IR 05000423/1989004

Insp Rept 50-423/89-04 on 890405-0515.No Violations Noted. Major Areas Inspected:Plant Incident Repts,Reactor Scrams, Shutdown to Repair High Unidentified Leakage & Repair to Svc Water Piping & Physical Security

ML20246B754
Person / Time
Site:	Millstone
Issue date:	06/28/1989
From:	Mccabe E NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20246B752	List: IR 05000423/1989004 ML20246B749
References
50-423-89-04, 50-423-89-4, NUDOCS 8907100091
Download: ML20246B754 (18)

Text

. _ . . . _

___ _ ____________ - .

"

-

,

.

.

.

.

F U.S. NUCLEAR REGULATORY COMMISSION

..

REGION I

Report N /89-04 Docket N License N NPF-49 Licensee: Northeast Nuclear Energy Company P.O. Box 270 Hartford, CT 06101-0270 Facility Name: Millstone Nuclear Power Ctatio. _fnit 3 Inspection At: Waterford, Connecticut Inspection Conducted: . April 5 - May 15, 1989 Reporting Inspector: W. J. Raymond, Senior Resident Inspector Inspectors: W. J. Raymond, Senior Resident Inspector G..S. Barber, Resident Inspector Approved by: bbb E, C.-McCabe, Chief, Reactor Projects Section IB bh Date Inspection Summary: Inspection on 4/5/89 - 5/15/89 Areas Inspected: Routine onsite inspection (112 hours0.0013 days <br />0.0311 hours <br />1.851852e-4 weeks <br />4.2616e-5 months <br />) of plant operations, previous inspection findings, Plant Incident Reports, reactor scrams on May 6 and May 11, a shutdown to repair high unidentified leakage on April 11, physi-

.

cal security, repairs to service water piping, allegations and the MAP 4.16 Allegations Resolution Program, Rosemount transmitters, maintenance, and sur-

-veillanc _Re sul t s: No violations were identified. Reviews of plant operational status during operations and during the refueling shutdown identified no unsafe con-ditions. Further NRC review is warranted on whether additional licensee docu-mentation of their program for temporary repairs to code class piping is re-quired to NRR (Detail 7.0). Rosemount transmitter failures due to oil loss were found to be adequately addressed; additional information will be needed to follow the licensee's actions sn this matte .

B907200091 890628 PDR G ADOCK 05000423 pnu

~ - - = _ - _ _ _ _ _ _ _ _ _

_

- _ _ _ _ _ _ _ _ - _ _

'

.

'

i l

TABLE OF CONTENTS PAGE 1.0 Persons Contacted.................................................... 1 2.0 S umma ry o f Fa c i l i ty Ac t i v i t i e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I j 3.0 Status of Previous Inspection Findings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 i

i 3.1 (Closed) IFI 85-09-01, Inspector Findings Regarding the I Modified / Amended Security Plan.. ..................... ....... 2 1 3.2 (Closed) UNR 87-24-01, Issue Amendment to Allow Testing of  !

Containment Overcurrent Devices to NEMA Criteria. . . . . . . . . . . . . . 2 j 3.3 (Closed) IFI 85-56-02, Review Solid Radwaste System and FSAR Amendment Reflecting As-Built Design.......................... (

2 l 3.4 (Closed) IFI 65-56-03, Review Dewatering Procedure and Fill-Head i Venting Modifications......................................... 3  !

3.5 (Closed)IFI 85-56-04, Review Radwaste Procedures for Reference to New Dewatering and Solidification Processes................ 3

)'

!

4.0 Plant Operational Status Reviews......... .......... ............. .. 3 5.0 Exces sive RCS Unidenti fied Lea kage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 6.0 Followup of Plant Trips............. ....................... ........ 5 6.1 Reactor / Turbine Trip due to Low Condenser Vacuum. . . . . . . . . . . . . . . . 5 6.2 Reactor / Turbine Trip due to Control Rod Testing. . . . . . . . . . . . . . . 5 7.0 Non-Code. Repairs to Code Class Systems..... ......... ....... ...... 7 8.0 Followup on Rosemount 1153 and 1154 Transmi tters. . . . . . . . . . . . . . . . . . . . . 9

- Followup on Allegation RI-89-A-38..... .... ....... ................ 14 10.0 Maintenance.. ....................................... ............... 15 j 11.0 Surveillance..... ............................. ........ ........ ... 16

\

12.0 Management Meetings.. ...... ................................. ..... 16 .

!

!

i

- - __-__-- -____-_

,. . _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ __,

..,

.

L

d .

l'

DETAILS 1.0 . Persons Contacted Inspection findings were discussed periodically with the supervisory and management personnel identified below:

S.-Scace, Station Superintendent C. Clement, Unit Superintendent, Unit'3 M. Gentry, Operations-Supervisor R. Rothgeb, Maintenance Supervisor K. Burton, Staff Assistant to Unit Superintendent J. Harris, Engineering Supervisor D. McDaniel, Reactor Engineer R. Satchatello, Health Physics Supervisor M. Pearson, Operations Assistant 2.0 Summary of Facility Activities The plant began the inspection period at full power and operated until 7:20 a.m., April 8 when a power reduction to 90% was necessary to perform condenser thermal backwashes. Power was returned to 100% by 6:55 that da A power reduction was commenced at 11:45 p.m. April 11 when unidentified leakage (See Detail 5.0) increased from 0.5 gpm to 2.5 gpm. The leak was confirmed by increases in containment radiation levels and chemistry sample The leak was from a cracked weld at a letdown line valve. A plant shutdown was completed at 10:00 a.m., April 11 and cooldown was com-plete at 19:48 p.m., April 12. A new valve was welded in place and estab -

lishment of containment vacuum began at 3:05 p.m.,. April 14. Heatup began with Mode 3 being reached at 10:48 p.m. April 14. Reactor startup began with criticality occurring at 2:11 p.m., April 1 Full power was achieved at 8:38 p.m., April 1 The plant continued to operate at full power until 8:10 a.m., May 6 when a manual reactor / turbine trip (Detail 6.1) was initiated due to the loss of two circulating water pumps due to seaweed blockage on the intake screen The storm subsided and the reactor was started up an'i made critical at 10:39 p.m., May 6. The plant returned to full power operation . The reactor automatically tripped on high negative flux rate from full power at 3:14 p.m. on May 11 (Detail 6.2). The trip occurred as I&C per-sonnel were installing test equipment in preparation for control rod scram time testing. The plant was kept shutdown to begin the refueling outage.

- - _ _ - _ _ _ _ _ - - - _ _ _ _ _ _

-_

.

-

Refueling Outage #2 is scheduled to last 52 days and will include the fol-lowing major activities: installation of the ATWS mitigation system; ser-vice water system inspection and repairs; ISI weld inspections; refueling; installation of reactor vessel level monitoring system for mid-loop opera-tions; and, a containment integrated leak rate tes .0 Status of Previous Inspection Findings (92701)

3.1 (Closed) IFI 85-09-01, Inspector Findings Regarding the Modified / Amended Security Plan The inspector reviewed the results of inspection 50-423/85-64 and noted that the inspection reviewed whether the Millstone 3 Physical Protection Program, including personnel, equipment, systems and facilities, was being effectively integrated into the proposed com-bined security program for the Millstone site. The review also in-cluded a special evaluation of the security force training program to determine the ability of security force personnel to carry out their duties and responsibilities by observing licensee administered ex-aminations of a statistically selected sample of security force per-sonnel, in the tasks in which they were qualified, to obtain results at a confidence level of 95%. Additionally, the review included in-terviews of key members of the security organization and project engi-neering staff responsible for the installation and testing of secur-ity systems and equipment. The review indicated that the Unit 3 security program conformed to NRC requirements in the areas examined and was bein-g effectively integrated into the Millstone site progra In addition, recent reviews and inspection have concluded that the Millstone 3 Modified Amended security plan was adequately integrated into site security. Any violations and/or deviations have been ad-dressed and effective corrective action was noted. Based on the lic-ensee performance to date, this item is close .2 (Closed) UNR 87-24-01, Issue Amendment to Allow Testing of Containment Overcurrent Devices to NEMA Criteria Amendment 13, dated January 20, 1988, was issued to revise the in-stantaneous overcurrent trip setting from plus or minus 20% to plus 40% minus 25% per the NEMP AB-2 criteria. Past testing conformc" to the expanded tolerance. This item is close I 3.3 (Closed)-IFI 85-56-02, Review Solid Radwaste System and FSAR Amendment Reflecting As-Built Design FSAR Section 11.4.1 was revised in 1987 to reflect changes in the waste solidification design. This revision replaced the in-site system with mobile solidification equipment. Existing system con-nections are compatible with the mobile solidification equipmen This item is closed.

________________ _ _ _ _ _ _ _ _ _ - - - -

_ _ _ ._ _ -_ _ _

j ..

.,

.

i 3.4 (Closed) IFI 85-56-03, Review Dewatering Procedure and Fill-Head Venting Modifications

!'

OM-43 replaces the OM-38 regarding operation of the NuPac Resin Dry-ing/ Dewatering System. Procedure OM-43 contains the necessary in-structions and emergency actions relative to system alarms. In ad-dition, the procedure. requires an operational check of the system interlocks prior to initiating a resin transfer. Also, the exhaust from the resin drying equipment is discharged through a HEPA venti-lation unit. Therefore, the plant's vent system would act be re-quired to handle any contaminated exhaust ventilation fram the equip-men These procedure changes were responsive to the inspector's concerns. This item is close .5 (Closed) IFI 85-56-04, Review Radwaste Procedures for Reference to New Dewatering and Solidification Processes OP 3338A, Radioactive Solid Waste and OM-43, NuPac Dewatering System describe the proper operation of their respective systems. In the event that waste solidification is necessary, a vendor's Process Con-trol Program will be reviewed and 50RC approved in order to accomp-lish the solidification. The solidification will be done with a mobile solidification system provided by a vendor. This~ activity is routinely inspected by the core inspection program. Future defi-ciencies noted will be addressed by the licensee during these inspec-tions. -This item is close Plant Operational Status Reviews (71707)

The inspector reviewed plant operations from the control room and reviewed the operational status of plant safety systems. Actions taken to meet technical specification requirements when equipment was inoperable were reviewed to verify the limiting conditions for operations were me Plant logs and control room indicators were reviewed to identify changes in plant operational status since the last review and to verify that changes in the status of plant equipment was properly communicated in the logs and records. Control room instruments were observed for correlation between channels, proper functioning and conformance with technical spect-fications. Alarm conditions in effect were reviewed with control room operators to verify proper response to off-normal conditions and to verify operators were knowledgeable of plant status. Operators were found to be cognizant of control room indications and plant status. Control room man-ning and cation shift staffing were reviewed and compared to technical specifi-requirement No inadequacies were identifie _ _ _ _ - _ _

- _ _ ___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _

.

.

5.0 Excessive Unidentified RCS Leakage (93702)

At 11:45 p.m., April 11, with the plant at full power, a shutdown com-menced when RCS unidentified leak rate reached 1.5 gpm (Technical Speci-fication (TS) limit is 1.0 gpm). The leakage was caused during Engineered Safety Features (ESF) slave relay surveillance testing earlier in the day ('4:00 p.m. to 6:00 p.m.). The RWST suction valves to the charging pumps were being opened for the test when operators closed down on the charging flow control valve to limit the amount of 2300 ppm boron that was injected'

to the RCS. The charging flow reduction was necessary to limit the post surveillance dilution required to return boron concentration to its end of cycle concentration. Charging flow was reduced rapidly, causing a de-crease in heat transfer across the regenerative heat exchanger. This ac-tion caused flashing to occur downstream of the letdown. orifices due to '

higher inlet temperatures. The subsequent manual increase in charging flow collapsed this bubble causing a water hammer to lift and reseat the letdown relief valve. An unidentified leak began at this poin The increase in leak rate manifested itself to the operator between 8:00 p.m. and 10:00 p.m. as increases were noted in containment radiation levels and sump pump rate The shift supervisor ordered the sump sampled for boron and activity. The sample boron concentration and activity was reported back at 11:30 p.m. representative of RCS liquid, confirming the leak indications. An Unusual Event was declared at 11:48 p.m. April 11

'

and the NRC was notified via the ENS at 12:07 a m., April 12. A power decrease was conducted to reduce inside containment radiation levels in preparation for containment entry. The entry team received their medical exam and was briefed on potential leak locations. The containment entry team located the leak on a cracked weld on a leakage monitoring valve (3CHS*V995) letdown line at 3:20 a.m., April 12. The weld connected the valve body to a 3/4 inch vent line. Spray was observed in a 270 degree arc coming from the weld. The leak is isolable by the inboard containment isolation valve and the orifice isolation valves. Leak repair required cold shutdown. Reactor shutdown was completed at 9:11 a.m., April 12 and the licensee continued plant cooldown to effect repairs. The leak was isolated during the cooldown, after Residual Heat Removal (RHR) cooling was initiated. The Unusual Event was terminated at 8:05 p.m., April 1 The inspector reviewed licensee actions during this event. Licensee ac-tions were generally effective and showed due regard for safety. Tech-nical Specification time limits were met. The plant was cooled down with-out inciden The inspector questioned the need for the sump activity and boron sample to confirm the leak. The licensee had two supporting indications (con-

!

tainment radiation levels and sump pump rates) that confirmed the initial leak rate. Sampling the sump resulted in an unnecessary delay in plant shutdown. Licensee use of real time supporting indications for offnormal conditions will be reviewed in future inspection _ _ _ _ _ _ _ - - - - - . - _ - - - - - ------

.

y

-

'

Licensee use of the RCS leakage abnormal operating procedure (AOP) was I

lacking. Neither the swing shift or midnight shift shift supervisor (SS)

! used the AD They felt it was unnecessary since they knew what they

l wanted to do. .The inspector emphasized the need to follow procedures and emphasized that operators receive the wisdom of all the members of Plant Operations Review Committee when they use and follow procedures. Proce-dural adherence during off normal conditions will be reviewed during future inspections. This item will remain unresolved pending further NRC-review of licensee procedural use and adherence (UNR 89-04-01).

6.0 Followup of plant Trips (93702)

6.1 Reactor / Turbine Trip due to Low Condenser Vacuum L

'

On May 6, at 8:10 a.m., while at 90% power, a manual reactor / turbine trip was initiated due to lowering main condenser vacuum. Power had previously been lowered to complete a condenser backflush. The "A" and "B" main circulating water (CW) pumps had been automatically tripped at 8:08 and 8:09 a.m. , respectively due to high suction dif-ferential pressure (DP). The high DP condition was the result of an early morning stor Excessive blockage on the intake _ screens re-sulted in the inability of the screenwash system to continue to clean the screens. The loss of both CW pumps on high DP resulted in a low vacuum in the "C" condenser shell which forced the manual reactor trip. All safety systems responded appropriately to the trip. Opera-tors stabilized the plant in hot shutdown. The trip was reported in accordance with 10 CFR 50.72(b)(2)ii at 8:30 a.m., May The intake screens were cleaned subsequent to the trip and the plant was restarted after the stormy conditions subsided. The approach to criticality was. initially begun at 1:00 p.m., but was aborted when the 1/M plot showed that criticality was predicted beyond the cap-abilities of control bank D. The licensee had anticipated that rod worth coJ1d overcome the effects of Xenon buildup after the tri The ECP was recalculated for later that evening with the approach to criticality commencing at 9:58 p.m., May 6. The reactor was made critical and Mode 1 was entered at 12:38 a.m., May The inspector reviewed the sequence-of-events printout and the opera-tor questionnaire Items of minor significance were questioned and satisfactorily addressed by the licensee. No inadequacies were note .2 Reactor / Turbine Trip due to Control Rod Testing The reactor scrammed automatically on negative flux rate trip from 100% full power at 3:14 p.m. on 5/11. The scram occurred when I&C personnel turned off a " rod drop monitor computer" which caused

_ _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - -

_ - _ _ _ _ _ _ -

-

.

.

.

.

control rods to insert. The rod test equipment was set up in pre-paration for scram time testing scheduled during the plant shutdown for the refueling outage on May 1 Operators stabilized the plant in hot shutdown at 560F and 2250 psi Plant response to the transient was normal except for minor problems with-a sticky pressurizer spray valve; problems re-opening the main feedwater control valve to the A steam generator in the post-trip recovery phase; and problems with the auxiliary feedwater flow con-trol valve to the D steam generato The steam driven auxiliary feedwater pump was out of service for overspeed testing at the time of the trip; a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action statement per TS 3.7.1.2 was in effec Steam generator level control was maintained with main feedwater system and the two motor driven auxiliary feedwater pumps as required. No ESF systems were required to operate. The resident inspector responded to the control room and veri Hed stable plant conditions. Inspector review of main control board Indications verified the plant responded as expected (except as noted above) for a reactor / turbine trip, and that reactor operator responses were proper. No inadequacies were note The licensee reported the scram to the NRC Duty Officer as required by 10_CFR 50.72(b)(2)(ii) at 3:39 p.m. May 11. The licensee kept the plant shutdown to begin the refueling. outage since fuel exposure was within the required burnup windo The negative rate trip occurred when two or more control rods in-serted while I&C technicians were installing the control rod timing l computer. 1&C personnel had entered the containment to install the l

equipment and test the communication links between the remote rod l position signal units and the computer. The communication link tested satisfactory per procedure SP 3451N21. The technician also connected the computer to the control rod logic cabinets (3RDS-RHK1HC) per the same procedure. The trip occurred as the technician powered down the computer. This action caused a spurious signal in the logic cabinet that resulted in rod insertion. This same test set up had apparently been performed in the past without incident. The exact mechanism on l

!

how the text equipment caused the rod insertion was still under lic-ensee investigation at the end of the inspection perio Licensee review of equipment performance following the trip noted the following:

(i) A misaligned limit switch on main feedwater isolation valve FWS*CTV41A for the ' A' steam generator prevented re-opening the valve on demand by the reactor operator following the scra The misaligned NAMCO switch failed to indicate the valve was

" closed" and prevented satisfying the reset permissive in the valve isolation circuit (reference S&W Drawing ESK-7JN). The

_ _ - _ _ _ _ - _ _

'~

.

,

p ..

.

. 7

' valve was opened by the operators with the assistance of main-tenance personnel at 4:52 p.m. Licensee corrective actions in-cluded plans to review switch mounting on other valves and to improve the switch mounting bolt arrangemen (ii) Following the scram, the auxiliary feedwater flow control valve (FWA*FCV31D1) to the 'D' steam generator closed in response to demand by the reactor operator to control level and prevent ex-cessive cooldown rates. The valve failed to reopen and genera-tor level was controlled using main feedwater. Licensee review determined that the valve controller failed on the main control board when a drive cord broke between the thumbwheel and the potentiometer that provides the position demand signal. Cor-rective actions included review of actions necessary to peri-odically inspect the cords on other controller (iii) Following the scram, the reactor operator noted reactor coolant system pressure decreased to about 2000 psig due to inadvertent operation of pressurizer spray valve RCS PK 455B. Operator ac-tion to place the controller in manual to cycle the valve, and operation of the pressurizer heaters limited the RCS pressure decrease. The valve controller on the main board was trouble reported on 10/31/88 due to suspected problems with the con-troller " sticking" sometimes. The loop 2 cold leg pressurizer spray valve, RCS PK 4550, had been out of service since 2/25/89 due to a controller problem. Licensee corrective actions in-cluded replacement of both controllers during the refueling out-ag Inspection of the event included interviews with operators and man-agement personnel, review of control room indications, and a review of the sequence-of-events printout, post trip data available from the plant computer, and the licensee's post-trip documentation (PIR 66-89 EPIP 4112-3 and OPS Form 3263). No anomalies were noted in plant system performance. Licensee review and evaluation of the event was proper. No inadequacies were identifie The resident inspector will follow the licensee root cause evalu-ations, equipment repairs, LER summary and corrective actions on a subsequent routine inspection. N-o inadequacies were identifie .0 Non-Code Repairs to Code Class Systems (71707)

NRC Inspection Report 88-24 describes previous NRC review of licensee ac-tions to identify and correct leaks in ASME Code Class 3 piping in the service water system. . Previous inspections found licensee evaluations of known leaks were technically acceptable to assure piping system integrity during interim periods of operation. The licensee used temporary repairs to limit the leakage from the system until the plant shuts down for an outag _ _ . . - - _ _ -

.

.

.

-

.g Service' Water Leaks One problem reviewed previously and addressed again during this inspection period, concerned a leak in the service water outlet from the "A" reactor plant component cooling water (RPCCW) heat exchanger,.just down stream of valve 35WP-V35. A through wall defect in the copper-nickle clad, carbon steel pipe'was found to be highly localized and had dimensions.that were less than the critical size that would jeopardize structural integrity of the 18 inch diameter pipe. The licensee installed a leak limiting device (a " soft patch" - wood plug held in place by metal and or webbed bands) to reduce water spillage to the floor area. The licensee removed the "A" RPCCW heat exchange from service on April 18 to further evaluate the de-fect after noting leakage had increased to about 5 to 10 gpm on April 1 Further licensee investigation found that although the size of the defect had increased slightly, the conclusions from the prior technical indica-tion remained valid. Actions were taken to reduce the leakage by im-proving the patch and then returning the system to service. The inspector reviewed the technical evaluation with engineering personnel and identi-fied no inadequacie License Requirement Further inspector review on April 18-19 of the regulatory requirements for construction, inspection and repair of safety class piping raised a ques-tion whether the plant was operating within the licensing basis for the interim period of operation under a " temporary repair" (soft patch). The ASME code of reference for MP3 specified in 10 CFR 50.55a(g)(3)(ii) is ASME III and ASME Section XI. Final Safety Analysis Report Table 3.2-1 establishes the correlation between ASME code classification and safety classification for piping systems, and classifies the RBCCW and Service Water Systems as Safety Class 3. Technical Specification 3.7.3 provides the operability requirements for the RBC CW system. Technical Specifica-tions 4.0.3 and 4.0.5 requires that safety class systems be tested per ASME Section XI and further states that failure to meet the TS surveil-lance requirements constitutes a failure to meet the limiting condition for operation.-

Section IWO 2600 and Table IWD 2500-1 of ASME Section VI applies to safety class 3 piping systems. The code requires that safety class 3 piping be subjected to periodic visual examination with an acceptance standard that no leakage is permitted in the pressure retaining boundary. The ASME Sec-tion XI code recognizes approved repair methods for code class piping, but does not recognize temporary repairs or "sof t patches." The use of repair methods on code class piping that is not recognized by the ASME Code con-stitutes a condition contrary to the requirements of 10 CFR 50.55(a)(g)

that is outside the NRR approved licensing basis for the plant.

- __- .__- -____

, _ _ ___-_ _

-

.

.

'

.

.

Safety Significance This matter was discussed with licensee technical staff and management on April 19 and during a conference call between licensee and NRC Region and NRR staff-on April 20, 1989. The licensee further described his program to monitor and address degradation in both small- and large-bore piping in the service water system in a letter dated April 28, 1989. The licensee stated that the soft patches are not ASME code repairs, but are interim non-weld repairs intended to be used until an outage of sufficient dura-tion occurs to allow permanent code repairs. The liceisee's engineering evaluations assured structural integrity criteria of the ASME code was not met even with the defects, and that operability of equipment in the area of the leak would not be compromised by flooding, assuming no credit is taken for.the soft patch. The interim repair is considered a maintenance activity that limits the amount of water leakage fr am the piping. NRC staff review of the' licensee's position identified ao inadequacies with the leak technical evaluations or the program to address service water system Based on the above, the inspector identified no safety concerns 3 systems. continued plant operation with temporary repairs on safety class regarding This matter requires further review by NRC management to determine what further actions,-if any, are required by the licensee. An NRC staff posi-tion to address this issue generically for the industry is pending. This item is unresolved pending completion of the review by the NRC (UNR 89-04-02).

8.0 Followup on Rosemount 1153 and 1154 Transmitters (92700)

Problem Summary The inspector reviewed ongoing licensee actions to address suspect Rose-mount transmitters. The inspection review included a meeting with cor-porate engineering personnel on March 30 and a meeting between NRC tech-nical staff in headquarters with industry groups on April 13, 1989. The licensee updated his initial 10 CFR Part 21 report by providing supple-mental information in a letter dated April 13, 198 The inspection reviews, along with input on April 3 from a licensee employee with safety concerns about the issue, identified new information to the NRC about the number of failures, the failure mode, the relatively high failure probability, and the significance of having a failed instru-ment that was not detectable. The employee's safety concerns involved addressal of the issue at other nuclear plants since actions to address the issue at Millstone station were either complete or in progress. Based on the additional information, the NRC staff took action to address the issue to plant operators (see below). NRC Inspection Reports 50-423/88-05 ,

and 89-02 describe NRC review of actions at Millston .

'

I l

i

_ - - _ _ - _ _ _ _ _ _ _ _ _ _ _ o

._ _ _ _ _ _ _ _ _ _ _

,

~

.

. l

.

L 10 Rosemount 1153 and 1154 pressure sensing units are Jsed extensively in the safety related, environmentally qualified applications in the nuclear in-dustry. Of 106 units in use at Millstone 3 (MP3), five failed in service in 1987. Subsequent reviews by the licensee concluded a potentially sig-nificant safety hazard (SSH) existed due to the failure mode and the wide-spread use of the instrument The results of the SSH were reported to the NRC in a March 1988 10 CFR 2'1 report. Subsequent review by the vendor, Rosemount, attributed the cause of the defects to the manufacturing process. Rosemount provided update information to users in a February 1989 letter that identified suspect units on a site specific basis, and recommended that utilities review the units for safety impact at their site The problem was further studied by the Electric Power Research Institute using Millstone 3 data supplied from thc. Off Site Information System (0FIS). The failure mode was characterized as follows:

The units fail from a loss of oil in the sensing chamber. That re-sults in an inability to respond over the full span, an inability to respond in the increasing pressure direction, and a 1oss of dynamic response capabilit *

The deterioration is gradual but has an " infant mortality" aspec Failue can occur within 30 to 36 months after being placed into ser-vice in a high pressure application (greater than 1000 psi).

The sensors can be significantly degraded in place (experience a loss of safety function) prior to the onset of detectable (observed) fail-ure. A channel that looks operable to an operator during a panel check can be " failed-as-is" and incapable of responding in the up-scale directio The detection of degraded units and identifying failures attributable to

}

'

loss of oil is difficult. Identifi ation relies upon accurate root cause determinations of failures at plast sites. It is probable that, as lic-ensees review the failure data ban for their plants, oil loss failures may exist but may not be identifiab'e. The ability to detect the failures is only as good as the level of detail with which the failure was de-scribed when entered into the data base (usually as part of the mainten-ance work order process), and only as good as the root cause analysis don Further, reviews of the calibration recnrd for +he plant may give a false security that the failure is not present, ur,less the review is done based on thorough guidance. Since the degradation is a slow process, a unit undergoing calibration during the early stages of failure may show only a slight amount of drift and this drift could be calibrated out during a test, or successively over several test _- _ _ _ . _ _ -

- ___

-_--___-- ____ _ - -

-

.

,

.

,-

,

U .

'

" The satisfactory completion of response time testing has not been adequate to assure installed units are acceptable. Out of the 78 identified fail-ures, only 1 or 2 were identified during response time testing. .A problem in meeting the response time acceptance criteria will show up only when the unit is on the verge of obvious' failure or already significantly de-graded. The problem can be seen in its incipient stages during tests when units are subjected to their full span of pressures. This includes cali-brations and response time test Licensee engineering reviews with the vendor determined that the first documented 1153/1154 failure (due to loss of oil) occurred in a unit with a 1979 shipping date, and the latest shipping date for a failed unit was in 1987. Just over 14,000 units were produced in that time in 300 lot Of about 85 failures suspected to be from loss of oil, Rosemount found that 78 were due to low oil. Each of these failures were traced to its manufactured lot and 20 lots were identified as suspect. There were 1004 units in these 20 lots, and 16 of these units were supplied to Millston The list of suspect batches for units identified in the February 89 Part 21 letter was developed from transmitters examined by Rosemount and known to have failed from loss of oil. Since the vendor does not have the cap-ability to handle contaminated units, all failures have not been examine It is estimated that the total number of failures from loss of oil may involve hundreds of units industry wid In correspondence with the licensee dated December C, Rosemount stated there have been no reported failures in sensors built in the last 3 years (1986 - 1988). The vendor reportedly made improvements in the process in that period to address the loss of oil problem. The vendor reportedly-has more recently, through a combination of improvements in the manufacturing process and in process testing criteria, improved the manufacturing reject rate.' Although the manufacturing process for 1151 & 1152s transmitters is the same as that for 1153/1154s, the former units are used mostly in con-trols applications and non-EEQ safety applications, and reportedly have not experienced the failure mod Estimated Failure Probabilities The licensee estimated the failure rate by relating the 78 loss of oil failures to the full manufacturing base produced from 1979 to 1987. The 78 fcslures represented 0.0565% of that manufacturing base. Using a rouno-up value of 1% defects in the manufacturing base, the failure rate for 1 year of service was then (0.01/8760 =) 1.1 x 10-6/ hour. This fail-ure rate compares favorably (1/30th) to the rate assumed for random fail-ures in probabilistic safety analyses of 3.85 x 10-5/hr according to the license ' Inspector review concluded that the above predicts 0.014 failures in an 18 month operating cycle, instead of the 5 failures that actually occurred at Millstone 3. Alsc, of the 106 units installed at Millstone 3,16 were

,

____.________ _ _ _ _ - - - - - -

_

-_ .______-_ -

-

.

.

from the suspect lots. Five of. these failed in service over the period from March - November 1987. The inspector therefore concluded that the licensee's estimate (1.1 x 10 5/ hour) was overly optimisti The inspector reviewed the methodology employed by Westinghouse in WCAP-10271-P-A, Evaluation of Surveillance Frequencies and Out Of Service Times For Reactor Protection Instrumentation System. In that methodology, the detectability of failures is an important factor that is accounted for explicitly in the calculation Undetectable failures are defined by IEEE 379 as failures that cannot be detected by periodic testing or cannot be detected by alarm or anomalous indication The Millstone 3 studies show that the Rosemount 1153 transmitters can be significantly degraded in place for months (incapable of providing a trip function in the upscale direction), with this condition not detectable by any alarm or anomalous indication. The condition might be detected by periodic test, but the calibration surveillance interval is 18 months (13,140 hr) and the mean time to detect failures is 13,140/2 = 6570 hour0.076 days <br />1.825 hours <br />0.0109 weeks <br />0.0025 months <br /> On the other hand, the WCAP methodology assumes a failed instrument will be detected within two' operating shifts (i.e., 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />), a significant differenc While the WCAP failure rate is 2.8 x 10 5/hr and the licensee estimated a 1% defect (1.1 x 10 8/hr), actual experience at Millstone 3 appears to be much worse. The WCAP assumed detection interval was 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, at Millstone 3 it is 657 The WCAP concluded that the failure probability (P) using X=2.8 x 10 '/hr and T=16 hour detection interval was acceptable, where:

P = IT/2 = 2.2 x 10 5 Using T=13,140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br /> and the licensee's assumed failure rate (1.1 x 10 5/hr), the failure probability results would be approximately 7 x 10 3 Considering the 5 failures experienced at Millstone 3 in 18 months, the failure rate would be 4 x 10 */hr. This is a much worse failure rate than 1.1 x 10 8/h This matter will be reviewed further with the licensee to determine whether a more definitive failure probability can be obtaine Further NRC Action / Followup The NRC technical staff issued an Informat' , Notice (IN 89-42) on April 21, 1989 advising the industry of the information available to the staff and requesting other utilities to review the matter for applicability for their plants. The present action plan for Millstene is to continue review of the 1153s and 1154s in safety-related applications for acceptable per-formance. The review includes testing as necessary to see if there is

,

b_ 2___________m__._-- - - - - - - - - - - -

- _-_ - - - - .

f

.

evidence of degraded performance of the type described in the INP0 Sig-nificant Event Notice (SEN) 57; i.e., sluggish response, slow drift of 1/.4 percent or more, reduced noise in signal or change in normal system signal fluctuations, inability to respond over the entire operr' ng range, et Suspect units would be further tested to confirm operabiist Wholesale changeout of suspect units that have yet to be proven inoperable was considered by the licensee but is not considered, by the licensee, to be the best course of action at this time. Until the full scope of the suspect lots is determined, there is a chance that new replacement units will also be susceptible to loss of oil failur Further, unless addi-tional data proves the " infant mortality" period invalid, a good confir-mation that a given . unit is not susceptible to the failure comes from the service time in high pressure applications without degradation. The best course of action appears to be to test installed units to detect signs of degradation. Test criteria from Rosemount are pending to assist this in-dustry effor The licensee noted that preliminary Rosemount findings have suggested that the cause.for the defects was related to a design change replacina an elastomer 0-ring with a metal one to qualify the transmitter for harsh accident environments. The metal 0-ring resulted in increased stress being applied to the glass sensing chamber. That caused cracking of the silica and eventual leakage. The 0-ring was installed during final as-sembly after intermediate pressure tests of the sensing chamber were com-pleted; thus, the assembled unit could be shinped with the incipient fail-ure mode undetecte Rosemount review is in progress to recommend testing for the industry to better detect degraded unit The inspector reviewed the bases for the licensee'< conclusions regarding Rosemount transmitters and identified no inadequacies. Licensee initi-atives to further review this issue included: testing on May 10 using the Great Neck Road training facility labs to record instrument pressure drop versus time to measure the rate of oil loss versus operating pressure; and use of the mockup flow loop to characterize the dynamic response characteristics of a degraded unit. Licensee actions during the refueling outage to further evaluate installed Rosemount transmitters will be re-viewed during subsequent routine inspection Previous NRC resident inspection (IR 89-02) reviewed licensee actions to assure operability of Rosemaunt transmitters in safety-related applica-tions at Millstone. These actions included verification of operability through response testing, calibrations, review of 0FIS data, and review of channel performance during transients. Licensee actions were assessed as thorough in addressing the issue at Millstone 3.

l

-

_ _ _ _ _ _ _ . _ _ . - - .-.

-

.

.

.

'

9.0 Followun on Allegations (40500)

Followup 'of a Specific Safety Issue (RI-29-A-38)

A licensee employee contacted the inspector on Apiil 5 to allege harrass-ment by a supervisor for bringing technical concerns to the NRC (reference Section 8.0 above concerning Rosemount transmitters).

The employee stated the harrassment occurred after presenting differing views to the NRC inspector during an inspection meeting at corporate engi-neering on March 30. The employee's supervisor was not in attendance dur-ing the meeting. Upon his return, the supervisor allegedly criticized the employee's performance at the meeting and restricted his further involve-ment with the problem. The employee stated it was inappropriate for him to be removed from the project due to his particular expertise in the issu The March 30 meeting was held at the inspector' request as part of the NRC inspection of the licensee's technical resolution of the Rosemount trans-mitter issue. During the meeting, the employee expressed views on the issue that differed from the general engineering consensus regarding the significance of the Rosemount problem, and in particular, the significance of the failure rate. Review of the matter by the NRC then concluded that the failure rate was not acceptable (see Detail 8.0, preceding) and the employee's safety concerns were substantiate j Inspector observations during the March 30 meeting were that the em-ployee_'s actions and statements were appropriate and beneficial to achiev-ing thorough examination of all facets of the technical issue. The in-spector noted further that the employee was especially capable in dealing with this issue due to his extensive involvement and study of the issue on an industry-wide basi The inspector informed the employee of the need to work with his chain of !

command and his rights to pursue the discrimination concerns with the De- t partment of Labor. The employee pursued the issue through the NU Alle-gation Resolution Progra The employee contacted the Allegations Program

.

<

coordinator and was referred to an outside consultant (LRS Associates) for followup of the technical issue. The administrative concerns were re- ;

ferred to licensee managemen ]

The inspector reviewed licensee actions to resolve this issue. The tech-nical and administrative issues were resolved to the employee's satisfac-tion. The licensee concluded that the employee's concerns were valid and that his continued participation in this matter was appropriate. Based on further NRC discussion with the employee, the licensee's allegations program was effective in resolv'ng this instance of an employee-identified safety concer l L - J

- - -_ . _ _ _ _ . _ _ _ _ _ _ - _

_ _ _ - _ - _ - - _ _ _ - _ _

..

w'

..

..-

.

l

-

Review of Allegations Program Implementation in General The inspector met with the NU Allegations Program Coordinator to review the history of issues > resolved by the program in its first year since im-plementation in June 1988. The itcensee stated that, while several in -

dividuals had initiated contact to resolve concerns, the only case in-tended to be addressed by MAP 4.16.(Millstone Employee Allegation Resolu-tion Program) was the one summarized above. The inspector reviewed with the licensee the specifics of the worker concerns in two other instance The concerns appeared'to have been properly resolve The licensee stated that a new corporate procedure, NEO 2.15, was issued to incorporate the MAP 4.16 guidance on handling resolution of employee safety concerns. The licensee plans to eventually have NE0 2.15 supersede MAP 4.16. .The licensee's assessment was that, while use of the program (in terms of the number of cases at Millstone and Connecticut Yankee) was low, the program was effective in resolving legitimate safety concern The licensee intends to continue with the present progra Results of a recent licensee survey of employee views were being tallied by the license The licensee stated the preliminary conclusions con-firmed previous perceptions: workers have a high degree of personal regard for quality and safety in the performance of their jobs; and most workers do not feel the need to use the MAP 4.16 program since concerns can be worked out at the level of the immediate supervisor. The inspector noted the licensee's comment Routine NRC review of the licensee's programs for resolving employee safety concerns will continue on subsequent routine inspection .0 Maintenance (62703)

The inspector observed and reviewed selected portions of preventive and corrective maintenance to verify compliance with regulations, use of ad-ministrative and maintenance procedures, compliance with codes and stand-ards, proper QA/QC involvement, use of bypass jumpers and safety tags, personnel protection, and equipment alignment and retest. The following activities were included:

-- Weld Repair to Leaky Letdown Valve (3CHS*V995)

-- Auxiliary Feedwater Valve FWA*FCV31DI Controller

-- Main Feedwater Valve FWS*CTV41A Limit Switch No inadequacies were identified.

_ _ - _ _ _ _

- - _ _ - _ _ - - _ . _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ - . _ _ - _ .

l, . +

.

7 ' . k I' 16 l

l 11.0 Surs>illance (61726)

_

The. inspector observed portions of surveillance tests to assess perform-ance in accordance with approved procedures and Limiting Conditions of Operation, removal and restoration of equipment, and deficiency review and resolution. The following tests were reviewed:

e

-- Diesel Fuel _011 Transfer Pump Readiness Test, dated 5/1/89

-

"A" Motor Driven AFW Pump Readiness Test, dated 5/1/89

-- LPSI' Injection Valve Stroke Timing, dated 5/8/89 No inadequacies were note .0 Management Meetings (3'0703)

Periodic meetings were held with station management to discuss inspection findings during the inspection period. A summary of findings was also discussed at the conclusion of the inspection. No proprietary informatfor, was covered within the scope of the inspection. No written material was given to the licensee during the inspection perio _ _ _ _ _ _ - - _ - - - _ _ _ _ _ _ _ - - - -