ML063110627
| ML063110627 | |
| Person / Time | |
|---|---|
| Site: | Maine Yankee |
| Issue date: | 10/07/1996 |
| From: | Shirley Ann Jackson NRC/Chairman |
| To: | Frizzle C Maine Yankee Atomic Power Co |
| tonacci, Mark DIRS/IPAB, 301-415-4045 | |
| References | |
| NUDOCS 9610090299 | |
| Download: ML063110627 (109) | |
Text
UNITED STATES NUCLEAR REGULATOYC MISN WASNINOTON.D 2a0O1 October 7, 1996 Mr. Charlesl0. Frizzle. Presi-dent ankbiee Atomic Power Company Van 329 Bath Road Bru~nswi, Ain 04011 Dea r Mr. Frizzle:
I afowarilg the Co~iso' rep~ort on- the Maine YakpeeAtomic Power Stat-ion by the Nucle'ar- Re"ult'r Indepenent -Safety'-Assessmn'm (S) The purpose of` the BSA wa*s to determine whether Maine Yankee wa'sin' conformity WithAlts esign and licensigbas; 0oassess operational safety peromne
-and to. evalutC an Yane' sef-assessment,. corrective actions,anpls forimprveent._
Ovealpefomane t Maine Yankee wa osdrdaeuate for operalt ion.
i~oeve~anumer f ignficntweaknese anddeficienies were. identified that -i_" ul I'-I viltos hse weanese tond 44 1cten~ci es appea to9
'be related to- two -root causes ecnoi pr0ue ocnancssadpo
-cb~pli F a ac f uiton probD detfcation.as -arsltf aitttde The' ISA 'revifew.was condulcted in resoe to findings' mad0 b the6ItMRC'-s 'Officte Of the inspectorGeneral .ý(016) ina :report. date ay 196. includeda assesmet of the a4nalytic, code SupL provIde for 6aie Yankee by the aneAtami Eliectric Compan. Te0rpor fonh "ago other thin~s, thatMain Yakee Ad e*periecd prbesw thteRLAP/SYA coniue'r -code, usdfor analyzing bow te enrq!8Py core Coolin syste wuld funct 6Wf during allsmall, break ls-o10 _f_-;coolaint. acctident (LOCA), and 1n: response, hdmdfe that code. 016 also founAd that these- prtlems wi th the computrcd a o
,been reported to the RC.as required, and that beca'use. of these problems, Maine Yanke'e "suse of,"the code was not Inaccordanc wt RC requl remet s.
ARC rev~ie 4i d not uncover these_ dfic~iencies.
din order.to .p'rovide a thorough n The teamwas lar-ge-and 'mu~lti--disciplined inlue ItieI
,anger, depth reyiew. Its iý #5 15 ed byi n an&
represphta-tives of the 'State of ainim.` To ensure an independent,-perspecti~e.,
the NRC members were' selected from NRC offices other than the Office of pgersoros-wlth no NulerRectrReqgulation- (NRR) 'and~'the'-ARC'5 Regi-6Wfl- 'Only si. fic t prior respo siiiyfm e ating 4ain Yakeweecosnth teamn's maaemn re 6td t e 96OO0 0 96100dr7 PDR COMSNRCC,1
-CORRE60ONDENCE ADRM
a 2
The ISA team was on site at Maine Yankee between July 15 and 26, 1996, and again between August 12 and 23, '1996. During these time periods, team members also conducted assessments at Maine Yankee's corporate headquarters in Brunswick, Maine, and at the Yankee Atomic Electric Company offices in Bolton, Massachusetts.
'The ISA team reviewed the use of selected analytic codes for performing non-LOCA safety analyses, as well as the capability of the safety-related support systems to perform in accordance with the assumptiions made in t hose The review determined that the conditio*ns of approval in iRC Safety analIses. Evaluation Reports have been met although weaknesses in documentation and validation of plant specific code applications are vulnerabilities which warrant your attention.
The team determined that cycle-specific core performance analyses were excellent. However, we'aknesses were found in more-complicated, less frequentl-y performed system safety analyses.- These weaknessesdid not cause the results to exceed Maine Yankee's design and ]icensing baes. However, the team questioned the capability of the containment spray system and the component cooling water- systems tomeet-the design basis assumt ins :for a LOCLA init from greater than 2440: MWt- These isses, alog wit wI the*
RELAP/SYA deficienc-ies, will be reviewed byNRCs Office of: Nuclear Reactor
'Regulation.
The- tea-m- identified significanit def iciencie's in the areas..of marintenance And' engineering, as. wellr as weaknesses in the overal p c te the ...
-coretiv action -program. Sc Ifly' lak :ohrou~tn
'certatin -safety.-systems resul -n'd i h xitneo aQslif~~ttin of of which Mflaine Y_ deiie a8nkiee was-unaware. In addition, the ISA not~ed-certain des'ign..
errors. Either Maine Yankee was unaware of these errors, or ft wastaWare of them and had failed to take actton to address them..
U should add that Maine Yankee deserves credit for havin'g formed teaof highly qua'ified personnel o nterface with the SA team a counterpart ur its review. The existence of this team was both:helpful to. the -il-SA tea*m's activities and valuable as a meians of ensuring that Maine Ya*kee 'l*arned much--as possibl e '"-fromI this elffort. In -addition, "itmeant that as.;prob-lem as areaswere ident ified-. aine Yankee was in a positioni to devote resources promtly- to necessary corrective actions.
,Ie'have sctheduled. a-meeting for Octo6ber 10. 1996,ý duin whi-h6we wil discuss the assessment and- rieispo'nd to questions you may have. '
requst-that following this' meeting,'heng yuoI determinethe act~ions needed t'nu 6iuet th ong7 e,
term resolution 'of the deficiencies noted.' I also request that by December 10, 1996, you provide to the:;dConun*ission your p.-,h4ns*qr , add.res i the
-otcauses of.the defcnciesL 144tifled-by -therISK7 f-RC"R~6Ian its Office o-f ucea"r Reactor-Regul iat*.ion l be- r il folloWU f teissues , en tietfd i*nih this as tin 1w-o terms60'6fverseeihig 0- *v atosand takin any enforcement -action_ deemed# appropriat-e-.
3 In accordance with 10 CFR 2,790(a), a copy of this letter and the enclosure will be placed in the NRC Public Oocument Room. Should you have any questions concerning this assessment, I would be pleased to discuss them with you.
Sincerely, Shirley Ann Jackson
Enclosure:
Indepe'6endt Safety Assessment Report for Maine Yankee Atomic Power Company cc: See page 4
- ~~ United
-*** States 4-4 Nuclear Regulatory Commission INDEPENDENT SAFETY ASSESSMENT OF MAINEYANKEE ATOMIC POWER COMPANY ctober 96100903ýl16 -961007
Licensee: Maine Yankee Atomic Power Company Facility: Maine Yankee Atomic Power Station Location; Wiscasset, Maine Docket No: 50-309 Onsite Evaluation Period: July 15-26, 1996, and August 12-23, 1996
.Team Manager:
Edward L. Jordan Team Leader: Ellis W. Merschoff Administrative Assistant: Ola B. West Team Members: Larry Bell
-John Ai. Boardmanf -
RussellI-L. Byw.water, Jr.
Harold 0. Christensen
-George M. Hausman John V.Kauffman Kriss M1. Kennedy.,..
G. NormanLauben "Ronald L.: Lloyd-Alan L.-Madison Thomas 0. Mý'artin
'Peter J.-Pect Jack E. Rosenthal State Representatives: :David Decr.ow Patrick Widis Dostie
- vanags" Contractors: 'George,Cha, Robert IChri.stie.
,CyrilI Crane Brian Haagensen Michael ShlyAmfberg-Leonard Ward Submiotted By:
W. Merschoff, Te eader. Date Approved By,:
L ora eam M anager. ae
TABLE OF CONTEMTS EXECUTIVE
SUMMARY
. °. . . .. . ... . .. . . . . . . .°.
V
1.0 INTRODUCTION
1.1 Background ........
1.2 Scope and*Objectives .................................
1.3 0e'thodology . . . . . . . .. . .
- 1.4 Facility Description .... . ......... ........ 2 1.5 Organization 3 3
2.0 CONFORMANCE TO DESIGN AND LICENSING BASIS ........... .
2.1 Trahsient and Accident Safety Analyses 4 2.1.1. Analytic Code Support . ..........
. 4 2.1, 2 SER .Condit io6,nsSati sfied But Not Documented . .... 4 2.113 Control Element Assembly Drop Transient . .
. . . . . 8 2.].4 Main Steam Line Rupture . . . .*..... . ...
2.!.5 Lack Of A Docuenhted Process To Demonstrate Code 2.2 Design ... . . . . . . . ... .
DeinRevie Of Seleocted Systems 13 2.2.1 Hfih-Press.ur'eSafety I,6njnction (HPSI) System....
.1.1
... HPSI System Description . . . . . .. .
-2. .12 Flow Testing.......................
2.1. 3 Throttle Valve Setting rig'........tur 2214 CS System Support to the psi, Sytem.,
2.2.?2 evc Water)Component Cooling Water. 17 2ý.2.21 System Description. .......... 138 2;12.2.2 ýAvailabilIity of Se*awterFowIto e
.Service Water Intake
- 2.2.2.3 Se-rvice.Wa-ter. Pump NPSHt.r.ct ........ I 2.2.2.4 Circ-cul6ating Wat;erPuMp HoUse -Fooding .
2-..25..Re-sidua Heat-Removal (RR) Heat Exc.hanger Thermal "T'.ans' .* t. .... ...............
2.2.,2.6 SW -andi PCCW/SCCW *Integrated Operation . 19 2.3 Electrical :and Instr" " r u nt And Controls-.. .. ... 21 2.3. iS.:kV Offsitfe -Powe Lines ........... 21 2.3.2*To~leriance ........
Degraded. B*Ianid.;:*":..-.."...-..-.;......-
Grid Ufndevoltage Relay CalibratiOn 17,9 2.3.3 Elec*trica**'ProtectIo-n, Coor ination, and Cable 2.3S4 125 '23 2 V c.... tal....... ....................
Station B tte . ..
.i ..
2.3.5 E*geyDiesel Generato- Electrical Loading 19 2:.3.6 Eetri T ca1 Calculations 2.:3.7 Inadequacies in Ventilation Systemsý 15 2371Protected Swi tchgear. Room, VNrtfIlti on,:.
23.3'.12 Spray Building Ventilation efcenis.
2.........8",Prei 'for ss-Connecting DC Buses10, 2.3.9 Envi;ronmental Qualificat ion 'i(EQ). Programm .. ......
21.3.9.1 EQ Submergence".
2-3R.9.2 -EQ/RG 1.97 Instruet uaification ii
2i3.9.3 *Backlog Of EQ Items . . ...... .
2.4 FSAR Inconsisstenties ...... .......... 30 2.4.1 Spent Fuel Pool Heat Exchanger Rating ... ......... . 331 2.4.2 Atmospheric Steam Dump Rated For 2.5 Percent Power . 32 3.0 ASSESSMENT OF OPERATIONAL SAFETY........
3.] Operations Assessment ....... ... .......... ..... 33
.................. 33 3.1.1 Problem Identification/problem Resolution . . . . . . 33 3.1.1.1 o*erator Workarounds and Compensatory Actions ... ............. . ... .......
3.1.1.2 Control Room Staffing ....... 33 3.1.2 Quality Of' Operpaions .a........ ............ 34
..... ..... .... 35 3,.12.1 Con'til *Rom Observations ..... ....... . 135 3... afety Systeems Wal~kdowtns...,.. .. .. ..
3.1.2.3 Management Oversight oVf.Operations .. .... 5
....... .36 3.1,2.4 Risk*Managemnt......................36, 3.1.:2.5 Oph:er6ab'lit y.Determina.t6ns.. . ......... 36
. 1.:]2.6 Týchinical ýSpecif-icatioInterpretations 3.1.2.7 P6Ast-Trip 'Rvitews...... .. .. ... 3 3.1.3 Programs-And Procedures .. .. .... ..3 3.4.3 ". Emergency Oerating Procedures ...........
3.1.3-2 C6ofi guroati 0;on 38 Controls .39......... . . .
3.n1.3'1.3 R-estart., Re'
. adi I . nes.s Program .
3;.1A.3.4 OeaioQn'sPerformance Assmn . 40 3.1.4 Pla't Support.. Program -0.D
ý3. 1.4.1 .. u.......-...........e.,.4 40........
FieProtection7 Progran 31 Training . ....
40:
...... 41 3 4 Inje tion Pro ecg ion Program..... .......
3.2 Ma intenante And esting As s e -sment .2. 41 t e hoh '
3.2.1.1 EqudipMent 'Performance oq..4f !
Auiiry_
PlJ~):'and"Yaive : est~ g :": ,:: Feedwater, Emergency Feedw-ater, High, Pressure Safety .:.*. * . . . 42 Inject ion,and, Emergec Diesel Generators 3.2.1.2 Equ:ipmenft Perforac Demonstrated Through
.. 4 Pum an Vave TestIng..........4 3.2.1.3- Chot~ainment Performance Demons- ated IThrough J CFR 50 -Appendix J Leak Rate TestIng... ...
2.14 ..... . ,5.........
3.2.1.4 Equipment Problems Trending Upwards S3.2.1.5 Plint Alkdown Observation`s- .:..... .... 45 3.2i2 PRroblem: dentif*fi cati*ion And "Resolution.. ... 46 3.2.3 Q tof aintenance........ ... . ,. . 47
. . 48 3-2.4 Testilng Weaknesses. ...........
3.2. M:ainqtenake Wrk Order. Control....... 49 3.2. 5'.1 )s f 'Probibili~stcRs Assssmnt 5.3
~Metodoigie 3.2.5-.2 Work-lPlanning .And'Tracki1ng.......
... * .54ý 3.3 Engineering sesn . . .. 54
.. .. .... .. . . 55 -.
3.3.. 1 . entific
. .. on And..Resol'u
.. Of-Problems .
,3.3.2 Engineering Programs................5 i ii
3.3.2.1 Engineering Modifications And Temporary Modifications ....... ... . .. ......
- Q 4 57 3.3.2.2 Erosion/Corrosion (E/C) Program.
e" u i 57 3.3.2.3 Service Water Operational Performance Inspection . . . . . . . . . . . . . . .. 58 3.3.3 Design-Basis Information .................. 58 3.3.4 Quality Of Engineering 59 4.0 SELF ASSESSMENT, CORRECTIVE ACTIONS, PLANNING, AND RESOURCES 61 4.1 Self Assessment . . . . . . g 61 4.2 Correct`ve Actions . ......... t 64 4.2.1 Problem Evaluation 64 4.2.2 Problem Reiolution ......... ! 65 4.3 Planning.And Resources . ... ........ 66 4.3.1- Plians 66 4.3.2 Economic Environment......... :67 4 .3.3 Resul:ts 1,Of Resource.e;Constraints 68
5.0 CONCLUSION
S . . . . ........ ........... 70 5.1 Licensing And Design.-.Basis . ........ 70 5-2 Operationa1 Safety.... ............ 70 5.2.1 Oerations . ... .........
5.2.2 6Indtenane And Testing ..... 70 5.2.3 'En 'dineeig .. . . . . 7*1
.5.3 Roo CausýseOf Signijficant Findings.
.3.1 -Root-CaUe 1: Economifc. P-essure ". 71 5!3.2 Rbot-Cýuse 2: Problem Identification -71 6.0 REGULTORY I1SSUES-.-..... .. ..... .. ..... 773
-6.1Analyti&CodeValidatiow ....... .. 73 6..2 Compliance With Safety Evaluation: Reports 73 6.03 LicensingReviews For Power Uprates 7i 6.4 SafIety.G.de l . . .
. . . ...... . 74 6.5 Inspection Program ................ ° 74 7.0 EXIT MEETINGS . . ..... ....... .. 75 APPENDICES..... ..... .............. 76 iv
EXECUTIVE
SUMMARY
Background
In December 1995, the Union of Concerned Scientists forwarded anonymous allegations to the State of Maine, and the NRC. The allegations were that Yankee State submitted the allegations to the performed inadequate analyses to support Atomic Electric Company knowingly power at which Maine Yankee Atomic Power an increase -in the rated thermal performing a technical review, the NRC Station (MYAPS) may operate. After Office of Nuclear Reactor Regulation (NRR) issued a confirmatory order on January at the plant to the original licensed 3, 1996, limiting power operation power level of 2440 MWt.
The NRC Office of the Inspector General allegation on May 8, 1996. QiG establishe (DIG) completed an. inquiry.into this problems with, and made modifications to, hat MYAPS experienced the 'RE'P/5YA computer code which was used in the emergency core cool ing coolant accident. 0IG also reported analysis for a small-break loss-of-activities which contributed to NCfa1l0re1 weaknesses in-the NRC revoiw and followup response' t detect thes deficiencies. In of Maine to about these findings, as well as to respond the safety'and the' effecti-veness of to.,concerns regulatory by the Governor oversight' of MYAPS, - the-NRC Chairman initiated%an independent safety assessme nt I of MYAPS.
[his-assessment was. to -,be.performed bya" independent of any recent or signifi f staffwho were ant.regulatory oversight responsibility
'for MYAPS. Add~it'ion'al 'ly, the assessmen6t of-Maine :was to be coordina~ted with the State
-thl*e iCom 'fstosi~ohn*-facililtate the picyon Ip~ part icio c~ea oomissn ic ipatiton.
cooperationby"State -representativYes io wih" wih iSt atrc.aat, cIommerci consistent.
States al nuclear with power plantt's. (57. FR, 64? erairy, 25 192.).___.
Licens'in nd De6si gn-Basi s Maine .Yankee was in general conformance with its licensing-basis although slig-nifi-cant, items of non-conformance were identified. Thý li'censing-ba~is understood by the icensee but lacked was and had not been well maintained. specificity, contained' inconsistencies, The use of analytic codes for safety analyses was very good. Cycle specific core performance analyses were excellent.
performed safety analyse. contained we-aknesses, More ,comp] icated, less fr.rqently acceptable based but tie analyses.werefouhd to
.the safety eval uationon reports comppensating margin. Conditions of use were- found to be saiisfied, but spec'ifled: in not documented.
-The-qual~ity and, availabili-ty of, desi~gn-basis infrmat
'Despite,uncorrected 'and previously und~isc' ertd ion wads good" overall.
basi~s -and compensatory mea'sures adequatel'y design problems, ~the design-poe evel of244 0 MWt.. 'However,. the,ýteLi supported plant operati~on at a lice nsee. did riot demonstrae that amf could not conclude, -and the Ob~Wer oqf_2 700 j " dsgnais
-asurd~aeqateNPH
'rh ~
cotinmn capabilityof the component cooling water sprayC pumps and -the heat removal co.oant*cc system in the event 'of a ls s-of-w accident.
v
Operations Performance in the area of operations was very good, with strengths noted in the areas of operator performance during routine and transient operating conditions; shift turnovers and pre-evolution briefs; use of risk information to assure safe operations; and the involvement of managemerit in day-to-day operations.
. Weaknesses were noted in the area of "workarounds"" and compensatory measures which unnecessarily burdened the operators Or Complicated-their response to transient conditions. Additionally, log keeping practices and post-trip reviews lacked rigor.
oaintenance and Testing Performance in the area of maintenance was good overall however, testing was weak. The resultAs of the rev.iew of equipment reliablity 'for the auxiIi ary feedwater, emergency feedwater, high pressure safetY injiection, and- emergency diesel generator systems showed mixed equipment performance. Strength s were noted in the area.s 'of knowledge. and .se. -*f risk methodloies for plýanninnlng, prior.itizing, and schedulin the contro ad ijted use of temporary sealants; and a motivated and dedicated work force. :Although materia, conditfon was -considered good overall, a number of sig-nific6ant material
.condition deficiencies were noted -as was a decline in material condition foll-owing4. the, 1995- stea-m generator tubing.'out age.
In*a*dequacies in the scope of testing programs were identified, as were
-Wi k 4esss in the.-rigor '-with whi ch -te-sting ,w-as pe-fori-ned ad.in the 'eValuation
'oftesting results to demonst rate f unctionali.ty of saetyequipmet. Al ac'k
.of a qet ýion-ing'. atti~tude n stres'sed4 reore eutdi the-usel of Poor.
surveillance :procedures and Ineffective: evalIuation of- surveillance test dita.
EngineerTing The quality of engineern wokws but consid'ered. god ovral .
'ie Strengths er noted in the capabii ty and ,,experience of the engine.ering staff, day-to-day engineering support ofmaihtenance and opera*i*ons, in the qua lity of most calculations,, and- in the. r6otiine use and applAcatilon, of analyt~i~c .codes. However, engineering was stress'e* bya shortage ofresources, and there was a tendency to accep exist ing. ondit*i*ons Speific weaknesses wee otd wit inossetietfctonn resolution. of. problems Inadequate testing, ; and wok n some calculations and an'alytic.codes.
Self Assessent. and Corrective Actions.
Weakhesses were i dentified i n. the areas, of probem Aidentif"icton and resolution.ý Whl ies sl-ss'essment-s were, genera'- ly good, the ocsi onal-ly fail ead to- ident ify wekess . q.-o -rIInc orrectly caracteritze'd the
,significance of :the" find ings. _.,Add itionalTy,-some corcieatons~wre no tiiiily aid' others ýwere ineffective, leadn to rptitiv problems. -Licensee plning was generaoly effect ive, althoughsome weaknesses w6re founid ji -the overall' implebetation of improvement p]ans.; Sore-economic pressures resulted in imfitatiohs on resources, which ipaired th6: :icensee's ab1ility tcomplete vi I
improvement projects that affected plant safety. Equipment problems were not resolved and improvement programs were not effectively implemented because the licensee perceived them to be of low safety significance.
Root Causes and overall Conclusions While overall performance at Maine Yankee was adequate for operation, a number of deficiencies were identified by the team in each of the areas assessed.
These deficiencies, which included weak identification and resolution of problems; weak scope, rigor, and evaluation of testing; and declining material condition stenned from two closely related root causes. These root causes were (1) economic pressure to be a low -cost energy producer has limited available resources to address corrective actions and some plant improvement upgrades and (2) there is a lack of a questioning culture.which has; resulted inthe pomptly correct s ignifi cant problems in areas to identify orrfailure perceived by management to be of low safety significance.
The economic pressures discussed I n Section 4.3 resulted in limitat-ions on resources and-interfered withi the -,icensee,.s ability. to complete projects and other efforts that would.. improve plant safety and testing 6activities.
Exapls" e ncIude the failure to adequately test safety related components (Section 3.2.4); the long-standing deficient desi gnconditins, su*ch .asthe illusttrates then licensees wilingness to _acceptexisting conditions, many of whicrh became operator workarounds u ..(.Se ctiion 3..1 s ).:....1 : .
Eamples of . iSsue which cthe illustrate complacency and failure to idenify or
,probmptly
-enviconent.: correc+t cditions s ign of ific+ant probl em~s., i ncland the service.water ude...axi)iary previously+ undis+covereid feedw.aterwate systems (Section 3..2);. in adequacies in vetiation systems (Section 2.3.7);
pobst-*trip "re~viiews wh~icrh l~acked rigor. and completenes.s (Section 3.1.,2..7.);
emer~gency comre colengmevent prOcedur~es
.operating.and a steam -that may noit generator tubeadequat~el r-upture y uncder addre.ss an. nin~adequate crutaio o ditions (Sect on 31.31); lack 4 of a questioning att-i.tude durig test perforance and evaluation that WaS not c tedsiscoverin eqipntproblems, budt .
Tnducive .
leadngr(Sect rathe totorpeitives.. prbem performance accepting equipmet (Setio 4.2).-W ion 2.2.1, o' 3.22, 3.2.4); and licensee self-assessments s thatoccasionally failed"to identifyweaknesseysor ihcorectly characte i zed the significance of findings (Section 4). I.n addmietion, some correc tive actions Were nota timely and others were ineffective, vii
11IN 11
1.0 INTRODUCTION
1.1 Background
In December 1995, the Union of Concerned Scientists allegations to the State of Maine, and the State submitted forwarded anonymcis the NRC. the allegationsto The allegations were that Yankee Atomic Electric Company performed inadequate analyses to-support an increase knowingly in. the rted thermal power at wh.ich aine Yankee Atomic Power station (MYApS) performing a technical review, the NRC Office of Nuclear may opeirate. After (NRR) issued a confirmatory order on January 3, 1996, Reactor Regulation at the.plant to the origina licens*ed power level o.f limiting power operation 2440 MWt.
The-NRCO.ffice of the Inspector General (OIG) completed allegation on May 8, 1996.OIG an inquiry into this Q established that MYAPS had exiperienced
ýproblems -with, and- maemdfcain o he'RELAP/SYA coptrce was used in the emergecy cre co6 -ing analysis for whifch a smal .-
b reik losts-of-
- coolant accident.' The proble~emms and subsequent modifications to the' NR as-is required and.
- the co*de asnot used were not reported in accordance 4ith the Safety--EvaluationP-AReot.and,with th The ~# in-d Akin- Pa -Ite
- K.3'. f-3.. a0.*6 aso rdepoted weaknesses rRC in the review adfo . ..
activties .coh wtich- contriut.1erdto IR fajiur-e:to'detect:thes;eadefi'jcien)cies.
4r 1 .1 - _1 ;-t -
-The RELAP igsue ras a queset on of whether siml probems. exist d i othe areas. naordoer to*o address-this question, S wel I s by the Governor of Maine- -About the safety'an-d the :resPon to .cocerns oversi"ghto e ffectiveness ftory assessiient bfoft..aine MYASYankee,t NRC. Chairean ititiated.
TJi at s'sessn~t --
~§tobe an perfre byata independent 'safty opsd ofstafft swhoere independent of any recent or-significan oversi g.ht.re'.sponi*bi*i .ty.for.. reglateo ry Main.. e Y e Additionaltly, the ae sasent e bo to n rintat o e
-representatives consiSte*t State With th of Maine to faiiat e p.roti.cp*atio. by -State i poicy cop: w Sttsa omrilnucl1ear power plants (57 R:, 6462, erar 5 199~)
The RELAP issue was the' subject of- a separate VRC investigatidii and. as not considered par-t'of this assessment.
1.2 $0c00e and . Objectives
- 4. d .. '$h . . .. .. fo' .. . . . .. . .... . ... .. . .
On -May, -31 1996, th staff was directedJto of Maine ;'YankeOe's safet performance.Thoeialglsoteidenen perfrmn 'an lindependent ,e ,Valuation safety assessment were to:- I independentl'y assess the conformance to its de.oign and,1licen sing bases including .. of MY1APS
-and corporateto offices; 2)idpnntyasseiss operational ppropriate revi~eWS at the site S gi vi ng -ri-sk-rperspective V. where app~ropri'ate.; (3 v~aluate te effectiventess: of. sae4 prfr4c
-~
detrmnethe- root cause(s) of safty-signficant I wr~~
-at~ns~ad "ravem 4 coftclusions on, overall1erformance. ni;sadda I
1.3 Nethodology The Independent Safety Assessment (ISA) team comprised members, 3 State of Maine members, and 6 contractors. 25 membes: 16 NRC with five functional area leaders reporting to The team was organized reported.to the team manager who reported directly a.team leader.. The team leader to the NRC Chairman.* The ISA team members were independent of both the NRC
.team devoted several weeks to preparation that Region I office and ORR. The included briefings by the staffs from, Region I, NRR, the Office:frteam.meetings and Analysis, anida Evaluatton On July 15, of1096, Operatiohal Data (AEOD), the Office of Investigations ithe teambegan a two-week evaluation at the faci :and 01G.
lity, including the corporate office and the Yankee Atomic The team returned to Maine Yankee on August 12., Electric Company offices.
Vweeks of evaluation, The representat4ivs from 1996, .for.an addit.ioal two licensee counterparts to discuss team findings. the team met. daily with their
-hadaddition,:to In, a two-membertheprocess State of Maine's partic¢ipationin the assessment, team observe at key assessmnt milestones. the The State
,process team provided. the State with an assessment fairness,. b-alac Of the ifSA. relative to its an, objectivity. The Statehalso adsppecial fi ve-me citi zen's review team peiodical ly'briefed on t IA r c¢ititzens review team"p:rov.ied the State advice-on and ' tinterpretations tts h of the ISA team! process and;fIWdI~S.ý r idepthd Assessment -was canducted n tihe areas painteance, testing, pla:nt qof eeerat;io,nhgts.
e eng.i .erin,aalytic code s Thd coressienactreions. the assestsment nsC an self-as.sesment 1APkdows; extended contol- Ofen
-ofntervieWs-0 serfom Obsv: 'ro ao " t ......
em-revfewV70 --
service kwater* high pressur sfo~et ijetion, ne . and emergcyi
~prqrm proes, nd procedurerves and anayic oerviw.
~adtoan,extensiv reibiiy analyi of I fewatr ! ]Zin hihpressure ut ed .t N :i t inje'tion ed aui fdwae1, emrgc Iay t -yA- j-a esseadengnydisl
- -`ý_ :.fios 6 _t_ee f eertor ane Po sytem a perored. Emhais.was placed on ideniyg both lcnsee Performance weaknesses,. stenthsan The assessment relied on the exi'sting-NRC benchmark util ized inthe NRC Systematic Asses sment of Lice-nseeýfor assessing perform-ance (SALP).: Speciicly PerforM`ýance, Prga
- Superior perform-ance isdefined-as followts:
Licensee-attention and involviftint- have beORn proiper and esutedin Iyfoc u-sed -on safety suerir lvelof sifety performance. Licensee programs, and procedures: haepoie
'licenseets self-ý,a s-sess menti` efifrt s 'haiviefetv been e'f
~t fetive
- s. The.
detf ication of e!,jergetsu. fin'thie.
correct ive atios-a
'so.urid cnpehensive-, and tho`rroughi. Recurring piriblems re technically aeiminte aidresolution of issues istimely.' Root; cause ýAnalyses are toouh 2
I I - I I- 'ý,
I~-.-,ý 1ýz_- _
77 I - ;111p imm
- Good performance is defined as follows:
Licensee attention and Involvement are normally resulted in a good level Of safety performance. well focused and procedures normally provide the necessary control Licensee programs and deficiencies may exist. The Iicensee's self-assessmentsof activities, but are normally good, althoughissues may escape identification.
usually effective, although some may not be Corrective actions are complete. Root cause analyses are normally thorough.
- Acceptable performance is defined as follows:
Licensee attention and involvement have resulted of .safety performance. Howtver, icensee performance in an acceptable level more of the following characteristiCs. Licensee may exhibit one or have not pr'vided s programs and procedures control of activities in important areas.
The licensee*s self-assessment efforts may not occur until fter a Potential problem becomes apparent. A clear i*mpl cations of significant issues may not have understanding of the safety been Numerous m'inor issues combine to indicate that the demonstrated.' ,
act ion is not thorough. Root cause analyses licensee's cor~rective do not probe deeply ug resuIting i6'n-the incomplete resolution of issues.
One area of this assessment, review of the use and codes,' isnot typically reviewed as part of the application of analytic, NRC COnsequently, a panel of acknowledged experts in regulatory process.
and phenomenology were' assembled and provided the area of code development a critical fidnsand observatlions of thejISA team inthis :area.' review of the, 1.4 Facil ity Description The Aaine- Yankee Atomic Power Station is' located, Bailey Point Road in Wiscasset, Maine. The plInt in' the tidewater area on is a Cnbustin Engineering pressurized-water reactor. The facility was which also served as the architectural engineer. constructed by Stone & webster, The full power operating license Was issued on June 29, 1973.
1.6 Organization The. Maine Yankee Atomic Power Station is owned and operated by t Yankee Atomic Power Company. The, chart, Appendix 8,-illustrates the Maine.
_Yankee organizational structure for management and support of the Maine Yankee Atomic Power Station.
3
2.0 C'ONFORIIMIE T-ODESIGN AND LICENSING BASIS This section describes the conformance of Maine Yankee to its. design a.nd licensling-Ibasis. Sign.ificant aspects of the desig"'of fMaine IYankee-we re _as10 onhandling "'worst c-ase" situations such as a postutlAted rupture" Of "alain, steam hnfe or -alarge bre~ak of reactor coolant'system piping along with additional assuffptions, such as,ý the failure of miItig-.atiIng 4equ-ipme.nt coilient w-ith a loss of offsite. power., This pproach establishes; the deerminist ic Ilicensing as. Thsdtrministivc aprah alono wth conservative design, effecti ve maintenance', and thorou h'testing p'rovides an In~heirent ma'rgin of safety' 'anddefense-in-dpht ewt cultaset and accide~nts that May occur.
To confirm plant conformance to the licensing basis,: the team,relviewed transient a ccdnt aaye ý(see Sectin, ), and euipment de.ig Ssues 6see Sections .2and.2.3). 0iceace 1ewe ýactual oeainsft alyses. deinf ures and1 capa~bili tyAand dciptiean numericalvle I
contaied heia' Safety Analyses Report (FAR aesiaized in Sectioan, 2.4'.
2j.1 1'ran'sight andAccidn _Saffty Anlyss Cycle-specific -4oe-performanFe.aayesuha h C4ntr1 lement ýAsbly
((EA)droptranientdescribed be owweexlet.--
harecomplicated, les frequenl efre ytm aeyaaye otie aiknesses, such as ths sociated with the ýsteam line rupture acciet u t,"eainalIyses,were fud ob acceptabl e basie.d on compensating margin.
Ovral use of-analytic codes for safety a1lssa very good. SER conit-ioms wre fatid to be siitisfie4 but nkot ometd cdevlainws
'ViLMe; extellet for- psis and fuel1 codes, wile weak for sytm odes 24.1.Anatit (:ode Suppr Teteam evaluaitedtfle anaytic code supot provided by Yankee Atomic Electric Comqpany (YAEC) for'Maine Yankee Atormic Power Company (NYAPCO) to asuetat a Yane was 'operated within- the: bouds :,of the 'safety anAltyOse. Ti ssessent'was performed breiwng the YAEC pro.Ces conductting :h*040A 0afkt analyses describe6d ',in Chapter 14 of theR FSAR,ý ýao an'T Ondpth reviewý Jof twosecific safety analyses:.the CEA drop transienit and thesealm line ruptuire arccWent; SeleLCtion of :the dropped CEA. transent 16r:
In,. eptlu review prov Wed.a sAruftured means. toý examine may of the codes wse&
tOY YAR.whil see tii Q Qthe of sta i tr nlysis for review ioVI:e foru -fforrev iewin"% a dynamicac'den'- anay'e a - 'oit a e s`tm code for acidfonts an anticiAt"ed Patulte oraln ccrreaces, 2 Amet.ficaton ofcdsM mtos and liMotLations. bsed on the iwtia~ eview oicl 40f eprs and K.RC safety. evaluiation reports .,SERs ()an ass0sssmp~
ohow imitations., restrictioans, and 1boundAry conditions are reffecte'd Un Ate safetIyý 'a".Y a yses central to the assessment was the VerifIcation ha condItios of approval6~tiheid'in NRC"'SE`s had7 beestifdinte aey 4
anayse0s. The ISA turin also specifically examined code validation using gdance *conetai*ned in +Generi~c Letter (CL) 83-1, "censee Performg Safety Analyises in Suppor't of Licensing ActliS,"QuaFebruary Iffcatton for 8, I8.
AlI ananlytic cdes used for the cur.'rent fuel cycle analyses, and a Matrix of codes and transient and (Cycle-15) reference accident analyses 4pii1to 08a shown- In als -Ia-nd -29, re-spect ively. Anltc, 4 mtodsr P-erforance:Analyses Report for cycle 15 (YAEE 107, also 4APPa!nix 0of the FSAR. As indicated in TAble Rev'sion 2), w2hich is 0, 6alne Yanke Analytical Codes for 'mst Fuel Ccle 15", S.s' contained conitions of apprval. Table 2* , Codes Used for %ey Transients, shows the "'applicati codes and me"hod0 to tPecific transint and accident of the analyses.
S
Table 1 MAINE YANKEE ANALYTIC CODES FOR FUEL CYCLE 15 CE FCTIOW NO.. Of SE.
'Physics 1
...... A T E_ _3 . ..- ,.,_UL Ph ys lic s 2 STAR ph- sis - Space/Time 2 FROSSTEY-2 Fuel Performance 4
.COBRAXIIIC Generic ,Core and. Fuel lHydraulic j-I COBRA-4IIIC Plant Core "and Fuel ,Hydraulic 0 Spec ific YAEC-I UHF Critical Heat Flux COr.rel ation 21 SCU ,.:. - :Statistical
.,,._ o :ThermAIUncertaintiesa i- ie . Ao .. Applied
. ... " 0
_0 2 St-olnt-s R*TRN :OZ Nod 2 SystemTherma~l 'Hydrau'Ii . 39 I-RETRA M od2*- Syste- Wen :i,"l -l"d c 0 BLRP Reacti v ty Balance 0 II.'-KIN integrated Single-Channel Fuel.
T/h,:PEWysics G[t4ItI! , System Thermal draulic5-(" SE£ conditions are limitations, application restrictions, and ver-ification aMd val id attion issues.-within which the code and apicatjion .ar JUdged acceptible :to -the staff.
' COnd i ons for COBROA-IIC Generic are imposed by the author:and are described In'the To*ica,.:Report BNWL-1695-6
Table 2 Codes Used for Key tansie nts
'1, IRT SIERM E "
CE. D ,O , .,
FROSSTEY-2 [GEMINI...............
'i..C.F YAEC-] SI CU HAND -RETRAN 02 1C KEN/
SETP, C* OD*-2 1 STAR fk:VAWTOAWAL __ _ _ _ XXXXx _ _ _ _ _ _
BOON DILUTIO0N ______ ____________
_ _ _x LOSS.I!*:!OFFL -OW'. . *X ______ X .X. _____*, X _ _
XEsisER TOAD- , X. x V. xx LOSSOFODX
,,OSS F X X X __
X X X X FEED WATER _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ __ _ __ _ _ _ _ _ _ _
MAIN ;"STEAM-;
LINEý ORUTUE_____
iJ .. '.... -'R E !,,*.
x JU*:*]
CýEAE.:RUPTURE..
EJECTION`I _____
.. . . ... .. .:1-STEN4 G.,ENERATOR X
CASNO-3G 'and SMILUtATE 3 are used torprepare input for a&l' the trantsent calculations 7
2,1.2 SER Conditions Satisfied But NothDocumented The ISA team found that YAEC calculations of transients and accidents conformed to all applicable SER conditions. In some cases SER conditions were explicit and readily verified. In other cases SER conditions were requests to provide justification for certain mod#ls, the selection of correlations, and inputs. In these cases the ISA team reviewed the conditions within the context of the code application.
YAEC did not have a written process to document how safety analyses conformed to SER conditions. Some conditions were "learly known, considered, and used by YAEC. Other conditions could notbe shOwn to be satisfied until additional analyse*s:,:* assessments, and sensitivity studies, w.ere accomplished inreSponse to ISAAnewrequests. This wOrkdemonstrated that all SER 'conditions had been satisfied, although the disposition of some issues required on the known conservatisms in specific accident analyses.
2.1.3 Control Element Assembly Drop Transient The CEA drop transient analysis Which -sed many of the YAEC codes and methods, was performed -in an ,excellent manneri.
The CEA drop wa s one' of the 10 non-LOCA transients normall'y reanalyzed for each cycle. The following set of NRC-approved codes and methods was used:-,_
CASMO-3G/TABLES-3, SIMUL.ATE-3, FROSSTEY-2, GEMINI-lI. COBRA-I1iC (YAEC-1 e)
Reactor Protective System (RPS) setpoint methodology, and Statistical Combination of Uncertainties (SC U).
Predicted fuel bundle and fuel rod power distributions were obtainedfrom fromICASN'-
the sections physics code SIMULATE-3, which in turn used neutron cross
,3G An, ISA- team review of predicted and measured fuel bundle power distributilons showed excellent agreement over several fuel cycles.
FROSSTEY-2. was a steady-state fuel performance code used ,to calculate margin to fuel -centerlinemelt using bounding values from a large number of fuiel rod powers a.nd p"power shapes, The FROSSTEY-2 SER review was performed by the
.authors of its -predecessor code, GAPON-THERMAL. there were numerous-iterations between YAEC and the reviewers, and substantive modifications' 'Io the code resulted. The two SER conditions on FROS$TEY-2 were straightforward-(1)a local burnup limit of 60,0O00 MWd/MTU and (2)the inclusion of fuel Manufacturing uncertainties. The local burnup limit was administratively' controlled at Maine Yankee, and manufacturing tolerances were accounted for 'in the statistical combination of uncertainties. For code validation, FROSSTEY-2 was compared to a significant PWR fuels data base. Probability/confidence limits of 95/95 for centerline melt temperature were used which included code and input uncertainties and were a function of, fuel burnup. Fuel performance -
calculations considered the multiple fuel types and multiple projected burnup, histories, 'and-were excellent overall.
GEMIN1I-Il1w'a's -asimplified systems code used to predict changes in reac'tor.
cool1a nt system (RC-S) p~ressure and core inlet ,temperature associated with the.
CLA drop transi~et. YAEC used the minimium RCS pressure calculated with B
GEMINI-Il for the COBRA-IIIC subchannel analysis which assumption. Since the GEMINI calculated transient temperatures was a conservative maximum core inlet temperatures contained in the plant were less than Specifications (TS), the TS value was used in the COBRA Technical again a conservative assumption. GEMINI-I contained subchannel analyses, treatment of reactor coolant and secondary systems a very simplified four lumped volumes, where fluid mass was constant and The RCS was modeled as secondary system was modeled as a single saturated subkooled, and. the volume. The pressurizer model contai ns two regions in,.which: equations for mass Interfacial heat transfer in the pressurizer was zero. and energy wee sol ed.
transfer was not, modeled. There was-a point kineticsmodel S$Ateam-to-wall Iheat Of thecore. An energy balance was performed by the code.. Benchmarkingqof minimal. Despite its simplicity, the mild therlal-hydraulicthe code was associated with the CEA drop transient (i .e. tan~sieht pressure, and temperature) Was not a. challenge small changes in reactor powe I to themodeling" apperoach in GEMINI-Il, and was acceptable for th i s appl icatiton.
COORA-IIIC was 'a'multiple channel core fluid :behavior and darture from nucleate boiling (DNB) .anal ys-is code, which. was used, twice in the IYAEC methiodology fo'rDNb-.- COBRA-lIICwas* fiirs~t used todm0bdel symetr i a o.he-eighth io6A u vendNro-suppl-ied fuel assOembly flowI-:reasi drmine na nnu et f ow penalety to be used in sub hanel N.t analyses.l es to penaltyswas determised conservatively -from bundlesino Tine Tahn -;power factors. Next, COg nzed raic p ar trs BRA-IsbcInl nlyses were pfomedto dw~el-ine individual.ubhan~t*ne DNBR" liis.isiwas done for a coIection of adjacentpinseand: sub-chfdnn'els hat had a" hih proabil o:f.tyreahin O.-
levels..d* i a Al ,power profi u conservative values for i 2 inle macid tepraue se lo, sdoetbih.~'nmm-N:...
and system' pressure. ... *:"per '
The YAEC-IODNB-correl atio6.n used by. YAEC i.n- the -.
bovewas evelped rom- a substan tia second discused number CO0B.RA-411C.,IC anialys'e s, Columbia Unvrst usng 1:014 fuel s'^imula,to0rs of te o eprietsa
'exact gjeometry; origqinally used, in Miaine"Yankee. -The data,' the C-ORA: code, te corr~elation, adauthostol thed SAtmtht hes ec ionsof ucrrelatin.is athors. In s - 3 b ACwere~
waell aset for the tat ddeeslopmen of ath o:fh rg -C c sre dtStatn B corlain Ths sthicrrc and 15estinhuea fisusel.F roueet pcfcainee W usAd t oasr A'q o .s. RoweZ"COBRA 5 'C: A Digital Compute Progr cor6 stteady Sthate alE and. Thema correlation Iusrslemcted"Mr~*i3 Hyrdi TrIin -Analysis -_ Ro BudeNc shou~ildibothejs~tified.lof One ofl~sea Elemetis, to Mac theFuel COR _11 f3 sateleP cific ortwst, f aboratories 9
that minimal geometric differences affecting DNBR would exist among difierent fuels within the same reload. YAEC has also required vendor flow testing to assure that appropriate flow resistances were applied in the one-eighth core analyses for determining flow penalties.
Overall the CEA drop analyses performed by YAEC for Maine Yankee was found to be excellent for the following reasons:
.(I) Power distributions were found to be accurate and uncertainties treated appropriately.
(2) The GEMINI analysis was applied in a conservative manner for the CEA drop transient.
(3) The fuel centerline melt analyses using FROSSTEY-2 with uncertainties was found to be conservative.
(4): The consistent application of the Columbia University DNB tests, the COBRA-IIIC code, the YAEC-I correlation, and the statistical combination of uncertainties was appropriate.
(5) Careful fuel procurement specifications and application of inlet flow penalties provided confidence that DNB analyses with mixed co6es is done appropriately, 2.1.4 Rain Steam Line Rupture Although weaknesses were found, -the main steam line rupture analysis Was found
.to beacceptable due.to- compensating- onservatisms-"
YAEC used :the RETRAN 02 MOD 2 and :Boron Injection RETRAN, Post-processor (BIRP) codes for analyses. of the main steam line rupture (MSLR) event for Cycle 15.
RETRAN 02 MOD 2 was used to simulat e primary andsecondary system thenal-hydraulic responses following an: MSLR. BIRP was used to calculate the reactivity feedback associated with the steam line rupture and consequential primary system cooldown.
YAEC performed calculations for a spectrum of NSLR-cases for Cycle.9- including cases at hot full power (HFP) and zero. power, for a range of postulated equipment failures. For Cycle 11, the calculation' for the bounhdihg FP case was repeated and was the reference for the currentCycle 1.5 analyses. For Cycle1,ol AE I.RA 02 A re act iVity effct were
.9 recac1 t~d. pt'~ prog...ram_.-,'
RETRAN 02 MOD 2 was a one-dimensional thermal-hydraulic computer-progr iinten'ded for use in an.lyzing toperational the consequenc*s f transients In Jiqt.waer eatos..Th .odesove te equations, of contitnvuity; Momentum to simulate the primary .and secondary fl'id temperathre andevnerg pressur..
th'e coe contained an equilibrium formulation with non-eqili-brium conditions m~odeled in the pre ss urIzer and reactor ve~ssel uprha. ore hetyt~s was"simulated with a onefdimenstonaI e c _ d i ct boiling curve was employed to treat the conVective heattransferbeten the fluid And the fuel rods. Point kinetics were used ;to compute core power. A 10
IN11111 1
bubble rise model was employed to treat two-phase flow and phase separation effects. This code was provided through the Electric Power Research Institute (EPRI) and has an extensive user group.
The Boron Injection RETRAN Post-processor (BIRP) was a separate code used to evaluate the reactivity feedback effects to determine the potential for a return to criticality during the MSLR. It used RETRAN 02 KOD 2 thermal-hydraulic results as input. BIRPwas used to calculate the soluble boron concentration due to safety injection during the steam line rupture, as well as the overall reactivity balance.
The NRC issued an SER on the use of RETRAN 02 MOD 2 and BIRP on October 2, 1985, with no SER conditions for theMaine Yankee plant-specific analyses.
SHowever, regarding a the generic SER with 39 SER conditions was issued on.Septemer4, 1984, use of RETRAN 02 MOD 2. The'ISA team reviewed these conditions within the context of the I4SLR appl ication to Main4e Yankeei ' Nine conditions did not apply to:PWRs. Another 22-conditions were expliCitly met because of the modeling approach and application to the MSIR. The remaining eig0ht conditions all involve .modeling and validation and are subject to interpretat-ion. On the compens-ating conservatismbasis- of sensitivity in the MSLR anlysesstudiesAdescribed
-perfqomdby bYAEC below, the ISA and team concluded that these'condi tions had been. satisfactorily addressed".
During the assessment,-the team found a number of errors and iconsistencies.
YAE C perf0ormed4 ýseveral -sensitivity studies -to quantif the issues-:for the.
team. Following is a-discussion of the .more substantive issues.
(1)" The. pressurizer and reactor vessel upper-.headinterfacial heat-transfer coefficient was assumed, tobe OOO-Btu/hr-ft-I'F. This -coefficient was non-ph-ysicaI and inconsistent with the test data in the literature such as the Massachusetts institute ofTechnology (MIT) pressur..:izer data Use of thiis coefficient i s: incorrect; however, MSLR' r'esUlts 'were event.
unaffected by this assumption since it is ýa depiessurization (2) There was a lack of RETRAN 02 MOD 2 benchmarking against separate-effects and integral and plant data; for example, IT pressurizer data, Shippingport plant data, Loss of Fluid Test (LOFT) loss-of-load test, and f4SLR integral tests.
(3) Liquid flow spikes were observed in steam line break flow, violating the model assumption that only pure steamp exits the break to,. max imizte the cool down-. This demons tratedthat an "error existed i~n t he ibubble-*r ise model in the code. However, the overall cooldown was un4affctedby these spikes..
11
(4) A possible non-conservative omission in the RETRAN 02 .OD 2 enthalpy transport model was found. The work term (PV) In the total energy equation was intentionally omitted as a simplification to the code.
This omission could produce enthalpies exiting the core and steam generators that were too high, thereby decreasing the cooldown rate. The evaluation of the-effect of this term indicates a less-than-5 F variation in the steam generator and core exit temperatures.
(5) There were no justifications or sensitivity studies for the assumed fluid mixing in the RCS. Use of scaled flow dataI to justify model 16g of the reactor vessel lower plenum and upper plenum as single nodes was inappropriate since the data did not include the asymmetric temperatures reflective of the MSLR event. Subsequent sensitivity studiesperformed bY YAEC for the ISA team showed that although0 the in itial cooldown progresses at a faster rate early in the transient when a split core rather than a single channel was modeled, the minimum temperature achieved during the MSIR did not change.
(6) An inadvertent switch in secondary-side heat transfer from nucleate boiling to transition boiling and forced convection to steam was noted in the hot zero power analyses. VAEC corrected this error and the new results showed that-thefutll-power -SLR aa_ yses remained imiting.
However the' hot zero power cases were 've ry close to the limiting full POWer case.
The ?4SLR analysis was judged to be bounding because the modeling of the heat removal from .the secside of the stoeamgenertor-reesulted -n an excessivel~y~::!:)*y low RCS temperature. The conservatively low preicted temperature was :supported by- the following conservatisms and supporting antayses-(1) In the. calculation, the heat extraction by the- secondary side was not degraded as the secondary level decreased. The full. heat removal capability was assumed until all of the secondary liquid was boiled off.
(2) Comparisons of the YAEC secondary-side modeling approach to an MSLR test at the LOBI04 test facility showed that the YAEC approach conservatively ugder-predicted -the test data. While the LO81 test cannot be directly used to quantify the conservatism of the MSLRcalculation due to scaling and modeling issues, simulation of the. LOBI testS with RETRAN 02 140 2 qualitatively demonstrated the conservatism.
4LOBI, Loop Blowdown Investigation Facility 6!Pr,,etest Predictions for a LOBI-4OD2 Large Steam Line 8reak" Lightfoot, J. Burchley, J. Rogers. Procedings by P.
to the Sth JInternational RETRAN Conference EPRI NP-5781-SR April 1988 12
2.1.5 Lack Of A Documented Process To Demonstrate Code Capability YAEC did not have a documented process in place to identify and rank key phenomena for each of the transients and accidents in the safety analyses report and in turn identify needed code validation and parametric study efforts, Some codes, such as the physics and DNB codes, were found to have extensive validation to actual plant measurements and experimental data respectively., In contrast, the ISA team found that there was overreliance on industry RETRAN validation efforts, and that validation of RETRAN for the XSLR accident at YAEC was weak. During the ISA, YAEC initiated the writing of a "Methods Overview M~nual" which was intended to address these issues.
2.2 Design Review Of Selected Systems The ISA team conducted an in-depth design review of: (1) the high-pressure-safety injection (HPSI) system;.(2) service water, which included the service water (SW),system, the primary component cooling water (PCCW) system, and the secondary component cool.ing water (SCCW) system; and (3) the electrical system,, particularly as it pertained to HPSI and SW. This design revyiew consisted of an eValuation of tthe ability of these. systems, as modified, maintained, tested, and operated by the licensee, to perform their intended safety functions through an in-depth review-of the work of the various engineering disciplines .(mechanical, electrical, instrument and controls.).
'2.2.1 -High-Pressure-Saqfety Injection _(HPSI)--System I
'Asa..A_ resul t of the ISA- team-st f-ind~ing -that the ci-rcuitry of. .one of the
-containment spray pumps (P-61S) -and the recirculation actuation system (RAS) anua~l switch periodically lwsinot tested, -the licen see discovered that .PS..
pump P-14A would not have actuated automAtical y after a oss-of-coolant
.,,accident (LOCA) with offssite power _avaiable. The abi:lity of the*conitainment splay (CS) system- to provide a reliable supply of water to HPSI pump suction AZFuriigo the recirculation phase of a' LOCA was not adequately demnstratea -for plant operation ati :power levels above 2440 MWt due to the potential for CS pump cavitation. With these exceptions, the ISA team found-that-the *PSI system would have functioned as intended; however, other weaknesses we~re noted with testing.
?.2m.1 PS1 System Description The HPSI system, the low pressure safety-injection (LPSI) system, and the CS system were the subsystems .of the emergency core cooling system (ECCS), The WPSJ system cons-isted of tihrqee pumps and, associated:.val:ves, instru~mefitation, and.pipii ng. One, pump was normal y operating .1as a charging pAmp, asecondR pump was al igned: _for J tandby operation, and' the third pum""was avaih-Ableas' a spa4re. Upon a safety injection would ,be autmatiqcally-a-igned toactuation s~ignal -SIAS)- £CCS teh r**ueling water 'toraget scIon
(-WST).
-um Vol1 oingInjctin o apr~x1i~e~y9a,,0 a ions. from,-tte-RW-T~-he -EC-S-l7*Jb-into**th recirtion phas e HPSI system would realign to take suction from the discharge of the Cs pumps, the CS .pumps would take suction from the containment sump, and the LPSI pumps would be stopped.
13
2.2.1.2 Flow Testing The HPSI system showed little-to-no margin in performance, particularly when operating at maximum flow conditions. The operating point for the HPSI pumps
.under these conditions was beyond the design information supplied by the pump manufacturer. The acceptablity of the operation of these pumps under these conditions was established by licensee tests. These tests may have shown some degree of cavitation and an uncertain, but likely very small, margin. These ltlmiting conditions would exist only in the low probability event of a large break LOCA.
The HPSI system was set up to operate under maximum flow conditions (Approximately 800 gpm) at an operating point approximately60 gpm beyond maximum flow on the pumpwcurve provided by thepump manufacturer. Flow net positive suction head (NPSH) data from the pu.mp manufacturer were notand available for this operating point. The licensee based the acceptability of the. system on testihg done nsite in 1972 and, 1993-.. The ISA team reviewed the-results of these tests in detail and concluded that, although in the engineering judgment of both the, ISA team and the licensee'that the HPSI sy stem was'operable, the tests-lacked rigor..
Preoperational HP$S pump runout tests were conducted in July 1972, and flow vues* we ret-recorded- uP ý'-to `805, gp With I-imited'Ad umein at ion of .u..p
.conditions and system lnu.Howe'ver, the corresodn RSTtnad t~inpera ture wIere approximat ely 7000glosad15 ,adte tss were run anfter the lHPSI flow- to6 the three loops was bal.anced. The licenseb later
`ýchanged- th iiumR evel prior -to--sbmp--recircu ati on to approimaiite Y, 100,000galtlons, resulting in several additional feet of NPSH avilable to the
ýpumps.
Additional HPS! pump. testing at high flow conditions was done in 1993 following* adjustments performed o.n the loop throttle valves. Regarding this testing, NRC Inspection Report 50-309/93-22, dated October 25, 1993, stated, During: a dynamic test of motor operated valve..(MYV) HSI-t41, what appeared to be runout conditions were observed at high pressure sýafety 'injecti ul(HPSI) Pump P-m4A. The pum n with a flo.wmeasured-at 796 gpM' (not including the recirculationflow) the pressure was less than 390 psig. Upn futher esting, the pump noise was still present when total flow was 800 gpm. While pump'vibration-and temperature.rema*ned normal,-the licensee was unable iodetermine that ihnitial pumpcavitation was not On the basis of the concerns of the. ISA 'team regarding these tests (adequacy
~ofocmetator-ad-intrmetaion -nd-i-~ode~t 'ro~vi de- add iUsjn--l assurAnce of the proper oPeratiOn of the system, the licensee plans a future test of theHPS? pumps in a tec¢hnically rigorous manner to fully demnstrate the available margin.
14
2.2.1.3 Throttle Valve Settings HPSI flow control into the reactor coolant system (RCS) was three throttle valves per train that were set with a tolerance controlled by high. The ISA team was concerned with the critical nature that may be too these throttle valves because unintended variations of of the setup of as little as 20 gpm could result in some cavitation, if flow was too high, or not flow values assumed in the LOCA analysis, if flow was too meeting design low.
The position of'the UPSI throttle valves (3-inch globe valves) controlled by the licensee within a tolerance of : 1/16 Inch was being flow testing done in 1993. During this testing, the throttle based on full these valves was established and mechanical stops were set. position of stated that tolerance on the position of these valves was The licensee ruler to measure how far the stem moved. In 1994 the licensee based on using a digital micrometer that measured stem'position of these valves began-to'use a inch. to within .001 The licensee did not have specific test data to evaluate tolerance or a specific coefficient of flow (Cv) value the impact of this for the throttle valves that could be used to calculate the impact of the tolerances flow. Estimates using a licensee supplied Cv that may be on HPSI delivery typical for this type of valAve.r concl uded that thi s tolerance band. could causea floovariati6on of more than 20 gpm per valve.
Actual flow'through the HPS! throttle valves was measured by Procedure 3.1.15.3, .ECCS Operational Pump Flow and Check each refuel ing cycle Flow measurements to each loop were measured and evaluated' Valve Testing."
adequate amount of total flow to the RCS,-and. to ensure to ensure an anr -acceptabl e flow distribution among the three loop -ijecti0oi points to
,possibility that, in-an accident, the flow through one accouint.-for -the, l1oopr- may bypass the core by going out the break. Althoug§h .this'*-test' could not definitively evaluate the settings of the throttle valives be'useIldto under
-ful flow conditions (essentially no reactor coolant,ystem back pressure), it did provide: a realistic appraisal of system performance mis-adjustment of the throttle valve setti*ngs.: The and ;.ould indjicate a gross results of the last performance of this testI as it iSA team reviewed the pertained system, in November 1995, and found them acceptable. to the HPSI The planned IhPSI flow testing to verify pump conditions at high flow will also enable the licensee to reset the position of these valves using a more precise tolerance to ensure that required flow' is met and runout conditions vae.not exceeded.
more preciseThetolerance l icensee pl-ans to inclI'ude
&the e resetting as part of that flow testing. of these .vaives to a 2.2,.1.4 Cs System Support to the HPSI System Theability ofthe*-S systm to provide a relilabl"e supply.
recirculation phase of .a LOCA was not adequately demonstrated of water during the power levels above 2440 1Wt due to CS pump cavitational concerns. for op:eration at These 15
conditions would exist only in the low probability event of a large break LOCA.
Maine Yankee was licensed to pre-1971 general design criteria (GDC) in Appendix A to 10 CFR Part 50. These criteria were provided in Appendix A of the Maine Yankee FSAR. FSAR Criterion 44 provided requirements for ECCS and stated in part, "The performance of each emergency core cooling system shall be evaluated conservatively in each area of uncertainty." The ISA team reviewed current and historical design calculations to evaluate if net positive suction head available (NPSHA) for the CS pumps during the recirculation phase was derived with the appropriate conservatism required by Criterion 44.
The. licensee asserted, and the ISA team found no evidence to contradict, that Maine Yankee was not conmitted to the requirements'of RegulatorydGuide 1.1, formerly Safety Guide 1, dated November 2, 1970', which stated -in part that "Emergency core cooling and.containment heat removal systems shoul'd be des4igned so that adequate NPSH is provided to'system pumps assumingmaximum expected temperatures of pum#fluids and "no increase' in' ýciont'ainment pressure from that present prior to postulated loss of coolant accidents." The licensee assumed-a less conservative CS pump NPSH, taking credit for accident induced containment pressure to demonstrate that NPSHA was greater than or equal -to the net positive sucti onhe ad required (NPSH).
Te ori:ginal NPSH calculation (MYC-272,. Revision 2,"NPSH Study, 'Containment Spray. Pumps.").,..assumed asump temperature of 190 f -arnd zeroconti nment over-pressure,;i ..although'h the max'imum sump tlemp6rature was predicted to be tmpron i hfi uain sig~nific-antly, lit
.1exce$ss o212 1 F. The....i-censee, reicognitng CS:pmne~ed :to zed-the toH..........
imp)rove t*he-qua-ity of this .analys~is and began reanalyzing CS pump NPsH in The current design basis NPSH calculation (MYC-1804, Revisi on ý0, "Contai-nment Spray Pump NPSH") established a time-dependent correlati-on between the NPSHA and NPSHO based on transient LOCA containment pressure and temperatures. This calculation showed an NPSH9 of 15.3 feet and a positive margin ,ofNPSH of less than 1 foot. A very sophisticated multi-node RELAP/MoD30model was used to cailculate blowdown mass and energy to the containment. A very simple one node code (CONTEMPT-LT 28) used thits information as an input to calculate the containment-pressUre and sump temperatre required for de.termininig NPSHA This analysis also assumed an initial power level of 2700 MWt. During the ISA the licensee. provided information from the pump mahufactur er which indicated tthat the pumps in question could be expected to pperate.ý, fr up to 15 mi nutes without' dam-aew an NPSH ofw 11.4 feet.at 3700-3900, gpm.
The following weaknesses were identified in this analysis.
O"Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal Syst-em Pumpos" 16
......-- 111 1,11.911-1. i1-11 ý- : I pomp=
(1) The precision of the analytic technique and the sensitivity of the analysis to containment sump temperature.
The team's evaluation of th. results (NPSHA values) indicoted that a change in sump temperature of only I OF would change the result by about 1 foot. NPSHA was calculated based on iteration between the two computer codes described above, that have an unknown degree of uncertainty for this type of analysis.
In particular, CONTEMPT-LT28 has options intended to bound the extent of mixing between the containment atmosphere and the break effluent, since a single node cannot address this phenomenon. Also, no validation for this type of analysis was presented. Given the uncertainty in the codes, the iteration scheme, and the sensitivity of the final product of this calculation, the ISA team questioned the validity of this c,1culational approach and the specific modeling assumptions used.
(2) Incorrect calculation of bounding CS pump suction head losses.
The suction pipe friction losses-were developed for pump P-61A in calculation MYC-272, Revision 4, "CS Pump Suction Losses During RAS." Assumption two of this calculation stated that the suction piping arrangements to pumps P-61s and P618 were virtually identical to pump P-61A. Therefore, this*calculation was as!sumed to. bound -the -worst-case coditionfor all :hr pumIs e ISA team determined that the suction piping arrangement for pump P-61S would result in higher suction piping frictonal losses than those calcu latedfor pumpp -61A. As a result of the ISA tea'm'sconcern- the l.icenseeperformed:an evaluation that'-confirmed an increase of suction pipe friction losses from 4.5 feet to approximately 53 feet.
(3) Use of a hot fluid temperature correction factor.
The licensee took credit for reduction of the NPSHR requirements due. to the increased sump temperature. This phenomenon was described in the Hydraulic Institute. Standards. The ISA team viewed the use of the NPSH, correction for this application as an example of a non-conservative assumption.
The Hydraulic Institute Standards (currently American National Standard for Centrifugal Pumps, ANSI/HI 1.1-1.5I1994) provided limitatiOns and precautions for use of the NPSHR temperature reductio n,inhcludingconsiýderatiions-of
.entrained air.or othergases present in the liquid and 'cons'ideration of the susceptibility of the suction system to transient changes in temperature and absol ute pressure. The ISA team considered thatý both of these .liimitations merited consideration because-the sump at er (ny not be sufficiendtlsy deareated and the. CS pump would be undergOing a-significant temperature 1trahsiet -hear the t6iime of minimum availability of.NPSH. However, the calculati-on was silent on applicability of these limitations.
olwing -he assessment, the Iice~nsee conducted additional analysis. to support plant operationat UP to 2440MWt. After reviewing thins information, the ISA team concluded that it was-appropriate to consi.der these pumps operable at power levels up to 2440 MWt.
17
Ma"M 2.2.2 Service Water/Component Cooling Water The ISA team concluded that the support systems, service water and component cooling water, designed to remove decay heat and heat ge-erated by individual components were capable of performing their design function up to the presently authorized power of 2440 MWt.ý 2.2.2.1 System Description The service water (SW) system was comprised of four SW pumps (housed in the circulating water pump house), four heat exchangers (two each for primary component cooling water (PCCW) and secondary component cooling water (SCCW),
and interconnecting piping and valves. The PCCW and SCCW heat exchangers consisted of two pairs of heat exchangers, an older and .smaller one and a newer and relatively larger one (by. approximately 20 percent), in. eachpair.
The newer heat exchangers. had titanium tubes and the older one had copper-nickel tubes. The SW system provided the ultimate heat sink for cooling of plant equipment. The system provided safety and non-safety functions by pumping seawater through the PCCW and, SCCW heat exchangers.
The PCCW and SCCW systems performed an integrated function-with the service water system6 in 'ooInplant equipment and: removing decy heat. 'Each subsystem consisted otwopumps, the heat exchangers described above,-and a flow distribution piping. network. These subsystems absorbed'heat:from indiv~idual .cmponent oolers and from-the--residual .-he-at removal (RHR) heat exchangers (one per train),. which represented, the -major post-accident heat load in removal or heat'- from- the --conta-inment bui-d-i.ng;".
2.2.2 Availability of Seawater Flo- Into the Servilce Mater .
Intake Structure A bottom contour map based on a 1994 survey of the area near the circulating water ,pump house showed relatively open access tn the Back River and ultimately to .the Atlantic Ocean. Therefore, an ample water supply was assured to the SW system.
2.2.2.3 Service Water Pump NPSH The service water pumps had sufficient margin of submergence over the range of operating.tide levels.
In the- installed configuration, the pump inlet flanges were at an elevation of
-14 feet 6 inches, and all pumps were shop tested to a water level 'of feet 6 inches above the pump inlet. "The water level at mi i mumsubmergence would Stherefore be at elevatioh -12 feet. A review of tida"l records from 1989: .to
_pest _(ecept 1995 w*hen tepatwsnot-.operati~ng),.showedhat-onl..a.i..
-7 feet (with small variations) was the low tide level.
2-.22.4 Circulating Water Pump House Flooding Adequate provisions were in place to mitigate the impact of floodi.ng in the circ(ulating water pump house. These provisions included level arlams, header 18
pressure valves to switches prevent that provided information if the headers failed, check drain back, and a 7-1/2 feet seismic circulating water pumps from flooding the SW space. In wall that separated the the the operators had sufficient information and time to locate event of flooding, isolate it before the problem and damaging the SW pump motors.
2.2.2.5 Residual Heat Removal (RHR) Heat Exchanger Thermal Transient The ISA team found that, with the plant limiting design-basis thermal transient, operating at 2700 MWt, the most LOCA, on the RHR heat exchangers was beyond Shifting to recirculation during a not been analyzed. The consideration their design specification and had of this thermal transient, apparently not explicitly addressed in conjunction with the power upgrade to 2700 MWt, was considered a weakness. Once again, these limiting conditions would exist only in the low probability event of a large break LOCA.
The maximum heat transfer rate, according was approximately 120MBtu/hr during to the RHR heat exchanger vendor, exchanger could sustain 50cycles of a transient of 10 seconds; the heat this transient. The power upgrade to 27006MWt increased the maximum containment resulted in a LOCA heat transfer rate sump temperature to 255 F, which Revision 1). A fatigue6 analysis of *the of 137 MBtu/hr (calculation Mg4-, N7, threshold was not performed, therefore heat- e"xchangers, atthe higher TheiMaal some assurance was needed: that the 6ternating estresses fuor the.arioussubassemblies of the heat exchanger would As a result of the ISA team's inquiry, the licensee investigated-the impact the higher thermal thr'esho:d. The original of no longer available. However, thevendor wastransient analysis calculation was for a heat exchanger of similar design able to provide a stress report and this information and concluded that these materials. The ISA team reviewed operable at the higher thermal values heat exchangers could hbeconsidered resulting from plant operation at 2700 MWt.
2.2.2.6 SW and PCCW/SCCW Integrated Operation Calculations demonstrating the design margin of the SW, SCCW, and PCCW systems (PCW, and SCCW will be referredtoas ystems) 'shOwed essentially no margin the component cooling water (CCW) perform their safety-related functions.for the' CCWsystems in their ability to The component inlet tempera"ture theCCWsystem loads a set at 118 *F, of temperature for assurig adequate bheat which appeared to be the maximum accident conditions. By the use of ca "removal from system loads under lculatior0sp, allof was the SW system to optimize operational the available margin
_transferredto limiting,- condit ions of this ana l ysis woul d, be flexibility. The si gnificant only i- the low probability event of a large break LocA.
The ISA team-was concerned with this approach systems because of the lack of margin in the to operation of the SW and CCW thmaterial condition CCW supportin, calculations and e sysem (hea exhanger yass valves.).
thesen.on-.onservatisms, the ISA team concl uded that it was appropriate to Dspi0te 19
consider the PCCW/SCCW systems operable at power levels up to 2440 MWt. The ISA team was unable to conclude, and the licensee did not demonstrate, that these heat removal systems would perform adequately under design-basis accident conditions originating from a power level of 2700 MWt.
On the basis of this integrated heat removal analysis, an engineering directive had been provided to ensure the SW system would be operated within certain limits. However, the operating limitations provided in the engineering directive were not bounded'by the licensing commitments. Section 9.4. of the FSAR stated, "The component cooling water'systepInheat balance was performed in 1990 ... demonstrating adequate Capacity for design basis post-LOCA conditions assuming a service water inlet temperature of 80 OF for CCW heat exchangers E-4B and E-5A, and,90 OF for CUW heat exchangers E-4A and E-58." The engineering directive restricted the maximum SW temperature to 70.2 °F for E-48 and E-5A (the older Cu-Ni units), and 78.5 °F for E-4A and E-5B (the newer titanium units). On the basis of the licensee's analysis, the CCW systems would not support plant, ._ation up to the SW temperature values in the FSAR.
Integrated operation of SW and PCCW/SLCW was non-conservatively analyzed due to:
I. CCW and -RHRHeat Exchanger Fouling and Testing FOuli~ng factorsused for the CCW and RHR heat exchangers were not conservative given ac sti~n done to confirm toappropriatey.
the* a~ssumed values.
The ISA .team's review of heat exchanger test results and.test practices identified that the test program was stl- being developed, and there was not enough-rlia-ble test results to support use of the fouling values used in the i icensee's design calculations.
The ISA.team had the following specific concerns with the licensee's heat exchanger testing program:
(a) Instrument uncertainty was not accounted for in determining the fouling values.
(b) The installed locations for the flow measuring devices were less than optimum to assure accuracy, and the flow measuring devices were not calibrated, for their specific application or ;adjusted for the actual 4pipe wall tthickness. apitno adjusted f t a (c) Heat exchanger tubes were cleaned on a periodic basis; however, there wa-s no -requirement to 'do performaneI'igjs eoeteha exhar, ceanjing,,_thustte,_mAximum--Aoul ingvalue---was -not---be~ing ý-
.monlitoed.
(d) The lack of surface mounted thermocouples made the-measured temperatures susceptib!e to potential streamhing.
20
- 2. Maximum CCW Heat Load The ISA team's review of calculation MYC-1742, heat. loads were modeled as one major Revision 1, found that the CCW represented all other CCW loads. The load (RHR) and one auxiliary load that maximum containment sump temperature, RHR heat exchanger load Was based on a MYC-1740, Revision 1. The remaining 255 OF, as determined in calculation load. This value was developed as a sum loads were lumped as a single lOMbtu/hr
- (EDG) load, control room. chiller, and of the emergency diesel generator other unidentified loads..
The ISA team questioned the basis for of the PCCW system, the heat load included the 10 Mbtu/hr value, since in the case exchanger,, which, had a design load of the spent fuel pool (SFP) heat each emergency diesel heat exchanger, 9 Mbtu/hr (prior to re-racking),and For the SFP load, the-licensee assumed w!iich had.aCload estimated at 5 Mbtu/hr.
exchanger would not exceedthe analyzed that the total load on the PCCW heat initial SFP temperature of 1100 F. valve based on an assumption of
- 3. Flow Diversion Temperature control for the PCCW and adjustment SCCW sy-stems. was ..accomplished by
'was on ye of the bypass flow around the heat exchangers was ne nlyar.opeirator pe ytem thaoprtdbh side). There the bypa'ss. valV ,e. The cluain the: fnle-t valve and accidentthe: bypasssvalve wuld be full sue that during aJdesign-bass 0fuy open, cluosed -and the 'inlet Val7ve would be thus maximizing f]ow through the heat exchanger'.
valves ididdnotgo. to_. thei r, safety If the bypass.
capability of the heat exchangers cul rel-aed.ps-piions; th&heattransfer 6
bican*y in 1995 che licensee discovered that the CCW heat exchangor bypass valve, PCCI-T20,was open about I*ý following related position, closed. At the time, an attempt to align-it to its safety immediate operability determination was Maine Yankee was in.an'outage and an reportability determination'had not yet not required; however, the been completed at the time of the ISA.
The ISA team found no calibration procedures were not:of the "fail safe" des:ign, noprocedureswerefor-these valves, the controllers found.-that tested, abi~lity of these valves to perform their safety elated function maintenance hi story of these Valves identified 11 completed maintenancethework orders'(W0s) for these valves in the lastfive n D , 1995, maintenance work order (WO)Q95-3194 was linkageqbetween _CCW heat echanger bypass initiated which iAdentirei d PC-T-49, .was mi sai igned.". This WO6 and in1et valves PCC-T20thatthe and was open the time of assessmentanddat scheduled 'for,complett ion dur'ing the -1997 completed Jaury1699,(PC)0adW
~~ ~ refueling outae WO9-4500
~ ~ ~ ~ 9-1450445pltdAuut9-0, one q
`4f6t~ ela fonction.an 96-01785-0 WOý appeared to be1 sttdthta0siin,.alr to 0imilar PCC-Ttw2 andJrecommene to- "wc -Ias:'lods 6get conrole addedl.ler r"inth e ncti vetfta WOn93-e459-t0had on a comndaoe~tinutom trle con678-0 tiated-"rebld/ea-tot ' m al func ition.
entioref.
21
On the basis of the ISA team's concerns, the licensee performed a test on the PCCW temperature control valve after the team left the site. This test was reported as successfully demonstrating the operation of this valve.
2.3 Electrical and Instrument and Controls The team found that the capability of the electrical system and instrument and control equipment to be generally robust and capable of performing their design function. Significant exceptions were noted with environmental qualification of components and ventilation systems.
2.3.1 115 kV Offsite Power Lines The 115 kV offsite power lines were not independently capable of supplying the plant auxiliary power system under certain conditions. In FSAR Section 8.2.3, the licensee stated that either of the incoming lines is independently capable of supplying the plant auxiliary power system. In. FSAR Criteri on- 39, "Emergency Power -for Engineered Safeguard Features" (FSAR, Vol III, Appendix A), the licensee stated, "alternate power systems shall be provided and designed with adequate independence, 'redundancy, and capacity to.permit functioning required of engineered safety featdres. As a minimum, the, onsite And offsite system shalI eac*inhdependently ovide thi s- capabiity 4assuming a single failur* of a singleactive _omponent in each power syStem."
The -.station had. two incoming -115-kV-1 ines, and the --main generat-orwas-cbnnected 345 kV line; 'to all were interconnected to the New England area transmission netwrk.. Themain generator--was connectedtoithe 345 kV.
swtchyard. Start up rand standby-(reserve) offsite poWer ed by the 11 5 kV switchyard s (which used -two inco.mi ng- linesU, Srowi ec and Mason) through -
reserve station service transformers X14 and X16. Under heavy loadfing Sconiditions, a capacitor bank was used to compensate -for and reduce the reactive voltage drop on. the Surowiec line.
In 1995 Central Maine Power (CMP) completed an update of its studies of the 115 kV system to verify that the system remained capable of supporting Maine Yankee licensing requirements. As a result of the CMP studies,the licensee found that the electrical, system analyses in calculation MYC-430, ReviMsion 3, "Auxiliary Power System Voltage Study," failed to on'si*der the effect-of a motor-driven main feedwater P'mpt (MDFW) automatic start following fast transfer of plant loads to the 115 kVoffsite reserve power System.
The.CMP Voltage sst-udy for the"fUll' 115 kv system, both Surowiecg (Section 69) and-Mason (Section 207) lines, indicated "that t*h ei system cou-ld.sUppot4tfaSt trans.fer of plant loadS and subsequent start of a MDFW pump. Howev,-the voltage study for the Surowi.ec ine -onl (Section 69) indicated hat the 15`kY, system Was inadequat ejor, the MDjFW,_0 ~pmp start.. The Study-ofre thattheSui~wi~ lie votag wold not recover (ate a fast transfer,a safety-injection actuation signal, and subsequent MDFW pump.-auto-start) within the al otted 5-second reset time. i nt.erval of :the de(grad*d e gri d, uni*eevoltage
-relay to prevent offs-ite reserve power from being disconnected. andautoaic start anrd loading of the EDGsI The ISA team concluded that th-isý Situation (i.e., the limited capability of the Surowiec line) was contrary to. 6theI design 22
and licensing-basis presented in the FSAR which stated that either of the 115 kV lines was independently capable of supplying the plant auxiliary power system.
As stated in a letter to the NRC dated July 19, 1996, aware of this issue as a result of a 1995 CMP update the licensee became kV system. of its studies of the 115 In response to the ISA team's concerns in this area, stated that the 345 kV offsite system would serve the licensee re.serve power. The 345 kV system can be back-fed as an alternate source of through the normal station service transformers to from the main transformer the onsit? 4160 Volt auxiliary power system. The provide station powe r to licensee considered this circuit to be a delayed access circuit which could approximately six hours with disconnection of the main be completed in "
generator links The Maine Yankee Technical Specifications, Section 3.12, required one 115 kV incoming line to be in service "Station Service Power,"
power. rTherefore, aTechnical .Specification Interpretation when the plant was at 1996, was initiated to require that.when. 115 kVwas dated January 12,
- supp*lyngq plant loads, and either MDFW pump was in in standby or was the Surowiec line (Section 69) was consideIred inoperable. the automatic mode, then The ISA team did not consider the licensee's position that the 345 kV:system
,-back-6feed operation, completed hwitohinsixhours, was an acceptable basis for omlii~ance-with the FSAR. and Maine Yankee-Design -i-terion 39*.However, the I-k`A team consi dered this situatio6n to be of low safety
,consideringthe historical st:abii s igni ficance t y o fte grid the ex independent reserve power transformers (X14 and X16),
conditions.- (heavy-l-oading and and the limited automat-i c-start-of -MDFW pump)- -under whi -the e SuroWeic*line would be unavailable.
2.
3.2 *Dgraded Grid Undervoltage Relay Calibration Tolerance Band The ISA team found that the calibration tolerance undervoltage relays may result in a setting 'that band for the degraded grid transfer of loads from offsite power to the emergency could cause a premature diesel generators (EDGs) fol.lowing a LOCA. As a result of recently updated CHP voltage licehnsee was in the process of revising the electrical system studies, the ca.lculation MYC-430 (Auxiliary :Power System Voltage- aalyses in 1990). As a result of these anaiyses, a vulnerability Study, Revision 3, May 14, was aqxl iary power system because the upper limit of the calibration tolerancefound in the *nsite band specified for the reset setpo i-tof the degraded was"settoo htigh (95.5 perceht of ratedbusVoltage.) g*rid, gufidervoltage relays iUnder worst-case con'ditijons th.eseý rel'ays zset at the, specified uppe liitof'th~et could cause premature transfer of loads from the tlerante,band I v off.site reserve power 115 sys:tem to the :EDGs This coud have creted a si cont yt FSAR tion that would be S2-s*. lhred he-ff i-te -reserve-p'owetr*-
systemt to ecapable of supplying the plant ýuxiliary power system.
In response to this issue the licensee stated the load of 1,366:MW- assumed in the full system base fol.l]owing; (1) A CMP grid Maine Yankee would again notify CMP to bring "the Maine is case unlikely; however, Yankee capacitorbank and Surowiec Transformer Auto Boost into service at grid loads gr"eater thAn 23
1,300 loadingMW.of (2) CMP 1,300 MWwould be asked to perform a system analysis based on a grid and the results would be used to veri'y an adequate system voltage to reset the degraded grid undervoltage base case would be eliminated from calculation relay. (3) The full system case which is based on the grid at a 1,300 MYC-430 and replaced with a new tolerance band of the degraded grid undervoltage MW load. (4) The calibration ISA team agreed with the licensee that relay would be reduced. The the potential for the as-found settings of these relays to cause a premature transfer of loads to the ENGs was unlikely and considered their planned actions acceptable.
2.3. Electrical Protection, Coordination, and Cable Selection The ISA team reviewed the specifications, drawings, calculations protection scheme, cable data, motor data, protective relay setting criteria, relay Settings, calibration records, and coordination' 480 Volt ac emergency buses, with particular forthe 4,160oVolt acand emphasis on motor. and bus protection associated with the HPSI, EFW selected motor and NOV feeder .cables and SW systems'. In addition, Ioading, cabl-e sizing, cable routing, were reviewed for electrical equipment tray and:conrdufit fill, and ampactity derating for these systems. Overall, the protection and coordination calculations ISA team found that electrical criteriawas consistent with industry standards were good, protective relay setting ca1ibration record."s were good, .cable sizing and practice, protective relAY appropriate, and.tray and conduit fill was robust, aMPaCity* derating was was accep-table. However, s-ome -minor discrepancies and errors were fond' (see Section.2.3.6).
12 125Vl N.3.- dc Vital, Station Batteries TheIS-A-team concl-udWed that the battery capacity was robust, and that all vital station batteries had a capacity greater-than 110 percent of the -needed-2.3.5 Emergency Diesel Generator Electrical Loading Although the.EDGs were assessed non-conservatively, their capacity was sufficient.
The onsite emergency ac power system consisted redundant .4,,160. Vo t, 2, 850 kW (2,000 hr/yr of two independent and rating) EDGs. The' P-SA reviewed.calculatn megenc Dise Generator LoadIng," team ReVision 4 which evaluated the loading of. equipment thhat cal.culation MYC- 107- was not o.ell docuimented,onto each tDG. The ISA team found non-conservativly; because al] required loads EDG loading was -assessed calculation, and, the loading profile was were not included in the rqUire n~ts. "The ISA team conc uded, inconsistent with F.SAR a. design however, that the EDGS were able to start.a,8 -c~arry. all. required-loads, i:ncl1udingq the! -ISA' team .:and not included in" the cal4c1u6l the additional 1loads found by
-. -following problems wint *loading on. The! ISA1 teamnOtet-e the.- to*_6fEDG Uvb* i n: calculation MYC-107:
- 1) Cable power losses in the .4-kV and 480 rncorated in.to the calculation. ThisVolt ac systems were not additionW al Io ad was estimated to be in the range.of 3 to 40 kW.
24
(2) The loading profile was inconsistent with FSAR and design requirements.
On the basis of FSAR Section 8.3.2 and the elementary system drawings, CS pump P-61A and PCCW pump P-9A automatically start 10 seconds after closure of the EDG 1A circuit breakers when EDG 1A starts in response to a SIAS. Contrary to this, the EDG-AA loading profile in calculation MYC-107 showed these pumps loading at 20 seconds with EFW pump P-25C.
In response, the licensee stated that FSAR Discrepancy 25 (June 19, 1996) was initiated to identify and resolve the discrepancy in the power demand for the loading steps; however, this specific problemwas not noted in this document,. The ISA team judged that this discrepancy would not have an adverse impact on .the EDG operability.
(3) There was a lack of documentation in the calculation to support motor loads. This was a minor weakness in the calculation.
(4) Pump motor loading was non-conservative. LPSI pump loading in calculation MYC-107 was identified as 336 kW; however, the based also loadingon value a
at runout would be 364-:kW.k. The EFW pump loading was nominal value of 378 .kW rather than on the runout value of 441 kW.
(5) Control air compressor manual start, required by procedure ECA-0.2, "Loss. of AllT ac Power- Re.overy, SI *Required," was not --incorporatedinto the cal culation. The licensee stated. that.the additional electrical loadwould be a cycling lo'adof :24.5 kW. fr na'n
.laded compressor
" and S71 kW fo r a loaded d.compress or.
(6) MOV *replacements were not -accounted for in the EDG -oading calculat-ion-intha-t- operators *anpd moto--st.-far 14 NOYswer*-replaced under the NOV "Upgrade Program ;.but -th-e motorhorsepower*.changes-were not.included In e... electrica ne-i ne drawing ed red by Procedure 17-227, ",El ectriical- D.istribut.iOn System Load Tracking, Revisioni. Althoughgthe load changes were- mostlya decrease of a few horsepower, this was an example of a weakness in configuration control.
In response tq the ISA team's concerns in this area, the licensee prepared a preliminary rdvision to calculation MYC-107 which showed that the loading on EDG-1B (worst-case) increased.from 2-,629 kW to 2,84?.kW (a 213 kW increase),
still below the Z,.000 hour/year rating limit of 2,850-kW.
2.3.6 Electrical Calculations
.Despite the deficienc.iies.noted :wi~th the EDG load-ing calculation and several other reI.atively minor we aknesses, electrical calculations .were very detailed, comjprehe-nsive, and .r~igorous Calculations prpae sic.199-3 we're better
.eari documented ahd more sohisticated h t t
-However,,--the--fol-l-owing-- addii-t.ýi~onal -cat-cul~at'ib-fAIvalp-ýobhi,ý~- Wir- noted:
(1) Incorrect motor data were used fo.r setting the HPSI pump motor protective relays in alculra.ton MYC' -1559' -in that the ii ncorrect locked
,rotor current was used.. fThe error was ih the conserviative direction and 25
motor protection was still maintained; therefore, this issue had no adverse impact on plant safety.
(2) Incorrect cable data were used in the coordination curve for the EFW pump P-25C motor in calculation MYC-1559. This error was in the conservative direction and motor protection was still maintained; therefore, this issue had no adverse impact on plant safety.
(3) Cable data and cable ddamage curves were omitted from calculation MYC-1063, "480 Volt Circuit Breaker Coordination," Revision 5, where curves did not identify the feeder cable size and did not incorporate the cable damage plot on the coordination curve to demonstrate that the cable was protected consistent with industry practice. The lack of cable data and cable damage plotshad no adverse impact on plant safety.
because cable sizing was conservative.
2.3.7 Inadequacies in Ventilation Systems Although. the licensee had previously identified inadequacies in the ventilation systems used to support safety-related electrical equipent, the ISA team found additional significant inadequacies in the design of these ventilation systems.
2.3.7. Protected:-Switchgear *Roos Ventilation De fic-ienci.es weere noted in the des-ign of the protected swi tchgear room vefntiliation system. The licensee was aware of, and -actively correctihg, some
-o~f 4he~siedei~ci~encies-. '-- As-a -result-7of-the -Atemsiquiries addi-ti-diial vu~lnerabi ties-were identfied ". Thenet effect of these recently identified probbems-could signifi cant., -possibly-contribut-ig from 1 per.ent to up to 10 percent additional: probability of core damage.
The battery and protected switchgear rooms were located in the turbine buil.ding and serviced by-a safety-related ventilation system. Therequipment for this ventilation system was located in 'the turbiIne building and consisted of motor-operated air supply and exhaust dampers,, supply fan FN,31 (powered from train A 480 Volt emergency motor control center ( 7CC)TA),
a motor-o erated recirculation damper, and exhaust fan.FN-32 (poweredfrom t;rai* B 48. Volt emergencyMCC-A)'. -This ventilation system*supor ted the operation.of the plant's safety-related batteries, inverters, and MCCs. In FSAR Section8 .3.3,the licensee .described the lack of redundancy for this ventilation system(single s*upply.and single-exh aust fans) aId *specified.
operator actions requi:red to6 M-itigate the consequences of aý si:ngle 'fan failure.
Asprt of the Indivi 'dual.Plant:E~xamination -External Events (IPEEE) efort,
-tejlcensee
.receift:ly-.eva~lýuatO~d.-.the--t-u~r-b-iebidn pcrm-f ta iib breaks. it was recogni-zed thatfollowinga high-ehergy break (HELB),
"operato~r act io .may be required: to manually ventilatetheline. protected switchgear room. On the basis of calcul.ations, assuming that the venoti!lAtion fans were not runnilng, the licensee concluded that ingre intthepotected 26
11110; 13111111 111111:1!1:1ýllilli:::ý switchgear room was not significant, and the high-temperature alarm in the room would signal operators to open doors and set up portable fans.
Despite the licensee's work to mitigate the effects of a potential HELB in the turbine building, the licensee did not fully consider the impact of a LOCA or HELB event on the protected switchgear room ventilation system. The ISA team found that the licensee had no calculations or analyses which evaluated the consequences of a supply or exhaust fan failure coincident with a LOCA or HELB under worst-case electrical loading. Although the licensee had prepared calculation MYC-1570, "Protected Switchgear Room, Protected Cable Tray Room &
Battery Rooms 1-4 Temperatures," Revision 0, to address the transient temperature in the safety-related electrical areas for various scenarios, the ISA team found that the calculation did not address various fan failure modes.
Further, the ISA team found that no emergency power source was available to power portable fans during a design-basis event which may include loss of normal ac power. Therefore, the compensatory operator actions to open doors and set up portable fans described in the FSAR and the licensee's analyses were not technically supported.
The original licensing-basis assumption for HELB inside the turbine building was for a break of a very large steam line that would result in enough damage to the turbine building that the effects of the line break would be rapidly mitigated by the failure of the building walls. However, the licensee recently concluded that the limiting HELB event was a smaller size break that would leave the turbine building intact, causing the harmful effects of the steam to be felt for a longer period of time. As a result of this finding by the licensee (before the ISA), compensatory measures were implemented to keep enough openings in the turbine building to mitigate the effects of a more limiting break.
In response to the ISA team's concerns, the licensee performed an additional analysis for calculation MYC-1570, taking into account all failure scenarios for the protected switchgear room ventilation system, including the scenario in which one fan (supply or exhaust) was assumed to fail. Air flow measurements for tne ventilation system and switchgear room under various fan configurations were also taken. Based on the results of this analysis, the following actions were taken by the licensee:
(1) The supply and exhaust dampers were blocked open and the recirculation damper was blocked closed under Work Order 96-02589-00, "Reposition Dampers," Revision 1.
(2) Design Basis Screen (DB$)96-006 ("Turbine Building MSLB Environment,"
Revision 3) was issued which concluded that the worst-case failure mode would be failure of a supply fan while the exhaust fan continued to run, resulting in the ingress of steam into the protected switchgear room which would be unacceptable. The heat load from switchgear and equipment was reduced by approximately 30 percent to eliminate unnecessary conservatism. The results Cf revised calculation MYC-1570 showed that the HELB scenario bounded the LOCA scenario and resulted in a heat buildup in the switchgear room which would require an operator to 27
MIN Nip,;
111119-01 mi. 11.10FIFF block open doors and set up portable fans within 15 to 30 minutes following the event to limit room temperatures to 135 *F.
(3) An emergency stop switch was installed in the control room under Work Order 96-02824-00 to allow an operator to trip the exhaust fan to limit ingress of steam into the switchgear room during a HELB event in the turbine building.
(4) A temporary change was made to Procedure AOP-2-7, "Excess Steam Demand,"
Revision 16, to provide guidance to the operator for establishing protected switchgear room cooling following a turbine building HELB event.
(5) A 350-foot power cord was provided to allow operators to plug into an EDG-backed power source (120-V ac vital power) for portable ventilation fans. A long-term, permanent modification was intended to install receptacles in the protected switchgear room which would be powered from EDG-backed emergency buses MCC-7A and MCC-BA.
(6) The current HELB evaluation covered summer conditions only; the licensee was formulating plans to resolve this issue for winter conditions.
2.3.7.2 Spray Building Ventilation Deficiencies Deficiencies were noted in the design of the spray building ventilation system. The licensee was aware of, and actively correcting, one of these deficiencies. The ISA team identified a separate deficiency that had the potential to effect the performance of the CS and LPSI systems.
The spray building houses the CS pumps and LPSI pumps. The ventilation system for this building consisted of a supply unit (HV-7), two safety-related exhaust fans (FN-44A and FN-44B), and associated dampers and ducts. HV-7 comprised a heating coil, fan, and filter.
The licensee had experienced occasions in which ventilation flow through HV-7 had been restricted due to ice buildup on the external surface of the unit in the winter months and from leakage from the heating coil causing ice to build up on the filter portion of this unit. Such situations were significant because there was a potential to impact the CS and LPSI pumps, which required adequate ventilation (removal of motor heat) in order to continue to run. The licensee recognized this problem and was in the process of implementing a design change to reconfigure the HV-7 supply unit to solve the existing design problems. The ISA team reviewed the licensee's plans to improve this design and found them acceptable.
As part of the review of this issue, the ISA team looked at the integrated operation of the spray building ventilation system and found that there were pneumatically positioned dampers (VP-A-56 and VP-A-57) on the suction side of the safety-related exhaust fans. Since the damper's air supply was non-safety-related, and considering the design of the dampers, there would be a reasonable potential for the dampers to close under accident conditions, 28
__ _ -l.-ma=
thereby rendering this safety-related ventilation system inoperable. On the basis of this concern, the licensee prepared DBS96-051 and mechanically blocked open dampers VP-A-56 and VP-A-57.
After the ISA team identified this issue, the licensee informed the ISA team that the desirability of blocking oper, these dampers had been raised in 1991 by a staff person from YAEC in a memorandum dated February 20, 1991, with the subject, "Minimum Ventilation Requirements for the Containment Spray Pump Area." This memorandum contained a specific recommendation to block open dampers VP-A-56 and VP-A-57 because, "If the controller fails, it could cause the inlet vanes for both fans to close, causing a reduction in the output of the system." The ISA team found no evidence that this issue had been entered into a corrective action system or was being tracked by the licensee. This was an example of the licensee's failure to take appropriate action to address a plant problem.
Although the plans and progress to resolve the problems with HV-7 were considered positive, the ISA team considered the licensee's performance weak in regard to the lack of followup of the identification of the damper concerns from 1991 and also weak in that the recent focus on the problems with this ventilation system did not result in identifying a vulnerability with dampers VP-A-56 and VP-A-57.
2.3.8 Procedure for Cross-Connecting DC Buses Plant Procedure 1-22-2 " AC and DC vital Bus Operation," allowed cross-connecting redundant 125-Volt dc vital buses for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> during plant operation, contrary to FSAR Appendix A, Criterion 39, "Emergency Power for Engineered Safety Features," which stated, "Alternate power systems shall be provided and designed with adequate independency, redundancy and capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, the onsite and the offsite power system shall each, ii.dependently provide this capacity assuming a failure of a single active component in each power system."
The ISA team found no instance when these buses had been cross-connected and, in response to the ISA team's concerns, the licensee stated that no occurrences of cross-connecting 125-Volt dc vital buses were documented after 1982, but cross-connection could have occurred before this period.
The licensee stated that this procedure was intended to be used only in limited conditions with due consideration given to overall plant risk.
however, as a result of discussions with the ISA team, Procedure 1-22-2 would be revised to limit cross-tieing of dc buses to Condition 5 or lower (i.e.,
plant not at power) for maintenance activities.
2.3.9 Environmental Qualification (EQ) Program The ISA team found that the licensee was not ieeting 10 CFR 50.49 requirements in that there were certain electrical components that were not qualified for their expected environment following a design basis event. There were concerns in three separate areas: submergence inside containment, 29
EQ/Regulatory Guide (RG) 1.97 instrument qualification, and backlog of EQ items. The ISA team also noted that there was no assigned staff engineer with primary responsibility in this area.
2.3.9.1 EQ Submergence As a result of a concern by the ISA team about EQ component elevations being below submergence level, the licensee conducted a walkdown on July 24, 1996, of reactor containment that revealed 30 components outside of Maine Yankee's design basis. These components were found to be installed below the maximum submergence level of 1.7 feet inside containment and were not environmentally qualified for the installed location. The EQ Program worksheets and EQ database did not reflect the actual component elevations.
The EQ components affected were distributed into three groups: containment isolation valve position indication; all channels of steam generator level (wide range and narrow range) indication; and primary inventory trend system level indication. Submergence levels for the EQ components ranged from 1/2 inch to 31 1/4 inches below the maximum submergence level of 1.7 feet.
The EQ submergence problem was reported to the NRC in licensee event report (LER)96-026 dated August 22, 1996.
The licensee's EQ submittal dated October 31, 1980, and the NRC's safety evaluation report (SER) dated June 1, 1981, identified approximately seven plant components that were below the submergence level that needed to be removed or replaced to meet the EQ rule. As a result of the ISA team's inquiry, the licensee identified 30 components below the submergence level.
Several of these components, such as HCV-257, HCV-271, and TV-3501, were the same components that were identified as below the submergence level in the licensee's 1980 submittal and the NRC's SER.
2.3.9.2 EQ/RG 1.97 Instrument Qualification The assumptions used to established EQ requirements for emergency feedwater (EFW) flow instrumentation were found by the ISA team to be inconsistent with Emergency Operating Procedure (EOP) E-1, "Loss of Primary or Secondary Coolant," operational requirements in that, under design-basis accident conditions, the use of the EFW flow instruments may not have been available.
The EQ worksheets for EFW flow transmitters FIT-1201A, FIT-1201B and FIT-1201C stated that EQ for these instruments during LOCA conditions was not required per YAEC memorandum, MYP 93-0293, Revision 2; however, EOP E-1, Step 3.a, required the operator to ensure minimum FW flow for decay heat removal. In MYP 93-0293, the licensee stated that steam generator level was an acceptable means of verification of EFW flow when referenced in the EOPs. However, without qualified EFW flow transmitters, EOP E-1 requirements may not be able to be accomplished in those situations (large break LOCA) where minimum EFW flow is required to ensure heat sink availability. During these situations, EFW flow instrumentation would be required until steam generator level exceeded the specified level limits.
30
Since the EFW flow transmitters would be exposed to a harsh radiation environment during a LOCA (MYP 93-0293), the EFW flow instrumentation may need to be environmentally qualified. The licensee stated that evaluation of this issue was under way as part of a revision to DMS 96-41. This revision would add an action item to provide a detailed review of the radiation dose at the instrument location. In addition, the licensee's RG 1.97 submittal and Regulatory Guide Source Document, "Design and Qualification Criteria for Post Accident Monitoring Instrumentation," identified these transmitters as being appropriately EQ qualified with no deviations from NRC guidance. The licensee did not adequately categorize and identify the exceptions taken on the RG 1.97 data sheets.
2.3.9.3 Backlog Of EQ Items There were other potentially significant EQ issues that remained open. The licensee had recently identified an expanded HELB concern in the turbine building that had the potential to impact safety related components in the turbine building.
2.4 FSAR Inconsistencies Prior to the ISA team arrival on site, the licensee initiated a FSAR and Technical Specification review to identify discrepancies with the licensing basis. The licensee placed priority on reviewing those systems being reviewed by the ISA team. Over 100 issues were identified. The ISA team identified additional discrepancies which are discussed throughout the report. Many of these issues will require changes to the FSAR and 10 CFR 50.59 reviews since equipment and procedures at MYAPS have changed from that described in the
- FSAR, 2.4.1 Spent Fuel Pool Heat Exchanger Rating The nameplate rating on the spent fuel pool (SFP) heat exchanger was not consistent with the design values in the FSAR.
Section 9.8.2 of the FSAR stated that the tube-side design of the heat exchanger (HX) was 225 OF and the nameplate stated that the tube-side rating of this HX was 200 *F. This discrepanry was noted in 1996 by an NRC review before the formation of the ISA team. The ISA team was concerned that the 200 OF HX tube rating could possibly prohibit the resto-7tion of SFP cooling following a prolonged loss of SFP cooling and bulk boil ig in the SFP. The licensee claimed a reasonable expectation that this HX could be used to restore normal cooling following bulk boiling and was tracking an action item to analyze by January 1, 1997, the capability of this HX to go to 225 OF. The ISA team considered the licensee's schedule reasonable because (1) the FSAR does not acknowledge restoration of normal cooling following bulk boiling, (2) the HX can be bypassed if necessary, and (3) there was an expectation for margin in the capability of this HX.
31
OPINION 2.4.2 Atmospheric Steam Dump Rated For 2.5 Percent Power The FSAR assumptions made regarding the response to a steam generator tube rupture (SGTR) were not realistic, In addition, the licensee assumed a capability of the atmospheric steam dump (ASD) of five percent power as part of its validation for EOPs. Subsequent licensee analysis of the steam generator tube rupture (SGTR) and inadequate core cooling (ICC) events revealed that the 2.5 percent value was acceptable for SGTR but not for ICC.
The ICC event was beyond the design basis of the plan' it was considered as part of the EOPs. (See Section 3.1.3.1)
FSAR, Section 14.12, stated, "The quantity of reactor coolant transported through the leak to the steam system is the same with or without offsite power. The primary to secondary leakage is assumed to be terminated within 30 minutes following the rupture." The ISA team considered that the additional complication of a loss of offsite power (LOOP) during an SGTR event would make it unlikely that the operators would be able to isolate the leak as quickly as would be the case with offsite power available. Without offsite power, the operators would lose their ability to vent steam to the main condenser, they would be limited in venting steam for cooldown through a single 2.5 percent capacity ASD valve. They would have to manually shut a valve locally in the vicinity of the steam generator relief valves before opening the ASD valve.
The time to isolate the affected steam generator would be longer tUdn stated in the FSAR.
In a letter dated July 1, 1996, to the NRC, the licensee committed to make physical changes to the atmospheric steam dump system to improve relieving capacity and reduce the isolation time of the affected SC.
32
3.0 ASSESSMENT OF OPERATIONAL SAFETY The ISA team assessed Maine Yankee's performance in the areas of operations, maintenance and testing, and engineering by evaluating the piograms in each of these areas and the licensee's implementation of these programs.
3.1 Operations Assessment The ISA team assessed the ability of Maine Yankee to safely operate the plant in accordance with its licensing and design bases. The areas assessed included the licensee's programs for identifying and resolving problems, the quality of the licensee's operations, and the programs established to operate the plant. In addition, the radiation protection and the fire protection programs were reviewed. The team interviewed operators and managers, performed three days of continuous control room observations, conducted detailed walkdowns of safety systems, reviewed EOPs, observed simulator requalification training, and observed the implementation of programs used to operate the plant.
Overall, performance in the area of operations was very good. Strengths were noted in the areas of operator performance during routine and transient operating conditions; shift turnovers and pre-evolution briefs; use of risk information to ensure safe operations; and the involvement of management in day-to-day operations. Areas for improvement include reducing the number of operator workarounds and compensatory actions, log-keeping, and post trip reviews.
3.1.1 Problem Identification/Problem Resolution The team assessed the programs used by Operations to identify and resolve problems in the plant. The team found that Operations was effective in identifying problems, but noted weaknesses with problem resolution.
3.1.,1.1 Operator Workarounds and Compensatory Actions Maine Yankee had several problems involving plant equipment, which created an additional burden on the operators during the plant shutdown and startup observed by the team. In addition, Maine Yankee had established several compensatory actions to address weaknesses in plant design. Some of these compensatory actions would require operators to take manual actions during a plant transient. Several workarounds and compensatory actions were longstanding issues or recurring problems which the licensee had not resolved.
During the performance of a plant shutdown on July 19 and 20, 1996, the team observed that the operators experienced several equipment problems which complicated the shutdown. These problems involved the trip of a motor-driven, main feedwater (MDFW) pump following an attempted start, the slow response of the main feedwater pump recirculation valve when the pump was started, leakage past a main feedwater regulating valve bypass valve whict required additional operator attention and actions, and the inability to operate the control element assemblies (CEAs) in the manual sequential mode due to a plant computer which was easily overloaded. The manual sequential mode problems
I RP III ffill 111110 0ýý 1WIlllill'i'mil contributed to the operator's decision to manually trip the reactor from low power during the shutdown.
Maine Yankee had also implemented or proceduralized actions to compensate for weaknesses in the design of the plant. Compensatory actions were taken as a result of design vulnerabilities associated with ventilation systems for the safety-related battery rooms, switchgear rooms, emergency diesel generator (EDG) rooms, and the containment spray building; turbine building flooding concerns; the inability to remotely isolate a ruptured steam generator; a single, undersized, steam generator atmospheric steam dump (ASO) valve; and a degraded offsite power supply.
3.1.1,2 Contrnl Room Staffing In March 1996, foilowing its review of NRC Information Notice (IN) 95-33, "Switchgear Fire and Partial Loss of Offsite Power at Waterford Generating Station Unit 3," and IN 95-48, "Results of Shift Staffing Study," Maine Yankee evaluated the ability of the operating crews, at their established manning levels, to respond to a plant fire similar to that experienced at Waterfor4 Unit 3 in 1995. The team found that Maine Yankee's evwjuation was thorough and that the licensee had identified weaknesses in (1) timely implementation of the emergency plan, (2) oversight by the Plant Shift Superintendent (PSS),
(3) workload of the remaining Control Room Operators (CROs), and (4) normal Shift Technical Advisor (STA) oversight. Maine Yankee found that if a medical emergency occurred during a plant fire, the PSS, as the assigned medical emergency responder, and the Shift Operating Supervisor (SOS), as the assigned fire brigade leader, could both be sunmoned from the control room to perform these duties.
The team was concerned that the licensee had established conflicting procedural requirements that would be impossible to comply with in the event of fire coincident with a medical emergency. During this postulated event, the minimum staffing requirements required in *he Technical Specifications would not be satisfied if the senior reactor operators responded as described in the licensee's administrative procedures. The team found that Maine Yankee has previously developed a comprehensive action plan to address the shift staffing issues which included: (1) us'ng security personnel rather than the PSS as medical first responder, (2) using a second CRO as the fire brigade leader rather than the SOS, (3) providing an additional security guard for the fire brigade to replace an auxiliary operator, (4) enhancing the dose projection process, and (5) enhancing STA effectiveness. However, the team determined that Maine Yankee's schedule for implementing these corrective actions by the end of 1996 was not timely. The team also determined that the licensee missed an opportunity to identify and correct this vulnerability during its review of IN 91-77, 'Shift Staffing at Nuclear Power Plants,' which discussed Maine Y3nkee's response to a fire.
In response to the team's concerns, Maine Yankee reassigned the duties of the medical first responder to the security supervisor, thus removing these duties from the PSS. Additionally, tho licensee planned to add a third licensed reactor operator to the control room staff and assigned the duties of the fire brigade leader to the reactor operator.
34
3.1.2 Quality Of Operations 3.1.2 1 Control Room Observations The team observed the performance of operators during a 3 day period of sustained control room observations. During this time, operators performed a plant shutdown and cooldown to correct a design deficiency in the PCCW system.
Operators performed well during the plant shutdown and cooldown. The team observed good command and control and good use of procedures. In addition, operators quickly identified and responded well to several equipment problems experienced during each activity.
The quality of communications used by operators during plant activities was good; however, the use of repeat-backs was inconsistent. In addition, control room alarms were seldom announced to the entire crew. The team observed similar weaknesses during simulator training sessions. Control room logs lacked detail and did not meet the guidance provided in Maine Yankee's administrative procedures. For example, operators did not log the starting time and stopping time of an EDG, equipment problems experienced during the plant shutdown, and the initiation of a manual reactor trip to shut down the reactor when problems were experienced with the CEA drive system. Observed shift turnovers and pre-evolution briefs were informative and provided operators with complete information about shift activities.
Auxiliary operator performance was identified as a strength. Team members accompanied auxiliary operators on their plant tours and found that they were knowledgeable, performed thorough rounds, took accurate logs, identified housekeeping deficiencies, and communicated well with operators in the control room. The utilization and performance of STAs was also a strength at Maine Yankee. The STAs were very experienced, had a good knowledge of plant operations, and were assigned a wide range of responsibilities, including conducting independent reviews of operability determinations and technical specification interpretations, making reportability determinations, and assisting the PSS with emergency plan implementation. The STAs also had a good understanding of probabilistic risk assessment which they used in performing on-line risk assessments and shutdown safety assessments. STAs updated these assessments as plant conditions changed and evaluated the effect of emergent maintenance on the assessment. STAs maintained the system unavailability log book and investigated unusual occurrences reported on their shift.
3.1.2.? Safety Systems Walkdowns The team performed a detailed walkdown of the accessible portions of the high-pressure safety injection (HPSI) and the service water (SW) systems to verify they were properly aligned. The systems were found to be properly aligned for emergency operation in accordance with the licensee's system operating procedures and plant drawings. Valves in the systems were labeled properly.
Control room labeling of remotely operated valves was satisfactory with each remotely operated valve identified by number, noun name, and actuation signal (if applicable). Minor deficiencies, such as inoperable local valve position indicators and unidentified packing leaks, were identified by the ISA team and 35
the licensee entered these deficiencies into its work order system. Material condition deficiencies associated with the SW system are discussed in Section 3.2.1.5 of this report.
3.1-2.3 Management Oversight of Operations Management oversight of plant operations was good. Managers were involved in the day-to-day operation of the plant and in the resolution of emergent problems. In addition, managers were actively involved in the operator requalification training program. Managers observed and evaluated crew performance during simulator training sessions, participated in the critique of crew performance, and reinforced their expectations for operator performance, including communications. Operations management met with crews during the training week to disLuss operations issues. Management also conducted periodic assessments of the Operations Department as part of the Operations Performance Assessment Program. Control of overtime at Maine Yankee was also very good.
3.1.2.4 Risk Management The use of Online Safety Assessments (OLSAs) and Shutdown Safety Assessments (SSAs) were strengths. The OLSA was ustJ as a tool to assess the safety implications of scheduled maintenance, unexpected equipment failures, unscheduled maintenance, and for developing long-range maintenance schedules, The SSA provided a simplified indication of the level of plant safety when the plant was shut down. The STAs performed safety assessments each shift, or when major equipment was found inoperable or removed from service. These assessments were communicated throughout the organization and risk insights were apparent in the licensee's decision-making process.
The OLSA was based on key safety functions, PRA significance, external events, as well as operational and engineering judgment. Both the online and shutdown assessments used relatively simple, straight-forward methods to assess risk.
OLSA was computer based and provided a plant score which was converted to a risk condition, i.e., green, yellow, orange, or red (in order of increasing risk). The OLSA program allowed calculation and control of accumulated risk during power operation by use of simple methods. SSAs were qualitative rather than quantitative and resulted in an overall risk condition, i.e., green, yellow, or3nge or red.
Management controls required approvals for intentional entry into the higher risk conditions and provided directions (such as immediate exit or development of contingency actions) for unplanned entry into higher risk states. Controls were established for exceeding calculated allowable times in higher risk states.
3.1.2.5 Operability Determinations Maine Yankee's operability determinations were generally acceptable, although some weaknesses were noted. The team reviewed approximately 60 operability determinations performed in the past by Maine Yankee and found that the determinations were appropriate. However, while on site, the team noted that 36
V the licensee made an incorrect operability determination associated with the performance of engineered safeguards feature relay testing.
On August 15, 1996, the licensee initiated SIC 96-18 to address inadequate testing of safety injection actuation system relays associated with the HPSI and the containment spray swing pumps. The PSS and the STA performed an operability determination and appropriately declared these pumps inoperable.
On August 16, the licensee reported that the testing of HPSI pumps P-14A and 14B did not test all contacts in the pump start circuitry. On August 17, the Operations Manager issued a memorandum stating that these testing discrepancies did not render the ECCS pumps inoperable because the Technical Specifications (TSs) did not specifically require that all safety injection actuation system contacts associated with the pump start circuitry be tested.
The team found that this interpretation of the TS requirements was incorrect.
The licensee inappropriately interpreted the relay tests required by TS Table 4.1-2, "Minimum Frequencies for Checks, Calibrations and Testing of Engineered Safeguards Systems Instrumentation Controls," were limited to verifying that the relays actuated properly. The licensee did not believe that TSs required contact actuation verification to confirm proper operation of the pump.
Following a conference call between Maine Yankee, NRC Region I and NRR personnel, the Operations Manager wrote a memorandum to the PSSs and STAs, which stated that if a safety-.related logic circuit testing deficiency was identified, the associated components would be considered inoperable due to a failed surveillance and the appropriate TS would be entered.
3.1.2.6 Technical Specification Interpretations The team reviewed 64 TS interpretations and found that the licensee appropriately used the interpretations to clarify specificatioYns which lacked detail. However, 2 of the 64 interpretations reviewed inappropriately changed the intent of the applicable TS.
Technical Specification 5.5.8.9 required Maine Yankee's Nuclear Safety Audit and Review Committee (NSARC) to audit facility activities at frequencies defined by Sections a through k of this specification. The licensee had incorrectly applied the provisions of TS 4.0.A and incorporated a maximum allowable extension of +25 percent to the audit inLervals. Maine Yankee indicated that it planned to cancel the interpretation.
TS 3.14 required two reactor coolant leakage detection systems of different operating principles to be operating, with one of the two systems sensitive to radioactivity in the containment, when the reactor was above two percent power. In a iS interpretation approved in 1985, Maine Yankee determined that leak detection systems sensitive to radioactivity were the containment gaseous rodiation monitoring system, the containment air particulate detector radiation monitoring system, and daily containment grab samples. The team concluded that. including a daily containment grab sample in this interpretation was a change to the TSs because this did not represent a continuously operating system. The licensee disagreed with the team.
37
. .. . . . . .. 11 At the conclusion of the assessment, the NRC was reviewing the appropriateness of this TS interpretation.
3.,,2.7 Post-Trip Reviews The team reviewed five post-trip reviews (PTRs) from 1991 through 1996. The PTRs, in general, lacked rigor and completeness. The reviews did not have detailed event timelines, complete descriptions of the event, and operator responses could not be determined from the documentation. The PTRs did not contain a complete list of required and completed short-term corrective actions and planned long-term corrective actions. In addition, individual operator statements contained in the reviews generally did not contain sufficient detail to add value to the review. One PTR reviewed by the team indicated that data from the plant computer was unavailable because of
- p. iblems associated with the plant computer and its inputs.
3.1.3 Programs And Procedures 3.1.3.1 Emergency Operating Procedures Although the quality of the emergency operating procedures (EOPs) at Maine Yankee was good, some exceptions were noted. In general, procedures conformed to the writer's guide and gave clear guidance to the operators. However, Maine Yankee recently reported that (OPs may not be adequate to address an inadequate core cooling (ICC) event and a steam generator tube rupture (SGTR) under ,-ertain conditions.
In 1986 Maine Yankee identified the inability to recover from an ICC event due to the small relief capacity of the atmospheric steam dump valve. The ICC event is a low-probability event which requires a small-break loss-of-cQolant accident coincident with a loss of condenser vacuum and loss of both trains of HPSI. Although the licensee planned to correct the problem, these plans were deferred and ultimately canceled in 1992. The licensee did not provide an explanation as to why the plans to increase the relief capacity were canceled.
In February 1996, the FOP coordinator re-discovered Maine Yankee's inability to recover from an ICC event and brought the issue to plant management's attention, Maine Yankee informed NRC on March 4, 1996, that the infomatior contained in a previously submitted EOP generation package regardinq the capacity of the atmospheric steam dump valve was incorrect.
In the Plant Root Cause Evaluation Report completed in July 1996, the t!-ersee concluded that the ICC event was not a design-basis event and Maine Yankee was not required, nor did it commit, to have the capability to mitigate an ICC event, Nonetheless, the licensee did inform the team it intends to modify the plant to increase steam relief capacity. At the conclusion of the assessmnent, the NRC was reviewing Maine Yankee's commitments with respect to the ICC event.
In May 1996, Maine Yankee found that it may take more time to isolate a ruptured steam generator than was originall, assumed in the SGTR EOP analyses.
Specifically, in the event of a SGTR with a coincident loss of condenser 38
vacuum, the time to isolate the ruptured steam generator could exceed 20 minutes; this is 15 minutes longer than the analysis assumption of five minutes. This increase was identified when Maine Yankee found that, due to a harsh environment created by the lifting of the main steam safety valves, an operator wuuvd have to don protective clothing to enter the main steam valve house in order to close a manual valve to isolate the ruptured steam generator. The licensee determined that, as a result of the additional time to isolate the steam generator, the potential existed to overfill the steam generator, releasing radioactive liquid to the environment, and possibly exceeding the limits of 10 CFR Part 100.
In response to its finding, the licensee conducted training to reduce the amount of time it would take an operator to don protective clothing and isolate the steam generator. The licensee stated that operators could isolate the ruptured steam generator prior to overfill. To ensure that the limits of 10 CFR Part 100 would not be exceeded in the event that an overfill condition did occur, Maine Yankee administratively limited reactor coolant system activity to 10-percent of the maximum value allowed by TS, The team reviewed Maine Yankee's EOP transient analyses for two additional events, loss of secondary heat sink and post LOCA cooldown, and did not identify any discrepancies with the information or assumptions used for these transiev,,
The team conducted walkdowns of selected EOP operator actions performed outside of the control room. Walkdown of actions outside of the control room for establishing HPSI and EFW/AFW, identified by the IPE as important recovery actions, revealed that the prucedures were adequate to perform the tasks.
Necessary tools were available and valves were properly labeled. Sufficient emergency lighting was installed to allow proper identification of components, with the exception of the upper levels of the main steam valve area. However, the licensee indicated that in an emergency, the operators would be wearing "bunker gear" which has a helmet light that would allow component identification. Also, the licensee was evaluating the installation of emergency lighting in this area. Control room switches were properly labeled, and all valves that might require local operation were also properly
- labeled, 3.1.3.2 Configuration Controls Maine Yankee drawings were accurate with a low backlog of drawing revisions.
Control room drawings were of good quality and appropriately updated to reflect plant temporary modifications.
Equipment labeling was good. The team noted that labeling on major equipment (valves and pumps) was very good. Labeling on plant instrumentation and gauges was not as good as on valves and pumps, but no deficiencies were noted.
During tours of the containment, the team found handwritten markings on the wall that included informal system drawings, component identifications, and a scale used in determining reactor vessel water level when in reduced inventory. The licensee indicated that these were old markings, were not used, and would be removed, 39
During control room observations, the team witnessed locked valve controls and hanging of equipment tag-outs, including team verification of the adequacy of tagging boundaries. The team also reviewed controls associated with operator information postings. Equipment tag-outs were appropriate and locked valves were properly positioned and locked.
During walkdowns of the SW and HPSI systems, the team found the systems properly aligned and valves properly locked.
3.1.3.3 Restart Readiness Program The team reviewed the Restart . adiness Program initiated during the extended outage in 1995. The purpose of the program was to achieve an event-free startup, to operate the unit safely and reliably throughout the operating cycle, and to ensure that plant equipment, procedures and staff were well prepared for startup and continued power operation following the extended outage. By initiating the Restart Readiness Program, Maine Yankee management provided additional oversight of the restart effort and performed a systematic and thorough review of equipment readiness. Maine Yankee also reviewed internal and industry operating experience to identify potential pitfalls and good practices related to restarting from an extended outage. The team found that the Restart Readiness Program was generally successful; however, it did not prevent several fuel handling events which occurred toward the end of the outage. As detailed in NRC Inspection Report IR 95-24, NRC staff noted weaknesses in the areas of preparation, training, decision-making, and problem identification, as well as corrective actions associated with the incidents.
3.1.3.4 Operations Performance Assessment Program The Operations Performance Assessment Program was effectively implemented.
The program consisted of periodic self-assessments in the areas of conduct of operations, housekeeping, training, and administrative controls. Management reviewed the results of the assessments for repetitive problems and to evaluate the effectiveness of corrective actions. Negative findings receiv.ýd management attention and adjustments were made to the assessment frequency, as necessary.
3.1.4 Plant Support 3.1.4.1 Fire Protection Program The team found that the Fire Protection Program at Maine Yankee was receiving increased management attention and resources to address previous problems in this area. Maine Yankee mad experienced problems with penetration seals, control of combustibles, and fire protection equipment. As a result of these problems, Maine Yankee instituted a Fire Protection Improvement Plan (FPIP) in 1995. The team found that Maine Yankee had made progress in implementing the FPIP. Planned activities included documenting the design basis for the FP system, inspecting penetration seals, and upgrading the procedures for controlling combustibles and ignition sources. Maine Yankee added a fire Protection Engineer, planned to hire a new Fire Protection Coordinator, and created a Fire Protection Training Instructor position.
40
3.1.4.2 Training Program The team observed four simulator training sessions to evaluate the effectiveness of EOP training. Crews performed well. Recent initiatives to improve training and evaluations, including increased involvement of the crews in critiques, commitments by crews to improve in those areas identified as needing improvement, and objective evaluations of crew communications, were viewed as good enhancements to operator training. The team noted that there was an increased emphasis on improving crew communications. In addition, the team observed that Operations management attended simulator training sessions and participated in the evaluation and critique of crew performance.
Simulator training was good and management's participation was a strength.
The team observed a classroom presentation and found that it contained a good mix of lecture, questions, and crew participation.
3.1.4.3 Radiation Protection Program The team assessed the Radiation Protection Program in the areas of radiation exposure controls, the "as-low-as-is-reasonably achievable" (ALARA) personnel exposure program, contamination controls, and the effectiveness of earlier improvement programs.
The licpnsee's ALARA program wis generally effective in controlling personnel exposure. With the exception of 1995, which consisted of an extended outage to repair steam generators, yearly personnel exposure had declined for all years (outage and non-outage). Maine Yankee management was proactive in the implementation of the ALARA program and had established an aggressive personnel exposure goal for 1996. Daily exposure was discussed at the morni-g meetings and management recognized that the personnel exposure for the spent fuel pool rerack project was higher than previously expected. As a result, management initiated a review of the work to reassess the ALARA planning and determine if the proper controls were in place to minimize exposure. ALARA planning packages reviewed by the team were thorough, comprehensive, and included ALARA hold-points, the use of training mock-ups, the identification of low dose rate waiting areas, and shielding evaluations. ALARA briefings observed by the team were comprehensive.
Maine Yankee was not effective in identifying and controlling contamination in areas of the plant considered to be clean. The team reviewed the personnel contamination events identified by Maine Yankee in 1996 and found that approximately 50 percent (44 out of 90) of the contamination events occurred in areas that were believed to be clean or uncontaminated.
The radiation protection program had been effective in identifying areas where improvement was needed, but had been less effective at resolving these problems. Specifically, recurring problems had been noted in the areas of unplanned exposure, the control of personnel contaminations, use of procedures, and supervisory oversight.
41
3.2 Maintenance And Testing Assessment The team determined performance in the Maintenance area was good overall, however, testing was weak. The results of the operating performance reviews for the auxiliary feedwater (AFW), emergency feedwater (EFW), high pressure safety injection (HPSI), and emergency diesel generator (EDG) systems showed mixed equipment performance. With some exceptions, safety-related pumps and valves operated well, and containment penetration testing has resulted in few problems, reflecting good plant material condition. Communications were found tc be good among Operations, Maintenance, and Plant Engineering Department personnel. The Maintenance Department staff did an effective job at identifying material condition deficiencies however some deficient conditions were not identified, such as the poor condition of the circulating water pump building service water (SW) bay space, and AFW deficiencies. The quality of plant maintenance was good as evidenced by minimal maintenance rework issues, and the overall good equipment operating performance. Several instances of equipment malfunctions which occurred during multiple plant shutdown and startup attempts in 1996 indicated declining material condition following the 1995 outage.
Inadequacies in the scope of testing programs were identified, as were weaknesses in the rigor in which testing was performed and in the evaluation of testing results to demonstrate functionality of safety equipment. A lack of a questioning attitude, and stressed resources resulted in the use of poor surveillance procedures and ineffective evaluation of surveillance test data.
In contrast to these weaknesses, the extent and types of eddy current testing of steam generator (SG) tubes was evidence of an aggressive and questioning attitude to determine the extent of SG tube cracking. The results of that testing led to the decision to sleeve SG tubes in 1995.
Overall work order planning and tracking was good, however, some weaknesses were found in the work control process.
3.2.1 Equipment Performance Equipment performance was good overall with some areas being excellent and some being weak. Conditional probabilities which incorporate component availabilities and reliabilities were poor for the AFW system, good for the EDG and HPSI systems, and excellent for the EFW system. Equipment performance of pumps and valves tested in the inservice testing (IST) program was excellent, and containment penetration testing results indicated the capability of the containment to withstand postlated accidents. There were some indications that plant material problems were increasing within the last year as evidenced by operational problems occurring during 1996 that were caused by poor material condition. Plant walkdowns indicated some material condition problems including the poor material condition of the service water bay space in the circulating water pump building.
3.2.1.1 Equipment Performance of Auxiliary Feedwater, Emergency Feedwater, High Pressure Safety Injection, and Emergency Diesel Generators The team performed an indepth review of equipment operating statistics for AFW, EFW, HPSI, and EDG systems for the time period from January 1, 1992, 42
- Mý M 111111 11 1; through June 30, 1996, (the time period) to determine their individual equipment conditional probabilities. The calculated conditional probability value for each system represents the probability that the system would be able to complete its mission when demanded, and was calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in maintenance for operating conditions 5, 6, and 7), (2) the probability of start (cumulative successful starts/cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given that a successful start had occurred). The results of the conditional probability study for the four systems that were reviewed showed mixed equipment performance. Performance of the AFW system was determined to be poor, EFW system was excellent, HPSI system was good, and the EDG system was good. Additional information showing time-dependent probabilities appears in Appendix C.
The findings for each system are detailed below:
(1) Auxiliary feedwater system conditional probability Based on the results of testing, the AFW system (consisting of one steam driven pump) performed poorly for the time period analyzed and was worse than the performance values assumed in the licensee's Individual Plant Examination (IPE). The licensee's IPE assumed conditional probability of approximately 91-percent, however, the team found that the conditional probability of the AFW system responding to a demand varied over the time period (January 1, 1992 to June 30, 1996) from a high of approximately 82 percent to its latest conditional probability of approximately 76 percent. The licensee was not fully aware of the poor condition of AFW pump P-25B and had not updated assumptions made in their IPE.
The AFW pump P-25B had difficulties both with failing to start and failing to run during surveillance testing. It had a failure to run in October 1992, because of an overspeed trip, a failure to start in January 1993, due to a controller problem, a failure to run in October 1993, due to an overspeed trip, a failure to start in January 1995, due to a controller problem, and a failure to run in June 1996, due to water and oil leakage problems. Due to several overspeed trips and maintenance down time after June 30, 1996, the overall conditional probability would likely drop below 70-percent. The AFW system was a standby system that had not been used by the plant for actual demands, and was designed to be started manually by operators.
(2) Emergency feedwater pump conditional probabilities The EFW system (consisting of two electrically driven pumps) performed well during the time period analyzed and compared well with the performance values used in the licensee's IPE. The system responded to actual demands following reactor trips during the time period. The system also responded adequately to demands during plant startups and shutdowns.
The system did not respond to all test demands during the period in that EFW pump P-23C had one failure to start during a surveillance test in Decembr 1993, when a breaker tripped open. There were no testing failures for pu,,.,
43
P-25A pump during the time period. The EFW system automatically started and ran successfully on three separate occasions following reactor trips during the time period from January 1, 1992 to June 30, 1996. During each event, the pumps performed as designed.
(3) High pressure safety injection system conditional probabilities Overall, the HPSI system performed reasonably well during the time period analyzed and compared well with the performance values used in the licensee's IPE, with the exception of "failure to start on demand assumptions." The licensee's RE would indicate a conditional probability of approximately 99.5 percent, however, the team found that the conditional probability of the HPSI system was better for pump P-14A at 100-percent (does not include test failure in August 1996, caused by a cut wire in the start circuity), and lower for pumps P-14B and P-14S at approximately 98-percent but was improving. The Failure to start of HPSI pump P-14A occurred after the period of analyses.
Had this test failure been included in the analysis, the conditional probability would have been lower.
The HPSI pumps had few failures during the time period analyzed. There was a failure to start of HPSI pump P-14B in March 1994, due to a breaker problem, and one failure to start of pump P-14S in August 1992, due to an interlock key in bus 6 that would not engage properly. For the time period analyzed, there were no emergency actuations of the HPSI system.
In response to a weakness identified by the team regarding lack of logic testing, the licensee performed some additional testing. A special test of pump P-14A resulted in a failure to start. Troubleshooting activities to determine the cause of the failure indicated that a wire had been inadvertently removed in the safety injection actuation signal (SIAS) start circuit for pump P-14A. Consequently, whenever pump P-14A had been aligned as the alternate pump during normal operation, it would not have received an automatic start signal as designed. If needed, the pump would have to be started manually. The licensee recalculated their IPE with this automatic signal missing to pump P-14A and found that the core damage frequency was increased by approximately six percent.
(4) Emergency diesel generator conditional probabilities The performance of the EDGs (consisting of two diesels) during testing was good overall for the time period analyzed, and compared reasonably well with the values used in the licensee's IPE. The licensee's IPE would indicate a conditional probability of approximately 91 percent, while the team determined the conditional probabilities for EDG-IA and AB to be approximately 92 and 90 percent respectively. The 1B diesel had been slowly improving from a weak conditional orobability of approximately 88 percent from December 1993, to June 1996, when it reached 90 percent. The latest trend for the lB diesel was downward to due increased planned and unplanned maintenance.
EDG-1A had one failure to run in April 1996, due to a cooling water pump shaft seal leak and a fuel oil fitting leak. EDG-1B had one failure to start (cause unknown) and one failure to run (cooling water pump seal leakage) in December 44
1993. The EDGs were not required to be started as a result of an emergency non-test ak.tuation during the time period considered while at power operations.
3.2.1.2 Equipment Performance Demonstrated Through Pump and Valve Testing Results of pump and valve testing performed as part of the licensee's IST program were very good, and test results showed that critical pumps and valves operated well, indicating good plant material condition. Of the 21 pumps in the IST program, none were in the alert or action ranges which would require either accelerated testing or corrective actions. In addition, of the 381 valves in the IST program, only three were on an accelerated test frequency program due to stroke times in the alert range. Along with the IST results, vibration data were collected through the predictive maintenance program which was used to assess the performance of rotating equipment. The rotating equipment log was used effectively to document items requiring additional monitoring and correction.
3.2.1.3 Containment Performance Demonstrated Through 10 CFR 50 Appendix J Leak Rate Testing Results of testing performed in accordance with 10 CFR Part 50 (Appendix J) for containment penetrations revealed few problems. These test results indicated the acceptability of the containment as a barrier to fission product release and that containment leakage criteria were met. For example, seven integrated leak rate tests (ILRTs) were accomplished since 1972 (1972, 1975, 1979, 1982, 1985, 1988, and 1992), resulting in one test failure (1985).
Some repetitive problems had occurred while performing local leak rate testing (LLRT). Testing of containment purge valves over the last few years has resulted in some failures that were adequately addressed by the licensee in 1995. The main cause of the failed tests was determined by the licensee to be an improper adjustment of an actuator during maintenance activities. In addition, the licensee had established a close out plan to identify and track issues with purge valves in general. Additional repetitive testing failures involved the containment sump isolation valves caused by debris in the sump such as tie-wraps, weld rod and safety wire. The LLRTs for these valves had routinely exceeded the administrative limit of 2.0 pound mass (Ibm)/day and their inoperable limit of 10 Ibm/day. The last five tests (performed since December 1995) were above the administrative limit, but below the inoperable limit. Proposals had been suggested to provide additional trench screens and to clean the sump and containment trenches during the 1997 refueling outage.
3.2.1.4 Equipment Problems Trending Upwards Plant material condition at Maine Yankee had been good over the last few years but during 1996 there were indications that equipment problems have been increasing. During the three years prior to the 1995 steam generator repair outage, Maine Yankee experienced a generally good plant operating performance record and plant material condition.
45
Ems=
Since coming back on-line in January 1996, the overall performance of Maine Yankee had been mixed. Although the unit was placed in service on January 16, 1996, power was reduced from 18 percent to less than 10-percent, and the main generator was taken off the grid to repair a main generator cooling control valve. The reactor tripped on February 13, 1996, when a feedwater valve positioner failed, and on July 14, 1996, power was reduced to locate a small leak in a condenser waterbox.
A plant outage to perform modifications to the primary component cooling water (PCCW) system piping began on July 20, 1996. During the plant shutdown, several equipment problems occurred, including the trip of a motor-driven main feedwater pump upon manual start, the slow response of main feedwater regulating bypass valves, and the inability to insert the control element assemblies in manual sequential mode. During the outage, additional equipment problems were identified that needed to be addressed prior to startup, including operability problems with AFW pump P-25B, excessive leakage of a residual heat removal valve (RH-4), and identification of safeguards equipment actuation logic testing deficiencies and associated equipment problems. The attempts to restart required the licensee to change operating conditions many times to address equipment concerns. After completion of repairs, the plant was returned to service on September 2, 1996. The number of equipment probiems identified in 1996 indicated that problems were trending upwards following the 1995 steam generator repair outage.
3.2.1.5 Plant Walkdown Observations The team conducted walkdowns throughout the plant. There were noteworthy observations of PCCW piping corrosion, service water (SW) pump bay degraded components, and cleanliness problems within the containment building. The team observed extensive external corrosion on a large portion of the PCCW piping within containment during a walkdown. This problem was previously identified and was monitored by the licensee. The corrosion, while creating a visible appearance of an extremely poor material condition, did not prevent the piping from performing its safety function and had been monitored by the licensee. The licensee indicated that portions of the corroded PCCW piping located inside of containment would be replaced with stainless steel piping during the 1997 refueling outage.
Team walkdowns of the SW pump bay in the circulating water pump building also revealed extensive material condition problems, such as water on the floor, corroded fasteners, corroded supports, pump base plate corrosion, missing u-bolt hanger parts, and cracked grout pads. After the team identified these problems, the licensee performed an in-depth inspection of the SW pump area, and found additional problems, which included a disengaged support (caused by the lack of weld penetration) for the raw water line leading to SW pump P-29B.
The pump was declared inoperable until a preliminary analysis indicated that the pump could withstand applicable loads despite the degraded support. The licensee indicated that resources would be made available to greatly improve the material condition of the SW pump bay.
The licensee had not effectively inspected the ccitainment for cleanliness after the outage. Team observations inside the containment indicated that 46
housekeeping required greater attention to eliminate inappropriate foreign material or items left over from maintenance activities. During inspections inside of the containment, the team identified problems with housekeeping and cleanliness, such as items wrapped in unqualified plastic, and discarded tape.
During followup inspections, the licensee found uncontrolled tools in the containment. The licensee implemented an initiative to replace plastic coverings utilized inside the containment with high-temperature qualified material.
3.2.2 Problem Identification And Resolution The Maintenance Department staff was effective in finding and documenting material condition deficiencies within the plant. They also identified and initiated the majority of corrective and non-corrective work orders (WOs). The WO process was the primary prccess used to initially identify and correct deficiencies. However, the effectiveness of the problem identification and resolution process was inconsistent. In many instances, testing was not an effective tool in identifying problems. A lack of a questioning attitude during test performance and evaluation was not conducive to discovering equipment problems, but rather to accepting equipment performance.
Walkdowns of plant systems indicated that some deficient conditions were not being identified by either of the three main groups (Maintenance, Engineering, and Operations Departments). These included the poor conditions of the circulating water pump building SW bay space and AFW pump P-25B deficiencies.
Depending upon the type or severity of a deficient condition, the licensee used other corrective action processes to evaluate the cause. The main corrective action program used by the Maintenance Department to review rework was not fully effective and, in some cases, failed to identify substantive problems or trends. Procedure No. 67-300-1, "Maintenance Self-Assessment Program (MSAP)," established a system for maintenance rework identification and corrective action follow-through. The procedure provided a system for equipment trending to identify recurring problems and to determine appropriate corrective action, and provided a system to enhance availability of lessons learned during previous maintenance evolutions. For'example, rework and repetitive failures associated with the AFW and EFW pumps were not identified by the progrLm as issues. Examples that were found indicated that the program was not always effective and in some cases the organizations at Maine Yankee were not communicating and cooperating with each other to identify and prevent repeat problems. Maine Yankee had identified this deficiency and was in the process of integrating existing fragmented corrective action programs with the intent of being more effective in identifying, resolving, tracking deficiencies, and minimizing repetitive failures.
The resolution of the Magne-Blast breaker problems demonstrated an effective program that corrected manufacturer equipment component defects and workmanship. Beginning in September 1993, the licensee experienced many problems with 4.16 kV and 6.9 kV Magne-Blast breakers. Problems with the breakers at other plants had also been observed and had continued to be identified by the industry during 1996. As a result of the various breaker issues commencing with the 1993 occurrence, a significant testing and 47
-- 11...... *._.-- M.....
E inspection program was implemented by Maine Yankee to resolve these problems, including consultation with the manufacturer, General Electric. The process was characterized by good focus, proactive approach, organized and comprehensive tracking of issues, clear communication, and traceability of documentation.
3,2.3 Quality of Maintenance The quality of plant maintenance was good, as evidenced by good overall plant material condition, good equipment operating performance, and a competent Maintenance staff. However, several instances of equipment malfunctions which occurred during recent plant shutdown and startup attempts indicated a declining trend in material condition.
Equipment problems that delayed recent plant startups or complicated shutdowns included, repetitive AFW pump P-25B D!,"oblems, leak-by of valve RH-4, foreign material in steam generator blQcz;_,n valve BD-T-12, a motor-driven feed pump trip, a slow response of a main feedwater (FW) regulating by-pass valve, and the inability to operate the control element assemblies (CEAs) in manual sequential mode.
The team observed or reviewed several mai*Linance;. tivities. Pre-job briefings were noted as excellent In general, procedure use and adherence were appropriate, but there were some instances of poor maintenance work practices.
(1) Failure to implement vendor recommendations for EFW pump P-25A During 1995, the licensee overhauled EFW pump P-25A, as a result of vendor recommendations to replace certain carbon steel pump internals with stainless steel parts because of previous incidents of internal component cracking. At the same time, additional internal pump parts were replaced. After reassembly of the pump, the licensee noted a binding of the pump internals when the pump was hand rotated during troubleshooting activities. Because of the binding, the new internals were subsequently removed and the old internals were reinstalled. During the final stages of the reinstallation of the old internals, the licensee had not performed a magnetic particle inspection of the "used" pump diffusers prior to reassembly as recommended by the manufacturer. However, it was also noted that the pump had performed well since January 15, 1996.
(2) Work order instructions not followed, service water system declared inoperable Licensee communication weakness resulted in a degraded condition of the SW system during maintenance on a seismic piping support. This event, which was discovered and reported by the licensee, related to a single event involving a problem of WO adherence and potential communication inadequacies. A maintenance Section head discovered that Maintenance personnel had removed a seismically qualified pipe support on a seal water line for SW pump P-29C without tagging out the pump. The support was removed to the "cold shop" when only prefab work was allowed by the WO. This condition was reported to the 48
control room, and the operators declared the pump inoperable on August 13, 1996. The support was repaired, and the pump was subsequently declared operable on August 17, 1996.
(3) Poor foreign material exclusion work practices resulted in a failure of steam generator blowdown valve, BD-T-12.
On August 18, 1996, following repeated attempts to close valve B-T-12 (a containment isolation valve), the valve was declared inoperable because it would not completely close. When the valve body was disassembled, a piece of weld rod was found lodged in the seat, preventing the valve from closing. The licensee was unable to determine the source of foreign material.
(4) Lack of procedural detail for installation and control of fastener lockwire A lack of WO detail resulted in a failure to reinstall fastener lock wire on components following maintenance activities. The team discovered that lockwire was missing during a containment walkdown involving five in-core instrumentation seal housings and on motor-operated valve (MOV) actuator mounting bolts for reactor coolant (RC) valve RC-M-32. These conditions did not pose an immediate safety concern, however, the licensee generated WOs to install the missing lockwire. The licensee also took actions to review and revise procedures involving lockwire installations.
3.2.4 Testing Weaknesses The team found inadequacies in the scope of testing programs, and weaknesses in the rigor in which testing was performed, and in the evaluation of testing results to demonstrate functionality of safety equipment. Despite the many inconsistencies between information contained in the Final Safety Analysis Report (FSAR) and the as-built condition of the plant (See Section 2.4), the licensee did not recognize a need to review and reconcile test procedures with design requirements, and to correct these errors. A lack of a questioning attitude resulted in the use of poor surveillance procedures, and in the ineffective evaluation of surveillance test data to determine equipment operability. Of the test procedures that were reviewed, the team found several examples of tests that had been developed, performed, and evaluated many times without questioning the validity of the test results. Examples include:
(1) Poor emergency diesel generator testing prorc i, A large number of important electrical time-delý ela.- -,ere not verified for proper operation and were not in the licensee', *, ,n program. The team identified that the 10 and 20 second EDG load S'ui, .. relays had not been calibrated since installation, the tolerance band and acceptance criteria had not been established, and these relays were not in the Maine Yankee Calibration Program. The team also identified that the actuation time of the 10 and 20 second sequencing time delay relays and the tolerance acceptance criteria for the relays were not logged on the surveillance procedure, and the 20 second timer actuation was not verified in the procedure. The procedure 49
Memo=
was also incorrect in that the signoff for the 20 second timer actuation was listed in the procedure as 30 seconds. The procedure had been performed many times without questioning the 10 second error in the timing sequence.
Based on the team's questions in this area, the licensee identified several other relays that were not tested or included in their calibration program.
These relays included, the motor-driven fire pump start permissive relay and the permissive relays to remove the low pressure safety injection (LPSI) plaop trip 10 seconds after the recirculation actuation signal to allow manual restart of the pump. The licensee indicated that an appropriate calibration interval would be assigned to these relays.
(2) Control room ventilation test results not properly evaluated The licensee failed to question the adequacy of a surveillance test used to determine if a positive differential pressure (dp) existed between the control room (CR) and adjoining rooms or buildings, and the assumptions used in a Yankee Atomic Electric Company (YAEC) calculation issued to justify the operability of the CR ventilation system. On October 31, 1995, a negative dp was observed during a surveillance test. The procedure required a positive dp to be acceptable. On December 12, 1995, YAEC issued a memorandum to the licensee, which justified operability of the CR ventilation system in response to the tes results, However, the YAEC calculation failed to incorporate the negative ý_essure results in the calculation (based on engineering judgment and control room pressure history the analyst assumed that the pressure was positive). Subsequent to the YAEC memorandum, the licensee failed to question the assumptions in the YAEC response and declared the CR ventilation system operable. Based on the team's concern that no corrective actions had been taken to address the failed CR ventilation surveillance test, the licensee performed an extensive dp surveillance and determined that current CR dp was positive. Further review of the October 31, 1995, failed test and the YAEC calculation assumptions by the licensee indicated that the CR vertilation system was inoperable from the failed test in October 1995, until the successful retest in August 1996.
(3) Inappropriate inservice test procedures for check valve testing The methodology used in test procedures to verify closure of safety-related pump discharge check valves in the IST program was inappropriate. The team observed the performance of surveillance test 3.1.22, Revision 15, "Emergency Feedwater System Cold Shutdown Flow Test," and questioned whether the specified pressure instrument and test methodology was acceptable to measure backleakage through the check valve. The licensee concluded that the instrumentation was not appropriate for the test application and retested using a pressure instrument at an alternate location. The licensee later determined that this too was an unacceptable test method because the EFW suction piping was connected to an open system. For the EFW system, the licensee determined that measuring reverse flow through the check valve was the method that should be used. The licensee initiated a review to determine if other systems were similarly affected, identified procedural inadequacies, and declared that the HPSI, LPS1. PCCW, secondary component cooling water (SCCW), and EFW systems were inoperable. The licensee reviewed results of so
other tests of the affected systems, revised test procedures, and retested the valves to determine system operability. Subsequent test results were acceptable. The licensee reported the issue to the NRC in LER 96-028 on August 28, 1996.
(4) Emergency equipment actuation circuitry not adequately tested and HPSI pump P-14A discovered incapable of starting on SIAS when in standby mode The team reviewed procedure 3-1.15.2, Revision 17, "ECCS Operational Test Recirculation Actuation System," and identified that the recirculation actuation signal (RAS) circuitry for the CS pump P-61S was not tested and verified. The licensee concurred with this finding and concluded, due to the similarity of the circuits, that there were also portions of HPSI pump P-14S circuitry that were not being tested.
The licensee stated that even though the circuits were not fully tested, the systems were i.i compliance with the technical specifications (TS). The team disagreed with this interpretation on the basis of the TS definition of operable and the requirements in TS Table 4.1.2 that required complete testing of SIAS actuation relays. The licensee decided to perform additional tests prior to increasing power above two percent that would verify that the HPSI pumps (P-14A, P-14B and P-14S) would start from the standby mode through exclusive actuation of the S]t relays. During this testing on August 17, 1996, HPSI pump* 0'4A failed to start due to an open lead (cut wire) that interrupted t - rt signal from the logic relay to the pump controller. The cut wire was ,. .j to have been partially removed (about 15 feet of wire was missing) with the remainder of the wire marked as "spare" in the wiring bundle at the main control board. The plant was brouq'it to cold shutdown to make repairs, and Unusual Occurrence Reports were written to document the testing problems found on the HPSI pump P-14A and CS pump P-61S.
(5) Additional examples of insufficient logic testing identified and equipment deficiencies discovered In response to the tear,'s questions concerning the adequacy of logic testing and as part of its implementation plan in response to NRC Generic Letter (GL) 96-01, "Testing of Safety-Related Logic Circuits," the licensee initiated a surveillance testing closeout plan to identify and correct other potential testing discrepancies. Several additional examples of insufficient logic circuit testing were identified involving the SIAS, CS actuation, RAS, containment isolation, feedwater trip, EFW initiation, reactor protection, EDG actuation, and main steam isolation systems. For the circuit testing that was completed prior to startup, three additional equipment deficiencies were identified that required repair; (1) a stuck relay in the CS pump P-61S circuitry was replaced, (2) a suction pressure switch on HPSI pump P-14B was replaced, and (3) a breaker for CS pump P-61S cycled when the undervoltage device was reset. The breaker trip was being investigated by the licensee.
(6) Control board annunciator fault alarm circuits not periodically tested The team reviewed the licensee's emergency core cooling system surveillance procedures and identified that four annunciator fault alarms were not tested 51
or operationally checked and verified by procedure. These alarms provided indication of a defect, such as loss of continuity, in the circuit.
(7) Standby power meters required by Regulatory Guide 1.97 not calibrated and periodically tested The team identified that the licensee had excluded most instrumentation meters required by NRC Regulatory Guide (RG) 1.97, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," from its calibration program. The licensee stated that the volt meters and ammeters for the inverters, battery chargers, DC buses, EDGs and emergency buses were determined to be out of the scope of equipment that required calibration to support operability determinations.
The licensee had concluded that the only standby power instruments that required periodic testing and calibration were the power and reactive load meters for the emergency diesel generators. The team disagreed with this position. Further discussions with the licensee indicated that the additional meters would be added to its calibration program.
(8) Lack of calibration for EDG room exhaust fan thermostat The team identified that the EDG room thermostats were not periodically calibrated and were not in a calibration program. The thermostats were calibrated when installed in 1990, and they were functionally checked to ensure that the exhaust fan started; however, the thermostat actuation point was not recorded and no acceptance criteria was applied. Since the operation of the EDG room exhaust ventilation fan affects the ambient air temperature, the thermostat calibration could potentially increase the need to derate the EDGs kW output limit. For example, ambient air temperatures above 90 °F ,
combined with jacket water temperatures above 190 OF (LOCA conditions) would require a derating of the electrical output of the EDG. These factors were not accounted for in the EDG loading calculations.
(9) Recirculation actuation signal manual trip switch contacts not effectively tested The team identified that trains "A" and "B" RAS manual trip switch contacts were not functionally tested in procedure 3-1.15.2, Revision 17, "ECCS Operational Test Recirculation Actuation System." The test procedure inappropriately tested the RAS manual contacts with the RAS automatic signal present, thereby not assuriog that the RAS manual trip switch contacts were actuated during the RAS manual test.
(10) Importance of air-operated valve testing recently recognized Although the air operated valve (AOV) testing program was in general compliance with the licensing basis and applicable regulations, the testing did not effectively verify the functionality of safety-related AOVs in design applications for safety-related systems. A large percentage of remotely operated valves at Maine Yankee were AOVs rather than motor-operated valves (MOVs). The reliance on AOVs to perform safety functions should have 52
commanded earlier management support for a comprehensive AOV testing program that would ensure reliable operation. Although the regulatory requirements to verify design functions under realistic accident conditions were not as explicit as for MOVs, the licensee was mandated by their design criteria, technical specifications and the FSAR to adequately test the safety-related valves to verify that they would operate under accident flows and pressures.
In addition, inservice testing did not adequately verify functionality of AOVs under representative accident conditions.
There were examples of AOV testing failures at Maine Yankee that may have been preventable if a comprehensive testing program had been in place. Recent examples included the failure of the FW regulating bypass valves (FW-A-112, 212, 312) to completely isolate during a reactor shutdown, the leakage detected during IST testing in the EFW isolation valves EFW-A-101, 201, 301, 338, 339, 340), and the failure of a blowdown trip isolation valve (BD-T-32) to close due to insufficient actuator spring pressure.
Additionally, approximately 10-percent of the station AOVs were included in the IST program. Many of the valves not included in the IST program performed safety-related functions such as the temperature control valves for the PCCW and SCCW systems (PCCW-T-19, 20 and SCCW-T-23, 24). Despite a history of actuator problems, these valves were not in the IST testing program.
The Maintenance Department had recently recognized the need for a comprehensive AOV testing program and was in the process of obtaining funding to procure the required diagnostic and testing equipment, and program training.
(11) Reactor-Water storage tank level transmitters overheated During the ISA team's review of the temperature range used for RWST level setpoint calculations, a walkdown was performed by the licensee as a result of the ISA team's inquiries. The walkdown resulted in finding transmitter enclosures for train B that were heated above the transmitters' design temperature of 1300 F. This condition caused the transmitters to be in an unanalyzed condition, invalidated the setpoint calculation for these transmitters, and caused two transmitters to exceed their qualified life. The resultant setpoint change was slightly non-conservative and did not affect the operability of the ECCS pumps. The transmitters were subsequently replaced.
3.2.5 Maintenance Work Order Control Overall WO planning and tracking was good. The use of the On-Line Maintenance Risk Management Program to set maintenance work priorities at Maine Yankee was excellent. Extensive risk-based methodologies were used at many levels by the licensee. The basis for some of the risk information may not be as conservative as previously assumed, as was the case for AFW pump P-25B which had a conditional probability (overall probability for success) much less than that specified in the licensee's IPE because equipment failure data had not been updated. Both the licensee and the team had identified some inconsistencies and inefficiencies with the WO process, and there was a large 53
backlog of open WOs (some dating back to 1991) where the actual work had been completed, although closeout of the work package was not yet performed.
3.2.6.1 Use Of Probabilistic Risk Assessment Methodologies In support of the licensee, the YAEC organization had established and implemented extensive probabilistic risk asses.sment (PRA) methodologies to assist in making risk-informed decisions to perform maintenance and testing activities. Yankee Atomic personnel were very experienced in PRA techniques, and the licensee was accustomed to using PRA insights on a daily basis. The licensee established an On-Line Maintenance Risk Management Program to manage risk. This program effectively used insights from the PRA to help plant personnel, on a daily basis, make decisions concerning maintenance and testing of equipment. Risk.assessments used by the Operations and Maintenance staffs to plan and schedule work were relatively simple. These assessments may not be as conservative as assumed, as was the case for AFW pump P-25B who's performance was much worse than that specified the licensee's IPE. Individual WOs were prioritized using risk perspectives to ensure that the most risk significant work was accomplished first. To accomplish this task, the WO process established specific equipment priorities based upon PRA information.
3.2.5.2 Work Planning And Tracking Overall WO planning and tracking was good. Some weaknesses were found in the work control process, however, the licensee was assessing how to improve WO efficiency. In addition, the database used to capture individual WO activities was useful in determining who initiated the WO, its priority, age, outage or nonoutage condition, safety or nonsafety-related condition, WO status, and many other parameters. The capabilities of the WO tracking system were under-utilized as a tool to aid management in understanding the status of WOs.
The licensee encouraged anyone, upon discovery of a deficient condition, to initiate a WO without intervention from others, However, a review of the 1995 steam generator outage WO statistics indicated there was a Ligh percentage of WOs that were canceled, deferred or voided after the WOs were entered and prioritized. This practice produced administrative inefficiencies which were largely caused by duplicate WOs, lack of initial deficiency tagging of components, or a subsequent determination that a WO was not required after one had been initiated. A review of open WOs showed that there was a backlog of 185 WOs (many greater than one year with the oldest being 1991), where the work had been completed, including functional testing, but the work package was not yet closed nut.
The processes used to perform work within the Maintenance Department differed between the mechanical, electrical, and instrumentation and control groups which caused some minor work control inconsistencies in tracking and trending of work. These work control differences also affected the reporting of monthly WO statistics, in that preventive maintenance or surveillance testing activities may or may not have been included in WO statistics.
i* . ......
.. .. *.... . .. .......... m
- L . ill. . * : --- - - , * * - * * - - - -- . . . ..
Work involving temporary repairs using sealants or coatings such as Furmanite and Belzona were well controlled and tracked. The team identified that no temporary sealants were in use in safety-related applications at Maine Yankee.
3.3 Engineering Assessment The quality of engineering work was mixed but considered good overall.
Strengths were noted in the capability and experience of the engineering staff, day-to-day engineering support of maintenance and operations, in the quality of most calculations, and in the routine use and application of analytic codes. However, engineering was stressed by a shortage of resources, and there was a tendency to accept existing conditions. Specific weaknesses were noted with inconsistent identification and resolution of problems, inadequate testing, and work on some calculations and analytic codes.
3.3.1 Identification And Resolution Of Problems The team found that, although the overall contribution of engineering to the identification and resolution of problems was generally good, some significant weaknesses were evident.
There were many examples of appropriate resolution of problems. These included the addition of safety-related ventilation fans in the EFW pump room, the recent addition of relief valves in the PCCW piping, the sleeving of the steam generator tubes, and the modification in progress for improving the ventilation supply into the containment spray building. However, in some cases, these were longstanding design deficiencies, that could have been resolved much earlier. ,ne Plant Engineering Department gave very good support to operations and maintenance in solving day-to-problems.
Through its IPE and IPEEE programs the licensee had either resolved or was in the process of resolving other issues. Safety improvements had been made, such as resolution of the lack of safety-related ventilatioti for the EFW pump room (identified in late 1995 and corrected in early 1996), the addition of a spave inverter, consideration and compensatory measures to acconm'odate turbine building flooding, and consideration of a larger spectrum of high-energy line breaks in the turbine building, for which compensatory measures had also been taken.
However the team also found:
- deficient design conditions that had not been entered in a corrective action system or were dropped,
- corrective action for problems that was not appropriately expanded to look for similar issues, and
- other long-standing deficient conditions.
Examples of issues for which appropriate corrective actions were not taken were (1) a design deficiency noted in 1991 by a YAEC engineer who desrribed the potential to lose safety-related ventilation flow into the containment
spray building due to the closure of ventilation dampers utilizing a non-safety-related source of instrument air and (2) the limitation of the atmospheric steam dump valve to relieve only 2.5 percent power which was identified in the mid-1980s, dropped as an issue needing resolution, and resurfaced by the licensee in 1996.
Examples of deficiencies that could have been found if the corrective actions were appropriately expanded to look for similar issues included problems with the ventilation systems in the protected switchgear room, the containment spray building, the control room, and the emergency diesel generator room.
Other examples of long-standing deficiencies missed, or not effectively pursued, were identified in the environmental qualification (EQ) program and equipment testing.
The team noted the lack of a conserv testing philosophy that resulted in the identification of numerous safet, clated components that were not being periodically tested or calibrated. ie team also found specific testing weaknesses with recirculation actua!ion signal (RAS) manual actuation, the P-61S CS pump, control room fault annunciators, the EDG room ventilation thermostat, Agastat relays used for timing safety-related components, and various safety-related valves (CCW bypass, check valves). As a result of the team's findings in this area, an operability problem was identified with HPSI pump P-14A. As a followup to the team's concerns, licensee testing revealed that HPSI pump P-i4A would not have started automatically on a safety-injection signal with offsite power available, although the pump could have been started manually.
The service water operational performance inspection (SWOPI) performed by the licensee was effective at identifying problems; however the licensee stated that the evaluation and resolution of these problems were delayed by resource constraints resulting from the steam generator tube sleeving effort in 1995.
3.3.2 Engineering Programs The engineering staff was technically competent with particularly good historical knowledge of the plant. The relationship between Maine Yankee and Yankee Atomic (YAEC) appeared to be a significant positive factor. There was extensive technical expertise within the YAEC organization, and its degree of familiarity with the Maine Yankee facility surpassed what could be expected in a normal client/architectural engineering firm relationship, The team assessed Engineering programs relating to (1) closure of NUREG-0737 responses to TMI action items, (2) modifications and temporary modifications, including the performance of 10 CFR 50.59 reviews, (3) erosion/corrosion detection in piping systems, (4) and the SWGPI effort, This assessment was peri'ormed by reviewing procedures and selected program documents, as well as by discussions and interviews with licensee personnel. Maine Yankee audits and assessments were reviewed to determine the effectiveness of Maine Yankee self-identification and correction of problems related to these programs.
56
3.3.2.1 Engineering Modifications And Temporary Nodifications The team reviewed the program for plant design changes and modifications, including procedures and selected program documents, and held discussions and interviews with licensee personnel. Audits ;id assessments were reviewed to determine if self-idenLified problems had been corrected.
The procedures were good, meeting the requirements of ANSI N45.2.11 "Quality Assurance Requirements for the Design of Naclear Power Plants." Reviewed modification packages were also good. The 10 CFR 50.59 reviews and screening documents reviewed were generally correct. Temporary modifications were acceptable; however, some temporary modifications had been installed for a long time (approximately 10 years). The licensee was aware of this condition, and had recently made some improvements in this area to reduce the number of temporary modifications. Licensee weaknesses and problems identified in self-assessments and audits in the area of modifications were appropriately corrected or were in the process of being corrected.
3.3.2.2 Erosion/Corrosion (E/C) Program The licensee's Erosion/Corrosion Program was difficult to assess because the common industry practice of using a cormpiter based program to determine inspection points was not being used. Although weaknesses were noted, the E/C prcgram was considered adequate.
The licensee strengthened its program following the failure of a moisture separator reheater scavenging vent elbow in 1992. Immediate corrective action included a complete rewrite of tUe E/C implementing procedure to make it more effective, The changes comprised a program and process to facilitate consistent implementation, screening of all piping for susceptibility to E/C, a documented basis for any exclusion, qualitative analysis of all susceptible lines, a process for selecting components for inspection, and documentation of actions taken on all industry experience.
The licensee also stated that it was making plans to use the EPRI CHECWORKS software but did not commit to an implementation date.
In certain cases, the licensee had replaced adjacent piping when it replaced fittings as a result of E/C testing. Whenever possible, the licensee used replacement components fabricated of steel having 2.25 percent chrome content, which the licensee stated reduced E/C rates by at least a factor of four. The licensee stated that its control of water chemistry by (1) the use of morphaline, (2) raising the cold condensate Ph to >9.2, and (3) maintaining oxygen in the condensate at <5 ppb had significantly reduced the corrosion rate for the affected systems.
The E/C program covered approximately 3000 fittings, of which approximately 826 had been replaced as a result of excessive wear. Historically, the plant has had limited success at preventing leeks. The plant had six small leaks in high-energy piping included in the program, four of these were pinhole leaks, and two of which were in fittings that had been inspected and had subsequently
- leaked, 57
There had been several small leaks in secondary drain lines to the main condenser, and during the last outage, the licensee failed to replace components on WO 94-02568-0,0 related to high pressure drain trap 15, which had been identified as having E/C.
3.3.2.3 Service Water Operational Performance Inspection The SWOPI, which the licensee performed in 1994, was comprehensive and insightful. It identified over 155 findings related to the service water system, PCCW, and SCCW systems. At the time of this assessment, 18 SwOPI findings were not closed. These 18 findings involved the adequacy of cooling of the EDGs, testing and trending of heat exchanger efficiencies (fouling) requited for safety analyses, and the absence of "a formal set of minimum heat transfer requirements related to containment heat removal" to support containment safety analysis. Resource impacts of the SG sleeving outage impacted the scheduled completion of these potentially significant items.
The team reviewed the SWOPI report and the responses to its findings in detail. Many of the items discussed in this report in Section 2.2.2 were identified in the SWOPI self-assessment but were not yet fully resolved. For example, even though work had been started, an effective program was not in place to ensure that the heat exchanger fouling did not exceed the bounding values assumed in calculations.
3.3.3 Design-Basis Information The quality and availability of design basis information (DB8), including drawings, calculations, and other documents containing detailed design information, was good overall but varied in quality depending on the functional area.
Design basis documents were reviewed for safety related and important to safety systems, Calculations varied with the engineering discipline.
Electrical calculations were typically excellent and recently revised. Some mechanical calculations were easily misinterpreted because there were portions of various revisions to the same calculation considered applicable. The earlier calculation revisions were not annotated to identify that they were "superseded" or "void." In general, electrical DBI was excellent and mechanical DBI was good.
Design basis sumary documents (DBSDs) were produced as part of an ongoing program to consolidate available design information on selected systems. This program had been in effect for about 10 years. The design basis recovery (DBR) for each system was accomplished primarily by creating a DBSD for the system. The 10 functional areas for which DBSDs had been developed were HPSI, LPS1, CS, EFW/AFW, PCCW/SCCW/SW, instrument air, control room habitaoility, flooding, station blackout, and Appendix R (fire protection) There were no DBSDs as yet for nine areas identified in thif program, including the emergency diesel generators (EDGs), electrical distribution, ventilation (partial), reactor protection, and safety-actuation signals (SAS). The overall quality of the D8SDs was good and they provided a valuable roadmap to other applicable documents and calculations. However, the team found that 58
they could not be completely relied upon without verification in that there were some minor discrepancies, Maine Yankee implemented an Inputs and Assumptions Source Document (IASO) in 1986 in response to an NRC confirmatory action letter in 1982. The IASD contained key parameters (important to safety and operator controlled) that were assumed in safety analyses. There was no similar document to provide configuration control of the numerous other safety-related parameters required in design and licensing-bases calculations and p'unt procedures. The licensee had identified weaknesses in the IASD and was working to replace it with a more comprehensive document called the Safety Analysis Information Document (SAID), which had a projected completion date of 1997. Completion of this effort was delayed as a result of the SG sleeving project.
As-built drawings were identified for all safety-related piping covered by NRC Bulletin 79-14, "Seismic Analyses For As-Built Safety-Related Piping Systems,'
(which included most safety-related piping) and for other specific Maine Yankee projects such as main control board verification. Other drawings had been verified on an as-needed basis, and, as a result, other systems such as SW, lacked a complete set of as-built drawings. The team walked down portions of the HPSI, CS, and EFW/AFW systems, verifying the as-built drawings against the plant configuration. A few errors were noted on the drawings walked down by the team, but none of these errors were significant. The overall quality of drawings vs very good.
3.3.4 Quality Of Engineering The team reviewed numerous engineering calculations and found their quality to be mixed and good overall. Deficiencies included errors and inappropriate assumptions. A weakness was also noted in the overall control of calculations.
Most of the calculations reviewed were detailed, comprehensive, and rigorous.
particularly in the area of electrical design. However, there were examples of significant -alculational deficiencies including the EDG loading calculation (approximately 200 KW of load was not accounted for), the NPSH calculation for the containment spray pumps (incorrect suction piping head losses and other inappropriate assumptions), and the heat load calculation for the CCW systems (inappropriate assumptions). These and other examples are discussed in more detail in Section 2 of this report.
The quality of 10 CFR 50.59 analyses was considered good, however the team found several isolated deficiencies of these analyses, such as, for a change to the RWST high-level alarm, consideration was not given to the potential for the consequences of adding more water to containment following an accident thereby potentially impacting environmental qualification of instrumentation.
The licensee had recently identified other problems with regard to 10 CFR 50.59 analyses. Before the team arrived onsite, the licensee initiated a review of selected FSAR sections to insure that the licensing basis of the plant was correctly stated. At the time of the ISA, this effort was partially completed but resulted in over 100 Apparent Discrepancy Reports, of which approximately 50 will require FSAR changes and accompanying 10 CFR 50.59 reviews.
59
A weakness in the control of calculations was noted, For example there were two active revisions of calculation MYC-272, "NPSH study, Containment Spray Pump." Revision 2, of this calculation was the basis for the injection phase NPSH, and Revision 4 of this calculation determined the suction piping frictional losses for the recirculation phase. Revision 2 was not annotated to identify that a portion of this calculation was superseded by a later revision. Calculation MYC-1731, Revision 0, dated August 26, 1994, calculated the post-LOCA containment sump temperature at 263 OF. This calculation should have been superseded since the sump temperature of record was 255 OF developed from calculation MYC 1740, Revision 1, dated June 25, 1996.
The ISA team found the SW system design calculations, and the Engineering Directive that provided operational guidance based on these calculations, to be an example of excellent engineering ,work. This directive summarized a number of comIplex interrelated parameters in a clear format. However, the limits established in this directive were not consistent with the FSAR (see Section 2.2.?.6), but this inconsistency was not safety-significant.
60
'I:11111111IRMIiii!
4.0 SELF ASSESSMENT, CORRECTIVE ACTIONS, PLANNING, AND RESOURCES Weaknesses were identified in the areas of problem identification and resolution. While licensee self-assessments were generally good, they occasionally failed to identify weaknesses or incorrectly characterized the significance of the findings. Additionally, some corrective actions were not timely and others were ineffective, leading to repetitive problems. Licensee planning was generally effective, although some weaknesses were found in the overall implementation of improvement plans. Some economic pressures resulted in limitations on resources, which impaired the licensee's ability to complete improvement projects that affected plant safety. Equipment problems were not resolved and improvement programs were not effectively implemented because the licensee perceived them to be of low safety significance.
The team (1) assessed the licensee's programs, procedures, and actions in the areas of problem identification and resolution, planning, and resources and (2) evaluated timeliness and effectiveness of corrective actions. The team conducted more than 100 formal interviews, observed numerous meetings, reviewed relevant documents, and used the techni, l findings discussed in Sections 2 and 3 as a basis for its assessment.
4.1 Self Assessment The licensee's demonstrated ability to identify and assess problems affecting plant performance and safety has been adequate. Numerous examples of internal and external assessments revealed a pattern of identifying problems and characterizing them effectively for station management. However, while many problems discussed in this report had previously been identified by the licensee, some notable problems had not been adequately identified or characterized.
Management encouraied all levels of the plant organization to identify performance problems. There was no evidence of a general reluctance to raise perceived safety concerns to station management. Interviews consistently indicated tnat the workers often highlighted problems in the plant and did not fear reprisals from supervisors or management. Management oversight of plant activities was adequate in assuring problem identification with some notable exceptions such as the failure to identify design problems in the ventilation systems and testing deficiencies of safeguard. logic circuits. The active presence of key managers inside the plant, anu the use of the zone inspection program have strengthened the uversight of many programs and activities throughout the plant. However, the team noted that supervisors occasionally missed obvious problems within the plant such as deficient material conditions in the service water pump bay and foreign material that remained inside the containment after closeout.
The Performance Assessment Program was generally effective in providing line management assessment of performance in individual departments. Each department manager assigned specific areas to department supervisors and other qualified personnel for problem identification and assessment. The effectiveness of these programs varied between departments. The Operations and Maintenance Departments were effectively identifying problems; however, 61
the Engineering Department had implemented the program, but had not conducted a sufficient number of assessments to provide meaningful feedback.
The Quality Control (QC) Program was effective in identifying problems and maintaining the standards of quality for required activities at Maine Yankee.
Programmnatic controls over work processes that were important to quality assured the proper qualification of QC inspectors and welders, the delegation of line responsibility for work quality, and the appropriate use of QC hold points and controls during minantenance planning and work control.
The Quality Assurance (QA) Program had a generally successful record of assessing the overall quality of station activities and identifying specific areas of vulnerability before performance degraded or the vulnerabilities became the subjects of regulatory enforcement. Annual audit and surveillance are4s were selected using a weighted criterion of 11 factors that included safety, industry experience, regulatory impact, and power generation to assure that the most risk-sensitive areas are assessed. Most of the licensee's assessments were thoroughly performed and properly self-critical. For example, in 1994, the Quality Performance Department (QPD) identified and correctly characterized the problems with controlling the inputs to the safety analyses. However, the team identified a few areas as. being adverse to quality which the licensee had not recognized as significant. Examples of such areas ir uded the ;ailure to identify components in the containment that were below submergence leve', in the Environmental Qualification (EQ) Program and the lack of complete testing of emergency core cooling system ',ECCS) actuation logic.
Maine Yankee has effectively used outside organizations to characterize and objectively assess specific areas that had been identified by internal audits and assessments as requiring outside expertise. The licensee has commissioned at least 19 external assessments over the last three years that have often revealed aspects of the problem areas that eluded internal assessments.
Recent examples of the successful use of outside assessment in areas which were first highlighted by QPD included audits of the Radiological Protection Organization by Westinghouse (1990), Cove's Edge Inc. (1995), and Millennium Engineering (1996).
The Cultural Assessment Team (CAT) Report (1996) was another example of the effective and timely use of outside experts to evaluate and characterize problems. This team of organizational psychologists and human factors specialists conducted an objective assessment of plant organizational culture in response to worker and management concerns. The overall finding was that the cultural atmosphere at Maine Yankee was "conducive to the raising of concerns perceived as safety significant, but is not conductive to forthright and prompt reporting for issues and concerns which are perceived to have little or no safety significance." When interviewed by the ISA team, most employees and managers expressed agreement with the findings and the recommendations of the CAT report. The licensee was developing an action plan to address the concerns and recommendations of the CAT report. Proposed actions included development of a new vision statement, increasing the Human Resources Section's presence on site, implementation of the Supervisory Improvement Program, and review of the End of Life Committee's 62
recommendations. Additionally, meetings were held with workers to emphasize the need to identify all problems.
Maine Yankee has made effective use of oversight committees to monitor the assessment process and to ensure that objective and independent views are presented to the Board of Directors. The Plant Operations Review Committee (PORC) effectively monitored such routine operational decisions as 10 CFR 50.59 reviews and procedure changes, and assessed how the licensee was handling unusual occurrence reports (UORs). The Nuclear Safety Audit and Review Committee (NSARC) functioned as the licensee's independent oversight board for all station issues. This committee was comprised of senior managers from Maine Yankee as well as outside experts from other utilities and experts from Yankee Atomic Electric Company (YAEC). Committee members effectively raised concerns as appropriate. NSARC members were observed to be actively involved in many assessment activities, including QA audit exit meetings and event reviews. However, the Chairman of the NSARC was also the Manager of QA for YAEC. In the latter position, he provided audit resources for Maine Yankee. As the Chairman of the NSARC, he was in charge of committee oversight of his department's work. This resulted in the appearance of a lack of independence. The Nuclear Oversight Committee consisted of outside experts who reported directly to the Board of Directors regarding high-level issues that impacted the industry.
The licensee used numerous performance indicators and managers met monthly to examine them and discuss their meaning. Although this process was a comprehensive effort, there were several key performance indicators that were under development and that had only two months of data, thus limiting the usefulness of trending the data at the time of the assessment. Tracking and reporting of many perfjrmance indicators was discontinued during the 1995 outage. Consequently, some managers stated that they saw little management benefit from many performance indicators and they were continuing to adjust their content and presentation to aid in use and interpretation.
The team found that performance indicators for the Maine Yankee Task Tracking System (MYTTS) did not reflect the significance of open items or identify late items. During the assessment, the licensee corrected this weakness when informed by the team. Performance indicators for maintenance work orders included only approximately 25 percent of the total number of outstanding work orders that were listed in the Maintenance Information and Parts Procurement System (MIPPS). For example, the indicator used to reflect corrective maintenance backlog contained only approximately 15 percent of the relevant action codes. Consequently, the total workload in the backlog was not accurately characterized by the performance indicator although the overall trend in the work off rate was representative.
The licensee's problem identification and tracking process consisted of approximately 29 individual systems. The fragmentation of the identification process was recognized by the licensee in several corrective action audits conducted over the past few years. Additionally, NRC Region I staff noted this issue in 1995. The licensee initiated the Learning Proc2ss Improvement Program to provide a plantwide methodology to integrate the separate tracking systems.
63
WBOW - IRRIAZI 111 =11 pligRMi 1'1 A review of approximately 4 years of data indicated that the existing problem identification systems such as the UORs and the safety issue concerns (SIC),
were effectively highlighting station problems to managers. Management had recently emphasized the need to lower the threshold for problem identification in response to the Cultural Assessment Team Report and the December 1995 allegations. One indication of the effectiveness of this threshold change was the increase since the beginning of the year in the number of design bases screens (OBS). In 1994 the number of DBSs identified by the licensee was 12.
The licensee had identified more than 50 issues in 1996.
Although the threshold for raising problems had decreased since the beginning of the year, the team found some examples where cultural barriers to problem identification still existed: for example, the poor foreign material controls for containment and the poor condition of the service water building.
Additionally, the licensee had not recognized a number of significant equipment and program deficiencies. These deficiencies included the inappropriate safety system check valve testing, the numerous environmental qualification concerns, and the lack of complete safety system logic testing.
4.2 Corrective Actions The team assessed the licensee's Corrective Action Program by evaluating the following areas: problem evaluation, problem resolution, and commitment tracking. Additionally, the team reviewed the licensee's new Learning Process, a program for improving corrective actions. The root cause evaluation process was generally effective; however, tracking of corrective actions was fragmented. Overall, the Corrective Action Program was weak and resulted in instances of untimely and ineffective corrective actions.
4.2.1 Problem Evaluation The team reviewed the licensee's problem evaluation processes and determined that the Plant Root Cause Evaluation (PRCE) process and Human Performance Evaluation System (HPES), when used, were effective in identifying root causes and recommending corrective actions. The individuals performing the root cause evaluations were trained in various root cause determination methods.
These methods were effectively used in the PRCEs reviewed by the team.
Although the departmental root cause determinations were less detailed than the PRCEs, they appeared effective at addressing lower level problems.
The licensee's Quality Performance Department (QPD) performed trending on various root causes (PRCEs, HPESs, LERs, SICs, and Radiological Incident Reports), QPDs nonconformance reports (NCRs), and corrective action requests (CARs). This information was provided to maniagement annually in the Functional Area Assessment Report (FAAR). The department level (Operations and Maintenance) root causes were not trended. However, radiological controls issues such as personnel contamination events were trended separately. The lack of departmental root cause trending combined with the infrequent FAAR trend data did not give management the information it needed to assess adverse trends. Timely trending could have identified continuing problems in the areas of foreign material exclusion control, and auxiliary feedwater (AFW) 64
. . ....* . ... ... .i;
... ..... ...... . .. * .., To..* . . .. g, system reliability. The licensee's new Learning Process was designed to address this issue.
4.2.2 Problem Resolution The team determined that the licensee's corrective action resolution process was weak. The licensee's tracking system was fragmented with approximately 21 individual systems. The backlog of corrective actions was relatively large and was increasing. Ex4luding work orders, there were approximately 1000 issues identified in the major tracking systems (CARs, Items for Investigation, and MYTTS). The other 17 systems had approximately 2200 items.
The average age of the items was 8 to 9 months, and some items were as old as 10 years. The licensee did not determine the resource requirements to complete corrective actions, but developed scheduled completion dates for the items. The July 1996 MYTTS Report showed that 534 items were open. This included 184 commitment items of which 42 percent were late, and 157 operational experience report items of which 28 percent were late.
The licensee's 1995 corrective action audit also questioned the commitment of management to timely problem resolution. The team reviewed a number of corrective action items and determined that the licensee continued to be untimely in correcting some significant issues. One example was the untimely actions to address concerns with the undersized atmospheric steam dump valve which the licensee first identified in 1986. A second example was the Service Water System Operational Performance Inspection conducted by the licensee in 1994. The report contained nine recommendations. None of the recommendations had been closed out and three were overdue. Additionally, numerous follow-up items were still open. One item identified a turbine hall flooding issue
- .hich was scheduled to be addressed in June 1997. However, the April 1996 IPEEE findings showed that the plant was outside of its design basis for a turbine hall flood. This design issue could have been identified and resolved in 1994. A third example was the issue of the ventilation damper in the containment spray building. This issue was previously raised by Yankee Atomic in a 1991 memorandum, but had not bee acted on by Maine Yankee.
Some of the licensee's corrective actions have been ineffective and have caused repetitive problems. An example of such ineffective corrective actions was the repetitive problems with the AFW control system and the continuing problem with the main feedwater pump P-28 tripping on low lube oil pressure.
An example of inadequate corrective action was how the licensee addressed the negative control room pressure identified during a surveillance conducted in October 1995.
The team reviewed the licensee's commitment tracking performance and found that the current commitment tracking system was good because of recent changes. In the April 1996 "RELAP/5YA Self Assessment Report," the licensee identified fragmented commitment tracking systems as a contributing cause. In response, the licensee adopted guidance outlined in the Nuclear Energy Institute's "Guideline for Managing NRC Commitments," dated December 19, 1995.
In addition, the licensee reviewed earlier documentation to verify the inclusion of all commitments. At the close of the assessment, the licensee had reviewed all applicable documents for the preceding 5 years.
65
In response to self-identified concerns, the licensee developed an integrated Corrective Action Program, the Learning Process, which was scheduled for implementation in the fall of 1996. The development of the Learning Process was a reengineering effort which involved a team approach. The objectives were to integrate the processes of problem identification, problem prioritization, root cause evaluation, problem tracking and resolution, and to develop a more useful trending process. The new system wos designed to be a computer-based system. At the close of the assessment, the licensee was developing the implementing procedures and necessary training.
4.3 Planning And Resources Licensee planning was effective; however, weaknesses were identified in planniny integration and improvement plan implementation. Economic pressures, which -esulted in limitations on resources, interfered with the licensee's ability to complete projects and other efforts that would bring improvements to plant safety and testing activities. Equipment problems were not resolved and improvement programs were not effectively implemented because the licensee perceived them to be of low safety significance.
4.3.1 Plans The licer;cS, did ýot have an integrated overall planning document. While many elements of Qn integrated plan existed, none of these elements contained information whifh identified required resources to achieve specified goals and objectives. Additionally, specific performance measurements to determine the level of accomplishment were not included. The licensee had independently identihied the lack of an integrated overall plan and was in the process of incorporating the fragmented elements into a single document as part of the Business Plan initiative and Executive Management Initiatives improvement plans.
Licensee work planning was orgai zed and effective. On average, 80 to 90 percent of planned lork was accomplished on the day scheduled. An additional strength of the p_.. ning process was the use of risk measurements to aid in timing of equipment and system outages and to increase employee awareness.
Outage planning was also organized and effective. The licensee used state-of-the-art computer planning aids and incorporated risk measurements into the overall outage plan. The licensee effectively incorporated industry guidance for shutdown risk management into the work planning process.
The licensee had a number of improvement plans for various purposes.
Improvement plans included the Learning Process described earlier, the Maintenance Improvement Program (including a Procedure Adherence Initiative),
the Engineering Quality Improvement Program, the Safety Analyses Improvement Plan, and the Supervisory Improvement Plan (a personnel training program).
These programs were well thought out, adequately documented, and promulgated to the appropriate staff.
Some past improvement programs were successful; for example, the licensee's efforts to improve industrial safety performance. In April 1996, all maintenance work was stopped in response to industrial safety concerns 66
identified by licensee management. Several days were then dedicated to discussing and highlighting industrial safety prior to resumption of work.
This action, coupled with continuing emphasis on industrial safety issues resulted in reductions in industrial safety hazards and lost time injuries.
The team observed good industrial safety performance during the assessment.
The team also found that some previous improvement plans were not effective.
For example, beginning in 1990, the licensee initiated several improvement plans to correct problems in the Radiation Protection Department. Despite these attempts at improvement, problems continued to repeat themselves. Some improvement plans had not been accomplished because of lack of funding. For example, the improvement initiatives associated with implementing a comprehensive air-operated valve (AOV) testing program had not been funded for the past 3 years and the Erosion Control Program was not fully funded for 1995. Also, some programs had received funding, but the licensee had discontinued them during times of resource stress. For example, the Supervisory Improvement Program was discontinued during the 1995 refueling outage.
4.3.2 Economic Environment Like all licensees, the Maine Yankee Atomic Power Company (MYAPCo) has experienced competitive pressure to generate power at low cost. However, unlike others, Maine Yankee has not engaged in drastic staff reductions, work process reengineering or other budget cutback efforts to maintain competitiveness because it has historically maintained a lean and efficient organization. Staffing levels and budget. expenditures have been constrained to that necessary to generate power efficiently.
The MYAPCo owners comprise 10 utilities in the New England region. The largest single owner, Central Maine Power (CMP), owns 38 percent of the company. Northeast Utilities, in combination with other subsidiaries, owns approximately 20 percent of the company. The balance of the owners consist of other New England utilities.
The owners have exclusive rights to the power that is generated by the plant in proportion to their equity share. They are also required to provide for the operating and capital expenses to produce this power. The owners do not directly purchase the power from MYAPCo. Instead, they funded the approved budget and cover any unexpected funding requirements in proportion to their share in equity. The owners can pass along their respective share of prudent operating costs to their rate payers.
The cost of producing power at Maine Yankee is lower than for most other base load power in the area. Maine Yankee has the capacity to produce approximately 50 percent of the power in the State of Maine at a wholesale cost of 2.5 to 3.5 cents per kilowatt-hour. However, due to ownership shares, approximately 25 percent of the total power in the State of Maine is actually generated by Maine Yankee, and the remainder of the power is exported to out-of-state owner utilities. The owners have established multi-year contracts to resell approximately six to seven percent of the power produced by Maine Yankee to other utilities.
67
-N- -
Senior plant management maintains control over the capital and operating budgets by setting budget targets and monitoring expenditures. The budget targets are constrained by Federal Energy Regulatory Commission (FERC) regulations and are required to be justified as needed and as reasonable. One of tne criteria used by the FERC process to establish the rate for wholesale power is the avoided coft of power on the grid.
The rate structure in Maine was established by the Maine Public Utility Commission in December 1994, and constrains CMP to a multi-year Alternative Rate Plan (ARP) agreement which explicitly caps the cost of retail power to customers throughout the State. In addition, CMP signed a series of long-term power contracts with smaller independent power producers (IPPs) and non-utility generators (NUGs) with wholesale rates that were previously set between 9 and I1 cents per kilowatt-hour. This combination of multi-year high-cost power contracts and ARP retail rate caps effectively forces CMP to balance the cc-'flicting objectives by mitigating the higher cost of power from the numerous NUGs and IPPs in their service area with low-cost power from Maine Yankee.
4.3.3 Results Of Resource Constraints Unlike most utilities, MYAPCo does not retain earnings and does not .vt asside re, rye funds for unplanned requirements, except those rrquired by law. All monies in excess of operational expenses are periodical)y returned to the owners. The owner utilities are required to either capitalize or immediately finance emergent requirements from their operating budgets. The 1995 steam generator sleeving project is an example of an unplanned requirement at the plant causing severe financial impact to several owners. In order to respond to the immediate cash requirements, MYAPCo imposed a 10-percent reduction in operating and maintenance (O&M) costs across the board and termlinated all outside contract labor on site. Except for the deconmissioning fund, the nuclear waste trust funds, and pension funds which were mandated by law, the organization did not set aside reserve capital funding to provide for emergent needs.
MYAPCo used a sophisticated financial model to determine the cost factors that could encourage large industrial customers to elect to generate their own power and erode the mix between industrial and residential users. These factors combined to internally constrain the utility budget targets to reflect the compe3titive position of the regional spot market for power which were even lower than the cost factors listed above. In summary, Maine Yankee produced some of the least expensive power in the New England region and the regional utilities in Maine ha," limited budget funding to offset higher costs and competitive pressures.
Management bas effectively operated the plant within the budget constraints established by the owners. However, the limitations on resources have delayed and deferred plant upgrades, improvements, and lower priority corrective actions which did not meet the threshold for safety, regulatory compliance, or reliable production. Projects which would likely have prevented problems were unfunded because of budget limits.
68
One illustrative example was th, imposed delay of the completion of the Safety Analyses Inputs Document (SAID) which could have re-identified the problem with the undersized ASO sooner. The SAID project was the corrective action to prevent loss of control over the safety analyses inputs in response to concerns first documented in 1994 by the Nuclear Engineering Department and QPD. Development of the SAID was substantially delayed in 1995 when the steam generator sleeving project required the redirection of engineering resources.
A request from the Corporate Engineering Department (CEO) in the 1995 budget request to add an additional engineer to continue the SAID development was not funded by the senior plant management.
Another example of a case in which limited resources interfered with performance was the decision not to implement a comprehensive AOV testing program. In 1995, the Maintenance Department proposed to implement the testing program and to procure a diagnostic testing system for AOVs. The consequence of not funding the effort was stated in the unfunded O&M budget list as "continue to work on AOVs on an 'as fail' basis (reactive) rather than predictive maintenance." Despite these words of caution and a strong justification to proceed, management did not authorize the $218,000 needed to correct this problem because the testing system was not explicitly required by NRC regulations. If implemented, this testing system could have detected and prevented some of the AOV problems identified elsewhere in this report.
Another example of deferring needed projects because of a lack of funding is the halting of the mechanical/electrical/I&C specialty training program during the 1995 steam generator sleeving outage. This training prepared maintenance workers as journeymen and provided continuing proficiency training. All specialty training was halted in an effort to increase the availability of maintenance workers to support outage work. Additionally, funds were not approved in the 1995 O&M budget to respond to industry reaccreditation issues.
Another example of the impact of limited resources on important projects was that the design-basis summary program was halted during the 1995 steam generator sleeving outage because of constraints on staff resources. If this program had continued, there would have been additional opportunities during the development of design-basis documents to identify some of the older desigr, problems that were later identified by the team.
In addition, approximately 100 high priority work orders were deferred from the 1995 outage schedule at the end of the outage because of schedule constraints. With maintenance work order and corrective action tracking system backlogs increasing, senior plant management has recently decided to add more staff.
69
5.0 CONCLUSION
S The conclusions drawn from this assessment and the underlying root causes for the significant safety findings follow.
5.1 Licensing And Design-Basis Maine Yankee was in general conformance with its licensing-basis although significant items of non-conformance were identified. The licensing-basis was understood by the licensee but lacked specificity, contained inconsistencies, and had not been well maintained.
The -e of analytic codes for safety analyses was very good. Cycle specific co erformance analyses were excellent. More complicated, less frequently pe, -med safety analyses contained weaknesses, but the analyses were found to be acceptable based on compensating margin. Conditions of use specified in the safety evaluation reports were found to be satisfied, but not documented.
The quality and availability of design-basis information was good overall.
Despite uncorrected and previously undiscovered design problems, the design-basis and compensatory measures adequately supported plant operation at a power level of 2440 MWt. However, the team could not conclude, and the licensee did not demonstrate, that the design-basis supported operation at 2700 MWt relative to assuring adequate NPSH for the containment spray pumps and for the heat removal capability of the PCCW and SCCW systems.
5.2 Operational Safety 5.2.1 Operations Overall performance in the area of operations was very good. Strengths were noted in the areas of operator performance during routine and transient operating conditions; shift turnovers and pre-evolution briefs; use of risk information to ensure safe operations; and the involvement of management in day-to-day operations. Weaknesses were noted in the area of "workarounds" and compensatory measures wh, . unnecessarily burdened the operators or complicated their response to transient conditions. Additionally, log-keeping practices and post-trip reviews lacked rigor.
5.2.2 Raintenance And Testing Performance in the area of maintenance was good overall however, testing was weak. The results of the review of equipment reliability for the auxiliary feedwater, emergency feedwater, high pressure safety injection, and emergency diesel generator systems showed mixed equipment performance. Strengths were noted in the areas of knowledge and use of risk methodulogies for planning, prioritizing, and scheduling work; the control and limited use of temporary sealants; and a motivated and dedicated work force. Although material condition was considered good overall, a number of significant material condition deficiencies were noted as was a decline in material condition following the 1995 steam generator tubing outage.
70
Inadequacies in the scope of testing programs were identified. as were weaknesses in the rigor with which testing was performed and the evaluation of testing results to demonstrate functionality f4safety equipment. A lack of a questioning attitude and stressed resources resulted in the use of poor surveillance procedures and ineffective evaluation of surveillance test data.
5.2.3 Engineering The quality of engineering work was mixed but considered good overall.
Strengths were noted in the capability and experience of the engineering staff, day-to-d. engineering support of maintenance and operations, in the quality of most , culations, and in the routine use and application of analytic codes. However, engineering was stressed by a shortage of resources, and there was a tendency to accept existing conditions. Specific weaknesses were noted with inconsistent identification and resolution of problems.
inadequate testing, and work on some calculations and analytic codes.
5.3 Root Causes Of Significant Findings Overall performance at Maine Yankee was considered adequate for operation of the facility. However, a number of deficiencies were identified by the team in each of the areas assessed. These deficiencies, which included weak identification and resolution of problems; inadequate scope, and weak rigor and evaluation of testing; and declining material condition stewved from two closely related root causes.
5.3.1 Root Cause 1: Economic Pressure Economic pressure to be a low-cost energy producer has limited available resources to address corrective actions and some plant improvement upgrades.
Management has effectively prioritized available resources, but financial pressures have caused the postponement of some needed program improvements and actions.
The economic pressures discussed in Section 4.3 resulted in limitations on resources and interfered with the licensee's ability to complete projects and other efforts that would improve plant safety and testing activities.
Examples include the failure to adequately test safety related components (Section 3.2.4); the long-standing deficient design conditions, such as the undersized atmospheric steam dump valve (Sections 3.1.3.1 and 3.3.1) and environmental qualification issues (Section 2.3.9); and the lack of effective improvement programs, such as the design basis reconstitution program (Sections 3.3.3 and 4.3.3). These and other examples discussed in the report illustrate the licensee's willingness to accept existing conditions, many of which became operator workarounds (Section 3.1.1.1).
5.3.2 Root Cause 2: Problem Identification There is a :ack of a questioning culture which has resulted in the failure to identify or promptly correct significant problems in areas perceived by management to be of low safety significance. Management appears complacent 71
Z 0.4 %
with the current level of safety performance and there does not appear to be a clear incentive for improvement.
Examples of issues which illustrate complacency and the failure to identify r promptly correct significant problems, include previously undiscovered deficient conditions of the service water and auxiliary feedwater water systems (Set~ion 3.2.?); inadequacies in ventilation systems (Section 2.3.1),
post-trip reviews which lacked rigor and completeness (Section 3.1.2.7);
emergency operating procedures that may not adequately address an inadequate core cooling event and a steam generator tube rupture under certain conditions (Section 3.1.3.1); lack of a questioning attitude during test performance and evaluation that was not conducive to discovering equipment problems, but rather to accepting equipment performance (Sections 2.2.1, 3.2.2, 3.2.4); and licensee self-assessments that occasionally failed to identify weaknesses, or incorrectly characterized the significance of findings (Section 4.1). In addition. some corrective actions were not timely and others were ineffective, leading to repetitive problems (Section 4.2).
72
6.0 REGULATORY ISSUES During the course of this assessment, a number of deficiencies were identified for which the NRC shares some responsibility. Certain of these deficiencies are identified here and will be developed and addressed as part of a separate NRC followup effort on the lessons learned from the Maine Yankee Independent Safety Assessment.
6.1 Analytic Code Validation The ISA team noted that the validation of RETRAN to known industry benchmarks for integral and separate effects test data was deficient. This validation is important to assure that the plant-specific applicatil of the code effectively models known physical effects; however, the requirement for this validation was vague. The requirement can be traced to Generic Letter 83-11, "Licensee Qualification for Performing Safety Analyses in Support of Licensing Action," issued on February 8, 1993, which states in part:
... some licensees planning to perform their own safety analyses may not intend to demonstrate their ability to use the code by performing their own code verification. Rather, they plan to rely on the code verification work previously performed by the code developer or others.
NRR does not consider this acceptable and each licensee or vendor who intends to use a safety analysis computer code to support licensing actions should demonstrate their proficiency in using the code by submitting code verification performed by them, not others.
The NRC has acted inconsistently relative to its expectations in this area.
In some cases, computer codes have been endorsed for use with little or no validation ac(:omplished. The NRC should review its expectations relative to validation and assure they are made clear to the industry.
6.2 Compliance With Safety Evaluation Reports During the Maine Yankee ISA, compliance with conditions imposed on the use of analytic codes was verified for 67 SER conditions affecting 13 codes.
Although compliance was confirmed, an audit trail to assure compliance was not always available, necessitating, in some cases, additional analyses to verify compliance.
The regulatory status of an SER imposed commitment is unclear and should be reviewed. If conditions within an SER are considered appropriate, clear NRC expectations relative to compliance, auditability, and reportability should be established.
6.3 Licensing Reviews For Power Uprates The Maine Yankee ISA team identified a number of mechanical components for which confirmation of operability at the upgraded power level of 2700 MWt 73 Now
1 ... .. ,,
could not be confirmed. The NRC should review the scope and rigor of the thcensing reviews condacted for power uprates.
6.4 Safety Guide I NRC Safety Guide 1, "Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal System Pumps" issued on November 2, 1970, states, NPSH for emergency core cooling and containment heat removal system pumps caused by increases in temperature of the pumped fluid under loss of coolant accident conditions can be accommodated without reliance on the calculated increase in containment pressure.'
Emergency core cooling and containment heat removal systems should be designed so that adequate net positive suction head is provided to system pumps assuming maximum expected temperatures of pumped fluids and no increase in containment pressure from that present prior to postulated loss of coolant accidents.
The NRC should review and clarify its intent relative to relying on containment pressure for assuring appropriate NPSH for emergency core cooling and containment heat removal pumps. Specifically, the issue of whether or not the containment can be assumed to be pressurized at the saturation pressure for the sump fluid temperature should be addressed.
6.5 Inspection Program The adequacy of the scope and implementation of the NRC inspection program should be reviewed in the following areas:
- the licensee-implemented testing programs for safety systems relative to its scope, rigor, and analyses of results
- the periodic review of licensee developed Technical Specification interpretations to assure consistency with the intent of the approved Technical Specifications
- assessment of the adequacy of the plant design-basis including a review of the disposition of significant findings from previous licensee efforts such as design-basis documentation or design-basis recorstitution programs.
74
7.0 EXIT MEETINGS Two interim exit meetings were held during the course of this assessment. The first was held on July 26, 1996, at the end of the first two week onsite assessment period, and the second was held on August 23, 1996, at the end of the second and final onsite assessment period. The purpose of the interim exit meetings was to provide an opportunity for the ISA team leader and functional area leaders to provide an integrated discussion of the assessment findings to date.
A final meeting, open for public observation, will be held with Maine Yankee representatives at the Wiscasset Middle School, Wiscasset Maine on October 10, 1996. The conclusions of the report will be discussed at this meeting.
75
1:11:111 1 :1 111111ý1!;
1:= 1111:
!J
ý,11 1;1; 1 ýl::
ýý MOMMUMISRUM ABBREVIATIONS AEOD Office for Analysis and Evaluation of Operational Data (NRC)
AFW auxiliary feedwater ALARA as low as is reasonably achievable AOV air-operated valve ARP alternative rate plan ASO atmospheric steam dump BIRP Boron Injection RETRAN Post-processor CAL confirmatory action letter CAR corrective action request CAT cultural assessment team CCW component cooling water CDF core damage frequency CEA control element assembly CEO Corporate Engineering Department CIMP Central Maine Power CR control room CRO Control Room Operator CS containment spray CWPH circulating water pump house DBA design-basis accident 081 design-basis information DBS design-bases screen DBSD design-basis summary document DBR design basis recovery DNB departure from nucleate boiling DNBR departure from nucleate boiling ratio OP differential pressure E/C erosion/corrosion ECCS emergency core cooling system EDG emergency diesel generator EFW emergency feedwater EOP emergency operating procedure EPRI Electric Power Research Institute EQ environmental qualification A-1 Appendix A
FAAR functional area assessment report FERC Federal Energy Regulatory Commission FNE foreign material exclusion FP fire protection FPIP Fire Protection Improvement Plan FSAR Final Safety Analysis Report GDC General Design Criteria GL generic letter 1ffEL HFP high-energy line break hot full power I
HI Hydraulic Institute HPES -human performance evaluation system "PSI high-pressure safety injection HVAC HX heating, ventilation, and air conditioning heat exchanger 3 1ASO Inputs and Assumptions Source Document I&C instrumentation and controls ICC inadequate core cooling ILRT integrated leak rate test IN information notice WPE Individual Plant Examination EE(( Individual Plant Examination of Externally Initiated Events IPP independent power producer ISA Independent Safety Assessment IST inservice testing LBLOCA large-break loss-of-coolant accident LER licensee event report LLRT local leak rate test LOCA loss-of-coolant accident LOOP loss of offsite power LPSI low-pressure safety injection 14CC motor control center 14FW motor-driven main feedwater MIPPS maintenance information and parts procurement system NOV motor-operated valve MSLR main steam line rupture MSR moisture separator reheater NWd/MTU megawatt day per metric ton uranium HYAPCo Maine Yankee Atomic Power Company 4YAPS Maine Yankee Atomic Power Station 14YTTS Maine Yankee Task Tracking System Appendix A
I I
NCR nonconformance report I
NPSH net positive suction nead NPSHA net positive suction head available NPSH. net positive suction head required NRC Nuclear Regulatory Commission NRR Office of Nuclear Reactor Regulation (NRC)
NSARC Nuclear Safety Audit and Review Committee NUG non-utility generator OIG Office of the Inspector General (NRC)
OLSA online safety assessment O&M4 operating and maintenance PCCW -primary component cooling water PED Plant Engineering Department PORC Plant Operation Review Committee PRA probabilistic risk assessment PREE plant root cause evaluation PSS Plant Shift Superintendent PTR post-trip review PWR pressurized-water reactor QA quality assurance QC quality control QPD Quality Performance Department RAS recirculation actuation signal RCP reactor coolant pump RCS reactor coolant system RG regulatory guide RHR residual heat removal RPS reactor protection system RWST refueling water storage tank SAID Safety Analysis Information Document SALP systematic assessment of licensee performance SAS safety-actuation signal SCCW secondary component cooling water SCU Statistical Combination of Uncertainties SER safety evaluation report SFP spent fuel pool SG steam generator SGTR steam generator tube rupture SIAS safety injection actuation signal SIC safety issues concerns SOS Shift Operating Supervisor SSA shutdown safety assessment STA Shift Technical Advisor SW service water SWOPI service water operational performance inspection A-3 Appendix A
T/H thermal-hydraulic 1
TS Technical Specification UR unusual occurrence report I
wo work order YAEC Yankee Atomic Electric Company 7
A-4 Appendix A
MAINE YANKEE ATOMIC POWER COMPANY Chairman Board of Directors D.T. Flanagan President/
Chief Executive Officer C,D.Frizzle I I I I I
Vice President
& General Counsel I Vice Prskident nnce Vi Pirsidenlt lu1-censing & Engineering Il JFInanoe &Administrbation i G.D. Whittier Vice President Operations G.M. Lei*ch I
I MA.Lynch J I.. .P.S. Lydon J I I I I Manager Public & Govt Affaim I Project Manager (YNSD) Plant Manager I
Senior Manager, Outage I Manager Training L.R. Diehl I P.L. Anderson I C.R. Shawq R.W. Blackmore R.M. Hayward f Manager, Corporate Manager QPD/
Strategic Planning I Engineering w
- I rtt Manager Learning Process Manager. Outage J.C. Frothingham -I S.E. Nichols I A.R. Shean R.L. Bickford
- - - - a I
Manager, L&E Support TI Manager Maintenance
-1 J.R. Hebert I M.J. Veilleux I Manager, Plant I
Enalneerina E.D. Soule 11 I Manager Operations S.'P. Smith I
Manager Technical Support J.M. Connell Appendix B 11 NffMjJzjW= 11 I millioll ý Bill I ýIII I 1 1111, ---
APPENDIX C EQUIPMENT PERFORMANCE FOR AUXILIARY FEEDWATER, EMERGENCY FEEDWATER, HIGH PRESSURE SAFETY INJECTION, AND EMERGENCY DIESEL GENERATOR SYSTEMS FROM JANUARY 1, 1992 THROUGH JUNE 30, 1996
Figure I Maine Yankee Independent Safety Assessment Team Emergency Feedwater Pump Train P-2SA - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probability that the emergency feedwater (EFW) pump train P-25A will respond to a random demand, during power operations, for injection into the steam generators and will start and will inject into the steam generators for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts/cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very high value (over 99 percent) until January 1996. Grn January 8, 1996, the pump was placed in maintenance to repair a bearing oil leak and stayed in maintenance for 143.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Therefore the standby availability dropped in January 1996 with a resultant drop in the conditional probability. There have been no failures to start or failures to run of the pump train over the time period.
The value of the conditional probability as of June 30, 1996, was 97.9 percent. Thus it is expected that the EFW pump train P-25C would complete its mission approximately 98 out of .00 random demands.
For these curves, high valuE are better than low values.
Total Starts 130 Successful Starts 130 Failures to Start 0 Total Run Hours 487 Run Failures 0 Planned Maintenance Hours 44.5 Unplanned Maintenance Hours 143.5 Appendix C
--- ~ ~ ~ .
-_-m___uxd W d
'ft Wd bmw ft o
MAMI YANKEE MAIU VANKU . .. low .
E*ta m*gGV UdwMt P.25A ffmnWOty rF*.Waft P.2A Coadflo! Pvobinbft Sbn*'b, AwagabRKy ga '.4LI
&WWIwtmdcm g~a'ixi KI0A 1 %lC p moALLM Slo .o a, e iu.
"0142 mmwI L,:Zto ISOu cmx "I 41 j
_% AF MAR41 YANKEE MAROG YANKEE S.lterwvy oydwsw Enwigf3Sy teodwuftr P-2SA 1000%t o Sw Probablmy of tRm 91 MA 900%
A505, AO%
pMoauay In urn _m r-"-
I~-~eI
-~
ARM to Domeon x aid%
~~
'50% ~ ~ ~ ~ ~ -Fm 75 % . *
.Vol * .**.
i 75 O
Figure 2 Maine Yankee Independent Safety Assessment Team Emergency Feedwater Pump Train P-25C - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probability that the emergency feedwater (EFW) pump train P-25C will respond to a random demand, during power operations, for injection into the steam generators and will start and will inject into the steam generators for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts/cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very high value (over 99 percent) until December 1993. On December 6, 1993, the pump failed to start due to problems with a breaker for the pump. Therefore the probability of start dropped in December 1993 with a resultant drop in the conditional probability. There have been no failures to run of the pump train over the time period.
The value of the conditional probability as of June 30, 1996, was 99.2 percent. Thus it is expected that the EFW pump train P-25C would complete its mission approximately 99 out of 100 random demands.
For these curves, high values are better than low values.
Total Starts 192 Successful Starts 191 Failures to Start I Total Run Hours 992 Run Failures 0 Planned Maintenance Hours 29.5 Unplanned Maintenance Hours 1.5 Appendix C
-.- - &.. h ".
A.&d W o buo Imew f,11W VA" am
MIAR61 YANKII MAIN YANKI Cmaqrncy fto&NM P.25C fmnvwoftyPdwti' P-25C
- 4 S0I 110', 1L
&S0% -u ave___A~
flo~~~iks?ý 9"1e*.*,
f~ew Ftoso"uOn x a NoI-rv12" - Anm 014 100%
{ In Im i 111- ___
aims".wi~cnl3t 75 0 MAEI YANKEE MAMEi YANKEE Emergncmy Pe*dwIfr P.25C ImrrmgeAy Peedwatr P.2$C PfbbIwt* of slafl Ptobebfty of Fun ItO CID0%
I WC%
,MOIA -
QtAAnE ca , .R Ni -V FORll 24 HIL wbMatN r.!MEj BS,85%
I ,*)t t93.m.,ux *I6 Nat BO ]~ w Io~~~1 80 ~
eoo,* lF'uw- 'a*'w L~"' I I I - *-i.
...... , ft+ _ P* *' "_
7 0%
a a ~
Figure 3 Maine Yankee Independent Safety Assessment Team Auxiliary Feedwater Pump Train P-25B - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probabi ity that the auxiliary feedwater (AFW) pump train P-25B will respond to a random demand, during power operation, for injection into the steam generators and will start and will inject into the steam generators for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts/cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very low value over the time period. There have been two failures to start and three failures to run over time period. The standby availability has been steadily dropping over the time period because of the time spent to repair failures.
The value of the conditional probability as of June 30, 1996, was 76.3 percent. Thus it is expected that the AFW pump train P-25B would complete its mission approximately 76 out of 100 random demands.
For these curves, high values are better than low values.
Total Starts 59 Successful Starts 57 Failures to Start 2 Total Run Hours 26.5 Run Failures 3 Planned Maintenance Hours 132.5 Unplanned Maintenance Hours 441.0 Appendix C
MAI1 TANKEE Auxtto" P.. Wubrtm Auz"kyF*WwutrP-0S 1~~w o fvwtw pir 1w~~~ 24 ~ X0*4
- 9ft cms~~
99%ai i
I - -Mgo mr;_76 ao 0% co w-
'Si'.
71.
I8uwom n ode 60%
7~ C-
?5% 4--
4--"\, 75 (V MAY111 YANK. NAMkE YAlEKE Auxiflary ftedtodr P-25 AuwxUtty Podwtitsr P-2S prmbelty of Ifti pgowbsbt aRun o
two0%
u ..I .
.. . m
- r. I. awav~
OIIWU~ ~bg*
~ tUB- ~'wy INS IFOR 24 +/-IMýCIHTIME ~ e~. aix a~i 950%.
60 WA oI F k-i -h~ R p;;;W.-o __ __
4
Figure 4 Maine Yankee Independent Safety Assessment Team High Pressure Safety Injection Pump Train P-14A - Condition~al Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probability that the high pressure safety injection (lIPS!) pump train P-14A will respond to a random demand, during power operation, for injection into the reactor vessel and will start and will inject into the reactor vessel for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1)the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2)the probability of start (cumulative successful starts/cumulative total starts),
and (3)the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very high value (over 99 percent). Thus it is expected that the lIPS! pump train P-14A would complete its mission approximately 100 out of 100 random demands.
During the course of the independent safety assessment team evaluation, it was discovered that there was a missing wire (had been inadvertently removed) in the safety injection actuation system (SIAS) logic which would have prevented P-14A from starting if P-14A were the "alternate pump" during power operation. This failure was not included in the conditional probability of pump train P-14A, but rather was included in the failure of the SIAS logic in the Maine Yankee Individual Plant Examination.
For the curves, high values are better than low values.
Total Starts 79 Successful Starts 79 Failures to Start 0 Total Run Hours 9.996 Run Failures 0 While aligned Planned Maintenance Hours 4.4 Unplanned Maintenance Hours 0.5 Appendix C 6 - . .. ~ m~ mn~ .ýM-z i-ma iia W-0 =
CVOWHP4 FtNEP Pi4AA cvcmm PUMP P-14A T -- ... . -ccNMnoNAL----,,.. . . STANOSY AVALIALTV
.. 7w t4. nPan uyt 95%
Oww bma P1,1 Parbm'wrr SW WW. , d" , i tto PRA kWSW ISIAS is mo~eW *WoUfin wPRA 1---%4"4 IMBOMY X 42hdJ
!WN m- mr o
_____ ~ i~ ~II~t __
MANS* YA3IKS CVcIC"Is* PUMP P-ItA -CV&40"8* PUMP P.14 PROsuLflY Cm STA~R PROSABLITY OF RUN DWrvbM a PMV PatrbiW&cu tw bIn t4 PRAi ISIAS stojmeodied ogo" ,,hoPRAL 85%
I *'** * ,-* **.'4
__.-__. *-* tw .*- tMl
.e Itom K 1n aI wm 75%1 M IRtP1Xft 2tal.
7e%
Figure 5 Maine Yankee Independent Safety Assessment Team High Pressure Safety Injection Pump Train P-146 - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probability that the high pressure safety injection (HPSI) pump train P-148 will respond to a random demand, during power operation, for injection into the reactor vessel and will start and will inject into the reactor vessel for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts/cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very high value (over 99 percent) until March 1994. On March 23, 1994, P-14B failed to start because of control problems. There have been no failures to run of the pump train over the time period.
The value of the conditional probability as of June 30, 1996, was 98.5 percent. Thus it is expected that the HPSI pump train P-14B would complete its mission approximately 98 out of 100 random demands.
For these curves, high values are better than low values.
Total Starts 68 Successful Starts 68 Failures to Start I Total Run Hours 6,592 Run Failures 0 While aligned Planned Maintenance Hours 9.5 Unplanned Maintenance Hours 0.7 Appendix C bwa Mod i& 'okd wk ".a Rm
- - ~ -
VAN!r YPJEKE!
CVCSMPSI PUMP P-148 CVCSnKPSI PUMP P.148 CONOnO?4#.. PROBAMUTY .-- STANDBY AVAIABILJTY
- O--.<--
'00%
O12 WTHI SLIWC i 90% 00%-
LVALUEf am I SIMM G~ fc~ucifios i.6:5]
Ecz'dta? i.*l Ju~ im. ~ sum.
~ .~a. at Mail ?4M10 @ M i aA~. tmflYkIj out:@* MOM MAINE YAIMKEE MAINE YANKEE----
OCCGOEPO PUMP P-148 CVCSIHPSI PUMP P-148 POWO LFTY OF START PROBABILITY OF RUN 95% -
a.WLULAflW* START S W~tH 24 HOU MISSON rmeI O0%
I,!n'-I. 6-J5 Lc% 56%
SWWaM~new* r-! - -5 mmo~nstw ismp
~uw,
~us 76% 1.~z~1 - r-r 4
Figure 6 Maine Yankee Independent Safety Assessment Team High Pressure Safety Injection Pump Train P-14S - Conditional Probability Operating Conditions 5 6, 7 from January 1, 1992 to June 30, 199G These curves represent the probability that the high pressure safety injection (HPSI) pump train P-14S will respond to a random demand, during power operation, for injection into the reactor vessel and will start and will inject into the reactor vessel for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts/cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
On August 5, 1992, there was a failure to start of P-14S. There were no other failures in this pump train over the time period. The Conditional Probability curve shows that tht value was relatively low at the beginning of the period (93.7 percent) and has risen to 98.3 percent over the time period.
The value of the conditional probability as of June 30. 1996, was 98.3 percent. Thus it is expected that the HPSI pump train P-14S would complete its mission approximately 98 out of 100 random demands.
For these curves, high values are better than low values.
Total Starts 60 Successful Starts 59 Failures to Start I Total Run Hours 11,159 Run Failures 0 While aligned Planned Maintenance Hours 27.3 Unplanned Maintenance Hours 0.0 Appendix C milli
MAgi YANKU -- - MAIM YANKU
- 'CVOUPSI PIM p.tdl CvOil Pp P.148 COWEOMML PRODAMMJY STANOSY AVALAmLIV I*e9*ma~Wn
, Or, 75%4 MAW YAHIM *" MAMN!VANX8--
CVCBAMSI PWIP P.141 CVOM*Ihp PUMP P.149 PROUAMBRJ1 OP START PROGUBIL rYOP RUN Not lo l awoXeam$
JN JWAI tw~m.x* O w8o o%( X ows 8ra%
[nA% dwhsW] ' 8r3kakd- 8we; i i'?i + i i i' ' '*'*'+ i .. g -
Figure 7 Maine YarKee Independent Safety Assessment Team Emergency Diesel Generator Train EDG-1A - Conditional Probability Operating Conditions 5, 6, 7 from January 1. 1992 to June 30, 1996 These curves represent the probability that the emergency diesel generator (EDG) train EDG-LA will respond to a random demand, during power operation, for ac electric powe,, to its 4.16 kV bus and will start and power the bus for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts/cumulative total starts), and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
On April 23, 1996, there was a failure to run of EDG-1A. There were no other failures in this EDG train over the time period. the conditional probability curve shows that the value was relatively constant over the time period (90 to 92 percent).
The value of the conditional probability as of June 30, 1996, was 91.7 percent. Thus it is expected that the EDG train EDG-IA would complete its mission approximately 92 out of 100 random demands.
For these curves, high values are better than low values.
Total Starts 67 Successful Starts 67 Failures to Start 0 Total Run Hours 113 Run Failures I Planned Maintenance Hours 367.5 Unplanned Maintenance Hours 86.2 Appendix C
-- -.a ~-.- ~ *~ ______
MAIE! YANK!! MANE YAPIK'!L 6M*EMECY OEM~ OINKRA-VOCR 9001A IEROUWCY OMId OERATOfQ IDOIA STAMMOY AVAMLA@LY I I
- WU 06,%,.*o,,
MI 1 ,aO ,x .fm
~ 'us- ~wm, 11061 Iln~we MulE YfANK!!
MAKIE YAHn!!
DIEROEHCY CO1L GIEUATOR EOGIA EMIROENCY 01105L. GENERATOR PROBABLITY OF START PRO.ABIUTY OF RUN 195%
98%
95% -~ ~ -
mc~
i HOWgood= wd ftouNn F&*xo Roh 24 Hbw kes" I ýý
____tma mnVW*,=,a 0* Sbu._l wWO*bW O P F~ii~I "f..s immy 1995 - A 05to 15% r-~ U.-dl SMd4dw l_.__'fl......
1~ ~ I
Figure 8 Maine Yankee Independent Safety Assessment Team Emergency Diesel Generator Train EDG-lB - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probability that the emergency diesel generator (EDG) train EDG-1B will respond to a random demand, during power operation, for ac electric power to its 4.16 kV bus and will start and power the bus for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts/cumulative total starts), and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
On December 17, 1993, there was both a failure to start of EDG-IB and a failure to run- of EDG-IB. There were no other failuret in this EDG train over the time period. The conditional proibability curve shows that the value varied over the time period from 88 to 92 percent. The overall trend has been negative except for the last few months.
The value of the conditional probability as of June 30, 1996, was 90.1 percent. Thus it is expected that the EDG train EDG-IB would complete its mission approximately 90 out of 100 random demands.
For these curves, high values are better than low values.
Total Starts 80 Successful Starts 79 1
Failures to Start 111 Total Run Hours 1 Run Failures Planned Maintenance Hours 396.5 Unplanned Maintenance Hours 132.5 Appendix C
.- E *-
Now-. NPO .. W
. 4 M1AR1 YAHE MAKE1 VANW(U- __
WIargENCy monE GEIMATOR 0o0i1 iEJItOENCY mISMa. GPATOst goals CONmMONAL PROwLMI tSTAMNMO AVALABKM I2j-N7HI SSLSD IBovam 1 o w~d23Itw 60% N VALoI.E ora*l I#.I mu 78% * ~1W MAI*E YANKEE MAINI YAHKEE EMERGENVCY MUSM. OERSRATOR EOIm EMERGENCY MaMOLNEWSORATOR 50013
-pRO*MI"Y OP START PROUAdIITY OF RUN gos
~~AAT(VE &rThii] 8e8% aIFOW Remfw 24I am%
seom e 1VIWo as.wui oft*I Q " 0 O 'g I auve Maelj I ;+I;+I I JWIV II IM -A
~~~~
70%~ - f-,-i.--,r- -r----
WSJUJ tan Maine Yankee Independent Safety Assessment Team Edward L. Jordan Team Manager AEOD Ellis W. Merschoff Team Leader Region 11 Uldis Vanags Patrick Dostie Ola B. West Admin. Assistant David Decrow Region II State Representatives II I Jack E. Rosenthal Analytic Code Support AEOD PeterAEODPrescott George Hausman I j Region III i i II Robert Christie Cyril Crane I Contractor Oontractor I
- ' I! II George Cha Contractor Michael Shlyamberg Contractor A ni 0 Appendix