IR 05000336/1996201
| ML20135F450 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 09/30/1996 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML20135F429 | List: |
| References | |
| 50-336-96-201, 50-423-96-201, NUDOCS 9612130066 | |
| Download: ML20135F450 (105) | |
Text
.. _ _ . _ - - - - - . . _ - _ - - - . - - - . -
- 1
.
i ;
'
.
l t l
%, Spec.ia lInspect. ion of Engineering
! ', and Licensing Activities at '
- t l .q}B REGy, l M LLSTONE x
NUELEAR v
'
1 ; Pp ER ST T dN l ;
k <,n .O
-
.
! T : 1, i O
>
r 4 . ,
.
l
.
>
,
-
@
a,p wrVg,f:g D g ;td my
-
e ca
= !
.
'
Y '
,
diff 6
) North}dist Nuclear nergy C$g mpany :
- %e& g -
l U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation ]
t
,
,
'
September 1996 Enclosure 2
- eA"288 ne 2 8?"
CORRESPONDENCE PDR
. . _ _ _ . . _ . - _ . . . . _ _ _ . _ _
i l
\
,
-
U.S. NUCLEAR REGULATORY COMMISSION I 0FFICE OF NUCLEAR REACTOR REGULATION Docket Nos.: 50-336 and 50-423
, License Nos.: DPR-65 and NPF-49
-
Report Nos.: 96-201 and 96-201 Licensee: Northeast Nuclear Energy Company Facility: Millstone Nuclear Power Station, Units 2 and 3
-
Dates: March 11-29, 1996 and May 13-22, 1996 Inspection Team: S. Alexander, Equipment Qualification
- and Test Engineer, NRR I. Barnes, Technical Assistant, Region IV G. Cha, Parameter, Inc.
C. Crane, Parameter, Inc.
J. Gavula, Reactor Inspector, Region III J. Hall, Senior Project Manager, NRR J. Heller, Senior Resident Inspector, Region III K. Johnston, Senior Resident Inspector, Region IV l T. Koshy, Senior Reactor Systems Engineer, NRR !
R. Latta, Senior Operations Engineer, NRR !
J. Macdonald, Senior Resident Inspector, Region I G. Morris, Reactor Inspector, Region 1 J. Nakoski, Operations Engineer, NRR W. Reckley, Senior Program Manager, NRR S. Rosenberg, Reliability and Risk Analyst, NRR J. Shackelford, Reliability and Risk Analyst, NRR D. Trimble, Project Manager, NRR Resident Inspector *: R. Arrighi, Resident Inspector, Region I Team Leader: Loren R. Plisco, Chief Operating Reactor and Construction Inspection Programs Section Inspection Program Branch Division of Inspection and Support Programs Office of Nuclear Reactor Regulation Team Manager: Martin J. Virgilio, Deputy Director Division of Safety Systems Analysis Office of Nuclear Reactor Regulation s
The MP3 Resident Inspector provided inputs for Sections 2.1 and 3.3 of the report.
.
SUMMARY
- Millstone Nuclear Power Station i Inspection Report 50-336/96-201; 50-423/96-201 i.
j On March 11-29 and May 13-22, 1996, a special inspection team from the U.S.
Nuclear Regulatory Commission (NRC), Office of Nuclear Reactor Regulation
,. (NRR), assessed the engineering and licensing activities at Millstone Nuclear j Power Station. The special inspection team focused on the licensee's j processes used to identify, evaluate, and resolve technical issues. The
~
- team's. review focused on the auxiliary feedwater (AFW) system, service water
! (SW) system, and emergency power systems for Millstone Unit 3 (MP3). Selected l
technical issues were also reviewed at Millstone Unit 2 (MP2).
- The team identified programmatic weaknesses and apparent violations of NRC's j regulatory requirements in the following categories: licensing- and design-
'
bases documentation; translation of design-bases requirements to procedures ,
, and practices; problem identification and corrective _ action; engineering; and l la. material safety classification. ]
Licensina/Desian-Bases Documentation ]
i The team found a number of errors in the MP3 Updated Final Safety Analysis l
Report (UFSAR). Among these errors were operating, surveillance, and .
- maintenance practices or procedures that were inconsistent with the !
i descriptions in the UFSAR. The team also found installed equipment or actual 1
'
i plant configurations that differed from the UFSAR descriptions and noted
! inconsistencies between the design criteria described in the UFSAR and other
! design documents. Although these errors did not directly impact safe plant operation, in several cases, the licensee had to extensively evaluatr
'
]
'
- issue to verify that the UFSAR was in error and that the actual plant configuration was acceptable. In at least one case, the licensee's planned corrective actions in response to the team's findings included changes to the
'
! plant configuration. These errors reflect a programmatic weakness in the a
'
licensee's process for maintaining the accuracy and consistency of infomation in the UFSAR, and also challenge the licensee's ability to maintain design 1
'
j control.
j i fh.
In general, the team concluded that the licensee's safety evaluations were ;
l prepared in accordance with 10 CFR 50.59 and adequately supported the i i determinations that the subject changes did not involve unreviewed safety
] questions (USQs). However, the team found several examples of an inadequate l i safety evaluation. In one case, because of an inadequate safety evaluation i regarding isolation of the MP3 turbine-driven AFW discharge piping, the i licensee failed to identify necessary changes to the Technical Specifications
, (TSs), resulting in plant operation with inoperable equipment. In a second
- case, a safety evaluation rega'rding MP2 hydrogen monitors did not adequately evaluate the design bases and did not assess the possibility of a malfunction
- a of a different type than previously evaluated. A third safety evaluation regarding MP3 SW booster pump start logic did not address the deletion of an
'
- automatic design feature, or the substitution of a manual action for a second
automatic design feature, and no evaluation was performed when the manual
!
> 1
!
L. _-- _ _
.
action was subsequently removed from a procedure. These issues are significant in that, in each case, the licensee attempted to resolve a design deficiency through temporary modifications or administrative controls, but failed to adequately evaluate the impact of the proposed changes under 10 CFR 50.59. The team also found a case in which a safety evaluation was not ,
performed as required by 10 CFR 50.59 to evaluate changes in the design, testing, and maintenance of si.ation blackout (SBO) components as described in the UFSAR. ,
The team ' concluded that insufficient review and verification of the Design Basis Documentation Packages (DBDPs) were performed for them to be used as controlled design documents. The team found instances of inadequate or untimely resolution of DBDP discrepancies. The team also concluded that the licensee lacked the process controls necessary to ensure that the DBDPs are properly revised to reflect all changes in design information. As a result of these weaknesses, the team concluded that reliance upon the information in the DBDPs as the bases for design changes could result in design errors. The team found discrepancies in the procurement specifications, DBDPs, and other design-bases documents for SB0 equipment; those documents were inconsistent with the actual equipment installed in the plant. The team also found a weakness in the licensee's document control process, in that technical evaluations referenced in TS amendment requests were not controlled as quality documents.
Translation of Desian-Bases Reauirements to Procedures and Practices The team concluded that the licensee demonstrated a weak understanding of the ,
original design-bases requirements for the systems reviewed during this
'
inspection. More significantly, however, the team concluded that upon ;
identification of a given design deficiency, the licensee opted for '
resolutions that were technically inadequate and, in many cases, placed t
'
additional burden on the plant staff to perform off-normal compensatory actions during potential transients and accidents when human performance demands would already be at elevated levels. Further, it was not apparent i that the licensee had attempted to quantify or evaluate the cumulative effect of these compensatory actions to ensure that the operation and response ;
capability of the given units remained within the original design and i licensing bases as described by TSs and the UFSAR. WithintheboundsofthisQ :
conclusion, the team identified several significant instances in which 4 [
'
licensee management did not project strong standards of performance expectations, critical independent oversight, comprehensive safety verification, or meaningful self-assessment. ;
Specifically, a temporary modification to the seismic restraint of the MP2 reactor building closed cooling water surge tank was installed with numerous !
discrepancies from the approved design. Team reviews indicated that no j management or engineering walkdowns or reviews of the modification were i performed to verify the adequacy or conformance of the installation. None of !
the discrepancies identified by the team had been documented or evaluated by 8
!
the licensee nor had the design description been reconciled with the as-built I configuration. ,
.
_- . - .- ---_ ---- . . - - - . - - - - - - - - - - - .
I
1 i Additionally, the team concluded that the licensee failed to either promptly or adequately evaluate and resolve several design deficiencies that had i existed since original construction that introduced common-mode failure i potential to safety-related systems. These systems were required by the j- . design bases to be independent from single-failure vulnerabilities. For example, a single-failure vulnerability in the power supply design that would
render the MP2 post-accident hydrogen monitoring system inoperable was j. addressed by procedural controls that would require operators to install
- jumpers during the course of accident response to restore power to the system valves. In each of these instances the licensee did not comprehensively address the design standards and codes described in the UFSAR during evaluation of these deficiencies.
The team also identified several instances in which information in a vendor i technical manual (VTM) had not been properly incorporated into station
- procedures. Specifically, the team identified that shipping caps remained l installed in the spare conduit ports of numerous Rosemount instrument
- transmitters. Ultimately, the licensee found that 106 transmitters installed i in MP3, and 35 transmitters installed in MP2, still had shipping caps in the
- spare conduit ports. The team determined that the work orders that installed the transmitters did not contain the vendor's installation instructions, which
- specified the replacement of shipping caps with permanent plugs. The absence
,
of plugs may allow the intrusion of foreign material, as well as ambient
moisture, inc.reasing the potential for transmitter malfunction or failure over j the life of the instrument.
'
Additionally, the VTM for the MP3 service water intake structure watertight doors contained specific direction for the periodic replacement of specific door components regardless of visual appearance. The VTM also contained l detailed inspection criteria for door components. Notwithstanding, station i procedures lacked component replacement criteria or detailed inspection j criteria. Further, when an operator documented a concern about door i performance noted during a routine tour, the licensee resolved the ACR by finding the existing preventive maintenance inspection adequate without l consulting the VTM.
The team also found that work orders that had been prepared for the repair of MP3 service water system backwash strainer valves had no consistent vendor-
recommended torque values for valve body-to-bonnet bolts. Further, when the ,
i team reviewed previous work orders, it found similar discrepancies in torque i
values. The team also noted that the previous maintenance activities on these
,
valves did not include post-maintenance testing to check for continued seat
- leakage or to initiate additional work orders to address degraded conditions l encountered during the work efforts.
Most significantly, however, t,he licensee failed to consider VTM information i in the design application of angle-type SOVs as containment isolation valves !
for the MP3 TDAFW pump discharge piping containment penetrations. The VTM had
- f , specifically cautioned that the S0Vs were " unidirectional" and would be
- incapable of remaining properly seated against minimal backpressure.
,
Notwithstanding, the licensee installed these SOVs in a containment isolation
function, in which high backpressure should have been a critical design ;
4 i
3 !
!
.
,- y- -
, e --...n- ,-- , , - , - , - - - - - - - - . , - -
_ _ _ _. _ _ . . _ . _ . . . . __ _ _ _ _ _ _ - - _ _ _ _ _ . _ . _ . . _ _ _ . ._
(
- consideration. Lacking adequate design controls and without consideration of the VTM information, the SOVs were inoperable since initial installation until this design issue was identified on March 30, 1996.
'
The team also noted instances in which the licensee did not fully resolve ,
issues that required a TS amendment. Specifically, the licensee had ;
identified an unusable volume of water within the condensate storage tank that was assumed to be available in applicable TS limiting conditions for , i operation. However, a TS amendment request that would have reconciled this ;
discrepancy was submitted to the NRC, but was later withdrawn without the implementation of any onsite interim compensatory actions or development of a revised TS change request. Additionally, the licensee did not comprehensively revise procedures affected by a TS amendment that authorized extending routine ,
AFW system testing from monthly to quarterly. Specifically, the licensee :
failed to address the requirement of an AFW pump vendor regarding the periodic j lubrication of the pumps when in standby service conditions. The lack of !
periodic lubrication had the potential to result in bearing failure upon j automatic or manual startup under certain operational conditions. l l
Overall, the team concluded that taken collectively, these concerns reflected )
a lack of understanding of and respect for the preservation of the design and j licensing bases for the given units. The team was particularly concerned that '
in many of the instances above, the licensee had the opportunity to either )
identify, or more promptly and comprehensively achieve, issue resolution. j However, many of the initial licensee actions were narrowly focused, lacked ' '
design bases technical evaluation, failed to consider vendor information, and were interim in nature. Further, the team was concerned with the lack of critical self-assessment and oversight within the management structure that could have identified these issues sooner. The team was also concerned about the effectiveness of the independent multi-discipline review bodies who are responsible comprehensive assessment of these issues to ensure that design and licensing bases are maintained.
Problem Identification and Corrective Action The team found several instances in which the licensee failed to identify existing degraded or nonconforming conditions or other deficiencies. Concerns involving the adequacy of the environmental enclosures for certain MP2 safety-related MCCs first arose in 1992. These and several other issues raised subsequently by the licensee's staff were not resolved at the conclusion of this inspection. Further, the team observed that the licensee's formal problem identification and corrective actions processes were not used to address these deficiencies.
Poor control of temporary installations of scaffolding and I-beams at MP3 created the potential for multiple-train failure of the recirculation spray system (RSS) system, and degraBation of the SW booster pump pedestal resulted
~ in the pump being declared inoperable. These deficiencies had existed for several years and were not identified by the licensee. An inadequate
'
temporary modification to the MP3 SW booster pump initiation circuitry went undetected, despite numerous reviews and analyses during the 6 years the modification was in place.
4 l l
__ _ _
The team found other instances where the licensee had a previous indication of a problem or condition, but they did not effectively identify the full scope of the concern and did not implement adequate corrective actions. A nonsafety-related battery at MP3 exhibited a history of marginal performance,
. yet the licensee did not recognize the need for corrective action before questioning by the team. The licensee failed to prevent the recurrence of a May 1990 event in which the MP3 reactor plant closed cooling water (RPCCW)
. system was operated above the 115 'F limit specified in operating procedures and the UFSAR. The team found that the licensee had previously identified concerns'with protective relay setting criteria, but had not performed a comprehensive evaluation of the discrepancies. Also, known deficiencies in the control of electrical drawings have not been corrected.
The team found problems in the licensee's system to track corrective actions.
In one case, the licensee failed to implement commitments for corrective actions to ensure that all of the dual-function containment isolation valves in MP2 were identified and properly tested. A subsequent adverse condition report (ACR) to correct this process failure was also " lost" and the licensee again failed to take the necessary corrective actions. In another case, an ACR documented the licensee's inability to track the status of 56 incomplete ACR-related assignments that were reported as " lost" due to inadequacies -in the licensee's trach ng system, which erroneously indicated a completed assignment status. All corrective action assignments in response to a third-party assessment on the effectiveness of the quality assessment process had been closed. However, the team found that many of these items had been inappropriately closed on the bases of verbal understandings, anticipated actions, pending reorganizations, or deferred actions. This practice resulted in an inaccurate status of corrective actions. The team also determined that 1 the licensee frequently failed to follow the procedural guidance for the-resolution of potentially significant conditions adverse to quality, in that several of the most significant ACRs have remained unresolved well in excess of the duration specified in the licensee's procedures.
The team found weaknesses in the licensee's oversight of the nonconformance report (NCR) process. Despite the fact that program deficiencies in the'NCR process were previously identified in Quality and Assessment Services (QAS)
audits conducted in 1992 and 1994 and in an NRC Inspection Report, the team determined that corrective actions had not been taken. A significant number of NCRs remain open, including some dating back to 1988. The team concluded that the licensee's NCR process lacked adequate controls to ensure the prompt resolution of nonconforming conditions.
The team found that quality assurance audits and third-party assessments were 9enerally effective in identifying programmatic weaknesses. However, management's responses to the findings and recommendations from these reviews were often inadequate. The tegm concluded that the corrective actions implemented to address the concerns identified in the QAS audit of licensing
,
and the third-party assessment of the effectiveness of the quality assessment process were inadequate. The team concluded that the licensee failed to implement prompt and effective corrective actions in response to SB0 audit
,
deficiencies documented in a third-party evaluation for all three Millstone paits.
_ _ _. _ _
. _ _ _ _ _ _ _ _ _ . - _ . _ _ - . . _ _ . _ _ . _ .- _._. . _ _ . . _
l
i i
On the basis of these findings, the team concluded that the licensee has l
- failed to establish an effective corrective action program for the Millstone
- Station. The team's review revealed weaknesses in the ability to identify I plant problems; delayed or inadequate corrective actions for known deficiencies; problems in the tracking of corrective actions; weaknesses in
'
.
the NCR process; and generally inadequate management response to quality ;
,
assurance audits and third-party assessments.
'
- Enaineerina ;
a :
The team found several engineering deficiencies associated with the conduct of design modifications, and concluded that the engineering staff had failed to I use appropriate rigor, thoroughness, and attention to detail. Among these ;
~ deficiencies were technical errors and omissions, nonconservative assumptions, !
and inadequate verification of all applicable design-bases information. The l team further concluded that the noted deficiencies were both indicative of i significant weaknesses in the methodology and rigor used for conduct of design verifications, and pointed to ineffective current processes (such as independent reviews, supervisory reviews, and reviews by oversight committees)
that are used to ensure appropriate design engineering performance. The lack 1 of rigor noted with respect to consideration of all applicable design-bases information during the conduct of modifications was considered significant )
because of its potential for creating a progressive loss of the design bases. I l
The team found that the licensee had addressed several design-bases issues by l the use of compensatory administrative controls or temporary modifications, i rather than restoring the affected system to its original design and licensing bases in a timely manner. One concern pertained to the ability of the MP3 SW booster pump discharge valves to meet 10 CFR Part 50, Appendix R, requirements. This concern was dispositioned by changing the system configuration, revising procedures, and installing a jumper. However, the procedure changes were later removed and the jumper disabled a necessary automatic start feature of the pumps. In another instance, an identified concern about the ability of the MP2 post-accident hydrogen monitor isolation valves to open, if.a single bus failed, was dispositioned by revising a procedure to direct operators to install temporary jumpers following an accident. This configuration violated the single-failure criterion and placed the hydrogen monitoring system design outside its design bases. A third example involved the recurring air binding of the MP3 SW booster pumps. In each instance, not only did the fundamental design issue remain uncorrected, but additional burdens were ~placed on the operators to compensate for the design flaw.
Material Safety Classification The team ascertained from review of the root cause evaluation for ACR 02621 that incorrect material, equipment, and parts list (MEPL) determinations were made to support changes in the safety classification of components in the Millstone units. The team concluded that these errors resulted from lack of
'
effective licensee oversight of the vendor performing the MEPL determinations.
.
--_-_----_--____O
!
l This problem was exacerbated by licensee management's authorization to use a licensee review process for safety classification determinations which did not involve licensee engineering staff who were familiar with site-specific design bases and licensing commitments. The team additionally concluded that
. weaknesses in engineering programmatic requirements including the procedures j and guidance for dispositioning potential nonconforming material, coupled with a lack of technical rigor, thoroughness, and attention to detail in the design
. process, contributed to these errors.
.
.
{}
,
.
1.0 Introduction On March 11-29, April 15-26, and May 13-22, 1996, a special inspection team from the U.S. Nuclear Regulatory Commission (NRC), Office of Nuclear Reactor Regulation (NRR), assessed the engineering and licensing activities at ,
Millstone Nuclear Power Station and Haddam Neck Station. This repcrt l describes the results of the inspection activities at MP2 and MP3.
1.1 Backaround The NRC has been concerned with the overall safety performance at Millstone Nuclear Power Station during the past 5 years. Although the NRC has observed improvements in some areas, performance problems have persisted and several events increased NRC concern about the licensee's safety decisionmaking process. The areas of concern included untimely resolution of design deficiencies, facility modifications, and process changes outside the licensed ,
design bases, and the inappropriate use of informal control processes for l handling engineering deficiencies. Of more recent concern, Millstone had !
sometimes failed to comply with safety-related aspects of its UFSAR and NRC ;
requirements.
On December 13, 1995, the NRC sent a letter to Northeast Utilities (NU),
asking it to describe actions taken to ensure that future operations of Millstone Unit 1 (MP1) would be conducted in accordance with the terms and conditions of the plant's operating license and UFSAR, as well as the Commission's regulations. The NRC also sent similar letters to NU for MP2, MP3, and Haddam Neck on March 7, 1996. On April 4, 1996, the NRC sent another letter asking NU to provide additional information describing the actions taken to address design and configuration control deficiencies.
In January 1996, NRC senior managers met to evaluate the nuclear safety performance of operating reactors. At that meeting, the NRC managers designated Millstone Nuclear Power Station as a Category 2 plant. Plants in this category have been identified as having weaknesses that warrant increased NRC attention until the licensee demonstrates a period of improved performance. Accordingly, senior NRC management decided to conduct a special l
inspection at Millstone Station to evaluate the engineering and licensing activities. In particular, that inspection would emphasize methods and processes that NU has employed to handle degraded and nonconforming plant conditions. On February 12, 1996, the NRC sent a letter to NU stating that the NRC had established a special inspection team to evaluate engineering and licensing activities in support of MP1 and MP2.
On February 22,199ti, an NU Event Response Team (ERT) performed a root cause analysis of MP1 UFSAR inaccuracies which concluded that the potential existed for configuration management conditions similar to those at MP1 to also be present at Haddam Neck and at the other Millstone units. The ERT documented its conclusions in a report on February 22, 1996; that report is commonly '
referred to as ACR 7007. On the basis of its review of the root cause analysis, NRC senior management concluded it was necessary to expand the scope g of the special inspection to include Haddam Neck and MP3, because of the .
. _ ._. . . _
.
.
i possible applicability of the program and process concerns to the engineering and licensing activities at those facilities.
1.2 Scope of Insoection
.
The purpose of the NRC's special inspection was to evaluate the engineering and licensing activities at MP2 and MP3, with particular emphasis on the
. methods and processes that the licensee employed at Millstone to bandle
, degraded and nonconforming plant conditions. The special inspection team
, reviewed ~ samples of engineering documents such as design-bases calculations, design change records, NCRs, ACRs, and safety evaluations (SEs). The team also reviewed audits and self-assessment activities for engineering and licensing activities. The team observed plant activities and conducted employee interviews, system walkdowns, and documentation reviews. In preparing for and conducting the inspection, the team reviewed selected issues from the past 2 years. The team focused its inspection on the licensee's
, processes that identify and resolve deficient conditions and ensure compliance with NRC requirements, as well as on the licensee's oversight activities for these processes. Although the inspection reviewed activities at both MP2 and MP3, the team placed its primary focus on MP3.
The team conducted a " vertical slice" review of selected MP3 safety systems, including the AFW system, the SW system, and emergency power systems. The
, team also reviewed the licensee's design-bases documents, the DBDPs for MP2 and MP3, which summarize and cross-reference available design-basis information for selectad systems.
2.0 Licensina/Desian-Bases Documentati;n
,
The team reviewed licensing- and design-bases information for the systems and issues selected for inspection, in order to assess the accuracy and
'
'
completeness of the documentation and any potential impact of that information on safe plant operation. As part of the review, the team compared the UFSARs j
for MP2 and MP3 to other licensing- and design-bases information and to the -
as-built configuration of the selected systems.
'
The team also reviewed selected modification packages and UFSAR changes to assess the licensee's compliance with 10 CFR 50.59. Selected safety
'
evaluations for changes related to the subject systems were also reviewed.
The team reviewed several licensing commitments related to the subject systems to verify that they were being satisfied.
To assess the licensee's maintenance of design-bases information, the team reviewed the procedures for the development and maintenance of the DBDPs. The team also reviewed the content of selected DBDPs for both MP2 and MP3.
'
2.1 UFSAR Maintenance (MP3)
'
Nuclear Group Procedure (NGP)-4.03, " Changes and Updates to Final Safety Analysis Reports for Operating Nuclear Power Plants," is the licensee's primary procedure to ensure that the UFSARs are properly maintained. The licensee had revised the procedure to improve the timeliness of responsible
- - - - .- . . - . . - . - . . - - - . - .. - - _-- . _ . --.
,
!
organizations in updating the UFSAR as well as to improve the quality of .
resolution of UFSAR deficiencies. Despite these recent changes, the team !
notd the following instances in which the MP3 UFSAR was inconsistent with !
other licensing- and design-bases documents, procedures, operating practices, !
or the as-built plant configuration: .
l L
(1) MP3 UFSAR Section 9.4.8.1, " Circulating and Service Water Pumphouse Ventilation System," does not accurately describe the operation of the .
SW pumphouse ventilation system in the summer and winter modes. The SW pumphouse is cooled by air drawn through an intake duct by a safety- l related exhaust fan. Downstream of the exhaust fan, in the exhaust duct in the SW pump rooms, is an access door, which is followed by L volume damper. Section 9.4.8.1.2 states: ;
"Each exhaust fan maintains a 100 percent exhaust air flow of 8200 cfm i during the summer, and a circulating air flow with a net exhaust of 3100 cfm during the winter by manually modulating a volume damper located on ;
'
the fan discharge, and by closing or opening the damper access door to ;
provide air circulation."
)
l According to the operating procedures, the licensee keeps the access '
door open in both summer and winter, contrary to the UFSAR description.
Additionally, while the exhaust flows during the summer and winter months were stated to be at 8200 cfm and 3100 cfm, respectively, the calculated total fan flow is 16,500 cfm and 15,500 cfe, respectively.
Therefore, the total air flow is significantly higher than what is implied in the UFSAR (i.e.,100 percent exhaust air flow of 8200 cfm implies that total flow is 8200 cfm.)
The team reviewed licensee engineering documentation that demonstrated that-the existing operating instructions were consistent with the !
original 1985 system design bases. In response to the team's questions, the licensee initiated an ACR to document the inaccuracy, and Final '
Safety Analysis Report Change Request (FSARCR) 96-MP3-14 was prepared to correct the discrepancy in the UFSAR.
(2) MP3 UFSAR Section 8.3.1.1.6, " Alternate AC System Description," states i that the alternate alternating current (AAC) system switchgear enclosure contains a battery rack, a 60-cell battery, and a battery charger, which supplies 125 ampere-hours at 125 Vdc nominal. The battery ampere-hour rating identified in the UFSAR is consistent with the ampere-hour rating identified in Specification SP-EE-317, " Specification for Diesel Generator Station Blackout, Revision 1, September 19, 1991," which is
'
based on an American Telephone and Telegraph Company model 4VR-125E battery. However, during a plant walkdown on May 14, 1996, the team observed that the install with a nameplate rating fo.ed battery is a GNB 80 ampere-hours. type also The team 6-MSB-2010 reviewed an battery !
MKW Power Systems memorandum, dated July 22, 1992, that contained a *
discharge rate table which listed an 80-ampere-hour rating for that battery type. The AAC system was installed and tested in August 1993.
However, when the UFSAR was updated by the licensee to include the AAC ~
system description, the information provided did not reflect the as-
_ - . - - _ _ _ . - _, . ,-. . ~ + , , _ , ,,-,..g ___ g.w g . - gr+ - --
installed battery configuration. The licensee prepared ACR 12868 on May 16, 1996, to resolve this discrepancy.
(3) MP3 UFSAR Section 10.4.9.2, "AFW System - System Description," specifies
. a minimum recirculation flow of 45 gpm for the two motor-driven auxiliary feedwater (MDAFW) pumps, and a minimum recirculation flow of 90 gpm for the TDAFW pump. The team determined that the quarterly
. surveillance procedures (SPs) for the MDAFW pumps and the TDAFW pump included recirculation flow acceptance criteria that were less than the minimum flow specified in the UFSAR. SPs 3622.1 and 3622.2, "MDAFW Pump 3FWA* PIA &B Operational Readiness Tests," specify a recirculation flow acceptance criterion of 43.2 to 52.8 gpm. SP 3622.3, "TDAFW Pump 3FWA*P2 Operational Readiness Tests," specifies a recirculation flow acceptance criterion of 87.3 to 106.7 gpm.
The SP acceptance criteria were established when each pump was initially
"baselined" approximately 8 years ago. The range was established on the basis on the bases of the formula stated in Section XI of the American Society of Mechanical Engineers (ASME) Code. The licensee failed to question the recirculation flow acceptance criteria during periodic reviews, during subsequent revisions to the SPs or UFSAR, or during reviews of the data from completed surveillances.
In response to the team's questions, the licensee performed a limited data review and found no instances of the measured recirculation flow being below the minimum specified in the UFSAR. The licensee also documented this concern in an unresolved item report, dated May 16, 1996. The licensee stated it plans to revise the MDAFW and TDAFW recirculation flow acceptance criteria and review other SPs to determine if any similar cases exist.
The team also noted that UFSAR Section 10.4.9.4, " Inspection and Testing Requirements," describes that AFW surveillance tests are performed monthly. Amendment No. 100, dated January 27, 1995, revised the TS surveillance test frequency for the AFW pumps from monthly to quarterly; however, the licensee failed to initiate an FSARCR to reflect this change until March 1996, contrary to Procedure NGP 4.03.
(4) MP3 UFSAR Section 8.3.1.1.4.2.e, " Electrical System Protection - Motor Feeder, Emergency Switchgear," identifies protective relay settings for electrical equipment, such as panelboards, generators, transformers, 6.9-kV and 4.16-kV buses, 480-V load centers, and motor control centers (MCCs).
The team determined that the design criteria used to calculate the protective relay settings in Northeast Utilities Service Co. (NUSCO)
Specification SP-EE-321,' Revision 0 ("NUSCO Control of Electrical Setpoint Data Base," Volumes 1, 2 and 3, January 22,1992), for the
'
4.16-kV safety-related motors (the reactor plant component cooling water pump motors, the quench spray system pump motor, and the safety injection pump motors) deviate from the setting criteria presented in the UFSAR and from the setting criteria presented in Stone & Webster
'
.. -.
-. _ _
document NERM-46 ("4.16kV and 6.9kV Station Service Protection Philosophy," January 23, 1978). Specifically, UFSAR Section (
8.3.1.1.4.2.e states that tne long-time inverse overcurrent unit is set !
to alam for overload condition at 125-percent of motor full-load current; however, the calculation and setting sheets in Specification '
SP-EE-321 and NERM-46 assume 115-percent of full load current. Also, UFSAR Section 8.3.1.1.4.2.e states that the standard instantaneous overcurrent unit for fault tripping is set at 175-percent of motor *
locked-rotor current; however, the calculation and setting sheets in Spe'cification SP-EE-321 assume 200-percent of motor locked-rotor current, and NERM-46 assumes 190-percent of motor locked-rotor current.
In response to the team's questions, the licensee performed an operability assessment, which concluded that, although certain relays have settings which are inconsistent with the NERM-46 criteria and the UFSAR requirements, the current configuration provides adequate protection of equipment and electrical coordination. The licensee also identified the following corrective actions to resolve the setting i deficiencies: (1) revise UFSAR Section 8.3.1.1.4.2 to eliminate discrepancies with respect to the design criteria; (2) revise Specification SP-EE-269, Revision 0, " Electrical Design Criteria," dated June 16, 1988, to modify the design criteria of NERM-45 and NERM-46, and to resolve a number of relay setting discrepancies; (3) incorporate numerous calculation changes in Specification SP-EE-321 to eliminate conflicting information; and (4) reset the long-time inverse overcurrent unit for Quench Spray Pump Motor 3QSS*P3B.
(5) MP3 UFSAR Section 8.3.1.2.4, " Cables and Routing Analysis," and Table 8.3-2, " Cable in Trays," specify the allowable electrical fill for safety-related cable trays. The team identified five safety-related L-service cable trays that had. electrical fill greater than the allowable one-layer depth (one-layer depth equates to 100-percent fill) specified in the UFSAR. The team also identified four safety-related C-service cable trays that had electrical fill greater than 157-percent (the analyzed allowable limit). In addition, UFSAR Table 8.3-2 had not been updated to reflect the 157-percent allowable fill criteria for C-service cable trays'.
The team observed that supporting calculations to determine cable ampacities are based on Insulated Cable Engineers Association (ICEA)
Specification P-54-440, "Ampacities of Cables in Open-top Cable Trays."
However, UFSAR Section 8.3.1.2.4 and Table 8.3-2 incorrectly identified ICEA Specification P-46-426, " Insulated Cable Engineers Association, '
.
Power Cable Ampacities," as the methodology used to determine ampacities. In response, the licensee initiated ACR 10525 and also prepared an analysis that demonstrated that the installed cable configuration for the tr'ays was acceptable. The licensee prepared a i safety evaluation to justify the as-installed deviations in tray fill. *
The licensee also initiated an FSARCR to update UFSAR Table 8.3-2 and Section 8.3.1.2.4 to resolve the discrepancies and to reflect the I approved tray fill conditions for L-service and C-service cable trays.
The licensee stated that the identified discrepancies have ex1sted in *
___ _ _ _ _ _ _ _ _ _ . _ _._ _ . _ _ _ _ _._ _ _ _ _._ .
i I
j the UFSAR since the plant-was built. This issue is discussed further in i Section 3.2.4.
, (6) MP3 UFSAR Table 6.2-65, " Containment Penetration," lists the AFW flow j, control valves as motor-operated valves (MOVs), and also indicates that i the valves fail "as-is." UFSAR Section 6.2.4, " Containment Isolation L System," states that "all air and solenoid-operated containment
. . isolation valves fail in the closed position." The piping and i instrumentation drawings (P& ids) correctly indicate that the valves are i solenoid-operated valves and that they fail open. The licensee l indicated that these discrepancies would be corrected as part of the ACR i closeout of this issue, which is discussed in greater detail in Section
- 3.3 of this report.
l The six deficiencies discussed above represent instances in which the MP3
!- UFSAR was not maintained up to date or did not reflect the actual plant
- configuration or operating practices. As such,.they constitute an apparent
, violation of 10 CFR 50.71(e). (EEI.423/96-201-01)
i l
'
The team also reviewed en FSARCR for MP3 that removed Table 8.3-5, " Battery Duty Cycle," from the UFSAR. Although some of the information contained in the table duplicates material in other sections of the UFSAR, the team considered the removal of this table to be inappropriate because the table was.
the only source of detailed information related to the sequencing of loads onto the safety-related batteries. 10 CFR 50.71(e) specifies the requirements for periodic updates of the Final Safety Analysis Report (FSAR), but does not provids for the removal of information from the FSAR as part of the periodic updates. '10 CFR 50.34(b) requires that the UFSAR include information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analysis of the structures, systems, and components. The description shall be sufficient to permit understanding of the system designs and their relationship to safety evaluations. The team considered that the removal of Table 8.3-5 was a reduction in the level of detail necessary for the understanding of the operation of the safety-related batteries.
2.2 10 CFR 50.59 Process The team reviewed selected evaluations performed to satisfy 10 CFR 50.59 requirements related to licensee-proposed changes to the facility as described in the Millstone UFSARs.
2.2.1 Service Water Booster Pump Bypass Jumper (MP3)
The team reviewed the history of bypass jumper (B/J) 390-20, which affects SW cooling to the motor control center / rod control area (MCC/RCA) of the MP3 auxiliary building. Section 9:2.1 of the MP3 UFSAR, " Service Water System,"
describes the design and operation of the SW system in providing emergency cooling to the MCC/RCA. The MCC/RCA is cooled by air handling units that are supplied by a nonsafety-related chilled water supply and safety-related SW.
SW is provided to the units by the SW booster pumps through a flow path
'
containing normally closed MOVs 130A and 130B. As described in the UFSAR, the
- . . - - - - . . -- ---
- _ - - - - - -
- - - - - - . - .- - -.- - ..-. - ..--. -. ...._. - - - .- .. -. - . - -
!
MOVs would open on high temperature at the air handling unit return ducts or a !
loss-of-power (LOP) signal. The opening of the MOVs provided a SW booster :
pump start signal. i t
The licensee installed B/J 390-20 on May 3,1990, to address several design .
. !'
deficiencies. This temporary modification moved the LOP signal from the MOV
"open" circuit to the booster pump start circuitry, allowing the booster pumps to remain off with the MOVs open.(this issue is discussed further in Sections ,
'
4.1 and 5.3). The team noted that a special instruction included in the ,
original ~B/J documentation was no longer implemented in the licensee's ;
procedures. The special instruction stated, "If a LOP occurs, when restoring i I
power, manually start the booster pumps after resetting the LOP and Station LOP." The special instruction was a compensatory measure for the automatic ;
feature of the original design that the B/J had deleted. The original design
.
ensured that the SW booster pump supply to the MCC/RCA was maintained after a l LOP reset action without reliance on an operator action. However, the B/J l resulted in the need to manually restart the pumps after a LOP reset. The l team determined that when the B/J was installed, an annunciator response :
procedure contained a step which implemented the B/J special instruction. !
This procedure was subsequently revised and the step was deleted. !
l The team also found that the circuits providing an open signal to MOVs 130A and 130B on high temperature in the return ducts were not transferred to the SW booster pump start circuitry. Therefore, the licensee defeated this design i function with the installation of the B/J. In June 1990, Engineering ;
initiated an FSARCR which discussed the return duct high temperature booster i pump start signal. The FSARCR and the technical evaluation for the B/J were !
reviewed by some of the same engineers, but no one recognized that the B/J !
'
defeated that start signal.
.
The licensee performed a technical assessment and safety evaluation to support !
the original installation of B/J 390-20. The B/J and the associated l evaluation were reviewed and approved by the plant operations review committee (PORC) preceding installation and periodically thereafter. However, the !
safety evaluation did not address the basis for the special . instruction or the l bypassing of the return duct high-temperature automatic start function. j
!
The team concluded that the safety evaluation for B/J 390-20 was inadequate j because it did not address the substitution of a manual operator action for an ;
automatic feature (pump start following LOP reset) and the defeat of an automatic actuation (pump start on high temperature in the return duct). !
These automatic features are described in UFSAR Section 9.2.1. Furthermore, i no safety evaluation was performed for the subsequent deletion of the l compensatory manual action specified in B/J 390-20. These items constitute an j apparent violation of 10 CFR 50.59. (EEI 423/96-201-02) ;
2.2.2 Post-LOCA Hydrogen Monitors (MP2)
!
'
The team reviewed ACR 01991, dated October 6, 1995, and Licensee Event Report (LER)95-038, which documented the licensee's determination that the MP2 plant !
configuration was outside the design bases because the containment gaseous and ~
particulate radiation monitoring system, hydrogen monitoring system, and the
- -. . -- -. -- -- - - -
. _ _ _ _ ___ _ . _ _ _ _ _ . _ . _ _ _ _ _ . _ _ _ . _ _ _
i l l
,
post-accident sampling system did not meet the single-failure criterion for l
-
the post-accident monitoring function. Specifically, a postulated loss of one j
- vital 125-Vdc bus would render these systems inoperable because a flow path !
'
could not be established following a loss-of-coolant accident (LOCA) due to j
. . the configuration of the power supply to the containment isolation valves. To >
resolve this issue, the licensee prepared a change to Operating Procedure
. (OP) 2313C, " Containment Post-Incident Hydrogen Control," Revision 18, dated
, January 12, 1996, to allow installation of electrical jumper wires to open the
! appropriate containment isolation valve if the associated vital 125-Vdc bus is l lost during a design-basis event. A more detailed discussion of this issue is
.
l
!
l presented in Sections 3.2 and 5.3 of this report.
i i The hydrogen monitoring system is an engineered safeguards feature (ESF)
system designed to meet the requirements for independence, redundancy, and the i single-failure criterion in accordance with the UFSAR (Sections 6.1, 6.6.1.2,
- and 7.3.1.2.6, and Table 7.5-3), Institute of Electrical and Electronics
- Engineers (IEEE) Standard 279-1971 (" Criteria for Protection Systems for i Nuclear Power Generating Stations"), IEEE Standard 308-1970 (" Criteria for
- Class IE Electrical Systems for Nuclear Power Generating Stations"), and j Regulatory Guide (RG) 1.97, Revision 2, " Instrumentation for Light Water l Cooled Nuclear Power Plants to Assess Plant Environs Conditions During and i Following an Accident," dated December 1980. Similarly, the containment
- gaseous and particulate radiation monitoring system is an ESF system and its i design bases also require independence, redundancy, and compliance with the
- single-failure criterion, as described in UFSAR Section 7.3.2.2.c. The team 1 determined that the licensee's resolution of the problem by requiring the !
- installation of electrical jumpers was contrary to t h design-bases i requirements for independence, redundancy, and compliance with the single-
!
failure criterion. The team also concluded that the safety evaluation for the procedure change, dated October 7, 1995, did not appropriately consider the design bases and did not adequately assess the possibility of a malfunction of
, a different type than previously evaluated, as required by 10 CFR 50.59. The j team believed that the change could have increased the chance of an
inadvertent short-circuit or grounding of the available 125-Vdc bus during an
,
accident when installing jumpers in cabinets with live circuits.
4 ,
l The failure to adequately evaluate the installation of electrical jumpers is
- considered to be an apparent violation of 10 CFR 50.59. (EEI 336/96-201-03)
!
'
- 2.2.3 TDAFW Pump Inoperability (MP3)
i l Plant Information Report (PIR) 3-94-060 "AFW High Energy Line Break (HELB)
- Concerns," dated March 15, 1994, and LER 94-004, "AFW Pipe Restraints
- Inadequate Design Due to Design Error," dated April 14, 1994, documented that
.
the discharge piping from the TDAFW pump was classified as moderate energy
' operation at 100-percent power,' or a portion of the TDAFW pump discharge j 1 piping could be subject to the high-pressure discharge from the MDAFW pumps i i
during startup and shutdown operations, the piping should have been classified i as HELB piping. The team reviewed the licensee's actions in response to PIR
!
'
3-94-060.
i
i
__ ~ . _ - .
.-
- _ , _ _ _ _ _ . ,_ _ , _
.-. -. . -- .- - . - .
The licensee revised procedures to close the TDAFW discharge isolation valves and isolate the injection paths whenever either MDAFW pump was in operation to control steam generator (SG) water level during startup or shutdown. The manual switches for the discharge isolation valves are located in the control room. These valves do not receive an automatic open signal but will fail open .
subsequent to a loss of station power.
Westinghouse analyses NTD-NSRLA-0PL-94-129, dated June 29, 1994, and .
ET-NSL-0PL-I-94-173, dated May 6,1994, evaluated isolation of the TDAFW injection' lines. The analyses acknowledged that closure of the isolation valves would effectively disable the TDAFW pump. The analyses concluded that this practice was acceptable because reactor coolant heat load would be low enough to permit operator action to recover feedwater within 10 minutes if feedwater from the MDAFW pumps was lost.
Safety Evaluation JJC-041894, "MP3 AFW System 3FWA*HV36A/B/C/D Procedure !
Change for Normal Startup, Hot Standby, and Shutdown Evolutions," dated May 10, 1994, acknowledged that the Haddam Neck Technical Specifications (TSs)
contained a provision that permitted the TDAFW pump automatic initiation function to be defeated below 10-percent power. The licensee also stated in the evaluation that MP3 TS 4.7.1.2.1.a.2 requires verification that each AFW control and isolation valve in the flow path is in the fully open position when rated thermal power exceeds 10 percent. On the basis of this surveillance requirement, and believing that the Haddam Neck TSs supported the same interpretation of the MP3 TS for this issue, the licensee found it acceptable to isolate the TDAFW pump injection path below 10-percent power.
The licensee reached this determination without regard for the limiting condition for operation of TS 3.7.1.2 which requires that at least three independent AFW pumps and associated flow paths be operable in Modes 1, 2, and 3.
The licensee failed to recognize the need to revise the MP3 TS, because it failed to adequately assess the procedure change in accordance with 10 CFR 50.59. The corresponding safety evaluation approved the system configuration without identifying the need to revise the applicable TS. 10 CFR 50.59(a)(1)
permits the licensee to make changes to the facility without prior NRC approval, unless the change requires a TS change or involves an unreviewed safety question.
However, on May 10, 1994, the licensee changed the facility operating procedures to permit closure of the TDAFW pump discharge valves whenever the MDAFW pump (s) were used for steam generator water control. This change was made without requesting a revision to the applicable TS and is an apparent violation of 10 CFR 50.59. (EEI 423/96-201-04).
On the basis of these issues, the licensee performed a review of operational data since the decision had been made to maintain the TDAFW isolation valves closed during low power operations or when the MDAFW pumps were in service. ,
This review determined that during several startups and shutdowns, the valves were closed, causing the TDAFW flow path to be inoperable when the reactor was in a mode of operation in which the requirements of TS 3.7.1.2 were applicable. The valves were closed during power operations on June 4,1995.
,
. _ _- _ -. . .- - -. .-. - - - - - - - _- - -
,
!
Additionally, operational mode changes were performed on June 1,1995 (entry into Mode 3), June 3, 1995 (entry into Mode 2), and December 15, 1995 (entry into Mode 2 and Mode 1) with the TDAFW isolation valves closed. Failure to ensure at least three independent AFW pumps and associated flow paths were
. operable with the reactor in either Mode 1, 2, or 3 operations is an apparent violation of TS 3.7.1.2. (EEI 423/96-201-05)
. 2.2.4 TDAFW Pump Automatic Start Feature (MP3)
The team noted that the MP3 UFSAR description of the automatic start features for the TDAFW pump was changed to be consistent with the as-built plant in FSARCR 95-MP3-12. However, a 10 CFR 50.59 evaluation was not performed for this change. The original FSAR, Section 10.4.9.2, "AFW System - System Description," and subsequent revisions had contained statements that the TDAFW pump would automatically start as a result of either of two signals: low level in two of four steam generators or a sensed loss-of-power event. The UFSAR l was subsequently revised to indicate that only the SG low-level signal would 4 automatically start the TDAFW pump. The NRC licensed the facility on the I basis that the plant was constructed as described in the UFSAR and, as such, the changes to the UFSAR are de facto changes to the licensing-bases and are required to be evaluated in accordance with 10 CFR 50.59.
The failure to perform a safety evaluation to determine if a change in the UFSAR description constitutes a USQ is considered an apparent violation of 10 CFR 50.59. (EEI 423/96-201-06)
2.2.5 EDG Room Low-Temperature Alarm (MP3) l The team found that the revision of the emergency diesel generator (EDG) low-temperature room alarm for MP3 was not in accordance with 10 CFR 50.59. The alarm setpoint was changed from 45.*F to 52 *F in order to ensure that the room temperature was maintained above 50 *F, which is the minimum temperature necessary for equipment qualification. The 45 "F setpoint and associated alarm response procedures are discussed in UFSAR Section 9.4.6, " Emergency Generator Enclosure Ventilation System," in relation to maintaining EDG rocker arm lubrication temperatures above minimum requirements. Although the alarm ;
setpoint was revised to a more conservative value, the team considered the change to the facility as described in 'the UFSAR to fall within the scope of 10 CFR 50.59. However, the license did not perform a safety evaluation for this change in accordance with 10 CFR 50.59.
The failure to perform a safety evaluation to determine if the change to the UFSAR involved a USQ is considered an apparent violation of 10 CFR 50.59.
(EEI 423/96-201-07)
2.2.6 Station Blackout Component Design, Testing, and Maintenance (MP3)
MP3 UFSAR Section 8.3.1.1.7, " Alternate AC Design Criteria and Compliance,"
describes the licensee's response to 10 CFR 50.63 by addressing the criteria
'
of Nuclear Utilities Management and Resources Council (NUMARC) 87-00, Appendix
,
B. The team found that the responses to three criteria did not accurately
reflect the as-built configuration of the plant or the licensee's current maintenance and surveillance practices.
The Criterion B3 response indicates that the 4160-V power cables are protected from adverse weather conditions by running the cables almost entirely in .
buried ductbanks, except for a small transition area where the power cables are supported by rigidly mounted cable trays. However, the team found that there was a section of cable that also ran between the ductbanks and the ,
above-grade cable trays, leaving approximately 4 feet on each end of the cable tray exposed to the environment with only the cable jacket for protection.
The Criterion B10 response indicates that every refueling outage, the plant will perform a start and full load test on the SB0 diesel generator (DG). The team observed that a quarterly load test is credited for this response.
However, the quarterly test does not load the diesel generator to either the rated continuous load or the emergency load referred to in the emergency operating procedures (EOPs). The team also found that the licensee was substituting a simulator exercise for the timed start test of Criterion B10.
The Criterion B11 response indicates that the surveillance and maintenance procedures for SB0 equipment are designed and. implemented with due consideration to vendor recomendations, the history of past maintenance practices, and engineering judgment. However, the team observed that the SB0 maintenance program was fragmented and missing important vendor maintenance recommendations for various support equipment. The vendor manual contained recommendations for periodic maintenance of electrical support equipment provided with the SB0 diesel package, including the SB0 battery, battery charger, and uninterruptable power supply. However, contrary to the above response, the licensee had failed to perform any maintenance or surveillance on these components.
The licensee did not perform a safety evaluation to provide a basis for determining that these changes to the SB0 equipment and procedures described in the UFSAR did not involve a USQ. Therefore, these items represent an apparent violation of 10 CFR 50.59. (EEI 423/96-201-08)
2.3 Comitment Trackina The team ~ determined that the NU licensing organization does not currently have a formal regulatory comitment tracking system, although actual work assignments to fulfill comitments are being managed using the Action Item Tracking and Trending System (AITTS). Before establishing the AITTS, the licensee maintained a database entitled COTRAP that recorded incoming and outgoing correspondence. The COTRAP database also listed additional actions to be completed by licensee organizations in association with the correspondence. These items would then be tracked by the licensing organization until the action wits completed. Actual implementation of such comitments, completed actions mentioned in correspondence, and actions included in correspondence not processed by the licensing organization (i.e., '
LERs), were not recorded in the COTRAP database.
.
- - . . . -.. .- - - - - . - - - - - - - - - - - . - - .
!
.
. The licensee has historically used various tracking systems and emphasized the
- assignment of tasks associated with the implementation of specific commitments 4 rather than the tracking and verification of completion of commitments. The
- existing records and management systems are not designed to allow the j. efficient compilation of a complete listing of outstanding commitments.
- Although the licensee has developed a comprehensive system to retrieve all
.
correspondence and reference documents for Millstone and Haddam Neck (the j. Licensing Information Search Tool [ LIST)), it has not been adapted to
- specifically identify or track commitments. The team observed that the LIST i system is not used routinely by the operations or engineering staff, and i procedures for control of design changes, calculations, or other licensee t activities do not specifically call for a search of licensing correspondence.
i The team reviewed a number of licensee commitments and observed, in general, j that the licensee had completed the actions cited in the correspondence as
+
being necessary to correct a deficiency or resolve a licensing issue. l l However, the team noted one instance in which commitments had not been j implemented and that is discussed in Section 4.2.
i j 2.4- Desian-Bases and Licensina Documentation Maintenance i
- The team reviewed the procedures for the development and maintenance of the i licensee's DBDPs. The team also reviewed the content of selected DBDPs
! prepared for MP2 and MP3, supporting documentation for a TS change request,
!. and SB0 engineering documents.
2.4.1 DBDP Program (MP2 and MP3)
f
! In 1991, NU began a program to assemble design-bases documentation for MP2 and
! MP3. Procedure NGP 5.28, " Development, Review, Update and Use of Design Basis
] Documentation Packages," describes the DBDP process, assigns responsibilities, i and provides detailed instructions. A DBDP Writer's Guide contains additional i'
information. The guidance given the DBDP preparers clearly. indicated that the ,
purpose of the DBDP program was to gather design-bases information into one
- reference document, but not to reconstruct the design bases. When the DBDP '
l program discovered missing information, it was not documented for later
,
reconstitution. The program was designed and implemented to identify l conflicting information among existing source documents; any such ,
- discrepancies were noted in a separate section of each DBDP. l
.
i The team discussed the DBDP verification process with MP3 engineering
} personnel. The team noted that the discipline and independent reviews of the
,
'
completed draft DBDPs were limited by resource constraints, as these reviews consisted of spot checks of the information for a given system. The team also
.
noted that little, if any, field verification of the completed DBDPs had been
! performed. The team concluded that insufficient review and verification of
- the DBDPs was performed for thein to be used as controlled design documents.
l As a result of an ongoing audit of document control processes, the licensee j* initiated ACR 8645 on March 20, 1996, which independently determined that the
{ DBDPs were not adequate to be used as sole-source design documents, because
,
there had not been sufficient management controls during their development. !
l
- 19
!
I i
!
. _ ,
. _ . _ . _ _ _ . _ _ _ _ _ _ _ . _ . . _ _ . _ _ _ _ _ _ . _ _ . _ _ _ .
!
This finding was contrary to NGP 5.28, which states that the DBDPs are of i equal quality to the source documents referenced within them and are !
designated as quality-related design documents.
f i
Procedure NGP 5.28 also describes DBDP discrepancy initiation, tracking, and .
handling. As- part of the development of the DBDPs, conflicts and inconsistencies in documentation were recorded in Section 6 of each DBDP.
Discrepancies identified in the licensee's review were documented on . ;
discrepancy evaluation forms (DEFs) and assessed for safety significance, '
reportability, and operability. Justification for each determination was also i documented on the DEF.
Safety-significance screening of discrepancies identified by the licensee ;
during the preparation of the DBDPs appears to have been based on undocumented l engineering judgment, rather than on the guidelines in the DBDP procedure, ;
(NGP 5.28, Section 6.3.2.2). As an example, those guidelines would have considered a discrepancy to be safety significant if it potentially affected I information in the UFSAR; but few discrepancies that referred to the UFSAR l were actually identified as safety significant on the DEFs. The team '
concluded that the licensee did not follow the DRDP procedure in this regard.
The team observed that discrepancies reported in the DBDPs were assigned resolution priorities by the probabilistic risk analysis (PRA) group in the NU corporate offices. Engineering, assigned to resolve discrepancies, apparently gave this work low priority. The MP3 DBDP program identified 139 discrepancies, all of which were scheduled for resolution by April 15, 1996, regardless of the priority assigned by the PRA group. On March 11, 1996, Engineering had closed out only 16 of the 112 discrepancies turned over-to it for resolution.
The team observed that.19 DEFs for the MP2 electrical' distribution system (EDS) DBDP (MP2-EDS) were initiated on September 9, 1993. Six evaluations involving UFSAR questions were assessed on the DEFs as not safety significant, based on undocumented engineering judgment, contrary to the guidelines of NGP 5.28 Section 6.3.2.2, which require written explanation of the basis for determining that a DEF is or is not safety significant. The MP2-EDS DBDP was issued on February 1, 1994, with all 19 discrepancies still open. On August 28, 1995, the licensee extended the original resolution due date from October 1, 1995, to March 1, 1996. On February 29, 1996, Design Engineering issued
j its resolution memorandum which confirmed that the six discrepancies involving !
the UFSAR were errors in the referenced documents, and that the UFSAR was !
accurate as written. l The team's review of the resolutions of the discrepancies for the MP2 EDS DBDP determined that the licensee failed to answer many of the underlying design-bases questions. For example, puestions on component ratings were answered by reference to the as-installed equipment, instead of by describing the basis for the requirement. Also, the response to a discrepancy on the impedance of ,
,
the spare generator step-up transformer referred to the wrong transformer; the ;
response to a discrepancy on the safety-related inverter minimum operating i voltage failed to initiate the corresponding revision to the equipment , l specification; and a non-vital battery main fuse rating discrepancy failed to 20 i
. - _ - . - =. . _. _. . _
i
!
'
identify the need for a coordination review when the fuse was confirmed to be rated for 1200 amps instead of 2000 amps.
The team was informed that NU also began a limited UFSAR verification program
. on the basis of the discrepancies initially identified in the DBDP program.
l The results of this program for the MP2-EDS were reported in November 1993, and identified four discrepancies in the UFSAR. One of the discrepancies
, duplicated a discrepancy already noted, but three items had not been previously documented. The team found that these discrepancies were not i addressed'by the licensee in the February 29, 1996, resolution memorandum for the other deficiencies in the MP2-EDS DBDP, and had not been corrected. As a result of this inspection, the licensee initiated an FSARCR to correct these three additional discrepancies found during the UFSAR verification program.
The team observed that the DBDP group consisted of four individuals and a l Project Engineer with responsibility for maintaining the DBDPs for all four Connecticut plants (MP1, MP2, MP3, and Haddam Neck). Through discussions with members of that group, the team learned that the individual DBDP files for future updates were not well controlled. No formal mechanism existed to !
collect and store revised or updated material for inclusion into the next l revision of the DBDP. The team noted that the Design Control Manual (DCM)
Section 5, " Calculations," had no mechanism to ensure that the related DBDPs would get updated to incorporate the results of new or revised calculations.
The team also noted that the results of the new electrical calculations performed in response to the 1993 Electrical Distribution System Functional l Inspections at MP3 had not been incorporated into the MP3-EDS DBDP. 1 The team observed that although the MP3 DBDP, " Service Water System," was revised in June 1995, no open discrepancies were resolved at that time.
Engineering issued proposed dispositions of the original open discrepancies on i November 16, 1995. The team determined that some of those dispositions did !
not completely resolve the original discrepancies. For example, the response for a discrepancy regarding required EDG cooling flow provided flow rates for .
different percentages of heat exchanger tube plugging without reference to SW l temperature, and different flow rates for two SW temperatures without regard ;
to plugging. Neither response addressed the effects of fouling. j NGP 5.28, " Development, Review, Update and Use of Design Basis Documentation Packages (DBDPs)," Revision 1, dated August 2, 1994, states that the information within the DBDPs shall be considered acceptable for use during Quality Category I design applications and that the DBDPs are designated as quality related design documents. Attachment 8.A to NGP 5.28 states that DBDPs are approved for use as design inputs in engineering activities such as design changes, TS changes, NCRs, operability determinations, and reportability evaluations. In addition, the NU Design Control Manual, Revision 2, dated January 15, 1,996, states that design input source documents include the DBDPs.
'
The team concluded that there was a lack of ownership for the issued DBDPs.
This was exhibited in the team's observations of inadequate review and l* resolution of open discrepancies (DBDPs MP2-EDS and MP3-SWP), untimely resolution of identified discrepancies (MP3), and failure to provide a
!
!
-- . _ - - -- ._ _ . - _ . . .-- .- - - . -
h L
l mechanism to feed revised and updated plant design information into the DBDP l
'
update process (all units). '
QAS audit report, " Document Control," dated April 22, 1996, concluded that the !
DBDP development process did not comply with the requirements of Appendix B to .
l 10 CFR Part 50: that is, the independent reviews were not properly completed and problems continued to exist with control of these documents. Furthermore,
'
.
QAS's review of NGP 5.28 and the DCM indicated that the D8DPs were not being ,
updated through the design change notice (DCN) process (except for a recent j pilot program at MP3), and that contrary to the requirements of NGP 5.28 these documents are not being maintained as quality records. The preliminary audit !
findings were documented in ACR 8645.
l The failure to ensure that adequate design control measures were established ;
for verifying and checking the accuracy of the information in the DSDPs is an apparent violation of 10 CFR Part 50, Appendix B, Criterion III, " Design '
Control." (EEI 336/96-201-09; 423/96-201-09)
i 2.4.2 Lack of Formal Records for Technical Specification Change Reqcest (MP3) l During a review of a recent TS amendment request, dated April 28, 1995, i
" Proposed Revision to Technical Specification Ultimate Heat Sink," the team :
noted that certain " technical evaluations" were referenced in the TS Change i Form to support the requested amendment. Technical evaluations are not stand- '
alone documents within the licensee's document control system and are not defined within its QA program. As such, they were not entered into the licensee's document control system, and when asked to retrieve the referenced technical evaluations, the licensee's only recourse was to obtain a copy from the originating engineer's personal file. l In the TS amendment request, the licensee stated that "an evaluation has been performed that safe shutdown will be achieved and maintained for a loss of offsite power event and a steam generator tube rupture event...with service
,
water temperatures as high as 77 *F." This statement pertained to technical evaluations that were listed in the licensee's proposed TS Change Form PTSCR 3-38-94 as References C and D. The referenced technical evaluations, "MP3 Service Water Operability Under a Loss of Offsite Power Given a 77 'F Ultimate Heat Sink Temperature," dated August 10, 1994, and "MP3 Service Water Operability During a Steam Generator Tube Rupture Event Without a Loss of l Offsite Power Given a 77 *F Ultimate Heat Sink Temperature," dated August 10,
'
1994, were neither retrievable nor retained within the licensee's QA records system. Although a copy of the technical evaluations was given to the team, it had to be obtained from the originating engineer's personal file.
,
!
Failure to maintain records of activities affecting quality is considered an ;
,
l apparent violation of 10 CFR Part 50, Appendix B, Criterion XVII, " Quality Assurance Records." (EEI 423/96-201-10)
'
2.4.3 Station Blackout Document Control (MP3)
The team reviewed selected engineering documents which described the design of j the AAC system for an SB0 condition. This power source consists of a stand- '
,
s ;
I
. _- _
, _ _ _ _ _ _
. _ - - - _ .- _. . - . .
!
l alone diesel generator and supporting subsystems. The SB0 equipment was installed in response to 10 CFR 50.63 and to the coping duration requirements of RG 1.155, " Station Blackout."
. During a walkdown of the SB0 equipment, the team found that Specification SP- ,
EE-317 " Specification for Diesel Generator Station Blackout," had never been i updated to conform to the purchased and installed equipment. The components
. listed in Appendix I, " Technical Data Furnished By Seller," listed different manufacturers, component models, and equipment ratings than what was actually I installed. The team also noted that certain engineering documents that were related to the AAC system were also inconsistent with the installed equipment or other documents. These documents included the DBDP (MP3-EDG), Electrical One-Line Drawing 12179-EE-1AV, Calculations 90-050-249 E3 and 90-050-308 E3, and SB0 Scenario Specification SP-EE-363, Section 7.3.2.
The team discovered that changes in the original procurement for the l manufacturer and component sizes of the SB0 battery (125 A-h vs. 80 A-h) and i battery charger (30 A vs. 50 A) were not included in revisions to the SB0 i specification and DBDP MP3-EDG. The team observed that the motor horsepower I for the air compressor and lube oil pump differed between the Specification EE-317, the one-line diagram, and the calculations. Also SB0 Specification EE-363 referred to the station battery instead of to the SB0 dedicated i batteries. '
I The team concluded that the design-bases documents for the SB0 equipment contained discrepancies because of poor document control. The licensee had committed to RG 1.155 and NUMARC 87-00, " Guidelines to Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light-Water Reactors," in ;
response to 10 CFR 50.63. Appendix A to RG 1.155 contains the QA guidance for ;
the nonsafety-related SB0 systems and equipment. Part 1 of that appendix !
addresses design control and procurement document control and states that
" Measures should be established to ensure that all design-related guidelines j used in complying with 10 CFR 50.63 are included in design and procurement '
documents, and that deviations are controlled." Contrary to this RG, the licensee failed to maintain the accuracy of the procurement specification which led to errors in other design documents.
2.5 Conclusions The team found a number of errors in the MP3 UFSAR. Among these errors were ;
operating, surveillance, and maintenance practices or procedures that were '
inconsistent with the descriptions in the UFSAR. The team also found installed equipment or actual plant configurations that differed from the UFSAR descriptions and noted inconsistencies between the design criteria described in the UFSAR and other design documents. Although these errors did not directly impact safe plant , operation, in several cases, the licensee had to extensively evaluate the issue to-verify that the UFSAR was in error and that the actual plant configuration was acceptable. In at least one case, the licensee's planned corrective actions in response to the team's findings included changes to the plant configuration. These errors reflect a
,
programmatic weakness in the licensee's process for maintaining the accuracy
'l I
. - - - - ---_ - . . - . - - _ - - - - --- -
l l
and consistency of information in the UFSAR, and also challenge the licensee's ability to maintain design control.
In general, the team concluded that the licensee's safety evaluations were prepared in accordance with 10 CFR 50.59 and adequately supported the ,
determinations that the subject changes did not involve USQs. However, the team found several examples of an inadequate safety evaluation. In one case, because of an inadequate safety evaluation regarding isolation of the MP3 ,
turbine-driven AFW discharge piping, the licensee failed to identify necessary changes to the TS, resulting in plant operation in conflict with TS requirements. In a second case, a safety evaluation regarding MP2 hydrogen monitors did not adequately evaluate the design bases and did not adequately assess the possibility of a malfunction of a different type than previously evaluated. A third safety evaluation regarding MP3 SW booster pump start logic did not address the deletion of an automatic design feature, or the substitution of a manual action for a second automatic design feature, and no ,
evaluation was performed when the manual action was subsequently removed from I the procedure. These issues are significant in that, in each case, the ,
licensee attempted to resolve a known design deficiency through the use of i administrative controls or temporary modifications, but failed to adequately evaluate the impact of the proposed changes under 10 CFR 50.59. The team also found a case in which a safety evaluation was not performed as required by 10 CFR 50.59 to evaluate changes in the design, testing, and maintenance of SB0 components as described in the UFSAR.
The team concluded that insufficient review and verification of the DBDPs were .
performed for them to be used as controlled design documents. The team found instances of inadequate or untimely resolution of DBDP discrepancies. The team also concluded that the licensee lacked the process controls necessary to ensure that the DBDPs are properly revised to reflect all changes in design information. As a result of these weaknesses, the team concluded that reliance upon the information in the DBDPs as the basis for design changes could result in design errors. The team found discrepancies in the procurement specifications, DBDPs, and other design-bases documents for SB0 equipment; those documents were inconsistent with the actual equipment ,
installed in the plant. The team found an additional weakness in the '
licensee's document control process, in that technical evaluations referenced in TS amendment requests are not controlled as quality documents.
3.0 Translation of Desian Bases to Procedures and Practices 3.1 Control of Temocrary Modification Installation (MP2)
During a tour of MP2, the team observed that a temporary modification had been installed on the reactor building closed cooling water (RBCCW) surge tank; the -
modification involved wooden posts and wedges, come-alongs, a nylon sling, and several metal cable rigging sli6gs. Discussion with the licensee indicated that the installation of bypass jumper (B/J) 2-95-045, " Reactor Building '
Closed Cooling Water Surge Tank Restraint," was necessary to resolve tank operability concerns regarding seismic design adequacy when the tank was at more than 50 percent capacity. The licensee had determined that the tank was ,
24 ,
J
- __.
,
operable when the tank level was below 50 percent and they were controlling tank level to maintain it below 50 percent.
'
Team review of the temporary modification design documentation revealed
. several discrepancies with the installed configuration. (Deficiencies regarding the technical adequacy of the design are discussed in Section 5.1.)
Specifically, the team observed that two wooden posts had been wedged in place
, between adjacent structural I-beams and two of the RBCCW tank support legs.
In order to secure the posts, the installation crew had secured each post to an adjacent come-along with rope. One of the posts had been installed directly above the junction box for tank level controller 6000. The team
,
'
questioned if each post was adequately secured by the rope. In addition, one post had been wedged in an I-beam that houses the cable for the level controller. The team expressed concern that free movement of the wooden post could damage the instrument cable. The temporary modification design document indicated that the wooden post would be in contact with the corner of the I-beam. However, this was not practical because of interference from the level controller cable. The cable interference was not reflected on the drawing, nor was the use of the rope or any other method to secure the wooden posts addressed in the temporary modification design package.
Additionally, the design package did.not specify the use of come-alongs.
Therefore, the come-alongs were installed without the benefit of engineering evaluation to ensure that their use would not create an adverse structural or l operational condition. The team inspected 10 of the installed come-alongs.
According to the attached identification tags, the inspection due date (January 1996) for four of the come-alongs had been exceeded by 2 months. The inspection due date for an additional four come-alongs was the end of March 1996. Further, the dead-leg length of chain of one come-along was wrapped !
around the isolation valve and the 1.5-inch piping for the level controller. :
The dead-leg lengths of chain of several come-alongs were hanging freely, so that the chains were in contact with the level transmitter that provides input to control the automatic makeup of the tank.
Finally, during a monthly in situ verification of this temporary modification, the licensee noted (documented in ACR 04845, October 2,1995) that one of the wooden posts had fallen to the floor. The licensee's solution was to secure ;
the wooden posts with the rope; this was done without evaluation or revision '
l to the temporary modification. Team reviews of quality records and interviews with licensee personnel indicated that neither engineering personnel or
, supervision nor other plant management had performed walkdowns to assess the l
adequacy of the B/J installation.
The failure to establish controls to ensure that a temporary modification to improve the seismic capabilities of the RBCCW surge tank was installed in accordance with the approved 8/J, as well as the failure to ensure that subsequent changes, including field changes to the original B/J, were subject to design control measures commensurate with those applied to the design and approved by the organization that performed the B/J design is an apparent
'
i violation of 10 CFR Part 50, Appendix B, Criterion III, " Design Control."
,
(EEI 336/96-201-11)
'
,
. . _ _ _ _ __ . .. _ ._ _ . _ . _ . _ _ _ _ __ _ _
l l
3.2 Oriainal Desian-Bases Installation !
3.2.1; Inadequate Nuclear Instrumentation Channel Independence (MP2)
On March 14, 1996, with MP2 shut down in Mode 5, the wide-range logarithmic ,
nuclear. instrumentation channels A, B, C, and D were declared inoperable because of potential susceptibility to a common-mode failure. The original .
design and installation resulted in a configuration in which the channels are ,
j susceptible to interaction due to electromagnetic interference (EMI). The i licensee initiated ACR 8001 on March 14, 1996, which identified a common-mode failure of wide-range channels B and C. It was determined that the +15-Vdc j power supply for wide-range chennel C failed in such a manner that the output '
voltage dropped and a significant 60-Hz ripple signal was imposed, causing the i alarm relay in channel C to alternately pick up and drop out, resulting in :
contact " chatter " The annunciator alarm circuit is common to all four wide-range channels and all four linear channels, and the alarm contacts in the :
channels are wired in a series circuit to the annunciator. Although the alarm t circuit is nonsafety-related, the wiring configuration created a common path :
to all channels, and the failed wide-range channel C power supply introduced !
electrical noise to all other redundant wide-range drawers, thereby causing i the power and rate indicators in both B and C wide-range channels to swing :
(and spike), causing alarms. 1 The team noted that the design requirements for the reactor protection system, 1 including the wide-range logarithmic nuclear instrumentation system, as r described in UFSAR Section 7.5.2.2, are based on the criteria of IEEE 279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations," l as applied in Combustion Engineering (CE) Specification 18767-ICE-501, Section i 3 0.0, " Reactor Protection System," Revision 1, dated November 19,.1973, and l CE Specification 00000-ICE-501, Section 3.1.1, " Reactor Protection System," .
Revision 4, dated May 17, 1973. Section 4.1 of CE Specification 00000-ICE-501 i states that the design must be such that any single failure within the l protective system does not prevent the protective action from operating.when i required. UFSAR Section 7.5.2.2 states that the design of the nuclear
'
instrumentation system is to maintain channel independence and conform to the 1 single-failure criterion in accordance with IEEE 279-1971, and UFSAR Section i 7.5.2.2.(f) states that all channel outputs are buffered so that individual >
outputs have no effect on any of the other outputs. In addition, IEEE 279-1971, Section' 4.6, states that channel independence will be established in that signals must be independent and physically separated to accomplish decoupling of the effects of electrical transients and reduce the likelihood of interactions between channels. However, wiring configuration (associated with annunciator circuits) for the wide-range logarithmic nuclear instrumentation channels did not meet'the single-failure criterion and the i criterion for channel independence. ,
Subsequent to this event, the licensee initiated Engineering Record (ER) ER-96-0064, dated March 16, 1996, and Revision 1, dated May 9, 1996, which concluded that the design for the MP2 wide-range logarithmic nuclear
'
,
instrumentation does not meet the criteria of IEEE 279-1971 for channel independence. ABB-Combustion Engineering performed a review and concluded t that, although the wide-range logarithmic channels are susceptible to EMI ~
j 26 ;
!
.
w -
v
,
l noise, the operability of the reactor protection system was not compromised. I Additionally, LER 96-013, dated April 15, 1996, was issued to report this .
design deficiency in accordance with the requirements of 10 CFR 50.73. The l failed power supply was replaced and temporary B/Js for the annunciator
. circuit were installed to eliminate the common-mode EMI problem. Longer-term, I the licensee intends to develop a permanent modification to install 24-Vdc l interposing relays for the annunciator circuit.
l
.
The failure to establish measures and design controls to ensure that the design bases for the wide-range logarithmic nuclear instrumentation channels, as described in UFSAR Section 7.5.2.2, were maintained for the installed l instrument channel configuration is an apparert violation of 10 CFR Part 50, 1 Appendix B, Criterion III, " Design Control." El 336/96-201-12)
3.2.2 Discrepancy in Usable Volume of Condensate Storage Tank (MP3)
In May 1992, a licensee self-assessment identified that 30,000 gallons of water in the condensate storage tank (CST) assumed to be available to supplement the demineralized water storage tank (DWST) volume was actually unusable in this configuration. This discovery was significant in that TS l 3.7.1.3 requires that a combined volume of 334,000 gallons of water be I available in the DWST and CST. By letter dated May 19, 1995, the licensee submitted a proposed TS change request (PTSCR) stating that 30,000 gallons of CST volume was unusable and that the combined CST /DWST volume as required by TS should be increased to a minimum of 364,00 gallons. However, because of other unrelated issues regarding the PTSCR, the licensee withdrew it in its entirety by a letter dated June 9, 1995.
The team noted that, since the PTSCR was withdrawn, the licensee had not submitted a revised request and had not implemented interim actions such as operator training or procedure revisions to compensate for this identified degraded condition. The licensee initiated ACR 13428 to document this issue.
Subsequently, the licensee stated its intention to revise the Technical Requirements Manual to reflect the actual usable volume in the CST, to provide training to plant operators prior to reentry into an applicable mode of operation, and to submit a revised PTSCR. Additionally, licensee reviews indicated that MP3 had never been in a configuration in which the unusable CST volume would have been necessary to fulfill the TS requirements.
Nonetheless, failure of the licensee to take prompt actions to submit a revised PTSCR or to implement interim compensatory actions until such time as a change request could be processed is an apparent violation of the requirescents of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action.' (EEI 423/96-201-13)
3.2.3 Post-LOCA Hydrogen Monitors (MP2)
The two redundant MP2 hydrogen monitors are required to be manually started from the control room after the onset of a design-basis act ident. Both hydrogen monitors have similar but separate flow paths for obtaining continuous gas samples from the containment. In addition, each sample flow path outside the containment is also used for the containment gaseous and
._
l particulate radiation monitors, which are connected in parallel with the hydrogen monitor; and, a portion of the instrumentation piping is also connected to the post-accident sampling system (PASS) to allow for obtaining a radiological grab sample for analysis.
'
On the basis of an engineering review, the licensee determined that the plant configuration did not conform with the design basis because the containment gaseous and particulate radiation monitoring system, hydrogen monitoring ,
system, and PASS did not meet the single-failure criterion for the post-accident-monitoring function. Specifically, a postulated loss of one vital 125-Vdc bus would render these systems inoperable because a flow path could not be established due to the configuration of the power supplies to the containment isolation valves. To resolve this issue, the licensee prepared a change to OP 2313C, " Containment Post-Incident Hydrogen Control," Revision 18, dated January 12, 1996, to direct installation of electrical jumper wires to open the appropriate containment isolation valve in the event that the j associated vital 125-Vdc bus is lost.
l l The hydrogen monitoring system is an ESF and the design bases require its
! configuration to meet the requirements for independence, redundancy, and the single-failure criterion in accordance with the UFSAR Sections 6.1, 6.6.1.2, and 7.3.1.2.6, and UFSAR Table 7.5-3; IEEE Standard 279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations"; IEEE Standard 308-
,
1970, " Criteria for Class IE Electrical Systems for Nuclear Power Generating l Stations"; and RG 1.97, " Instrumentation for Light Water Cooled Nuclear Power l Plants to Assess Plant Environs Conditions During and Following an Accident,"
l Revision 2, dated December 1980. Similarly, the containment gaseous and particulate radiation monitors are part of the ESF system and the design bases also require independence and redundancy and compliance with the single-
! failure criterion in accordance with UFSAR Section 7.3.2.2.c. The team
! determined that the licensee's change to OP 2313C to install electrical l
jumpers to correct the single-failure design deficiency concerning loss of a 125-Vdc vital bus is contrary to the design-bases requirements for independence, redundancy, and compliance with the single-failure criterion.
,
Further, the installation of jumpers during a design-basis accident to
! compensate for a design deficiency would place additional burdens on the plant
! staff during a period of high human performance demands. This issue is also l discussed in Section 5.3.1 of this report.
3.2.4 Cable Tray Fill Greater Than Design Description (MP3)
The team noted several cable tray fill discrepancies between the UFSAR criteria and the as-built plant that have existed since the completion of plant construction. Specifically, the team found several L-service cable trays, which include 600-Vac and large de feeder cables, with fill exceeding ;
UFSAR requirements, as well as a discrepancy in the UFSAR with respect to the industry standards. In response to the team's concerns, the licensee i performed a computer sort of the cable and raceway control program which l indicated that five safety-related L-service cable trays had electrical fill
'
j greater than the one-layer depth allowed (i.e., one-layer depth equates to !
100-percent fill) in UFSAR Section 8.3.1.2.4 and UFSAR Table 8.3-2 (i.e., Troj *
3TL1070 at 105-percent fill, Tray 3TL2040 at 132-percent fill, Tray 3TL204P at
,
!
108-percent fill, Tray 3TL2060 at 132-percent fill, and Tray 3TL210P at 108-percent fill). The team also found that Calculations 67E, " Maximum Cable Length for Continuous Duty Motors," Revision 0; 69E, " Maximum Cable Length for Heater Feeders," Revision 0; and 192E, " Maximum Cable Length for Lighting
. Transformer Feeders," Revision 0, used ICEA P-54-440, "Ampacities of Cables in Open-top Cable Trays," to determine cable ampacities. UFSAR Section 8.3.1.2.4 and UFSAR Table 8.3-2 incorrectly identified ICEA P-46-426, " Power Cable
. Ampacities," as the methodology used to determine ampacities.
On March 21, 1996, the licensee initiated ACR 10525, after visual verification that the five safety-related L-service cable trays of concern exceeded the fill requirement specified in the UFSAR. In addition, the licensee prepared an analysis which demonstrated that the installed cable configurations for these trays were within the 2.5-inch depth assumed by the design calculations.
Therefore, the installed cable ampacities were determined to be acceptable.
The team also reviewed tray fill associated with safety-related C-service control cables, which include 120-Vac and 125-Vdc circuits for control, metering, relaying, and alarm functions. UFSAR Table 8.3-2 (Cable in Trays)
states that C-service control cables are routed in cable trays with a maximum tray fill of 50 percent (of tray height) in accordance with ICEA P-54-440 criteria. The cable and raceway control program tracks cable fill and calculates percent fill in trays based on cable diameters, tray width, calculated cable depth, and the derating criteria in Calculation 173E,
" Determine Ampacity of "C" Cables Insta11eo in Tray or Conduit," Revision 0.
Calculation 173E uses ICEA P-54-440 to determine cable ampacities based on 1-inch calculated depth of fill; and the tray fill limit of 50 percent equates to 100-percent allowable fill (i.e.,100 percent of the limit) in the cable and raceway control program. Calculation Change Notice (CCN) I to Calculation 173E, dated July 26, 1995, was prepared to provide a basis for increasing the 1-inch calculated depth to 1.5-inch calculated depth of cable fill for determining ampacities; the CCN provides a basis for increasing the percentage of allowable fill from 100 percent to 157 percent for C-service trays on the basis of engineering approval. However, the team noted that UFSAR Table 8.3-2 had not been updated to reflect a 157-percent allowable fill. ,
I The team observed several C-service cable trays which appeared to be 1 overfilled. In response to the team concerns, the licensee performed a computer sort which indicated that four safety-related C-service cable trays had electrical fill greater than the allowable 157 percent (i.e., Tray 3TC402P at 159-percent fill, Tray 3TC442P at 158-percent fill, Tray 3TC4430 at 173-percent fill, and Tray 3TC4620 at 172-percent fill).
A licensee walkdown performed in response to the team concerns revealed that cables in the trays of interest were not fully seated within the trays.
However, the cable and raceway control program computer model assumed all cable was fully seated in the tray for the entire tray length, thereby j creating a conservative overfill criterion. On May 17, 1996, the licensee l initiated CCN 3 to Calculation 173E, which determined revised tray fills that i are enveloped by the 157-percent allowable fill criterion for the four cable trays of concern. In addition, the licensee prepared a safety evaluation to justify the as-installed deviations in tray fill from tray fill values
'
. - _- _ __..- - - - - . . . . - . - - - - . - - - . - - -
specified in the UFSAR for the C-service and L-service cable trays. The licensee also initiated FSARCR 96-MP3-24, dated May 15, 1996, to update UFSAR Table 8.3-2 and Section 8.3.1.2.4 to resolve discrepancies and reflect as-installed tray fill conditions approved by engineering for L-service and C- 1 service cable trays. , j 3.2.5 Station Blackout Diesel Generator Loading (MP3) ;
'
The MP3 SB0 DG is designed so that electrical loads must be manually connected ,
to the generator. E0Ps 35 ECA-0.0 and ECA 0.3, instruct the operator to i manually limit the total load on the 580 DG. The team noted that the guidance -
in E0P 35 ECA-0.3 for loading the 5B0 DG was based solely on the continuous nameplate ratings of the connected equipment, and that it did not consider the :
effect of inrush currents associated with electrical motor startup. The licensee had no information to support the capability of the SB0 DG with respect to starting kVA limits.
A dedicated SB0 computer controls the SB0 DG starting process. The computer ,
is powered from a dedicated uninterruptable power supply (UPS) which is designed with an internal battery and battery charger. The battery charger receives power from either the normal power system or from the SB0 DG. The 1 SB0 UPS is not powered by a safety-related electrical bus. Therefore, its associated battery may discharge to such an extent that during a loss-of- .
offsite-power event there may not be sufficient capacity to start the SB0 DG. '
OP 33460, " Station Blackout Diesel," Sections 4.7 and 4.8, contains a caution that would limit the unavailability of power to the SB0 UPS to 45 minutes. :
However, E0P 35 ECA-0.0, Attachment G, merely indicates that the SB0 diesel
'
may be started but not immediately loaded. The E0P does not contain direction :
or caution statements that would limit operation of the SB0 DG in an unloaded !
condition which may cause excessive fuel deposit build-up and place excessive mechanical wear on the diesel engine.
The team also identified a concern regarding the adequacy of the SB0 DG surveillance test program. The current test program does not load the DG to its continuous rating, which is less than 90-percent of the rating of the '
anticipated loads expected during an SB0 event. Specifically,-the SB0 DG has a continuous rating of 2260 kW. However, the SB0 DG quarterly load test t directs that the generator be loaded to between 2100 and 2200 kW. Further, per E0P direction, the SB0 DG could potentially be loaded to its 168-hour
'
rating of 2574 kW.
Finally, the team found a discrepancy between operator log sheets and SB0 l battery charger vendor information. Specifically, the operator shift tour ;
Form 3670.3-6, identifies the acceptable voltage range for the SB0 battery !
charger as 125 to 140 Vdc. However, the vendor's instruction cautions that charging above 2.31 volts per cell (138 Vdc) would shorten the battery's .;
expected useful life by one-hall.
The following concerns identified by the team remain unresolved pending the
'
'
NRC review of the licensee evaluations for (1) the consideration of the ;
effects of inrush currents associated with electrical motor startup; (2) the l potential loss of SB0 DG start capability should an SB0 be experienced more *
l.
.
i
. _ _- ________.______-______,_m______
I l than 30-45 minutes after a loss of the normal power supply to the computer; (3) the potential adverse effects of sustained operation of the SB0 DG in an unloaded condition; (4) the adequacy of the current SB0 DG surveillance test program; and (5) the adequacy of current operator log sheet ccceptance l. criteria for SB0 battery voltages. (URI 423/96-201-14)
3.3 Incorooration of Vendor Information into Station Processes
"
3.3.1 Auxiliary Feedwater Valves - Containment Isolation Function (MP3)
On March 30, 1996, MP3 conducted a TS-required shutdown. The shutdown was necessitated after the licensee determined that the TDAFW pump isolation valves could not fulfill the operability requirements of TS 3.6.3,
" Containment Isolation Valves." Specifically, after evaluation of vendor-supplied information regarding valve performance when closed, the licensee concluded that the valves were not capable of maintaining containment integrity at the design-bases containment accident pressure of 38.6 psig. The licensee generated an ACR to document this condition, and issued a 10 CFR 50.72 report to document the plant shutdown as required by TSs. On April 26, 1996, the licensee submitted LER 96-06 in accordance with the requirements of 10 CFR 50.73.
Concern for the design adequacy of the valves was raised on March 28, 1996, during a licensee review of a potential TS change, to address the team finding regarding low-power operations with the TDAFW pump isolated (documented in Section 2.2.3). The licensee had contacted the valve vendor, Target Rock, regarding the backpressure capability of angle-type solenoid-operated valves (S0Vs). The vendor indicated that the valves were " unidirectional" and were not designed to isolate system pressure in the reverse direction. Upon receipt of this information, the licensee performed a preliminary operability determination that concluded that there was reasonable assurance that the valves were capable of performing their containment isolation function.
However, after the NRC questioned the adequacy of the bases for this determination, the licensee conducted bench testing of a spare Target Rock SOV that clearly demonstrated the valve would not seat against the design-bases containment accident pressure. Subsequently, the licensee declared all four valves inoperable and the plant shutdown was initiated. Testing of the SOVs installed in the TDAFW discharge lines indicated that the valves were capable of holding pressure in the direction of normal AFW discharge flow (from the AFW pump to steam generator). However, when test pressure was applied on the valves in the accident (or reverse) direction, the valves became unseated and the isolation capability of the valves began to degrade at a backpressure of only 8.0 psid.
The licensee classified these valves in accordance with 10 CFR Part 50, Appendix A, General Design Criteria (GDC) 57, " Closed System Isolation Valves." As such, the valves aire required to be capable of isolating the
'
containment under certain design-bases accident conditions. Additionally,
! UFSAR Table 6.2-65 identifies these valves as containment isolation valves.
l Previously, NRC GL 91-15, " Operating Experience Feedback Report - Solenoid-Operated Valve Problems at US Reactors," dated September 18, 1991, transmitted
NRC NUREC-1275, Volume 6, that highlighted significant operating events
!
! .
involving observed or potential common-mode failures of solenoid-operated valves (SOVs). Specifically, NUREG-1275, Section 7.1, " Design Application Errors," and Section 7.1.5, " Directional SOVs," discuss spurious openings of safety-related SOVs as a result of high backpressure. Additionally, Section 5.1.4, " Directional SOVs," specifically addresses inadvertent operation of .
Target Rock angle-type SOVs as a result of improper valve orientation. This section further describes that several models of Target Rock angle-type SOVs used for isolation purposes are " unidirectional," in that they will experience ,
undesired seat lifting when the backpressure at the outlet port is only 2 to 5 psi higher than the inlet port. The manufacturer considered the lifting of the angle-type SOVs to be a licensee application problem. The NUREG cites Target Rock Manual TRP 1571J that "most solenoid valves because of the nature of the operation of the valve, will stop flow in only one direction. By design, upstream pressure acts on the top of the disc, forcing it onto its seat, thereby creating a tighter seal. However, if downstream pressure rises above upstream pressure, the disc will tend to lift off its seat, thereby allowing flow." This vendor manual with the exact statement of design capability was supplied to the licensee in 1982 when the TDAFW SOV isolation valves were procured from Target Rock. Notwithstanding this vendor information, the licensee installed the angle-type SOVs in an application in which high backpressure should have been a critical design consideration.
Additionally, although the SOVs were classified as containment isolation valves and in 1994 had been credited as a HELB barrier, it was not until March 30, 1996, that the licensee performed a bench test of a prototype SOV that demonstrated the design capabilities and limitations of the application of the angle-type SOVs as TDAFW containment isolation valves.
The failure of the licensee to establish design controls to verify the adequacy of the design of the angle-type S0Vs to properly remain isolated against design-bases accident pressures by suitable qualification testing under the most adverse design conditions is an apparent violation of the requirements of 10 CFR 50, Appendix B, Criterion III, " Design Controls."
(EEI 423/96-201-15)
Further, the inadequacy of the containment isolation function of these valves calls into question the effectiveness of the use of these valves as an HELB barrier as previously discussed in Section 2.2.3 of this report. Because the valves could experience undesired lifting, it would appear that the valves would not be capable of isolating the portion of TDAFW pump discharge piping not analyzed to withstand a HEl.B from the high energy discharge of the MDAFW pumps, as was assumed by previous licensee analysis. Although the licensee has implemented modifications to the valves that ensure seating capability in all ranges of design backpressures, this issue remains unresolved pending NRC review of the licensee's analysis related to the function of the TDAFW discharge isolation valves. (URI 50-423/96-201-16) *
3.3.2 Leaking Backwash Strainer Valves (MP3)
'
The team reviewed work contro! documentation for the MP3 SW strainer backwash valves. The licensee had reported that the SW strainer backwash valves for the strainers on the A and C SW pumps (35WP*MOV24A and 24C) had significant *
seat leakage. Trouble reports (TRs) were initiated for 3SWP*MOV24A and
_ __
... _ - - _ . . - _ _ __ ._.-
l l
! 35WP*MOV24C on Decemt ..- 2,1994, and on February 19, 1996, respectively. At the time of the inspection, the planning department had completed the i
automated work orders (AW0s) for repair of the valves and had placed the
'
packages in a holding file for the appropriate maintenance window.
The VTM for the subject valves specified a torque requirement for the body-to-bonnet bolts that varied with bolt size. The team noted that although the AWO
. for valve 3SWP*MOV24C included a torque specification for a 7/32-in. body-to-bonnet bolt, the AWO for valve 35WP*MOV24A did not include a torque specification.
When the team spoke with the planning staff it found that maintenance planners are not required to consult VTMs when developing AW0s. Rather, it is assumed that relevant VTM information would be included in controlled station procedures. However, the team noted that no maintenance procedure had been prepared for this valve type. The bolting torque value had been included in :
the AWO for the 35WP*MOV24C valve because of the initiative of the specific work planner to obtain this information, rather than because the work planning process required it. The licensee initiated ACR 10875 to document and assess the cause of the deficiency of the AWO.
The team reviewed the maintenance history and found that both valves had previously been found to be leaking and that some prior corrective maintenance activities had been performed. The documented work indicated that the deficiencies had not been corrected. However, maintenance personnel had not performed a post-maintenance valve leakage test and had not initiated additional corrective maintenance work orders.
In March 1993, the licensee initiated AWO M3 93-04160 for valve 3SWP*MOV24A to address valve stem seal leakage, and actual work on the valve was performed on August 14, 1993. The AWO documented that the valve plug was " badly washed out" and that the valve was reassembled with this damaged plug "per NU j supervision." The team noted that the subsequent post-maintenance test did
-
not check for seat leakage and that a followup AWO or other action was not initiated to address the degraded valve plug.
The team reviewed AWO M3 94-03416, initiated in February 1994, to address that valve 3SWP*MOV24C had seat leakage and that it traveled past its closed l position. Work was performed in April 1994, and the AWO documented that the
'
motor operator limit switch had been readjusted. The team determined that readjusting the closed position of the valve plug would not necessarily affect seat leakage for this valve design. Further, the team noted that again in this instance, the post-maintenance test for the AWO did not test for seat leakage. The team also noted that AWO M3 94-03416 specified that the body-to-
. bonnet bolts be torqued to 20 ft-lb, corresponding to a bolt size of 3/8-in.
! This contradicted the bolt size and torque value specified in the open AWO and VTM for 35WP*MOV24A. The licen'see subsequently reviewed the maintenance
,
performed in February 1994, and concluded that 35 ft-lb was the appropriate torque value that should have been specified, but that 20 ft-lb was adequate. ;
I Ultimately, in April 1996, the licensee replaced the subject valves under !
'
,
revised work orders.
t
.
i Overall, the team concluded that the licensee demonstrated weak performance in j the planning of these maintenance activities. Important vendor information i was not included in the controlling processes. Additionally, supervisory l personnel accepted degraded component performance without initiating follow-up l work orders. Finally, comprehensive post-maintenance test criteria were not .
l developed that would have established a baseline for valve performance. !
3.3.3 Service Water Pump Room Watertight Doors (MP3) .
During a walkdown of the MP3 SW intake structure, the team observed that the l watertight doors for both SW pump rooms had deformed and abraded seals, and l that the handwheels for both doors were difficult to operate. Additionally, l the " dog" to the upper-right-hand corner of the B pump room door was not in contact with the combing. The team informed the licensee of these deficiencies and the licensee initiated TRs.
The team noted that the VTM for the watertight doors directed that regardless of condition, gaskets should be replaced every 5 years to ensure proper door 1 performance. In addition, the VTM directed that every 5 years, the 0-ring in '
the handwheel shaft should be replaced. Through discussions with licensee work control personnel, the team learned that these gaskets had never been replaced and that the VTM recommendations had not been incorporated into the preventive maintenance (PM) program. In response to these findings, the licensee initiated ACR 10601 on March 29, 1996.
The team noted that the most recent 18-month PM inspection of the MP3 SW pump room watertight doors had been completed in September 1994 for the B-train door, and in March 1996 for the A-train door. The PM job description directed the performing individual to " Inspect this door visually and functionally to insure that it operates properly should it be required in the event of an emergency."
The documented work comments for both inspections were very brief, did not highlight any deficiencies, and, in the case of the job performed on March 4, 1996, stated, "18 month PM comp." The team observed that the recommended inspections discussed in the VTM inspection were considerably more detailed and that an inspection performed in accordance with these recommendations would have resulted in door adjustments and gasket replacements.
The team noted that ACR 5218, dated September 29, 1995, had been initiated by l a plant operator who discovered deficiencies in both service water pump room doors and questioned whether the doors would properly seal. The ACR review concluded that the 18-month PM tasks were adequate. System engineering also performed an operability determination which concluded that the incomplete gasket seal was minor, that static pressure would help seal the doors, and that the doors remained operabig. Maintenance subsequently adjusted the door mechanism to seat the door better.
'
The team questioned the adequacy of the assessment effectiveness of the ;
corrective actions taken, considering the ACR conclusion that the existing PM
_ . _. _ ._ _ _ _ _ _ _ _ _ _ _ _. _ __ _.. _ _ _ . . . _ _
,
,
'
task was determined to be adequate in contrast to the comprehensive inspection detail and component replacement periodicity prescribed in the VTM.
Subsequent to the team concerns, the licensee initiated a gasket replacement I
. PM task on a 5-year frequency. Additionally, a PM technique form was created i which contained specific inspection points and acceptance criteria consistent l l with the VTM. The team reviewed these tasks and found them acceptable. i
'
3.3.4 Auxiliary Feedwater Pump Lubrication Schedule (MP3)
During the review of routine AFW pump surveillance test procedures, the team noted caution statements regarding manual lubrication of the pumps prior to operation under certain conditions. Specifically, SP 3622.1 and SP 3622.2 ("MDAFW Pump 3FWA* PIA &B Operational Readiness Tests," Section 2.1.2) and SP 3622.3 ("TDAFW Pump 3FWA*P2 Operational Readiness Tests," Sections 4.1.7, 4.3, and 4.3.5) directed the operator to manually prelubricate the pump bearings if the given pump had not been operated during the previous 40 days. The team questioned the licensee regarding the basis for this requirement.
l The pump manufacturer, Bingham Willamette, states in technical manuals (01M- !
l 041-001C and 002C) that the pumps should be lubricated every 30 days if they l are normally in standby service. Further, the manuals caution that failure to i lubricate the pumps before startup after extended standby service could result in scoring of the pump bearings. In 1987, with the concurrence of the vendor, the licensee extended the prelubrication requirement interval to 40 days to coincide with the TS surveillance periodicity of 30 days plus an additional 10 days to capture the 25-percent grace period to perform routine testing. A l team review of the inspection record revealed that the NRC had previously l inspected this issue in NRC Inspection Reports 50-423/85-71 and 86-07.
'
l
.
On January 3, 1995, TS Amendment No. 100 was issued that changed the routine surveillance period from 30 days to quarterly. The new TS surveillance
.
requirement nominally equated to a 90-day periodicity with a 25-percent grace l period of approximately 23 days. However, during the process of revising
- administrative and operational procedures to incorporate the new survaillance periodicity, the licensee failed to address the prelubrication interval
' -
recommended by the vendor. Therefore, station procedures maintained the 40-day prelubrication caution that existed since 1987, although the procedures were used only quarterly.
The team expressed concern that the reliability of the pumps could be significantly degraded if they were to have been called on to automatically start or were manually operated during plant operation more than 40 days into a surveillance interval. Additionally, the team expressed concern that the lack of a proceduralized periodic lubrication of the pumps during standby service effectively precluded a, meaningful as-found surveillance test since the pump bearings would only be prelubricated immediately prior to the
'
surveillance test itself, thereby eliminating normal as-found standby service ;
conditions, i
' '
The licensee initiated ACR 10790 to document the team's concerns. Initial licensee communications with the pump vendor indicated that more than 40 days
'
4
)
___ _
_ _ - . _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ . _ _ _ . . __ ._
between standby service lubrications could result in prompt bearing failures upon pump starts. Therefore, the licensee declared all three AFW pumps inoperable until an appropriate lubrication interval could be established and '
until pump operation since the change in surveillance periodicity could be l verified. Subsequently, the licensee determined that the TDAFW pump, which is '
j equipped with an electric lubrication pump in addition to the main pump shaft- I driven lubrication pump, is lubricated monthly and, therefore, was not affected-by the surveillance periodicity change and was considered operable. '
However, the imAFW pumps, which are equipped only with the main pump shaft- l driven lubricating pumps, were verified to have no other governing prelubrication controls. Licensee review of the completed surveillance tests indicated that one MDAFW pump had been tested within the previous 40 days and, therefore, was operable. The remaining MDAFW pump'was manually lubricated and returned to an operable standby service condition.
Subsequent licensee discussions with the vendor indicated that a film of l lubricating oil necessary to ensure adequate lubrication during pump startup t from standby conditions would remain on the bearing surfaces for up to 113 days. At the conclusion of the onsite portion of the inspection, licensee engineering personnel were reviewing the technical adequacy of this new vendor information; this remains an unresolved item pending final licensee disposition of the appropriate standby service lubrication interval. ,
(URI 423/96-201-17) !
Notwithstanding, the failure to establish controls to coordinate the !
comprehensive revision of station procedures necessary to implement all .
implications of TS Amendment 100, including reconciliation of the vendor ;
recommended prelubrication interval for the AFW pumps is an apparent violation !
of the requirements of 10 CFR Part 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings." (EEI 423/96-201-18)
3.3.5 Rosemount Transmitter Installation Deficiency (MP2 and MP3) l; On March 13, 1996, during a tour of MP3, the team observed two Rosemount ;
transmitters (3CHSFT139 and 3CCPFT128) with plastic shipping caps in the spare !
conduit ports, and a third transmitter (GWS-FT-84) with the spare conduit port !
open to the environment.
The manufacturer's instruction manual (4302, Revision B, dated July 1982) l contains specific instructions for conduit installation. It directs the ;
installer to seal off an unused conduit port with a stainless steel pipe plug, ,
using a qualified thread sealant and a torque value of 150 in.-lb. The dust j caps are merely intended to provide a foreign material exclusion (FME)
boundary for the conduit ports prior to field installation. The absence of '
_ plugs may allow the intrusion of foreign material, as well as ambient moisture, increasing the potential for transmitter malfunction or failure over the life of the instrument.
In response to the team's concerns, the licensee initiated ACR 10511 on -
l March 14, 1996. Additionally, the licensee promptly inspected all transmitters that were accessible during plant operation. The remaining i transmitters were inspected during a subsequent plant shutdown. In all, 106 -
l
,
36 1 i
!
I
,_ ._. -
_
_. _ _ . _ _ _ . _ _ _ _ _ . _ . . . . _ . . . _ _____ _ _ ._ _ ... _ _ ._
,
t
!
of the 399 transmitters inspected at MP3 did not have stainless steel plugs i installed in the spare conduit ports. The licensee indicated that the .
majority of these transmitters (1) provided inputs to instrumentation that i either supported the operability of an associated system or component required j. by TS, (2) were relied upon when executing E0Ps, or (3) would be called upon i
if primary post-accident monitoring instrumentation should be unavailable.
Additionally, during the inspections, the licensee noted three additional
. Rosemount transmitters that had not been identified on the Production ;
Maintenance Management System (Pt#iS). The team also identified a transmitter !
(3CHS*FT21) that was described in the UFSAR as safety-related, but that was '
being maintained as a nonsafety-related component.
The licensee initiated ACR 05948 to investigate potential applicability at
. MP2. ' Inspections at MP2 identified 35 transmitters that did not have plugs
! installed in the spare conduit ports. Five of these transmitters provided .
l inputs to instruments with post-accident monitoring functions. I I
l The team reviewed MP3 maintenance work orders (M3-85-36912 and M3-85-36913),
completed on November 14, 1985, that had installed two of the discrepant transmitters (3HVC*PT73A and PT73B) classified as safety-related. The work orders did not reference either plant-specific installation procedures or l vendor technical manuals. During the team inspection, the licensee reclassified these transmitters as nonsafety-related.
The licensee's failure to establish instructions or procedures to ensure that the Rosemount transmitters would be installed and subsequently inspected, -
consistent with vendor manuals to ensure quality control of the involved craft is an apparent violation of 10 CFR Part 50, Appendix B, Criterion V, '
" Instructions, Procedures, and Drawings." (EEI 423/96-201-19)
3.4 Conclusions The team concluded that the licensee demonstrated a weak understanding of the
,
'
original design-bases requirements for the systems reviewed during this inspection. More significantly however, the team concluded that upon
,
identification of a given design deficiency, the licensee opted for
'
resolutions that were technically inadequate and, in many cases, placed additional burden on the plant operations staff to perform off-normal compensatory actions during transients and accidents when human performance demands would already be at elevated levels. Further, it was not apparent that the licensee had attempted to quantify or evaluate the cumulative effect of these compensatory actions to ensure that the operation and response
- capability of the units remained within the original design and licensing
'
bases as described by TS and UFSAR. Within the bounds of this conclusion, the team noted several significant instances in which licensee management did not
,
project strong standards of per,formance expectations, critical independent !
t oversight, comprehensive safety verification, or meaningful self-assessment. '
Specifically, a temporary modification to the seismic restraint of the MP2 RBCCW surge tank was installed with numerous discrepancies from the approved B/J. . Ten come-alongs that were not included in the B/J design specification
, were installed without formalized control of usage or applied force.
.
'
- 37
- _ _ _ __ _ ._ .- _. _ _ . _ . _ . _ _ _ _ . _ - _ _ _ _ _ _ . - . _ < . _ _
!
Additionally, several of these come-alongs had expired calibrations. After installation, a wooden shoring post fell down from its installed location, and the only corrective action taken was to better secure the wooden posts with l ropes. Team reviews indicated that no management or engineering walkdowns or '
reviews of the modification were performed to verify the adequacy or .
conformance of the installation. None of the discrepancies identified by the
'
team had been documented or evaluated by the licensee nor had the B/J design :
description been reconciled with the as-built configuration. .
!
i Additionally, the team concluded that the licensee failed' to either promptly ,
or adequately evaluate and resolve several design deficiencies that had '
existed since original construction that introduced common-mode failure potential to safety-related systems. These systems were required by design '
bases to be independent from single-failure vulnerabilities. For example, a single-failure ' vulnerability in the power supply design that would render the MP2 post-accident hydrogen monitoring system inoperable was addressed by l procedural controls that would require operators to install bypass jumpers ;
during the course of accident response to restore power to the system valves. !
In each of these instances, the licensee did not comprehensively address the design standards and codes described in the UFSAR during evaluation of these deficiencies.
The team also found several instances in which information in a VTM had not been properly incorporated into station procedures. Specifically, the team found that shipping caps remained installed in the spare conduit ports of numerous Rosemount instrument transmitters. Ultimately, the licensee found that 106 transmitters installed in MP3, and 35 transmitters installed in MP2, still had shipping caps in the spare conduit ports. The team determined that the work orders that installed the transmitters did not contain the vendor's ;
installation instructions. .
B Additionally, the VTM for the watertight doors on the MP3 service water! intake structure contained specific direction for the periodic replacement of door components regardless of visual appearance. The VTM also contained detailed inspection criteria for door components. Notwithstanding, station procedures had no component replacement criteria or detailed inspection criteria. When the team reviewed completed door inspections, it found only brief notes regarding door conditions. Further, when an operator documented a concern about door performance noted during a routine tour, the licensee resolved the ACR by finding the existing PM inspection adequate without consulting the VTM.
The team also found that work orders that had been prepared for the repair of MP3 service water system backwash strainer valves had no consistent vendor-recommended torque values for valve body-to-bonnet bolts. Further, when the team reviewed previous work orders, it found similar discrepancies in torque values. The team also noted tha,t the previous maintenance activities on these i
'
valves did not include post-maintenance testing to check for continued seat leakage or to initiate additional work orders to address degraded conditions ,
discovered during the work efforts.
.
Most significantly, however, the licensee failed to consider VTM information
,
in the design application of angle-type S0Vs as containment isolation valves
f
, ~, -
. . - - . . - - - - - - - - - - - - - - - . - . - - - . .--
,
y
,
for the MP3 TDAFW pump discharge piping containmer.t penetrations. The VTM had
. specifically cautioned that the SOVs were " unidirectional" and would be
incapable of remaining properly seated against minimal backpressure.
'
Notwithstanding, the licensee installed these SOVs in a containment isolation
.
function, in which high backpressure should have been a critical design consideration. Lacking adequate design controls and without consideration of l
'
the VTM information, the S0Vs were inoperable since initial installation until
. this design issue was identified on March 30, 1996.
!
l~
The team also noted instances in which the licensee did not fully resolve issues that required a TS amendment. Specifically, the licensee had
,
identified an unusable volume of water within the CST that was assumed to be
,
available in applicable TS limiting conditions for operation. However, a TS
- amendment request that would have reconciled this discrepancy was submitted to the NRC but was withdrawn later, without the implementation of any onsite
- interim compensatory actions or development of a revised TS change request.
j Additionally, the licensee did not comprehensively revise procedures affected l' by a TS amendment that authorized extending routine AFW system testing from monthly to quarterly. Specifically, the licensee failed to address the requirement of an AFW pump vendor regarding the periodic lubrication of the pumps when in standby service conditions. The lack of periodic lubrication )
had the potential to result in bearing failure upon automatic or manual l startup under certain operational conditions.
Overall, the team concluded that taken collectively these concerns reflected a lack of understanding of and respect for the preservation of the design and licensing bases for the units. The team was particularly concerned that in ,
many of the instances above, the licensee had the opportunity to either j identify, or more promptly and comprehensively achieve, issue resolution.
However, many of the initial licensee actions were narrowly focused, lacked design-bases technical evaluation, failed to consider vendor information, and were interim in nature. Further, the team was concerned with the lack of critical self-assessment and management oversight that could have identified these issues sooner. The team was also concerned about the effectiveness of the independent multi-discipline review bodies who are responsible for comprehensive assessment of these issues to ensure that design and licensing bases are maintained. ,
4.0 Problem Identification and Corrective Action !
The team conducted plant tours and system walkdowns, reviewed licensing and design-bases documents, and interviewed station personnel in order to assess the licensee's ability to identify deficiencies, and to implement, track, and complete corrective actions to resolve deficiencies. The team also reviewed quality verification programs and audit activities to determine the effectiveness of these function; in raising concerns and the effectiveness of management's actions in response to identified problems. MP3 was the primary '
.
focus for these inspection activities. Some MP2 activities were also reviewed. In limited cases, programs or issues reviewed by the team also applied to MP1 and Haddam Neck.
.
- _ _ _ _ _ __ _ _ . _ _
l j
The team examined ACRs, operating procedures, plant logs, computer records,
. operability determinations, maintenance and surveillance histories, work control procedures, work orders, temporary modifications, design change packages, and the UFSAR to assess the licensee's perfcrmance in identifying deficiencies. The team reviewed selected audits, ACRs, responses to NOVs, ,
LERs, and other activities to assess the effectiveness of the licensee's ,
corrective action program in tracking and dispositioning identified deficiencies. The team also reviewed the licensee's specific corrective ,
actions for issues related to selected systems.
4.1 Deficiency Identification and Processina 4.1.1 Degraded Motor Control Center Environmental Enclosures (MP2)
During a plant tour of MP2, the team observed gaps between the door seals and the doors in some motor control center (MCC) environmental enclosures. In addition, the team questioned the adequacy of the cooling system for the MCC environmental enclosures.
In 1981, the licensee completed modifications to enclose MCCs B51 and B61, which supply power to safety-related loads, in response to the NRC requirements for environmental qualification of safety-related equipment. In addition to the protection provided by the enclosures, the modifications also provided a dedicated cooling system to maintain the MCCs in an acceptable temperature range.
The team found that the environmental qualification of the MCCs has been an ongoing engineering concern that the licensee has reviewed several times since 1992. On October 28, 1992, the licensee documented its operability determination (0D) on reportability evaluation form (REF) 92-67, which was prompted by a reanalysis of the temperature profils for safety-related MCCs following an auxiliary steamline break (ASLB). The OD in REF 92-67 concluded that MCCs B51 and B61 were operable, and that the effects of postulated higher temperatures in the vicinity of the enclosures did not constitute a reportable condition. However, this conclusion was based on the assumption that an ASLB would be nutcoatically isolated within 10 seconds of the line break and that it would not result in a reactor or turbine trip.
The OD in REI 92-67 recognized that " failure of these MCCs would mean losing the ability to perform an orderly shutdown of the reactor." Nevertheless, the licensee relied on compensatory actions to ensure the operability of the MCCs in the event of an ASLB. In the event that enclosure cooling would not be sufficient to prevent elevated temperatures, the licensee's approach involved deenergizing the affected MCC, waiting for temperatures in the enclosure to reach an acceptable range, and then reenergizing the MCC for the safe-shutdown function. Although an automati,c reactor or turbine trip is not anticipated in this scenario, the OD did not consider the consequences of a plant trip with one or more MCCs deenergized. The team concluded that the OD was narrow in '
scope and did not consider the full spectrum of possible plant conditions.
The team reviewed another operability determination, associated with REF 92- *
82, dated December 1, 1992, which was performed to reassess the operability of 40 j
- - -. . - - - -. . - _ _ _ . - - - - . - - - . - --
i these MCCs because of a new understanding of their temperature response in
~
post-accident conditions. This OD concluded that, in the event of a main steamline break, the temperatures in the MCC enclosures could rise to 143 'F in 851 and 145 *F in B61. These temperatures are above the qualification l. temperatures of the MCC equipment; the vendor had qualified the MCCs for 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> at 131 'F. However,.the licensee determined that the MCCs were
operable, based on the assumption that one of the two non-Category I enclosure
!. cooling systems would remain operable in a harsh environment and prevent the temperature in that MCC enclosure from rising above 131 'F. The licensee did not provide a documented basis for the assumption that an unqualified j component would be available in a post-accident environment.
.
l Although the licensee does not have an analysis that predicts the ambient
- temperature of the auxiliary building during a LOCA event, the licensee used
- 110 'F in the 00 in REF 92-82, which is the maximum design temperature for the i building with the ventilation system operating. The team noted that the
{ auxiliary building heating, ventilation, and air conditioning (HVAC) system
! could not be assumed to be available in the event of an accident because. it
- was not designed for such service and that the licensee had made a j nonconservative assumption in the OD.
REF 93-04, dated March 14, 1994, stated that the worst-case outdoor i temperature should be assumed in calculating the heat rise in the MCCs, j instead of the highest monthly average temperature of 81.5 *F. The licensee l considered the MCCs to be operable, on the basis of the~ low outdocr
- temperature at the time of the evaluation. An attachment to this evaluation
- also stated that thermal detectors that would allow operators to confirm i forced cooling in the enclosures were not installed. The team did not find any licensee corrective actions taken in response to these concerns.
l I The team reviewed several other internal licensee documents that noted
! concerns with the enclosures. In response to NRC Information Notice 92-52, j " Barriers and Seals Between Mild and Harsh Environments," the Vice President 1 of the Millstone Station sent a memorandum to the lead licensing engineer, j dated February 16, 1993, addressing the need for completing the HELB analysis
- and implementing any necessary compensatory measures for the barriers.
! Engineering Work Request (EWR) 2-94-00236, dated August 2, 1994, documented j that the MCCs may be operating outside the design bases, but the team did not identify any licensee action in response to this concern. A licensee memorandum of November 17, 1995, highlighted several technical concerns: the non-Category I cooling system for the MCC B51 and B61 enclosures which also i lacked weatherproof fittings, the fact that operations was not informed by
- engineering of the prompt operator actions required in certain scenarios, the j fact that the worst-case outdoor temperature was not used in the enclosure
- heatup calculations, and the inappropriate cancellation of EWR 2-94-172, which l had requested the installation pf control room indication of MCC enclosure l temperature. The team found no evidence of specific licensee corrective
, actions taken in. response to these concerns. t
,
, The licensee's formal problem identification and corrective action processes j, were not used to identify, track, and resolve the documented deficiencies in
-
j the analysis and design of the cooling system for the MCC B51 and B61
l 41
-
!
!
!
environmental enclosures. This system is relied upon to maintain the operability of the MCCs, which are critical for the operation of the high pressure safety injection (HPSI), low pressure safety injection (LPSI) and charging systems. The licensee's REF 93-04 and EWR 2-94-00236 documented that the MCCs may be operating outside of their design parameters during an ,
accident due to the loss of enclosure cooling. REF 93-04 determined only the interim operability of MCCs because of the low seasonal temperatures that existed at the time. As of March 31, 1996, the team noted that the subject ,
deficiencies for MCC enclosure cooling remained uncorrected.
With respect to the integrity of the enclosure door seals, the team concluded that the door seals had degraded for two reasons. First, the original security door lock was replaced with a simple latch in May 1988. This change appears to have increased the original 3/16-inch gap at the door edge; however, the licensee did not appear to consider the impact of this change on the operability of the MCCs. Additionally, the licensee had not implemented a maintenance program for these barriers; this resulted in the failure to identify the absence of a gasket on a portion of the MCC B51 enclosure door and undersized gaskets around the MCC B61 enclosure door.
The licensee's problem identification and corrective action processes failed to identify and correct the excessive door seal gaps that could compromise the environmental integrity for the enclosures surrounding MCCs B51 and B61 in the event of an accident. This deficiency appears to have existed since May 1988, when the door locks were replaced. In response to questions from the team, the licensee issued ACR 7958 on March 19, 1996. The licensee reported this deficiency in LER 96-018, issued on April 18, 1996, and identified the cause of the excessive door seal gaps to be a weakness in the existing program to inspect and verify the integrity of environmental protective barriers.
The failure to promptly resolve deficiencies in the analysis and design of the MP2 MCC environmental enclosures and the failure to identify and correct inadequate barrier seals constitute an apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action." (EEI 336/96-201-20)
4.1.2 Battery Degradation (MP3)
The team reviewed the maintenance history of selected MP3 electrical components. The team observed that in 1995, battery 6 (associated with bus 3010-1), was cycled through eight equalizing charges immediately followed by surveillance testing. During this period, there were two test failures and several cells showed a decline in performance.
The licensee identified the degradation of this battery in ACR 1163, dated September 23, 1995. The ACR indicated that five battery cells had failed in the previous 4 months. The ACR was closed out when the cell voltages recovered; however, the problem'of cells failing recurred in later months. In addition, the periodic surveillances were scheduled to be performed '
immediately following equalizing charges; the team considered this to be a case of surveillance test preconditioning, which tended to prevent the identification of battery degradation. ,
l l
Battery 6 is classified as nonsafety-related, however, Abnormal Operating Procedure (A0P) 3563, Revision 4, directs remedial actions in the event of the loss of the battery 6 bus and requires a manual reactor trip and the performance of E0P E-0, " Reactor Trip or Safety Injection." The battery 6 bus
, powers the main generator automatic and manual voltage controls, the steam jet I air ejector, and the moisture separator drain tank emergency level control j valves. Although the loss of the battery 6 bus will probably not result in an j
,, immediate automatic plant trip, the less of this bus is significant and will ;
complicate the operator response to a plant transient; therefore, A0P 3563 I requires the operators to manually trip the plant.
A0P 3563 indicates that this bus also supports the automatic fast-transfer capability for the 4160-V safety bus. However, the licensee stated that some of the listed loads and the respective load descriptions in this A0P were incorrect. These errors could provide additional, unnecessary challenges to operators during the response to a plant transient. The licensee indicated that the procedure errors would be corrected.
In response to the team's concerns about the vulnerabilities of this battery, the licensee initiated ACR 10522 on April 10, 1996. Recognizing the trend of failures and the difficulty in recovering individual cell voltages, the licensee stated that it had decided to replace the battery, and a specification was issued for the procurement of a new battery on April 25, 1996.
Although the battery is classified as nonsafety-related, the team considered the licensee's response to the degraded battery to be another example of weakness in the licensee's ability to identify and promptly correct degraded equipment problems.
4.1.3 Unsecured I-Beam Above Safety-Related Components (MP3)
During a tour of MP3 on March 12, 1996, the team found temporary I-beams installed above three of the four recirculation spray system (RSS) heat exchangers. The licensee reported this condition to the NRC on March 13, 1996, in accordance with 10 CFR 50.72, after determining that the temporary I-beams had the potential to render one heat exchanger in each train of the RSS inoperable during a seismic event. The I-beams were also located over the RSS suction valves from the containment sump, which created the potential for a breach of containment during a seismic event.
In response to the team's questions, the licensee speculated that the I-beams were installed to serve as an attachment for chain falls used to remove the top head of the heat exchangers for periodic inspections and cleaning during past outages. The licensee stated that there was no documentation supporting the installation of these I-beams. The licensee and the team were unable to determine when the I-beams were' initially installed. However, on the basis of
'
discussions with the licensee and the observed condition of the I-beams, it was apparent that the I-beams had been in place for at least several years.
Once identified by the team, the licensee removed the I-beams and initiated ACR 10382 to perform an engineering review of the historical impact on plant
'
_ _ _ _ _ . _ . _ _ _ _ _ __ _ - . _ _ . _ _ _ _ _ _ ._ _ __ _
I i
l
operations. Following the engineering review, the licensee determined that '
'
the RSS heat exchangers could have been rendered inoperable during a seismic ,
event. As such, a condition existed that was outside the design bases of the plant in that the potential existed for a seismic event to render both trains of RSS inoperable. . ,
r In response to this event and as corrective action to ACR 10382, the licensee !
stated that it plans to change its work control procedures to incorporate , l temporary equipment restraint instructions. These instructions had previously !
been developed and incorporated into the licensee's Material Condition Program ;
'
Manual used by licensee supervisors. However, the guidance was not made readily available to workers in the work control procedures. The team found !
that the guidance provides sufficient instructions on appropriate methods for i restraining temporary equipment installed near safety-related equipment. ;
The as-found condition of the temporary I-beams could have had a significant impact on the safe operation of the facility by creating a common-cause failure of both trains of the RSS. The licensee had no instructions or technical justification for the installation of the temporary I-beams above i the RSS heat exchangers. In addition to its concern about the lack of '
appropriate procedures, the team was concerned that this condition had existed i for several years and had not been questioned by the licensee. The failure to promptly identify and correct a significant condition adverse to quality is an
,
,
apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective !
'
Action." (EEI 423/96-201-21)
!
, 4.1.4 Inadequate Control of Scaffolding (MP3) :
i During a tour of MP3 on March 12, 1996, the team noted that three of the four !
RSS heat exchangers had scaffolding installed around them. 'The licensee j indicated that the scaffolding had been installed to enable operator access to !
valves located above the RSS heat exchangers and to enable periodic heat exchanger' cleaning. The team observed several scaffold tubes and wood planks j in physical contact with the heat exchangers. In general, these scaffolding installations did not appear-to provide adequate clearance between the i scaffolding and safety-related equipment. The licensee's current engineering :
guidance in Attachment 10 " Scaffolding and Ladders," to Work Control (WC) l Procedure 1, " Work Control Process," stated that a 2-inch minimum seismic shake space is needed between scaffolding and safety-related equipment. i l
In response to the concerns identified by the team, the licensee issued ACR I 10383 on March 12, 1996. During a subsequent walkdown, the licensee found ,
, additional installation deficiencies in the scaffolding around the RSS heat r exchangers. In response to the concerns noted by the team and by the licensee ;
during its own walkdown, the licensee evaluated the impact of each deficiency ,
on the operability of the affected components and systems. From a historical i perspective, the licensee determined that the scaffolding installation i deficiencies did not affect the operability of the RSS heat exchangers or *
l other components or systems. The licensee removed the scaffolding around heat '
exchangers B and D and modified the scaffolding around heat exchanger C to correct the deficiencies. ,
.- - . - .
. . _ _ ___ __ _ _ _ _ .-. _ _ - _ _ _ _ _ _ . _ ._ _ . _ _ _ _
i
- The' team reviewed the AW0s for installation of the scaffolding around the RSS
- heat exchangers. Although it could not be confirmed from the AW0s, it appeared that the scaffolding around the three RSS heat exchangers had been i installed at different times in 1991, and that the scaffolding around RSS heat
- . exchangers 8 and D was later modified on December 31, 1992. The AW0s for
- scaffolding around the RSS heat exchangers B and D did not contain clear
- instructions for maintaining adequate clearances between the scaffolding and
, the safety-related equipment. The AWO that contained installation
, requirements for scaffolding around RSS heat exchanger C contained ,
- instructions to avoid interfering with vital equipment and to confirm the
- installation before closing out the AWO. i i l j The team found that the licensee had missed several opportunities to identify
'
the deficient scaffolding installation around the RSS heat exchangers.
Temporary modification controls were used to control the scaffolding
- installation in 1993. These B/Js were reviewed on a monthly basis until June 1 1994. When the scaffolding control program was revised in 1994, long-term
, scaffolding was not walked down to ensure compliance with the revised
! requirements. In February 1995, after questions by the NRC, the licensee !
performed walkdowns of all long-term scaffolding, including the scaffolding
'
l around the RSS heat exchangers. In April 1995, the NRC issued an NOV for the i licensee's failure to ensure that scaffolding was installed as required (see i the discussion in Section 4.2.3). In response to this NOV, the licensee i walked down all of the scaffolding installed in MP3. In addition, following
.
the revision of scaffolding control requirements in Revision I to Attachment 10 of WC-1 in April 1995, the licensee was required to perform routine walkdowns and installation reevaluations every 6 months. The licensee did not i- - find any deficiencies with the scaffolding surrounding RSS heat exchangers B, i l C, or D when the.B/Js were issued and reviewed, or during any subsequent j
- scaffolding walkdowns, until questioned by the team. l 4 !
The scaffolding deficiencies noted by the team are indicative of a weakhess in !
- the licensee's ability to identify conditions adverse to quality. The.
- licensee has taken steps to improve the control of scaffolding installed
- around safety-related equipment; however, continuing installation problems are i
'
evidence that the licensee's control of scaffolding is not fully effective in ensuring that safety-related equipment is not adversely impacted.
4.1.5 RPCCW Temperature Above Piping Analysis Limits (MP3)
The team reviewed portions of the licensee evaluation and response to ACR 7269 that had been issued on January 16, 1996. The ACR documented that the maximum i
'
assumed water temperature of 115 *F for the reactor plant closed cooling water (RPCCW) system as described in UFSAR Section 5.4.7.3 and Table 5.4-7 had been j exceeded during an MP3 shutdown in May 1990. The actual peak RPCCW
- temperature recorded was 143 *F and was at the RPCCW discharge flow from the i outlet of the residual heat removal (RHR) heat exchangers. The potential for i *
RPCCW temperatures to exceed design-bases assumptions during plant shutdowns
> is a subset of a broader set of concerns regarding the design and operational
! parameters that affect the ability of the licensee to achieve safety grade cold shutdown (SGCS) consistent with the description in UFSAR Section
]
'
5.4.7.2.3.5, " Safety Grade Cold Shutdown." Previously, the NRC addressed i 45
4
-
3
- __ _ - - _ . _ _ _ _ _ _ _ _ _ __
_ . . _ _ _ _ _ _ _ _ _ . . . _ - _ _ _ _ . . . _ ____ __ _ _ __
various aspects of the SGCS issue in NRC Inspection Reports (irs) 50-423/94- t 32, 50-423/95-20, and 50-423/96-01. Further, NRC unresolved items 50-423/94-32-02 and 50-423/96-01-07 remain open to evaluate the broader technical implications of the SGCS issue.
.
The team reviewed various aspects of the licensee's corrective actions to ensure that appropriate documentation and evaluations would be conducted if the RPCCW system design maximum temperature was to be exceeded during plant . ,
shutdown. OP 3208, " Plant Cooldown," had previously provided instruction to
'
operators to maintain RPCCW system temperature below 115 *F. However, Revision 14 to OP 3208, issued on April 12, 1995, added instructions to ensure ,
that operators issue an ACR and notify system engineering personnel if the 1 RPCCW system temperature exceeds 115 *F. The team reviewed RPCCW operational data from a December 1, 1995, MP3 shutdown. The data, acquired from the plant process computer, revealed that the RPCCW temperature at the outlet of RHR heat exchanger A exceeded the 115 *F limit and reached a maximum temperature of 120 *F. Review of control room logs indicated that no entries had been made during the shutdown regarding abnormal RPCCW temperatures.
Subsequently, the licensee reviewed RPCCW system temperature data from other recent MP3 shutdowns and identified two other occurrences in which the RPCCW system maximum temperature of 115 *F had been exceeded. Specifically, during :
an April 15, 1995, shutdown, the RPCCW temperature at the outlet of the B RHR heat exchanger reached a maximum of 118 *F, and during a September 9, 1994, shutdown, the RPCCW temperature at the outlet of the A RHR heat exchanger i remained slightly above 115 *F for several hours. During each of these i occurrences, the operators failed to either maintain the RPCCW temperatures '
within system design limits, or to document the conditions on ACRs and make appropriate notifications to system engineering personnel.
MP3 TS 6.8.1.A requires that procedures be established, implemented, and maintained covering the activities recommended in Appendix A of RG 1.33, Revision 2, February 1978. Appendix A to RG 1.33 states that startup, operation, and shutdown of safety-related pressurized water reactor systems should be covered by written procedures. OP 3208, " Plant Cooldown," Revision 16, Steps 4.3.10 and 4.3.11, requires the operator to monitor RPCCW return temperatures from the outlet of the A and B RHR heat exchangers to ensure the design maximum RPCCW temperature of 115 *F is not exceeded. The procedure also requires that operators initiate an ACR and notify system engineering personnel if this temperature is exceeded. This procedural instruction.has existed since Revision 14 of OP 3208 was issued on April 12, 1995. Previous revisions of OP 3208 required operators to maintain the RPCCW temperatures below 115 *F. Contrary to the above, the team identified that during a shutdown on December 1,1995, MP3 operators failed to maintain RPCCW below 115
"F and failed to initiate an ACR to document and notify system engineering that the temperature had been exceeded as required by OP 3208. Subsequent to the team's identification of this occurrence, the licensee identified that during MP3 shutdowns on September 9, 1994, and April 15, 1995, that the RPCCW ,
temperature limit of 115 *F had also been exceeded. This is an apparent violation of TS 6.8.1.A. (EEI 423/96-201-22).
.
1 i
!
_. _ _ __.
. _-- .-. l
!
l 4.1.6 Control Room Voltmeter Indication Discrepancy (MP3)
Operating Procedure OP 3344A, Revision 10 "480 Volt Load Centers", contains operating instructions for placing in service, cross-tying, and aligning 480-V
. load centers. This procedure states that the bus voltage at the load center should be between 424 V and 506 V to prevent damage to equipment. During an MP3 plant walkdown on May 14, 1996, the team observed that control room
. voltmeter MB8 for the Train B 480-V emergency bus load center 32X (3EJS*US- ,
4B(-P)) indicated that the bus voltage was 510 V and the local voltmeter at !
the bus indicated 485 V to 490 V, depending on the phase measured. The i indicated voltage on control room voltmeter MB8 was above the maximum high- l voltage limitation (506 V) required by OP 3344A; and since there are no logs l of load center bus voltage taken by the control room operator, the operator '
was not aware that the meter indication exceeded the high-voltage limitation.
The team reviewed Calculation NL-038, " Station Service Study Voltage Profile,"
Revision 2, including CCN 4, dated October 20, 1995, which demonstrates that .
the maximum calculated acceptable load center bus voltage is 510 V, based on i light load conditions and the switchyard at 366 kV. Therefore, the indicated I voltage on voltmeter MB8 was at the calculated upper design limit (510 V) in !
addition to exceeding the maximum voltage limitation (506 V) of OP 3344A.
l Voltmeter MB8 is calibrated in accordance with Generation Test Services 1 Procedure CPT 1407, Revision 0, " Panel Meter and Transducer Calibration." The ;
calibration procedure, CPT Form 1407-2, indicates that the acceptance range I for voltmeter MB8 is 112 V; and the as-found condition indicates the meter was l reading high by 10 V during the last calibration, performed on July 27, 1994..
The licensee. initiated ACR 13246 on May 14, 1996, in response to the team's observation and performed a calibration check of control room voltmeter MB8.
The meter was found to be beyond the 112-V acceptance range, because of a +15- i V zero shift of the meter. The voltage on load center 32X measured as 494 V, !
and control room voltmeter MB8 was adjusted and recalibrated; the as-left ,
reading of voltmeter MB8 was 492 V. Although.the licensee concluded that the !
voltmeter was out of calibration and that the actual voltage on load center .
32X was within design limits, this issue is another example of a weakness in '
i the licensee's ability to identify deficiencies and the failure to translate design-bases operating restrictions into procedures.
4.1.7 Service Water Booster Pump Jumper (MP3)
The team reviewed B/J 390-20, initiated on May 3, 1990, which changed the starting circuits for the service water supply to the MCC/RCA air handling units. (This issue is also discussed in Sections 2.2 and 5.3 of this report.)
The team noted that B/J 390-20 was still in place, as of March 1996. However, a special instruction to manually restart the booster pumps following a LOP,
'
which was included in the original B/J documentation, was no longer incorporated in the licensee's annunciator response procedures.
The team noted that the original system design ensured that the SW booster pump supply to the McC/RCA air handling units was maintained after a LOP reset
. _ - . _ _ . _ _ _ _ _ . _ . _ _ _ _
________._y
l i-i !
i action without relying upon operator action. The special instruction required l t
operator manual action in place of the automatic feature of the original '
design. At the time the B/J was installed, an annunciator response procedure contained the B/J special instruction. However, the procedures were subsequently revised and the step was deleted. .
)
In response to the team's questions, the licensee initiated ACR 10782 on :
March 20, 1996, and subsequently revised the annunciator response procedure. ,
In addition, the licensee reviewed all outstanding B/Js to confirm that !
special instructions were appropriately implemented. !
The team also found that the high-temperature switches in the return duct, l which had originally.sent an open signal to the MOVs, had not been transferred i to the booster pump start circuitry when the B/J was installed. As a result, i the automatic feature to have the booster pumps start on high temperature in !
the return duct was disconnected by the B/J. On March 23, 1996, the licensee j initiated ACR-10795 to address this concern. Operators started and operated !
the booster pumps continuously until the issue could be resolved. On April ;
19, 1996, the licensee submitted LER 96-05, which concluded that the bypassing i of this automatic start feature represented a condition outside of the design j bases.
The team reviewsd the history of actions taken by the licensee and determined that there had been previous opportunities to identify the technical ;
weaknesses of B/J 390-20. The team noted the following opportu11 ties:
'
- Engineering performed a technical-assessment and safety evaluation to support the original installation of B/J 390-20 in May 1990. The :
evaluation did not address the basis for the special instruction that ,
was included in the B/J. In addition, the evaluation did not address '
the bypassing of the high-temperature start function. The PORC reviewed i and approved the B/J and its associated evaluations before the B/J was i installed.
- The Operations Manager is required to conduct a monthly audit on all B/Js. The' audit requirements called for a verification of all tagging.
Although the Operations Manager was not required to verify special !
instructions, the team noted that_the instructions were documented on ;
the same page as the tagging. Between the original B/J installation and ,
the team's review, the Operations Department performed approximately 70 '
monthly reviews. ;
- The licensee's procedures required that the PORC review all B/Js more !'
than 3 months old to determine whether a_ permanent repair or modification should be performed and to review the implementation date of the modification. The PORC had reviewed B/J 390-20 four times and had extended the implementation date of a permanent modification to July 1996. , ,
- The B/J procedure also required that the Unit Director review a justification for the extended use of the B/J and, at the time ,
l
!
.. _ _ _ _ _ ,
. _ . . . . _ _ _ _ _ _ _ _ _ _ _ . _ . - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
B/J 390-20 was installed, the procedure required the Vice President of Nuclear Operations to review a quarterly summary.
In June 1990, Engineering submitted an FSARCR to Licensing that more
. accurately described the original design of the SW supply to the MCC/RCA coolers. The change request was initiated in response to an NOV in NRC IR 50-423/89-23, dated February 26, 1990. The revised UFSAR section
, discussed the high-temperature start function in the return duct. The team noted that the FSARCR involved some of the same engineers who had performed the technical evaluation for the B/J.
In May 1993, the licensee identified that the temperature switch in the return duct for one train was in the same area as the other train, representing a potential conflict with 10 CFR Part 50, Appendix R, equipment separation requirements. They established a firewatch until separation could be properly achieved. The team noted that a considerable amount of engineering review had been performed to assess the technical significance and the reportability of this issue.
However, the team found no review of the impact that this' issue had on B/J 390-20 or any recognition that the temperature switch in the return duct would not perform one of its functions.
The D8DPs issued in August 1994 for both SW and ventilation systems stated that the high-temperature start in the return duct had been disabled by B/J 390-20. The DBDPs referenced several documents as the bases for this action. The team reviewed the associated references-and did not find any which discussed the bases for defeating the high-temperature start in the return duct.
=
In late.1994, Engineering was in the process of performing final reviews of a design change to permanently install- the B/J. During the review, the licensee found that to meet the original design criteria, the SW pumps had to remain running after resetting a_ LOP without operator action. Engineers revised Plant Design Change Request (PDCR) 394-099 and rescheduled its implementation. They did not, however, reevaluate the B/J on the basis of this issue.
On April 19, 1996, the licensee submitted.LER 96-05 to report both the defeated high-temperature start in the return duct and the deleted LOP reset special instruction as conditions that were outside the design bases of the plant. The "Cause of Event" evaluation contained in LER 96-05 stated the following:
The original review of the B/J at the Engineer, Supervisor, and Plant Operating Review Committee level failed to identify the entire impact of the B/J. Dnce installed, there was no subsequent
requirement.to verify the accuracy of the work. The operating procedure steps at the time of jumper installation in 1990, r addressed operator response to high temperature in the MCC and
.
RCA. These procedure steps were deleted in a subsequent revision
!' because the relevance to the existing B/J was not understood.
- i
i
!
!
-,, . . , .
__ ..__ _ _ __ -..___.._ _. . _ _ . _ _ _ . _ _ _ . _ _ _ . _.
l
!
The evaluation of safety significance in LER 96-05 concluded that SW supplied {
to the MCC/RCA cooling unit would be adequate in most scenarios without the l booster pumps running. The analysis did indicate that cooling may not be :
sufficient in those cases in which a LOP or other event prevented the l isolation of the SW supplies to turbine plant component cooling water. . !
However, the analysis did not discuss what events this could be applicable to i and how the consequences may be mitigated. Additionally, the LER referenced a test of the air handling unit cooling coils'that had been performed in , ;
December 1995 as supporting evidence that the MCC/RCA temperature would rise i slowly. The team reviewed the test and noted that the licensee had not !
analyzed the test data. Further, six space heaters had been used to simulate heat loads, but the System Engineer had not determined how the heat produced ,
by these heaters compared to accident heat loads. l
The LER stated that permanent modifications would be implemented to correct !
the problems. The LER did not discuss any corrective actions regarding the !
B/J program, such as changes, either past or planned, to improve technical evaluations, subsequent periodic reviews, and timeliness of resolution. The '
team noted that several actions that had been taken were not documented in the !
LER. The team was subsequently told that the licensee planned to submit a revised LER.
Considering the number of outstanding B/Js and the fact that B/J 390-20 was in i place for more than 6 years, the team concluded that plant management had not ,
placed sufficient emphasis on promptly resolving design deficiencies. !
Although plant management had recently been placing greater priority on resolving B/Js and had been discouraging the use of new B/Js, detailed reviews of existing B/Js have not been performed to assure their technical adequacy.
The team further concluded that (1) the technical evaluation performed for l B/J 390-20 was inadequate because it did not address the defeat of one automatic actuation and the substitution of a manual action for an automatic ;
feature; (2)_ the licensee missed several opportunities to identify the i technical inadequacies of B/J 390-20; and (3) the LER submitted for conditions !
outside the design bases was incomplete because it did not identify the cause ;
of the weak technical review, provide a thorough assessment of safety '
implications, or discuss corrective actions taken to improve the B/J process.
The licensee's multiple failures to identify and correct the deficiency l introduced by the installation of B/J 390-20 constitute an apparent violation ]
of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action." ;
(EEI 423/96-201-23)
4.1.8 Concrete Spalling on Service Water Booster Pump Pedestal (MP3)
. On May 20, 1996, during a walkdown of the MP3 service water system, the team observed that the concrete pedestal for SW booster pump 3SWP*3B was spalled.
The damaged concrete was at the pump end of the pedestal. It appeared that condensation and pump seal leakage had soaked the concrete, causing the rebar ,
to rust and expand. The team asked the licensee if this condition had been previously identified and questioned the impact on the structural integrity of the pedestal. , ,
_- - _ _ _ _ _ - - _ . _ . _ . . .-. _ . . - _ - - -
. - . _ - ._-- .. - . - - - - - .- . . -_
i The licensee determined that this condition had not been previously identified. Additionally, on May 21, 1996, a civil design engineer examined the pedestal and determined that the concrete under two anchor bolts at the i pump end appeared significantly degraded and that the two bolts did not extend
'a past the pedestal and into the floor. The engineer concluded that the ability
- of the pump to withstand a seismic event could not be determined and SW
'
Train B was subsequently declared inoperable. The licensee initiated
,
, ACR 12877, and performed walkdowns of the concrete pedestals for other a components.
.
The discovery by the team of this degraded condition that had existed for an
! extended period -- a condition that resulted in the licensee declaring a
- component inoperable -- is an apparent violation of 10 CFR Part 50, Appendix
-
B, Criterion XVI, " Corrective Action." (EEI 423/96-201-24)
4.2 Corrective Action Trackina and Trendina 4.2.1 Testing of Dual-Function Valves (MP2)
The team reviewed the licensee's corrective actions associated with LER 93-023-01 and NOV 50-336/93-20-06, which pertained to the maintenance and testing of MP2 dual-function containment isolation valves. The licensee's valve maintenance and test program had failed to specify the proper bench settings for certain pneumatic valves. In particular, the maintenance procedures and testing for containment isolation valves which also serve the function of line break isolation did not specify the proper bench settings and retest requirements. This condition resulted in certain containment isolation valves being unable to close against full system pressure in performing their line-break isolation function. This deficiency had been identified in NRC IR 50-245/93-27, 50-336/93-20, 50-423/93-23 and was documented as NOV 50-336/93-20-06. The licensee committed, in both the LER and its response to the violation, to provide before May 6,1994, procedures with adequate detail for bench settings on other pneumatic actuators. Additionally, the licensee committed to specify the retest requirements for verifying that the valves would be capable of isolating against full system pressure as well as containment design pressure for all valves that functioned in a dual role.
On June 8, 1995, the licensee discovered that it had not met its commitment to identify all of the dual-function containment isolation valves, revise the procedures, and specify the appropriate retest requirements by May 6, 1994. In response to this failure to satisfy the commitment, the licensee initiated ACR 01935 to track the corrective actions. In March 1996, the team determined that the licensee had still not resolved the deficiencies, despite the issuance of this ACR. The licensee stated that the corrective actions i associated with ACR 01935 had been " lost" in the system. The licensee initiated ACR 9623 on March 20, 1996, in response to the team's identification that the planned corrective act' ions still had not been implemented. In
'
response to ACR 9623, the licensee identified 75 valves in MP2 which were affected by this condition. As of May 22, 1996, the corrective actions associated with revising the applicable maintenance procedures and satisfying the applicable retest requirements were scheduled to be completed by August
'
24, 1996. The team concluded that the licensee's failure to implement planned
'
_ _ _ . _ _ _ _ _ _ _ _ __._._ _ _ _ _ ._ _ _ __. _._. .. _ _ _ . _ _ _ _ _ _ _
corrective actions in response to an NOV for more than two years, and the l failure to effectively track those actions, represents a significant breakdown in the corrective action process.
The licensee's failure to implement prompt corrective action in response to .
!
identified conditions adverse to quality is an apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action." (EEI 336/96-201-25) ;
'
4.2.2 Errors in Electrical Drawings (MP3) !
The team reviewed the results of a recently conducted QAS audit concerning the !
document control program at Millstone (Audits A60582, A60583, and A60584, :
dated April 22,1996). The objective of this audit was to verify that an adequate process existed to maintain specified quality-related documents, including accurate plant drawings and DBDPs, and that the associated processes were properly administered. Additionally, this audit evaluated the effectiveness of corrective actions within this area.
t The results of this audit, which were summarized during the QAS exit meeting l attended by the team on March 28, 1996, noted that existing lighting panel electrical drawings did not accurately reflect as-built plant configurations >
for MP1 and MP3 and that these conditions represented a potential safety ,
hazard to personnel and equipment. ACR 8655, dated March 28, 1996, classified !
this discrepancy as a significance Level B occurrence, based on the loss of l configuration control, workaround processes, and management's failure to take .
prompt corrective action. As noted in the audit report, the licensee i identified a similar drawing control deficiency in 1992, following an elevator ;
fire in the MP2 containment. In that case, the drawing inaccuracies resulted '
in delays in isolating power to the elevator lighting fixture, which hindered !
the licensee's efforts to put out the fire. Although engineering personnel :
subsequently conducted MP2 walkdown verifications of 100 percent of the
'
affected lighting panels, no corresponding verification activities.have been performed for MP1 and MP3. QAS identified seven ACRs for MP1 issued since August 1995, involving electrical lighting panel schedules and drawings that did not accurately reflect plant configurations. The audit further documented that the MP1 electrical maintenance department stated that it had initiated approximately 15 ACRs during the prior year involving this issue; but these had been addressed on a case-by-case basis, comprehensive corrective actions were not taken.
The failure to appropriately address the generic safety implications of this event was noted both in the audit report and ACR 8655 as a significant vulnerability for MP1 and MP3 which had received inadequate management attention. Furthermore, as determined by the team, inaccuracies related to ,
control wiring diagrams (CWDs) for MP1 were also the subject of two previous l Level B ACRs which have remained open since their identification in July 1995.
Specifically, ACR 3822 and ACR 3824 documented configuration control and tag-out deficiencies related to CWDs that did not reflect current design ,
'
information.
Despite the identification of these potentially significant personnel and ,
equipment issues and the repeated opportunities that have been afforded the
_
. - - _ _ - .
- - - - - - . _ - - - .. - - - - - _.- - - - - - . - - .
licensee to address these design control deficiencies, as of May 22, 1996, no corrective actions had been taken in response to ACRs 3822 and 3824, and the root cause evaluation response related to ACR 8655 was overdue. Although the electrical drawings in question were not safety-related, the potential impact
. of errors-in these drawings was demonstrated by the MP2 containment elevator fire. The team concluded that the licensee's failure to correct identified'
l deficiencies, which were entered into the formal ACR process, was an
, additional example of a weakness in the implementation of the corrective action program.
l 4.2.3 Scaffolding Deficiencies (MP3)
l During an MP3 walkdown on March .12,1996, the team noted that scaffolding l around chiller 3HVQ*ACUlA was physically braced against a bracket directly l attached to the chiller's ducting. The scaffolding around the chiller was l installed to enable inspection and repair of SW piping above the chiller. As discussed in Section 4.1, the licensee issued ACR 10383 concerning
'
l deficiencies with scaffolding near the RSS heat exchangers. The licensee's
,
assessment performed as a result of ACR 10383 included a review of the impact
'
of scaffolding near the chiller. After the team pointed out the deficiency, the licensee removed the piece of scaffolding braced against the ducting.
AWO M3-95-27307 contained instructions for installing the scaffolding around ,
! the chiller on January 3, 1996. The supplementary instructions in AWO M3-95-27307 provided guidance to maintain a clearance of 2 inches around all safety-
!
related' equipment or to ensure that the scaffolding was securely clamped to a steel structure to prevent seismic interaction. Attachment 10, Revision 1, to WC 1, " Work Control Process," Step 1.4.1, requires the first-line supervisor to verify that the scaffolding is erected as specified in supplementary instructions provided by a work-processing engineering representative. With the scaffolding braced against the chiller's ducting, the minimum spacing required by the AWO was not established. The team concluded that the responsible supervisors did not adequately verify that the scaffolding surrounding the chiller was erected as specified, contrary to the requirements of Step 1.4.1 to Attachment 10 of WC-1.
The team's identification of this conditior is of concern because it represents a recurrence of a violation of scaffolding controls as discussed in NRC irs 50-423/95-07 (issued April 26, 1995) and 50-423/95-25 (issued August 9,1995). IR 50-423/95-07 documented the licensee's failure to ensure that adequate spacing was maintained between safety-related equipment and scaffolding. The licensee's corrective actions in response to the violation included walkdowns of other scaffolding, which did not identify any other nonconforming conditions; the issuance of Revision 1 to WC-1, which provided more detailed instructions for the supervisor to verify scaffolding erection; the briefing of construction supervisors and general foremen on the scaffolding discrepancies; and the briefing of the carpenters responsible for ;
erecting scaffolding at MP3 regarding their responsibility to maintain '
l adequate clearances when installing scaffolding.
'
In the causal factor corrective action plan prepared in response to ACR 10383, the licensee acknowledged that the corrective actions to the previous
.
, ,_ m.-., , , . - - , _ . - _ - -.m,_ ,
,_y., +
violation were not adequate to prevent recurrence. The licensee indicated in response to ACR 10383 that one.of the corrective actions was to add a requirement to WC-1 that maintenance engineering perform a post-installation ,
walkdown. Walkdowns by the licensee in response to the team's concerns and as '
corrective action in response to ACR 10383 discovered other scaffolding .
installed at MP3 that required correction. The licensee also reviewed all of !
the installed scaffolding to ensure up-to-date engineering evaluations had ;
been documented as required by Revision 1 of Attachment 10 to WC-1. .
The team reviewed the engineering evaluations performed to satisfy the requirements of Attachment 10 to WC-1 for the long-term scaffolding that had ;
been installed before the scaffolding program was changed in 1994. These engineering evaluations had adequate documentation and recommendations for minor modifications to the scaffolding to satisfy the requirements of ,
Attachment 10 to WC-1. The licensee issued AW0s to implement the recommendations made in the engineering evaluations.
The team found additional discrepancies during this inspection of scaffolding !
that had been in place when the walkdowns were performed in response to the violation documented in IR 50-423/95-07. On the bases of these additional ,
discrepancies with previously installed scaffolding, and the discrepancy with ;
the scaffc1 ding installed around chiller 3HVQ*ACUIA, the team determined that ;
the licensee's corrective actions in res not effective in preventing recurrence. ponse to the previous The scaffolding violation found configuration were i near the chiller represents a procedural violation of Step 1.4.1 in Attachn:ent 10 to WC-1. Also, the licensee's failure to take adequate corrective action :
to prevent recurrence of the violation documented in IR 50-423/95-07 !
represents an apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, i
" Corrective Action." (EEI 423/96-201-26)
4.2.4 Protective Relay Settings (MP3)
As described in Section 2.1, the team found that the protective relay setting criteria for safety-related motors prescribed in UFSAR Section 8.3.1.1.4.2.e were inconsistent with the control setting sheets and criteria used in i calculations within NUSCO Specification SP-EE-321, and the criteria in " Stone
& Webster Engineering Protection Philosophy," NERM-46.
In response to the team's concerns in this area, the licensee initiated two ACRs. ACR 10519, dated March 20, 1996, provided an operability assessment which concluded that, although the settings of certain relays were inconsistent with the NERM-46 criteria and the UFSAR requirements, protection 1 of equipment and electrical coordination were adequate for the installed configuration. ACR 10785, dated March 22, 1996, investigated factors that ]
contributed to the inconsistent relay settings and controlling design-bases documentation. Initially, NERM-45, " Stone & Webster Engineering Protection Philosophy, Station Service Profection Philosophy," dated March 29, 1977, and NERM-46 had been used by the licensee and Stone & Webster as design criteria for protective relay settings. However, certain relay settings calculated in
.
NUSCO Specification SP-EE-321 deviated from the NERM criteria because it was judged that the NERM criteria were more restrictive than criteria in industry standards. '
__. .. .
- - _ - . _ - - . _ - - - - - - _ - - _ _ . - _ . -
'
.
To resolve issues raised by the team, the licensee conducted a complete review of relay settings and criteria. The licensee noted that the following .
l corrective actions were necessary to resolve the setting deficiencies: (1) l
! revise UFSAR Section 8.3.1.1.4.2 to eliminate discrepancies with respect to
. the design criteria; (2) revise Specification SP-EE-269, Revision 0, *
" Electrical Design Criteria," dated June 16, 1988, to modify the design
! criteria of NERM-45 and NERM-46, and to resolve a number of relay setting ,
i , discrepancies; (3) incorporate numerous calculation changes in Specification >
,
SP-EE-321 to eliminate conflicting information; and (4) reset the long-time i l inverse overcurrent unit for Quench Spray Pump Motor 3QSS*P3B. ;
The team noted that the licensee had been aware of some design control weaknesses with respect to protective relay setpoints. DCN DM3-S-0677-93, dated August 12, 1993, documented that NERM-45 and NERM-46 were uncontrolled i design criteria for setting protective relays; and these criteria needed to be controlled by incorporating the information into NUSCO Specification SP-EE-269. Although the issuance of DCN DM3-S-0677-93 immediately made NERM-45 and NERM-46 part of Specification SP-EE-269, the licensee did not perform a comprehensive evaluation of the protection philosophy criteria, UFSAR, and the :
installed configuration. The licensee told the team that the criteria and '
UFSAR discrepancies were not previously identified; however, the licensee had found some instances of relay setting discrepancies in the past. These discrepancies were treated as isolated occurrences. The licensee stated that the discrepancies found by the team had existed in the UFSAR since the plant '
was built.
The team concluded that the licensee was aware that the design criteria for i setting protective relays'were inconsistent and had identified discrepancies in the past, yet did not perform a comprehensive evaluation of the protection philosophy criteria, the UFSAR, and the installed configuration. In one case, the actual relay setting needed to be reset to conform with the design criteria. The licensee's failure to identify a condition adverse to quality and to take the necessary corrective actions to resolve the deficiencies is an apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action." (EEI 423/96-201-27)
4.5.5 Corrective Action Tracking Weaknesses (MP2 and MP3)
The team reviewed ACR 08987, dated February 6,1996, which documented a programmatic weakness in the. implementation of the AITTS and the corrective
, action process. In particular, this ACR documented the licensee's failure to
'
track the status of 56 incomplete ACR-related assignments that, because of inadequacies in the AITTS program, were reported as " lost." As described in i the subject ACR, the AITTS database erroneously indicated a " complete" assignment status; however, there was no objective evidence to substantiate ,
the' closure of the 56 ACRs. This ACR further indicated that management !
'
guidance had not been promulgated to define what constituted " completion" of
'
an AITTS assignment and that no program existed to periodically review ACRs l that were in an indeterminate status. The ACR' identified the following additional problems: generic concerns related to incomplete AITTS assignments, delays in the implementation of corrective actions, and the improper maintenance of safety-rehted records.
!
l l
l
.-. - - .- .- . -- - _ --
__ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ . _ _ .__ _ _ .___._
'
!
r
'
!
- In response to these deficiencies, the licensee developed corresponding AITTS I j action assignments to track the resolution of these issues. The licensee also j issued Revision I to the Management Action Plan for the Millstone corrective j action program on May 21, 1996,
,.
., ,
, The team raised a related concern about the premature closure of AITTS
- assignments on the basis of proposed corrective actions. The team found that i this weakness in the licensee's corrective action program applied to both .
'
! Haddam Neck and Millstone; this issue is discussed further in NRC IR 50- !
- 213/96-201.
'
i
- 4.3 Self-Assessment /0uality Verification
!
'
4.3.1 Implementation of Corrective Actions (MP2 and MP3) I i
'
j- The team evaluated the results of an independent assessment of the
- " Effectiveness of the Quality Assessment Process," performed by the Yankee i i
Atomic Electric Company (Yankee Atomic), dated April 12, 1995. The purpose of
- the Yankee Atomic assessment was to review the responsibilities, capabilities, l l and roles of the QAS organization in identifying and correcting conditions :
- adverse to quality. The results of this review generally confirmed the '
i adequacy of the QAS organization to correctly identify plant problems and to
{ correctly characterize their findings in a scrutable manner.
) However, this review also raised a significant issue that adversely affected !
l the ability of the QAS organization to perform its quality assurance (QA) !
-
function. Specifically, the assessment identified an apparent conflict in -1
- management's expectations of the QAS organization regarding how they were to
! implement their role of assessing quality. The assessment also stated that ,
.!
' the responses to QAS findings do not specifically close issues but generally provide line management's intentions to correct identified deficiencies. The l QAS organization is not required to review the corrective actions (if any are l taken) until the next audit, which is typically every 2 years. The assessment j further stated that the numerous instances of inadequate or incomplete i corrective actions identified by subsequent audits were a strong indication j that little emphasis was being placed on item resolution. ;
i i
Relative to the corrective action process, the~ Yankee Atomic assessment j indicated that there was "no apparent accountability for correction of 1 identified issues. It is the [ Yankee Atomic] Team's perception that the l existing corrective action programs are not effective in establishing and
-
forcing timely response to identified issues." The assessment concluded that j the problem identification element of the various corrective action processes i was successful in identifying significant issues, but the established
- processes routinely resulted in missed action due dates and missed l commitments. This observation supported the Yankee Atomic Team's conclusion j that QAS was capable of identifying pertinent problems; however, they had no i
corresponding role in getting the cognizant organizations to rectify deficient ,
l conditions. The assessment further stated that the observed lack of i accountability manifested itself strongly during the examination of the lack !
) of timely responses to audit and surveillance findings and the lengthy time periods that were required to implement corrective actions. As stated in the ,
'
i i i 1 i
i
. - ._ . - - _
-- . _ . - .
__ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _
- 1
!
i
$ ~
l
! assessment, "There appears to be no consequence for exceeding corrective I action due dates." ;
! i
The Yankee Atomic Team recommended the following actions for followup by l
- . licensee management: l 1 !
- * Senior management needs to choose either a compliance-based or
}, performance-oriented QA oversight and hold responsible organizations and i
- individuals accountable for timely and effective problem resolution. ;
4-i * Corrective action programs need to be reviewed to determine how to )
- assure that corrective actions are implemented on schedule. !
,
]
- Senior management needs to clarify the role of the QAS organization,
'
particularly if it is to be used as a mechanism to correct identified i
<
deficiencies.
! * QAS should develop a writer's guide to improve the quality of reports l and QAS should develop a rotational assignment program to broaden the i field experience of QAS personnel.
i i In order to determine the current status of the findings and recommendations i presented in the Yankee Atomic assessment, the team examined the relevant action request (AR) assignments in AITTS. The team observed that all of the
'
assignments had been closed out. However, in the team's judgment, no
'
, substantive corrective actions had been implemented in response to these assignments. Specifically,.these items had been closed out on the bases of f verbal understandings, anticipated actions, pending reorganizations, or i deferred actions. Thus, despite the significance of these third-party i' assessment findings and recommendations, few management initiatives had been implemented to correct the pertinent issues after more than a year.
- The team also reviewed QAS Audit Report 30336, " Millstone Licensing," dated l March 1, 1995, and assessed the licensee's response. The purpose of this
! audit was to verify that the licensing orr;2nization had established
- appropriate mechanisms to ensure control of regulatory correspondence and j commitments made by the licensee Although this audit revealed some notable
- strengths within the licensing s.,anizatim, several weaknesses were also
- found in two primary areas of concern.
! -The first area of concern involved the perception that reports to the NRC were i not as clear as they could be and that there was a widespread belief that
- plant problems were being justified legalistically. Although no specific
'
safety issues were identified during the audit, a concern was documented that
"there exists a feeling that the present licensing department culture could
'
allow one to develop." The aud,it report went on to state that, "This is a
major concern which must be addressed quickly and thoroughly by NU management,
- , and is a' level C finding" (Finding F-01).
i
{ The second area of concern raised in the audit involved licensing's i *
interactions with the respective unit organizations and generally related to i the lack of timeliness in the dissemination of LERs, commitment tracking, and J
j. 57
i
-
.. . - . -
. . . ._ - . - _ ,
. _ _ _ _ . _ _ _ _ _ _ _ _ _ .. _ _ _ _ _ _ _ _ _ _ _ _
i a
.
E the proper management review of technical information. Areas for improvement
- included the need for licensing to provide more specific guidance related to i UFSAR updates and the need to inform cognizant individuals before canceling TS
change requests.
j -
!- In response to the audit findings, an independent root cause evaluation was
? conducted and a report was issued on August 9, 1995. The independent
] evaluation generally confirmed the concerns expressed in the audit. ,
-
Additionally, the evaluation identified broader concerns beyond the j performance of the licensing organization, including a concern that management
actions in response to recent events typically consisted of, "a limited j initial response; no consensus on the need for corrective action; relying on ,
minimum regulatory requirements rather than on a specific safety analysis;
'
'
'
and/or a long time or strong management action was needed before a final
- solution was agreed upon." The independent evaluation stated that individuals ;
raising issues had to " persist and persevere" to assure that the issues were
- assessed thoroughly by management. The evaluation also stated that due to a
! lack of resources or because open items and commitments are sometimes lost or j forgotten, corrective action on issues may not be complete and effective.
'
In order to determine the current status of the corrective actions associated j with the QAS audit (Finding F-01) and the recommendations of the independent '
- evaluation, the team reviewed the applicable assignments in the AITTS. The team also examined a QAS memorandum to the Executive Vice President, Nuclear, j dated September 15, 1995, concerning the action plan for the response to Audit i A30336. The team determined that, as of May 22, 1996, Finding F-01 remains in
',
an open status because several of the fundamental issues identified in the i audit had not been adequately addressed. Among these were the need to rebuild i
regulatory confidence, including a review of licensing's technical position on
- matters of importance to the NRC and NU managers; the need to communicate to
! all NU employees the nature and results of the licensing audit, as well as the intended corrective actions; and the need to prevent recurrence of this issue.
.'
As described in the September 15, 1995, QAS memorandum:
- !
The QAS audit identified a perceived erosion of NRC l confidence in how NU addresses important nuclear issues. .
It also identified feelings shared by NU management personnel that we are not doing our best at resolving these issues in a timely and appropriate manner. The Root Cause Evaluation corroborates these findings, although it shifts the responsibility to NU management rather than just the Licensing department. The key point of both of these reviews is that a cultural problem, rather than a technical problem exists and must be-dealt with swiftly '
and effectively if we are ,to reach company goals.
The team concluded that, despite the confirmation of the audit findings '
reflected in the independent evaluation, the corrective actions that have been
,
taken to address the adverse conditions identified in the audit finding were inadequate. The team ascertained that minimal efforts have been expended to correct the root cause of this condition, to prevent recurrence, or to measure *
i
___ _. - _ _ _ _ _ . _ _. _ _ _ _ _ _ . _ _ _ _ _. ._ _ _ . _ _
i the effectiveness of these corrective actions. Specifically, the AITTS assignment relating to improving regulatory confidence through improved review l of operability determinations was inappropriately closed, based on a j memorandum which addressed MP1 UFSAR discrepancies. Another AITTS assignment
. for a QAS review of self-assessments, intended to determine whether management expectations for correspondence were being met, was still open.
. The team concluded that the failure to implement prompt-and effective corrective actions in response to the programmatic deficiencies identified in the April'12, 1995, Yankee Atomic assessment on the " Effectiveness of the Quality Assessment Process," and the March 1,1995, QAS audit of Nuclear l
Licensing, provided further indication of weaknesses in the corrective action
program.
4.3.2 Station Blackout Audit (MP2 and MP3)
l The team examined the results of a third-party evaluation entitled " Station
'
Blackout Assessment," Report 24-00116, Revision 0, dated October, 1994, which l
had been performed by VECTRA for the Millstone and Haddam Neck plants. (The
, team's review of this issue as it applies to Haddam Neck is discussed in NRC
IR 50-213/96-201, dated July 31,1996.)
'
The purpose of the third-party assessment was to review the implementation of the SB0 requirements delineated in 10 CFR 50.63, as documented in licensee l correspondence and in the respective NRC safety evaluation reports (SERs) for l each plant. The VECTRA report identified 13 issues related to MP1, 14 issues i for MP2, 11 issues for MP3, 16 issues for Haddam Neck, and 3 issues that were l applicable to all four plants. These findings included potentially inadequate i SB0 loading calculations, inadequate voltage drop calculations, and inadequate battery sizing calculations. Additional findings involved the effects on systems and equipment resulting from the loss of heat tracing during an SB0, emergency lighting and communications concerns, the adequacy of emergency diesel generator reliability programs, and discrepancies associated with the safe-shutdown scenarios for each of the four units. The report also recommended corrective actions to address each of the identified issues.
.
The team requested information related to the current status of the SB0 issues I raised in the VECTRA assessment. In response to this request, the team was
'
given a variety of documentation, such as EWRs, various memoranda, surveillance reports, an Independent Safety Engineering Group (ISEG) report, Action Requests (ARs), and ACRs. As determined by the team, at the time of ,
-the VECTRA assessment, no formal mechanism existed for tracking items that i were identified in third-party reviews other than assigning responsibility to the cognizant organization for the individual units. This practice resulted in a fragmented and poorly controlled response to potentially safety-l significant issues related to SSO requirements.
l ,
With respect to the items raised in the VECTRA assessment, MP1 Design i
! Engineering prepared a memorandum on October 10, 1994, which described the l issues and documented the proposed responses. On May 31, 1995, MP1 Design l Engineering issued a revised implementation schedule for the majority of the i items, which were tracked in AITTS, under ARs 95024910 and 95024912. On the l'
- 59
! l
!
'
.
I
. - . - -- -
_- _. . _ _ _ _ _ _ _ . _ _ _ _ _ _... - _ ___.._. _ _ ._ _ _ . _ _ _ _ _
i i
! basis of the team's review of these ARs, all of these activities were l characterized as " complete." However, the AITTS narrative for these items did
- not document a basis for the completed status. The team determined that j several of the original items remained incomplete, including the revision of
- the SB0 battery sizing Calculation PA-88-031-GE, Revision 2, and station ,
j battery loading and charger sizing Calculation PA 90-105-318El, Revision 1, i the revision of the SB0 loading calculation,-and the revision of SB0 Procedure j ONP 503C, to reflect the correct time sequences for removal of de loads. ,
The team also reviewed Design Engineering memorandum DE 2-95-937, dated
.
October 13, 1995, which provided a proposed schedule for resolving the VECTRA
! SB0 items associated with MP2. This memorandum requested the closure of the
,
14 items identified in AITTS under AR 95025817, on the basis of the proposed completion dates contained in an attachment to the memorandum. The team
,
f
reviewed the subject AR and noted that all of the items had been listed as
, " complete." However, in discussions with the team, the licensee acknowledged
- that only 1 of the original 14 items had been effectively addressed and the ,
'
others remained open. In response to this condition, the licensee initiated '
ACR 11097 to document this apparent example of a failure to implement i appropriate corrective actions. An SB0 coordinator for MP2 was assigned and i draft responses were prepared for several of the open issues. Additionally, several items were planned for resolution on the-basis of scheduled revisions j to the associated electrical calculations.
! Relative to MP3, the team examined a memorandum from the Technical Support l Group, dated October 6, 1994, which stated the licensee's initial position on j selected findings in the VECTRA assessment. The team also reviewed supporting j calculations, Concern Resolution Requests, engineering memoranda, station i procedure change documentation, QA surveillance results, and the applicable
! "SB0 Safe Shutdown Scenario Document" (Specification SP-EE-363) in order to l'
confirm the current status of these issues. Additionally, the team evaluated -
the results of recent Nuclear Safety Engineering Group reports assessing how j the MP3 SB0 program was revised as a result of the licensee's response to the VECTRA findings. After reviewing this information, the team determined that 3 of the original 11 findings for MP3 required further corrective action. In particular, items related to inadequacies in the battery sizing calculation,
- SB0 diesel generator maintenance, and inconsistencies in the identification of J j
-
SB0 containment isolation valves remained open.
- The team concluded that licensee management missed several opportunities to
! address these potentially safety significant SB0 issues and failed to '
- implement prompt and effective corrective actions in response to documented
deficiencies at all three Millstone units. Among these opportunities were (1) ;
i the initial identification of these items by VECTRA in October 1994, (2) the
- subsequent highlighting of inadequate followup to SB0 regulatory commitments
, identified in QA surveillance SIP MP3-P-95-006, dated October 11, 1995, and
(3) the identification of unresolved SB0 issues from the VECTRA report which j were documented in a Nuclear Safety Engineering Group report dated February 8, j 1996. The team noted that this same report contained the recommendation that '
- additional ISEG evaluations be performed to assess the status of the VECTRA
- findings at Millstone and Haddam Neck. However, as of May 22, 1996, the j licensee had not completed these recommended actions. *
1
!
!
4 ;
l
- - - ,
l
___ _ _ _ _ . _ _
______________.___._____.__7
!
! l l
l I The team concluded that the issues raised in the VECTRA assessment, which i
- included concerns regarding the adequacy of calculations involving SB0 l l loading, voltage drop, and battery sizing, were potentially safety
- significant. The failure to address these issues and take appropriate >
f . corrective action for more than 18 months since their identification at all three Millstone units, is an apparent violation of 10 CFR Part 50, Appendix B,
Criterion XVI, Corrective Action. (EEI 336/96-201-28; 423/96-201-28) {
^
4.3.3 Nonconformance Reports Not Trended or Prioritized (MP2 and MP3)
-
! NRC 1R 50-245/95-81; 50-336/95-81; 50-423/95-81, identified URI 95-81-01 ,
- concerning, in part, the lack of trending of NCRs. As described in that IR, ;
! the licensee's QA program directs that a trend analysis be performed of ;
i nonconformances to document program and procedural deficiencies, and that this l
, trend analysis be periodically reported to upper-level management by the
] organization responsible for controlling the document that reports the ,
! problem. However, the NRC found that the licensee's proceduralized trend :
i analysis program did not trend NCRs, nor was there a formal process to ~
- prioritize the resolution of deficiencies involving safety-related structures, j systems, and components.
!
- The team reviewed the licensee's program controls for identifying, j documenting, and approving the disposition for nonconforming materials, parts, ;
, components, and vendor services described in Procedure NGP 3.05, l "Nonconformance Reports," Revision 8. The team also evaluated the results of ,
l QAS audit and surveillance findings within this area and examined selected ;
,
NCRs. involving safety-related equipment.
,
.
QAS concerns related to the large numbers of old NCRs had been previously l documented in Audit Report A21054, A22054, A23054, " Corrective Action- i i Nonconformance Reports," dated July 22, 1992. The Executive Summary of this l l audit report stated, "The management of Millstone Station should take action i
to close the large number of long term open nonconformance reports."- The l
- concern for the continuing failure to provide timely responses to
- nonconforming conditions was repeated as a finding in Audit Report A25092,
A21065, A22065, A23065, "Nonconformance Reports," dated July 14, 1994.
- Specifically; Finding F-01 of this audit identified that contrary to 10 CFR
.- Part 50, Appendix B, Criterion XVI, " Corrective Action," which requires that l measures shall be established to ensure that nonconformances are promptly identified and' corrected, the procedural controls for-NCRs contained in l Nuclear Engineering and Operations Procedure (NE0) 3.05 did not specifically i address how long it should take to resolve nonconforming conditions. The
.
! audit report stated that there was no formal mechanism to prioritize the resolution of NCRs on the basis of safety significance and no tracking process i
to ensure their timely resolution. The audit further revealed that some NCRs reviewed at both Millstone and Haddam Neck had remained open for more than a i year. The findings of this audit as they apply to the Haddam Neck Plant are l, addressed in NRC IR 50-213/96-201, dated July 31, 1996.
! The team discussed this issue with QAS personnel who were involved with the
- audit and examined the followup documentation related to this issue contained j* in a licensee memorandum dated August 14, 1995. This memorandum stated, in t
y. 61 l
- i l'
. -. -. . . _ .
,
!
part, that administration of the NCR program had been transferred from QAS to Engineering and that disposition time requirements for NCRs should be defined I in the next revision of NGP (formerly NEO) 3.05 and that the resulting corrective actions would be tracked in the AITTS. However, after examining ,
relevant AITTS data and reviewing the documentation associated with this .
j issue, the team detemined that NGP 3.05 had not been revised to address '
disposition time requirements for NCRs, that NCRs were not being tracked in AITTS, and that Finding F-01 remained open almost 2 years after the ,
identification of this ites. !
-
l The team found that a total of 760 NCRs remained open-for the three Millstone ,
units: 314 at MP1, 132 at MP2, and 314 at MP3. After reviewing outstanding ;
NCRs, the team identified several MP3 NCRs, which dated back to 1988-1989,- l that remained uncorrected with no work assignments (AW0s) against them. These open NCRs included issues related to damaged air-operated valves in the volume !
control system, deficiencies associated with the 480-V load centers, and !
multiple nonconforming conditions on the recirculation spray system.
Despite the fact that this programmatic issue had been identified in audits conducted in 1992 and 1994 and was documented in a 1995 NRC IR, the team determined that corrective actions had not been taken to resolve the-identified deficiencies in the NCR process. Furthermore, as noted by the l team, large numbers of NCRs still remain open, including some examples of l unresolved NCRs dating back to 1988. Therefore, the failure to establish ;
adequate controls for the resolution of nonconforming conditions and the failure to implement appropriate corrective actions is an apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action." r (EEI 336/96-201-29; 423/96-201-29) !
4.3.4 Adverse Condition Reports Remain Unresolved (MP2 and MP3)
The team noted that a Level A ACR (ACR 13318) was issued on May 10, 1996, to document a programmatic breakdown in the implementation of the ACR program.
Level A ACRs, as defined in Procedure NGP 2.40, represent, " Events or issues *
of such importance they deserve the immediate, undivided attention of whatever i resources are required to mitigate the consequences, determine the causes, and ,
implement at least sufficient interim corrective measures to prevent- !
recurrence." An in-progress QAS audit of the corrective action program ,
. concluded that the ACR process was not being effectively implemented and that ,
because of the recurrent difficulties within this area (as discussed in NRC IR ,
95-81), a Level A ACR was prepared. Although the audit report associated with '
this activity had not been issued at the end of the team's assessment, the details of the event were evaluated in order to gain insights into the ;
programmatic implications of this ACR. ;
.
The ongoing audit of the ACR program examined a sample of Level C and D ACRs, in order to confirm the' appropriate implementation of this deficiency j documentation process. The licensee had made preliminary determinations that, ,
'
for 10 of 11 ACRs reviewed to that point, personnel did not properly establish the causal factors, and management reviews of the associated ACR corrective action plans were also inadequate, in that they failed to identify the *
deficiencies. QAS also determined that, contrary to the requirements of
i
, - . _ - . - - .- - .- --
. -
Procedure RP 4, Section 1.10.3, the Events Analysis Department did not perform the required corrective action effectiveness reviews, and contrary to the requirements of Procedure NGP 2.40, Section 6.3.7, numerous Level C ACRs were not completed in a timely manner. Additionally, the QAS audit found that,
, contrary to the requirements of Procedure NGP 2.40, Section 6.3, the specified database searches were not being conducted for potentially significant ACRs to determine if similar events had occurred in the past.
In response'to the issues raised in ACR 13318, the licensee initiated an audit of the ACR corrective action program at Haddam Neck, to determine if similar conditions existed there. Additionally, the team was advised that the . Nuclear Safety Engineering Group was in the process of evaluating the ACR program implementation for Level A and B conditions. However, at the conclusion of this inspection effort, no definitive results had been obtained from these activities.
In order to determine if the issues documented on Level A and B ACRs were receiving prompt corrective action, that the cause of the reported condition was properly determined, and that appropriate corrective actions were taken to preclude repetition, the team reviewed the current listing of outstanding ACRs characterized as either Level A or B. On the basis of this review, the team determined that numerous Level A and B ACRs, which represent potentially significant conditions adverse to quality, have remained unresolved well in excess of the procedural guidance specified in NGP 2.40 (30 days for level A and 45 days for Level B ACRs). The following Level A and B ACRs were a sample of those overdue (either open or rejected) as of May 22, 1996:
ACR 03925 - Inadvertent SIAS occurred while performing ATWS functional testing, dated July 4, 1995 (MP2)
ACR 08174 - Pressurizer steam space heatup rate exceeded TS-limit of 100 'F per hour, dated December 17, 1995 (MP2)
ACR 07507 - Thermal power exceeded 2701 MW after batch addition to VCT, dated February 11, 1996 (MP2)
ACR 08904 - PMMS database program indicators may be in error, dated February 8,1996 (applicable to site)
On the basis of its reviews within this area, the team concluded that site management had not promptly corrected these and other items which represent potentially significant conditions adverse to quality - some for almost a ;
year. . Accordingly, the failure to implement timely corrective actions for i significant conditions adverse to quality is an apparent violation of 10 CFR '
Part 50, Appendix B, Criterion XVI, " Corrective Action." (EEI 336/96-201-30) l l
4.4 Conclusions l
-
The team found several instances in which the licensee failed to identify existing degraded or nonconforming conditions or other deficiencies. l Concerns involving the adequacy of the environmental enclosures for certain 1
-
MP2 safety-related MCCs first arose in 1992. These and several other issues
raised subsequently by the licensee's staff were not resolved at the conclusion of this inspection. Further, the team observed that the licensee's formal problem identification and corrective action processes were not used to address these deficiencies.
n Poor control of temporary installations of scaffolding and I-beams at MP3 created the potential for multiple-train failure of the RSS system, and degradation of the SW booster pump pedestal resulted in the pump being ,
declared inoperable. These deficiencies had existed for several years and were not identified by the licensee. An inadequate temporary modification to the MP3 SW booster pump initiation circuitry went undetected, despite numerous reviews and analyses during the 6 years the modification was in place.
The team found other instances in which the licensee had a previous indication of a problem or condition, but it did not effectively identify the full scope of the concern and did not implement adequate corrective actions. A nonsafety-related battery at MP3 had a history of marginal performance, yet the licensee did not recognize the need for corrective action before questioning by the team. The licensee failed to prevent the recurrence of a May 1990 event in which the MP3 RPCCW system was operated above the 115 *F-limit specified in operating procedures and the UFSAR. The team found that the licensee had previously identified concerns with MP3 protective relay setting criteria, but had not performed a comprehensive evaluation of the discrepancies. Also, known deficiencies in the control of electrical drawings have not been corrected.
The team found problems in the licensee's system to track corrective actions.
In one case, the licensee failed to implement commitments for corrective actions to ensure that all of the dual-function containment isolation valves in MP2 were identified and properly tested.. A subsequent ACR to correct this process failure was also " lost" and the licensee again failed to take the necessary corrective actions. In another case, an ACR documented the licensee's inability to track the status of 56 incomplete ACR-related assignments that were reported as " lost" due to inadequacies in the licensee's tracking system, which erroneously indicated a completed assignment status.
All corrective action assignments in response to a third-party assessment on the effectiveness of the quality assessment process had been closed. However, the team found that many of these items had been inappropriately closed on the bases of verbal understandings, anticipated actions, pending reorganizations, or deferred actions. This practice resulted in an inaccurate status of corrective actions. The team also determined that the licensee frequently -
failed to follow the procedural guidance for the resolution of potentially significant conditions adverse to quality, in that several of the most significant ACRs have remained unresolved well in excess of the duration specified in the licensee's procedures.
The team found weaknesses in the licensee's oversight of the NCR process.
Despite the fact that program deficiencies in the NCR process were previously identified in QAS audits conducted in 1992 and 1994 and in a 1995 NRC IR, the '
team determined that corrective actions had not been taken. A significant number of NCRs remain open, including some dating back to 1988. The team concluded that the licensee's NCR process lacked adequate controls to ensure '
the prompt resolution of nonconforming conditions.
The team found that quality assurance audits.and third-party assessments were generally effective in identifying programmatic weaknesses. However,
.. management's responses to the findings and recommendations from these reviews were often inadequate. The team concluded that the corrective actions ,
implemented to address the concerns identified in the QAS audit.of licensing L
. and the third-party assessment of the effectiveness of the quality assessment process were inadequate. The team concluded that the licensee failed to implement prompt and effective corrective actions in response to SB0 audit deficiencies documented in a third-party evaluation for all three Millstone units.
On the bases of these findings, the team concluded that the licensee has failed to establish an effective corrective action program for the Millstone Station. The team's review revealed weaknesses in the ability to identify plant problems; delayed or inadequate corrective actions for known deficiencies; problems in the tracking of corrective actions; weaknesses in the NCR process; and generally inadequate management response to quality assurance audits and third-party assessments.
5.0 Enaineerina The team assessed engineering and technical support activities that were applicable to the MP3 AFW, SW, and electrical distribution systems.
Inspection of the electrical distribution system focused primarily on the AAC system for recovery from an SB0 condition, protective relay settings, and cable tray electrical fill for power and control cables. For each system, the team reviewed the TS, the UFSAR, site design documents, and selected operating and test procedures, drawings, modifications, ACRs, safety reviews, and calculations. In addition to the MP3 systems, identified above, the team also reviewed selected MP2 modifications and ACRs. The team also performed system walkdowns and. assessed the engineering bases for the system safety functions.
5.1 Desian Chanae and Modification Process
.
5.1.1 Inadequate Design Verification for RBCCW Surge Tank Seismic Restraint (MP2)
After noting deficiencies in the installation of the temporary seismic restraints on the MP2 RBCCW surge tank (see Section 3.1), the team reviewed the associated design calculations to determine if they met regulatory requirements and licensee commitments.
During efforts in 1995 to address GL 87-02, " Verification of Seismic Adequacy of Equipment in Older Operating Nuclear Plants," the licensee identified a discrepancy in the original calculation for the RBCCW surge tank supports.
Although the support steel exceeded certain-allowable design stresses, on April 7,1995, the licensee determined that the tank was operable with water level below 50 percent capacity. To ensure operability with the tank level more than 50 percent capacity, the licensee added temporary seismic restraints
to the tank under B/J 2-95-045, dated April 14, 1995, with the intent of
_. -. ._
l l
adding permanent restraints during the next refueling outage. l I \
The team reviewed the design calculations for both the temporary and final modifications of the tank. The licensee's design concept for both modifications consisted of (1) wire ropes attached to adjacent structures and ,
I wrapped around the tank at several locations and (2) braces acting as I
compression members between the tank and adjacent structures. During !
discussions with the NRC team, the licensee noted that this design minimized , l
, materials, welding to the tank, and installation time. '
The team reviewed Calculation 95-ENG-1198 M2, Revision 1, dated April 14, 1995, which designed and analyzed the temporary and final modification !
configuration. The team determined that the design verification of the calculation was inadequate after identifying the following discrepancies and inconsistencies: ,
l (1) The area of a 1-inch diameter anchor bolt was incorrectly given as 0.994 '
square inches rather than the actual 0.785 square inches. This was considered significant because the bolts were at 99 percent of the I
assumed allowable stress.
l (2) The calculation evaluated the existing tornado missile barrier by j applying a seismic load from the tank; however, the analysis did not ;
include any seismic response from the missile barrier itself. !
(3) The tank's specified seismic load did not include forces from the two 8-inch attached pipes.
(4) No consideration was given to the stiffness of the restraints relative to the existing tank anchorage, to determine if loads would exceed the design allowables before the cables became effective in restraining the load.
(5) The design did not recognize the need or consider the effect of pre-tensioning the cables.
On the basis of the team's comments, the licensee issued Revision 2 of the calculation on April 3,1996, to address the issues discussed above. After considering as-built configurations, the licensee concluded that the design still met all design requirements.
The team reviewed the revised calculation and concluded that the design verification continued to be inadequate because of the following observed discrepancies and inconsistencies:
(1) The calculation used incorrect dimensions in determining the weights of the 1-inch thick missile barrier plates. ,
(2) The missile barrier model was anchored to the building at an elevation of 84 feet, but the assumed seismic accelerations were based on
nonconservative response spectra from 71.5 feet.
. _ _ _ _ - . _ _ _....~ _.__ _ _ _ _ ._ . _ _ . _ . _ . _ .._ _ . _ _ . _ __ _
(3) The anchor bolt evaluation for nodes 35 and 36 did not address the distance to edge of concrete; provide the basis for anchor bolt size, spacing, or number of bolts; or justify why the -X load could be distributed to all anchor bolts.
~
(4) Lateral forces were incorrectly input into the computer analysis for several load cases (i.e., total load was divided by 10 but was only
, applied to 7 or 8 nodes in the +Z and -Z directions).
(5) The tank's calculated baseplate bending stiffness neglected the attached I-beams and was potentially nonconservative.
(6) The stres miel results were not reasonable because torsional loads on several niembers and reactions at several nodes were inconsistent with the applied loads.
The team concluded that although the licensee's initial identification of the-seismic design problem was good, the resolution of the problem was neither rigorous nor thorough. Although the team concluded that the deficiencies did not result in the tank being inoperable, the existence of these fundamental design deficiencies in the original and revised calculation indicate weaknesses in the design verification process.
The failure to verify the adequacy of the design as exemplified by the 11 items above is considered an example of an apparent violation of 10 CFR Part 50, Appendix B, Criterion III, " Design Control." (EEI 336/96-201-31)
5.1.2 High Pressure Safety Injection Thermal Relief Valve Discrepancies (MP3)
On February 2, 1991, while testing high pressure safety injection (SIH) check valves, thermal relief valve 3SIH*RV-8851 lifted and did not reset. This valve, together with thermal relief valves 3SIH*RV-8853A and -88538, provide overpressure protection to the SIH piping system from reactor coolant system backleakage through the SIH system discharge check valves. The lift setpoint of 1750 psig for the thermal relief valves was significantly higher than the 1550 psig shutoff head of the SIH pumps, and was, therefore, considered to minimize the possibility of inadvertent actuation during pump start. However, valves 3SIH*RV-8851 and -8853B had a history of premature actuation and leakby, with both valves having been reworked four times preceding the February 2, 1991, event.
PDCR MP3-91-045 Following the February 2, 1991, event, the license installed stiffer springs in the SIH relief valves through PDCR MP3-91-045, in an attempt to reduce valve chatter and resultant seat damage. The new spring was selected by extrapolating the tested flow characteristics of two other spring sizes. The
'
selected Type 60A spring was installed without specific verification of the !
discharge flow rate. The valve manufacturer, Lonergan, indicated that the new spring would reduce the rated capacity by one-half or more. The design change was ineffective in resolving the problem, as evidenc'ed by the premature
-
lifting of thermal relief valve 3SIH*RV-8853B on March 30, 1991, on start of
-. . . . _. _ __ _ _ _ - . _ _
. .- . - - . .- . - -
i SIH pump A, and the subsequent April 10, 1991, lifting of thermal relief valve 3SIH*RV-8853A during preparation for SIH check vaive testing.
The team noted during review of PDCR MP3-91-045 that the stated design function of the relief valves was to provide a relief capacity of 20 gpm per .
valve. Calculation 3-ENG-148, " Determination of Capacity for 3SIH*RV-8851,
-8853A, and -8853B," dated March 31, 1991, was revised as part of this design change. This calculation changed the assumed backleakage through the SIH discharge check valves from 5 gpm to 4 gpm, and determined that a relief valve capacity of 20.3 gpm was required. The replacement of the springs was estimated in the PDCR to decrease the existing flow capacity through each valve to approximately one-half (i.e., from 40 gpm to approximately 20 gpm).
The team considered the modification inadequate in that there were no detailed calculations developed to support the flow capacity estimates and it provided no capacity margin for valves which may not exhibit consistent performance at a given setpoint.
PDCR MP3-91-075 As a result of the premature lift problems encountered following the spring replacement, a new design change was implemented through PDCR MP3-91-075, which was approved by PORC on April 11, 1991, to raise the setpoints for thermal relief valves 3SIH*RV-8851, -885?A, and -8853B from 1750 psig to 2235 psig. This design change has been successful, to date, in eliminating premature lifting of the thermal relief valves.
On March 21, 1996, the team questioned the adequacy of the current design to provide sufficient thermal relief capacity. The licensee contacted the manufacturer and performed calculations to demonstrate the acceptability of the current design. In this review process, the licensee noted that the data on hand from the relief valve vendor had .cupported its use up to 2000 psig.
The licensee obtained the required certification for a 2235 psig setpoint during the inspection period. On June 5,1996, the licensee also located Calculation 12179-PH-97, " Relief Valve Reaction Load Calculation," dated May 5,1993, which demonstrated the available relief flow capacity to be 44.7 gpm per valve at 2235 psig. The result of this calculation should have been incorporated into Calculation 3-ENG-148, rather than as a part of Calculation 12170-PH-97, " Relief Valve Reaction Loads."
.
l Following the onsite inspection, the team identified two problems with PDCR MP3-91-075 pertaining to performance of hydrostatic testing.
(1) PDCR MP3-91-075 increased the SIH piping system design pressure from 1750 psig to 2485 psig. The "ASME Section XI Repair Replacement Plan" associated with the PDCR deferred performance of the ASME Code hydrostatic test required as a result of the change in design pressure.
(Note: Conflicts existed in the document package relative to whether ASME Section III Code or Section XI Code requirements were applicable to the hydrostatic testing.) 10 CFR 50.55a, paragraph (a)(3) provides for the use of alternatives to ASME Code requirements when authorized by the Director, NRR. The failure to obtain this authorization for deferral of ,
_ _. __ _ _ _ _ _ ._. __
e i
f an ASME Code-required hydrostatic test is an apparent violation of 10 CFR 50.55a(a)(3). (EEI 423/96-201-32)
i (2) Section 7.0, " Implementation and Testing," of PDCR MP3-91-075 referenced
.
.
AWO M3-93-14450 as applicable for the hydrostatic test. The licensee
,
provided a copy of. Engineering Form 31063-1, " Hydrostatic Pressure
Test," for AWO M3-93-14450, dated September 8, 1993, which specified a
!
, hydrostatic test pressure factor of 1.1. The hydrostatic pressure test
results provided to the team, which were signed off as completed on September 26, 1993, also indicated that when the hydrostatic test was
! performed, a hydrostatic test pressure of 1.1 times the thermal relief j
valve setting of 2235 psig was used. The "ASME Section XI Repair
- Replacement Plan" indicated that the applicable Section XI Code was the j 1983 Edition through the Summer 1983 Addenda. Paragraph IWC-5222(a) in j ASME Code Section XI requires, however, that at least 1.25 times the t
'
relief valve setting be used when the design temperature exceeds 200 'F.
The S1H piping system design temperature is 250 *F. The failure to comply with ASME Code provisions is an apparent violation of 10 CFR Part 50.55a(g)(4). (EEI 423/96-201-33)
The team considered these deficiencies to be examples of a lack of rigor and thoroughness in the design verification process.
5.1.3 Potential for Entry of Foreign Materials Into the Unit 3 Recirculation System (MP3)
In June 1995, PDCR 3-94-0162 installed test flange rings with drilled bolt holes on the RSS suction piping penetrations inside the MP3 containment sump.
The rings provided a surface for bolting blind flanges over the pipe openings for enhanced sealing during local leak rate testing (LLRT) of these penetrations. The PDCR specified that two sets of bolts were to be used at each penetration. One set was for attaching the blind flanges during the LLRT. This set was to be removed from the sump along with the blind flanges during plant operation. The second set, FME bolts, was to be installed " snug tight" in each test flange ring during plant operation. The purpose of the FME bolts was to prevent thread damage and minimize the accumulation of water and debris in the test ring bolt holes during plant operation.
The team concluded that, under post-accident conditions, the FME bolts could loosen, particularly at the low torque value specified, and back out of the flanges.as a result of flow vortices or turbulence inside the sump. The team ,
noted that the bolts, located at the mouth of RSS suction piping, could be pulled into the RSS pumps. A breakdown in administrative controls over either )
I set of bolts could also result in unrestrained bolts inside the sump. '
Previous NRC generic communications have addressed plant events in which debris was found in safety systems, including the safety injection system, and resulted in reduced flow during' testing of the systems. Consequently, the
- practice of installing bolts in test flange rings inside the sump during plant operation unnecessarily introduces foreign material into the sump that could, if dislodged or improperly controlled, lead to RSS pump damage or loss in j
,
performance. t
69 ;
- -. . _ - . . - - . - . _ . - - . _ - . - . . - - . - . - . _ . - - . - . . - - - . . . . _
l l
l Although licensee personnel did consider and dismiss (in the 10 CFR 50.59 i
, evaluation of this modification) the potentir.1 for bolt loosening due to floor i vibration, and also recognized the need to ensure the blank flanges were removed before plant operation (PORC review of the PDCR on December 22,1994),
they did not consider the potential for loosening from flow action or from a .
breakdown in administrative controls.
At the time the PDCR was processed, the licensee's design control measures did ,
not require that engineers developing design changes consider the potential for modifications to introduce foreign material into vulnerable areas. One ,
engineering manager said that foreign material had been treated at the facility as a maintenance concern rather than a design consideration.
This issue was subsequently included in an NRC letter to the licensee, dated April 4, 1996, which listed concerns that must be resolved before unit ,
restart. The licensee issued a work order to remove and destroy the FME bolts '
from the containment RSS pump suction test flange rings. In addition, the licensee stated that FME precautions will be taken during removal to preclude dropping the bolts into the open RSS suction piping. DCN DM3-S-0336-96 was issued in support of the removal and to modify the original PDCR. A procedure ;
change was also issued on May 9,1996, for the containment closeout checklist .
to routinely verify that the blank flange bolts are removed before power operation. On May 1, 1996, the licensee issued Revision 2 to the Design Control Manual which incorporated a requirement for independent reviewers of .
PDCRs to check for foreign material concerns. l
5.1.4 Untimely Evaluation of Service Water Thermal Performance (MP3)
The team reviewed PDCR MP3-94-122, "3HVR*ACU1A/B Service Water Cooling Coil Replacement," Revision 0, which replaced coils in the MCC/RCA coolers because of leaks at the tube joints, to verify correct implementation.
The purchase specification for the coils did not specify thermal performance shop tests, and the PDCR post-modification test requirements stated that the
" cooling coil heat transfer performance shall be verified...after startup from RF05." The replacement coils were installed during Refueling Outage RF05 in i May 1995. However, a thermal performance test was not conducted until December 1995. In addition, although flows and temperatures were obtained during the test, no analysis or evaluation of the data was performed as of May 21, 1996. The team considered the 6-month delay in conducting the heat l transfer performance test and the additional 6-month delay in evaluating the l test data to be a weakness in the licensee's post-modification test process.
The team's review of the test data found that the test data differed :
significantly from the purchase specification, necessitating the need for analyses of the test data. i
The failure to adequately and promptly evaluate the test data to assure that l the design change was properly implemented is an apparent violation of 10 CFR ,
Part 50, Appendix B, Criterion XI, " Test Control." (EEI 423/96-201-34)
,
l
.
70
- -, _ - . - . - . - ., . - -- -. _ -_- _ _ -_ - ._
_ ._ _ . ._ - _ . _ . _ _ _ _ .-_ _ _ . _ _ _ _
5.1.5 Unanalyzed Restricting Orifice Installed in Service Water System (MP3)
In response to GL 89-13, " Service Water System Problems Affecting Safety-Related Equipment," the licensee determined that the MP3 SW system had been ;
. adequately designed to mitigate waterhammer loads due to column separation and 1 rejoining concerns. The team reviewed the associated design calculations and noted an additional restricting orifice in the SW vent system that had not
, been considered in the original waterhammer analyses. The additional restricting orifice invalidated the startup test results which showed that column rejoining forces were adequately mitigated by the SW system.
Because of elevation differences in the SW system, a column separation and l rejoining-phenomenon had to be postulated during a loss-of-offsite power and j pump restart sequence. The licensee's efforts to reduce the predicted loads '
included installing an open vent system at the highest system elevation !
allowing air to enter whenever the system pressure dropped below atmospheric conditions. The design required a restricting orifice to limit the amount of water that would bypass the control building air conditioning coolers during normal operation, while allowing sufficient air volume to refill the system during the loss-of-offsite power sequence. The introduction of air into the system cushioned the column rejoining forces that occurred when the pump restarted.
The licensee's Calculation SWEC P(T)-1070, " Orifice Size Determination for Air Admission into Service Water HVK Supply Line," Revision 0, dated January 26, 1985, concluded that for restricting orifices R0-149A and B, an orifice diameter of 0.425 inch allowed too little air into the system, but 0.500 inch was acceptable. Although preoperational testing verified that the column rejoining loads were inconsequential with the 0.500-inch orifice, later preoperational testing noted that air entering through the open service water system vents prevented the condenser water boxes from being properly primed.
This problem was resolved through Engineering & Design Coordination Report T-P-06677, dated August 1, 1985, by introducing 0.375-inch diameter restricting orifices, R0-153A and B, in the vent line to reduce the air flow into the condenser system. Although this resolved the condenser issue, no additional calculations or tests were conducted to confirm that the waterhammer mitigation effects were still valid with this smaller orifice in the system.
After the team identified this issue, the licensee initiated an ACR, and by the close of the onsite inspection had not completed the reviews to determine the consequence of the unanalyzed restricting orifice.
Failure to subject design changes to design control measures commensurate with those applied to the original design is an apparent violation of 10 CFR Part 1 50, Appendix B, Criterion III, ", Design Control." (EEI 423/96-201-35) i
5.1.6 Inadequate Design Verification and Problem Resolution for Service Water System Design Change (MP2)
The licensee's MP2 SW system self-assessment identified on September 29, 1995, l a seismic vulnerability caused by a design change for detecting a leak in
'
. ___ _ _ . _ _ _ _ _ _ - _ _ _ _ . . _ _ _ _ _ . . _ _ _ . _ _ _ _ _ _ _ .
I
. switchgear room cooler X-182. The original leak detection design i
'
automatically isolated SW flow to the cooler based on a local low-pressure '
switch in the SW system. This feature had been disabled since 1993, due to ;
numerous inadvertent sy tem isolations, but was reinstituted using a different !
leak-detection concept because of a SW 1eak.. To resolve the inadvertent .
isolation problem, PDCR.2-064-94, " Vital Switchgear Ventilation System-Service Water Isolation," which was signed April 25, 1995, and completed June 22, !
1995, installed a liquid-level switch in the cooler cofferdam. Instead of ,
sensing a drop in SW system pressure, automatic isolation occurred when water !
was detected inside the watertight enclosure below the cooler. Although intending to detect only an SW leak, the modification did not consider that it would also isolate flow due to a seismically induced leak in the overhead i nonsafety-related fire protection (FP) piping. The modification's seismic :
review extensively evaluated new installed components, but did not consider !
the effects from seismic failures of external components. i
,
After identifying this deficiency, the licensee issued DCN DH2-S-1246-95 on February 27,1996, " Modification to Fire Protection Piping Cable Spreading Area Turbine Building," to replace Victaulic couplings on the FP piping near the cooler with standard flanges. The licensee considered this the only seismic weakness in the FP piping system. Calculation 95-ENG-1324-D2, I Revision 0, dated November 15, 1995, concluded that the FP piping and its j supports still met the seismic 2-over-1 stress criterion with the added weight from the standard flanges.
The team reviewed the licensee's calculation and concluded that the ccrrective ;
actions did not adequately resolve the design deficiency. Due to the addition i
, of the moisture switch, the licensee now needed to demonstrate that adjacent '
sources of water were also seismically qualified in order to maintain the ;
seismic qualification of the cooler. The original 2-over-1 stress criteria j for the nonsafety-related FP system (i.e., Northeast Utilities MP2, Category l II/I. Design Criteria for Fire suppression Systems) ensured that it would not fall down after a seismic event and damage safety-related equipment. These criteria did not, however, ensure that the system remained leak-tight following a seismic event, as demonstrated by the need to replace Victaulic couplings. The cooler's seismic design bases were not established because the FP system's 2-over-1 design criteria were less conservative than the safety-related piping criteria. Failure to adequately correct the seismic vulnerability of Cooler X-182, as described above, is an apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Action."
(EEI 336/96-201-36)
5.1.7 Installation of Filters on Battery Room Ventilation System Fire Dampers (MP3)
During a walkdown of the MP3 electrical system on May 14, 1996, the team questioned the licensee regarding the installation of air filters on the fire '
dampers for safety-related battery rooms 1 and 4. The filters were taped into place without any indication of the controls authorizing their installation.
,
The fire dampers affected were 3HVC*DMPF33, 3HVC*DNPF40, 3HVC*DMPF38, and 3HVC*DNPF43.
'
i
,
.
-r., - -- - - -
- ._. ._. -. _ .- -
!
The team ascertained that a technical analysis was not performed to assess the impact of the filter installation on the fire dampers' ability to perform their safety function. UFSAR Section 9.4.1.3 states that the fire dampers i automatically isolate the area affected by fire. The licensee stated that the j
. filters were installed using housekeeping practices to mitigate dust buildup ;
on the battery terminals. An April 12, 1995, Calculation 95-ENG-1109 MS, l Revision 0, was performed to assess the filter impact on air flow to the '
. battery room exhaust fans. This calculation determined that the battery room ventilation system fans had adequate capability to ventilate battery rooms 1 through 4; whether the installed filters were clean or clogged. The l
, ventilation system for Battery Room 5 required the filter to be clean in order for the ventilation fan to adequately ventilate the room. This calculation
~
did not address any other impact of the failure or degradation of the filters on the capability of the ventilation system (including the fire dampers) to perform their safety functions.
In response to the team's questions, the licensee issued ACR 12876 on May 20, i
.
'
1996. This ACR noted that the filters had been installed since 1984, and that the filters were inspected by the weekly battery surveillance for housekeeping l data. Step 6.1.14 of Maintenance Form 3712NA-1, Revision 5, " Battery
- Housekeeping," identifies a requirement to check that the air filters are clean and that the ventilation system is functional. However, no acceptance
- criteria were specified on the maintenance form with respect to filter
, cleanliness requirements. The licensee informed the team that it was
- preparing DCN DM3-5-175-96 to document the installation of the filters and the fabrication and use of filter brackets. However, licensee management subsequently determined that the DCN should be canceled and that the filters should be removed.
! While the licensee acknowledged that there were no formal configuration
! controls authorizing the installation of the filters, the licensee had 1 i included an inspection of the filters on Maintenance Form 3712NA-1, a PORC '
approved procedure. The team ascertained from the licensee that the requirements for the filter inspection were added in Revision I to Maintenance Form 3712NA-1, which was issued on March 16, 1987. Revision I tc Maintenance Form 3712NA-1 was approved by PORC during the March 12, 1987, meeting.
,
-
By installing the air filters over the battery room fire dampers, the licensee had operated the facility without performing an analysis for the impact the
.
filters had on the ability of the fire dampers to isolate the battery rooms from a fire in an adjacent switchgear room. Although the filters were installed in 1984, the licensee had no basis until April 1995, for determining
)
that the ventilation systems would adequately ventilate the battery rooms with j the filters installed. While Calculation 95-ENG-Il09 MS, Revision 0, determined that the ventilation systems in the battery rooms could adequately
'
ventilate the rooms with clean filters installed in all cases, the filter on the fire dampers for Battery Room 5 required close monitoring to detect
clogging. Without clearly defined acceptance criteria in Maintenance Form
^ 3712NA-1, there was limited assurance that the ventilation system for Battery Room 5 would continue to adequately ventilate the room.
.
<
_ _ _ _ . _ - _ _ _ . . _ . _ __ _._ _ _ _ _ _ ___
10 CFR Part 50, Appendix B, Criterion III, " Design Control," requires that design changes, including field changes, be subject to the design control measures commensurate with those applied to the original design. Criterion III also requires that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes .
that are essential to the safety-related functions of the structures, systems, and components.
.
The licensee's failure to apply design control measures for the installation of the filters on the battery room fire dampers, commensurate with the original design from the initial 1984 installation until the 1995 performance of Calculation 95-ENG-1109 MS, Revision 0, is an apparent violation of the requirements of 10 CFR Part 50, Appendix B, Criterion III, " Design Control."
.
(EEI 423/96-201-37)
5.1.8 Failure to Consider Post-Accident Fluid Temperatures in Calculating System Flow Rates (MP2)
During its review of the MP3 SW system piping configuration and predicted operating parameters under post-accident conditions, the team recognized that there was a potential for SW flow choking at the orifice downstream of each recirculation system heat exchanger (RSSHX). The licensee had recently determined that SW temperatures at these locations can be higher than originally predicted, but had not recognized a need to perform a follow-up assessment for possible flow choking.
In response to the team's concerns, the licensee performed an assessment and determined that cavitation and orifice choking could occur in the SW system.
The assessment showed that choking under clean RSSHX conditions can occur and would be expected to reduce RSSHX SW flow from the previously expected range of 6200 gpm to about 5400 gpm. The reduced SW flow was determined to be adequate in that about 4100 gpm (for clean RSSHXs) was estimated to be necessary for removal of the post-accident heat from containment. Although the assessment indicated that the effects of the SW choking can be tolerated, this example, coupled with an acknowledgement by licensee engineering personnel that SW system flow predictions are normally performed on an isothermal basis (i.e., assuming 75 *F fluid temperature throughout the SW system), highlighted a programmatic weakness. Effects such as cavitation and choking are masked when system flow rates are predicted on the basis of isothermal conditions rather than anticipated fluid temperatures.
The team determined that the potential for flow choking could have been identified as early as March 22, 1985, during the performance of a sizing Calculation 12179-P(T)-1092, for Orifices 35W-R0125 A-D. As a result of an error in methodology (i.e., less than the full calculated orifice differential pressure the screeningwas that usedwasin comparing ,d by the architect-engineer for chokingagainst the performe incorrectly concluded that choking would not occur. A subsequent orifice .
sizing calculation,12179-NE-025, dated November 8,1985, also failed to identify the potential for choking.
.
74 i l
l
!
..- -- .- - - - . . - . _,.
_ . _ _ . . _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ._ _ _.
-
,
I i
! In May 1993, the licensee realized that heat transfer across the RSSHXs would !
i be greater under accident conditions than that assumed in the UFSAR. During )
normal plant operation, the tube and shell sides of the RSSHXs are maintained
'
dry, which minimizes corrosion and fouling. Thus, the levels of RSSHX fouling
! underestimate of both the heat transfer coefficient for these components and I j the maximum RSSHX SW outlet temperature following a LOCA. A bounding j calculation, US(B)-348, was performed assuming clean RSSHXs to determine the
-
.
l
! maximum RSSHX SW outlet temperature. The purpose of the calculation was to l
- determine'whether the resultant SW outlet piping thermal stresses were l
.
acceptable. The calculation showed that RSSHX outlet temperatures could reach !
189 *F for a short period of time following a LOCA. The licensee did not, however, reexamine its calculation modeling the SW system flow (Calculation
- 90-069-01116M3) as a result of the predicted higher RSSHX SW outlet
- temperature, and also failed to recognize the increased potential created by i j the elevated temperature for orifice choking.
j The team determined that the licensee's engineering staff did not consider the potential for choking during performance of the US(B)-348 bounding calculation
'
-in 1993. The licensee's approach for determining the adequacy of SW flow was to examine heat loads on a component-by-component basis in conjunction with a calculation that used an isothermal flow model for determiniag available system flow. The temperature assumed in the SW flow model was 75 *F. The team considered that the use of this approach could result in a potential for choking effects in other plant systems. Licensee personnel told the team that they were in the process of purchasing computer flow models for the SW systems for each Millstone unit and for other selected systems. Discussions with licensee engineering staff on this issue resulted in the initial identification of the potential for a problem in the MP2 high pressure safety injection (HPSI) system. In that system, flow choking could occur at components providing significant pressure breakdowns, such as the flow orifices in each HPSI injection leg. Since the system draws water at elevated temperatures (250 *F) from the containment sump under post-LOCA recirculation conditions, the potential for choking and the effects of choking in that system can increase. The failure of the licensee to calculate available system flow rates utilizing fluid temperatures predicted for post-accident conditions is considered an unresolved item pending licensee completion of its ,
HPSI flow evaluation and NRC review. (URI 336/96-201-38) l 5.2 Desian-Bases Calculations and Analyses l l
5.2.1 Station Blackout Diesel Generator Battery Duty Cycle (MP3)
UFSAR Section 8.3.1.1.6 states that the AAC switchgear enclosure contains a 60-cell battery and battery charger which supplies 125-Vdc power for starting l the diesel generator and supporting auxiliary equipment. Consistent with the requirements of Specification S)-EE-317 " Specification for Diesel Generator
,
Station Blackout," Revision 1, dated September 19, 1991, the vendor provided a battery duty cycle diagram and a cell-sizing worksheet. However, the team found that the licensee had reviewed and approved vendor data on battery cell
sizing and required duty cycle which were technically deficient.
Additionally, the licensee did not perform a calculation to determine battery
- - . . __
- -
_ _ _ _ _ _ . _ . _ _ _ _ _ _ _ _ . _ _ . _ . _ _ _ _ _ _ _ _ _ _ . _ _ _
I adequacy. Therefore, the team found that there was no documentation or calculation which determined the capacity and adequacy of the 125-Vdc battery to start the SB0 diesel generator and auxiliary equipment consistent with the required duty cycle. Each of the specific technical deficiencies is discussed i below. . ;
(1) Incorrect Duty Cycle
.
The vendor, MKW Power Systems, provided the licensee with (a) letter, !
" Battery sizing Data," dated July 16, 1992, (b) a GNB Worksheet, dated July 14, 1992, and (c) a Duty Cycle, dated May 19, 1992, which ,
identifies a two-step, 4-hour duty cycle. The first step shows a 6.09-A '
continuous load for the first 239 minutes, and the second step shows a ,
24.09-A load for the last minute. However, the team found that the duty cycle specified in UFSAR Section 8.3.1.1.7 is only I hour. In addition, j the team'found that numerous loads were missing from the duty cycle (e.g., the starting current for the dc fuel oil pump (estimated at 35 ;
A); two air start de solenoid valves; starting and run current for the -
de turbo lube oil pump (estimated 35 A and 5.8 A, respectively); :
starting and run current for the de governor booster pump (estimated 20 A and 8.8 A); and the de electric governor controller. The team concluded that these additional loads would greatly increase the duty :
cycle requirements, especially in the last minute.
l
,
(2) Incorrect Temperature for Battery Cell Sizing The vendor provided the licensee with a cell sizing worksheet based on ;
IEEE 485-1983, " Recommended Practice for Sizing Large Lead Storage s Batteries for Generating Stations and Substations," methodology and used i a minimum cell electrolyte temperature of 70 *F. However, the heat pump '
that controls the 580 switchgear room temperature is set at 66 *F to 75
- F; and there is no area temperature alarm or recording of temperature. '
Therefore, the team found that the minimum electrolyte temperature (70
- F) selected by the vendor for cell sizing is inconsistent with the temperature the battery can experience (at or below 66 *F since there was no alarm) at the installed location. Since a lower assumed minimum i temperature results in an increased battery cell size and capacity, the vendor's selection of 70 *F was not conservative.
(3) Lack of Battery Discharge Data i
The vendor provided the licensee with a cell-sizing worksheet based on l IEEE 485-1983 methodology wnich determined that the required cell size ;
is seven positive plates per cell. However, the team found that no i battery discharge data or performance curve are available to confirm the !
amperes per positive plate discharge rate indicated by the vendor. For example, a 71.80 A/positiv,e plate is used at the last minute without supporting data, and the cell section size incorrectly shows 0.35 . i instead of 0.25. Since vendor battery discharge data are missing, the !
team concluded that the adequacy of the battery size cannot be confirmed, and the additional duty cycle loads (described above) cannot ,
be incorporated and evaluated.
.- - - . _ , . - _. - . - - - -.- - - - - - _ --
!
i
!
(4) Lack of Voltage Profile j The team found that no battery voltage profile is available which shows ;
the resultant voltage at the beginning and end of each section of the :
. duty cycle at the projected ampere rate discharged. Therefore, the j ability of the battery to maintain a minimum voltage level required for :
operation ~of equipment (i.e., closure of the SB0 diesel generator output *
.
breaker) was not substantiated. .
In response to the team's concerns in this area, the licensee stated that 580 >
. test IST 3-93-017, dated August 13, 1993, verified that the battery started the SB0 diesel generator I hour after a simu' 3ed SBO. The licensee also ;
stated that the adequacy of the battery had t.st been properly evaluated in !
April through July 1992. The licensee initiated ACR 012868 on May 16, 1996, !
to resolve the technical issues in this area. Subsequently, battery discharge i curves were obtained from the vendor, and the licensee prepared a preliminary ~
battery sizing calculation using a 60 *F minimum cell temperature during the ;
correct duty cycle duration and loading. The calculation indicates that the battery is adequately sized with 65-percent spare capacity, and the battery i voltage profile remains above the minimum value. In addition, the licensee stated.that'a procedure will be implemented to record area temperatures once a shift to ensure that the cell temperature remains above the minimum value.
5.2.2 Turbine-Driven Auxiliary Feedwater Pump Calculation Discrepancies (MP3)
The team reviewed appropriate sections of the UFSAR, DBDPs, E0Ps, E0P Setpoint Documentation, and engineering calculations to validate the operability of the turbine-driven auxiliary feedwater pump (TDAFWP).
E0P 35 ECA-0.0, Revision 11, dated October 3,1995, delineates the required operator actions for the TDAFWP in response to a loss of all ac electrical power. The steps specified in this procedure were developed in E0P Setpoint Documentation Calculation W3-517-981-RE, Revision 4, dated June 29, 1995, and were based on Calculation 91-074-324M3, Revision 0, dated March 1, 1993. The team reviewed the latter calculation and questioned the validity of using an assumption of 1 psig steam exhaust pressure. This assumption had been taken from the data sheet sent by the vendor and did not take into consideration the backpressure increase due to friction pressure drop from plant-specific exhaust piping.
In response to the team's question, the licensee provided Calculation 12179-PH-90, Revision 0, dated May 26, 1983, that had calculated a turbine exhaust pressure of 14 psig. The calculation recognized that this was a significantly higher exhaust pressure than originally provided by the vendor, and potentially had an adverse impact on the TDAFWP performance. The calculation
,
i recommended that a study be performed to determine if the turbine could deliver. the required horsepower with this higher exhaust pressure; however,
,
the licensee performed no additional study. !
4 The failure to use the correct turbine exhaust pressure in Calculation 91-074-
324M3 is an apparent violation of 10 CFR Part 50, Appendix B, Criterion III, l " Design Control." (EEI 423/96-201-39) i
-
<
'
j 77 i l
!
_. - _ _ _ _ -_ , _ _ . - , . - _ , .
_ _ _ _
In addition to the above deficiency, the team noted several other potential discrepancies in Calculation 91-074-324M3. These were (1) an assumption that the mechanical efficiency of the turbine was constant for the range of steam ,
inlet pressures, (2) a mass flow rate of 43651 lb/hr was used at 1200 psia '
whereas the vendor data sheet specification was 64300 lb/hr, and (3) a pump ,
requirement of 75 HP was calculated for the 125-psia case, whereas the vendor's data sheet specification was a turbine output of 68 HP.
'
After speaking with the team, the licensee initiated ACR 13426, dated May 22, 1996, to address these issues. The team noted that there was conservatism in the E0P calculation. However, a revised evaluation of the TDAFWP overall ,
performance had not been finalized at the end of the inspection. Review of '
the licensee's evaluation is considered an unresolved ites. (URI 423/96-201-40)
5.3 Correction of Desian Issues by Usina Administrative Controls 5.3.1 Post-LOCA Hydrogen Monitors (MP2)
During an engineering review of containment isolation valves, the licensee determined that the plant configuration was outside the licensing bases because the containment gaseous and particulate radiation monitoring system, hydrogen monitoring system, and post-accident sampling system did not meet the single-failure criteria for the post-accident monitoring function.
Specifically, a postulated loss of one vital 125-Vdc bus would render these systems inoperable because a flow path could not be established due to the configuration of the power supply to the containment isolation valves. The team reviewed ACR 01991 (dated October 6, 1995), Operability Assessment TS2-95-745 (dated October 5, 1995), ACR 03532 (dated October 3, 1995), and LER 95-038-00 (dated November 2, 1995), concerning this issue.
During normal plant operation, the containment gas and particulate radiation monitoring system draws a continuous air sample from the containment atmosphere through normally open containment isolation valves. Upon receipt of a LOCA signal, the containment isolation valves are automatically closed, and both 125-Vdc vital power sources must be available in order to reopen all the containment isolation valves in each sampling train to establish a flow path to the monitoring systems. The hydrogen monitoring system and PASS are l required to use the containment gaseous and particulate radiation monitor '
sample flow path after the onset of a LOCA.: Therefore, loss of either of the 125-Vdc vital power sources would prevent the control room operator from establishing a sample flow path to the redundant hydrogen monitor and the PASS system when required post-LOCA.
To resolve this design issue, the licensee prepared a change to OP 2313C,
" Containment Post-Incident Hydrogen Control," Revision 18, dated January 12, 1996, to allow installation of Jumper wires (available in the control room) to open the appropriate containment isolation valve in the event a vital 125-Vdc bus is lost during a LOCA. ,
,
Operability Assessment TS2-95-745, dated October 5, 1995, proposed a permanent !
design change to correct the power supply logic for these containment *
j i
78 !
___ __.-_ _ _ _.._._ _ _ _ . _ . _ _._ __. _ __ _ . _
l
!
)
isolation valves, thereby achieving compliance with the licensing-bases single-failure criterion and the system design bases. However, ACR 01991 indicates that the licensee later decided (on November 9, 1995) that this ;
design change was not warranted; therefore, the design change was rejected and
, 'the procedure change (OP 2313C) was considered the permanent solution for this design deficiency.
. The team observed that the hydrogen monitoring system is an ESF system whose design bases require the configuration to meet the requirements for independence, redundancy, and the single-failure criterion in accordance with i the UFSAR (Sections 6.1, 6.6.1.2, 7.3.1.2.6, and Table 7.5-3); IEEE Standard :
279-1971, " Criteria for Protection Systems for Nuclear Power Generating .
Stations"; IEEE Standard 308-1970, " Criteria for Class IE Electrical Systems !
for Nuclear Power Generating Stations"; and RG 1.97, Revision 2, ;
" Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant Environs Conditions During and Following an Accident," dated December 1980. i Similarly, the containment gaseous and particulate radiation monitors are part l of the ESF system and the design bases also require independence, redundancy,
'
and compliance with the single-failure criterion, as described in UFSAR Section 7.3.2.2.c. 1
Therefore, the team found that the licensee's resolution to implement a change i to OP 2313C to correct the single-failure design deficiency is contrary to the l design-bases requirements. The team concluded that the procedure change -
i
'
significantly altered the design bases for the hydrogen monitoring system.
The fundamental design requirement is that a single failure of an active component would not affect the ability of the redundant system to perform the safety function. However, the present configuration of the hydrogen ,
monitoring system, which relies on installation of jumper wires by control room operators to power valves in the event of loss of a vital 125-Vdc bus 1-
'
coincident with an accident, does not meet the single-failure criterion.
Similar requirements exist for the containment gaseous and particulate monitoring system. In addition, the consequences for this major change to the design bases were not properly evaluated by the licensee. A safety evaluation, dated October 7, 1995, did not assess the effect on the i
consequences of changing the design bases for the system. In addition, it did not evaluate the increased chance of inadvertent short-circuit or ground on l the available dc bus when installing jumpers in cabinets with live circuits.
l
'
In summary, the team found that the design of the hydrogen monitoring system is outside the design bases.
In response to the team's concern, the licensee reevaluated the significance of this issue, and initiated ACR 7924'on March 20, 1996, to resolve the single-failure susceptibility for the hydrogen monitoring system and PASS. In addition, LER 96-09, dated March 18, 1996, and LER 96-10, dated March 25, 1996, stated that the 3-hour requirement for obtaining a containment sample for analysis in accordance with'NUREG-0737 (TMI Action Plan), and the 12-hour
requirement for manually starting the hydrogen monitoring system, could not be ,
met because it was discovered that'the hydrogen sample pump could not be !
started until the containment pressure drops below 10 psig. The licensee j ,
found that containment pressure would not drop below 10 psig until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> l
t
) 79
!
l
_ . _ _ _ _ _ _ _ _ _ _ . . _ . _ _ _
after a LOCA. ACR 8391, dated March 23, 1996, was also initiated to address some related technical issues.
The licensee issued Engineering Memorandum DE2-96-274 on May 14, 1996, to resolve the single-failure vulnerability prior to unit startup. DCN M2-96-054 .
was initiated to modify circuits to power the containment isolation valves from the appropriate power supply, thereby satisfying the single-failure criterion and allowing the hydrogen monitoring system and the PASS to function .
as required by the design bases.
The licensee's failure to ensure that the plant configuration was maintained i in accordance with the design and licensing bases is an apparent violation of 10 CFR Part 50,' Appendix B, Criterion III, " Design Control." (EEI 336/96-201-41) 3 5.3.2 Original Design Problems with Service Water Booster Pump (MP3) !
As previously discussed in Sections 2.2 and 4.1 of this report, the safety evaluation for SW booster pump temporary modification, B/J 390-20, was ;
inadequate and the licensee had missed many opportunities to identify the technical deficiencies noted by the NRC during this inspection. In addition, ,
to these concerns, the team noted that over the 10 years since the initial ,
identification of a design issue with the discharge valves the licensee had i identified several design problems, and for the most part, dispositioned them !
without making permanent design changes. Specifically:
In January 1986, the licensee identified that the required fire [
protection separation criteria had not been met for both SW booster pump i trains. The MOVs for the A and B trains were in the same room and both i valves could be disabled in their normally closed position during a [
fire. In response to this design problem, the licensee maintained the B l train MOV in the open position. This resulted in the B booster pump i running continuously instead'of only during a loss of offsite power. !
- In 1988,-the MOV manufacturer informed the licensee that the valve operators could detach from the valve stem during a seismic event. In response to this design problem, the licensee opened the A train MOV, t which also resulted in its booster pump running continuously. l
In February 1989, engineering noted that both booster pumps had i experienced accelerated wear as a result of the continuous operation. !
In response to this concern, the licensee racked out both booster pump J breakers. !
In January 1990, NRC inspectors noted that the pump breakers had been ;
racked out without performing a safety evaluation or revising the *
operating procedures. In response to these concerns, the licensee re- !
closed both breakers and, again, both booster pumps ran continuously. .
- In May 1990, the licensee installed temporary modification B/J 390-20, i which changed the system initiation signal from the MOV's "open" circuit , j to the pump's " start" circuit. This allowed the MOVs to remain open l 80 l
l i
l
- . . ___ _ _ _ _ _ __ _ L
_ _ _ _ _ _ _ _ _ . _ _ . . _ . _ _ _ _ _ _ . _ _ _ . - . _ . _ . _ _ _ _ - . _ _ _ _
i l
!
l without having the pumps running and ensured that the pumps started on
! an initiation signal. Procedure changes were made to prompt the operators to start the pumps. Subsequently, these procedure changes
.were inadvertently deleted.
] ~
- In May 1993, the licensee identified another fire protection separation
! problem, this time with the return duct temperature switches. In
. response, the licensee provided a firewatch until separation could be
- properly established. In this instance, a permanent design change was l made.
i i * In March 1996, the team found that temporary modification B/J 390-20 had not transferred the return duct high temperature switch, initiation i signal, from the MOVs "open" circuit to the booster pump " start" l circuit. In response, the licensee started the booster pumps until the
issue could be resolved.
In May 1996, in response to the team's concerns, the licensee completed the
-
installation of the permanent modification to replace B/J 390-20. The team
considered 10 years to be an excessive amount of time to resolve an identified i design deficiency.
5.3.3 Service Water Booster Pump Air Binding (MP3)
! . Team review of recent ACRs revealed that on three occasions since July 1995, a i SW booster pump had become air bound during surveillance testing.
- Specifically, ACR 3607 (dated July 11, 1995), ACR 4964 (dated September 13, i 1995), and ACR 12333 (dated April 30,1996), documented these occurrences.
j During review of the initial occurrence, engineering persor.ael postulated that
- improper venting during a swap of SW pumps just prior to the surveillance had i introduced the air that caused the booster pump to become air bound. However,
- ^ the ACR did not provide-a definitive conclusion that the occurrence was caused by personnel error in that the SW pumps had not been vented during pump swap nor did the ACR identify corrective actions.
The licensee analyzed the causes of the two subsequent occurrences and concluded that the affected booster pump had become air bound because of inadequate procedures. When the licensee performed an operability >
determination in response to ACR 4964, it concluded that during a design-basis loss-of-offsite-power event, the isolation of SW flow to nonsafety-related systems such as the turbine plant closed cooling water system, would increase service water system discharge pressure and flow to the remaining safety-related interfaces that would, in turn, sweep entrapped air from piping and component restrictions and, therefore, the booster pumps would remain operable. The team assessed the operability determination assumption as plausible; however, the licensee had not performed any quantitative analysis .
or system testing to support the operability determination. Engineering had I requested that potential design modifications to correct the air binding be
'
evaluated. However, the team noted that no action had been taken on this request. To date, corrective actions have been limited to procedure revisions that require additional operator actions to increase venting at component high
point during the swapping of operating SW pumps.
- . _ - - - - . . . - . _ - . - - - - - - - - - _ - _ . - - - -
l The team concluded that the licensee has yet to perform a comprehensive causal analysis for these occurrences. Additionally, the repeat nature of these occurrences indicates that the limited corrective actions taken to date have not been fully effective. Further, these corrective actions have placed l additional operational burdens on plant operators and have not addressed .
potential system modification enhancements.
5.4 Conclusions , ,
t The team found sevaral engineering deficiencies associated with the conduct of -
,
design modifications, and concluded that the engineering staff had failed to :
use appropriate rigor, thoroughness, and attention to detail. Among these deficiencies were technical errors and omissions, nonconservative assumptions, ;
and inadequate verification of all applicable design-bases information. The !
team further concluded that the noted deficiencies were both indicative of i significant weaknesses in the methodology and rigor used for the conduct of design verifications, and pointed to ineffective processes (such as t independent reviews, supervisory reviews, and reviews by oversight committees) ,
that are used to ensure appropriate design engineering performance. The lack ;
of rigor noted with respect to consideration of all applicable design-bases :
information during the conduct of modifications was considered significant )
because of its potential for creating a progressive loss of the design bases. }
>
The team found that the licensee had addressed several design-bases issues by .
the use of compensatory administrative controls or temporary modifications, .
rather than by restoring the affected system to its original design and i licensing bases in a timely manner. One concern pertained to the ability of ,
the MP3 service water booster pump discharge valves to meet 10 CFR Part 50, i Appendix R, requirements. This concern was handled by changing the system configuration, revising operating procedures, and installing a jumper.
However, the ' procedure changes were later removed and the jumper disabled a necessary automatic start feature of the pumps. Another concern about.the ability of the MP2 post-accident hydrogen-monitor isolation valves to open, if a single bus failed, was handled by revising a procedure to direct operators !
to install temporary jumpers following an accident. This resolution violated ,
the single-failure criterion and placed the hydrogen monitoring system design outside its design bases' A third example involved the recurring air binding
.
,
i of the SW booster pumps. In each instance, not only did the fundamental design issue remain uncorrected, but additional burdens were placed on the ;
operators to compensate for the design flaw. J 6.0 Material Safety Classification The team examined the evolution and implementation of the licensee's material !
safety classification program to follow-up on concerns that were initially raised in NRC IR 50-245/95-07; 50-336/95-07, 50-423/95-07 as URI 423/95-07-11. ;
The concerns pertained to the appropriateness of downgrading certain safety-related components (i.e., MP2 TDAFW pump and EDG air start system components, '
>
and MP3 containment personnel hatch door interlock components) to a nonsafety-related classification under the provisions of the licensee's Material, Equipment and Parts List (MEPL) Program. Additional inspection of these .
concerns was documented in NRC IR 50-245/95-09; 50-336/95-09; 50-423/95-09.
82 j i
!
-_ . _ _ _ _ _ - _ _ ____
- _. . . . - - - _ _ _ . . - . - - -
6.1 Backaround The team ascertained that structures, systems, and components (SSCs) at Millstone were originally classified in accordance with Appendix A of the
, . licensee's quality assurance (QA) topical report, which reflected the guidance of NRC RGs 1.26, " Quality Group Classifications and Standards for Water ,
Steam , and Radioactive Waste- Containing Components of Nuclear Power Plants,"
, and 1.29, " Seismic Design Classification." Subsequent to the initial safety classification process, the licensee developed the MEPL/ Bill of Materials (BOM) Program in July 1991, as part of a Nuclear Management and Resources Council (NUMARC) comprehensive procurement initiative. Specifically, the MEPL/B0M program utilized the guidance contained in Electric Power Research Institute Report NP-6895, " Guidelines for the Safety Classification of Systems, Components, and Parts Used in Nuclear Power Plant Applications (NCIG-17)."
In July 1992, Nuclear Energy Services (NES) was awarded the contract to generate the MEPL/BOM classification determinations for Millstone and Haddam Neck. This activity was to be performed in accordance with the requirements of NU's and NES's QA programs and the procedural controls defined in NGP 6.01,
" Material, Equipment, and Parts Lists (MEPL) for Inservice Nuclear Generation Facilities." The resulting changes in safety classifications were then to be incorporated into controlling design documents. Subsequent to its inception, the MEPL/BOM program underwent several changes which resulted in unexpected delays in schedule implementation. In August 1994, the Procurement Engineering Group (PEG) management realized that there was a strong likelihood of missing another project milestone. In response to these concerns, the licensee management agreed to allow the MEPL/B0M Project Manager to act as the individual MEPL Unit Engineer in order to eliminate perceived redundancy in the technical review of MEPL determinations. Following this decision, a memorandum authorizing this action was jointly issued on August 17, 1994, by the three Engineering Directors.
NES completed the MEPL/B0M classification determinations and reclassified affected components and parts in the Production Maintenance Management System (PMMS) database in August 1994 for MP1 and in March 1995 for MP2. The corresponding changes in the MP3 component safety classifications were not downloaded into PMMS, thus the classifications for affected components were not changed.
As noted above, concerns related to the implementation of the licensee's MEPL/BOM program were identified as NRC URI 50-423/95-07-11. This URI discussed concerns related to the downgrading of components associated with the containment personnel hatch door interlock system for MP3. The team determined that these interlock components had been downgraded in 1987, and were thus not part of the current MEPL/BOM program. The team noted from its review of NRC IR 95-09 that the' evaluation indicated that the revised safety
~
classification of selected components may not have been appropriately i performed. In particular, this report addressed the following MP2 safety-related components that had been reclassified as nonsafety-related: (1) the AFW pump, Terry turbine, and governor; (2) the pressurizer liquid and vapor space temperature and the pressurizer surge line temperature monitoring loops;
1 l
l
_ _ _ _ _ _ _ _ _ . _ _ _ _ _. _ _ . _ _ _ _ _ _ _ _ ._ _ _ .. _ _ .
,
d
! (3) the pressurizer spray valve actuators; (4) the reactor coolant pump speed
- sensor signals to the reactor protection system; and (5) the pressurizer
! motor operators. The. report noted that the licensee's reclassification
process determined that since these components were not specifically credited .
!
in the accident analyses, they were considered to be nonsafety-related. The
- adequacy of the licensee's implementation of the MEPL/BOM program was
. questioned because the items that were downgraded performed an accident .
! mitigation function, even though they were not specifically credited in the
- accident analysis.
.
l The NRC concern expressed in IR 95-09 was that a change in quality
, classification of a component could result in a change to the design bases of
the facility. Accordingly, the inspectors considered that the process must j appropriately consider the requirements of 10 CFR Part 50, Appendix B, i Criterion III, " Design Control." The licensee's position on this issue, as
! reporteo 1; NRC IR 95-09, was that a change in quality classification did not i constitute e design change for those SSCs that are not described as safety-i related in the UFSAR. However, it did not appear that the UFSAR contained a j comprehensive listing of safety-related SSCs, nor was it clear to what extent i the previous system classifications had been relied upon for subsequent design
!
work. The inspection report concluded that without the benefit of requisite
-
design reviews and safety evaluations, inappropriate downgrades in the safety classifications of SSCs could involve a USQ.
!
1 6.2 Insnection Team Evaluation i
! :
l 6.2.1 ACR 02621 Root Cause Evaluation (MP2) i
The licensee initiated a review of the MEPL/BOM safety classification process i in response to the identification of material safety classifica: ion concerns l documented in NRC URI 50-423/95-07-11, in order to determine if the l i
reclassification errors were the result of programmatic weaknesses or process )
! implementation issues. As a result of this effort, licensee personnel
determined that implementation errors had occurred which led to the
,
inappropriate reclassification (and subsequent downgrading in PMMS from QA
[ Category 1 to non-QA Category 1) of specific components including the MP2 AFW
! pump Terry turbine, and governor; reactor coolant pump (RCP) speed sensors,
{ and the PORV block valves. These deficiencies were documented in ACR 02621, l dated April 24, 1995.
The team reviewed the initial root cause investigation associated with this
- ACR, which was forwarded to the Vice President, Engineering Services on
! June 6, 1995. This root cause investigation was never formally issued for 1 action, as a result of a Vice President, Engineering Services memorandum of i July 31, 1995. This memorandum directed that the report be withdrawn for
! further review, clarification, or correction by an independent review team, with a proposed completion date of September 15, 1995. The Vice President, Engineering Services informed the team that this action was taken because
.
q.
j statements and inferences in the report were in dispute. Revision 1 of the 4 root cause investigation for ACR 02621 was issued on December 6, 1995, and was j noted by the team to contain comparable conclusions and recommendations as the
- 84 i
i
, - . . y .v.. . , . . . . - . . - -
.- . _ _ . _ _ _ _ . _ . _ _ _ _ . . . _ _ _ _
. _ _ _ _ _ . _ _ _ _ _ _ _
, initial report. The team determined that the reevaluation process, which r
- delayed implementation of corrective actions by approximately 6 months, did i
! not add substantively to the ultimate root cause determination findings.
l ., The issued root cause evaluation concluded that incorrect MEPL determinations were made for the Millstone units because appropriate individuals, ( knowledgeable about NU's plant-specific design bases and licensing
, commitments, were not available for discipline reviews. Pertinent sources of data as referenced in MEPL Procedure NGP 6.01 (e.g., safety analysis, l licensing commitments, TS Bases, etc.) were not accessed or researched in I
sufficient detail, and were misinterpreted. The root cause evaluation further
, stated that the deficiency in the review process was exacerbated when licensee t
management authorized the Nuclear Production Materials (NPM) MEPL/BOM Project t Manager to act as the MEPL Engineer for the program. This' action removed the value added to the complex MEPL determination process by experienced NU engineers and removed the importance of maintaining design engineering ownership of this program.
The root cause investigation concluded that the licensee had not provided adequate controls over the vendor performing the MEPL/BOM determinations and that both PEG and the vendor had deviated from the governing procedural requirements, resulting in the generation of incorrect safety classifications.
Specifically, the requirements of NGP 6.01 were not complied with, which resulted in three significant areas of procedural noncompliance:
(1) The technical review determination requirements of NGP 6.01, Section 6.1.2.4, were not properly executed. The "NO" box was checked for discipline reviews and the " required discipline reviews" were not listed. However, these attributes were specifically required for MEPL determinations involving a change in safety classification. ,
Furthermore, this section of the MEPL form was improperly signed and I dated after the completion of the actual evaluation work rather than !
before, which negated the selection of proper discipline reviews.
(2) NGP 6.01, Section 6.1.2.6, requires that the MEPL determination verification requirements be performed following the technical review determination. Contrary to this requirement, the specified verifications were signed as being " completed" prior to the technical review determination discussed in (1) above.
(3) NGP 6.01, Section 6.1.2.2, states, in part, that completed individual MEPL determinations may not be revised. Contrary to this requirement, new MEPL determinations were issued which superseded portions of the
'
existing MEPL determinations.
Following the root cause evaluation for ACR 02621, the licensee initiated extensive corrective actions f5r the Millstone units. These corrective
actions included the review and verification of nuclear indicators (QA
! Category 1 or non-QA status designators) that had been downgraded in the PMMS database, in order to confirm the appropriate implementation of NGP 6.01 requirements, and, where applicable, the return to a QA Category 1 quality
-
classification in PMMS for downgraded components. Additionally, work orders
- 85 l
.
_ _ _ . _ _ . _ . . _
that had been issued for components with incorrectly downgraded nuclear indicators, were reviewed to determine if any non-quality work activities had ,
been performed, downgraded parts installed, non-quality procedures utilized, i or if improperly trained personnel had performed safety-related work. The l materials management program enhancements were instituted through the .
!
licensee's detailed procedural reviews which culminated in the replacement of ;
Procedure NGP 6.01 with Standard Specification SP-ST-ME-944. The improved I process controls defined in Standard Specification SP-ST-ME-944 limited the ,
ability to make changes in the PMMS nuclear indicators to a select group of '
individuals, and defined more stringent procedural controls for safety classification activities, which addressed most of the previously identified problems in the MEPL determination process. The team noted, however, three !
areas in which Standard Specification SP-ST-ME-944 appeared to need further >
strengthening: (1) ensuring that all the design- and licensing- bases requirements and commitments applicable to the item being evaluated for QA/ safety classification are reviewed for their effect on the classification .
of the ites (part, component, material) itself and not just the parent system,
'
in order to maintain design control in accordance with Criterion III of 10 CFR Part 50, Appendix B; (2) ensuring that failure modes and effects analyses consider all safety-adverse failure effects and not be limited to the effects on the parent system / component of the item being evaluated (i.e., failures of I components that can be tolerated by the parent system component, but with an adverse effect on surrounding equipment); and (3) establishing procedures as required by Criterion V of 10 CFR Part 50, Appendix B, to govern the process of creating MEPL-bases documents or for preparing the attachments used to supplement the various sections of the MEPL determination forms.
The licensee's review and verification of affected component indicators revealed that of the population of 1447 items downgraded for MPI, approximately 20 percent were returned to a QA Category I status and that an additional 364 devices were conservatively upgraded to QA Category 1. On the bases of the findings documented in ACR 02621, and the results of the MPI ,
component nuclear indicator reviews, MP2 elected to restore the QA Category 1 l status to all of the approximately 1000 affected items. Relative to MP3, the comprehensive proposed changes to the nuclear indicators proposed by the MEPL/BOM Program were never downloaded into the PMS database and, as a result, the components were never downgraded. This difference in implementation philosophy was the result of MP3 Design Engineering's position (documented in. Memorandum MP3-DE-95-1009, dated January 4, 1995), which defined its intention to maintain review authority over the list of changes to l nuclear indicators prior to downloading the data into PMMS. The team '
ascertained that a few inappropriate downgrades were performed in MP3 prior to the MEPL/BOM Program, and a few individual component downgrades were also made during the MEPL/BOM Program which had been approved by MP3 Design Engineering.
During this inspection effort, the team confirmed the findings identified in NRC URI 50-423/95-07-11 relative to the licensee's failure to maintain adequate design controls for components that perform a safety function. .
Specifically, the team concluded that as a result of inadequate oversight of contractor supplied services, involving the safety classification of SSCs, numerous components maintained in the licensee's MEPL/BOM program were *
improperly downgraded from a QA Category I safety-related classification to
. - _. .. . _ _ . . - - .. .
,
)
non-QA. As a result of incorrect implementation of the MEPL/B0M program requirements, safety classification determinations were not prepared and
'
approved in accordance with the controlling procedural requirements of NGP !
6.01. Furthermore, as documented in ACR 02621, the technical reviews and
. appropriate discipline reviews were not properly performed nor were pertinent I sources of data involving licensing commitments, TS Bases, or safety analysis
,
searched in sufficient detail.
<
,
,
Accordingly, NRC URI 50-423/95-07-11 is closed. The failure of the licensee l to implement appropriate quality standards and measures for the selection and review for suitability of application of material, parts, equipment and processes that are essential to the safety-related functions of structures, systems, and components is an apparent violation of 10 CFR Part 50, Appendix B, Criterion III, " Design Control." (EEI 336/96-201-42)
.
,
'
6.2.2 Material, Equipment, and Parts List-Related Nonconformance Reports (MP2 and MP3)
l
'
During NRC inspection of MEPL-related NCRs at Haddam Neck (IR 50-213/96-201),
4 the team identified that neither NU Procedure NGP 3.05, "Nonconformance !
- Reports," nor NU MEPL procedures provided any guidance regarding the criteria to be used in evaluating the adequacy of installed non-QA material in safety-
. related applications. The team concluded that this lack of procedural J
guidance was a principal factor in the observation that approximately 20 l MEPL-related NCRs from 1994 were closed without adequate written justification
'
for " Admin" or "use-as-is" dispositions. The team findings were identified as an apparent violation (50-213/96-201-35) of 10 CFR Part 50, Appendix B, Criterion XV, " Control of Nonconforming Material, Parts and Components," and 10 CFR Part 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings."
The team found additional examples during its review of MP21993 - 1996 MEPL-related NCRs where inadequate written justifications had been made for " Admin"
,
or "use-as-is" dispositions. These examples included:
1 * NCR 294-134 (various spent fuel pool cooling (SFPC) system valves)
. NCR 294-156 (Pipe Supports HGR-60365 and HGR-60375)
.
NCR 294-157 (MS Valve 2-MS-138)
- NCR 294-158 (Vent Damper 2-HV-279)
. NCR 294-167 (SW System, Pushbuttons PB1/6475, PB2/6481, and PB3/6488)
The team also identified NCRs that were dispositioned by reconfirming non-QA classifications without adequatie bases (i.e., MEPL revaluations that
,
contradicted the NCRs). Examples noted in this category included:
- NCR 294-155 - This NCR classified valve actuator 2-CN-2410, level I
controller LC-5280C, and CST level transmitter LT-5280, associated with vacuum drag valve 2-CN-241 as non-QA. The normal function of this valve
- - - -- . - - - -..- -- - - = - - - . . - - .-
i is to open to provide main condenser hotwell makeup water from the CST.
- The components in question also have the active safety function of I
overriding an open signal for valve 2-CN-241 to close to preserve i minimum CST volume for AFW use. However, the NCR disposition took
- credit for a valve modification that restricts flow to the hotwell in .
'
) case the valve fails open. This modification allows time for operator
- intervention to prevent draining the CST below minimum required volume for AFW. The team did not consider, however, that a backup measure , ,
involving operator intervention was adequate justification for not !
considering the active safety function of the components. i
,
- NCRs 294-136 (safety injection (SI) tank pressure indicators) and 294- !
, 135-(HPSI pressure transmitters) - These NCRs were inconsistent with the i design bases because they classified the instruments as non-QA despite j the pressure boundary functions of the instruments.
Before the conclusion of the onsite inspection, the licensee provided, with the exception of the vacuum drag valve components, additional information
-
which supported a determination, for the examples noted by the team, that the
<
installed components were suitable for their safety-related application
+
despite the inadequacies in the NCR disposition justifications. The question ,
- of the correct safety classification for the vacuum drag valve components was !
still under review by the licensee at the conclusion of the onsite inspection. ,
The lack of adequate justification for the dispositions of MEPL-related NCRs constituted a failure to prevent the use of potentially nonconforming material in safety-related applications. This failure to establish adequate measures to control nonconforming material, parts, or components is an apparent violation of 10 CFR Part 50, Appendix B, Criterion XV, " Control of Nonconforming Material, Parts, and Components." In addition, the failure to establish instructions or procedures, appropriate to the circumstances to prescribe the process of evaluating the suitability of non-QA components ,
installed in safety-related applications, an activity affecting quality, is an !
apparent violation of 10 CFR Part 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings." (EEI 336/96-201-43; 423/96-201-43) l
6.3 Conclusions The team ascertained from review of the root cause evaluation for ACR 02621 that incorrect MEPL determinations were made to support changes in the safety classification of components in the Millstone units. The team concluded that these errors resulted from lack of effective licensee oversight of the vendor performing the MEPL determinations. This problem was exacerbated by licensee management's authorization to use a licensee review process for safety classification determinations which did not involve licensee engineering staff who were familiar with site-specific design bases and licensing commitments.
The team also concluded that wehknesses in engineering programmatic requirements, including the procedures and guidance for dispositioning potential nonconforming material, coupled with a lack of technical rigor, '
thoroughness, and attention to detail in the design process, contributed to these r?rors. ,
.. . . . - . _ - - . - - . .. ._ ... - - - . . . _ . . _ . . _ . - - . - ..
)
)
l l 7.0 Manaaement Meetina
1 The team sumarized the inspection findings to members of licensee management
- at the conclusion of the inspection on May 22, 1996.
! . 1
'
- The team asked the licensee whether any materials examined during the
- inspection should be considered proprietary. No proprietary information was j , identified.
.
!
<
a
!
f I
l l
t l
l
. i
. :
.
-- - -. . _ - _ - - .
o
- i l
l I
APPENDIX A
- LIST OF PRIMARY DOCUMENTS REVIEWED
)
1. Licensee calculations (including CCNs):
'
'
-
90-050-249 E3
-
90-050-308 E3 s
- 67E, " Maximum Cable Length for continuous Duty Motors," Revision 0
- 69E, " Maximum Cable Length for Heater Feeders," Revision 0
-
192E, " Maximum Cable Length for Lighting Transformer Feeders," i i Revision 0 i
- 173E, " Determine Ampacity of "C" Cables Installed in Tray or
- Conduit," Revision 0 i
- - CCN 1 to Calculation 173E, dated July 26, 1995 '
'
- 188E Revision 2, CCN 1
!
- NL-038, " Station Service Study Voltage Profile," Revision 2, l including CCN 4, dated October 20, 1995
- PA-88-031-GE, Revision 2
- PA 90-105-318El, Revision 1
- 95-ENG-1198 M2, Revision 1, dated April 14, 1995
- 3-ENG-148, " Determination of Capacity for 3SIH*RV-8851, -8853A, and - !
8853B," dated March 31, 1991 l
- 12179-PH-97, " Relief Valve Reaction Load Calculation," dated May 5, 1993
-
12170-PH-97, " Relief Valve Reaction Loads"
-
SWEC P(T)-1070, " Orifice Size Determination for Air Admission into Service Water HVK Supply Line," Revision 0, dated January 26, 1985
-
95-ENG-1324-D2, Revision 0, dated November 15, 1995
-
95-ENG-1109 MS, Revision 0, dated April 12, 1995
- 12179-P(T)-1092, dated March 22, 1985
- 12179-NE-025, dated November 8, 1985
- 90-069-01116M3
-
W3-517-981-RE, Revision 4, dated June 29, 1995
-
91-074-324M3, Revision 0, dated March 1, 1993 ,
- 12179-PH-90, Revision 0, dated May 26, 1983 '
2. Plant Design Change Requests:
- PDCR MP3-91-045
-
PDCR MP3-91-075
- PDCR 3-94-0162
-
PDCR MP3-94-122, "3HVR*ACUIA/B Service Water Cooling Coil Replacement," Revision 0
- PDCR 2-064-94, " Vital Switchgear Ventilation System - Service Water Isolation"
.
3. Abnormal Operating Procedures (AOPs):
- A0P 3563, Revision 4 A-1
- _ _ _ _ . _ . _ _ _ . . _ _ _ _ _ . _ _ _ . - _ _ _ . . . . _ _ _ _
.
APPENDIX A LIST OF PRIMARY DOCUMENTS REVIEWED (Continued)
.
4. Emergency Operating Procedures (EOPs):
'
- E0P 35 ECA-0.0, Revision 11, dated October 3, 1995
- E0P 35 ECA 0.3
-
E0P E-0, " Reactor Trip or Safety Injection" 5. Surveillance Procedures (SPs):
-
SPs 3622.1 and 3622.2, "MDAFW Pump 3FWA* PIA &B Operational Readiness Tests"
-
SP 3622.3, "TDAFW Pump 3FWA*P2 Operational Readiness Tests" 6. Operating Procedures (ops):
-
OP 2313C, " Containment Post-Incident Hydrogen Control," Revision 18, dated January 12, 1996
-
OP 33460, " Station Blackout Diesel"
-
OP 3208, " Plant Cooldown," Revision 14, dated April 12, 1995
- OP 3344A, Revision 10, "480 Volt Load Centers" 7. Nuclear Group Procedures (NGPs):
-
NGP 4.03, " Changes and Updates to Final Safety Analysis Reports for Operating Nuclear Power Plants"
-
NGP 5.28, " Development, Review, Update and Use of Design Basis Documentation Packages"
-
NGP 3.05, "Nonconformance Reports," Revision 8
-
NGP 2.40, " Issues Management and Action Tracking"
-
NGP 6.01, " Material, Equipment, and Parts Lists (MEPL) for Inservice Nuclear Generation Facilities" 8. Other miscellaneous procedures:
-
Generation Test Services Procedure CPT 1407, Revision 0, " Panel Meter and Transducer Calibration."
-
WC 1, " Work Control Process," Attachment 10, Revision 1
- SB0 Procedure DNP 503C 9. Adverse Condition Reports (ACRs):
- ACR 01991, dated October 6, 1995
- ACR 8645, dated March 20, 1996
- ACR 04845, dated October 2, 1995 -
- ACR 8001, dated March 14, 1996
.
A-2
_.. . _ _ . _ _ _ _ _ _ _ _ . - _ _ _ _ _ . _ _ - . _ . ._ ._
l I
J APPENDIX A LIST OF PRIMARY DOCUMENTS REVIEWED L
, (Continued)
i
-
)
! -
ACR 5218, dated September 29, 1995 l*
-
ACR 1163, dated September 23, 1995 i i - ACR 7769, dated January 16, 1996
.
'
-
ACR O b35, dated June 8, 1995
-
ACR 9623, dated March 20, 1996 i j -
ACR 8655, dated March 20, 1996
-
ACR 10519, dated March 20, 1996 i -
ACR 10785, dated March 22, 1996 -
-
ACR 08987, dated February 6,1996 ;
-
ACR 13318, dated May 10, 1996 l
3 -
ACR 03925, dated July 4, 1995
- -
ACR 08174, dated December 17, 1995
) - ACR 07507, dated February 11, 1996 l -
ACR 08904, dated February 8, 1996 i - ACR 03532, dated October 3, 1995 l -
ACR 8331, dated March 4, 1996 l - ACR 7506, dated February 16, 1996
- ACR 3607, dated July 11, 1995
-
ACR 4964, dated September 13, 1995
- -
ACR 12333, dated April 30,-1996
-
ACR 02621, dated April 24, 1995
! 10. Quality and Assessment Services (QAS) Audit Reports:
! -
A60582/A60583/A60584, dated April 22, 1996, " Document Control"
-
A30336, " Millstone Licensing," dated March 1, 1995 ;
- - SIP MP3-P-95-006, dated October 11, 1995
! - A21054/A22054/A23054, " Corrective Action-Nonconformance Reports,"
- dated July 22, 1992
! - A25092/A21065/A22065/A23065, "Nonconformance Reports," dated July 14,
} 1994-11. Technical evaluations, "MP3 Service Water Operability Under a Loss of l
! Offsite Power Given a 77 'F Ultimate Heat Sink Temperature," dated j
.
August 10, 1994, and "MP3 Service Water Operability During a Steam '
j Generator Tube Rupture Event Without a Loss of Offsite Power Given a 77
- 'F Ultimate Heat Sink Temperature," dated August 10, 1994 {
,
- 12. Westinghouse analyses NTD-NSRLA-0PL-94-129, dated June 29, 1994, and l ET-NSL-0PL-I-94-173, dated May 6, 1994 i
13. VECTRA Report 24-00116, Revision 0, dated October 1994, " Station i -
Blackout Assessment,"
J A-3
i
+
>
+ !
.
- . -
APPENDIX A LIST OF PRIMARY DOCUMENTS REVIEWED (Continued)
'
.
14. MKW Power Systems memorandum, dated July 22, 1992 15. Engineering Work Request (EWR) 2-94-00236, dated August 2, 1994
'
16. Design Engineering memorandum DE 2-95-937, dated October 13, 1995 17. Memorandum MP3-DE-95-1009, dated January 4, 1995 :
18. FSARCR 95-MP3-12 19. PTSCR 3-38-94 20. CE Specification 18767-ICE-501, Section 3.0.0, " Reactor Protection System," Revision 1, dated November 19, 1973 21. CE Specification 00000-ICE-501, Section 3.1.1, " Reactor Protection System," Revision 4, dated May 17, 1973 22. Engineering Record (ER) ER-96-0064, dated March 16, 1996, and Revision 1, dated May 9, 1996 23. Rosemount Instruction Manual 4302, Revision B, dated July 1982 24. DCN DM2-S-1246-95, dated February 27, 1996, " Modification to Fire Protection Piping Cable Spreading Area Turbine Building" 25. Maintenance Form 3712NA-1, Revision 5, " Battery Housekeeping" 26. Specifications
-
Specification SP-EE-317, " Specification for Diesel Generator Station Blackout, Revision 1, September 19, 1991
-
Specification SP-EE-321, Revision 0 "NUSCO Control of Electrical Setpoint Data Base," Volumes 1, 2 and 3, January 22, 1992 I
-
Specification SP-EE-363, "SB0 Safe Shutdown Scenario Document"
-
Specification SP-ST-ME-944
-
Specification SP-EE-269, Revision 0, " Electrical Design Criteria,"
dated June 16, 1988 27. Plant Information Report 3-94-060 "AFW High Energy Line Break (HELB)
Concerns," dated March 15, 1994 28. Safety Evaluation JJC-041894, "MP3 AFW System 3FWA*HV36A/B/C/D Procedure '
I Change for Normal Startup, Hot Standby, and Shutdown Evolutions," dated May 10, 1994
.
A-4
APPENDIX A LIST OF PRIMARY DOCUMENTS REVIEWED (Continued)
.
29. Design Control Manual, Revision 2, dated January 15, 1996
'
30. Electrical One-Line Drawing 12179-EE-1AV 31. REF 92-67, dated October 28, 1992 32. REF 92-82, dated December 1, 1992 33. REF 93-04, dated March 14, 1994 34. NU memorandum, dated February 16, 1993 35. DCN DM3-S-0677-93, dated August 12, 1993 36. Yankee Atomic Report, " Effectiveness of the Quality Assessment Process,"
dated April 12, 1995 37. QAS memorandum, dated September 15, 1995 38. NU memorandum, dated October 6, 1994 39. Nuclear Safety Engineering Group report, dated February 8,1996 ,
l 40. NU memorandum, dated August 14, 1995 '
41. Bypass / Jumper 2-95-045, dated April 14, 1995 42. Engineering'& Design Coordination Report T-P-06677, dated August 1. 1985 43. MKW Power Systems letter, " Battery Sizing Data," dated July 16, 1992 44. GNB Worksheet, dated July 14, 1992 45. Battery Duty Cycle, dated May 19, 1992 (MKW Power Systems)
46. SB0 test IST 3-93-017, dated August 13, 1993 47. Operability Assessment TS2-95-745, dated October 5, 1995
.
e A-5
_ - . _ . . _ _ _ . . . . __ _ . .- _ _. _ _ . __ _ _ . _ .
APPENDIX B LIST OF ACRONYMS
) "*
~
AAC alternate alternating current ACR adverse condition report AFW auxiliary feedwater AITTS Action Item Tracking and Trending System A0P abnormal operating procedure
,
AR action request
'
ASLB auxiliary steamline break ASME American Society of Mechanical Engineers l AWO automated work order
.
- B/J bypass jumper BOM bill of materials
-! CCN calculation change notice
- CE Combustion Engineering
,
'
CFR Code of Federal Regulations CST condensate storage tank
,
CWD control wiring diagram
- DBDP Design Basis Documentation Package
DCM Design Control Manual DCN design change notice
DEF discrepancy evaluation form DG diesel generator DWST demineralized water storage tank l EDG emergency diesel generator
- EDS electrical distribution system EEI escalated enforcement item l EMI electromagnetic interference i
'
E0P tmergency operating procedure ER engineering record ERT event response team ESF engineered safeguards feature EWR engineering work request FME foreign material exclusion
< FP fire protection FSAR Final Safety Analysis Report i FSARCR Final Safety Analysis Report Change Request GDC General Design Criteri6n 4 GL generic letter
'
-
GNB Gesellschaft for NLklear-Behalter B-I
-
f f
J
_ _ _ _ _ . . _ _ . _. _ _ _ . . . - . _ . _ _ . _ . _ . . _ - _ . _ _ _ _ _ . . - - . _
APPENDIX B LIST OF ACRONYMS (Continued) '
,
,
HELB high energy line break ,
HPSI high pressure safety injection *
heating, ventilation, and air conditioning
'
HVAC l ICEA Insulated Cable Engineers Association IEEE Institute of Electrical and Electronics Engineers 1 IN information notice IR inspection report ISEG Independent Safety Engineering Group LER licensee event report LIST Licensing Information Search Tool LLRT local leak rate testing LOCA loss-of-coolant accident LOP loss-of-power LPSI low pressure safety injection LT level transmitter MCC motor control center MDAFW motor-driven auxiliary feedwater MEPL material, equipment, and parts list MOV motor-operated valve MPI Millstone Unit I MP2 Millstone Unit 2 MP3 Millstone Unit 3 NCR nonconformance report NEO Nuclear Engineering and Operations Procedure NES Nuclear Energy Services NGP nuclear group procedure NOV Notice of Violation NPM nuclear production materials NRC Nuclear Regulatory Commission (U.S.)
NRR Nuclear Reactor Regulation (Office of)
NU Northeast Utilities NUMARC Nuclear Management and Resources Council-NUSCO Northeast Utilities Service Co.
OD operability determination OP operating procedure ,
,
a B-2
- . . - - -. -.-..-. . . ~ - - - - .. _ - .
'
l
i APPENDIX B
- LIST OF ACRONYMS i (Continued)
-. I 1 P&ID piping and instrumentation drawings
- PASS post-accident sampling system )
i
!*
PDCR plant design change request '
PEG Procurement Engineering Group
, PIR plant information report PM preventive maintenance Pl#tS Production Maintenance Management System
'
PORC Plant Operations Review Committee PORV power-operated relief valves i
PRA probabilistic risk assessment PTSCR proposed technical specification change request
- QA quality assurance
] QAS Quality and Assessment Services j RBCCW reactor building closed cooling water
.
RCA rod control center RCM Regulatory Compliance Manual
.
RCP reactor coolant pump REF reportability evaluation form j RG Regulatory Guide
~
RO restricting orifice RPCCW reactor plant closed cooling system j RSS recirculation spray system i
j RSSHX recirculation system heat exchanger i
3 SB0 station blackout !
) SCCs structures, systems, and components
. SE safety evaluation
.
SER safety evaluation report 1 SFPC spent fuel pool cooling i SG steam generator l SGCS safety grade cold shutdown l SI safety injection i SIH high pressure safety injection
, SOV solenoid-operated valve i
'
SP surveillance procedure SSCs structures, systems, and components
-
!
J a
'
B-3 f
_. - . . _ . - _ _ . .. - - _ _ . _ _ _. ___ .- -- - _ _. . _ _ - ~ _ .
I l
!
l i
'
! APPENDIX B LIST OF ACRONYMS (Continued) ;
- !
TDAFW turbine-driven auxiliary feedwater i l TR trouble report ;
i TS Technical Specification '
,
UFSAR updated final safety analysis report I l URI unresolved item (NRC)
'
l UPS uninterruptable power supply l USQ unreviewed safety question l l '
VTM vendor technical manual WC work control l
'
l l
l
!
.
6 l
B-4
- . - - _ . - - - . . - - - -- - ..- - -. -. _ .- - . - ..- . - - . -
APPENDIX C
, APPARENT VIOLATIONS
'
MP2 ISSUES NUMBER Failure to adequately evaluate temporary modification in 336/96-201-03 accordance with 10 CFR 50.59 Failure to ensure adequate design control measures for 336/96-201-09 DBDPs Failure to adequately control installation of temporary 336/96-201-11 modification to RBCCW surge tank ,
Failure to maintain nuclear instrumentation channel 336/96-201-12 independence Failure to maintain MCC environmental enclosures 336/96-201-20 Failure to promptly correct identified discrepancy with 336/96-201-25 dual-function isolation valves Failure to promptly correct SB0 audit deficiencies 336/96-201-28 Failure to promptly correct identified nonconforming 336/96-201-29 conditions Failure to promptly correct significant conditions 336/96-201-30 adverse to quality Inadequate design verification for RBCCW Surge Tank 336/96-201-31 Seismic Restraint Inadequate corrective action for SW seismic design 336/96-201-36 deficiency Failure to meet single failure criterion for hydrogen 336/96-201-41 monitor Failure to implement adequate design controls for MEPL 336/96-201-42 Failure to establish adequate measures to control 336/96-201-43 nonconforming materials
.
I e
C-1
.
_. ._ _ ,
APPENDIX C APPARENT VIOLATIONS (Continued)
MP3 ISSUES NUMBER ,
failure to update UFSAR in accordance with 10 CFR 50.71(e) 423/96-201-01 Failure to adequately evaluate a temporary modification in 423/96-201-02 -
accordance with 10 CFR 50.59 Failure to request TS amendment in accordance with 10 CFR 423/96-201-04 50.59 -
Failure to comply with TS 3.7.1.2, AFW system 423/96-201-05 Failure to evaluate UFSAR change in accordance with 10 CFR 423/96-201-06 50.59 Failure to evaluate UFSAR change in accordance with 10 CFR 423/96-201-07 50.59 Failure to evaluate changes to SB0 equipment and 423/96-201-08 procedures described in the UFSAR in accordance with 10 CFR 50.59 Failure to ensure adequate design control measures for 423/96-201-09 DBDPs Failure to maintain records supporting a TS amendment 423/96-201-10 request Failure to revise TS to reflect unusable CST volume 423/96-201-13 Failure to establish design controls to verify adequacy of 423/96-201-15 angle-type SOVs Failure to maintain lubrication interval for AFW pumps 423/96-201-18 Failure to ensure Rosemount transmitters were installed 423/96-201-19 consistent with vendor recommendations Failure to promptly identify and correct adequate 423/96-201-21 installation of temporary equipment Failure to identify operation of the RPCCW system above 423/96-201-22 UFSAR limit Failure to identify inadequate temporary modification of 423/96-201-23 SW booster pump start circuit Failure to identify concrete spalling on SW booster pump 423/96-201-24 pedestal
'
Failure to take adequate corrective action for scaffold 423/96-201-26 installation deficiencies
Failure to adequately correct inconsistencies with 423/96-201-27 protective relay setting criteria C-2
APPENDIX C APPARENT VIOLATIONS (Continued)
,
MP3 ISSUES NUMBER
Failure to promptly correct SB0 audit deficiencies 423/96-201-28 Failure'to promptly correct identified nonconforming 423/96-201-29 conditions Failure to obtain authorization for deferral of 423/96-201-32 hydrostatic test Failure to comply with ASME Code provisions for 423/96-201-33 hydrostatic test Failure to adequately evaluate post-modification testing 423/96-201-34 of MCC/RCA coils Failure to analyze impact of SW orifice 423/96-201-35 Failure to apply design control measures to battery room 423/96-201-37 filters Failure to use correct turbine exhaust pressure in TDAFW 423/96-201-39 calculation Failure to establish adequate measures to control 423/96-201-43 nonconforming materials I
.
O e
C-3
.. - . _ . - - - . . . .._.._ .. ..- _ -. -- _. - - _-..._ _- _ . . - . . _ . . .
i l APPENDIX D i
j UNRESOLVED ITEMS
!
i
MP2 ISSUES NUMBER Failure to consider post-accident fluid temperatures in 336/96-201-38 j
analyses
!
i l MP3 ISSUES NUMBER j _
Adequacy of SB0 design-bases, testing, and procedures 423/96-201-14 Analysis related to TDAFW discharge isolation valves 423/96-201-16 l
l Lubrication interval for MDAFW pump bearings 423/96-201-17 i
j Evaluation of TDAFW pump performance 423/96-201-40
i
i i
!
!
i I l l l t
i i
!
l i
- !
I
~
.
D-1
. - . . _
l
'
i i
n l September 12, 1996 l l-1
Mr. Ted l Executive Vice President - Nuclear l Northeast Nuclear Energy Company c/o Mr. Terry L. Harpster P. O. Box 128 Waterford, Connecticut 06385 j SUBJECT: NRC MILLSTONE UNIT 3 RESTART ASSESSMENT PLAN I
Dear Mr. Feigenbaum:
The enclosed document is the NRC Millstone Unit 3 Restart Assessment Plan. It is beir.g ;
provided to you to ensure there is a clear understanding of the issues of concern to the NRC and allow maximum coordination of your restart activities. As your restart activities identify l new issues, we will modify our plan to incorporate emerging concerns. If you have ;
questions regarding the contents of this document, please contact me or Jacque Durr of my i staff. j Sinerely, Original Signed By Jacque Durr for:
Wayne Utnning, Director 1
'
Millstone Oversight Team Docket No. 50-423 Enclosure: NRC Millstone Unit 3 Restart Assessment Plan ,
l cc w/ encl:
M. H. Brothers, Nuclear Unit 3 Director L. M. Cuoco, Esquire D. B. Miller, Senior Vice President,-Nuclear Safety and Oversight S. E. Scace, Vice President, Reengineering !
E. A. DeBarba, Vice President, Nuclear Technical Services l F. C. Rothen, Vice President, Maintenance Services S. B. Comley, We The People l V. Juliano, Waterford Library .
J. Buckingham, Department of Public Utility Control l State of Connecticut SLO
.
a fi A I M M C ENCLOSURE 3
"snIVJJl ;
lI
'
.
l
_. _ _ . . . . - . _ _ . __ _ _ _ _ . __ . _ . . . _ _ . - ..
.
!
l l
t l September 12,1996
!
l I
- MEMORANDUM TO
- Hubert J. Miller,
! Regional Administrator, R1
, Roy Zimmerman I Associate Director for Projects Ofhe of Nuclear Reactor Regulation l FROM: Wayne D. Lanning, Director Millstone Oversight Team, RI Phillip F. McKee, Director Northeast Utilities Project Directorate i Office of Nuclear Reactor Regulation l SUBJECT: MILLSTONE RESTART ASSESSMENT PLAN Attached for your review and approval is the Millstone Station Restart Assessment Plan which encompasses the NRC Manual Chapter MC 0350, Staff Guidelines for Restart Approval. The Millstone Oversight Team (MOT) will fulfill the role of Restart Panel for the purposes of MC 0350. This assessment plan is applicable to Millstone Unit 3, and, once approved, will be maintained and updated as necessary by the Millstone Oversight Team.
! The MOT intends to make minor revisions without seeking additional approval; however, if a significant revision is made to the plan, you will be notified and requested to approve the change. The restart plans for Units 1 and 2 will generally contain the same generic issues 1 supplemented with plant specific technicalissues. l The restart assesement plan consists of several major elements requiring close j coordination of NRC resources. First, the MOT is emphasizing the broader programmatic I issues being addressed by the licensee in their improving Station Performance Program.
These are the underlying issues that have contributed to the decline in the licensee's i performance. The second area is the licensee's responses to the 10 CFR 50.54 (f) letters
- for each of the units and the associatod NRC Confirmatory Order. Lastly, the MC 0350 I overview process and the Operational Safety Team inspection will be tailored to the restart l Of the specific unit. -
hh h (f-
. - . = - _ . .. .. _. -_-- . .. _ _ _ . - - . - .
.
.
- The MOT will continue to meet with the licensee and the public regarding this plan. l Accordingly, this plan will be a living document and updated periodically.
Original Signed By: Original Signed By:
Phillip F. McKee, Director Wayne D. Lanning, Director Northeast Utilities Project Directorate Millstone Oversight Team Office of Nuclear Reactor Regulation Region I l
.
Original Signed By: Original Signed By:
Approved:
Roy Zimmerman Date Hubert J. Miller Date l
l I
.
i l
i I
.
l
.
.
.
REV 9/12/96 MILLSTONE i RESTART ASSESSMENT PLAN l
l 1.0 BACKGROUND l The three Millstone Units are shut down to formulate responses to a series of ,
10 CFR 50.54 (f) letters requiring them to affirm their compliance with the l conditions of each unit's license and the regulations. The NRC performed a series l of inspections at Units 2 and 3 with a 20 person Special Inspection Team (SIT) to 4 ascertain the extent of their compliance. Currently, the results of those inspections l are under assessment by the team and NRC management. The licensee is focusing i on Unit 3 as the lead plant for restart, and is directing resources from the other !
units to concentrate on completing one unit at a time.
On June 28,1996, the Executive Director for Operations issued a letter to the licensee that stated the Commission had decided to make the three Millstone units a Category 3 on the Watch List and would vote on the restart of the Millstone {
units. It is the intent to implement the appropriate aspects of NRC Manual Chapter '
0350, " Staff Guidelines for Restart Approval" for the restart of all three units. The NRC will schedule and implement its inspection program after the licensee has I indicated that the activities necessary for restart are complete and ready for inspection. The NRC has been dealing with Northeast Utilities on broader performance issues which go beyond the 10 CFR 50.54(f) concerns. These broader concerns are considered contributory causes for the current poor performance, which the 10 CFR 50.54(f) issues are a subset. These issues have been formalized by the licensee in a program titled " Improving Station Performance" (ISP) and are topics that will be addressed by the licensee and reviewed by the NRC Millstone l Oversight Team (MOT). A meeting was conducted on April 30,1996,and disclosed that the licensee was not adequately managing the program nor tracking progress.
The salient concerns embodied in the ISP include leadership, communications (employee concerns), the corrective action program, procedural adherence and procedure upgrades, work planning and control, and operational enhancements.
The NRC restart assessment program will focus on the broader issues of the ISP and licensee self assessments and management oversight, recognizing the necessity to ensure adequate closure of the 10 CFR 50.54(f) process. The NRC plan for inspection of the Improving Station Performance issues is discussed in more detailin Section 3 of this plan.
2.0 10 CFR 50.54(f) Activities Each Millstone unit has beer > requested to submit information describing actions taken to ensure that future operations will be conducted in accordance with the terms and conditions of the operating license, the Commission's regulations, and the Final Safety Analysis Report. The NRC requested that the information be submitted no later than 7 days prior to the restart of the respective Millstone units.
In the May 21,1996 letter, the NRC requested NU to provide for each unit its plans for completing the licensing bases reviews.
.
- ..
.
i l
l .
l To aid in NRC understanding of how deficiencies were identified and dispositioned, the NRC's May 21,1996, letter also requested that NU provide for each Millstone unit a comprehensive list of design and configuration deficiencies and information j
related to how each deficiency was identified and will be dispositioned.
On August 14,1996, the NRC issued a Confirmatory Order establishing an Independent Corrective Action Verification (ICAV) program. The independent effort
, will verify the adequacy of NU's efforts to establish adequate design bases and
'
design controls, including translation of the design bases into operating psocedures and maintenance and testing practices, verification of system performance, and
,
implementation of modifications since issuance of the initial facility operating '
' licenses. The NRC oversight of the ICAV program and activities will be separate from, and in addition to the activities described in this restart essessment plan. The
. results from this program will be incorporated into this restart plan and considered a significant part of the decision regarding recommended restart. The deficiencies found by the licensee as a result of the 50.54(f) letters will be evaluated by the Millstone Oversight Team (MOT) to identify restart issues.
3.0 MC 0350 Process Millstone Unit 1 entered a routine refueling outage in October 1995. At the January 1996 Senior Management Meeting, the site was placed on the " Watch i List" for various reasons, including a concem for regulatory compliance. '
Subsequently, the NRC sent a 10 CFR 50.54(f) letter requiring the licensee to certify compliance with the regulatory requirements before restarting the unit.
Subsequently, Millstone Units 2 and 3 were sent similar letters which required responses before restart.
The NRC Inspection Manual, Manual Chapter 0350, " Staff Guidelines For Restart Approval", provides guidelines and a list of tasks and activities that must be considered before a plant that has been shutdown for cause can restart. Because of NRC concerns relating to the licensee's management effectiveness, the appropriate aspects of MC 0350 will be applied to the restart of Units 1,2 and 3 to ensure applicable requirements have been met (Enclosure 2).
The regional inspection effort will focus on selected areas of the ISP and completing the routine inspection program requirements. This assessment plan will be maintained and updated by the Millstone Oversight Team (MOT). It is intended that the MOT willidentify new issues to be added to the plan as the Millstone facilities restart plans evolve; there is no intent to have NRC management approve minor changes to this assessment plan.
The Regional Administrator,in coordination with the Deputy Executive Director for Nuclear Reactor Regulation, Regional Operations and Research, and the Director of Nuclear Reactor Regulation (NRR), will make a recommendation regarding restart.
NRR and the Region willinform the Commission of the staff's and licensee's restart
'
activities through Commission papers, or communications to the EDO. The Commission will then vote on whether to approve the restart of each Millstone unit.
.
'
'
3.1 MILLSTONE OVERSIGHT TEAM
.
The Millstone Oversight Team (MOT) is composed of the Director, Millstone Oversight Team, the Director, Northeast Utilities Project Directorate, the Project
,
Managers for the three Millstone units, the DRP Project Branch Chief, the Senior Resident inspectors for the three Millstone units and the appointed Division of Reactor Safety representative. The function of'the Millstone Restart Panelis described in Manual Chapter 0350 and will be fulfilled by the MOT.
.
3.2 MILLSTONE OPERATIONAL READINESS PLAN
'
On July 2,1996, NU submitted the Unit 3 Operational Readiness Plan, which was discussed at the July 24,1996 meeting and updated at the August 19,1996
) meeting. The MOT will review this plan and hold periodic meetings with Northeast Utilities, open to the public, to discuss the schedule for implementation and coordination of NRC restart activities.
On August 13,1996, NU submitted the Operational Readiness Punchlist items identified for restart. The deficiency list, which will be updated periodically, includes restart and deferred items, and will be audited to verify the acceptability of the criteria used to defen items from the restart list.
! 3.3 CORRECTIVE ACTION PROGRAM The NU corrective action program has been weak in ensuring comprehensive and effective corrective actions. There are many instances of narrowly focused corrective actions that failed to embrace all aspects of the underlying problem.
Additionally, the licensee has failed to follow up on corrective actions to ensure they were effective. Consequently, the MOT has determined that any restart effort should examine the current state of the licensees corrective action program.
[ Because of the large nu~mber of Adverse Condition Reports (ACR) being identified
!
by the licensee's staff, the resident and regional inspection staff will concentrate on issues for each unit identified by the ACR process and audit the licensees corrective actions for completeness. The staff has selected level"A" and "B" ACR's for review. Additionally, other ACR's will be examined to provide a spectrum of safety significant and lessor risk issues. The initial list of selected items is contained in Enclosure 1.
The intent is to primarily assess the corrective action program while dealing with the safety significant technicalissues. Examination of the corrective action program needs to review the Action Requests (AR) from the Action item Tracking and Trending System (AITTS) program, which is an extension of the ACR process, and commitments regarding violations and inspection items. Further, a significant input to assessing the licensee's corrective action program is derived from the normal inspection program where valuable insi0 hts regarding the effectiveness of corrective actions are routinely collected from the technical safety inspections.
_ . _ ._ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _
,
'
l
-
.
l
.
"
Additionally, the NRC Independent Corrective Action Verification team will assess the licensee's corrective actions for degraded and non-conforming conditions, l Finally, the Operational Safety Team inspection (OSTI) will audit portions of the l corrective action process during the course of its activities. '
I Demonstration of improvements in the process will be judged by the completeness l of the licensee's corrective actions for each of the inspected ACR's. There must be j
, a high ratio of successfully completed ACR's to the total population inspected. ;
There should only be minor comments regarding the processing, evaluation, directed corrective actions and closure of an issue.
3.4 WORK PLANNING AND CONTROLS (C.4.)' <
l
'
Work planning and controls are other areas that the licensee has shown a weakness. The ability to plan, control and complete work is fundamental to ,
achieving adequate corrective actions. Effective work planning and controls are i prerequisites for reducing and managing backlogs. Weak work planning and !
control was demonstrated during the Unit 2 outage wherein tagging boundary violations resulted in an extensive effort by the licensee to correct. Work control i and planning were also issues at Unit 1, which resulted in a management meeting. l There will be a complete review of the Automated Work Order (AWO) process by the resident or regi'onal staffs. The automated work order process is an integral part of the work planning and control system and is instrumental in establishing the ;
scope of the work, providing the appropriate procedures, and establishing the ;
tagging boundaries. Consequently, the Unit 1 resident staff has been directed to use the available initiative inspection hours to do a comprehensive inspection of the AWO process, which is a site wide process.
The OSTI will assess the engineering and maintenance backlogs during its operational readiness inspection. The OSTI will determine if there are safety significant issues that must be resolved before restart.
3.5 PROCEDURE UPGRADE PROGRAM (C.3.3.e)
The quality and adherence to procedures has been a chronic problem at the Millstone site. The issue was an element in " Improving Station Performance" and was one of the subjects of discussion at the periodic meetings between Northeast -
Utilities and the NRC. In response to NRC concerns, the licensee developed the Procedure Upgrade Program in the early 1990's to improve station procedures.
The resident inspectors will relate procedural inspection findings back to the procedural upgrade program.(PUP), identifying whether the procedures reviewed during the course of an inspection have been upgraded and characterize the quality of the document. This will establish a basis for assessing the effectiveness of the i
i Reference to applicable MC 0350 section j
l l
,
.
.
.
licensee's PUP. The NRC staff will develop an inspection plan for examining selected portions of each unit's individual efforts.
3.6 OVERSIGHT (C.1.4 )
The licensee has identified its oversight function as deficient through self assessments and external and internal audits and a contributing factor in the licensee's declining performance. The report of Assessment of Past ineffectiveness of Indeoendent Oversicht by YAEC examined the failure of Quality Assessment Services, the Independent Safety Evaluation Group, and the Nuclear Review Board (NRB) to identify the deficient FSAR control process and the radioactive waste conditions. They found that management did not support these functions adequately.
In addition, the Joint Utilities Management Association (JUMA) issued its report on July 17,1996. One conclusion was that the quality assurance program audits, surveillances, and inspections were not effective in the implementation of their mission and resolution of identified problems. In addition, the JUMA audit found that recommendations for improving OA effectiveness identified in previous QA internal and external assessments have not beer addressed.
The NRC assessment of the nuclear oversight function is addressed as part of the MOT's review of the ISP program and through insights gained from the normal inspection program, in addition, the NRC will perform a specialinspection of the oversight function using the services of its Human Factors Assessment group. Late in the restart process for each unit, there will be an inspection to evaluate the effectiveness of the oversight groups and management's utilization of the oversight process. There should be positive indications that the oversight function has been made an integral part of the licensee's management team assessment process. The oversight function should result in meaningful findings, have access to line management and provide assessments of process and program effectiveness
. through periodic reports. There should be evidence that the reports are forwarded to the responsible manager and that they have dealt with the contents appropriately. Oversight should be adequately staffed with qualified and experienced personnel. The audit and surveillance programs need to be clearly defined, proceduralized, and implemented with established schedules.
3.7 ENFORCEMENT Outstanding enforcement items will be reviewed by the resident inspectors to determine if any issues require closure before plant restart. The outstanding restart
-
enforcement items will be added to the NRC Significant issues List. The agency is currently accumulating escalated enforcement items concerning the spent fuel pool and design bases issues which may require licensee response before recommending restart of each unit. There are also potential enforcement items that will result from the efforts of the Office of Investigations, the allegation process review group, the Office of the inspector Ger.eral, the Special Inspection Team, routine resident and regionalinspection efforts and the 10 CFR 2.026 petition process. The
-. - . . . - _ _ . - . _ . - _- . _ - . _ .. . . --. - - .- -
l*
I l
~
l '
culmination of this process is not fully developed at this time. The Office of Enforcement and the Millstone Enforcement Panel have the lead responsibility for this process. The results from this process will be formalized and incorporated into !
this assessment plan.
3.8 EMPLOYEE CONCERNS 1
)
l The Millstone site has had a chronic problem in dealing effectively with employee ;
,
concerns. The NRC continues to receive an inordinate quantity of allegations from I ( the staff at the Millstone site. The current series of 10 CFR 50.54(f) letters were )
I initiated as a result of an allegation and subsequent 10 CFR 2.206 petition dealing ;
,
'
with the Unit 1 spent fuel pool. The NRC has issued two enforcement actions for harassment and intimidation to Northeast Utilities in the past three years and has a current escalated enforcement action pending.
The NRC has initiated two task groups to examine the Northeast Utilities handling of employee concerns and the recent layoffs that affected several previous allegers.
The task group examined Northeast Utilities handling of employee concerns and identified a number of root causes for the licensee's problems in this area. The task group also concluded that past problems and their root causes still remain. The output from these two task groups and the licensee's response to their findings will be reviewed for restart issues as well as potential enforcement actions.
3.9 SIGNIFICANT ISSUES LIST The technique used for the restart will be to reach agreement with the lice.nsee on its restart issues list, have it impose controls on adding or deferring items from the list, have the resident inspectors review the list to ensure it included issues of interest to the NRC and have the residents review the deferred list to ensure appropriate rationales for deferral have been documented (See item B.4.3. of MC 0350). As the result of the 10 CFR 50.54(f) activities, the licensee initially determined that about 600 items did not meet criteria for inclusion as a restart item. The resident inspector, augmented by headquarters staff, reviewed this list and confirmed that the licensee performed an adequate assessment of the discrepancies. This process will be used in the restart assessment of each unit.
The MOT will determine that the licensee's restart issues list includes appropriate restart items from the licensee's programs such as ACR, AR (AITTS), engineering work requests, and commitments. j The enclosed NRC Significant issues Lists will contain items that are being used to audit and evaluete licensee programs such as the corrective action process and significant safet)/ regulatory. technical issues.
Restart issues will meet at least one of the following criteria:
1. Resolution of the issue is required to ensure safe operation of the j facility to include satisfaction of the technical specifications or l 7
__ . _ _ __ _ . - _ _ ._ _ _ _
<
l
'
I
, licensing basis.
2. Inspection of the issue will provide an insight to an identified
,
programmatic deficiency such as the corrective action system.
I j 3. Inspection of the issue will provide assessment of management I effectiveness or personnel performance.
3.10 RESTART INSPECTION
I i Selected portions of NRC Manual Chapter 93802, " Operational Safety Team
) Inspection," will provide the framework for a team inspection of each unit during restart. The inspection will cover self-assessments by the licensee, the licensee's
.
irnplementation of its startup plan, control room observations during the approach to criticality and power ascension, selected systems readiness inspection and i
observation of management oversight.
The resident inspectors will provide close monitoring of each unit during mode 3 changes to ensure compliance with each unit's technical specifications and FSAR
- design bases.
3.11 PLANT PERFORMANCE REVIEW I
i On May 16-17,1996, the MOT conducted a Plant Performance Review. The Plant
'
Performance Review was used to identify the issues that needed to be inspected for the Millstone Station. The review identified severalissues that warrant NRC inspection before plant restart of the unit. The unit specific issues as well as station wide issues identified by the PPR are contained in the Significant issues List
for each unit as inspection items.
) 3.12 LICENSE AMENDMENTS
l Millstone Unit 3 currently has two license amendments required for startup in the review process. They are: 1) the over temperature A T time constants and the l steam line pressure negative rate high steam line isolation time constant: and 2)
,
change operational modes with both shutdown margin monitors inoperable and to revise the locked valve list.
i
,
-
.
-
a h
>
i
___ . _ _ _ . _ _ _ _ __ . . _ _ __ _ _ _ . _ ___ _ __ _ _. _._ _ . _ . _
- .
'
1 Enclosure 1 MILLSTONE UNIT 3 l SIGNIFICANT ITEMS LIST
- REF. ITEM RESP. STATUS ACR RSS AND OSS PIPING TEMPERATURE NRR 10733 MAYBE HIGHER THAN ANALYZED (NRR DRS SUPP.
REVIEW ENG. ANALYSIS, DRS INSPECT INSTALLATION)
'
01148 BEFORE RESTART '
ACR REACTOR POWER INCREASE WHEN DRP
! 05715 UNBORATED CATION DEMIN PLACED i
INTO SERVICE 3CHS-DEMIN2 ACR EDG SEQUENCER CDA SIGNAL OUTPUT DRS 01895 "A" TRAIN COMPONENTS STARTED
'
ACR FAILURE TO ENTER AN ACTION DRP 01844 STATEMENT WHEN MSIVS WERE
, CLOSED i ACR RCP SEAL INJECTION FILTER "B" DRP 1 04199 GASKET FAILED RESULTING IN SPILL OF
, COOLANT TO FLOOR DRAINS ACR RCS CHECK VALVE BODY TO BONNET DRP
- 06092 LEAK 3 RCS*V146 ACR WHILE DEWATERING SPENT RESIN, THE DRP l 01535 WASTE TEMPERATURE IN THE LINER
! RAISED FROM 90 TO 310oF l j ACR NEED FOR ADDITIONAL REVIEW OF DRS 10543 RESPONSE TIME TESTING FOR i PROCEDURES l
'
ACR CLOSURE OF PIR WITHOUT DRP
]
! 10774 DESIGN CONCERN
'
i I ACR CONTAINMENT FOUNDATION EROSION NRR
-
j 6323 ACR CCP SYSTEM OPERATION ABOVE DRP a 10800 DESIGN TEMPERATURE I
l Responsibility i
4
_._. __ . _ . . . . _ _ _ _ ~ _ . - _ .__ _ _ . . _ . _ . . _ _ . . - _ . _ _
.
'
MILLSTONE UNIL3 Continued REF. ISSUE RESP. STATUS ACR SGCS OPERATIONAL CONFIGURATION DRS 7745 CONTROL ACR LETDOWN HEAT EXCHANGER LEAKAGE DRP M3-9 6- AND DESIGN DISCREPANCIES
,
0159 t
l ACR DUAL FUNCTION VALVE CONTROL AND DRP/NRR 01935 TESTING ACR RCP SEAL HOUSING LEAKAGE AND DRS l 7266 BOLT CORROSION 10790 CONTROL AND USE OF VENDOR DRS INFORMATION RESOLUTION OF AFW VALVES AND DRS HELB REVIEW OUTPUT FROM J. HANNON PE EMPLOYEE CONCERNS REVIEW ENFORCEMENT AND SRI UNRESOLVED ITEMS FOR ITEMS FOR RESTART ISSUES REVIEW NRR SPECIAL TEAM FINDINGS NRR
- FOR RESTART ISSUES REVIEW ALLEGATIONS FOR RESTART PE/NRR ISSUES REVIEW ALL OPERABILITY SRI DETERMINATIONS AND BY-PASS JUMPERS BEFORE RESTART FATIGUE CYCLE OPEN ITEMS IP 37750 DRS COMPL.
PART 70 STORAGE AND INVENTORY IP DRS COMPL.
84750
.
l l
l
i
. . . . _ _ . _ _ . _ _ . _ _ _ . . . . _ . . _ . . _ . _ _ _ . _ _ . . _ . _ . _ _ _ . . . _
0-i*
'
I I :
!~ MILLSTONE UNIT 3 !
REF. ISSUE RESP. STATUS i
FORMALITY OF NON-ROUTINE DRS SECURITY ACTIVITIES AND NEW FUEL SECURITY IP 81064 ;
ESSIG LACK OF ON SHIFT DOSE DRS MEMO ASSESSMENT CAPABILITY OVERLAP TESTING OF RPS/ESF DRS REVIEW LICENSEE EVENT REPORTS SRI FOR RESTART ISSUES.
MATERIAL, EQUIP. AND PARTS LIST NRR (MEPL) PROGRAM EVALUATION l MOTOR OPERATED VALVE PROGRAM DRS i
GL89-10 PORV/SG DUMP VALVES
'
PPR RESIDENT EMPHASIS: MISSED SRI G.1.C SURVEILLANCES ,
PPR RESIDENT EMPHASIS: DILUTION SRI I G.1.C EVENTS PPR RESIDENT EMPHASIS: FEEDWATER SRI G.1.C HAMMER i
PPR RESIDENT EMPHASIS: CHECK VALVE SRI G.1.C LEAKAGE l PPR RESIDENT EMPHASIS: WORK- SRI G.1.C AROUNDS PPR RESIDENT EMPHASIS: SURVEILLANCE SRI G.2 CONTROL,MAINT. CONFLICT PPR RESIDENT EMPHASIS: USE OF SRI G.2 VENDOR INFORMATION PPR RESIDENT EMPHASIS: AWO QUALITY SRI G.2 AND BACKLOG CONTROL PPR RESIDENT EMPHASIS: ABUSE OF USE . SRI G.2 AS-IS FOR DEFICIENCIES PPR RESIDENT EMPHASIS: SEISMIC 11/1 SRI G.2 i
3 j l
- . . - --
. . _ . .
_
- . - - _. - - - - - - - - .. -_ . . . .... -- .
.
~
- MILLSTONE UNIT 3 CONTINUED i
REF. ISSUE RESP. STATUS ;
EFFLUENT / ENVIRONMENTAL DRS l SAMPLING AND ANALYTICAL l PROFICIENCY !
RADWASTE SYSTEMS / CONTROLS DRS l
HEAT EXCHANGER PERFORMANCE DRS (GL-89-07) SRI 1R96-04 REVIEW LICENSEE CORRECTIVE SRI ACTION PROGRAMS FOR EFFECTIVENESS TO INCLUDE ACR's AND NCR's REVIEW 0737 ACTION ITEMS FOR DRP COMPLETION REVIEW ENGINEERING BACKLOGS DRS I REVIEW 50.54F ISSUES FOR MOT RESTART NRR ACR REVIEW SELF ASSESSMENT ROOT DRP 7007 CAUSES AND VERIFY CORRECTIVE ISP ACTIONS GL HEAT EXCHANGER PERFORMANCE SRI 89-13 DRS
ORDER PHASE ll OF THE ICAVP NRR
,
e
.
% __ m , .,
,
.
l
,
- \
- j ENCLOSURE 2 l
MILLSTONE UNITS 3 !
RESTART APPROVAL
- 1 The following items are considered applicable to the restart of Millstone Units 3:
,
I
'
r l
i I
l I
i
i
.
5
- . - .- . - - . .__ _ .- .- - _-. . - - - - .
1 .
l
! l
'
!
UNIT 3 I
'
I RESPONSIBILITIES AND AUTHORITIES l i
NEED STATUS RES P
- 4.0 Director. Office of Nuclear Reactor Reaulation (NRR). X C NRR 1 Notifies the Executive Director for Operations (EDO)
and the Commission, as appropriate, of the NRC actions taken concerning shutdown plants and the proposed followup plan.
.
'
4.0 Reaional Administrator X C RA
i a. Discusses with the Deputy Executive Director
-
for Nuclear Reactor Regulation, Regional Operations and Research, the Office of
'
'
Enforcement (OE), and NRR, as appropriate, the need for an order or confirmatory action letter (CAL) specifying the actions required of the
- licensee to receive NRC approval to restart the plant and the proposed followup plan.
b. Decides,in consultation with the NRR X C RA Associate Director for Projects, whether this i manual chapter applies to a specific reactor restart. )
i i
c. In coordination with the NRR Associate Director X C RA l for Projects, decides whether to establish a Restart Panel.
d. In coordination with the cognizant NRR X C mot j Director, Division of Reactor Projects, develops a written Restart Assessment Plan, including a case-specific checklist, to assign responsibilities and schedules for restart actions and interactions with the licensee and outside organizations. .
l
!
,
6
.
j
.
T
. ~ - . . . . . - . - - --
.
t
'
NEED STATUS REs
'
P
! e. Coordinates and implements those actions X mot prescribed in the Restart Assessment Plan that have been determined to be the regional ;
office's responsibility. These include, when l
'
appropriate, interactions with State and local 1 agencies and with regional offices of Federal !
- agencies. )
f. In conjunction with NRR, reviews and X MOT determines the acceptability of licensee's SRI corrective action program. OSTI NRR
,
g. Approves restart of the shutdown plant, X RA
following consultation with the EDO and the Director of NRR, and approval / vote by the Commission.
4.03 NRR Associate Director for Projects i
l a. Acts as the focal point for discussions within X zimme NRR to establish the appropriate followup rmen actions for a plant that has been shut down.
4.04 NRR Reactor Projects Division Director M Kee a. Coordinates participation in followup X conference calls and management discussions to ensure that the Regional Administrator and
- the Director of NRR are directly involved, when
- appropriate, in followup action.
'
b. Coordinates and implements actions prescribed x McKee i1 the Restart Assessment Plan that have been determined to be NRR's responsibility. These
'
include, where applicable, appropriate NRC Office or NRR Division interaction with other Federal agencies (e.g., Federal Emergency Management Agency (FEMA), Department of Justice (DOJ)) pursuant to any applicable e
Memoranda of Understanding.
'
.
.
l l
NEED sTATU RESP. I s
B.1 INITIAL NRC RESPONSE NA The facts, the causes, and their apparent impacts should be established early in the process. This information will assist the NRC in characterizing the problems, the safety significance, and the regulatory issues. Early management appraisal of the situation is also important to ensure the proper immediate actions are taken. The following items should have been completed or should be incorporated j into the CSC as appropriate. Refer to l
'
Section 5.02 of this manual chapter for
. additional information.
a. Initial notification and NRC NA management discussion of known facts and issues b. Identify / implement additional NA inspections (i.e. AIT, llT, or Special) (Region).
c. Determine need for formal NA !
regulatory response (i.e. order or CAL).
d. Identify other parties involved NA (i.e., NRC Organizations, other Federal agencies, industry organizations).
.
I
-
.
\
.
NEED STATU RESP.
S B.2 NOTIFICATIONS NA Initial notification of the event quickly communicates NRC's understanding of the event and its immediate response to the parties having an interest in the event.
Notification to regional and headquarters offices of cognizant Federal agencies may be appropriate. As the review process )
continues, additional and continuing l notifications may be required.
I a. Issue Daily and Directors Highlight NA I (NRR).
b. Issue preliminary notification NA (Region),
c. Conduct Commissioner assistants' NA briefing.
l d. Issue Commission paper (NRR). NA I e. Cognizant Federal agencies notified NA (i.e., FEMA, EPA, DOJ).
f. State and local officials notified NA (Region).
g. Congressional notification (NRR) NA
.
.
PROCESS B.3 NEED STATU RESP.
S B.3 ESTABLISH AND ORGANIZE THE NRC REVIEW PROCESS a. Establish the Restart Panel. X b. Assess available information (i.e. X mot inspection results, licensee self-assessments, industry reviews),
c. Obtain input from involved parties both X mot within NRC and other Federal agencies such as FEMA, EPA, DOJ.
d. Conduct Regional Administrator briefing X mot (Region).
e. Conduct NRR Executive Team briefing X C mot (NRR).
f. Develop the case-specific checklist (CSC). X C mot
_._
g. Develop the Restart Assessment Plan. X C mot h. Regional Administrator approves Restart X C RA Assessment Plan.
i. NRR Associate Director and/or NRR X C AD Director approves Restart Assessment Plan.
J. Implement Restart Assessment Plan. X mot k. Modify order as necessary X NRR I I
.
i
.
!
!
. _ - - - __ _ _ _ _ . . _ - _ .__ -_.
-
i I
_
NEE sTATU RESP ;
D s B.4 REVIEW IMPLEMENTATION B.4.1 Root Causes and Corrective Actions osTI MOI a. Evaluate findings of the special team X inspection.
b. Licensee performs root cause analysis X NU and develops corrective action plan for osTI root causes.
c. NRC evaluates licensee's root cause X mot osTi determination and corrective action plan.
.
!
l
.. ..
__. . _ . - _._~ .__. _ . - _ . _ _ _ - __._______._m - . _ _ _ _ _ _ . - _ _ .
.
i.
.
! .
<
.
NEED STATU RESP j s
- B.4.2 B.4.2 Assessment of Eauioment Damaae NA
- For events where equipment damage occurs, a thorough assessment of the extent of damage is necessary. A root cause determination will be
- necessary if the damage was the result of an I internal event. The need for independent NRC
.
l assessment should be considered. The licensee
- will need to determine corrective actions to repair, I test, inspect, and/or analyze affected systems and
) equipment. These actions are required to restore i or verify that the equipment will perform to design
! requirements. Equipment modifications may also i be required to ensure performance to design i requirements.
i
!.
l Potential offsite emergency response impact for j external events such as natural disasters, j explosion;, or riots should be considered. NRR
'
should obtain information from FEMA l headquarters reaffirming the adequacy of State j and local offsite emergency plans and
! preparedness if an event raises reasonable doubts j about emergency response capability.
{ a. Licensee assesses damage to systems and NA
!, components.
I I b. NRC evaluates licensee damage NA
! assessment. i
c. Licensee determines corrective actions. NA i
j d. NRC evaluates corrective actions. NA !
!
i
!
1
'
l 12 l
i
,
t
-. -. .- - . ~ . . -- -
. . . .._ . . _ . . . _ . . _ . . . _ _ _ . . _ . _ - _ _ _ _ _ _ . _ . . - _ _ . _ . . . _ = _ - _ . _ . _ . _ _
-
J 1 .
l
. , ~
i i ,
,
'
i NEED STATU RESP.
S '
'
i
.
B.4.3 Determine Restart Issues and Resolution X MOT i
j The establishment of the restart issues that j require resolution before restart demands a clear j understanding of the issues and the actions
- required to address those issues by both the NRC l and the licensee. This section outlines steps to ,
i determine the restart issues and NRC's evaluation j of their resolution.
i l a. Review / evaluate licensee generated restart X MOT issues. .
i
. b. Independent NRC identification of restart X MOT ;
issues c. NRC/ licensee agreement on restart issues. X MOT d. Evaluate licensee's restart issues X MOT ,
i implementation process.
?
i a e. Evaluate licensee's implementation X SRI j verification process.
i )
l l
,
!
i i !
'
I l I
i i
f j- .
l
!
$
,
a j 13
$
,
t 4.._.
-
. _
. _ , - - . _ _ . _ . ___ _ ___. -
_ _
.
)
NEED STATUS RESP
.
B.4.4 Obtain Comments Since some shutdowns involve a broad number of l issues, solicitation of comments from diverse sources I
may be appropriate. The decision to solicit comments J from a group and the level of participation should be made on a case-by-case basis. Input from these i groups should be factored into the restart process I when they contribute positively to the review. Note:
If needed, comments concerning the adequacy of state and local emergency planning and preparedness must be obtained from FEMA headquarters through mot l
NRR.
l x
a. Obtain public comments.
b. Obtain comments from State and Local X slo Officials (Region).
c. Obtain comments from applicable X NRR Federal agencies.
B.4.5 Closeout Actions When the actions to resolve the restart issues and significant concerns are substantially complete, closeout actions are needed to verify that planned inspections and verifications are complete. The licensee should certify that corrective actions required before restart are complete and that the plant is physically ready for restart. This section provides l actions associated with completion of significant NRC l reviews and preparations for restart. mot osTI a. Evaluate licensee's restart readiness self-assessment (Region). X b. NRC evaluation of applicable items from X mot Section C "lSSUES" complete.
c. Restart issues cidsed. X mot SRI OSTI d. Conduct NRC restart readiness team inspection X osTi (Region),
e. Issue augmented restart coverage inspection X osTI plan (Region).
___ . _ _ - - _ . _ __ _ _ _ _ . . . . _ _ . . __ _ _ _ _ _ _ _ _ _ _ _
.
.
-
. I
,
NEED STATUS RESP.
l f. Comments from other parties considered. X MOT i
g. Determine that all conditions of the Order / CAL X NRR ,
are satisfied. :
h. Re-review of Generic Restart Checklist X MOT
- complete. SRI
'
B.5 RESTART AUTHORIZATION (B.5)
1 l
When the restart review process has reached the point ;
that the issues have been identified, corrected, and '
l reviewed, a restart authorization process is begun. At l l this point the Restart Panel should think broadly and j ask: "Are all actions substantially complete? Have we l overlooked any items?"
i a. Prepare restart recommendation document and l basis for restart (Region). X MOT l b. NRC Restart Panel recommends restart X mot
d c. No restart objections from other applicable HQ X McKee offices. ;
.
j d. No restart objections from applicable Federal X mot l agencies. l l
e. Regional Administrator concurs in restart X RA recommendation '
l f. NRR Associate Director and/or NRR Director X McKee concurs in restart recommendation.
g. EDO concurs in restart recommendation when X EDO required.
h. Conduct ACRS briefing when requested (NRR). NA
.
i
\
.
.
NEED sTATU RESP.
s i. Conduct Commission briefing when requested X NRR RA (NRR).
j. Commission concurs in Restart Authorization. X coMM i k. Regional Administrator authorizes restart. X RA B.6 RESTART AUTHORIZATION NOTIFICATION (B.6)
l Notify the applicable parties of the restart authorization.
Notifications should generally be made using a memorandum or other format consistent with the level of formality required. Communication of planned actions is important at this stage to ensure that NRC i intentions are clearly understood. l l
a. Commission (if the Commission did not concur in the Restart Authorization or as requested) (NRR).
X mot b. EDO (if the EDO did not concur in the restart X EDO recommendation or as requested) (NRR).
c. Congressional Affairs (NRR). X oCA
'
d. ACRS (a briefing may be substituted for the NA written notification if the ACRS requests a briefing) (NRR).
e. Applicable Federal agencies (NRR). X NRR f. Public Affairs (Region).
,
X OPA g. State and local officials (Region). X SLO 4 h. Citizens or groups that expressed interest during X mot the restart approval process (Region). ,
l
.
_. . - . .. .-.- _ . . .- - --.___ = - - _-----_ -.- .. . . . - - .-
.
ISSUES
.
NEED sTATU RESP.
s C.1.1 Root Cause Assessment
,
a. Conditions requiring the shutdown are X mot
! clearly understood.
i b. Root causes of the conditions requiring the X mot shutdown are clearly understood.
'
c. Root causes of other significant problems X mot are clearly understood.
,
d. Effectiveness of the root cause analysis X mot program.
C.1.2 Damaae Assessment
j a. Damage. assessment was thorough and NA comprehensive.
b. Corrective actions clearly restored systems NA and equipment or verified they can perform as designed.
C.1.3 Corrective Actions j a. Thoroughness of the corrective action plan X mot b. Completeness of corrective action programs X SRI for specific root causes.
c. Control of corrective action item tracking. X SRI i osTI
!
d. Effective corrective actions for the X SRI conditions requiring the shutdown have osTi been implemented.
'
e. Effective corrective actions for other X SRI
'
significant problems have been osTI implemented.
f. Control of long-term corrective actions. X SRI osTi
.
._,
___ _ _ . . _ _ _ _ __ _ . _ _ _ . _ _ - _ _ ___...____ _ _
__ __ _ _ _ _ _ _
.
.
- i
'
g. Effectiveness of the corrective action X SRI verification process. osTI l
!
i NEED sTATU RESP.
s C.1.4 Self-Assessment Caoability The occurrence of an event may be indicative of potential weaknesses in the licensee's ;
self assessment capability. A strong !
"
self-assessment capability creates an environment l where problems are readily identified, prioritized,
- and tracked. Effective corrective actions require problem root cause identification, solutions to 1 correct the cause, and verification methods that ensure the issue is resolved. Senior licensee i management effectiveness in ensuring effective l 4 self-assessment is treated separately.
a. Effectiveness of Quality Assurance Program. X NRR l b. Effectiveness of Industry Experience Review X osTi Program.
c. Effectiveness of licensee's Independent X SRI Review Groups. osTi
_
d. Effectiveness of deficiency reporting system. X SRI osT1 e. Staff willingness to raise concerns. X OE l NRR f. Effectiveness of PRA usage. X IcAV TEAM g. Effectiveness of co. .itment tracking X SRI program. NRR h. Review applicable external audits X osTi i. Quality of 10 CFR 50.72 and 50.73 reports. X SRI
.
.
.
NEED STATU RESP.
s C.2.1 Manaaement Oversicht and Effectiveness a. Goals / expectations communicated to the staff. X osTI b. Demonstrated expectation of adherence to X SRI procedures. osTi c. Management involvement in self-assessment X Moi and independent self-assessment capability NRR d. Effectiveness of management review X SRI committees. osTi e. Management's demonstrated awareness of X SRI day-to-day operational concerns, osTI f. Management's ability to identify and prioritize X SRI significant issues. osTI g. Management's ability to coordinate resolution X SRI of significant issues. osTI h. Management's ability to implement effective X SRI corrective actions. osTI C.2.2 Manaaement suooort a. Impact of any management reorganization. X mot b. Effective and timely resolution of employee X mot concerns.
c. Adequate engineering support as demonstrated X DRs by timely resolution of issues. osTI d. Adequate plant administrative procedures. X SRI PE j J
e. Effective information exchange with other X sri utilities. OSTI f. Participation in industry groups.
NA g. Effectiveness of Emergency Response X DRs Organization.
h. Coordination with offsite emergency X DRs ;
planning officials.
. - __. . .. _- _. .. - - - _ . -. - - --
.
.
- .
NEED sTATU RESP.
li s l C.3.1 Assessment of Staff j mot a. Demonstrated commitrnent to achieving X SRI
!
osis improved performance.
b. Demonstrated safety consciousness. X osTi f
,
.
! c. Understanding of management's expectations X osT l and goals.
-
j d. Understanding of piant issues and corrective X osTI
' actions. SRI
e. Qualifications and training of the staff. X osTI i f. Staff's fitness for duty. NA i
'
g. Attentiveness to duty. X osTI
h. Level of attention to detail. X osTI a
j i. Off-hour plant staffing. X SRI
j j. Staff overtime usage. X SRI SRI
,
j
k. Procedure usage / adherence.
-
{X SRI PE i 1. Awareness of plant security. X DRS
! ,
, m. Understanding of offsite emergency planning X DRs i issues.
g , _. ___ ..
. ,_ _ _ _ _ _ _ _ _
.- - --
l C.3.2 essessment of Coroorate Suooort and Site i
'
Enaineerina Suncort X osTI
]
J a. Corporate staff understanding of plant issues.
b. Corporate staff site specific knowledge. X osTI
]
j c. Effectiveness of the corporate / plant interface X osTi i meetings.
I d. Corporate involvement ith plant activities. X osTi
_
e. Effectiveness of site engineering support. X DRs f. Effectiveness of the site desiga modification X DRs process.
. _ _ _ __
o e
g. Effectiveness of licensing support. X NRR NEED STATUS RESP.
h. Coordination with offsite emergency planning X NRR officials.
C.3.3 Operator issues i
!
a. Licensed operator staffing meets requirements and licensee goals. X osTi b. Level of formality in the cont. .,o m . X osTi SRI c. Effectiveness of control room simulator X DRs training. I
d. Control room / plant operator awareness of X osTi l equipment status, SRI e. Adequacy of plant operating procedures. X SRI PE i
l f. Procedure usage / adherence. X SRI j osTi g. Log keeping practices. X osTl ,
. og .. .. .
. . . -_ - __ __ _ - - - . - _ . _ - _ - . .--
C.4 ASSESSMENT OF PHYSICAL READINESS OF THE l PLANT a. Operability of technical specification systems. X osT1 b. Operability of required secondary and support X osTi systems, i c. Results of pre-startup testing. NA l d. Adequacy of system lineu'Js. X osT l e. Adequacy of surveillance tists/ test program. X osTI l
l f. Significant hardware issues resolved (i.e. X osit
!
damaged equipment, ecupment ageing, modifications).
g. Adequacy of the power ascension testing X osTi SRI program, h. Effectiveness of the plant maintenance program. X osTI DRs i. Maintenance backlog managed and impact X osTI on operation assessed.
l
i
!
. .
d
. . _ .
_ _ ._
$ <
h g. Effectiveness of licensing support. X NRR
.
NEED STATUS RESP.
a h. Coordination with offsite emergency planning X NRR officials.
C.3.3 Ooerator issues
!
a. Licensed operator staffing meets requirements l
and licensee goals. X osTi
) b. Level of formality in the control room. X osTI l SRI l l
c. Effectiveness of control room simulator X DRs I training.
!
d. Control room / plant operator awareness of X osTi !
equipment status, SRI l i e. Adequacy of plant operating procedures. X sri i
PE l f. Procedure usage / adherence. X sri osT j g. Log keeping practices. X osTi C.4 ASSESSMENT OF PHYSICAL READINESS OF THE
! PLANT
!', a. Operability of technical specification systems. X osTi b. Operability of required secondary and support X osTi
_
systems.
c. Results of pre-startup testing. NA l d. Adecuacy of system lineups. X osT e. Adequacy of surveillance tests / test program. X osT
[
l f. Significant hardware issues resolved (i.e. X osTi i
damaged equipment, equipment ageing, modifications).
I g. Adequacy of the power ascension testing X osti l program. SRI
'
h. Effectiveness of the plant maintenance program. X osTi DRs
'
i. Maintenance backlog managed and impact X osTI on operation assessed.
.
i 1