IR 05000317/1989011

Special Insp Repts 50-317/89-11 & 50-318/89-11 on 890417-27. No Violations Noted.Major Areas Inspected:Breaches of Unit 2 Refueling Containment Integrity & 890422 Installation of Temporary Mods to Unit 1 Refueling Machine

ML20247C791
Person / Time
Site:	Calvert Cliffs
Issue date:	05/18/1989
From:	Lester Tripp NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20247C765	List: IR 05000317/1989011 ML20247C761
References
50-317-89-11, 50-318-89-11, NUDOCS 8905250050
Download: ML20247C791 (15)

Text

- _ _ _ _ _ _ _ _ __ _ _ - - _ - _ - - _ - _ _ _ _ _ - _ _ _ -

.y ' ' ,

m

.

, .

-

.

N /

U.S. NU' CLEAR' REGULATORY COMMISSION Region I

..

50-317 DPR-53-

,

Docket Nos : .50-318 License Nos.: DPR-69

,

50-317/89-11 Report Nos.: 50-318/89-11 Licensee: -Baltimore Gas and Electric Company Post Office Box 1475 Baltimore, Maryland 21203

_

f cp - Facility: Calvert Cliffs Nuclear Power Plant, Units 1 and 2 Inspection at: Lusby, Maryland

- Inspection conductedi April 17-27, 1989 Inspector: P ils n, Rea or Engineer Approved by: , 6 L'owell E. Tr~1pp[/fChief 'Dat6-Reactor Projects Section No. 3A Summary: Inspection Conducted April 17-27, 1989: Inspection Report No /89-11 and 50-318/89-11

- Areas Inspected:

Special inspection of-(1) the April 17 and 19,1989, breaches of Unit 2 refuel-ing containment integrity during core alterations and (2) the April 22, 1988, installation of a temporary modification to the Unit I refueling machine that involved an unreviewed safety question.

>

Results:

Inadequate control of operations and maintenance activities during the Unit 2 refueling outage led to two instances of breaching refueling containment integ-rity during core alteration This is an apparent violation (Detail I). A

- significant weakness in the licensee's procedure controlling temporary modifi-cation- resulted in a temporary modification to the Unit I refueling machine that. involved an unreviewed safety question. This is an apparent violation

.

' (Detail II). The fact that this modification as well as several other tempor-ary modifications that affected nuclear safety did not receive POSRC review prior to implementation is also an apparent violation (Detail II).

8905250000 89051G PDR ADOCK 05000317 g Q PDC t

)

_ _ - _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ - - .

.

• '

.

,

b

-

.

C I

' DETAILS

!

Within this report period, interviews and discussions were. conducted with l various licensee personnel, including senior control room- operators, i design engineers, outage planners, and the licensee's management staf Breach of Containment Boundary Events (93702) Overview

~ On April 17, 1989, the licensee performed core alterations for a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 35 minute period without refueling containment integrity

.

being . established. The core' alterations consisted of uncoupling control element assemblies (CEA's). A direct vent path was inadver-tently established between the containment and the outside environ-ment. An in-containment service water supply header, which provided the vent path, had been drained for maintenance evolutions prior to the start of core alterations. . Containment refueling integrity had been established using two fail-open air-operated control valves on t the. service water system return line from the No. 21 containment air cooler (CAC). ~ Due to an unrelated maintenance activity, the solen-oids for the above control valves were deenergized thus causing the valves to open breaching the containment boundary.

( On April 19, 1989, the licensee perfornied core alterations for approximately two hours without containment integrity required during refueling. The core alterations also consisted of' uncoupling CEA' A direct vent path was established between the containment atmosphere and the outside environment via the same drained service water header. Prior to this event, the licensee had established refueling containment integrity downstream of No. 21' CAC using two outterfly valves ' vice the . fail-open control valve Due to miscommunication between shift personnel, both butterfly valves were inadvertently opened which created the vent path and breached the containment l boundary.

l Vent Path, Description and Requirements l Vent Path Inside containment on the service water header suppling cooling water to and from No. 21 CAC, there are three automatic vent valves (2-SRW-249, 245 and 244). The normal function of these valves is to prevent air binding of the CAC; however, when the CAC is depressurized and drained, each valve provides about an one-eighth inch opening into the service water header. The ser-vice water header exits the containment and splits in two par-allel lines, a four-inch line and a eight-inch line. Each line

. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ - _ _ - _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _

_ _ - . . _ _ _ _ _ _ _ _ - _ - _ _ _ - _ _ -

, . -

.

-

.

g contains a fail-open air-operated control valve (four-inch line 2-CV-1583, eight-inch line 2-CV-1582) and a manually operated butterfly valve (four-inch line 2-SRW-138, eight-inch line-2-SRW-139). The two lines then join into a single header which then combines with other service water header A vent valve i (2-SRW-470) on the combined ' service water header had been pre-viously safety tagged open to assist in the draining of No. 21 CA In addition, prior to the first breach in containment boundary, one of the butterfly valves (2-SRW-128)' had been removed for maintenance, but was replaced prior to the second event. The direct access from the containment to the outside environment during the first event was via the auto' vents inside'

containment, 2-CV-1582 which was open for ongoing work and th opening following removal of 2-SRW-138 or the tagged open vent

,

valve 2-SRW-470. The path for the second event was via'the auto vents inside containment, 2-CV-1582 which had been reopened, and the tagged open vent valve 2-SRW-47 . Requirements Technical Specification (TS) limiting condition for operations (LCO) 3.9.4.c specifies that, during core alterations, each penetration providing direct access from the containment atmos-phere to the outside atmosphere shall be either:

a) closed by an isolation valve, blind flange or manual valve, or b) be capable of being closed by an operable automatic con-tainment purge valv The action statement associated with this LCO requires the im-mediate suspension of all operations involving core alteration The surveillance requirements associated with this LCO required that refueling containment integrity be verified within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> prior to the start of core alterations and at least once per seven days during ccre alteration C. Detailed Description On April 5,1989, the licensee isolated and then drained and vented No. 21 CAC and its associated outside containment service water pip-ing. This was done to remove and repair 2-SRW 138 and to inspect the service water piping downstream of the above butterfly valv .__-___ _ _-_ -_______-__ - - -

-- .

. .

,

<

.

.

On April 15, 1989, shift operators completed Surveillance Test Pro-cadure (STP) 0-55A-2 " Containment Integrity Verification (Mode 6)"

prior to removing the Unit 2 reactor vessel hea Since No. 21 CAC was depressurized, STP 0-55A-2 required that the two fail-open air-operated control valves 2-CV-1582 and 2-CV-1583 be shu On April 16, 1989, a safety tagging clearance was approved (No.29-630) and implemented which removed electrical power from the solenoid to 2-CV-1582. The purpose of the clearance was to allow for environ-mental qualification work on the valve's position indication equip-

. men This resulted in the valve opening and thereby providing a direct path between the containment and the outside atmospher On April 17, 1989, at approximately 2:15 p.m. , core alterations (CEA uncoupling) were commenced. At approximately 3:50 p.n. following shift turnover, the Unit 2 reactor operator noticed that 2-CV-1582 was open and that the containment had been breache The shift supervisor then ordered the immediate suspension of CEA uncewplin The shift operatur cleared the tags on the solenoid to 2-CV-1582, reenergized che. solenoid, and then shut the valve to reestablish penetration integrit The licensee started an investigation of the event ar4d suspended all core alterations until corrective measures were in place to prevent recurrenc The licensee determined that on April 17, 1989, two othar unrelated maintenance activities took place which also breached the containment boundary, but core alterations were not in progress at the tim Control room operators were not aware that these two activities were in progres The first activity was the performance of local leak rate testing on the Unit 2 containment penetration No. 9 in accordance with STP-M-571-2. From 4:30 p.m. to 4:45 p.m., there was a direct path from the containment to the outside environment. The vent path was via 2-SI-388 through failed check valve 2-SI-340 and into the west penetration room through 2-SI-387 which had been left open following removal of a leak rate machin '

The second activity, which took place the evening of April 17, 1989, was the removal of two steam generator relief valves from the No. 21 steam generator which had its manway covers removed. The licensee's Tagging Authority (separate group within the Operation's Department)

approved a maintenance order to remove 2-MS-3993-RV and 2-MS-3995-R Since the steam generator manways were open, the removal of these valves provided a direct path from the containment to the outside environmen _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _

. _ _ _ _ _ _ _ _ _ _

-

..

l

.

J

-

. i

{

On April 18, 1989, the licensee implemented corrective actions to  !

prevent recurrence. This action consisted of placing caution tags on all containment boundary valves to prevent inadvertent opening. The resident inspector pointed out to the licensee shift supervisor that the licensee's long standing practice of relying on valves with fail-oper> features (loss of air or power) for containment refueling integ-rity was unacceptable since it was apparently inconsistent with Technical Specification 3.9.4.c.1 requirements. The licensee mod-ified :TP-0-55A-2 to . hange refueling integrity boundaries to valves without hil-open features. In particular, the boundary valves asso- .

ciated with the containment air coolers were changed to the manual I butterfly valves downstream from the fail-open air operated control valve On April 18, 1989, in order to reverify refueling containment integ-rity, the licensee performed the revised STP-0-55A- The tagging authority reissued the safety tag clearance for the .c enoid to 2-CV-1582 which resulted in the valve being opene On April 19, 1989, on the midnight shift, plant operators began to caution teg all the valves required for refueling containment integ-rit On day shift, an off-shift crew was brought in to assist in the tagging proces The caution tag clearance, prepared and con-trolled by the control room operators, required that if a CAC was depressurized, its associated downstream butterfly valve be shu The only indication available to the operators that a CAC was drained were control room flow indicators which had been removed. Therefore, the operators took a conservative approach and shut the butterfly valves to all CAC' After the caution tagging was completed, the shift supervisor ques-tioned the isolation of all filled and pressurized CAC's since the

,

station's Abnormal Operating Procedure (AOP) -

6D " Fuel Handling ( Incident" required that all available CAC's be placed in service if an accident should occur. He, therefore, ordered the control room supervisor to reopen the butterfly valves on the available CAC's. The control room supervisor, in turn, ordered some of the operators from the extra crew to remove the caution tags and open the butterfly valves on the available CAC's. The plant operators then mistakenly removed th caution tags and opened the butterfly valves associated with the No. 21 CAC. Therefore, a direct path between the contain-ment attrosphere and the outside environment was establishe At 4:25 on April 19, 1989, CEA uncoupling was recommenced. At 6:35 p.m., CEA uncourling was stopped due to a concern over a failed local leak rate %st on an unrelated containment penetration check valve. At 00:01 a.m. on April 20, 1989, the shift operators dis-covered the breach in the containment boundary through No. 21 CA In both instances of breach of refueling containment integrity, the

! licensee made the proper notifications to the NRC.

_ - _ - - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ _ - - _ _ _

-____ - _ ___

g ..

'

g .

.

D. Inspector-Findings There were several different contributors or weaknesses in the licensee's conduct of operations and maintenance which led to these two' event . .The controls. for preventing a breach in refueling containment a integrity prior to the first event were inappropriate in that j

' the ~ licensee had an . inadequate program in place to preven !

inadvertent opening of a containment penetration after integrity '

had been established using. STP-0-55A-2. The use of fail-open valves as a containment boundary and the performance of .. local leak rate testing on boundary. valves during core alterations were also considered to be weaknesses' . There were several weaknesses in licensee's safety tagging clearance progra j

. The licensee's Tagging Authority was neither aware nor required.to be aware that refueling containment integrity hadL been establishe The Tagging Authority, with the i April 16, 1989 shift supervisor's approval, issued tne clearance- (29-630) which resulted in the first breach in refueling containment integrit The. shift supervisor was required to approve all safety ;

tagging clearances. However, his subordinate, the control roc., supervisor, was the individual required to approve the removal of safety tagging clearances. Therefore, depending on the activity level in the control room, the shift super-visor may not have been informed .that a system / subsystem /

component had been returned to servic During an inter-view, one ' shift supervisor said that, during a major !

refueling outage, he is informed when equipment has been '

returned to service or is available about 50 percent of the tim l The Tagging . Authority issued a computer printout to the shift supervisor every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> which listed all equipment which had been removed and' returned to service. With the large number of safety tagging clearances being issued and cleared, the printout was no longer current within a few hours after it was issued to the control room. One shift supervisor stated he conridered the printout obsolete when ,

he received i <

ug l

______--__-____-____-__-___________L

- _ - _ _ _ _ _ _ _ _ _ - - _ . . _ _ _ _ _ _ _ _ _ _ _ - . _ _ _ _ _ ._. . _ _

'

.

.

-

6 The Tagging Authority was authorized to approve maintenance orders (i .e. , give permission to start the maintenance activity). If the proposed work was to be performed within a previously established boundary (i.e., already tagged for other maintenance), a supplementary safety tagging clear-ance was issued 'which did not require shift supervisor approval. Therefore, the shift supervisor was not always

. cognizant of what maintenance activities were in progres The breech of containment boundary through the opening left by the removal of steam generator relief valves (see

.Section I.C) was a result of the above practic . There were weaknesses identified in the licensee's control . of outage activitie Unscheduled maintenance activities were performed which affected tne containment boundary. The environmental qual-ification work performed on control valve 2-CV-1582 had been scheduled early in the outage when refueling contain-ment integrity was not required. The work - was not per-formed when scheduled and was to be rescheduled when integ-rity was not require However, the work was authorized even though it was not scheduled to be performed. The removal of the steam generator relief valves is another example of performing unscheduled wor The inspector determined from interviews with the licen-see's outage management and the shif t supervisor on duty just prior to the second event, that there was pressure i from outage management to complete the containment boundary l

caution tagging evolution because of concerns over a con-l tractor's work schedul . Due to the method that safety tagging clearances were controlled and the lack of control of outage activities, shift supervisors did not appear to have a high degree of confidence that they were completely aware of the status of plant systems. This appears to have led to a general mistrust of the information 1 systems available to them in the control room. The shift super-visor who authorized safety tagging clearance (24-661) causing the first breach in containment boundary, stated he thought that No. 21 CAC was in service and that 2-CV-1582 was already ope He thought this despite his shift turnover information sheet which had listed No. 21 CAC out of service for several day Other shift supervisors interviewed expressed the same lack of confidenc _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ - _ _ _ _ _ _ _ - _ _ - - _ - _ _ - - - _ _ -

_

- - __-_ .- _

.

.

-

.

t There appears to be weaknesses in operator communications. Prior to the second event, the guidance given to the extra operators i

'

to remove the caution tags and unisolate the available CACs was inadequate in that they mistakenly unisolated the No. 21 CA This breached the containment boundar . The extra operators brought in to assist in caution tagging the containment boundary valves had not been made aware of the pre-vious breach in containment. Therefore, they were not sensitive to the importance of their assignmen . The shift crew that opened the butterfly valves associated with i the No. 21 CAC (2-SRW 138 and 139) did not follow the require-ments of Calvert Cliffs Instruction (CCI) 112 " Safety Tagging" in that the removal of the caution tags from these valves w not performed using the formal tagout modification process required by the instructio The formal modification process would have required written shift supervisor approval prior to the caution tag boundary being change . During both events, the level of activity in the control room was extremely high. Unit I was in the process of heating up following a forced outage and Unit 2 was in a major refueling outage. Although the Technical Specification requirements for minimum control room staffing were met, it appeared that the number of oversight and support personnel utilized to monitor these simultaneously conducted activities was inadequat . Although not a direct contributor to either event, the inspector identified weaknesses in the licensee's process for temporary procedure change Calvert Cliffs Technical Specification (TS) 6.8.3.a allows for temporary changes to TS required procedures without prior Plant Onsite Safety Review Committee (POSRC)

review provided the intent of the original procedure is not altere After the first event, STP-0-55A-2 was revised to change containment boundary valves from fail-open valves to valves without this feature. Even though this change apparently involved a change of intent, the revision was implemented after approval by t vo licensed senior operators without the required POSRC revie It did not appear that Operation's Department Management recog-nized what is meant by a change of intent. When the inspector raised this concern with the Operations Department Management, he was told that they did not believe the change involved a change of intent since the original purpose (establishing refueling containment integrity) was not altere At the time of the inspection, the licensee was evaluating how to define

" change of intent".

__-_-_- _ _ _ _ _- _ _ -

_____ __

b_ ,, - .

.

.

l I

There also appeared to be a weakness in the method used to track temporary- procedure changes to STPs. There was no requirement to document the temporary changes made to a working copy of a STP on the master procedure. Therefore, each time an STP was used, there was no documentation as to what had been revised the last time the procedure was used. There were several temporary changes made to STP 0-55A-2 each time it was used prior to each event. However, some of the changes made to the STP prior to the first event were not carried over to the STP used prior to the second event even tMugh it would appear that the changes should have been. This wea' uss was previously identified by NRC as early as January 1988 (Inspection Report 88-01).

E. Licensee Corrective Action After the second loss of refueling containment integrity, the licen-see conducted an extensive investigation as to the causes of both event The investigation included a- Human Performance Evaluation System review of the events. The licensee developed a comprehensive corrective action plan and presented it to the inspector during a meeting held on April 26, 1989, at the sit The following are the main corrective actions commitment , Establish precise windows for maintaining containment closur These windows could include periods when core alterations are not being performe Commitment date April 25, 198 . At the beginning of each window, Operations will perform STP-0-55A and the core alteration portion of Operation Procedure (0P)-5, Mode 6 Checklist to establish a containment closure baseline. Commitment date April 25, 198 . During containment closure windows, no maintenance or testing will be performed on containment penetration components shown in STP-0-55A. Commitment date April 25, 198 . Details of significant events will be communicated to operating crews and outage management staff in a timely manne Commit-ment date April 25, 198 . When modifying a tagout, the modification process contained in CCI 112 will be used by operations crew Commitment date April 25, 198 . Evaluate the adequacy and administration of Mode 6 Checklist in OP-5 and implement any appropriate changes. Commitment date May 3, 1989.

_ _ - -__-_ _ ______-____- ___-___ __ ___________ -_-__ ___________ ___ - _

- - - - - - _ - _ _ - - - - - ,

'

? .. .

-

.

-

.

9 Implement improved methods for . communicating shift turnover information (considering improved shift turnover checklist,

-status boards, etc.). Commitment date May 30, 198 . Evaluate providing shift supervisor with a marked up. copy of a

. print (s) for each clearanc Commitment date May 25, 198 ' Prior to establishing containment closure windows, all boundary valves required by STP-0-55A for containment closure will have tags applied to preclude the valves being inadvertently oper-ate Commitment date April 25, 198 . Evaluate the type of tag to be used for containment closur Commitment date May 25, 198 . A status board will' be maintained in the Tagging Authority  ;

office to. inform personnel when containment closure is required l and other pertinent facts about plant statu Commitment date  !

. April 25, 198 '1 Evaluate permanently revi. sing STP-0-55A so as not to rely on fail open valves. Commitment date May 30, 198 ;

13. During outages, the Operation Maintenance Coordination (OMC) i organization will review and approve all unscheduled work (non-emergency). Commitment date April 25, 198 . Clarify tagging authority review requirements to specifically  !

include the adequacy of the _tagout for existing plant condition Interim clarification, Commitment date May 1,1989

--

CCI 112 Revision, Commitment date May 10, 1989 1 Sensitize operating crews to their responsibilities for adequacy  ;

of tagouts. Commitment date May 10, 198 J 1 Determine requirements for equipment availability dering core )

alterations that may be necessary to mitigate. the consequences  !

of a fuel handling incident (CACs, charcoal filters, etc.). i Commitment date May 30, 198 . Review with OMC organization and shift crews, the licensee's top 1 priorities (safety and quality versus plant availability). Com- l mitment date May 10, 1989,

- - _ _ - - _ _ _ - _ _ - - - _ _ _ _ _ - - - - - - - - _ _ ____

_ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ __ __ _

j .

I

~

~

I 10 i

!

- 18. Assure operating crews are informed of reasons for changes to l

,

active STPs. Commitment date May 15, 198 j 1 Evaluate the adequacy of staffing in the operations sectio Commitment date May 30, 198 ]

!

Just prior to this inspection's exit meeting, the licensee presented I the inspector with information that may have mitigated the potential  !

consequences of the two events. This information is presently being  !

evaluated by the NR ; After the second event, the licensee conducted a review of the l physical attributes of the service water system automatic vent I valves which revealed a ball and screen assembly on the valve discharge. ' Physical walkdowns, conducted by the licensee, were I performed for four automatic vent valves on the drained portions i of the service water nea(%r. In each case, the presence of the stainless steel ball was confirme . Further physical inspection showed that the ball valve seats on i a - chamfered orifice. The orifice has an opening of 0.041 I inche l l The valve's manufacturer, Hoffman ITT Corporation, was contacted l by the licensee to determine if the ball valve would preclude  !

reverse flow. The manufacturer informed the licensee that the  !

Vent valves were factory tested for venting operability but not -l for reverse flow. However, the vendor stated that the purpose i of the ball valve was to prevent ~ reverse flow. The licensee l tested a new vent valve from stock but could not reproduce the {

vendor's stated qualifications. Test results varied based on  ;

the seating obtained during each attempt. No empirical seating ':

pressure was defined since repeatability was not achieved. In I each case, the steel ball covered the orifice, restricting the  !

open channe The installed automatic vent valves were not l teste !

l F. Apparent Violations and General Weaknesses Highlighted by Both Events j i

In summary, the two breaches of refueling containment integrity dur-ing core alterations are two instances of a failure to meet Technical Specification 3.9.4.c and constitute an apparent violation (50-318/ l 89-11-01). l l

I l

_ _ _ _ _ - . _ _ _ _ _ _ _ _ _ - - - _ _ _ _ _ - - - - _ _ - _ _ _ _ - _ _ _ - _ _ _ _ _ - - _ _ _ _ _ _ - _ _ - - -

'

..

..., . . -

.

-

.

The issue of whether there was a violation of Technical Specification 6.8.3.a. regarding the manner in which STP-0-55A-2 was revised,.

remains unresolved until- the licensee completes their evaluation and it is reviewed further by the NRC (50-318/89-11-04).

The contributors to both events discussed in Detail I of this report reflect underlying weaknesses in the control of operations and main-tenance' activities during the Unit 2 outag I Unreviewed Temporary Modification

. Overview On April 22, 1988, the licensee installed a temporary modification to the Unit 1 Refueling Machine which increased the probability of a fuel hanching acciden The temporary modification consisted of bypassing a limit switch which made it possible to lower a spent fuel

' assembly onto the upender when the upender .was not completely ver-tical. The modification was installed without a 10 CFR 50.59 evalua-tion being performed and without prior Plant Onsite Safety Review Committee (POSRC) review. On April 20, 1989, the licensee's Off Site Safety Review Committee (OSSRC) determined that the above modifica-tion constituted an unreviewed safety questio System Description and Requirements Refueling Machine Interlock There are several interlocks associated with the refueling machine and upender in the reactor . are These interlocks restrict movement of the refueling machine to ensure that all-conditions to safely transfer fuel are met prior to transferring a fuel assembly from the refueling machine to the upender and vice vers One of these interlocks prevents movement of the refueling machine into the upender area unless the upender. is fully ver-tica Two limit switches must be actuated to satisfy this interlock. One switch, ILSAVH, is actuated as the upender moves away from the horizontal position but before it reaches the vertical position. This switch is actuated by a carriage which rocks back to its "home" position as the upender is being raised. The second limit switch, ILSAV, actuates once the upender is completely vertica This interlock must also be satisfied to illuminate the "upender vertical" light on the l refueling machine consol All refueling equipment is categorized by the licensee as non-

,

safety related.

l l

- _ - _ . . _ _ . . _ _ _ _ . - _ -- ._ - - _ - _ - _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _

- _ _ _ _ - _ _ _ _ _ - _

y; .

.

.

-

32 Requirements The 10 CFR. 50.59 allows the licensee to make changes "to their licensed facility as described in the Final Safety Analysis Report (FSAR); provided the change or modification does not-involve a change to Technical Specifications or an unreviewed ~

safety questio The regulation also defines.what constitutes an unreviewed safety questio One criterion for determining if a proposed change involves an unreviewed safety . question is whether the proposed modification increases .the probability of an. accident previously analyzed in the FSA CFR 59.59 also requires licensees to submit a. license amend-ment to -the L NRC for approval prior to the installation of any

. change or modification that is determined to involve either a change to Technical Specifications or an unreviewed safety questio Calvert Cliffs Technical Specification 6.5.1.6.d states that the E POSRC shall be responsible for the review of all proposed changes or modifications to plant systems or equipment that affect nuclear safet Detailed Description On. April 22, 1988, just prior to the start of fuel movement for the last Unit 1 refueling outage, the . licensee determined that limit switch ILSAV had failed. Repair of the limit switch would have required draining the reactor cavity. In order ' to prevent a delay in the refueling outage, the failed limit switch was bypassed using a jumper. The jumper was installed (Serial No.1-88-54) in accordance with Calvert Cliffs Instruction (CCI) 117, " Control of Temporary Modifications." The temporary modification was approved by two licensed senior operators as allowed by CCI 117. The licensee then refueled Unit I reacto ,

On March 10, 1989, an onsite meeting was held between the NRC and members of the licensee's staff to discuss several NRC concerns over the licensee's process for temporary changes to plant equipment (see routine resident Inspection Report 317/89-04; 318/89-04). An outcome from this meeting was a commitment from the licensee to review all installed temporary modifications to determine if the modification should have had prior POSRC review and 50.59 consideratio The licensee determined that six temporary modifications should have had prior POSRC review and 50.59 evaluations performed. These tem-porary modifications were as follows:

_ _ = _ _ _ __ - _-_ - _ _ -_ _ __ _ _ __ _- __ _ __ _ _____ _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ - - _ _ _ -

- - __ _ _ _ _ -

,

.

.

-

.

.

'

--

1-88-54 installed April 22, 1988 on Refueling Machine  ;

--

1-87-24 installed February 24, 1987 on Unit 1 0xygen Analyzer

--

1-87-47 installed May 7, 1987 on Unit 1 0xygen Analyzer l

--

1-88-145 installed Au<.,ust 2, 1988 on Unit 1 #11B Reactor Coolant

,

Pump low lift pump pressure alarm -- 2-89-6 installed February 18, 1989 on Unit 2 to encapsulate a steam leak on a feedwater heater valve

--

2-89-8 installed February 22,1989 on Unit 2 secondary steam valv !

The licensee subsequently performed a 50.59 evaluation on these six temporary modifications. All but temporary modification 1-88-54 were i found not to involve unreviewed safety question l The 50.59 evaluation for the temporary modification on the refueling machine concluded that with limit switch bypassed, it was possible i to lower a spent fuel assembly onto the upender when the upender was I not completely vertica The evaluation also concluded that without the upender vertical, there was a possibility of damaging a fuel ,

assembly, and therefore the temporary modification increased the i probability of a fuel handling acciden On March 22, 1989, the POSRC reviewed the 50.59 evaluation and con-curred with the evaluator's conclusion. The next day the temporary modification was remove On April 20, 1989, as required by the licensee's Technical Specifica-tion, the Off-Site Safety Review Committee reviewed the 50.59 evalua- l tion and also concurred that the temporary modification had involved an unreviewed safety questio : Inspector Findings The main contributor which led to the installation of a temporary modification which involved an unreviewed safety question was incor-rect guidance given in CCI 117, CCI 117 allowed for tha installation of temporary modifications without prior POSRC review and 50.59 con- ,

sideration if the equipment affected was non-nuclear safety relate '

The refueling machine was listed as non-nuclear safety related l equipmen l l

l l

l l 1 i

E _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ . _ __ . _ _ _

'

j

_ , _ - . .: .

-

.

'

The licensee took no additional precautions such as adding warning steps to fuel handling procedures, conducting additional training, etc., to alert fuel handlers that the interlock had been bypasse Additional concerns on the process used by the licensee for control-ling temporary modifications had already been identified in March 1989 and are discussed in Inspection Report 317/89-04; 318/89-0 Licensee Corrective Actions After the NRC raised several concerns with the process used by the licensee to control temporary modifications on March 10, 1989, the licensee took steps to prevent recurrenc The licensee committed to revise CCI 117. An an interim compensatory measure, the licensee issued a night order on March 13, 1989, which required all prnposed temporary modifications be reviewed by POSRC prior to installatio The revision to CCI 117 was still in the review process at the time of the inspection and therefore the inspector could not ascertain if the licensee's long term corrective actions would be effectiv Apparent Violations and Weaknesses In summary, the failure to meet 10 CFR 50.59 with respect to not obtaining a license amendment prior to installing temporary modifica-tion 1-88-54 and the multiple examples of other temporary modifica-tions which were installed without 50.59 consideration is an apparent violation (50-317/89-11-02). Further, there are multiple examples of temporary modifications which affected nuclear safety which did not receive prior POSRC review which is also an apparent violation of Technical Specification 6.5.1.6.d (50-317/89-11-03; 50-318/89-11-03).

CCI 117 contained a significant flaw in that it permitted the instal-lation of temporary modifications without the prior 50.59 considera-tion and POSRC review for modifications to plant equipment that were described in the FSAR and/or affected nuclear safet III. Exit Interview (30703',

Meetings were periodically held with senior facility management to discuss the inspection scope and findings. A summary of findings was presented to the licensee at the end of the inspection.

l l

l

_ _ _ _ . _ _ . _ . _ _ . _ _ . _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ _