ML20045C216

Forwards Response to NRC 930521 Ltr Re Violations & Proposed Imposition of Civil Penalty Noted in Insp Rept 50-458/93-11 on 930225-0330.Corrective Actions:Surveillance Test STP-057-0401 Performed,Verifying Operation of Interlocks

ML20045C216
Person / Time
Site:	River Bend
Issue date:	06/16/1993
From:	Graham P GULF STATES UTILITIES CO.
To:	NRC OFFICE OF ENFORCEMENT (OE), NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
EA-93-060, EA-93-60, RBG-38643, NUDOCS 9306220221
Download: ML20045C216 (10)

Text

,- ". {

i GULF STATES UTILITIES COMPANY ,

i

&a , E P El htiMA.hDN POL f (.T f U.f FCF T/3 hT f MW S ol.LF LOU!5;ANA 7077$ l AFM A CO! S 604 f.M {VP44 340 br:f. I June 16, 1993 ,

RBG- 38643 l File Code No. G9.5, G15.4.1 l Director, Office of Enforcement U.S. Nuclear Regulatory . Commission Attn: Document Control Desk Washington, D.C. 20555 Gentlemen:

River Bend Station - Unit 1 Docket 50-458 Inspection Repon 93-11 EA 93-060 Pursuant to 10CFR2.201, this letter provides Gulf States Utilities Company's (GSU) reply to the Notice of Violation and Proposed Imposition of Civil Penalty for NRC Inspection Report No. 50-458/93-11 and Enforcement Action EA 93- ,

060. This inspection was conducted Febmary 25 - March 30,1993, of activities authorized by NRC Operating License NPF-47 for River Bend Station Unit 1.

The attached reply to the Notice of Violation and Proposed Imposition of Civil Penalty addresses the violations cited by the NRC. Also, enclosed is a check for '

$50,000 in payment of the civil penalty.

Sincerely, OWS P.D. Graham Vice President River Bend Nuclear Group JEB/JPSdRII/FRC/D JMAS/kym ,

cc: Regional Administmtor >

U.S. Nuclear Regulatory Commission Region IV

, 61i Ryan Plaza Drive, Suite 400

/ -

Arlington, TX 76011 1,p c NRC Resident Inspector M0050 I

P.O. Box 1051 y,I k t))(h)' 1)

St. Francisville, LA 70775 g 62gg g { b o00 50 G PDR :3

]

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION STATE OF LOUISIANA )

PARISH OF WEST FELICIANA )

Docket No. 50-458 In the Matter of )

GULF STATES UTILITIES COMPANY )

(River Bend Station - Unit 1)

AFFIDAVIT Philip D. Graham, being duly sworn, states that he is a Vice President of Gulf States Utilities Company; that he is authorized-on the part of said company to sign and file with the Nuclear Regulatory Commission the documents attached hereto; and that all such documents are true and correct to the best of his knowledge, information and belief.

--e Philip' D. Graham 1

Subscribed and sworn to before me, a Notary Public in and for the State and Parish above named, this lloR day of QN tuu ,

19 6 . My Commission expire's with Life.

h ChhA IM Claudia F. Hurst Notary Public in and for West Feliciana Parish, Louisiana

.-a,, --e. .mga- a s. - . a,s .1- s. s. ,,a - s a f

~

ATTACIIMENT REPLY TO NOTICE OF VIOLATION LEVEL III GULF STATES UTILITIES COMPANY RIVER BEND STATION DOCKET 50-458 LICENSE NO. NPF-47 INSPECTION REPORT 93-11 EA 93-060 >

REFERENCES i

NRC Inspection Repon 50-458/93 dated April 12, 1993 Notice of Violation - Letter from J.L. Milhoan (NRC) to P.D. Graham (GSU) dated May 21, 1993.

VIOLATIONS A. 10 CFR Section 50.59 states, in pan, that the holder of a license authorizing operation -

of a production or utilization facility may make changes in the facility as described in the safety analysis report, without prior commission approval, unless the propo' sed char.ge involves an unreviewed safety question. A change is deemed to involve an unreviewed safety question if the probability of occurrence or the consequences of an accident or malfunction of equipment imponant to safety previously evaluated in the safety analysis repon may be increased.'

'i The River Bend Station Updated Safety Analysis Report,' Section 3.8.2.1.3.1, Personnel Air Lock, states in pan, that the air lock doors are electrically coupled and mechanically

• interlocked, so that one door cannot be opened unless the other door is closed and sealed.

Contrary to the above, on October 25,1991, the licensee failed to perfonn an adequate safety evaluation prior to the permanent removal of the electrical interlock on the drywell  ;

and containment airlock doors. The removal of the electrical interlock was a change to j the facility as described in the Updated Safety Analysis Report and involved an i unreviewed safety question, i.e., an increase in the probability of a malfunction of the j airkxk. The change was made without prior Commission approval. l B. Technical Specification 3.6.1.4 states, in part, that each primary containment air lock shall be operable in Operational Conditions 1, 2, 3, and when irradiated fuel is being ,

handled in the primary containment and during core alterations and operations with a 6 1

9

-e ,--e. r---,-4 , + . , -- ,> - - - -

e. g r - g --

potential for draining the reactor vessel. Technical Specification 3.6.1.4 Action Statement b. requires, in part, with the interlock mechanism inoperable, that the licensee maintain at least one operable air lock door closed and either return the interlock to service with in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or lock one operable air lock door closed; and, that personnel entry and exit through the air lock is pemiitted provided cue operable air lock door remains locked at all times and an individual is dedicated to assure that two doors are not open simultaneously.

Contmry to the above, from October 1990 to March 11, 1993, with the plant in Operational Conditions 1, 2, or 3 at various times, the interlock mechanism on both containment airlock doors was inoperable because the licensee had removed power from the electrical portion, and the licensee did not return the interlock to service within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or lock one opemble airlock door closed or control personnel entry and exit through the containment airlock with an individual who was dedicated to assure that two doors were not open simultaneously. '

C. Technical Specification 4.6.1.4 states, in part, that each primary airlock shall be demonstrated operable at least once per 6 months by verifying that only one door in each airlock can be opened at a time.

Contrary to the above, from October,1990 to April,1993, the licensee did not perform a surveillance test that was adequate to verify that only one door in each airlock could be opened at a time. Surveillance Test STP-057-0401, which was used to test the safety-related containment airlock interlocks, was inadequate because the electrical ponion of the interlock was identified as optional and was not tested when de-energized.

ADMISSION OF TIIE VIOLATIQE GSU admits the violation.

REASON FOR TIIE VIOLATION On February 25,1993, it was discovered that two incidents occurred which apparently caused j the interlock mechanism in the upper containment airlock at elevation 171' to operate  !

improperly. In one incident the seals on one airlock door were partially deflated while the other airlock door was not completely closed. In the other incident, the. mactor door started to equalize while the outer door was not secured and sealed. Both of these cases constituted breaches of containment.  ;

The first incident occurred at 1350 on Febmary 25,1993. An individual entered the j containment airlock from the outer door, auxiliary building side. He attempted to manually close the outer airlock door from inside the airlock. He rotated the handwheel towards the "close" position, unaware that the airlock door was not seated completely in its frame.

Movement of the handwheel into the " seal" position caused the seals to innate while the airlock lI 2 I

door was still outside its frame. Additionally, the door's latch pins were extended. Movement of the handwheel to the closed position released the mechanical interlock in the reactor door.

IIowever, due to the door's position, the latch pins were not in their keepers. The individual then proceeded to attempt to open the reactor door. The reactor door handwheel was rotated towards the "open" position which initiated depressurization of the seals.

Having the seals dedated on the reactor door, while the outer door was slightly ajar, caused a momentary breach of the containment. The individual inside the airlock promptly closed and -

secured the reactor door upon being infonned by individuals on the auxiliary building side of the airlock that the outer door was not sealed properly. He opened and then properly closed and secured the outer door. STP-057-0401 " Primary Containment Airlock Door interlock Test" was performed immediately after this incident to verify operation of the mechanical interlocks.

The second incident occurred at approximately 1940 on Febmary 25, 1993. An individual entered the upper containment airlock from the auxiliary building to check radiological postings  ;

within the airlock. As he entered the airlock, the outer door swung shut but the handwheel was not rotated to the closed position. The individual was in the airlock only momentarily when he heard equalizing air from the reactor door and noticed the reactor door handwheel moving as an individual was attempting to enter the airlock from the containment. This caused a momentary breach of the containment through the airlock equalizing valve. The person inside the containment physically stopped the movement of the handwheel from inside the airlock immediately after he heard the reactor door stan to equalize. He then rotated the handwheel to ,

the closed position. He secured the outer door by rotating the handwheel from the open to the closed position. The reactor door was then opened to allow the other individual to enter the airlock and the control room was immediately contacted. Maintenance work order No. R174728 was genemted by the Shift Supervisor to inspect and correct the interlock malfunction following the second incident.

As identined in the vendor's operation and maintenance manual (3219.711-056-001), the two doors, one at each end of the airlock, are designed to be mechanically interlocked so that one door cannot be opened unless the other is completely closed and scaled. When the handwheel  ;

on one door is rotated to the open position, the mechanical interlock mechanism is designed to prevent opening of the opposite airlock door so that the containment cannot be breached during ,

access through the airlock.

When operating the doors manually, as identified in the vendor manual, special care must be taken by the individual when the door is in the open position. Operating instmetions are posted  ;

on each airlock door identifying the proper operation of the doors in the manual and automatic l mode.

In addition to the mechanical interlock, the airlock is designed with a solenoid activated handwheel locking mechanism. The purpose of the handwheel locking mechanism is twofold.

Under complete automatic operation, with power supplied to the airlock, the handle lock solenoid mechanism functions as part of the differential pressure monitoring system. If a '

3 3

differential pressure of more than 0.5 psi exists across the airlock door, the handwheel locking mechanism is energized and for personnel safety prevents the continuation of the opening sequence until the pressure is equalized. 1 In addition to being used as a part of the differential pressure monitoring system, under automatic conditions, the handwheel locking mechanism energizes when the door is opened. This prevents rotation of the handwheel while the door is in the open position. The handle locking mechanism that prevents the handwheel from rotating when the door leaves its frame, will not function when the door is operated in the manual mode (with control power off). Movement of the handwheel to the " seal" position de-activates the mechanical interlocks. If this occurs with the door not fully closed, the seals will inflate, potentially damaging the seals and creating a personnel hazard.

The handwheel locking mechanism, which would have prevented the handwheel from mtating when the door was in the open position, was de-energized prior to the two incidents described 7 above.

Originally, the airlock doors were designed to opemte by a pushbutton which actuated a sequencing system to automatically deflate / inflate the door seals and hydmulically open/close the door. A review of modification requests (MRs) and condition reports (CRs) regarding the '

airlock interlocks indicates that since August 1985 repetitive problems have been occurring with the handle lock solenoid and the hydraulic operating system. The corrective actions implemented did not substantially reduce the airlock problems.

In August,1986, CR No. 86-1296 was generated to address a condition in the upper containment airlock (lJRB*DRAl) in which the outer airlock door was ajar with the seals inflated and the inner door was opened. This condition existed for approximately two minutes. As a result of this incident, MR No. 86-1438 was generated to relocate the door's open/close limit switch from the door hinge to above the door frame. Note that this limit switch controls the actuation of the handwheel locking mechanism. The purpose of this MR was to ensure the reliable operation of the handwhccl locking mechanism. Modification request (MR) 86-1438 stated that the testing of the handwheel locking mechanism (electrical interlock) shall be included in STP-057-0401, .

" Primary Containment Door Interlock Test." The STP was revised in accordance with the MR; however, it indicated that the testing of the handwheel locking mechanism is not Technical Specification - related and is only applicable when power is supplied to the airlock. The unreviewed safety question determination (USQD) generated for the MR indicated that the handwheel locking mechanism was not safety related. In addition, the USQD did not indicate that the handwheel locking mechanism was required for the safe and reliable operation of the airlock interlock. system to ensure that the Technical Speci0 cation requin:ments for the interlock are met. The 1986 review of the design requirements versus the licensing basis was inadequate.

In October,1990 four people were trapped inside the Upper Containment Airlock (1JRB*DRA1) after the airlock doors were locked up in the closed position and the handle lock solenoid started smoking and burning (Ref. CR 90-0934). As a result of this incident, a decision was made to 4

- . ...see - . . + -A l_ -a 4A. m+ J -- - - - - . .

A *i=Ea - u -.i- # C- - 4 :*M-m -3: 3.- a s , A.

l Y

disconnect the electrical power as well as the automatic hydraulic operating system and opemte the doors manually. The solenoid activated handwheel locking mechanism which would have ,

prevented the handwheel from rotating when the door was in the open position was de-energized when the electrical power was disconnected.

Repetitive operational and maintenance problems associated with the handle lock solenoid and hydraulic system led to the decision to disconnect the electrical power supply and opemte the doors manually. The basis for this decision was as follows:

. The design of the doors enabled them to be operated in the manual mode with the power on or off.

The airlock doors were designed to be mechanically interlocked so that one door could not be opened unless the other is completely closed and sealed. When one door is open, the mechanical interlock mechanism is designed to lock the opposite airlock door so that the containment cannot be breached during access through the airlock. Regardless of the condition of the power supply to the airlock and the mode of operation the mechanical interlock-system was designed to prevent breaching of the containment. The mechanical interlock relies on proper manual operation of the door.

. The electrical equipment including the handwheel locking mechanism is non-safety related.

. As part of the disposition of CR 90-0934, the design requirements were reviewed +

against the licensing basis. The USAR indicated that both doors are mechanically latched and hydraulically swung. The USAR also stated that the doors are interlocked such that, in the event one door is open, the other cannot be actuated.  ;

It also stated that in the event of a power failure, it is possible to operate the airlocks manually. Consistent with the design, the engineer interpreted the USAR to mean that the airlocks could be manually operated during nonnal plant opemtion and not just during a power failure. He believed that the USAR sections did not prohibit or restrict the operation of the doors in a manual mode.

• However, NS AC 125 " Guidelines for 10 CFR 50.59 Safety Evaluations" indicates that changing the function of a structure, system or component from automatic to manual operation could be considered as a change to the facility as described in -

the Safety Analysis Report. Therefore, the 10CFR50.59 evaluation OSEE) for CR 90-0934 was not perfonned in accordance with the guidance of NSAC 125 as identified in engineering procedure ENG-3-004, " Safety and Environmental Evaluations."

4 Based on the above the mechanical interlock alone was considered sufficient for the continued operation of the airlock and maintaining containment integrity while the airlock was being used ,

in either an automatic or manual mode. l l

l 5

i l

After the decision was made to climinate the electrical power and operate the airlock doors manually a modification request was initiated to remove the components exclusively associated with automatic operation. Since the airlocks were designed to operate in the manual mode, the modification request was not considered to be essential for the continued operation of the airlocks in the manual mode, but rather was considered to be an enhancement to the design configuration of the airlocks. Therefore, when it appeared that the configuration of the plant should be changed, a timely design change was not implemented.

A review of maintenance work orders (MWOs) indicates that since 1985 corrective and preventative maintenance on the airlocks was not given adequate priority to restore them to their original design mode (i.e., automatic operation). It appears that maintenance was not provided t to the extent necessary to preclude handle lock solenoid and hydraulic system problems.

Therefore, adequate management attention to long standing equipment maintenance problems was not applied. Frequent discussions with the airlock vendor indicate that the airlock was designed for about 2000 cycles per year; however, the airlocks at RBS are cycled more than 2000 times in one month.

The root cause of this event consists of five causal factors. as detennined by a cause and effect task analysis:

1) The original design was inadequate for the level of service at RBS.

2) The 1986 review of the design requirements versus the licensing basis was inadequate.

3) The 10CFR50.59 cvaluation (ISEE) for CR 90-0934 was not performed in accordance with the guidance of NSAC 125 as identified in engineering procedure ENG-3-004,

" Safety and Environmental Evaluations."

4) When it appeared that the configuration of the plant should be changed, a timely design change was not implemented.

5) Adequate management attention to long standing equipment maintenance problems was not applied.

CORRECTIVE STEPS TIIAT HAVE BEEN TAKEN AND TIIE RESULTS ACIIIEVED Upon identifying the first incident, STP-057-0401 " Primary Containment Airlock DoorInterlock Test" was perfonned to verify operation of the mechanical interlocks. Maintenance Work Order No. R174728 was generated by the Shift Supervisor to inspect the interlock malfunction following the second incident. As a compensatory measure, GSU took actions consistent with the Action Statement of TS 3.6.1.4, " Primary Containment Airlocks."

Prompt modification request (PMR)93-009 has been completed. The handwheel lock solenoid has been modified to energize directly from the airlock door open/close limit switches during 6

l l

l

manual operation of the door, with control power supplied to the airlock. This will prohibit movement of the door handwheel when the door is outside its frame. This change ensures that the mechanical interlocks are maintained even if an attempt is made to misoperate the equipment.

In addition, prohibiting movement of the handwheel will ensure that the seals are not inflated when the door is open, which could result in personal injury and/or damage to the seals.

To ensure safe and proper operation of the airlock doors, detailed operating instructions were posted at each airlock door as required by PMR 93-0009. These instructions contain appropriate caution statements warning individuals of the potential personnel injury consequences of improper operation of the door.

CORRECTIVE STEPS TIIAT WILL BE TAKEN TO AVOID FURTIIER VIOLATIONS A high perfonnance team has been organized to thoroughly review the airlock design. With .

assistance froa the airlock vendor this team will perfonn a detailed design review of the River Bend airlocks. This design review will concentrate on the past and present airlock design, operational and maintenance problems. Following evaluation, necessary modifications of the airlocks will be initiated to enhance their perfonnance. These modiGcations will be implemented no later than the Rfth refueling outage (RF-5).

Several corrective actions were identified during the enforcement conference with the NRC Region IV on April 21, 1993 and in subsequent discussions with the NRC Senior Resident Inspector. A case study training class using the details of the airlock incidents has been developed to provide additional training and guidance in the performance of 10CFR50.59 evaluations. This training has been provided to all appropriate personnel in the Engineering Department as well as numerous individuals in other departments. Other individuals on site who  !

are qualified to perfonn 10CFR50.59 evaluation reviews and those who review dispositions of condition repons will be provided with this case study training as well. The expected completion date for this additional training is September 1,1993. In addition, clarification will be provided in the procedures related to 10CFR50.59 evaluation to reflect conclusions from the training session.

Previous 10CFR50.59 evaluations will be reviewed for conditions similar to the airlock situation.

This review will encompass modification requests (MR) and condition reports (CR) that have been completed since 1985. If similar conditions are identified, the 10CFR50.59 evaluation will be reviewed in detail and, if necessary, re-performed using the guidance provided by the case study training. The initial reviews of the CRs and MRs are expected to be complete by July 31, 1993. Depending on the quantity of additional 10CFR50.59 evaluations required it is expected that they will also be completed by July 31, 1993. Included in this completion of additional 10CFR50.59 evaluations will be engineering correspondence that in the past has provided guidance to operations on various operating scenarios in the plant.

A review has been perfonned of all outstanding maintenance work orders (MWO) to identify any items of potential concern that should be reviewed under 10CFR50.59. Fourteen items were 7

.. w',

5 identified that require further review. These reviews will also be completed by the July 31, 1993 date. hiaintenance is developing an upgraded work control program that will incorporate this type of review for degraded conditions and potential safety implications that may mquire a 10CFR50.59 evaluation. The expected implementation date for the upgraded work control program is July 31,1993.

In order to reduce the rate of usage of the airlocks, operations will develop a plan to reduce the entries to less than 1000 per month per airlock. This plan will be fully implemented by l December 1,1993. Integral to this plan is the resolution of fire protection issues within the containment building. This will allow removal of firewatches from containment which )

represents ahnost half of the current entries. In order to ensure reliable functioning of the interlock system the Operations Department has also revised STP-057-0401 to include testing-of the handle lock solenoid as part of the Technical Specification required interlock system.

This frequency of this STP has been administratively increased to once per week for a minimum of six months. In addition, the Maintenance Department has revised the monthly preventive -

maintenance task for the airlock door to include additional checks on the interlock system.

The description in the USAR of the operation of the airlocks was revised with PMR 934)009.

Additional clarification of both the USAR and the Tech Specs will be provided with the modifications for the pennanent upgrade to the airlock system.

The drywell airkick has also been eworked to ensure that the handwheel locking solenoid and the mechanical interlock system are fully functional. This was completed during the current forced outage (FO 93-01).

On April 23,1993, the Plant Manager held a briefing on airlock issucs for plant staff personnel, and other River Bend Nuclear Group personnel who hold at least a Supervisory position.  ;

I ATE WIIEN FULL COAIPLIANCE WILL HE ACIIIEVED l

Full compliance was achieved when the airlock door interlock was mstored to an opemble status.  !

Additional corrective actions will be completed as described above. ,

f 8