IR 05000423/1989014
| ML19327B511 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 10/16/1989 |
| From: | Haverkamp D NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML19327B509 | List: |
| References | |
| 50-423-89-14, IEB-88-009, IEB-88-9, IEIN-80-21, IEIN-85-080, IEIN-85-80, NUDOCS 8910310326 | |
| Download: ML19327B511 (20) | |
Text
{,
..
'
,
.
,-
'
'
d
.
[
,
i U.S. NUCLEAR REGULATORY COMMISSION
REGION I
b L
Report No.
50-423/89-14 Docket No.
50-423 License No.
'
i Licensee:
Northeast Nuclear Energy Company P.O. Box 270
. Hartford, CT 06101-0270 Facility Name: Millstone Nuclear Power Station, Unit 3
-
.
.
Inspection At: Waterford, Connecticut Inspection Conducted:
July 18 through ' August 28, 1989 Reporting Inspector:
K. S. Kolaczyk, Resident Inspector, Millstone 3
-
Inspectors:
W. J. Raymond, Millstone Senior Resident Inspector K. S. Kolaczyk, Resident Inspector, Millstone 3 D. H. Jaffe, Project Manager, NRR S. Hou, Mechanical Engineer, NRR
,..
NRC-Contractor G. DeGrassi, Brookhaven National Laboratories
'
Approved by:
Q Cc)wa bk
/o//d,//d I'
Donald R. Haverkamp, Chief, Date Reactor Projects Section 4A
Division of Reactor Projects
,
i Inspection Summary: Routine Inspection by Resident Inspectors and Headquarte s~
L Personnel (Inspection Report No. 50-423/89-14)
Areas Inspected:
Routine onsite inspection at Millstone 3 during normal and backshift work periods (128 regular and 21 backshift hours, respectively) of plant operations; maintenance and surveillance; security; engineering and tech-nical support; and safety assessment'and quality verification.
Results: Overall, plant operations were conducted safely during the report period. One apparent violation was identified for a failure to notify the NRC of the cccurrence of an event which rendered a safety system inoperable (Sec-tion 6.1).
Weaknesses were identified in the failure to restore to service, in a timely manner, a radiation monitor required by technical specifications, and in Millstone Station emergency notification system communications (Section 4.1).
Two unresolved items were identified during this inspection period concerning rosemount transmitter failure probabilities (50-423/89-14-01), and restoration of post-maintenance diesel generator operability (50-423/89-14-02). (Sections 3.0 and 9.0, respectively.)
su188se8M8$gs Q
_. _ _.
__
_
_ _, -
w.
,
.
.
.
e-
.
,
.
I i.
TABLE OF CONTENTS
,
PAGE
,
1.0 Persons Contacted....................................................
I 2. 0 ' S umma ry o f Fa c i l i ty Ac t i v i t i e s.......................................
3.0 Status of Previous Inspection Findings'(92701*)......................
,
4.0 Review o f Facil i ty Activi ti e s (71707)................................
50 4.1 ENS Phone Communications at Millstone Station...................
'
4.2 Tour of Technical Training Facilities...........................
4.3 Main Feedwater Pump' Seal Failures...............................
i 4.4 Inoperable Steam Generator Blowdown Radiation Monitor...........
4.5 P l a n t Sy s t em Wa 1 kd own s..........................................
4.6 Auxiliary Feedwater System Check Valve Leakage...................
5.0 Plant Operational Status' Reviews (71707, 93702)......................
5.1 Review of Plant Incident Reports (PIRs).........................
5.2 Facility Tours..................................................
5.3 Plant Security..................................................
-
6.0 Facility Event Review (93702)........................................
6.1 ' Fuel Bc11 ding Integrity.........................................
6.2 Reactor Building Component Cooling Water Relief Valve Lifts.....
7.0 Licensee Response to NRC Initiatives (93702).........................
7.1 Storage of Transient Equipment in Safety-Related Areas (TI 87-03)....................................................
7.2 Audit of Bulletin 88-09 Actions Regarding Thimble Tube Wear.....
8.0 Review of Licensee Event Reports (LERs) (93702)......................
9.0 Maintenance (62703)..................................................
,
10.0 Surveillance (61726).................................................
10.1 Emergency Generator Fuel Oil Transfer Pump Operational Readiness Test..........................................................
10.2 Boric Acid Pump Operability Test................................
11.0 Management Meetings (30703)..........................................
- The NRC Inspection Manual inspection procedure (IP) that was used as inspec-tion guidance is listed for each applicable section.
,
U
.
.
. g
..
,.
.,
,
DETAILS 1.0 Persons' Contacted Inspection. findings were discussed periodically with the supervisory and manageinent personnel identified below:
e S. Scace, Station Superintendent C.. Clement, Superintendent, Unit 3 M. Gentry, Operations Supervisor R. Rothgeb, Maintenance Supervisor K. Burton, Staff Assistant to Unit Superintendent J. Harris, Engineering Supervisor D. McDaniel, Reactor Engineer R. Satchatello, Health Physics Supervisor M. Pearson,' Operations Assistant T. Burns, Chemistry Supervisor W. Buch, Emergency Preparedness Manager 2.0 Summary of Facility Activities At the beginning of the report period the plant was at 95% of rated power while the licensee examined condenser water box "B" for leakage.
Power was increased to 100% on July 17 after the water box was closed and filled.
During the period several power reductions were required due to balance of plant (BOP) problems, including outboard bearing seal failures on all three main feed pumps.
These failures, which occurred on August 9, 12, and 13, required power reductions of 50%.
(See section 4.3.)
3.0 Status of Previous Inspection Findings (0 pen) Inspection Report 89-04: Followup on Rosemount 1153 and 1154 Transmitters Operability Concerns The licensee responded to NRC Region I letter dated June 28, 1989, and the
enclosed inspection report 50-443/S9-04, Section 8.0, by letter dated
'
August 1, 1989. The submittal provided additional information regarding i
the continued operability of installed transmitters, an assessment of j
transmitter failure probabilities, and present licensee actions to monitor i
transmitter performance.
NRC review of licensee failure probability esti-mates is in progress and the results will be included in a subsequent in-
)
spection report.
The additional information confirmed previous NRC con-clusions that the Rosemount operability issue has apparently been addressed satisfactorily at Millstone 3.
The inspector also reviewed a licensee reportability evaluation dated August 1, 1989 initiated to assess whether undetectable failures of Rose-
!
mount transmitters and the finite probability of an undetected loss of
-
.
--
-
N
.
.
.
..
,.
'
i'
L reactor protection system or engineered safeguards system function was reportable to the NRC as a condition contrary to the requirements of 10
CFR 50, Appendix A, General Design Criteria (GDC) 21.
l GDC 21 states, in part, that "[T]he protection system shall be designed to permit periodic testing of its functioning when the reactor is in opera-tion, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred." The licensee concluded that the GDC was met and that no report to the NRC was required.
Inspector review noted that daily channel checks of safety related instru-
'
ment channels are required by the technical specifications and are relied upon during periods of plant operation to detect loss of channel function
' '
and loss of protection system redundancy. The inspector noted that the licensee conclusion that the item was not reportable was based on the present understanding of the loss of oil problem, testing techniques, and
the improved performance monitoring program that is in place.
Report-
'
ability under 10 CFR 50.73(a)(2)(ii)(B) is appropriate if it is concluded
!
that the plant did not meet its design basis due to an inability to detect I
degraded transmitters during performance of the required channel checks.
The inspector. concluded that compliance with GDC 21 is not obviously as-sured for those situations in which a channel check is not capable of de-
tecting a transmitter degraded due to a loss of oil. Undetectable degra-
.
dation of certain Rosemount transmitters is important to other users in
!
the industry and my be of generic concern. This issue will remain an unresolved item (50-423/89-14-01) pending completion of NRC staff review of the licensee's technical submittals and resolution of the reportability requirement evaluation.
4.0 Review of Facility Activities 4.1 ENS Phone Communications at Millstone Station
!
!
Periodically the inspector monitors licensee ENS notifications to the
!
NRC headquarters operations officer in Rockville, Maryland to assess i
the adequacy and accuracy of the reports.
The licensee is required i
'
to notify the headquarters operations officer of any event that oc-I curs as specified in 10 CFR 50.72.
The events specified in 10 CFR 50.72 vary from a shutdown required by technical specifications to a L
declaration of a site emergency as specified in the licensee emer-
'
gency plan.
Information that is received is asser, sed and analyzed by l-specific NRC offices which then decide what action, if any, is war-L ranted. These actions could range from development of a generic let-ter regarding an identified deficiency or dispatch of a special in-vestigative team.
,
_.
- -
.
D
,
k
-
,
!
.
.
.
.
,
.
r 3-
p
!
Therefore, it is important that the NRC operations officer receive information in a clear, concise manner from a knowledgeable indivi-dual.
If the information received is inadequate, the operations of-
'
ficer is required to ask additional questions until he understands
,
the event.
On July 18 at 4:26 p.m. the inspector monitored a Millstone Unit 2 ENS call.
The purpose of that phone communication was to report the
!
,
~
commencement of a plant shutdown required by technical specifica-
tions pursuant to 10 CFR 50.72(b)(1)(A). Plant shutdown was required since both diesels were declared inoperable. This event is described in Millstone Unit 2 inspection report 50-336/89-16, Section 7.0.
g Although the notification was made within the I hour time require-
-
ment, the individual making the notificatior, did not have a complete understanding of the event. Consequently, his presentation confused
.the operations officer who had to ask numerous questions which the person making the notification was unable to answer.
Eventually, the Unit 2 shift supervisor was placed on the circuit to clarify the communication. Thus, what should have been a brief notification required 28 minutes to complete.
This weakness has been noted by the inspector during other notifications and confirmed by interviews with shift supervisors at Unit 3.
The inspector was concerned that present communication skills were inadequate and could result in unnecessarily lengthy calls that could delay the transmission of vital information in an emergency.
The individual making the ENS notification was a shift supervisor staff assistant (SSSA). This position is staffed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day by engineers with limited nuclear experience.
Currently, Millstone 1 and 2 share one SSSA per shift, while Millstone 3, alone, has one SSSA per shift.
In addition to making ENS notifications, the SSSA operates the radio pager equipment used to notify offsite personnel of an event at Millstone, performs investigations of plant incident reports, moni-tors the performance of plant equipment, and performs administrative tasks as directed by the shift supervisor.
,
NRC Information Notice No. 85-80, dated October 15, 1985, establishes
'
the NRC position that personnel who make ENS phone communications should have sufficient knowledge of the event and plant conditions, and be properly trained to report the event.
The inspector reviewed an SSSA training plan at the Millstone site.
In order to qualify as an SSSA, an individual need only receive general employee training and instruction on the use of the radio L
pager equipment.
Once completed, the individual is permitted to stand watch. A subsequent instruction requires formal classroom training on plant specific systems, review of station emergency l
g
'
,
.
.
..;
.
,
-
f'
plans, and unit orientation tours.
This additional training facili-tates plant equipment operttor (PEO) qualification, ond completes the L
formal training plan. Qualification as a PE0 normally takes about six months from the time the SSSA begins shift work.
i After review of the training plan and observation of SSSA perform-ance, the inspector concluded that though sufficient for the majority of assigned tasks, the minimal training program does not offer the plant system or technical specification knowledge required to support ENS requirements in a satisfactory manner.
The inspector discussed his observations with the Unit 3 Superinten-
<
dont who agreed that the minimal training required for SSSA qualifi-
,
!.
cation does not provide sufficient system or technical specification knowledge to the SSSA.
Further, the station superintendent stated that SSSA training is being examined at Unit 3 and that the inspec-tor's concerns would be addressed.
The inspector stated that this concern is not confined to Unit 3.
The SSSA training program will be i
monitored by the inspector during future routine inspections.
4.2 Tour of Technical Training Areas The nuclear technical training facilities are located within the I
owner controlled area at the Millstone site and service all four
Northeast Energy Company nuclear plants.
The inspector toured the
'
training areas to familiarize himself with the facilities and per-i sonnel who are assigned there. Tours of the training areas revealed that they are well supplied with training aids including both working j
i l
and demonstration models.
This equipment varied from working electrical breaker stations, where breaker maintenance and trouble-i shooting techniques can be developed, to pump flow circuits, where l
thermal hydraulic laws can be demonstrated. The inspector noted that
!
the training labs could be of benefit to licensed and unlicensed l
personnel when a demonstration is required of plant equipment and theory of operation.
Through interviews with the technical training staff personnel, the inspector ascertained that each individual has a considerable amount of operational experience at the Northeast Utilities plants.
The inspector noted that this level of experience assists the instruc-tors in answering real time questions that students may ask in class.
The inspector concluded that Northeast Energy Company has a highly capable staff with a well-focused training agenda.
4.3 Main Feedwater Pump Seal Failures The inspector reviewed licensee actions to address three Byron Jackson main feedwater pump outboard seal failures in August, 1989.
The following mechanical seal failures occurred: "A" turbine-driven feedwater pump on August 10 - repairs (replacement of the mechanical seal package) were completed on August 11; "B" turbine-driven feed-
,
r n
-.
.
(
+ - * -
water pump on August 12 - similar repairs were completed on August 13; and, the motor-driven feedwater pump on August 13 - similar repairs were completed on August 14. Plant power operation continued through-out the evolutions.
The licensee normally uses both of the turbine-driven main feedwater pumps, each rated at 60% capacity, during routine operations at power.
The motor-driven feedwater pump, also rated at 60% capacity, is normally in standby and is put into use when a steam-driven pump is required to be taken out of service.
Plant load was periodically reduced to 60% power during the period from August 10 - 15 while work was in progress on the pumps. Although power generation was impacted by the seal failures, there was no known impact on plant safety.
,
The inspector noted that the seals had been replaced on all three pumps during the recently completed refueling outage.
Further, dur-ing the startup from the outage a seal on the "A" turbine-driven feedwater pump failed and had to be replaced.
Leakage from the seals
.
is collected and routed via a drain system to a turbine building col-
'
lection tank.
On August 13, plant operators noted that leakage from the motor-driven pump seal exceeded the capacity of the collection
-
system and.resulted in some spillage onto the turbine operating deck.
The leakage then spilled down a level to the top of the main genera-tor cooling control panel causing an annunciator power supply to fail.
No other operational problems were noted.
Analysis of previous failures by Borg-Warner, the seal manufacturer, revealed the cause to be high temperature.
Initially it was determined that the high temperatures were caused by insufficient cooling water flow to the seals.
Licensee efforts to address this issue consisted of developing a seal injection system from the dis-charge of the condensate booster pump.
This modification was added during the first refueling outage and increased seal injection flow from 2.5 to 5 gpm. However, seal failures due to thermal fatigue continued to occur during the second operating cycle at a reduced frequency. The licensee 4-currently experimenting with a higher temperature silicon-based seal rather than the tungsten carbide seal now in use. Two silicon seals were installed during the second re-fueling outage.
One failed on startup.
However, this failure was attributed to improper installation and not excessive heat. The re-L maining seal continues to function properly. The licensee intends to procure additional silicon-based seals for further examination. A final option being considered is use of a seal with an integral cool-ing system.
Current seal injection temperature is 114 degrees F.
It is hoped that the new system will reduce injection temperatures to 100 degrees F.
The inspector reviewed specifications for the feed pump seals and verified that the licensee was operating them within design para-meters. Through conversations with a plant maintenance engineer the inspector learned that different personnel had replaced the main
-
. -
--
p
,
[i L.
'
-
(
'e
.
m
,
'
,
feedwater pump seals during-the previous outage.
Therefore, the possibility of a common cause error has been discounted. The inspec-tor noted that although the probability of three seal failures within
,
a four day period is small, no evidence of improper operation was found. The inspector concluded that licensee actions to address the feedwater pump seal failures have been prudent and reasonable and that no safety concern exists.
Seal performance at Millstone unit 3 will continue to be monitored during routine inspections.
4.4 Inoperable Steam Generator Blowdown Radiation Monitor
'
By constantly boiling water, steam generators collect and concentrate
.
impurities from the feedwater and condensate systems. To reduce the amount of impurities that collect in the generators, a blowdown sys-tem is installed. This system removes impurities by bleeding off a small amount of water from the bottom of the steam generators, where the impurities are most likely to collect, and directs the water through demineralizers to remove contaminants.
The concentrating action of the steam generators tends to collect any particulate isotopic material and thereby gives an early Indication of a-primary-to-secondary leak.
In order to monitor for leakage at Millstone Unit 3, a radiation monitor, 3SSR-RE08, is installed in the steam generator blowdown piping.
This detector samples the blowdown effluent from all four steam generators in a sequential pattern, i.e., one generator is sampled for 15 minutes, then the next, until all four are sampled and the sequence is repeated.
In the event that activity is detected, an alarm is sounded in the control room alert-ing operators. The steam generator blowdown path to the condenser is automatically isolated.
,
,
Millstone Unit 3 technical specification 3.3.3.9. requires 3SSR-RE08 to be in service when the pathway is being used, except that outages are permitted for a minimum of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for the purpose of maintenance, performance of required tests, checks, and calibrations, or sampling.
If the monitor is not operable, the technical specification action statement allows effluent releases from this pathway to continue provided best efforts are made to repair the instrument and that grab samples are taken to measure steam generator blowdown activity.
These samples are required to be taken at twelve-to-24 hour intervals based on the reactor coolant activity. The action statement further directs the licensee to exert best efforts to restore the inoperable instrumentation to operable status within 30 days and, if unsuccessful, to explain in the next semi-annual effluent release report why the inoperability was not corrected in a timely manner.
While examining the radiation monitor panel in the control room, the inspector noted that steam generator blowdown monitor 3SSR-RE08 was inoperable. The inspector examined the SS log book and verified that the inoperable condition and the appropriate technical specification action statement were logged, and that grab samples were being taken.
.
--
m
_.
,
.
x.
[
.c
..
.
.
.
,
o,
5:
..
F Through conversations with licensee personnel, the inspector learned
!
that the steam generator radiation monitor had never been declared operable since the commencement of commercial operation in April,
.
1986. The inspector did not consider that best efforts had been
'
. exerted by the licensee to place this monitor into service.
The inspector reviewed licensee semi-annual effluent release reports for the periods January-June and July-December,1986.
No. reference to the inoperable radiation monitor appeared in the former report as i
required by technical specifications.
In the latter, the monitor was reported to be out of service, but no explanation why the inoper-ability was'not corrected in a timely manner was offered. The in-spector noted that the licensee has neglected to provide to the NRC updated status reports on this instrument in subsequent semi-annual i
,
reports, and was concerned that a reporting requirement had not been
'
fulfilled.
The inspector discussed his concerns with the chemistry supervisor who acknowledged that the statement in the effluent release report does not explain to the NRC the status of the monitor. He indicated to the inspector that this would be changed.
He further stated that the NRC had not been notified of the radiation monitor status in the January - June report because his staff had interpreted the technical
!
specification notification statement to mean the July to December report period.
The inspector informed the chemistry supervisor that for an instrument out of service in a January-June time frame, that period would constitute the "next effluent report" period. The
..
chemistry supervisor acknowledged the inspector's observation.
L Through conversations with the system engineer, the inspector learned l
that the radiation monitor has been out of service because of insuf-L ficient blowdown sample flow to the monitor.
In early 1986, licensee efforts to increase sample flow by increasing the diameter of the
sample piping and components were unsuccessful, and further attempts to resolve the issue were delayed by changing priorities.
The safety significance of this inoperable monitor is small. Since all blowdown water is directed, normally, to the main condenser for reuse, water is not released to the environment.
If primt.ry to secondary leakage were to occur, radiation monitor 3 ARC-RE21, which monitors the air ejector vent, would detect the leakage after a period of time.
Finally, the licensee is taking the required grab samples at the appropriate intervals as required by technical i
specifications.
Nevertheless, reliance on redundant instrumentation and backup pro-cedures to compensate for inaction to repair or modify equipment required by technical specification is a poor practice. The health and safety of the public is assured, in part, by a multi-layered system which depends on operable plant equipment. While allowing a reduced level of instrumentation designed to mitigate a tube leak
.
.
.
~-
. c
.
,
,
event for a short period of time, the technical specifications are
not intended to facilitate delay by a licensee. Having a technical
'
specification - required radiation monitor out of service for 3.5 years 1s indicative of uncharacteristically weak performance in the area of engineering and technical support. The inspector discussed his concerns with the station superintendent who agreed that having a radiation monitor out of service for 3.5 years is unacceptable. He also agreed that the statement contained in the effluent monitoring report should be updated to better' identify to the NRC the actual status of the radiation monitor. The inspector noted that station management responded quickly to the inspector's concerns regarding
-
the radiation monitor, and at the end of the report period, plant
-
personnel were working on restoring the monitor to service. Licensee corrective actions taken to restore the monitor to service, and to accurately report its status to the NRC constitute an unresolved item. (UNR 50-447/89-14-01)
4.5 Plant System Walkdowns The inspector performed a walkdown of the emergency diesel fuel oil transfer system and verified that system 1;neups were correct, piping
and components were assembled in accordance with plant drawings and components were properly labeled.
No deficiencies were identified, but the inspector did note several small leaks from the
"A" fuel flow transmitter located in the fuel oil storage tank vault. The inspec-tor reported these leaks to a maintenance supervisor who initiated trouble reports to document the deficiencies. The inspector observed that since this piping is located within a locked, underground vault, it is unlikely that these leaks would have been identified unless performing a system walkdown or periodic inspection tour. In this specific case, the identified leaks were minor and did not present a significant operational safety or fire hazard.
Nonetheless, the in-spector considered that it would be a good practice to closely ex-l amine piping in areas where access is limited whenever access to those areas is granted.
The condition of equipment in areas where cecess is limited will continue to be monitored by the inspector.
4.6 Auxiliary Feedwater System Check Valve Leakage i
By letter dated July 7, 1989, the NRC staff granted the licensee's L
request for relief from ASME code requirements associated with re-l verse flow closure of check valves on the discharge side of the auxiliary feedwater (AFW) pumps. The relief was issued on condition that the licensee institute a program to monitor the temperature of the AFW piping downstream of the pumps; the NRC staff was concerned that backleakage of feedwater into the AFW system would expose AFW piping and supports to temperatures in excess of design values.
The inspector reviewed OPS Form 3670.2-1 Rev. 8 CH4, "Outside l
Rounds", which included a new requirement that each shift monitor the temperature (by hand touch) of the AFW piping at each of the four i
t
,
.
.
-
_
,
[
t-
,
I
'
.
I p
,.
,
!
L
I.
containment penetratiuns. Upon initiation of the AFW pipe temperature monitoring program, the licensee found that the AFW piping at the "D" i
E steam generator containment penetration was experiencing temperatures
'
of approximately 180 degrees F. At the same time the other three steam generator containment penetrations were found to have a tem-perature of approximately 90 degrees F. To cool the subject penetra-tion piping, the licensee has been injecting water into the "D" steam generator on a daily basis by running an AFW pump. Since the tem-
'
perature of the piping between the subject penetration and the AFW
,
<
pump is not elevated, the licensee assumes that no downstream leak
'
path exists. The licensee is currently determining the short term AFW temperature limits via a detailed stress calculation; the long term temperature limit is 100 degrees F. Until the short term AFW' piping temperature is determined, OPS Form 3670.2-1 will have a temperature limitation of 150 degrees F which will be determined by use of a
. hand-held pyrometer. The licensee will investigate the source of the backleakage during the next cold shutdown. The licensee will also make a procedural change to address remedial actions to be taken for
elevated AFW piping temperatures. The licensee's procedures currently l
only address elevated temperatures at the AFW pump discharge.
'
Finally, the licensee will cerrect the source of the feedwater back-leakage (most likely two leaking, upstream, check valves) during the next cold shutdown. The licensee's handling of the AFW backleakage problem was considered adequate by the inspector.
The licensee's progress 6 resolving this problem will be monitored during routine resident %spection.
5.0 Plant Operational Status Reviews
The inspector reviewed plant operations from the control room and reviewed
!
the operational status of plant safety systems to verify safe operation of I
the plant in accordance with the requirements of the technical specifica-tions and plant operating procedures. Actions taken to meet technical specification requirements when equipment was inoperable were reviewed to verify that limiting conditions for operations were met.
Plant logs and control room indicators were reviewed to identify changes in plant opera-tional status since the last review and to verify that changes in the
,
status of plant equipment were properly communicated in the logs and records.
Control room instruments were observed for correlaticn between channels, proper functioning, and conformance with technical specifica-
!
tions. Alarm conditions in effect were reviewed with control room opera-p
- .
tors to verify proper response to off-normal conditions and to verify that I
operators were knowledgeable of plant status. Operators were found to be l.
cognizant of control room indications and plant status.
Control room man-ning and shift staffing were reviewed and compared to technical specifica-l tion requirements. No inadequacies were identified. The following speci-l fic activities were also addressed:
l l
(,
'
e s
~*
.
,6 *
.
'
!
5.1 Review of plant Incident Reports The plant ' incident reports (PIRs) listed below were reviewed during the inspection period to (i) determine-the significance of the
.
events; (ii) review the licensee's evaluation of the events; (iii)
E verify that the licensee's response and corrective actions were
.
proper; and, (iv) verify that the licensee reported the events in accordance with applicable requirements. The PIRs reviewed were:
3-89-60, 3-89-82, 3-89-115, 3-89-130, 3-89-132, 3-89-134, 3-89-135, 3-89-136, 3-89-137, 3-89-138, 3-89-139, 3-89-140, 3-89-141, 3-89-143, 3-89-144, 3-89-145, 3-89-147, 3-89-149, 3-89-150, 3-89-151, 3-89-152, 3-89-153, 3-89-154, and, 3-89-155. PIR 3-89-82, and 3-89-115 are
,
l discussed further in detail 6.1 of this report.
5.2 Facility Tours The inspector toured the entire Millstone 3 site during this inspec-tion period. He noted that plant housekeeping has improved since the completion of the refueling outage.
The inspector observed that
'
areas mentioned in his previous report as requiring attention, such as the recirculation spray system (RSS) and recirculation heat re-moval-(RHR) system cubicles, were clean.
The inspector will continue to monitor licensee housekeeping efforts in less frequently traveled areas.
5.3 Plant Security The inspector toured the Millstone site perimeter monitoring guard performance and noting the condition of the protected area fence and surveillance cameras.
The inspector also interviewed guards sta-
,
tioned at designated posts and in the secondary alarm station.
Dur-ing his tour, the inspector questioned guards who had been placed in areas as a compensatory measure when a protected area boundary was
,
compromised. The inspector found the guards knowledgeable of their responsibilities and attentive. However, on one occasion while con-ducting a tour of the protected area, the inspector noticed an in-attentive security guard in a trailer used for break periods. Though not serving as a compensatory watch over a protected area, he was on duty as an armed responder.
The inspector notified the licensee of his observation and the guard was relieved and disciplined by the licensee's security contractor.
L i
During the tour, no defects in the protected area boundary fence were l
observed. Detection aids also appeared to be functioning properly.
i The inspector had no further questions regarding security at the
'
Millstone site.
l l
1'
I l
.
.
.-.
--.-
---
-
V
..
u
.
c
.
r-
.
.-
,
!
!
6.0 Facility Event Review
'
6.1 Fuel Building Integrity
. The inspector reviewed plant incident report (PIR) 3-89-62 and PIR 3-89-115.
Both reported an unintentional violation of fuel building integrity which resulted when fuel building rollup doors were opened.
When a fuel building rollup door is opened, the pressure that is maintained by the emergency ventilation system is effectively elimi-nated in the fuel building, which makes the ventilation system in-operable.
Plant technical specification (TS) '.9.12.b. requires the re-dundant fuel building ventilation trains to be operable, during any evolution involving movement of fuel within the storage pool or crane operations with loads over the storage pool when irradiated fuel is in.the storage pool.
If the ventilation system is inoper-
'
able, fuel movement must be suspended.
l A negative pressure in the fuel building is required because, in the event that a fuel assembly is dropped in the building and a source term is generated, all particulate activity will be collected by the ventilation sistem.
The ventilation system will then pass the particles through charcoal filters which will remove the contaminants and thereby lessen the release of radioactivity to the environment.
The first incident was documented in PIR 3-89-62 on May 24, 1989.
Security personnel opened fuel building rollup door 327 in order to allow refueling equipment to be moved into the fuel building.
Reac-tor engineer personnel in the fuel building noticed that the door was opened when they heard the warning beep of a forklift truck. When they investigated the source of the noise, they found the door open.
A new fuel assembly was being lowered into a storage rack was fully
,
inserted and fuel movement was halted in accordance with TS 3.9.12.b.
'
Investigation of the event by the licensee identified that personnel miscommunication was the cause.
The security console operator stated that he called the shift supervisor (SS) and obtained permission to open the door.
However, the SS reported that security never asked for permission. The specific cause of this miscommunication was not determined.
Licensee corrective action to prevent recurrence consisted of:
Posting signs at the fuel building doors which state that the SS
--
and security must give permission prior to opening the docrs.
Revising fuel handling procedures to require danger tagging
--
doors shut when fuel building integrity was required.
Implementing a policy for operations personnel to notify secur-
--
ity when fuel building integrity is required.
_
__
F
.;
,
,
.
.
L
c
..-
i l
.
p
-
.-
L Establishing a security log to record times when permission is o
--
granted from the SS to open or block doors at the station.
Modifying work orders to identify fuel building integrity doors,
--
t Modifying procedure ACP 7.09, Requests for Security Door / Gate
--
Coverage, to correctly identify which doors require security coverage.
This event was reported through the station's PIR system. Through discussions with personnel from the security, operations and engi-neering departments, the inspector concluded that the investigation was sufficient, the corrective actions taken were adequate and that the personnel who were moving fuel at the time of the event acted properly by suspending fuel movement.
However, 10 CFR 50.73(vii)(c) requires that the NRC be notified by submitting a licensee event report (LER) whenever an event occurs '
which renders inoperable two independent trains in a single system designed to control the release of radioactive material.
This report is required to be submitted within 30 days of occurrence. The licen-
'
see failed to submit a report.
This is a violation (50-423/89-14-01).
The inspector discussed the reporting criteria with the unit opera-tions and engineering superintendents. They stated that since the
-
technical specification action statement requirements were met, and since the event had minor safety significance, no LER was required.
The inspector stated that this position is incorrect. Although the technical specifications were complied with, an event did occur which rendered bnth trains of the fuel building ventilation system inoper-a'al e.
Compliance with technical specification action str.tements does not relieve the licensee of its responsibility to report the event to the NRC.
The second violation of fuel building integrity occurred on June 23, 1989 and was documented in PIR 3-89-115.
During this event, a supervisory security guard was dispatched to obtain the keys for rollup door 329, which is located in the decontamination area of the fuel building. When the security guard obtained the keys, he opened, then shut door 329.
The door was opened approximately three to four inches to test the operability of the door, a standard procedure prior to fully opening a security door.
In this instance, mainte-nance requested that the door be opened so that equipment could be moved out of the decontamination area.
The security guard who opened the door never received permission to do so from the security console operator.
Instead, he mistakenly believed that when he was requested to obtain keys for the door, he was also given permission to open it.
-~
,
-
.
..
,
.
.:
.
..
,,' -
!
..
I3 t
L F
This occurred in spite of the fact that warning signs were posted stating that the SS and security must give permission to open the door and that the doors were red tagged shut. The installation of I
warning signs and tagging shut of rollup doors was taken as a result
.
of the previous incident. When questioned, the guard acknowledged
'
that he saw the tags, but opened the door anyway. At the time of the event, fuel building integrity was required because of spent fuel
. movement in the fuel building.
However, since the rollop door was opened only 3 to 4 inches then quickly shut, negative pressure in the
,
fuel building was unaffected; and the ventilation system therefore was not rendered inoperable; consequently, no LER is required.
Licensee corrective actions were to:
t PeempMsize to security supervisors in the guard force the im-
--
portance of danger tags.
Instruct personnel in the guard force to obtain permission from
--
the Central Alarm Station (CAS) prior to taking any action on a door.
Notify CAS of any signs in the area before a security guard is
--
to take any' action on a door.
As part of the review of this incident, the inspector interviewed
>
several security guards and verified that they had a correct under-standing of the station tagging requirements.
He also verified that required corrective actions implemented as a result of the first
incident were in fact being done.
The inspector verified that the warning signs were properly posted, ACP 2.02, Work Orders, was being revised, a memorandum was sent to the security supervisor and a log was established by security. However, the inspector noted that engi-
.
neering personnel had not updated their procedures as of August 31, even though there was a requirement to do this by September 1, 1989.
-
Also, interviews with the security supervisor, reactor engineer personnel, and operations personnel revealed that there was confusion concerning how security was to be informed when fuel building integrity was required. These two issues were discussed with the unit superintendent and engineering supervisor. The engineering supervisor agreed that due to other commitments, his department neglected to update the procedures and that personnel were now in the process of updating them.
The unit superintendent stated that security would be notified at the morning meeting when fuel building integrity was required, and he stated that the implementation of these corrective actions could have been tracked bette h
y
..
-
.
.g-
,
i
The inspector noted that the corrective actions taken in both inci-dents were adequate; however, the corrective actions were not imple-mented in a timely manner in all cases. The inspector will continue
.
to monitor the timely implementation of corrective actions in future
'
inspections.
6.2 Reactor Building Components Cooling Water Relief Valve Lifts
,
On August 21, while shifting reactor building components cooling water (RBCCW) pumps, an RBCCW relief valve lifted on the' reactor coolant pump "A" oil cooler. Approximately 400 gallons of water
,
spilled into the containment sump before the relief valves reseated.
The lifting of RBCCW relief valves when shifting system pumps has been documenteo previously in Millstone Unit 3 Inspection Report No. 50-423/89-11.
Licensee actions to resolve this system deficiency will be monitored by the inspector during routine inspection.
7.0 Licensee Response to NRC Initiatives 7.1 Storage of Transient Equipment in Safety-Related Areas (TI 87-03)
NRC Information Notice No. 80-21 (IN 80-21), dated May 16, 1980, raised a number of issues associated with the seismic design of nuc-lear power facilities including the temporary use of non-seismic equipment such as tool storage cabinets and scaffolding. The licensee responded to IN 80-21 by making changes to their housekeeping program as described in procedure ACP-QA 4.01, Plant Housekeeping. Sec-tion 6.4.7 of the subject procedure requires the following considera-tions when working in safety related areas:
Temporary ladders are to be secured to prevent interaction with
--
safety-related equipment.
Unattended equipment mounted on wheels is to be secured by
--
chocks, locked wheels, or curbs.
Equipment with a high center of gravity is to be secured against
--
tipping.
Staging or scaffolding should be erected and secured in accord-
--
ance with ACP2.19, " Scaffolding Program". Section 6.5.2 of ACP-2.19 contains requirements to prevent scaffolding from tipping or sliding.
Equipment is not to be stored such that a falling hazard is
--
created (e.g. a tool box stored above safety-related equipment).
Cranes are to be secured against swaying or swinging interaction
--
with safety-related equipment.
The inspector considers the above provisions to be responsive to the concerns in IN 80-21 regarding storage of transient equipment in safety-related areas.
-
(-
e
.
h
.,
.
.,.s-
[
"
!
Safety-related areas of Millstone Unit 3 were inspected and deter-mined generally to be in compliance with regard to ACP-QA-4.01. How-t ever, the following conditions were noted:
Chain falls consisting of a chain / pulley assembly on an overhead
--
trolley are routinely used in safety related areas. The licensee does not routinely secure this equipment. The inspector noted that chain falls in the charging pump cubicles, the steam valve building, and the emergency diesel generator rooms should be secured.
Gas bottles near the containment spray-additive tank should be
--
secured.
Equipment mounted on wheels in the basement of the steam valve
--
building should be properly secured against rolling.
These items were brought to the attention of a licensee maintenance
supervisor who secured the equipment. The inspector was told that
'
the licensee is currently preparing instructions to secure chain falls in safety-related areas.
The inspector considered that un-secured equipment in the basement of the steam valve building was an isolated example of a procedure violation of minor safety signific-ance and nad no further questions in this area.
7.2 Audit of Bulletin 88-09 Actions Regarding Thimble Tube Wear On July 25 and 26, 1989, personnel from the Nuclear Reactor Regula-tion (NRR) Mechanical Engineering Branch and a contractor consultant
from Brookhaven National Laboratories conducted an audit at Millstone Unit 3 of incore thimble tube wear. The purpose of this audit was to
review the licensee's activities related to NRC Bulletin 88-09, Thimble Tube Thinning in Westinghouse Reactors. Specifically, this bulletin requires the establishment of an inspection program to moni-tor thimble tube degradation. The program should include the estab-lishment, with technical justification, of appropriate acceptance criteria, inspection methodology and inspection frequency. The pro-gram should be implemented in accordance with the schedule given (next refueling outage for most plants), and corrective actions should be taken for deficiencies which fail to meet the established acceptable criterion.
Millstone Unit 3 performed eddy current testing of thimble tubes dur-ing the first refueling outage in December,1987 and during the second refueling outage in June, 1989.
The first thimble tube in-spection revealed wall loss ranging from a few percent to approxi-mately 40% in 27 of 58 cases. As a result, one tube with 40% wear was capped and six tubes with wear between 24% and 40% were reposi-tioned.
The second inspection revealed additional tube wear with a maximum of 58%. The tube with this wear was capped and two tubes with over 40% wear were repositioned.
One of the two repositioned
.
_-
-
,
<
.
.
.
<
- .;.
'
'
e
I tubes had already been repositioned after the first inspection.
'
L Based on the two inspections, tube wear appears to be random and un-predictable.
Some tubes with significant wear during the first cycle
!
had'no additional wear during the second cycle, while some tubes with p
insignificant wear during the first cycle showed substantial wear during the.second cycle. The licensee plans to repeat eddy current
'
testing during the third refueling cycle in December,1990.
I As a result of the audit, the inspector concluded that the licensee
~
has defined and implemented an adequate inspection program responsive to bulletin 88-09 requirements.
However, it was noted that the lic-ensee has not taken any long term corrective actions. If a thimble tube should develop a leak, the reactor would have to be shut down, cooled down and drained to below seal table level in order to stop
,
the leak.
This action would take approximately 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and, assum-ing a five gpm leak, would spill approximately 14,000 gallons of reactor coolant into the seal table room. Although this would not create a safety concern (available pumps have a makeup capacity of 300 gpm), the leak would result in a radiological and contamination cleanup problem.
Due to the. uncertainties involved in inspection technology and wear mechanisms, the inspector concluded that a licensee proposed installation of magnetic isolation ball valves on the thimble tubes is a prudent design modification that would prevent the an unisolable leak and, therefore, should be implemented expedi-tiously. The inspector discussed this conclusion with the licensee engineering superintendent who stated that this modification is currently being evaluated by the licensee staff.for installation during a future outage.
Further review of the results of this evaluation and licensee implementation of inspections and corrective actions will be performed as part of the routine inspection program.
8.0 Review of Licensee Event Reports (LERs)
Licensee Event Report- (LERs) submitted during the report period were re-viewed to assess LFR accuracy, the adequacy of corrective actions, compli-ance with 10 CFR N.73 reporting requirements and to determine if there were generic implications or if further information was required.
Selected corrective actions were reviewed for implementation and thorough-ness. 'The LERs reviewed were:
LER 89-15, Inoperable Emergency AC Distribution.
--
LER 89-07, Control Building Ventilation not placed in Filtered
--
.
Recirculation LER 89-16, Missed Fire Detection Surveillance
--
No deficiencies were noted by the inspector.
- -.
.
.
.
-
-
!
.
+ -
,
. -.
'
l
' 9.0 Maintenance
,
i The inspector observed g rtions of maintenance being performed on "B" diesel generator support systems in preparation for performance of routine preventive maintenance on the "A" diesel generator. The "B" diesel gene-rator was run as required by Technical Specification 3.8.1.1 to verify that it was operable prior to taking the "A" diesel generator out of ser-vice. While the "B" diesel generator was being run, a service water heat
+
exchanger high. differential pressure, indicative of a fouled condition, was observed, and an engine water jacket high temperature alarm was received.
The "B" diesel was secured and work requests were generated to clean the "B" diesel generator service water heat exchanger and trouble-shoot the water jacket temperature regulating valve.
The inspector verified that the personnel performing work on the service water heat exchanger and troubleshooting the water jacket te'mperature controller were knowledgeable of their responsibilities and properly
following procedures.
The inspector observed both jobs for several hours
'
and verified that good shop practices were being followed.
After completion of the maintenance activities, the inspector noticed that the SS exited the limiting condition for operation (LCO) and declared the diesel operable prior to running the diesel. When the inspector questioned these actions, he was told that the actual maintenance that was performed on the diesel, i.e. cleaning of the service water heat exchanger and troubleshooting of the water jacket heat exchanger controller, did not render the diesel inoperable, since the heat exchanger was leak tested
,
satisfactorily when work was completed and no work was done on the water jacket temperature controller.
Further, when the diesel was isolated for work, only the unit control power fuses were removed and the diesel gene-rator breaker was not repositioned.
Therefore, only the fuses had to be reinstalled to restore the unit to operability.
The need to run the diesel generator after reinstallation of control power fuses remains an unresolved item pending further review by the inspector. (50-423/89-14-02)
10.0 Surveillance The inspector observed portions of surveillance tests to assess perform-ance in accordance with approved procedures and limiting conditions of operation; removal and restoration of equipment; and deficiency review and resolution.
10.1 SP-3646B: Emergency Generator Fuel Oil Transfer Pump Operational Readiness Test The inspector observed portions of the "B" & "D" emergency diesel generator transfer pump operational tests. The purpose of this test is to verify that pump vibration, discharge pressure, and flow is within specification while the pump is recirculating the contents of the diesel fuel oil storage tank.
- - -
.
_
.
n
,
o
-
.
..
{c.
.
.,
.A.'
,
Prior to performance of the test, the inspector verified that the valve lineup was satisfactory, that personnel were using up-to-date procedures and that electrical jumpers were installed correctly.
During the performance of the test, the inspector noted that the in-service inspection (ISI) technician was measuring pump shaft axial
,
vibration using a meter that was out of calibration. The inspector questioned the technician on this issue and was told that pump shaft axial vibration is not required to be taken and that calibrated instruments were being used to. measure axial and parallel motor
vibration, as required. The technician further stated that pump axial vibration was being taken for his own benefit to get a " feel"
'
for how the pump was running and that the data obtained would be kept for historical purposes only.
The inspector reviewed Section XI of the 1983 ASME Code and verified that pump axial vibration measure-ments are not required to be taken.
However, the inspector cautioned the technician that measurements taken with an out of calibration instrument.normally could not be used for anything but information purposes.
The technician acknowledged the inspectors concerns and the inspector had no further questions.
10.2 SP-3604C.1: Boric Acid Pump Operability Test During the second refueling outage, the "A" boric acid transfer pump was overhauled offsite by a vendor.
To verify that the pump'was in-stalled correctly, an operability test is required to be performed.
The inspector observed the performance of surveillance procedure 3604.C.4 which is used to prove operability of the pump. Operability is determined by energizing the pump and verifying that it develops rated flow and discharge pressure, while not vibrating excessively.
The inspector verified that personnel were properly briefed, test equipment used was calibrated, valve lineups were correct, and pro-
,
cedures were being followed.
During the performance of the test, the
'
"A" boric acid pump failed to develop rated discharge pressure.
The test was stopped and a licensee investigation revealed that the pump
,
l was rotating backwards due to improper electrical lead installation.
?
The leads were reversed, and the pump test was rerun satisfactorily.
The inspector considered licensee actions to be appropriate and had no further questions.
11.0 Management Meetings l
L Periodic meetings were held with station management to discuss inspection findings during the inspection period. A summary of findings was also discussed at the conclusion of the inspection.
No proprietary information l
was covered within the scope of the inspection.
No written material was L
given to the licensee during the inspection period.
l l
l L
1'
'
.
.
.
.