IR 05000423/1990008
| ML20055F548 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 07/03/1990 |
| From: | Haverkamp D NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20055F546 | List: |
| References | |
| 50-423-90-08, 50-423-90-8, NUDOCS 9007180013 | |
| Download: ML20055F548 (25) | |
Text
{{#Wiki_filter:, . _ - - - - , , - ,
-
_
-' '
iW
}REVImmEYah
," MOML0 1(3:23)
* NG51NP"'Mqph,%s3 - (sic:arxz) , ,
i US
' . yg4L - (beg.sg. < : CkJsA.44$ CLEAR:REGULATORYCOMMISSION e
M 010N I ( o s ot. m n W > UUDCI)
. Repert No.:- ._S0-423/90-08-Docket No.: 50-423 License No, NPF-49 Licensee: Northeast Nuclear Energy Company P.O. Box 270 Hartford, Connecticut 06141-0270-Facility Name: Millstone Nuclear power Station, Unit 3 Inspection at: Waterford, Connecticut inspection r
Conducted: May 3, through June 11, 1990
'
Reporting 1 inspector: . i Kenneth S~ Kolaczyk, Resident Inspector, Millstone 3 i Inspectors: j i William J, Raymond, Millstone Senior Resident Inspector j Kenneth S. Kolaczyk, Resident Inspector, Millstone 3 Jennifer L. Dixon, Reactor Engineer, Operational . Programs l Section, Region 1 l
'
Douglas A. Dempsey, Resident Inspector, Millstone 1
}
Approved by: M 7h/fC bonald R. Haverkamp, Chief V Date Reactor Projects Section 4A -
Division of' Reactor Projects 1 Inspection Summary: 30-423/90-08) Inspection 'on S/3/90-6/11/90 (Inspection Report No.
b !
-
,
- Areas Inspected:
Routine onsite inspection at Millstone 3 during normal and i
;
backshift work periods of plant operations; maintenance and surveillance;
-: verificatio security; engineering and. technical support; and safety assessment and quality 'I i
.
I
j .I
;
i 9007180013 900703 3 PDR ADOCK 0500 Q
. . * 'i S., j . ! * .
I, ,
,
' Results:
:
-
- 1. - General Conclusions on Adequacy. Strength or Weak.,ess in Licensee Programs - See enclosed Executive Summary Violations l Two violations were identified during this report per,'o One violation
.
'
concerned.the: failure to inform the NRC in a timely manner when systems " were rendered inoperable. The other violation concerned operator u inattentiveness to procedures which caused an ESF actuation and rendered .
. redundant safety system trains inoperabl L
- Unresolved Items t
:'
During this report period, three unresolved items were closed, and qne item was updated. The closed items were: (1) item 86-35-01 concerning licensee- ' corrective actions taken to ensure correct resistance temperature table t are used; (2) item 88-23-02 concerning corrective actions taken to ensure 4 security event reports are made in a timely manner; and (3) item 88-23-03 regarding licensee corrective actions taken to vitalize the intake structure. . Item 85-62-02 was updated to document licensee inaction on the ; issu '
,,
r i
11 !
- - i
'
l'. ;..
-
,
,
. -)
.l
.
Executive-Summary Plant Operations Operator performance during this report period was inconsistent. As a result of not following procedures, an engineered safety features actuation occurred during a plant cooldown, and the high pressure safety injection system was-rendered inoperable during plant heatup. The NRC was not informed in a timely manner on two occasions when safety systems were rendered inoperable,.
,
;
Maintenance / Surveillance Improper torquing of the steam generator. handholes during previous maintenance activities. resulted in the development of handhole leakage which necessitated cooling down to Mode 5 to effectrrepair , Securit ) Reviews conducted in this area did not identify any substantial weaknesse Corrective actions taken for two violations were determined to be acceptable,
,
Engineering / Technical Support The licensee has not provided the inspector with sufficient information t close a five year old open ite , Safety Assessment / Quality Verification
;
The licensee has not been implementing technical specification license amend-ments withinf30 days of issuance, The delays in implementation ranged from 9 si days to 4 month ^ r 1[
>
f iii
,
_ y i h .' i. o+- -. -
- !
i . k
- .
l
:i ,
_ TABLE OF CONTENTS i Page 1.0 Plant Operations Review.............................
.
2.0 NRC Inspection Review............................... 1 3.0 .'iant Operations (IP 71707/71710/93702)*............ 2 3.1 Control Room Observations...................... 2 3.2 Plant Tours.................................... 2 l l 3.3 Engineered Safety Feature Actuations .......... 3
,' 3.4 Steam Generator Handhole Leakage Identified.... 4 r '3.5 Review of Plant Incident Reports ............... 5 l u 3.5.1 PIR 3-90-81, Both Trains of Hi
,
) Safety In,jection Inoperable..........gh.......... Pressure 5
: Reactor Trip Due _to Loss of Condens
-
,
V a c u um . . . . . . . . . . . . . . . . . . .............
..........er 9 3.7 Reactor Trip Due to Dropped Control Rod........ 10 3.8 Stand-by Readiness of. Engineered Safety Features-(ESF) Systems and System Walkdown. . . . . . . . . . . . . . 11 1 4.0. Observation of Maintenance Activities (IP 62703).... 12 5.0 Observation of Surveillance Activities (IP 61726). .. 12
;
6.0' Engineering / Technical Support (IP 37701/92701)...... 13 1
'
6.1 Engineering Support of Plant Operations. . . . . . . . . 13 6.1.1 (Closed) Unresolved Item 50-423/86-35-01 Incorrect Resistance Conversion Tables Used..... 13 , ! 6.1.2 (0 pen) Follow Item 50-423/85-62-08 Voice Page/ Evacuation Alarm Adequacy.................. 13 H
, 7.0 Security-(IP 71707/92701/92702)..................... 14 i 7.1 (Closed) Violation 50-423/88-23-03 Opening Between Vital and Protected Areas. . . . . . . 14 - 7.2 (Closed) Violation 50-423/88-23-02 Failure to Make a One-Hour Security Report. . . . . . . . . . . . 15 7.3' Security Concerns Investigated................ 15 7.3.1 Security Deficiencies Re (RI-89-A-0120)................. ported ......... 15 '
7.3.2 Concerns Regarding Entry into Cable , Vault Area (RI-89-A-0080) .............. 17 T-1
; i
-
..
7-
! . . . - . - .. : .- . -- . -.
-
. ,
~
.
Page 8.0 Safety Assessment / Quality Verification (IP 90712/71707).
- 18 .. 8.1 Technical Specification Amendment Implementation................................ 18 8.2 Periodic Reports............................... 19 8.3 Licensee Event Report Review................. 20 i 8.4 . Management Meetings..........................
* The NRC inspection manual inspection procedure (IP) or temporary instruction . (TI) that was used as inspection guidance is listed for each applicable-report sectio
r
'
>
i
)
t h
>
;
p.
l' I T-2 .}
;
_ _ . - _ _ _ _ - _ - - _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . - _ - _ _ - _ . _ _ _ _ _ _ _ - _ - . _ _ _ _ _ _ _ _
,
ll*}? ' * 'l . .; os
" . - ..
I < ? DETAILS e _ Plant Operations Review Millstone Nuclear Power Station Unit 3 (Millstone 3 or the plant). entered' the report period at 100% of rated thermal power. On May 10, operators-manually tripped Millstone 3 from 60% of rated thermal power when the 8 circulating' water pump automatically tripped due to high differenttal ; pressure across its traveling screen caused by stormy weather conditions. A post-trip containment entry identified steam leaks on steam generator ' handhole covers, which necessitated placing the plant in cold shutdown, Mode 5,. to conduct repair The repairs were completed on May 17 and
!
i plant heatup was begun, On May 20, the plant was taken critical and synchronized to the grid on May 2 ! Plant power ascension was halted at 75% power when the licensee l discovered'that
.tentl a power range nuclear instrument was reading incon.is-Af ter review of the instrument performance, the licensee subsequently recalibrated the instrument on May 24 and increased reactor power reaching 100% on May 2 '
.
On May 28, the licensee declared an Unusual Event emergency classification and commenced a: reactor shutdown when valve MV-8801B. failed a monthly slave relay test. Subsequent troubleshooting by instrument and controls 1
*
y technic'Sas isolated the defect to the test c'ircuitry, and the Unu'sual ' Event was terminated with reactor power at 69%. A power ascension was commenced and full power was reached on May 2 '; '
.On June 6, Millstone 3 automatically tripped on-high negative rate .
because of a' dropped control rod. The rod failure:was attributed to
.
corrosion buildup on a cable connector plug which attaches to the control rod coil stack. The corrosion buildup caused a wire lead to fail whic 'de-energized the rod gripping coil, and resulted in the dropped rod. The-
,
licensee subsequently repaired the connector and the plant was restarted on June 8. At the end of the report period, Millstone 3 was-holding-at 80% of rated power due to problems with feedwater heater-level control-
. valve _ NRC Inspection Review
i
' During the week of Juns 4, an NRC inspection team consisting of. regional and headquarters personnel conducted a training effectiveness revie Preliminary results did not identify any significant weaknesses. The;NRC team held an exit meeting on June 8 and their findings will be documented in inspection report 50-423/90-06, t
1 i
f,i...
:, ,e . . ,
The inspection activities during this report period included 175 hours of inspection during normal activity working hours. In addition, the revie *
,
of plant operations was routinely conducted during periods'of backshifts l-(evening shifts) and deep backshifts (weekends and midnight shifts), t ' Inspection coverage was provided for 15 hours during backshifts and 8 hours during deep backshifts. An exit meeting which presented the results
of this inspection was conducted on June 19,11990. .0 Plant Operations ' 3.1 Control Room Observations -
!
. The inspector reviewed plant operations from the control room and ' l
.. reviewed the operational status of plant safety systems to verify ' safe operation of the plant in accordant.e with the requirements of-p technical specifications and plant operating procedures. Actions lj}
l taken 'to meet technica' specification requirements when equipment was p inoperable were reviewed to verify that limiting conditions for E operation were-met.- ?lant logs and control room indicators were ;
' reviewed to identify c%nges in plant operational status since the ,1 l 'last review and to verify that changes in the status of plant equip- '
L -ment were properly communicated in the logs and records.
- 1
l ' Control' ro'om instruments were observed for correlation between -! channels, proper functioning and conformance with technical speci-
.fications. Alarm conditions in effect were reviewed with control room operators to verify proper response to off-normal conditions and to verify operators were knowledgeable' of p ant status. Trainees who
i were manipulating reactor controls were under instruction.by licensed , operator Operators were found to be cognizant of control room i
,
indications and plant status. Control. room manning and shift staf fing were reviewed and compared to technical specification requirements. No inadequacies were identified during steady state plant operations.
1 - 3;2 . plant Tours The inspector observed plant operations during regular
.. .and backshift tours of the following areas: 1 i -
L . Control Room Containment-L L
, Vital Switchgear Rooms Diesel Generator Rooms ESF Building Intake Structure Turbine Building Auxiliary Building
'
During plant tours, logs and. records were reviewed to ensure i
' compliance with station procedures, to determine if entries were correctly made, and to verify correct communication and equipment statu No inadequacies were noted, y
n
,, , '
laj i n, ,
'
y'
, ,
c '
m
'i
? - Engineered Safety Feature Actuations
!
Two engineered . safety features (ESF) actuations occurred while- , % setting plant conditions for steam generator-repair wor , k-The first ESF signal which occurred on May 12 at 9:06 a.m. was caused by 'a B steam generator high water level which resulted when the
'
a associated main steam isolation valve-(MSIV) was opened causing-a
'
water level swell. -The high water level, which went above the full-
'
indicated range, caused a feed water isolation signal to be gener- ' '~ ated. . However, no valves actually moved since -they were already in ' the closed position.
The cause of this. event was personnel ~ error,. The operator who opened the MSIVs did not rigidly adhere to OP3316, Main Steam System, ; which requires the operator to maintain less than a 25-pound differ- '2 ential pressure across the MSIVs before opening them. Rather, the
- .
differential pressure across the valves was 60-70 psid _ The high ,- dif ferential. pressure coupled with a faster opening "B"4 MSIV caused a ' rapid pressure drop inLthe' generator and-the resultant-water level swell. Failure to adhere to OP3316 is a violation of technical specification 6.8.1, which is discussed-further.in Section:3. ,
' :(50-443/90-08-01).
L<
' Prior to the actuation ~, a plant cooldown was in progress per opera-ting procedure 3202, Plant Cooldown. As part of a test to determine if the MSIVs could close within five seconds,at a reduced steam pressure and temperature, operators closed all four MSIVs. Th valves closed satisf actory; however, an adequatt plant -cooldown rate -
could not be achieved using the.MSIV bypass valves. Therefore, the-decision was made by the operators to reopen the valve ,
*
, During conversations-with the inspector,.the operators stated-that a significant steam generator swell was not expected with the reactor g at reduced temperature and pressure conditions of-350 degrees F and ' '..' , 400 psia. Therefore, the valves were opened with the higher than allowed differential pressur To prevent recuirence of the event, J the operations supervisor issued a memorandum to operators stressing the importance of rigidly adhering to' procedures during test The inspector noted the supervisor's actions.
! The second-engineered safety feature actuation was initiated when the level transmitter on the B steam generator was isolated but not equalized and removed from service. Consequently, when operators
l began a draindown of the B steam generator on.May'13 at 3:51 a.m., apparent seat leakage through isolation valve 3-FWS-154 caused the transmitter _ leg to drain. This caused the transmitter to reach an apparent low level on bistable 3-FWS-L552, which in conjunction with 1
.
bistable 3-FWS-L528 already being in the tripped position, completed l the two out of four logic that is necessary for an ESF auxiliary l feedwater pump start due to a low steam generator water leve L l lI l lb l l l
-
n r
'
b
.(:. ,
'(
4 i
,
Upon_ receipt ofl the AW pump Jtart, operators secured the draindown : land: stopped the AN pumps. Instrumentation and control technicians ' were-then called in to equalize the steam generator level transmit-ters which nullifies'the low = steam generator leve The-root-cause of the event was procedure deficiency. Specifically, i the. steam generator draindown procedure OP3316 did not provide _ instructions to the operators on when the steam generator level : transmitters should be taken out of service and equalized. Rather, the operators would be reminded of the necessity to isolate the transmitter +.hrough' use of a memo from the I&C departmen During previous' draindowns, when the level transmitters were isolated,'they were quickly equalized. However, during this event, a decision.was- ~ ' made to isolate the detectors, then begin the draindown during .the- -i . midnight shift. Ti e detectors would then be equalized sin the morning * when I&C personnel were-there. The need to proceduralize the evolu- " tion had already been recognized by an 1&C supervisor who'had drafted l a memo to- the operations' department recommending that the draindown !'
. procedure'be revised. The inspector determined that the procedurali-zation of this evolution should be adequate to prevent' recurrence and had no further question }
3.4 Stecm Generator Handhole Leakage Identified t
.
'i Following the May 10 reactor trip, a containment entry was performed ,
to locate the source of -increased -leakage into .the containment drai I tank (CDT). Investigations partiilly attributed the increased-leakage to be from the B power operated relief block valve _ and the
~ B loop-bypass valve stem leakoff paths, which were subsequently a isolated. However, the licensee also discovered a 360 degree cir- '
cumferential steam leak on a handhole cover on the B steam generator-and another slight steam leak on.-the C steam generator handhol Following' discovery of the' leaks, the licensee placed the plant ~ in -
~
cold shutdown to effect repair 'I According to a licensee maintenance engineer, the handhole leakage was attributed to a failure to obtain an adequate crush depth on the
,
'
handhole flexitallic gaskets using the Westinghouse (the nuclear steam supply system vendor) specified torque. valves. Therefore, a ' adequate metal-to-metal seating surface between the handhole cover and generator was.not obtaine ~ ,
,
Inspection of the 24 handbole covers located on the steam generator revealed that 15 did not have adequate metal-to-metal contact and had-to be either-retorqued or disassembled. One of the fifteen handholes was damaged sufficiently to require weld buildup. To achieve the optimum crush depths, the licensee retorqued the handhole bolts to revised Westinghouse specifications which increased the bolt torque value by 30 lbs. The bolts were then slugged until no movement was - noted. Subsequently, the bolts were removed, one at a time, lubri- l cated and then retorqued to the Westinghouse torque values. Final <
,
m
,.' . .-
[p ,
,
;
,
y ,
-
i ; p 5 ; i
. !
verification of satisfactory metal-to-metal contact was made through l use of an inspection mirror rather than a feeler gauge which was ' previously used. According to the engineer, the mirror is preferred over a faeler gauge since the thin gauge tends to distort due to the handhole geometry. This distortion is thought to have given false
,
l indications of satisfactory metal-to-metal contact when previous ' handhole repairs were made. Additionally, in a departure from 3 previous methods, the licensee retorqued the handhole gaskets 12 J hours after the final inspection to ensure proper seatin ; inspector review of this activity revealed that if an adequate test method had been initially developed to ensure metal-to-metal contact, the leakage may not have develope This is the second instance of handhole leakage extending a plant shutdown during this operating I cyclo. The inspector discussed this issue with the unit director who e indicated that the 'tillstone 3 handhole leakage problems are not t uncommon. According to the director, other facilities with identical generators have been able to ensure proper gasket seating by retorquing the handholes while in Mode 3. The director stated that th b option is Nss' viable at Millstone due to the sub-atmospheric containment which limits access, The director stated.that by increasing the hant' hole torque to ensure adequate crush depth, he is confident that retorquing the handholes in Mode 3 will not be necessary to prevent leakage from developing. The inspector noted the director's comments and will continue to monitor performance in ' this are .5 Review of Plant Incident Reports The plant incident reports (PIRs) listed below were reviewed during the inspection period to (i) determine '.he significance of the events; (ii) review the licensee evaluation of the events; (iii) verify that the licensee response and corrective actions were proper; and, (iv) verify that the licensee reported the events in accordance i with applicable requirennts, if require The PIRs reviewed were: number's 3-90-72 thru 3-90-8 No inadequacies were identified. The folicA ng Firs warranted ins')ector followup: 3-90-72, 3-90-74, 3-90-75, 3-90-81, and 3-90-81. These incidents are discussed further in sections 3.6, 3.3, 3.5.1 and 1.0 respectivel . PIR 3-90-081 Both Trains of High pressure Safety injection TEnerable
.
This event occurred on May 18, 1990 with the reactor shutdown in Mode 3 and plant heatup in progress at 385 degrees F and 900 psig. During i actions to refill the C and 0 safety injection accumulators at 6:05 p.m. in'accordance with procedure OP 3310B, a controi room operator (CRO) closed safety injection valve 3SIH*MV8835. This valve is V e dis-harge isolation valve on the common discharge header for both trains of safety injection (SI) and closing valve MV8835 made both trains of SI inoperable. This action was performed as required by n ~
;
d (,, ,,
*
i
'
. I 6 i
.
step 7.2.3 of the procedure to complete the accumulator fill j operation, however, the operator did not re-open MV8835 as required ' by step 7.2.4 when he completed the fi-il operatio { At approximately 10:00 p.m., another operator on shift noted that the ESF status panel and " Group 6 ESF off normal" annunciators were illuminate The matter was reported to the duty supervisory control t room operator (SCO). Investigation by the shift identified that the , illuminated annunciator was caused by the out-of-position valve ! MV8835 which was reopened at 10:17 p.m. Consequently, during the ! time of plant heatup in Mode 3, both trains of high pressure safety ' injection were inoperable for 4 hours and 12 minute ? The SCO did not report the matter to the shif t supervisor and no ' r actions were taken on May 18 to initiate a reportability determina- .
tion as required by licensee procedures. -However, the 500 discussed ' ' the incident during a subsequent conversation with another SCO on May : 19. The SCO who was informed of the incident notified his shift
,
supervisor ($$) who discussed the event the aext day with the swing
-
shift SCO. Plant incident report 3-90-81 was initiated and the ; matter was found reportable to the NRC per 10CFR50.72(b)(2)(iii), '
- reactor operation with a condition that could have prevented the fulfillment of a safety function needed to mitigate the consequences of an accident. The licensee made an ENS report to the NRC opera-tions of ficer at 4:41 p.m. on May 20 and notified the NRC resident inspector at 3:00 ,
'
,
The incident was reviewed by licensee management and an off-duty SS + was assigned to perform an immediate investigation of the event. The * CR0 responsible for the valve lineup error and tN responsible 500 ' were removed from shift work pending review of the event by manage-ment. The licensee review followed up on how the valve misalignment occurred, why the of f normal condition took so long to discover, and why reportability procedures were not followed on May 1 l.icensee Investigation Results On May 23 the inspector was briefed by the operations superintendent on the results of the investigation. The licensee concluded that several errors were made by operators during the performance of the accumulator fill nperation. The licensee explanation of the
.
sequence in which events occurred is listed below: At 4:43 p.m. leak checks of various primary plant check valves per SP3601.F.4 " Reactor Coolant System Pressure Isolation Valve Test" were in progress by a CR0 who was held over from the day shift. These leak checks were being performed by a dedicated off-shif t operator since they involve closing the safety injection isolation valve i MV8835 which renders the intermediate injection system inoperabl The dedicated operator's sole purpose, in addition to running the test, is to open this valve in the event that a safety injection l l,
.
F 1 $ I
_ m lL', *
,, '
l '
.
{ 7 l actuation occurs. Prior to commencement of the leak checks, the operator had filled accumulators in accordance with Section 7.1 of OP 33108, " Accumulator Low pressure Safety injection". The operator completed the tests and at 6:00 p.m., entered OP 33108 Section to replenish water level in the C and 0 accumulators, which had decreased because of the leak checks. Apparently, the operator did not see the note that was placed before section 7.2 which states that section 7.2 is applicable only in modes 4,5 and 6 since it disables both trains of safety injection by closing MOV 8835. When the 'B' $1 pump was started, the operator informed the SCO. The SCO determined that it was unusual to run the 'B' SI pump since the A pump was used as required in Section 7.1 during previous fills that had taken place during the day. This prompted the 500 to review the procedure, however, he also did not see the note. The SCO then informed the SS on duty that the 'B' SI pump was in operation and valve MOV8835 was r closed to fill the accumulators. The SCO also stated that the CR0 who was performing this evolution served as the dedicated operator ' when valve MOV8835 was close The SS noted the SCO's comments..and the accumulators were filled. The CR0 then notified chemistry to sample the accumulators as required by procedure. However, he neglected to open valvq MOV8835 as specified in the previous step in the procedure. Once the accumulators were sampled and leak checks complete, the CR0 left at 7:00 According to the operations supervisor, when the out-of position valve was identified at 10:00 p.m. by an on-duty CRO, the 500 did not report the event to his SS since the SCO only considered the event to be a personal performance issue and not a technical specification compliance concer The SCO explained that wnen MV 8835 was found out of position, he examir.2d the technical specifications and determinec that the valve was opened within the six-hour time requirement of TS 3.03; therefore, no violation existed. The consideration that the event was reportable never occurred to hi Therefore, he waited until the next day to inform the operator's immediate supervisor, another SCO, of the operator's performance relative to the out of position valv When he was interviewed by the licensee management representative, the operator could not explain why he entered the incorrect portion of the procedure, why he failed to see the note, and why he failed to restore the safety injection system to an operable statu To prevent recurrence of this event, the operations supervisor indicated that the PIR will be routed to all operators for revie Greater emphasis on the significance of reviewing technical speci-fication violations for reportability will be made with shift supervisor The operators who made the errors will be kept on the same shif ts with increased oversight by their immediate supervisor Both operators would also be individually counselle l
.
__ . . . . .
'
I . .; 0 ,
. , . . *
.
Inspector Assessment
!
Reactor operation in Mode 3 with both $1 trains inoperable is ' contrary to the requirements of Technical Specification (TS) 3. Operation with two trains out of service necessitates entering * TS 3.0.3 which requires the plant to be placed in hot shutdown within six hours if an SI train cannot be restored to service in one hou This is to ensure that a sufficient amcunt of borated water is . available to be delivered to the core to mitigate a return to ' criticality in the event that a design bases main steam line break were to occur. Inspector review of the assumptions made in the main - steam line break analyses revealed that two initial assumptions that are made when calculating the effects of the accident - one rod ,
~
withdrawn and zero ppm boron - were not present during the time that the safety injection system was inoperable. Therefore, there is some ' confidence that Appendix K emergency core cooling system cladding criteria could have been met if a main steam line break occurre . Inspector review of the licensee controls for use of a dedicated ! operator revealed that current procedures are inconsistent. Speci-fically, some procedures such as SP 3606.1, " Recirculation Pump 3R$5-PIA Operational Readir.ess Test", call out when a dedicated operator is required whereas procedure SP 3601F.4, which the CR0 was using prior to the event, does not identify when a dedicated operator is necessary even though MV 8835 is closed in a mode where safety injection is required. Such inconsistencies in procedure preparation could desensitize an operator to the importance of his task. Accor-ding to the operations supervisor, all procedures were to have been updated to provide specific guidance to the operators when a dedi-cated operator is required. Apparently the review failed to revise some procedures such as OP 3310B and SP 360 The licensee needs to improve procedures in this regard to ensure consistenc > Inspector review of the operator's adherence to procedures revealed - that in this instance performance was poor. The operator first. used an incorrect section of a procedure and then did not complete the actions contained in it. Further, the 500 who reviewed the operators-actions did not determine that an incorrect section was being use When interviewed by the_ inspector, neither operator could identify why they overlooked the procedure step The failure of operators to adhere to procedures during this outage caused an ESF actuation as detailed in Section 3.3 and in this situation rendered safety equipment inoperable. In both instances the safety significance was minor; however, it is notable that both events occurred during non routine evolutions plant cooldown on May 12 and plant heatup on May 18. Therefore, operator attentiveness to _ _ _ _ _ _ _ _ _ _ - _ _ - - _ - - - - - - - - - - - - - - -
_ _ _ _ _- y ,* ; ,; ,
.
I
' .
, procedures during non-routine events needs to be improve The f ailure to follow procedures during these evolutions is collectively considered a violation of technical specification 6.8.1, which requires written procedures to be established, implemented, and maintaine (50-423/90-08-01) The failure to notify the NRC within four hours of a plant opera-tion on May 18 in a condition that could have prevented the fulfil-men, of a safety function needed to mitig6te the consequences of an accident is contrary to the requirements of 10 CFR50.72(b)(2). The inspector noted that once a reportable matter was recognized by responsible shift management'on May 20, 1990, a timely report was made to the NRC, However, other instances have recently occurred where operators have failed to report equipment out of service in a tirpely f ashion. PIR 3-90-54 detailed a missed four-hour immediate notification requirement that should have been made to the NRC on March'19 when both trains of the auxiiiary building filters were inoperable. During the event, operators referred to the reporting requirement contained in the Emergency Action Tables and determined that a 30-day Licensee Event Report (LER) was required but did not search further and evaluate whether a four-hour report was necessar As a result of this incident, additional guidance was provided to operators on how to use the incident classification tables. However, no training was provided to operators on what combinations of equip-ment failures require a four-hour report to the NRC. Therefore, operators may not understand that a timely restoration of equipment to.an operable status is not enough and that certain equipment failures warrant informing the NRC. The failure to notify the NRC within four hours of plant operation on March 19 and May 18 of a condition that could have prevented the fulfilment of a safety func-tion needed to mitigate the consequences of an accident is a violation of 10 CFR 72(b)(2). (50-423/90-08-02).
The inspector was also concerned about the failure of the licensee to perform remedial training on what events are reportable. This concern was discussed with licensee management who indicated that a request for training has been developed to initiate training on reportability issue The inspector will continue to monitor licensee performance in this area in future resident inspection .6 Reactor Trip Due to Loss of Condenser Vacuum ! On May 10, Millstone 3 was manually tripped from 60% power when the B circulating water pump automatically tripped due to high differential pressure across its travelling screens. The high differential pressure was due to seaweed infusion and tidal surge caused by stormy weather conditions. Prior to the trip, operators i had begun to reduce power in accordance with SP 3665.2 " Intake Structure Conditions Determination and Response." However, the power reduction was not started early enough. Consequently, when the B i circulating water pump tripped, operators manually tripped the f
!
I
.. . .
. --
,
, +;. ,
.
.
'
l
. .
reactor in anticipation of the turbine / reactor trip which would have occurre Plant response was normal except that the C and D circulating water pumps automatically shut down due to high differ-ential pressure caused by adverse weather conditions shortly after the reactor tri Inspector review and followup of this. trip consisted of review of the sequence of events printout and actions taken prior to the trip, discussions with operators, system engineers, and licensee manage-ment, and attendance at a post-trip supervisors meeting. The inspector noted that operators adhered to SP3665.2 and began a plant shutdown when it was determined through use of a point system that the combination of wind, sea conditions, and seaweed infusion that existed made the intake system reliability suspect. However, the inspector noted that the procedure was not effectively implemented in that the degraded weather conditions were not recognized early enough, nor was power decreased in a timely manner, to prevent a reactor tri The inspector discussed his observation with the unit director who stated that in hindsight the slow downpower rate was in error. The director stated that the effects of this storm were worsened by a rapid wind shift and increase from the south which caught operators off guard. To alert operators of rapidly varying weather changes in the future, if wind speed reaches 20 miles per hour, a computer priority alarm will be generated. The inspector noted the director's comments and observed that the licensee revised SP 3665.2 to allow a faster downpower ramp from 1/2 to 1?f per minute to the plant maximum design rate of 5?4 per minute. Additionally, operators were instruc-ted to notify operations management immediately if adverse weather conditions appear on Niantic Bay. The licensee concluded that an earlier management notification of any suspect intake condition may allow sufficient time to make a decision on power operation before the intake system is actually threatened. The inspector considers that an earlier management notification of impending intake system challenges may help speed the decision process regarding reducing power operation. The inspector will continue to monitor the effec-tive implementation of SP 3665.2 in future resident inspectio .7 Reactor Trip Due to Dropped Control Rod On June 6, at 6:18 a.m., Millstone 3 automatically tripped on high negative rate when control rod G13 in shutdown bank B dropped into the core. Plant response to the transient was normal; operators performed the immediate actions contained in emergency operating procedures and maintained the plant in hot standby. The inspector responded to the control room upon notification of the trip and verified acceptable plant response to the transient. Inspector review of the trip consisted of a sequence of event review, control board walkdowns and interviews with operators, instrumentation and control personnel and reactor engineers. No inadequacies were note .
-
-
- - -
- - - - -
-
-
. . , , .
.. .
. . . . . . . ..
. .* . . , , ,
.:
'
The inspector observed instrumentation and controls troubleshooting operations, and noted that the approach used to determine the cause and problem was systematic and controlled. No major inadequacies were noted. During the performance of special test SP-30-3-5, which was used to withdraw control rods to assist in troubleshooting operations, due regard for plant safety was noted by instrumentation and controls and operations personnel. Troubleshooting operations revealed that rod G13 in shutdown bank B failed to move on deman Resistance checks performed on the rod stator gripper coil cable located in containment revealed low resistance to ground. A contain-ment entry was subsequently performed and the cable was removed and inspected. Examination of the cable plug, which connects the cable to the control and coil stack, revealed corrosion on the cable leads where they penetrate the plu V The corrosion apparently caused two leads to degenerate which allowed them to separate from the plug, causing the gripper coil lo de-energize and the control red to subsequently dro The licensee subsequently repaired the cable plug, and reisstalled the cable. Resistance checks performed on the remaining control rod coils for the other control rods did not identify any deficiencie Once testing of the rod revealed that the repairs were satisfactory, a plant startup was commence The licensee plans to disassemble several cable plugs during the next refuel outage to perform a more thorough inspection. The inspector determined that this would be prudent since the resistance checks that were performed only verified-that no severe degradation was present in the cable plug However, future reliability may be questionable due to the corrosion mechanism that is taking place. Licensee actions taken to determine the root cause of the rod failure and to establish the reliability of the control rod drive system will be reviewed in future inspection .8 Stand-by Readiness of Enaineered Safety Features (ESF) Systems and lystem Walkdown The inspector conducted a detailed system walkdown of the charging, safety injection, and safety injection accumulator systems. During the walkdown, the inspector verified that the licensee syr. tem valve lineups matched the actual configuration in the plant. . Plant draw-ings were compared to as-built system contiguration. Pipe supports were examined, and housekeeping in the area around the systems was assesse Valves in all three systems were found to be in the expected posi-tions. Major valve packing leaks in the charging system had been previously identified by the licensee and were tagged and containe However, several small seal leaks that were found by the inspector in the containment had not set been identified. Through conversations with licensee engineers, several of the leaking valves had already been observed but no trouble reports had been initiated. The l
.
_
. _ _ _ _ . *. '*
. .
,, ;
.
l inspector considered that all leaks, even if small, should be entered into the licensee tracking system, so that these leaks can l be tracked and monitored. The inspector noted that in the past the licensee has identified suspect components. Performance in this area will continue to be followe , All equipment was correctly labeled. Housekeeping was found to be good with the exception of lube oil system leaks on the charging pump platforms. Instrumentation inspected appeared to be properly installed, calibrated, and functioning. With the exception of th , few small deficiencies noted, the charging, safety injection, and < safety injection accumulator systems appeared to be in good conditio .0 Observation of Maintenance Activities i The inspector observed and' reviewed selected portions of preventive and corrective maintenance to verify compliance with regulations, use of l administrative and maintenance procedures, compliance with codes , and standards, proper QA/QC involvement, use of bypass jumpers and
. safety tags, personnel pro.tection, and equipment alignment and retest. The following activities were included:
AWO M3-90-09528 "A" Diesel Generator Preventive Maintenance AWO M3-90-09303 Fire System Modifications AWO M3-89-01259 Fuel Oil Day Tank 3EGF. TIC 2A Level Security maintenance performed on electrical E-fields during 1987 - 1989, and on door 311 f rom June 1989 ^ ember 198 No inadequacies were identifie .0 Observation of Surveillance Activities
,
The inspector observed portions of completed surveillance tests to assess performance in accordance with approved procedures and Limiting Conditions of Operation, removal and restoration of equipment, and deficiency review and resolution. The following tests were reviewed: SP 3614A.2 Auxiliary Building Filter Test SP 3441A13 Power Range 43 Operational Channel Check SP 3605.1 Fuel Pool Cooling Pump A Operational Readiness Test No inadequacies were note .. / ', , i s '
6.0 Engineering / Technical Support 6.1 Engineering Support of Plant Dperations 6.1.1 (Closed) Unresovled Item 50-423/86-35-01 Incorrect Resistance Conversion Tables Used This item concerned licensee corrective actions to ensure that only resistance bridge tables that are unique to a specific resistance , temperature detector (RTD) are used for the loop RTD elements. This ! is in response to a December 16, 1986 license discovery that calcu- , lations performed under startup test 3-INT-8000, Appendix 8015, " Loop Flow Measurements" had been based on erroneous data. Specifically, temperature values used in.these heat balances had been obtained r using resistance conversion tables for RTDs, which were different than the RTDs use Each RTD has a unique conversion curv > Calculations performed using the new tables revealed that the loop low flow rue was nonconservative. Therefore, as an interim measure, the licensee reduced the loop 2 low flow bistable to compensate for the non-conservative flow rate determination, In March 1987, the lo'op flow transmitters were recalibrated during a planned mid-cycle outage in March 1987 using the correct RTD conver-sion tables. To ensure that correct RTD conversion curves are used when RTDs are replaced in the future, the licensee included in the - RTD planned maintenance management system replacement criteria, a requirement to obtain new updated calibration curves and add them to the RTD calibration procedure. According to a licensee instrumenta-tion and controls technician supervisor, this would serve as~an additional reminder to technicians that new-tables must be used when RTDs are replaced. The inspector reviewed the licensee actions and had no further questions, This item is close .1.2 (0 pen) Follow Item 50-423/85-62-08 Voice Page/ Evacuation ! Alarm Adequacy This item was opened to track the licensee disposition of unsatis-factory test results obtained during construction testing while performing steps 7,2 and 7.3 of 31NT3031 " Voice /Page Evacuation Alarm Test" in containment. During the original performance of this test, there were high background noise levels in the containment due to equipment operation such as reactor coolant pumps, The elevated noise levels obscured'the audible activity of the evacuation / voice page rendering the test unsatisf actory. The concern regarding this test failure is that personnel in the containment may not hear the evacuation alarm on a voice page that could warn them of a problem in containment,
"
kh . :
.. . .
h g 14 i i I i L i
,.
. ;
. i E =The inspector contacted the licensee in October 1989 to ascertain the h4 p
status of'dispositioning this item. As.of June 11, 1990, the : licensee had yet to inform the inspector of the complete actions ! , taken.to address this concern. . The inspector considered that five
. years was suitable time to address this engineering item and,-
therefore, contrary to its normal performance the licensee has not
. ;i . ' ' '
been. responsive to this NRC concern. The inspector discussed this' ; determination with the plant director who said that he noted the inspector's concerns. The inspector will continue to ,
,
monitor the licent.ee performance on addressing NRC issues, i
,
'
. 7.0 ~ Security
;
Selected aspects'of site security were verified to be proper during inspection tours, including site access controls, personnel searches, personnel monitoring, placement of ,5ysical barriers, compensatory measures,. guard force staf fing. -and response .tc alarms and degraded _ s condition .1. (Closed) Violation 50-423/88-23-03 Opening Between Vital and i
. Protected Areas i
!
.i i
l This paragraph contains safeguards Information and is not=for ! public disclosure. It-is intentionally.left blan l
.
I e Additionally, in the response to the' violation, the licensee : committed to perform a review of the remaining vital areas per a I written predetermined criteri . The review was conducted by security ;
. supervisors and was completed on March 31,.1990. According to the security manager, no deficiencies were identified. A final assess- .
ment'of the: data and acceptance of the results will be conducted by ; i the' licensee security oversight committee. The inspector reviewed the procedural guidance that was used to perform the security . assessment and the results that were obtained and had no question ,
,
k _
^
' *'*,, , . - ..
.
Based upon review of the licensee response to this violation, the inspector considers the corrective actions to be complete. This item is considered close .2- (Closed) Violation 50-423/88-23-02, Failure to Make a One-Hour Security Report This violation documented that upon discovery of the problem discussed in section 7.1 the licensee failed to make a one-hour report to the NRC, as required by 10 CFR 73.71 (b)(1). In a March 16, 1989 response, the licensee concluded that the root cause for the failure was human error. The person reporting the event to the NRC failed to follow procedural guidance contained in emergency plan implementing procedure (EPIP) 4112, Incident Communication The individual involved referred to a general overview flow chart contained in EPIP 4112 instead of the body of the procedure. To prevent recurrence, all shift supervisors were briefed on the event and the ambiguous flow chart was deleted from EPIP 411 The inspector considers the licensee actions to be appropriate as security events that have occurred since this incident have been appropriately classifie This item is considered close .3. Security Concerns Investigated 7.3.1 Security Deficiencies Reported (RI-89-A-0120) The inspector looked into the following concerns:
(1) Secondary alarm station (SAS) operators may be overloaded with administrative duties such as radio checks and cannot monitor the central alarm station (CAS) functions. (2) A security guard reported to his supervisor that his gun was inoperable due to rust accumula-tion on the barrel, yet he remained on station for two hour (3) On two occasions in 1987 and 1988 perimeter intrusion detection system equipment was found to be out of service, yet the NRC was not notified. (4) In the third or fourth quarter of 1989, a guard on rounds found a Vital Area door open, yet the CAS operators identified the door as shut and this finding was not reported to the NR This paragraph contains Safeguards Information and is not for public disclosur It is intentionally left blan '
.
. i in "'l
~
_ b f- f,
. 1 . . ,
l t [ 16 The inspector observed the SAS operators perform on four separate occasions. At all times, SAS operators were able to ef fectively monitor the CAS operators functions. During periods of high activity, good communication was noted between the SAS operator and his supervisor, and effective action was taken to ensure guards would
' arrive at an alarming location within the time specified in SEP 5056 " Alarm Response."
In response to the second concern, the inspector examined a gun with similar rust buildu The rust appeared to be only on the outside surface and was probably caused by a combination of exposure to rain and use in a seaside environment. The inspector determined that the type of rust observed would not prevent operation of the weapon. Through conversations with the licensee gunsmith, the inspector was informed that guns are checked prior to issue, at the commencement of shift. This inspection includes a wipe down and oiling of the gun to p'revent rust buildup. The gunsmith acknowledged that if a gun is not oiled and wiped down prior to issuance, a slight build 9p of rust may occur due to environmental conditions; however, the buildup would not affect operability of the weapon. The inspector noted that .the licensee has purchased covers for the guns to be used during periods of inclement weather. The inspector noted that the use of covers will help protect the weapons from the adverse climate and therefore, should increase their service li, Based upon inspector review of this concern, it appears highly impro-bable that any rust that could occur on a weapon during a shif t could render a weapon inoperable. The licensee weapon checkout program appears adequate to ensure that inoperable or unsafe weapons could not be placed into servic Therefore, no safety or security concern exists, in response to the third conceri., the inspector conducted a review of maintenance work orders initiated because of failed perimeter intrusion detection system (PIDS) surveillances for the years 1987, 1988, and 1989. The review consisted of comparing the security event log to work orders that were developed as a result of PIDS test failure The inspector concluded that on January 23, 1988 and March 23, 1988, PIDS test failures were not logged in the safeguards event log as required by 10CFR73, Appendix G, paragraph II(a). The inspector identified this finding to a security supervisor who acknowledged that the two test failures should have been documented in the event log. The supervisor stated that the failure to document was the
-
result of personnel error which could be partly attributed to personnel being unfamiliar with new NRC requirements, which started . in the fourth quarter of 1987, that required test failures to be reported in the safeguard log. The inspector discussed his findings with a Region I physical security inspector and was informed that
. *A * i *. s - , , . '
t
.
l 17 l l during the ;arly implementation of the new NRC requirement to main-tain a security event log, it was initially unclear what events actually should be reported. Therefore, several NRC licensee facilities were inconsistent in the reporting of safeguard event The inspector noted that review of the safeguard log, since the first quarter of 1988, did not identify any other lapses in reporting requirements. Therefore, the inspector determined no generic issue exists regarding rept-ting safeguard events, and although the concern was substantiated, ne safety or security issue exist Inspector review concerning the fourth issue involved a review of maintenance work ordrs on the door for the affected period and interviews with security personnel to identify if appropriate action would be taken if a security door was found to be inoperabl e Inspector review of work orders issued on the door in question for
'
the affected period did not identify any which were issued to repair a defective security door switch. One work order MP-89-04688 was issued when a guard identified the mechanical door latch as defec-tiv The inspector verified that the guard's discovery was properly documented in the safeguard log on September 6, 198 The inspector interviewed security personnel in the CAS and asked what type of action they would take if a security door was found to be inoperable. At all times the security individuals indicated that a search of the area would be conducted, a guard posted at the door, a trouble report would be issued and the event recorded. Based upon inspector review of completed work orders and interviews with security personnel, the inspector was assured that pruper actions have been taken and would be taken in the future if a guard discovered that door was inoperabl The inspector had no further question .3.2 Concerns Regarding Entry into Cable Vault Area (RI-89-A-0080) The inspector was contacted by a former contract security guard officer with the following concerns: (1) A personnel safety hazard exists in the cable vault rooms that are protected by the CO2 system in that personnel cannot get out of the area in-the allotted time prior to system actuation; (2) no communication equipment exists in the C02 protected areas; and, (3) inadequate training is provided to security officers concerning entry into C02 protected area The inspector performed a walkdown of the cable vault areas and noted that there were several areas that could not easily be exited in the event of an impending CO2 discharge. Currently for Millstone Unit 3, the CO2 system provides a one-minute warning prior to discharge. The inspector noted that the procedures for guard entry into C02 areas had changed in 1987. The inspector reviewed security procedures and noted that guards are not allowed to perform routine patrols in the I
.. . . .
.
'
[o l
'["
.
.
.
.
O 18 i CO2 protected cable vault If a security guard is required to enter the vault areas in response to an alarm, the guard is required to first notify the operations department and to have the CO2 system to the affected area locked out prior to entry. Therefore, the inspector detern..aod that exit from the CO2 protected area in the event of a discharge is moot since personnel would not be in the effected area if CO2 was discharged, , However, the inspector noted that labeling of the affected switchgear ! area could be improve Specifically, prior to entering the cable ; vault from the 4'6" level of the switchgear room, a sign is posted
-
on the steps entering the area which reminds personnel that CO2 must be disabled from the control room prior to entry. The inspector determined an improved location would entail placing it across the ladderwell handratis which an individual would have to cross in order r to enter the cable vault area. The inspector discussed this observa-tion with the unit director who noted the inspector's commen ' In response to the other concerns, the inspector reviewed training given to guards prior to their entering CO2 protected areas and
,
;
determined the instructions provided were adequate. The inspector ' noted that permanent communication equipment does not exist in the i cable vault areas, but determined that the additional equipment would ' not subsequently improve worker safety since guards already are J required to notify the control room prior to entering the areas unless CO2 is removed from service. The inspector noted that the licensee had also installed CCTVs to monitor the access doors to the cable vaul Based on the above concerns, the inspecter determined that although the matter of whether personnel can exit the cable vault areas is a i valid industrial safety concern, the licensee has established adequate controls and provided proper training to individuals that , will minimize the obvious hazard. Therefore, this matter is close .0 Safety Assessment / Quality Verification 8.1. Technical Specification Amendment Implementation The inspector reviewed recent technical specification amendments to determine if'they were being implemented in a timely fashion. Review of the implementation schedule for license amendments 42-48 revealed that none of the amendments which required procedure revision or ' setpoint changes were implemented within the 30 days that is speci-fied in the letter which accompanies the change. The delays in implementation ranged from 9 days for amendment 46, which changed the operability requirements for the main steam isolation valves and radiation monitors to four months for amendment 43, which lowered the reactor coolant pump underfrequency trip setpoint. The delays in
_ _ - _ _ _ _ _ _ i o *'
,. , , ce ! *
7 ,
'
:
.
implementation of the changes are in apparent conflict with Millstone l Station Administrative Control Procedure 3.29, " Implementation of Technical Specifications Amendments," which states that it is the station policy to implement technical specification changes within 30 i day i The inspector noted that the technical specification amendments that were granted opened up the Millstone 3 " operating window" and were, ; therefore, less restrictive than the original plant operating basis. Although the failure to implement the changes in a timely manner is not safety significant, the NRC expects a licensee to i implement a change within the 30-day time requirement as specified in the authorization letter. Therefore, all procedures and setpoints 1 are expected to have been changed before the 30-day window expires ! unless a documented management decision has been made to keep a t setpoint more conservative. If a licensee needs greater than 30 days to implement a change, it should be noted on the accompanying appli-cation for a licensee amendment. The NRC Millstone 3 project manager has indicated a willingness to expedite an amendment transmittal process if necessary to speed up the implementation process. The ; inspector informed the Millstone 3 licensing engineer and plant l director of the NRC findings and they noted the inspector's comment The inspector had no further questions.
, 8.2 Periodic Reports , Upon receipt, periodic reports submitted pursuant to technical specifications were reviewed. This review verified that the reported information was valid and included the required NRC data. The inspector also ascertained whether any reported information should be classified as an abnormal occurrence. The following reports.were " reviewed:
, -- April Monthly Operating Report -- May Monthly Operating Report : -- June 8, 1990 Special Report Update Regarding the Post Accident Sample System The inspector noted that the April Monthly Operating Report was deficient in.that it did not include the licensee actions taken to prevent recurrence of the April 1 and April 16 of 1990 reactor trip The inspector discussed this issue with the engineer who prepared the report. The engineer stated that omission of the licensee correc-tive actions was due to oversight. The inspector noted that the recently issued May report was complete and determined that-this occurrence was isolated, as previous monthly reports reviewed have been complet _ . _ - _ _ _ _ _ _ . _ _ _ _ _ . .___ _ ._ _ _ - _ . _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ . - _ _ _ _ _ _ _ - _ - _ _ [[ I Cl 3 .
l ':
-.
20 .
!
.
b lL 0 8.3 Licensee Event Report Review
, !~
Licensee Event Reports (LERs) submitted during the report period were reviewed to assess LER activity, adequacy.of corrective actions,. -
' compliance with 10CFR 50.73 reporting requirements, and determination for generic implications or a requirement for further informatio ,
;
U- Selected corrective actions were reviewed for implementation and
'm -
thoroughnes l The LERs reviewed were 90-10 00 and 90-12-00.. No l
[. .
l-
,
inadequacies'were identifie ' l 8.4 ; Management Meetinos
-
,
E-Periodic meetings were held with station management to discuss ! inspection findings during the inspection period. A summary of l
'.. . findings was also discussed at the conclusion of the inspection.. No 1 ' proprietary information was covered within the scope of the inspec- .i tidn. No written material was given to the licensee during the inspection perio ' .
l
!
.
!
i !
.
! c. - i i s
;
i
-
,
.., u
.
!
I:
'
l ..
'
K4 ? ior ;
*
4
-,er- -- .- ~ n _
}}