IR 05000313/1998001
| ML20236H045 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 07/01/1998 |
| From: | Powers D NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | Hutchinson C ENTERGY OPERATIONS, INC. |
| References | |
| 50-313-98-01, 50-313-98-1, 50-368-98-01, 50-368-98-1, EA-98-158, NUDOCS 9807070065 | |
| Download: ML20236H045 (4) | |
Text
.
e t ' MGy[1 k
UNITED STATES g1 NUCLEAR REGULATORY COMMISSION f.
.
,
- $
REGION IV
%
G11 RYAN PLAZA DRIVE, SUITE 400
%,
AR LINGTON, T E XAS 76011-8064 July 1,1998 EA 98-158 C. Randy Hutchinson, Vice President Operations Arkansas Nuclear One Entergy Operations, Inc.
1448 S.R. 333 Russellville, Arkansas 72801-0967 SUBJECT: RESPONSE TO NRC INSPECTION REPORT 50-313/98-01; 50-368/98-01 Thank you for your letter of June 22,1998, in response to our May 7,1998, letter and Notice of Violation conceming the failure to include the Unit 2 turbine building sump system in the scope of the Maintenance Rule program, the failure to adequately demonstrate a balance of availability and reliability for certain risk significant systems, and the failure to have adequate monitoring requirements for certain systems. We have reviewed your reply and find it responsive to the concerns raised in our Notice of Violation. We will review the implementation of your corrective actions during a future inspection to determine that full compliance has been achieved and will be maintained.
Sincerely, M
W Dr. Dale A. Powers, Chief
,
Maintenance Branch l
Division of Reactor Safety j;
l l
Docket Nos.: 50-313;50-368 l
'
cc:
Executive Vice President
& Chief Operating Officer Entergy Operations, Inc.
P.O. Box 31995 Jackson, Mississippi 39286-1995 9007070065 900701 PDR ADOCK 05000313 G
._
_ _ _ _ _ _ _ _ _
-_
_ - _ _ _ _ - - - _ _ - _ _ - _ - _
_ - _ _ _ _ _ _ - - _ _ _ _ _ _ _ - - _ _ - _ _ _ _ _ _ _ - _ _ _ _ - _ _ - - _ - _ - _ _ _ _ - -
>
.
,.
Entergy Operations, Inc.
.-2-I
' Vice President Operations Support
. Entergy Operations, Inc.
P.O. Box 31995 -
Jackson, Mississippi 39286 -
Manager, Washington Nuclear Operations ABB Combustion Engineering Nuclear Power.
12300 Twinbrook Parkway, Suite 330 Rockvil:e, Maryland 20852-
. County Judge of Pope County
. Pope County Courthouse Russellville, Arkansas 72801 Winston & Strawn 1400 L Street, N.W.
Washington, D.C,' 20005-3502 David D. Snellings, Jr., Director-Division of Radiation Control and Emergency Managements Arkansas Department of Health 4815 West Markham Street, Mail Slot 30 Little Rock, Arkansas 72205-3867
'
Manager-Rockville Nuclear Licensing
- Framatome Technologies
,
1700 Rockville Pike, Suite 525 Rockville, Maryland 20852 i
!
I
,
R
!
[n f
- - - - - - - - - -
-
_ _ - - _ _
_
- - _ - - - - - -. - _ - - - - - _ - _ _ _ - - - - - - - - - - - - _ _ _. _ _
_ _ _ - - _ _
_. _ - -. _ - _
.
- s'.
.-
,
Entergy Operations, Inc.
-3-g.bocto DCD'(IE01);Cr bcc distrib. by RIV:
- Regional Administrator-
. Resident inspector DRS Director
~ DRS Deputy Director.
DRP Director MIS System Branch Chief (DRP/C)
RIV File
' Project Engineer (DRP/C)
DRS-PSB Branch Chief (DRP/TSS)-
C. Goines (Al 98-G-0074)
-,
b
..
- DOCUMENT NAME: R: ano\\an801ak.pcg
_
To recolve copy of document. Indicate in box: "C" = Copy without enclosures "E" = Copy with enclosures "N" = No copy l-RIV: SRI:MB,sj C:MB c
PCGage
DAPowersdf 07/i/98 07/t /98 OFFICIAL RECORD COPY CCGG38
-- _
-_
-
.-_.
-
_ _ _ _ - _ _ _ _ _ _ _ _.
._ ____-___ _______ _____ - _ _
e Q,
- Entergy Operations, Inc.
-3-
_bec to DCD'(IE01)
. bec distrib. by RIV:
- Regional Administrator Resident inspector
.
- DRS Director -
DRS Deputy Director DRP Director MIS System Branch Chief (DRP/C)
RIV File Project Engineer (DRP/C)
DRS-PSB Branch Chief (DRP/TSS).
- C. Goines (Al 98-G-0074)
.
DOCUMENT NAME: R: ano\\an801ak.pcg -
._
To receive copy of document, indicate in box: "c" = Copy without enclosures "E" = Copy with enclosures "N" = No copy l
RIV:SRl:MB,s)
lC:MB c. i PCGage N
' DAPowers df 07/(/98 07/I/98-OFFICIAL RECORD COPY f.
l I'
_ - - - _ - - - _ _. - _ - - - _ - _ _ _ - - _ - - _ _ - _ _ _ _ _ _ _ _ - -
_ - _ _ _ _ - - - - - - - _ _ - _ _ _ _ - - - -. _ _ _ _.,
.,3
>; '
Entergy operations,Inc.
--
'9
~~~
.
N 1448 SA 333 Russelure. AR 72801 Tel501858 5000 10CFR2.201
.ig
,
"- -'
June 22,1998
t
>
'0CAN069801.
M b' 0 a
l L _.
_
,. ;
U. S. Nuclear Regulatory Commission
[
MiP 0~'
- Document ControlDesk Mail Station OP1-17 Washington, DC 20555 l
Subject:
Arkansas Nuclear One-Units 1 and 2 Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6 Response ToIaWion Report 50-313/98-01;50-368/98-01 Gentlemen:
Pursuant to the provisions of 10CFR2.201, attached are the responses to the notices of violation identi6ed during the iaW on of Maintenance Rule implementation at Arkansas i
Nuclear One(ANO).
Per discussion with Dale Powers on June 4,.1998, an extension was granted until June 22, 1998, for submittal of our response to the notices of viols 1%n. Sbuld you have any questions -
or comments, please call me at 501-858-4601.
Very truly yours, k
Dale R me Act. F r, Nuclear Safety
'
ing DEJ/ajs i
.,*. A
.
-
!a c 'Ef - J 6 'S 0 l
r l
.
ODr M :
.'
+ r n, fL1Vhre A,,/v w w Il f
.
U. S. NRC June 22,1998
-
'
Page 2
,
.
cc:
Mr. Ellis W. Merschoff Regional Administrator U. S.NuclearRegulatory Commission I
Region IV.
611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-8064 i
NRC SeniorResident Inspector Arkansas Nuclear One P.O. Box 310 j
London, AR72847 Mr. William D. Reckley NRR Project Manager Region IV/ANO-1 & 2 U. S. Nuclear Regulatory Commission NRR Mail Stop 13-H-3 One White Flint North 11555 Rockville Pike
Rockville, MD 20852 l
i i
L i
l
--_--__
- _ _ - _ _ _ - - _ _ _ _ _ - _ _ _ _
i Attachment to OCAN069801
-
)
[
Page 1 cf16 NOTICE OF VIOLATION I
During an NRC inspection conducted January 26-30, 1998, with in of5cc inea-+ ion performed through March 30,1998, five violations of NRC requirements were identiSed. In accordance with the " General Statement of Policy and Procedure for - NRC Enforcement Actions," NUREG-1600, the violations are listed below:
A.
10 CFR 50.65(bX2) requires, in part, that the scope of the monitoring program speci6ed in paragraph (aXI) shall include certain 'non safety-related structures,
. systems, and components whose failure could prevent safety-related structures, systems, and components from fulfilling their safety-related function.10 CFR 50.65(c) states that the requirements of this section shall be implemented by each hcensee no later than July 10,1996.
Contrary to the above, from July 10,1996, until January 28,1998, the Unit 2 turbine building sump system was not included in the scope of the Maintenance Rule program. The inclusion of the turbine building sump in the scope of the Maintenance Rule was necessary because of the adverse effect imposed on a safety system (emergency feedwater) as a result of the potential failure of the turbine building
sump.
i This is a Severity Level IV violation (Supplement 1) (50-368/9801-01). There is no response required to this violation.
!
B-10 CFR 50.65(aX2) requires, in part, that monitoring as 'specified in 10 CFR 50.65 l
.
(aXI) is not required where it has been demonstrated that the performance or
!
condition of a structure, system, or component is being effectively controlled through the performance of appropriate preventive maintenance, such that the structure, system, or component remains capable of performing its intended function.10 CFR 50.65(c) states that the requirernents of this section shall be implemented by each l
~ licensee no later than July 10,1996.
10 CFR 50.65(aX3) requires, in part, that the holders of an operating license shall
!
evaluate performance and condition monitoring activities and associated goals and l
L preventive maintenance activities at least every refueling cycle provided the interval i
between evaluations does not exceed 24 months. Adjustments shall be made where i
necessary to ensure that the objective of preventive failures of structures, systems, and components through maintenance is appropriately balanced against the objective of minimizing unavailability of structures, systems, and components ~ due to monitoring or y.- ;ve maintenance.
,
l Contrary to the above, u of July 10,1996, the time that the licensee elected to not monitor the performance or condiden of certain structures, systems, and components against established goals pursuant to the requirements of Section (aXI), the licensee i
failed to demonstrate that the performance or condition of structuces, systems, and i
components within the scope of 10 CFR 50.65 had been effectively controlled by I
i
Attachment to
.
.
OCAN069801
-
l* #
Page 2 cf16
..-
performing appropriate preventive maintenance SpeA=Uy, the licensee failed to
'
adequately demonstrate the performance or condition of the emergency feedwater
!
initiation control system, the engineered safety features actuation system, the reactor l
building headng and ventilation system, the reactor buildir:g sumps, the reactor
.
protection system, the traveling screens and screen wash system, and the 120 Vac
,
!
instrumentation system had been effectively controlled by perfonning appropriate preventive maintenance. No availability measure was ' considered in the demonstration. Rehability.and ' availabdity measures are both necessary to demonstrate that preventive maintenance had been effective to ensure that system functions' will perform as required. Further, as a result of r.ot establishing performance measures for availability of these uructures, systems, and components, I
the periodic evaluation of preventive maintenance activities for Unit ? performed in
[
June 1997, in accordance with 10 CFR 50.65(aX3), did not adequatSi demonstrate
l a balance of availability and reliability.
'
l This is a Severity Level IV violation (Supplement 1) (50-313/9801-03).
i C.
10 CFR 50.65(aXI) requires, in part, that the holders of an operating license shall
monitor the performance or condition of structures, systems, and components, as
defined in 10 CFR 50.65(b), against licensee-established goals in a manner sufEcient l
to provide reasonable assurance that such structures, systems, and components are capable of fulfilling their intended functions. When the performance or condition of a structure, system, or~ compa* does not meet established goals, appropriate corrective action shallbe taken.
,
l 10 CFR 50.65(aX2) requires, in part, that monitoring as specified in 10 CFR 50.65
(aXI) is not required where it has been demonstrated that the performance or condition of a structure, system, or component is being effectively controlled through
the performance of appropriate preventive maintenance and the structure, system, or f
component remains capable of performing its intended function.10 CFR 50.65(c)
states that the requirements of this section shall be implemented by each Mcensee no later than July 10,1996.
Contrary to 10 CFR 50.65(aX2), as ot* July 10, 1996, the time that the licensee elected to not mordtor the perfo;mance or condition of certain structures, systems, and components against lice?see-established goals pursuant to the requirements of
- .
!
Section (aXI), the licensee had not demonstrated that the performance or condition of certain structures, systems, and components within the scope of 10 CFR 50.65 had been effectively controlled through the performance of appropriate p'reventive maintenance, as evidenced by the following examples:
1.
The licensee failed to establish adequate measures to demonstrate the performance or condition of the traveling screens and screen wash systems.
Sp-4"r=Hy, the licensee considered the traveling screens' availability to be tracked under the service water systems, but one traveling screen on each unit could provide adequate flow to all the service water loops, such that any l
l
)
'.
Attachment to -
OCAN069801 -
-
',
Page 3 of16 one screen in Unit 2 and any three screens in Unit I could be unavailable indefinitely without impacting the availability of the service water loops.
Allowing the traveling sens to reach such a state before taking corrective actions would not demonstrate that preventive maintenance was effective to control the system's performance or condition to maintain its intended function.
2.
The licensee failed to demonstrate that'the performance of a relay for the Unit 2 safety-related post-accident sampling system was being effectively controlled through the performance of appropriate preventive maintenance.
l Specifically, the licensee had established performance measures-for this J
c-paa-* ofless than three functional failures per two cycles and no repeat functional failures. These measures were not a~ dequate because the relay was only actuated once each cycle for surveillance testing of sampling valves and, therefore, it was unlikely to exceed two failures within two cycles. Thus, no adequate basis had been established to demonstrate that the performance or condition of the relay _ was being effectively controlled through the performance of effective preventive maintenance that the component remained capable of performing its intended function.
3.
The Ece failed to dsr.r,r.see that the performance of the containment integrity function was being effectively maintained through the performance of appropriate ym.4ve maintenance on the safety-signi6 cant containment isolation valves. SpadAmHy, the ]jCensee faiiod to demonstrate it had established adequate measures to evaluate the effectiveness of preventive maintenance on the containment isolation valves prior to placing them under Category (a)(2). A functional failure of either units' containment isolation valve, due to test leakage, would not have occurred until a limit imposed by Technical Specifications, Section 3.6.1, for integrated containment / reactor building leak rate was exceeded. Allowing containment isolation valves to reach such a state before taking corrective actions would not demonstrate
.that gweve maintenance was effective to control their performance or
condition to maintain its intended function.
'
4.
From July 10, 1996, through January 28, 1998, the licensee had failed to establish adequate measures to evaluate the appropriateness of the performance of preventive maintenance for the Unit 2 core protection calculator system. The licensee had recognized that the performance criteria j
were inadequate,. but failed to evaluate the effectiveness of the new j
perfonnsnce criteria established on Lwar 9,1997. Specifically, the
!
licensee had failed to perform a historical performance review of the system
!
data against the new performance criteria. On January 28,1998, the licensee performed the historical review and identi6ed one functional failure of the control element assembly calculator whose performance criteria were
'
monitored under the core protection calculator system
- _ _ _ - _ _
. _ _ _
- _ _ _ _
. - _ _ _ _
_ _ _______ _ _
_ _ _ _ _ _
___-
- Attachment to
.
.
.
OCAN069801
-
' ',
Page 4 ef16 i
This is a Severity Level IV violation (Supplement 1) (50-313; 368/9801-04).
l D.
10 CFR 50.65(aXI) states, in part, that holders of an operating license shall monitor the performance or condition of structures, systems, and components, as defmed by 10 CFR 50.65(b), against licensee-established goals in a manner suf5cient to provide l
reasonable assurance that such structures, systems, and components are capable of fulfilhng their intended functions. Such goals shall be established commensurate with l
safety and, where practical, take'into account industry-wide operating experience.
When the performance or condition of a structure, system, or component does not meet established goals, appropriate corrective actions shall be taken.
l Contrary to the above, the current licensee-established goals for the Unit 2 main steam safety valves were not commensurate with safety. Safety valve performance
was monitored against goals at a higher threshold for reliability than the normal performance criteria, which permitted excMag the license limits as speci6ed in Technical Speci6 cation 3.7.1.1 and the ASMF/ ANSI OM-1987 Code, Part 1.
Further, the corrective action established by the licensee could not be monitored by the goals. Implementation of the corrective action was not scheduled until January 1999.
l This is a Severity Level IV violation (Supplement 1) (50-368/9801-06).
E.
10 CFR 50.65(a)(1) requires, in part, that the holders of an operating license shall monitor the performance or condition of structures, systems, and components, as defined in 10 CFR 50.65(b), against lia.rmc::tablished goals in a manner suSicient
!
to provide reasonable assurance that structures, systems, and components are capable of nanmag their intended functions. When the performance or condition of a structure, system, or component does not meet established goals, appropriate i
corrective action shall be taken.
10 CFR 50.65(a)(2) requires, in part, that monitoring, as specified in 10 CFR 50.65 (a)(1), is not required where it has been demonstrated that the performance or condition of a structure, system, and component is being effectively controlled
through the performance of appropriate preventive maintenance and the structure, system, or component remains cap 61e of performing its intended function.10 CFR 50.65(c) states that the requirements of this section shall be implemented by each licensee no later than July 10,1996.
Contrary to the above, on March 13,1997, the licensee incorrectly permitted the 125
Vdc system for Unit 2 to remain under 10 CFR 50.65(a)(2) when preventive l
maintenance failed to assure that this system remained capable of performing its
l intended function. Speci6cally, a surveillance test failure of a swing charger was not l
identi6ed as a functional failure. The combination of the missed failure and two previously identi6ed failures demonstrated that the preventive maintenance being performed on this system was not appropriate. It failed to assure that the system remained capable of performing its intended function. Accordingly, the 125 Vdc
___
_
..
.
-
____. _ - _. _ - - _. _ _ _ _ - _ _. _ _ _ _ _.. __ _ _ _ _ _ _ _ _ _ _ __
______
Attachment to
.,
OCAN069801.
-
Page 5 of16 system should have been designated as a Category (a)(1) system following the failures.
This is a Severity Level IV violation (Supplement 1) (50-368/9801-07).
l I
l l
I
\\
,
i
!
i i
j e
,
(
_ _ - _
___ _______ - _-_ _ _ _ _ __ _ _ _ _ - _ _ _
_
-
.
Anvh-t to OCAN069801
-
Page 6 cf 16.
,
B. Resnonse to Notice of Violation (50-313/9801-03)
!
As a result of not establishing performance measuresfor amicability of the emergency j
feedwater initiation control system, the engineered safetyfeatures actuation system, the reactor building heating and wntilation system, the reactor building sumps, the reactor protection system, the traveling screens and screen wash system, and the 120 Vac instrumentation system, the periodic enluation ofprewntin maintenance activitiesfor Unit 1 performed in accordance with 10CFR50.65(a)(3), performed in June 1997, did not adequately demonstrate a balance ofamilability and reliability.
(1) Reason for the violation.
Maintenance Rule monitoring is established to track performance of structures, systems, or components (SSCs) and fulfill the requirements of 10CFR50.65. The objectives of the rule are to ensure that important systems are capable of performing their intended j
functions and that failures resulting in reactor trips _ and unplanned safety system l
actuations are = F-M When indications of ur.accq, table performance occur, the Maintenance Rule requires appropriate corrective actions to be implemented. Goals are to be established to monitor the effectiveness of the corrective actions and to focus management attention on those areas where performance does not meet expectations.
Systems within the scope of the Maintenance Rule are classified as either (aXI) or (aX2),
referring to 10CFR50.65 paragraph (aX1) or (aX2). The (aX2) classification is assisned to a system which satisfies its performance criteria indicating that the existing maintenance program on the system is adequate to maintain key system functions. A system which does not satisfy its performance criteria is evaluated for possible (aXI)
classification and may require a corrective action plan, goal setting, and increased management attention. Periodic assessments, as required by 10CFR50.65 paragraph (aX3), are performed for each unit on a once per cycle basis to essess the effectiveness of maintenance actions.
The ANO Maintenance Rule Program was initially developed using NUM 'Z.C 93-01 as j
a guide. This guide has been endorsed by Regulatory Guide 1.160 as an acceptable
'
means ofimplMag the Maintenance Rule. The industry guidance document implies that either availability, reliability, or condition performance criteria, or any combination, could be used as performance criteria for risk significant systems. ANO's interpretation
!
of this guidance was that normally operating SSCs did' not require unavailability l
monitoring.
'
Based on industry experience reviews,,ANO determined that availability should be monitored on additional risk significant systems unless an appropriate technical justification is provided. The appropriate engineers were notified of the need to monitor l
availability but the methodology was not developed and the data was not assembled until I
D=h-1997. The failure to track past unavailability prior to this time caused the l
inappropriate availability repotting in the ANO-1 periodic review performed in' June
!
I
- _ _ _ _ - - _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _ _ - _ _ - _
_ - _.
- _ __ _ _. - -.._ _
Attachneit to
-
.
OCAN069801
-
',
Page 7 cf16 1997. This issue was self-identi6ed by ANO personnel and corrected prior to the NRC inspection.
' (2) Corrective stens that have been taken and the results achieved.
The ANO Maintenance Rule Program was revised to require risk significant systems, includmg normally operating systems, to be monitored for unavailability unless an appropriate technicaljusti6 cation is provided.
~
l An assessment of past availability performance was conducted. The systems listed in the violation have met their performance criteria for both availability and reliability; therefore, they have demonstrated adequate b=1-ve.
(3) Corrective stens that will be taken to avoid further violations.
The lessons learned from this violation will be diedmart with system engineers by Sap *amhar 30,1998.
(4) Date when full comali=ce will be achieved.
Full compliance was achieved on February 11,1998, when availability monitoring for systems listed in the violation was completed.
I t
l
,
I l
,
_
_ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ -
.
_
A"ach=aatto
-.
OCAN069801
-
i (
Page 8 ef16 C. Resnonse to Notice of Violation (50-313: 368/9801-04)
Ihe licensee had not demonstrated that the performance or condition of certain structures, systems, and components within the scope of10CFR50.65 had been efectinly controlled through theperformance ofappropriateprewntin maintenance.
Rsecr.sc to example Cl:
+
' The licensee failed to establish adequate measures to demonstrate she performance or condition of the trawling screens andscreen wash systems.
(1) Reason for the violation.
Maintenance Rule monitoring is normally conducted at the plant, system, or train level-and is specifically geared toward determining how well an SSC has fulfilled its key
,
functions. Certain systems have redundant components which can fulfill key system or train functions individually. " Masking" or " shadowing" occurs when one or more good performing redundant components are relied upon to satisfy the system or train function and poor performing components are " masked."
Based on guidance provided by various Maintenance Rule reference documents, ANO followed the plant probabilistic safety assessment (PSA) convention and tracked the unavailability and performance of the traveling screens and screen wash system as part of
,
the service water system. However, since one traveling screen on each unit could provide adequate flow to the service water loops, there was a potential that inadequate performance of the traveling screens and screen wash system could be " masked" by the overall performance of the service water system. The cause of this violation was a misinterpretation of the intent of the guidance documents.
(2) Corrective stens that have been *mkaa and the r*=d*= achieved.
The ANO Maintenance Rule Program was revised to clearly identify traveling screen performance criteria for availability and reliability at the train level separate from the
'
c service water system.
.
Unavailability criteria have been established and past performance evaluated as adequate.
!
(3) Corrective stens that will be taken to avoid further violations.
L The lessons learned from this violation will be discussed with system engineers by September 30,1998.
l
.
d
rr AFeh-t to
..
OCAN069801
-
,
- Page 9 of16
,
(4) Date when full compliance will be achieved.
Full compliance war ed on May 28,1998, when past pedormance was evaluated as adequate based ou. 2.ew criteria.
.
s
1
l l
.
_ _ _ _ _ _ _ _ _ _
._
_ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ - _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ -
Attachment to
.
OCAN069801 i
-
' Page 10 cf16
,
Resnonne to examnie C2:
The licenseefailed to demonstrate that the performance of a relayfor the Unit 2 safety-related put accident sampling system was being efectinly controlled through the performance ofw y; ate prewntin maintenance.
(1) Reason for the violation.
The system engineer that originally developed the perfonnance criteria for the ANO-2 post accident sampling system (PASS) misunderstood the scoping criteria for the Maintenance Rule and established the performance measure ofless than three functional failures per two cycles and no repest functional failures for many components in the PASS system When the system engineer ramhrari that the actual Maintenance Rule scope for ANO-2 PASS was only one relay, he made the appropriate change in scope.
The performance measures were then not adequate because the relay was only actuated once each cycle for. surveillance testing cud, therefore, it was unlikely to exceed two
_
failures within two cycles. Thus, no adequate basis had been established to demonstrate that the performance or condition of the relay was being effectively controlled through the performance of effective preventive maintenance i
The cause of this violation was the failure to reassess the adequacy of the performance
criteria when the system scope was revised. The ANO Maintenance Rule Program does not include " changes in system scope" as a reason to reassess performance criteria.
(2) Corrective stens that have been taan and the r-he achiaved.
l
The relay in the ANO-2 PASS system has been rescoped as part of another system of
-
similar components with the same functions.
j Past performance was evaluated as acceptable based on the performance criteria of the new system.
!
(3) Corrective stens that will be tuan to avoid further violations.
The lessons learned from this violation will be diacnamart with system engineers by September 30,1998.
The ANO System F2pgj.g Desk' Guide will be revised by December 1,1998, to consider operating condition and testing intervals when establishing performance criteria j
and to require the reassessment ofperformance criteria when system scope is changed.
'
l l
, _ -. -_ _.- - _ ____
_ _ _
_ _ _ _ - _ _. _.
_.
.. _.
Attachment to l-
..
OCAN069801
'
1'f, Page 11 cf16 (4) Date when full compliance will be achieved.
l Full compliance was achieved on May 23,1998, when the PASS relay was rescoped and past perfonnance was evaluated as acceptable.
i
,
.
,
,
,
1 j
l l
.
'
,
l
l
,
Q
.
_ _ _ _ - _ - - - _ - - - -
..
Attachment to OCAN069801
-
Page 12 of16
,
Response to example C3:
The licensee failed to demonstrate that the performance of the containment integrity function was being e.[fectively maintained through the performance of appropriate preventive maintenance on the safety-sigmpcant containment isolation valves.
(1) Reason for the violation.
The original performance criteria for the containment isolation systems were established based on a limiting number of functional failures of containment isolation components and, in addition, not exceeding the ANO-1 and 2 technical specification limits for total leakage. This was consistent with the Maintenance Rule philosophy used for other systems. A limit for the number of functional failures allowed was established but no attempt was made at derming a functional failure for each component. The appropriate system engineer evaluates conditions adverse to quality and determines if a functional failure has occurred.
Based on industry experience reviaws, ANO determined that additional guidance should be established for when individual containment isolation valve seat leakage should be classified r2 a functional failure. In December 1997, the responsible system engineers determimd the appropriate limits for single valve leakage but-did not update the Maintenance Rule documents. Additionally, the total containment leakage performance criteria was revised but the Unit I database was not updated.
Therefore, the performance cdteria in the documents reviewed by the inspection team would not have demonstrated that the performance or condition of containment isolation valves was
,
being assured through the performance of appropriate preventive maintenance. The cause of this violation was the failure of the system engineers to update the established functional failure criteria in the technical basis document or Maintenance Rule database.
j i
(2) Corrective steos that have been taken and the rmha achieved, i
The Maintenance Rule database and technical basis documents have been corrected to include individual and total containment isolation valve leakage criteria.
(3) Corrective steos that will be taken to avoid further violations.
The lessons learned from this violation will be discussed with system engineers by September 30,1998.
(4) Date when full comoliance will be achieved.
l l
Full compliance was achieved on January 28, 1998, when the corrected Maintenance Rule documents were reviewed and approved.
i l
!
r a
_
__. _ _ _ -_ _ ___- - - _ _ _ - _ _ _ _ _ - _ - - _ _ - _ - -
OCAN069801
)
- Page 13 cf16 g
l Pa=anaam to example C4:
Dee licenseefailed to establish adequate measures to ensluate the appropriateness of the performance ofprewntin maintenancefor the Unit 2 coreprotection calculator. system.
. (1) Reason for the violation.
On D-W 9,1997, new performance criteria were established for the ANO-2 core protection calculator system.. A historical performance review of the system data against the new performance criteria was not performed. The cause of this violation was that
. the system engineer making the change did not have an up-to-date copy of the System Fagiaaaring Desk Guide and failed to verify that h was the latest revision. A recent a
change to the desk guide required a past performance evaluation when performance r
criteria are changed.
(2) Ce active stens * hat have h=a +=kaa and the r=d*= nehiaved.
q l
The system engineer was provided with a copy of the latest revision of the desk guide.
j
. The past performance evaluation was completed and the system was determined to be appropriately clammified as (a)(2).
-
!
!
(3) Corrective stens that will be *=kaa to avoid further vinktians.
I The lessons learned from this violation will be discussed with system engineers by
..
September 30,1998.
(4) Date when ful! canaalianca will be achieved.
Full compliance was achieved wh' n the past performance evaluation was completed on e
January 28,1998, i
,
l
\\
'
I i
y j
?. -
.
,
'i
E,.
~
? Anich
, to
]
,
OCAN069801
-
Page 14 cf16
,
D. Response to Notice of Violation (50-368/9801-06)
The current licensee.<stablished goalsfor the Unit 2 main steen safety unius were not conunenarate with safety.
(1) Reason for the violation.
The intended function of the main steam safety valves (MSSVs) is to function as a group to provide adequate over-pressure protection. A system level performance criteria to monitor this function is established as, "No failures of the MSSVs as a group to provide steam generator over-pressure protection during a cycle." To provide a more predictive monitoring method, giving early warning of MSSV degradation, performance criteria of
"Less than 3 functional failures of the MSSVs tested failing to lift within i3% during
<
MSSV testing per operating cycle," have also been established. This is based upon l
industry-wide operating experience and the ANO-speci6c valve design. Failure to meet this criteria has resulted in the MSSVs remaining in the (aXI) category, even though the high lift setpoint problems have not resulted in the failure of the MSSVs as a group to perform their intended safety function.
E The MSSVs were placed in the (aX1) category in June 1996 based upon five MSSVs failing to meet Maintenance Rule performance criteria for failing setpoint testing during refueling outage 2Rll. The (aXI) goals were established to reduce the failure rate of
- valves -e#% setpoint tolerances at ANO to a rate consistent with industry operating experience. Actions were issued to deermine see$shta performance and failure rates for MSSVs based on industry experience.
The corrective action plan for ANO-2~ MSSVs includes changing the technical specification requirements as reco==aaM by industry experience. The Maintenance Rule (aX1) cause determination process has properly identified the' ANO-2 MSSVs as not performing adequately with respect to industry standards and h has also identified that our technical specification limits'of +1/-3% are not reasonable and should be revised. The technical speci6 cation change documentation is being assembled for submittal this year. The new technical speci6 cation limits of*3% should be in place prior to the next ANO-2 testing intervalin 1999.
A long-term goal, consistent with (aX2) performance criteria, was established for ranyling outage 2R14 that less than three MSSVs will lift above +3% of setpoint. To measure the effectiveness of the corrective actions performed during ranpling outage 2R12, a short-term goal was established for refueling outage 7R13 that less than four MSSVs willlift above +3% of setpoint. In addition to these goals limis the number of s
valves lifting above the ASME Code / revised technical speci6 cation requeements, other long-term and short-term goals were established to limit how far out ofIolerance the failing valves could lift. These additional goals were: for refueling outage 2R13 all MSSVs will lift below +5% of setpoint and for refueling outage 2R14 all MSSVs will lift below +4% of setpoint._ The short-term goals were established to provide a measure of l '
3, Ate.ch=aa' to OCAN069801:
-
Page 15 cf16
,
improvement compared to past performance They would not indicate that the MSSVs were ready to return to an (a)(2) status.
The goals for individual MSSV setpoints were established based on achieving an acceptable failure rate for individual valves prior to dispositioning the main steam system to (a)(2). This setpoint failure rate was established consistent with industry operating experience. ANO believes that these goals, as well as the performance criteria, provided -
reasonable assurance that the key system function of providing adequate over-pressure -
protection for the steam generators would be maintained.,
The cause of this violation was that the goals were stated ambiguously in that they could be interpreted as being non conservative or not commensurate with safety.
~ (2) Corrective stens that have been taken and the remdte mehiaved.
<
New goals were established commensurate with safety so that they are clearly identified at a lower threshold than the -performance criteria and consistent with technical specifications.
The (a)(1) monitoring period for the MSSVs was changed to December 1, 2000.,
~
(3) Corrective stens that will be taken to avoid further violatiana The lessons learned from this violation will be dimen==I with system engineers by
-
Saptand=r 30,1998.
.
(4) Date when full camaliaana will be achieved.
Full compliance was achieved on June 4,1998, when the new goals were approved for the ANO-2 MSSVs.
l
.
P l
- _ _ - - _ _ __ _ _
_ _ __ _ ____ _ _ - _ _ _ _. __ __-. __
-
- - _.
Attachment to g.
OCAN069801
--
'.,
Page 16 of16
~
E. Resnonse to Notice of Violation (50 368/9801-07)
- The licensee incorrectly permitted the 125 Vdc system for Unit 2 to remain under 10CFR50.65(a)(2) when prewnttu maintenancefailed to assure that this system remained i
cqpable ofperformig its intendedpnction.' Specipcally, a surwillance testfailure of a swig charger was not identifed as afunctionalfailure.
(1) Reason for the violation.
On March 13,1997, a surveillance test failure of a non-connected swing battery charger was not identi6ed as a functional failure.
The system engineer that made the
' inappropriate functional failure detennination had received no training on " masking" and
" shadowing" concerns with respect to the Maintenance Rule. Tlie need for trsh.g was identi6ed in early 1997 and four training modules where developed covering appropriate aspects of the Maintenance Rule. "Maskiing" and " shadowing" were dimimaad in detail, with WAc examples, during tring in October 1997. This training was performed aAer the functional failure determination was made for the noted event (2) Corrective stens that have been takaa and the rad s achieved.
t When it was concluded that the initial functional failure determination on the swing battery charger was incorrect an assessment was made, per the Maintenance Rule Program requirements, as to whether the performance criteria were appropriate. The-evaluation determined that the performance criteria were overly restrictive. A new performance criteria ofless than three functional failures of the chargers per cycle was established and the 125VDC system remains classi6ed as an (a)(2) system under the Maintenance Rule.
.
l Qualification checklists have been established to track training of system engineers to document their qualification prior to performing Maintenance Rule engineering tasks Maintenance Rule documents were updated to reflect the new performance criteria.
i Training of AFO system engineers on " masking" and " shadowing" was completed on i
October 28,1997.
l (3) Corrective stens that will be taken to avoid further viehtions.
I
' The lessons learned from this violation will be discussed with system engineers by
.
@ ~nh-30,1998.
.
(4) Date when full cs# -v will be achieved.
Full compliance was achieved on May 29,1998, when the new performance criteria were approved.
I I