IR 05000341/1996201

Insp Rept 50-341/96-201 on 960821-30 & 0909-13.No Violations Noted.Major Areas Inspected:Safety Assessment & Corrective Action,Operations,Maintenance & Engineering

ML20134L422
Person / Time
Site:	Fermi
Issue date:	11/12/1996
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20134L420	List: IR 05000341/1996201 ML20134L417
References
50-341-96-201, NUDOCS 9611210002
Download: ML20134L422 (40)

Text

,

. -. - . . - . . _-

.

~

U.S. NUCLEAR REGULATORY COMMISSION

!

0FFICE OF NUCLEAR REACTOR REGULATION

l'

Docket No.: 50-341 l License No.: NPF-43 Report No.: 50-341/96-201 Licensee: Detroit Edison Company (Deco)

~

Facility: Enrico Fermi, Unit 2

'

Location: 6400 N. Dixie Hw r Newport, MI 48166 Dates: August 21-August 30, 1996; September 9-13, 1996 l

!

"

Inspectors: Peter S. Koltay, Team Leader Serita Sanders, Special Inspection Branch Phillip M. Ray, Special Inspection Branch Edmund A. Kleeh, Special Inspection Branch

.

'

Sampath K. Malur, Special Inspection Branch Don Prevatte. Contractor l James Leivo, Contractor Don Beckman, Contractor Approved by: Donald P. Norkin, Section Chief

, Special Inspection Branch

Division of Inspection and Support Programs

!

Office of Nuclear Reactor Regulation l

,

d

$

.

d

4

YM

"

9611210002 961112 Enclosure

,

PDR ADOCK 05000341 G PDR 1

.

_ _

.

.

TABLE OF CONTENTS EXECUTIVE SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . i I SAFETY ASSESSMENT AND CORRECTIVE ACTION . . . . . . . . . . . . . . . 1 Problem Identification .................... I S. Deviation Event Report Process ............ I Problem Analysis ....................... 2 S. Deviation Evaluation Reports ............. 2 S. Trend Reports . . . . . . . . . . . . . . . . . . . . . 3 S. Root Cause Analysis . . . . . . . . . . . . . . . . . . 4 S. Quality Assurance . . . . . . . . . . . . . . . . . . . 5 II OPERATIONS ............................. 6 Conduct of Operations . . . . . . . . . . . . . . . . . . . . . 6 Operations Procedures and Documentation . . . . . . . . . . . . 6 Quality Assurance and Self-Assessment - Operations ...... 7 0. Self-Assessment and Problem Resolution ........ 7 0. Quality Assurance Oversight . . . . . . . . . . . . . . 9 0. Quality Assurance. . . . . . . . . . . . . . . . . . . . 9 III MAINTENANCE ............................ 11 Conduct of Maintenance .................... 11 Maintenance Procedures and Documentation ........... 11 Quality Assurance in Maintenance Activities . . . . . . . . . . 12 IV ENGINEERING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Conduct of Engineering .................... 13 E. HPCI System Design Review . . . . . . . . . . . . . . . 14 E.1. Mechanical ................. 14 E.1. Electrical ................. 16 E.1. Instrumentation and Controls (I&C) (20). . . . 18 E. Non-interruptible Air System (NIAS) Design Review . . . 22 E.1. Mechanical ................. 22 E.1. Electrical ................. 24 E.1. Instrumentation and Controls ........ 24

.

. - - - . _ . . - - . - . - . . . _ . _ _ . . . . - . . - = - - . . - - - . . . . - _ . . . . . . _ - . .

'

.

.

.

!

i

, -

j Procedures and Documentation ................. 26 i

! E. HPCI System . . . . . . . . . . . . . . . . . . . . . . 26

E. Non-interruptible Instrument Air System (NIAS) .... 26

. Quality Assurance and Corrective Action . . . . _ . . . . . . . . 28

. E. Problem Identification ................ 28 1 E. Problem Resolution . . . . . . . . . . . . . . . . . . . 29 i

, UFSAR and DBD Review ..................... 30

,

l

!

APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1

-

e i

i f

!

i

!

!

l

.

4 l.

?

~1 i

i

$

i

,

?

\

l

,

i i

$

.

.

.

J

,

I J

,

'.

i

,

d

-

._. _ _ _ . _ __~__ __ ___ _ _ _ _ . _ _ . . _ _ _

.

l t .

!

'

.

EXECUTIVE SUMARY i

An Operational Safety Assessment inspection at the Fermi 2 Nuclear Plant was i concluded on September 13, 1996. The eight member team was led by the Special

'

.

Inspection Branch of the Office of Nuclear Reactor Regulation. The inspection had two objectives: (1) in accordance with Inspection Procedure 40500, the j team assessed the licensee's ability to identify and resolve performance j problems; (2) performing a detailed review of the design, in accordance with

Inspection Procedure 93801, the team assessed the performance capability of the high pressure conlant injection (HPCI) and the non-interruptible control i air supply system (WIAS), and applicable support systems. The team also '

examined self-assessment and quality assurance programs designed to identify and resolve problems through the corrective action process.

i' .The team verified that the licensee's site-wide problem identification and corrective action process us.ing Deviation Event Reports (DERs) was i

comprehensive and continued to gain acceptance by site personne The tracking and trending of the DERs within the corrective action program identified adverse trends in the areas of operations, maintenance and engineerin However, the. team also noted weaknesses in several phases of the problem identification process including, some resistance by craft personnel '

to participate in the DER initiation, and the failure to provide guidance needed to properly classify DERs according to the significance of the probl,m e or event. The procedure also lacked specific requirements to escalate long standing repetitive issues to the attention of upper managemen The teu: identified significant weaknesse regarding the failure of licensee corrutive actions to prevent recurrence of problems. For example, in the operations area, deficiencies were identified in procedure preparation and upgrade during 1994 and part of 1995 in deviation report DER 95-0624. The repetitive nature of the problem was noted in a recently issued adverse trend report, DER 96-1004. Also in the operations area, the lack of effectiveness of corrective action initiatives were evidenced by recurrent improper component manipulations (DER 95-0199), and by repetitive failures to enter Technical Specification action statements (DER 95-07890).  ;

In the area of work control, adverse trend DER 95-0626 and again DER 96-1005, identified recurring issues. The team determined that weaknesses in the initial characterization of the problems, assignment of probable cause, and root cause analysis contributed to the inadequate corrective actions. For example, the team identified that a substantial number of the work control related DERs had the same probable cause " inattention to detail." The corresponding corrective actions were generally limited to counseling and retraining of employees. The lack of specific requirements to bring recurring issues to the attention of upper levels of management was also regarded by the team as a contributor to the chronic nature of the problem i

,

_ _ _ . - . _ _ _ _ _ . - . . . .

.

d

.

The nuclear quality assurance (NQA) audits and surveillances did not reflect the adverse trends apparent from the DERs in the areas of work control and I

!

uperations. Although significant problems were identified in NRC and third

' party reports as well as in the DERs, the level of NQA audit activity was not

'

increased. In the biannual audits of the corrective action program, NQA did j I

not follow the requirements of the QA manual for generating DERs and for escalating repetitive issues to management attentio The team noted that the Nuclear Safety Review Group (NSRG) was cognizant of i

the repetitive problems resulting from inadequate corrective action i

!

However, there was no indication of initiatives to address the adverse condition The team also concluded that the inspected systems, (HPCI and NIAS) are capable of performing their intended safety functions. However, one calculation had to be created to verify that existing instrumentation would detect a pressure transient in the HPCI system steam exhaust line and isolate the system as required. Several other calculations such as DC 2913 for fuse selection, and DC 5352 for motor operated valve (MOV) pickup voltage, required ;

corrections in order to verify system operability. Additionally, numerous l

'

UFSAR and design basis document (DBD) inaccuracies were brought to the 1 licensee's attention.

The team identified a deficiency regarding surveillance test acceptance criteria derived from calculations. In two instances the maximum leakage ,

' rates allowed by surveillance could exceed the NIAS system capacity. In !

another case the minimum pickup voltage for an MOV exceeded the voltage available at the valv l l

ii

. - - - . . - -

.

!*

I SAFETY ASSESSMENT AND CORRECTIVE ACTION Scope

,

The team assessed the effectiveness of the licensee programs to identify, resolve and prevent recurrence of problems that degrade the quality of plant i operations and safety. These licensee programs include: problem

identification process, root cause analysis, quality assurance, safety review

.

committees, and self assessments.

i S.1 Problem Identification S. Deviation Event Report (DER) Process l

'

The team assessed the acceptability and use of the DER process by site i personnel.

! The DER process is a site-wide mechanism available to all personnel, for identifying problems. The process as described in procedure MLS02, Revision 4

" Deviation and Corrective Action" has been in place for approximately one i year. As a part of this. process, the DERs were delegated to respective line

,

organizations for corrective action proposal and resolution. The central j corrective actions program (CAP) is implemented by the Director of the Safety l" Engineering organization, who is designated to manage the problem identification and the corrective action program. Areas of improvement were noted.in the DER process, as well as several weaknesse As of September 1996 site personnel initiated 1110 DERs for the current yea This compares with 630 DERs initiated during the same period in 1995. This increase was attributed to a licensee site-wide effort to reduce the threshold

,

for initiating the problem report .

Although the number of DERs issued during this year increased, the team i identified weaknesses in program implementation. For example, the DER flow I chart type procedure was complicated. The team verified this through field j' interviews that indicated that maintenance craft personnel would not use the

. DER flow chart, in part, due to its complexity. The workers expected their supervisor to initiate DERs. Training on the DER process provided to craft

. personnel through the general employee training did not discuss the procedure

! and the DER form. The Director of Safety Engineering stated that training j will incorporate management expectations to have workers initiate DERs.

l As of April 1995 the licensee initiated a three-level classification of DERs

- based on significance. Significant DERs (identified as Level 1) are defined in procedure MLS 02 as describing conditions that have an adverse or potentially adverse effect on equipment icoortant to safety. The team noted instances where events of apparent roderate to high safety significance were categorized as Level 2 or Level 3 even thotgh they included multiple accident precursors and involved degradation of safety related systems, structures, components, or activitie For example, DER 96-0020 identified three performance problems with a fire door repair, including failure to make an LC0 entry and was categorized as a Level 2; DER 96-0159 involving installation of

__ _ ____. *

i

'

l an AC relay instead of the required DC relay was categorized Level ,

Documentation did not explain why the above issues were not considered

! Level 1.

j The team also noted the following examples where DERs were misclassified as

.

Level 2 or 3 instead of Level 1, that were subsequently corrected by the

corrective action program manager and assigned Level 1: DER 96-0464, DER 96-0633, DER 95-0718, DER 95-0626, DER 95-0378, DER 95-076 : The team determined that the lack of. adequate guidance for the classification

of DERs is a weakness in the program. (Inspector Follow-up Item 50-341/96-201-01).

l Nuclear Quality Assurance (NQA) also utilized the DER process to track and resolve its audit and surveillance based finding However, there was an inconsistency in that response to non-NQA DERs could be extended three times without management approval, while NQA initiated DERs required the NQA {

i

manager's signature for the first extension. The team was concerned that such l inconsistent application of requirements might diminish the importance of the l l DER process and result in confusion for plant personne i t

i The-team concluded that the DER process uas being used to report more plant problems as reflected by the increase in the numbers. However, there l continued to be resistance to initiating DERs at the craft level. The DER j process lacked detailed guidance for significance level determinatio l

S.2 Problem Analysis '

i i 4 S. Trend Reports  !

! 1

The licensee's Safety Engineering Group semi-annually evaluates declining

'

!' performance trends and patterns by review of individual DERs and issues " Trend

,

DERs" which require root or common cause analysis of the apparent trends and

{ comprehensive corrective action to prevent recurrence (CATPR).

l During 1995 through August 1996 the licensee identified adverse performance i trends that involved improper component manipulation (Trend DER 95-0199, based '

i on eleven 1994 DERs), failure to enter technical specification action

. statements (Trend DER 95-0789, based on ten 1995 DERs), and inadequate ;

j procedure quality (Trend DER 95-0624, based on fifteen 1995 DERs and Trend DER :

96-1004, based on nineteen 1996 DERs). The deficiencies of the current

] analysis period appear to be repetitive problems identified by the 1994 and

! 1995 trend reports. The continuing performance problems were attributed, in j

part, to inadequate operator knowledge and training.

i,

<.

The Director of Safety Engineering initiated the practice of assigning a Level j 1 significance level to trend DERs regardless of the significanca levels of j the individual DERs supporting the trend. However, the team noted that i personnel involved with trend evaluations were not aware of this practic i The lack of specific guidance to designats trend DERs as Level 1 is a weakness

.

} of the progra (Inspector Follow-up Item 50-341/96-201-02).

_ _ _ _ .

.

!

i

.

!

The DER Trend Analysis Report for the First and Second Quarter 1996 also identified adverse trends in inadequate personnel performance in the areas of i work control, conduct of maintenance, design configuration and mooification control.in plant support engineering, and procedure preparation upgrade in in-service inspection progra ,

Additionally, weaknesses in the work control process were identified by the !

team as a repetitive deficiency from both the 1995 and 1996 reports. The team }

found no indication that the licensee recognized these as recurring problems, and, in general, the team found no indication that any of the recurring issues were brought to the attention of high level site management. The 1995 trend report tracked the deficiency under DER 95-062 ;

For inappropriate actions (human errors) associated with the trend report DERs the licensee identified inattention to detail and misjudgment as the predominant causal factors. The licensee did not appear to investigate the cause of repetitive worker misjudgment and inattention to detail. This was evident in the repetitive nature of the causal factors identified b operations and maintenance. (0.7.1; M.5)

In conclusion, although trending codes and causal factors for subject events were inconsistently applied, the trending program was adequate to identify

,

'

adverse performance trends. The repetitive nature of the adverse trends, and the lack of guidance for the escalation of long standing problems to management attention, are weaknesses in the corrective action progra S.2.2 Root Cause Analysis (RCA)

The team reviewed the available training material and work instructions for root cause analyses, completed Level 1 DER root cause ' analyses conducted from

.

I 1995-1996, and DER corrective and preventive actions, to determine whether the process was effectiv i l

In early 1996, the licensee had concluded that too many root cause  !

determinations were being done as a result of inadequate guidance for DER l significance level assignments. As a result, the prioritization and cause determination guidance in Safety Engineering Conduct Manual Procedure MLS02,

" Deviation and Corrective Action," Revision 3, was revised to properly differentiate between Levels 2 and Level 3 and the significance level for a

,

!

Level 1 DE The licensee was seeking to hold the number of Level 1 DERs to about 100 to 200, out of an estimated total DER population of about 2,00 l In April 1996, NQA audit 96-0106, " Evaluation And Corrective Actions Program,"

identified root cause analysis as being ineffective. As a result, the licensee committed to reduce the existing 170 core evaluators to 40 (10 per line organization) and retrain the selected candidates. At the time of the inspection, the 40 core evaluators had not been selected and retraining had not been scheduled. Instead, representatives from Safety Engineering personally assisted individuals in performing root cause analysi '

These efforts resulted in some inconsistent improvements in root cause analysis. In approximately one half of the 1996 RCAs reviewed, as found ,

3

.

.---n

.. .. _ - - . .-- --

.

'

conditions were not adequately describe The corrective actions in response

!

to the root cause analysis were generally limited to additional training recommendations and did not appear to solve the proble For example, the

,

following RCAs are typical of the lack of accepted root cause analysis

,

methodology and the arbitrary treatment of programmatic and organization failure causal factor:.

'

DER 96-0434, "RHRSW Check Valve Closure Failure:" The RCA used event chronology as part of the investigation but there was no indication that a generally accepted method was used for the remainder of analysis. Initial analyses did not address human performance issues until questioned later

-

by corrective action program staf DER 96-0755, "RWCU Demineralizer Panel Fire Caused by GE CR120A Relay Failure:" The RCA text implied that a modified events and causal factors

, charting method was used but no chart or time line was included. The

conclusions were reasonable but did not challenge the lack of effectiveness of the Operating Experience Review Progra DER 96-0595, "Div 2 TWMS Isolation While Replacing Burned out Light Bulb:"

The RCA did not use formal RCA methodology and did not address programmatic or organizational issues except for a recommendation to

consider reinstitution of deficiency tagging system.

'

DER 96-0454, "TBHVAC South Exhaust Fan Damage:" The RCA used good events

.

and causal factors charting methodology but did not address programma^.ic root causes (e.g., work control, configuration control, inadequate work

instructions, or others), that resulted in improper alignment of the fan hardware which caused the damage.

The team also reviewed the following RCAs that were performed and documented properly and included the necessary corrective action recommendations to resolve the issues: DER 96-022, DER 96-0374, DER 96-0657.

t

In conclusion, recent improvements in root cause analysis can be attributed to l the temporary support by more experienced corrective action program staff

'

members. However, the licensee had not completed its plan to promptly identify and retrain personnel in root cause assessment methodology. This is a weakness in the corrective action program. (Inspector Follow-up Item 50-j 341/96-201-03).

S.2.3 Quality Assurance The team reviewed audit reports issued in the past two years and the quality organization's ability to identify and escalate significant problems to management's attention.

! The Nuclear Quality Assurance (NQA) organization conducted biannual audits of the corrective action program. The quality assuraace n.4nual, Internal Audits

- MQA02, Chapter 4.8, requires the auditors to issue DERs for audit finding The team noted three examples in audit NQA 96-0106 where DERs were not generated to reflect audit findings. One example involved the lack of

4

i

_ . _ _ _ __ . _ _ _ - _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ .

i l

l

'

guidance for core evaluators on the level of review performed for each of the l

'

three DER significance levels. This illustrated a problem with the Deviation j

" and Corrective Action procedure MLS02, in failing to delineate the assignment and criteria for significance Level 1, 2, and 3 DERs. Two other examples ,

i involved audit findings that identified programmatic weaknesses in the root

,

cause evaluat' ion process, and in establishing corrective actions for DER Failure to issue DERs was also identified to the licensee in an audit of NQA

.

activities conducted by the Joint Utility Management Association in June 199 .

Audit report NQA 96-0106 identified that a repeat problem of transferring j

corrective actions from an older DER to a new DER was previously identified in 1 audit report NQA 95-0133 under DER 95-0724. Audit report NQA 96-0106 captured i the problem under DER 96-0199. However, the repetitive problem was not i escalated to the attention of senior management as required by the Management i Action Request (MAR) described in the NQA manual, Internal Audits-MQA02,

Chapter 4.8, Section 3. Additionally, two independent audits, NQA 96-0104 " Procedures, Manuals, and 3 Orders," and NQA 96-0106; " Evaluations and Corrective Actions" identified ;

i problems with the DER procedures; however, NQA did not. relate the two to i

!

capture the broader problem of an a'nhiguous DER procedure. For instance, NQA-

96-0104 identified a problem with the corrective action procedure not being

! user-friendly. NQA-96-0106 identified problems in using the DER procedure in l that core evaluators were not able to distinguish between Level 1, 2, and 3 ,

t DERs and performed poor root cause analyse I

In conclusion, the NQA organization did not follow the requirements of the j Quality Assurance manual for generating DERs for audit findings and for escalating repetitive issues to management's attention. This is identified as j Deficiency 50-341/96-201-01, i

5 S.2.4 Nuclear Safety Review Group i The team reviewed the four Nuclear Safety Review Group (NSRG) meeting minutes i for 1996. The meeting minutes indicated the NSRG's awareness of the problems j that confronted the corrective action program. This information was provided

to the NSRG through presentations by the corrective action program manager,

NQA reports, trend reports, and analysis of major events.

k

For example, the February 1996 minutes discussed the October 1995 monthly DER

trend report (NASF-95-0203) that showed a growing site-wide problem in DERs

,

that dealt with preparation and upgrade of procedures. Additional discussion i

on the results of trend report was deferred until the next NSRG meeting. The team noted that the issues were not discussed in the NSRG April 2, 1996 i meeting.

j The April 2,1996 minutes, d1 eussed lack of effectiveness of the most

frequently used corrective actions such as training, required reading, and

'

lessons learned. The NSRG also noted that root cause analyses were inconsistent and inadequat .

1 5 i

i l

. . . - . . . - . . . . _ - . - -- . - - - - - - - . - - _ . .

,

'

.

'

NSRG identified that the backlog of DERs was increasing as evident from the

November 1995 DER trend report NASF 95-0219. Additionally, the NSRG j recognize that the same issues continued to be identified. Discussion i concentrated on recurring problems due to ineffective corrective action in the L areas of routine evolutions, procedural adherence, and personnel performance.

!. Aggressive follow-up of NQA findings and reissuance of DERs that have

ineffective corrective actions were identified as a solution. Moreover, NSRG stated that NQA and Safety Engineering should be more demanding in accepting j corrective action plans.

j The May 30, 1996 meeting minutes discuss the DER trend analysis for the third

and fourth quarters if 1995 - NASF-96-0025 that indicated individual

! performance and determination of causal factors for equipment failures as significant recurring weaknesses needing more attention.

.

l The July 31, 1996 meeting minutes identified another example of inadequate corrective action in response to a 1995 DER that had some indications of

symptoms similar to the service water freezing problems encountered in February 1996. The 1995 DER did not adequately assess that information and

'

resolve the problem at the time.

I In conclusion, it was apparent to the team from the meeting minutes of the NSRG that the group was cognizant of repetitive problems resulting from inadequate corrective actions. However, the team did not find any indications of NSRG initiatives to address these problem II OPERATIONS l 1 Conduct of Ooerations The team observed routine controi room activities during day shift and early afternoon shift periodically during the inspection. These observations were j conducted in conjunction with procedure reviews, control panel walkdowns, and -

i review of control room records and activities for temporary modifications, l jumpers and lifted leads, operator work arounds, 'and the plant material l concerns list. No conceras were identifie O.3 Operations Procedures and Documentation The team conducted walkdowns of portions of the High Pressure Coolant Injection (HPCI) System Operating Procedure (SOP) and a sample of Alarm '

Response Procedures (ARPs) at control room panels, relay rooms, and in the >

reactor building. The team identified two procedure deficiencies involving incorrect identification of HPCI inverter fuses and an incorrectly referenced event classification procedur A procedure action step in ARP 2054, "HPCI Inverter Circuit Failure," Revision 5, incorretly identified inverter fuses to be checked in Relay Room Panel Hil-P612. Correct identification of the fuses by the licensee took about 20 minutes. Actual panel markings were confirmed by review of Wiring Diagram 61721-2045-23, Revision Z and the HPCI System Power Distribution Drawing  :

. . . - .-. - - . -.- -. . . - - - - - _ . _ . - ~ - ---

d

,

I

!-

'

61721-2225-2, Revision J. The licensee issued DER 96-1028 on August 23, 1996 l to correct the deficiency and a temporary procedure change was issued with an )

i interim correction.

!

l In a second procedure, the team identified that ARP 2059, "HPCI Pump Discharge Flow Low," Revision 4, included an incorrect " Initial Response, Step 4."

l This step directed the operators to classify the event in accordance with EP-101 " Classification of Emergencies." The licensee concluded that the step

was inappropriate and that the current emergency action levels and event

classification scheme do not apply to conditions subject to the ARP. Licensee i

' reviewed several other ARPs and found similar incorrect steps. DER 96-1045 was issued for the evaluation of the proble Because of problems with procedure quality and useability identified in 1994-95, the licensee had begun a system operating procedure (SOP) upgrade program in January 1996. The inspection team reviewed the overall plan, schedule, and status of the SOP upgrade activities, including discussions with on-shift operators participating in the program. The program was about half ,

complete and behind schedule. Originally, the S0P effort was to be completed !

by the end of September 1996. .The licensee expected to complete the effort by the end of this year. Upgrading of ARPs and abnormal operating procedures (A0Ps) was planned to begin after completion of the S0P effor In conclusion, two procedure deficiencies were identified from a relatively small sample of procedures inspected and represent problems similar to those previously identified by the licensee. Although the licensee's plans include i upgrading all operating procedures (except Emergency Operating Procedures) in '

the 1996-97 time frame, procedure problems continue to challenge operators as indicated by recent event .7 Ouality Assurance in Operations 0. Problem Identification and Resolution Recent inspection results and the May 1996 SALP identified continuing performance problems in operations, especially in the areas of personnel errors, procedural adherence, work controls, and the impact of long standing equipment problems on routine operations. The team reviewed the operations department's self-assessment and problem identification activities to determine: (1) whether these activities were effective in identifying and correcting the problems contributing to the adverse performance and, (2) whether management was using the processes to effect broader improvemen In 1994-95, several adverse performance trends were identified by the licensee's corrective action program in equipment manipulation, procedural inadequacies, and multiple failures to enter technical specification action statement Similar performance problems have continued to occur and have generally been well identified by the licensee's programs. However, the licensee's corrective action program and tne corrective and preventive actions implemented by line organizations have not been successful in preventing recurrenc . . . - - - -. - - - . - . _ - - . - - _ - - - . - -

'

.

.i

'

For example, trend DER 95-0199 was issued on March 6, 1995 as a result of j eleven 1994 DERs involving various equipment manipulation problems such as

'

valve mispositioning resulting in several operational events. The " DER Trend ,

Analysis Report for the First and Second Quarters 1996," issued on August 20, 1996 by the Director, Safety Engineering, noted that the trend in ,

i i

inappropriate component manipulation had remained constant during 1996. This

!

assessment is also supported by recent exarmles of inappropriate component-

,

manipulation and field work activities such as starting and sustained operation of a circulating water pump with its discharge valve closed;

) misalignment of a containment thermal recombiner during testing; )

mispositioning of emergency diesel generator air receiver outlet valves, and ,

i i

others. The licensee had only recently completed the final corrective action to prevent recurrents (CATPR) for DER 95-0199, and had evaluated the 1996 1 occurrences as part of that DER. The team noted that the corrective actions i

!' designed to prevent recurrence of problems and improve performance rely on i personnel training. At the time of the inspection, no additional action was-

planned by the licensee pending a determination of the corrective action

, effectiveness. However, the team verified that during the nineteen months i j since the adverse trends involving equipment manipulations were identified,

the corrective actions were not effective.

l Trend DER 95-0789 was issued on October 16, 1995 as a result of ten 1995 DERs documenting failures to enter technical specification action statements

,

i 1 l associated with surveillance, maintenance, and equipment deficiencie !

Corrective actions again relied heavily on personnel training and were not yet i complete at the time of the inspection. An event during the inspection, l

involving operability of the Reactor Core Isolation Cooling system barometric i' condenser, was a recent example where the operations staff did not promptly recognize the significance of a problem, causing a delay in operability j assessment of the RCIC system and the entry into the applicable technical i specification action statement. The team noted that this event was indicative 1

i of the continuing lack of effectiveness of the training-related corrective

] actions, s

! The most persistent adverse trend involved operating procedure qualit Trend DER 95-0624 resulted from fifteen third and fourth quarter 1995 !

individual DERs. The corrective action to prevent recurrence for DER 95-0624

', addressed weak operating procedure technical reviews and incorrect i

! prioritization of operating procedure changes and resulted in closure of the i

'

DER in April 1996. Through June 1996, an additional nineteen individual DERs were issued in operations as a result of procedure quality problems and Trend i DER 96-1004 was issued on August 21, 1996. The continued weak performance was l l attributed by the licensee to misjudgments and inadequate knowledge in about ,

j half the cases, resulting in procedures with inadequate scope or detail. It '

was not clear that these were valid root causes. The licensee's formal root cause analysis for Trend DER 96-1004 had not been completed by the close of j the on-site inspection activitie !

. In conclusion, while the licensee has been successful in recognizing and 1 identifying problems and deficiencies, the corrective actions taken have not l been effective in resolving problems. As discussed in Section S of this ;

J i

,

4

-

, . ._ .

. _ _ _ . . _ _ . _ _ _ _ . _ __ . _ . _ . . _ _ . _ . _ _ _ _ _ . ~ ._

-

.

'

l i

!' report, the licensee has relied on common cause analysis techniques which have {

not addressed all potential root causes and has not provided adequate

-

j

} corrective action for human performance issue '

l ' 0.7.2 Self Assessments

i During 1995-96, the Operations Department increased the self-assessment of

. specific activities, such as work- control, operator work-arounds, procedure

.

compliance, and others. Although these assessments were not structured like l audits nor implemented as a formal plant program, they identified and 1 confirmed several problems that were previously described in the 1995-96 DER-

' data.

. .

[ A Comprehensive Integrated Technical Assessment (CITA) was performed by an ;

l inter-departmental team in January-February 1996. The report-(96-0103)  !

t

identified five major recommendations for improved operator performance. The CITA also validated technical specification compliance issues identified by

DER 95-0789, and identified related issues of weak operator knowledge of plant

and administrative processes.

t

A self-assessment of operations work control conducted in April 1996, i

!

identified programmatic and organizational recommendations for performance improvement. Discussions with operations management indicated that some of i

the work control self assessment recommendations were receiving management

, follow-up although they were not being formally tracked as corrective action

commitments.

i A " DER Situational Analysis for 1995 DERs in Operations and Maintenance" was

-

published in April 1996 to evaluate the trend in personnel performance-related 3 problems in the 1995 DERS. The situational analysis reviewed additional DER i

'

data for trend indications. The report confirmed that misjudgment, inadequate skills or knowledge, and inattention to detail accounted for all' but a few of l_ the inappropriate actions in operations. The report did not appear to

consider the contribution of other administrative, programmatic,~or personnel i accountability factors, such as, adequacy of technical resources available for L procedure development, verification of procedures input information and field j validation, breakdowns in the technical and management review and approval

! processes in the DERs. The Operations Department's response to these j performance problems generally focussed on operator knowledge (training) and j problem awareness.

d I

In conclusion, the team determined that, while the self-assessments confirmed

. previously identified problems they did not contribute to improving l performance and to the prevention of recurring performance problems.

!

. 0.7.3- Quality Assurance i

'

The team reviewed the Nuclear Quality Assurance (NQA) Department's oversight j and assessment of operational activities to determine whether the scope of the i program and the level of NQA activity adequately covered operational j activities; whether the NQA audit, assessment, and surveillance activities i were effective in evaluating Operations performance; whether NQA activities i

j 9

I t

t

- , - . - --

, . - - - - - . - .___. - ..- - - - . - - . - - - - - - -- - . - - . - . -

! .

l i

i -

successfully identified performance issues before they became self-revealing i

or were identified by NRC; and whether NQA facilitated adequate corrective and

preventive actions that contributed to improved performance.

1 *

i-The overall program scope and coverage appeared to meet the " routine" program

requirements of Technical Specifications and the NQA Conduct Manual MQA02,

-

" Internal Audits and Surveillance," Revision 2. There had been two audits of

,

plant operations in 1996 (the Operations CITA done in early 1996 and an I

Emergency Operating Procedure / Station Blackout audit in June 1996). Six i surveillances (of which four were "SALP Concerns Group" activities) were j conducted with a strong operational orientation. While the CITA and the SALP r Concerns Group surveillances were viewed by the team as worthwhile i' initiatives, they provided only limited evaluation of the continuous ,

l

performance problems that were either self-revealing or identified by the NRC '

l and the DER proces l

j The team reviewed each of the 1995-96 NQA audit and surveillance reports of

operational activities and the "NQA Observation / Finding Follow-up List"

covering the period 1992-96. The team noted that most of the findings, j including those in 1996, involved procedural, administrative and compliance

issues, and only a few involved performance based issues or systemic problem For example, only one surveillance activity was found to have performance  !

! based output. NQA Surveillance 96-0228 from May 28-July 12, 1996, included '

j shift observations and evaluated tagging and valve lineup errors and other l j operations related work. The surveillance dic not identify any findings in l

! the operations area. The remaining NQA surveillances for 1995-96 involved ,

4 housekeeping and material conditions or non-operations issue I i

3 Similarly, in mid-1995, NQA performed two seven week surveillances of

operations work control resulting in no findings or observations in the areas

! of administrative controls, configuration control, or material condition.

i During this time, however, problems continued to be identified in DERs issued

in these areas. In contrast, with the lack of findings in the NQA i

surveillances, in August,1996, another trend DER, prepared by safety i engineering with several dozen DER-examples was issued identifying chronic j work control problems.

i In conclusion, the NQA audits and surveillances failed to identify or confirm j previously noted recurring problems in the areas of operations.

i Based on interviews with auditors and review of the audit and surveillance i reports, the team determined that the NQA staff personnel received little j training on performance-based assessment concepts and techniques. These

-

concerns were discussed with the recently appointed Director, NQA, and the

! Manager, Nuclear Assessment, who provided near term plans for initiating i improvement in this area.

!

III MAINTENANCE

j M.1 Conduct of Maintenance 1 Ihe inspectors observed the performance of maintenance activities including j surveillance, corrective maintenance, and preventive maintenance. The quality

'

t 10

.

i

-- - _

-. -. . - -

'

,

of maintenance was assessed including worker knowledge, procedure use, pre-job

'

briefing, communications, and results documentation. The craft personnel's understanding of the problem identification process (DER) was also evaluate In addition, the team reviewed the surveillance records of the HPCI system to verify the completion and documentation of Technical Specification requirement The activities observed by the team were conducted by knowledgeable and i experienced workers. Observed work was performed adequately with the use of approved surveillance, preventive maintenance, or corrective maintenance procedures. The maintenance supervisors conducted detailed pre-job briefings that included potential plant and personnel hazards that may be encountered, verbal discussion of work to be performed, and acceptance criteria and expected results. Both the supervisor and the lead technician assigned to the maintenance activity verified that the work procedure and revision were correct. The shift superviscr reviewed the procedure and the plant conditions required prior to approval of test initiation. A review of the surveillance test records indicated, that at the time of the inspection all current channel l functional tests for HPCI were performed within the required schedule and met I the acceptance criteria specified. The results of the surveillance test were documented adequately and included the "as found" and "as left" dat M.3 Maintenance Procedures and Documentation The team observed maintenance and surveillance activities to determine the adequacy of procedures and procedure use. Also, the team reviewed the maintenance program procedures, guidelines, and maintenance performance reports from March 1995 through August 1996 to assess the tracking, trending, and control of maintenance activity backlo The team identified a weakness in the documentation of the performance and verification of surveillance procedure steps. The team noted the following two activities where technicians interchanged their designated roles as performers and verifiers of the surveillance tasks: On August 23, 1996, during performance of Surveillarce Procedure 42.302.03, " Channel Functional Test Div II 4160v Bus 65E & 13EC Undervoltage Circuit" and on August 27, 1996, during remote operations on surveillance test 44.030.264, ECCS - Reactor Vessel Water Level (ADS Level 3 and Feedwater/ Main Turbine Level 8), Div II, Channel B Functional Test." The licensee initiated DER 96-1030 to address this issu The licensee issued regular reports to management for communicating the status of the maintenance backlog. Work completed and repeated work was reported to management on a monthly basis providing an adequate mechanism for trending of corrective maintenance overall performance. Component failures were trended in the monthly reports using Nuclear Plant Reliability Data System information in accordance with the licensee's Maintenance Conduct Manua The team verified through a review of mair?.enance monthly reports that the licensee trended preventive maintenance (PM) by schedule, and the scheduled amount of grace period used prior to the overdue date for the PM was tracke The maintenance staff used only 10% of the grace period on an average and

i

_ _ _ . _ _ _ _ .- _ . _ _ _ - _ _ _ _ . _ _ . _ _ _ _ . _ _ _ _

i

i

!,

.

i there were no overdue PMs during the last year. The licensee also trended PM i activities that documented unsatisfactory "as-found" conditions. This was

! used to aid the maintenance and engineering staff in determining changes to i ;the frequency of PM The number of PMs with unsatisfactory "as-found" i conditions occurred 15% of the time. The licensee trended corrective

maintenance performed on components that were covered by scheduled PMs. This

' trending indicated a decrease over the last year in corrective maintenance required on components that received PMs. All PM trends were presented to l management in a monthly report adequately depicting the PM program performance j graphically and numerlcally.

! M.5 Ouality Assurance in Maintenance Activities The team interviewed 4 managers, 10 workers, and 3 engineers in the maintenance organization. These interviews focused on the processes that the maintenance department used for performance improvements including: Deviation Event Reports (DER), Quarterly Performance Indicator Report, and Self-Assessments. The team also reviewed DERs from 1995 and 1996 that were assigned to maintenance for resolution, and DERs that the licensee's Safety Engineering group issued to address negative trends in maintenance. In addition, the team reviewed the-licensee's second quarter 1996 Quarterly Performance Indicator Report, and maintenance self-assessments performed prior to the initiation of the formal self-assessment proces The maintenance personnel indicated that problems were resolved through procedure changes and post-event lessons learned training, often bypassing the .

DER processe Interviews with the craft personnel also identified a '

reluctance to use the DER process for identifying problems. These workers indicated that they would notify.their supervisor if a problem occurred during maintenance work activities and leave the decision for writing a DER to the discretion of the supervisor. The director of Safety Engineering, who is responsible for the DER program implementation, stated that the licensee expectation was that all employees would write DERs when problems were identified. These expectations were not met at craft levels of the maintenance organizatio The team's review of DERs packages from 1995 and 1996 and trend DERs initiated by the Safety Engineering group indicated, in general, a lack of in-depth cause determinatio The maintenance department determination for the probable cause of a significant number of DERs was " inattention to detail."

The trend DER 95-0626, August 28, 1995, identified a trend of deviation in the area of work control. Eleven of these DERs were evaluated by the maintenance department and determined to have a probable cause of " inattention to detail."

The trend DER 96-1005, August 20, 1996, identified the same deviation in the work control area and 15 of the DERs probable cause determinations indicated

" inattention to detail" as the probable cause. The team identified an additional 6 DERs with " inattention to detail" as the probable cause. The repetitive nature of the probable caures and the corresponding corrective actions are indicative of weaknesses in the corrective action progra The Quarterly Performance Indicators for the second quarter of 1996,

' identified significant weaknesses attributed to maintenance. Maintenance

._._ . _ _ _ _ _ _ _ _ . _ _ . _ _ . _ _ _ _ _ _ - _ _ . . _ _ _ _ _ _ _ . _ . . . _ _ _-

.

.

managers were not aware of the factors that contributed to weak maintenance

performance. Consequently, there were no plans and goals to address the problems identified by the repor The inspector found, during interviews with maintenance staff, that the i

expectations for the use of the Quarterly Performance Indicator report were j not clearly communicated through the maintenance organizatio ,

>

$ The maintenance managers indicated that the maintenance organization had just i

begun formal self-assessments at the time of the inspection. The I&C i superintendent had decided to conduct a series of self-assessments in various j areas of the department. The other superintendents had not determined how to l conduct the self-assessment process.

, Conclusion .

-

In conclusion, maintenance and surveillance activities were appropriately

! performed in accordance with procedural requirements and the Technical j Specifications. Maintenance trending of backlog and preventive maintenance i

• was good with periodic reports to management providing clear indications of {

work status ar.d condition of the proaram effectiveness. A weakr.ess was noted in the problem identification process in that craft personnel were reluctant )

'

)

to initiate DERs. A process to trend the DERs was also in place. However, corrective action concentrated on training and counseling was not adequate to i prevent persistent recurrence of the problem J l IV ENGINEERING

E.1 Conduct of Enaineerina - Scope

!

The safety system functional inspection of the high pressure core injection )

i (HPCI) system and non-interruptible instrument air system (NIAS) in the functional area of engineering consisted of design documentation review, i

system walkdowns, and discussions with the cognizant system and plant support

engineer The types of documents reviewed included appropriate portions of

chapters 6, 7, 8 and 9 of the updated final safety analysis report (UFSAR),

design basis document (DBD) for the system, design calculations, drawings, i deviation event reports (DERs), engineering design packages (EDPs), inservice

and surveillance test procedures, and operating procedure .

'

,

.

E.1.1 HPCI System Desian Review i

'

E.1. Mechanical Design Bases l The primary design and licensing bases documents for the HPCI system were the l applicable portions of Chapters 6, 7, 3 and 9 UFSAR, and the DBD (E41-00,

Revision A). Supporting documents reviewed included drawings, calculations,

-

modification packages, safety evaluations, vendor manuals and documents, DERs, procedures, and licensing document \

'

i 13

.

. _ . _ _ _ _ _ _ _ _ . .__ ._ _ _ _ __.._ _ _ . ___ _ _ _ _

i .

i l

'

, .The scope of the team's review included: verification of the appropriateness

' and correctness of the design assumptions, boundary conditions, and system

models; verification that the design bases were in accordance with the licensing bases and commitments and regulatory requirements; and verification

of the adequacy of the testing requirements.

~

The following paragraphs describe the discrepancies and errors in the

documents reviewed by the team

I Condensate Storaae Tank Water Reserved for HPCI

}

'

For a small break loss of cooiant accident (LOCA), the initial source of t makeup water to the reactor through the HPCI system is from the condensate

storage tank (CST), which is a non-safety-related, 600,000 gallon, multi-

purpose tan Statements in the UFSAR, the DBD, and the Technical

. Specifications, indicated that the CST was designed to assure that at i

least 150,000 gallons of water were reserved and available for use by the '

1 HPCI syste The HPCI pump was automatically switched from the CST to the ;

j suppression pool (torus) when the level in the CST reached 32 inches from '

! the bottom of the tank because of considerations such as vortexing effects i

and location of the level instrument nozzle.

$

l l The team performed a calculation considering the actual CST and standpipe dimensions and the switchover setpoint (32 inches above tank bottom) and l

noted that, contrary to the statements in the UFSAR, DBD, and requirements l in the Technical Specifications, there were only approximately 105,000

gallons of water reserved and available in the CST for the HPCI system.

'

The safety significance of this error was minimal because the suppression i pool (not the CST) was considered as the safety-related source in the

. accident analysis, and because during normal operation the CST level was l maintained well above the Technical Specification (TS 3.5.3.b.3) minimum j of 300,000 gallons for use by the HPCI and core spray systems. The

d licensee issued DER 96-1087 to address this concern.

! HPCI Pumo Suction Low Pressure Trio / Alarm l

4

'

Sections 4.1.3 and 4.1.6 of the HPCI system DBD stated that low pump suction pressure indicated cavitation and lack of cooling that could cause

, pump damage. Annunciator Response Procedures 2D55, Revision 5; 2089,

Revision 4; and 2093, Revision 5, also described this function for an

!

I alarm in the control room. The trip / alarm setpoint was 15 inches Hg vacuum. The trip / alarm function was always present regardless of whether j the system was in the test mode or the operational mode.

j' Using data from design calculation DC-1270, Revision A, the team estimated that the pump cavitation would commence well before the trip / alarm t setpoint is reached. Therefore, this setpoint was not appropriate. The i team nas also concerned that a spurious actuation of this trip would shut i

down the HPCI pump during a post-accident mode of operation. The licensee issued DER 96-1191 to review the setpoint and the need for this trip

function. (Inspector Follow-up Item 50-314/96-201-04).

14

.

i n -

. . - - . - .-

__ _ __ _ _ _ _

,

l

,

' Identification of HPCI Check Valve Safety Function The team reviewed the testing of check valve E41-F045 in the HPCI pump torus suction line. The licensee considered this valve to have only one safety function, that is, to open to allow the HPCI pump to take suction from the torus. This conclusion was documented in an internal memo NE-PJ-

,

88-0592, dated September 23, 1988, that was the basis for determining that the valve was required to be included in the inservice testing program and that the open position was required to be tested. The team pointed out that this valve's primary safety function was to prevent CST draindown to the torus during periods when the HPCI pump was not operating after HPCI pump suction switchover to the torus. This valve, together with motor operated valve E41-F004, provided the redundancy required to meet the single failure criterion in the performance of this functio The licensee was able to show that although the valve's closing function was not tested, the valve was opened, inspected, and manually exercised through its entire range of operation at each refueling outage, which satisfied the ASME Code,Section XI requirement. The team had no further safety concerns with this issue. The licensee issued DER 96-1146 to address this issu '

b. Calculations

,

j The team reviewed five mechanical design calculations relating to the HPCI

'

system. All appeared to be correctly performed, with clearly identified purposes, assumptions, inputs, and references. However, design calculation

.

DC-1270, Revision A, which calculated the NPSH requirements for the ECCS pumps including the HPCI pump did not appear to account for the suction stainer

-

pressure losses, either in the clean or the partially plugged condition. The team considers that the failure to assess the impact of the suction pressure

,

~

losses on the HPCI pump NPSH was a weakness in the calculatio (Inspection Follow-up Item 50-341/96-201-05). System Modifications The team reviewed six modification packages associated with the HPCI syste One concern was identified regarding EDP-27042, Rev 0, " Operator Gearing

-

Change for MOV E4150F003." This modification changed the gear ratio in the HPCI steam supply outboard containment isolation motor operated valve (MOV) to provide more closing force in order to overcome the calculated resistanc In the preliminary evaluation screening performed for this modification, the licensee determined that since the valve's gears were not described in the UFSAR, no safety evaluation was required. However, the valve itself was described in numerous locations in the UFSAR, (e.g., Section 6.3.2.2.1, Figures 6.3-2 through 6.3-5, and Section 6.2). Its safety functions included opening to supply steam to the HPCI turbine for a small break LOCA and closing to effect prinary containment isolation. This modification could have affected either or both of these functions by changing the valve's operating

speed, the stress in its components, its ability to provide adequate

.

-

containment isolation, its ability to unseat on demand, and electrical demands on the motor and power supply. Some of these considerations were discussed in

.the modification documentatio The licensee indicated that the practice of not performing safety evaluations unless the specific item being modified was described in the UFSAR was generally used for all modifications. The team did not have any safety concerns with this particular modification, but was concerned that the-

' licensee's interpretation when generally applied had the potential to overlook safety issues. The. licensee issued DER 96-1144 to investigate the team's concer System Configuration l

The team performed walkdowns of selected accessible portions of the HPCI system. The material condition of the system appeared to be good, and no cases were noted where the system configuration deviated from design or licensing documents. The team noted several locations in the ECCS corner pump rooms where it appeared that seismic II/I concerns might exist. However, the licensee was able to show that in each case the proper criteria had been met and the configurations were acceptabl Conclusion

~ The team concluded that all mechanical functions of the HPCI pump were acceptable. Several concerns that do not affect safe operations of the pump were brought to the licensee's attention, including, potential drop of CST water level below minimum requirement; inappropriate pump trip set point could cause pump cavitation; and failure to account for pressure drop across suction strainers in flow calculations. The licensee issued DERs to address each ,

concer i l

E.1. Electrical Design Basis The team reviewed the safety related normal and emergency electrical supplies for the HPCI system, as described in the UFSAR, DBDs and applicable sections of the technical specification The design basis for the electrical portion of the HPCI' system was appropriate and was consistent in the reviewed 3 document J The team noted that the float and equalizing charge voltage ranges listed on page 30 of DC Electrical System DBD (R32-00, Revision 0) did not agree with the recommended values for these same parameters in Table 6 of vendor manual l VME11-1, Revision C. The licensee issued DER 96-1158 to correct this erro j Calculations The team reviewed eight calculations related to electrical systems and five electrical design instructions which provide the methodology for calculation ,

The team verified that the ratings for selected equipment in the HPCI system "

I i

- _ - . __ _ - - . . - - - . .- -

.

.

were appropriate on the basis of these calculations and other design basis I documents. With the following exceptions the calculations provided an '

adequate basis for sizing electrical components and for protective devices, permissives, and interlocks:

The team evaluated the following calculations: Fuse Coordination During the review of calculation DC-2913, the team noted the fault currents had not been calculated at the applicable downstream panels but only at the distribution panels 2PB2-5 and 2P82-6. The available fault currents at the buses as calculated in DC-0214 were 2700 amperes eac The team selected circuit 6 of panel 282-6 for review because it supplied safety-related and non safety-related loads. The team questioned whether ;

'

FRN-R-15 fuse at 2PB2-6 rated at 15 ampere and KLM-10 fuse rated at 10 ampere at panel Hil-P620 (HPCI turbine controls) located downstream would coordinate for a fault current of 2700 amps. A fault in any of the non safety-related loads in the circuit protected by a 10-ampere fuse could cause the loss of HPCI turbine control which has no redundancy. The licensee calculated the fault current of 620 amperes at panel Hil-P620 and contacted the vendor to verify whether the fuses would coordinate at the calculated fault currents. The vendor stated that it would not be possible to predict with any certainty whether the fuses would coordinat The licensee issued DER 96-1128 and agreed to take appropriate measures to verify the coordination of these fuse (Inspector Follow-up Item 50-341/96-201-06). Acceptance Criteria for Pickuo Voltace for Motor Operated Valve (M0V) Ooen Coil Contactors The acceptance criteria for pickup voltage for the contactor for the HPCI MOV E4150F059 was raised from 102 volts to 104 V on September 5, 1991, based on test results of maintenance procedure 35.306.008, Revision, 23, page 16. This change was approved and documented in calculation DC-5352, Revision A, in accordance with as-built notice (ABN) 13013-1, Revision, The calculation erroneously assumed that this valve opened at the end of the Division II battery discharge cycle when in fact it would open on the HPCI initiation signal at the beginning of the battery discharge cycl The voltage available at the "open-contactor" coil terminals at the beginning of the battery discharge cycle would be about 102.9 V as calculated by the licensee in response to the team's question, instead of 116.34V originally stated. The licensee reviewed the maintenance history of this valve to verify whether any changes were made to the pickup voltages subsequent to 199 In April 1994, maintenance procedure 35.306.008, Revision 29, was performed to test the pickup voltage of the

"open-contractor" coil of MOV E4150F059. At that time the test results showed that the "as found" and "as left" values of pickup voltage were 94.5 V and 90 V, respectively. The licensee issued DER 96-1129 to document this issue. The licensee agreed te verify the pickup voltage of the "open-contactor" in question during the next outage. Calculation DC-

_ _ _ __ __ __ ._ _ _ . _ _ . _ _ _ _ _ . . . _ _ _ _ _

.

h l 1

'

5352 and the overall acceptance criteria for the pickup voltage for the

<

! open coil of valve E410F059 were incorrec This is identified as a i

'

, Deficiency 50-341/96-201-02).

}

j System Modifications

,

'

\

The team reviewed fifteen electrical design changes that were applicable to the HPCI system. In most cases, the modifications had only minor impacts on the HPCI system electrical design. The safety evaluations, where required,

<

were performed and were adequat Seven of the design changes dealt with the modification of the pickup voltage for HPCI system MOV contactors. During testing of the pickup voltages in !

accordance with maintenance procedure 35.306.008 the licensee found that each of them was out of tolerance with the acceptance criteria listed on page 8 of that procedure. Engineering evaluated the condition and approved a one-time ;

deviation if the modified pickup voltage was less than the available voltage at the contactor's terminals per calculation DC-5352. For each one-time deviation, a ABN (as-built notice) was initiated to change the contactor's pickup voltage. For a second deviation, the contactor would be replace Calculation DC-5352 determined the available voltages at the terminals of HPCI MOV "open-contactors." The operability of each HPCI MOV was based on its available voltage being greater than its pickup voltage. Due to environmental conditions and state of cleanliness, the pickup voltages of these contactors began to increase over a period of time. The team was concerned that the MOVs might be inoperable if, during the maintenance interval, the pickup voltages increased above the acceptance criteria due to component degradatio Presently the calculation or procedure did not require a specified margin between the calculated available voltage and the pickup voltage acceptance criteria to allow for increase in pickup voltage with time during the maintenance interval. The licensee agreed to modify the calculation to provide a reasonable nrgin between the calculated allowable value and the test acceptance criteri ' System Configuration The team reviewed the schematics and logic drawings for HPCI and verified that they were consistent with the design basis and surveillance instruction During the walkdown, the team also verified that the power sources for all HPCI MOVs and pumps were consistent with the design drawings and the actual nameplates on the specific cubicles of the respective DC motor control centers, and that adequate separation was provided for wiring from HPCI inverters and ADS inverter Conclusion The team concluded that in general calculations were conservative, reasonable and appropriate. However, an incorrect acceptance criteria for the pickup voltage for an NOV was identified a deficienc . _ . . . - - - - - - . __ -- - -- . . . - . _ . - .

,

-

.

E.1. '

Instrumentation and Controls (I&C)

!

To evaluate the functional capability of the HPCI instrumentation and controls

design, the team reviewed system functions, such as HPCI initiation, flow i

control, turbine trip, HPCI isolation, suction transfer, draining of

! condensate, and HPCI test isolation. The team also selected the

) instrumentation that support these functions.

.

The team reviewed the UFSAR, the Technical Specifications, the DBD, HPCI

,

Functional Operating Sketches and Flow Diagrams, instrument accuracy

,

calculatior.;, logic diagrams, schematic diagrams, selected wiring diagrams, selected tubing irometric diagrams, and selected environmental qualification

(EQ) documents. Ir addition, the team reviewed selected test / calibration procedures and operating procedures for consistency with design requirements and system configu"ation. The team also reviewed a sample of HPCI

,

modifications and )erformed a selective walkdown of the HPCI instrumentation.

i Design Basis

The team identified and reviewed the following design basis scenarios for which each selected instrumentation was required to perform a safety function: HPCI Turbine Hiah Exhaust Pressure Isolation Instrumentation The HPCI turbine exhaust pressure isolation instrumentation consisted of redundant pressure instrument channels that sense pressure between two rupture disks and provide an input to HPCI isolation when 10 psig pressure is reached. The rupture disk burst pressures were 175 plus or minus 10 psig, and the rupture disks discharge into the torus room adjacent to the HPCI roo The team questioned whether the pressure instrumentation was capable of sensing a pressure transient / shock wave of a short duration resulting from the inboard disk rupture followed immediately by the failure of the outboard rupture disk. Neither the licensee nor its vendor had performed an analysis or tent that would assure that the magnitude and duration of this transient world be sufficient to seal-in the HPCI isolation signa Two pressure channels must actuate concurrently (series contacts) to achieve HPCI isolation. A pressure sensing line was vented to the torus room through a restriction orifice to relieve pressure between the disks due to thermal effects (this venting feature and its basis were not described in the DBD).

In response to the team's question, the licensee and its vendor prepared an analyses during the inspection to show that the pressure transient between the rupture disks would be detected by the instruments and the HPCI isolatio signal would be sealed-in. The team did not review the analysis. Because the margin between the maximum allowable instrument channel response time and minimum pressure transient time reported by the informal calculations was small (about 1/3 second), the team noted that the licensee should identify the uncertainty margin in the calculations,

._ . _ _ _ _ _ _ _ - _ . . _ _ _ _ . _ _ . _ . _ _ - _ . . . _ _ _._ __

i

!-

!

'

'

including sensitivity to initial conditions, as-built instrument i

line/ piping configuration, and other effects. The licensee issued DER 96-1156 to address this issu . Environmental Qualification of Sunoression Pool Level Instruments The team identified from the instrument accuracy calculation (DC-4534,

" Torus Water Level Measurements and Calibration Measurements," Revision E)

.and an (EQ) design calculation (DC-3224, Attachment 43, " Equipment Qualification Review," NUREG.0588, Category 2C) that the licensee had assumed that the suppression pool level instrumentation channels were not !

required to perform during a loss of coolant accident a (LOCA). However, l these instruments are required to actuate on high suppression pool level to transfer HPCI suction to the suppression pool anti control level in the suppression pool. This function could be required during an accident condition. Therefore, the more severe LOCA environment should have been assumed for the qualification of the instrument and for evaluating accident environmental effects on instrument accurac In response to the team's concern, the licensee stated that the vendor data indicated that the instruments and capillary connections were capable of beino qualified for the more severe environmental conditions and that there was sufficient margin in the existing setpoint calculation to acconnodate the accident environmental effects on instrument channel accuracy. On that basis the team did not have a safety concern regarding the classification of these instruments. The licensee issued DER 96-1122 to investigate upgrading the instrument classificatio . Physical Seoaration between Divisions I and II at Relav Contacts The team identified an issue involving the design basis and acceptability of Division I and Division II instrumentation wiring landed on terminals -

of relays E41K205B and E41K205D in HPCI/RCIC CST low level channels. The UFSAR Figure 3.12-2 and NED0-10139, " Compliance of Protection Systems to Industry Criteria: General Electric BWR NSSS," June 1970 generally allowed this configuration, but the team's concern was that the site-specific maximum credible fault conditions might not have been identified and evaluated to support the adequacy of this practice of contact-to-contact separation between divisions. In response to the team's concern, the licensee issued DER 96-1147. (Inspector Follow-up Item 50-341/96-201-07). Calculations The team reviewed the assumptions, methodology, selected design inputs, and results of instrument accuracy calculations for the sampled HPCI instrument channels. The calculations utilized the methodology documented in topical report NEDC-31336, " General Electric Instrument Setpoint Methodology," October 1986. The team did not identify any concerns with the reviewed calculations except fo minor errors described in 1Se following par 7raph One of the assumptions in calculation DC-4549, "HPCI Turbine Speed Control Instrumentation," stated that for the HPCI suction pressure instrumentation,

_

_

_ ___ .

'

l

l

&

radiation effect did not apply because the instruments were not required to perform a safety function during an accident. However, this channel was one of several that can trip the HPCI turbine, and therefore, it must be assured that accident environmental conditions would not cause a spurious trip of the HPCI pump and -defeat emergency core cooling system (ECCS) function _

In response to the team's concern, the licensee stated that the intent was to state that instrument error contribution due to radiation effects was negligible. The licensee also identified that this assumption was incorrectly-stated in other accuracy calculations. The licensee issued DER 96-1052 to follow up revisions to the affected calculation The team reviewed letter NE-PJ-87-0529 which established the harsh environment effects on instrument accuracy for applicability to DC-4549, and concluded that post-accident radiation effects were negligible and the overall results and conclusions of DC-4549 were not affecte The team's review of selected surveillance procedures did not identify any inconsistencies with the design calculation System Modification From the list of modification to the HPCI system provided by the licensee, the ,

team concluded that there had not been extensive modifications to safety i related HPCI instrumentation after the operating license had been issued. The team selected six' modification packages and reviewed . safety evaluations, !

.

supporting analyses, and modification impact evaluations. The team also

!

reviewed selected design documents to confirm they had been correctly updated j following implementation of the modifications. The team did not identify any problems in the modifications reviewe i

' System Configuration The team performed a selective walkdown of accessible portions of the HPCI instrumentation and control system. The team inspected sloping of selected instrument impulse lines, freeze protection and surveillance of condensate storage tank level instruments, and shielding and grounding practices for selected HPCI instrumentatio During the walkdown, the team questioned the licensee's practice of bundling together the input and output wiring of safety /non-safety isolation device This configuration was observed in several areas of internal wiring within cabinet H11-P612. The team's concern was that the isolation device might be bypassed by the coupling afforded by the bundling together of input and output wirin The licensee issued DER 96-1102 for preparing a basis for the acceptability of '

this configuration. The team's discussion of this issue with the licensee indicated the following: all the output (non-safety) wires were current loop or low voltage-(less than 10 Vdc) instrumentation & control circuits; the licensee's separation criteria /UFSAR hasis did not require separation of safety related and non-safety related circuits within cabinets, but did not permit association of non-safety related cabling with more than one safety-

__ __ ___ __ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ . _ _ _ _ . _ _

,

l.

i .

L related division; the isolators were qualified for isolation of maximum

{ credible fault (MCF) currents and voltages, and the MCF would not bypass the j isolator because of the circuit and cable characteristics; output cabling had electrostatic shielding; bundling practice was limited to wiring withi ,

.

!

cabinets and would be limited to about eight feet maximum; and the observed ;

wiring practice reflected original construction and was not permitted for '

. modifications. On the foregoing basis, the team concluded that MCF coupling

! would likely be preclude i

- Conclusion ,

l The team concluded that the HPCI design basis for instrumentation and control was consistent with commitments and was adequately supported by analysi However, a calculation had to be generated to verify HPCI isolation following exhaust steam line rupture, and contact to contact separation criteria needs to be verifie The team concluded that the material condition of the HPCI instrumentation appeared acceptable and no configuration discrepancies were identifie E.1.1. Conclusion for HPCI System On the basis of a review of the design basis documents, portions of the UFSAR, and selected calculations and modifications, and a walkdown of the system, the team concluded that the HPCI system is capable of performing its intended safety' functions. Except for the discrepancies discussed in this report, the HPCI system' design basis and implementing documentation were consistent and acceptabl E.1.2 Non-interruptible Air System (NIAS) Desian Review E.1. Mechanical Design Bases The team reviewed the UFSAR and the DBD (P50-02,03, Revision A) which are the primary licensing and design basis documents for the NIAS. Supporting  !

documents that were also reviewed included drawings, calculations, modification packages, DERs, and procedure The scope of the team's review included: verification of the appropriateness and correctness of the design assumptions, boundary conditions, and system models; verification that the design bases was in accordance with the licensing bases and commitments and regulatory requirements; and verification of the adequacy of the testing requirement No design basis or licensing basis discrepancies in the NIAS were noted by the team. However, in reviewing the system d? sign inside the drywell to provide nitrogen for operation of the main steam isolation valves (MSIVs) and automatic depressurization system (ADS) valves, the team identified a concern regarding the protection of the MSIVs against high energy line breaks. The licensee reviewed the potential for adverse effects due to jet impingement on

.. .. .. . -.

l

-

the MSIVs and concluded that one MSIV operator could potentially be effected

,

-

by jet impingement from a feedwater line break. The licensee also discovered ;

that the previously considered steam line breaks at the MSIVs had not

- accounted for all of the possible jet configurations that could result, and the potential did exist for additional impacts on the valve operators. The licensee issued a DER 96-1116 to review this issu (Inspector Follow-up Item 50-341/96-201-08). Calculations

The team reviewed six design calculations relating to the NIAS. All but one l appeared to ha correctly performed, with clearly defined purposes,

,. assumptions, inputs, and references.

'

Calculation DC-4931, Rev B, was intended to demonstrate, that the NIAS leakage and air usage under accident conditions was less than the 100 cfm capacity of d

the NIAS compressor However, this calculation did not consider the back-

leakage through valves P50-F440 and P50-F441, which were the isolation valves between the non-safety-related station air system and Division I and Division

'

11 safety-related NIAS, respectively. It also did not consider the leakage through the leakoff point created when modification EDP-10531, Rev A, installed a drilled cap at the NIAS compressors' aftercooler drains, through

1. which there would be continuous bleedoff whenever the drain trap was bypassed for maintenance. This is further discussed in Section E.3.2 of this repor System Modifications

'

The team reviewed three modification packages associated with the NIAS syste No significant discrepancies were discovered in any of these except, as discussed above, the failure to revise the calculation concerning system leakage when modification EDP-10531 was implemente System Configuration g The team walked down portions of the NIAS which consisted of the air compressors and major piping and valves. The material condition of the system appeared to be good. No cases were observed where the system configuration deviated from design or licensing document E.1. Electrical Design Basis The team reviewed the normal and emergency electrical supplies as described in the UFSAR, DBDs and the technical specifications for NIAS. The design basis for the electrical portions of the NIAS was appropriate and was consistent in the reviewed document '

!

- Calculations i

The team reviewed a non safety-related calculation that sized the feeders to the new station air compressors. This calculation was a part of design modification EDP-26849, Revision The assumptions and methodology in the calculation were adequat System Modifications The only design modification reviewed by the team in the electrical area was ;

EDP-26849, Revision 0, that upgraded the non safety-related station air t compressors including the calculation discussed above. The control air system had no other electrical design changes of any significanc System Configuration The team reviewed the applicable drawings covering the power circuitry to the '

control air system compressors, and verified the independence between the divisional feeders to the individual electrical loads. The team also verified that there was no cross over between divisions by reviewing cabling in the respective tray containing these feeders utilizing the computerized cable routing system. Additionally, the team confirmed that the permissives and interlocks for the control air compressors and isolation valves P50-F402, F403, F440, and F441 were installed and tested in accordance with the design basis, and that the control air compressors were controlled by the emergency diesel generator load sequence E.1. Instrumentation and Controls To evaluate the functional capability of the NIAS instrumentation and controls design, the team selected several functions for review, such as starting of air compressors, isolation of NIAS, and the loading of air compressor Design Basi::

The team reviewed the NIAS des!gn basis documentation, the applicable chapters of the UFSAR, functional operating sketches, schematic diagrams, and logic diagrams. The team did not have any concerns regarding the design basis in the instrumentation and control are Calculations The licensee had not prepared formal accuracy calculations for the NIAS pressure instrument channels because these channel setpoints had not been identified in the technical specifications. However, the licensee indicated that the setpoints were formally established from the NIAS design basis documents (DBD) and supporting mechanical analyses, and setpoint tolerances were controlled to vendor supplied tolerance values. The setpoints and tolerances were established and maintaincd under the licensee's design control and surveillance programs, and were contained in the Central Component Database. The pressure switches were located in mild environments, and therefore, no accident environmental effects were applicabl . . . -

.. _ . .- .

.

.

On the foregoing basis, the team considered the licensee's establishment and control of safety-related NIAS pressure setpoints acceptabl System Modification From the list of NIAS modifications provided by the licensee, the team concluded that there had been very few modifications to safety-related NIAS instrumentation after the operating license had been issued. The team reviewed PDC 8345, " Replacement of Agastat Relay," which involved a replacement-in-kind of control relays to accommodate service life specifications. The modification applied to several systems. The team did not identify any problems with this modificatio System Configuration The team reviewed logic and schematic diagrams for the circuits sampled and found them consistent with the DBD and UFSAR commitments. The team performed a selective walkdown of the NIAS instrumentation, including confirmation that the safety-related pressure switch root valves were either locked open as shown on the NIAS functional operating sketch or were identified in the governing administrative control procedure. The team did not identify any problem E.1. NIAS Conclusion

~

The team concluded that the NIAS is capable of performing its safety functions. In general, the system design basis and implementing documentation were consistent and acceptable. As discussed further in Section E.3.2 of this report, the team noted that acceptance criteria specified in test procedures were not appropriately considered or were inconsistent with assumptions in system capacity calculations. However, the actual test results were within the capacity of the system, and therefore, did not adversely affect the syste E.3 Procedures and Documentation E.3.1 HPCI System The team reviewed 37 annunciator response procedures and 7 surveillance test procedures associated with the HPCI system to determine if they were consistent with the system licensing and design bases. These procedures were generally well written and technically correct, and no significant discrepancies were discovered except in one procedur The HPCI flow test conditions for the low end of the HPCI turbine supply steam pressure range specified in the various plant documents were inconsisten Surveillance Procedure 24.202.02, Revision 25, specified a reactor pressure of 165 psig, TS 4.5.1.c.2.a stated that the HPCI system be tested when steam was supplied to the turbine at 165 psig plus 50 psig or minus O psig, and the Mode D table of UFSAR Figure 6.3-1 showed that the low pressure end of the HPCI system operating range as 165 psia (150 psig). Taking into consideration the maximum pressure drop of 15 psi in the steam supply piping and the torus

_.__ . _ .. _ _ _

t

-

.

l

i

' -

pressure during accident conditions, the differential steam pressure across l - the HPCI turbine will be about 112 psi with the HPCI pump delivering 5000 gpm.

). The licensee provided documentation that shond that the HPCI system had been

!. tested during the initial startup with a turbine inlet pressure as low as 135 i psig. However, this differential steam pressure was 'still higher than the estimated 112 psi across the HPCI turbine during accident conditions.

i i Not simulating the lowest estimated differential pressure conditions across i the HPCI turbine during testing is not a significant concern because the core

! spray and RHR systems are available to 4Dver flow to the reactor vessel at

approximately 300 psig, well before the team pressure to the HPCI turbine j reaches the low end of the turbine's operating range. However, to resolve i

'

this issue either an appropriately justified revision of the required HPCI operational steam pressure range or development of a method to extrapolate the HPCI pump test results to verify the pump's performance at the currently specified low steam pressure condition would be required. The licensee issued

! DER 96-1155 to review this issu (Inspection Follow-up Item 50-341/96-201-

{ 09).

E.3.2 Non-interruptible Control Air System (NIAS)

"

The. team reviewed seven surveillance test procedures associated with the NIAS to determine if they were consistent with the design and licensing base Although these procedures were found to be generally well written, the team noted the following instances where the procedures were technically inadequate: Testina of NIAS Comoressors The NIAS. compressors are safety-related components which are susceptible to degradation over time. During the pre-operational test program the compressors were tested and their capacities were determined to be marginally above the design values. They have not been tested since then to verify their capacity. The licensee initiated DER 96-1057 to address this concer . NIAS-to-Station Air Isolation Test Acceptance Criteria Air operated valves P50-F440 and P50-F441 provided the isolation between the safety-related NIAS system and the non-safety-related station air system. Surveillance Procedure 24.129.04, Revision 26, " Control Air Isolation Integrity," tested the leakage of these valves, and specified leakage rate acceptance criteria as 25 scfm and 20 scfm, respectivel Design' calculation DC-4931, Revision B, "Non-Interruptible Control Air System (NIAS) Calculations," demonstrated that the NIAS system leakage / usage under accident conditions was less than the NIAS compressor capacity of 100 standard cubic' feet per minute (scfm). The calculated air usage / leakages during accident conditions for Divisions I and II were 70.882 scfm and 86.681 scfm, respectively. For the condition when both divisions are cross-tied and only Division I compressor is operational the calculated demand was 87.223 scfm, and when only Division 11 compressor is

.

___ _ __ _ . _ . . _ . - . _ _ _ _.._ _._.__ _ _ _ _ _ _ ___ _ _

1

l' operational the calculated demand _was 93.294 scfm. The calculation did

not include leakage through valves P50-F440 and P50-F441 and the leakage j through the drilled caps installed in the acceptance criteria for the

after-cooler drains. If the isolation valve test acceptance criteria i

leakages are added to the appropriate divisions, the total system demand j would exceed the capacity of the compressor. The team considered the

!

licensee's failure to establish appropriate surveillance acceptance t

criteria as another example of Deficiency 50-341/96-201-02.

j During the inspection, the licensee performed an informal air i leakage / usage test on the Division I portion of the NIAS. This test showed that the usage / leakage rate was well within the compressor i

t capacity. Division II test was scheduled to be performed on the last day of the inspection. The licensee reviewed all of the previous test results l and operating conditions when the two divisions were cross-tied, and

determined that in no case had the actual leakage rate exceeded the compressor capacity. Therefore, the licensee concluded that the system 1 was never inoperable as a result of this procedure discrepancy. The team

{

~

reviewed the licensee's evaluation and the actual leakage rates observed in previous tests, and agreed with the licensee's conclusio . Auto-D u ssurization System (ADS) Accumulator Leakaae Testina and Desian Basis 1 slation

,

Calculation DC-0469, Revision C, 9/21/84, " Essential Accumulators for !

Class I Valves (SRVs)," determined the ability of the automatic l

depressurization system's (ADS) safety-related nitrogen accumulators to l actuate the safety relief valves five times over a period of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> assuming a leakage rate of 0.002 scfm. UFSAR Section 5.2.2.2.3 stated )'

that the normal leakage from the pneumatic system was so small (0.016 scfm) that it had no influence on the size of the accumulato Surveillance Procedure 43.137.002, Revision 21, "SRV Accumulator Check Valve Test," specified 2 scfh (0.033 scfm) as the acceptance criterion (approximately sixteen times the value assumed in the calculation) for the accumulator leakage. Therefore, the acceptance criteria was non-conservative with respect to the design basis, and potentially the ADS accumulator would not have been fully. capable of maintaining its 36-hour capacity if the leakage was. equal to the acceptance criteria. When the !

acceptance criteria was substituted in the calculation, the accumulator '

capacity would be adequate for a period of 33.81 hours9.375e-4 days <br />0.0225 hours <br />1.339286e-4 weeks <br />3.08205e-5 months <br />. The calculation also contained the non-conservative assumption that the event started wit the accumulator at 100 psig. When the accumulator pressure was reduced to 75 psig (the low pressure alarm setpoint minus 5 psig for error), the calculated capacity would be adequate for only 16.46 hours5.324074e-4 days <br />0.0128 hours <br />7.60582e-5 weeks <br />1.7503e-5 months <br />. However, the actual worst leakage from the last test was 0.0195 scfe, and this value did not have an adverse impact on the accumulator function. DER 96-1027 was initiated.by the licensee to address the discrepancies in the acceptance criteria and the calculation. The team considered the non- i conservative valve leakage acceptance criteria another example of ;

Deficiency 50-341/96-201-0 ,

L

. .

l . _ _ . _ . . _ . . ___ __

_ . _ . _ _ _ . . . _ _ _ . . . _ _ _ _ _ _ . _ . _ . _ _ . _ _ _ . _ _ . _ _

.

.

T i

-

Conclusion.

!

' Non-conservative leakage rate acceptance criteria in surveillance procedures was identified by the team as a deficiency. The team verified that in each

i case the actual leak rates were well with in a capacity of the system to meet demands. Immediate corrective actions were initiated by the licensee.

! E.5 Quality Assurance and Corrective Action

.

j E.5.1 Problem Identification

!

'

Prior to 1995 the DER process had been used mainly to identify significant l events or when other avenues for solving problems were not successful. In

! April 1995, the licensee expanded the DER process to lower the threshold to allow trending and tracking of minor problems.

!

Subsequently, there were a few examples where the engineering staff did not identify problems or initiate DERs promptly. For example, the clogging of the .

drain line from the combined residual heat removal service water (RHRSW) l Division I return header to the cooling towers, and that the combustion turbine generator CTG 11-1 test procedure did not ensure that the battery was fully charged at the end of the test. Although system engineers had noted excessive condensate system piping vibrations, they did not write a DER for more than 10 days until questioned by NRC. During this inspection, the team identified a potentially generic problem of not tracking assumptions used in calculations that need to be factored into plant documents such as-surveillance test procedures (See Section E.3.2).

.

Because the DER process was not as effective as expected in identifying minor I

'

problems, the licensee management performed an assessment of the DER process

,

and initiated actions to get the line organizations involved in the process, promote self-identification, and improve prioritizatio The number of DERs issued by the technical groups and the DERs that were assigned to them for resolution during January through September 1996 were significantly more than that in 1995. Although the system engineers continued to use work requests to get routine equipment problems corrected, they used the DER process to document repeat problems or problems that were unfamiliar or problems that potentially affected the system performanc Nuclear Quality Assurance (NQA) performed several audits of engineering activities, such as design control program, inservice testing (IST) program, document control and records management, and safety evaluations. In addition, NQA also performed surveillance of system engineering walkdown, CTG 11-1 modification construction, hydrogen water chemistry modification, and design change acceptance tests. NQA issued DERs for conditions adverse to quality and the audits identified good observations and recommendation i Comprehensive Integrated Technical Assessment (CITA) of engineering was a significant NQA activity that was perfanned in February 1996, and this audit provided good findings and specific recommendation It identified areas for-improvement, such as prioritization of engineering work activities by consensus between engineering and operations instead of primarily by

-. . . -. - - -.- .. -

- --

_ _ _ _ _ . _ _ _ .

. - _ _ .._. _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _. . -

'.

,

a

! .

'

operations, improving the level of detail in Conduct Manuals to provide sufficient information, and ensuring that personnel make conservative

decisions in preliminary evaluations to determine whether safety evaluations

are needed.

Plant support engineering performed self evaluations and self assessments.

Self evaluations consisted of self critiques, employee field observations (supervisory observation and critique of employee's work as the work was being performed) and EDP revision cause tracking. Self assessments were performed

on topics, such as procedure adherence, EDPs implemented during the last

! outage (RF04), fire detection system review, and maintenance rule program.

! The team reviewed some of the self assessments and concluded that the assessments were good and contained useful recommendations. The team verified i

that the recommendations were being tracked, though not in a common tracking system. System engineering performed employee field observations and j participated in system outage critiques.

!

,

The independent safety engineering group (ISEG) issued periodic status reports and performed assessments, such as evaluation of position indication probe (PIP) modification, Level 1 DERs open for more than 180 days, and refueling j outage plan review. The team noteo that the ISEG review of the PIP i

a modification was thorough and contained good recommendations,

!

The team concluded that problem identification by engineering has been

adequate. The DER process is well understood and is widely used by engineering. Although a large number of assessments have been performed, most

of them were performed in response to identified problems and not as a part of i

planned and proactive approach to assess engineering activities and programs !

i

,

to prevent problems.

!

.

E. Problem Resolution i

i In the area of problem resolution the performance of engineering had not been t

fully satisfactory. Control rod position indication problems continued after

.

modifications were performed during RF04. The licensee issued DERs 96-0110,

! 96-1220, and 96-0365 to document equipment freezing problems that occurred

,

last winter. The team questioned the licensee about site-wide actions taken

! to prevent similar problems next winter. In response to the concern the

licensee formed a task group to identify and resolve potential freezing j problems.

i Several modifications installed during RF04_did not function as expected. The i

' licensee reviewed the causes for six modifications in the instrumentation and control (I&C) area that experienced many problems, and made four

,

recommendations. One of the recommendations was to identify "high-risk"

modifications and require additional supervisory reviews. The team noted that

,

for RF05, the licensee had identified "high-risk" EDPs and had performed or

planned the required additional reviews. The team considered this approach i appropriate. The effectiveness of these actions would be determined after the RF05 outage,

1

'

i

. __ -

.

.

..

.

'

!

.

!

.

l

?

The team reviewed root cause analyses from samples of Level i OERs. Although the root cause evaluations reviewed by the team appeared to be reasonable, it was not evident that the evaluator had considered all the causal factors because they were not documented.

I In December 1995, the engineering backlog reduction group was tasked to

resolve 720 open issues such as engineering design packages (EDPs), DERs,

!

-

design calculations, as-built notices, and technical service requests by December 1996. The team reviewed the progress of backlog reduction and

concluded that, on the basis of the progress made by the group, the project j would be completed before the end of this year. The licensee has quantified a the backlog of work-in-progress and has developed schedules, goals and i

performance measures to manage the reduction of this backlog.

l The team concluded that problem resolution by engineering has the potential to

improve because of the many actions taken by the licensee. The improvements

,

in the DER process, additional reviews of "high-risk" EDPs, initiatives to j improve engineering, .and efforts to reduce backlog should improve the j effectiveness of engineering support to plant operations.

'. E.6 -UFSAR and DBD Review

The team reviewed the UFSAR and the DB0s for both the HPCI and NIAS system ,

1 No errors were discovered in the NIAS documents other than those discussed in '

!

Section E.3.2. However, numerous errors and inconsistencies were discovered i in the HPCI documents as detailed below:

[ E. HPCI System UFSAR Errors

. Figure 6.3-2 incorrectly showed the HPCI turbine exhaust line high

, pressure trip as 150 psig increasing. The actual value was 140 psig in l accordance with GE-Design Specification Data Sheet 22A1362 AR, Sheet 10.

i Table 6.3-6 incorrectly showed at two places the vessel pressure for HPCI

,

system as 1,135 psia. The correct value was 1,146 psig (1,161 psia) for l

the power unrated condition.

! Figure 6.3-1 contained tables that depicted the various design operating

. conditions for the HPCI system. These tables showed the maximum reactor

.

pressure as 1,135 psia. The correct powe.r update value according to the j licensee was 1,161 psia.

! Sections 6.3.2.2.3, 6.3.2.2.4, and 6.3.2.2.4.1 stated that the injection j valve permissive was less than 500 psig. The correct value for both the

'

core spray and RHR systems, as shown in Table 6.3-6, was 350 psig.

i t' Section 6.3.2.6 contained a statement that the CST was designed to retain

a minimum reserve of 150,000 gal- for use by the HPCI or RCIC system. As

discussed in Section E.1.1.1 of this report, the reserve available for use i was only approximately 105,000 gallon #

)

!

. 30

a

a

, - . . - . - --

_ - . . .-_ . .. . - . . - - _- . _ . - ..

.

a

. Section 6.3.2.14 contained a statement that the low CST level switchover point for HPCI suction to the torus was at 2 feet 3 inches (27 inches)

above the bottom of the tank. The licensee stated that the correct

,

switchover point was 32 inche Sections 9.2.6.1 and 9.2.6.2 and Figure 9.2-10 also contained conflicting information regarding the CST level at which auto transfer occurs.

" l UFSAR 7.4.1.1.3.8 stated that the cabinet for the CST level transmitters were locked, but during the walkdown the team did not find any lock on the i

'

cabinet or on the gate in the fence surrounding the CST. The locks had apparently been removed as a part of a security department'c effort to

.

minimize the number of lock '

j UFSAR 7.4.1.1.3.8 stated that setpoint for the space heater inside the I

level instrument cabinet was 80 degrees F while the actual setpoint was 50 degrees F. This section of the UFSAR stated that the space heater capacity was 100 watts while the space heater rating of 1000 watts was

shown on drawing SI721-2522-1, Revision l

UfSAR Table 6.3-6 showed the setpoint values for the RPV level and high drywell pressure channels used to initiate HPCI as 91.2 inches above top of active fuel (TAF) and 2.0 psig, respectivel ,

, .

However, UFSAR figure '

,

7.3-12, Sheet 3, the DBD, and the TS specify these values as 110.8 inches above TAF and 1.68 psig, respectivel UFSAR Sections 7.3.1.1 and 7.1.2.1.3 and the DBD cited IEEE Std 279-1971 as the design basis for the HPCI instrumentation and controls. However, UFSAR Figure 7.3-2, Note 11 stated that the HPCI system shall be designed

.

to IEEE Std 279-1971 insofar as practicabl UFSAR Fig. 6.3.2.2.1 contained an incomplete description of HPCI trip signals and was not consistent with UFSAR section 7.3.1.2. . UFSAR Figures 6.3-2, -3, -4, -5 (HPCI mode diagrams) showed incorrect tag numbers for high drywell pressure channels used to initiate HPCI.

4 Setpoint in Figure 6.3-3 for CST / suppression pool suction transfer was incorrectly listed as 5" above norma Section 8.3.2.2.1 stated that there were two center-tapped 260/130 Vdc battery and each battery had its own charger. This implied that each 260 Vdc battery had its own charger. Actually each 130 Vdc battery had its own charge Section 8.3.2.1.1 indicated actual setpoints for battery high voltage

trip, high voltage alarm, and' low voltage alarm. No tolerance ranges are given or no statement is made to indicate that these are nominal value ; Table 8.3-15 showed feeds to ADS Logic A & B circuits from the DC distribution panels. The loads were not labeled to indicate the i

respective logic circuit and power sourc ^

s

. _ __ ___ _ _ _ _ . _. _ - _ - _ _ _ . _ _ . ._._..- _ - _

'

i e

'I

.

j E. HPCI System DBD Errors The maximum normal operating speed of the HPCI turbine is 4,100 rpm.

Section 4.2.1.1, stated that the overspeed trip is required to operate at i

i not greater than 122% of this value, or 5,002 rpm. It also stated that the current overspeed trip of 5,000 rpm i 2% meets this criteria. As

,

written, this last statement is not cor:ect; 5,000 rpm + 2% (100 rpm) is 5,100; this exceeds the criteria by 98 rp Section 4.1.2, Item 3, contained a statement'that the available

,

submergence in the CST was .a minimum of l.8 feet (approximately 22 inches). However, Section 4.1.2, Item 6 stated that the actual level at j which the switchover of the HPCI pump suction occurred was 32 inches.

$ c '. The licensee stated that after the power update, the correct design basis l operating pressure range for the HPCI system was 1,161 psia to 165 psia in

the reactor vessel. At numerous locations in the DBD the vessel pressure e and the corresponding pressure at the inlet to the HPCI turbine are

}

.

incorrectly stated.

T

' Page 3 contained a statement that the LPCI and core spray system were designed to operate "at or below 500 psig." The reactor vessel injection i valves do not receive a permissive to open until the reactor pressure

falls below 350 psig. Page 15 contained a similar incorrect statement.

i i In Section 4.1.6, Page 32, incorrectij identified RPV Level 1 as a LOCA signal.

-

E. Conclusions

! The team identified numerous discrepancies in the UFSAR chapters relating to i the HPCI system and in the system design documents. The licensee issued DERs 1 96-0382, 96-1008, 96-1038, 96-1039, 96-1049, and 96-1087 to address the UFSAR j and DBD discrepancies. (Deficiency 50-341/96-201-03)

i Public Exit Meetina Summary f

l The inspectors presented the inspection results to members of licensee management at the conclusion of the inspection on September 24, 1996. The licensee acknowledged the findings presented.

,

, The inspectors asked the licensee whether any materials examined during the

inspection should be considered proprietary. No proprietary information was t

identified.

I i

i

!

!

.

1

.

,

-_ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ . _ . . _ _ _ . . _ . - . _ _

-

. . _ _ _ _ _ . _ . _ . . _ .

.

'

PARTIAL LIST OF EXIT MEETING ATTENDEES The Detroit Edison Company D.R. Gipson, Senior Vice President U.D. Romberg, Assistant Vice President, Engineering W. O'Connor, Jr., Manager Nuclear Assessment P. Fessler, Plant Manager J. Plona, Technical Manager W.A. Colonallo, Director, Safety Engineering P. Smith, Director, Nuclear Licensing U.S. Nuclear Reaulatory Commission P.S. Koltay, Team Leader -

D.P. Norkin, Section Chief, NRR M. Jordan, Branch Chief, Region III A. Vegel, Senior Resident Inspector C. O'Keefe, Resident Inspector

_ _ . . _ _ _ . . . _ _ _ . _ . _ _ . _ . . . . . _ _ _ . _ _ . . _ _ _ _ . . _ _ _ _ _ _ . . . . _ _ _ . .

_. .y

'

=

APPENDIX A i

. The team has characterized several findings as deficiencies. Deficiencies are the apparent failure of the licensee (1) to comply with a requirement or (2)

to satisfy a written commitment to conform to the provisions of applicable j: codes, standards, guides, or other ac'cepted industry practices that have not j been made legally binding requirements, i

Number Report Section Title l

Inspector Follow-up Items

. 96-201-01 S. Inadequate guidance for

,

classification of DERs.

!

l 96-201-02 S. Lack of guidance for classifying trend DERs.

l 96-201-03 S. Failure to identify and train root cause evaluators.

a

'

96-201-04 E.1. Improper setpoint for HPCI pump suction low pressure tri E.1. HPCI flow calculations failed to account for suction strainer

. pressure losse E.1. Verify coordination of fuse E.1. Verify relay contact separation requiremen E.1. Licensee to assess jet impingement on main steam isolation valve E. Evaluate low pressure test requirement for HPCI pum Deficiencies 96-201-01 S. Failure to follow QA manual requirements for writing DERs and escalating repetitive issue l A-1

___ _ _ . _ _ . ._ _ _

-

_ _ _ _ . . _ - . . . . _ . . _ _ _ _ _ . _ _ _ . . . _ _ . . _ . _ _ __ _ e

!

.

!

.

Deficiencies (Cont'd.) {

, 96-201-02 E.1. Incorrect acceptance criteria for

-  !

MOV contactor pickup voltag E. Failure to establish appropriate a'ir leakage acceptance criteria

,

for isolation valves.

I E. Failure to establish appropriate j air leakage acceptance criteria

for SRV accumulator check valve Correct identified UFSAR and design document discrepancie I

l I

A-2