IR 05000440/1999005

Insp Rept 50-440/99-05 on 990301-05.No Violations Noted. Major Areas Inspected:Licensee Implementation of 10CFR50.65, Requirements for Monitoring Effectiveness of Maint at Npps

ML20196K850
Person / Time
Site:	Perry
Issue date:	04/02/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20196K849	List: IR 05000440/1999005 ML20196K846
References
50-440-99-05, 50-440-99-5, NUDOCS 9904070278
Download: ML20196K850 (22)

Text

.

.

.

U. S. NUCLEAR REGULATORY COMMISSION REGION 111

Docket No: 50-440 License No: NPF-58 Report No: 50-440/99005(DRS)

Licensee: FirstEnergy Nuclear Operating Company Facility: Perr/ Nuclear Power Plant Location: P. O. Box 97, A200 l Perry, OH 44081 l Dates: March 1 -5,1999 ,

l Inspector: Martin J. Farber, Reactor Engineer, Rlli Anthony N. Fresco, Senior Researen Engineer, BNL J. D. Wilcox, Senior Operations Engineer, NRR Approved by: Ronald N. Gardner, Chief, Electrical Engineering Branch Division of Reactor Safety I

i l

, l

'

l I

o h. 4 0 { 0 g [ y I

l

'

l l

l i

w- .

f

.

EXECUTIVE SUMMARY Perry Nuclear Power Plant, Unit 1 NRC Inspection Report 50-440/98022 This was a special inspection, which examined the licensee's implementation of 10 CFR 5015,

" Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." The report covers a five-day on-site inspection by one regional inspector, an inspector from the Office of Nuclear Reactor Regulation, and a consultant from Brookhaven National Laborator Operations -

-

While operators generally understood the guidance associated with ccunting unavailability times while using managed restoration, tighter controls were necessary to avoid misuse of the process and to ensure continuous availability of a dedicated operato Maintenance

-

The practice of managed ra' - ation, i.e., thn discounting of maintenance rule unavUlability when simp;< ' ned operator actions can make an inoperable system available for accident mlt, .aon within specified time periods, appeared to have an acceptable risk-informed justification. The acceptability of " managed restoration" as a practice is a policy matter that will be reviewed by the Office of Nuclear Reactor Regulation (NRR).

-

The licensee practice of revising unavailability criteria on a recurrent basis had the potential to mask degrading equipment performance. Similarly, the practice of revising reliability criteria as the number of functional failures approached limits also had the potential to mask degrading equipment performanc l-

_

.

.

Report Details Summary of Plant Status Unit 1 was operating at full powe Introduction This was a special reactive inspection, which examined the licensee's implementation of 10 CFR 50.65, " Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants "

The report covers a five-day on-site inspection by one regional inspector, an inspector from the 1 Ofhce of Nuclear Reactor Regulation, and a consultant from Brookhaven National Laborator This inspection examined the licensee's practices of" managed restoration," and real-time adjustments to performance criteria. These two practices were initially described in NRC Inspection Report 50-440/9802i (DRP). The imection specifically reviewed the "10-Minute" and "4-Hour" criteria under the concept of managing restoration, the controls used in implementing this practice under the licensee's " Maintenance Ruta - Unavailability Timo Monitoring Guideline," and the practice of real-time performance criteria revisions. Specifically, the resident inspectors had questioned the following two practices:

Unavailability time was not counted against the performance criteria when:

)

.

a) certain safety-related, high safety significance components such as the high pressure core spray (HPCS) system, reactor core isolation cooling (RCIC)

system, or low pressure core spray system were taken out of service for surveillance testing and were capable of being restored to service by operator action within a designated time period of 10 minutes b) certain components were out of service which would affect the containment venting flow path through the spent fuel pool and which could be restored within a period of four hours.

'

c) certain components were declared inoperable under the plant technical specifications due to relatively minor degraded conditions such as the in-operability of a single seismic snubber.

l +

Performance criteria was revised during the operatina period between each refueling cycle after functional failures were experienced such that the structures, systems, or components (SSC) in question were not considered for placement in the (a)(1) category with the establishment of goals and monitoring. An example was identified involving the Control Complex Chilled Water System (P47) reliability performance criteri .

.

.

l. Operations 04 Operator Knowledge and Performance (62707)

04.1 .Ooerator Knowledae - Monitorina Unavailability Inspection Scope The inspectors evaluated the license's implementation of the "10-Minute Rule" and the

"4-Hour Rule." The inspectors interviewed licensed operators and Shift Technical Advisors (STA) to determine if they understood the general guidance contain .d in

" Maintenance Rula Unavailable Time Monitoring Guideline," Revision 7, for monitoring unavailability times, especially those times related to the "10-Minute Rule" and the

"4-Hour Rule" criteria. (The concept of" managed restoration," involving the us6 of the

"10-Minute Rule" and the "4-Hour Rule," will be discussed later, in the performance criteria section of this report). Areas addressed during these interviews included requirements for monitoring unavailability, the dedicated operators' responsibilities, and the licensee's responsibilities for its implementatio Observations and Findinas b.1 Manaaed Restoration "10-Minute Rule" and "4-Hour Rule" The inspectors found that the operators generally understood their responsibilities in the control room with regard to tracking of SSCs unavailability. The Senior STA was responsible for tracking unavailability time for SSCs within the scope of the maintenance rule (MR). The Unit Supervisor provided the means of ensuring a responsible

,

'

Equipraent Operator was available to complete the r:ecessary actions within the ten-minute and four-hour time constraints. The Senior STA maintained and reported the l time of the unavailability for the SSCs; electronic logs aiso logged the out-of-service and inoperable time as the two were not counted by the same criteria. Unavailability was not logged against the SSC if the related system could be restored within the 10 minutes and 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> time restraints. For the "10-Minute Rule," the licensee assurned that retuming equipment to service would be performed in a maximum of 10 minutes in accordance with procedures and that the total task time included communication with the control room, travel, equipment reccve.y from the rnaintenance activity, and equipment retum-to-service, preceded by an additional one minute initial time window that was assumed for control room detection, diagnosis, and decision-makin The inspectors were concerned that the " dedicated" operator was considered to be the Unit Supervisor and not a local operator stationed r. ear the equipment who wouid be

'

ready to perform the recovery actions upon demand from the control room. During operator interviews, certain scena:los were developed and discussed which challenged the ability of the operating crews to reestablish system performance within the 10-Minute and 4-Hour criteria. The following concems were identified with respect to the rigor of controls for using the managed restoration guidance:

_

, 1) There was a potential for managet 'storation to be applied to other activities beside simple surveillances. For ext 11e, during discussions with the Maintenance Rule Program Engineer ai., trobabilistic Safety Assessment (PSA)

staff, the licensee indicated that the 10-Minute criterion was only to be used by the operators during surveiltances. The inspectors identified that this expectation was not followed on February 25,1999, during a breaker swap-out on battery charger EFD-1-A (1R42-S0006). Also, from discussions with plant operating personnel, the inspectors concluded that there was some confusion among the operators regarding exactly to which systems the 10-Minute rule vias intended to !

apply. Following the on-site inspection, the licensee issued Condition Report No.99-519, dated March 9,1999, which identified that the operations staff had incorrectly classified the Standby Liquid Control Train B as inoperable and available using the managed restoration guidanc ) There was a potential that continuity of assignments for managed restoration responsibilities would not be maintained. While under the 10-Minute criteria, complex evolutions such as shift changes or shift briefing / turnovers, times of high control room activity, or when other major evolutions are occurring in the control i room could raise the potential for dedicated operator assignments to be lost or mistake ) There was a potential that the dedicated operator would be unable to respond ;

under all circumstances. During times of minimal shift coverage, certain operators could have joint duties such as a fire brigade member while assigned to restore an SSC under the 10-Minute criteria. This would potentially result in diverting the dedicated operator's availability during a fir In discussions centered on the above conditioris and situations, the licensee recognized the need to implement and maintain more rigorous controls for the use of the "10-Minute Rule" and "4-Hour Rule" criteria. Evaluation of revisions to " Maintenance Rule Unavailable Time Monitoring Guideline," Revision 7, is an Inspection Follow-up item (IFI)

50-440/99005-01(DRS).

l c. Cone'psions l

While operators ger:arally understood the guidance associated with counting unavailability times while using managed restoration, tighter controls were necessary to avoid misuse of the process and te ensure continuous availability of a dedicated operato w_

.

i

-

l

,

l 11. Maintenance iWi1 Conduct of Maintenance (62706)

l M1.1 Backoround I Inspection Scope

! The inspectors examined the licensee's implementation of the MR program, focusing on i the use of performance criteria for (a)(2) SSCs. The inspectors examined the process and the technical justification for " managed restoration," which related to the accumulation of equipment unavailability and real-time adjustments to reliability and i unavailability performance indicators. This involved reviewing the licensee's guidance

, for controlling the use of the "10-Minute Rule," and "4-Hour Rule," original and current l reliability and unavailability performar e criteria, equipment reliability and unava: lability performance statistics, condition reports, MR expert panel meeting minutes, and the technical risk-based justifications for these practices. Also, the inspectors interviewed members of the system engineering staff, risk assessment staff, MR staff, and the expert pane Findinos and Observations b.1 *Manaaed Restoration" The two conditions referred to by the licensee as the "10-Minute Rule" and the

"4-Hour Rule," respectively were contained in a document entitled " Maintenance i Rule Unavailable Time Monitoring Guideline," Revision 7, February 7,1999, which l l incorporated the same definitions as in PAP-1125. In Attachment 5 of the guideline ,

document, " Interim Maintenance Rule Guidance on Returning Equipment b Service  !

l Which is Managed for Restoration Under Ten Minutes & Four Hours Criteria,"it stated i l that when the reactor pressure vessel (RPV) level control function that the SSC i performed was challenged, the " dedicated" individual would immediately initiate l action (s) whica vould result in the restoration of equipment that was inoperable but considered available with;n ten minutes. " Challenged" referred tu maintaining adequate core cooling during accident scenarios by restoring and maintaining RPV level greater than 185 inches for non-Anticipated Transient Without Scram (ATWS) and greater than -25 inches for ATWS situations. The time to immediately initiate the 10- '

,

minute equipment restoration action (s) was when RPV level could not be restored and maintained greater than 185 inches for non-ATWS or greater than -25 inches for ATWS

'

situation Similarly, Attachment 5 also stated that when the Containment Pressure Control function ( that ihe SSC performed was challenged, the " dedicated" individual would immediately I initiate action (s) which would result in the restoration of containment venting equipment that was considered available within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. " Challenged," in this case, referred to maintaining adequate containment heat removal during accident scenarios by maintaining containment pressure less than the pressure suppression pressure (PSP)

with the Residual Heat Removal (RHR) system's operating modes of suppression pool cooling, containment heat removal, and shutdown cooling. The time to immediately initiate the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> containment venting equipment restoration action (s) was when the containment pressure could not be maintained below the PSP with the in-service RHR trai The licencee's purpose for invoking the "10-Minute Rule" and the "4-Hour Rule" was to avoid tracking and recording unavailability time for surveillance testing which was considered to be only a small fraction of the normal SSC outage time. The design of the Perry Nuclear Power Plant, in general, did not have pull-to-lock protection on switches for major components. Consequently, the licensee had determined that the only way to prevent spurious operation of equipment during surveillance testing was to rack out the associated circuit breakers. This rendered the equipment inoperable under technical specifications and the licensee appropriately entered the associated Limiting Condition for Operation. Normally, the equipment would also be considered unavailable for MR accounting. The licensee intended to minimize the effect of this unavailability time by modeling into the PSA the probability of operator recovery within the 10 minutes or 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as necessary. As opposed to the conventional design basis analyses for which non-safety related components nor manual actions within 10 minutes of initiation of the accident were relied upon, the licensee was attempting to justify this pondion based on more realistic probabilistic methods which relied upon manual recovery actions, availability as opposed to in-operability, and non-Appendix K thermal hydraulic codes such as the Modular Accident Analysis Program which considers fuel cladding temperatures above 2200 deg F as acceptabl The inspectors considered the licensee's position that surveillance testing times were !

generally of very snort duration (i.e., generally 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or less per quarterly surveillance) i compared to the total equipment unavailability performance criteria limit times to be

! reasonable. However, it was not clear as to how much benefit was be gained by not l tracking such unavailability times since they generally occur only once every three

months at the time of the quarterly surveillance. The licensee had not yet completed i j sensitivity studies to gauge the increase in risk due to RPV injection functions being in the " managed restoration" position, which was a term the licensee applied to the 10-Minute and 4-Hour rules. (Preliminary results using the zero maintenance PSA model 1 for HPCS in the managed restoration state caused an approximately 7% increase in core damage frequency (CDF) from 4.8E-6 to 5.2E-6/ reactor year).

The inspectors determined that the use of " managed restoration," was a policy matter and that it would be reviewed by the Office of Nuclear Reactor Regulation. This will involve a detailed examination of the licensee's technical justification by the risk assessment branch and a policy decision by the program office which considers but does not entirely rely on the licensee's risk justification. This was considered an inspection Follow-up Item (IFI)50-440/99005-02(DRS),

- .

'

. Performance Criteria Adiustments t.2.1 Unavailability Criteria Adiustmento During this inspection, the inspectors noted that PAP-1225,6.5.4.2, allowed the unavailability criteria for a system or train to be changed in advance of the installation of a design modification or for the implementation of a periodic equipment overhaul with a l frequency greater than once per two fuel cycles. The licensee had established fractional unavailability criteria for its high risk significant systems. For each cycle, the criteria were translated into a specified number of hours for each afiected system, depending upon the expected length of the fuel cycle. Unavailability was monitored on a per cycle basis. The inspectors reviewed actual SSCs failures and associated unavailability times i in order to evaluate the effectiveness of the process to monitor SSCs under (a)(1) and (a)(2) of the rule. The inspectors also discussed related SSC failurcs and unavailability times with appropriate plant personnel and performed a review of six-month actual unavailability and reliability criteria on several systems. Attachment A is a chart of related functional identification, functional dcscriptions, unavailability limits set, and actual unavailability used based on certain periodic date The inspectors reviewed the following systems:

Systems reviewed (Functional Descriptions):

Fl = E12-03-A, Low Pressure Core injection A with Room Cooling l FI = E12-03-B, Low Pressure Core Injection B with Room Cooling FI = E12-03-C, Low Pressure Core injection C with Room Cooling FI = E12-21-A, Residual Heat Removal Containment Spray A with Room Cooling Fl = E12-21-B, Residual Heat Removal Containment Spray B with Room Cooling FI = EC-23-0, Div 3 Battery Normal Charger l FI = R42-15-0, Div 3 Common Reserve Battery Charger Fl = T23-00-2, Venting Residual Heat Removal Spray A with AC FI = E51-00, Reactor Core Isolation Cooling with Room Cooling & DC The inspectors attended a Plan of the Day meeting which included a listing of l " Maintenance Rule Unavailable Hours Performance Criteria for Cycle 07" current as of l March 1,1999. The inspectors noted that some SSCs such as the Divisions 1,2, and 3 l

battery chargers had unavailability limits of 1255 hours0.0145 days <br />0.349 hours <br />0.00208 weeks <br />4.775275e-4 months <br />. According to " Maintenance Rule Functions Unavailability Performance Criteria," the Division 1,2, and 3 battery chargers (function R-42) were not of high safety-significance and had an unavailability performance criterion fraction of 0.1 or 10% of an assumed 12550 hours for a 18-month fuel cycle. The Perry Unit 1 Technical Specification, "DC- Sourcer. - Operating," B 3.8.4, Revision 1, stated that the loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed. For each division, in addition to the normal charger, there was a reserve charger through which additionally a cross-tie could be established to the battery chargers of permanently shutdown Unit 2, so there was a great deal of redundancy in the battery charger system for Unit 1. The licensee stated

4 .

E l

that the battery chargers originally had no unavcilability performance criteria set because they did not appear above the cutoff point to be ranked as high safety significant SSC The inspectors reviewed other systems for changes in unavailability criteria based cn the listings in the Plan of the Day. As an example, Functions E12-03A/B/C, Low Pressure Core injection (LPCI) Trains A, B, or C, respectively, composite unavailable hours including room cooling, were reviewed. On September 9,1998, LPCI A/B/C each had a limit of 253 hours0.00293 days <br />0.0703 hours <br />4.183201e-4 weeks <br />9.62665e-5 months <br />. Then on November 23,1998, the limits were raised to 270 hours0.00313 days <br />0.075 hours <br />4.464286e-4 weeks <br />1.02735e-4 months <br /> each. On December 14,1998, LPCI A had a limit of 311 hours0.0036 days <br />0.0864 hours <br />5.142196e-4 weeks <br />1.183355e-4 months <br /> with 167 hours0.00193 days <br />0.0464 hours <br />2.761243e-4 weeks <br />6.35435e-5 months <br /> used and then on January 25,1999, a limit of 318 hours0.00368 days <br />0.0883 hours <br />5.257936e-4 weeks <br />1.20999e-4 months <br /> was set. in the same time frame, on December 14,1998, the limit for LPCI B was reduc 9d from 270 hours0.00313 days <br />0.075 hours <br />4.464286e-4 weeks <br />1.02735e-4 months <br /> to 230 hours0.00266 days <br />0.0639 hours <br />3.80291e-4 weeks <br />8.7515e-5 months <br />. On January 25,1999, LPCI B the limit was changed o 235 hours0.00272 days <br />0.0653 hours <br />3.885582e-4 weeks <br />8.94175e-5 months <br /> with a total of 133 hours0.00154 days <br />0.0369 hours <br />2.199074e-4 weeks <br />5.06065e-5 months <br /> used. The hours used for LPCI B varied from a high of 134 hours0.00155 days <br />0.0372 hours <br />2.215608e-4 weeks <br />5.0987e-5 months <br /> on October 19,1998, and then dropped down to 122 hours0.00141 days <br />0.0339 hours <br />2.017196e-4 weeks <br />4.6421e-5 months <br /> on December 14,199 To justify these changes, the licencee referred to the expert panel meeting minutes for meeting 145, dated December 7,1998. These meeting minutes stated that the RHR Loop A unavailability hours had been significantly reduced because of additional hours used during work on valve E12F028A which was normally performed during refuelin Unavailab"ity performance criteria changes were needed for the blind pipe fitting installation for the steam condensing mode design modification (January 1999 - to eliminate this mode) and to perform work on suppression pool cleanup filter demineralizer valves which resulted in 'he unavailability of both trains of Containment Venting with RHR Containment Spray headers. The expert panel was requested to approve adjustment of the RHR loop and containment venting with RHR spray unavailable hour limits by:

. Increasing the unavailability (limit) of containment venting for RHR spray A and B with AC power from 0.017 to 0.022 based on the margin available in existing Calculation 6.16, Revision . Adjusting the unavailable time limit and the unavailability from the functions affected on Loop A to Loop The meeting minutes then described in detail the specific adjustments to be made with respect to RHR Loop A and Loop B. The minutes concluded by stating that since the unavailability changes met the change criteria in PAP-1125, and the changes were from the 0.005 Containment Venting margin in Calculation 6.16, Revision 1, and from compensating adjustments to the affected functions (where these compensating ( changes provide no net increase in the unavailable time for a function on .no system l level), the unavailability performance criteria remained essentially unchanged with regard to the impact of the bounding sensitivity analysis. The sensitivity calculation showed the l performance criteria previously selected by the expert panel was properly bounded in that the estimated CDF increased from the baseline of 1.41E-5/ year to 1.96E-5/ year or a 39% increase. This increase fell under the "Further Evaluation Required" band of the Electric Power Research Institute (EPRI) PSA Applications Guide and such a change would be expected with all of the performance criteria at the unavailability limits. The

,

.

minutes further stated that the increased CDF was well below the NRC safety goal of 1 1.0E-4/ year indicating the unavailability criteria were appropriat The inspectors reviewed similar exchanges in unavailability performance criteria limits ,

for other high safety significant systems such as those between the RCIC and HPCS )

systems as described in the meeting minutes of expert panel meeting 139, dated July 28,1998. To complete the January 1999 RHR A and February 1999 RHR B steam condensing modifications,150 hours0.00174 days <br />0.0417 hours <br />2.480159e-4 weeks <br />5.7075e-5 months <br /> were subtracted from the HPCS system limit and added to the RCIC system limit. Subsequently, in a memorandum to the expe:t panel a dated February 20,1999, the entire 212 hours0.00245 days <br />0.0589 hours <br />3.505291e-4 weeks <br />8.0666e-5 months <br /> of steam condensing design change work }

and the 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br /> of planned non-routine maintenance work with a frequency of greater i than two fuel cycles were recommended to be added to the unavailability criteria for !

RCIC. This additicnal time was subtracted from the unavailability performance criteria of l the Feedwater Motor Feed Pump. The memo noted that the Motor Feed Pump has a higher risk achievement worth and higher risk reduction worth than the RCIC syste In May 1997, the PSA was subjected to a peer review through the BWR owner's grou The thermal hydraulic analysis, systems analysis, dependency analysis, structural analysis, and quantification process were considered particularly strong. The data, accident sequence evaluation, human reliability analysis, containment performance evaluation, and maintenanco and update process were considered as areas for improvement. The system train unavailabilities were based on plant-specific data from a 19"M-data group provided by SCIENTECH as input to the IPE. At the time of the peer 3 eva!uation, HPCS and RCIC maintenance unavailabilities were based on more recent i data. Since the time of the evaluation, the licensee had updated the data for the ;

diesel-generators. At the time of this inspection, most of the PSA data were still generi j The inspectors characterized the licensee's actions with respect to the unavailability .

performance criteria as "online balancing." The inspectors found the licensee's analyses l to be very complete and comprehensive and to provide adequate technical justifications for the changes made to the unavailability performance criteria from the perspective of overall risk of core damage. The inspectors were concerned that althodgh the licensee had adequately justified the risks incurred by changes to the unavailability performance i criteria at the level of overall CDF, the inspectors believed there was a highly likely degradation of an SSC's performance would not be detected because of the Feensee's prac' ice of revising unavailability criteri i b.2.2 Reliability Criteria Adiustments

!

The issue of adjustments to reliability criteria was first identified in Inspection Report -

50-440-98020(DRP) by the Perry resident inspection staff. The resident inspectors were concemed by the decision of the MR Expert Panel which addressed repeat failures of the control complex chiller, P47A. There were failures of the P47A motor temperature sensors in Dece& r 1997 and Septembei 1998, however, this was dete; mined to not require monitoring under 10 CFR 50.65(a)(1). The expert panel also changed the relia'dlity performance criteria from two functional failures in a fuel cycle to three functional failures in two cycles. The expert panel's decisions were based on an 10 >

.

<

r'

i

J

i ('

examination of the failure's contribution to CDF. Subsequently, there was an additional f'

similar failure in December 1998, and the licensee indicated it planned to monitor the system under 10 CFR 50.65(a)(1) in the future. An unresolved item (URI 50-4a0/98020-01(DRP)) was opened to assess the acceptability of the licensee's i disposition of the P47A problem The licensee had established reliability performance criteria of allowing a specified nuraber of functional failures per fuel cycle for systems. The criteria were monitored on a per cycle basis rather than a rolling average. In some cases, the licensee had established reliability criteria which spanned two fuel cycle The inspectors examined the disposition of the P47A Control Complex Chiller failures.

l Condition reports associated with the chiller failures and the expert panel meeting minutes addressing the situation were reviewed to understand the sequence of events and understand the rationale for the decisions. The inspectors found that after the second failure the expert panel addressed the issue and determined from a presentation

'

by the responsible system engineers that corrective actions were being developed and !

that the problem was intrinsic in the design of the motors (built-in sensors). The expert l panel concluded that monitoring under (a)(1) was not necescary. Also at that time, the l expert panel approved revision to the reliability criteria, changing it as described in the j previous paragraph. The justification for changing the reliability criteria was based on a

'

determination that there was minimalimpact on CDF as a result of a chiller failure. A third failure occurred, and the expert panel dispositioned this failure as not maintenance l preventable, therefore (a)(1) monitoring was still not required. The most recent failure of I l the chiller occurred in December 1998. At the close of this inspection, the investigation l l into this failure had not been completed; the completion date was Monday, March 8, i l 1999. A review of the results of this investigation was considered an inspection follow-up j l

item (IFI) 50-440/99005-03(DRS). The inspectors found that the assessments required l when an SSC reached a performance criteria threshold were conducted as expecte '

Therefore, the unresolved item (50-440/98020-01(DRP)) will be closed; however, the inspectors viewed the decisions as non-conservative and told the licensee in the exit meeting that the issue had been poorly handled. A detailed examination of the technical justification for revising the reliability criteria was not conducted due to lack of inspection time; however the inspectors considered the impact of the criteria change on the program's capability to signal equipment degradation. At first look, the change would

appear more conservative since simple arithmetic would suggest that three fa!!ures in ,

j two cycles implied one and one-half failures in one cycle. But failures do not occur in l

'

halves; if considered a one-cycle basis, three failures would be needed to trigger an evaluation. This change actually constituted a fifty percent reduction in sensitivity of the criteri The inspectors questioned whether similar changes in reliability performance criteria had been made. Review of original and current criteria revealed an adjuttment in reliability criteria for the R22, Metal-clad Switchgear 15KV & SKV System. The system consisted of both high and low safety significance components with i reliability criterion of two failures per fuel cycle. The system was split into high ar sw safety significance portions and each was assigned the same criterion of two failures per fuel cycle. Under

~

the original con',iguration, two failures of any combination of high or low significance j components would trigger an evaluation; under the current, risk-oriented corniguration three failures of any combination would be necessary to idgger an evaluation. This l

change also resulted in a fifty percent reduction in the sensitivity of the criteri {

l

'

Re intent of the MR was to evaluate the impact of maintenance on systems and one of the most vital aspects of this evaluation was the ability to identify degrading equipmen The inspectors were concerned that these changes, although apparently justified in a risk-based manner, challenged the licensee's ability to identify emerging problems with equipment because the criteria were being made less sensitive. At the exit meeting, the licensee acknowledged the vulnerability created in their MR program by the desensitization of cnteria and agreed to evaluate the issu In addition to the concerns over potential masking of equi;inent degradation, the inspectors identified two other related issues. The inspectors also noted that while the l practices of " managed restoration," and real-time adjustments to performance criteria as I SSCs approached thresholds had an apparently valid technical, risk-based justification, a j perception that the licensee was " managing the indicators," had been created. This was significant because the NRC is presently considering revisions to the reactor inspection program which will rely heavily on performance indicators. The other concern grew from the fact that much of the licensee's technical basis for these practices relied on the impacts to CDF. The Perry plant, being a BWR-6, has intrinsically greater safety margins and an initially lower overall CDF. The inspectors were concerned with the potential for other utilities, whose plants did not have comparable safety margins, to adept these practices without careful consideratio c. Conclusions l l

The practice of managed restoration, i.e., the discounting of MR unavailability when l simple, defined operator action can make an inoperable system available for accident

! mitigation within specified time periods, appeared to have an acceptable risk-informed justification. The acceptability of" managed restoration" as a practice is a policy matter that will be reviewed by the Office of Nuclear Reactor Regulation. The licersee actions !

in revising unavailabili'! criteria on a recurrent basis appeared to have acceptable l technical justification in the cases examined, yet this practice had the pote .ual b mask degrading performanc The actions taken oy the licensee in revising reliability criteria as the number of functional failures approached limits appeared to have acceptable technical bases in the cases examined, yet this practice also had the potential to mask degrading equipment performanc _

c i_

.

II. Mar.saement Meetinas

%1 Exit Meeting Summary The inspector presented the inspection results to members of licensee management at the conclusion of the inspection on March 5,1999. The licensee acknowledged the findings presented. The inspector asked the licensee whether any materials examined during the inspection should be considered proprietary. One proprietary document was identifie !

l l

l

l l

<

.

.

PARTIAL LIST OF PERSONS CONTACTED B. Boles, Manager, Plant Engineering Services l N. Bonner, Director, Maintenance P. Bordley, Nuclear Unit Supervlaor R. Collings, Manager, Quality Assurance W. Colvin, Maintenance Rule Program Engin'eer R. Dame, Supervisor, Test Programs

! T. Henderson, Compliance Supervisor i W. Kanda, Plant Manager G. Kindred, PSA Engineer P. Lashley, Engineering Specidist B. Luthanen, Compliance Engineer D. Mackovjak, NSSS Lead System Engineer L. Myers, Vice President R. Rischel, Maintenance Rule Coordinator, Davis Besse M. Rupp, Senior Engineer R. Schrauder, Director, Plant Nuclear Engineering Department R. Siembor, PSA Engineer P. Southerland, Preventive Maintenance Engineer J. Wolf, Licensing Engineer INSPECTION PROCEDURES USED IP 62706 Maintenance Rule IP 62707 Maintenance Observations IP 929';2 Follow-up - Maintenance ITEMS OPENED and CLOSED Opened 50-440/9Ca06-01(DRS) !FI Revisions to controls on the implementation of " managed restoration" 50-440.'99005-02(DRS) IFl Review of the acceptability of the practice of" managed restoration," as a policy matter 50-440/99005-03(DRS) IFl Review of resu!ts oflicensee evaluation of the most recent Control Complex Chiller (P47) failure

! Closed 50-440/98020-01(DRP) URI Acceptability of licensee determinations after two failures of the Control Complex Chiller (P47)

14 .

_

.

.

LIST OF ACRONYMS USED ATWS Anticipated Transient Without Scram CFR Code of Federal Regulations CR Condition Report DRP Division of Reactor Projects DRS Division of Reactor Safety EPRI Electric Power Reri arch Institute ,

'

HPCS High Pressure Core Spray IFl inspection Follow-up Item IP inspection Procedure IR inspection Report LPCI Low Pressure Core !rijection MR Maintenanco Rule NRC Nuclear Regulatory Commission NRR Nuclear Reactor Regulation PAP Plant Administrative Procedure PDR Public Docu.nent Room PSP Pressure Suppression Pressure !

RHP. Residual Heat Removal RPV Reactor Pressure Vessel SSC Structures, Systems and/or Components i STA Shift Technical Advisor l l

15 l

_

J

-- -

,

..

.

PARTIAL LIST OF DOCUMENTS REVIEWED

' Procedures:

,

PAP-1125, " Monitoring the Effectiveness of Maintenance Rule Program," Rev. 3, dtd May 26,1998

-

PAP-1924, "On-Line Risk Assessment," Rev. O, did July 23,1997

-

TAl-0513," Monitoring the Effectiveness of Maintenance Structure Monitorf.1g Program,"

Rev.1, dtd August 19,1997 Guidelines r

! -

Maintenance Rule Unavailable Time Monitoring Gaideline, Rev. 7, dtd February 24,1999 l

f Calculations

+

Calc. No. 6.16, " Determination of Level 1 PSA Safety Significance SSCs for the PNPP Maintenance Rule," Rev. 2, undated Calc. No. 6.17, ' Determination of Level 2 PRA Safety Significant SSCs for the PNPP

'

-

Maintenance Rule Program," Rev.1, undated l Calc. No. 6.18, " Establish Unavailability Performance Measures and Unavailability l Criteria for the PNPP Maintenance Rule," Rev.1, undated l

~

-

Calc. No. 6.20, " Recommended Performance Criteria for Systems / Trains Eaeed on PSA Failure Rates," Rev 0, undated Other Documents

. ~ Reliability Performance Criteria Validation: Part 1

+ Reliability Performance Criteria Validation: Part 2

-

DC Battery Chargers (E22 and R42) Condition Monitoring Performance Criteria, Rev. j

,

-

Diesel Generator (E228, R43, & M43) Reliability Performance Criteria Established at 1

! 44% above the Licensing Bases of 0.95 at 0.9722 Will Require Goal Eetting at 31% i above the Licensing Basis, Rev 3.02 l'

. Control Complex Chilled Water (P47) Reliability Performance Criteria, Rev. 3.02

. Maintenance Rule Functions, Performance Criteria, and Classifications, Rev. 3.02, dt:'

Februa.,y 22,1999

- Expert Fanel High Safety Significance Determination of SSCs and Functions for the PNPP Maintenance Rule Program, Rev. 4.4, dtd August 3,1998 I a

Periodic. Assessment Report of Maintenance Effectiveness for Operating Cycle 5

- (August 14,1994 - April 10,1996), dtd Ochber 14,19%

. Maintenance Rule Monitoring Program Periodic Assessment Report of Maintenance Effectiveness for Operating Cycle 6, dtd August 10,1998

4

-

.

q

,

.

-

Maintenance Rule - Four Perry Power Plant Systems, Structures, or Components, SSCs i are (a)(1) and Need to Demonstrate improved Performarece, SSCs with Reliability and l Condition Monitoring Performance issues

-

Perry Nuclear Power Plant Maintenance Rule Expert Panel Members and Alternates, dtd !

January 26,1999

-

Organization Chart - Perry Nuclear Power Plant Department, Plant Engineering Section

-

Oiganization Chart - Perry Nuclear Power Plant Operations Department

-

EPRI TR-100259, Project 2847-01, Final Report, June 1992, "An Approach to the Analysis of Operator Actions in Probabilistic Ris:t Assessment, - Figure 2-5 ' Cue Response Structure Timelines for Type CP His,'" page 2-12 (PROPRIETARY).

- EPRI TR-105395, PSA Acolications Guide, August 199 * EFRI Technical Bulletin 96-11, " Monitoring Reliability for the Maintenance Rule,"

November 199 . EPRI Technical Bulletin 97-03, " Monitoring Reliability for the Maintenance Rule -

Failures to Run," March 199 Perry NPP, Continuation Form, PAP-1608," Human Reliability Analysis of Hur.M Error Probabilities for Returning Equipment to Service Which is Managed for Restoudn Under Ten Minutes," undate l

- Plan of the Day, Week 02-Period 7,03/01/99 to 03/02/99," Maintenance Rule Unavailable Hours Performance Criteria for Cycle 07" page 10, March 1,199 ;

-

" Maintenance Rule Functions Unavailability Performance Criteria," Rev. 3.02, approved !

02/22/9 Perry Unit 1 Technical Specification, "DC Sources - Operating," B 3.8.4, Revision !

r

-

F

.

~

!

'

l Attachment A l

Unavailability Limits and Use

,

Eyt, tem : Low Pressure Core Inlection (LPCI)

l System Fl / Date Functional Limits Established Actual Used (hours)

!

E12-12-03-A Description (hours)

l .

9/14/98 LPCI A with Rcq Cig 253 4 10/5/98 LPCI A with Rm Cig 253 75 10/12/98 LPCI A with Rm Clg 253 146 l 10/19/98 LPCI A with Rm Cig 253 167 ( 11/23/98 LPCI A with Rm Clg 270 167 l

l 12/14/98 LPCI A with Rm Clg 311 167

-

i 1/25/99 LPCI A with Rm Cig 318 167

!

l System F! / Date Functional Limits Established Actual Used (hours)

E12-12-03-B Description (hours)

j- 9/14/98 LPCI B with Rm Cig 253 4 10/5/98 LPCI B with Rm Clg 253 90 l 10/12/98 LPCI B with Rm Cig 253 63 10/19/98 LPCI B with Rm Clg 253 134 10/26/98 LPCI B with Rm Clg 253 133 11/23/98 LPCI B with Rm Cig 270 133 l 12/7/98 LPCI B with Rm Cig 270 122 12/14/98 LPCI B with Rm Clg 230 122 1/11/99 LPCI B with Rm Clg 230 130 1/25/09 LPCI B with Rm Clg 235 129 2/5/99 LPi. I B with Rm Clg 235 133

,

. _ _ - _

I '

,

.

Attachment A l

System FI / Date Functional Limits Established Actual Used (hours)

I E12-12-03-C Description (hours)

9/14/98 LPCI C with Rm Clg 253 4 10/5/98 LPCI C with Rm Cig 253 38 11/23/98 LPCI C with Rm Cig 270 38 1 25/99 LPCI C with Rm Cig 276 38

.\ \

System: Residual Heat Removal (RHR) Containment Surav with Room Coolina l System FI / Date Functional Limits Established Actual Used (hours)

E12-21-A Description (hours)  ;

9/14/98 RHR Containment 253 4 Spray A with Room )

Cooling '

10/5/98 RHR Contdnment 253 135 l Spray A with Room l Cooling l l

10/12/98 RHR Containment 253 228 Spray A with Room Cooling 11/23/98 RHR Containment 270 228 Spray A with Room Cooling 12/14/98 RHR Containment 381 228 Spray A with Room Cooling System FI / Date Functional Limits Established Actual Used (hours)

E12-21-B Description (hours)

11/23/98 RHR Containment 270 Spray A with Room Cooling

-

,

-

.

l Attachment A j

--

l 12/14/98 RHR Containment 160 Spray A with Room Cooling System: Division.3 Batterv Normal Charaer l l

System Fl / Date Functional Limits Established Actual Used (hours) I E22-23-0 Description (hours)

10/5/98 Division 3 Battery 575 0 Normal Charger 11/23/98 Division 3 Battery 614 0 l Normal Charger 1/25/99 Division 3 Battery 628 0 Normal Charger 2/15/99 Division 3 Battery 1004 1025 Normal Charger 3/1/99 Division 3 Battery 1255 102 Normal Charger i

System: Division 3 Common Reserve Charaer I l

!

System FI / Date Functional Limits Established Actual Used (hours)

R42-13-0 Description (hours)

10/5/98 Division 3 Common 575 0 Reserve Charger l 11/23/98 Division 3 Common 614 0 Reserve Charger 1/25/99 Division 3 Common 628 0 R^ serve Charger 2/8/99 Division 3 Common 628 1025 Reserve Charger 2/15/99 Division 3 Common 1004 0 Reserve Charger

.

.

.

Attachment A i

2/22/99 Division 3 Common 1004 123 Reserve Charger

!

3/1/99 Division 3 Common 1255 37 l Reserve Charger l

i System: Ventina Residual Heat Removal (RHR) Spray with AC  ;

I System Fl / Date Functional Limits Established Actual Used (hours)

T23-00-2 Description (hours)

9/14/98 Venting RHR Spray 196 2 A with AC l

10/5/98 Venting RHR Spray 196 42 A with AC 11/23/98 Venting RHR Spray 209 106 A with AC 12/7/98 Venting RHR Spray 209 199 A with AC  ;

12/14/98 Venting RHR Spray 381 199 A with AC 1/25/99 Venting RHR Spray 389 199 A with AC 2/1/99 Venting RHR Spray 389 421 A with AC System Fl / Date Functional Limits Estab.ished Actual Used (hours)

T23-00-3 Description (hours)

9/14/98 Venting RHR Spray 196 2 B with AC 10/5/98 Venting RHR Spray 196 31 B with AC

y c

.

Attachment A 11/23/98 Venting RHR Spray 209 95 B with AC 12/14/98 Venting RHR Spray 160 95 B with AC 1/25/99 Venting RHR Spray 163 95 B with AC 2/1/99 Venting RHR Spray 163 317 B with AC System: Rx Core Isolation Coolina (RCIC) w/R Cla & DC '

System FI / Date Functional Limits Established Actual Used (Lours)

E51-00 Description (hours)

,

9/14/9e RCiC w/R Cis & DC 426 6 10/5/98 RCIC w/R Cig & DC 276 248 10/12/98 RCIC w/R Clg & DC 276 181 10/19/98 RCIC w/R Cig & DC 276 250 11/10/98 RCIC w/R Clg & DC 426 250 11/23/98 RCIC w/R Cig & DC 454 250 1/11/99 RCIC w/R Clg & DC 454 260 1/25/99 RCIC w/R Clg & DC 464 260 2/8/99 RCIC w/R Clg & DC 464 397 3/1/99 RCIC w/R Clg & DC 55 .9 22