IR 05000413/1987023
| ML20236L915 | |
| Person / Time | |
|---|---|
| Site: | Catawba  |
| Issue date: | 10/09/1987 |
| From: | Cooper T, Hawkins F, Hill W, Mellen L, William Orders, James Smith, Spraul J, Weiss S NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II), Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20236L881 | List: |
| References | |
| 50-413-87-23, 50-414-87-23, NUDOCS 8711110117 | |
| Download: ML20236L915 (25) | |
Text
{{#Wiki_filter:- _ _ _ _ - _ _ _ _. _ _ _ _ _ -. _ _ _ _ _ _ -. _ ,
' l -
- .
)
U.S. N'JCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION Report No.: 50-413/87-23, 50-414/87-23 l Docket.No.: 50-413, 50-414-License No.: NPF-35, NPF-52 Licensee: Duke Power Company 422 South Church Street Charlotte, NC 28242 Facility Name: Catawba Nuclear Static'n " Inspection at: Clcver,SC(Catawbasite) Inspection Dates: July 13-24, 1987 Inspectors: [ A M _. /. /0/f// / W. M. Hill, Jr.JSenior: Operations Engineer '(Date) NRR (Team Leader) ?fh.db /,Y.
/o///f f fT.A. Cooper,KeactorInspector '(DateJ / Region II 914 N /bb'I.
/&/f//7 h L. S. Mellen,41eactor Inspector / / (Date) Region II l 9?'. 24. d_ i,. /o/f/f' 7 ,, W. T. Orders,4cr.1or Resident Inspector (Date) Region II . W. M h.I. / dkk'I J. D. Smith, Opef4tions Engineer (Date) NRR N N 'h . /d/5' / [ J. G. Spraul, Q'tfality Operations Engineer ' / (Date) NRR Reviewed By: hk s 4d /b/9/37 F. ' awkins, Chief, Q~uality Operations Section '(Date) H NRR Approved By: Mb /o[9d7 . S. H. Weiss, Chief, Quality Assurance Branch /(Ddte') NRR 8711110117 871106 PDR ADOCK 05000413
Q PDR
. _ - - - -. - - - - -. - _ . 4' ' . This special, announced inspection was conducted to assess the effectiveness ' of the licensee's quality verification organizations in the identification.
l solution, and prevention of safety-significant problems and deficiencies.
It I included an assessment of quality verification functions of the Quality Assurance, Quality Control and line management organizations in the following aress: (1) plant operations, (2) plant modifications, and (3) plant i maintenance. The details and results of the inspection follow.
!
PLANT OPERATIONS l The inspectors evaluated the role and function of the licensee's quality , ,. verification organization in the day to day operation,.of the facility through -
direct observation of activities and reviews of documentation.
The I documentation reviewed included (1) problem identification reports, (2) ) reactor trips reports, (3). selected operational procedures, (4) and documented I reports of various personnel errors. Normal activities including control room j operations were also observed to evaluate the effectiveness of the Operations j and Quality Assurance organizations in identifying and resolving problems.
- ' A.
Problem Identification Reports During a review of Problem Identification Reports'(PIRs), the inspectors identified an apparent design deficiency of the Nuclear Service Water (RN) System. PIR 0-C87-0047 described an accident scenario which ! resulted in an operating condition that had not been analyzed in the Final Safety Analysis Report (FSAR).
The RN system as described in the FSAR provides ess'ential auxiliary , support functions to Engineered Safety Features of the station. The system is designed to supply cooling water to various heat loads in , both the safety and non-safety portion of each unit.
Provisions are made to ensure a continuous flow of cooling water to those systems and components necessary for plant safety during normal operation and under accident conditions. Sufficient redundancy of piping and , components is provided to ensure that cooling is maintained to i essential loads at all times.
. Two bodies of water serve as the ultimate heat sink for the components , cooled by the RN System. Lake Wylie is the normal source of nuclear service water. A single transport line conveys water from a Class 1 , seismically designed intake structure at the bottom of the lake to both ' the A and B pits of the Nuclear Service Water Pumphouse.
Isolation of each line is assured by two motor operated valves in series powered from separate power supplies.
Should Lake Wylie, the normal source of nuclear service water, be lost due to a seismic event in excess of the design of Wylie Dam, the Standby Nuclear Service Water Pond (SNSWP) contains sufficient water to bring the station safely)to cold shutdown following a single loss of coolant accident (LOCA. The SNSWP has an intake structure designed to Class 1 seismic requirements with two Class 1 redundant lines to transport water !- independently to each pit in the Nuclear Service Water Pumphouse that are each secured by a single motor-operated valve. Automatically upon loss of Lake Wylie or an Engineered Safety Features actuation, the Lake Wylie )
)
. _ _ ____-_ _ E- ' . ., - , I g
isolation valves are closed and the SNSWP valves to both "A" pit and "B" pit are opened. Each pit has been designed to provide the flow needed for a simultaneous unit LOCA and unit cooldown.
.
Nuclear Service Water pumps 1A and 2A take suction from the "A" pit and i discharge through strainers that join together to form the Channel A Supply line to the channel A components in both units. Nuclear Service Water pumps IB and 2B discharge through strainers that join together to form the Channel B supply line to Channel B components in both units.
The operation of any two pumps on either or both supply lines is sufficient to supply all cooling water requirements for startup, cooldown, refueling, and post-accident operation of both units.
As' described in the FSAR, the RN system design. basis includes the ability " to operate under a combination of a Safe Shutdown Earthquake (SSE), a LOCA on one unit, extended shutdown of the other unit, loss of downstream dam, and a prolonged drought in hot weather. The RN system must also be able to withstand a loss of offsite power during a unit LOCA and unit shutdown with a simultaneous loss of Lake Wylie.
The accident scenario described in PIR 0-C87-0047 begins when one unit is operating and one unit is shutdown for refueling, and one of the two emergency diesel generators for the shutdown unit is out of service. The design bases described in the FSAR assumes an earthquake occurs causing a loss of Lake Wylie because of the failure of the dam. The switchyard (non-seismic) would also fail because of the earthquake causing a loss of offsite power'and the automatic starting of the emergency diesel I generators.
If a LOCA occurred in the operating unit under these conditions, the realignment of the RN system supply to the pond would occur immediately if the decreasing lake level had not initiated the realignment. When the realignment to the pond occurred, a single failure of the supply valve to open in the operating train would result in only one Nuclear Service Water pump in the other train supplying both units, l A review of previous NRC Inspection Reports 50-413/86-30 and 50-414/86-33, indicated that the licensee was aware of operating restrictions on the RN system in July 1986. On July 8, 1986, both Unit 2 diesel generators (DGs) had been declared inoperable. When a DG is ' inoperable, the equipment configuration renders its corresponding Nuclear Service Water pump inoperable. When both Catawba plant Technical Specification (TS) pumps.become inoperable, the 3.0.3 requires that action be initiated within one hour to place the affected unit in Mode 5 or 6.
A l meeting was subsequently held by the NRC Region II inspectors with the licensee on August 25, 1986, to discuss the RN system equipment configuration and resulting dx ign deficiency.
In response to NRC concerns, the licensee committed to review for revision Operating ! [ Procedure OP/0/A/6400/06, " Nuclear Service Water System" to require ! realignment of the pump suction to the Station Nuclear Service Water Pond waen either a pump or D/G is out of service.
The licensee also committed to review OP/0/A/6400/06 to assure RN system operability under any scenario described in the proposed revision. Some five months later, on January 21, 1987, a letter was sent from the .
l ___ _
. ___ _ _ _ - _ _ _ _ _ - c . ' , " ' Operations Department to. Project Services Engineering. The letter , , enclosed Station Problem Report CNPR-02350 describing the problem with the_ Nuclear Service Water System in the accident scenario.
It . recommended deletion of the automatic realignment of RN system valves on a LOCA signal. The letter requested the identification of all necessary: FSAR and technical specification changes, and'an evaluation of the required changes for their. applicability to 10 CFR 50.59 requirements and NRC reporting requirements.
Subsequently, on January 26, 1987, a letter from Project Services Engineering to Nuclear Department Services requested instead that a design study be initiated to review the station problem report and determine whether the recommended solution was adequate, or should
alternate solutions be considered. The letter also requested that potential inconsistencies between the proposed solution recommended by , the Operations Department and the safety analysis, FSAR, and the Technical Specification be identified. The attachment to this letter - further stated, "In summary, present design of the RN system does not ' support operation within the bounds of the safety analysis if one unit is in cold shutdown and in compliance with the technical specification."
The letter indicated that the design study results were needed expeditiously (within45 days).
Nuclear Department Services forwarded this letter to Design Engine,ering, and on March 27, 1987, some two months later Design Engineering issued Design Study CNDS-080/00, Part 1.
Design Engineering recommended deletion of the automatic realignment which shifts the RN system supply to the SNSWP on a LOCA signal from either unit.
However, Design Engineering also indicated that the recommended resolution did not completely alleviate the problem. The study explained that the deletion of the LOCA signal to the RN system did not preclude a single active failure from causing the loss of the two Nuclear Service Water pumps under the conditions specified. The study also explained that deletion , ' of the automatic LOCA realignment would reduce'the level of redundancy of - the RN system and that additional redundancy would be needed elsewhere.
In addition, the scope of the study was bein detailed probabilistic risk assessment (PRA)g increased to include a analysis which would include a safety analysis.
> On April 10, 1987, approximately eight months after the potential design deficiency was identified, PIR 0-C87-0047 was issued with the station ' problem report, CNPR-02350 attached. The PIR questioned whether the problem was an unreviewed safety question or unanalyzed condition that significantly compromised plant safety.
On May 13, 1987, Design Engineering issued CNDS-080/00, Part 2.
This study concluded that situation identified iri the station problem report and modified by the design study was a previously unanalyzed situation that needed immediate attention because the current RN system design did not support operation from Lake Wylie with one unit in any of the operational conditions Modes 1-4, the other unit in either operational condition Modes 5 or 6, and one of the shutdown unit emergency diesel generators' inoperable. The design study indicated that recommended . resolution did not preclude a single active failure that would result in
lu r . _.. _ _
_ - _ _ ______ -__ - _ _ _ _ - -- _.
. _ _ _ - - - - - ___, . -
- .=
. , ., ,
i , ( ,. < the loss of.two Nuclear Service: Water pumps under this scenario. To preclude a single active failure from resulting in the loss of two of the p(2)ps,' t would be necessary to (1) install parallel isolation valves or um i align the RN system to the SNSWP when an RN system pump'would be .! inoperable for Jonger than 72 hours.
Implementation of either of these
proposals would require prior NRC approval. The Design Study, Part
also; concluded that the sequence of events specified in the problem.2, report would be probabilistically insignificant if the redundancy of the.
pit instrumentation were increased.
Based on; review of the licensee appare.the above information, the inspectors concluded that ntly did not recognize the significance of the design inadequacy nor promptly respond with adequate corrective action. At the conclusion'of the inspection, the. inspectors expressed the following ., concerns: ' ., 1.
During certain modes.of operation, an operational condition . previously unanalyzed appeared to exist in the event of an accident scenario of a: simultaneous LOCA with a unit shut down, one Nuclear Service Water pump would be supplying both units.
The RN system did not meet the FSAR design basis of two independent.
l . . 2.
. l sources of Nuclear Service Water for a simultaneous LOCA and a unit cooldown.
3.
This-did not appear to be an acceptable application of PRA.. 4.
The RN design deficiency shoulo have been reported under i 10 CFR 50.72 or 10 CFR 50.73.
Following the inspection, on August 7, 1987, the NRC sent a letter provide (1) the provision of 10 CFR 50.54(f) requesting that the lic0nsee pursuant to an. analysis justifying the adequacy of one Nuclear Service Water pump to serve both units or (2) a description nf actions implemented or planned to be implemented that justify continued plant _ , ! operation.
' ' On August 14, 1987, the licensee responded to the NRC letter dated ] August 7, 1987. The licensee responded asserting that they believe the RN system meets the General Design Criteria. An additional response d
dated August 21, 1987, corrected a labelin response. g error for two valves on a ! diagram in the August 14, 1987, On August 27, 1987, the licensee gave a formal presentation to the NRC where it emphasized that
its revised procedure requires them to operate in'conformance with the ! ! General Design Criteria.' l In summary, the plants may have been operated in a previously unanalyzed condition for over a year. The licensee was slow to recognize the significance of the problem and slow to take adequate corrective action
when it was identified. They did not perform a 10 CFR 50.59 review to ! determine if an unreviewed safety question existed, and they did not j report the condition to the NRC. These matters are still under review by i the NRC.
. . .
pWl' 5. l-- - - = ~ --- - - - - - - - p - ' m av [My - ,* -N . ' . J Ag , =j ' i: a- ' i h ,< , , ,,, , , ' pi J ' K' BL Reactor Trips '
i.
. iTN inspectors reviewedLthe history of reactor trips at Catawba for the
previous year. : The inspectors noted. that several trips' were caused by .
o , problems associated with the FeedwaterlSystem. When reactor trips occur, 'i <
Operations Plant 9 Performance :CatawbaLSafety, Review Group-(CSRG) 4 and.
E'g the corporate Operating Experience Management and_ Analysis group (OEMA)- R a: "are involved in evaluating the' event. Station Directive 3.1.18, R .y. Investigation of Reactor 3 Trips,1 Revision 9 specifies. this process.
. . ' -When a reactor trip occurs,.the,0perations ' Department initiates the
g' =Minf-Trip. Report. A Reactor. Engineer..from the Operations Department - J ' ' completes the Post Trip Review'and forwards it1to the CSRG...The CSRG ' . . initiates an Incide'nt Investigation Report, where accuracy of the Post ?!
Trip Review is verified and; root cause'and corrective action is . determined. The' corporate based OEMA ove.rsees the entire process,
,, -trends root causesfand recurring problems, Land provides; feedback and + , recommends corrective action.to. plant management.
The inspectors reviewed a memorandum from'OEMA.to the Manager of Nuclear
Maintenance, dated February 3,01987, concerning reactor trip' reduction.. ! This, memorandum:noted a trend'in Feedwater: System-associated _ trips and , .made recommendations to reduce the incident rate. The site,, responding?
to these: recommendations, amended the Technical Specification,> performed-modifications to the Feedwater: Control' System, revised operating-procedures..and Steam Generator level.' controls. The inspectors 1noted thatt the licensee is'considering still further recommendations.
a.
i Feedwater related problems caused ten reactor trips' prior to'the ) - . implementation of these recommendations. However, only one feedwater . related trip has occurred since the. implementation.
C.
Procedures- ,
The inspectors initiated this portion'of the. inspection with a review-of' , selectedLicenseeEventReports(LERs).
LERs have documented numerous problems which resulted 'from deficient procedures. The inspectors reviewed LERs written since January 1, 1986, and noted that 21 reportable a-events were. attributed to the use of deficient. procedures. One previous j-NRC' violation'was,also attributed to the'use.of deficient procedures..
, This review revealed that deficient procedures had contributed to three ' reactortrips,four'engineeredsafeguardfunction(ESF)actuations,'one ESF system inoperable, one breached fire barrier, one violation for a f 12,000 gallon coolant leak, and multiple missed Technical Specification ' J surveillance.
,
To ensure procedures are. adequate, the Operations Department reviews its procedure every two yeart. At that time,-Operations Department personnel perform a complete procedure review which includes verifying technical adequacy. All of these events would indicate a weakness'in the Operations Department review program.
- To improve the procedures, the Operations Department has instituted an informal program.
Shift personnel report procedural errors by , phone to the Operations Procedure Development Group when they are { O ,! d (b g
't -,M e e- _ _ _ _ _
t ' - . ( l encountered. This group then ensures the procedures are corrected. The l inspectors reviewed phone call transcripts and noted that none of the ' procedures which were referenced as defective on the LERs had errors ndted prior to the incidents. This technique addresses the problem after , the fact.
Since the program is not formalized, it is not clear to the l ' inspector if the licensee expects the operator to determine procedural j adequacy prior to each use of the procedures.
In any event, the
inspector could not conclude that the program to review procedures every I two years is effective based on the number of procedure-related problems.
j
- q The inspectors reviewed the latest report of Quality Assurance (QA) surveillance CN-85-17, dated May 9, 1985, performed on the Operation { Department's two-year review program. The surveillance appeared to have ' reviewed administrative compliance and not procedure adequacy. The four j findings of the 0A surveillance were superficial and consisted of i documentation errors; for example, the review date was entered ( incorrectly on the process record form.
The inspectors reviewed a sample of QA audit reports in this area.
It was noted that several findings were specific to several procedures.
For example, the procedures for calculating target flux differences and a calculating the lower limit of detection following a GeLi detector ! calibration needed to be changed. However, the inspectors could not { determine from the audit reports that QA had determined whether or not (1) procedural adequacy was a problem, (2) line management was addressing the' problem,(3)weaknessesexistedincurrentprograms,cr(4) problems existed with procedures resulting in those events discussed in the LERs.
g It appears to the inspectors that the Operations Department has recognized the problem and taken some actions to improve their procedures. However, from this review, it appears that QA has not been effective in identifying significant problems with procedures or evaluating changes implemented by the Operations Department.
D.
Personnel Errors
, ' During the LER review, the inspectors noted that there had been 44 LERs attributed to personnel error since January 1,1986. Operations < Department personnel were involved in several eve)1ts described in 12 of q
those 44 LERs. These 12 resulted in two reactor trips, six Technical Specification violations due to failure to recognize inoperable equipment, one Technical Specific 6 tion violaticn for failure to take appropriate corrective action, and several missed, technical specification surveillance.
, The Operations Department Shift Operations Engineering Section, through an informal program, is trending personnel errors by reviewing LERs, PIRs, shift log books, and other appropriate documentation.
Problems are discussed with operation supervision. The Operations Department is aware of the problem with personnel errors and is monitoring it.
The inspectors reviewed QA Surveillance and Audit Reports performed since January 1, 1986.
It was noted that personnel error had not been addressed in either QA Audits or Surveillance even though the plant , , Am_m__ .m_
.g ,,, ...r 7- -- --7,- -- ~ - 7 - - - - m) , Loi, , j;.&, ~ ' a s ^ ' ' m a } , . , ' y
1 > r , [ [
- p
'd
& " y-g- . , r
- ]
A , , .i), < ,
m J' management'had expressed concerns ~in this. area.EThe-QA organizations did ] , a y"' not'very:theirisurveillance'and audit schedules to address problem areas ' .unless'specificaL11y requested by-plant management.
< ' ' L _. . 3%> . + The inspectors interviewed personnel in the Compliance Organization.
.
, < a' QA Audit group, QA Survel.11ance group, Catawba Gafety Review Group H U
- (CSRG).jandthe:corporatebasedOperatingF"erienceManagementand
l Analysis group (0EMA). it was noted that tn. :ompliance Group was, j , ,, directed by plant management'early.in 1987.to. rend personnel.
' 3 errors.. Compliance personne1'showed the inspectors a. chart of: Lpersonnel errors per quarter per department through:the end of.1986.- - ' LT.hejinspectnrsidid not determine any significant action taken as a- ] , . result. of. these trends.. The corporate based QA' Audit group plans to.
' include personnel error in an annual trend analysiv report.
' ' < However, examples:of this report were.not available.
' The. CSR'G and.0EMI' trend reactor trips and other. significant events at d Catawba.1 0EMA provides.~ recommendations for improvement to plant i > g , b management.. This program.has been used primarily forLreactor trip
- reduction. 0EMA is expanding.its review to; include programmatic. treed-analysis. The outline _ for the expanded program has been developed and is -
in the process.of being implemented.
Both the CSRG and OEMA groups are j ' ' expanding the scop ~e. of their existing programs to include: trending i f analysis.and recommendations on observed. program weaknesses. This.
. expanded program has the potential to supply the needed ' review and '
- e
' feedback necessary to identify and resolve problems.
q
. .-Injconclusion',theOperationsDepartmenthasmade.somechangesbecauseof
problems ~which have occurred in the areas of procedures, personnel-errors,,and reactor. trips.
It.. appeared _that the reactor tr.ip reduction program has been > . effective;in making some improvements. However, the' inspectors could not
determine ~if program changes involving procedures and personnel' errors were ~ effective. The inspectors concluded that findings from QA Audits and ') < , Surveillance were generally administrative..Further, QA was not effettive'in identifying problems and evaluating changes to operating, programs. The QA . department needs to be:more: involved in the. day-to-day operations.
. particularly in known or. suspected weak areas.so that these weaknesses can be y - appropriately addressed.
' The. inspectors noted that operations personnel control room demeanor and attention to operation. details'was professional. Access control, log keeping, and control of plant surveillance and maintenance activities appeared good.
i PLANT MODIFICATIONS ' ~ Design. changes, temporary. station modifications and post-modification testing .were evaluated to assess the effectiveness of the licensee's quality ~ verification organizations in identifying, solving, and preventing recurrence - of safety-significant, technical problems. The inspection also assessed the , , effectiveness of -line management in ensuring that identified deficiencies are , dealt.with promptly, completely, and correctly.
'
8 -
, .. .
< - -
a
< - 'A f ?fp ' 'j- ,
- q i
a.
. "b ' , , . < y ft i ! .!' ' . _ , N< .. O L A.
-Design. Changes? l '
The licensee' considers the second independent review of design activities { as a part.of their quality verification program.: Therefore, six
i - lrelatively recent~ operational events that occurred because of a design i , u, deficiency were analyzed to determine the effectiveness of the existing L , ' quality verification programs.
' . 1.
Safety Irijection During Loss of Control Room Test Due to Design . Deficiency (LER 414-86-028)> f '
, m.
On June 27, 1986, a Unit 2 Safety Injection actuated on low i .' Pressurizer and Main Steam Line pressure during a Loss of Control i .RoomTestduetoinadvertentopeningoftheSteamGenerator(S/G) q . Power Operated Relief Valves (PORVs).
The incident was attributed!to'a design deficiency. The S/G PORV.
controls were changed but legends for PORV controls located on the.
Auxiliary Shutdown Panels (ASPS) were not revised accordingly.
Therefore, personnel could not accurately position the PORVs. Since-procedures which specify the PORV controls were not revised following the implementation of.the design change, the operators were unaware of the change to S/G PORV controls.
- ' The Loss of Control Room Functional Test was performed on June ~27, 1986, to d'emonstrate the following: a.
The unit can be brought to Hot Standby conditions with the controls on the Auxiliary Shutdown Panels (ASPS).
' b.
The unit can be maintained at Hot Standby from the Auxiliary Shutdown Panels.
.,. ' c.
The unit can be brought to Hot Standby and maintained in that condition with the minimum shift requirements of the Technical - ' Specification.
i d.
The Reactor Coolant System can be cooled down at least 50 'F from a steady state Hot Standby condition while being operated from the ASPS.
On June 27, 1986, a Loss of Control Room Functional Test was started with the unit at 24% power. As part of the test, the PORV breakers at the' Auxiliary Feedwater Pump Turbine Control Panel (AFWPTCP) were closed in accordance with the procedure. When the breakers were
closed, S/G A, B, C, and D Power Operated Relief Valves (PORVs) ' opened to 75% although the PORV manual loaders on the AFWPTCP were , set per procedure to the proper setpoint, 1125 psig. The design I change mentioned above had modified the PORV controls.
The changes had not been incorporated into applicable operating Procedures, nor had manual loader legends and scales on the ASP been changed to indicate the real PORV positions. The S/G PORV opening caused a rapid depressurization of the secondary side with an
, _ _ __ l
- . . - , . - - - - -. Im .W^
. , > , ,
. p ' o , m , , h.
l ,
,Si < s ,' h ~ ' ' ' . accompanying cooldown of the primary side. Personnel observed the l ' decreasing steam pressure and attempted to shut the PORVs'by: .] increasing the'setpoint for.PORV opening, but the PORVs-opened-l ' m l< further.
For approximately 4.5 minutes, the S/Gs:were blowing down ) m . j-through the:S/G PORVs.
, {
< , . q Pres'surizer Pressure dropped off scale (less than 1700 psig)
u ,. l approximately 2 minutes after the S/G PORVs opened.
Safety l ' a Injection (S/I)conditiononLowPressurizerPressure(1845psis) l
, i and Low Steam Line Pressure Loop D.(725 psig) occurred but 'j
, initiation was blocked due to control being transferred to the ASPS.
, As Pressurizer level continued to' decrease, personne1Lmanually l; started Centrifugal Charging (NV) Pump 2B. However, due' to valve ' - controller labeling problems, ASP Operators were reducing charging L flow rather than increasing it.
' , The decision was made to terminate the test and return control to.
. the Control Room.
When this was done, S/I immediately actuatsd, l both Diesel Generators'(D/G) actuated on LOCA conditions, and the S/G PORVs reclosed. The transient was terminated.- ] Previously, the loader provided a control function such that the i ' PORVs open fully when the setpoint was exceeded.. In January 1985,.a ( - Design Change Authorization.(DCA) cnanged the function of the ASP { S/G'PORV manual loaders such that the PORVs opened in direct.
i proportion to the_ dial position. This DCA was implemented in ' October 1985.
j l The legends on the loaders were not revised. Since the manual
- . loaders appeared physically the same, the ASP Operators attempted to close the PORVs by increasing the setpoint but actually opened the PORVs further.
.. Furthermore, on several occasions during December 1985, January , 1986, and February 1986, responsible personnel discussed the DCA, , but the effects on ASP operation were not understood; thus { procedures and training were not modified.
' , ASPS are designed to facilitate an orderly shutdown of the unit from ' outside the control room.
In this case, modifications to a safety . related component were made, yet the attendant modification of the indicationeon the panel were not made, procedures were not changed to ! reflect the modification, an6 proper training was not given to the J ' operating staff. Thus, the ASPS could not appropriately perform their , intended safety function.
Further, it was significant that the quality verification process detected none of the deficiencies prior to the event.
' ' 2.
Unit Shutdown Resulting from PORV Inoperability Due,to Design / Installation Deficiency (LER 413-87-012) J l On March 11, 1987, the Unit 1 pressurizer PORVs were declared l inoperable when it was determined that the instrument air (VU ]
1
l
. l _ - _ _ -
yM M'. ' ' #+ l < w.
,,,, c w w , . - ' 'J'- ___ .... M' l }-Q ' : hg . , w ? , j . e .ha p ' - ) i
, fi ' lL supplies for the three 3ressurizer PORVsiwere iricorrectly connected, d ~
K*' ' This incident was altri)uted tola design' deficiency in that the.- O " N ! , _ +" design' drawings for the inst'rument' air (VI) supply connections were,
- not sufficient to ensure correct connection to the appropriate PORV..
' < ' . The Pressurizer is' equipped with Power Operated Relief Val'ves - $ " m ,
s(PORVs) to limit system pressure and prevent actuation of.the d ' N
- -
high-pressure; reactor. trip. The operation of these valves also r >
,)imits;the undesirable opening of.the spring-loaded code safety.
.. ' u ' ', Ll ' valves. The:PORVs'are designed to limit'the Pressurizer'pressuretto.
- , p
'a value.below the high-pressure. trip setpoint;for all design . - D , E transients up'to and including a.95 percent step l10ad decrease with: ' v , "* , B steam dump actuation. Normal-control air to the PORVs isl supplied.
H bytheInstrumentlAirSystem(VI).
, , o6 , , ( ..
~ The pressurizer PORVs also provide a safety-grade means of- . 4) o - > L depressurizing Xhe Reactor Coolant (NC) System.. f1trogen from thes . Cold: Leg Accumulators provides a safety-grade source of4 motive power , ' ' '. W L M for the'two;PORVs. The pressurizer:PORVs we also used to: provide
LowTemperature.0verpressureProtection(LTOP).pLTOPprovides,.
overpressure protection of the NC System while operating at low' ~ temperatures.
' > , On March 10, 1987,'with the unit in Mode-4, Hot Shutdown, control , room (CR).personnelLeganperformingthe~NCPORVandBlockValve j Stroke Test procedure.. Personnel attempted to' cycle Pressurizer ' "- 'PORYINC032Bwith-InstrumentAir(VI)isolatedfromthevalveand' i backup nitrogen aligned to it. The valve would;not cycle.-.The j valve would cycle with VI aligned tosit. =It was later determined i , , that the emergency backup! nitrogen supply lines ~to the Pressurizer PORVs were' incorrectly connected. ;The PORVs were declared ' inoper.able. Subsequently, an inspection revealed that the ' 'InstrumentAir(VI) supply,linesweretubedtothewrong.PORVs.
, Ultimately, the'PORVs were properly. connected, tested, and. returned,:
to service. - A review of modifications associated with the
Pressurizer PORVs was performed to determine when'the VI, tubing 4 ] error wasimade.
It was determined that the tubing was connected to ! , " the wrong PORVs when the unit was under construction'(approxim.+41y.
j 1981). ' The backup nitrogen supply was added in April 1981.
] < I This incident was attributed to a design deficiency in that the.
appropriate design piping layout and instrument detail did not give sufficient information to ensure correct VI tubing connections to the correct PORVs. The test after initial installation didinot + detect this deficiency.
, - , ' The point is that the PORVs, which are safety-related components required by Technical Specifications (TS), were installed and tested . incorrectly during construction in 1981, yet the quality , verification organizations did not detect the degraded situation until a TS required surveillance test identified the situation in l , 1987.
' i
, , , _._N.
- - - -u--. - - - - -. - - - - - - * "
{.Q.. .. - m ' n " u , , .i 'I i{' g .. ' . 3.
- Unit Shutdowns,Due to Design Deficiency with Containment Air Return
" Fans (LER 413-87-05) ,( ' On January 30,1987, Units 1and2enterddTechnicalSpecifibation ' i
3.0.3 following the determination that the containment. air return ' , and hydrogen skimmer systems were inoperable.
It'was determined i that the systems were inoperable due to the> possibility that the , . containment-air return fans (CARFs), could be rendered inoperable in, , 'the event of a containment spray actuation where the CARF pits would be flooded with collected' spray.. Deflective curbs were.then installed on the Reactor Building operating decks on both units to.
a ' prevent collected spray from funneling into'the fan pits. The , systems'had been inoperable since initial fuel load on both units, i.
This incident was attrib $ted to design deficiency in that no devices to prevent funneling of collected containment spray 'into CARF pits - " l were speciffed on design drawings.
' The' purpose of the Containment Air Return Sub-s stem of the l Containment Air' Return and Hydrogen ~Skimer (VX System is'to encure rapid air return from upper to lower containment after an ' initial-n largebreakloss-of-coolant (LOCA) blowdown. The subsystem consist's of two redundant, independent and separately located 100% capacity fans per unit.
Each Containment Air Return fan is located in a pit, 1approximately_13 feet deep, below the Reactor Building operating , deck. The fan intake is through grating on the 605 foot elevation.
' Fan discharge is directed below to lower containment.
Each
Containment Air Return fan pit is served by a 6 inch drain line ' ' which routes liquid to the reactor refugling cavity and then to ths containment sump. This function would be necessary in the event of a LOCA and subsequent actuation of.the Containment Spray system.
Some collection of containment spray in the fan pit is expected and
the drain line is provided for that purpose. The refueling canal and reactor vessel area are surrounded by a 3 inch raised curb which wovid. direct containment spray to the' Containment Air Return fan pits.
The sizing of the pit drain would be inadequate to remove all -, the containment. spray which could have been funneled to the pits..The flooding of the fan pits would render the Containment Air Return fans , inoperable due to submersion.
On January 14, 1987, NRC Region II contacted Nuclear Production ' Licensing about a problem concerning Containment Air Return fan ' pit drainage at another facility.
a
, , on January 29, 1987, a review of ) As a part of the resulting review c the design drawings for another licensee facility identified a 3 ) inch curb around the refueling canal and reactor vessel. That afternoon, a design drawing from that facility was found which i indicated that a 6 inch curb device was installed to divert coliected containment spray away from the Containment Air Return pit aad back to the refueling canal area.
$
j - _ _ _ _ _ _ _ -
h. _ ; f . &
m a ! , , , [[ kN k . "
' ' ' - ' " ,
s , , , ) ,( I . t ' a{" ..< cL;, Onl January 30,1987, Design Engineering' verified that no' curW
? devices ~to protect the Containment-Air Return fan pits were.
m W.. M" specified on3 Catawba design drawings.: 1 Design Engineering continu,ed; E
- reviews to determine -if any
- differences. in the design between -
Catawba and the other. facility existed to' alleviate.1the necessity for the devices at Catawba.t That afternoon,. Operations. entered TS C '3.0.3 forl Units'1 and 2, after discussions with Design Engineering b , ' indicated that-the operability of the Containment. Air Return and.- H ' L Hydrogen Skimmer System could not.be assured during a containment x' H L' spray; actuation.-.Ultimatelytthe curbs'were installed,on.both units , at Catawba.- u ' s , , . Theneedfor.azcurbtopreventcollectebcontainmentspray'frome ~ ' entering the Containment Air Return fan pits and rendering the fans y i, , I
- inoperable was recognized'by the. Design. Engineering Department R
l .during the construction phase'of:the. plant.
Design Engineering' j , . internal correspondence _ addressed the need for the curb in'
' a . September 1978.The Catawba structural ~ design' drawings were not- " ' revised.accordingly, althoughLthecsame correspondence.apparently' . initiated.the installation of the curbs at the other plant.
' s The' incident was identified as a design deficiency. LThe Containment r L . Air Return and Hydrogen Skimmer Systems'were inoperable on both-I . units'since construction, yet the. quality verification _ organization'ns ~! , ^ 'did not detect the deficiency.
y ' '4. Diesel' Inoperable Due to' Incorrect Specification In
, Support / Restraint (LER 413-86-15) R >q On March 12, 1986, diesel generator (D/G) 1A was. declared inoperable '! due to.its inability to meet the requirements of the D/G 1A a f operability test.. Upon investigation, it was discovered that a bolt attached 'to a support.was interfering with the fuel. throttle rod o,f , the D/G.' This; event was attributed to a design deficiency in that design personnel did not specify in the modification package the maximum bolt length to prevent interference with the. operating ?" equipment.
- , L
s Technical Specification (TS) 3.8.1.1 specifies that two physically j ~& independent circuits must exist between the off-site transmission-1 . , network and the on-site Essential Auxiliary Power System.
It also - . requires two independent diesel generators to.be operable. When one , of these four independent sources becomes inoperable,.the action .' - statement requires a demonstration'of the operability of the remaining A.C. sources.within 1 hour. All sources must be returned 9-to an operable. status within 72. hours or the unit must enter Hot Standby within the next 6 hours and Cold Shutdown within the following 30 hours.
a On March 12, 1986, personnel began installation of certain Diesel ' Generator 1A support and restraint system (S/R) pursuant to a > 'NuclearSectionModification(NSM).
It was found that the existing t bolts were too short. Additional bolts were too long but were installed. The personnel knowing a problem existed with the bolt , l
l i w=:
- _ - _.
-.
_ - _ _ - _. - _ _ - - - - -. m 9 99. , . ~ n , ....;.,sg .
' i , . . ., .., . e Linsta11ation, decided that it was close to quitting time, and he-Y would contact technical. support the next, morning for' resolution. - . . i ?.. Later that' evening, personnel performed procedure PT/1/A/-4350/02A, m Diesel Generator 1A. Operability.Tei,t. The'D/G would not start and . E ultimately, it was determined that a balt installed in the support . ' was interfering.with the movement of the fuel thbottle rods - Lresulting,in the,D/G inoperability.
> j , This; incident was attributed to a design deficiency _in:that the'S/R t sketch issued for the modification.by design personnel failed to , stipulate a bolt length or a clearance between the bolt and the throttle > rod.
! , ' The. point l's that the' NSM did not specify the critical parameters:
which ultimately resulted in the inoperability of the diesel, and + a the quality verification organizations involved did not detect.the ~ deficiencies. prior to the event.
f a z x, y 5.
. Shorted Lamp Socket Causes Reactor Trip OUe to Design Deficiency ! (LER413-86-40) '. . ' On July-17, 1986, the Unit l' reactor tripped.due'to a shorted lamp * socket.. When the lamp socket shorted, it. caused a main generator trip,.a reactor trip, and a turbine trip. The unit was at 85% powery at the time of this incident.
This incident was attributed to a design deficien~cy. The design " , documents incorrectly specified terminal connections for the lamp
socket.
, .. ,
The purpose of.the Unit Main Power System; Protective Relaying System is to protect the power system.
It removes any element from service when that element may prove detrimental to the effective operation and -integrity of the system.
' ' r '
. The lamp socket that failed is associated with a relay which trips - the associated generator breaker, motor operated disconnects, - '; associated switchyard power circuit breakers, and the associated ' switchgear breakers. The' lamp indicates relay coil continuity and is in series with the relay coil.
l This incident was attributed to a design deficiency. The diagram for the lamp wiring was incorrect. With the lamp socket wired incorrectly, enough heat was generated to cause the socket to ! u degrade, the short circuit to occur and the eventtto transpire. The i point is that this very basic design function was inadequately-j a ' performed, and it was not detected by the quality verification i organizations prior to event.
i . . t n
-t .v . __________m .. _..
%.. - . -, - --- - - -- - - c ,
, . f$$k;W Y, " ' ' ' " - , , Oy,
>l,- -,. , .
' 4 - , W $s ,, 4 U<f ' ' , m , , - [df Turbine Driven Auxiliary Feedwater Pump Inop(erahle F 16.
Shutdown Facility Due to Design Deficiency LER414-86-45) m
- )l
, On Ostober 11, 1986, 18 month testing of Turbind' Driven Auxiliaryc ' > ~ ),i
. ' h .. Feedwater Pum (CAPT) manual start control from the Standby Shutdown '! L.;'r Facility;(SSF was attempted for Unit 2.. The CAPT did not. start ' .because,the' valve _ controlling' steam flow to the CAPT'did not open.
LI Investigation revealed thatithe solenoid valve which opens the j . , .., v control valve was tubed incorrectly'although it was tubed per the: ': design' drawing.b The solenoid valve was retubed and the: associated- ,, instrument' detail drawing was corrected.
c The' Standby Shutdown System provides an alternatiand: independent. .means'to achieve'and maintain'a: hot standby condition in'one or both y,, . units..?The Standby Shutdown Facility.(SSF) structure houses.some of- , K c the. equipment and control panels for this system.. The Turbine.. L, Driven Auxiliary Feedwater (CA)' Pump _.isLused to maintain adequate-steam generator (S/G) secondary side inventory. S/G: level' . ^] l, indication is available'in the SSF. -The.CAPT starts when a: low-low S
- level: signal in two outiof fourl steam generators occurs. iThe'CAPT
] cansaiso.be starteo from.a manual pushbutton in.the.SSF. ProcedureL j
PT/2/A/4350/22, CA Control from Standby Shutdown Facility-D Opera 4111ty T.est, is used toiverify that the CAPT controls function C.<- properly from the.SSF.
-, p 'On October 11, 1986, the CAPT manual; start control from SSF was attempted per test procedure, CA Control from SSF Operability Test.
,. PT/2/A/4350/22..-The CAPT did n'ot start because the steam flow-31.
'
'r-control. valve. operated from the.SSF'(2SAS),did not open.
! < Investigation revealed that the solenoid valve (2SASV0052) which } , opens 2SAS from the SSF was tubed incorrectly although it was tubed- ' per instrument detail CN24995A2.
Solenoid valve 2SASV0052 which.causes the:CAPT to start, was 1' . apparerttly retubed between September 29,,1985 and October. 11, 1986, o , yet no; reco' d of this work has been found'.. It is ossible that this-r a solenoid drawing).valvewasoriginallyinstalledincorrect1(perthedesign.
' z This. incident was attributed'to a design deficiency. The . solenoid valve was installed in accordance with an incorrect design drawing.
, The point is that this equipment was installed pursuant >to the j' ' design drawings which were incorrect, but the problem was not , , detected by the quality verification organization prior to the w event.
! As stated above,-these events were reviewed to determine if the -; ,, organizations involved were effective in verification of quality fo: , ' design, installation, and testing of the facility.
1 In sunnary, the inspectors concluded that these six designs performed in-l support of plant modifications appeared to be flawed initially a.nd were l not detected by the in-line design engineering quality verification.
' i ! , a .
k
JL'
yy m } [~- ' h W}
J - . r , . . ' ' l
v .. I~ [' Add'itionally. at the' site the design / modification packages were not r adequately reviewed by either the Construction Maintenance Division (CMD) or Projects, and the errors were not detected 1by this second level of ~ in-line quality verification.
I ' .. < , ! I ,, 'In two of the incidents, post-modification testing.did not-detect the 'l c O' errors.. It appeared that these problems could have been detected and 'l c, - corrected through better coordination between engineering and staffs j ' located at the site. The licensee has implemented a new program, i , TOPFORM, which should improve this situation. Howeyer, it is too early to evaluate its effectiveness.
' , i . , After a review of 1986 and 1987 corporate QA audits and site surveillance t
reports, the'NRC inspector _ determined that the QA organization through their' audits and surveillance had not detected any weaknesses in the j areas of design, modifications or. post modification testing. 0verall, l , the effectiveness of the quality verification organizations, both in line and quality assurance. organizations,'could be further improved with ~ respect to the detection of safety-significant deficiencies in design and
' modification testing.
'!
B.
Temporary Station Modifications i
- .
Temporary station modifications (TSMs) were reviewed to' determine if- _ J there were a large number of outstanding temporary modifications, if they.
J were-installed for long periods, and if the nuclear station modification - process, which entails a more rigorous review and approval, was being circumvented.
' ' , w $reviewofitheoutstandingtemporarystationmodificationrevealedthat there are. approximately 185 outstanding temporary modifications some-of which date back to 1982.
Further, the review revealed an apparent abuse i of the modification system; more specifically, certain of the outstanding temporary modifications appear to be permanent.in nature.
They have been " - installed for a considerable length of time, and it appears that they had l - been deemed a temporary modification to expedite, installation.
Examples, -( ., of these temporary modifications are as follows: t ' , , 1.
Work Request 003118IAE - which replaced,the internals of a flow transmitter in a safety-related system in 1984.
2. - Work Request 000213 LAP - which installed a cooling system on ' , certain reactor vessel level instrumentation system cabinets, a permanent system, in'1985, w
3.
Work Request 000391LA1 - connected permanent power for Unit 2 reactor vessel level instrumentation system cabinets in 1986.
l A review of the 1986 and early 1987 site QA audits revealed that no ' deficiencies were detected in terms of the number of outstanding TSMs, . the length of time some of the TSMs had been installed, nor concerns , associated with, circumventing the NSM process.
l ' ,
G , _._____________._m -_ _
_ _ _ _ , , , y.
, , - t ' ' ' J ' . ,m e , , The inspector concluded that the quality verification organizations evaluating in the TSM process are somewhat ineffective in the detection and correction of deficiencies in the TSM process. Scme of the TSMs have , been installud an inordinate length of time; certain of the TSMs appeared - to have abused the TSM/NSM system of review, approval and safety evaluation;'yet there have been no problems detected.
- C.
Post-Modification Testing The area of post-modification testing was reviewed to determine if appropriate. testing was being prescribed and successfully completed. The t inspector reviewed the results of the licensee's Testing Review Committee ' whose function was to evaluate certain modifications to determine if " appropriate testing had been performed. The Testing Review Committee was formed after the March 11, 1987, event on Unit I where the pressurized ~3 PORVs were'found to be tubed incorrectly.
The review revealed a , significant number of post-modification testing problems.
, \\ . , , The Testing' Review ~ Committee reported findings and made recommendations in several Intrastation Letters. The letter on the Auxiliary Feedwater - System (CA),datedMay 21, 1987, stated that modifications CN-10054 and CN-10057 relocated and revised the CA auto-start logic' and recommended ' ' the following. post modification testing for these changes: "1) ' verification of all CA auto-start logic from control room.
2) verification of ability to reset all CA auto-starts from control , room with signal'present.
3) verification of ability to reset all CA auto-starts from the , Auxiliary Shutdown Panels with signal present.
4) verification of Auxiliary Shutdown Panel CA Auto-Start blocking logic while transferred to the ASP's."
The letter further stated retesting of items 1 and 2 were documented on i the NSM work request but recommended that items 3 and 4 be actually < retested to verify operability of these functions.
The committee noted thatrthe operability has never been demonstrated for these functions on , Unit 1 since they were not tested preoperationally.
The Auxiliary Shutdown Panels (ASPS) contain controls which' provide the capability of achieving and maintaining hot shutdown when the control room is inaccessible. Selector switches on the ASPS allow the operator to transfer control of the equipment required for shutdown from the control room to the shutdown panels.
When equipment control is transferred to ASPS, all controls in the control room and all interlocks ! that originate or pass through the control room or cable room are defeated.
These panels control the Auxiliary Feedwater System in the event that the control room was lost and had to be evacuated.
If the ASPS had not been retested following the modifications, there is no assurance that the panels would function properly if a shutdown had to be performed from outside of the control room. The need to perform adequate retest was demonstrated on June 27, 1986, when Loss of Control Room Test was being performed on Unit 2.
Low pressurizer and main steam line pressure occurred when control. was shifted from the control room to the ASPS. An improper design change contributed.to low pressurizer
b___________--_--- --
i 4.
, s A 'a 1,. ' , , , and main steam line pressure.
If the retest had not been performed, the inadequate design may not have been discovered before it was , i needed for an actual emergency. This event resulted in a level III ! i violation and $50,000 civil penalty. Without completed retests, the NRC i inspector could not conclude the ASPS were operable.
j Detailed below are a number of other modifications which apparently did not receive adequate post modifications testing: ' Modification: CE 0392 '
' Component: Valve 2RN232A , Function: Diesel generator 2A heat exchanger inlet isolation Finding: No post-modification functional retest performed.
Modification:' CN 10608 , Component: Valves INI 9A, 1NI 10B j Function: Unit 1 safety injection discharge isolation valves , Finding: No post-modification retest performed.
Modification: CE 0480 Component: ' Valves 2NV 1A, 2A, 1248, 135
Function: NV '1A, 2A, reactor coolant to letdown heat exchanged l ' isolation valves; 124B, excess letdown pressure
- control valve; 135, residual heat removal flow to ] letdown heat exchanger
Finding: No post-modification functional retest performed.
Modification: CN 10236 Compryient: Valve 1 ND,18 t Function: Residual heat removal pump isolation valve to pump 1A from loop B Finding: No post-modification functional retest performed.
, Modification: CN 10432 Component: . Valves IND 24A, 1ND 58B l Function: Residual heat removal heat exchange outlet valves to l , ' l letdown heat exchanger ' Finding: No post-modification functional retest perforned.
Modification: CN 10371 Component: Multiple safety related motor operated valves , l Function: Various safety"related functions ' Finding: Torque switch settings changed, yet no functional verification retests performed, f Modification: CN 10435 Component: Valves IND 25A, IND 59B ' ' Function: Residual heat removal pump 1A and 1B minimum flow valves
Finding: No post modification retest performed.
l j I ,
4 _ _ _. _
%@DW, i
u.
l <d ' , g <l .' ' ' ,3 , " s: . , x g.
, , ' h, 4 ,m' " ' ' ' ', ;,Fmy;, i ,b- . .,.,. . .! , , ' ' %T Modification: J,. CN 10203 ' > " ' ' .f 'i f Function:-. ,Valvs 1KC 1Al .
- Component:.
J' Component cooling' auxiliary building'no~n: essential- . . ' a.
return header: isolation valve.- H " . Finding:1 No post modification functional retests performed.
.' > - ,.; ,
.. ~ Modification CN 10203 . ,
Component:
- Valve 1 KC 53B a
' ,p y Function:.. - Component cooli_ng auxiliary' building nonessential' header isolation. valve . " g . Finding:i No post-modification functional retests' performed.
> > - .o ,q u - '
Modification: CN 10099.
6', Component:. Valve 1 NV 188A.
E ' ,a' '! ' L j
Function: ' Volume control. tank outlet isolation valve < , m b;., ' '" Finding:- A No post-modification verification performed after wiring modified.- ,. ' E ~, ~ These are but a few of.the problems l detected:by.the Testing Revfew j Comi ttee'. The results of the Testing. Review Committee clearly; indicate
d that appropriate post-modification testing.was not adequately prescribed H . .or performed during.the time frame of the. reviewed modifications.
L, Discussions with Testing Review Comittee personnel revealed-thst:certain j of-the post-modification testing which had not been performed was still'
- not conducted by the close of the inspection.
J '
- The inspector reviewed the QA involvement in-the area of-post -
modification testing..The most recent audit in the area of modification
~,- ' ,was conducted in-1986. -The a6dit included corrective ' action, training, R = qualification, and the review: process for the work request and .; ' modification programs <in connection with the refueling outage.
It did
.. not identify any significant weaknesses in the post modification testing, j ' . , .
The most recent corrective action audit [NP8725CN] covered the period ' ' February 23, 1987, through April 15, 1987. The inspector was informed by the audit team leader that at the time of'the audit, the audit team was ! not aware <of the Testing Review Committee, its activities or its findings:. This comittee was established as part of the corrective , l-actions following.a significant problem involving post modification testing. This 'comittee completed their review of. the Auxiliary a ' Feedwater System and reported their results in Intrastation Letterse dated April 7,1987, near the end of the QA audit. Even though the ., comittee was established as part of the corrective, actions, neither the c 'q scopeL nor schedule of-the QA audit'was adjusted to include the ongoing t activities or initial reports of the;comittee. Thesesintrastation' . letters reported problems and recommendations for post modification o testing as discussed earlier in-the report. Some problems in the April 7 5. - letters were significant and should have been documented as Problem ! ' Identification Reports (PIRs).
PIRs,are used to identify and track ' significant problems to ensure proper evaluation and prompt resolution.
..
4 a _ _ _ _ _ _, . _ _ _ _ _ C ^ . ,.
m 'The fact that these significant problems were not documented in pIRs illustrates a weakness in the PIR Program. The audit for corrective action did include the PIR program but did not detect this weakness.
i The quality verification organizations,assnciated with identifying and j performing of post-modification testing appeared to be somewhat
ineffective. Review of applicable QA audit reports of the 1986 and i early 1987 time frame revealed that the reports did not reflect significant weaknesses in the area of post modification testing.
, In summary, the' heview performed of the area of post modification testing h revealed that quality verification programs in these areas appear ineffective and need to be strengthened accordingly.
. <
) ' PLANT MAINTENANCE , , The inspectors reviewed the quality verification organizations in the maintenance area to determine if substantive technical issues were being identified and corrected. The inspection focused primarily on the diesel generators, auxilia'y feedwater system, Rotork and Limitorque valves, r containment spray heat exchanger, post-maintenance testing, main feedwater control, and main feedwater bypass valves.
The maintenance quality verification was performed by five organizational elements: Maintenance, Quality Assurance (QA) Surveillance, QA Audits, QA Technical Support, and Quality Control (QC). The quality verification , activities of these organizations are discussed below: l l A.
The Maintenance group appeared to be staffed with technically qualified ! personnel. The formal, completed portions of their programs, such as I detailed maintenance histories for components, generally have sufficient - n information to provide meaningful information to maintenance management.
l Trending most maintenance problems is not formal. The Engineering j Support group within Maintenance appears to be informally trending and j tracking information on system problems and recurring maintenance concerns. While some programs are not formalized, the maintenance department appears to be quite effective in identifying weaknesses in the maintenance ar,ea.
B.
Based on review of surveillance reports, the inspector determined that i issues identified by the QA Surveillance group, generally, were not very < substantive.
From January 1, 1986, through July 1, 1987, six QA ' surveillance were conducted: Lifting and Handling Equipment, Retest and Functional Verification, Maintenance Procedures, Field Activities and Hydrostatic Testing, Independent Verification, and Preventive Maintenance. Of the 21 findings from the six maintenance QA surveillance , reports, 19 were administrative finaings such as wrong revision numbers and mis.<ing signatures; two were substantive technical findings.
' The QM Surve111ance Attribute list, which gives guidelines for the performance of surveillance within various disciplines, lists the following guidelines for maintenance:
, - _ _ -
. ' ' . , , , , Surveillance i , Frequency e Category in 1 2 -87 Semi-annual Work requests 86-3, 86-25 Semi annual Retest and functional 86-25 e verification ' Semi-annual Preventive maintenance 86-25, 87-14 Semi-annual Independent verification 87-8 ' , Annual Lifting & handling equipment 86-3 Annual-Maintenance procedures-86-34 Annual Field activities 86-44 Annual Hydrostatic testing 86-44 ) ProblemsexistedinthetechnicalarcascoveredbyQAsurveillances,buk , the. surveillance did not reveal them. The only QA surveillance which , covered retests and functional verification was 86-25.
It reviewed 21 work orders. Six had retest requirements specified which were in apparent conflict with Station Directive 3.2.2, " Development and Conduct of the Periodic Testing Program," Rev. 8.
One of the conflicts concerned Work Order 2964MNT. The specific issue was the replacement of the, number 7 bearing on the 2B diesel generator. This replacement was a Unit 2 license condition. The station directive required a retest of the diesel generator after completion of the maintenance activity.
The appropriate retest was riot documented or required by the work order. The QA surveillance did not detect this error. The maintenance group verified a retest had been performed in this case and in the other five cases noted although the work orders,were apparently incorrect.
It appeared that the strength in the maintenance department personnel compensated for other program weaknesses. Where there were technical errors, QA was not effective in identifying them.
Based on subsequent discussions with two senior QA surveillance . specialists who have been through portions of a QA surveillance training program recently, the inspector determined those two surveillance specialists appear to be more effective and better able to identify substantive problems.
C.
The QA audit group performed two audits in the ma'intenance area. The resultant reports were reviewed by the inspector; The findings were generally more substantial than the findings of the QA surveillance group, but no significant technical findings were identifitid.
D.
The Quality Control group may have found some substantive technical findings, but the findings were not documented if they could be corrected first. The item had to be corrected before passing the QC hold point in ! a maintenance procedure. The inspector expressed a concern that even though the problems were corrected, the lack of documentation identifying errors prevents an accurate assessment of maintenance performance.
Therefore, maintenance could not accurately track or trend performance problems.
l
,
i .. J . ! E.
The Quality Assurance Technical Support group may have identified some technical findings, but,this was difficult to determine.
Problems i generally were not documented when they could be corrected immediately.
Therefore,- there was little documentation to allow management to ' effectively trend or track problems.
It appeared that maintenance department personnel are technically knowledgeable.
Site QA was involved in a training program to improve the technical abilities of their people. Corporate QA has started a program of self-initiated, technical audits. Both QA and maintenance have implemented programs to improve the ability to identify and correct substantive technical issues. Therefore, the overall program in the maintenance area was adequate.
CONCLUSION { Based on a review in the areas of operations, modifications, and maintenance, the inspectors determined that there were several significant issues which j needed prompt attention and resolution. The first had to do with the Nuclear
Service Water Sys' tem. The Nuclear Service Water System was designed to' i ' accommodate a loss of Lake Wylie due to occurrence of a seismic event by automatically transferring the supply and return to the Nuclear Service Water Pond (SNSWP) on receipt of a realignment signal. This was accomplished by closing double isolation valves on the supply and return to Lake Wylie and { . opening the single isolation valve to the pond.
There was a single valve for i each train, A and B.
Given the design basis accident scenario as described in the FSAR with one unit operating and one unit in refueling: a postulated j failure of one of these valves could have resulted in both units being.
' supplied by only one service water pump. The licensee has not demonstrated < satisfactory performance of both units in this condition. Therefore, the
current design did not appear to meet Criterion 44 of Appendix A to 10 CFR 50 for single failure. This appeared to be an unanalyzed condition and an ) unreviewed safety question. The licensee has revised their operating procedures to realign their Nuclear Service System when the units are in this i condition. This prevents a single active failure from reducing system operation to one pLmp. This matter is still under review by the NRC.
j The other issues involved operability of several systems and components.
It appeared that modifications were made to Unit 1 Auxiliary Shutdown Panel and J several safety-related motor operated valves (MOVs) and retests were not i performed following completion of the modifications. These issues were . raised as a result of findings identified by the lest Review Committee.
' Some problems with design changes and post modification testing have occurred as a result of weaknesses in communication between engineering ano staffs located at the site. There appeared to be a lack of effective oversight by a quality verification organization which allowed interface problems. to exist.
As a result of sevoral significant problems which have occurred in the past the licensee implemented a program, TOPFORM, to improve the communications ' between the different departments.
It was too early for NRC to evaluate this program.
_ _ - - -
, y;- - - - - ' ' - ' ' ~ ~ ! .m ... " - +> u , , z , , j p.. g y,' ., ..*- ,j ~ '
} [',l '~ .... The Quality Assurance Organization has nbt been effective in' identifying j
- , '
. significant technical-problems or issues,' bringing them'to management's.
j attention, and. ensuring proper corrective. action.
In defining organizational ! responsibilities, the licensee has segregated regulatory compliance'and ' .y' ., -quality verification into two distinct. activities:, Quality Assurance , monitors compliance and the line_ management organizations verify quality.
l ', 'Even though.each department was capable of. monitoring' internal department- , w ' activities, none were effectively monitoring the interface between ~ departments.- Significant technical issues were then assessed'as problems for " qtality verification and not as compliance issues. :Therefore QA does not become involved.; Separation between regulatory compliance And_ quality. verification was not ~a normally acceptable practice because the NRC did not.
consider these functions independent.
u The licensee has taken~ steps to improve the effectiveness'of.their Quality l l ' Assurance Organization. Although.none were completed, the licensee hes begun .a new program of. self-initiated technical audits. A formal training program ' ' covering reactor-systems is being provided to QA personnel. When completed,:
these changes should improve the effectiveness of the QA organization.- l
EXIT' INTERVIEW-i- a , , T'e inspectors' met with licensee representatives listed in Appendix Aion-h . July 24,11987, and discussed the purpose, scope, and results of the-i . inspection. ' ' ! .a ,
- i
,s , .a , , ,
( - J ---< l l l a
, i i i f f . 2a < , ,
_ - o - - ' m , l,4 I APPENDIX A >- l Exit Meeting Attendees ' ., Duke Power Company J. Barbour QA Manager Operations H. Barron M. Boyd Superintendent of Operations Director, Mechanical Services N. Bradley; QA Surveillan::e T. Bright Engineering Manager, CMD-C G. Contacy
CNS/TS/HP
M. Cote' , Compliance J. Cox M. Criminger Manager, Station Training ' ._ D. Dalton Quality Assurance , QA Technical Services L. Davison QA Manager, Technical Services S. DeGange R. Futrell Integrated Scheduling Engineer G. Hallman Manager, Nuclear Safety Assoc.
. Manager, Nuclear Maintenance j J. Hampton Station Manager C. Hartzell a Complaince Engineer 'W. Houston J. Lanning Design Engineering F. Mack, Jr.
Administrative Coordinator, Station Services T. Mathews Project Services Engineer ' Manager, Duke Projects W. McCollough Maintenance Engineer y 'E.
McCraw McGuire ' P. McIntyre Assoc.,Eng./ IRE , D. Miller Quality Assirance W. Miller Planning Engineer G. Mitchell Operations R. Priory G. Reese Vice-President, Design Engineering QA Supervisor, Aud,it Division J. Roacs Security Coordinator L. Schmid Operations, General Office R. Sharpe Nuclear Engineer J. Stackley I&E Engineer H. Tucker Vice-President, Nuclear Production R. Wardell Superintendent, Technical Services R. White Catawba Safety Review Group J. Willis Station QA Manager ,T.
Wyke '. Chief Engineer, Design Engineering , '
NRC , ' A. Beach NRR V. Brownlee RII/DRP F. Hawkins NRR 'f K. Jabbour NRR M. Lesser Resident Inspector P. Van Doorn SRI Inspection Team , e - _ _ _. _ _ _ _ _ _ _
p{.O P^qpmwg ~ _ _ _ _ _ _.. _.. - - - - " ." :: .[ b . hi . gtt
,
- <
j
n ;; ' , . .x, ('5 p 'Other-a p.
JJ. Brown:~ -North Carolina Electric Membership' Corp.. < G. ' Provencher -- .QA Supervisor,' Arkansas Power & Light , y < u.
J.
! , , , +- 1,. ?0ther licensee personne,l were contacted / interviewed 'during the inspection.- y
f g< ). i.
I
.) ..i i ~h i . e l ' f e i-t $ Y ) i ' , f .. j
tv.
, o
$ k i ! + .. I dh,'.. .,. , _ _.. . - - - _ _.-
p*: r 4.y w y y y - , ,,z c
- %
.. ,., <.,! .r' ,>'V $,,7 ': ' i.
s .,..' n$ ', h d, f, kg 3. p ' /, '. ' , -j '
- 5
- j, p, i,y i 1, ., , , i ,, .. '. 4 : If ,,4 wrx'1 '
> a' , ~. o-
- p:
., p' x ' .5-14 '{f q' ' ' i ,n , h) '. k .,f ' o
- p
' ' .. g* u
- o s
, , ,
- -.k ' k Tl, li
' '
,, ' ' i ' '(R , ( .,, '" ' , :: Duke' Power lCbmpany : T' 4- - . . ' ' <
,.r- , .., ,
I JDistEibution:l +; < - , PDR . , . e.
~.,. y , NT B'R'ea$in[
, ,; ' "4TMurley.: NRR ;. - L i URStarostecki,JNRR -
n, L ' " ' FMiragli', NRR, a , JPartlow, NRR' y Glainas, NRR' " , yn "
- SVarga,1NRR)
, y' ". lm ' WTroskoski,' E00 ,. , . '
- JRoekNRR E
iSHWeiss,;NRRE , , 'FHawkins, NRRE [ '[:WHil.1;NRR' ., ' ' KJabbour, NRR-gr
- '_
>
- n
< , , E ~ RedionlIIIDistribution: ,. ' - '3AGibsony DRS
L VBrownl ee,-': DRP; ' p fCJulian,DRS i ' a: !- ABelisle,,DRS ' . PVanDoorn, SRI,LCatawba' .y g RII Docket' Room s' > , , , , A: ' ., , , ... , , 3:R% ,; i i ^ "5520.301/ HILL , '2.. , < s.
, , ., , . +;;; , . ,. , p
- '11
.{ d 'jg, . '
- -, .y.
n . t i
4 g
- See previousf. con.currences O
, , , ,. .QAB:DLPQ:NRR QAB:DLPQ:NRR C:QAB:DLPQ:NRR D:DLPQ:NRR PDII:NRR PDII/3:NRR q l*WHill:nkp
- FCHawkins
- SHWeiss'
3*JWRoe
- KJabbour *
~ 1/' /87 11/- /87 11/ /87, 11/?/87 11/ /87 ' 11/ /87
1 , . . r u.. I n '+ . J AD NRR-Dii. -
m GL a - , .,~ lig /87
/87
,- r . ~; :- <
' .l s ' _ I $ ' s '/ - ~ = = ar_=-- _:-.-- _.. _ - _.._-__-_.__ -__ __. - -_ . _ __i
R' ' p[ u T
}; 4., .- }&_,
- .3
, A, w; p ' ', '. +[': 3 ~, } ' ' - , , 1 %~.. n. ' '. ',, > .'...t . )a. ', ',. , ,en ..., , , s - g?l$ f.:_2 h./ N,.$I.-,k , QJ ' ' ' Oc ,, ' ' ' w ) '. 'NI.1. i N; ',, M.
" d - ', ' ) / , La ' '~;e .. , i...,v' m
" m: ., 1:al3 : lb c'- ,- - < -., .t.
-y y)..y:.t j; _ _,
- .;g ',,
'r-1' , - hl ..'y t; ,5 p'ip: 7,. 7>, s 6e ! t,
' mi- "'. . ,c i ;, ' q.3 ... ppf' 4'.W; 4'. > ' ,-3-c ;.- 14, , PA.W -
y- [
s , ' . g,> _4yn Q,.., ' " ,, .' . '7.. e T- ' i ' , ,A ,-ui ' ' .
1: .m . ... .; t' , 3.- > f( . , .,, ,.? y'*j' '
~.g' 'Y' b' N. \\ '
y $@is:,'.\\ ' *: . gQi, _g ' , , LDukeDPowen. Company - 41-2 "> y' ,.o , , , - ' g.
- ' - < ,
- j-Gu
-- '
- g w'-"
Distribution:D ' i.
. s '.. . y . & W
- v
' ' , " ~ ' ' ' i
- PDR c-,
' ' ' ' , , i DCS i ^,, + + ". , ' < t; , ' , s ~ u L ,, QAB:Readiiign, s gpj ' - . . ,h
f ' i >9.3TMurley, NRR;l\\'.RStarost'cki,;NRRJ % ',.." ' ' f W M. ' ' cc o c , e
" ' , A e " " ' .. >% g (pgji.aglia.j NRR : V
- *
, H.?, JPartlowDNRR <m '. ' N4 '1 El< s' Glainiw,TNRRLn;, .. e ' > " D LSVarga,HNRRi'! mM l E" e < . < , . , , p1 s Wiroskos ki,j EDO - t " - y . U h ,, , n
- 0 Roe,ENRR f
, '
i RSHWeis,!NRRW N' ' ' , Q"7 L E0each; RIV? q..,' J a- ' , . FHawkins,iNRR9 x.' ' ' ' <' 9 ' , . ]] m: ' p.b WHillVNRRL.. % ' , J fi lK0abbour.cNRR; .J . ~, gs , n, . y e , eli ' m :
- RedIoN1'I T Dist'ribiltion:' '
C " , , d ,N> AGibsori, DRS. - ,
? M. 4 " ' LVBrownlee,JDRPJ ' a l
- ;CJulian',q DRS d
< " .r . : , M.
lABelisle,DRSi . 5!I
.a " 5: :
- PVanDoorn,. SRI
- ,1 Catawba
>
m,;' LRII DocketTRoom M, , - . ,. lm5 \\
i, o .,. .. m ,
.., . ,
s p :.
n .,' ., . n . . - - _ (5
- y6,<
5520.301/ HILL ? , , - > , m, - . .,. ~ " . m. '. 'L-4, ,, , .. - . .. , ,i A h y Q~ '* , , y v a ky [[, " i .
, 't i gk ,, , ' QAB:0LPQ:N I' QAB:DLP :NRR :D NRR P 11: R PD 1 NR Q PQ NRRL
.FCHawkins) ) C: SHWeis JWRoe KJabbour-O//rn( gT, J 'TWHill:nkp.
?10/8-/87 ~10/ /87-10/ 87 10/q/87-10/l4-/87 10/g/87
m
< y,; , ,, ., l > , "
f ADRII':NRR .DRP:NRR .l - '#
R Glainas.. SVarga ' ' 10/J/87-10/.. /87 ' " . < g-l v, j ' e i _u '(' + .' l ' ,i< f' l ': - - =. - .- .e __tw; }}