ML20107C750
| ML20107C750 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 02/11/1985 |
| From: | Cooney M PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC |
| To: | Starostecki R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| References | |
| CON-#185-631 OL, NUDOCS 8502220054 | |
| Download: ML20107C750 (12) | |
Text
r, 4
e PHILADELPHIA ELECTRIC COMPANY 2301 M ARKET STREET P.O'. BOX 8699 PHILADELPHIA. PA.191o1 (2i s) s41502o M. J. COON E Y c u% ",'R!'."oc,,,,,
February 11, 1985 ELECTRIC PRODUCTsON DEP ARTME NT Docket Nos. 50-352 50-353 Inspection Report:
50-352/84-65 50-353/84-14 Mr. Richard W. Starostecki, Director Division of Projects and Resident Programs U.S. Nuclear Regulatory Commission Region I 631 Park Avenue King of Prussia, PA 19406
Dear Mr. Starostecki:
Your letter of January 11, 1985, which forwarded combined Inspection Report No. 50-352/84-65;50-353/84-14 for Limerick-Generating Station Units 1 and 2, contains two items of concern which you requested that we address.
In addition, Appendix A to the combined inspection report contains items which appear not to be in complete compliance with-the Commission's rules and requirements.
Appendix A.to this letter restates.the findings and concerns, each followed by our response.
Should you have~any further questions or require additional information please do not hesitate to contact us.
s.
0054 850211 Very uly yours, hhh DOCK 05000gg2 0
'/
/
Attachment
~
~ cc:
J..T. Wiggins
'See Service List
\\
a
", 50-352/84-65 Docket No. 50-352
'50-353/84-14 Appendix A Concern No. 1
... There have been several instances of problems which apparently have involved personnel errors....
They may be indicative of an adverse trend.
Although these errors have not resulted in any immediate safety problems, the matter is of concern to us and warrants management attention.
Response
PEco management has also been concerned with the nunber of License Event Reports and suspected licensee event reports which have occurred since Unit 1 received the license to operate at low power and has instituted a program aimed at reducing the number of reportable events, with specific emphasis being placed on reducing personnel errors.
This is being done through counseling and disciplinary action, but more importantly, by developing an Operational Excellence Program with tangible rewards for performance improvements.
An analysis of the licensee event reports submitted during 1984 and the suspected licensee event reports under consideration for 1985 reveals 16 and 10 events, respectively, which fall into the category of personnel errors.
There is no singular cause for these personnel errors.
Subcategories which adequately separate those events are:
failure to follow procedures; failure to anticipate results of actions; failure to recognize system interrelationships; failure to perform required testing; or failure to observe changing plant conditions.
While there is no single cause which adequately addresses these subcategories, a common tnread throughout relates to'a
-failure to take the necessary time to perform supportive
-tasks or the task itself due to a ' perceived' urgency to promptly complete assigned tasks.
A concerted effort by plant management has been made to stress to employees that they must take sufficient time to properly evaluate and
_ perform tasks independent of schedule needs.
Attached is a copy of a report prepared by the Independent Safety Engineering Group which addresses personnel errors and causes to identify common root causes, for specific corrective actions.
Concern No.
2.
There is also concern noted
. regarding facility design.
Specifically, it appears that not all of
50-352/84-65 Appendix A 50~353/84-14 Docket No. 50-352 Page 2 the equipment needed to assure habitability of the control room during postulated past-accident situations is identified in technical specifications.
Response
As is indicated in the body of the inspection report, there are four radiation detectors, any of which independently provide isolation of the Control room, two of which also start the Control Room Emergency Fresh Air System (CREFAS) fans.
The precent Technical Specification (3.3.7.1) permits the minimum number of channels (i.e., radiation detectors) to be three.
Under this Technical Specification, a detector could be out-of-service indefinitely, with no Limiting Conditions for Operation in effect.
In this condition, a single faiure could make the system inoperable (i.e., neither CREFAS f ans may start) ; however, the unfiltered outside air supply would still be isolated.
If a second detector becomes inoperable, the Technical Specifications require isolation of the Control Room in the radiation isolation mode within one hour.
The Plant Operations Review Committee (PORC) has discussed this concern and has concluded that it is prudent that with one detector out-of-service, specific corrective action should be taken.
To be in compliance with the intent of the Technical Specifications, with one radiation detector out-of-service, the Senior Staff Engineer on call will be notified and a Maintenance Request Form (MRF) will be written to have the device repaired within 14 days.
PORC formalized this conclusion in a Technical Specification POSITION which has been issued to the licensed operators.
The purpose of these POSITIONS is to provide uniform interpretations of Technical Specifications in those areas where there is potential for misunderstanding.
With regard to Technical Specification 3.3.7.8.1 addressing main control room chlorine detectors:
There are four chlorine detectors which monitor the.outside air intakes for the Control Room ventilation system.
All.four detectors operate the isolation valves, but only two, the C and D detectors, also' start the CREFAS fans.
As described in FSAR Section 9.4.1.1.1.F, for the CREFAS to be operating in the
~
Chlorine-isolation mode, a fan must be running and the isolation valves must have operated.
The Technical Specification requires that two Chlorine Detection Subsystems shall be operable at all times._The PORC' discussed this configuration and concluded that since the C and D Chlorine
-Detectors are the only two detectors which operate both the isolation valves and start the fans, each of these (i.e., C
50-352/84-65 Appendix A 50*353/84-14 Docket No. 50-352 Page 3 or D) comprised a subsystem and that the A and B Chlorine Detectors-provided only a (non-required) backup isolation signal.
PORC formalized this conclusion in a Technical Specification POSITION.
With regard to Technical Specification 3.7.2, the PORC reviewed the operations of the CREFAS and its dependence on the normal HVAC supply and return subsystems with the following conclusion:
A control Room Emergency Fresh Air Supply System subsystem should consist of one filter train and fan and its associated dampers as well as a Supply and Return Flowpath to the Control Room.
Therefore, as long as either return fan from the Control Room is in an operating mode, the CREFAS has an adequate flowpath.
This conclusion was formalized in a Technical Specification POSITION.
In addition to development of these POSITIONS, a request has been made of the Engineering and Research Department to review the Radiation Monitoring and Chlorine Monitoring System Designs and associated Technical Specifications and
.possible changes to these systems towards the goals of maximizing system availability and safety function reliability.
The above referenced Technical Specification PORC POSITIONS were reviewed and approved by PORC on January 15, 1985, and approved by the Station Superintendent on January 22, 1985.
Finding A 10 CFR 50, Appendix B, Criterion III and Section 3 of Volume I of the Limerick Generating Station Quality Assurance Plan require design changes, to be subject to design control measures commensuate with those applied to the original design.
Contrary to the above, the design control measures which have been established did not prevent the disassembly and removal of. required pipe whip restraints labeled _as RIA and RIB on General Electric Drawing ll2D3256 Rev. 2 from the recircualation pump suction lines.
This is.a Severity Level IV violation (Supplement II).
Response
The removal of the restraints'was caused by the existence of two different numbering systems for the Recirculation System
50-352/84-65 Appendix A
,.50j353/84-14 Docket No. 50-352 Page 4 Pipe Whip equipment.
General Electric (GE) had not included number designation for the restraints with the original design information submitted to Bechtel for the pipe whip restraints.
For this reason, Dechtel assigned number designators to the restraints via a field drawing in order to control construction activities.
GE later assigned numbers to the restraints when they supplied the necessary restraint gap dimensions which had been requested by Bechtel.
GE, at this time, also identified the fact that five restraints originally specified were no longer required.
A Startup Work Order (SWO) was prepared and approvcd to install the shims needed to achieve the required restraint gaps and to remove the five restraints which were no longer required.
It was incorrectly assumed by the personnel performing the work that the Bechtel and GE numbering systems were equivalent.
The numbering discrepancy caused two required restraints to be removed (RIA and RIB), two restraints no longer required to be left assembled (R3A and R3B), and nine restraints to be installed with incorrect gaps.
This has been corrected as follows:
Restraints RIA and RID have been installed in accordance with the General Electric design, and the installation has been approved by Quality Control.
Restraints R3A and R3B have been disassembled (rods and shims removed).
The nine restraints installed with incorrect gaps have been evaluated by General Electric and found to be acceptable.
Bechtel drawings and documentation have been revised to coincide with the General Electric number. system for the restraints.
To determine if discrepancies existed elsewhere between General Electric and field generated drawings, a review was performed of field drawings generated to supplement / clarify General Electric design drawings.
This review determined that only the case identified by the violation contained conflicting.information.
In addition, a review has been performed by. Engineering and Research Quality Assurance of the SWO's written for.the Reactor Recirculation system (Startup system 64A) to determine if any similar occurrences existed.
None were found.
To. prevent recurrence, Job Rule 8031-JR-G-30 was revised to
. require the Field to obtain supplementary information for.
vendor drawings by formal request for revisions.
Field drawings may only be used as part of this-request to detail the field requirements.
50-352/04-65 Appendix A 502353/84-14 Docket No. 50-352 Page 5 Finding B Technical Specification (TS) 6.8.1 requires that. procedures be implemented and maintained to control the operation of plant systems and to perform surveillance testing activities.
Procedure S43.lA controls the startup of the reactor recirculation sytem and requires that ST-6-043-390-1 be successfully completed no more than 15 minutes prior to starting a reactor recirculation pump.
Procedure ST-6-043-390-1 is used to verify that the temperature difference limitations of.TS 3.4.1.4. are met prior to starting a reactor recirculation pump.
Contrary to the above:
- 1) on 11/26/84 at about 10:40 a.m.,
procedure S43.lA was not followed in that an operator started the B reactor recirculation pump without first performing ST-6-043-390-1; and, 2) As of 11/26/84, ST-6-043-390-1 did not completely verify compliance with TS 3.4.1.4. in that the ST did not require an assurance that the temperature difference limitation between an idle recirculation loop and the reactor vessel coolant stated in TS 3.4.1.4a, would be met prior to startup of the pump in the idle loop.
This is a Severity Level V Violation (Supplement I).
nonnnnne The "B" Reactor Recirculation Pump-was started on November 26, 1984, without first performing ST-6-043-390-1 as required
~
by proceduce S43.1.A.
As a corrective measurei the responsib'e licensed operator has been. disciplined regarding this failote to. follow procedures.
In addition, the.
' Operations Engineer has discussed this event with.allfof the
[
operating shifts at the shift meetings in order to stress the
~
importance of following-procedures.
To correct the cited difficulties in 2) above,-ST-6-043-390 was revised and re-issued on November 27, 1984, to assure that the requirements of TS 3.4.1.4 are met prior to placing an idle recirculation
-loop.in service.
Finding C l
JTechnical Specification 6.8.l' requires that written procedures-be maintained covering theLactivities-in Appendix L
A of Regulatory Guide 1.33.-
Regulatory Guide 1.33 requires
~
l l
l t
50-352/84-65 Appendix A 50-353/84-14 Docket No. 50-352 Page 6 procedures to control the discharge of effluents from the liquid radioactive waste system.
System procedure S63.1.C governs the release of Floor Drain Sample Tank No. 2 to the cooling tower blowdown line and requires that discharge pipe sample rack 00S368 be in service during releases.
Contrary to the above, on November 28, 1984, the contents of Floor Drain Sample Tank No.2 were released to the cooling tower blowdown line with the discharge pipe sample rack not in service.
This is a Severity Level V Violation (Supplement IV).
Response
This violation, a failure to follow procedures, resulted from the misinterpretation of one of the radwaste control room panel annunciators.
The wording on the annunciator window
" Liquid Radwaste Discharge, Hi-Lo Flow" was read to mean that there was high/ low flow in the radwaste discharge line rather than in the sample line.
When the alarm occurred on October 26, 1984, the investigation did not reveal an abnormal discharge flow condition; therefore, it was postulated that the alarm unit had malfunctioned.
Upon discovery of the meaning of the alarm, the sample pump was activated returning the radwaste sample rack to service.
A review of the laboratory samples, taken from Radwaste Sample Tank No. 2 during the. period that the sample pump was inactive, revealed gross radioactivity below the lower limit of detection (5N7 microcuries/ milliliter).
As a corrective measure, the
' annunciator window has been permanently revised to indicate sample pump flow-Hi/ Low.
Procedure CH-1017, " Procedure for Preparation and Control of Liquid Radwaste Discharge Permits", has been revised to require a signoff by the Radwaste Operator ensuring that the sample rack is properly functioning'and in service.
Finding D Technical Specification 6.8.1 requires that procedures be-implemented and. maintained to control corrective maintenance activities on safety-related equipment and to control the equipment's return to service.
. Administrative Procedure A-41 controls the restoration to service of safety-related equipment following maintenance and
o.
'50-352/84-65 Appendix A 50-353/84-14 Docket No. 50-352 Page 7 requires, in Sections 5.3 and 5.4, that an operational Verification Form be completed prior to declaring the equipment operable.
Administrative Procedure A-26 controls corrective maintenance activities and requires, in Section 5 6 1 5 that the specific test performed after maintenance activities have been completed and the results of these tests be recorded on an Operational Verification Form or otherwise documented on a Maintenance Request Form.
Contrary to the above, procedures A-26 and A-41 were not followed during the restoration to service of the Reactor Protection System power supply breakers in panel 1BC248 on 11/9/84 in that, as of 11/19/84, the operational verfication Form for Maintenance Request Form 840425, which controlled 4
the replacement of these breakers, had not been completed, and the results of all tests performed following restoration were not otherwise recorded on the Maintenance Request Form.
This is a Severity Level V Violation (Supplement 1).
Response
I Testing performed on the Reactor Protection System (RPS) power supply breakers before returning the system to service was completed satisfactorily on routine test RT-ll-04010.
This testing was documented in the " Work Performed" section of Maintenance Request Form (MRF) 8404025 and copies of the RT were appropriately attached.
It was presumed that it was not necessary to repeat this testing as an Operational Verification Form; hence, "none" was entered.
In order to correct this situation, Administrative Procedure A-41 has been revised so that the Operational Verification Form section of the MFR can indicate N/R "Not Required" if adequate testing has been performed and documented in the
" Work Performed" section of the MRP.
f
ATTACHMENT Page 1 0f h TABLE 1 - CAUSES OF INCIDENTS 10/26/84 01/01/85 to 12/31/84 to 01/31/85 CAUSE CODE CATEGORY NUMBER NUMBER
-A.
Personnel Error.
16 (total) ll(total)
~
A-1 Failure to follow procedures, rules, regulations.
.5 5
A-2 Failure to use correct procedure.
A.3 Failure to properly identify equipment.
1 A-4 Failure to properly communicate.
A-5 ' Failure to observe changing-conditions.
2 1
-A-6 Failure to properly interpret information, results. 4 A-7 Failure to perform required inspections / tests.
4 1
3 i
A-8 Failure to properly assess consequences of actions.
-A-9 Other' personnel errors.
.1 i
B..
Design, Manufacturing, Construction / Installation
.20 (total) 11 (total)
Deficiency B-1 ' Code and regulation compliance inadequate.
B-2 Application of design principles inadequate.
.14 4
4
- B-3 Procurement specification inadequate.
B-4 Calculational error.
B-5 Construction / installation error.
.1 B-6' Poor workmanship.
.3 B-7 Quality assurance / control inadequate.
B-8 Manufacturing _ error.
B-9 Failure due to incorrect application of material.
L'B-10 Failure due to abnormal wear.
1 B-ll Component-out of calibration.
B-12 Inadequate' shelf-life / storage.
B-13 Material not in accordance with design / purchase
' specification.
1 p.B-14 Failure'due to normal wear.
5
.B-15 Design does not facilitate testing.
- D-16 Other deficiencies.
.2 5-l.C.
External Causes.
l Failure from lightning strike / tornado / flooding.
{IC-1 L.C-2 Failure from man-made off-site event.
LC-3 Other external cause.
~
D.-
Procedure Deficiency.
.5 (total) 1 (total)-
l_D-1 ~ Incorrect.
.4 1-
'D-2' Did not cover: situation / inadequate.
- D Approved procedure did not exist.
-D Ot'her procedure deficiency.
.1 E.,
Management / Quality Assurance Deficiency.
E-1 Major breakdown;of. administrative controls..
i I-o
ATTACID4ENT Page 2 of 4
- E-2 Major breakdown of preventive maintenance program.
- E-3 Mejor breakdown of surveillance test program.
.E-4.~ Major breakdown of quality assurance controls.
- E-5 -Ilousekeeping inadequacy.
t
-X.
Other.
7 (total) 3 (total)
- X-1 Failure with unknown cause.
- X-2. Test equipment malfunction / misapplication.
'X-3 Failure that cannot be assigned to a classification listed above.
.7 3
s 48 26 1
4 I
4 m
p t'
3 I
I f
a 6
6 4
t 1
7 m
e
_y
,I,
-=
ATTACHMENT I
Page 3 or 4 1
I i'
Table 2 - Detailed Breakdown of Causes 1
A. Personnel Error (27 total) l 4-c A-1: Failure to follow procedure, rules, regulations.
i a) Failure.to_ notify shift before working (2).
.(
b) Procedure not followed (3).
c) Failure to post fire watch (1).
d) Drywell lighting breaker closed (1).
e) Improper movement of mode switch (1).
f) FWCU isolation while swapping demineralizers (1).
i g)-Failure to comply with Tech. Spec. time limits (1).
A-4: Failure to properly communicate (1).
l t
A-5: Failure to observe changing conditions (3).
j I
4 j
A-6: Failure to properly interpret information (4).
A-7: Failure to perform required inspections /tects, a) Failure to-properly-follow Technical Specifications (3).
b) Incorrect evaluation"of test results (1).
c) Failure to perform required tdst (1).
A-8: Other personnel errors.
a) Fire doors left open (1).
b)'Didn't check Tech. Specs. while working on HPCI-pressure transmitters (1).
c) Opened equalizing valve on refuel floor low Delta P Sensor (1).
d) Reactor enclosure low Delta P isolation (1).
B.. Design Manu'facturing, Construction / Installation Deficiency (31 total)
B-2: Application of design principles inadequate.
a). Common process and reference leg valving disturbances' (3).
b) Riley temperature switch problems (6).
c) RPS. Static Inverter problems: (3).
d)' Reactor Enclosure differential pressure sensor location (3)..
e) ' Design,.does ' not f acilitate. testing (1).
f) Inadequately Sized Fuse- (2)..
- B-5: Construction / installation error, a)-Incorrect solenoid. valves (1).
B-6:? Poor workmanship.
'a) Fire penetrations not sealed (2).
b) Bad cri'mping (1).
B-ll: Component out of calibration (1).
ATTACHMENT
' i Page h of 4 B-14: Failure due to normal wear (1).
B-15: Design does not facilitate testing l
a) RWCU isolation while removing jumper (2).
b) Shorted HPCI isolation circuitry while' installing a DVM (1).
c) HPCI Delta T switch leads reversed (1).
d) Scram while valving in core ficw instrument (1).
B-16: Other deficiencies.
a) Refuel Floor HVAC air balance not performed (2).
D.. Procedure Deficiency (6 total)
D-1: Incorrect.
a) Incorrect check-off list (2).
b) ST step incorrectly written (2).
D-2: Did not cover situation / inadequate (1)
D-4: Other procedure deficiency.
a) Procedure doesn't provide proper-guidance (1).
X. Other (10 total)
X-2:. Failure that can't be assigned to another classification.
a) Chlorine detector tape _ broken (5).
b) Blown fuse (1).
c).Visicorder connector failure (1).
d) Voltage regulator card failure on RPS inverter (1).
e) HPCI isolation due-to broken wire (1). _
f) Reactor enclosure HVAC isolation ~due to fuse failure due to slip of jumper.during testing (1).
s
-