ML20072L310
| ML20072L310 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 07/06/1983 |
| From: | Selover R Public Service Enterprise Group |
| To: | Deyoung R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE) |
| References | |
| RTR-NUREG-1000 EA-83-024, EA-83-24, NUDOCS 8307130306 | |
| Download: ML20072L310 (44) | |
Text
e
'o
, ff~
Public Service Electric and Gas Company R. Edwin Selover 80 Park Plaza, Newark, NJ 07101201-430 6450 Mailing Address: P.O. Box 570, Newark, NJ 07101 Vice President and General Counsel July 6, 1983 Mr. Richard C. DeYoung, Director Office of Inspection and Enforcement U.S. Nuclear Regulatory Commission Washington, D. C. 20555 Re: Notice of Violation and Proposed Imposition of Civil Penalties Docket Nos. 50-272, 50-311, License Nos. DPR-70, DPR-75 EA 83-24
Dear Mr. DeYoung:
Public Service Electric and Gas Company (the
" Company") is in receipt of your letter dated May 5, 1983, and the Notice of Violation and Proposed Imposition of Civil Penalties (the " Notice of Violation") attached thereto. On June 9, 1983, the NRC extended until July 6, 1983 the date by which the Company could respond. This letter constitutes the Company's response to the Notice of Violation.
The Company is well aware of the significance of the events which occurred on February 22 and February 25, 1983 at Salem Generating Station (" Salem") Unit 1. As indicated on page 1-1 of Volume 1 of NUREG-1000 (Generic Implications of the ATWS Events at the Salem Nuclear Power Plant), although the conditions leading to the demand for both of such trips and the rapid manual shutdown of the reactor by the operators turned these events into little 8307130306 830706 PDR ADOCK 05000272 e G PDR C ~I N oh
4 1
i more than routine reactor shutdowns, we agree that the implications of such events, in terms of reactor trip system S
reliability in particular, and of adherence to procedures in
- general, are both significant and far-reaching for the Company and for the entire nuclear industry.
However, we believe that those events, and their contributing factors, do not justify imposition of a civil i penalty of the magnitude proposed by the NRC. The significant generic implications should not be allowed to obscure either the relatively benign nature of the actual l events or what constitutes an appropriate enforcement action based on the facts in this case.
The February 22 and 25, 1983 incidents at Salem have been carefully scrutinized by the Commission. Every past action of the Company has been placed under a microscope, dissected and analyzed. As you are aware, top management of the Company has been intimately involved in the investigation of the incidents. Management has also l
actively taken part in proposing remedial steps to assure that lasting corrective actions will be taken, both with I
regard to the failure of the trip breakers themselves and to adherence to procedures at Salem.
l There seems to be little point in attempting to l re-review the events which are the subject of the Notice of I
l
, , ., . . . . . ..... . . - . .- A
i 1 '
l Violation. They have been the subject of numerous meetings
, with the Staff, letters, reports and formal Commission meetings. The essential facts are not in dispute. The short-term actions have already been completed and the i
i longer term matters are the subject of the NRC's Order i
Modifying License Effective Immediately dated May 6, 1983, l
and are being actively pursued. We wish to merely emphasize l
a few points related to these incidents to give a i
perspective which was perhaps previously lacking and which is relevant to the amount of any civil penalty, i
A careful analysis of events leading to and involving the occurrences on February 22 and February 25, 1983, indicates that the Company's maintenance practices were consistent with the instructions supplied to the j Company by Westinghouse, the vendor that supplied the reactor trip breakers. In addition, in the most recent SALP i
Report for Salem (January 11, 1983), the NRC Staff rated
- maintenance in Category .1, reflecting
- " Licensee management i
attention and involvement are aggressive and oriented toward nuclear safety; licensee resources are ample and effectively used such that a high level of performance with respect to operational safety or construction is being achieved." The record also reflects that prompt and comprehensive remedial action was taken by Company management to assure that these i
3, , , . . . . . . . - . . ..-___..m. . , , , , , . . . , - _ . . . . _ , , , , . . _ _ , , , - , , _ . , , , - . , . , , , , , , _ . _ . . _ , , . - - -
4_
events do not recur and that all necessary improvements were made or committed to. The Company is further engaged in a test program to determine the life cycle and replacement interval for the undervoltage trip attachments and to verify the adequacy of the company's new maintenance and surveillance procedures used on the reactor trip circuit breakers. The benefits of this program will certainly be industry-wide.
The Company is not at this juncture requesting a formal hearing on the proposed factual findings set forth in the Notice of Violation. We take specific note in this regard of the meticulous attention to detail and the high standard of compliance the NRC expects of its licensees (10 C.F.R. Part 2, Appendix C, General Policy and Procedure for NRC Enforcement Actions (" Enforcement Policy")at I). We further recognize that this standard imposes a very high level of conduct on the Company, a standard which we believe is necessarily more stringent than virtually every other standard of conduct imposed by other regulatory schemes, whether under federal or state law.
While we recognize that there are areas involving procedures and procedure adherence which can be strengthened with respect to our nuclear operations, we continue to believe, as- previously discussed with the
l
.f .e I
, y I
Commission, that corporate management in general has been involved in taking actions to assure a strong nuclear organization and that on-site management capability is the equal of any in the country. Further, since the Salem events, we have implemented new operating, maintenance and quality assurance (QA) procedures. We have also instructed personnel in these procedures and in the importance that they be strictly adhered to, and we are carefully monitoring performance so as to assure improvement in station operation. Finally, we are working diligently to properly identify any further areas for improvement, both on i our own and with the assistance of Management Analysis Company ("MAC"), and we will make whatever changes may be required so as to strengthen overall performance.
Accordingly, it is the Company's position that the civil penalty as proposed in this case is not warranted based on the undisputed factual record and, therefore, that the penalty should be mitigated as a result.
i i
I. Mitigation of the Proposed Penalty is Warranted in Light of the Company's Corrective Actions i
It- is beyond' dispute that Section 234 of the i
. - - . . . - . . , _ . . , , - - . - . . . - - , , _ . - . , - . _ . _ , ~ . .w-. .
I
- s. _
f
! Atomic Energy Act authorizes the NRC to impose only ci il i penalties. The legislative history of that provision stat'e_s "The penalties authorized [in that section] are civil only and are remedial in nature as opposed to punitive" '(S .
l Rep. No.91-553, 91st Cong., 1st Sess. , Reprinted in (1969)
U.S. Code Cong. Admin. News 1607, 1622)., Recent amendments to Section 234 increasing the statutory maximum of civil .
penalties to $100,000 per violation with no upper limit do [' "[
not change the nature of these penalties. _
.s The Enforcement Policy reflects this statutory.4 ,'
.,s
.'s
^
requirement and states at IV. B. " Civil penalties are designed to emphasize the need for lasting remedial action ,
and to deter future violations." Because Section 234 requires that civil penalties be remedial in purpose, and because the Commission recognizes the need to relate such civil penalties to potential improvement of conduct, it
- follows that an adequate factual basis must exist for the NRC to believe that the proposed civil penalty in this case will serve a remedial purpose, ,
, Simply. stated, we believe the NRC has no basis
! upon which to conclude that the imposition of a large civil penalty in this proceeding will serve any remedial purpose.
The proposed penalty is unnecessary in that the significant, I corrective actions described below were either completed or *
~
~q
. , . - . , _ , . - . . - . . _ , - . , _ . , . , , . . ,,, _ ,_ ,,_ , , . - . . . . ~ . - , _ ~ , , . _ .
^
o
- r
,. ,, . /
J <, :' +
, ,) !
, , ,s -
a.
3 .
,/ '
v
- s. ,
j .. ,
were committ'ed to as a comprehensive reiaedial program prior y _ . ,- ,
to the issuance of the Jotice of Violation. Thus,
[ :.-
imposition of the civil penalty will not contribute in any meaningful way towards achieving compliance - with NRC
- regulations. .
- As indicated in the April 29, 1983 letter from the NRC Staff authorizing the restart of Salem 1, the program of z corrective actions which the Company implemented is
,- documented in'its lotters to the NRC dated March 1, 8, 14, 18, 23 and April 4, 7, 11, 22, 27, and 28, 1983. Such correctiveactionsinclude$thefollowing:
- 1. A new detailed maintenance . procedure, M30-2,
" Reactor Trip ,and - Bypass ACB ' Inspection and developed _. ukd e Test," was approved by the Company. This procedure, which applies to the circuit breakers, includirig the }undervoltage trip attachments, is based upon and refers to current Westinghouse procedures. It encompasses electrical testing of the
' breakers, notification of the Technical j
i N- Department of the need for post-maintenance testing and appropriate QA inspection hold points. A Caution Notice has been placed on the switchgear cabinets directing personnel to sd
- '~ ~ .
e
- 'e>--
c .,-.
er ,. -- -
o .
1 adhere to procedure M30-2 for all trip breaker maintenance.
- 2. New undervoltage trip attachments were obtained, tested and installed in each of the four Salem 1 breakers prior to restart.
Similar actions have been taken with respect to Salem 2 prior to its restart scheduled in July 1983.
- 3. Surveillance / maintenance procedures associated with the Solid State Protection System were revised to increase the frequency of surveillance testing of the reactor trip breakers from every other month to once a month. Also., the main breakers will be functionally tested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to startup, instead of within 7 days prior to startup. Further, every six months, the main and bypass breakers will be surveillance tested and maintained. This will include:
response time testing; trip bar lift force measurements; undervoltage trip attachment output force measurement; drop out voltage
( check; and servicing, maintenance and adjustments.
l l
l l
- 4. Emergency Instruction I-4.3, Reactor Trip, l for Salem 1 and 2, was revised to include the requirement to manually trip the reactor trip breakers on all reactor trips.
- 5. Formal reactor trip / safety injection post trip review procedures were developed to specify the requirements and criteria that must be met prior to start-up. Under these procedures, f the Station Operations Manager may authorize l restart following a reactor trip or safety injection provided that the Post Trip Review has been completed, evaluated, and reviewed with the Operations Manager, and the evaluation clearly indicates the cause of the event, and that all equipment and systems functioned as designed. These procedures require that if the cause of the event has not been clearly determined, or there is a question concerning the proper performance of equipment .or systems during the event, an investigation will be conducted and the results reviewed by the Station Operations Review Committee, which shall make recommendations to the General Manager - Salem m
,, .4 - -- ----,,-.--.,-,-e , ~#,..------..-w--,,-,---,,-,_,,,,,---,--,-r- - - . . ~ , . . - - ,
- o Operations on reactor start-up. The review of the sequence of events printouts will be conducted by senior reactor operator licensed personnel familiar with the various control room recorders and alarm printouts. Training on the interpretation of the sequence of events recorder printouts has been conducted, and additional training will follow. Prior to completion of the additional training, an individual supervisor knowledgeable on the sequence of events recorder and who understands expected equipment response times will review sequence of events printouts for all reactor trips or safety injections prior to restarting the plant.
- 6. Licensee Event Reports, deficiency reports, maintenance work sheets and work orders are being reviewed to identify items requiring preventative maintenance. The preventative maintenance program will then incorporate the results of this review.
- 7. Reactor trip and bypass breaker traceability has been established by recording the location of each breaker by serial number on a 1
. . . . . - ~ . . _
l documentation sheet which has been incorporated into the M3Q-2 Maintenance Procedure.
- 8. All Westinghouse technical bulletins, manuals, and other documents, pertaining to Westinghouse safety equipment utilized at Salem have been obtained on a controlled document basis and reviewed.
- 9. The administrative procedure for the control of station maintenance has been revised to include QA review of all work orders designated non-safety related prior to performing the work in order to assure proper classification.
- 10. The importance of adhering to the reporting requirements of 10 CFR 50.72 has been re-emphasized to operating personnel, and the appropriate procedures, personnel training l
and communications methods were revised to 1
assure that notifications are made within the required time periods.
- 11. Additional training was conducted prior to start-up to re-emphasize and strengthen the operators' understanding of the Solid State
Protection System and the significance of associated alarms and indicators. Such training was in addition to the regular requalification training program which has itself been revised to emphasize these subjects. ,
1 Equipment has been
- 12. The Master List (MEL) updated and re-issued as a controlled document. Appropriate personnel were indoctrinated in the purpose and use of the MEL.
- 13. The Nuclear Review Board was reconstituted prior to the February events to strengthen its operations.
- 14. A member of the Safety Review Group is being assigned to the Station Operations Review Committee.
- 15. The Company had authorized an independent assessment of the QA program prior to the February events, which will be submitted to the NRC in July 1983.
- 16. The Company has undertaken an independent management diagnostic study of the structure, management systems and staffing of the Nuclear
i ,
Department by Management Analysis Company.
The report, including an Action Plan recommended by MAC, was submitted to the Company which forwarded it to the NRC on June 29, 1983. The Company is evaluating the MAC recommendations and will report thereon to the NRC by August 29, 1983.
! 17. The Company committed to establish a Nuclear i
i Oversight Committee reporting directly to its Board of Directors to provide an independent basis for evaluating the effectiveness of plant operations in terms of nuclear safety.
- 18. The Company has committed to a test :ogram to determine the life cycle and replacement interval for undervoltage trip attachments and to verify the adequacy of new maintenance and surveillance programs used on reactor trip circuit breakers. This program is scheduled i to be completed by October 1983, and the results will be made available to the NRC and the nuclear industry generally.
- 19. Additional training has been provided to all L operators concerning those procedures which l
l were revised following the February events L
prior to start-up. Testing was administered to assure satisfactory comprehension.
- 20. The procurement procedure has been reviewed and an interim procedure to strengthen the procurement program was established. A final procedure will be implemented in July 1983.
This procedure will include requirements and responsibilities for proper classification of items and control of the procurement process.
! Appropriate personnel will be instructed in the use of this procedure.
- 21. A system has been instituted whereby all vendor technical documents are received by i
. nuclear engineering for evaluation and determination of applicability for Salem.
- 22. A program has been instituted covering all safety-related equipment included on the Salem
, Master Equipment List to provide verification that all equipment manuals are under a document control system.
- 23. The Company committed to expedite the staffing ;
l the Nuclear Assurance and Regulation l l
Department so as to be completed by l i January.1984.
l l
, , . - - -.- . _ . . . , - . . . . - . - , _ _ , , ._ , . . - . . . _ . . . . _ . . - . .._l
- 24. A complete managed maintenance program for all safety-related systems will be implemented by January 1984.
In view of these extensive corrective actions, a number of which will result in beneficial information or model procedures for the entire nuclear industry, the Company submits that no valid regulatory purpose will be served by the imposition of a large civil penalty in this case. The NRC Staff itself has stated that the civil penalty in this case was proposed "to assure that PSE&G will fully implement -lasting corrective actions that address the violations identified in [the Notice of Violation]." The corrective actions described above clearly demonstrate that this goal has been accomplished without civil penalty.
f, Therefore, mitigation of the proposed civil penalty is warranted.
Three of the four goals of the NRC Enforcement Policy have already been achieved. Through this enforcement action and the Company's extensive commitments outlined above, the NRC Staff has acted to ensure compliance with NRC regulations and license conditions, to obtain prompt correction of noncompliance and to deter future non-compliance. By mitigating the proposed civil penalty, it
- - - - . _ _ - - .. .- . = . -.
1 will accomplish the fourth goal of that policy: viz.,
encouraging improvement of licensee performance, and by example, that of the industry. We believe that this fourth goal is critical and should not be ignored. NUREG-1000 (Abstract, p. iii) states " regulatory and programmatic
! changes will be incorporated into the Regulations, Standard Review Plan, manual chapters, and other documents as necessary to assure continued attention to the lessons learned from the Salem Unit 1 ATWS events." We believe that this is a far better approach towards achieving the 4
goal of improvement in overall licensee performance throughout the industry than by isolating a single facility l
and imposing a large civil penalty.
II. Conditions Surrounding the February 22 Event Obscured the Breaker Failures and l Should be Considered in Mitigation The circumstances surrounding the February. 22, 1983 event at Salem should be considered in understanding 4
why the related post-trip review did not uncover the failure of the automatic trip at that time. Although we
, recognize that licensees must correctly determine the cause i
j of a plant shutdown prior to restart, we believe the three points below should be considered in determining the amount
[ of any . civil. penalty. The NRC Region I Inspection Report i
i i
No. 50-272/83-06, 50-311/83-05 issued April 11, 1983 briefly l describes (pages 12 and 13) this event as follows:
"Following repairs to the Control Rod Drive power ,
supplies, the reactor was critical at 3:16 p.m. I and the unit synchronized at 8:36 p.m. on February
- 22. At 9:55 p.m. on February 22, 1983, with the reactor at 20% power, the operators were transferring the 4KV Group Buses from Station
, Power Transformers to the Auxiliary Power
! Transformers. When the operator attempted to transfer the IF 4KV bus, the infeed breaker from 1
] the Auxiliary Power Transformer failed to close, !
- de-energizing the bus resulting in the loss of the
, 13 reactor coolant pump (RCP) and a loss of
- control power and indication for the 12 main feed pump (MFP) which began to coast down. At 9
- 56 p.m., the reactor was tripped. An automatic trip signal on 13 low-low steam generator level occurred at about the same time that the operator manually actuated the trip switch because he had 4
lost feedwater control and indication and had decreasing steam generator level.
! "The reactor trip / turbine trip started the l automatic transfer of the group buses from the 4 Auxiliary Power Transformers to the Station Power Transformers. This resulted in the Station Power
, Transformer infeed breaker to the IF 4KV Group Bus closing, re-energizing the bus, simultaneously starting all the loads still connected, thus
! causing an undervoltage condition on the transformer. This undervoltage condition caused
, the 1B 4KV Vital Bus to transfer to the 12 Station Power Transformer. The 13 RCP locked rotor j protection tripped the 13 RCP breaker. All auxiliary feedwater pumps started automatically on the low-low steam generator level. Since steam generators 11 and 13 provide steam to the turbine driven auxiliary feed pump and since there was no reactor- coolant flow through the 13 steam generator because of the de-energized 13 RCP, a 100 ~ psi differential pressure developed between main steam line 13 and other steamlines. The protection system sensed that as a steam line
-break and initiated a safety injection at 10:04
+ . .
i
, p.m. Pressurizer level decreased to 1% before safety injection flow started increasing level.
At 10:06 p.m. it was noted that the 11 RCP had tripped (reason unknown).
"With both the 11 and 13 RCP's tripped, no spray flow was available to limit pressurizer pressure.
As pressurizer level increased from safety injection flow, pressure also increased to the 4
PORV setpoint and actuated the PORV's which remained open relieving to the pressure Relief Tank until the safety injection was terminated at
, 10:11 p.m., by operators, when pressurizer level reached 22%. Both PORV's then closed, placing the plant in a stable condition in Mode 3 (Hot
- Standby). At 11:34 p.m. the operators made the required notification to the NRC Operations Center concerning the trip. At 3:00 a.m. on February 23, the 13 RCP was returned to service. The 11 RCP was returned to service at 11:17 a.m. after inspection and testing of the RCP breaker failed to identify any malfunction. At 6:28 a.m. the block valve for PORV PR-2 was closed because of seat leakage on PR-2.
"The inspectors ' began a followup review of this .
event at 7:00 a.m. on February 23. The inspectors were provided with the licensee's internal report 4
of the analysis of the event. The report included a cover memo from the Operations Engineer to the Plant Manager which stated that a detailed investigation had been completed which showed that the reactor had tripped automatically about 1 second before the manual trip was initiated by the operator."
During these events, numerous alarms were sounding in the control room because of the plant condition, and normal i control room lighting was lost for a short period of time.
First, in reviewing the events to determine the cause of the reactor trip, there were various significant
- . problems to evaluate. As indicated in the discussion
)
.- - .v,. ,. - - , + ..,_._,r - _ . , . - . - -_ -- . _ . _ , , , , . , , . _ , _ , , _ . , . . ..,-,.,,u,.y. .~.,.,--.__,,-m_
regarding the generic implications of post-trip review in NUREG 1000 (page 2-8):
...some events are very hard to unravel, particularly those involving perturbations from loss of lighting, loss of feedwater, safety injection, PORV openings or numerous alarms.
Important failures and system anomalies can be obscured or ignored unless there is a documented and systematic evaluation of the event and its implications. Many operating events are so complex that a proper interpretation can only be achieved by a detailed examination of a complete listing of the sequence and timing of events that includes important system parameters.
" Task Force meetings with the four Regulatory Response Groups (RRGs) identified only one utility, although there may be others, which clearly extends a top management safety philosophy down to the level of post-trip reviews. ... "
All of the anomalies referred to above were present in the February 22 event. The post-trip review therefore involved a number of complex significant problems about which plant personnel were justifiably concerned and upon which they were concentrating.
Second, a principal reason why the failure of the
( reactor trip breakers to open automatically was not I
l recognized was that the operators acted promptly in manually shutting down the unit. The decision to manually trip the reactor occurred about 23 seconds from the time the IF bus de-energized and plant conditions began to degrade, but the actual trip occurred only 3.6 seconds after the l
l
low-low steam generator level demand signal from the solid state protection system should have caused an automatic trip. In the NRC Staff's Salem Restart Evaluation dated April ll, 1983, it is concluded at page 18: "In the February 22 event, the operators' resp.nse was prompt and fully satisfactory from the time the transient started until the time the reactor was manually tripped."
Third, it is only because of the fact that the Company took the initiative and installed the type of sequence of events recorder which is at Salem that it is possible to accurately reconstruct the February 22 event.
1 It is not presently required that each nuclear plant in the United States have such a sequence of events recorder. Not all plants are so equipped. NUREG-1000 states the following at page 2-9 with respect to the importance of sequence of events recorders:
"The importance and role of plant computers in event reconstruction deserves more attention at operating plants. Currently, the computers are not required to be operable for power operation and often are powered by nonvital buses. As a result, they are not available for certain events and transients, including loss of power. There have been a number of occasions (e.g., TMI-2 and the Ginna steam generator tube rupture event) where analysis of operational events at nuclear power plants have suffered because the plant computers were not operational to record the sequence of events and the associated alarms. In ;
these cases it was difficult, if not impossible, l to accurately reconstruct the events."
The Company should not be unduly penalized for its initiative.
Notwithstanding these points, we are quite concerned that the personnel involved did not recognize what had in fact occurred on February 22. We recognize our responsibility in this matter, and, as discussed above, we have instituted a formal post-trip review procedure to assure that such will not happen again. However, we believe that the February 22 post-trip review should be considered in the perspective of these three points in determining the amount of any civil penalty.
III. Other Mitigating Factors There are a number of additional facts which the Commission should consider with regard to mitigation. There were a number of matters beyond the control of the Company related to these incidents which contributed to the failures of the undervoltage relays. The Company recognizes and accepts its responsibility for safe operation of the facility. However, the additional facts set forth below should be considered in terms of mitigation. As stated in the NRC's Enforcement Policy at IV.A.:
" Licensees are not ordinarily cited for violations I resulting from matters not within their control, such as equipment failures that were not avoidable
by reasonable licensee quality assurance measures or management controls."
Since these factors have been well documented during the Company's and the NRC's investigations of this matter, we shall discuss them only briefly in response to the Notice of Violation.
It is apparent that the design of the breakers contributed substantially to the events. First, the analysis presented to the NRC by its own consultant, the Franklin Research Center ("FRC"), indicates that the life of the undervoltage trip attachment devices cannot be assumed for more than a " reasonable" period, which in FRC's opinion was six months as a minimum, assuming personnel are prevented from interfering with the device and instructed in how to perform the minimum maintenance required (Transcript of NRC meeting held April 26, 1983, page 44, line 14, testimony of Dr. Zenons Zudans, Vice President of Franklin Research Center). Neither the Company, the nuclear industry nor the NRC was aware of this limited life.
I
! Second, FRC's final report of initial I
investigation (Appendix E to the NRC's Appendix A to the I
Salem Restart Report dated April 11, 1983) contains the following conclusions and recommendations with respect to the manufacturing by the vendor, and use by licensees, of 1
l l
< the undervoltage trip attachments:
"FRC believes that in the as-manuf actured
'new' condition, the 1983 UVT attachment will properly trip a circuit breaker that has a trip bar force requirement that is within the design limit of 31 ounces, and would probably consistently trip a circuit breaker with as-found trip bar force requirement of up to 38 ounces. However, sufficient evidence has not been presented to show
. that current manufacturing processes for the UVT attachment when coupled with maintenance will eliminate long-term failures that appear to be mechanical, age-related phenomena. The variations from device to device cause concern. The fact that honing is a hand operation indicates that variations in the surfaces of the latch will remain even though no extreme roughness should be expected.
"In addition, the lack of quantitative acceptance criteria adds concern that impending failures might be missed during inspection and maintenance.
"On March 18, 1983, Westinghouse Switchgear Division personnel also indicated that the UVT l attachment must be replaced some time during the life of the plant. Criteria for determining when to replace the UVT attachment do not appear to be available.
"FRC recommends the following actions:
i
- 1. Acceptance criteria be set for parameters 1-affecting correct operation of the UVT attachment.
- 2. Testing methodolcgy for acceptance tests be prepared for factory and Licensee use.
l 3. Uniformity of construction be instituted s or sufficient testing be performed showing that the variations in the devices are of no consequence to reliable operation.
L I I j !
l
c .o ,
4 4
. 4. Testing of the UVT attachment be performed to show. that the device can successfully operate for the intended lifetime with proper maintenance.
- 5. Criteria be developed to determine a replacement interval for the UVT L attachment such that replacement occurs j significantly before the possibility of L failure.
i
" Data and information provided to date indicate that the long-term reliability of the UVT
( attachment has not been proven to be adequate. The j' reliability of the UVT attachment appears to be i significantly below that of the DB-50 circuit
]-
breaker to which it is mated." (Emphasis _ added. )
l Again, neither the Company, the nuclear industry nor the NRC knew of such infirmities of the - undervoltage
- j. trip attachments prior to the Salem events. This is clearly ;
I j demonstrated by the NRC Staff's investigation into the j phenomenon known as anticipated transients without scram (ATWS) being conducted for over fourteen years prior to the Salem events, in addition to the efforts of a task force 1
- involving twenty-two utilities (including the Company).
i
! Throughout these investigations the components, such as j reactor trip breakers, or subcomponents such as undervoltage
! trip attachments, were not emphasized as requiring special t
attention as to their performance or reliability. ,
l Further, NUREG-1000 states the following at page 3-24 with. respect to the potential for a warning of the Salem events:
-._ _ . _ . . _ _ - , _ . - . - _ . . . . _ . _ . . _ . _ . . _ . - . , . _ , . . - _ - - - . ~ _ _ _
" Routine statistical analysis of single failures and failure rate data would probably not have suggested a high potential for common cause failure resulting in multiple, simultaneous breaker failures. However, with hindsight it appears that proper identification of root causes with common mode failure potential coupled with a detailed engineering understanding and careful review of LERs [ Licensee Event Report] might have given an advance warning of the Salem failures. Complete narrative descriptions reporting the failures and indepth engineering review would be necessary to identify the potential common cause failures.
Future reporting requirements associated with the proposed LER Rule should result in improved reporting of significant events such that engineering analyses can address the generic implication of failures. Component failures must i be better reported under an improved NPRDS [ Nuclear Plant Reliability Data System] (see Section 3.2.4)."
It was also concluded that the performance failures of reactor trip system breakers was comparable with the rate ccmputed in the " Reactor Safety Study" (WASH 1400), and thus did not generate concern for reactor breakers reliability based upon operating experience. (Id. at 3-23).
It seems incongruous that these conclusions can be made in NUREG-1000 while the NRC proceeds to impose a civil penalty because of the very events under consideration in NUREG-1000.
The knowledge about, and the expected reliability of, the undervoltage trip attachment were summarized by Dr.
Zudans, as follows:
"There is really basically nothing wrong with
the device other than the people who are exposed to it did not know what they should do or should not do.
"The other fact that we found out is that the device, as the device deteriorates, it is detectable. In other words, it will let you know it is hurting. All you have to do is follow simple procedures. You should never repair the device, you should never repair it. You just throw it away and replace it with another device."
(Transcript of NRC Meeting held April 26, 1983, pages 44-45.)
The NRC has recognized that these quality concerns are such that a diverse automatic trip should now, because of the Salem events, be considered for all Westinghouse pressurized water reactors. As stated at page 5-8 in NUREG-1000:
"As indicated in the draf t ATWS Rule in Table 5.2, Item 2, only the plants designed by Combustion Engineering and Babcock & Wilcox would be required to install an additional diverse scram system (including power interruption to the rods). No preventive measures, such as a diverse scram train, were initially recommended for the Westinghouse plants because the mitigative measures (diverse turbine trip and automatic auxiliary feedwater actuation) were believed to be
, sufficient, based on the initial value/ impact I
analysis. Because of the effect of the Salem events on the estimated failure rate of the Westinghouse reactor scram system, and the fact that other potential common-caus_e failure modes exist (see Section 3.1), a diver'se scram system i should be proposed through rulemaking for the l Westinghouse plants as well. This is consistent with our regulatory objective of defense in depth and the need for high reliability in the reactor trip system which is challenged on the average of ten times per year. This diversity would be aimed at minimizing the potential for failure of the Westinghouse trip system. Implementation of such
9'
+
a preventive measure, and those identified in Table 5.2, must not be construed as a basis for relaxing, in future designs, the present capability for the different plant types to mitigate an ATWS event." (Emphasis added.)
Third, in addition to the limited life and infirmities associated with the undervoltage trip attachment device itself as indicated above, the necessary proper maintenance instruction referred to in Dr. Zudans' testimony had not been provided to the Company and certain other licensees.
4 The Instruction Manual issued by Westinghouse
. Electric Corporation with respect to the reactor trip breakers (I.B. 33-850-3D, effective May 1970) indicates the following at page 5:
" NOTE: It is not advisable to lubricate any
. parts of the breaker. The lubrication supplied during - factory assembly is sufficient for years of service. The lubricant is of a special form which
! is used sparingly. The addition of oil will only promote the accumulation of dust and dirt."
Further, the specific instructions in the Instruction Manual
~
with respect to the undervoltage trip attachment are silent with respect to maintenance being required, although the Manual does specify maintenance for other breaker parts.
Subsequent to the issuance of this manual, Westinghouse - issued a Technical Bulletin (NSD-TB-74-1) on l January 11, 1974. The Company has no record or other evidence that this bulletin was ever received, nor has I
Westinghouse been able to produce proof that it was in fact delivered to the Company. Bulletin 74-1 notes that a malfunctioning undervoltage trip device was " corrected by cleaning the entire breaker, and lubricating the faces of the vertical-travelling latch in the undervoltage device linkage. A molybdenum disulfide lubricant such as Molykote G is recommended."
On February 19, 1974, one month later, Westinghouse issued NSD letter 74-2 which superseded and cancelled the information in Technical Bulletin NSD-TB-74-1.
Again, the Company has no record or other evidence that this letter was sent to or received by the Company. Letter 74-2 states with respect to lubricants:
"6. Lubricants. Although the Instruction Manual (page
- 5) cautions against any re-lubrication in the field, the manufacturers have agreed that the reliability of the breaker is improved by lightly lubricating the linkage of the undervoltage device occasionally. However, the lubricant should be applied only sparingly to the front and back faces of the vertical-traveling latch (interfacing with the flat copper-alloy spring).
"A dry or near-dry molybdenum disulfide iubricant should be used. Technical Bulletin NSD-TB-74-1 indicated Molykote G as a possible choice. That information is incorrect and is hereby rescinded.
Molykote G uses a thickened mineral oil as a vehicle, which would tend to collect foreign material. A better choice would be Molykote M-88, or Spray-kote. Both are commercially available Dow Corning products." (Bold f ace emphasis added.)
We believe that if the information in Bulletins 74-1 and 74-
2 had been sent to the Company, it would haVe been incorporated as a preventative maintenance item for the breakers.
1 Importantly, the Company is not the only licensee >
which failed to receive this information, a fact recognized on several occasions by the NRC. For example, IE Information Notice No. 83-18 issued by the NRC on April 1, 1983, indicates that 7 of the 28 plants using Westinghouse DB-50 type breakers had not been maintaining the breakers per the recommendations in Westinghouse NSD Data Letter 74-
- 2. This suggests that letter 74-2 had not been sent to plants other than Salem. In addition, NUREG-1000 states on pages 2-17 and 2-18, as follows:
"...INPO evaluation findings and informal discussions indicate that control of vendor maintenance instructions is frequently inadequate in operating plants. Other safety-related components have been identified for which technical manuals are not available.
" Responses to IE Bulletin 83-01 disclosed that seven other plants with Westinghouse NSSSs were performing maintenance on ~DB-50 breakers in the reactor trip system at variance with NSD-74-1 and -
- 2. This may indicate that some of these plants had not received NSD-74-1 and 2. The possible failure of a number of plants to have these service bulletins, coupled with the failure of Salem to receive NSD-74-1 and -2,-and of Westinghouse to be aware of this, -indicates a general problem rather than an isolated occurrence. Likewise, the Westinghouse letter of March 21, 1983 to R. Mattson of NRC describing its information dissemination procedures raises many questions about the adequacy
i
! F
- I of those procedures. Finally, information from NRC regional offices and from the headquarters
- licensing staff indicates that _ vendor-licensee relationship problems are not unusual and not i
limited to Westinghouse.
I " Westinghouse has stated it will provide a review !
of, and upgrade where necessary, its current ;
methods for distribution of technical information within Westinghouse and to utilities. Westinghouse will provide to the Westinghouse Owners Group a list of active Westinghouse technical information
- and recommendations for safety-related equipment.
j Salem has committed to a program to update existing i documentation on all its safety-related . equipment
, and to ensure -that vendor documentation is l controlled.
" Based on all the above, it is prudent to assume j the problem involves other plants, other equipment i supplied by Westinghouse, and equipment supplied by L
other vendors." (Emphasis added.)
t
. Once again neither the Company, the nuclear
] industry nor the NRC had fully appreciated the industry-wide problem of vendor-licensee communications prior to the Salem events. We assume that the recommendations as a result of NUREG-1000 will address this issue, and we would expect that the suggested remedies will be somewhat patterned af ter the
- Company's corrective actions at Salem.
Fourth, notwithstanding the failure of 1~
Westinghouse to provide needed information on breaker 1
)
maintenance, the Company .took the initiative and called Westinghouse to request the support of a Technical Service Representative in inspecting and cleaning the breakers, t
Although this service was performed pursuant to purchase and work orders which were erroneously classified as non-safety related, certain points should be made in mitigation. At the outset, we reconfirm with the Commission that we view the misclassifications seriously and have taken action to assure that they do not recur. However, the misclassifications were an isolated event. In the investigation which preceeded the NRC's authorization to restart Salem 1, the Company made an exhaustive study of approximately 15,000 non-safety related work orders. It discovered approximately 35 other misclassified work orders but in each instance the af fected system was appropriately tested. Thus, of these 35 improperly classified orders, which represent an error in the order of only 2/10ths of one percent, absolutely none affected safety.
Also, the Westinghouse service representative so
, retained was at the Salem site for four full days and four hours of overtime (January 13, 14, 17 and 18, 1983) for l breaker servicing. The representative serviced one of the reactor trip breakers while demonstrating the procedure for Company personnel who did the servicing of the other trip breaker at the same tire. The bypass breakers were later serviced by Compan3 personnel, pursuant to the '
l
representative's instructions. Nevertheless, the breakers failed less than two months inter. At no time during such servicing at Salem was reference made to NSD Data letter 74-2, the then current Westinghouse maintenance instruction.
The Company's actions in this regard appear to be similar to the industry practice. As stated in NUREG-1000 at page 5-7:
"A review of failures of the undervoltage trip attachments at all PWRs [ pressurized water reactors] (see Section 3.2) indicates recurring failures whose root causes were not being l identified or corrected. The affected utilities have, on occasion, utilized a manufacturer's representative to aid in trouble shooting, apparently with limited success. There has not been any indication that the utilities contemplated more extensive action to improve the reliability of the scram breaker portion of the reactor trip system prior to the Salem event. No one appears to be systematically accumulating and analyzing industry-wide experience with scram systems or components."
We believe that these items indicate both that mitigation is appropriate and that the best method for addressing the generic implications thereof to encourage improvement in licensee performance is through new or revised industry requirements, in part patterned after the Company's corrective actions.
e O ' e 0
IV. Specific Responses to Notice of Violation As indicated above, the facts surrounding the occurrences on February 22 and February 25 are essentially not in dispute. The Company's position in this matter is extensively documented by its letters to the NRC dated March 1, 8, 14, 18, 23 and April 4, 7, 11, 13, 22, 27 and 28, 1983, which are incorporated herein by reference. Except for Items otherwise discussed below, in these letters, the Company has for each Item in the Notice of Violation stated an admission or denial, the reasons for these occurrences, the corrective actions which have been taken and those which are underway and the steps that it is taking to avoid further occurrences. Attachment 1 to the Company's April 28, 1983 letter contains a summary listing of the short and long-term actions and completion schedules. The short-term items have been completed. The long-term items will be completed as indicated, all in compliance with the NRC's restart authorization dated April 29, 1983 and the Order 1
dated May 6 1983 modifying the Salem licenses to incorporate '
therein the items specified in the -Company's April 28, 1983 letter. l Because of the comprehensive discussion of these
matters in the Company's various submittals already in thi record, the following responses relate to only those areas of the Notice of Violation warranting further comment. -
With respect to Item 1 of the Notice of Violation, the Company believes that it is unreasonable to assess a civil penalty for four days of violation. The total elapsed time from the February 22, 1983 event at 9:56 p.m. to the second event at 12:21 a.m. on February 25, 1983 is less than 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br />. It therefore would be a closer reflection o,f the actual events to consider the matters set forth~in Item 1 of the Notice of Violation to encompass two days, or a maximum, unmitigated penalty for Item 1 of $200,000.
Further with respect to Item 1, we have examined the two Salem incidents designated as Severity Level I under 10 C.F.R. Part 2, Appendix C, General Policy and Procedure for NRC Enforcement Actions, against the very significant violations which are set forth by example. In our opinion, the Salem events have not been properly categorized. The i result of the two occurrences is far less severe than an accidental criticality, a release of radioactivity offsite l greater than ten times the Technical Specifications limit, i i
or a safety limit being exceeded. The operators acted l l
quickly and correctly in each case. Even had operator intervention not occurred for some time thereafter, no m
3
-Q~ - ,
, .. . . _ .> 2 2: -
3 s..
j%'
Wa ,
~
- significant impact would have. occurred. While not denying y the significance .of the two incide$tts , we submit a lesser A -
g everity level would be appropriate.
Further, it does not appear that the remaining example violation included in the Enforcement Policy under Severity Level I is applicable to the February 22 and 25 Salem events, i.e. "A system 5/ designed to prevent or
+. .
mitigate a serious safety event not[being, able to perform itsinteddedsafetyfunction2/whenactuallycalleduponto 4
work." Footnote 7 indicates:
"7' Intended
~
safety function' $.eans ,the total safety function, and is not directedf toward the loss of redundancy. For example, considering a e BWR's [ boiling water reactor] high pressure ECCS
[ emergency core cooling system] capability, the violation must resdit"in complete invalidation of both HPCI [high pres'aure coolant injection] and ADS [ Automatic ',- Depressurization , System]
subsystems. A . loss of one subsystem does not
- defeat the intended safety function as long as the other system is operable."
In .the Salem events, the reactor trip breakers failed to
, automatically open j following receipt of a valid trip signal ,
from the Solid State Protection System. However, it does I not appear that there was a to'tal failure of the Reactor Trip System as contemplated by footnote 7 quoted above,
'% because the breakers were in each case opened by the manual trip ei'gnal. The ability to manually trip the _ unit is requif}ed,. and provides a' redundant method to trip the
.k.
f
- , "i - - ,
a reactor if the automatic method fails. The manual trip actuates both the undervoltage trip attachment and a shunt trip attachment to shut down the reactor. This part of the Reactor Trip System did not f ai'..
4 A somewhat similar event apparently occurred at I
Haddam Neck in 1971 during surveillance testing. As stated by the NRC in NUREG-1000 at page 3-21: ,
... Failures of the DB-50 were first reported at H. B. Robinson aad Haddam Neck in 1971. These events were of particular concern because Haddam
. Neck experienced simultaneous failures of the undervoltage trip attachment in two reactor trip system breakers when an RPS trip signal was initiated during a surveillance test. Since the
, shunt attachments on both breakers were determined i to be operable, this event did not. constitute a i
complete failure of the trip system.' As a result, the Atomic Energy Commission (AEC) issued the first of 34 Bulletins and other notices (listed in Table 3.3) concerning various types of circuit breakers and relay failures in reactor safety system. Four of these documents related to failures in the reactor trip system." (Emphasis added.)
Although it is our understanding that the shunt trip at Haddam Neck was a part of the automatic trip mechanism, the previous AEC action indicates the diverse tripping mechanisms should be considered as separate subsystems.
The facts of the February Salem events therefore are not appropriate for classification as Severity Level I under the NRC's Enforcement Policy.
The Notice of Violation states the following as l
l
. .. ,. - .\
Item 2A:
" Criterion XVI of 10 CFR, Part 50, Appendix B, requires in part, that ' Measures shall be established to assure that conditions adverse to quality such as failures, malfunctions...
are promptly identified and corrected. In case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.'
" Contrary to the above, "Following the breaker failures at Unit 2 on August 20, 1982 and January 6, 1983, the licensee failed to adequately investigate the cause of the breaker failures, and failed to take corrective action with regard to the failed breakers and to inspect and service all of the reactor crip breakers on Units 1 and 2."
The Company questions the imposition of any civil penalty for this alleged violation. On August 20, 1982, the 2B reactor trip breaker on Unit 2 failed to operate during surveillance testing. It was replaced with the 2A reactor trip bypass breaker from Unit 2. The undervoltage coil on 2B reactor trip breaker was replaced, and it was reinstalled. A functional test of the undervoltage trip attachment was performed and was documented by a completed surveillance test.
On January 6, 1983, during routine operation, 2A reactor trip breaker on Unit 2 failed to open in response to a trip signal generated due to a steam generator low level.
It was replaced with the 1A reactor trip breaker from Unit 1. The 2A breaker relay was cleaned, lubricated, and readjusted. A manual trip test was satisfactorily performed, and the breaker was installed in Unit 1.
Thereafter, all the reactor trip and bypass breakers in Unit 1, which was at that time out of service for refue'.ing and maintenance, were maintained either by a Westingit .se service representative or by Station personnel pursuan~ to directions given by the representative as to the enr: set maintenance procedure. Although the Unit 1 br akers subsequently failed in February 1983, it has only been as a result of such failures that the entire industry has been made aware of the inherent unreliability of the undervoltage trip attachment parts which failed. Indeed, given the Franklin Research Center's refusal to recommend a term of life for the breakers in its post-event study (Salem Restart Report, April 11, 1983, Appendix E to Appendix A), the recently discovered need for the undervoltage trip attachments to be subject to a 100% quality control inspection of ten critical parts and a post-assembly acceptance test of 25 operations without failure, and the 26 other failures of Westinghouse DB-50 breakers to date in the industry, it is questionable whether any quality assurance program could have determined the cause of the
condition. In fact, as discussed above, NUREG-1000 indicates at page 3-24 that such may have required
" hindsight" and that future Licensee Event Report requirements will be designed to assist the industry in the recognition of generic implications of failures. With respect to Unit 2, it was out of service at the time of the February eventr., and all the Salem 2 breakers have been inspected, serviced and tested in accordance with the new procedures developed as a result of the Salem 1 events prior to the scheduled restart of Salem 2. Therefore, we believe any penalty with respect to Item 2A is inappropriate.
With respect to Item 2D3, preventive maintenance was not performed on reactor trip and bypass breakers from December 1976 for Unit 1, and from August 1980 for Unit 2, until January 1983 because of specific instructions contained in the manual for the breakers, and because the vendor failed to update the maintenance procedures for the breakers. The maintenance performed in January 1983 was done pursuant to the direction and supervision of a representative of the vendor of the breakers. Mitigation of the penalty for this item is appropriate under these circumstances.
! With respect to Item 2E, a system was not in l
- effect which was capable of tracing breaker location.
l
However, Criterion VIII of 10 CFR 50, Appendix B, states i
that such identification and control measures shall be designed to prevent the use of incorrect or defective material, parts and components. The Company, the nuclear 1
industry and the NRC did not have an indication of the I
limited life of, or infirmities associated with, the j undervoltage trip attachments prior tc the Salem events.
Moreover, the Salem events demonstrate that the item for which traceability is critical is the undervoltage trip attachment, much more so than the entire circuit breaker.
The problem of traceability of the breakers, and Y
particularly the undervoltage trip attachment, is recognized in NUREG-1000 at page 2-27 as one which the vendor must i address:
" Westinghouse provided no means by which undervoltage trip attachments having the design modifications delineated in NDC-Elec-18 could be unequivocally identified. This was the case for undervoltage trip attachments which were modified in the field as well as for undervoltage trip attachments originally manufactured with the modifications."
NUREG-1000 also states at page 3-30:
- "The DB-50 breaker is a special order unit; there is no inventory. Inspection of a few units to date indicates a certain amount of variability exists among units with regard to assembly. There is at least one unit obtained from the Salem plant that appears not to have the 1973 modification which was to hand polish the latch surfaces where machining or cutting took place. There is no positive way to l
identifir a unit to dete rn.ine whether it incorporates all the latest design modifications and recommendations without performing a detailed inspection of the internals of the unit.
Westinghouse made a commitment to investigate this problem." (Emphasis added.)
Further, NUREG-1000, at page 2-28, indicates the following with respect to the section of the NRC's regulations under which the penalty in Item 2E is sought to be imposed:
"Our regulations at 10 CFR Part 50, Appendix B, Item VIII, ' Identification and Control of Materials, Parts, and Components' require a method for identification of safety-related parts such as DB-50 circuit breaker undervoltage trip attachments having the design modifications delineated in NDC-Elec-18. The fact that this was not accomplished on the UV trip attachments that failed at Salem may be indicative of problems with the identification provided for other safety-related components to distinguish components with specific modifications from components not having the modifications."
It appears that full compliance with Item 2E is, and will continue to be, virtually impossible without corrective action by the vendor. Thus, the imposition of a civil penalty is improper under this item.
The Notice of Violation indicates that the NRC has determined that the violations in Item 2 are as serious as the February 22 and 25 events and should result in a civil penalty equivalent to that proposed for Item 1. The Company strongly objects to this position. As noted above, we
e **
- question whether any penalty is appropriate for certain matters in Item 2, and we believe that there are strong l
mitigating factors which must be considered for this Item.
Further, as mentioned, in reviewing other work orders for Salem following the February events, it was found that approximately 35 of 15,000 non-safety related work orders were misclassified but that such work orders had no impact on safety. This indicates an error rate of approximately
.2%. We view these misclassifications seriously and have implemented corrective procedures. However, in light of the results of the work order review, they were isolated occurrences.
To assess a $400,000 civil penalty under Item 2 in light of these facts would be unduly harsh and punitive, especially given the Company's extensive prior committments to institute both long-term and short-term corrective actions to improve Salem operations. In any event, as indicated above, the Company believes that imposition of a
$400,000 civil penalty for Item 1 is not warranted. To the extent the Staff mitigates that penalty, the proposed penalty for Item 2 should also be mitigated but to a greater extent than Item 1.
l
, , e.- ,
g ** O V. Conclusion We are deeply concerned about the events which occurred at Salem in February 1983. We believe that the generic causes and implications of the events further emphasize the need for this concern and that they also demonstrate that it is inappropriate and unnecessary to impose civil penalties in the proposed magnitude to assure compliance. Irrespective of any civil penalties, this Company has taken and will diligently follow through on strong remedial measures with respect to the equipment responsible for the February failures, the related operating and maintenance procedures, and the execution of such procedures by personnel.
We believe the Company has acted in good faith with the NRC in connection with this matter. A civil penalty of the magnitude proposed by the NRC will further no regulatory purpose. Accordingly, we urge that the penalty be mitigated.
- Respectfully submitted, Vice President and General Counsel
.p _ . . , . , _ . , . . . . , . , .,, _.,. . , , , , , . . ,,-..-9,. .y- , , .,.- -
c.
, . I, STATE OF NEW JERSEY )
SS.
COUNTY _OF ESSEX )
RICHARD A. UDERITZ, being duly sworn according to law deposes and says:
I am a Vice President of Public Service Electric and Gas Company, and as such, I find the matters set forth in thv attached response to the NRC's Notice of Violation and Proposed Imposition of Civil Penalties, Docket Nos. 50-272, 50-311, License Nos. DPR-70, DPR-75, EA83-24, are true to the best of my knowledge, information and belief.
d[a~
RICHARD A. UDERITZ
' I Subscribed and sworn to before me this 6th day of July, 1983.
Notary Public of New Jersey >
My Commission expires PAULA A. NATAllzid NOTARY PUBUC OF HEW JERSEY My Cosaiss:on Expires Feb.3,1937 L-