IR 05000336/1998202

Insp Rept 50-336/98-202 on 980302-0409.Violations Noted. Major Areas Inspected:Cooling Water Sys

ML20236L552
Person / Time
Site:	Millstone
Issue date:	06/11/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20236L533	List: IR 05000336/1998202 ML20236L532 ML20236L538
References
50-336-98-202, NUDOCS 9807130068
Download: ML20236L552 (43)

Text

- - _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _

.

'

U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION Report No.: 50-336/98-202 Docket No.: 50-336 License No.: DPR-65 Licensee: Northeast Nuclear Energy Company Facility: Millstone Unit 2 Location: Millstone Nuclear Power Station 156 Rope Ferry Road Waterford, Connecticut 06385 Dates: March 2, through April 9,1998 inspectors: Paul P. Narbut, System Lead, Team 2A

,

Special Projects Office J

James R. Houghton, Mechanical Engineer Special Projects Office Steven R. Jones, Resident inspector, Region l Thierry M. Ross, Senior Resident inspector, Region ll Robert G. Fitzpatrick, Electrical Engineer Brookhaven National Laboratory *  !

Robert E. Serb, Piping Engineer

,

Parameter, Inc.*

James A. Vail, l&C Engineer l Idaho National Engineering and Environmental Laboratory *

• Contractors Approved by: Ralph Architzel, Team 2 Leader Special Projects Office Office of Nuclear Reactor Regulation

.

9007130068 980611 PDR ADOCK 05000336 G PDR

- - _ _ _

.

.

SUMMARY Millstone Nuclear Power Station l

inspection Report 50-336/98-202 The staff of the U.S. Nuclear Regulatory Commission (NRC), Office of Nuclear Reactor Regulation, Special Projects Office, performed a vertical slice, safety system functional inspection (SSFI), on the Millstone Unit 2 reactor building closed cooling water (RBCCW)

system. In addition, the team reviewed the functions of important attendant and interfacing systems including the service water system (SWS) and electrical system The inspection was an independent examination and part of the coordinated oversight of the Independent Corrective Action Verification Program (ICAVP) described in SECY-97-003,

" Millstone Restart Review Process," dated January 3,199 ,

'

The purpose of the inspection was to assess the effectiveness of the Configuration Management Program (CMP) implemented by Northeast Nuclear Energy Company (NNECO),

the licensee for Millstone Unit 2. Additionally, this inspection was to assure that the licensee's i

review of the RBCCW system had accurately assessed the capability of the system to perform i the safety functions required by its design basis, the condition of the system compared with its l

design and licensing bases, the accuracy of the as-built configuration compared to design drawings, and complianco of system operations with the Final Safety Analysis Report (FSAR) {'

_

and the p! ant's Technical Specifications (TSs).

The team observed that, before the NRC's selection of the RBCCW as the out-of-scope system  !

on September 19,1997, the licensee had already identified and resolved many important l RBCCW design vulnerabilities. For example, the licensee had reanalyzed system flows,  !

determined that some flows were not adequate and increased flow to those components by I increasing piping size ]

I At the start of the inspection, the team was aware that not all problems were analyzed and  !

resolved. The licensee's March 2,1998, letter to NRC identified uncompleted tasks. For j example, the licensee had identified that important program reviews such as the high-energy j line break analysis and environmental qualification reconciliation would not be complete j Subsequently, the licensee identified that other activities would not be complete, such as operator training, calculations, and modifications. In addition, at the start of the inspection, the j team identified other activities areas that were not completed and had not been not identified in j the licensee's March 2,1998, letter. For example, the team identified that the calculation and actions required for the failure of an RBCCW pump to start had not been analyzed. With the understanding of the status discussed above, the team concluded that sufficient information was available to inspect and make reasonable conclusions about the adequacy of the licensee's CMP, their review of the RBCCW system, the capability of t,he system to perform the safety functions required by its design basis, the condition of the system compared with its design and licensing bases, the accuracy of the as-built configuration compared to design drawings, and the compliance of system operations with the FSAR and the plant's TS The team identified eight violations. Some of the violations had multiple examples. One l

unresolved item is being considered as an ICAVP significance Level 3 finding with the potential-i-

.

to be classified higher based on the results of the licensee's waterhammer analysis and eight violations are being considered as ICAVP significance Level 3 findings. The licensee had identified and were correcting many system problems in its CMP review of the RBCCW system.

In accordance with NRC policy, when the team identified a problem that the CMP had already identified and had or was in the process of correcting, the team did not issue a violation.

Additionally, the team made a number of observations of strengths and good practices. For example, the licensee's broad electrical reviews performed over the past two years were considered comprehensive in depth and breadth and conservative in nature.

The team concluded that the licensee had identified and resolved many important RBCCW system vulnerabilities. Although the team had findings, the number of findings was usual for this type ofinspection.

Similar to previous NRC inspection teams' conclusions, the team recommended that the licensee give continued attention to lowering the threshold for performing safety evaluations in accordance with 10 CFR 50.69.

Overall, it appeared that the licensee had accurately assessed the system's capability to perform its safety functions, its condition compared to its design and licensing bases, and its operations compliance with the FSAR and the plant's TS .

-ii-

_ _ _ _ _ _ _

___ _ _ _____ - - _ - _ - _ --

l

l l

~ Introduction The team performed a vertical slice safety system functional inspection (SSFI), which examined

' the Millstone Unit 2 reactor building closed cooling water (RBCCW) system. In addition, the team reviewed the functions of important attendant and interfacing systems including the

. service water system (SWS) and electrical systems.

.

The inspection was an independent examination and part of the coordinated oversight of the

! Independent Corrective Action Verification Program (ICAVP) described in SECY-07-003, ( " Millstone Restart Review Process," dated January 3,1997.

l

!

The purpose of the inspection was to assess the effectiveness of the Configuration Management Program (CMP) implemented by Northeast Nuclear Energy Company (NNECO),

the licensee for Millstone Unit 2. Additionally, this inspection was to assure that the licensee's

! review of the RBCCW system had accurately assessed the capability of the system to perform

! the safety functions required by its design basis, the condition of the system compared with its design and licensing bases, the accuracy of the as-built configuratic.. compared to design l ~ drawings, and compliance of system operations with the Final Safety Analysis Report (FSAR)

and the plant's Technical Specifications (TSs).

!

The RBCCW system was not one of the four "in-scope" system groups reviewed by Parsons l Power Group Inc., the ICAVP contractor. The four "in-scope" system groups comprised 11 of the 63 Group 1 or 2 systems covered by the Maintenance Rule,10 CFR 50.65, at Unit .1 Backaround i

The RBCCW system examined by the team was 1 of 63 systems covered by the Maintenance Rule,10 CFR 50.65, at Unit 2. The licensee's CMP had evaluated all 63 systems. The RBCCW system was selected because of its high risk significance and the number of modifications and changes made to the system since plant licensin .2 System Description and Safety Function

The funcCon of the RBCCW system is to transfer heat from safety-related systems, structures,

' heat exchangers for shutdown cooling, and components to an ultimate heat sink. The RBCCW

_

system's safety function is to transfer the combined heat load of these systems, structures, and components under normal and Loss of Coolant Accident (LOCA) conditions. The RBCCW system provides cooling to several essential safety-related components including shutdown cooling heat exchangers (HXs), the containment cooling units, safety-related equipment rooms, and seal coolers for the containment spray, high pressure safety injection, and low pressure safety injection pumps. The system also provides cooling to several nonessential but important components such as reactor coolant pump thermal barriers and the spent fuel pool cooling heat exchange .3 Insoection Scone and Methodoloov The scope of the inspection included an examination of the RBCCW system with a focus on the B loop (Facility 2) and an examination of the attendant and interfacing systems including

L_ _ _ _ _.__ _. . _ _ _ _.____..._____________________.___________.________________.__.__________o

- _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _

. I

.

electrical, instrumentation and controls, and portions of the SWS. The team used the vertical slice, methodology described in inspection Procedure 93801, " Safety System Functional Inspection," dated July 15,1997. Because the purpose of the inspection was to assess the effectiveness of the licensee's review of the system, the team examined system design,-

including modifications, and the appropriate translation of the design and licensing bases into operations and surveillance activities. The team used experts in mechanical and electrical design, instrumentations and controls, piping and structural analysis, operations, maintenance, and surveillance testin * Mechanical Scoos of Review The team reviewed the mechanical engineering discipline to verify that the RBCCW system was capable of performing the safety functions required by the design and licensing bases in the TSs and FSAR. The team verified that the licensee's design basis had been satisfactorily identified and maintained through design documents and analyses and that the design basis analyses were correctly translated into plant operating procedures. The team performed a limited review for the interfacing SW The team reviewed a sample of design basis calculations, updates, and new calculations. The review included varying phases of operation including normal operation, normal shutdown, LOCA injection, and recirculation phases. Additionally, the team reviewed sizing and design adequacy for a sample of components, recent major system modifications, the FSAR and issued change requests (FSARCRs), and a sample of safety evaluations and deportability

' determinations. Also, the team reviewed a sample of engineering procedures and operations implementing procedures. The team walked down the RBCCW system to verify that major equipment was in accordance with applicable component design data and with the piping and instrumentation drawings (P&lDs). Findinas The team found that for the mechanical engineering discipline, the RBCCW system was capable of performing its safety functions. The licensee's extensive review of the RBCCW

. system resulted in an adequate update and maintenance of the design basis for the syste The licensee's CMP had identified and resolved important RBCCW system vulnerabilitie However, the team identified problems and oversights as described belo . Inad_ equate Testing for a Backup Air Accumulator The team reviewed a calculation which verified the adequacy of the sizing of air accumulators added to ensure valve operability if normal air was lost. Calculation 9'[-ENG-01823-M2,

" Verification of Accumulator Size for Valves 2-RB-13.1 A/B," Rev. 00, dated August 13,1997, assumed a leakage rate of 0.0026 pound-mass per minute (Ibm / min), a duration of 90 minutes, and a room temperature of 135 'F. The calculation concluded that the air accumulator sizing (1.31 cubic feet /10 gallons) was adequate and would maintain a rninimum pressure of 60 pounds per square-inch gauge (psig), the pressure necessary to maintain the valve in the closed position. The team concluded that the calculation was adequate but observed that the

.. .. .. . _ _ _ _ _ _ _ . _ _ _ .. _

_ _ _ _ _ _ _ _ _ _ _ - _ _ - _ - _ - _ _ _ _ _ _ _ _

_ _ _ _ - _ _ - _ - _ _ . - _ - _ _ - _

.

~

post-modification' test procedure did not utilize the criteria assumed in the calculatio Surveillance test procedure SP 21206, " Instrument Air Accumulator Check Valve Test," Rev.3, dated November 11,1997, was the specified post-modification test in modification number PDCR 2-064-95, " Air Accumulator for 2-RB-13.1 A &B," Rev.1, dated August 20,199 The team concluded that the post-modification test for the air accumulators was not adequat The test procedure did not utilize a starting pressure of 90 psig as assumed in the calculatio Similarly, the test did not verify that the pressure at the end of the test was 60 psi Additionally, the test did not demonstrate that the valves would remain closed at 60 psig as assumed in the calculation. The team noted that the design document leakage rate criteria was conservativ The failure to establish a test procedure which incorporated the acceptance limits contained in design documents is considered a violation of 10 CFR 50, Appendix B, Criterion XI, " Test Control."

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-01, Example 1)

2.2.2 Threshold of Safety Evaluations for Modifications The team observed two modifications that should have received safety evaluation .

Modification PDCR 20-040-95, "RBCCW Surge Tank (T3) Support Modification,"

Rev. O, dated May 30,1996, added a seismic support modification to the RBCCW surge tank. Section 6.0, " Safety Evaluations," of the modification stated that the design change did not require a safety evaluation per 10 CFR 50.59 because the proposed modification was not a component described in the FSAR. However, the team noted that FSAR Section 9.4.3 described the surge tank. Further, FSAR Table 9.4-1 provides attributes of the RBCCW Surge Tank, including its classification as Seismic Class The team concluded that the seismic support was an intrinsic part of the surge tank described in the FSAR. Additionally, the team concluded that the support, which structurally tied the surge tank to a large missile-barrier wall, was of sufficient significance that the introduction of a potential unreviewed safety question should have been carefully and formally assessed in a safety evaluation. The licensee previously concluded that a safety evaluation was not required since the st.pport was not described in the FSA .

Modification MMOD No. M2-97528, "RBCCW System Minimum Flow Recirculation Line " Rev. 00, dated October 17,1997, increased the size of each RBCCW pump recirculation orifice size to increase the minimum flow rate. The team's concem was that the modification would affect flow distribution. The licensee previously concluded that a safety evaluation was not required because the orifice size and flows were not described in the FSA The team considered that the licensee should have had a lower threshold for performing 10 CFR 50.59 safety evaluations. The licensee stated that they would revise their procedures to lower the safety evaluation threshold.

l

- -_ __ _

.

.

2.2.3 Lack of Corrective Action for a System Scenario The team identified a case where the licensee had identified a potential system scenario, but had not completed the analysis and corrective action because the tracking document was improperly closed. The licensee had issued Licensee Event Report (LER) 336/97015, dated April 15,1997, and described the scenario where a delayed manual start of an RBCCW pump (after it failed to automatically restart following a LOCA with a coincident loss of normal power)

could result in more significant voiding of the affected RBCCW train, and therefore a more severe waterhammer condition than previously analyzed for Generic Letter (GL) 96-06. The team found that the LER scenario was not analyzed and the corrective action was not define Procedure RP-4, " Corrective Action Program," Rev. 6, Change 1, dated April 1,1998, requires the licensee to validate that actions are complete before closure. However, the licensee stated that the action request for this item was inadvertently closed when calculations for a different scenario were complete The licensee analyzed the scenario during the inspection. The licensee concluded that a more severe waterhammer than that previously analyzed for GL 96-06 would occur. The new analysis concluded that 45 minutes would be required before the RBCCW pump could be manually started to assure that the previous GL 96-06 analysis for waterhammer effects would still be bounding. As corrective action, the licensee stated that they would revise the operating procedures to ensure that the RBCCW pumps would not be restarted immediately if they failed to start. The licensee is performing a waterhammer analysis to assess the impact of the increase voiding in the RBCCW piping for the as found condition, assuming operators immediately restart the affected pum Pending completion of the waterhammer analysis assuming operators immediately restart the pump, this issue remains unresolved as a potential failure to correct a condition adverse to quality pursuant to 10 CFR 50, Appendix B, Criterion XVI, " Corrective Action."

This was an ICAVP significance Level 3 finding that may be classified higher based on the results of the licensees waterhammer analysk. (URI 50-336/98-202-09)

2.2.4 Improper Flow Rate in the FSAR The team found a case where the licensee had not updated the FSAR. FSARCR 98-M2-7, Rev. O, approved February 4,1998, revised the heat loads for the shutdown coolers in FSAR Section 9.4.3.3 to reflect the reduction of the design basis minimum design flow from 4820 l gallons per minute (gpm) (2.41 x 108 pounds per hour) to 3500 gpm. However, the team found

, that FSAR Table 9.3-1 had not been changed from 2.41 x 10' pounds per hour to the lower I

mass flow corresponding to 3500 gpm (i.e., approximately 1.75 x 105 pounds per hour).

1 .

l The licensee issued Action Request 97010240 06, dated March 27,1998, to track and resolve this item. Procedure RAC 03, " Changes and Revisions to Final Safety Anaiysis Reports,"

Rev. O, dated December 18,1997, required that the licensee update the FSA i

__-_- ______ __ _ _ _ _ _ _ _ _ _ _ _ - _-

.

'

The failure to initiate a change request to update the FSAR to reflect revised analyses results is considered a violation of 10 CFR 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings."

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-04, Example 5)

2.2.5 Inadequate Procedure to Minimize System Pressure Spiking The team determined that a change made to the operations procedure for pump swapping was not adequate. The procedure change was intended to capture an operations strategy for minimizing pressure spikes during pump switching operation ]

l

'

'

Condition report (CR) M2-97-0489, "RBCCW System Design Pressure Can be Exceeded at Low Flows," dated March 27,1997, stated that RBCCW high system pressures occurred at i

components on the - 45' 6" elevation in the auxiliary building when check valves rapidly closed during pump swapping. The report also stated that system pressure transients from these operations resulted in relief valve lifts and occasional failure of the relief valves to reseat.

,

Engineering evaluation M2-EV-0021, "RBCCW System Evaluation - System Design Pressure,"

!

' Rev. 0 (Final), dated January 8,1998, recommended actions to alleviate the problem. It recommended modifying the relief valve with " soft" seat material and establishing a higher setpoint. This was accomplished by a modification. It also recommended that operations j change the system operating procedure to reduce pressure transients during pump swap Subsequently, the licensee revised procedure OP 2330A, *RBCCW System," Rev.18, dated March 9,1998, by specifying the performance of the following steps in raoid succession:

(1) start the oncoming pump, (2) observe the on-coming pump discharge pressure and motor current indications, and (3) secure the off-going pump. Procedure OP 2330A included a maximum flow limit before pump swaps to limit the check valve disk travel when the associated pump was stoppe The team noted several weaknesses with the procedure - (1) Procedure OP 2330A did not i address low-flow conditions. Low header flows of 4000 gpm were reasonably expected dunng {

normal operation and provide a higher initial pressure, (2) licensee had not evaluated nor tested ;

the effectiveness of their procedure change at these low-flow, high-pressure conditions to verify l

that the procedure was effective, (3) revised procedure was not compatible with the periodic i inservice test (IST) procedure. OP 2330A stated that when shifting pumps, header flow should j not exceed 6500 - 6700 gpm. However, this was_ incompatible with IST procedure instructions .

that required a flow of 7400 gpm, and (4) procedure change was not consistent with the FSA The procedure stated that pump switching will be performed in * rapid succession." Interviews l

!

with plant operators ascertained that they were accomplishing the pump switching evolution l within a couple of seconds. FSAR Section 9.4.4.2,tescribed " gradually bringing the spare RBCCW pump ... into operation at the same time that one of the operating RBCCW pumps . is l phased out of operation." ,

i The failure to correctly and comprehensively revise the RBCCW operating procedure to minimize pressure spiking is considered a violation of 10 CFR 50, Appendix B, Criterion XI,

• Corrective Action."

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-02, Example 1)

i

_ _ _ _ - _ _ - _ - _ _ - _ _ _ _ _ _ _ - _

a

.

2.2.6 Lack of Periodic Flow Balance Testing The team noted a case where the licensee had not made provisions for periodic reverification of proper system flow balance. After several modifications which affected the flow balance in the RBCCW system, the licensee issued procedure SPROC 97-2-19, "RBCCW Building Closed Cooling Water System Flow Balance," Rev. 2, dated March 2,1998, to align and lock the RBCCW system valves such that proper system flow balance was achieve The failure to establish a periodic test procedure to demonstrate that the RBCCW system flow to safety-related components will perform satisfactorily inservice was considered a violation of 10 CFR 50, Appendix B, Criterion XI, " Test Control."

. This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-01, Example 2)

2.2.7 Lack of Test Acceptance Criteria The team noted that the periodic inspection and cleaning procedure for the RBCCW HX did not have as-found acceptance criteria. Without acceptance criteria, the period between cleanings might not be changed if fouling reached unacceptable level In their June 21,1996, letter to the NRC, " Update to GL 89-13 Response," the licensee committed to inspect the RBCCW HXs quarter!y and clean as required. These actions are intended to demonstrate that the HX is sufficiently clean to perform its heat removal functio Preventive Maintenance Procedure MF2701J-96, " Service Water Cooled Heat Exchangers Subject to GL 89-13," Rev. 3, dated April 27,1997, provided instructions for periodic maintenance and inspection of service water-cooled HXs. For the RBCCW HXs X18A, X18B, and X18C, the procedure specifies that the system engineer perform an as-found inspection of the HXs on a frequency of once per quarter and document the results on a checklist. The as-found inspection checklist includes sections to document the presence and quantify of macro fouling, matting, sitting, foreign material, and mechanical tube plugging. The checklist also included sections to document the condition of cathodic protection and intemal coating However, the procedure lists "AS FOUND inspection Complete" as the only acceptance value for the inspection, and the procedure does not specify a separate review of the finding The team reviewed records of past inspections of the RBCCW HXs and noted that the HXs had experienced orily minor fouling. Therefore, the team concluded that it was likely that the cleaning frequency had been adequate to ensure that the RBCCW system remained capable of performing its design functio However, the failure to provide as-found acceptance criteria to ensure that the RBCCW cleaning frequency was sufficient was considered a violation of 10 CFR 50, Appendix B, Criterion XI, " Test Control."

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-01, Example 3)

.. . . . _ - _ - - _ - _____ _ .

. l

'

'2. FSAR Clarity

. The team identified some FSAR changes that were correct as written but could have been clearer. For example, FSARCR 98-MP2-6, approved February 2,1998, revised Section 9.4. to change the heat removal capability of the system during the injection phase of a LOCA from 165.3 x10' BTU / hour to 211.7x' 10' BTU / hour. The FSAR did not explain that the heat removal values given were for the condition where the containment air recirculation (CAR)

coolers were clean (from a calculation of the maximum RBCCW peak temperature) versus the condition where the CAR coolers were in a fouled condition (from the containment analysis).

The team noted other similar clarifications during the inspection and provided them to the licensee.

i Conclusions The team found that the RBCCW system was capable of performing its safety functions, met applicable codes, standards, regulatory requirements, good engineering practices, and met its l licensing basis commitments. The licensee had performed an extensive review of the RBCCW l system that resulted in adequate calculations and design basis. The team identified three

. examples of a violation for ineffective test control (2.2.1,2.2.6, and 2.2.7)- two examples of a i ' violation for ineffective corrective action, (2.2.3 and 2.2.5), and one violation for failure to update the FSAR (2.2.4).

1 Electncal l Scooe of Review l .

!

l The team reviewed the electrical portions of the RBCCW system as well as the power supplies

' necessary for the system to perform its intended functions. The goal of the review was to verify l that the electrical portion of the system met the licensing and design bases for functionality,

! capacity, redundancy, independence, single failure, environmental qualification, and the TS.

l

'

The review was completed by performing a system walkdown, reviewing applicable procedures, i

'

reviewing design calculations, and reviewing the design, design changes and drawings.

Findinas

The team found that for the electrical engineering discipline, the RBCCW system was capable  !

. of performing its safety functions. The licensee's review was in depth and comprehensive.

L However, the team identified problems and oversights as described belo . System.Walkdown l The team did a system walkdown to verify that there was sufficient ele,ctrical separation

, between electrical trains and from hot pipes, that the installed configuration agreed with the l~ drawings and with the analyzed condition, that equipment identification numbers and nameplate

! data agreed with the specifications, and that there were no other evident physical ,

' vulnerabilitie ..

i

!

{ _ . . _ _ . . . . _ _ . _ . _ . _ _ _ . _ _ _ _ _ . _ . _ . _ _ _ _ _ _ _ _ _ _ _ . . . ..

-

,

a The team traced power-related cabling from the pumps to the appropriate switchgear. The RBCCW system had three power trains. The trains at Unit 2 were named Facility 1 for pump train A, Facility 2 for pump train C, and Facility 5 for pump train B (the swing pump). Since Facility 5 can be associated with either Facility 1 or 2, depending on system alignment, Facility 5 cables were run in conduits rather than cable trays. This was verified by the team's !

walkdown. Power-related cabling for pumps A and C were also run in conduits from the pumps I to their respective cable tray systems before leaving the pump roo :

3.2.2 Cable Separation Problem The day before the team's walkdown, in preparation for the NRC walkdown, the licensee

{

conducted a walkdown of the areas to be inspected. During that walkdown, the licensee l

identified one instance where the two RBCCW pump trains (Facilities 1 and 2) did not meet the separation criteria as specified in FSAR Section 8.7 and the licensee specification j SP-M2-EE-0016, ' Electrical Separation Specification- Millstone Unit 2", Rev.1, l

September 9,1997. The separation criteria required 18 inches horizontally and 4 feet vertically l of free air space between redundant cable trays. In this case, there was approximately 9 ,.

inches of free air space horizontally, in such circumstances, the FSAR required barriers such as metallic cable tray covers. The licensee documented the problem in CR M2-98-0640, dated March 10,1998. Ordinarily, the NRC does not issue violations for licensee-identified problem However, since the licensee identification was in preparation for the inspection and was made immediately before the inspection walkdown, the lack of separation was considered a violation of 10 CFR 50, Criterion V. The team did a walkdown of both trains of cabling and no other separation problems were observe The failure to maintain the cable separation required by Specification SP-M2-EE-0016 for cables Z12AA20, Z2LAA20, and Z24LA60 and Z16HT35 on Standards drawing 25203-34031, Rev. 7, was considered an example of a violation of 10 CFR 50, Appendix B, Criterion V,

" Instructions, Procedures, and Drawings."

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-04, Example 1)

As corrective action, the licensee issued Design Change Notice (DCN) DM2-00-0475-98 to install cable tray covers. Additionally, the licensee provided Engineering Self-Assessment Report ESAR-PRGM-97-032 that documented the results of a June 1997 assessment of the Separation-Independence-Diversity Program, and concluded that the program had established controls to ensure compliance to the licensing basis. In addition, the licensee concluded that there had been a generic lack of documentation for the electrical separation problems and consequently, had issued a modification, MMOD M2-97541, " Cable Tray Covers" to investigate and document the use of cable tray covers and other barriers. The licensee stated that the activity was ongoin During the walkdown, the team also examined the separation of RBCCW cabling from hot pipes because of the potential for reducing cable ampacities. Also the team examined " Technical Evaluation for Hot Pipes in Vicinity of RBCCW Cables," M2-EV-98-0026, Rev. O, dated

- January 27,1997. Neither the licensee's Technical Evaluation nor the team's walkdown found instances of hot pipes in close proximity to the RBCCW cable I - - .

i

- _ _ _ _ _ _ _ _ - - - _ - _ _ _ _ --_ - ..

. l

^

3.2.3 Procedures The team examined the time required for the RBCCW pumps to achieve full flow following a design basis event. The time to achieve full flow was an important assumption in the water-hammer analysis. The team examined the applicable test procedures and test results for the emergency diesel generator (EDG) load sequencers, and the time interval between RBCCW pump start signal and full flow of the pump. The team concluded that 19 seconds was a l

reasonable and conservative estimate of the time required for full pump flow following a design basis event. The team concluded that the 26 seconds assumed by the licensee was conservativ The team reviewed Operating Procedure OP 2343 "4160 Volt Electrical System," Rev.17

'

through Change No. 9, dated February 10,1998. The team noted that the procedure read as if it were possible to interconnect one train of ac power to the other train's de control power. The licensee resolved the question by opening the applicable circuit breaker cubicles and demonstrating that interlock mechanisms precluded the interconnection. The licensee stated that the procedure would be clarified in the next revisio While performing a degraded voltage design review, the team reviewed Abnormal Operating Procedure (AOP) 2580, " Degraded Voltage" Rev.1, through Change No. 2, dated March 11, i 1996. The team found the procedure to be logical and complete. However, the team found i one minor error in a note but not a procedure step. The note stated that an under voltage I condition on either safety bus would result in a load shed and the start of both EDGs. In fact, only the under voltage bus would load shed and only its EDG would start. The licensee stated !

the procedure would be revised and issued AR 98006646 Assignment 01 to track the actio (IFl 50-336/98-202-10)

3.2.4 Calculations The team reviewed design calculations to verify that they were performed using acceptable methods, the assumptions were sound, the results are reasonable, any design margin changes

,

were considered, and appropriate reviews were performe The team examined Calculation No. PA91-004-276E2, " Millstone Unit 2 - Station Service Study, 1-Voltage Profile," Rev. O, dated December 28,1995, and No. PA85-082-0811GE, " Millstone Unit 2 4.16KV Relay Settings." Rev. 2, dated June 28,1990, The team concluded that the calculations were adequat The team also examined a sample of 10 calculation change notices. The team found that the changes were properly performe l i

'3. Design Review ,

The team used the Millstone Unit 2 Individual Plant Examination (IFE), a probabilistic risk assessment of the unit, to select samples for the design review. The sixth highest ranked element in the IPE was a common-cause failure of two RBCCW pumps. The eighth and ninth (tie) highest ranked elements were the two 4160V safety busses, 24C and 24D. Loss of the two safety de control panels was also within the top 20 ranked component I 9 ____ _ _-____ _ _____ ___ .

.

Because of the high importance ranking of the two 4160V safety busses,24C and 24D, the team performed a detailed review of the associated circuit breakers, control schemes, and OP 2343. On the basis of the results of this review, no single failure was found that would compromise the independence of the two main safety busse .2.6 Unreviewed Safety Question The team reviewed M2-EV-970060, " Technical Evaluation for Separation Evaluation - Main Control Room Panel C01," Rev. O, dated January 23,1998. The evaluation resolved discrepancies found by the licensee's engineering staff during a previously conducted system walkdown of this control panel. The walkdown discovered instances where the design basis separation criterion of 12 inches of cable separation between redundant trains within panels was not met. The evaluation stated that the separation criterion had been changed to 6 inches, therefore, the existing separation distances were not a problem.

l The team foilowed up and determined that the change in separation criteria was made in Design Change Request (DCR) M2-96-068, Rev. O, dated September 8,1997. The change revised SP-M2-EE-0016, " Electrical Separation Specification-Millstone Unit 2," Rev. O, dated September 9,1996. The DCR included a Safety Evaluation No. S2-EV-97-0018, Rev.1, dated September 8,1997, which concluded in paragraph 1.3 that there was no unreviewed safety questio The original NRC-reviewed separation criterion of 12-inches was described in the FSAR, Section 8.7.3.1, and was used as the unit's licensing basi The team considered the change to the licensing basis electrical separation criteria described in the FSAR to be a violation of the requirements of 10 CFR 50.59, since the proposed change increased the probability of the consequences of an accident or malfunction of equipment important to safety. The team noted that train interaction probability is an inverse function of separation distanc ; Therefore, the team considered the change in criteria represented an unreviewed safety question, as defined in 10 CFR 50.59, and should have been submitted to NRC for review and approval before implementatio This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-08)

The licensee stated that they agreed that NRC should have been notified regarding the change, as a change in commitments, but that they did not agree that the change was an unreviewed safety question as defined by 10 CFR 50.59. The ncensee's safety evaluation noted that NRC had endorsed the Institute of Electrical and Electronics Engineers (IEEE) standards that reduced the separation requirement in a regulatory guide for newer plants. The team pointed out that the applicable IEEE standards were not endorsed by NRC in 10 CFR 50.55(a). The team noted that although a 6-inch separation within cabinets had beer) approved for newer plant designs, the detailed review and approval process was carried out on that basis and those designs were approved individually on their own merit i l

_ __-_____-___--_-____-_ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - - _ _ _ _ - . _ _ _ .. i

.

'

3.2.7 Technical Specification Omission The team noted that Section 3.8.1.1.a of the TS did not include the requirements of General Design Criterion (GDC) 17. The TS required two offsite power paths (lines) from the electrical

, grid to the switchyard, whereas GDC 17 required two paths from the electrical grid, through the switchyard, to the Class 1E safety busse The licensee stated that the TS issue had been addressed earlier in 1995. The licensee issued LER 95-035 on October 5,1995, which reported the fact that the licensee's procedures had not

_ required them to enter a limiting condition for operation with less than two power paths from the switchyard to the onsite safety busses. The licensee's procedures were changed at that time but TS 3.8.1.1 was not corrected. The licensee also changed theirTechnical Requirements Manual to explain in detail that a minimum of two power paths is required from the electrical grid all the way to the safety busse Licensee procedure RAC-02, " Technical Specification Change Requests and implementation of License Amer'dments," Rev. O, Change 1, dated January 28,1998, required the licensee to submit change requests to the NRC to enhance safety. It also stated that a change request can be initiated in response to an adverse condition report. Procedure RP-4, " Corrective Action Program," Rev. 6, Change 1, dated April 1,1998, required that conditions adverse to quality be identified and promptly corrected. The failure of the licensee to correct the TS was considered a violation of 10 CFR 50, Appendix B, Criterion XVI, " Corrective Action." The licensee issued {

CR M2-98-0883 for this proble i l

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-02, Example 2)

3.2.8 Electrical Environmental Qualification l l

The team examined the status of the licensee's Electrical Environmental Qualification (EEQ)

program for the RBCCW. The program for Unit 2 was not complete at the time of the inspection. However, the licensee had completed a bounding set of calculations for the locations of the RBCCW equipment. This bounding analysis was documented in M2-EV-98-0034, " Technical Evaluation for EEQ Environment Bounding Conditions for the RBCCW System," Rev. O, dated February 27,1998. The team reviewed the evaluation by sampling 24 safety-related electrical RBCCW components which were not included in the EEQ program. The team concluded that the components had been acceptably dispositioned within the documen The team also reviewed M2-EV-98-0005, " Evaluation of EEQ Components to New ESF Room i Temperatures During a LOCA," dated January 30,1998. The evaluation assessed the impact l of higher ESF room temperatures calculated by the licensee. The evaluation was found to be l adequat ,

3.2.9 Design Changes

~ The team sampled 13 electrical design changes to verify that they were done in accordance

' with approved procedures, procedural controls for parts substitution were properly implemented, and consideration for effects on previous acceptance tests was performe li - - -. _ _ _ _ _ _ _ . _ _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _

-__ - _____ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ - - _ _ - _ _ _ _ - _ .

.

Operating procedures, maintenance procedures, test procedures and related training materials were modified as necessary. The team found no significant problems with the change .3 Conclusions The team concluded that the licensee had essentially re-reviewed every aspect of the electrical ,

'

portion of both the RBCCW and its power supplies. The team considered that the licensee's review had been both conservative in nature and comprehensive in breadth and dept <

! Instrumentation and Control  ! Scone of Review The team reviewed the Instrumentation and Control (l&C) discipline to verify that the RBCCW l system was capable of performing the safety functions required by the design and licensing

'

basi l The team did a system walkdown to examine the labeling, installation, and condition of components and reviewed the applicable FS'AR secdons, P&lDs, instrument lists, elementary drawings, and TS. The team also reviewed a sample of design changes, surveillance procedures, setpoint calculations, operating procedures, and temporary modification logs. The team also observed l&C technicians performing work in the fiel Specifically, the team reviewed the following: (1) a design change that replaced the RBCCW pump suction pressure switch, (2) SWS valves for proper lineup upon a safety. injection actuation signal (SlAS), (3) fail-as-is air operated valves (to confirm that these valves lock in position with loss of air or power), (4) testing of the automatic safety functions of the RBCCW for completeness and end-to-end testing (included observation of engineered safety features actuation signal [ESFAS) logic and time response testing), (5) elevated post-accident RBCCW temperatures and room temperatures for their application to equipment qualification and the qualification documentation, (6) instrument setpoint calculations for margin and methods, quality classification, instrument valve line-ups, and (7) the jumper and temporary modification log for configuration contro .2 Findinas in general, the team found that the physical condition, maintenance, and design of the RBCCW system I&C were good. Exceptions are discussed belo . Pressure Indicators and Tubing were Incorrectly Classified as Nonsafety-Related and Nonseimi . The team noted that two pressure indicators, PI-6324 and PI-6325, an'd their respective tubing,-

were incorrectly classified as nonsafety-related and nonseismic. The instruments were located within the RBCCW containment penetrations. The team noted that the RBCCW tubing and instrumentation were originally installed as Category 1 (safety-related and seismic), but over time, the licensee had reduced the requirements for most lines beyond the root valves and the instruments to non-Category 1 (nonsafety-related and nonseismic). The team considered that

,

_. _

_ _ _ _ ____ - - _ _ _ - - - - - - - - - - - - - - - - - - - - . - - - - - --

,

'

for containment penetrations, the instruments need not function after a seismic event, but the containment boundary function of the entire wetted surface should be maintained. Therefore, the instrumentation should be seismically qualifie The team noted that the FSAR Section 5.2.8.2.1 and Millstone specifications SP-ME-668, Rev. 4, dated May 23,1997, required these instruments and tubing to be Category 1. After discussions with the team, the licensee initiated actions to reestablish the components as Category The failure to mainta;n the classification of PI-6324 and PI-6325 as safety-related and seismically qualified is considered a violation of 10 CFR 50, Appendix B, Criterion V,

" Instructions, Procedures, and Drawings." The team did not consider this problem to affect operability since the instruments were originally installed as Category This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-04, Example 2)

4.2.2 Valve Identification Conflict The team noted that the letdown HX RBCCW outlet temperature control valve had two different identificatiori numbers. The valve,2-RB-402, was also identified as 2-CH-223. The dual identity existed in several data bases. Valve 2-RB-402 was identified as safety-related whereas 2-CH-223 was no The RBCCW P&lD correctly showed the letdown HX RBCCW outlet temperature control valve (TCV) as 2-RB-402 with a control loop identified as T-223. However, the charging system P&lD 25203-26017, Sheet 2, Rev. 20, shows the same valve as 2-CH-223. FSAR Table 9.4-2 and the plant maintenance database listed dual designations for the valve. The team's walkdown verified that the actual identification tag on the valve was "2-RB-402." The team considered that this duality has the potential for configuration control problem When the team reviewed the plant production maintenance management system database for the safety category of the " Letdown Heat Exchanger RBCCW Outlet TCV Air Operator," the data under the 2-RB-402 designation indicated a Category 1 designation, and the data under 2-CH-223 designation, indicated a non-Category 1 designation. The team also examined component records and found no procedural or maintenance errors as a result of the identification confusion. After discussion with the team, the licensee stated that they would examine and correct the FSAR, procedures, and drawings as a result of this findin The failure to maintain a unique identification for the letdown HX RBCCW outlet temperature control valve and the establishment of conflicting safety classifications were considered a violation of 10 CFR 50, Appendix B, Criterion Vill, " Identification and Control of Materials, Parts, and Components."

,

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-03)

- _ _ - _ _ -

- _ _ - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ ___________ - ___- ___ __-__-_- -

.

. 1 4.2.3 Setpoint and Uncertainty Calculations The team examined the licensee's instrumentation setpoint calculation program for the RBCCW system. The team noted that Specification SP-M2-IC-019, " Millstone Unit 2 I&C Setpoints,"

Rev. O, dated December 12,1997, included reactor protection system and engineered safety feature actuation system parameters. It was not intended to include the RBCCW setpoints.-

The licensee stated that the plant predated, and did not implement, most guidance on setpoint methodology used by newer plants. However, the licensee further stated that, as an intended enhancement, the specification would be expanded to include ultimate heat sink parameter The licensee stated that all other setpoints, including the RBCCW, were covered by original design calculations and their revisions. The licensee stated that it planned to revisit these other setpoints in the future and would address those used in each emergency operating procedure or in the I&C procedure " Basis" document in the form of an updated setpoint calculation. The licensee stated that this would be done to all safety setpoints that were not included in reactor protect %n system or ESFAS setpoints. In 1997, the licensee had added the basis document to the prc cdures format. At the time of the inspection, only a limited number of procedures have been modified to the new format. The licensee stated the recalculation of original setpoint calculations would be done in accordance with their nuclear steam supply system vendor owners group program described in Combustion Engineering Owners Group letter, CEOG-98-037, dated January 30,199 The team noted that existing setpoint calculations (original architect-engineer's calculations)

were difficult to retrieve or were missing. An example was the calculation for the RBCCW pump low suction pressure pump trip (PS-6119A, B, & C). The 15 psi setpoint is very conservative but does not correspond to any identifiable feature of the system or pump characteristic. The licensee could not locate the original setpoint calculatio The team considered the lack of documented setpoint calculations for some safety-related instrumentation to be an observation. During the inspection, the licensee issued a DCN, I DM2-00-0448-98, dated March 12,1998, to add balance-of-plant setpoW- to the specificatio (IFl 50-336/98-202-10). Conclusions in general, the team found that the physical condition, maintenance, and the team-reviewed-aspects of the design of the RBCCW system l&C were good. Setpoint calculations reviewed were conservative._ The lack of setpoint calculations was being properly addressed by the licensee. In the field, the team observed that I&C personnel maintained excellent

- housekeeping and work practice The team identified two violations in the engineering area regarding a lack of procedure compliance and a lack of component identification control (4.2.1 and 4,.2.2). Neither violation affected system operabilit _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ - _ _ _ _ - _ - _ _ - _ _ _ _ - _ _ - _ _

_ _ _ _ - _ - _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ - - - - _ -

..

~ Structures and Sunoorts Scooe of Review The team reviewed the piping and supports engineering discipline tn verify that the RBCCW system was capable of performing its safety function required by tt.e licensing and design bases. The review assured that the licensee's design basis had been satisfactorily identified and maintained through design documents and analyses. The team reviewed design basis calculation updates and new calculations as applicable for large bore piping stress analysis, piping support analysis, and waterhammer loading analysis applicable to GL 96-06 effects. The team also reviewed recent modifications made to the system, including the addition of intersystem LOCA relief valves and piping changes to the emergency core cooling system (ECCS) pumps' seal coolers. The team also reviewed engineering procedures to verify compliance with the design basis and for good engineering practices. These procedures

.. included the evaluation of effects of loads for large bore piping (2-1/2-inch and larger size), the simplified " chart' design method used for small bore piping (2-inch and smaller size), and the evaluation of GL 96-06 effects on small bore pipin The team walkdown inspections included (1) inlet and outlet piping and supports to the spent fuel pool HX, (2) surge tank piping and supports, (3) inlet and outlet piping and supports to the RBCCW pumps (including crosstie piping), (4) RBCCW HX inlet and outlet piping and supports,

. (5) selected header piping and supports, and (6) intersystem LOCA relief valve pipin .2 Findinas

. In general, the team found that the licensee's procedures, calculations, installation, and document control for the RBCCW system to be adequate. Piping and supports were generally properly designed and installed. Some problems were identified as described belo .2.1 Original Installations not per Drawings

,

The team found an example of originally installed small bore piping which was not installed as shown on the currently applicable piping isometric drawing. The team noted that a 3/4-inch by 1/2-inch reducing elbow was installed instead of a 3/4-inch elbow, and a 3/4-inch by 1/2-inch

reducer as specified by DCN No. DM2-00-0640-97, "HPSI 41 A Seal / Bearing Coolers Cooling i Water Supply and Return Pipe Replacement," dated August 12,1997. The team concluded  !

! that the reducing elbow, which was not shown on the original piping drawings, must have been l part of the original piping supplied with the pump skid. Nonetheless, the 1997 DCN failed to l- accurately portray the as-installed piping and failed to identify it as existing piping.-

!

The team found a second example of an installation that was not in accordance with the drawing; in this case, a piping support was installed differently than its drawing required. The support, Hanger No. 6, was shown on drawing 25203-22200 SH. 491315E, Rev. 00, dated l'

March 3,1982 The actual installation was different than that depicted by the hanger drawing in that the drawing showed a frame-type restraint, but the installed restraint was a cantilever  ;

arrangement. Additionally, the drawing showed 4-inch and 2-inch angle members, but the l installation was made of 6-inch square tube and 6-inch wide flange members. Likewise, anchor  ;

base plate locations, sizes, and concrete fastener sizes were different than shown on the j drawin l l

_ _ _ _ _ . _ _ _ _ . . _ . . _ _ _ - - - - _ - - - - . - = - - - - - - - - - - - - - - - - " - ~ '

. - -_ _ - _ _ _ _ _ _ _ ___ _ _ _ __ _ _ _ - _ _ _ .

.

During the inspection, the licensee evaluated the installed configuration and found it to be acceptable. The licensee issued CR M2-98-0843 and CR M2-98-0850, both dated March 27,1998, to document the problem and its resolution.

l The failure to install piping and supports, as required by drawings, is considered a violation

[ of 10 CFR 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings." This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-04, Example 3)

l 5.2.2 New Support installations not per Drawings The team also identified two examples of recent modification work where piping supports were not installed in socordance with their drawings. The supports,25203-22200-611087 and 25203-22200-611100, were shown on DCN No. DM2-00-0919-97 "HPSI Pump P-41 A Seal / Bearing Cooling Water Supply and Return Piping Supports," (Rev. 0), dated October 10,1997. The actual installations differed from the drawing in that the assemblies were rotated 90 degrees from that show The team discussed the installation process and the final acceptance of the modification. The licensee engineering supervisor indicated that the question of support orientation was recognized but not documented prior to acceptance of the installation. The team noted that since the installation procedure did not provide for options from the drawings, and the drawings did not show the installed configuration, the installation should not have been accepted. The team further noted that during the inspection the licensee engineering supervision did not recognize this situation as a procedural compliance issu During the inspection, the licensee issued CR M2-98-0908, dated April 1,1998, to address and resolve the proble The failure to install new pipe supports in accordance with drawings is considered a violation of 10 CFR 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings."

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-04, Example 4)

5.2.3 Missing Pipe Support Calculations During the inspection the team requested calculations for installed supports. For one support, Support No,450026, licensee inspections and calculations that document compliance with NRC Bulletins 79-02 and 79-14, were found. For the other support, Support No. 450022, the

. licensee inspections and calculations which documented compliance with NRC Bulletin 79-14, were found. However, complete original design calculations were not found for either suppor The licensee stated that a majority of the pipe support calculations are not available onsite, that the original calculations had not been stored onsite, and that the licensee was in process of retrieving the calculations. This fact had been previously identified by the licensee in Engineering Self-Assessment Report (ESAR) No.97-043, " Calculations," dated May 22,1997, ESAR No.97-063, " Pipe Stress and Support Assessment," dated June 26,1997, and in CR 16  ;

I

\

_ ___ _ - - - .. . . .

.

_ _ _ _ _ _

- .

M2-97-0829 dated May 20,1997. The CR recommended a number of corrective actions including the development of a calculation index, the identification of " critical" calculations, and the performance of such calculations that are not currently availabl The licensee stated that if the calculations could not be retrieved they would develop a rationale for why that was an acceptable condition and present it to the NRC in the future. This will be a followup item. (IFl 50-336/98-202-11) Conclusions in general, the team found the licensee's procedures, calculations, installation, and document control for the RBCCW system adequate. Piping and supports were generally properly designed and installed. The team identified two violations with a total of four examples where work had not been performed in accordance with drawings (5.2.1 and 5.2.2). Ooerations Ooeratina Procedures 6.1.1 Scope of Review The team reviewed a number of operating procedures related to normal and abnormal operation of the RBCCW system. These procedures were reviewed to verify technical adequacy and accuracy. A vertical slice review would normally review training materials, instructor guides, lesson plans, and emergency operating procedures for the RBCCW system, but the licensee had updated these documents and procedures within the last 2 year Consequently, they did not reflect any of the recent modifications and procedure changes accomplished during the ongoing extended shutdow .1.2. Findings The principal operating procedures reviewed by the team were as follows (1) AOP 2564, " Loss l

of RBCCW," Rev. 3, (2) all RBCCW-related annunciator response procedures (ARPs), (3) OPS l Form 2611D-2, *RBCCW System Alignment Checks, Facility 2," Rev. 25, and (4) OP 2330A, l

"RBCCW System," Rev.1 In general, these procedures provided adequate guidance to the operators for operating the RBCCW system during the various normal and abnormal conditions for which the system was designed and evaluated. However, certain procedures were considered incomplete or i inconsistent, while others provided conflicting or confusing instructions. In particular, many of the ARPs were of marginal quality and contained many deficiencies. The team's more significant findings and observations regarding the aforementioned operating procedures are described below. The specific details of all findings and observations were discussed at length with responsible licensee personne . . . _ _ _ _ _ _ _ _ - _ _ _ _ _ -

_- _ _ _____-_-_ _ - _ _ _ _ _ _ _ - _ - -_

, .

.

AOP Inconsistencies The team identified some instances of minor inconsistencies and incomplete guidance associated with AOP 2564. Examples are:

i

. Section 4.7, " Response to RBCCW Header Rupture," did not define " rupture."

Insufficient guidance was provided to distinguish between leak and rupture and the different actions that may be appropriat . Attachment 1, " Potential Leak Locations," did not provide applicable isolation valves for affected components. Also, Section 4.7.2 that stated " attempt to locate and isolate -

rupture," did not provide sufficient guidance nor refer to existing procedures (e.g.,

step 4.3.3 of OP 2330A) on how to isolate an RBCCW supplied componen . The pump header crosstie valves 251 A/B were left open when the subject RBCCW HX of Steps 4.1.6,4.2.4,4.3.4, and 4.4.6 is not in service. This was inconsistent with OP 2330A, OPS Form 2611D-2, and the plant operating philosoph ARP inconsistencies Inconsistencies and inadequacies with RBCCW-related ARPs were identified. Inconsistencies were found between the ARPs themselves, and between the ARPs and other procedural requirements in AOP 2564 and OP 2330A. Inadequacies were primarily a result of incomplete

. guidance and lack of detail. Furthermore, the team identified problems with the linkages between OP 2330A and AOP 2564. These problems affected most of the ARPs reviewed by .

the team. Representative examples of the identified inconsistencies and inadequacies are:

- in the ARPs for RBCCW Pump A and C Overload / Trip (ARP 2590E A-6 and C-6, respectively) the " Corrective Actions" were not consistent with AOP 2564. These ARPs require tripping the reactor if the "B" RBCCW pump was not available to supply the affected facility; whereas, AOP 2564 allows an operator to realign the "B" RBCCW to the affected facility and then try to start the pum . ARP 2590H, RC-148, "RBCCW Gross' Activity," Rev. 2, did not provide guidance for addressing reactor coolant system (RCS) inleakage (e.g., locate, isolate, sample SWS, assess releases, etc.) once RBCCW system activity has been confirmed and the source header identifie '

. ARP 2590E, Rev. 4, DA-4 and DB-4 (Reactor Support NB Cooling Flow Low) did not specify how long a loss of concrete cooling can be tolerated, or who should be notifie ,

'

. ' ARP 2590C, Rev. 2, AA-11, AB-11, and BA-11 (CEDM Cooler A/B/C Flow Low)

required monitoring the RBCCW system parameters and control element drive mechanism (CEDM) fan air discharge temperature but did not provide adequate guidance on what parameters to monitor, how to verify the alarm, nor what to do about elevated CEDM temperatures. Unlike other ARPs for the RBCCW-supplied components

. _ _ _ _ _ _ _ _ _ _ - _ .__

'

.

'

,

in containment, CEDM Cooler Flow Low provided no caution regarding containment entry at power to investigate problems.

I

.

Letdown HX Outlet Temperature High ARP 2590B, A-9, failed to recognize the RBCCW system as a possible source of the alarm (e.g., reactor coolant system (RCS) inleakage or RBCCWlow flow).

l

.

ARP 2590E, D-6, "RBCCW Quench Tank and PDT HX Flow Low," Rev. 4, did not identify possible causes nor provide guidance on addressing possible leak or low flow condition (e.g., isolating component per OP 2330A).

i l ARP 2590E, A-7 and C-7, "RBCCW Header A/B Flow High," Rev. 4, required isolating l RBCCW leak from header but did not provide guidance nor refer to OP 2330A on how to

!

isolate the leak.

!

.

ARP 2590E, B-7 and D-7, "RBCCW Header A/B Pressure Low," Rev. 4, did not instruct the operator to check that header pressure is less than 50 psi. Step 2 of the ARP was not exactly consistent with AOP 2564 instructions for restarting the RBCCW pump following a trip (e.g., requesting shift manager permission, and resetting pump switch).

Step 2 appears redunds'it when compared to Step 3.

.

. The guidance for addressing possible RCS in-leakage was significantly different between ARPs 2590E, A-8, *RBCCW Surge Tank Level High," Rev. 4, and D-8,

"RBCCW HX Temperature High."

.-

Step 2.1 of ARP 2590E, *RBCCW Surge Tank Auto Makeup," Rev. 4, B-8, appears to infer that the surge tank level is high and increasing. Although Step 2.3 refers to i

. AOP 2564 for additional guidance regarding a rapid loss of RBCCW inventory that  ;

I exceeds capability for makeup (i.e., a rupture), the AOP provides very little guidance in -

i response to the RBCCW leak of Step 2.2. Also, no guidance or referral to OP 2330A l was provided on establishing and maintaining manual makeup contro .

Procedural guidance seemed to be missing between Steps 8 and 9 of ARP 2590E, Rev. 4, D-8, "RBCCW HX Temperature High" (e.g., searching for and identifying possible RCS inleakage).- Also, it was questionable whether RCS inleakage was even a credible initiator of ARP D-8. Further, the ARP made no reference to OP 2330A for

" Supporting Information" nor for Step 9 on how to isolate RBCCW supplied component In general. the RBCCW-related ARPs were considered to contain numerous inconsistencies, widely differing levels of detail, and poor integration with operating and abnormal procedural instructions. These procedure quality deficiencies constituted a violation of 10 CFR Part 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings." ,

,

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-06)

Imorecise Valve Lineuo Procedures The alignment check procedure, OPS Forms 2611D-2, had some unclear, confusing, and

' conflicting instructions. The team,nc,ted that the RBCCW system could be crosstied in multiple

_ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ -

_ - _ - _ _ _ _ _ -_ _ _ _ _ _ _

l

.

ways, and that the "B" RBCCW swing pump and HX could be aligned to either of the other two facilities. This system flexibility provided many possible valve alignments. However, the alignment procedures of OPS Forms 2611D-2 and 2611C-2, "RBCCW System Alignment l Checks, Facility 1," Rev. 22, did not provide adequate guidance for clearly specifying the required positions of all valves. Many valves had a required position of "OP/CL"(i.e., open or closed). The shift manager or unit supervisor was relied upon to determine the correct position, depending upon how the system was to be configured and according to applicable " Notes" in the comment field of the alignment procedure. The team found that the notes did not sufficiently address all system alignment conditions or configurations, and on occasion conflicted with each other, forcing the shift manager or unit supervisor to rely solely on their judgment and knowledge. Some examples are as follows:

- Note 4 of 2611D-2 d;d not specJy what the required position should be for affected valves when 4160 volt bus 24E is aligned to bus 24 . For valve 2-RB-211D, Note 1 and 4 can directly conflict with each other (i.e., Note 1 would require the valve to be closed when Note 4 could require the valve to be open).

- For those valves whose required position is "OP*/CL" (the asterisk position applies when the system is inservice) but there is no required position when the system is not inservic The team interviewed the shift manager and the unit supervisor regarding the RBCCW system alignment checklists. Results of these interviews suggested that the shift manager and the unit supervisor were familiar with RBCCW system design and operational requirements, and they appeared capable of making the system alignment checklists work despite the aforementioned problems. However, the team concluded that working around vague or conflicting procedure guidance is an unnecessary burden on the operating crews and may cause confusion. The NRC previously issued a notice of violation in NRC Inspection Report (IR) 50-336/96-08 and again raised this concem in IR 50-336/97-02, regarding the lack of guidance for system alignment checklists with required valve positions of "OP/CL." To address the NRC's concern, the licensee issued CR M2-97-0787. The scope of the licensee's corrective actior.s for CR M2-97-0787 appeared to encompass the team's similar findings related to the RBCCW system alignment checklists. The corrective actions for the RBCCW system were not required to be completed until Unit 2 reached Mode 6. (IFl 50-336/98-202-12)

6.1.3 Conclusions in general, the team found that procedures provided adequate guidance to the operators for operating the RBCCW system during the various normal and abnormal conditions for which the system was designed and evaluated. However, certain procedures were considered incomplete or inconsistent, while some others provided conflicting or c,onfusing instructions. In particular, most of the ARPs contained many quality-related deficiencies. The team considered this to be a violation. The system alignment checklist also had some unclear, confusing, and conflicting instruction '

.

' Svstem Configuration and Condition 6.2.1 Scope of Review l

The team conducted a walkdown of the Facility 2 portion of the RBCCW system to observe L material conditions and to verify that the as-built system configuration matched the latest l P&lDs. The team also compared RBCCW P&lDs to the Facility 2 system alignment checklist for accurate representation of valve positions and locked valves. Additionally, the team verifed that the as-found condition of sealed valves was as required by the Facility 2 system alignment L - checklist for sealed valves.

!

6.2.2. Findings

,.

The team found that, overall, the actual RBCCW system configuration cotopmed extremely well against the P&lD, Drawing No. 25203-26022, Sheets 1 through 6. One minor exception was l

'

noted regarding the inaccurate representation of the take-off lines for the supply side to the reactor vessel support cooling coils. .This exception was allowed by Note 12 of the P&lD legend, Drawing No. 25203-26001, Sheet 1, Rev.15, which granted considerable discretion i

regarding diagrammatical representation of take-off lines for showing sequence of flo Notwithstanding this note, the licensee addressed this minor P&lD error by writing l CR M2-98-0610 and issuing DCN DM2-00-0438-98 to correct the drawin Labeling During the walkdown, the team also observed that, overall, the RBCCW system labeling for l

Instruments, valves, and equipment was good overall. However, there were some minor discrepancies. For example, valve 2-RB-30.1B had no label, and unofficial temporary (handwritten on plain white paper) tags were installed on Valves 2-RB-55A, 558, 355C, 376, and 377. (IFl 50-336/98-202-13)

l Condition A few oil and water leaks were noticed and some limited surface rust was observed, but the licensee's recent efforts to improve physical conditions (e.g., painting) were also obviou Varying degrees of rust, from minor to excessive, were especially noticeable on the reactor vessel support cooling supply and return throttle / isolation valves in containment. Once notifed, the licensee initiated trouble report 09M2135932 to clean up and repaint these valves. Overad, plant housekeeping in the auxiliary building and containment was considered good considering the current. extended shutdown and ongoing outage wor Valy.c Positions The team determined that the great majority of valve positions represented on the RBCCW P&lDs were accurately depicted. However, the positions for several butterfly valves were not properly depicted when compared with OPS Form 2611C-2 and D-2 assuming a normal full power lineup (i.e., RBCCW pump "A" aligned to Facility 1, pump *C" aligned to Facility 2, and pump "B' electrically aligned to Facility 1). The team observed that valves 2-RB-4.1C and D

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ - . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ._ _ _ _ - . _ _ _ - _ _ _ _ _ _ _ - _ _ . _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _

.

and 2-RB-251 A and B were shown open on the P&lDs, but should have been closed and that valve 2-RB-211F was shown closed on the P&lDs, but should have been ope To address these P&lD discrepancies, the licensee initiated CR M2 98-0915 and issued DCN DM2-00-0597-98 to update the P&lD with the correct valve positions. These actions were consistent with Note 10 of the P&lD legend, drawing no. 25203-26001. This note recognized that although the P&lDs were not to be used for operational configuration control of valves they were to be updated as required to reflect proper valve positions as determined by system lineup procedures. (IFl 50-336/98-202-14)

Sealed Valves The team observed a number of sealed valves in containment that were not identified as sealed by the system alignment checklist (OPS Form 2611D-2). These valves were the cooler coil vent valves for the containment air recirculation (CAR) and coolant units. The team noticed that the CAR cooler coil drain valves were both sealed and identified as sealed by OPS Form 2611D-2. The licensee explained that valves in containment were sealed in response to a previous NRC violation (50-336/96-08-07) and that affected system alignment checklists were being revised. Rev. 25, of SP 2611D-2, had incorporated the requirement to seal all RBCCW containment valves except the CAR coil vents. The licensee stated that this was because, at the time of Rev. 25, they had been evaluating the need to seal the vents. After the evaluation was completed, the vent valves were also sealed. The licensee planned to incorporate these additional sealed valves into Rev. 26. (IFl 50-336/98-202-15)

6.2.3 Conclusions The team concluded that overall, the actual RBCCW system configuration compared well with the P&lDs. Operations personnel exhibited a high degree of familiarity with the physicallayout of the RBCCW system. The RBCCW P&lDs properly depicted the normal operating position of valves, except for a few butterfly valves. The physical condition of the RBCCW was good overall. Housekeeping was also generally good and efforts to improve physical appearances were apparent. Labeling of components was considered good overal .3 Locked Valve Proaram 6.3.1. Scope of Review The team reviewed the licensee's locked valve program as described by Operations Department. Instruction (ODI) 2-OPS-1.32, " Locked Valves," Rev. 4, dated June 12,1997, including ODI Form 1.32-1, Rev. 9, " Locked Valve List." The team also compared the locked valve list (LVL) to the P&lDs and system alignment checklist (OPS Form 2611D-2) for RBCCW system, Facility 2. Furthermore, the team interviewed operat, ions personnel and supervisors responsible for implementing the locked valve progra .3.2. Findings The locked valve program at Millstone 2 was not prescribed by an approved plant procedure, but rather by an informal ODI. This was contrary to TS 6.8.1, which required written procedures

_ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ -

'

.

^

l to be established, implemented and maintained as recommended by Appendix A of Regulatory I Guide (RG) 1.33, dated February 1978. RG 1.33 specifically identifies * Equipment Control (e.g., locking and tagging),"in Section 1.c of Appendix A. The lack of a formal procedure for

,

controlling the locking of equipment was considered another example of a resident inspector i identified violation for failure to have a procedure for safety related activities. The new example identified in this report will be included as part of the violation documented in the resident i inspector report IR 50-336/98-20 The team noted that since its inception in 1994, the locked valve program at Millstone 2 has l never been fully implemented as dercribed by ODI 2-OPS-1.32. In particular, the following problem areas were noted:

.

Instruction 1.8.2 stated that when a valve is added to the LVL the associated lineups, l P&lDs and procedures will be revised accordingly. Also, Note 10 of the P&lD legend (Drawing No. 25203-26001) requires all P&lDs to reflect locked valves in accordance with ODI 2-OPS-1.32. However, contrary to OPS-1.32 and Note 10, many valves '

identified on the LVL were not represented as locked valves on the RBCCW P&lDs (i.e.,

,

Drawing. No. 25203-26022). Some specific examples of valves listed on the LVL that l

'

weren't shown as locked on the RBCCW P&lDs were 2-RB-29B and D; 2-RB-191 A,19B and 16C; 2-RB-244; 2-RB-39,41 and 43; 2-RB-24; 2-RB-71 A, C, and E; 2-RB-31D, 31G,31H,32B,32D,33D, and 33 Subsequent discussions by the team with engineering management, indicated that the P&lDs were not routinely revised to incorporate changes to the LVL. Instead, the l licensee conducted comprehensive revisions to the P&lDs approximately every 18 l months to inc!ude locked valve changes. The licensee stated that such a revision was I accomplished about two years ago. However, after reviewing the LVL, dated i April 17,1995, used during the last P&lD campaign, the team found at least five locked valves (i.e., 2-RB-31 D, 31G, 31H, 33D, and 33H) that were not included in the RBCCW P&lDs.

'

.

Instruction 1.2 stated that locks shall be placed on valves which have been evaluated to meet one or more of the criteria provided in Attachment 1, " Criteria Used to Determine the Need for Locks on Valves." The team compared the RBCCW system valves against the locked valve criteria and determined that a large number of valves (about 50) met some of the criteria of Attachment i but were not locked. The team did not find any unlocked valves which were required to be locked by Attachment 1 criteria for design bases, TS requirements, and regulatory commitments. However, the team found valves that.were not locked but met the other Attachment 1 criteria such as valves in inaccessible locations and high radiation areas. Since the Attachment 1 criteria that were not being met were not part of the licensing or design bases, the team considered l that a violation was not warrante ,

l l .

Instruction 1.1.1 and 1.3 stated that all valves required to be loc %d by valve lineups l (e.g., OPS Form 2611D-2) will be included on the LVL. The team found ecod

correlation between the locked valves identified by the system checklist OP6 Form 2611D-2 and the LVL for almost all locked valves. However, the team did find two examples of locked valves on the system checklist that weren't on the LVL, they were

l m

.

the "B" containment spray (CS) and "B" low pressure safety injection (LPSI) pump seal cooler outlet throttle valves (2-RB-191A and 2-RB-198). These valves were identified as locked throttled (LT) by OPS Form 2611D-2, but were not listed in the LVL. Also, the

"B" emergency safeguards room cooler outlet to header "B" (2-RB-69B) was identified as LT by the LVL, but only identified as "open" on OPS Form 2611D-2. The OPS Form requirements were correc The guidance within OPS-1.32 itself was inconsistent in several places regarding which valves were required to be locked and controlled by the program, instruction 1.2 requires locks on all valves that have been evaluated to meet the criteria of Attachment 1. Instruction 1.1.1, however, required only those valves locked by valve lineups or procedures, and those locked per criteria 1,2, and 8, to be contained in the LVL. These two instructions imply that some valves will be locked but not included in the LVL, which was inconsistent with the

" comprehensive list of valves requiring locks and the locking criteria they meet" described by instruction 1.1.1. Furthermore, instruction 1.3 stated that the LVL shall contain all valves required to be locked by design bases [ criteria 1), commitments [ criteria 8], and valve lineup This guidance appears to exclude TS-required locked valves (criterion 2) and valves locked by procedure, which was inconsistent with Instruction 1. Numerous CRs have been written by the licensee in the past regarding problems with locked valves. The two most recent ones are CR M2-97-1595 and 2695. CR 1595 identified two charging pump valves (2-CH-340 and 440) that were on valve alignment checklists but not on the LVL or applicable P&lDs. CR 2695 was written to assess a perceived trend of locked valve problems. This CR identified 17 previous CRs; each one related to inadequate locked or sealed valve control. The licensee's proposed corrective actions in CR 1595 (which subsumed the corrective actions for CR 2695) did include long-term, broad-scope actions such as upgrading OPS-1.32 to a formal operations procedure and training operators on the new program

- expectations. Although, the licensee had previously identified problems with their locked valve program it was not clear to the team that the licensee recognized all the problems described above. Also, it was not possible to ascertain whether their plans to upgrade OPS-1.32 would

.

have addressed all of the team's finding The failure to identify all locked valves from the LVL onto the RBCCW system P&lDs is inconsistent with the applicable drawing note, thereby making the P&lDs inaccurate. This is considered a minor violation of 10 CFR Part 50, Appendix B, Criterion V, alnstructions, Procedures, and Drawings," and as such not subject to formal enforcement actio .3.3 Conclusions The locked valve program at Milletone 2 was not prescribed by an approved plant procedur . This was considered another example of failing to establish procedures required by TS 6. and will be included as part of the violation documented in IR 50-336/98-207. The licensee also failed to adequately implement significant elements of its locked valve program even as it was described by informal operations department instruction. Overall, the program was ambitious in scope and poorly executed.

l t

.24

_ _ _ _ _ - _ - _ _ _ _ - _ _ _ - _ _ _ _ _ _ - - _ - _ _ _ .

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _

.

~ Simulator Fidelity and Configuration 6. Scope of Review The team conducted a detailed physical examination of the main control boards, indicating panels and annunciator windows in the control room that were associated with the RBCCW system and compared them to the Unit 2 training simulato .4.2. .:indings The team found that the simulator compared well with the actual control room panels. The various indicators, controllers, hand switches, labeling, mimic diagrams, alarm windows, and layout matched the simulator exactly, except for minor discrepancies such as magnetic information signs commonly used on control room panels were not evident on the simulator, green bands on controller indicators for letdown temperature and pressure in the control room were not present on the simulator. In addition, two pieces of the Letdown HX RBCCW flow mimic were missing from the simulator. The team did not consider these differences to be significan The licensee initiated CR M2-98-0646 to correct the aforementioned discrepancie .4.3 Conclusions Overall, the simulator compared well with control room panels with or.ly minor discrepancie .5 Radiation Monitor Setooint Control 6.5.1. Scope of Review The team observed operation of the RBCCW gross activity radiation monitor system (RM-6038), and did a walkdown of associated process lines. The team also reviewed

" Millstone Two Radiation Monitor Manual," dated June 27,1997. This manualincluded the alarm setpoint basis calculation for RM-6038, which was intended to ensure that potential releases of radioactive material via the service water system from RCS in-leakage into the RBCCW system were maintained below 10 CFR Part 20 limit .5.2 Findings The team found that the licensee had not properly translated the design basis into procedures and had inadequate procedure controls for the radiation monitor. However, the team found that the licensee had set the monitor conservativel '

Samole Flow was not Controlled On March 3,1998, during the team's system walkdown, RM-6038 appeared to be operating normally. However, the team noticed that the process sample flows were not balanced considering the existing RBCCW system alignment. At the time of the walkdown, the "B" RBCCW pump was in service and supplying Facility 1 components via the *A" RBCCW HX and

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

.

the Facility 2 portion of RBCCW was not in service. While in this alignment, F1-6313 ("B" RBCCW pump discharge sample flow to RM-6038) was indicating about 0.50-0.75 gpm, and F1-6312 ("A" RBCCW pump discharge sample flow to RM-6038) was indicating about 2.25 gpm even though the "A" RBCCW pump was not in service. F1-6314 ("C" RBCCW pump discharge sample flow to RM-6038) showed zero flow for the nonoperating Facility 2 train. Total flow through RM-6038 as indicated by Fl-6038 was about 3 gpm. This flow distribution was within the minimum limits established by OPS Form 2669A-2, Rev. 25, " Unit 2 Aux Building Rounds,"

for FI-6038 (2.0-3.5 gpm) and F1-6312 and 6313 (greater than zero gpm).

The operator accompanying the team considered the flow to be acceptable. Subsequent interviews with operators and operations supervision affirmed that no attempt was made to adjust flow from the individual pumps except as needed to achieve 2.0-3.5 gpm on F1-6038, and greater than zero flow as indicated by F1-6312,6313, and 6314. No procedural guidance existed for the operators to balance the distribution of sample flow. After discussions with the operations staff, and actual observations of the flow distribution, the team became concemed that the sensitivity of RM-6038 to detect reactor coolant inleakage could be adversely affected because of inadequate control of the flow distribution. Although the reactor was defueled at the time of the inspection, the RM-6038 flow distribution observed was representative of the way operations has maintained flow in the pas Additionally, the team had a concem about the observed fact that a majority of sample flow to RM-6038 was coming from the off-service "A" RBCCW pump. With the existing flow distribution, the team estimated that the sample flow from the operating "B" RBCCW was being diluted by a factor of 4 to 6 times. The team noted that even under optimum conditions, with balanced sample flow from each of the two operating pumps (e.g., RBCCW pumps A and C),

the dilution rate would be 2 to 1, which would reduce RM-6038 sensitivity by half. Furthermore, actual dilution rates could be considerably greater (reducing RM-6038 sensitivity even further),

whenever the swing "B" RBCCW pump was in operation. This was because of the unique location of the "B" sample piping takeof Setooint Calculation Review The team reviewad the setpoint basis calculation for RM-6038 to ascertain how sample flow dilution was accounted for by the alarm sctpoint calculation. Typically reduced sensitivity because of dilution, would warrant a reduced setpoint by an equivalent amount. However, the setpoint basis calculation in the Millstone Two Radiation Monitor Manual did not assume any dilution. Failure to account for sample dilution could mean that the RBCCW gross activity for postulated reactor coolant inleakage would have to be many times greater than the highest activity limit.(i.e., SE-5 uCi/mi) allowed if the alarm for RM-6038 had been set to the maximum calculated setpoint in counts per minute (cpm).

However, the team found that the setpoint methodology was very conservative. The radiation manual recommended an alarm setpoint of 2 to 3 times the normal reading, rather than the calculated maximum setpoint, as a more rapid indicator of potentialleakage. This approach was proceduralized in OPS Form 2654K-1, " Radiation Monitor Setpoint Verification," Rev. 3, and as such, the highest alarm setpoint since November 1996 has been 700 cpm primarily due to historically low background. The calculated maximum setpoint of SE-5uCi/ml contained in j the radiation manual corresponded to an alarm setpoint of about 8000 cpm plus backgroun _ _ _ - _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ __ _ _ _ _ __

\ \

'

l

l l .

'

Thus, the licensee's setpoint methodology of SP 2654K, Rev. 3, " Radiation Monitor Setpoint Verification," has resulted in a considerably more conservative setting and increased sensitivity of RM-603 Postulated Problems The team noted that under certain conditions of unbalanced sample flow and/or elevated  !

background levels the licensee's current setpoint methodology would prcbably be inadequat For example, with a worst-case process sample EW distribution (e.g., "B" RBCCW pump running on Facility 1 with 0.50 gpm sample flow and postulated reactor coolant in-leakage, with '

a combined 4.0 gpm coming from the other two sample lines), the resultant 9 to 1 dilution along with slightly elevated background levels could result in an effective setpoint greater than the maximum allowed by the radiation manual. Furthermore, independent of sample flow, the radiation monitor manual allows background radiation levels up to 25,000 cpm before requiring corrective actions to reduce the background. With background levels at 25,000 cpm, the RM-6038 alarm setpoint could be set as high as 50,000 cpm according to SP 2654K. An alarm setpoint this high would correspored to 3E-4 pCi/ml which exceeds the maximum allowabte setpoint of SE-SuCi/ml (i.e., 8000 cpm plus background).

Actions in response to the team's findings, the licensee initiated CR IV2-98-0671 that included corrective actions to evaluate worst-case sample line dilution flows, take actions to address any unacceptable flow, revise the maximum allowable setpoint calculation to include worst-case dilution, revise maximum allowable background, and add procedural controls as necessary to maintain background radiation levels below the maximum. The team considered these corrective actions to be appropriat Failure to properly translate the design basis into procedures and to provide adequate procedural controls for background levels and sample line flow, and inadequate setpoint calculation bases were considered a violation of 10 CFR 50, Appendix B, Criterion ll!, " Design Control."

This was an ICAVP significance Level 3 finding. (VIO 50-336/98-202-05)

6.5.3 Conclusions The RBCCW gross activity radiation monitor system (RM-6038) appeared to be adequately maintained and properly operating and its alarm setpoint was conservatively set. However, the setpoint bases calculation for RM-6038 did not account for process sample dilution, nor was there any procedural guidance to ensure optimum sample flow for RM-6038 sensitivit Furthermore, the procedures for setting and verifying the alarm setpoint were inadequate to ensure that changing flow rates and background levels did not adversely impact the setpoin These procedural and setpoint calculation inadequacies were considered a violatio l

l

._____-_____A

I Desian Chanaes 6. Scope of Review l The team reviewed the design change record packages M2-97039, *RBCCW System -

Shutdown Cooling Heat Exchanger intet & Outlet Valve Position Changes"; M2-97038

"RBCCW System - Letdown Heat Exchanger Valve Failure Position Change"; M2-97018,

"RBCCW System -Installation Of Intersystem LOCA Relief Valves"; and M2-97526, "RBCCW System - ESF Room Air Cooler Flow Loops F-6732 & F-6736 Modification." The DCRs were reviewed to verify that associsted operations procedure changes and training requirements were identified and tracked for implementation. The team also examined the simulator to ensure that design changes in the plant were being reflected on the simulato .6.2. Findings At the time of the inspection, almost none of the significant RBCCW system design changes being performed by the licensee during the current outage were fully completed and closed ou The team selected several more significant DCRs that had well-developed packages and involved actual system modifications. At the time of the inspection, physical modifications for two of the DCRs were essentially complete (M2-97526 and 97018), one was still in progress (M2-97039), and the last had not begun (M2-97038). On the basis of a review of the DCR packages, and interviews with responsible licenste personnel involved with the training department and procedure writers group, the team determined that training requirements, simulator modifications and procedure changes had already been identified by the respective organizations for the appropriate DCRs. The team also verified that the identified training requirements, simulator modifications, and procedure changes appeared to be adequately tracked to ensure their timely implementation to suppo.t completion and closure of the respective DCRs. Of the DCRs reviewed, only DCR M2-97526 was sufficiently far along for the team to review final implementation. The DCR required modifications to the simulato The team verified that the simulator had been physically modified to be consistent with the control room modifications implemented according to DCR 97526. However, the team noted that the simulator software had not been updated to reflect increased engineered safety feature (ESF) room cooler flow. In 1995, the licensee had recognized that RBCCW flow to the ESF room coolers during accident conditions was inadequate. The flow was increased from approximately 58 gpm to 82 gpm. This increased flow was greater than the indicating range of F1-6732 and 6736 (RBCCW flow to the ESF room cooiers). To correct the problem of over-ranged instrumentation, the licensee issued EAR M2-95-330 and DCR M2-97526 to recalibrates the flow transmitters and replace their indicating scales. Although flow was increased in the plant, and the indicator scales were replaced on both the simulator and control room panels, the training department did not recognize the need to update the simulator software. After discussing this issue with the team, the licensee bestigated the facts,and then initiated CR M2 98-0896 to correct the simulato The design control rneasures of U2 OA-12, " Processing and implementation of Design Change Records and Minor Modifications," Rev.1, Section 1.11.5, required the Nuclear Training Simulator Group to " ensure that simulator hardware and software are modified to reflect changes made to the unit." Although, the training department failed to upgrade the simulator

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

'

software the actual software change was considered by the team to be a very minor change

- with minimal impact on operator's interface with the simulato ~ The failure 'to adequately implement procedural measures for the simulator design control was considered a minor violation of 10 CFR Part 50, Appendix B, Criterion lil, " Design Control" and as such not subject to formal enforcement actio .6.3 Conclusions The team found that modification packages were reviewed and tracked by responsible licensee personnel to ensure that appropriate procedure changes and training requirements were identified and implemented before release to operations and DCR closure. However, a noncited violation was identified for failing to upgrade simulator softwar .7 Document Control 6.7.1 Scope of Review The team reviewed a large number of procedures (e.g., AOPs, emergency operations procedures (EOPs), ops, and surveillance procedures (SPs) and drawings (RBCCW P&lDs) in the control room, Technical Support Center (TSC) and Controlled Document Library (CDL) on the third floor of building 475. This review was conducted to verify that controlled procedures and drawings in these locations were up to date with the latest revisions and change .7.2 Findings

'

Procedures and drawings reviewed by the team at the various locations were verifed to be the 3'

latest revision and have the latest changes with one notable exception. On March 30,1998, the team discovered numerous out of date P&lDs on a stick file maintained in the CDL on the third floor of Building 475. More specifically, the team found that all six sheets of the RBCCW stick j file P&lDs (Drawing. No. 25203-26022) were out of date by several revisions. Subsequent l Interviews with the CDL librarian and a document control supervisor confirmed that none of the j stick file P&lDs maintained in this CDL had been updated since their initial transfer to the CDL '

in May 1997. Apparently, during implementation of the CDL project (i.e., combining the majority l of document control satellites into a few centralized CDLs), control and possession of these P&lDs were officially transferred to the CDL on the third floor of building 475. However, a mistake was made in transferring ownership. Rather than changing the ownership for future distribution of P&lD revisions to the CDL, the distribution for this controlled set was inadvertently canceled, l

The team noted that even though there was unfettered access to using these uncontrolled P&lD

prints in the CDL, any copies of the P&lDs would have come from properly updated file The failure to distribute and incorporate the new drawing revisions issued since May 1997 for ;

the set of P&lDs maintained in the CDL was considered a violation of 10 CFR Part 50, Appendix B, Criterion VI, " Document Control."

.

This was an ICAVP significance Level 3 finding (VIO 50-336/98-202-07)

i

,

_ - _ _ . _ - _ _ _ _ _ _ _ ___

.

.

6.7.3 Conclusions All procedures and drawings reviewed by the team at various controlled locations were verified to be the latest revision and have the latest changes with one notable exception. A violation was issued for failing to maintain up to date P&lDs in the third floor CDL of building 47 .8 Ooerator Workarounds and Control Room Deficiencies 6. Scope of Review The team reviewed the "MP2 Operator Burden List" and " Control Room Panel Deficiency List."

In addition, the team interviewed the individual responsible for maintaining these list .8.2 Findings At the time of the inspection there were no outs.anding RBCCW-related operator burdens (OBs). There were 37 OBs listed, most of which involved nonsafety-related equipment. All OBs were assigned a lead department and tracking number and had a schedule for completio The team found there was litt!e procedural guidance for identifying, tracking, evaluating, and prioritizing OBs and operator workarounds. However, this had already been recognized by the Operations department which was in the process of providing more detailed guidance in a pending revision to ODI 2-OPS-1.39, " Operations Review Board." Most of the OBs were scheduled to be completed during operation after restart or during the next refueling outag The operations department also actively tracked control room panel deficiencies. There were 47 deficiencies identified on the Control Room Panel Deficiency List. Of these, six were related to the RBCCW system. Similar to the OB list, the deficiency list assigned a lead department and tracking number, along with a projected schedule for completion. However, unlike the OB List, many control room panel deficiencies had "No Date" or " Late" for expected completion. With the aid of the responsible operations support engineer, the team was able to determine the current planning / work status of each RBCCW-related deficiency. Of the six deficiencies, two had an expected completion date of " Late" and two others had "No Date." Of these four, one had work in progress, two were awaiting parts, and status of the fourth was difficult to ascertain without contacting the lead department. For those deficiencies with a scheduled completion date, almost all were planned to be completed by the end of May 199 .8.3 Conclusions Operations.was actively identifying, tracking, and resolving operator burdens and control room panel deficiencies. The number of outstanding items was reasonable for a plant in an outage but would be excessive for an operating plant. Also, failing to update the expected completion date of those deficiencies identified as " Late" and with "No Date," was, indicative of poor attention by operations managemen _ -- -_ _ _ _ _ - _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _ - - _ - _ _ _ _ _ _

____ - - - _ - _ _ _ - _ _ _ - - _ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

. Maintenance Scope of Review During the inspection, there was no significant maintenance in progress related to the RBCCW system, except for tubesheet cleaning and repairs on the service water side of the RBCCW HXs during the first week which the team observed briefly. However, the team did review l

maintenance procedure MP 2703B5, Rev. 7, " Reactor Building Closed Cooling Water Pump Overhaul," and its associated Vendor Technical Manual (VTM) #2503-365-003, Rev.1,

" Installation, Operation, and Maintenance of Reactor Building Closed Loop Cooling Water Pumps (Ingersoll-Rand Company)." Furthermore, the team interviewed responsible mechanics on their experience and use of MP 2703B .2 FimJinas The limited observations by the team of mechanical maintenance work on the service water side of the RBCCW HXs, indicated that the mechanics were conscientious, controlling entry of fon.ign materials into the open system and maintaining good housekeepin Even though it is not a routine maintenance activity, the mechanics interviewed were reasonably knowledgeable and familiar with the RBCCW pump overhaul procedure and its implementation. Furthermore, the mechanics considered the procedure to be usefu After completing a review of MP 270385 and its applicable VTM, the team found that the maintenance procedure had incorporated appropriate details and was consistent with the VTM, except as follows:

-

The reassembly section of the VTM required a 1/16-inch separation from the bearing housing when installing the oil flinger to the rotating assembly. However, MP 2703B5 failed to identify any required clearance for flinger installation

.

Some minor dimensional details were missing from the Attachment 1 drawing of MP 270385 (e.g., the lower half of the impeller was not clearly defined).

Only the first bullet above had any potential significance, but after discussions with the vendor (Ingersoll-Dresser Pump Company), the licensee determined that the 1/16-inch clearance was a critical dimension only when the flinger was metallic. The flingers used at Millstone Unit 2 were non-metaliic. In fact, for noremetallic flingers, the vendor recommended (in its response memo dated April 6,1998) "they should be set flush against the mating part." The licensee initiated CR M2 98-0916 to revise MP 2703B5 accordingly. Also, the licensee concluded that past flinger installations were within the skill of the craf ^ Conclusions The RBCCW pump overhaul procedure contained appropriate details and was sufficiently consistent with the vendor technical manual, with a few minor exceptions. Responsible mechanics were reasonably knowledgeable and familiar with the RBCCW pump overhaul procedure and its implementatio ___ . _ _ . .

_

. Surveillance and Inservice Testina Scone of Review i

The team observed that plant operators perform a monthly RBCCW system alignment verification in accordance with OPS Form SP 2611D-2, Rev. 25, Change No. 2, "RBCCW System Alignment Checks, Facility 2." The team also observed the performance of SP 2611G, Rev. 0, "B" RBCCW Pump Tests, "Section 4.2 for "B" RBCCW IST, Facility 1. Additionally, the team interviewed responsible personnel involved with the Inservice Test Progra l

. Findings The team found performance of surveillance testing was adequat .2.1 Surveillance On March 9,1998, the team observed the performance of a routine monthly RBCCW system alignment check by a licensed reactor operator and an unlicensed plant equipment operator according to OPS Form 2611D-2. Monthly RBCCW system alignment verifications are required by TS 4.7.3.1.a.4 and 5 whenever Unit 2 was in Modes 1 through 4. However, Unit 2 was defueled and in an extended shutdown during the team inspection, and yet the operations department continued to do the monthly system alignment checks. Furthermore, the TS only required verifying those RBCCW valves servicing safety-related equipment. However, operations routinely verified the correct position of all RBCCW valves. The team considered this to be a positive initiative by the operations department, especially during such an extended shutdown period. The team noted that operators performing the system alignment checks were

~

familiar with the physical layout of the plant and specific valve locations. They were also very proficient in implementing the procedur .2.2 IST On March 30,1998, the team observed control room operators perform a routine IST of the "B" RBCCW pump. .The test went smoothly. The responsible operator was very knowledgeable and performed the test in a conscientious manner and according to SP 2611G and OPS

' Form 2611G-2, Rev. O. Appropriate *hi;,h" flow test parameters were established, and the pump performance data for pressure (i.e., suction, discharge, and differential) and vibration were acceptable. However, when operators prepared to swap RBCCW pumps from pump "B" to pump "A" to perform OPS Form 2611F-1, Rev. O, "RBCCW Pumps Discharge Check Valve IST, Facility 1, the operators identified a procedural conflict (see report section 2.2.5). Recent changes to OP 2330A failed to recognize that it would conflict with procedural instructions in RBCCW IST procedures, such as SP 2611G and SP 2611 A, Rev. 7, "'A' RBCCW Pump Tests."

The controlling note in OP2330A states that 'When shifting pumps, he'ader flow should not exceed . 6500 - 6700 gpm ...," whereas, the RBCCW pump IST procedures state for high flow tests to " Establish 7400 gpm" header flow. Unable to reconcile the procedural conflict immediately, operators conservatively terminated further testing until the problem could be resolve :

I __

- _ _ _ _ _ _ - _ _ .

The team was unable to review the Millstone 2 IST program as the licensee was in the midst of upgrading the Second Ten Year IST Program to their Third Ten Year IST Program. Although the final draft was essentially complete, their program upgrade has not been reviewed, approved, and issued. The licensee's plan was to issue the new program by Mode However, in preparation for Mode 6, many of the IST system procedures (including RBCCW)

have been recently written so they can be implemented before Mode 6 for those systems required to be operable for Mode 6. Even though the Third Ten Year Program is not issued, the IST coordinator was able to confirm that it will contain valve stroke tests for all RBCCW valves (including those modified, or affected by procedure changes, during the recent extended outage) required to reposition during abnormal or emergency condition .3 Conclusions The monthly RBCCW system alignment verification and quarterly *B" RBCCW pump inservice test (IST) were both performed well by knowledgeable operators according to site procedure The continued performance of monthly TS surveillance requirements and inservice testing while the unit was in an extended shutdown condition was considered a strengt .0 Overall Conclusions The team concluded that the licensee had identified and resolved many important RBCCW system vulnerabilities. Although the team had findings, the number of findingt was usual for this type of inspectio Similar to previous NRC inspection conclusions, the team recommended that the licensee give continued attention to lowering the threshold for performing safety evaluations in accordance with 10 CFR 50.59.

.

Overall, the team concluded that the CMP was effective and that the licensee had accurately l assessed the capability of the RBCCW system to perform the safety functions required by its l design basis, the condition of the system compared with its design and licensing bases, the accuracy of the as-built configuration compared to design drawings, and compliance of system operations with the FSAR and the plant's TSs.

l l 1 Entrance and Exit Meetinos The team conducted an entrance meeting with the licensee on March 2,1998 and an exit meeting on April 9,1998. The exit meeting was open to public observation. During the exit l meeting the. team leader presented the results of the inspection. The list of persons who !

, attended the exit meeting is contained in Appendix .

l l

l _ . _ _ _ ___ __ ___- ____ _ _

'

APPENDIX A l Exit Meeting Attendees i Northeast Nuclear Enerov Comoany M. Ahern Manager, Design Engineering M. Bowling Recovery Officer J. Fougere Manager, ICAVP N. Hanley Assistant Project Manager, Configuration Management Program D. Harris Coordinator, Regulatory Compliance D. Hersey Operations Engineer, Unit 2 R. Joshi Manager, Regulatory Compliance, Unit 2 G. Komoski ICAVP Inspection Lead, Design Engineering R. Laudenat ICAVP Program Director, Regulatory Affairs R. Lawrence Representative, ICAVP N. Madden Supervisor, ICAVP H. Miller Director, Unit Services R. Necci Director, Configuration Management Program J. Pizzi Representative, ICAVP J. Price Director, Unit 2 C. White Representative, ICAVP Connecticut Nuclear Enerov Advisory Council J. Markowicz Representative US Nuclear Reculatory Commission H. Eichenholz Millstone Site Coordinator, SPO E. Imbro Deputy Director for ICAVP, SPO S. Jones Resident inspector  !

P. Narbut System Lead, Team 2A, SPO I

.

O

A-1 l

i

'

L . _ . _ _ ..

_ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ _

b

.

APPENDIX B List of Acronyms AOP(s) abnormal operating procedure (s)

AR action request ARP(s) alarm response procedures BTU British Thermal Units CAR containment air recirculation CEDM control element drive mechanism CDL Controlled Document Library CFR Code of Federal Regulations CMP Configuration Management Plan epm counts per minute CR(s) condition report (s)

DCN design change notice DCR design change request ECCS emergency core cooling system EDG emergency diesel generator EEQ electrical equipment qualification EOP(s) emergency operation procedure (s)

ERC Engineering Record of Conespondence ESAR Engineering Self-Assessment Report ESF engineered safety feature ESFAS engineered safety features actuation signal

'F degrees Fahrenheit FSAR Final Safety Analysis Report FSARCR Final Safety Analysis Report Change Request GDC general design criterion / criteria gpm gallons per minute GL Generic Letter

'

HX heat exchanger IBM / min pound mass per minute ,

ICAVP Independent Corrective Action Verification Program IEEE institute of Electrical and Electronics Engineers IFl inspector followup item l&C instrumentation and control IPE individual plant examination B-1

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ .

- . . . . , . . . . . ..

- g 0

'

iST inservice testing LER(s) ~ Licensee Event Report (s)

LPS . low pressure safety injection -

LOCA- loss-of-coolant accident LVL locked valve list LT locked throttled NRC (U.S.) Nuclear Regulatory Commission OB operator burdens ODI riperations department instruction OP(s) ..aperating procedure (s)

P&lDs piping & instrumentation diagrams

. psig - pounds per square inch gauge

.RCS ' reactor coolant system I RG Regulatory Guide i RBCCW reactor building closed cooling water i

RPS reactor protection system

!

SER safety ev,luation report

!

SIAS safety injection actuation signal SSFI safety system functional inspection l l

S W S -- service water system '

TCV- temperature control valve

' TS(s)_ Technical Specification (s)

'TSC Technical Support Center pCi/mi ~ micro curies per milliliter VIO violation -

!

'VTM ' Vendor Technical Manual i

i O

%

B-2 l

,

.

APPENDIX C Summary of In9pection Results item Number Example Typel - Rep Status Title N ICAVP Sec Level 50-336/202-01 E VIO 2. Open Failure to incorporate design L3 requirements for air Criterion XI, Test accumulator tests Control E . Failure to establish a periodic test E . Failure to provide acceptance criteria for RBCCW HX 50-336/202-02 E VIO 2. Open Failure to revise operating L3 procedure Criterion XVI, Corrective Action E . Failure to correct the TS 50-336/202-03 NA ViO 4. Open Failure to maintain a unique L3 valve identification number Criterion Vill, Control of Material 50-336/202-04 E VIO 3. Failure to follow procedure L3 Open for cable separation Criterion V, Procedures E . Failure to classify instrumentation as seismic and safety E . Failure to install piping per drawing (Original piping)

.

E . Failure to install piping per drawing (New piping)

E . Failure to initiate a FSARCR 50-336/202-05 NA VIO 6. Open Failure to translate design L3 into procedure for radiation Criterion 111, Design monitor Control C-1

.

_ _ _ - _-_ _ - _ _ - - - - - - - - _ - - _ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - --

t

.

50-336/202-06 NA VIO 6. Open inadequate procedures L3 (ARPs)

Criterion V, Procedures 50-336/202-07 NA VIO 6. Open Failure to maintain up-to-L3 date drawings Criterion VI, Document

_

Control 50-336/202-08 NA VIO 3. Open Failure to identify an L3 unreviewed safety question 10 CFR 50.59, Changes, Experiments, and Tests 50-336/202-09 NA URI 2. Open Failure to resolve a failure L3 scenario 50-336/202-10 NA IFl 4. Open Lack of documentation for balance of plant setpoint calculations 50-336/202-11 NA IFl 5. Open Pipe support calculations not on site 50-336/202-12 NA IFl 6. Open imprecise valve lineup procedures 50-336/202-13 NA IFl 6. Open Plant labeling errors 50-336/202-14 NA IFl 6. Open Valve positions on P&lDs inconsistent with operating procedures 50-336/202-15 NA IFl 6. Open Sealed valves not included in operating procedur VIO = Violation URI = Unresolved item IFl = Inspector Followup Item

.

C-2

_ _ _ _ _ - _ _ _ _ - _ _ - - .

.

l Distribution for letter to Mr. M. L. Bowlina dated June 11, 1998 Distribution w/enet:

l

! * Region i Docket Room (with copy of concurrences)

l

'

< Nuclear Safety Information Center (NSIC)

PUBLIC

. FILE CENTER, NRR (with Oriainal concurrences) {

. SPO R/F

.NRC Resident Inspector, Millstone Unit 2 l

'

OE (2)(EA Packages Only)

.W. Axelson, RI, DRS S. Collins, NRR '

W. Travers, NRR, SPO W. Lanning, RI M. Callahan, OCA  ;

W. Dean, NRR, SPO l

'E. Imbro, NRR, SPO '

P. McKee, NRR, SPO

. P. Narbut, NRR, SPO v R. Architzel, NRR, SPO J. Nakoski, NRR, SPO R. McIntyre, NRR,SPO D. Mcdonald, NRR, SPO S. Dembek, NRR, SPO S. Reynolds, NRR, SPO J. Andersen, NRR, SPO D. Screnci, Rl, PAO (c-mail)

Inspection Program Branch NRR, IPAS K. Greene, NRR, PIMB/ DISP T. Walker, RI DOCUMENT NAME:A:\98._202.336

• See previous concurrence page(s)

To receive a copy of this document, Indicate in the box "C" copy w/o attach /enci"E" copy w/ attach /enci"N" no copy OFFICE ICAVP:SPO ,E TechE N ICAVP ICAVP DD:lCAVP NAME PNarbut/sJh/ RArchitzel* SReynold5D Elmbro E DATE 61 ll 198 5/14/98 61 9 198 6/ ll 198 6//[#l98 OFFICIAL RECORD COPY I

l