CLOSED, AND DISCUSSED Opened 50-282/99007-03(DRP);
AV Control room special ventilation system inoperable 50-306/99007-03(DRP)
longer than allowed by TS 3.13.A.1 due to problem with chiller room doorlatches
,
Opened and Cloned 50-282/99007-01(DRP);
NCV Design control violation for control room chiller room 50-306/99007-01(DRP)
door deadbolt installation 50-282/99007-02(DRP);
NCV'
Procedure compliance violation for temporary 50-306/99007-02(DRP)
procedure change for control room chiller room door deadbolt installation 50-282/99007-04(DRP)
NCV Procedure compliance violation for failing to isolate containment inservice purge system while moving heavy load over the reactor l
50-282/99007-05(DRP);
NCV Failure to perform surveillance test for isolation of 50-306/99007-05(DRP)
containment inservice purge system from spent fuel special ventilation system required by TS 4.15 Closed 50-282/99005 (1-99-05)
LER Contair. ment inservice purge system not isolated during heavy load movement over fuel 50-282/99004 (1-99 44)
LER
' Surveillance procedure inadequate to demonstrate 50-306/99004 operability of spent fuel pool special ventilation system Discussed 50-282/99007; 50-LER Loss of control room special ventilation function due to 306/99007 (1-99-07)
broken / inadequate door latch pins on control room
- Revision 1 chiller doors
-
,
i
l I
)
..
l-
!
LIST OF ACRONYMS USED l
AV Apparent Violation l-CFR Code of Federal Regulations l
DRP Division of Reactor Projects LER Licensee Event Report NCV
'Noncited Violation NRC Nuclear Regulatory Commission l
OWA Operator Workaround
- Preventive Maintenance SP Surveillance Procedure
~TCN Temporary Chang'e Notice Tl Temporary Instruction TS Technical Specification Y2K Year 2000 l
L I
l
]
i I
.-
21