ML20100A321

Forwards Revised Response to NRC Re Violations Noted in Insp Rept 50-354/95-11.Corrective Actions:Prepared Test Procedures & Segments of Circuits Test Satisfactorily

ML20100A321
Person / Time
Site:	Hope Creek
Issue date:	01/02/1996
From:	Storz L Public Service Enterprise Group
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LR-N95175, NUDOCS 9601050062
Download: ML20100A321 (14)

Text

- e .

A

~ '

. 4 Pubhc Semce ]

Dectnc and Gas  ;

Company Louis F. Storz Public Service Electric and opn .O. Box 236. Hancocks Bridge, NJ 08038 609-339-5700

- Senior Vice President Nuckar Operatons LR-N95175 United States Nuclear Regulatory Commission Document Control Desk Washington, DC 20555 Gentlemen:

REVISED REPLY TO NOTICE OF VIOLATION MISSED TECHNICAL SPECIFICATION SURVEILLANCE REQUIREMENTS INSPECTION REPORT NO. 50-354/95-11 HOPE CREEK GENERATING STATION FACILITY OPERATING LICENSE NPF-57 DOCKET No. 50-354 Pursuant to the provisions of 10CFR2.201, this letter submits the  !

response of Public Service Electric and Gas Company to the notice of violation issued to the Hope Creek Generating Station (HCGS) in a letter dated September 19, 1995.

, The details concerning these issues are documented in Licensee Event Report (LER) 95-017-00 entitled " Inadequate Testing of Emergency Bus Undervoltage Logic Circuitry - Missed Surveillance Test, Diesel Generators Inoperable," dated August 11, 1995, and 1 LER 95-018-00 entitied " Missed Surveillance Test Due to Procedure I and Personnel Error - Automatic Depressurization and High Pressure Coolant Injection Systems Inoperable," dated August 17, 1995.

Also, as requested, this letter provides a comprehensive i description of HCGS's planned corrective actions to improve our i current Surveillance Requirement Program. l l

i In addition, this letter, revised as noted, responds to your November 24, 1995 correspondence regarding your concern with the ,

comprehensiveness and timelinese of the immediate corrective l 1 actions related to the July 1995 discovery of inadequate surveillance testing of the Emergency Bus Undervoltage Logic Circuitry.

4 050031 9601050062 960102 PDR ADOCK 05000354 G PDR j ,

I;

/ l

@ Pnntedon Rewbd Papr C/

I Document Control Desk LR-N95175 Should you have any questions or comments on this transmittal, do not hesitate to contact us.

Sincerely,

/ - @

L. F. Storz Senior Vice President -

Nuclear Operations Attachment (1) e 95-4933

I Docum'ent Control-: Desk ~ JAN01 16

- LR-N95175 C Mr. T. T. Martin, Administrator - Region I U. S. Nuclear Regulatory Commission 475 Allendale Road King.of Prussia, PA 19406

'Mr. D. Jaffe Licensing Project Manager - Hope Creek

.U. S. Nuclear. Regulatory Commission One White Flint North Mail Stop 14E21

~

11555 Rockville Pike Rockville, MD 20852 Mr. R. Summers USNRC Senior Resident Inspector (X24)

Mr. K. Tosch, Manager IV Bureau of Nuclear Engineering 33 Arctic Parkway CN415 Trenton, N.J. 08625 i'

1

s l'

4 i

e

ATTACHMENT REVISED REPLY TO NOTICE OF VIOLATION l MISSED TECHNICAL SPECIFICATION SURVEILLANCE REQUIREMENTS INSPECTION REPORT NO. 50-354/95-11 HOPE CREEK GENERATING STATION FACILITY OPERATING LICENSE NPF-57 DOCKET NO. 50-354 LR-N95175 I. INTRODUCTION Recent performance at Hope Creek has resulted in a significant number of Licensee Event Reports (LERs) relative to missed surveillance activities. As a result of this Technical Specification (TS) surveillance testing performance, the Technical Specification Surveillance Improvement Program (TSSIP) project has been initiated by the General Manager of Hope Creek Generating Station (HCGS). The project will be completed by a multi-disciplinary team consisting of approximately 5 to 6 Nuclear Business Unit (NBU) staff and contract personnel on a full time basis.

In support of this project, a review of the LERs related to missed TS surveillance requirements has been performed. The main contributing factors to the missed TS surveillance requirements are inconsistencies between surveillance procedures or scheduling requirements and the TS requirements, such as:

• Incorrect periodicity of the surveillance;

• Incorrect operational condition in which the surveillance should be performed;

• Omission of a component from a system test; and i

• Incorrect testing methodology. j The charter of the TSSIP project is to compare the TS requirements of section 4.0 (with the exception of section 4.0.5 l requirements) to the surveillance procedures to verify that all I requirements are met. This comparison will include verification that:

• Procedures test the entire scope of the TS system (channel, logic system, etc.), including inputs, sensors, indicators, alarms and trip functions as applicable,

• Numerical values, setpoints, tolerances, calculations, t

graphs, figures and tables included or referenced in the l procedures are consistent with values specified in the TS, Page 1 of 11

ittachment LR-N95175 Revised. Reply to Notice of Violation- l

• . Procedure steps, including prerequisites and special conditions (i.e. any operational condition restriction),

associated with satisfying TS Surveillance Requirements are correct and identified in the procedure,

• Procedures satisfy the intent of the surveillance requirement as stated in the TS Bases,

• Procedure acceptance criteria satisfy the TS surveillance requirements and acceptance criteria have referenced bases, and

• The computerized surveillance scheduling program correctly

~ identifies the required frequency and Operational Condition for performance.

This program is beira closely modelled af ter the TSSIP effort recently completed at Washington Public Power Supply System (WNP-2). Bases packages will be prepared for each TS Surveillance Requirement. We are confident that this project will resolve deficiencies associated with missed or improperly performed TS surveillance requirements.

II. REPLY TO THE NOTICE OF VIOLATION

1. Description of the Notice of Violation

" Hope Creek technical specification 4.0.2 requires in part, that each surveillance requirement shall be performed within

, its specified surveillance interval with a maximum allowable

! extension not to exceed 25 percent of the specified i surveillance interval.

i

contrary to the above, during the period of July 13 to 20, 1995, certain surveillance requirements were not performed

within the specified intervals, including the maximum

allowable extension, as stated in the following examples:

(i) Hope Creek technical specifications 4.8.1.1.2.h.4.a and 6.a require in part, that each diesel generator be l

demonstrated operable at least once per 18 months

, during shutdown, by simulating a loss of offsite power and verifying load shedding from the emergency busses. ,

On July 13, 1995, it was determined by the licensee l that surveillance testing omitted complete verification l of the circuits associated with the vital bus load 1 l

. Page 2 of 11 l 1

l l

l 1

, Att:chment LR-N95175 Revised Reply to Notice of Violation l.'

shedding in. response to the loss of offsite power l signals. Specifically, overlap testing between bus  !

loss of power auxiliary relays and the individual load 4

. breaker trip circuits had never been adequately I demonstrated since initial plant licensing. l l

l (ii) Hope Creek technical specification 4.3.3.1 requires in I part, that each ECCS actuation instrumentation channel shall be demonstrated operable by the performance of a

quarterly channel functional test. On July 20, 1995, it was determined by the licensee that various specified ECCS actuation instrumentation channel functional tests were not completed within the

, specified intervals for the following three examples:

(1) on June 6, 1995, the condensate storage tank ,

level-low instrument channel functional test for the HPCI system suction swap was improperly credited by the completion of a suppression pool level high instrument channel calibration; i (2) on June 29, 1995, the "C" RHR and "A" core spray )

pump discharge pressure-high permissive instrument channel functional tests for the automatic

< depressurization system were improperly' credited by the completion of an "A" RHR pump discharge pressure-high permissive channel calibration; and, (3) on June 29, 1995, the "B" and "D" RHR pump i discharge pressure-high permissive instrument 1 channel functional tests for the automatic depressurization system were improperly credited by the completion of an "B" core spray pump discharge pressure-high permissive channel calibration."

Discussion for Example is j

, 1 l

2a. Reason for Violation L

PSE&G has reviewed the circumstances described by the NRC l and concurs with the facts cited in the violation.

On July 13, 1995, a review of surveillance testing was performed in response to the discovery of drawing discrepancies regarding loss of power (LOP) logic descriptions. After review of the existing surveillance testing procedures used to perform the load shedding for the vital busses against the criteria of Information Notice 95-1 Page 3 of 11

. :,sw

Attcchment LR-N95175 Revised Reply to Notice of Violation 15, " Inadequate Logic Testing of Safety Related Circuits,"

dated March 7, 1995, it was revealed that the testing performed to verify TSs 4.8.1.1.2.h.4.a and 6.a was incomplete. These TSs address diesel generator testing and require the simulation of a LOP, and a LOP in conjunction with an Emergency Core Cooling System (ECCS) actuation test signal. The overlap in the surveillance testing did not adequately test all segments of the circuits associated with load shedding in response to a LOP signal. Specifically, the load shed that is initiated upon bus undervoltage (one-out-of-two-taken-twice logic) had not been functionally tested (i.e., there was no test procedure that provided an input to this logic and verified the desired output (load shedding) occurred as required). While all the relays in the circuits were cycled during testing, a small number of the relay contacts and their associated functions were not fully tested.

Since operability of the load shedding feature had not been demonstrated, the four diesel generators were declared inoperable in accordance with TSs at 2100 hours0.0243 days <br />0.583 hours <br />0.00347 weeks <br />7.9905e-4 months <br /> on July 13, 1995. Upon declaring the diesel generators inoperable, operating shift personnel reviewed and discussed TSs 3.8.1.2 and 4.0.3. At the time, the operating shift personnel considered TS 4.0.3 to be governing, with TS 3.8.1.2 to be invoked following the twenty-four hour grace period allowed by TS 4.0.3. Both TS were entered on the Limiting Condition for Operation (LCO) log.

Following discussions among operating shift personnel and various department representatives, at approximately 0830 h:wrs on July 14, 1995, it was determined that the governing TS was 3.8.1.2, and not 4.0.3. With four diesel generators inoperable, the minimum A.C. power sources required to be operable by TS 3.8.1.2 were considered to be functional but not operable in accordance with TSs. The associated action statement requires, in part, the suspension of core alterations, suspension of handling of irradiated fuel in the secondary containment, suspension of operations with a potential for draining the reactor vessel, and suspension of crane operations over the spent fuel storage pool when fuel l assemblies are stored therein. When the LCO form was  !

updated to reflect the correct governing TS, the required  ;

actions were not captured. Compliance with the required actions was verified although controls were not established.

The untested undervoltage auxiliary contacts used for load shedding were reviewed by the system manager. A test procedure was created that performed a functional test of 4.16 kV load shedding to satisfy Surveillance Requirements  ;

4.8.1.1.2.h.4.a and 6.a. This test provided an input signal )

l Page 4 of 11 l 1

. Attcchment LR-N95175 Revised Reply to Notice of Violation l to the undervoltage relay logic and verified that the associated load was shed from the vital bus as required. l This test was conducted satisfactorily. The "C" diesel 1 generator was declared operable at 1300 hours0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br /> on July 16, i 1995. The "A" diesel generator was declared operable at 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br /> on July 17, 1995. The return of the "A" diesel l generator to operable condition restored the required minimum A.C. power sources of two as required by TSs in i Operational Condition 4. The "B" and "D" Emergency Diesel l Generators were also tested satisfactorily. In addition, the system manager verified the balance of the contacts related to the undervoltage logic scheme were functionally tested.

As reported in LER 95-017-00, dated August 11, 1995, the cause of this event was procedural inadequacy. A contributing cause was inadequate review of operating experience feedback of previous similar occurrences at other ,

l facilities. The test procedures did not provide sufficient overlap to ensure that TS requirements were met for the ,

complete circuit. Failure to test segments of these (

circuits is attributed to inadequate technical input and review during the development of these test procedures. The error was not identified during subsequent reviews of the procedures since those reviews focused on the specific changes in that revision.

During the system manager's review of the July 13, 1995 occurrence, using the guidance provided in Information Notice 95-15, PSE&G questioned the methodology for the logic system functional tests required per Technical Specificacion 3/4.3.3, " Emergency Core Cooling System Actuation Instrumentation" (i.e., was verification that every contact of the auxiliary relays changed state required?). PSE&G's position at that time was that the requirements of a Logic System Functional Test were being satisfied with current l procedures. However, due to the varied interpretations l throughout the industry regarding what constitutes adequate l overlap testing, the resolution of the Logic System Functional Testing concern to test all contacts was assigned to the Technical Specification Surveillance Improvement Program (TSSIP) effort.

The question regarding the adequacy of that testing (i.e.,

verifying every contact changed state) methodology with respect to Technical Specification 3/4.3.3 was documented in PSE&G's Corrective Action Program (CAP). This was so that potential deficiencies in the methodology could be identified and addressed prior to or during Hope Creek's sixth refueling outage, scheduled to begin on November 10, i 1995.

l Page 5 of 11

, Attcchment. .

LR-N95175 Revised Reply to Notice of Violation The basis for operability of the Emergency Diesel Generators for undervoltage. initiation was the. satisfactory functional tests of the previously untested segments of the load shed function and the verification of the control functions of the auxiliary relays associated with the undervoltage circuit. This testing supported the conclusion that the Emergency Diesel Generators would have been capable of performing their intended safety functions if called upon.

Reasonable assurance of operability was also demonstrated by the successful performance of the Loss of Power / Loss of Coolant Accident (LOP /LOCA) test over the last 6 cycles.

The timing for follow-up to the question of adequate testing is believed to be consistent with Generic Letter 91-18, Section 6.1 based on the strength of our reasonable assurance at the time. It should also be noted that this time frame is consistent with the guidance provided in the draft Generic Letter for testing of safety-related logic ,

circuits. This draft Generic Letter requests completion of a Technical Specification Surveillance procedure review for safety-related logic circuits by the first refueling outage commencing 90 days after issuance of the Generic Letter.

In conclusion, PSE&G believes that the corrective actions taken.in response to the July 1995 discovery of inadequate surveillance testing of the Emergency Bus Undervoltage Logic Circuitry were comprehensive and timely based upon judgement of the information available at the time. The November deficiency was self-identified by PSE&G through implementation of a follow-up action put in place as a result of the July evant, namely TSSIP. The TSSIP process assures that surveillance deficiencies are identified and corrected, which was the case with the Logic System Functional Testing of the Emergency Diesel Generator start, load shedding and sequencing logic.

TSSIP's review of Technical Specification surveillance testing, including Technidal Specification 3/4.8.1.1 and 3/4.3.3, is ongoing. PSE&G expects that TSSIP will identify additional inadequacies in surveillance testing. These additional findings will be appropriately reported to the NRC. PSE&G believes that completion of the TSSIP will preclude future surveillance testing deficiencies. ,

l 3a. Corrective Stoos That Have Been Taken and Results Achieved

a. Test procedures were prepared and previously untested segments of the circuits were tested satisfactorily.

b. This event was reviewed with Licensed Operating personnel with focus on the applicability of TS 4.0.3 and the requirement to implement positive controls when Page 6 of 11 l

1

^

Attechment LR-N95175

' Revised Reply to Notice of Violation l

directed by TSs. In addition, personnel involved have

-been counseled regarding the appropriate level of  !

personal accountability.

c. The. existing-process for reviewing operating experience feedback (OEF) for applicability to Hope Creek was completed by an independent consultant.

Recommendations from this review have been evaluated for implementation based upon the value added to the OEF process. Those recommendations.that will improve the quality of the OEF process will be implemented by February 28, 1996. These recommendations will improve OEF coordination between NBU departments, and result in a more timely review of OEF.

d. The Technical Specification Surveillance Improvement Program (TSSIP) was initiated. Based on the TSSIP review of the Emergency Diesel Generator related logic -

circuits, on November 14, 1995, the TSSIP concluded that although the specified Logic System Functional Test procedure performs a macroscopic functional test of the Emergency Diesel Generator start load shedding and sequencing logic, more specific testing would be required to satisfy the definition and requirements of a Logic System Functional Test. Specifically, all logic paths for the bus undervoltage auxiliary relays, of which the load shedding relays are a subset, are required to be functionally tested. This occurrence is documented in LSk 95-033-00, dated December 14, 1995.

e. Procedure changes have been implemented to ensure the completeness of the Logic System Functional Tests for the underveltage logic circuits,

f. Testing of all vital busses demonstrated compliance with the Logic System Functional Test requirements for i

the undervoltage logic circuits, and showed all required relays and contacts to be operational.

4a. Corrective,Stoos that Will Be Taken to Avoid Further Violations

a. Problems identified during implementation of the TSSIP will be appropriately communicated to the responsible department so that corrective actions can be taken.

i These corrective actions will prevent further violations. The TSSIP will be completed by 12/31/96.

l Page 7 of 11

AttCchment LR-N95175

- Revised Reply-to Notice of Violation l- )

Sa. Date When Full Compliance Will Be Achieved j Full compliance was achieved upon proper completion of the I following surveillance requirements on July 18, 1995: )

1) Surveillance requirement 4.8.1.1.2.h.4.a, simulating a l loss of offsite power by itself and verifying loss of  !

power is detected and de-energization of the emergency busses and load shedding from the emergency busses, and

2) Surveillance requirement 4.8.1.1.2.h.6.a, simulating a loss of offsite power in conjunction with an ECCS actuation test signal and verifying loss of power is detected and de-energization of the emergency busses and load shedding from the emergency busses.

Discussion of Example 11:

2b. Reason for Violation PSE&G has reviewed the circumstances described by the NRC and concurs with the facts cited in the violation, with the exception of the third example as discussed on page seven (7) of this response.

(1) On June 5, 1995, with the plant in Operational 4 Condition 1, credit was improperly taken for TS 4.3.3.1-1.3.c, functional testing of the HPCI Condensate Storage Tank (CST) low level suction transfer instrumentation channels, based on the performance of a single channel calibration. As discussed in LER 95-018-00, dated August 17, 1995, the credited functional test includes both CST level suction transfer instrument channels. The channel calibration procedure includes only one of these two instrument channels but allowed crediting of the functional test. The TS 4.3.3.1-1.3.c test interval was exceeded on July 6, 1995. HPCI was functional but inoperable per TS i 4.3.3.1-1.3.c. TS 3.5.1.c Action Statement requires that with the HPCI System inoperable, the system be returned to operable status within fourteen days or be in at least Hot Shutdown within the following twelve hours. For reasons not related to this issue, the plant entered Operational Condition 4 (Cold Shutdown) on July 7, 1995. Operational Condition 3 (Hot Shutdown) was inadvertently entered on July 8-9, 1995, as reported in LER 95-016-01, dated October 2, 1995.

The reactor steam dome pressure reached was less than 200 psig. HPCI is only required to be operable in Operational Condition 3 when steam dome pressure is greater than 200 psig. The functional test of the Page 8 of 11

l

~

Attnchment LR-N95175 Revised Reply to Notice of Violation l missed channel was successfully performed on July 21, 1995, prior to entering Operational Condition 3 and reaching a steam dome pressure of 200 psig.

This inappropriately credited surveillance tast was self identified during a review of functional test work history initiated following a similar occurrence on July 20, 1995, as discussed on page 7.

(2) On November 13, 1991 and again on May 22, 1993, credit was improperly taken for functional testing of the Residua? Heat Removal (RHR) "A" and "C" Pump Diecharge Pressure (Automatic Depressurization System (ADS)

Permissive) instrument channels based on the performance of a single channel calibration. The I&C Supervisor improperly allowed crediting of the functional test. ADS was functional but inoperable per TS 4.3.3.1-1.4.e until the next functional tests of the missed channels, performed successfully on December 12, 1991 and June 16, 1993.

The ADS circuits affected by these occurrences are part of the ADS initiation logic. Two initiation signals and one permissive signal are used to actuate ADS.

These signals are reactor vessel low water level, high drywell pressure, and RHR and/or Core Spray (CS) pumps running. These permissive pump running signal indicates that RHR and/or CS is available to provide reactor vessel makeup water. In both of the above occurrences, two of the three pump running signals were functional but inoperable per TSs.

These inappropriately credited surveillance tests were self identified during a review of functional test work history initiated following a similar occurrence on July 20, 1995, as discussed in the next example.

(3) On July 20, 1995, with the plant in Operational Condition 4 (Cold Shutdown) , it was self identified during closure of surveillance test documentation that on June 28, 1995 an instrumentation fstnctional test had been improperly credited as complete based on the performance of a channel calibration. The functional test included three instrument channel tests while the channel calibration includes only one of the three instrument channels required by the functional test.

The surveillance would have been overdue on July 20, 1995. On July 8, 1995, for reasons not related to this issue, the plant entered Operational Condition 4.

Operational Condition 3 was inadvertently entered on July 8-9, 1995, as reported in LER 95-016-01, dated Page 9 of 11

Attnchment LR-N95175-

• ' Revised Reply to Notice of Violation l

October 2, 1995. The reactor steam dome pressure reached.was less than 100 psig. ADS is only required to be operable in Operational Condition 3 when steam dome-pressure is greater than 100 psig. Because ADS is not required to be operable in operational Condition 4 or in Operational Condition 3 when the steam dome pressure is below 100 psig, the RHR Low Pressure Coolant Injection (LPCI) Mode Pump Discharge Pressure -

High perm'.ssive for ADS is also not required to be-operable. The improperly credited surveillance requirement was completed on July 21, 1995, prior to changing to Operational' Condition 3 and reaching a steam dome pressure of-100 psig. Therefore, the improper credit of performed testing did not result in a violation of the HCGS TS Surveillance Requirements.

The cause of these events is procedural inadequacy and personnel error. Maintenance supervisory personnel together with the faulty' functional test procedures improperly allowed-crediting of a multi-channel functional test based on performance of a single channel calibration.

3b. Corrective Stoos that Have Been Taken and Results Achieved

a. As an interim corrective action, until procedural errors were corrected, a memo was immediately sent to all I&C Supervisors identifying the twelve functional tests which cannot be credited by completion of a single calibration.

s. The HPCI functional test that was improperly credited on June 5, 1995 was satisfactorily performed on July 21, 1995 prior to reactor startup.

c. All channel calibration procedures have been revised to l include explicit directions regarding the crediting of '

the functional test based on performance of the channel calibration.

d. For multiple channel functional tests, the planning and scheduling organization has added a precautionary note to the associated recurring task work orders to indicate that channel calibrations of multiple channels )

are required to credit the completion of the functional l test. )

l 4b. Corrective Stoos that Will Be Taken to Avoid Further Violations

a. Problems identified during implementation of the TSSIP l will be appropriately communicated to the responsible Page 10 of 11 i

I

, AttOchment LR-N95175 Revis,ed Reply to Notice'of Violation l department so that corrective actions can be taken.

These corrective actions will prevent further l violations. The TSSIP will be completed by 12/31/96. j Sb. Date When Full Comolianco Will Be Achieved 1 Full compliance was achieved upon proper completion of:

1) Surveillance requirement 4.3.3.1-1.3.c, functional testing of the HPCI Condensate Storage Tank (CST) low level suction transfer, on July 21, 1995, and'

2) Surveillance requirement 4.3.3.1-1.4.e, functional testing of the RHR "A" and "C" Pump Discharge Pressure i ADS Permissive, on December 12, 1991 and June 16, 1993. I Page 11 of 11