IR 05000423/1997209

Insp Rept 50-423/97-209 on 971027-980128.Violations Noted. Major Areas Inspected:Licensee Ability to Identify & Resolve Licensing Bases Deficiencies

ML20216G108
Person / Time
Site:	Millstone
Issue date:	04/01/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20216G083	List: IR 05000423/1997209 ML20216G078 ML20216G092
References
50-423-97-209, NUDOCS 9804170349
Download: ML20216G108 (70)

Text

. -- - - - - - . . - . _ _ _ .

.

'.

U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION Report No.: 50-423/97-209

'

Docket No.: 50-423 j License No.: NPF-49 i Licensee: Northeast Nuclear Energy Company

~

J Facility: Millstone Unit 3 -

Location: Millstone Nuclear Power Station 156 Rope Ferry Road Waterford, Connecticut 06385 Dates: October 27,1997 through January 28,1998 Inspectors: Anthony Gody, ICAVP, Leader, Team 3A Special Projects Office Brian Hughes, Operations inspector, Special. Projects Office Herschell Walker, Electrical Inspector, Special Projects Office James Houghton, Mechanical Inspector, Special Projects Office Donald Prevatte, Mechanical Engineer, Contractor *

Robert Quirk, l&C Engineer, Contractor *

Omar Mazzoni, Electrical Engineer, Contractor *

Michael Plunkett, Civil / Structural Mechanical Engineer, Contractor *

• Contractors from Parameter, In Approved by: Steven A. Reynolds, Branch Chief Special Projects Office 1 Office of Nuclear Reactor Regulation I

I i

l I

Enclosure 2 '

9804170349 980401 I PDR ADOCK 05000423 G PDR ,

<

.

. .

SUMMARY During the period from October 27,1997, through January 28,1998, a team from the Nuclear Regulatory Commission's (NRC) Special Projects Office, Office of Nuclear Reactor Regulation, in accordance with the guidelines outlined in SECY-97-003, " Millstone Restart Review Process," conducted an inspection at Millstone Unit 3 and at offices of Sargent and Lundy (S&L), the Unit 3 Independent Corrective Action Verifestion Program (ICAVP)

contracto The purpose of the inspection was to independently assess the licensee's ability to identify and resolve licensing bases deficiencies; determine if the licensee's change processes were adequate to maintain the Unit 3 design and licensing basis; determine if the critical functions of

~

accident mitigation systems credited in Final Safety Analysis Report (FSAR) Chapter 15, can be accomplished; and, to assess the effectiveness of the Tor 2/Ter 3 aspects of S&L's ICAV The

"

S&L Tor 2 reviews were designed to be more limited in scope than those performed on the in scope" (Ter 1) systems selected by the staff. The staffs evaluation of the contractor's Tier 1 review is the subject of NRC inspection Report 50 423/97-210. The Tor 2 review began after i the selected sample of critical perfonnance characteristics of the accident mitigation systems specified in Chapter 15 of the FSAR were approved by the NRC. S&L then determined if the

)

l selected performance characteristics could be met by these systems through a review of i system tests and some design calculations. This review provided a measure of confidence that the licensee's accident mitigation systems were adequately designed and tested and would perform as assumed in the accident analyse The inspection team was tasked to determine if selected FSAR Chapter 15 accident mitigation systems were built and tested in accordance with the Unit 3 design and licensing basis, and evaluate the effectiveness of the S&L review. To accomplish this task, the team approached the Tor 2 review differently than S&L by performing a more focused and detailed functional review of a smaller sample of FSAR Chapter 15 accidents. The team selected the spectrum of loss-of-coolant accidents (LOCA) and the steam generator tube rupture (SGTR) acciden The team determined that the licensee's instrumentation and controls engineers demonstrated a good focus on safety and sound engineering practices. Th's team concluded that the design, installation, and testing of instrumentation and controls used to mitigate the consequences of a LOCA and SGTR accident were adequate. Instrumentation used during the SGTR acc6 dent and LOCA were reliable and property calibrated. Isolated problems were identified with the surveillance procedures associated with resistance temperature detector time response testing l which are discussed in Section 2.1 of the report. The licensee acknowledged these problems l and was responsive by immediately initiating corrective action The S&L implementation of the Tier 2 part of the ICAVP was generally acceptable. Isolated instances of incomplete implementation of the approved project instructions were noted and

"

are discussed in Section 2.1 of the report. S&L was responsive to all of the issues identifed by expanding the scope of the effort as neede In the mechanical systems area, Section 2.2 of the report, the team found that the licensee used good engineering practices and adequately maintained the plant design and licensing bases. Several minor exceptions related to inconsistences between the design and licensing I

_

.

-

,.

bases were noted. The team did find an isolated example of an improper interpretation of regulatory guidance for pipe break sizing and a minor problem associated with service water systems pump test result However, a problem was identified in the licensee's implementation of their TS 6.8.4 program to '

reduce leakage from systems outside containment that carry reactor coolant following a LOC The team found that the licensee did not implement an adequate recirculation spray system heat exchanger test program. The licensee's review of this program failed to identify and 4 correct this program weakness during their CMP effor S&L's review of mechanical-related critical characteristics was acceptable. However, in several instances, the review process did not meet the requirements specified in the project

-

instructions. Subsequent revisions to the review process corrected the problems identified by

~

.)

the team and provded assurance that allissues have been recognize No S&L critical characteristics were attributed to the electrical area as part of the Tier 2 revie In the area of control room and offsite dose consequences, numerous errors and inconsistences between the design and licensing bases were identified. Several calculations with different input assumptions covering the same aspects of the analyses were indicative of 3 poor calculation controlin this area. Additionally, the licensee's organization responsible for maintaining these analyses failed to recognize the importance of maintaining the design and licensing bases consistent with one another. The licensee was responsive to the issues and indicated a commitment to combine the design and licensing bases into stand alone calculations, provide additional oversight of the dose analysis group, and verify that the plant operation was consistent with the new design and licensing bases. Findings are detailed in Section 2.4 of the repor For example, a calculation assumed an unfiltered in-leakage to the control room for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following a LOCA, but failed to recognize a single-failure vulnerability in the control room inlet damper arrangement. The licensee identified this issue in November 1996, during the configuration management program but appropriate corrective action was not implemented. In addition, the team found that 10 minute operator response time to manually reposition the control room dampers assumed by the licensee was unsupporte In the area of dose consecuences, the licensee did not provide S&L the latest calculation of record for the critical characteristics associated with the offsite dose consequences from an SGTR accident. Subsequently, S&L committed to perform a review of the new calculation once the licensee completes its review and approves i During the Tier 3 inspection, the team evaluated both the licensee's current and past performance in implementing various change processes designed to control plant configuratio The team reviewed approximately 100 changes to the plant implemented since January 199 In addition, the team selected 30 past changes for which S&L has completed its ICAVP revie !

A list of plant changes reviewed by the team is contained in an attachment to this repor l The licensee's procedures for conductirsg design changes met the requirements of 10 CFR Part 50, Appendix B, and licensee personnel adhered to those procedures. Minor weaknesses were ,

identified in the design control manual. Additionally, temporary modifications included '

il i

!

.

.

,.

substantial calculations that were not controlled to the same level as design changes, and emergent conditions were not evaluated adequately on systems that had temporary modifications installed. The latter resulted in the potential inoperability of the A emergency j- diesel generator following a tomado. (See Section 3.1 of this report.)

! The licensee's procedures for maintaining the Unit 3 licensing bases were adequate with some L

exceptions. Change packages were generally prepared using good engineering practices with

! adequate oversight. Although the level of detail could be improved in the Unit 3 safety evaluations (SEs), the team found that the packages reviewed were sufficiently developed to support the conclusions. A weakness was identified in the threshold for writing an SE for a Final Safety Analysis Report Condition Report (FSARCR) which later was found to have been previously identified by the licensee. However, the licensee's corrective actions failed to review FSARCRs between mid-1996 and July 1997. The licensee subsequently determined that SEs should have been written for approximately 50 percent of the FSARCRs written during that '

~

period of time. None of the SEs resulted in an unrelvowed safety question determination.

l

'

The team found that S&L performed their Tier 3 review in accordance with the approved project instructions. S&L identified similar problems with the threshold for writing SEs for FSARCRs.

l l

l

1 r

lii l

.

REPORT DETAILS l

i Background On August 14, igg 6, the U.S. Nuclear Regulatory Commission (NRC) issued a Confirmatory Order (Order) to Northeast Nuclear Energy Company (NNECO or the licensee) requiring ccmpletirsn of an Independent Corrective Action Verification Program (ICAVP) before the restart of any isillstone unit. The Order directed the licensee to obtain the services of an organization independent of the licensee and each facility's design contractor to conduct a multi-disciplinary review of Millstone Units 1,2, and 3. The staff approved the Sargent and Lundy Corporation ICAVP team (S&L) to perform the ICAVP for Millstone Units 1 and 3 on April 7,1gg _

The Order.also stated that an ICAVP audit plan was to be developed by the independent -

organization and that the audit plan must describe (1) the conduct of an in-depth review of selected system's design and design basis ; (2) risk- and safety-based criteria for selection of systems for review; (3) activities to assure that the quality of results of the licensee's problem identification and corrective action programs on the selected systems is representative of, and consistent with that of other systems; (4) procedures and schedules for parallel reporting of findings of S&L to both the NRC and the licensee; and (5) procedures for S&L to comment on ;

the licensee's proposed resolution of the findings and recommendations. The Order further !

stated that the scope of the ICAVP shall include (1) a review of engineering design and i configuration control processes; (2) verification of current, as-modified, conditions against {

design and licensing bases documentation; (3) verification that the design and licensing bases !

requirements have been property translated into operating procedures and maintenance and l test procedures; (4) verification of system performance through review of specific test records or observation of selected testing of particular systems; and (5) review of proposed and implemented corrective actions for design deficiencies identifed by the license ' Three Tier Process in a paper to the Commission (SECY-g7-003, " Millstone Restart Review Process,") dated January 3,19g7, the staff described the Millstone restart review process. To provide the level of assurance necessary to support a unit restart decision, the staffs expectation, described in SECY-g7-003, was that the ICAVP would encompass the aspects of configuration control ~

described in a Tier 3 approac ,

in Tier 1, systems were selected to test the thoroughness of the licensee's reviews in identifying potential nonconformance with the design and licensing bases. The systems selected were the service water system (SWS), quench spray system (QSS), recirculation spray system (RSS),

emergency diesel generator () and its support systems, and the auxiliary building's heat, ventilation, and air conditioning system and supplemental leakage collection and release system (SLCRS). S&L was tasked to conduct a thorough review of all design changes made to these systems after the issuance of the operating license, the remaining part of the original system configuration, and all operational aspects of these systems, including maintenance, surveillance testing, and training. S&L was also expected to rev'ow the licensee's corrective actions for previously identified design-related deficiencies for the selected systems, including the deficiencies discovered during the implementation of the licensee's corrective action program _

.

-

,.

in Tier 2 the objective was to verify that critical design characteristics of systems relied upon to mitigate the consequences of accidents analyzed in the Final Safety Analysis Report (FSAR)

were consistent with those used in the design of the mitigation system and the accident analyses. The scope of the ICAVP Tier 2 review was focused on verifying the critical design characteristics, therefore, the Tier 2 review involved more systems than the Tier 1 revie The Ter 3 objective was to provide insights into the effectiveness of the various change processes in controlling the plant's configuration over the lifetime of the plant. The review evaluated a sample of changes made to the facility configuration since issuance of the operating license and a review of the processes that govemed those changes. These processes included calculation changes, proposed Technical Specification (TS) changes, temporary modifications, drawing changes, procedure changes, setpoint change requests, and replacement item evaluation .0 Accident Mitigation System Functional System Functional Review (Ter 2)

The Tier 2 review was described in SECY-97-003 as providing additional assurance of the adequacy of the licensee's programs by broadening the scope of the review to other systems in addition to the system selected for Tier 1. To evaluate the capability of accident mitigation systems subject to the Tier 2 review, the contractor selected design characteristics of these -

systems that were specified in Chapter 15 of the FSAR and submitted them to the staff for approval. The NRC-approved critical characteristics were evaluated by the contractor by performing a review of documented surveillance tests, plant startup tests, or a critical review of design calculations, specifications, vendor documents, and drawings for conformance with the system performance input to the accdent analyse The NRC team inspection of Tier 2 differed from the S&L's review in that the team performed a focused and risk informed functional review of the systems involved in the mitigation of the spectrum of large-break loss-of-coolant accidents (LOCA) and the steam generator tube rupture (SGTR) accident, which was similar to a safety system functional inspection. The scope and depth of the teams' inspection was determined using insight gained from NRC risk analysts,- the Millstone Unit 3 risk model and industry experience. A list of the accident mitigation systems evaluated, their significant mitigation functions, the corresponding S&L critical characteristic numbers, and the scope of the team's inspection is provided in /ppendix E to this report. The team's inspection encompassed all 7 of the S&L critical characteristics associated with the SGTR accident and 25 of the 33 S&L critical characteristics associated with the spectrum of LOCA' .1 Instrument and Controls Inspection Scope The team performed a functional review of each significant instrument loop associated with the mitigation of a LOCA and SGTR accdent. This functional review included an evaluation of the adequacy of sensor and instrument rack installation, electrical separation, setpoints, surveillance testing, calibration, and response time testing. For the SGTR accident, the significant instrument loops included pressurizer pressure, over temperature A temperatura (07dT), and power range nuclear instrumentation. For the LOCA, the significant instrument

!

l

.

-

.

loops included containment pressure, pressurizer pressure, and refueling water storage tank leve A review of other instruments used during the LOCA and SGTR accident included the incore thermocouples, the reactor vessel level indication system, and the containment leak monitoring systems. This review was limited to an evaluation of equipment reliability, operator training, and adequacy of surveillance testin Obserdions and Findinos Resistance Temnerature Detection Resoonse Time Surveillance Te.k s

-

The calibration of resistance temperature detection (RTD) instrumentation provides the signals to determine the various reactor coolant system (RCS) temperatures.~ Reactor coolant system ~

temperature is used in the reactor protection system (RPS) for several key reactor protection schemes. The over temperature A temperature (OTdT) trip is relied upon for certain postulated SGTR accident Technical Specification (TS) 4.3.1.2 requires that RTD respcase times be verified to meet the specifications contained within the Technical Requirements Manual (TRM). The response time for the instrument loops involved in developing inputs for the OTdT and overpressure A temperature (OPdT) reactor trips, and temperature-average (Tave), specifed in TRM Table 3.3.1-1, is less than or equal to 7.0 seconds. SP 31024 ' Calculation of Reactor Trip and ESF Response Times," Revision 2, Change 3, adds the RTD response time to the delay time of the analog racks, actuation logic, reactor trip breaker, and control rod drive gripper coil field deca The non-RTD time response is 0.5 seconds, therefore, the response time of the RTD must be less than 6.5 seconds. The team assessed the procedures applicable to verify response time and identified the following procedural inadequacies:

(1) The RCS narrow range RTD response time surveillance procedures (SP 3443E12, E22, E32, and E42) require the results from three or more runs of the loop current step response (LCSR) test method for each RTD to be averaged. The LCSR test method supplies an extemal signal to the RTD and measures the RTD response time. Therefore, plant conditions must be stable to obtain co'nsistent and meaningful test results. The turveillance procedure does not determine if data obtained during the LCSR test is valid before averaging them togethe The failure to include a determination of data acceptability in the RCS narrow range RTD response time surveillance procedures is an example of a violation of TS 6.8.1, " Procedures and Programs,* which requires adequate written procedures to be established, implemented, and maintained (VIO 50-423/97209-01).  ;

in response to the team's finding, the licensee indicated that they planned to change the associated test procedures to include steps to verify data quality prior to plant startu (2) Surveillance Procedure SP 31024 does not increase the results by 10 percent to account for the tolerance of the analysis method as suggested by the vendor manual. The vendor manual recommendations, supported by AN/ISA S67.06-1984, Section 8, indicate that indirect test resu'ts shall provide results equal to or more conservative than direct response time tests. The LCSR is an indirect method of determining RTD response time. Although the

__

- -

.

-

,.

licensee is not committed to AN/ISA S67.06-1984, they are required to incorporate vendor 1 information in their procedures and use the information to develop adequate test procedure Failure to include margins te account for the indirect measurement of RTD response time in the OPdT surveillance procedure is an additional example of a violation of TS 6.8.1, Procedures and Diagrams, (VIO 50 423/97209-01).

The licensee indicated that they planned to change the associated test procedures to include steps to verify data quality prior to plant startu . Evaluation of S&L's ICAVP Review

. Inanection h-The team performed an evaluation of the Tier 2 reviews conducted by S&L to determine the adequacy of the ICAVP implementation. For Tier 2, the team reviewcd 14 instrument and controls-related LOCA and SGTR critical characteristic Observations and Findinas S&L's review of instrument and controls-related characteristics during the ICAVP review was acceptable. However, S&L's verification of the surveillance test results was not complete in tha it did not incorporate verification of the functionality of and devices, required for the actuation of equipmen Additionally, S&L's description of critical characteristics associated with the LOCA and SGTR accidents lacked detail. As a result S&L failed to properly verify applicable rod drop times, to ;

determine that the FSAR Table 15.6-4 was inconsistent with critical characteristics and that

'

critical characteristics did not account for scram breaker control rod gripper mechanism delay time The team verified that S&L expanded its review with no additional issues identified, and the licensee initiated corrective action to update applicable FSAR table .1.2 Conclusions

. Overall, the team found that the licensee's instrumentation and controls engineers demonstrated a good focus on safety and utilized sound engineering practices. The design, installation, and testing of instrumentation and controls used to mitigate the consequences of a LOCA and SGTR accident were adequate. The team did, however, find isolated problems with the surveillance procedures associated with resistant temperature detector time response testing which were both examples of a violation of the requirement found in TS 6.8.1. The licensee acknowledged these problems and initiated corrective actions. None of the problems identified resulted in a safety system not being able to accomplish it's accident mitigation functio The team found that the in-core thermocouples, reactor vessel level indication system, and the containment leak monitoring systems were reliable, adequately maintained and tested, and operators were knowledgeable of their operation and limitation _ _ . _ . . _ . .

.

'

.

The team identified areas where S&L reviews and assessments had to be expanded to meet <

the requirement of the S&L project instructions. Subsequent reassessmentis by the team indicated that the S&L review was acceptabl .2 Mechanical Systems Raview Inspection Scope The team evaluated accident mitigation functions of the service water system (SWS),

component cooling water (CCR), auxiliary feedwater (AFW), low-pressure safety injection, high-pressure safety injection, RSS, QSS, safety injection pump cooling, and system The team also evaluated equipment reliability, operation, and surveillance testing for a sample of containment isolation valves, steam generator power operated relief, isolation, and bypass '

valves, and main steam isolation valve Observations and Findinas Technical Soecification Leakmaa Monitorina Proaram A significant contributor to the radiological effects of a LOCA is leakage of radioactive water !

outside containment from ECCS and containment cooling systems following a LOC I Calculation P(R) 746, "ECCS System Leakage Outside Containment," Revision 0, dated March 10,1982, established the design basis values for this leakage. These values were inputs to both the offsite dose to the public and control room operator accident dose calculations. The team reviewed two important aspects of this calculation (1) were the leakage values developed by the calculation reasonable and current, and (2) were the leakage values adequately translated into the dose consequence calculations. The second aspect is addressed in Section 2.4 of this repor The licensee's commitment to NUREG 0737 was reflected in TS 6.8.4 which stated:

"The following programs shall be established, implemented, and maintaine t Primarv Coolant Sources Outside Containment A program to reduce leakage from those portions of systems outside containment that could contain highly radioactive fluids during a serious transient or accident to as low as practical levels. The systems include the recirculation spray systems [RSS), Safety injection, charging portion of chemical and volume control, and hydrogen recombiner The program shall include the following:

(1) Preventative maintenance and periodic visual inspection requirements, and ;

(2) Integrated leak test requirements for each system at refueling cycle intervals or less."

_

.,

The design basis leakage for the RSS heat exchangers had been established by Calculation P(R) 746, at 60 cc/hr for each RSS heat exchanger. The licensee has not established an inspection and look testing program for the RSS heat exchangers as required by TS 6. The team noted that the licensee reviewed Calculation P(R) 746, Revision 0, as a part of the CMP and issued a calculation change notice, dated May 12,19g7, which stated that the leakage control program required by TS 6.8.4, "substantially supplements and affirms the calculation conclusions." The licensee's failure to implement the requirement of TS 6.8.4 was identdied as a potentially significant condition adverse to quality and is considered an apparent violation (eel 50-423/g720g-02).

Together, the four RSS heat exchangers provide the only means to remove hest from the

~

reactor coolant inside the containment sump following a LOCA. These heat exchangers are cooled by water pumped directly from the Long Island Sound through the SWS. It is important that leakage from these heat exchangers not occur and, if so, be immediately detectable and insolable. The team reviewed the design and installation of the SWS radiation monitors which would be used to identify leakage from these heat exchangers and found that they were adequate. The team also found that operators were aware of the proper actions to take in the event leakage from these heat exchangers occurre ECCS Pumo Seal Desion -

The RSS pump seal design was intended to have zero contaminated leakage by utilizing a double-tandem mechanical carbon face seal arrangement pressurized intamally with a clean extemal seal water system. This was reflected in Calculation P(R)-746 which assumed zero contaminated leakage from the RSS pump seals. However, the seal water supply system was found to have a sufficient supply of water to last only a maximum of 30 days following a LOC Once the seal water supply is exhausted, leakage into the auxiliary building from these seals would be contaminated. The licensee acknowledged this error and planned to modify their leakage calculation to include this leakage. Both the licensee and the team concluded that the 3,000 cc/ hour margin for " miscellaneous leakage" in the calculation easily accommodated this error which was approximately 50 cc/ hou .

Inconsistencies Between the Desian and Licensina h=== (

The team evaluated the following inconsistencies between the Unit 3 design and licensing l

bases to determine if they had been identified by the licensee during the CMP and if they I constituted an unreviewed safety questio l l

(1) The RSS pump seal water injection system discussed above was addressed in the FSAR I Section 6.2.2, " Containment Heat Removal System," which describes the pump sealing systems as injecting " clean" water between the seals, and further states that, "it is not expected ,

that the seals would see the effects of particles in the pumpage." The FSAR went on to say

'

that "By design, a clean source of seal water... ensure [s] the long-term reliability of the pumps to perform as required." These FSAR statements were found to be misleading in that during the !

inspection the licensee verified that the RSS pump seals were designed to operate in systems which contain particles in the pumpage and no significant pump degradation was expected to occur during 1-year of continuous operations following a LOCA. The licensee stated that the FSAR would be changed to reflect pump design characteristic _ _ __

.

-

.,

This is an example of a violation of 10 CFR 50.71(e) which requires that the FSAR be updated periodically to ensure it contains the latest material developed (VIO 50-423/97-209-03).

(2) FSAR Sections 15.6.3.1,15.6.3.2, and 15.6.3.3, in their description of the reactor coolant system cooldown following a SGTR accident, described reducing the RCS pressure to the level of the faulted steam generator in order to stop the flow through the broken tube. These sections indicate that the cooldown is achieved by the release of steam from the non-faulted steam ger:erators' safety / relief valves. The team found that the FSAR statements were not consistent with Westinghouse Analyses WCAP-11002, " Evaluation of Steam Generator Overfill Due to a Steam Generator Tube Rupture Accident," dated February 1986, and WCAP-10698-P-A, * Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident," dated March 1986. These analyses assumed that operators would cool down the reactor coolant system by controlling the release of steam from the non-faulted steam generators through the

- steam generator dump valves. The team concluded that the FSAR statement was wrong and -

that the FSAR error should have been identified and corrected during the CM This is an example of a violation of 10 CFR 50.71(e) which requires that the FSAR be updated periodically to ensure it contains the latest material developed (VIO 50 423/97-209-03).

in-Service Testina of SWS Pumns During a review of SWS pump testing, the team found that the licensee had failed to property account for the location of the pump discharge pressure gauge being downstream of an in-line strainer. This resulted in an error of approximately 4 psid in the pump test results. Other corrections for intake water level, discharge gauge level, and specific gravity measurement were adequately included in the procedure. The SWS pump was operating within both the ASME,Section XI, allowable range and well within the analyzed minimum SWS total flow requirements for accident mitigation. The team discussed this observation with the licensec and CR 98-060 was written on December 12,199 The licensee's failure to properly account for the SWS strainer in SWS pump test results is a <

violation of minor significance and is being treated as a non-cited violation consistent with l Section IV of the NRC Enforcement Policy (NCV 50-423/97-209-04).

\

2.2.1 Evaluation of S&L's ICAVP Review Inspection Scope The team performed an evaluation of the Tier 2 reviews conducted by S&L, to verify that the ICAVP was implemented in a critical and thorough manner. For this purpose, the team reviewed 7 mechanical systems-related LOCA and SGTR critical characteristic Observations and Findinas S&L's review of mechanical systems-related critical characteristics during the ICAVP review was acceptable. However, the following problems were identified related to the implementation of Tier 2 review as described in the " verification method" part of the Tier 2 database. In each case, S&L expanded their review to meet the requirements of the paject instruction i

+

1

!

.

.- - - - . - . . - - - - -

. .. . . .

.

.

. . .. . .

.

'

.

'

Critical Characteristic 154 involved a review of the assumptions listed in FSAR Table 15.6-8 for the input parameters to the ECCS analyses. The team found that S&L did verify that the parameters listed in the FSAR were included in the ECCS LOCA analyses, but did not verify that the TS, operating, and testing characteristics of the ECCS systems supported the FSAR table assumption Critical characteristic 153 involved a review of the Calculation P(R) 746, Revision 0, results which were translated to FSAR Table 15.6-g and addressed the leakage of radioactive liquid from emergency core cooling systems. The team found that S&L's review of this critical characteristic did not include a verification of system leakage using the design calculation or surveillance procedures as stated in their verification method. S&L's reevaluation resulted in a discrepancy report on the TS 6.8.4 program failures identified by the NR When the Tier 2 critical characteristic involved an in-scope Tier 1 system S&L's accident review group (ARG) identified the critical characteristic and determined the proper verification metho Once that was done, the ARG developed a system requirement to be reviewed by the system review group (SRG). Critical characteristics 160 and 161 were tumed over to the SRG by the ARG since they involved in-scope systems. The team found that the SRG review of these critical characteristics did not implement the verification method planned by the AR Subsequently, S&L proposed a review scope that was acceptable to the tea .2.2 Conclusions The team found that the licensee used good engineering practices and adequately maintained the plant design and licensing bases. Several minor exceptions related to inconsistencies l

between the design and licensing bases were note However, a problem was identified in the licensee's implementation of their TS 6.8.4 program to reduce leakage from systems outside containment that carry reactor coolant following a LOC The team found that the licensee did not implement an adequate RSS heat exchanger test program. More importantly, the team found that the licensee's review of this program failed to identify and correct this program weakness during their CMP effor S&L's review of mechanical-related critical characteristics wEs acceptable. However, in several instances, the review process did not meet the requirements specified in the project instructions. Subsequent revisions to the review process corrected the problems identified by the tea .3 Electrical Systems - Inspection Scope The team evaluated the functional design of the vital 125 Vdc systems including the 4160 Vac cable calculations, the EDG starting and loading sequencer, and safety-related 480 Vac relay setting calculations. A total of 16 electrical calculations were reviewed for adequacy and compliance with design bases, and regulatory and procedural requirements. Six surveillance procedures were reviewed to determine if they adequately tested the electrical systems capability to perform during an acciden _ - _ _ _ -

.

'

P Observations and Findinos Calculations associated with the station batteries and the EDG were evaluated and found to be acceptable. However, the team found that revised calculations were not stand alone documents and the review had to incorporate a review of the original calculations and all the subsequent changes in order to assess the plant design base During the review of calculation BATS-96-1247E3, " Potential for Cable ignition for Battery 5 and Charger,' Revision 0, Change No.1, a potential unanalyzed condition was noted. The minimum short-circuit currents had not been evaluated. This precluded the assessment of the adequacy of protective devices to trip on low level faults, increasing the potential for cable overheating during these low-level electrical faults. The licensee agreed that additional

.

evaluations in this area were prudent and initiated the appropriate corrective action ,

The NRC will review the licensee's conclusions in a followup inspection (IFl 50-423/97-209-05).

The surveillance procedures reviewed by the team were verified to be adequate for testing the electrical systems capability to perform their accident mitigation function .3.1 Evaluation of S&L ICAVP Review S&L's review in the electrical systems was completed as part of the Tier 1 review as there were no electrical critical characteristic .3.2 Conclusions Electrical calculations were found to be acceptable, although some needed clarification. The issue associated with minimum fault currents discussed above will be addressed during an NRC followup inspectio .4 Review of Control Room and Offsite Dose Consequences

. Inspection Scope .

The team reviewed the design basis analyses of the radiological effects for two accident j scenarios, the LOCA and the SGTR. For each of these events, two types of analyses were j

!

addressed, offsite dose and control room dose. The reviews addressed methodologies, inputs, '

assumptions, and consistency with other analyses and the licensing base l

! Observations and Rndings l l

The team found numerous errors and inconsistencies between the design and licensing base More importantly, the team found that the licensee's organization responsible for maintaining this part of the design and licensing basis did not understand the importance of maintaining these bases consistent with one anothe A

._

'

?

in this area, the team found it difficult to correlate the design and licensing bases with one another. Previously realizing these difficulties, the licensee had changed FSAR Table 15.6-9, Note 1 (FSAR Change 96-34, dated June 1996) to read,

" ...

the tables of assumptions and doses to the public, control room and technical support center (TAC) from an Unit 3 LOCA presented here are somewhat out of date but cannot be modified until the above license amendment request is resolved. In the interim, the license amendment request documentation and the supervisor of radiological engineering should be consulted concoming questions on LOCA radiological assumptions and results."

The specific issues and violations are discussed belo Offsite Dose Analysis - LOCA , ,

Calculation 88-019-96RA, Revision 2, dated November 2,1993, including Change 1, dated September 18,1997, *EAB [ Exclusion Area Boundary) and LPZ [ Low Population Zone) Doses From a Unit 3 LOCA," was the calculation of record for the offsite radiological effects of a Unit 3 large break LOCA. The team found that the results of the calculation were not consistent with FSAR Table 15.0-8, " Potential Offsite Doses Due to Accidents," as follows:

Comparison of Offsite Dose Calculations to FSAR Table 15.0-8

]

EAB Dose EAB Dose LPZ Dose LPZ Dose Thyroid (rem) Gamma (rem) Thyroid (rem) Gamma (rem)

Calculation 150 1 .6 !

Results  !

FSAR Table 140 .0 .0-8 This is an example of a violation of 10 CFR 50.71(e) which requires that the FSAR be updated periodically to ensure it contains the latest material developed (VIO 50-423/97-209-03).

In response to the disagreements in the values of the FSAR table and the calculation the licensee will determine whether or not a safety evaluation is required to be performed. This is an Unresolved item (URI 50-423/97-209-16).

Control Room Ooerator Dose - LOCA )

,

Calculation M3R00M94/0164-R3, Revision 0, dated December 1,1994, updated by Change 1, i dated September 22,1997, " Doses to the MP3 [ Millstone, Unit 3) Control Room and TAC Following a Unit 3 LOCA," was provided to the team by the licensee as the calcufstion of record for the Unit 3 control room and technical support center radiological effects for a Unit 3 large break LOCA. The following discrepancies were identifie d'

l The calculation assumed an unfiltered in-leakage to the control room for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following a l LOCA, but failed to address a single-failure vulnerability in the control room inlet damper arrangement identified by the licensee in 1996 and described in the adverse condition report

.

(ACR) M3-96-0276. This issue was closed with a memorandum (RB-97-137) on November 8, 1997. The team determined that the licensee's disposition of this issue was inadequate. The j licensee's review was informal and contained no calculations to support the conclusions. In ('

addition, the 10-minute operator response time to manually reposition the dampers assumed by the licensee was unsupported. During a simulator exercise, where the inspection team purposely failed these dampers, operators were aware of the need to open the dampers, but put no emphasis on the time limit. The licensee concluded that the operator response time to reposition the control room ventilation inlet dampers was more appropriately 40 minutes rather *

than the 10 minutes previously assumed . A formal dose assessment using accepted methodologies concluded that the dose impact to the operators was minima The failure to implement adequate corrective actions once the inlet damper single-failure vulnerability issue was raised during the CMP is an apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI (eel 50 423/97-209-06).- -

Two additional calculations of records in this area VR(B)-394, 'To Determine The Effect of Reduced Filtered Air intake Along with Filtered Recirculation on the Control Room Habitability Analysis," Revision 0, dated July 13,1997, and Calculation 88-019-97RA, " Doses to the MP-3 Control Room and Technical Support Center From a Unit 3 LOCA," Revision 0, dated February 12,1989, overlappe The licensee indicated that they would address the multiple calculations of record issue by completing a stand-alone calculation with consistent design and licensing basis references.-

The team concluded that the proposed action was appropriat !

Offsite Dose Analvses - SGTR Calculation VR(B)-259, " Radiological Consequences Due to a Steam Generator Tube Rupture,"

Revision 4, dated February 17,1984, was provided to the team by the licensee as the calculation of record for this event. The team identified the following discrepancies in this calculation. The results of the calculations were not affected by the discrepancie (1) NRC SRP Section 15.6.3, " Radiological Consequences of Steam Generator Tube Failure," states 'The steam generator tube rupture has been evaluated with and without a concarrent loss of offsite power " FSAR Section 15.6.3.3 reflected this statement with the statement, "Offsite power is conservatively assumed to be lost following the tube rupture, resulting in the condenser being unavailable for steam dump." This was reflected in FSAR Section 15.6.3.1 that stated, "In the event of coincident station blackout (loss of offsite power), i as assumed in the transients presented in this section, the steam dump valves automatically !

close to protect the condenser." However, this assumption was not reflected in this calculation or FSAR Table 15.6-8, *[SGTR) Steam Releases and Feedwater Flows," where more than half the steam from the steam generators in the first two hours was dumped into the main condenser rather than to the environment. This would require the availability of the main condenser which would require offsite power. Therefore, this assumption was non-conservative with respect to the FSAR statemen (2) No single-failure was considered in this analysis although FSAR Section 16.6.3.4 stated that the limiting single-failure was assume ;

-_

. _ . _ ..

.

-

.

(3) FSAR Table 15.6-6 showed 106,300 pound mass (Ib/m) of primary coolant lost to the faulted steam generator. The calculation only accounted for 104,500 lb/ . When the team discussed these discrepancies with the licensee, the licensee revealed that, as with the LOCA calculation, this was not the only analysis of record. The licensee provided a Westinghouse generic calculation, WCAP-10698-P-A,* Evaluation of Offsite Radiation Doses fo a Steam Generator Tube Rupture Accident," Supplement 1, dated March 1986. The results of this calculation had been presented to the NRC in a letter dated January 22,1988. Although the results were within the values recommended by the NRC SRP (10 percent of the 10 CFR Part 100, * Reactor Site Criteria" limits), they were not consistent with the FSAR. A comparison of the results with the FSAR follows:

_

Pro Accidentlodine Spike EAB Dose EAB Dose LPZ Dose LPZ Dose Thyroid (rem) Whole Body (rem) Thyroid (rem) Whole Body (rem)

Calculation 1 .2 .2 Results FSAR Table .019 0.24 0.0012 15.0-8 ,

Concurrent lodine Spike EAB Dose EAB Dose LPZ Dose LPZ Dose Thyroid (rem) Whole Body (rem) Thyroid (rem) Whole Body (rem)

Calculation .2 .2 Results ,

FSAR Table 0.34 0.018 0.076 0.0011 15.0-8 The licensee had identified these discrepancies in 1996 and wrote ACR-M3-96-0875. The resolution was to have Westinghouse produce a new calculation. This new calculation was received by the licensee during the inspection but had not yet been reviewed and approved by the license In response to the disagreements in the values of the FSAR table and the calculation the licensee will determine whether or not a safety evaluation is required to be performed. This an Unresolved item (URI 50-423/97-209-16).

Unlike the first calculation presented to the team by the licensee, the Westinghouse analyses did consider numerous single-failure scenarios. However, they did not consider a single-failure of a steam generator blowdown isolation valve on the faulted ' steam generator. The team noted that the resultant offsite and onsite dose from this single-failure had the potential to be significantly higher than what was analyzed. For example, first the cont;nued flow through this valve would pressurize the steam generator blowdown tank until relief Valve, 3 MSS-RV3-0, would lift to atmosphere on the turbine building roof. This would result in an unaccounted ground-level release path from the faulted steam generator. Second, unlike the release path

,

-

.,

through the main steam safety valves, no credit could be taken for the partition factor between the steam generator liquid and the steam (assumed to be 100) for this release path since the source for this release path was the liquid from the bottom of the steam generators. The analysis considered that the release from the faulted steam generator would be terminated by operators in one-half hour. This is how long it takes to reduce reactor coolant system pressure to below the faulted steam generator safety valve setpoint. However, blowdown through this release pathway, and therefore, primary-to-secondary leakage through the tube break, would continue until the primary pressure was reduced to the blowdown tank relief valve reset pressure, approximately 75 psig, which would take approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or untilit was manually isolate The licensee maintained that this single-failure was acceptable because there was a redundant .i air-operated isolation valve in the blowdown line to isolate the line. However, this was a non-safety-related valve that could not be taken credit for in the design. The licensee also ' ~ 4 maintained that there were manual valves that could be used for isolation. Although this was correct, the team found that no operator action time to close these valves was considered in the analyses nor were there any " response not obtained," actions in the plant emergency operating procedures. The licensee agreed that they would verify that the assumptions made in the analysis, once approved, were consistent with plant operating procedure This aspect of the licensee's analysis is an Unresolved item (URI 50-423/97-209-07).

l 2. Evaluation of S&L's ICAVP Review I Inspection Scope  ;

i The team performed an evaluation of the eight Tier 2 dose consequence-related entical characteristics reviews conducted by the contracto Observations and Findinas (1) The licensee did not provide S&L with the latest calculation of record as requested. The latest calculation is WCAP-10698-P-A," Evaluation of Offsite fladiation Doses for a Steam Generator Tube Rupture Accident," Supplement 1, dated March 1986. S&L committed to review the new Westinghouse analysis once it was approved and implemented by the license (2) Critical Characteristics 68,69, and 191 were associated with the dose to the control room operators. These three critical characteristics addressed the same accident and entailed verifying that the dose calculation was in accordance with the descriptions, assumptions, and values contained in FSAR Tables 15.6-10,15.6-12,15.6-14 through 15.6-20, and FSAR Sections 15.0.9.1 and 15.6.5.4, and that the results were as reported in FSAR Table 15.6-1 The team found that S&L had adequately verified that the calculation incorporated the descriptions, assumptions, and values contained in the above referenced Tables. The review also detected the discrepancy between the control room ventilation flow rates shown in Table 15.6-12 and the rates allowed by TS 4.7.7.

-

(3) Critical Characteristics 192 and 197 involved a review of offsite dose due to ESF building leakage. Item 197 involved a verification that the ECCS system leakage of 5,000 cc/hr

- .

__

.

'

(into the secondary containment building) described in FSAR Table 15.6-9 and FSAR Section 15.6.5.4 was reflected in the analysis of offsite dose from a LOCA. In addition, the verification method proposed stated, " Verify that assumptions listed in Table 15.6-9 reflect the plant design, operating, and testing characteristics...." item 192 involved a verification that the supporting dose calculation results were properly reflected in FSAR Table 15.0- The team found that the review did verify that the ECCS system leakage identified in the FSAR were consistent with the assumptions in the dose analysis and that the dose analysis results were consistent with the FSA However, S&L did not verify that the assumptions listed in FSAR Table 15.6-9 reflected the plant design, operating, and testing characteristics as they had described in their planned -

verification method. Once these issues were raised, S&L appropriately performed their planned

-

review, wrote discrepancy reports, as appropriate, and documented their result q

)

(4) Critical Characteristic 163 involved the LOCA radiological consequences of secondary containment bypass leakage. The review method reflected a verification that the secondary bypass leakage used in the LOCA radiological analyses was per FSAR Table 15.6-9 and FSAR Section 15.6.5.4. In addition, the review also included a verification that the licensee had identified all of the bypass leakage paths and modeled them appropriately in the post-LOCA dose analyses, and that the release pathways were limited only to the containment and the auxiliary building ventilatio The team found that the review did verify that the radiological dose analyses was consistent with the bypass leakage assumptions contained in FSAR Table 15.6-9 and FSAR Section 15.6. (5) Critical Characteristic involved a verification that the assumptions in FSAR Table 15.6-1 were properly incorporated in the TAC LOCA dose analyses, the plant design, operating, and testing characteristics, and that the analyses results were correctly reflected in FSAR Table 15.6-22. The team found that the review did verify that the data in FSAR Table 15.6-21 were properly incorporated in the design analysis and the plant design, operating, and testing characteristics. The analyses results were verified to be correctly reflected in FSAR Table 15.6-2 I 2.4.2 Conclusions The licensee's organization responsible for maintaining the design and licensing bases for radiological consequences did not have an appreciation of the need to maintain these bases consistent with one another. Corrective actions implemented by this organization reflected an informal, non-rigorous approach towards the resolution of problems. Once identified by the NRC team, licensee management immediately recognized the significance of these issues and committed to implement immediate improvements. These included hiring independent oversight of the organization, re-performing calculations as stand-alone documents, and a verification that the plant is operated in accordance with the design and licensing bases as applicable. The team considered the licensee response to the issues to be acceptabl The scope of the S&L review met the requirements of the project instructions and the quality of the review was acceptabl '

. . -

,

'

OperatorActions Insonetion Saa The team observed an operating crew respond to both an SGTR and LOCA on the Unit 3 simulator, reviewed emergency operating procedures, and performed plant tours. The review of emergency operating procedures involved a verification that the accident analysis assumptions, design bases, licensing bases, and plant operation conformed with each other when appropriat Observations and Findinos Steam Generator Tube Runture (SGTR) Emeroenev Operations PE-r=!are (EOP) (E-3)

SGTR EOP (E-3) was a symptom-based procedure developed by following the generic Westinghouse Owners Group (WOG) procedure guidance. The licensee appropriately modified the generic WOG E-3 procedure to agree with the configuration of Unit 3. A step deviation document was prepared and describes in detail why and where a deviation from the WOG approved procedure exists. In general, the deviations were a result ofinserting the plant specific information for components. Plant specific instrument setpoints were developed using the setpoint calculation methodology provided in the generic WOG procedure development document The operator training on EOPs is part of the Unit 3 accredited licensed operator training program. In addition, a detailed analysis was performed by the licensee for the design basis SGTR event which included studies of the operator response times on the plant specific simulator during licensed operator retraining scenarios. The team observed an operating crew during a design basis SGTR scenario on the Unit 3 simulator. ' The operating crew used the appropriate EOPs and rigorously progressed through the EOP network which directed them to EOP E-3. Using EOP E-3, the operating crew manually isolated the steam generator with the ruptured tube (including SG blowdown) and maintained adequate reactor core sub-cooling prior to equalization of the steam generator pressure with the reactor coolant system pressure. The team determined the operator response times to mitigate the event using the EOPs exceeded the response times stated in the Unit 3 FSAR, " Accident Analyses," Chapter 15. The operators'

response time was 46 minutes, contrary to FSAR Section 15.6.3, which reflected an operator response time of 30 minutes. The licensee was aware of the discrepancy and recently re-performed the SGTR analysis using an NRC approved Westinghouse methodology. In addition, the licensee planned to update FSAR Section 15.6.3, to reflect the proper operator response time and will determine whether or not a safety evaluation is required to be performe This is an Unresolved item (UNR 50-423/g7-209-16).

Loss of Reactor or Secondary Coolant AeMant (E-1)

i EOP E-1 was a symptom-based procedure developed from the generic WOG procedure guidance. The licensee had appropriately modified the generic WOG E-1 procedure to agree with the configuration of their facility. A step deviation document was prepared and provided l

.. . . - . - - - . . - - .

.

'

.

the appropriate level of detail why and where a deviation from the WOG approved procedure existe The team observed an operating crew during a LOCA scenario on the Unit 3 simulator. The scenario simulated a 6-inch break in the RCS cold-leg. The operating crew appropriately used the EOPs, and progressed through the EOP network which directed them to EOP E-1, LOC Using EOP E-1, the crew executed the appropriate mitigation strategy in accordance with the EOP network including ES-1.3, " Transfer to Cold Leg Recirculation.' The team then advanced the clock to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and observed the crew appropriately perform EOP ES-1.4, " Transfer to Hot Leg Recirculation."

2.5.1 Evaluation of E4.'s ICAVP Review Overall, S&L followed their project instructions but did not certify the availability of instrument indications in the control room for Critical Characteristics 64 and 156 involving a review of the operators transfer to hot-leg recirculation and subsequent transfer to cold-leg recirculation, respectively. Subsequently, S&L completed their added review ofindications available to the operator and concluded that they were appropriate for all EOP scenario .5.2 Conclusions The team concluded that sufficient indications and procedures are in place to ensure an orderly transfer to both ES1-3, and ES-1.4 and that opemtors were property traine The licensee appropriately identified the discrepancy between the design / licensing basis and plant operation associated with the 30- minute period of time for operators to equalize the RCS and steam generator pressure .0 Design Control and Configuration Management The NRC design control and configuration management team inspection (Tier 3) plan included l (1) a determination if the current Millstone Unit 3 change processes were adequate to maintain !

the design and licensing basis; (2) an evaluation of how well these processes were being implemented by the licensee; and (3) an evaluation of the effectiveness of S&L's revie !

To accomplish objective (1), the team evaluated the licensee's procedures that control changes to plant calculations, technical specifications, permanent and temporary modifications, ,

drawings, set points, replacement items, the final safety analysis report, computer software,

'

and operations, maintenance, and surveillance procedures were inspected. For objective (2),

the team inspected approximately 130 changes made to Unit 3 since January 1996. Objective (3) was accomplished by inspecting approximately 30 of the 260 past changes reviewed by S&L The specific changes and procedures inspected by the team are listed in Appendix During the Tier 3 inspection, the team focused on verifying that (1) the licensee appropriately considered which design disciplines were to be included in the review of the design change, i (2) the design change was appropriately reviewed by plant management, (3) the design package was property evaluated to determine if the change constituted an unroviewed safety apostion, (4) the appropriate design bases were utilized in the review, (5) the change used -

property qualified components, (6) tne design change was property tested after installation, i

. . ... . . _

. _ . . . . - ..

.

'

(7) the operators received the appropriate training on the change, (8) the operating procedures were properly changed, and (g) the system interaction was considered in the change proces .1 Engineering Design Control- Change Processes Inacection Scope The team reviewed the following significant engineering design control processes used to maintain the Unit 3 configuration and design basis:

e Nuclear Group Procedure (NGP) 5.2g, "The Design Control Process"

.

• Design Control Manual (DCM), R_evision 5 _ . . .

• Procedure NGP 6.12. " Evaluation of a Replacement item" The team also selected a sample of 57 changes to Unit 3 systems, structures, or components for the review. This sample included a review of engineering work requests (EWRs), setpoint changes, commercial grade dedications, American Society of Mechanical Engineers (ASME)

Section XI repair and replacements, like-for-like replacements, design change notices (DCNs),

design change requests (DCRs), and minor modification In addition, the team evaluated the licensee's processes for making temporary modifications to Unit 3. These procedures included the licensees DCM, and Procedure WC 10 (Unit 3),

" Jumper, Lifted Lead, and Bypass Control." To evaluate the implementation of these  ;

procedures, the team selected a sample of 33 recently closed and open temporary '

modifications to inspec Observations and Findings {

Temporary Modifications l

The team found that the procedure for temporary plant modi 5 cations had been significantly :

improved since the initiation of the ICAVP Nevertheless, some inconsistencies were found 1 between this procedure and TS 6.5.1.6, " Plant Operations Review Committee." TS 6.5. i required that the Plant Operations Review Committee (PORC) review all proposed changes or modifications to plant systems or equipment that affect nuclear safety. The specific inconsistencies were:

(1) WC-10, Attachment 2, 'Non Operational Equipment Temporary Modification Control," l permits making temporary modifications to non-operational equipment without prior PORC 4 review. WC-10 Step 1.3.10.b requires PORC review and approval within 14 days ofinstallation, not before it is installed as indicated in TS 6.5. (2) WC-10, Revision 1, permits removal and re-installation of a temporary modification I without explicit PORC approval. This may not always be appropriate, (e.g. repeated leak repairs !

on a valve) and was not consistent with TS 6.5. '

.

.

.

The guidance in WC-10, which allowed the installation of temporary modifications without prior PORC review, are examples of inadequate procedures. Technical Speedication 6.8.1,

" Procedures," requires that adequate procedures be developed, implemented, and maintaine The team discussed these observations with the Unit 3 Shift Supervisor who reviewed all the installed Unit 3 temporary modifications with the team. All temporary modifications were found to have been previously reviewed by PORC. The licensee issued CR M3-97 4161 to initiate correctrve actions to correct the procedure. This failure constitutes a violation of minor significance and is being treated as a non-cited violation (NCV) consistent with Section IV of the NRC Enforcement Policy (NCV 50 423/97-209-08).

Temocrary Medhens - Emeroent Corweima I

The license had not established adequate guidance on the evaluation of emergent conditions on systems with temporary modificatons installe . ._

For example, during a review of installed temporary modifications that included a walkdown of the Unit 3 "A" EDG, the inspectors noted that Bypass / Jumper 3-970049, was installed to block the "A" EDG building ventilation exhaust dampers in the "open" position. Another Bypass /

' Jumper 3-97-060 installed two temporary 480 Vac space heaters in the EDG building. The licensee indicated that the heaters were necessary to maintain an adequate temperature in the builoin The licensee stated that an actuator for the EDG building ventilation system air intake dampers had failed "open" on October 11,1997. Upon further review a potential system interaction problem between the failed "open" air intake dampers and the blocked "opan" exhaust fans was recognized. The train "A" EDG building tomado dampers were then tested for proper operatio The test determined that when closed, the tomado dampers would not automatically reopen as designed. This would prevent the train "A" EDG building ventilation from self-restoring, as designed to normal operations following a tomado. Manual restoration of the ventilaton system would be acceptable to realign the system to a recirculation configuration. However, the licensee determined that the differential pressure across the train "A" EDG building door could be sufficiently high to prevent it from being opened. This would make it impossible for operators to manually realign the EDG building ventilation. The licensee declared the train "A" l

EDG inoperable on November 13,1997, and submitted a Licensee Event Report (LER) on December 18,1997. Since spare parts were not available, another temporary modification was implemented on November 15,1997, to replacs the safety-related intake damper motor that had failed and the 'A' EDG was declared operabl The licensee concluded that a failure of the "A" EDG building ventilation system air intake damper on October 11,1997, rendered the "A" EDG inoperable for a period of 36 days. During this period, Unit 3 was in a volume control tank outage and the "A" charging pump, with it's associated train "A" EDG, was required for a reactivity flow path (boron injection). For 36 days the potential existed that following a tomado event, the emergency power source would not be available to support the boron injection flow path required by TS Section 3.1.2.1.

. 1 The failure to have an operable emergency power source to support the required boron  !

inject'on flow path is a violation of TS 3.1.2.1 (VIO 50-423/97-209-09).

18 '

_ . _ _ _ _ _ _ , _

.

'

instaHation of Temocrary Mc-1,79- ,s The inspectors reviewed Bypass / Jumper 3-97-060 used to install the space heaters in the train

"A" EDG building. The inspectors noted that these temporary heaters were required to be installed more than six inches above the building floor to reduce the risk of fire in the event of an oil or fuel spill. During the previous walkdown of the building, the inspectors had noted that the heaters were installed approximately four inches above the building floor. 10 CFR Part 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings," requires that activities affecting quality be prescribed by and accomplished per documented instructions, procedures, or drawings of a type appropriate to the circumstances. The failure to install the space heaters per the instruchons provided in Bypass / Jumper 3-97-060 is an example of a violation of 10 CFR Part 50, Appendix B, Criterion V (VIO 50-423/97-209-10).

Ter.ssrerv Mod;f;.Ari catada'lan control

~~

- -

The team found a procedure inadequacy in that WC-10 did not require that calculations supporting temporary modifications be controlled in accordance with the DC For example, Bypass / Jumper 3-96-111, " Block Open 3FWA*AOV62A and B," dated January 2, 1997, installed a temporary blocking device on the subject auxiliary feedwater (AFW) system train cross-connect valves between the discharge piping of the A and B motor-driven AFW pumps. This was required to support an electrical outage in one train of AFW by allowing the operable AFW pump to feed the opposite train steam generators to meet the TS requirement that two steam generators be available for decay heat removal. The temporary modification incorporated an uncontrolled calculation that analyzed the stresses in the temporary blocking device. This equipment, and hence this calculation, were " activities affecting quality" on a system "important to safety."

10 CFR Part 50, ' Instructions, Procedures, and Drawings,* Appendix B, Criterion V, requires that activities affecting quality be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, and drawing The licensee's Design Control Manual (DCM), Chapter 5, *Chculations," required that calculations (1) document the applicable references and design inputs, (2) clearly state the assumptions and their bases, (3) describe the method of calculation, (4) be design verified, and

(5) be numbered and logged, among many other requirements. None of these requirements had been accomplished in the calculation incorporated into the evaluation of the bypassfjumpe Additionally, the DCM required that such calculations be "... structured to enable a technically qualified, competent individual to retrieve and verify the results without recourse to the preparer." Neither the inspector nor the licensee contact person could verify the results of this calculation due to its lack of explanation and clartt The licensee's failure to control the generation, review, and approval of this calculation is an example of a violation of 10 CFR Part 50, Appendix B, Criterion V (VIO 50 423/97-209-11).

Subsequently, the licensee initiated a review of temporary modifications installed in all three units. Two temporary modifications, one in Unit 1 and one in Unit 2 were identifed with calculations that were of suc:h complexity that they should have been formally controlled in

i i

-

,

-

l

accordance with the DCM. The team concluded that the licensee's immediate corrective actions following the identifi* ion of this problem were timely and appropriat Temporary Moddications Opunation of Design Bases Bypass / Jumper 3-96-070, "MSIV [ Main Steam isolation Valve) Cylinder Hole Cover Plates,"

was initiated on July 3,1996, to restore the "C" main steam line pressure boundary while the plant was in Mode 5. This was required to assure a decay heat removal path through this steam line in case of a loss-of-shutdown-cooling even The "C" steam line pressure boundary had been breached during the outage by removal of the MSIV pilot valves, leaving two small holes. This bypass / jumper required that steel plates with a minimum thickness of %-inch, along with gaskets, be bolted over the holes. The bypass /

Jumper stated that 65 psig "... conservatively bounds any pressure that may result from the loss

) of RHR [ Residual Heat Removal System)...," and %-inch plates were deemed adequate for this

!

pressur The team also reviewed EOP 3505," Loss of Shutdown Cooling and/or RCS Inventory,' Revision 1 8, dated July 19,1997, to determine an enveloping pressure that could have been reached for i the loss-of-shutdown-cooling event. This procedure contained no provisions that would have I limited the main steam pressure to 65 psig. It did, however, limit RCS pressure to 330 psia !

l (315 psig). Therefore, the actual main steam pressure would have been significantly above the 65 psig assumed.

l l The actual plates installed were provided by the valve manufacturer and were approximately 1-l inch thick. Therefore, they would have withstood considerably more pressure than the %-inch l thick plates the licensee was planing to use. The licensee appropriately generated CR M3-97-l 4405 to address the teams conco CFR Part 50, ' Design Control," Appendix B, Criterion 111, requires that measures be i established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.

.

Contrary to this requirement, the licensee failed to translate Em appropriate pressure limits in i Bypass / Jumper 3-96-070 for the MSIV cover plate (VIO 50 423/97-209-12).

3.1.1 Evaluation and Conclusions of S&L's ICAVP Review Twenty of the 90 changes reviewed by the team discussed in Section 3.1 above, were also reviewed by S&L. The team evaluated S&L's review and determined that they followed their project instructions and performed an acceptable review of these changes.

3. Conclusions The team concluded that the licensee's procedures for conducting design changes met the requirements of 10 CFR Part 50, Appendix B. The team did find some problems associated with isolated procedural weaknesses, such as calculations associated with temporary modifications were not controlled to tle san,e level as design changes, and emergent

-- .

.

'

t conddions were not evaluated adequately on systems that had temporary modifications. The licensee was responsive to the concoms raised by the tea .2 Licensing and Administrative Controls - Change Processes Insoection Scope The team reviewed the significant processes used to maintain the Unit 3 licensing bases. The specdc procedures reviewed were NGP 4.03, Changes and Updates to FSAR for Operating Nuclear Plants; Regulatory Affair and Compliance (RAC) 03, Revision 0; Changes and Revisions to Final Safety Analysis Reports, RAC 01, Revision 0; Licensing Basis Management NGP 3.12, Safety Evaluations Process; and NGP 4.02, Proposed Technical Specification Change Requests and Requests for Enforcement Discretion." The team also selected 51 changes for the inspection. These changes included 33 FSAR changes,4 TS changes, and 14 procedure change Observations and Findinos Channes to the Final Safety Analvsis Ranart The process for verifying the accuracy of the Unit 3 FSAR was defined by Project instruction (U3._PI) 19, " Millstone Unit 3 Final Safety Analysis Report Verification." Attachment 1 of Revision 0 to U3_Pl 19 required the use of NGP 4.03 and the preparation of a safety evaluation (SE). However, NGP 4.03, Revision 9, permitted the use of an SE or a 10 CFR 50.59 SE screening form to ensure that the basis on which the operating license was issued is not invalidated. Allowing an SE screening to be performed rather than performing a full SE would be acceptable only for administrative changes to the FSAR such a fixing a typographical erro l Many of the FSAR change (FSARCRs) packages reviewed by the team were, in fact, multiple l

changes combined in one package. In accordance with the licensees NGP 4.03 procedure, )

those FSARCRs which were classified as clarifications rather than changes did not have a SE l prior to approval. Within the group of changes which were for clarification only, the team I identified some changes that affected the licensing basis of Unit 3. As such, the team concluded that those FSARCRs should have included a safeh evaluation. For example:

(1) FSARCR 97-MP3-84 made approximately 10 changes to the FSAR, including deleting the statements "The auxiliary feedwater system (AFW) meets all the requirements of IEEE

[ Institute of Electronics and Electrical Engineers) Standard 279-1979" and "... auxiliary feed ,

pump suction pressure transmitters arc periodically tested in accordance with the Technical Specification ." The licensee's basis for making these changes without a safety evaluation was, they ' correct misleading or ambiguous information and deletes information that is either redundant or not applicable." The licenses stated the deleted statements were more inclusive than intended because only the safety-related portions of the AFW meet the IEEE standard requirements, and the auxiliary feed pump suction pressure transmitters are not mentioned in the Technical Specir,cet;on (2) FSARCR 97-MP3-90 replaces the statement, "The quench spray pumps have manual controls on the main control board and at the auxi:iary shutdown panel (ASP)," with the statement, ' Controls and indicators are provided in the control room for manual operation of the

.

'

quench spray system. REMOTE /LOCA control selector switches are provided for the quench spray pumps outside the control room at the switchgear." The team noted that the ASP and switchgear are in different location (3) FSARCR 97-MP3-134 replaced the statement, " Manual control with transfer switches for these valves are located at the ASP," with the statement, " Manual control for these valves are located at the ASP. Transfer switches for these valves are located on the Transfer Switch Panel (TSP)." The team noted that the ASP and TSP are in different location NGP 4.03, Section 6.4.17, requires PORC approval of stand alone FSAR changes which require a SE. As a result of not developing an SE for FSARCRs implemented for clarification purposes, many changes, which appeared to be more than just clarifications were not reviewed by PORC prior to approval. The team concluded that the threshold for writing a SE was not

.

appropriate. This observation was discussed with the licensee and the licensee indicated that both intamal and extemal reviews in June 1997, had identified this SE threshold program weakness and corrective actions had been initiated. One of the corrective actions was to review FSARCRs performed from the time of licensing until the start of the Unit 3 configuration management effort which was in 1996. Another corrective action was to revise the applicable plant procedures and re-train plant personnel concoming the development of formal SEs for FSAR changes which were previously described as clarifications. The licensee further indicated that the guidance contained in NGP 4.03 prior to the fall of 1997 allowed personnel to not develop an SE if there was a conflict between the FSAR and other quality related documents as long as the FSAR could be changed to match the other documents as a clarification rather than a change to the FSA The team identified a relationship between the time the FSARCRs were approved and the corrective actions described by the licensee. Specifically, the overall quality of the associated screening forms and SE had been substantially improved. In general, those FSARCRs implemented in mid-1997 were found to appropriately include a SE when neede Furthermore, the team found that those approved in the fall of 1997 were more complete and included discussions of all the changes included in the FSARCR. The team attributed these improvements to the corrective actions described by the licensee, clear goals and expectations from the operations review committee, and critical self-assessments in this are T l However, the licensee's corrective actions for the SE threshold program weaknesses did not l include a review of the approximately 500 FSARCRs approved between the start of the CMP l effort (mid 1996) and the retraining of plant personnel in mid 1997. The licensee concurred with !

the teams finding, and prior to the end of the inspection period, wrote CR 97-4022, and l completed their review of all FSARCRs approved between the start of the CMP and the retraining of personnelinvolved with revising the FSAR. Using their current threshold for writing SEs, the licensee found that about 50 percent of the FSARCRs implemented during that period should have included a SE. The licensee also indicated that their review of all of the FSARCRs implemented without a SE found no unreviewed safety question l l

10 CFR 50.59, " Changes, Tests and Experiments," states that the licensee shall maintain l records of the facility. These records must include safety evaluations which provide the basis for the determination that the change does not involve an unreviewed safety question. (VIO 50-423/97-209-013).  :

,

l

.

'

t Safety Evaluations The team reviewed NGP 3.12, " Safety Evaluations," Revision 10, dated March 1,1997, which was the licensee's precedure for the performance of safety evaluations required by 10 CFR 50.59, " Changes, Tests, and Experiments." Since problems with the threshold for writing an SE had been previously identified by the licensee, the team also reviewed the licensee's draft procedure to replace NGP 3.12, which was procedure RAC 12, " Safety Evaluation Screens and Safety Evaluations." A number of additionalinconsistencies between the procedures and 10 CFR 50.59 were identified by the tea (1) NGP 3.12, Section 4.5 defined " Consequences of an Acc6 dent" as, "The radiological dose to the public from a postulated accident." This definition was too narrow in that it did not .

address consequences to the Operators, which are limited by 10 CFR Part 50, Appendix A,

_

" General Design Criteria," (GDC) Number 19. " Control Room." The licensee's draft procedure, RAC 12, had the same definition. The licensee acknowledge the observations and committed to revise the definition in RAC 12 prior to its issuanc (2) NGP 3.12, Section 4.8 defined " Equipment important to Safety" only in terms of equipment relied upon to remain functional following design basis accidents. The team found that this definition was too narrow. The definitions from several regulatory sources, including 10 CFR 50.72 and 50.73 also include equipment necessary to keep the plant in a safe condition, even where no accident has occurred. For instance,10 CFR 50.72 and 50.73 defined safety functions as:

e Shutting down the reactor and maintaining it in a safe shutdown conditio * Removing decay heat.

e Controlling the release of radioactive materia l e Mitigating the consequences of an acciden The licensee agreed to provide additional guidance on the term " equipment important to safety" in RAC 12, Revision (.

'

(3) The NGP 3.12 SE forms did not explicitly ask the same three questions contained in 10 CFR 50.59 nor provide a place to ac.swer yes or no in addition to requiring a discussion of the bases. The team was concemed that the potential existed for the questions and answers to be misunderstood. The licensee responded that the forms had been revised in RAC 12 to address the team's conce I (4) NGP 3.12, Section A.4, discussed "USQ [Unreviewed Safety Question] Determination I Guidance", and Subsection A.4.5, discussed the " Possibility of an Accident of a Different Type Than Previously Analyzed in the Safety Analysis Report". This subsection indicated that if a newly identified accident type was bounded by other events that were analyzed, or if the newly identified accident type was judged less credible than other accidents that were identified in the

{

licensing bas,es, it did not have to be considered a USQ. This direction was not consistent with ;

10 CFR 50.59 whicF. stated without qualification, that if the possibility of a diierent type of i accident than any previously evaluated in the safety analysis report (SAR) was created, then !

i

l

- -- .--

.

.

'

t the change involves a USQ. Per 10 CFR 50.5g, bounding events and probability of occurrence were not to be a part of the consideration for a different type of accident. The licensee agreed to change the RAC 12 guidance to conform with 10 CFR 50.5 ,

(5) Subsection A.4.6 of NGP 3.12, discussed the same discrepancy regarding the

" Possibility of a Malfunction of a Different Type than any Evaluated Previously in the Safety

~ Analysis Report". This subsection stated that "If the proposed Change could result in a different failure mode [" malfunction of a different type") than any previously evaluated, then the Change may be a USQ. As before, per 10 CFR 50.5g , if the change created a " malfunction of a different type",it involved a US (6) NGP 3.12, Figure A.6, at the bottom of the figure, the "USQ Dose Increase Criteria"

~ '

indicated that if a change created a change in dose to the public greater than 1 mram above the dose previously reported in the SAR and also more than 10 percent grester than the SAR reported dose, then the change involved a USQ. This was not consistent with 10 CFR 50.5g, which allowed no incremental dose increase without the change being considered a USQ. The licensee indicated they would be revising this guidanc (7) NGP 3.12, Figure A.6, this figure did not address the radiation dose limits to Operator The licensee agreed to revise RAC 12 accordingl The licensee's proposed changes to the subject procedure will be reviewed by the NRC. This is an inspection Followup item (IFl 50 423/g7-20g-14).

Technical Saadfientian Chana== - Auriliary Feedwater (AFMA System Break I =Em i

The team reviewed four TS changes and the TS change processes. In general, the team concluded that the processes and three of the TS changes reviewed were found to be  !

adequate. One TS change had a problem with a previously unanalyzed AFW system pipe i break, and is discussed belo Proposed technical specification change request (PTSCR) 3-18-g7, dated June 6,1997, J changed TSs 3.7.1.3,4.7.1.3.1, and 4.7.1.3.2. The changes mainly involved increasing the i combined total water volume required to be in the domineralized water storage tank (DWST) i and the condensate storage tank (CST) during Modes 1,2, and 3, from 334,000 gallons. The water volume change was to account for 50,000 gallons of unusable volume in the CS To ascertain the maximum volume of water needed, the licensee reviewed the FSAR Chapter 15 " accidents" and determined that the feedwater line break was the most limiting. The volume .

required for a " major" feedwater line break included the following components: 306,236 gallons ;

for decay heat and sensible heat removal in order to meet the FSAR required "10/6 criteria" (sufficient water for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> of steam discharge in hot standby, plus 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> RCS cooldown to 350'F); 19,364 gallons for DWST unusable volume, measurement uncertainty, and vortexing allowance, plus 30 minutes of spillage through the break. In this analysis, break spillage from the AFW injection piping was limited to 8,400 gallons by the cavitating venturis which were a design feature specifically installed for this purpos The team identified a break location on the AFW injection piping, the section of 6-inch AFW

.

.

,.

piping between the cavitating venturis and the upstream check valves that was pressurized during normal operation. If a break were to occur at one of these points, the spillage from the AFW system could be considerably more than assumed since the cavitating venturi would not restrict the injection flow from the AFW pumps. This new break location was also identified by the licensee and documented in CR M3-97-2556, dated August 8,1997. The team noted that this CR had been initiated by the licensee after questions were raised during the NRC review of the proposed TS chang The team reviewed the licensee's CR, subsequent reportability determination, and planned corrective actions. The licensee's reportability determination concluded that the subject break location was bounded by FSAR Chapter 15 analyses. Since the licensing basis of Unit 3 allowed the exclusion of a loss-of-offsite power for certain pipe breaks when the pipe break does not result in a transient (e.g. a reactor or turbine trip), the team agreed with the licensee's conclusion. The licensee property determined that a single active failure should be considered when analyzing this event. The licensee also conservatively assumed that the reactor would be tripped before conditions within containment approached any reactor trip setpoint. Once the reactor was tripped, the licensee assumed that the worst-case single-failure would be a failure of the turbine driven AFW pum However, the licensee's position was that following a break in this location no automatic reactor trip would occur, the plant would be shutdown in an orderly manner, the break would be isolated, and then operators would cool the reactor coolant system with the AFW system. The inspectors then focused on whether operators were capable of identifying and isolating the break before the AFW system was started or if the break could be isolated by operators before damage to the AFW system occurred after it was starte The licenssa indicated that operators would be able to identify the symptoms of a feedwater or main steam pipe break by increased containment humidity, temperature, pressure, and higher containment sump flow rates. In addition, the operator alarm response procedures direct a containment entry as soon as possible to identify the source of the leakage. The licensee indicated that the expected response for a pipe break in this location was either (1) initiate a manual reactor trip, or (2) reduce power to 50 percent, at which time a manual reactor trip would be inserted. The licensee further indicated that prior to the reactor trip order, operators would be expected to initiate AFW flow in anticipation of a feedwater isolation signal on a low Teve condition during the manual reactor trip. The team recognized that with the indications available, operators would not be able to identify the exact location of the break unless the containment entry was successful. This would require operators to rapidly identify the AFW pipe break after they started the AFW system in preparation for the manual reactor trip discussed abov The team's concem was that if operators failed to recognize that one of the motor-driven AFW pumps was in a run out condition after it was started, it would not take long for that pump to fai If the other motor-driven AFW pump failed to start (single-failure), then no AFW would be available until the operator started the turbine-driven AFW pump. If the operator failed to recognize that one of the motor-driven AFW pumps failed from excessive run out because of the pipe break, then nothing would prevent the same thing from happening to the turbine-driven

.

AFW pump. Although, these events were not likely to occur, the team concluded it was

. ... . . - - . . .

.

'

'

.

important to verify that operators would respond appropriately to this apparent design weaknes Once the licensee completes their corrective actions, the NRC will review the indications available to the operator, how the operator starts the AFW system, and determine if an operator has sufficient indications available and procedural guidance to isolate an AFW pipe break prior to initiating a manual reactor trip following an AFW pipe break. This planned NRC activity is an inspection Followup item (IFl 50 423/97-209-15).

3.2.1 Evaluation and Conclusion of S&L's ICAVP Review Eight of the 51 changes reviewed by the team, as discussed in Section 3.2.1, above, were also -

reviewed by S&L The team found that the review was in accordance with the project instructions and was acceptable. S&L was not tasked to review NGP 3.12, and, hence, did not have the opportunity to identify the issues associated with inconsistencies between the procedure and 10 CFR 50.5 .2.2 Conclusions The team concluded that the licensee's procedures for maintaining the Unit 3 licensing bases were adequate. Although the level of detail could be improved in the Unit 3 SEs, the team found that the packages reviewed were sufficiently developed to support the conclusions. A weakness was identified in the threshold for writing an SE for an FSARCR, which later was found to have been previously identified by the licensee. The team also found that the licensee's corrective actions failed to review FSARCRs between mid-1996 and July 1997. The licenses's subsequent investigation revealed that SEs should have written for approximately 50 preent of the FSARCRs written during that period of time (a total of 250 SEs). Upon review by the licensee of the FSARCRs identified by the team none resulted in USQ Several procedural inadequacies were identified in the licensee's procedure for writing SEs. In general, these procedure interpretations involved direct conflicts with 10 CFR 50.59. However, no unresolved safety questions (USQs) were identifie e Entrance and Exit Meetings  !

The team conducted entrance meetings on November 10,1997, and December 1,1997, at the Millstone Unit 3 facility for Tier 3 and Tier 2, respectively. On January 5,1998, the team conducted an entrance meeting at the S&L offices in Chicago, Illinois. During each of these meetings the team discussed the scope, duration, and expected support requirements for each phase of the inspectio On January 28,1998, the team leader conducted an exit meeting which was open for public observation. During this meeting, the team's findings and observations were discusse A partial list of persons who attended these meetings is attached in Appendix i r

--

- .

'

Appendix A List of Apparent Violations, Unresolved items, and Inspector Followup items This report categorizes the inspection findings as violations (VIO), apparent violations being considered for escalated enforcement (EEI), unresolved items (URis) or inspector followup items (IFI) in accordance with Chapter 610 of the NRC Inspection Manual. An apparent violation is a matter about which the Commission has concluded there is enough information to conclude a violation of a legally binding requirement has occurred. The violation is classified as apparent until the NRC assigns a severity level and the licensee is given the appropriate chance to respond to the NRC's determinations. A URI is a matter about which the Commission requires more information to determine whether the issue in question is acceptable

- -

or constitutes a deviation, nonconformance, or violation. The NRC may issue enforcement action resulting from its review of the identified URis.~ ~ An IFl is a matter for which additenal information is needed that was not available during the inspectio Item Number Finding Type Section(s) Title 50-423/97-209-01 VIO 2.1.b(1) Violation for failure to develop adequate 2.1.b(2) procedures in accordance with Technical Specification 6. /97-209-02 eel 2. Violation for failure to establish an I adequate program to reduce leakage of primary coolant sources outside containment in accordance with Technical Specification 6. /97-209-03 VIO 2.2.b(1) Failure to maintain the Final Safety 2.2.b(2) Analysis Report current as required by 2. CFR 50.71(e).

50-423/97-209-04 NCV Minor violation of TS 6.8.1 regarding in'- I service testirgi of the service water system Pum /97-209-05 IFl 2. Unanalyzed low-level fault current revie /97-209-06 eel 2. Failure to implement adequate corrective actions in accordance with 10 CFR '

Part 50, Appendix B, Criterion XV /97-209-07 URI 2. Verification that appropriate operators

' actions are defined to isolate steam generator blowdown in the event the I

automatic isolation fail /97-209-08 NC . Minorinadequacies in the temporary modification procedur ,

.

A-1

,m

.

.

,.

50 423/97-209-09 VIO 3. Failure to meet the limiting condition for operation for Technical Specification 3.1.2.1 for the Train "A" emergency diesel generato /97-209-10 VIO 3. inadequate design and installation of temporary modifications contrary to 10 CFR Part 50, Appendix B, Criterion /97-209-11 VIO 3. inadequate control of calculations of l'

temporary modifications contrary to 10 CFR Part 50, Appendix B, Criterion /97-209-12 - VIO 3. Failure to adequate translate design- -

{

bases into a temporary modifcation in accordance with 10 CFR Part 50, Appendix B, Criterion Il /97-209-13 VIO 3. Failure to include safety evaluations with records of FSAR changes where safety evaluations are required by 10 CFR 50.5 /97-209-14 IFl 3. Licensee to upgrade procedure NPG 3.12,

" Safety Evaluations."

50 423/97-209-15 IFl 3. Verification of appropriate operator actions following a auxiliary feedwater system pipe break upstream of the cavitating ventur /97-209-16 URI 2.4b Based on disagreements between the 2.4b FSAR and the need for safety evaluations to be performe .

A-2 l

i w

- - . - _ .

'

.

?

Appendix B Entrance & Exit Meeting Attendees Partial List bleME ORGANIZATION Neil Cams NU, Chief Nuclear Omcor Dave Goebel NU, VP Nuclear Oversight Michael Brothers NU, Unit 3 Recovery Officer Martin Bowling NU, Unit 2 Recovery Officer .

,

Jack McElwain NU, Unit 2 Recovery Officer .

Patricia Loftus NU, Manager, Regulatory Affairs

' Denny Hicks

'

~NU, Director, Unit 3 -

Barry Pinkowitz NU, Manager, Unit 3 Operations Paul Grossman NU, Director, Unit 3 Engineering Gary Swider NU, Manager, Technical Support Engineering Robert Andren NU, Manager, Design Engineering Wayne Kropp NU, Nuclear Oversight Mario Bonaca NU, Nuclear Engineering Barbara Wilkens NU, Manager, Programs and Engineering Standards Evan Woollacott Nuclear Energy Advisory Council (NEAC)

Terry Concannon NEAC Richard Laudenat NU-lCAVP Drexel Harris NU-Licensing Joe Fougere NU, Manager ICAVP Raymond Necci NU-ICAVP William Travers NRC/ Director, SPO Eugene Imbro NRC/ Deputy Director, ICAVP, SPO Steve Reynolds NRC/ Chief, ICAVP,SPO Peter Kottay NRC/ICAVP,SPO ,-

Anthony Gody NRC Team Leader, ICAVP,SPO i Mike Plunkett NRC/ Contractor- Team Member Don Prevette NRC/ Contractor-Team Member Brian Hughes NRC/lCAVP,SPO -Team Member Omar Mazzoni NRC Contractor-Team Member AlWalker NRC/ICAVP, SPO -Team Member Robert Quirk NRC Contractor-Team Member James idoughton NRC/ICAVP, SPO-Team Member Harold Ektenholz NRC/lCAVP,SPO -Team Member Wayne Lenning NRC/ Deputy Director, Reactor Projects, SPO Jack Durr . NRC/ Chief, Reactor Projects, SPO Tony Come NRC Senior Resident inspector- Unit 3 Beth Korona NRC Resident inspector- Unit 3

.

B-1 l

..

'

.-

Appendix C List of Documents PROCEDURES Emergency Operating Procedures (EOP)

EOP E-1, * Loss of Reactor or Secondary Coolant"

EOP E-3, ' Steam Generator Tube Rupture"

EOP ES-1.3, " Transfer to Cold Leg Recirculation"

EOP ES-1.4, " Transfer to Hot Leg Recirculation"

EOP 3505, Revision 8, " Loss of Shutdown Cooling and/or RCS Inventory"

• AOP 356g, Revision 11. " Severs Weather Conditions"

. . . . ..

_ Operating Procedures (OP)

OP 3260, " Unit 3 Conduct of Operations"

OP3203, Revision 15, " Plant Startup"

• - OP3252 Revision 3, Change 1, " Operator Aids"

OP3353.MB1 A-MB4C, " Main Board Annunciator Response"

OP 3215, Revision 5, " Response to intake Structure Degraded Conditions" i OP 32608, " Equipment Control"

EN 31064, Revision 3, " Operating Strategy for Service Water System - Millstone 3" Surveillance Procedures (SP)

SP 31024, Revision 2, " Calculation of Reactor Trip and ESF Response Times"

SP 3443E10 E20, E30, E40, Revision 3, "Four Channel RPS/ESFAS [ Engineered Safety Feature Actuation System) Time Response..."

SP 3443E11, E21, E31, Revision 0, "Three Channel RPS/ESFAS Time Response..."

SP 3443E12, E22, E32, E42, Revision 0, * Protection Set 1 RCS Narrow Range RTD Time Response..."

SP 3642.1, "A EDG Monthly Surveillance Test"

SP 3642.2, "B EDG Monthly Surveillance Test" a SP 3646A.2, Revision 13, " Emergency Diesel Generator B Operability Test"

SP 3646A.1g, Revision 3, " SIS Transfer of DG From Test to Standby"

SP 3712NB, Revision 1, " Battery Discharge Testing Surveillance"

-

SP 3712NB, Revision 2, " Battery Discharge Testing Surveillance"

SP 3885, Revision 5, * PASS Reactor Coolant Operability Test"

SP 3626.13, Revision 15, " Service Water Heat Exchanger Fouling Determination"

SP 3630A.6-2, Revision g, " Reactor Plant Component Cooling Water Pump 3CCP*P1C OperationalTest"

SP 3630A.7, Revision 5, " Reactor Plant Component Cooling Water System Valve Operational Test"

SP 3630E.1, Revision 5, " Safety injection Pump A- Cooling Pump Operational Readness Test"

SP 3630E.2, Revision 5, " Safety injection Pump B - Cooling Pump Operational Readiness Test"

EN 31121, Revision 6, "MP3 - lST Pump Operational Readiness Evaluation" C-2

. . - -

a

-- -. .

,

'

t Administrative Procedures (NGP/RAC) l

NGP 5.29, "The Design Control Process"

• -l NGP 6.12 " Evaluation of a Replacement item"

NGP 4.03, " Changes and Updates to FSAR for Operating Nuclear Plants"

-

RAC 03, Revision 0, " Changes and Revisions to Final Safety Analysis Reports"

-

RAC 01, Revision 0, " Licensing Basis Management'

NGP 3.12, Revision 10, " Safety Evaluations"

NGP 4.02, " Proposed Technical Specification Change Requests and Requests for Enforcement Discretion" l

-

WC 10, Revision 0, Jumper, Lifted Lead, and Bypass Control."

Design Control Manual (DCM), Revision 5 DRAWINGS - - - -

-

12179-EM-102A, Revision 15, " Reactor Coolant System"

12179-EM-102B, Revision 15, " Reactor Coolant System"

=

12179-EM-102D, Revision 10. " Reactor Coolant System"

12179-EM-102E, Revision 13, " Reactor Coolant System"

12179-EM-102F, Revision 8 " Reactor Coolant System"

-

12179-EM-103A, Revision 15, ' Reactor Coolant Pump Seals"

-

12179-EM-105A, Revision 12, " Charging Pump Sealing and Lubrication'

j

- 12179-EM-104A, Revision 28, " Chemical & Volume Control"

12179-EM-104D, Revision 17, " Chemical & Volume Control"

=

12179-EM-113A, Revision 14, "High Pressure Safety injection" 12179-EM-113B, Revision 18, "High Pressure Safety injection"

-

-

12179-EM-112A, Revision 25, " Low Pressure Safety injection"

12179-EM-112C, Revision 16, " Low Pressure Safety injection / Containment Recirculation"

• 12179-EM-133B, Revision 34, * Service Water *

• 12179-EM-1488, Revision 14, " Reactor Plant Ventilation"

= 12179-EM-148A, Revision 25, " Reactor Plant Ventilation ~

~

12179-EM-151A, Revision 18, ' Control Building Heating, Ventilation, and Air Conditioning"

=

12179-EM-115A, Revision 19, " Quench Spray & H, Recombiner*

12179-EM-133A-28, " Service Water," dated October 29,'1997

-

12179-EM-133B-39, " Service Water," dated November 26,1997

-

12179-EM-133C-18, " Service Water," dated October 29,1997

.

12179-EM-1330-26, " Service Water," dated October 29,1997

12179-EM-121A-19, " Reactor Plant Component Cooling Water System," dated May 13,1997 CALCULATIONS

Stone & Webster Calculation 03705-US(B)-359, Revision 0, "Rocirculation Spray Pump Performance"

NU Calculation 90-069-01131M3, Revision 1, Change 2, " Evaluation of 3HVR*ACU1 A and 1B Cooling Coils Under Various Conditions of Tube Pluggage and Fouling"

Stone & Webster Calculation 12179-US(B)-273, " Post LOCA Containment Temperature and Pressure Analysis"

- Stone & Webster ^,alculation 12179-US(B)-253, Revision 5, " Documentation of LOCTIC Data Deck for Millstone Unit #3 LOCA Analysis" C-3

-- .

.-

, I

-

,

-

Stone & Webster Calculation 17273.19-US(B)-342, Revision 2, " Recirculation Spray Heat Exchanger 'UA' Spray & LHSI Recirculation Modes"

Stone & Webster Calculation 03705-US(B)-359, Revision 0, " Recirculation Spray Pump Performance"

Stone & Webster Calculation 12179-P(B)-958, Revision 1, " Control Building Heat Gain Calculation *

Stone & Webster Calculation 12179-P(T)-935, Revision 0, Change 3, *SWP System Operating Conditions"

=

Proto-Power CeipciMion Calculation 97-041, Revision A, "MP3 SW System; Determination of Minimum Available Flows During Accident Scenarios and investigation of SW Heat Exchanger Retum Lines for Potential Cavitation or Choked Flow"

Proto-Power Corporation Calculation 97-035, Revision 0, " Containment Recirculation Cooler Discharge Orifice Cavitation Analysis" . . _

NU Calculation 95-ENG-1177M3, Revision 0, *MP3-Control Building Water Chiller Condenser (3HVK*CHL1A/B) Analysis"

Proto-Power Corporation Calculation 97-123, Revision 0, "MP3-Control Building Water Chiller Condenser (3HVK*CHL1 A/B) Analysis"

.

Proto-Power Corporation Calculation 97-006, Revision 0, Change 1, "MP3 Air Cooling Unit 3HVR-ACU Proto-HX Model Development and Thermal Performance Test"

.

Proto-Power Corporation Calculation 97-002, Revision 0, " Minimum Required Service Water Flow to 3HVQ* ACUS 1 A/B and 3HVQ*ACU2A/B and 3HVK*CHL1A/B'  ;

.

Stone & Webster Calculation 12179-P(B)-1129 Revision 2, Change 3, " Millstone Uni Cooling Loads and Ventilation Requirements for MCC/RCA Air Conditioning"

=

NU Calculation 95-ENG-1037M3, Revision 0, Change 1, "MP3-Charging Pump Coolers 3CCE*E1 A&B; Required Service Water Flow with 78 Degree F SW Temperature"

.

NU Calculation 90-069-1116M3, Revision 0, Change 2, " Millstone Unit No. 3 - Service Water System - Minimum Available Cooling Water Flow Rates Under Design Basis Accident Scenarios"

-

Westinghouse Calculation WCAP-12468, " Component Evaluations," dated July 30,1993

NU Calculation 90-069-01130M3, Revision 0, Change 3, " Millstone Unit No. 3 Service Water System - Summary of Westinghouse Heat Exchanger Calculations"

=

NU Calculation 94-ENG-1037M3, Revision 0, Change 1, "MP3 - Charging Pump Coolers 3CCE*E1A & B; Required Service Water Flow With 78 Degree F SW Temperature'

-

NU Calculation 94-ENG-1038M3, Revision 0, Change 1,"MP3 - Safety injection Pump Coolers 3CCl*E1A & B; Required Service Water Flow With 77 Degree F SW Temperature *

Stone & Webster Calculation 12179-P(T)-1185, Revision 0, Change 1, * Determine the Adequacy of The Main Steam Safety Valves Capacities"

=

Stone & Webster Calculation 12179-SP-3 MSS-01, Revision 0, *3 MSS *RV22A,B,C,D Monitors Main Steam Pressure and Provides Emergency Pressure Relief For the Steam Generators"

Stone & Webster Calculation 12179-SP-3 MSS-02, Revision 0, "3 MSS *RV26A,B,C,D Monitors Main Steam Pressure and Provides Emergency Pressure Relief For the Steam Generators"

.

Stone & Webster Calculation 12179-SP-3 MSS-03, Revision 0, *3 MSS *RV23A,B,C,D Monitors Main Steam Pressure and Provides Emergency Pressure Relief For the Steam Generators"

.

Stone & Webster Calculation 12179-SP-3 MSS-04, Revision 0, *3 MSS *RV24A,B,C,D Monitors Main Steam Pressure and Provides Emergency Pressure Relief Fu the Steam Generators *

Stone & Webster Calculation 12179-SP-3 MSS-05, Revision 0, "S * :.,S*RV25A,B,C,D Monitors Main Steam Pressure and Provides Emerger cy Pressure Relief For the Steam Generators"

NU Calculation No. NSEG-MECH-NSP-181-MSS, Revision 0, *3MSSS-PIC20A,B,C,D (1&2)

Main Steam Line Pressure Relieving Valves 3 MSS-PS20A,B,C,D" C-4

,

.

NU Calculation 96-ENG-1260-M3, Revision 1, "MP3 Main Steam System Pressure Based on Safety Valve Accumulations and Set Point Drift"

Proto-Power Corporation Calculation No.96-001, Revision 0, Change 1, " Empirical Adjustments of the MP3 SW Model to 1995 Flow Test Data and incorporation of DCNs*

Stone & Webster Calculation 12179-P(T)-0974, Revision 0, " Determine maximum Sustained Pressure of Service Water System"

NU Calculation 90-069-1065M3, Revision ), Change '7, "M3 Service Water System - NRC Generic Letter 89-13, item IV Design Basis Summary Report"

Calculation 12179-MP(B)-163-FA, Revision 3, " Water Hammer Analysis of Recirculation Spray System"

Calculation 12179-NM(S)-748-CZC001, Revision 0, Changes 1, 2 & 3, ' Nozzle Evaluation of Containment Recirculation Pump 3RSS*P1 A to P1B'

-

Calculation 12179-NP(F)-2105, Revision 0, Changes 1,2,3 & 4, " Comparison of Calculated

- -,

Nozzle Loads with their Allowable Values for Containment Recirculating Pump 3RSS*P1A" -

Calculation 12179-NP(F)-2106, Revision 0, Changes 1,2, 3 & 4, " Comparison of Calculated Nozzle Loads with their Allowable Values for Containment Recirculating Pump 3RSS*P1R'

-

Calculation 12179-NP(F)-2107, Revision 0, Changes 1,2, 3 & 4, " Comparison of Calculat xf Nozzle Loads with their Allowable Values for Containment Recirculating Pump 3RSS*P10"

Calculation 12179-NP(F)-2108, Revision 0, Changes 1,2 & 3, ' Comparison of Calculated Nozzle Loads with their Allowable Values for Containment Recirculating Pump 3%8*P1D*

Calculation 89-094-1018ES, Revision 4, "MOV Set Point Analysis Acceptance Criteria for 3 MSS *MOV74A, B, C.& D'

-

Calculation 12179-NP(B)-X1704, Revision 3, Changes 1 and 2, " Pipe Stress Analysis- Steam Generator Auxiliary Feedwater Piping'

Calculation 12179-NP(B)-X1706, Revision 1, Change 6, " Pipe Stress Analysis- Steam Generator Auxiliary Feedwater Piping *

P(R)-0983, Revision 0, "NPSH Evaluation for ECCS Pumps RHS, SlH, CHS - Maximum Safeguards *

294, Revision 4, "NPSH Available for ECOS Pumps"

3-ENG-181, Revision 0, " Determination of Available NPSH to Charging Pumps During Gravity Boration"

249, Revision 3, " Determination of Maximum Water Level inside containment Following a LOCA*

232, Revision 2 " Floor Sumps Water Supply as a Function of Floor Water Depth"

W3 517-409-RE, Revision 0, "Altemate Means of Cooling the Safety injection and Charging Pumps'

WCAP-11002, 2/86, " Evaluation of Steam Generator Overfill Due to a Steam Generator Tube Rupture Accident"

-

WCAP-10698-P-A, 3/86, " Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident'

SP-3HK-29, Revision 2, "3HCV*PCV68A&B Pressure Regulator Setpoint"

-

P(B)-0990, Revision 0, " Control Room Emergency Pressurization System"

-

Setpoint Change SP-SlH-5, Revision 2, "3SlH*RV8851-SlH-P1 A/B Discharge"

-

Setpoint Change SP-SlH-5, Revision 3, "3SlH*RV8851-SlH-P1A/B Discharge"

-

Setpoint Change SP-SlH-3, Revision 2, "3SlH*RV8853A/B Safety injection Pump Discharge Pressure"

UR(B)-394-0, Revision 0, "To Determine the Effect of Reduced Filtered Air intake, Along With Filtered Recirculation on the Control Room Habita.%Iity Analysis"

M3R00M94/01064-R3, Revision 0, Change 1, " Doses to the MP3 Control Room and TSC

.

C-5

- --

. . . -

-

'

i

Following a Unit 3 LOCA*

VR(B)-259-4, Revision 4, " Radiological Consequences Due to a Seam Generator Tube Rupture" {

• l WCAP-13002, 8/91, " Margin to Overfill Analysis for a Steam Generator Tube Rupture for Millstone Nuclear Power Station Unit 3 Four-Loop Operation"

WCAP-10698, Supplement 1,3/86, " Evaluation of Offsite Radiation Doses for a Steam I generator Tube Rupture Accident"

NSP-217-FWA, January 28,1988, '3FWA*SS40-3FWA*T1 Overspeed Trip Protection"

P(B)-0990, Revision 0, " Control Room Emergency Pressurizing System"

12179-SP-3HUC-29, '3HVC*PCV68 A&B, Pressure Regulator Setpoint"

Proto-Power Calculation 96-056, Revision 0, "MP3 - Auxiliary Feedwater System; Determination of Degraded and Maximum Pump Curves" -

.

. 96-ENG-1277-M3, Revision _0, Change 1 "MP3 - AFW System Proto-Flo Model, Database -

Documentation Package"

97-ENG-01467-M3, Revision 0, "Re-rate of Cavitating Venturi's 3FWA*CAV60A, B, C, and D*

US(B)-247, Revision 1, " Sizing of Cavitating Venturies for the Auxiliary Foodwater System"

PPC 97-006, Revision 0, *MP3 MSS System; Determination of Steam Flows and Pressure Drop Relationships for the AFW Turbine (3FWA*T1) Supply and Exhaust Piping"

US(C)-294, Revision 4, "NPSH Available for ECCS Pumps"

97-ENG-01474D3, Revision 0, *MP3 AFW System DWST inventory Loss As a Result of an SSE"

P(R)-0983, Revision 0, 'NPSH Evaluation for ECCS Pumps RHS, SlH, CHS - Maximum Safeguards'

SP-3SlH-3, dated March 25,1993, "3SlH*RV8853A, B Safety injection Pump Discharge Pressure"

SP-3SlH-4, dated April 251985, "3SlH*RV8858 Safety injection Pump suction Header Relief Valve"

P(R)-746, dated march 101982, 'ECCS System Leakage Outside Containment"

Engineering Report M3-ERP-970011, Revision 0, "Non-Safety Line Break Failure Analysis"

86-078-623GM, Revision 0, Change 1, " Duration of the Seal Water Supply in the Containment Recirculation Pumps Post-LOCA"

88-019-96RA, Revision 2, Change 1, "EAB and LPZ Doses from a Unit 3 LOCA"

195E, Revision 0, Change 3, " Verification of Cable Selection for 6.9 kV and 4.16 kV Loads Emergency Diesel Generator Cables" $

=

195E, Revision 0, Change 4, "4160 V switchgear power cables routed in trays without maintained spacing"

BAT 1-96-1241E3, Revision 1, Change 1, * Replacement of solenoids for Battery 1, Charger, Associated Cable and Electrical Device Verification"

BAT 1-96-1241E3, Revision 1, Change 2, " Loading revision for Battery 1, Charger, Associated Cable and Electrical Device Verification"

• . BAT 1-96-1241E3, Revision 1, Change 3, " Loading revision for Battery 1, Charger, Associated Cable and Electrical Device Verification'

BAT 1-96-1241E3, Revision 1, Change 4, " Loading revision for Battery 1, Charger, Associated Cable and Electrical Device Verifcation"

BAT 2-96-1243E3, Revision 1, Change 1, " Modification of Auxiliary Building Vent System for Battery No. 2, Charger and Associated Cable and Electrical Device Verifcation'

BAT 2-93-1243E3, Revision 1, Change 2, " Relay Load Changen for Battery No. 2, Charger and ,

Associated Cable and Electrical Device Verifcation"

• l BAT 2-96-1243E3, Revision 1, Change 3, " Change of lockout relay for Battery No. 2, Charger C-6

,

'

e and Associated Cable and Electrical Device Verification'

-

BATS-96-1247E3, Revision 0, Change 1, " Potential for cable ignition for Battery 5 & Charger"

BATS-96-1243E3, Revision 1, " Verification of existing e'esign for Battery No. 5 & Charger with Associated Cable & Equipment"

=

BAT-SYST-1240E3, Revision 1, "DC System Analysh, Methodology and Scenario Development"

NL-033, Revision. 3, Change 3, " Emergency Generater Loading and Starting KVA Incorrect insertion of spread sheets"

NL-033, Revision. 3, Change 4, " Emergency Generator Loading and Starting KVA Per as built conditions"

NL-033, Revision. 3, Change S, " Change in Brake horse power for Emergency Generator Loading and Starting KVA"

NL-033, Revision. 3, Change 6, * Emergency Generator Loading and Starting KVA" LICENSING DOCUMENTS

=

FSAR Section 1.2.10, " Engineered Safety Features *

FSAR Table 1.3-1, " Design Comparison"

-

FSAR Section 1.8 "Conformance to NRC Regulatory Guides"

=

FSAR Section 1.8N, "NSSS conformance to NRC Regulatory Guides"

=

FSAR Section 6.3, " Emergency Core Cooling System"

SER Section 6.3, " Emergency Core Cooling System"

FSAR Section 15.6, * Decrease in Reactor Coolant inventory *

FSAR Section 6.2.4.1.2, " Isolation Criteria - Fluid Systems Penetrating the Containment *

FSAR Section 6.2.4.1.4, " Design Requirements for Containment isolation Barriers"

FSAR Section 6.2.4.2, *[ Containment) System Design"

FSAR Section 6.2.3.6.3, " Containment isolation Valves Leakage Rate Test (Type C)"

-

FSAR Section 10.4.9, " Auxiliary Feedwater System"

-

Technical Specification 3.5.4, " Refueling Water Storage Tank"

FSAR Section 15.2.8, "Feedwater System Pipe Break"

=

Technical Specification 3/4.7.7, ' Control Room Emergency Ventilation System"

-

Technical Specification 3/4.6, " Containment Systems" a

Technical Specification 3/4.7.9, ' Auxiliary Building Filter

- Technical Specification 3/4.7.8, " Control Room Envelope, Pressurization System" System"

FSAR Table 15.0-7, " lodine and Noble Gas inventory in Reactor Core and Fuel Rod Gaps'

• FSAR Table 15.0-8, " Potential Offsite Doses Due to Accidents" LICENSEE EVENT REPORTS (LERa)

LER 423/89012, July 5,1989, ' Containment Leakage in Excess of Limits Due to Valve Leakage" 1

LER 423/97018, March 7,1997, " Technical Specification Parameter Compliance *  !

.

LER 423/96044, December 4,1996, " Qualification of Containment Systems Following a i Design Basis Accident"

-

LER 423/96032, October 9,1996, "High Pressure Safety injection Relief Valve Piping Hydrostatic Test Non-Compliance with ASME Code Due to Personnel Error"

LER 423/96031, October 6,1996, " Potential Failure of Safety Related Control Valves Due to Failure of Non-Qualified Air Regulators"

LER 423/96029, September 29,1996, " Functional Deficiency in the Setting of the Emergency i

C-7 i

i

--

..--. - -. . . .

..

.

'

i Core Cooling System Throttle Valve Positions *

LER 423/96028, December 13,1996, " Potential Overcooling of Charging Pump Lube Oil System Due to Failure of Air-Operated Temperature Control Valves"

-

LER 423/94010, August 24,1994, "Both Trains of Charging inoperable Due to Procedural Deficiency"

LER 423/97008, February 22,1997, " Failure to Enter Technical Specification 3.0.3 Action Statement for MSIV Closure"

-

LER 423/94007, May 13,1994 ' Violation of Engineered Safety Feature Response Time for Quench spray System" .

! *

LER 423/93006, June 21,1993, " inadequate Surveillance Testing of High Pressure Safety injection Check Valves"

t LER 423/92026, December 3,1992, "Both Trains of High Pressure Safety injection .

l Inoperable"

_ _ . . .

l LER 423/91011, May 10,1991, "Both Trains of high Pressure Safety injection System i inoperable Due to Relief Valve Leakage" j =

LER 423/89022, October 25,1989, " Valve Stroke Time Testing in the Wrong Direction Due to ;

l Transcription Error"

LER 423/97029, Revision 0, " Design Basis Concem on Steam Generator Tube Rupture

(SGTR) Analysis for Main Steam Pressure Relief Bypass Valves (MSPRBV)*

l LER 423/97041, Revision 0, " Operation of Service Water System With Only One Pump i Operable" OTHER DOCUMENTS / MANUALS REVIEWED

Vendor Manual ELC1-801R1 "LCSR [ Loop Current Step Response] Analyzer AMS [American Measurement Systems) Model ELC-1 Operation, Maintenance, and Calibration Manual" l

l

$

,

I

. ,

,

l C-8 '

>

..

_. -- .-

_

.

e Appendix D List of Acronyms ACR(s) adverse condition report (s)

AFW auxiliary feedwater i

ANSI American National Standards instituto ARG accident review group ASME American Society of Mechanical Engineers ASP auxiliary shutdown panel

'

CCI charging pump cooling CCR ,, component cooling water - -

cfm cubic feet per minute CFR CodedFederniRegulations

' CMP configuration management plan CR(s) condition report (s)

CST condensate storage tank DCM design change manual DCN design change notice DCR design change request 4 DWST domineralized water storage tank ECCS emergency core cooling system EDG emergency diesel generator EDI engineering department instruction eel escalated enforcement item EOP(s) emergency operation procedure (s)

ESF engineered safety feature ESFAS engineered safety feature actuation system EWR(s) engineering work request (s)

FSAR Final Safety Analysis Report FSARCR Final Safety Analysis Report Change Request GDC general design criterion / criteria

' HELB high energy line break j l

ICAVP Independent Corrective Action Verificat'en Program l IEEE Institute of Electrical and Electronics Engineers j IFl inspechon followupitem l ISA instrumentaten standard LCSR loop current step response LER(s) licensee event report (s)  !

LOCA loss-of-coolant accident  :

D-1  !

O

f MELB medium-energy line break MSIV main steamisolation valve NCV non-cited violation NGP(s) Nuclear Group Procedure (s)

NNECO Northeast Nuclear Energy Company NRC U.S. Nuclear Regulatory Commission 4 NUREG NRC technical report

{

OP(s) operating procedure (s)

OPdT over-pressure A temperature OTdT over-temperature A temperature

!

P&lD - piping and instrumentation diagrams - - c - -

I PORC Plant Operations Review Commhtee PTSCR Plant Technical Specification Change Request QSS ,

quench spray system RCS reactor coolant system RHR residual heat removal RPS reactor protection system RSS recirculation spray system RTD resistance temperature detector RWST refueling water storage tank S&L Sargent and Lundy SAR safety analysis report SE safety evaluation SGTR steam generator tube rupture SlH high pressure safety irSection SIL low pressure safetyinjection SLCRS supplementary leakage collection and release system SP surveillance procedure I, SRP Standard Review Plan .

SSE safe shutdown earthquake SWS- service water system Teve

'

temperature-average TRM Technical Requirements Manual TS(s) Technical Specification (s)

TSC Technical Support Center UlR unresolved item report i UPA upper plenum anomaly USQ unresolved safety question

.

.

Vac volts, altamating current VCT volume controltank D-2

.

-

_ _ _ . .

,

.

'.

.,

.

,

Vdc volts, direct-current VIO violation-WC water column WOG Westinghouse Owners Group

.

ig c

,

)

!

!

D-3

^__

lij .

-

il I!!!a!!!!!!!::: e si - -- -

l .i j!!

i al l ij l iI ,11 b l {fi i!

, il!  !

Is! ,

s Y bal ji i 1 lo,;11 i

g!;b !  !

i pi l a m!I l I I I is i i l e,I 111.13se tsel Il ie'l

,+

g ..

s:.q~y;;.934;2 . .jly.. ~7,.au,n ; ,6 (DIS $k$ :[Gl[Ys.~. I iC0ig

+et m

{F1?.PM;A t.

;pgkiX3Is;Efft

+3w~ - ]

9M~s4 di ? ^iY.4 *

= 7~;;949ff/p,74fNf0"i-sW,:i D?ir l, :

. 3. o^

f l

'-*y peCJ --g

,

e e

.,

!

P -

il1 r -

-

I ,1=

ei llt nl{

311 31-

.. all all

.

2 1 il $1 f l  !

i  !

Il 5 2l!'l { l'tlil li sI

!

l' IflI b g

n ax

an ll . u"I 0l.!!.!a!

1 .

2 6 n, gram q 4a?an;%@:s,,i$$

a ;w . .

- a:

i 5 $ N$3NE e

N>22yg gg@

h*Iijd y;y;.7~;y,::y~g

]3 ~y; ;rNIM E S Ii;

}\,:. m;=799;pw!&gg.g')4?p s&EMI sys m Jhw

, $ygg;gppyg; gls gj+ycgm 73y;

>

l is;g;.;r;

,

n

_

-

' - -

a ** #e-g- .w- %-, , up

' .

lll 1

1 a

-

1 E!!!ain!i

" ~

f ]l i

l'

lls g

.a 9 3 L 1,1 ! i!I !!

7 ,4, g> ; -

, 2

!!I k lh bj ii !

I Ilajg i

'oem ffi

! i ll

a(iu!

.

11 "

11 &

e 1!.I1 ta 11 se *iifeel in e - lll11!lI e

ws en- # .. ggwa&

f !^ bh 2 5 b5 11L iM. i{'Rd!& l!$RMs

-

b

. - -

.

,I]'l3 .

-

.

3-I Ol! I's io i

.

10 1!

. II !.

If I T

,

] .Vw&SMmen g .es @ E _frlW&M iar f %dyn @

wn @d %t:ed s ; w.;;

i AiFS" s :www! iDFET_

b $$lhWM}dZ~WJGi' ads;MWWCj [gisiNhbdN$ !kbfd

. . . _ ..

.

.

-

.

11j -

si 1::!-

-

1:::

-

-

1 1 1:!

I .Ili ,il i 1 l , ,j inai 1(!,3 ,

i i I ,i i111

! I.! ,,! i ii . i : 4111111

,

1: *

l *

' I i i 1 . ,

g, j !g I !

'

ll ll l3ljI h

<j l 11 1 .i .i i l'iti f

I ! !y 1 i

.

Il ,

liel iel ie P'

'

11 1s l sls ee 1 eti

-

g, y ~my

~ my%:;;+%e p 4 :;

.

vg *ai2.: 2

1. [ II ,I I'

f j $

j 5 '

.

yp .

3:r a g} .~ g ig SJ@ 5, gg;j}

]}d JM.n,. ].,

..

1].yli@s,?

.

y; gN[@w.g@;,js ye ;g hd ..z

-

I

..

..

. . . _ _ _ _ _ _ - _ _ - - - - _ _ - .

ee

?

li l il!!! s!! s!a!!s!! t -

"

l !hl 1 1

.

A gI { h

[ 1 8 i [t lj{

n1 ll i 1 l " ,

l[ 11 1 ! li ii '

lI il I" i,

, n_

Il i!!!fi w

ill n

1,11 n

!!

y7 [

I w$.m' la'.u'

[

u gi i ksMMW xmW lll, %j; r,

-

l

!

l'

il1 t . - -

.

'

i nlj I Iilli !!

a 1111 11 5 2 1

1 illi i <

I4 Iiii '

< '

1111.1 .

• ' ' *l::;.._l,yyri. _. . g rl],?ll._~lf", * l N <

, ,: 5 ' ' ' :?3_

{' ^

~

a it Lme_ .

m@4$D4

?

.

!

.

111 ij j -

.

j '

i .I,I f^

.

lil! ,

• 2 *

% h l } 88 a I  ! iH i tlk !! li lI ,l, !!INIIillll!!!lh!!lljl

 !0!!,i  ,

Il

     ,n 1'

a A8 IA 1 1 A

    ;

A

     .f 11 ,. 131

       '
- st I s, ss e, 1,6 1-ae s1 93x ~': n ,' ;;g
   . ;.;wsmyg  ':

9, ;w- 51

.

l5 % ~ w v: p gi ,; .~gp:g p. ;y 5 4; , 3c .z;jw.r y:;. 5g ~, ,.,y:,Ay -

     '
   .
     ;
$ ....er  . .
 '
  -    -
     '

h' E

    ::1.aw
    -

yvua w x

      .

11<

 'cdi; M. W 3. (5vg N. ?u;z c rea?j f g, p f @e :.. ~
.Il' ..
 .. . .

Q.{!lb.?, .

    . ..  ,
       ;

l

,
:
-
 $E $I ll   -

I jI l1 i t i ,

 !i l 'i l !]

11 I! Il i

     :

g i n J ll li lii i{1 I in i ii '. I !!!! !!llhi 111 IL l;l

 .
 .

jj,llii i . . . . .

 .. .. . . .
  . . . . . . - - . - . . . . _ - -
     !

.
*

f Appendix F

$EN@MIKs22s2$hS&LTIER3ITEMSINSPECTED.BY;THENRC36@)$%efjM~ 3s Document Number Description FSARCRs 92-MP3-21 Emergency generator starting air system j 96-MP3-26 Emergency generatorload sequencer 96-MP3-28 Foundation data for major structures bearing capacity for j   major structures
 '

NCRs 3-91-0085' - Repair of Valve 3BDG'V890 - l 3-87-0071 Electrical penetration conduit leaking EWRs 3-93-00146 Valve stem faliures to RCS & MSS valve 3-94-00093 S/G feed-water nozzle thermocouples l Procedure 3622.3-1, Turbine driven auxiliary feed-water pump operational Changes Revision 8 readiness test SP-3611C.1, Post accidentliquid sampling Revision 3 ' SP-3611C.1, Post accedent liquid sampling Revision 4 SP-3712NB, Battery surveillance discharge testing , Revision 1 SP-3712NB, Battery surveillance discharge testing Revision 2 Set-point MP3-94-018 RPCCW pressure switch 3CCP-PS17A, B set-point Changes revision SP-3CCP-5, Setpoint change - charging pump Revision 1 SP-3SlH-3, Setpoint change - high pressure safety injection Revision 2

SP-3SlH-5,- Setpoint change - high pressure safety injection Revision 2 L

SP-3SlH-5, Setpoint change - high pressure safety injection Revision 3 CGDs MP3-0179 Service water system MP3-93-0020 Service water system F-1

.
-

. i

@Mfj9tf%.@ S&L TIER 3 ITEMS INSPECTED BY.THE NRCggynQelis{yQ MP3-93-0141 Diesellube oil system l

MP3-0001 4160V switchgear MP3-0019 Post accident monitor ASME M3-95-07535 Replace 3CCl*E1A end cover bolting Section XI Repair & Replaceme nts (AWOs) M3-96-18649 Replace 3SWP*MOV24B and flange bolting Temporary RWST Hi-Hi and RWST Hi level annuciators on main Alterations 3-94-016 control board MB2

     '

3-97-006 Battery 3 (301A-2) i Like forlike Pump sealmaterial  ; replacemen RIE-93-0082 < ts RIE-93-0093 Pressure transmitter  : RIE-199608 Replace Pacific valve with Crane valve RIE-199025 Model number change for roller yoke pin RIE-201457 Replace GE battery with Varta battery DCNs DM3-S-0091-93 Support requirements for drain lines DM3-S-300-90 Pratt butterfly valves DM3-P-168-91 Agastat set-poirik I DM3-P-0018-90 Group i ESF lamps DM3-S-0103-90 Electrical penetration study F-2

.
-

. Mfi4MMsD4 w:c-usih +m ADDITIONAL TIER 3 ITEMS INSPECTED BY mw c:-aw.a.:sacwm.was:&u.aw,~>se m, iM

     .a THE NRC Document Number Description Design DCR-M3- 3 MSS *MOV17A, 3 MSS *MOV178 and 3 MSS *MOV17D Change 96062 added as containment isolation valves Request-96063 QSS/RSS pipe support modifications-96067 Emergency diesel generator modification-96071 Interior repair of emergency fuel oil tank
, ,
 -9607,5 CCP. system design temperature rerate support modification

      '
 -96068 Safety injection system pipe support modification-96056 QSS/RSS/SWP pipe support modifications outside  ,

containment I i-96085 Set-point changes for 3HVZ-TS24,3HVZ-TS25A,3HVZ-TS258, 3HVZ-TS28A, 3HVZ-TF288, 3HVZ-TS29A, and 3HVZ-TS29B-96087 3SWP*RO153A/B orifice size change-97015 CCP supply and retum piping temperature reevaluation i-97026 Re-rate of auxiliary feedwater system inside containment-97027 Cold over-pressure protection system PORV actuation set-point change-97045 RSS pump restriction orifices to prevent suction line flashing-97063 RSS expansion joint support modification-97061 DWSTlevelindication modification-97020 Modification to preclude a loss of spent fuel pool cooling-97083 Set-point revision for reactor coolant pump under-speed reactor trip Minor MMDM3- TTIP hardware installation for hydraulic snubber RF06 Modifications 96561-96564 Addition of drain connection to service water header-96581 Connection of gamma-metrics audio circuit to containment speaker F-3

'

.
-
.
%
& %%w.so w@hs!GiAG! a u w em nan,m ADDITIONAL TIERw3wITEMSw w:m INSPECTED m THE NRCNBY:wweecn!PsW
     ?.n i: n-96582- Recirculation pump vortex suppression grating hold-down clamp design-96590 Replacement of unqualified conax penetration terminal block-96592 ILRT blow-down silencer installation-96586 GWS moisture analyzer replacement 3GWS-MIT68-97516 Modification of containment structure polar crane 3MHR-CRN1-97529 Set-point change gamma-metric neutron flux monitoring system-97541 Modification to boric acid batching tank outlet piping Bypass and 96-017 Encapsulation of 3 MSS-PV47C Jumpers (Temporary modifications)

96-029 Temporary plug for control room pressure boundary, train B 96-030 Temporary plug for control room pressure boundary, train A 96-034 Blocking closed "B" suxiliary building filter inlet damper 3HVR* MOD 20B 96-035 Blocking closed "B" fuel building filter inlet damper 3HVR* MOD 808,, 96-037 Blocked closed t' rain *B" SLCRS for inlet damper 3HVR*AOD95B 96-038 Blank flange for 3FWA*HV32B 96-039 Freeze seal on auxiliary feedwater lines at penetrations 79, 80,81, and 82 - 96-040 Temporary heat for battery room 6 96-047 3RHS*FCV618, "A" RHR heat exchanger bypass, positionerlocking device upgrade 96457 'A' EDG panel, 3EGS*PNLA, annunciator modifications 96-058 "B" EDG panel, 3EGS*PNLB, annunciator modifications 96-059 Temporary cooling to CCS heat exchanger F-4

.

'
.
<
<

Wi4.u. inf wADDITIONAL m::M9&a*aula? <.s m u s.um sTIER w w 3raITEMS s.... o :INSPECTED ws idW6#4 THE NRC BY,1mrwicM@kud E070 MSIV cylinder hot cover plates E071 Sump pump for under-drain sump 3 SWR-SUMP 1 E072 3SWP*AOV39B repair per NCR 3E318 96-077 Battery 2 cell 44 jumper 96-080 Block open 3FWA*AOV62A and B, motor-driven auxiliary feedwater pumps' cross connects 96-091 Position "A" emergency diesel generator cubicle ventilation

 , dampers for maximum cooling ..

96-098 Installation of temporary modified strainer elements 3SWP*STR1 A, B, C, and D E 101 Install modified strainer elements in 3SWP*STR1 A, B, C, and D E 105 Position limiter on 3CCP*TV32A, B, and C E 106 3CCP*FV66A, CCP to "A" RHR heat exchanger, loop monitoring E 107 Install temporary patch on 3SWP*030-345-3 E 111 Block open 3FWA*AOV62A and B, motor-driven auxiliary feedwater pumps' cross connects

    .

97-001 Temporary Heat for Battery Room 6 97-006 Battery 3 Cell 29 Jumper 97-017 3SWP*P1B ARCOR Coating 97-026 Belzona Seat on'3SWP*TV35B 97-027 Temporary Patch on 3SWP-150-104-3(A) 97-030 Electrical Jumper Btw 38YS-PNL5-1 and 3BYS-PNL5-2 Plant 3-11-97 Clarification that only one service water pump per train is Technical needed for the train to be operable Specification Change Request 3-18-97 DWSTlevel measurement 3-20-97 Reactor trip system set-point changes F-5

9 b rad 2@@4.fDf@EADDITIONALTIER v.snau;6mv e a.; ;&au;wascu.w.xww.umu 3 ITEMS INSPECTE

    . amer 3-27-97 New Technical Specifications for the steam generator atmospheric relief bypass valves Final safety 96-MP3-11 Engineered safety features, essential auxiliary support Analysis  system Report Change Requests 44 System response times - radiological consequences
      '

57 Charging, letdown, and seal water system / volume control tank / hydrogen system instrumentation requirements 97-MP3-32 Emergency diesel generator fuel oil storage and transfer system and instrumentation requirements 68 Engineered safety features and essential support systems 72 Containment heat removal system / containment systems / safety related display instrumentation /and compliance with other regulatory requirements 81 Engineered safety systems and essential auxiliary systems 84 Engineered safety systems and essential auxiliary systems 85 Emergency generator fuel oil storage / cooling water system / starting air system / lubrication system / combustion / air intake and exhaust system / engineered safety features and essential auxiliary support systems 86 Engineered safety systems and essential auxiliary support systems i 90 Containment recirculation system / engineered safety _ features and essential auxiliary support systems 97 Engineered safety systems and essential auxiliary support systems 115 Control systems not required for safety 120 Seismic design / water systems / air conditioning, heating, cooling and ventilation systems, other auxiliary systems, main steam system, other features of the main steam and power conversion system, decrease in heat removal by the secondary system

      )

F-6

,

' A ff.ffgi'$y@n:DDITIONAL an- n w e TIER c.an z.m ITEMS INSPECTED D%THE2fddy m:3mauaww+.+w.r:ms:ww..msw NRCJipp 127 Auxiliary feedwater system / steam generator blowdown system / loss of non-emergency AS power to station auxiliaries 134 Systems required for safe shutdown 139 Auxiliary building ventilation / containment structure ventilation system / engineered safety features system and essential auxiliary support systems 148 Reactor trip system 151- - Main steam system 152 Main steam system 165 List of reactor trips / generating station variables 170 Protection system interlocks 180 Conformance to Regulatory Guide 1.22/ engineered safety features and essential auxiliary support systems 265 Containmentisolation system 266 Containmentisolation sytem 268 Containment penetration 269 Containment penetration 282 Engineered safety features system / water system N97-MP3-1 Onsite meteorological measurements program 9 Containment structure I

.

F-7 _ _ . - _ _ .

f-

    '

l~ ,i* ' Distribution for Memorandum to M. L. Bowlina \ y Distribution w/ enclosures: - Region I Docket Room (with rapy of concurrences) Nuclear Safety information Center (NSIC) PUBLIC , ' File Center (with Oriainal concurrences) SPO R/F NRC Resident inspector OE (2) W. Axelson, DRS S. Collins W. Travers S.' Reynolds E. Imbro via e-mail W.Lanning M.Callahan, OCA G. Tracy, OEDO P.McKee P. Koltay

' A. Gody, RIV B.Hughes J. Nakoski D. Mcdonald S. Dembek J. Andersen D.Screnci, PAO Inspection Program Branch (IPAS)  l K. Greene, PIMB/ DISP l

i i

    !
    ;

? -

#
,s" Mr. M. L. Bowling   -2-

, the effectiveness of the corrective actions taken to address the finding. Your corrective actions i taken in response to these findings will be assessed by the NRC as part of our review of the implementation of ICAVP-related corrective actions.

, As noted earlier, this inspection was part of the NRC's ongoing assessment of the effectiveness of your CMP and S&L's ICAVP. The findings of this inspection will be combined with the results of other NRC inspections to make an overall determination of the restart readiness of Unit 3 and ' your configuration management practices. However, the results from this inspection provide a measure of confidence that the Unit 3 accident mitigation systems are adequately designed and tested and will perform as assumed in accident analyse In accordance with Title 10 of the Code of fodera/ Regulations, Section 2.790(a), a copy of this letter and the enclosures will be placed in the NRC Public Document Roo Should you have any questions concerning the enclosed inspection report, please contact the project manager, Mr. James Andersen at (301) 415-1437, or the inspection team leader, Mr. Peter Koltay at (301) 415-295

Sincerely, Driginal signed by, Eugene V. Imbro, Deputy Director ICAVP Oversight Special Projects Office Office of Nuclear Reactor Regulation Docket No. 50-423 Enclosures: 1. Notice of Violation 2. Inspection Report 50-423/97-206 cc w/ enclosures: see next page

*" This report was reviewed by a Technical Editor in March 1998 OFFICE ICAVP:SPO E TechE ICAVP ICAVP h -

DD:lCAVP NAME NGNy "* PKoltay SReynoldsN Elmbrod - DATE

 =r 3/l//98 numusunummuseum =

3/---198

   - r = use-3/2//9 s

h/98 amamensammes == bl98 mi OFFICE D:SPO kOE / :lCAVP[q NAME WTravers JLi an Elm / DATE 3/ 198 98 \ 98 \ OFFICIAL RECORD COPY > , }}