IR 05000327/1990001
| ML20006E711 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 02/07/1990 |
| From: | Harmon P, Linda Watson NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20006E705 | List: |
| References | |
| 50-327-90-01, 50-327-90-1, 50-328-90-01, 50-328-90-1, NUDOCS 9002260255 | |
| Download: ML20006E711 (28) | |
Text
{{#Wiki_filter:^ ~ n,f ., . , 5,'. t. q' '* .g A ' f,f ' 'f g Kitt,4 UNITED STATES -
,p - NUCLEAR REGULATORY COMMISSION Jy.
" REoloN 11 <r ' -E - * 101 MARIETTA STREET.N.W.
.-E
A7LANTA, GEORGI A 3032s \\...../. . > Report Nos.: 50-327/90-01 and 50-328/90-01- , Licensee: Tennessee Valley Authority 6N38 A Lookout-Place" g 1101 Market: Street
Chattanooga, TN: 3740? "801 --Docket Nos.: 50-327 and 50-328 License Nos.: DPR-77.and DPR-79 ~ ' Facility Name: Sequoyah 1 an.f 2
Inspection Conducted: January 8-12, 1990 Inspector:l f.8/e n m T 4 b n M7/PO (P. Harmo W Team ~ Leader Date Signed Team Members:.J.~Brady, Project Engineer, TVAPD, SP/NRR J. Donohew,-Senior Project Manager, TVAPD, SP/NRR' P. Humphrey, Resident Inspector, Watts Bar, TVAPD, SP/NRR B. Crowle~y, Reactor Inspector, RII ' R. Chou,. Reactor Inspector, R11-Approved by:] / g a M W .7/7/fC 4.. J. Watssf( CWief Date Signed TVA ProjecYs Section 1 TVA Projects Division Office-of Nuclear Reactor Regulation SUMMARY Scope: The. inspection was performed t'o ensure that the 50.59 program in effect at Sequoyah at the time.of the inspection fully meets the requirements of 10 CFR 50.59, the Safety Analysis Report, and the licensee's QA program.
The inspection reviewed the licensee's look back program to verify that the scope of. the. program was adequate and that the conclusions were valid.
- c-Results
The inspection team concluded.that the Safety Evaluation program at Sequoyah is adequate to fulfill the requirements of 10 CFR 50.59 but that weaknesses existed in.the implementation of the program resulting in several minor errors and failure to properly evaluate one significant issue. In addition, the team concluded that the licensee's lock back review of evaluations performed under the previous program was sufficient in scope and detail to provide reasonable assurance that Unreviewed Safety Questions had been properly identified and B, -$.Og22ggQ $,8 fjh
O- - _.
_ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
!E y _n? m " '
, , wm _1.*g1 , , ,
e {7 :p :r x.
...
- g y ,3,.., P;w, m + y _ , O '2.
' g hcw...
- 6 '-
c,. v , , $:p,
- addressedLunder the? previous. program, and that adequate QA oversight of the e,
' y Lpresentjprogram exists, p .
- q..
~- - Esf% , (Three" violations? 6f ~ NRC J reqisirements were identified and -- are described.in -
, -detailqinithis! report. Twoi:of-the three violations.'are' apparent and are;under- - - , '~ ' . consideration for' escalated enforcement.- They.lsre: , , f, m ,rAoparent Violation' 50-327,328/90-01-01, Inadequate' Safety Evaluation-for Emergency Instruction.. Revision, Paragraph 3 .
- n Viola' tion t 50-327,328/90-01-02,- ~ I'nadequate Design Document and Safety-
.EvaluationLfor RWST Level Transmitters,. Paragraph-11: ', Apparent -Violation' 50-327,328/90-01-03 HInadequate' Corrective Action ~:for? Residual Heat Removal Pump.Deadheading,. Paragraph 11 !One! Inspector Followup Item was identified: , IFI ~. 50-327,328/90-01-04,: Problems With Test 1 Gauges, Paragraph 10 , . No deviations oriunresolved items were identifisd.
, .,,m -.' _.
'- 1.
<3'. 7$ s a '; '
5
w i N b k
'
1 m
,
1
l- -
! m.
., .. _ ... _., __ , ..,.
- - . + , ,
- c5
,A ., wy x
- c,
[_% g-L, y b g.
' REPORT DETAILS - , E 1.
Persons! Contacted Licensee Employees- , '*J.' Bynum, Vice President, Nuclear Power Production / W. Byrd, Acting Site Director t S. Bargerstock, Manager, Procurement Engineering ' <
- C. Vondra, Plant Manager R. Beecken,. Maintenance Manager
- M. Burzynski, Site Licensing Manager
- M. Cooper, Compliance Licensing Manager S. Crowe, Site Quality Manager
- T. Flippo, Quality Assurance Manager J. Gates,. Technical Support Manager
'
- W. Lagergren, Jr., Operations Manager
>
- M. Lorek, Operations Superintendent
- R. Proffit, Licensing Engineer
- R. Rogers, Supervisor, Engineering Support Section
., S. Spencer, Licensing Engineer
'C.-Whittemore, Licersing Engineer .
- J. Wilder, Principal Nuclear Engineer j
NRC Employees.
, L
- B. A.: Wilson, Assistant Director for Inspection Programs, TVAPD-
- !
- L. J.. Watson,.Section Chief, Sequoyah, TVAPD j
- Attended exit interview
- . Acronyms and initialisms used in' this report are listed in the last , paragraph.
] 2.
Design Changes and Modifications (37700) l i The inspection team reviewed documentation, approval processes and record j keeping requirements, safety assessments and safety evaluations prepared ] . under the revised 10 CFR 50.59 program.
The revised 10 CFR 50.59 program for Sequoyah is governed by Nuclear Power y Standard STD-6.1.3, " Safety Assessments /Evaluatiohs of Changes, Tests and i e Experiments", Revision 2.
The inspector reviewed STD-6.1.3, Revision 2 ~ and the 50.59 determinations (i.e.
safety evaluations and/or safety ..
ee , - y ,,. , ' F j 9, , . . ?$ '. .f., - 't 4. - L assessments) written under this standard for 18 design change notices / (DCNs). ~ These DCNs were the following: ' M01401A M01898A - M02045A' , M01523A M01901B M02046A- , M01534A M01932A M021078-
M01535A M01937A M02109B L M01536A M01957A M02112A M01834A M02004A M02142A y . Of'(these' 18 DCNs, five had both a safety assessment and a. safety evaluation written for the 10 CFR 50.59 determination. The remaining 13 were processed with a safety _ assessment -only..-The safety assessment and the safety evaluation are described in Appendix 0 and Appendix E of r STD-6.1.3, respectively..The distinction to the~ licensee between a y g safety assessment and a. safety evaluation is'that the 10 CFR 50.59 Safety ! Evaluation' is the official. record that an Unreviewed Safety Question
( -(USQ) is not introduced as' a result of the change.
, Not all changes to the facility are required to be. reviewed under this standard. Maintenance activities performed by an approved procedure and ' within-the limits of the Technical Specifications which do not result in a change ty a system or which replace components with replacement parts procured :to the same (or equivalent) purchase specification _ are not reviewed under this. standard. The inspector agrees that these changes do-not-need to be reviewed under the standard.
The _. inspector could not determine any other changes to the facility which were outside this - standard.
The standard establishes the requirements for the review and evaluation of , proposed changes --to procedures, proposed tests and - experiments, and-proposed changes to tne facility. A safety assessment is required-for the'above except for the following:
a.
Site or corporate quality related procedures which are exempted from r this safety assessment by application of a review which is detailede in Section 3.10 of the standard, and b.
Non-intent changes to procedures which meet TVA Form 40138 (Appendix C of the standard) or similar existing site specific processes which meet STD-5.50 and NQAM, Part I, subsection 2.6 criteria.
, c .The 1.icensee has not developed criteria to determine what procedures would ' )~ be exempted; therefore, Section 3.10 was not reviewed by the inspector.
Form 40138 was reviewed and considered to be acceptable to conclude that the changes to the procedure were non. intent changes and did not have to be reviewed within a safety assessment.
o ~ r
- y R, 2; ,
, .... '
Q Appendix D provides the requirements for a. safety assessment. A detailed description of ~ the proposed change, special' activity _ or condition (Section A) is required including a discussion of the. systems,- structures, and components affected.
This must include a list of references used in completing the description.
The preparer must' decide if. the. proposed change is safe to perform.
If the answer, is no, the - . assessment requires that a revision to the proposed change must be made to
make the proposed change safe or-tn cancel the proposed. change (Section B). The standard uses a checklist in _ Appendix D to assist the preparer in determining what safety concerns could be impacted by the proposed change.
The inspector reviewed the checklist during the review of 50.59 determinations for the the DCNs listed above.
Possible additional items for the checklist were discussed with the licensee; however,- the inspector concluded that the existing checklist was acceptable.
For the DCNs reviewed, the inspector agreed with the judgements in the DCNs that the proposed changes were safe.
The. check list is also important because it is used to assist the preparer.
in deciding if a USQ exists or not.
In Section C of Appendix D, the preparer is asked if the proposed change affects any information, directly or indirectly, in the SAR. The SAR is defined in the standard as the latest version of the plant FSAR, additional submittals made by the licensee that form the basis of the Facility Operating License, any.
ammendments to the license, the FSAR changes not yet submitted to the NRC, and the commitments referenced to NRC SERs, but not yet in the FSAR. If the decision in Section C is that the proposed change does not directly or indirectly af fect the information in the SAR, the preparer does not have to fill out the Safety Evaluation (Appendix E of the standard) which would require the preparer to address the--specific requirements in 10 CFR 50.59(a)(2) for a proposed change not to involve a USQ and not to require prior Commission approval. The questions in Section C-are at the heart of the site 50.59 determination.
Guidance for the preparer is contained (1) in the checklist of Appendix 0 (to determine what the safety concerns are in the proposed change); (2) in Appendix B, " Format and Content of Safety Assessments / Evaluation and Criteria for-Determining Whether a USQ is Created"; and, (3) in the definitions of terms in Section 5.0 of the standard. These were reviewed by the inspector and considered acceptable.
The only comment is that the definition of the SAR should include the entire NRC SER instead of just the commitments made by the licensee because not all aspects of an NRC SER will end up in the FSAR.
The guidance in Appendix B and the definitions of changes definitely help the preparer deal with the problem of changes to activities not described directly in the SAR but which should require the preparer to address the specific requirements in 10 CFR 50.59(a)(2).
In reviewing Section C, the inspector had a concern about the questions in the section.
It appears that the questions do not address item (ii) of 10 CFR 50.59(a)(2) in that they do not address the possibility that an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created. This will be reviewed by the NRC staff and will be discussed with the licensee at a later date.
,
y y[. ... 4, r y & , f K
.
- _
__ F In Section D of Appendix D, the preparer determines if the proposed change requires ~ a change to the plant Technical Specifications. For Sections B, . C -and D, the preparer is required to provide a written justification for-his decisions.
These written justifications and the detailed description of the proposed change-is attached to the safety assessment for the line manager and level 11 reviewer to evaluate and concur on as required by~the . standard.
If the decision in Section C is that an unreviewed safety question may exist (i.e. the proposed change affects the SAR), the , preparer also completes a safety evaluation on the proposed change.
~i The requirements for a safety evaluation are in Appendix E of the standard.
The inspector reviewed Appendix E.and concluded that the questions'on the-proposed change in the appendix address the criteria for a USQ in 10 CFR 50.59(a)(2).
The appendix. is adequate to decide if a proposed change does not have aspects which meet the 50.59(a)(2) criteria y and, therefore, the change does not involve a USQ. The safety evaluation ' is reviewed and concurred on by the line manager, optional level I reviewer, level II reviewer, and the plant manager or designee.
Appendices D and E require that there be documentation attached to the I " form in the appendix to address and provide justification for the answers to the questions.
This documentation is required to have enough detail ' for an independent reviewer to agree with only the information attached to the form.
In-the definition for " stand-alone-document" in Section 5.0 of f the standard, the documentation package for both the safety assessment and the safety evaluation is required.to provide sufficient detail for a
- qualified reviewer to reach the same conclusions as the preparer with-only
.the information in the documentation package.
' Based on the review of STD-6.1.3, Revision 2, the inspector concludes that the standard is adequate to review proposed changes to the facility and make a 50.59 determination on'the proposed change except for the inspector's comment on Section C of Appendix D discussed above.
This comment is under staf f ' review.
The standard (1) provides adequate definitions of important terms used 'in the 50.59 determination; (2) provides adequate guidance in Appendix B and the definitions that the effect of the proposed change on the facility may only be indirectly described in the SAR; (3) requires adequate documentation of the decisions of the preparer reviewing the proposed change; and (4) requires concurrence by a qualified independent level II reviewer. The inspector noted that the definitions in STD-6.1.3 indicated that the phrase "as described in the safety analysis report" in 10 CFR 50.59 includes NRC SERs.
The inspector concludes that the revised program is an improvement on the old program. The inspector discussed his review of the standard with the licensee.
The comments included the following: a.
instructions to the preparer that no safety assessment / safety evaluation is required are provided only through the definitions in Section 5.0 of the standard, rather than at appropriate points in the body of the procedure;
- y , y , 7.. ; . .- p,., E . ,
- o b.
the term " licensing limit" which is given in a definition on page 18 of the standard should be defined in the-terms used in the standard; , c.
the : 50.59 L library should include other documents such 'as NRC Bulletins and Generic Letters.which provide requirements. on facilities and describe how equipment should operate; and, j
- t d.
other items that the ' licensee should include in the checklist' in ~ Section B of Appendix 0 are: .i, Post-maintenance testing not accomplished - , Accident Analysis- -- - Interaction of Class II (non-seismic)Lequipment located over Class I-(seismic) equipment Design Basis Calculations - Non-safety change which affects a safety system - . , The inspector found no serious deficiencies in the standard.
, The inspector reviewed the 50.59 determinations in '18 DCNs listed above which were completed under the revised program, For the 18 DCNs, the preparer followed the guidance and requirements in the standard. For the 13 DCNs which the preparer concluded in the safety assessment - that ~ no safety evaluation was needed, the inspector agreed with this conclusion.
- However, in seven of these 13 DCNs, the inspector had comments on the i completeness of the documentation provided with the safety assessment-form. These comments were on the completeness of the justification that - the change was safe, that a safety evaluation was not needed, and that a Technical - Specification was not needed.
The concern was the 'large fraction of 50.59 determination reviews that. the inspector had comments on. Individually, these comments do not indicate serious deficiencies in the revised program, -but the number of questions raised by the inspector mayl indicate that stand-alone documentation is not sufficient.
Overall, i the inspector concluded that the revised program was adequate for the - L licensee to make proper 50.59 determinations except for the comment' on-
question C of Appendix 0 of the standard as discussed above.
3.
Changes to Plant Procedures (42700) Procedure changes made under the new program were reviewed to determine whether they are made in conformance with 10 CFR 50.59.
This review included the Emergency Instruction E-0, Reactor Trip and Safety Injection,- (. which' was implemented to resolve RHR pump deadheading issue.
The / inspector also-reviewed a sample of procedure changes implemented after November 1, 1989.
The inspector reviewed approximately 30 of 42 available procedure changes.
.' The review included determinations that proper decisions were made regarding intent /non-intent nature of the procedure changes.
The inspector concluded that the proper determinations had been made and that proper assessments were made with the single exception of the E-0 change ' discussed belo m- -
h . +. t , u, L
y.,,-. !- .The - licensee implemented Rev. 7 to E-0 on December 6, 1989, after
k discovering-that pump characteristics and RHR system arrangement resulted - ' in the stronger of the two RHR pumps closing the discharge check valve on-
, the weaker pump. This caused a loss of flow in the weaker pump because 'the minimum flow recirculation line is located downstream of the check [ valve.
Engineering calculations determined that pump damage could occur
. if the pump ran for longer than 11. minutes with zero flow. Rev 7 of E-0
- -[
reset the SI signal and stopped both RHR pumps within a time frame of-less , than 11 minutes after. receipt of an SI signal.
The previous procedural > t steps directed the operators to reset the SI signal much later, past the point when pump damage could have occurred.
Rev. 7 also. changed - the criteria for stopping the RHR pumps af ter resetting the SI signal.
Previously, the operators were directed to stop the RHR pumps. only af ter i verifying that RCS pressure was above RHR pump shutoff head of 180 psig and stable or increasing. The new step 'in Rev. 7 required the operators ' to shut off both RHR pumps based solely on the RCS pressure above 180 ! psig. The-requirements to determine if RCS pressure was dropping were deleted in the new step.
The new step was placed before steps which examine certain parameters which diagnose whether a LOCA is occurring.
After the NRC staff expressed concern with this procedural change, the , licensee again revised E-0 (Rev. 8) on December 8, 1989.
Rev 8 ' rescinded the requirement for the operator to stop b9th RHR pumps after resetting the SI signal and instead required the operators to stop only ' one of the two pumps.
The Safety Assessment ( Appendix 0 of STO 6.1.3) supporting the Rev. 7 change to E-0 concluded that the change was safe to make, and that the , procedure was not described in the SAR. Therefore, further evaluation of the change in the Safety Evaluation (Appendix E) portion.of the change processing procedure, STD 6.1.3, Safety Assessment / Evaluation of Changes, Tests, and Experiments was not required.
The determination. that the procedure, E-0, was not described in the SAR was in error. FSAR Chapter 13 specifically lists Emergency Instructions including Reactor Trip and Safety Injections.
Secondly, the preparer and ' revtewers ' of this ' change package apparently did not consider that:the question of whether the procedure is described ~ in the SAR is meant _ to encompass the function that the procedure _ controls. Directions to preparers of a change package stating this position are contained in the Definitions section of STD 6.1. 3, but are not restated in section C of the Safety Assessment form.
The form question pertaining to procedure changes merely asks whether the procedure is described in the SAR.
The function, operator actions and automatic actions in response to an SI signal (whether inadvertent or caused by an actual accident), is described in various sections of the SAR.
The Rev. 7 change package answered this question- "No".
If the question had been properly marked "Yes", a safety evaluation would have been required. As a result of the error made by . the preparer which was not detected by the reviewer, a further evaluation " in the form of a safety evaluation was not performed. The distinction to the licensee between a safety assessment and a safety evaluation is that the 10 CFR 50.59 Safety Evaluation is the official record that an Unreviewed Safety Question (USQ) is not introduced as a result of the change.
- ,.
Q
' . , .
- .;
l,' ~
..; p 7' + i
The inspector agreed with the licensee that there was not a USQ involved with the change. This conclusion was supported by_ an analysis performed by::: Westinghouse subsequent to the change and. af ter the inspector ' o requested the licensee to provide assurance' that no USQ was invoived.
However, that determination was not made prior to implementing Rev. 7 to E-0.
~ In addition _to the error described above in the processing and review of Rev. 7 to E-0, the Safety ' Assessment also did not consider several ' attributes' affected by the change.
These included Human Factors, Equipment Reliability, Single Failure Criteria, Equipment Failure Mode,; , Equipment Redundancy.
However, each of these attributes were addressed by.the. change package-accompanying Rev. B'of E-0.
Furthermore, a Safety Evaluation was performed for Rev 8, even though it was not required as a , result - of the Safety Assessment, _The Rev. 8 Safety Assessment also , indicated that the procedure was not described in the SAR. In addition, the' reviews for. Rev 7 and Rev. 8 did not address the ' accident scenario described by Westinghouse involving the recirculation mode -of RHR for - small break LOCAs.
In conclusion, the inspector has determined that a Safety Evaluation was ,; not perform !d as required by 10 CFR-50.59 for Rev. 7 of the Emergency Instruction, E-0.
This is considered as an apparent violation,' VIO 327,328/90-01-01.
4.
Facility Modification (37701) i-The inspector reviewed documentation to determine the adequacy of the - program supporting modifications which require prior review and approval by NRC. The licensee had submitted a TS change request associated with performing repairs on the essential raw cooling water (ERCW) strainers.
The work.causes one train of ERCW and therefore, one train of emergency . diesel generators to be. inoperable.
The licensee's evaluation indicated l that this change to the Technical Specifications did not involve a significant hazard consideration as defined in 10 CFR 50.92(c).
The TS 7' change request and licensee evaluation of the request were reviewed.- The , inspector concluded that the evaluation for this proposed change was ' acceptable.
The inspector had-no comments on the licensee's determination.
5.
QA Oversight of the Design Changes and Modifications Program, Review of ...
- the Licensee's Lookback Program (37702)
The inspector discussed QA oversight of the design change and modification program with the licensee and determined that QA monitoring activities and audits were scheduled.
The inspector reviewed the monitoring and audit inspection plans and discussed additional activities, such as procedure change package reviews that also provide information on performance in the 10 CFR 50.59 area. QA presently conducts a 100% review of procedure change packages.
The licensee also discussed the tracking and trending of the monitoring and procedure change program findings.
These programs appear adequate to satisfy regulatory requirements.
,
w
, , h :: <
- ,g e
_.' .. To ensure that deficiencies identified by previous inspections were . properly-. addressed, the licensee was requested to conduct a review of safety evaluati'ans performed under the previous 10 CFR 50.59 programs, i
The -inspector reviewed the licensee's ' audits and reviews conducted by ISEG,' Nuclear Engineering, Nuclear. Manager's Review' Group, Quality Assurance, Plant Operations Review Staff, Nuclear Safety Review Board, and
a special task force review that reviewed all previous audits, The.
inspector sampled. the 10 CFR 50.59 documents reviewed by these audits and concluded that the audits adequately addressed the documents reviewed.
The inspector. independently picked eleven surveillance instruction change i packages and reviewed = the associated 50.59 documentation.
No problems L were identified. The inspector also reviewed Al-58 Appendix E handwritten t . instructions for.1988 through ' 1989 to determine whether they were . adequately evaluated in accordance with-10 CFR 50.59.
None of the licensee's reviews had sampled the Al-58 packages.
The inspector found 'i three packages which had administrative problems in that the forms were not properly filled out or did not include the required 50.59 e . documentation.
The inspector determined that these three items would not . require. a safety evaluation and therefore had no safety significance. The inspector - found a fourth example which appeared to need a safety ' evaluation.
However, - the three USQ questions were asked on the Al-58 Appendix B form with a one item block which was checked "no", indicating that a USQ did not exist.
The inspector agreed with.this conclusion.
-However, a7 safety evaluation may have been required.
The inspector determined-that there was no safety significance for this issue.
The inspector's findings-were consistent with the results of the licensee's audits and task force conclusions that there were probably no USQs missed by the old program, but that personnel errors existed. in filling out the 10 CFR 50.59 evaluation forms that could result in a ~ safety evaluation not being prepared when required.
6.
Tests and Experiments Program (37703) ' The inspector reviewed safety assessments and safety evaluations to determine whether the licensee has implemented a QA program relating to the control of tests and experiments that is in conformance with 10 CFR'50.59, NRC commitments and industry guides and standards.
The inspectors reviewed the circumstances surrounding the RHR pump deadhead test conducted on December 5,1989.
This operation called for running both RHR pumps 1A-A and IB-B to test for deadhead (no flow) problems due to pump-to pump interaction.
The procedure used for this test, approved by QA, is Section 26.0, " Field or Local Manipulation of Equipment" of AI-30, " Nuclear Plant Conduct of Operations".
The operation of starting both pumps simultaneously is allowed per design Therefore, a special procedure to run both pumps at the same time was not required to be written. The results of this special test verified that a ' deadhead condition occurred during simultaneous RHR pump operation.
See paragraph 11 for further details of this issue.
-
l { g ' ~ ' ~ ..g . r.n ' b,'_ , t
i The licensee generated. Temporary Alteration ' Control Form (TACF) No.
0-89-69-063 in accordance with' AI-9, " Control of Temporary Alterations and ~ Use of.-the Temporary Alterations Order", on December 17, 1989 to' install y- - .the temporary; heaters for the RWST level transmitters and to place the permanent _ heaters and thermostats back. in service.
This TACF was _ generated for corrective action of RWST level transmitter freezing. TACF . , No. 0-89-69-063 was reviewed to determine. if it conformed to Al-9 requirements in. content, approval, limitation, and.that a safety , assessment and safety evaluation which satisfy'_10 CFR 50.59 were ', > performed. The daily journal recorded by the Assistant Unit Operator for outside rounds on December 20 and 24^,1989 and January 2,_3, and 4,1990; were reviewed for temperature recording in the RWST instrument cabinets to check for accomplishment of the recording requirements.
No deficiencies were noted.
The inspectors concluded that the licensee _I performed the routine test of RHR-pumps and the special installation for the temporary heaters for the RWST level transmitters in accordance with the Erequirements contained in plant procedures _and instructions.
This indicated that tests and experiments were being adequately controlled and that the associated QA program relating to these issues was adequate.
7.
Commercial Grade Procurement (38703) i The' inspector examined the details of the engineering evaluations and acceptance methods for upgrading commercial grade parts and components in relation to whether this program adequately implemented review ~ requirements from 10 CFR 50.59. The examination included interviews of ~ . responsible personnel, review of applicable procedures, and review of a 4-sample of engineering evaluations as detailed below: 'The Manager of Procurement Engineering, who is responsible for - administering the upgrade program, was interviewed.
Procedure TI-110, Rev.
3, Technical Evaluation For Procurement of -- Materials and Services, which includes detailed requirements for upgrading, was reviewed.
The following CEG Output Packages for upgraded parts or components ' were reviewed: RIMS B29 900109 116 - Radiation Monitor Pump Motor 480 volt Room Condensing Fan Motor . RIMS B29 900102 101 - Class 1E Fuses b-RIMS B29 891221 121 - Bolting The above limited examination revealed a comprehentoive, detailed program for upgrading commercial grade parts and componerats with good implementation.
The implementation of 10 CFR 50.59 requirements was considered adequate in-this area.
t-8.
Non-licensed Staff Training (41400) , .
-- pw.
, .. > . g+; .,. J g 1.. L'
, h, ~. - ~a The _ inspector reviewed the training programs supporting the Qualified Safety Evaluation Preparer and Reviewer concept in; the new-10 CFR 50.59 program as implemented by the TVA Nuclear Power Standard, STD-6'1.3, Rev. 2, Safety ' Assessment / Evaluation of Changes, Tests, and . Experiments. The Level I and Level 11 training programs. were evaluated dX with the following results: H' a.
Level I Program The formal level I training program consisted of eight hours of l classroom training, eight hours of workshop training, and a written examination with a minimum passing score of 80 percent.
The training included a comprehensive study of the requirements for-performing a safety analysis to determine if the change is safe, what, items are included in the SAR and contents of each, actions required, TVA procedures that are applicable, how to differentiate between intent and non-intent changes,- steps involved in processin0 a Safety Analysis,, actions to be taken if a proposed activity is determined to be unsafe, and general' information to ensure a good working knowledge . of STC 6.1.3.
In addition,. prior NRC violations for failing to perform adequate 10 CFR 50.59 reviews at Sequoyah were included in o the lesson plan.
The workshop training ^ included performing safety assessments, safety , evaluations, and class discussions. The students handwritten work is l submitted for evaluation at the completion ' of.the workshop 'and -{ satisfactory results are required.
.! The inspector noted no deficiencies during 'the review of the program j i.
for qualifying individuals as a level I reviewer.
~ b.
Level.II Program \\ ' The Level II reviewer. is defined as a TVA individual' approved-through a screening process by a Qualification Review Board (QRB) . and to have demonstrated the following: jl - Knowledge of Nuclear Power Standard, STD-6.1.3.
- Knowledge of.the contents of the FSAR, Technical Specifications, - and NRC SERs.
Extensive knowledge of plant systems and their interactions.
- Thorough understanding of the 10 CFR 50.59 criteria and process.
- Knowledge of the plant design basis including accident analysis, - regulatory requirements, and of the " defense-in-depth" concept.
- i ( ) f 'C . i .
y .
W b y,, y . ( .; m -, { > I
Q e ,
e-TVA. management stated that a training program has not been completed e for the Level II reviewers.
However, a group of. individuals were i selected and evaluated by the QRB for. certification as Level 11 reviewers.
One _ of the individuals certi fied, by the board was.
selected by the inspector and a. review of that individual's .> qualifications 'was conducted.
The inspector' determined ' that the ' ' individual had the following qualifications: s Bachelor'of Science degree in Nuclear Engineering - Sixteen years ~ experience in the nuclear industry in the areas of - design,. licensing, FSAR updating program, Plant Operations Review Committee, and upgrading theQ' list.
Current section supervisor of the Safety Analysis Group, the + E modification program, the environmental qualification program, U and the FSAR-(primarily the accident analysis section).
In addition.to a review of the individuals' credentials refe'renced.
above, three individuals from the list of Level II certified ' reviewers were known by the inspector.
The inspector had observed these individuals directly while assigned to Sequoyah during Unit 1 restart, They are considered knowledgeable and capable.
Based on the sample of persons reviewed above by the NRC inspector, - the Level 11 reviewers list appears acceptable at this time.
! 10. -Qualifications and Assessment of Offsite Support Staff (40703) The team reviewed Engineering activities in support of the 50.59. process to evaluate the qualification of the support staff > and the adequacy of the . Engineering activities relative to specific calculations and evaluations.
Engineering evaluations 'and calculations relative to the RHR pump.
deadheading issue and the RWST' Level Sensor Temperature Controller modification event were chosen for review.
(See paragraph 11,. URI 327,328/89-29-03, for RWST level sensor evaluation).
- On. November 28, 1989, a routine ASME Section XI quarterly surveillance on , RHR Pump 2A-A 'resulted in a delta P of 200 psi which was outside the
, acceptance range of 168.3 -to 184.6 psid.
During evaluation of this problem, the licensee evaluated the pump-to pump interaction between pumps , A and B to determine if a deadheading problem existed. This evaluation resulted-in the determination that deadhleading was not a problem for @r ' _ Unit 2.
However, further evaluation revealed that it was e problem for Unit 1 (See Paragraph 11).
, i i, ! ? e
m ~ - W h: .t ,, s~ .. - , v.
s fe
L. y...- .,. b The following summarizes the team's review relative to engineering support 'for this problem: a.
- ASME Section XI Surveillance Testing-Af ter pump 2A-A failed its surveillance, the calibration of the pressure gauges used were checked and the discharge pressure gauge - was found to be out of calibration.. The-surveillance was ' rerun using l another discharge pressure gauge and the delta P was found to be p 194.5 psi,: still outside -the acceptance limits.
On November '29, ii. 1989, the-surveillance was repeated under controlled conditions and b ~ the delta P 'was determined to be 189 psi, still outside ' acceptance limits.
An engineering analysis was performed and the decision was made that the increase in_ delta P was not caused by pump degradation.
In accordance with ASME Section XI and the analysis, new reference
values were established using the current surveillance results. The ! following records' relative to disposition of the failed surveillance y h were reviewed: Potential Reportable Occurrence (PRO) 2-89-156 ' SI-128.4,.R4, Residual Heat Removal Pump 2A-A Quarterly - Operability Test, November 28, 1989 RCA Investigation Report, 2A-A RHR Pump Fails SI-128.4 on November 28, 1989
DNE Calculations SQN-74-0053, EPM-RSR-112889 ICF No. 89-0866 for SI-128.4, R4, including 50.59 Safety Assessment, Appendix D Computer Printouts summarizing all delta P surveillance data and historical changes to ' delta P reference values for all Unit I and Unit 2 RHR pumps J b' RHR Pump Interaction (Deadheading) . As indicated above, the licensee determined that the weaker Unit 1 RHR pump would be deadheaded against the stronger pump.
The team reviewed the following documentation relative to engineering calculations and evaluations for this issue: Design Output Document - P-QIR-NE-MEB-SQP-PM-89042 R0 DNE Calculations titled RHR Pump miniflow Operation - Potential Pump-to-Pump Interaction Voided CAQR SQP890639 (voided based on issuance of LER 327/89-032)
. _.._ ' V, . ,
's.
c ,
- ...
PRO 1-89-277 . S01-74.1,. RS2, Residual Heat Removal System, including 50.59 Safety Assessment, Appendix D Final Event Report 11-89-097, RHR Pump Deadheaded When Operating' in Parallel c.
Personnel Qualifications Relative to the above calculations and evaluations, the team-evaluated the qualifications of support personnel -to determine . whether the support staff is qualified to perform engineering analysis-and. evaluations required by 10 CFR 50.59..The evaluation consisted of the following: . Interview of' supervisory and nonsupervisory (engineers) Design Engineering and Technical Support personnel responsible for the calculations and evaluations listed above Review of 10 CFR 50.59 Level I/II training / certification records . .for: Design Engineering and Technical Support personnel responsible for the calculations and evaluations listed above Review of a. sample of position descriptions for Design Engineering and Technical Support engineers Review of the following procedures: Standard Practice SQA 168, R2, Conduct of Technical Support NEP-1.2, R2, Training NEP-1.6, R0, Project Manual, Preparation and Control NEP-2.3, RO, Conduct of Changes to Licensing Documents NEP-3.1, R1, PCN4, Review NEP-5.2, R0, PCN1, Review NEP-6.6, R1, 10 CFR 50.59 Safety Evaluations 'SQEP-Al-04, R4, Sequoyah Engineering Project Organization SQEP-Al-05, R0, Interface Control ' Interviews and records indicated that Design Engineering and Technical Support personnel were well qualified to perform the calculations and evaluations.
' -
- mc > ~ x; -
. E sg Wc , u oi
, ,, - ' h During the above reviews, the following problems were identified: The. licensee's. RCA Investigation Report-indicated that when- ' attempting to resolve the RHR pump 2A-A delta P problem,- the u discharge pressure gauge was pulsating between.195 and. 225 psi-i making accurate pressure measurements very ' difficult.. This' , < condition was improved somewhat by throttling - the test' gauge
P.
isolation valve.
The team noted that delta P surveillance test results using similar. test. setups had been u>ed; to calculate l pump interaction delta P between the > two pumps.
Based.on the g . requirement of 11 psi-maximum pressure differential between. the " two pumps, inaccuracies introduced by the large gauge pulsations can invalidate pressure differential determinations.
-The- - inaccuracies can also bring into question routine quarterly test - resul t s. The, licensee stated that they had recognized the- , concerns with obtaining accurate test results with large gauge ~! pulsations and were addressing this question in their Section XI task group report.
The Section XI task group was formed to evaluate problems identified during the RHR testing.
The-team also noted that the RCA Investigation Report raised a 'j question relative to out of calibracion test gauges that could' indicate'a trend of problems with.M&TE.
NRC has noted other recent problems with M&TE.
The licensee - (Technical Support ' < ' personnel) stated that this question will be -investigated to determine if there -is an adverse trend of M&TE out of calibration, i In order to review resolution to these problems, Inspector Followup Item (IFI) 327,328/90-01-04, Problems With Test Gauges, i will track the M&TE issues. The team also noted that neither of the above' problems have had a CAQR issued as of the inspection exit date.
NRC - concerns relative to the lack of timely-initiation of CAQRs were presented to the licensee at the a f inspection exit meeting.
~ 11.
NRC Unresolved Items, Violations (92701, 92702) (Closed) URI 527,328/89-29-03, Compliance with 10 CFR 50.59, with two Examples.
t Example 1 of this URI involved the disposition of the RHR deadhead issue with respect to the revisions made to Emergency Instruction E-0, Reactor.
Trip and Safety Injection. These issues are addressed in paragraph 3 and are the subject of Violation 327,328/90-01-01.
Example 1 of the URI is closed.
Example 2 of the URI involved the removal of heateh. for the RWST level transmitters.. Evaluations performed by DNE staff were reviewed by the NRC inspector in an effort to determine the quality of the safety evaluations as required by 10 CFR 50.59.
, M
- p l1l,, _ ' y ] . ,_ , .., . n !
g D T'h'e ' inspector reviewed Design Change Notice, DCN 1138A, involved in the removal of thermostats and heaters that were originally-installed in 1982.
for freeze protection for the Unit 1 Refueling Water Storage Tank (RWST)
level transmitters. The reason for the removal was based on the heaters and thermostats not-being IE qualified.
The possibility : existed for~ the ! heaters to fail in the on. position causing failure of the transmitters due to overheating. Engineering personnel stated that only the condition for overheating was evaluated prior to removing the heaters and thermostats.
In addition, the Safety Evaluation (M0138A) that was performed by :the ' licensee to evaluate the heater and thermostat removal in-September of 1989 was reviewed and found to be inadequate in that Section D, Effects on Safety, states that the ' thermostats and heaters were not required to ensure operability of the RWST level transmitters.
' On December 15, 1989, the RWST level transmitters froze and the RWST level detection system was declared inoperable, Neither the design change nor the safety evaluation adequately con.idered the effects on the_RWST level transmitters from removing'the thermostat and heaters. This is considered a violation of 10 CFR 50 Appendix B Criterion III for inadequate design control and 10 CFR 50.59 for an inadequate safety evaluation and is-identified as VIO 327,328/90-01-02,- Inadequate Design ~and 50.59 Review.
URI 327,328/89-29-03 is closed.
(Closed) URI 327, 328/89-29-04, Bulletin 88-04 Response Bulletin 88-04, - Potential Safety-Related Pump _ Loss, addresses safety i related pump loss due. to deadheading caused by pump-to pump interaction during: miniflow operation and whether mlniflow capacity is adequate for even a-single pump in operation.
The inspector reviewed the bulletin i response issued August 2, 1988; LER 89032 addressing current problems i directly related to this issue which were identified December 5, 1989; the j licensee's event investigation report relating to ' this issue in general,.
which was issued on January 11, 1989; and all references for each. The inspector determined that the licensee had been informed of this problem by NRC. Information Notice 87-59, RHR Pump Loss, in November 1987 and by two. Westinghouse letters addressing this issue in October and November of J 1987 prior to issuance of NRC Bulletin 88-04. The November.1987 letter j identifies this issue as an unreviewed safety question as defined in
10 CFR 50.59 and details proposed courses of corrective action to resolve j it, although Sequoyah was not specifically identified as being affected.
.) ' Westinghouse also issued a letter dated May 23, 1988 detailing their recommended actions in response to the bulletin and identifies Sequoyah as j potentially being impacted.
.l R The inspector reviewed calculation SQN-74-0053 dated July 22,1988 which j identifies that at shutoff head (deadheaded) the RHR pumps reach the
maximum operating temperature in 11.1 minutes.
This calculation also
analyzed several conditions of pump miniflow operation during parallel pump operation and determined the pump-to pump differential pressure to be j 11.1 psi at 100 gpm and 11.8 psi at 50 gpm.
l q l
_ .__ _ _ _ _. _ _ _ _.... .. . . 3% i
- .
, ,bh
The inspector reviewed the 'ASME Section XI RHR pump test data for both units from 1977 through 1989 to determine -if deadheading could have occurred based on a 12 psi pump-to pump differential.
The inspector concluded from this data that on Unit 1 this problem probably existed from July 11, 1987 through 1989.
Test data from July 11, 1987 until November 8,1989' indicated that of the 23 tests conducted on the Unit 1 RHR pumps (11 on the -1A pump,12 on the IB pump) only the test conducted , on April 5, 1988. on the IB pump, when compared with the corresponding ~ nearest-in-date 1A pump tests, would have provided positive information to conclude that deadheading did not exist.
Since comparisons of the other 22 tests did give positive indication that deadheading ' existed, the resident inspector asked the licensee on November 29, 1989 why they thought deadheading would not occur on Unit 1-if a valid ESF signal was received.
The resident inspector continued to pursue this issue with the licensee including requesting an operability determination during the NRC exit interview on December 4, 1989.
On December 5, 1989 the licensee started both RHR pumps and determined that the 1A pump was in-fact deadheaded.
This. confirmation verified the licensee's engineering calculations which predicted that if greater than a 12 psi difference between the pumps existed, deadheading of the weaker pump would occur.
The licensee's calculations determined that a deadheaded pump could operate for only 11 minutes before internal damage to the pump would occur due to excessive temperature.
.The August 2,1988 bulletin response and TVA's actions did not recognize 'that the RHR pump deadheading issue was valid at Sequoyah at the time.
The licensee believes that an average of the ASME Section XI pump tests-was used as the basis for comparison between pumps.for thu bulletin response.
This conclusion is based on the current surveiliance which _ -uses the averaging method because the licensee was unable to determine 'Y . from existing records the basis for the bulletin response.. Pump data .found in the bulletin response file, ~ when averaged for each pump and compared, supported the licensee's bulletin response statements.
The licensee concludes in the LER that the averaging method is inadequate to ' detect pump-to pump interaction problems.
Had the proper analysis been . performed of the same data that was averaged, the licensee would have concluded that the problem did exist on Unit 1 at the time of the bulletin response.
Not all of the calculations or conclusions of TVA engineers were considered in responding to the bulletin or in the corrective actions taken. For example, a CAQR was prepared which paralleled the Westirghouse recommendations of May 23, 1988 for correction 'of the problem wnich included emergency procedure changes and a longer term hardware fix, and al'so recommended testing the pumps by running them in parallel to determine if deadheading actually existed. This CAQR was never processed and as such a formal operability call was never made.
The Westinghouse recommendations contained in the CAQR were never adequately implemented.
In addition, this CAQR contained information identifying that the time to damage an RHR pump by deadheading was about 10 minutes.
The CAQR also recommended contacting the pump manufacturer (Ingersoll-Rand) concerning
h f,' 1 . I, - ' g3 - '17 ,- PN, _ - x--w 4' v'm t hydraulic--instability or impeller recirculation problems in relation to; _ pump recirculation flow.- -Had this CAQR been processed it appears that1the necessary information, which in. December 1989 forced resolution of. this
issue; may'have been properly evaluated in the summer of 1988.
. ~ Licensee discussions with and data obtained from the pump manufacturer were misinterpreted and misused in developing the corrective action taken.
This information' indicated that pump-operation withf as low as 100 gpm mini-flow which did not exceed 20 minutes will not cause pump damage.
- - This information probably addressed the hydraulic instability issue. This ~ information does not address the deadheading issue but was misinterpreted-byc the licensee and used to address the deadhead issue.
Further eva1uation lof this problem during fall of 1988 in relation to emergency a ~ procedure changes. used this 20 minute time frame as a basis for concluding that existing emergency procedures were adequate.
The inspector concluded that the resultant errors in adequately addressing i and correcting this issue appeared to be due to. interface and communi- , cation problems between organi:ations.
These interfaces would have been- -forced to work had' a CAQR been processed as required._ In addition, a documented operability determination would have been made.
' On November. 22,1989 a system engineer was reviewing data pertaining to- " the Unit 1 RHR pump test and concluded that. the SI-754 surveillance test, implemented to check ' for pump deadheading, would not meet its acceptance criteria when performed during the next refueling outage._ This surveillance averages the' five tests conducted for each pump. between refueling outages as was accomplished for the bulletin response.
The system engineer wrote a memo to his supervisor noting that an engineering evaluation would be required by the SI, since pump average differential was-17.8 psi. He noted that no pump degradation had occurred, since the average value was consistent with the current value of 17.52 psi. This information was sent to engineering on November 127, 1989. A CAQR had not been-generated prior to-identification.that the deadheading issue actually
cf existed for the Unit 1 RHR pumps by the resident inspector on November 29, 1989, nor prior to the December 5,1989 parallel pump test run of both Unit,1[RHRpumps.
The failure to adequately address and correct the consequences of the RHR pump deadheading issue is considered a violation of 10 CFR 50, Appendix B, ~ Criterion XVI for failure to correct a significant condition adverse to quality and is identified as VIO 327, 328/90-01-03.
, After confirming the existance of the problem on December 5,1989, the licensee placed the IB RHR pump in pull-to-lock (including LC0 entry) to prevent pump-to pump interaction until. an. emergency procedure revision could be-processed.
The emergency procedure revision to stop both RHR pumps prior to 11 minutes into an accident sequence and the subsequent revision to stop only one pump are discussed in paragraph 3.
The inspector found that the final event investigation report performed by the licensee was rigorous and that corrective actions described in the event report, when fully implemented, should correct the problem.
. o
.q f .: r w y
U The va'rious-information pertaining to this issue was processed through the Nuclear. Experience Review program (IEN, Westinghouse letters, and IEB). - The inspector ' discussed with the licensee the NER program and how <!' operability determinations are made through' this program.
This program relies on the CAQR program to make operability determinations, As such, . operability determinations are made after distribution of the incoming ," information to the appropriate organizations for review. The distribution for - this information is - determined by the site NER representative q (presently STA qualified)' and several other individuals ( presently SRO ' qualified) at a meeting every Thursday.
There have been no CAQRs generated to date directly from this meeting.
This -indicated that operability determinations.are being made only af ter the organizations c ~ . receiving the information have made appropriate evaluations and processed a CAQR.
The inspector was concerned that time sensitive operability > determinations were being unnecessarily delayed by the distribution and processing of the incoming information after the initial NER review. The site NER representative told the inspector that in some cases he had hand carried. information to appropriate departments to expedite these determinations. 'If the information had immediate operability concerns, the operations department should be made immediately aware of it for a formal operability determination. The lack of a formal policy for time sensitive determinations is considered a potential weakness in the NER program which the licensee should address.
URI 327,328/89-29-04 is closed.
-(Closed) VIO 327,328/89-15-04, 50.59 with Three Examples Example 1 of this 3 part violation addressed actions taken to isolate the BIT recirculation in. an effort to terminate backleakage from the RCS to the BIT and, via the recirculation path, to the BAT.
Licensed operators-stopped the BIT recirculation based on a TS interpretation that had not . been evaluated in the 50.59 program.
As a result, a change in system i alignment described in the SAR as necessary to ensure the BIT remained operable was performed without benefit of a 50.59 review.
- Immediate corrective action initiated by the licensee was to return the [ i BIT recirculation to normal. Further corrective actions included removing the TS interpretation from the control room and performing a 50.59 review l and PORC approval process before re-issuing each separate interpretation.
To ensure compliance and use of approved procedures, AI-30, Nuclear Plant ! Conduct of. Operations, was revised to define conditions and controls under
. which manipulations of plant equipment and systems may be performed
~ j without procedures.
Revisions to the 50.59 program as discussed in this l report were also incorporated.
Example 2 of the violation involved placing the RHR system in an unanalyzed condition to perform RHR system venting.
This occurred when SI-128.1, RHR Pump and Piping Venting, was revised, without an adeauste 50.59 review, to open the RHR hot leg injection valve to facilitate venting the RHR piping, and closing the cold leg cross-connect valve.
These alignments placed the RHR system in configurations that could lead .i
y- , _[ . fi y, _ L, ' - i
- v
- .;
f b
Lf :.~ - to pump runout if called on _ to-start or prevent a single pump from _ . supplying all four cold legs.
L Corrective' actions included cancelling the ' procedure changes that [J implemented the unanalyzed condition and implementation of the new L 10 CFR 50.59 program with the Level II reviewer concept.
Level II.
L reviewers must be conversant with the 50.59 program and concept as well.as g having a background in. system operations and interactions.
Example 3 of the violation involved a modification of the excore nuclear - instrumentation system which resulted in 'an undetected failure of the-t intermediate range cha r.nel s. The change was performed on the detector basket location without an adequate 10 CFR 50.59 review.
Cause of this event included personnel errors in both the preparation and review of the evaluation supporting the change, as well as previously mentioned weaknesses in the 10 CFR 50.59 program.
The personnel involved were L-disciplined, the IR channels were recalibrated in ' accordance with their new location, and the 10 CFR 50.59 programs were revised. The corrective actions are adequate and V10 327,328/89-15-04 is closed.
' (Closed) VIO 327,328/89-15-05, Three Examples of Failure to Establish and Implement Procedures Per T.S. 6.8.1 This violation was originally identified with three examples, The ) violation was revised and issued as e second violation in an escalated
, enforcement package with one example, described below.
].t The recten for the violation was that interim action, taken after the SOS
' identified the RHR venting procedure as inadequate, was informal and ! incomplete.
The responsible individual assumed that further performances .j of : SI-128 could not be made.
This ' was based -on his belief that i _ performance packages were-issued through his section.
In-fact, on two '} separate occasions performance packages for SI-128'were issued directly to ' the main control room.
' q Corrective actions -included revising SI-128 to delete the incorrect alignment, and revising AI-4, Preparation, Review, Approval and Use of Site Procedures, to establish a method for placing an administrative hold ] on'a deficient procedure.
Corrective actions for this violation are a complete and are adequate.
VIO 89-15-05 is closed.
l ! ' (Closed) VIO 327,328/89-18-03, VIO 327,328/89-18-04, VIO 327,328/89-18-10, L ~ Monitoring Ice Bed Temperatures I f The inspector reviewed the licensee's response to Violations j 327,328/89-18-03, 327,328/89-18-04 and 327,328/89-18-10.
The violations
have to do with monitoring the ice bed temperatures with a temporary f system which did not meet the requirements of TS 3.6.5.2.a.
Violation s 327,328/89-18-03 was issued because the licensee failed to comply with ! ' TS 3.6.5.2.a in that, with the ice bed temperature monitoring system not available in the main control room, the licensee did not determine, every i j ' 1. ; ..
g%
q = s6 - ! w w a.
- *. , p L
.. 12 hours, the ice bed. temperature at the' local ~ ice condenser temperature.
. monitoring panel as required by the action statement.
The licensee , ' admitted the violation and -responded that the root cause was. the ' misinterpretation that Appendix A to Surveillance Instruction (SI) 477,
" Backup Ice Condenser Temperature Monitoring",-which provided~ an acceptable method to meet TS '3.6. 5. 2. a. After discussions with NRC management, the licensee agreed that it did not, The licensee's , corrective actions were: (1) upon determination of the _ above-mentioned + misinterpretation immediate actions were taken to enter LCO 3.6.5.2 ar.d , L verify the ice bed temperatures' at the local ' monitoring panel every 12 hours until the permanent control room equipment was-repaired and ~ reinstalled as required by TS 3.6.5.2.a, (2) operations management has discussed with the' SOSs the need for literal compliance with the TS and the plant manager has issued a memorandum to operations personnel stressing the need for this compliance, and'(3) SI-477 was revised to_ reflect the requirements specified in TS 3.6.5.2.
Violation 327,328/89-18-04 was issued because the licensee failed - to N comply with 10 CFR 50, Appendix B, Criterion XVI in that management did j not take prompt corrective action when the Unit was not in compliance with
- j TS 3.6.5.2.a for ice condenser temperature monitoring.
The licensee admitted _ the violation and stated that, as discussed in its response to Violation 327,328/89-18-03, there were different interpretations F initially made in consideration of the TS and the temporary alteration requirements; The SOS recognized the difference between the j L L interpretations of the operators and the NRC inspector.
He considered l ' the legal TS requirements for monitoring ice bed temperatures with installed equipment versus the technical basis for monitoring of ice bed-j temperatures with a temporary recorder when ice bed temperatures are l below the TS limit, but did not enter the LC0 at that time and deferred ~1 - the question to his management for further discussion.
The licensee's corrective action was that-the Site Director met with key site personnel to stress the importance of literal compliance with the TS and of the escalation process to ensure timely resolution of questionable situations concerning compliance.
j l Violation 327,328/89-18-10 was issued because the licensee completed temporary plant changes to the ice condenser temperature monitoring system without performing an adequate review pursuant to the ' requirements of
-10 CFR 50.59 as required by AI-9. The licensee admitted the violation-and { j! stated that the cause of the violation was a misinterpretation of the-temporary alteration provisions of Administration Instruction AI-9 in that the operators believed that equivalent and acceptable controls were h.
provided in SI-477 and were allowed by AI-9. This is discussed further in ' the licensee's response to Violation 327,328/89-18-03.
The licensee's j corrective actions were that (1) SI-1, Surveillance Program, will be
revised to clearly state-that all sis must comply with Al-9, Section 2.2.2, and to specify a 30 day maximum time that test equipment may be left-installed unless otherwise specified in the SI and (2) the revised j 50.59 program and enhanced sensitivity of operators to literal interpretation of the TS would prevent any further sis from incorrectly implying that the SI met the TS.
i - _j
C ', - ,; . .
e
21 ,e ~ " The inspector has reviewed the corrective actions taken by the licensee.
The instruction $1-1 has been revised and it also now requires that consideration must be given to the effects of the test equipment on the TS requirements.
This would include the allowed times given in action statements of the TS. The inspector has reviewed the revision of SI-477 which was current during the violations and the' revision made to address the violations. -The inspector concludes that the SI-477 at the time of ' the violation could have been interpreted by the operators such that they could have believed TS 3.6.5.2.a was being met by Appendix A.of SI-477.
This was not correct but the previous SI-477 would have implied it was correct. The revisions to SI-477 will' prevent this misinterpretation in { , the future.
The stress on literal interpretation of the TS, the i revisions to SI-1 and the revised 50.59 program for reviewing' changes to procedures should prevent a situation similar to these violations in the future. However, the inspector requested that.the licensee. address the possibility of other sis existing that could imply to the operator that '. the actions in the SI' meet'the requirements of the TS when in fact they do not.
The licensee stated (1) that Section 8.3 of AI-4, " Preparation, Review, Approval and Use of Site Procedures / Instructions", requires a j < periodic' review of surveillance instructions, at.least once every l2 years, i by an individual knowledgeable in the area affected and (2) that SI-1 i required an SI to' be reviewed against a checklist' in Appendix F of SI-1 'I for compliance with the TS.
The inspector reviewed the checklist in ! Appendix F.of SI-1 and concluded it should prevent sis from incorrectly . ' implying that the SI meets the TS.
The inspector concludes that the licensee has adequately ' addressed the causes of the violations. VIO 327,328/89-18-03, VIO 327,328/89-18-04, and-VIO 327,328/89-18-10 are closed.
j q" .
(Closed), VIO 327,328/88-43-01, Failure to Have Adequate Procedures and to Implement Procedures Regarding 50.59 Reviews.
The-inspector reviewed the violation response and changes to the licensee's program which had been made since issuance of the violation response. The licensee's supplemental response specifically' addressed the , issues of the violation and discussed how the design control process is i supposed to prevent the violation. The inspector discussed recent changes
in the design control organization and how they affect the design control process described in the response.
Although these changes still allow - processing the-design control package separate from the safety evaluation in the early stages of the design control process, the process still p ensures that reconciliation of these two products occurs.
Sufficient j
. reviews af ter this reconciliation still exist to ensure that assumptions
and limitations that were used as the basis for the safety evaluation ! remain valid.
Training on the 50.59 program is addressed in paragraph 9 of this report and is considered adequate.
This item is closed.
i l E
- M
'4 - ' > , wf- , , , . Mm ^ n t hJ ~ ' ~( e ib, +
+ ' u ' _j-P
, F L12.1.. . ; .. - Exit -Interview f(30703): . , ' ' c: . .'. . . . P 1Thejinspection scope and findings were. summarized,on! January 5, 1990,;with
e @Cx those persons; indicated i_n paragraph 1.
The. Team: Leader described!the - " p iareas.-inspected,and discussed in detail the ' inspection findings. listed.
< ~
- below. :The" licensee -acknowledged the~ inspection findings and e did, not
.- + , .3 identify..: as, proprietary any. of -the materia 11 reviewed by the: inspectors-_ j P-during the inspection.
a ' L; ^
! y . Inspection,Findingsi > .sk - ' Three violations of-NRC. requirements.were identified.
" r s ', ' The present program 1to implement 10 CFR 50.59 requirements was ~ , P adequate, butheaknesses existed in the. implementation: of the program' y - which : resu~1ted1in J several minor' errors and ; failure J to -properly '
- .F evaluate an emergency procedure revision.
'
. , ' E The licenseets Lookback program was sufficient in scope and detail to: , provide reasonable ' assurance that USQs had-been ' properly identified'
" "and addressed under'the previous programs.
ri '
- -The following items were closed or opened in this report for' Unit 1 a'nd '2
- (327,328):-
~~ ! , . Item'- Status'. Description F-VIO 90-01-01 Open Inadequate 50!59 for E-0,'R7' O
VIO 90-01-02~ Open . Inadequate Design and
y 50 59 Reviewi.RWST- ' ' VIO 90-01-03 Open Corrective Action for RHR J Pump,Deadheading ' -IFI 90-01-04 Open Problems With Test Gauges , u URI 89'-29-03 Closed Compliance with.10 CFR 50.59
$! . VIO 89-15-04 Closed 50.59 With 3 Examples , e a VIO 89/15-05 Closed Fail to Establish and Implement Procedures sk per TS 6.8.1 - VIO'89/18-03 Closed Ice Condenser Monitor . J VIO 89/18-04 Closed Failure to Take Prompt Corrective Action w , [Q,1 -
pyy - - -
p* .-A i _:c : . ACK' w '23 ty , , , - -- .., , Item... Status Descr_iption
. , -(cont'd) L VIO;89-18-10 Closed Fail to Perform 50.59L for Plant Change-l VIO 88-43-01 Closed Inadequate Procedure and' t 50.59 Review j p( ' ! F, VRI 89-29-04 Closed Bulletin 88-04 Response-h1 In " addition to the inspection findings presented above, the inspection' team ' leader expressed concerns regarding 'the apparent reluctance _of Sequoyah staff.to initiate and process CAQRs until details of_an apparent problem are well: defined and-requirements of the discrepancy can be listed along with a -description of the concern. These are obvious attribt.;es-to ensure quality in the CAQR program.
However, insistence on a high-level of detall and ccmprehensiveness in-an initial submittal could result in .. genuine concerns not being promptly identified -and reviewed.
In. a N related area, concern was expressed that the Nuclear Experience Review
Program exhibited weaknesses in promptly identifying potential' operability , i s sue s.- . v .; During the reporting period,, frequent discussions were held with members i > of the licensee's staff concerning inspection findings.
N 13. - List of ' Acronyms and Initialisms P ABGTS - -Auxiliary Building Gas Treatment System Auxiliary Building Isolation
ABI - ABSCEl-Auxiliary Building-Secondary Containment Enclosure Auxiliary Feedwater ,AFW '-- AI ' Administrative Instruction - < AOI - -Abnormal Operating Instruction Auxiliary Unit Operator AVO - LASOS Assistant Shift Operating Supervisor - ' ASTM - American Society of-Testing and Materials l BIT.
Boron Injection Tank - - Browns Ferry Nuclear Plant BFN - Control and Auxiliary Buildings C&A' - CAQR Conditions Adverse to Quality Report - Component Cooling Water System CCS - g O CCP Centrifugal Charging Pump - A CCTS - - Corporate Commitment Tracking System - p CEG Contract Engineering Group - CFR - Code of Federal Regulations , b COPS - Cold Overpressure Protection System CS Containment Spray - Critical Structures, Systems and Components CSSC - Chemical and Volume Control System 'CVCS - , CVI Containment Ventilation Isolation -
. _ _ _ _ _ _ _ _ _ _ _ - -........ ( y g;Q.
g,;4. t
Direct Current DC - DG- ' -Design Change Notice DCN.
- Diesel Generator - Division:of Nuclear Engineering DNE - Engineering Change Notice-ECN
- -
Emergency Core Cooling System ECCS - Emergency Diesel Generator . EDG - El- -Emergency Instructions - ENS Emergency Notification System - _ Emergency Operating Procedure E0P - Emergency Operating Instruction EO - Essential Raw Cooling Water ERCW - ESF Engineered Safety Feature - Flow Control Valve FCV - FSAR Final. Safety Analysis Report - General _ Design Criteria GDC - General _0perating Instruction GOI- - Generic Letter GL' - HVAC Heating Ventilation and Air Conditioning - Hand-operated Indicating Controller HIC - H0 Hold Order - Health Physics HP
- ICF.
. Instruction Change Form IDI Independent Design Inspection -
- IN NRC Information Notice
- IFI.
Inspector Followup Item - IM Instru. ment Maintenance - Instrument Maintenance Instruction IMI ' IR
Inspection Report
- KVA Kilovolt-Amp - Kilowatt KW - Kilovolt 101 - Licensee Event Report LER - LC0 Limiting Condition for Operation - LIV - Licensee Identified Violation -LOCA - Loss of Conlant Accident Main Control Room MCR - MI Maintenance Instruction - MR Maintenance Report - MSIV Mair Steam Isolation Valve - NRC Bulletin .NB - NE - ' Nuclear Engineering NEP Nuclear Engineering Procedure - Notice of Violation NOV. - Nuclear Quality Assurance Manual NQAM - NRC Nuclear Regulatory Commission - OSLA Operations Section Letter - Administrative - ~OSLT Operations Section Letter - Training - OSP - Office of Special Projects PLS - Precautions, Limitations, and Setpoints ,
. -
, -.a0 ' 2S _ . Preventive Maintenance PM - Parts Per Million PPM - Post Modification Test PMT - Plant Operations Review Committee PORC - Plant Operation Review Staff PORS - Problem Reporting Document PRD - Potentially Reportable Occurrence PRO - Pounds per Square Inch Pressure PSI - Quality Assurance QA - Quality Control QC - QRB - Qualification Review Board Radiation Control Area RCA - Reactor Cociant Drain Tank RCDT - Reactor Coolant Pump RCP - Reactor Coolant System RCS - Regulatory Guide RG. - Residuhl Heat Removal RHR - RM Radiation Monitor - Reactor Opert. tor RO - Rod Pesition Indication RPI - Revolutions Per Mirute RPM - Resistivity Temperature Device Detector RTD - RWP Radiation Wo"k Pertit - , Refueling Wcter U.orage lar.k PWST - SAR Safety Analys s Report - Safety Evaluation Report SER - SG Steam Generator - Surveillance Instruction $1 - Special Maintenance Instruction SMI - System Operating Instructions 302 - Shift Operating Supervisor SOS - Sequoyah Engineering Project Procedure SQEP - Sequoyah Standard Practice Maintenance SQM - Seismic Qualification Review Team SQRT - Surveillance Requirements SR - Senior Reactor Operator SRO - SSOMI - Safety Systems Outage Modification Inspection Safety System Quality Evaluation SSQE - Solid State Protection System SSPS - Shift Technical Advisor STA - STI Special Test Instruction - Temporary Alteration Control Form TACF - Average Reactor Coolant Temperature TAVE - TDAFW - Turbine Driven Auxiliary Feedwater Technical Instruction TI - Reference Temperature TREF - TROI - Tracking Open Items Technical Specifications TS - . Tennessee Valley Authority TVA - Upper Head Injection UHI - . _.. _ _. _.. _
l' O en;*e4 .. s
- ,
i Unit Operator
- Unresolved Item URI - Unreviewed Safety Question "-- USQ - Unreviewed Safety Question Determination USQD - Volts Direct Current VDC - Volts Alternating Current VAC -- Work Control Group WCG - Work Plan LWP - Work Request WR - e . t
i ' o - -
I }}