IR 05000285/1998019
| ML20206R170 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 01/08/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20206R154 | List: |
| References | |
| 50-285-98-19, NUDOCS 9901190166 | |
| Download: ML20206R170 (33) | |
Text
..
.__
_
_ _ _ _.
_ _. _.. _ - -.. _ _
.._. _ _
__. _ _ _. _,_.
.. -
,
i l
v l
ENCLOSURE 2
'
i r
U.S. NUCLEAR REGULATORY COMMISSION
.
j
REGION IV
.
,
Docket No.:
50-285
);
License No.:
DPR-40 Report No.:
50-285/98-19
,
Licensee:
Omaha Public Power District i
Fac:lity:
Fort Calhoun Station l
Location:
Fort Calhoun Station j
FC-2-4 Adm., P.O. Box 399, Hwy. 75 - North of Fort Calhoun Fort Calhoun, Nebraska Dates:
October 5-23,1998, within office review until December 11,1998 I
Team Leader:
J. E. Whittemore, Senior Reactor inspector, Engineering and Maintenance
' Branch L
Inspectors:
D. Carter, Resident inspector, Reactor Projects, Branch D
~
W. McNeill, Reactor inspector, Engineering and Maintenance Branch
)
- Accompanying l -
Personnel:
M. Shlyamberg, Contractor, Nuenergy, Inc.
. Approved By:
. Dr. Dale A. Powers, Chief, Engineering and Maintenance Branch Division of Reactor Safety i
Attachment:
Supplementalinformation
!
!-
,
l I
l
9901190166 990108
PDR' /4 DOCK 05000285 *
^
G PDR
I
,,
--
.
.
l-2 EXECUTIVE SUMMARY Fort Calhoun Station NRC Inspection Report 50-285/98-19 This routine, core inspection was performed by three Region IV inspectors and a contractor to assess the effectiveness of the Fort Calhoun Station corrective action program in identifying, evaluating, correcting, and preventing problems that affect the safe operation of th9 facility.
The corrective action program at Fort Calhoun Station generally has been effective. The team recognized an apparent low threshold for entry into the program as employees were using the program. There was also common understanding and philosophy shared by individual managers about the program capabilities and goals. The team relayed to facility management observations related to timeliness of condition report initiation, weak cause and operability evaluations, and significance of repeat failures.
l
_O_perations In general, licensee initiation and review of condition reports was good. Control room
=
personnel performed prompt safety assessments of events or conditions brought to their attention. Shift manager initial determinations of operability and reportability were timely and of good quality. However, several examples of untimely condition report initiations were identified (Section 2.c).
The number of operator work arounds had recently been greatly reduced and was being
.
effectively maintained at a low level. The resolution and closure of operator work arounds were timely and consistent with licensee priorities. However, the compensatory measures for operators regarding one operator work around for calculating reactor vessel head bubble formation were vague. Also, the required periodic manual operation of the auxiliary building ventilation heating system to prevent the automatic shutdown of the ventilation system had inappropriately not been considered to be an operator work around (Sections 5.c and 6.c).
.
The program for identifying and tracking control room deficiencies was not adequately
.
maintained. The licensee-identified corrective actions that were still being implemented to address weaknesses in the control room deficiency identification program had not been effective in preventing the recurrence of some problems (Section 5.c).
Maintenance Corrective action was adequately implemented by the licensee's work control program.
- The work control process, including tool pouch and minor maintenance programs, did not inhibit the appropriate generation of condition reports when necessary, or in any way, circumvent the corrective action process. However,3 out of 18 (17 percent) non-safety related, successfully completed tool pouch activities reviewed should have been performed as planned maintenance activities per licensee expectations (Section 3.c).
-- -
-
-.
.
~
-3-Enaineering i
An untimely cause determination and operability evaluatica was performed by
.
engineering for safety functions dependent on air-operated valves and dampers (Section 2.c).
The inspectors identified five engineering evaluatians performed in response to generic j
.
communications and industry information that were weak or should have been more rigorously pursued. The licensee had previously issued two Level I condition reports and received a Severity Level IV and a noncited violation for failure to identify the scope of review and implement adequate corrective actions related to the potential for the
. inadvertent dilution of the reactor coolant system, and yet failed to identify all affected procedures. The long-term failure to establish measures to assure that conditions adverse to quality are promptly identified and corrected was identified as an example of a 10 CFR Part 50, Appendix B, Criterion XVI violation (Section 4.c).
The switch modification to Auxiliary Feedwater Pump FW-10 had resulted in a failure
.
modo that did not previously exist and appeared to increase the probability of the single failure of Pump FW-10; therefore, it was an unreviewed safety question. The licensee's failure to consider the unreviewed safety question, when balanced with the improvement in overall system reliability, constituted a violation of minor significance of 10 CFR 50.59 and is not subject to formal action (EA 98-554) (Section 7.b).
l
__ __
__ _
<
I
.
-4-Report Details Summary of Plant Status The licensee was operating the facility at approximately 100 percent power for the duration of the inspection. Near the end of the final onsite inspection week, the licensee performed a successful temporary repair, at power, on a feedwater check valve that was leaking to the containment atmosphere.
Backaround All aspects of the corrective action program in effect at Fort Calhoun Station were reviewod in the operations, maintenance, and engineering functional areas, as discussed below. Since the corrective action program envelopes all technical disciplines and all of the functional areas that are normally evaluated during the assessment of licensee performance, as allowed by NRC Manual Chapter 0610, " Inspection Reports," this report format will deviate from the typical structure specified by the manual chapter.
1.
Scope (40500)
The team analyzed the problems identified in the documents listed in the attachment to determine the licensee's effectiveness in performing:
Initialidentification and characterization of problems,
..
Elevation of problems to the proper level of management for resolution,
.
Root-cause analyses,
.
Disposition of any operability /reportability issues,
.
Implementation of appropriate corrective actions,
.
Evaluation of repetitive conditions, and
.
Evaluation of generic communications and industry operating experience for
.
applicability to Fort Calhoun Station.
The documents reviewed included condition reports, work requests, work orders, engineering action requests, score cards, and operability evaluations. The team also reviewed quality assurance audits, self assessments, and licensee response to NRC and industry generic communication..- _..
-.
-
...
.. - -.
-...
-
.. _ - ---
.-
.
U
.
.
5-2.
Condition Reports a.
Scope The team reviewed the condition reports listed in the attachment. The sample was based, in part, on the risk significance of the system or components identified in the condition reports. The review evaluated the effectiveness of the licensee's process in identifying, correcting, and preventing the problems that affect safe plant operations.
Also, the team reviewed cause and reportability determinations, as applicable, to assess their quality and effectiveness.
b.
Observations and Findinas The licensee's corrective action program categorized condition reports according to significance with Level 1 as being the most important level and Level 6 the least important level. During the review of all condition reports, the team observed that licensee control room personnel performed prompt safety assessments of events or conditions brought to their attention. Initial determinations of operability and repoitability by control room shift personnel were timely and of good quality.
b.1 Operations Related Condition Reports The team reviewed 16 operations-related condition reports to assess the adequacy of problem identification, evaluation, determination and implementation of corrective action, determination of operability and reportability, and timeliness of reporting. Comments on some of the condition reports are given below.
Condition Report 199800344 This condition report described that the control room momentarily received 22 annunciator alarms, simultaneously, for no apparent reason. This condition was identified on March 4, at 10:15 a.m., and the condition report was written on March 6, at 3:37 p.m.,2 days later. A maintenance work request was written to troubleshoot the event on March 15. The licensee's troubleshooting efforts revealed no specific cause for this condition. The generation of the condition report and the decision to troubleshoot the problem were untimely,2 and 11 days following the event, respectively.
Condition Report 199800720 This condition report described that an operator entered a restricted high radiation area without radiation protection continuous coverage in violation of Technical Specification 5.11.2. The licensee submitted Licensee Event Report 97-05 in response
,
to this violation. The event occurred on April 7, at 9 a.m., and the condition report was
.
-
-
-
..
_-
-.
-
- - _. - -. -
- -
.-
.
a
.
l-6-initiated on April 9, at 11:53 a.m.,2 days later. This condition report was assigned a Condition Level 1 due to its significance. The licensee took adequate corrective action to prevent recurrence. Initiation of the condition report, however, was untimely.
Licensee Event Report 97 05 was closed in Inspection Report 50-285/98-10 and a l
noncited violation was issued.
Condition Report 199701359 This condition report indicated that an individual operated a selector switch in the control room for the nuclear detector well coolers without obtaining prior permission from control room operators, to verify proper switch contact on October 2,1997. The individual had entered the control room and positioned the switch without first contacting or requesting assistance from control room personnel. Licensee control room personnelidentified this as a violation of Standing Order SO-O-1," Conduct of Operations," Revision 37. The licensee's immediate corrective actions were to counsel the individual on proper control room conduct of operation and request that the individualleave the control room. The condition report was initiated on October 5,1997,3 days later. The condition report generation was untimely. The individual's failure to comply with the requirements for conduct in the control room constitutes a violation of minor significance and is not subject to formal enforcern6nt action.
Condition Report 199701178 i
This condition report described an unusual noise coming from the letdown filter Room 11. The room contained chemical and volume control system filters and miscellaneous piping, and was controlled as a restricted high radiation area. The shift manager requested an operability determination be performed on the chemical and volume control system components located in Room 11. This condition was identified on September 5, at 10 a.m., and the condition report was written on September 9, at 12:15 p.m.,4 days later. On October 12, field inspection identified the source of the noise as a pipe rubbing at the piping penetration between Room 11 and its adjoining room. On October 17, the engineering personnel subsequently confirmed that the noise was caused by increased pipe vibration due to a failed pulsation dampener accumulator on Charging Pump CH-1C. Following the repair of the accumulator the noise stopped.
(See the report section addressing engineering-related condition reports, specifically Condition Report 199700809 and related condition reports.) The initiation of the condition report was untimely.
Condition Reoort 9701152 This condition report described inoperable fire barriers that were not restored to functional status within 7 days, as required by licensee procedures. This condition was identified on August 28,1997, when the first fire barrier 7-day time limit was exceeded, and the condition report was written on September 3,1997,6 days later. Licensee
!
personnel were aware that the fire barrier had exceeded its 7-day requirement, but held l
off initiating a condition report so that other inoperable fire barriers, that were going to
'
exceed their 7-day requirements, could be added into a common condition report.
During this time, fire protection impairment permits and appropriate compensatory l
-
_
__
- _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _
- _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _
.
.
7-measures were established and put in place for the inoperable fire barriers. The team determined and informed licensee personnel that the practice of delaying the initiation of a condition report to capture additional examples was not appropriate.
In the above examples, licensee initiation of condition reports was untimely. The team did not, however, identify any safety significance to any of the issues reported late, and corrective action was underway or completed when the condition reports were eventually generated.
b.2 Maintenance-Related Condition Reports The team selected and reviewed a sample of 55 maintenance-related condition reports, including the applicable proposed corrective actions, operability, and reportability determinations, and process timeliness. Comments on some of the condition reports are given below.
Condition Reports 199701605.199800098.199800967. and 199801187 The team's review of maintenance-related condition reports identified four condition reports that were not issued in accordance with the licensee's program guidance.
Procedure SO-R-2," Condition Reporting and Corrective Action," Revision 7, paragraph 5.2.2, states that condition reports shall be initiated immediately.
(Immediately was not defined.)
Licensee personnel issued Condition Report 199800967, dated April 29,1997,
.
7 days after Penetration M-22 did not meet local leak rate testing criteria.
Licensee personnelissued Condition Report 199701605, dated November 24,
.
1997,3 days after identification of a procedural deficiency identified in a measuring and test equipmeni procedure for calibration of a mini-pulser used in testing of radiation monitors.
Licensee personnel issued Condition Report 199800098, dated January 23,
.
1998,5 weeks after the identification of the failure to include in the measuring and test equipment program a new laser tool for alignment of equipment.
Licensee personnel issued Condition Report 199801187, dated May 20,1998,
.
8 days after identification of the failure to meet test criteria for a Diesel Generator 1 sequence timer during surveillance testing. The timer circuit supplied power to the motor-driven auxiliary feedwater Pump FW-6.
The licensee initiated Condition Report 199801874 to address the team-identified issue related to the untimely initiation of certain condition reports. The team verified that the alignment tool and the mini-pulser procedure were not used in the performance of quality or safety-related tasks during the period when either the calibration or the procedural adequacy was in doubt. The team also noted that sequencer and
,
_ _.
.
-8-
.
penetration test failures (Condition Reports 199801187 and 199800967) identified were issued during a refueling outage when the equipment was not required to be operable.
The licensee's procedure, however, did not allow any leeway in the initiation of condition reports. The team determined that these delays were not safety significant.
Condition Report 199800948 During testing after a modification to upgrade 32125 Vdc (supply and load breakers)
circuits according to Construction Work Order 98-0047, Condition Report 199800948 was issued for Circuit 2 being found to have reversed polarity. Additionalinspection performed because the condition report found Circuit 17 was also reversed. Upon further review and investigation by the licensee, it was established that two previous failures had occurred. Circuit 13 had been reversed on April 22,1998, and Circuit 6 was
.
reversed April 23,1998, after the discovery of the Circuit 2 reversal. All circuits had passed post-modification testing before the failures. However, the testing was not adequately performed in that some personnel were not sensitive to the polarity of the volt meter readings. If a condition report had been issued on April 22,1998, when the first reversal was discovered, then the other polnrity reversals could have been avoided or identified earlier. After Condition Report 199000948 was issued, all circuits were verified as acceptable as part of the corrective actione. After this problem was identified by the team, the licensee included this as an additional example in Condition Report 199801874 of a failure to issue a condition report in a timely manner.
Condition Reports 199701662 and 199701708 The team identified two condition reports with weak cause determinations. Condition Report 199701662, dated December 9,1997, noted that while performing Surveillance Test OP ST-CCW-3001," Component Cooling Water Category B Valve Exercise Test,"
the control switch for the component cooling water Flow Control Valves HCV-2810A/B failed to function. Within a few days, the condition report was statused as ready for closing with no cause determination or corrective actions because the particular failure could not be identified or duplicated. Condition Report 199701708 was issued on December 17,1997, for the same type of failure and closed on May 1,1998, with an indeterminate cause determination. The cause determination said the cause of switch failure was not clearly identified but it was suspected that the failure was due to normal wear associated with the age of the switch. The switch was replaced under Maintenance Work Order 97-4522 on January 9,1998, and there were no additional failures. However, the generic extent of additional switch failures in this same manner was not addressed in either condition report.
The team noted that the first and second condition reports were both processed at a Level 4. Procedure SO-R-2, paragraph 3.20, requires processing at a Level 3 for conditions having generic concerns or conditions with a frequency of occurrence that is unacceptable. This decision on significance levelis normally made by the corrective action group. The licensee issued Condition Report 199801913 after this issue of a repetitive failure was identified by the tea I
!
c
.
!
9-b.3 Engineering Related Condition Reports The team sampled 94 engineering-related condition reports, including the applicable
,
l proposed corrective actions, operability, and reportability determinations. Overall, the condition reports were correctly classified, and had the appropriate corrective actior's to prevent recurrence, in some cases, the team found that the extent of the conditions identified was not adequate. For some condition reports, the operability evaluations were weak. The discussion provided below provides the basis for these comments.
Condition Renort 199700489 This condition report was initiated on April 30,1997, when NRC Inspection Report Followup Item 50-285/9706-02 identified a weak operability determination for pressure regulators that supplied instrument or backup air at 30-35 psig for the safety-related air-operated valves and dampers. The regulators were not classified as safety related and, therefore, could not be credited to fail to the low or off position to assure that valves or dampers would fail to the safe positions. If the regulators were assumed to fail open or to the high position, the downstream components (solenoid valves and air actuators)
would see approximately 120 psig, the full pressure of the instrument air or backup air system. However, not all of these downstream components were qualified to this pressure, therefore, the effect of the elevated actuator pressure on the stroke time or the potential air pressure drop across the solenoid valves was also unknown.
Based on the information provided by the licensee, the initial concern related to this issue was documented in a memorandum from S. K. Gambhir to W. G. Gates, dated January 24,1989. This memorandum identified 11 safety-related, solenoid-operated valves that had a maximum operating pressure differential rating less than maximum supply pressure. Out of these 11 solenoid-operated valves,6 valves had the maximum operating pressure differential rating of 25 psid lower than the regulated (reduced) air pressure.
The proposed corrective actions were limited to replacement of these 11 solenoid-operated valves during the 1990 outage, with the new ones having the maximum operating pressure differential rating greater than 100 psid. The i
memorandum was not specific on the safety designation of the air regulators. No other
!
issues, such as total population of the affected functions and solenoid-operated valves, qualification of the air operators, or the effect on valve or damper stroke times, were addressed.
I in February 1996, Condition Report 199600161 icantified 15 additional i
solenoid-operated valves that had a maximum operating pressure differential rating less i
than 100 psid, i.e., less than maximum supply pressure. This condition report was
generated based on the solenoid-operated valve program development under Generic i
i l
.
.
.
-10-Letter 91-15, " Operating Experience Feedback Reports, Solenoid-Operated Valve Problems at US Reactors." This condition report identified that some of the pressure regulators were not safety related. Similar to the 1989 corrective actions, the corrective action associated with this condition report was limited to replacement of the solenoid-operated valves and no other issues, such as qualification of the air operators or stroke time of the air regulators were addressed.
In April 1997, NRC inspection Report 50-285/97-06, dated June 27,1997, discussed the
'
concern about effects of regulator failure on the operability of the safety-related air operators. Condition Report 199700489 was initiated and concluded that,"... no operability concerns have been identified at this time." The conclusion was based on
the lack of observed failures of the air operators at Fort Calhoun Station and in the industry. The conclusion was also based on the lack of observed failures of the air regulators to fail in a way that could result in full air pressure being applied to the downstream components. Other than the reliance on the nonsafety-related pressure regulators this condition report did not offer any compensatory actions to compensate for the failure of the nonsafety-related air regulators. Furthermore, a prompt determination of transportability or population of the affected air-operated valves or dampers was not done.
The eventual corrective action for this condition report included the performance of a long-term, detailed engineering analysis that determined the potential effects of failure of the nonsafety-related air regulators on the safety-related components located downstream of the air regulators. This analysis was completed in August 1998, about 2 months prior to this inspection. The analysis identified more than 250 safety-related valve or damper operating systems that were affected by this condition. Out of the approximate 250 actuators, one case was identified where the effect of the failure of the pressure regulator would have caused the stroke time of the air-operated valve to exceed the design's analyzed value. Condition Report 199800090 was initiated to address this problem, related to a steam generator blowdown system containment isolation valve. The evaluation of this issue concluded that there was no safety significance associated with this finding. With the exception of this item, the study did not identify any other cases where the failure of a nonsafety related air regulator would have lead to an unanalyzed condition, in summary, the licensee failed to perform a timely evaluation to assure the operability of the safety-related functions provided by the integrated system (regulators, solenoid valves, and operators) to reposition the affected components to the safe positions. The licensee's initial concern in 1989 was limited to qualification of the solenoid-operated valves. The total population of the solenoid-operated valves that were not qualified for full instrument air pressure was not determined until 1998. The identification of additional solenoid-operated valves was prompted by response to Generic Letter 91-15.
Other effects of the pressure regulator failures were not addressed until identified by the NRC in 1997.
Therefore, from problem identification on April 30,1997, until completion of the engineering evaluation on August 5,1998, there was no basis for operability of approximately 250 integrated systems including safety-related operators and
.
,
!
-11-I solenoid-operated valves, and nonsafety-related pressure regulators that provided safety-related functions. However, the eventual completion of the evaluation verified that the safety related functions were in fact, operable.
Condition Report 199700015 This condition report was initiated to question the adequacy of the net-positive suction head for the safety injection pumps during the injection phase following a loss-of-coolant accident. The available low-pressure safety injection pump net-positive head was based on the nominal pump flow rates and, therefore, potentially nonconsen/ativo. The licensee evaluated this condition and determined that the evaluation of the net-positive head as documented in Updated Safety Analysis Report was nonconservative, since the Updated Safety Analysis Report flow rates for a single pump operating were not based on a near empty safety injection refueling water tank. The licensee's evaluation indicated that before the recirculation actuation signal, when the safety injection refueling water tank would be almost empty, the flow rates would be higher, and at these flow rates the low-pressure safety injection pumps would see an available net-positive head lower than the required head. The evaluation conservatively assumed that the low-pressure pumps would cavitate for 30 minutes. The other emergency core cooling pumps were found to have sufficient net-positive head at tne higher flow rates.
The team also observed, that both pump performance and the net-positive head required curves were not certified in the region of the anticipated operation. The extrapolation was done by the original pump vendor based on the certified pump performance curves. The team was concerned about the effect of the cavitation on pump performance. However, the operability evaluation failed to discuss effects of uncertainty introduced by extrapolation of the vendor-certified curves.
The licensee provided the following information to address the team's concerns. The more accurate estimate of duration of the cavitation was approximately 6 minutes if the break were big enough to initiate the containment spray pumps, or 14 minutes if the break were not big enough to initiate the containment spray pumps. Therefore, the exposure of seals and bearings to cavitation conditions was shorter than previously assessed. Also, the licensee provided additional information that the low pressure coolant injection pumps have bearings in a close proximity to the impeller, and based on the expert opinion of a pump consultant, the seals should not experience degradation.
The team found this additional information to be satisfactory to resolve the concern about the effects of the cavitation.
The team considered the licensee's evaluation of the effects of the available net-positive head on emergency core cooling system pump performance to be weak.
Condition Reports 199700809.199701030.199701222.199701463.199801166.
,
199801679. and 199801818 l
l These condition reports were reviewed by the team because they addressed pipe hanger and support failures. Four of the condition reports (199701030,199701222, 199701463, and 199801818) reported hanger and support failures on the chemical and i
i
.
. -. - - - - _.
-
_.
_.. - -
-
-
.-
- - -... - -.
- -.
-. - -
..
-12-volume control system. The review of these condition reports and discussions with licensee personnel allowed the team to make the following observations. The failed l
pipe hangers in the chemical and volume control system had all experienced l
fatigue-induced failures due to vibration. The interview with the system engineer
'
revealed that it was eventually determined that the reason for these hanger failures was due to inadequate gaseous nitrogen pressure in t'.e charging pump pulsation dampeners. This resulted in excessive pipe vibr tjon, which fatigued the hangers and l
caused subsequent failure. This brought to light that the licensee's surveillance and
,
preventive maintenance program did not periodically affirm that the charging pump pulsation dampeners were sufficiently charged and capable of performing their intended i
design function. This condition has since been corrected.
All of the condition reports were categorized as Level 4 and attributed the hanger
failures to fatigue. Further cause determination was not performed. The licensee's
'
procedure encourages, but does not require, a more stringent condition report condition level to be assigned for repetitive failures. However, increasing subsequent condition reports to 1.evel 3 would have encouraged but not required a more stringent cause determination. The team believed that the licensee's initial cause determinations for failed chemical and volume control system pipe hangers were weak.
c.
Conclusions I
in general, licensee initiation and review of condition reports was good. However, several examples of untimely condition report initiations were identified. Control room personnel performed prompt and good safety assessments of events or conditions brought to their attention. Shift manager initial determinations of operability and reportability were timely and of good quality.
The team identified weak engineering cause determinations and an untimely operability evaluation for safety functions dependent on air-operated valves and dampers.
3.
Corrective Action implementation Through the Work Control Process a.
Scope The team reviewed the licensee's tool pouch and minor maintenance programs (see the conduct of maintenance and work control procedures listed in the attachment). Also, the team reviewed 23 maintenance work requests of tool pouch activities, 24 maintenance work orders, and 2 repetitive maintenance orders listed in the attachment. The selection of the documents was based,in part, on the risk significance of the systems or components. This review evaluated the licensee's effectiveness in timely identifying, evaluating, correcting, and preventing conditions that may affect the safe operation of the plant.
!
-.
_
_
_.
.
.
-13-b.
Observations and Findinas Tool Pouch Activities Tool pouch maintenance was a licenseo program to correct minor problems that could be performed on the spot, with a minimum of documentation and planning. Examples of tool pouch maintenance were housekeeping, replacement of light bulbs, packing adjustment on manual valves (not subject to surveillance testing), replacement of handwheels, and so forth, according to Procedure SO-M-101, " Maintenance Work Control." During a review of maintenance work requests for tool pouch maintenance, the team identified 3 of 18 (17 percent) that did not appear to meet the procedural requirements for performance as tool pouch maintenance.
Maintenance Work Request 9702976, dated August 6,1997, replaced a
=
protection rod on a site glass for the component cooling water tank.
Maintenance Work Request 9802692, dated July 24,1998, replaced a gauge
=
glass in critical quality element equipment, the boric acid storage tank temperature indicator.
Maintenance Work Request 9802866, dated August 10,1998, unplugged a drain
line on a heating, ventilation, and air-conditioning unit for an electrical penetration room.
Although the systems above were safety-related, none of the components or appurtenances that were repaired or replaced were considered by the team to be safety-related or important to the safe shutdown of the facility. The team noted that Procedure SO-M-101, " Maintenance Work Control," Revision 46, paragraph 5.1.1.B, allowed only noncritical quality element gauge glasses to be replaced, only mounting hardware to be replaced, and only floor drains to be unplugged, under the tool pouch maintenance process. The licensee issued Condition Report 199801858 for these team-identified observations. The team did not have any safety concerns related to the l
above observations, because the minor problems were all safely corrected by the process. However, the failure to adhere to the procedural requirements constitutes a violation of minor significance and is not subject to formal enforcement action. Also, l
the team informed management that the high percentage of deficiencies identified in the small sample appeared to be significant.
Minor Maintenance Activities Procedures required minor maintenance to be performed according to a maintenance work document such as a maintenance work order, preventive maintenance order, or a repetitive maintenance order. Tasks performed as minor maintenance were intended to have a minimalimpact on plant operations and require a minimum of planning.
Examples of minor maintenance were changing air filters, obtaining oil or fluid samples, painting, and repair or replacement of floor gratings. The team did not identify any I
.
.
-14-issues of concern related to the licensee's minor maintenance process. However, Condition Report 199801857 was initiated because of the team's observations of one maintenance work order that was improperly voided. The licensee's work control process distinguished between voiding and closing maintenance work orders, and voiding a maintenance work order required documented justification. The licensee identified a second improperly voided maintenance work order.
Maintenance Work Request 9703257, dated August 26,1997, on a control room
.
annunciator alarm for the boric acid pump discharge pressure was closed to Maintenance Work Order 973223. Maintenance Work Order 973223 was voided on August 29,1997, with no justification. The licensee issued Condition Report 199801857 after this problem was identified by the team.
Procedure MD-AD-0003," Preparation of Maintenance Work Documents,"
Revision 5, paragraph 5.11.1, requires that reasons be documented for voiding a maintenance work order. A preventive maintenance order performed later found no problem with the alarm setpoint or calibration.
Maintenance Work Request 9703534, dated September 17,1997, was initiated
.
to calibrate a flow indicator because a fuel oil transfer pump was in the alert level for the inservice testing program. (The alert level is entered when performance degrades, such that additional testing is required to demonstrate operability.)
The flow indicator for the diesel generator transfer pump was to be calibrated to assure that the indicator was not causing the pump flow anomaly. The maintenance work request was closed to Maintenance Work Order 973469 on September 18,1997. Maintenance Work Order 973469 was voided, not closed, on November 14,1997, because Preventive Maintenance 9705838 was performed on September 19,1997, that calibrated the indicator. The licensee added Maintenance Work Request 9703534 to Condition Report 199801857 because the maintenance work order should have been cbsed, not voided.
The team did not identify any safety significance related to the improper closing of the two condition reports listed above. However, failure to provide the documented justification constitutes a violation of minor significance and is not subject to formal enforcement action.
Taoaing During a walkdown of the auxiliary feedwater system, an old style work request tag that identified an oilleak more than one year old was found on the inboard side of the auxiliary feedwater pump motor. However, no oilleakage was observed. The work request tag had Maintenance Work Request 9703221 documented on it. Maintenance l
Work Request 9703221 was dated August 25,1997. Maintenance Work Request 9703221 was closed to Maintenance Work Order 973308 that was voided on October 15,1997, with the note that the work would be done under Maintenance Work Order 971144. Maintenance Work Order 973308 stated that the tag was removed. This was contrary to the observation that the tag was still on the auxiliary feedwater pump motor. Maintenance Work Order 971144, dated November 7,1997, was closed with no comments in the work perforrned sections that indicated the oil leaks on the inboard side l
i
!
. - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
- 15-of the auxiliary feedwater pump motor were corrected. This was contrary to Procedure SO-M-101, paragraph 5.9.10, that requires upon completion of maintenance work, that the work completed section of the maintenance work order shall be completed. Paragraph 5.10.8 required when the post-maintenance testing has been successfully completed, the craft person shall remove any work request tags. The licensee issued Condition Report 199801919 after this problem was identified by the team. The team did not identify any safety significance with this observation, as there was no oil leakage. However, the failure to remove the work request tag constitutes a violation of minor significance and is not subject to formal enforcement action.
Conclusions The licensee's work control program adequately implemented the corrective action program. The licensee's personnel found it necessary to initiate corrective action to address team-identified issues related to the appropriateness of performing maintenance under the tool pouch program. Corrective action was also initiated because of a team observation related to improper toiding of maintenance work orders.
The work process, including tool pouch and minor maintenance, did not appear to inhibit the appropriate generation of condition reports when necessary or in any way circumvent the corrective action system. However,3 out of 18 (17 percent) non-safety related, completed tool pouch activities reviewed were not eligible to have been performed as tool pouch activities per the licensee's expectations.
4.
Review of Generic Communications and Operating Experience Feedback a.
Scope The team reviewed the licensee's program procedure and evaluations of information notices, generic letters, and industry-provided information.
b.
Observations and Findings The licensee's program for review of generic communications and industry events was implemented by Procedure NOD-OP-21, " Operating Experience Review Program,"
Revision 8, and administered by the Operating Experience Review Coordinator. The procedure was administrative in nature and relied on other program requirements, e.g.,
cause analysis and engineering evaluation, to assure appropriate review. The following are observations related to the effectiveness of the licensee's reviews.
Industry information Related to Boron Dilution Events in Pressurized Water Reactors The team's review of Condition Report 199701587 and related information identified problems related to the licensee's review of industry-provided information that identified a potential for reactor coolant system dilution. A potential existed for a core reactivity change due to the addition of demineralized water to the volume control tank and, therefore, dilution of the reactor coolant system during normal operation of the post-accident sample system as directed by Procedure CH-SMP-PA-0001," Post-
!.
. - _ -
..
-
--
-
-
. - -. -.. _-,..
._ -.-
.--
-
-.
.
.
-16-Accident Sampling System Normal Operation," Revision 19. This condition report was designated as Level 1, which required a root cause and generic implementation analysis report be prepared. The root-cause analysis identified that this procedure had steps that violated Standing Order SO-O-1," Conduct of Operations," Revision 37, and 10 CFR 50.540). The following sequence of events was based on the information provided in the
,
root-cause analysis and other documents referenced in the root-cause analysis.
On September 19,1994, the licensee was informed through industry ininrmation of boron dilution events that occurred in pressurized water reactors. it was recommended the licensee review plant systems, procedures, and expenences to identify activities that could result in a low concentration of borated water being transported to the reactor coolant system and that controls be developed to prevent such occurrences. The licensee's implementation of this recommendation failed to identify that the conduct of post-accident sample system instrument calibration and normal operational procedures could lead to a boron dilution.
On September 20,1994, the licensee revised Procedure IC-CP-01-6713, " Calibration of PASS Drain Collecting Tank Level Switch LS-6713," Revision 0, allowing a lineup that permitted the post-accident sample system drain collector tank to be pumped to the volume control tank. The change resulted in the potential to introduce demineralized water to the reactor coolant system, thus resulting in a reactivity change.
j i
!
On September 21,1994, the licensee's use of calibration Procedure IC-CP-01-6713, l
Revision 1, led to an unauthorized dilution event (worst-case 10 gallons) of the reactor i
coolant system. However, the licensee did not identify the event for more than 21 months.
On June 28,1996, the licensee issued Condition Report 199600846 due to the identification of the potential to introduce nonborated water to the volume control tank and subsequently to the reactor coolant system during the performance of l
Procedure IC-CP-6713. This condition report was designated as a Level 1 condition j
report and, therefore, a root-cause analysis was done. The root cause was determined to be a general lack of knowledge of the post-accident sample system that contnbuted to an inappropriate procedure. Included in the contributing causes was an inadequate procedural review process and an inadequate review of system and procedures in response to the industry information. Action item 5 of Condition Report 199600846 was to reopen the specific review process to determine what procedures have been reviewed and complete reviews of those procedures that had not
,
been reviewed.
!
(
During June and July 1996, NRC conducted an inspection and issued Inspection i-Report 50-285/96-04 on August 2,1996. The report identified a Severity Level IV violation against 10CFR50.540), reactivity control, and a noncited violation for failure to comply with programmatic administrative requirements, which led to the 1994 dilution event.
.
-
l
-
-17-l On January 7,1997, Corrective Action 5 of Condition Report 199600846 was closed I
without identifying any additional potential for boron dilution during normal operation of post accident sample system.
In addition to the review associated with Condition Report 199600846, the licensee performed an independent review of Procedure CH-SMP-PA-0001. The scope of this review was to search for flowpaths that could cause a boron dilution event. This review also did not identify the potential for a boron dilution event.
On November 19,1997, the licensee issued a second Level 1 Condition Report, 199701587, when it was identified that a potential to introduce nonborated water to the reactor coolant system through the post-accident sample system continued to exist. The team's review of the corrective actions associated with this condition report indicated, that all of the actions, except the effectiveness of review were completed. The effectiveness of review was scheduled for completion on January 30,1999. However, the long-term failure to establish measures to assure that conditions adverse to quality are promptly identified and corrected was a violation of Criterion XVI of Appendix B to 10 CFR Part 50 (50-285/9819-01).
Information Notice 91-50. Supplement 1. " Potential for Water Hammer Durina Restart of Residual Heat Removal Pumos" This information notice supplement addressed water hammer events that took place
since 1991, and indicated that additional systems could be affected. The team's review l
of the licensee's evaluation of this supplement identified that the licensee did not perform any additional system-based review for this supplement. Instead, the licensee relied on the previous review, which was limited to the auxiliary feedwater, main steam, and feedwater systems. Review of other systems, which could experience water hammers, such as raw water, component cooling water, and residual heat removal was not done.
Furthermore, the review was done by operations and system engineering organizations, and the design engineering department was not involved in the review. The team viewed the licensee's evaluation of this information notice supplement to be weak.
l Information Notice 97-16. "Preconditionino of Plant SSCs Before IST or Technical j
Specification Surveillance" l
This information notice addressed two potential mechanisms which could lead to
'
preconditiening of tests and surveillances. The first mechanism discussed in the information notice was preconditioning due to inappropriate steps within procedures, and the second mechanism was " grooming" due to the scheduling of preventive maintenance before the sun,eillances. The licensee's evaluation of this information notice and the response " orovious NRC Violation 50-285/9713-02 addressed the preconditioning due to the perfort, "ce of inappropriate steps in the surveillance procedures. However, the licensee did not have a programmatic approach to address the potential for " grooming" due to scheduling a preventive maintenance activity before surveillance. The licensee relied on the training and the awareness of individual system engineers and planners to prevent " grooming." The team viewed the lack of programmatic approach to address a potential for grooming to reflect a weak evaluation of the information notice.
l l
- -
.
.-
- -
-
- -.
.
--
.
.
.
.
.
.
-18-Information Notice 97-41. " Limerick EDG Lubricant Oil Coolers Were Undercized Relative to the Desian Conditions Reported on the Heat Exchanaer Data" The team's review of the licensee's evaluation of the information notice identified the following condition. To verify the rating of the emergency diesel generators, the licensee conducted hot weather testing. Since these emergency diesel generators are air cooled, j
the air temperature is one of the most restricting parameters in establishing the emergency diesel generator rating. The intake air temperature during the test was 95*F while the design air temperature is 110"F. The results of these tests were extrapolated j
to design basis conditions in Calculation FC05916, " Operating Temperature Limits for
'
DG-1 and DG-2 " Revision 3. The team's review of this calculation and discussions with the licensee's personnelindicated that this calculation was essentially a snapshot of test
,
conditions that did not provide any indication or allowance for future degradation of the jacket water pump, nor did the current surveillance program adequately monitor such degradation. The team considered the lack of monitoring for jacket water pump degradation and the subsequent failure to consider this degradation in the calculation to be a weakness. The licensee issued Condition Report 199801925 to address this issue.
The description of this condition report states, that additional evaluation needs to be completed and a methodology developed to identify pump degradation prior to next summer's hot weather.
c.
Conclusions i
l The team's review identified that some of the licensee's information notices and generic letter evaluations were weak. The licensee had issued two Level 1 condition reports and received a Severity Level IV and a noncited violation for failure to identify the scope of l
review and implement adequate corrective actions related to the inadvertent dilution of
the reactor coolant system, and yet failed to identify all affected procedures. The long-term failure to establish measures to assure that conditions adverse to quality are (
promptly identified and corrected was identified as an example of a violation of l
Criterion XVI of Appendix B to 10 CFR Part 50.
t 5.
Operator Work-Arounds and Control Room Deficiencies a.
insoection Scoce (40500)
The team reviewed Operations Department Policy and Directive OPD-4-17," Control Room Deficiencies and Operator Work Arounds," Revision 8, which described the process for controlling operator work arounds and the licensee's controls for ensuring l
timely corrective action of operator work arounds. The team also reviewed the most current control room deficiency list, dated October 20,1998.
J
.
i
.
.
-19-b.
Observations and Findings Ooerator Work Arounds i
Operations Department Policy and Directive OPD-4-17 defined operator work arounds as alternate actions required of operators to compensate for the inoperable or deficient condition of a component. Operator work arounds could complicate operator responses during emergency or transient conditions. The term determined that the licensee had identified 6 current operator work arounds,2 of which impacted emergency operating or abnormal operating procedures. Over the past 6-month period, the average number of operator work arounds decreased from about 22 to 7. The average time the licensee took to close an operator work around also decreased from about 200 to about 60 days.
All current operator work arounds had resolution dates assigned and were being tracked.
The team identified that Operator Work Around 98-17," Licensed Operator Must Track inventory Changes During Plant Cooldown," was initiated from Condition Report 199800739, which identified a deficiency of the reactor vessel head vent system to adequately vent non-condensable gases from the reactor vessel head during plant cooldown. The compensatory measures for the operator work around required operators to perform manual tracking of inventory changes on Form FC-1327, "RCS Inventory Log During Shutdown Conditions." Procedure OP-3A, " Plant Shutdown," Step 22, required, in part, that during cooldown, operators use Form FC-1327 to track reactor coolant system inventory changes and volume control tank gas space additions for possible reactor vessel head bubble formation.
The team questioned NRC-licensed operations personnel as to how the information recorded on Form FC-1327 assiated in the determination of the void size in the reactor vessel head and who recorded and analyzed the information. Some operations personnel could not explain the process used to calculate the size of a reactor vessel head bubble. The team discussed this operator work around with an operations supervisor who explained that the shift technical advisor reviewed Form FC-1327 each shift during plant cooldowns. A determination of potential bubble size was made based on the amount of reactor coolant system charging and letdown, and changes in volume control tank, pressurizer, and reactor vessel indicated level. Licensee representatives acknowledged that this operator work around compensatory measure was not sufficiently detailed to aid the control room operators in overcoming the design deficiency of the reactor vessel head vent system. In addition, Procedure OP-3A did not provide clear instructions to control room operators on how to calculate the size of a possible reactor vessel head bubble, and how the information should be utilized. Licensee personnel indicated that there were plans to review this issue.
The team also identified as an operator work around the licensee's reliance on operators to manually control the auxiliary building ventilation heating system to prevent the auxiliary building ventilation system from tripping and being declared inoperable. As discussed in Section 6.b, the licensee's program did not recognize this condition as an operator work aroun.
,
.
-20-Cor trol Room Deficiency identification Proaram Directive OPD-4-17 defined a control room deficiency as any plant component that has been identified as deficient, which is operated or controlled from the control room, provides indication or alarm to the control room, provides testing capabilities from the control room, provides automatic actions from or to the control room, or provides a passive function for the control room. Directive OPD-4-17 also prescribed that the control room deficiency list be walked down every week by an operations engineer to ensure that the list accurately reflects the currently identified control room deficiencies.
The team identified that 4 of 24 control room deficiencies did not have required control room deficiency identification tags, as compared to the control room deficiency list. The operations supervisor informed the team that 2 of these control room deficiencies, Work Requests 0000796 and 0000037, were closed out the week before. The operations supervisor also indicated that the other two control room deficiencies, Work Requests 9802254 and 0001418, had been worked and were waiting for post-maintenance testing to be performed.
-
Standing Order SO-M-101, Section 5.10.8, stated that work request stickers were to be removed af ter post maintenance or other testing has been satisfactorily completed.
Once the team informed the operations supervisor of these discrepancies, he directed that new stickers be affixed to the affected control roorn equipment. The team also identified that the control room deficiency tracking list was not up-to-date as several control room deficiencies had not been removed from the list after closure. In additinn, the control room deficiency tracking list was not complete in identifying control room panel locations where equipment tags were located.
The team interviewed the licensee operations representative who performed the most recent walkdowns and reviewed the most recent weekly walkdown results. The team determined that none of the required walkdowns had been performed since September 29,1998, a 3-week period at the time of the team's discovery. Weekly walkdowns were performed up to September 29, when the operations personnel indicated that they were directed by licensee management to stop performing the walkdowns.
The team notified licensee management of these findings. The licensee management provided the team with a copy of Condition Report 199801283, Level 4, which was initiated from a quality assurance audit. This condition report detailed numerous deficiencies with the control room deficiency identification program. The condition report identified that walkdowns and audits of the control room deficiency program had not been adequately performed, maintenance work request stickers were missing from control room equipment, and the wrong priority was assigned to a control room deficiency maintenance work request. The condition report cause description described that the quality assurance audit was performed during an outage when operation and scheduling departments were focused on outage work. The condition report action item description recommended that Directive OPD-4-17 be revised to make allowances for outages and not require walkdowns and audits during outages. The condition report closure description stated that Directive OPD-4-17 had been revised to accommodate outage i
,
.
-21-conditions, and that the shift manager and the operations control center supervisor had the final call on the identification of a control room deficiency. The team noted that Condition Report 199801283 remained open and that planned corrective actions had not yet been effective in improving the control room deficiency process. This was evident by the number of problems with the control room deficiency process, during nonoutage power operations.
Licensee personnel initiated Condition Report 199801929, dated October 22,1998, to address the problems identified by the team. Personnel assigned the condition report a Level of 3, based on conditions occurring with a frequency that is unacceptable. The condition report identified all the issues the team identified plus additional prob.lems. The licensee acknowledged in the condition report that there were problems with the control room deficiency process and that there was no clear owner responsible for the generation and updating of the control room deficiency list.
The team did not identify and maintenance or testing that had been overlooked or performed incorrectly. Further no safety-significant issues were identified as a result of the poor program documentation. The team determined that the failure to place control room deficiency tags on affected equipment, perform weekly walkdowns, and maintain the control room deficiency list, constitutes a violation of minor significance and is not subject to formal enforcement action.
c.
Conclusions The number of operator work arounds had recently been greatly reduced and was being effectively maintained at a low level. The resolution and closure of operator work arounds were timely and consistent with licensee priorities. However, the compensatory measures for operators regarding one operator work around for calculating reactor vessel head bubble formation was vague. The licensee inappropriately had not considered the manual operation of the auxiliary building ventilation heating system to prevent the ventilation system from shutting down as an operator work around.
The control room deficiency identification program was not adequately maintained and, corrective actions to address weaknesses in the program had not been effective.
Additional corrective actions were planned, and the condition report remained open.
6.
Review of Operating Logs, Audits, and Self-Assessments a.
jns.pection Scope (40500)
The team held discussions with operations personnel and reviewed control room logs for the 2-month period of March through April 1998, to determine if any logged items met the threshold for the initiation of a condition report. The team also reviewed operations night notes and shift memoranda. A review was also conducted of guidance for the development of audit plans and checklists, the two most recent audits, and the latest self-assessment of the corrective action program. Interviews were conducted with members of the Nuclear Safety Review Group.
i
.
-22-b.
Observations and Findings Operatina loos The team's review of operating logs indicated that operations personnel routinely logged equipment deficiencies. The team verified that condition reports were appropriately initiated on the logged deficiencies. In addition, numerous log entries referenced that condition reports had been initiated. Other log entries referenced that maintenance work requests were written on certain equipment deficiencies that did not meet the threshold of a condition report. in general, operations personnel initiated condition reports on equipment deficiencies that were adverse to quality. However, the team identified two instances where equipment deficiencies were logged and equipment declared inoperable. The team questioned whether condition reports should have been initiated.
On April 29,1998, at 12:58 a.m. control room operators logged that radwaste
building radiation Monitor RM-43, noble gas channel, was declared inoperable when its check source window stuck open. The licensee had initiated maintenance work request, MWR 9801420, on April 22 when the check source window began to stick. Maintenance work order, MWO 981416, was initiated on April 30, to repair the stuck check source window. RM-43 is a non-safety related radiation monitor that is not referenced in technical specifications. The team considered the handling of this equipment failure under the work request program as acceptable.
On March 11,1998, at 5:33 a.m., control room operators logged that the auxiliary
building ventilation dampers tripped shut, that auxiliary building radiation Monitor RM-62 sample pump tripped off, and that Monitor RM-62 was declared inoperable. Monitor RM-62 is referenced in technical specifications and in the off-site dose calculation manual. At 5:35 a.m., control room operators logged that the auxiliary building ventilation " freeze stats" were overridden, which reestablished auxiliary building ventilation, that Monitor RM-62 sample pump was restarted, and that Monitor RM-62 was declared operable.
The team reviewed Condition Reports 199700453,199701490, and 199800044, which were initiated due to repeated problems with the auxiliary building ventilation system tripping off, due to freeze-stat problems. The auxiliary building ventilation system is heated by providing auxiliary steam to two steam coils, the pre-heater coil, and main heating coil. The steam supply to the preheating coil is manually controlled. This design relies on operator action to provide the required steam supply to prevent freezing of the coils. If outside air temperature drops and the preheater steam coil flow is not manually increased, there is a potential to actuate a " freeze stat," which functions to trip the auxiliary building ventilation system fans, to prevent freezing of the main heating coil. The trip of the fans render the auxiliary building exhaust stack radiation Monitors RM-62 and RM-63 inoperable. Operations personnel have become accustomed to this situation happening during cold weather conditions.
i l
l
'
l
l
?
.
23-
l l
Condition Report 199700453 referenced an earlier Condition Report 199601621 that stated there have been numerous times in the past where these coils have
,
'
frozen and ruptured. Condition Report 199701490 indicated that the licensee-generated Operator Work Around OWA 97-31 on November 3,1997, for auxiliary l
building supply ventilation freeze-stat YTC-850 tripping. The licensee's corrective l
action, described in Condition Report 199701490, was to add new instructions to Procedure Ol-VA-2, " Auxiliary Building Ventilation System Normal Operation,"
Revision 7, and Procedure OI-AS-1, " Auxiliary Steam System Normal Operation,"
Revision 27. The instructions provided operators guidance on the control of the auxiliary building ventilation heating system. The licensee considered the l
addition of these instructions sufficient to remove the operator work around on December 4,1997.
Open Condition Report 199800044, dated January 13,1998, described the problem of the freeze-stats tripping as an existing design problem which l
appeared to be caused by the interaction of several conditions, e.g., coil steam I
admission valve not controlling in auto, stratification of air downstream of heating
)
coils, and a lack of automatic preheating coil steam pressure control. The licensee requested engineering assistance and initiated Engineering Assistance Request 98-038, on February 20,1998, to evaluate the interactions of all identified auxiliary building ventilation problems. The condition report action item was to verify the completion of Engineering Action Request 98-038. Design
'
engineering review of Engineering Action Request 98-038 was scheduled for May 1999. The team determined these corrective actions to be adequate. However, despite repeated occurrences and reliance on operator actions to assure the normal operation of the auxiliary building ventilation system and the operability of Monitor RM-62, the licensee inappropriately did not consider this condition to be an operator work around. The team determined that the condition was an operator work around.
Audits and Self-Assessments The team reviewed Procedure OAM-10," Conduct of Internal Audits," Revision 15, and the related guidance for preparation of an audit checklist. A subsequent review of specific Quality Assurance Audits 98-SARC-003, dated January 9,1998, and 98-SARC-023, dated July 30,1998, and their associated checklists, revealed that the l
audits were appropriately performed in accordance with the licensee's procedures and l
requirements.
The team observed that together the audits resulted in the generation of 11 condition reports and 7 recommendations. Generally, the audit-generated condition reports addressed single element performance issues related to the auditor's review of an
,
'
individual condition report. Most of the audit findings appeared to identify administrative problems with condition report disposition.
In general, recommendations identified programmatic issues (i.e., improve feedback to originators, communicate management expectations, and develop a process to adjust the corrective action program from experience gained). The team noted that the
!
_
.
.
-24-
'
licensee's guidance did not identify any critical attributes for the evaluation of individual corrective action program elements (i.e., identification, evaluation, cause determination, etc.).
The team reviewed the most recent self assessment related to the corrective action program, SRG 98-018,"NSRG Self-Assessment of NSRG/Ouality Assurance / Quality Control." This assessment focused mainly on the performance by nuclear safety review, quality assurance, and quality control groups. A performance-based or programmatic assessment of the licensee's corrective action program was not performed during this effort.
During interviews with nuclear safety review group personnel, the team became aware that audits and evaluations of the corrective action program were always performed by quality assurance. The nuclear safety review group had not been involved for some time
,
in the assessment or evaluation of the corrective action program.
'
c.
Conclusions Operations department personnel, in general, had a low threshold for initiating condition reports. However, one example was identified where the threshold was high and the corrective action system had not been effective in addressing the problem of inadvertent auxiliary building ventilation systern shutdown. The guidance for the performance of audits and the corrective action program audits were adequate.
7.
Licensee Event Reports i
a.
Insocction Scoce The team reviewed a sample of recent licensee event reports to assess the adequacy of the licensee's cause determination and corrective action, b.
Observations and Findinas l
The licensee event reports reviewed provided the basis for determining the cause of the l
event, and corrective actions to be taken to prevent recurrence. The team verified that l
the licensee's corrective actions taken were adequate to address the events and prevent l
recurrence.
b.1 (Open) Licensee Event Report 50-285/98-08: overpressurization of auxiliary feedwater piping due to misadjustment of governor.
Backaround Licensee Event Report 98-08 reported an event that resulted in the inadvertent overpressurization of the auxiliary feedwater system during overspeed testing of the steam-driven Auxiliary Feedwater Pump FW-10. A subsequent detailed root cause analysis identified the direct and contributing causes of the event and corrective actions
l, j
,
'
,
-25-
,
l were developed and identified in this event report and Condition Reports 199801246 and 199801255. The team noted that a corrective action specified in the event report was the implementation of a facility modification. The modification (MR-FC-98-008) consisted of the installation of a safety-related pressure switch in conjunction with a safety-related solenoid valve arranged to sense an overpressure condition at the discharge of Pump FW-10 and cause the turbine steam supply valve to trip shut, thus, reducing the potential for gross system failure due to overpressurization.
Inspection ollowuo c
The tearn considered the modification to be an adequate means to prevent overspeed of Pump FW-10 leading to system overpressure, and eliminate the potential for gross system failure, due to system overpressurization. The team reviewed the licensee-performed screen and safety evaluation required by 10 CFR Part 50.59, for the licensee to implement Facility Modification MR-FC-98-008 without prior NRC approval. The purpose of the licensee's evaluation was to determine if an unreviewed safety question had resulted from the facility change. The team noted the following.
Evaluation Section B.7 posed the question, "Could the proposed activity increase
the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the USAR7" The answer provided,"The circuit and associated components are designed and constructed to critical quality element (Safety-Related) requirements to ensure the existing level of reliability. The spurious actuation of the pressure switch and/or solenoid valve could cause a loss of FW-10 and is considered part of the Pump FW-10 single failure. PUMP FW-6 (electric-driven auxiliary feedwater pump) powered from DG-1 would be available to perform the auxiliary feedwater function."
10 CFR 50.59(a)(1) states that a change may be made to a facility without prior
-
Commission approval unless the proposed change involves a technical specification change or an unreviewed safety question.
10 CFR 50.59 (a)(2) states that a proposed change shall be deemed to involve an
-
unreviewed safety question if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis, may be increased.
The team observed that the licensee's evaluation recognized that potential spurious actuation of newly installed components could cause a loss of Pump FW-10 and was considered part of the single failure analysis. Following the onsite portion of the inspection, the licensee submitted in a letter dated November 16,1998, additional information to be considered in this matter. The inspection team reviewed and l
'
considered this information to make a determination.
I
-=.-
-
.. -.
'
.
.
.
,
-26-l l
l The team determined that the modification had resulted in the introduction of a failure i
!
mode that did not previously exist and appeared to increase the probability of the single
'
failure of FW-10; therefore, it was an unreviewed safety question. This failure constitutes a violation of minor significance and is not subject to formal enforcement action for the l
following reasons:
l l
The design change represented an overall improvement to the auxiliary feedwater i
system. While the probability of a malfunction of Pump FW-10 may have been increased, the likelihood of a catastrophic failure (caused by pump overspeed) of the entire auxiliary feedwater system was reduced.
l b.2 (Closed) Licensee Event Report 50-285/97-13: voluntary entry into the general shutdown l
technical specification action statement. On August 25,1997, the licensee removed i
instrument Inverter A from service to perform scheduled maintenance. While removing the inverter from service the manual transfer switch was found to be broken. This condition placed the licensee in Technical Specification 2.7(2)O, and a 24-hour limiting condition for operation. The licensee decided to repair the switch by providing temporary
.
power to the inverter bus. However, this configuration required the licensee to declare l
Instrument Bus A inoperable, as well as Inverter A. Technical Specifications does not
!
allow this configuration; therefore, Technical Specification 2.0.1 was entered. The j.
licensee commenced a reactor shutdown to be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> while conducting
'
repairs. Technical specification 2.0.1 was exited approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> later, after repairs were completed on the inverter manual transfer switch and the instrument inverter. At that time, reactor power had been reduced to approximately 22 percent.
!
The team reviewed and verified corrective actions taken by the licensee as described in this licensee event report and Condition Report CR 19971100. The team found that the corrective actions taken were commensurate with safety significance and were
[
acceptable..
c.
Conclusions Corrective actions taken by the licensee to address conditions identified in licensee event reports were appropriate.
l 8.
Corrective Action Program Conclusions l
The corrective action program at Fort Calhoun Station generally has been effective. The
team recognized an apparent low threshold for entry into the program as employees l
were using the program. There was also common understanding and philosophy shared
by individual managers about the program capabilities and goals. The team relayed to
!
facility management observations related to timeliness of condition report initiation, weak cause and operability evaluations, and significance of repeat failures.
l
.
l l
l
.
__
_ _ _ _.. _ _ _
. _ _. _. _ _ _
.
_
l
.
27-9.
Exit Meeting Summary The team presented the inspection results to members of licensee management at the conclusion of the onsite inspection on October 23,1998. The licensee's management i
acknowledged the findings presented. Licensee management commented on a potential unresolved item and expressed a belief that the related safety evaluation for the modificdon to Pump FW-10 met the regulatory requirements. Additionalinformation regarding the evaluation was submitted by the licensee in a letter dated November 16, 1998. A supplemental telephonic exit was held on December 11,1998. During this discussion, the licensee's str.ff was informed of the resolution of the potential unresolved,
item.
The team asked the licensee's representatives whether any material examined during the inspection should be considered as proprietary. No proprietary information was identified.
l l
l
.
_.
..
. _ _ _,
.m_.
.
_
_ _ _..
_ _.
_.. _ _.
_
.. - _ _ _.
. _ _.
...
t
..
,
.
ATTACHMENT
1 SUPPLEMENTAL INFORMATION
' PARTIAL LIST OF PERSONS CONTACTED Licensee M.LCore, Manager, System' Engineering M. Ellis, Supervisor, Maintenance Support -
. M. Frans,' Manager, Nuclear Licensing
.W. Harsher, Supervisor, Station Licensing J K. Henry, Supervisor, Primary System Engineering T. Herman, Senior Quality Assurance Lead Auditor J
. R. Jaworski, Manager, Design Engineering G.' Kavanagh, Licensing Engineer.
R. Ridenoure, Manager, Operations H. Se' lick, Manager, Security Services
,
J. Sk!les, Manager, Station Engineering J. So!ymossy, Plant Manager J. Spilker, Manager, Corrective Action Group z D. Spires, Manager, Quality Assurance M. Tesar, Acting Division Manager, Nuclear Support D. Trauseh, Manager, Nuclear Safety Review Group J. Tills, Assistant Plant Manager R Westcott, Manager, Training.
Qtharra G. Cook, Supervisor, Regulatory Compliance, San Onofre Nuclear Generating Station INSPECTION PROCEDURES USED IP-40500 Effectiveness of Licensee Controls in Identifying, Resolving, and Preventing Problems ITEMS OPENED, CLOSED, AND DISCUSSED Opened 50-285/9819-01 VIO Inadequate Corrective Action to Assure Operability and Prevent Boron Dilution (Section 3.b)
-
,
i i
..
~
,
,,,.
-
. - - - -
. _.,
, _ _
- l
..
2-Closed
!
50-285/97-13 LER Voluntary Entry into the General Shutdown Technical Specification Action Staternent (Section 7.b)
\\
l
'
Discusned
50-285/98-08 LER Overpressurization of Auxiliary Feedwater Piping Due to Governor
'
Misadjustment (Section 7.b)
LIST OF LICENSEE PROCEDURES REVIEWED j
SO-R-2," Condition Reporting and Corrective Action," Revision 7 SO-M 100," Conduct of Maintenance," Revision 27 SO-M-101, " Maintenance Work Control," Revision 46 MD-AD-0002, " Maintenance Work Request Creation, Disposition and Closure," Revision 5 l
l SO-O-1," Conduct of Operations," Revision 37 Surveillance Test OP-ST-CCW-3001," Component Cooling Category B Valve Exercise Test" Procedure NOD-OP-21," Operating Experience Review Program," Revision 8 CH-SMP-PA-0001," Post-Accident Sampling System Normal Operation," Revision 19 l
l Procedure IC-CP-01-6713, " Calibration of PASS Drain Collecting Tank Level Switch LS-6713,"
Revision 0 Operations Department Policy and Directive OPD-4-17, " Control Room Deficiencies and Operator Work Arounds," Revision Procedure OP-3A," Plant Shutdown, Revision 3 Procedure OI VA-2," Auxiliary Building Ventilation System Normal Operation," Revision 7 Procedure OI AS-1," Auxiliary Steam System Normal Operation," Revision 27 Procedure OAM-10 " Conduct of Internal Audits," Revision 15
.
.
. s.
,
.
. o-3-
-
i
>
LIST OF DOCUMENTS REVIEWED
'
i j
98-SARC-003, SARC Corrective Action Audit Report, January 9,1998
98-SARC-023, SARC Corrective Action Audit Report, July 30,1998 SGR-98-018, Self-Assessment of NSRG, OA, and OC
.
Construction Work Order 98-0047 l
l Calculation FC05916, Operating Temoerature Limits for DG-1 and DG-2, Revision 3 L
50.59. Safety Evaluation for Facility Modifiotion MC-FC-98-008 s
Repetitive Maintenance Orders 972892 973542
- -
Maintenance Work Reauests 9702934 9703221 9703595 9801164 9801960 9702935 9703257 9703610 9801165 9802056 9702966 9703352 9703700 9801166 9802284 l
9702976 9703398 9703733 9801168 9802692 L
9703006 9703487 9703734 9801205 9802749 9703097 9703489 9703752 9801207 9802866 9703107 9703495 9704045 9801208 9803048 l
9703126 9703534 9704056 9801209
l.
9703127 9703565 9704493-9801884
'
9703157 9703593 9801163 9801958 Maintenance Work Orders 972882 973117 973356 973533 974081
972940 973125 973423 973553 974203 L
972997 973147 973424 973567 977019 f'
973080 973223 973443 973659 980535 l
973081 973279 973469 973708
!
!
Licensee Event Reports i
97-007 97-012 97-013 98-008 97-010
,
t
$
.
.
. --.
_
-
-
.-
s
.
l-4-
'
Condition Recods 199500391 199701232 199701661 199800305 199800917 199601239 199701277 199701662 199800318 199800920 199700015 199701281 199701673 199800326 199800929 i
'
199700067 199701308 199701679 199800344 199800942 199700203 199701313 199701687 199800346 199800958
'
199700489 199701320 199701705 199800372 199800967 l
199700570 199701354 199701708 199800373 199800996 l
199700775 199701358 199701732 199800407 199801023
)
199700911 199701359 199800015 199800426 199801035 199700977 199701368 199800024 199800448 199801066 l
199700978 199701393 199800033 199800458 199801083 199700984 199701430 199800043 199800509 199801099 199700992 199701442 199800065 199800553 199801117 199701026 199701447 199800066 199800600 199801148 199701036 199701463 199800076 199800605 199801157 199701054 199701470 199800079 199800639 199801187
'
199701084 199701480 199800088 199800640 199801200 199701094 199701485 199800098 199800650 199801227 199701106 199701490 199800103 199800660 199801245 199701121 199701496 199800107 199800682 199801283 199701124 199701499 199800147 199800702 199801366 199701126 199701524 199800207 199800703 199801579 199701133 199701532 199800218 199800751 199801633 199701142 199701555 199800219 199800752 199801654 199701152 199701556 199800220 199800763 199801661 199701165 199701568 199800226 199800764 199801683 199701177 199701578 199800227 199800778 199801732 199701178 199701589 199800233 199800786 199801751 199701194 199701605 199800236 199800833 199801929 199701201 199701625 199800237 199800894 199701211 199701632 199800245 199800896 199701222 199701642 199800278 199800905
199701226 199701643 199800284 199800908 Enaineerina Assistance Reauests97-203 97-305 97-335 98-108 97 221 97-306 97-345 98-183 97-245 97-327 97-366 97-300 97-332 98-047 l
!
l l
$
.
-Q-5-System Report Cards EOS-SYE-97-188, dated July 16,1998 EOS-SYE-97-241, dated July 16,1998 EOS-SYE-97-250, dated July 16,1998 EOS-SYE-98-010, dated January 16,1998 EOS-SYE-98-017, dated January 16,1998 EOS-SYE 98-028, dated January 16,1998 EOS-SYE-98-094, dated January 16,1998 EOS-SYE-98-102, dated January 16,1998 EOS-SYE-98-112, dated January 16,1998 Licensee Response to Generic Communications and Operational Events INFORMATION DESCRIPTION NOTICES 91-50, Suppl.1 Potential for Water Hammer During Restart of Residual Heat Removal Pumps 91-85R1 Potential Failure of Thermostatic Control Valves or DG Jacket Cooling Water Valves 97-14 Assessment of Spent Fuel Pool Cooling 97-16 Preconditioning of Plant SSCs Before IST or Technical Specification Surveillances
'
97-27 Effect of incorrect Strainer Pressure Drop on Available Net Positive Suction Head 97-33 Unanticipated Effect of Ventilation System on Tank Level Indications and Engineering Safety Features Actuation System Setpoint 97-38 Level Sensing System initiates Common-Mode Failure of High Pressure injection Pumps 97-41 Limerick EDG Lubricant Oil Coolers were Undersized Relative the Design Conditions Reported on the Heat Exchanger Data 97-52 Inadvertent Loss of Capability for Emergency Core Cooling System Motors 97-60 incorrect Unreviewea Safety Question Determination Related to Emergency Core Cooling System Swap Over from the injection Mode to the Recirculation Mode l
.
.
.
.
I,
-
%
6-97-76 Degraded Throttle Valves in Emergency Core Cooling System Resulting from Cavitation-Induced Erosion During a Loss-of-Coolant Accident i
97-78 Crediting of Operator Actions in Place of Auto Actions & Modification of Operator Actions, including Response Time 97-81 Deficiencies in FEMA for l&C Systems 97-83 Recent Events involving Reactor Coolant System Inventory Contro!
'
During Shutdown 97-90 Use of Non-Conservative Acceptance Criteia in Safety-Related Pump Surveillance Test 98-02 Nuclear Power Plant Cold Weather Problems and Protective Measures 98-22 Deficiencies identified During NRC Design Inspections 98-23 Crosby Relief Valve Setpoint Drift Problems Caused by Corrosion of the Guide Ring
,
,
GENERIC DESCRIPTION LETTER 97-04 Assurance of Sufficient NPSH for ECCS and Containment Heat Removal Pumps 98-02 Loss of Reactor Coolant Inventory and Associated Potential for Loss of Emergency Mitigation Functions While in a Shutdown Condition 98-03 Year 2000 Readiness Programs
!
,