ML20132B453
| ML20132B453 | |
| Person / Time | |
|---|---|
| Site: | Crane, Maine Yankee  |
| Issue date: | 12/05/1996 |
| From: | Shirley Ann Jackson, The Chairman NRC COMMISSION (OCM) |
| To: | Myers H AFFILIATION NOT ASSIGNED |
| Shared Package | |
| ML20132B456 | List: |
| References | |
| TASK-2.K.3.30, TASK-2.K.3.31, TASK-TM NUDOCS 9612170220 | |
| Download: ML20132B453 (2) | |
Text
. _ _.
Mgwuok UNITED STATES
&g NUCLEAR REGULATORY COMMISSION WASH 1NoToN, D.C. 20555-0001 December 5, 1996
+..**
CHAIRMAN Mr. Henry R. Myers Post Office Box 88 Peaks Island, Maine 04108
Dear Mr. Myers:
I am responding to your letters of September 4, 13, and 25, 1996, and October 7 and 14, 1996, expressing concerns at the Maine Yankee Atomic Power Station about (1) conformance with Three Mile Island (THI) Action Plan Items II.K.3.30 and II.K.3.31, (2) competence and integrity questions resulting from the licensee's long-standing nonconformance with these two items, (3) whether Maine Yankee is in substantial compliance with U.S. Nuclear Regulatory Commission (NRC) regulations, and (4) whether the overall level of compliance with regulatory requirements endangers public health and safety.
You also ask, " Prior to completion of the criminal process, what administrative actions will the Commission take in response to the licensee's violation of the requirements of THI Action Plan Items II.K.3.30 and II.K.3.31?"
In your September 4 and 13 letters, you reiterate the request you made in your 4
letter of August li, 1996, asking for the Commission's position with respect j
to the regulatory basis for the order of January 3,1996. This order restricted operation of Maine Yankee Atomic Power Station to 2440 megawatts thermal (MWt) with Small Break Loss of Coolant Accident (SBLOCA) requirements specified in TMI Action Plan Items II.K.3.30 and II.K.3.31.
By letter dated October 18, 1996, I replied to your August 14 letter.
In your September 4 letter, you also urge the Commission to address directly the question of whether the level of compliance with regulatory requirements at Maine Yankee has diminished to the point at which protection of public safety cannot be ensured in the manner required by the Atomic Energy Act. As you are aware, the Commission directed that an independent safety assessment (ISA) review be conducted in response to findings made by the NRC's Office of the Inspector General in a report dated May 8, 1996.
The overall goals of the ISA were to (1) independently assess the conformance of Maine Yankee to its design and licensing bases, including appropriate reviews at the site and corporate offices; (2) independently assess operational safety performance, giving risk perspectives when appropriate; (3; evaluate the effectiveness of licensee self-assessments, corrective actions, and improvement plans; and (4) determine the root cause(s) of safety-significant findings and draw conclusions on overall performance.
The ISA team found that overall performance at Maine Yankee was adequate for operation. However, a number of weaknesses and deficiencies were identified that will he evaluated for possible enforcement action.
In coordination with the Region I and NRR staffs, the team concluded that the plant could be operated safely at 2440 MWt, taking into consideration the nature and scope of ft/
the problems identified and the-immediate corrective actions taken by the licensee.
I forwarded the report of the ISA team's efforts to Maine Yankee on d4 October 7, 1996, a copy of which is enclosed.
\\y 9612170220 961205 g
PDR COMMS NRCC T
CORRESPONDENCE PDR (pw9 f()ts ()(~
1DDf6 {}MhW
)
1 Mr. Henry R. Myers,
Before the startup of Maine Yankee in late August 1996, the staff reviewed the licensee's resolution of several design issues raised by the ISA team regarding available net positive suction head fo'r the containment spray pumps and the heat removal capacity of the primary and secondary component cooling water systems. The licensee's corrective actions for these issues at that time addressed operation at 2440 MWt. Therefore, the NRC staff concluded that operation of the plant at this power level did not pose an undue risk to 4
public health and safety. However, further action on these issues will be required before the staff will consider a request from the licensee to allow Maine Yankee to be operateci at power levels up to 2700 MWt.
t As you also know, a public meeting was held at the Wiscasset Middle School on i
October 10, 1996, to discuss the team's findings. Additionally, an open Commission meeting was held on October 18, 1996, in which the managers of the ISA team described the key findings in their report.
During this meeting, the Commission requested the staff to inform the licensee to present its response 1
to these findings and any proposed corrective actions at a future Commission meeting. The NRC staff will evaluate the licensee's response to the findings of the ISA team, as well as other recent issues raised regarding licensed activities at Maine Yankee.
1 Your letters mistakenly ascribe some semantic significance to distinctions in phraseology used in previous correspondence, and ask whether the Commission will affirm that the Maine Yankee plant is in " substantial compliance" with i
NRC regulations. As I noted above, the staff has found that, under current operational limitations, the Maine Yankee plant can be operated without undue risk to public health and safety.
This finding is predicated on an assessment of the licensee's conformance to the Commission's regulations, license 4
conditions (including technical specifications), and orders, and of the ability of the licensee's programs to ensure safe operation.
The staff's finding reflects the judgment that operation in accordance with current license restrictions and authorizations can be conducted with reasonable assurance of adequate protection of public health and safety, the fundamental safety standard under the Atomic Energy Act.
Separate from the ISA issues, the staff is reviewing for appropriate action the recently issued NRC Office of Investigations report (as mentioned in your i
letter) along with its ongoing technical evaluation of the issues that were addressed in the staff's order of January 3, 1996.
In the meantime, the NRC staff is enhancing its oversight of Maine Yankee Atomic Power Company through l~
increased inspection activity.
I trust that you will find this information helpful in understanding the NRC's oversight activities at Maine Yankee.
Sincerely, l
Enclosure:
ISA Team Report
UNITED STATES
[8 k
NUCLEAR REGULATORY COMMISSION WASHINGTON. o.C. 20555-0001 g
g
\\..... j[
October 7, 1996 cHA M AN i O M
Mr. Charles D. Frizzle, President Maine Yankee Atomic Power Company 329 Bath Road Brunswick, Maine 04011
Dear Mr. Frizzle:
I am forwarding the report on the Maine Yankee Atomic Power Station by the The Nuclear Regulatory Commission's Independent Safety Assessment (ISA) team.
purpose of the ISA was to determine whether Maine Yankee was in conformity with its design and licensing bases; to assess operational safety performance; and to evaluate Maine Yankee's self-assessment, corrective actions, and plans for improvement.
Overall performance at Maine Yankee was considered adequate for operation.
However, a number of significant weaknesses and deficiencies were identified that will result in violations. These weaknesses and deficiencies appear to be related to two root causes: economic pressures to contain costs and poor i
problem identification as a result of complacency and a lack of a questioning attitude.
The ISA review was conducted in response to findings made by the NRC's Office 4
of the Inspector General (0IG) in a report dated May 8, 1996.
It included an assessment of the analytic code support provided for Maine Yankee by the Yankee Atomic Electric Company. The OIG report found, among other things, that Maine Yankee had experienced problems with the RELAP/5YA computer code, used for analyzing how the emergency core cooling system would function during a small break loss-of-coolant accident (LOCA), and in response, had modified that code. OIG also found that these problems with the computer code had not been reported to the NRC, as required, and that because of these problems, Maine Yankee's use of the code was not in accordance with NRC requirements.
NRC reviews did not uncover these deficiencies.
The team was large and multi-disciplined in order to provide a thorough, in-depth review.
Its 25 members, led by an NRC manager, included three representatives of the State of Maine. To ensure an independent perspective, the NRC members were selected from NRC offices other than.the Office of a,,
Nuclear Reactor Regulation (NRR) and the NRC's Region I.
Only persons with no The significant prior responsibility for regulating Maine Yankee were chosen.
e team's management reported to me.
g.
-Q
i 2
5 The ISA team was on site at Maine Yankee between July 15 and 26, 1996, and again between August 12 and 23, 1996.
During these time periods, team members 9
also conducted assessments at Maine Yankee's corporate headquarters in Brunswick, Maine, and at the Yankee Atomic Electric Company offices in Bolton, Massachusetts.
J
]
The ISA team reviewed the use of selected analytic codes.for performing non-LOCA safety analyses, as well as the capability _of the safety-related support j
systems to perform in accordance with the assumptions made in those analyses.
The review determined that the conditions of approval in NRC Safety Evaluation 2
Reports have been met although weaknesses in documentation and validation of l
plant specific code applications are vulnerabilities which warrant your
)
attention.
2 l
The team determined that cycle-specific core performance analyses were excellent. However, weaknesses were found in more complicated, less frequently performed system safety analyses. These weaknesses did not cause l
the results to exceed Maine Yankee's design and licensing bases. However, the team questioned the capability of the containment spray system and the component cooling water systems to meet the design basis assumptions for a i
LOCA initiated from greater than 2440 MWt. These issues, along with the l
RELAP/5YA deficiencies, will be reviewed by NRC's Office of Nuclear Reactor j-Regulation.
The team identified significant deficien:ies in the areas of maintenance' and l
engineering, as well as weaknesses in the overall approach to testing and the i
corrective action program.
Specifically, the lack of routine testing of certain safety systems resulted in the existence of a significant defickncy of which Maine Yankee was unaware.
In addition, the ISA noted certain design Either Maine Yankee was unaware of these errors, or it was aware of l
errors.
them and had failed to take action to address them.
1 I should add that Maine Yankee deserves credit for having formed a counterpart l-team of highly qualified personnel to interface with the ISA team during its j
review. The existence of this team was both helpful to the ISA team's i
activities and valuable as a means of ensuring that Maine Yankee learned as much as possible from this effort.
In addition, it meant that as problem areas were identified, Maine Yankee was in a position to devote resources promptly to necessary corrective actions.
We have scheduled a meeting for October 10, 1996, during which we will discuss the assessment and respond to questions you may have.
I request that l
following this meeting, you determine the actions needed to ensure the long-i term resolution of the deficiencies noted.
I also request that by j
December 10, 1996, you provide to the Commission your plans for addressing the root causes of the deficiencies identified by the ISA. The NRC's Region I asid its Office of Nuclear Reactor Regulation will be responsible for followup of 6
l o, the issues identified in this assessment, in terms of overseeing corrective actions and taking any enforcement action deemed appropriate.
4
)
1 t
t I
3 In accordance with 10 CFR 2.790(a), a copy of this letter and the enclosure will be placed in the NRC Public Document Room.
Should you have any questions concerning this assessment, I would be pleased to discuss them with you.
.f 1
l b.
Sincerely,
[;* /~%
i
/bi I
,? (t s y 4
Enclosure:
independent Safety Assessment Report for Maine Yankee Atomic Power Company 1
4 t
cc:
See page 4 l
- i s
1 1
e i
l i
(
i l
4 i
i t
i.
4 4
4 s
4
_w,,-
,,a
4 1
4 cc w/ enclosure:
Mr. Charles B. Brinkman Mr. Christopher R. Shaw Manager - Washington Nuclear Plant Manager Operations Maine Yankee Atomic Power Station ABB Combustion Engineering P.O. Box 408 12300 Twinbrook Parkway, Suite 330 Wiscasset, ME 04578 Rockville, MD 20852 Mr. G. D. Whittier, Vice President Thomas G. Dignan, Jr., Esquire Licensing and Engineering Ropes & Gray, Maine Yankee Atomic Power Company One International Place 329 Bath Road Boston, MA 02110-2624 Brunswick, ME 04011 Mr. Uldis Vanags Mr. Patrick J. Dostie State Nuclear Safety Advisor State of Maine Nuclear Safety i
State Planning Office Inspector State House Station #38 Maine Yankee Atomic Power Station Augusta, ME 04333 P.O. Box 408 Wiscasset, ME 04578 4
Mr. P. L. Anderson, Project Manager Yankee Atomic Electric Company Mr. Graham M. Leitch 580 Main Street Vice President, Operations Bolton, MA 01740-1398 Maine Yankee Atomic Power Station P.O. Box 408 Regional Administrator, Region I Wisca; set, ME 04578 U.S. Nuclear Regulatory Commission 475 Allendale Road Mary Ann Lynch, Esquire King of Prussia, PA 19406 Maine Yankee Atomic Power Company 329 Bath Road First Selectman of Wiscasset Brunswick, NE 04578 Municipal Building U.S. Route 1 Mr. Jonathan M. Block Wiscasset, ME 04578 Attorney at Law P.O. Box 566 Mr. J. T. Yerokun Putney, VT 05346-0566 Senior Resident inspector Maine Yankee Atomic Power Station Mr. James R. Hebert, Manager U.S. Nuclear Regulatory Commission Nuclear Engineering and Licensing P.O. Box E Maine Yankee Atomic Power Company Wiscasset, ME 04578 329 Bath Road Brunswick, ME 04578 Friends of the Coast P.O. Box 98 Edgecomb, ME 04556
l d
I l
p#"%
't United States 1
o i
5 i Nuclear Regulatory Commission
%,...../
1 I
q INDEPENDENT SAFETY ASSESSMENT 1
i OF MAINEYANKEE ATOMIC POWER COMPANY
)D:
aam; m.-
j
\\";[:i $$'.$?)'(
,.,,'. 4
.. y f"
fJ.Rhs:%*'.
~n nc
^- ' '
'.. ~-
^
~
f 3.-
^
- r;. p g a.
)
.g:.;' y.f:w-;n~,,
A,. -
y mQ
- .q s
l
. w-.
m --..
t
.,,p l
n
=
J
.,G.*
,.g..
. n, 4 *e.
1
,J
" 'j.
}
October 1996
/ f 1/?
f
a Licensee:
Maine Yankee Atomic Pcwer Company Facility:
Maine Yankee Atomic Power Station i
~
Location:
Wiscasset., Maine Docket No:
50-309 Onsite Evaluation Period:
July 15-26, 1996, and August 12-23, 1996 Team Manager:
Edward L. Jordan Team Leader:
Ellis W. Merschoff Administrative Assistant:
Ola B. West Team Members:
Larry Bell John R. Boardman Russell L. Bywater, Jr.
Harold 0. Christensen George M. Hausman John V. Kauffman Kriss M. Kennedy G. Norman Lauben Ronald L. Lloyd Alan L. Nadison Thomas 0. Martin Peter J. Prescott Jack E. Rosenthal State Representatives:
David Decrow Patrick Dostie Uldis Vanags Contractors:
George Cha Robert Christie Cyril Crane Brian Haagensen Michael Shlyamberg Leonard Ward lO!7!96 Submitted By:
Ellis W. Merschoff, T eader Date MN
/4 95 Approved By:
~
Date Edward C/ ordan, Team Manager
/
-- - ~ -
4 i
TABLE OF CONTENTS v
i EXECUTIVE
SUMMARY
1.0 INTRODUCTION
1 1.1 Background..........................
1 1
1.2 Scope and Objectives.....................
2 1.3 Methodology 1.4 Facility Description.....................
3 3
1.5 Organization.........................
2.0 CONFORMANCE TO DESIGN AND LICENSING BASIS 4
2.1 Transient and Accident Safety Analyses 4
4 2.1.1. Analytic Code Support 2.1.2 SER Conditions Satisfied But Not Documented 8
2.1.3 Control Element Assembly Drop Transient........
.8 2.1.4 Main Steam Line Rupture................
10 2.1.5 Lack Of A Documented Process To Demonstrate Code 13 Capability 13 2.2 Design Review Of Selected Systems 2.2.1 High-Pressure-Safety Injection (HPSI) System 13 2.2.1.1 HPSI System Description 13 2.2.1.2 Flow Testing.................
13 2.2.1.3 Throttle Valve Settings 15 2.2.1.4 CS System Support to the HPSI System 15 2.2.2 Service Water / Component Cooling Water 17 2.2.2.1 System Description..............
18 2.2.2.2 Availability of Seawater Flow Into the Service Water Intake Structure........
18 2.2.2.3 Service Water Pump NPSH 18 2.2.2.4 Circulating Water Pump House Flooding 18 2.2.2.5 Residual Heat Removal (RHR) Heat Exchanger Thermal Transient................
18 2.2.2.6 SW and PCCW/SCCW Integrated Operation 19 2.3 Electrical and Instrument and Controls............
21 2.3.1 115 kV Offsite Power Lines..............
21 2.3.2 Degraded Grid Undervoltage Relay Calibration 23 Tolerance Band....................
2.3.3 Electrical Protection, Coordination, and Cable Selection.......................
23 2.3.4 125 Volt de Vital Station Batteries 24 2.3.5 Emergency Diesel Generator Electrical Loading 24 25 2.3.6 Electrical Calculations 2.3.7 Inadequacies in Ventilation Systems 25 2.3.7.1 Protected Switchgear Room Ventilation 26 2.3.7.2 Spray Building Ventilation Deficiencies 28 2.3.8 Procedure for Cross-Connecting DC Buses 29 2.3.9 Environmental Qualification (EQ) Program.......
29 2.3.9.1 EQ Submergence................
29 2.3.9.2 EQ/RG 1.97 Instrument Qualification 30 ii
30 l
2.3.9.3 Backlog Of EQ Items 31 i
2.4 FSAR Inconsistencies.....................
31 2.4.1 Spent Fuel Pool Heat Exchanger Rating 1
2.4.2 Atmospheric Steam Dump Rated For 2.5 Percent Power..
32 33
3.0 ASSESSMENT
OF OPERATIONAL SAFETY..................
33 3.1 Operations Assessment 3.1.1 Problam identification / Problem Resolution 33 4
3.1.1.!
Operator Workarounds and Compensatory 33 rctions.....................
34 3.1.1.2 Control Room Staffing 35 3.1.2 Quality Of Operations 3.1.2.1 Control Room Observations 35 35 3.1.2.2 Safety Systems Walkdowns...........
3.1.2.3 Management Oversight of Operations......
36 36 3.1.2.4 Risk Management 36 3.1.2.5 Operability Determinations..........
3.1.2.6 Technical Specification Interpretations 37 38 3.1.2.7 Post-Trip Reviews 38 3.1.3 Programs And Procedures 38 3.1.3.1 Emergency Operating Procedures........
39 3.1.3.2 Configuration Controls............
40 3.1.3.3 Restart Readiness Program 40 3.1.3.4 Operations Performance Assessment Pregram 40 3.1.4 Plant Support....................
40 3.1.4.1 Fire Protection Program 41 3.1.4.2 Training Program...............
3.1.4.3 Radiation Protection Program.........
41 42 3.2 Maintenance And Testing Assessment..............
42 3.2.1 Equipment Performance..............
3.2.1.1 Equipment Performance of Auxiliary Feedwater, Emergency Feedwater, High Pressure Safety Injection, and Emergency Diesel Generators 42 3.2.1.2 Equipment Performance Demonstrated Through 45 Pump and Valve Testing 3.2.1.3 Containment Perfomance Demonstrated Through 10 CFR 50 Appendix J Leak Rate 45 Testing..................
3.2.1.4 Equipment Problems Trending Upwards....
45 3.2.1.5 Plant Walkdown Observations 46 3.2.2 Problem Identification And Resolution......
47 48 3.2.3 Quality of Maintenance 49 3.2.4 Testing Weaknesses 3.2.5 Maintenance Work Order Control 53 3.2.5.1 Use Of Probabilistic Risk Assessment 54 Methodologies...............
54 3.2.5.2 Work Planning And Tracking 55 3.3 Engineering Assessment....................
3.3.1 Identification And Resolution Of Problems.......
55 56 3.3.2 Engineering Programs iii
3.3.2.1 Engineering Modifications And Temporary Modifications..................
57 3.3.2.2 Erosion / Corrosion (E/C) Program 57 3.3.2.3 -Service Water Operational Performance 58 Inspection 3.3.3 Design-Basis Information...............
58 59 i
3.3.4 Quality Of Engineering 4.0 SELF ASSESSMENT, CORRECTIVE ACTIONS. PLANNING, AND RESOURCES....
61 61 4.1 Self Assessment.......................
64 4.2 Corrective Actions 4.2.1 Probl em Eval uation..................
64
- 4. 2. 2 Probl em Re s ol uti on..................
65 4.3 Pl anning And Resources....................
66 66 4.3.1 Plans 4.3.2 Economic Environment.................
67 4.3.3 Results Of Resource Constraints 68
5.0 CONCLUSION
S............................
70 70 5.1 Licensing And Design-Basis 5.2 Operational Safety......................
70 5.2.1 Operations......................
70 70 5.2.2 Maintenance And Testing 71 5.2.3 Engineering 5.3 Root Causes Of Significant Findings 71 5.3.1 Root Cause 1: Economic Pressure...........
71 5.3.2 Root Cause 2: Problem Identification 71 6.0 REGULATORY ISSUES.........................
73 6.1 Analytic Code Validation...................
73 6.2 Compliance With Safety Evaluation Reports 73 73 6.3 Licensing Reviews For Power Uprates 6.4 Safety Guide 1........................
74 74 6.5 Inspection Program......................
7.0 EXIT MEETINGS........................
75 76 APPENDICES...............................
iv
i EXECUTIVE SUMARY l
Background
l' In December 1995, the Union of Concerned Scientists forwarded anonymous allegations to the State of Maine, and the State submitted the allegations to the NRC. The allegations were that Yankee Atomic Electric Company knowingly i
)
performed inadequate analyses to support an increase in the rated thermal
. power at.which Maine Yankee Atomic Power Station (MYAPS) may operate. After performing a technical review, the 1RC Office of Nuclear Reactor Regulation (NRR) issued a confirmatory order su January 3, 1996, limiting power operation at the plant to the original licensed power level of 2440 Wt.
f The NRC Office of the Inspector General (OIG) completed an inquiry into this l
allegation on May 8,1996. OIG established that MYAPS had experienced problems with, and made modifications to, the RELAP/5YA computer code which l
)
was used in the emergency core cooling analysis for a small-break loss-of-l coolant accident. OIG also reported wakrasses in the NRC review and followup j
activities which contributed to NRC failure to detect these' deficiencies.
In response to these findings, as well as to respond to concerns by the Governor of Maine about the safety and the effectiveness of regulatory oversight of j
MYAPS, the NRC Chairman initiated an independent safety assessment of MYAPS.
This assessment was to be performed by a team comprised of staff who were independent of any recent or significant regulatory oversight responsibility 1
j for MYAPS. Additionally, the assessment was to be coordinated with the State l
of Maine to facilitate participation by State representatives consistent with l
the Commission's policy on cooperation with States at commercial nuclear power plants (57 FR 6462, February 25,1992).
p i
Licensing and Design-Basis Maine Yankee was in general conformance with its licensing-basis although significant items of non-conformance were identified. The licensing-basis was j
understood by the licensee but lacked specificity, contained inconsistencies, j
and had not been well maintained.
i The use of analytic codes for safety analyses was very good. Cycle specific l
core performance analyses were excellent. More complicated, less frequently performed safety analyses contained weaknesses, but the analyses were found to i
be acceptable based on compensating margin. Conditions of use specified in j
the safety evaluation reports were found to be satisfied, but not documented.
The quality and availability of design-basis information was good overall.
Despite uncorrected and previously undiscovered design problems, the design-j basis and compensatory measures adequately supported plant operation at a l
power level of 2440 Wt. However, the team could not conclude, and the licensee did not demonstrate, that at a power of 2700 M t the design-basis assured adequate NPSH for the containment spray pumps and the heat removal capability of the component cooling water system in the event of a loss-of-j coolant accident.
i
,f y
1 1
Operations Performance in the area of operations was very good, with strengths noted in the areas of operator performance during routine and transient operating
^
conditions; shift turnovers and pre-evolution briefs; use of risk information j
to assure safe operations; and the involvement of management in day-to-day i
operations. Weaknesses were noted in the area of "workarounds" and compensatory measures which unnecessarily burdened the operators or complicated their response to transient conditions. Additionally, log keeping practices and post-trip reviews lacked rigor.
Maintenance and Testing Performance in the area of maintenance was good overall however, testing was weak.
The results of the review of equipment reliability for the auxiliary faedwater, emergency feedwater, high pressure safety injection, and emergency diesel generator systems showed mixed equipment performance. Strengths were noted in the areas of knowledge and use of risk methodologies for planning, prioritizing, and scheduling work; the control and limited use of temporary sealants; and a motivated and dedicated work force. Although material condition was considered good overall, a number of significant material condition deficiencies were noted as was a decline in material condition following the 1995 steam generator tubing outage.
Inadequacie: in the scope of testing programs were identified, as were weaknesses in the rigor with which testing was performed and in the evaluation of testing results to demonstrate functionality of safety equipment. A lack of a questioning attitude and stressed resources resulted in the use of poor surveillance procedures and ineffective evaluation of surveillance test data.
Engineering The quality of engineering work was mixed but considered good overall.
Strengths were noted in the capability and experience of the engineering staff, day-to-day engineering support of maintenance and operations, in the quality of most calculations, and in the routine use and application of analytic codes. However, engineering was stressed by a shortage of resources, and there was a tendency to accept existing conditions. Specific weaknesses were noted with inconsistent identification and resolution of problems, inadequate testing, and work on some calculations and analytic codes.
Self Assessment and Corrective Actions Weaknesses were identified in the areas of problem identification and resolution. While licensee self-assessments were generally good, they occasionally failed to identify weaknesses or incorrectly characterized the significance of the findings. Additionally, some corrective actions were not timely and others were ineffective, leading to repetitive problems.
Licensee planning was generally effective, although some weaknesses were found in the overall implementation of improvement plans.
Some economic pressures resulted in limitations on resources, which impaired the licensee's ability to complete vi
i f
improvement projects that affected plant safety.
Equipment problems were not resolved and improvement programs were not effectively implemented because the licensee perceived them to be of low safety significance.
4
!~
Root causes and 'Overall Conclusions While overall performance at Maine Yankee was adequate for operation, a number J
l of deficiencies were identified by the team in each of the areas assessed.
i These deficiencies, which included weak identification and resolution of problems; weak scope, rigor, and evaluation of testing; and declining material
=
~
condition stenused from two closely related root causes. These root causes i
were (1) economic pressure to be a low-cost energy producer has limited available resources to address corrective actions and some plant improvement j.
upgrades and (2) there is a lack of a questioning culture which has resulted i
in the failure to identify or promptly correct significant problems in areas perceived by management to be of low safety significance.
l The economic pressures discussed in Section 4.3 resulted in limitations on
]
resources and interfered with the licensee's ability to complete projects and I
other efforts that would improve plant safety and testing activities.
Examples include the failure to adequately test safety related components (Section 3.2.4); the long-standing deficient design conditions, such as the undersized atmospheric steam dump valve (Sections 3.1.3.1 and 3.3.1) and i
l environmental qualification issues (Section 2.3.9); and the lack of effective improvement programs, such as the design basis reconstitution program (Sections 3.3.3 and 4.3.'4).
These and other examples discussed in the report j
illustrate the licensee's willingness te accept existing conditions, many of 1
which became operator workarounds (Section 3.1.1.1).
Examples of issues which illustrate complacency and the failure to identify or promptly correct significant problems, include previously undiscovered deficient conditions of the service water and auxiliary feedwater water l
systems (Section 3.2.2); inadequacies in ventilation systems (Section 2.3.7);
post-trip reviews which lacked rigor and completeness (Section 3.1.2.7);
emergency operating procedures that may not adequately address an inadequate core cooling event and a steam generator tube rupture under certain conditions (Section 3.1.3.1); lack of a questioning attitude during test performance and i
evaluation that was not conducive to discovering equipment problems, but rather to accepting equipment performance (Sections 2.2.1, 3.2.2, 3.2.4); and i
i licensee self-assessments that occasionally failed to identify weaknesses, or incorrectly characterized the significance of findings (Section 4.1).
In addition, some corrective actions were not timely and others were ineffective, j
leading to repetitive problems (Section 4.2).
i j
vii i
5
i
1.0 INTRODUCTION
- i..
1.1 Background
I In December 1995, the Union of Concerned Scientists forwarded anonymous allegations to the State of Maine, and the State submitted the allegations to j
the NRC. The allegations were that Yankee Atomic Electric Company knowingly performed inadequate analyses to support an increase in the rated thermal i
power at which Maine Yankee Atomic Power Station (MYAPS) may operate. After
~
performing a technical review, the NRC Office of Nuclear Reactor Regulation (NRR) issued a confirmatory order on January 3, 1996, limiting power operation j
at the plant to the original licensed power level of 2440 MWt.
l The NRC Office of the Inspector General (OIG) completed an inquiry into this l
allegation on May 8,1996. OIG established that MYAPS had experienced problems with, and made modifications to, the RELAP/5YA computer code which j
was used in the emergency core cooling analysis for a small-break loss-of-coolant accident. The problems and subsequent modifications were not reported to the NRC as is required and the code was not used in accordance with the i
Safety Evaluation Report and with the Three Mile Island Action Plan Item II.K.3.3.1.
OIG also reported weaknesses-in the NRC review and followup i
activities which contributed to NRC failure to detect these deficiencies.
l The RELAP issue raised a question of whether similar problems existed in other i
areas.
In order to address this question, as well as to respond to concerns by the Governor of Maine about the safety and the effectiveness of regulatory oversight of Maine Yankee, the NRC Chairman initiated an independent safety i
assessment of MYAPS.. This assessment was to be performed by a team comprised l
of staff who were independent of any recent or significant regulatory oversight responsibility for Maine Yankee. Additionally, the assessment was to be coordinated with the State of Maine to facilitate participation by State i
representatives consistent with the Commission's policy on cooperation with States at commercial nuclear power plants (57 FR 6462, February 25,1992).
i The RELAP issue was the subject of a separate NRC investigation and was not 1
j considered part of this assessment.
1.2 Scope and Objectives I
On May 31, 1996, the staff was directed to perform an independent evaluation i
of Maine Yankee's safety performance. The overall goals of the independent l
safety assessment were to:
(1) independently assess the confomance of MYAPS to its design and licensing bases including appropriate reviews at the site and corporate offices; (2) independently assess operational safety performance giving risk perspectives where appropriate; (3) evaluate the effectiveness of licensee self-assessments, corrective actions, and improvement plans; (4) j determine the root cause(s) of safety-significant findings and draw j
conclusions on overall performance.
i i
1 i
L
_ ~._
h i
1.3 Methodology The Independent Safety Assessment (ISA) team comprised 25 members: 16 NRC members, 3 State of Maine members, and 6 contractors. The team was organized with five functional area leaders reporting to a team leader.
The team leader reported to the team manager who reported directly to the NRC Chairman. The team devoted several weeks to preparation that included team meetings and ISA team members were independent of both the NRC Region I office and NRR. The j
~
briefings by the staffs from Region I, NRR, the Office for Analysis and Evaluation of Operational Data (AE00), the Office of Investigations and OIG.
3 i
on July 15, 1996, the team began a two-week evaluation at the facility, including the~ corporate office and the Yankee Atomic Electric Company offices.
The team returned to Maine Yankee on August 12, 1996, for an additional two j
weeks of eviluation. The representatives from the team met daily with their licensee counterparts to discuss team findings.
4 In addition to the State of Maine's participation in the assessment, the State had a two-member process team observe at key assessmer.t milestones. The process team provided the State with an assessment of the.ISA relative to its fairness, balance, and objectivity. The State also had a special five-member citizen's review team periodically briefed on the ISA team status. The citizen's review team provided the State advice on and interpretations of the ISA team process and findings.
An indepth assessment was cenducted in the areas of plant operations, 4
maintenance, testing, engineering, analytic code support, and self-assessment i
and corrective actions. The assessment consisted of interviews; system walkdowns; extended control room observations; system reviews of service 1
water, high pressure safety injection, and emergency diesel generators; program, process, and procedure reviews; and analytic code reviews.
In addition, an extensive reliability analysis of auxiliay feedwater, emergency feedwater, high pressure injection, and emergency diesel generator systems was performed. Emphasis was placed on identifying both licensee strengths and performance weaknesses.
The assessment relied on the existing NRC benchmark for assessing performance utilized in the NRC Systematic Assessment of Licensee Performance Program (SALP).
Specifically:
Superior performance is defined as follows:
Licensee attention and involvement have been properly focused on safety and resulted in a superior level of safety performance.
Licensee
]
programs and procedures have provided effective controls. The licensee's self-assessment efforts have been effective in the identification of emergent issues. Corrective actions are technically sound, comprehensive, and thorough.
Recurring problems are eliminated and resolution of issues is timely.
Root cause analyses are thorough.
1 m
e
--_.-.- =--
Good performance is 4 fined as follows:
e Licensee attention and involvement are normally well focused and resulted in a good level of safety performance. Licensee programs and procedures normally provide the necessary control of activities, but deficiencies may exist. The licensee's self-assessments are normally good, although issues may escape identification. Corrective actions are usually effective, although some may not be complete.
Root cause analyses are normally thorough.
Acceptable performance is defined as follows:
e i
Licensee attention and involvement have resulted in an acceptable level of safety performance. However, licensee performance may exhibit one or more of the following characteristics. Licensee programs and procedures l
have not provided sufficient control of activities in important arear.
l The licensee's self-assessment efforts may not occur until after a 1
potential problem becomes apparent. A clear understanding of the safety implications of significant issues may not have been demonstrated.
Numerous minor issues combine to indicate that the licensee's corrective l
action is not thorough. Root cause analyses do not probe deeply enough, resulting in the incomplete resolution of issues.
One area of this assessment, review of the use and application of analytic codes, is not typically reviewed as part of the NRC regulatory process.
Consequently, a panel of acknowledged experts in the area of code development j
l l
and phenomenology were assembled and provided a critical review of the findings and observations of the ISA team in this~ area.
1.4 Facility Description The Maine Yankee Atomic Power Station is located in the tidewater area on Bailey Point Road in Wiscasset, Maine. The plant is a Comisustion Engineering pressurized-water reactor. The facility was constructed by Stone & Webster, which also served as the architectural engineer. The full power operating license was issued on June 29, 1973.
l 1.5 Organization l
The Maine Yankee Atomic Power Station is owned and operated by the Maine l
Yankee Atomic Power. Company. The chart, Appendix B, illustrates the Maine l
Yankee organizational structure for management and support of the Maine Yankee l
l Atomic Power Station.
e 3
2.0 CONFORMANCE TO DESIGN Als LICENSING BASIS This section describes the conformance of Maine Yankee to its design and licensing-basis. Significant aspects of the design of Maine Yankee were based on handling " worst case" situations such as a postulated rupture of a main steam line or a large break of reactor coolant system piping along with additional assumptions, such as, the failure of mitigating equipment coincident with a loss of offsite power. This approach establishes the deterministic licensing basis. This deterministic approach along with conservative design, effective maintenance, and thorough testing provides an inherent margin of safety and defense-in-depth to cope with actual transients and accidents that may occur.
To confirm plant conformance to the licensing basis, the team reviewed transient and accident analyses (see Section 2.1), and equipment design issues (see Sections 2.2 and 2.3). Discrepancies between actual operations, safety analyses, design features and capability, and descriptive and numerical values contained in the Final Safety Analyses Report (FSAR) are suusarized in Section 2.4.
2.1 Transient and Accident Safety Analyses l
Cycle-specific core performance analyses, such as the Control Element Assembly (CEA) drop transient described below, were excellent.
More complicated, less frequently performed systems safety analyses contained weaknesses, such as those associated with the steam line rupture accident, but the analyses were found to be acceptable based on compensating margin.
Overall, use of analytic codes for safety analyses was very good. SER conditions were found to be satisfied but not documented. Code validation was mixed: excellent for physics and fuel codes, while weak for systems codes.
2.1.1. Analytic Code Support The team evaluated the analytic code support provided by Yankee Atomic Electric Company (YAEC) for Maine Yankee Atomic Power Company (MYAPCo) to assure that Maine Yankee was operated within the bounds of the safety analyses. This assessment was performed by reviewing the YAEC process for conducting non-LOCA safety analyses described in Chapter 14 of the FSAR, and an indepth review of two specific safety analyses: the CEA drop transient and the steam line rupture accident.
Selection of the dropped CEA transient for in-depth review provided a structured means to examine many of the codes used by YAEC while selection of the steam line rupture analysis for review provided a forum for reviewing a dynamic accident analyzed with a complex systems code.
The overall review included:
(1) identification of the design-basis analyses for postulated accidents and anticipated operational occurrences, (2) identification of codes, methods, and limitations, based on the team's review of topical reports and NRC safety evaluation reports (SERs), (3) an assessment of how limitations, restrictions, and boundary conditions are reflected in the safety analyses. Central to the assessment was the verification that conditions of approval contained in NRC SERs had been satisfied in the safety 4
analyses. The ISA team also specifically examined code validation using guidance contained in Generic Letter (GL) 83-11, " Licensee Qualification for Performing Safety Analyses in Support of Licensing Actions," February 8,1983.
All analytic codes used for the current fuel cycle (Cycle 15) reference analyses, and a matrix of codes and transient and accident analyses applications are shown in Tables 1 and 2, respectively. Analytic methods are listed in Maine Yankee Technical Specification 5.14.2 and in the Core
~
Performance Analyses Report for Cycle 15 (YAEC 1907, Revision 2), which is also Appendix D of the FSAR. As indicated in Table 1, " Maine Yankee Analytical Codes for Fuel Cycle 15", most SERs contained conditions of approval. Table 2, Codes Used for Key Transients, shows the application of the i
j codes and methods to specific transient and accident analyses.
\\
i i
D e
4 0
5
Table 1 NAINE YANKEE ANALYTIC CODES FOR FUEL CYCLE 15
~
CODE NAME FWCTION No. Of SER COM ITIONS" CASMO-3G Physics 1
SIMULATE-3 Physics 2
STAR:
Physics - Space / Time 2
FROSSTEY Fuel Performance 4
COBRA-IIIC Generic Core and Fuel Hydraulic 11" COBRA-IIIC Plant Core and Fuel Hydraulic 0
Specific YAEC-1 CHF Critical Heat Flux Correlation 2
SCU Statistical Uncertainties Applied 0
to Thermal Margin Setpoints RETRAN 02 Mod 2 System Thermal Hydraulic 39 Generic RETRAN 02 Mod 2 System Thermal Hydraulic 0'
Plant Specific BIRP Reactivity Balance 0
CHIC-KIN Integrated Single Channel Fuel, 0
T/H, Physics GEMINI-II System Thermal Hydraulic 5
m SER conditions are limitations, application restrictions, and verification and validation issues within which the code and application are judged acceptable to the staff.
" Conditions for COBRA-IIIC Generic are imposed by the author and are described in the Topical Report BNWL-1695.
0 6
j i
/
X
)
CT IS H
C 2
0 NA2 X
X HC s
n o
i t
a U
C X
X X
X X
X X
l u
S c
l a
c 1
t F
n C
H X
X X
X X
X X
e s
E C
i t
A n
Y s
e na is r
n t
a T
r N
e h
T I
O X
X X
X X
X X
t 2
y P
e T
l S
e K
E l
7 P
a b
r R S l
a o
r T
f o
C f
d I
e I
t s
I u
X X
X X
X X
X p
U
-A n
s R
i e
B d
O e
o C
ra C
pe I
r I
p I
o N
X X
X X
X t
I M
d E
e G
su er 2
a
-Y 3
E T
X X
X X
X X
X E
S T
S A
O L
R U
F M
I S
R L N O
d A O T
n W
I W R D
E N AE a
A T O O D A R O RR R U L T A O MU I
EU G
"T D L F O O L R AT T NT 3
N P H I
O T D F F FT TU E GU O
I R
I O D S O OA SR J R
M S
D W N E S W
E M S
N O S Z E S SD NE AE A
A A A R S I
C S SE IN A EB C
2.1.2 SER Conditions Satisfied But Not Documented The ISA team found that YAEC calculations of transients and accidents i
conformed to all applicable SER conditions. In some cases SER conditions were j
explicit and readily verified. In other cases SER conditions were requests to provide justification for certain models, the selection of correlations, and inputs. In these cases the ISA team reviewed the conditions within the context of the code application.
VAEC did not have a written process to document how safety analyses conformed to SER conditions. Some conditions were clearly known, considered, and used by YAEC. Other conditions could not be shown to be satisfied until additional analyses, assessments, and sensitivity studies, were accomplished in response to ISA requests. This new work demonstrated that all SER conditions had been satisfied, although the disposition of some issues required reliance on the known conservatisms in specific accident analyses.
2.1.3 Control Element Assembly Drop Transient The CEA drop transient analysis which used many of the YAEC codes and methods, was performed in an excellent manner.
~
The CEA drop was one of the 10 non-LOCA transients nonnally reanalyzed for each cycle. The following set of NRC-approved codes and methods was used:
CASM0-3G/ TABLES-3, SIMULATE-3, FROSSTEY-2, GEMINI-II, COBRA-IIIC (YAEC-1 DNB),
Reactor Protective System (RPS) setpoint methodology, and Statistical Combination of Uncertainties (SCU).
Predicted fuel bundle and fuel rod power distributions were obtained from the physics code SIMULATE-3, which in turn used neutron cross sections from CASMO-3G. An ISA team review of predicted and measured fuel bundle power distributions showed excellent agreement over several fuel cycles.
FROSSTEY-2 was.a steady-state fuel performance code used to calculate margin to fuel centerline melt using bounding values from a large number of fuel rod powers and power shapes. The FROSSTEY-2 SER review was performed by the authors of its predecessor code, GAPCON-THERMAL. There were numerous iterations between YAEC and the reviewers, and substantive modifications to the code resulted.
The two SER conditions on FROSSTEY-2 were straightforward:
(I) a local burnup limit of 60,000 mwd /MTU and (2) the inclusion of fuel manufacturing uncertainties. The local burnup limit was administratively controlled at Maine Yankee, and manufacturing tolerances were accounted for in the statistical combination of uncertainties. For code validation, FROSSTEY-2 was compared to a significant PWR fuels data base.
Probability / confidence limits of 95/95 for centerline inelt temperature were used which included code and input uncertainties and were a function of fuel burnup.
Fuel performance calculations considered the multiple fuel types and multiple projected burnup histories, and were excellent overall.
GEMINI-II was a simplified systems code used to predict changes in reactor coolant system (RCS) pressure and core inlet temperature associated with the CEA drop transient.
YAEC used the minimum RCS pressure calculated with 8
=
P!
GEMINI-II for the COBRA-IIIC subchannel analysis which was a conservative assumption. Since the GEMINI calculated transient temperatures were less than maximum core inlet temperatures contained in the plant Technical i
Specifications (TS), the TS value was used in the COBRA subchannel analyses, again a conservative assumption.
GEMINI-II contained a very simplified treatment of reactor coolant and secondary systems. The RCS was modeled as four lumped volumes where fluid mass was constant and subcooled, and the secondary system was modeled as a single saturated volume. The pressurizer model contains two regions in which equations for mass and energy ware solved.
Interfacial heat transfer in the pressurizer was zero. Steam-to-wall heat j
transfer was not modeled. There was a point kinetics model of the core. An energy balance was performed by the code. Benchmarking of the code was minimal. Despite its simplicity, the mild thermal-hydraulic transient associated with the CEA drop transient (i.e., small changes in reactor power, pressure, and temperature) was not a challenge to the modeling approach in GEMINI-II, and was acceptable for this application.
COBRA-IIIC was a multiple channel core fluid behavior and departure from nucleate boiling (DNB) analysis code, which was used twice. in the YAEC methodology for DNB. COBRA-IIIC was first used to model a one-eighth symmetric core section using vendor-supplied fuel assembly flow resistances to 4
The determine an inlet flow penalty to be used in subchannel DNB analyses.
penalty was determined conservatively from bundle-sized hydraulic parameters and power factors. Next, COBRA-IIIC subchannel analyses were performed to determine individual subchannel DNB limits. This was done for a collection of adjacent pins and sub-channels that had a high probability of reaching DNB.
This analysis used the most limiting of a large number of fuel pin power level:; and axial power profiles using conservative values for inlet flow, inlet temperature, and system pressure.
The YAEC-1 DNB correlation used by YAEC in the second COBRA-IIIC analyses discussed above was developed from a substantial number of experiments at Columbia University using 14X14 fuel simulators of the exact geometry originally used in Maine Yankee. The data, the COBRA code, the correlation, and associated biases and statistical combination of uncertainties were a matched set used to establish a minimum DNB.
The ISA team discussed the YAEC application of COBRA III-C with the code authors.
In BNWL-1695', the author of the original COBRA code, stated that all 11 user-selected correlations should be justified. One of the COBRA IIIC authors told the ISA team that the selections of correlations by YAEC were reasonable as long as the selections remained constant for the application as well as for the development of the DNBR correlation. This was the correct procedure and was followed by YAEC.
The Cycle 15 core cor.sisted of a mixture of Combustion Engineering, Siemens, and Westinghouse fuel. Fuel procurement specifications were used to assure
'D. S. Rowe, " COBRA III C: A Digital Computer Program for Steady State and Transient Thermal - Hydraudic Analysis of Rod Bundle Nuclear Fuel Elements, " March 1973, Battelle, Pacific Northwest Laboratories 9
that minimal geometric differences affecting DNBR would exist among different fuels within the same reload. YAEC has also required vendor flow testing to assure that appropriate flow resistances were applied in the one-eighth core analyses for determining flow penalties.
Overall the CEA drop analyses performed by YAEC for Maine Yankee was found to be excellent for the following reasons:
(1)
Power distributions were found to be accurate and uncertainties treated appropriately.
i (2)
The. GEMINI analysis was applied in a conservative manner for the CEA drop transient.
1 (3)
The fuel centerline melt analyses using FROSSTEY-2 with uncertainties i
)
was found to be conservative.
(4)
The consistent application of the Columbia University DNB tests, the COBRA-IIIC code, the YAEC-1 correlation, and the statistical combination of uncertainties was appropriate.
(5)
Careful fuel procurement specifications and application of inlet flow penalties provided confidence that DNB analyses with mixed cores is done appropriately.
2.1.4 Main Steam Line Rupture Although weaknesses were found, the main steam line rupture analysis was found i
to be acceptable due,to compensating conservatisms.
l j
YAEC used the RETRAN 02 M00 2 and Boron Injection RETRAN Post-processor (BIRP) 1 codes for analyses of the main steam line rupture (MSLR) event for Cycle 15.
RETRAN 02 MOD 2 was used to simulate the priaary and secondary system thermal-hydraulic responses following an MSLR.
BIRP was used to calculate the reactivity feedback associated with the steam line rupture and consequential primary system cooldown.
YAEC performed calculations for a spectrum of MSLR tases for Cycle 9 including cases at hot full power (HFP) and zero power, for a range of postulated l
equipment failures. For Cycle 11, the calculation for the bounding HFP case For was repeated and was the reference for the current Cycle 15 analyses.
Cycle 15, only reactivity effects were recalculated.
RETRAN 02 MOD 2 was a one-dimensional thermal-hydraulic computer program intended for use in analyzing the consequences of operational transients in light water reactors. The code solved the equations of continuity, energy, and momentum to simulate the primary and secondary fluid temperature and pressure.
The code contained an equilibrium formulation with non-equilibrium conditions i
modeled in the pressurizer and reactor vessel upper head. Core heat transfer was simulated with a one-dimensional heat-conduction model in which the boiling curve was employed to treat the convective heat transfer between the fluid and the fuel rods. Point kinetics were used to compute core power. A 10 i
~ _ _ _. _ _ _ _ _. _. _ _
l bubble rise model was employed to treat two-phase flow and phase separation effects. This code was provided through the Electric Power Research Institute (EPRI) and has an extensive user group.
The Boron Injection RETRAN Post-processor (BIRP) was a separate code used to evaluate the reactivity feedback effects to determine the potential for a return to criticality during the MSLR.
It used RETRAN 02 M00 2 thermal-hydraulic results as input. BIRP was used to calculate the soluble boren concentration due to safety injection during the steam line rupture, as well as the overall reactivity balance.
l The NRC issued an SER on the use of RETRAN 02 MOD 2 and BIRP on October 2, 1985, with no SER conditions for the Maine Yankee plant-specific analyses.
However, a generic SER with 39 SER conditions was issued on September 4, 1984, regarding the use of RETRAN 02 MOD 2.
The ISA team reviewed these conditions within the context of the MSLR application to Maine Yankee. Nine conditions did not apply tc, PWRs. Another 22 conditions were explicitly met because of the modeling approach and application to the MSLR. The remaining eight conditions all involve modeling and validation and are subject to interpretation. On the basis of sensitivity studies performed by YAEC and compensating conservatism in the MSLR analyses described below, the ISA team concluded that these conditions had been satisfactorily addressed.
During the assessment, the team found a number of errors and inconsistencies.
YAEC performed several sensitivity studies to quantify the issues for the team. Following is a discussion of the more substantive issues.
(1)
The pressurizer and reactor vessel upper-head interfacial heat-transfer coefficient was assumed to be 1000 Btu /hr-ft* 'F.
This coefficient was non-physical and inconsistent with the test data in the literature such as the Massachusetts Institute of Technology (MIT) pressurizer data.
Use of this coefficient is incorrect; however, MSLR results were unaffected by this assumption since it is a depressuri;.ation event.
(2)
There was a lack of RETRAN 02 MOD 2 benchmarking against separate-effects and integral and plant data; for example, MIT pressurizer data, Shippingport plant data, Loss of Fluid Test (LOFT) loss-of-load test, and MSLR integral tests.
(3)
Liquid flow spikes were observed in steam line break flow, violating the model assumption that only pure steam exits the break to maximize the cooldown. This demonstrated that an error existed in the bubble-rise model in the code. However, the overall cooldown was unaffected by these spikes.
e 11 1
l 1
J (4)
A possible non-conservative omission in the RETRAN 02 MOD 2 enthalpy transport model was found. The work term (PV) in the total energy equation was intentionally omitted as a simplification to the code.
This omission could produce enthalpies exiting the core and steam generators that were too high, thereby decreasing the cooldown rate. The evaluation of the effect of this term indicates a less-than-5 'F variation in the steam generator and core exit temperatures.
There were no justifications or sensitivity studies for the assumed (5) fluid mixing in the RCS, Use of scaled flow data to justify modeling of the reactor vessel lower plenum and upper plenum as single nodes was inappropriate since the data did not include the asymmetric temperatures reflective of the MSLR event. Subsequent sensitivity studies performed by YAEC for the ISA team showed that although the initial cooldown progresses at a faster rate early in the transient when a ' split core rather than a single channel was modeled, the minimum temperature achieved during the MSLR did not change.
An inadvertent switch in secondary-side heat transfer from nucleate (6) boiling to transition boiling and forced convection to steam was noted in the hot zero power analyses. YAEC corrected this error and the new results showed that the full-power MSLR analyses remained limiting.
2 However the hot zero power cases were very close to the limiting full V
power case.
The MSLR analysis was judged to be bounding'because the modeling of the heat removal from the secondary side of the steam generator resulted in an excessively low RCS temperature. The conservatively low predicted temperature was supported by the following conservatisms and supporting analyses:
(1)
In the calculation, the heat extraction by the secondary-side was not degraded as the secondary level decreased. The full heat removal capability was assumed until all of the secondary liquid was boiled off.
Comparisons of the YAEC secondary-side modeling approach to an MSLR test (2) at the LOBI' test facility showed that the YAEC approach conservatively under-predicted the test data. While the LOBI test cannot be directly used to quantify the conservatism of the MSLR calculation due to scaling and modeling issues, simulation of the LOBI test' with RETRAN 02 MOD 2 qualitatively demonstrated the conservatism.
' LOBI, Loop Blowdown Investigation Facility
'" Pretest Predictions for a LOBI-M002 Large Steam Line Break" by P.
Lightfoot, J. Burchley, J. Rogers. Procedings to the 5th International RETRAN Conference EPRI NP-5781-SR April 1988 12
~2.1.5 Lack Of A Documented Process To Demonstrate Code Capability l
YAEC did not have a documented process in place to identify and rank key phenomena for each of the transients and accidents in the safety analyses report and in turn identify needed code validation and parametric study efforts. Some codes, such as the physics and DNB codes, were found to have extensive validation to actual plant measurements and experimental data i
respectively.
In contrast, the ISA team found that there was overreliance on industry. RETRAN validation efforts, and that validation of RETRAN for the MSLR accident at YAEC was. weak. During the ISA, YAEC initiated the writing of a l
~
" Methods Overview Manual" which was intended to. address these issues.
4 i
2.2 Design Review Of Selected Systems l
The ISA team conducted an in-depth design review of: (1) the high-pressure-safety injection (HPSI) system; (2) service water, which included the service water (SW) system, the primary component cooling water (PCCW) system, and the i
secondary component cooling water (SCCW) system; and (3) the electrical i
system, particularly as it pertained to HPSI and SW. This' design review consisted of an evaluation of the ability of these systems, as modified, maintained, tested, and operated by the licensee, to perform their intended safety functions through an in-depth review of the work of the various i
engineering disciplines (mechanical, electrical, instrument and controls).
1 l
2.2.1 High-Pressure-Safety Injection (HPSI) System f
As a result of the ISA team's finding that the circuitry of one of the containment spray pumps (P-61S) and the recirculation actuation system (RAS) j ranual switch was not periodically tested, the licensee discovered that HPSI i
pump P-14A would not have actuated automatically after a loss-of-coolant
+
accident (LOCA) with offsite power available. The ability of the containment spray (CS) system to provide a reliable supply of water to HPSI pump suction j
during the recirculation phase of a LOCA was not adequately demonstrated for plant operation at power levels above 2440 MWt due to the potential for CS i
j pump cavitation. With these exceptions, the ISA team found that the HPSI j
system would have functioned as intenced; however, other weaknesses were noted i
with testing.
l 2.2.1.1 HPSI System Description 1
The HPSI system, the low pressure safety-injection (LPSI) system, and the CS i
system were the subsystems of the emergency core cooling system (ECCS). The HPSI system consisted of three pumps and associated valves, instrumentation, and piping. One pump was normally operating as a charging pump, a second pump was aligned for standby operation, and the third pump was available as a spare. Upon a safety injection actuation signal (SIAS), ECCS pump suction would be automatically aligned to the refueling water storage tank (RWST).
Following injection of approximately 200,000 gallons from the RWST, the ECCS would go into the recirculation phase, the HPSI system would realign to take suction from the discharge of the CS pumps, the CS pumps would take suction from the containment sump, and the LPSI pumps would be stopped.
13
4 2.2.1.2 Flow Testing The HPSI system showed little-to-no margin in performance, particularly when
- operating at maximum flow conditions. The operating point for the HPSI pumps under these conditions was beyond the design information supplied by the pump manufacturer. The acceptability of the operation of these pumps under these conditions was established by licensee tests. These tests may have shown some degree of cavitation and an uncertain, but likely very small, margin. These limiting. conditions would exist only in the low probability event of a large break LOCA.
The HPSI system was set up to operate under maximum flow conditions (approximately 800 gpm) at an operating point approximately 60 gom beyond maximum flow on the pump curve provided by the pump manufacturer. Flow and net positive suction head (NPSH) data from the pump manufacturer were not available for this operating point. The licensee based the acceptability of the system on testing done on site in 1972 and 1993. The ISA team reviewed the results' of these tests in detail and concluded that, although in the engineering judgment of both the ISA team and the licensee that the HPSI system was operable, the tes'ts lacked rigor.
Preoperational HPSI pump runout tests were conducted in July 1972, and flow values were recorded up to 805 gpm with limited documentation of pump conditions and system lineup. However, the corresponding RWST tank and temperature were approximately 70,000 gallons and 105* F, and the tests were run after the HPSI flow to the three loops was balanced. The licensee later changed the minimus RWST level prior to sump recirculation to approximately 100,000 gallons, resulting in several additional feet of NPSH available to the pumps.
Additional HPSI pump testing at high flow conditions was done in 1993 following adjustments performed on the loop throttle valves. Regarding this testing, NRC Inspection Report 50-309/93-22, dated October 25, 1993, stated, During a dynamic test of motor operated valve (MOV) HSI-M-41, what appeared to be runout conditions were observed at high pressure safety injection (HPSI) Pump P-14A. The pump was noisy and with a flow measured at 796 gpm (not including the recirculation flow) the pressure was less than 390 psig. Upon further testing, the pump noise was still present when total flow was 800 gpm. While pump vibration and temperature remained normal, the licensee was unable to determine that initial pump cavitation was not occurring.
On the basis of the concerns of the ISA team regarding these tests (adequacy of documentation and instrumentation) and in order to provide additional assurance of the proper operation of the system, the licensee plans a future test of the HPSI pumps in a technically rigorous manner to fully demonstrate the available margin.
14 m
l 2.2.1.3 Throttle Valve Settings 4
HPSI flow control into the reactor coolant system (RCS) was controlled by
)
three throttle valves per train that were set with a tolerance that may be too l
high. The ISA team was concerned with the critical nature of the setup of j
these throttle valves because unintended variations of as little as 20 gpm l
could result in some cavitation, if flow was too high, or not meeting design 4
flow values assumed in the LOCA analysis, if flow was too low.
l The position of the HPSI throttle valves (3-inch globe valves) was being controlled by the licensee within a tolerance of 1/16 inch based on full flow testing done in 1993. During this testing, the throttle position of these valves wa.s established and mechanical stops were set. The licensee stated that ' tolerance on the position of these valves was based on using a j
ruler to measure how far the stem moved.
In 1994 the licensee began to use a j
digital micrometer that measured stem position of these valves to within.001 inch.
1 l
The licensee did not have specific test data to evaluate the impact of this tolerance or a specific coefficient of flow (Cv) value for the throttle valves that could be used to calculate the impact of the tolerances on HPSI delivery flow. Estimates using a licensee supplied Cv that may be typical for this type of valve concluded that this tolerance band could cause a flow variation of more than 20 gpm per valve.
Actual flow through the HPSI throttle valves was measured each refueling cycle by Procedure 3.1.15.3, "ECCS Operational Pump Flow and Check Valve Testing."
Flow measurements to each loop were measured and evaluated to ensure an adequate amount of total flow to the RCS and to ensure an acceptable flow distribution among the three loop injection points to account for the possibility that, in an accident, the flow through one loop may bypass the core by going out the break. Although this test could not be used to definitively evaluate the settings of the throttle valves under full flow conditions (essentially no reactor coolant system back pressure), it did provide a realistic appraisal of system performance and would indicate a gross mis-adjustment of the throttle valve settings. The ISA team reviewed the results of the last performance of this test, as it pertained to the HPSI system, in November 1995, and fount them acceptable.
The planned HPSI flow testing to verify pump conditions at high flow will also enable the licensee to reset the position of these valves using a more precise tolerance to ensure that required flow is met and runout conditions are not exceeded. The licensee plans to include the resetting of these valves to a more precise tolerance as part of that flow testing.
2.2.1.4 CS System Support to the HPSI System The ability of the CS system to provide a reliable supply of water during the recirculation phase of a LOCA was not adequately demonstrated for operation at power levels above 2440 MWt due to CS pump cavitational concerns. These 15
j conditions would exist only in the low probability event of a large break LOCA.
Maine Yankee was licensed to pre-1971 general design criteria (GDC) in Appendix A to 10 CFR Part 50.
These criteria were provided in Appendix A of the Maine Yankee FSAR.
FSAR Criterion 44 provided requirements for ECCS and stated in part, "The performance of each emergency core cooling system shall be evaluated conservatively in each area of uncertainty." The ISA team reviewed. current and historical design calculations to evaluate if net positive suction head available (NPSH,) for the CS pumps during the recirculation phase was derived with the appropriate conservatism required by Criterion 44.
The licensee asserted, and the ISA team found no evidence to contradict, that Maine Yankee was not committed to the requirements of Regulatory Guide 1.1, formerly Safety Guide 1,. dated November 2,1970', which stated in part that
" Emergency core cooling and containment heat removal systems should be designed so that adequate NPSH is provided to system pumps. assuming maximum expected temperatures of pump fluids and no increase in containment pressure from that present prior to postulated loss of coolant accidents." The licensee assumed a less conservative CS pump NPSH, taking credit for accident induced containment pressure to demonstrate that NPSH, was greater than or equal to the net positive suction head required (NPSH,).
The original NPSH calculation (MYC-272, Revision 2,"NPSH Study, Containment Spray Pumps"), assumed a sump temperature of 190 *F and zero containment over-pressure, although the maximum sump temperature was predicted to be significantly in excess of 212 *F.
The licensee recognized the need to improve the quality of this analysis and began reanalyzing CS pump NPSH in 1995.
The current design basis NPSH calculation (MYC-1804, Revision 0, " Containment Spray Pump NPSH") established a time-dependent correlation between the NPSH, and NPSH, based on transient LOCA containment pressure and temperatures. This calculation showed an NPSH, of 15.3 feet and a positive margin of NPSH of less than I foot. A very sophisticated multi-node RELAP/M003 model was used to calculate blowdown mass and energy to the containment. A very simple one node code (CONTEMPT-LT28) used this information as an input to calculate the containment pressure and sump temperature required for detennining NPSH This i
analysis also assumed an initial power level of 2700 MWt. During the ISA the licensee provided information from the pump manufacturer which indicated that the pumps in question could be expected to operate for up to 15 minutes without damage with an NPSH, of 11.4 feet at 3700-3900 gpm.
The following weaknesses were identified in this analysis.
'" Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal System Pumps" 16
l (1)
The precision of the analytic-technique and the sensitivity of the analysis to containment sump temperature.
The team's evaluation of the results (NPSH, values) indicated that a change in sump temperature of only 1 'F would change the result by about 1 foot. NPSH, i
was calculated based on iteration between the two computer codes described above, that have an unknown degree of uncertainty for this type of analysis.
In particular, CONTEMPT-LT28 has options intended to bound the extent of mixing between the containment atmosphere and the break effluent, since a single node cannot address this phenomenon. Also, no validation for this type of analysis was presented. Given the uncertainty in the codes, the iteration scheme, and the sensitivity of the final product of this calculation, the ISA team questioned the validity of this calculational approach and the specific modeling assumptions used.
(2) Incorrect calculation of bounding CS pump suction head losses.
The suction pipe friction losses were developed for pump P-61A in calculation MYC-272, Revision 4, "CS Pump Suction Losses During RAS." Assumption two of 4
this calculation stated that the suction piping arrangements to pumps P-61S and P-61B were virtually identical to pump P-61A. Therefore, this calculation was assumed to bound the worst-case condition for all three pumps. The ISA team determined that the suction piping arrangement for pump P-61S would result in higher suction piping frictional losses than those calculated for pump P-61A. As a result of the ISA team's concern, the licensee performed an i
evaluation that confirmed an increase of suction pipe friction losses from 4.5 feet to approximately 5.3 feet.
(3) Use of a hot fluid temperature correction factor.
The licensee took credit for reduction of the NPSH, requirements due to the increased sump temperature. This phenomenon was described in the Hydraulic Institute Standards. The ISA team viewed the use of the NPSH, correction for this application as an example of a non-conservative assumption.
The Hydraulic Institute Standards (currently American National Standard for Centrifugal Pumps, ANSI /HI 1.1-1.5-1994) provided limitations and precautions for use of the NPSH, temperature reduction, including considerations of entrained air or other gases present in the liquid and consideration of the susceptibility of the suction system to transient changes in temperature and absolute pressure. The ISA team considered that both of these limitations merited consideration because the sump water may not be sufficiently deareated and the CS pump would be undergoing a significant temperature transient near the time of minimum availability of NPSH. However, the calculation was silent on applicability of these limitations.
Following the assessment, the licensee conducted additional analysis to support plant operation at up to 2440 MWt. After reviewing this information, the ISA team concluded that it was appropriate to consider these pumps operable at power levels up to 2440 MWt.
17
1
(
i l
2.2.2 Service Water / Component Cooling Water The ISA team concluded that the support systems, service water and component cooling water, designed to remove decay heat and heat generated by individual i
components were capable of performing their design function up to the presently authorized power of 2440 MWt.
a 2.2.2.1 System Description 4
The service water (SW) system was comprised of four SW pumps (housed in the circulating water pump house), four heat exchangers (two each for primary component cooling water (PCCW) and secondary component cooling water (SCCW),
and interconnecting piping and valves; The PCCW and SCCW heat exchangers consisted of two pairs of heat exchangers, an older and smaller one 2nd a newer-and relatively larger one (by approximately 20 percent), in each pair.
a l
The newer heat exchangers had titanium tubes and the older one hr.d copper-4 nickel tubes. The SW system provided the ultimate heat sink for cooling of plant equipment. The system provided safety and non-safety functions by i
pumping seawater through the PCCW and SCCW heat exchangers.
t The PCCW and SCCW systems performed an integrated function with the service water system in cooling plant equipment and removing decay heat.
Each subsystem consisted of two pumps, the heat exchangers described above, and a j
flow distribution piping network. These subsystems absorbed heat from j
individual component coolers and from the residual heat removal (RHR) heat exchangers (one per train), which represented the major post-accident heat l
load in removal of heat from the containment building.
2.2.2.2 Availability of Seawater Flow Into the Service Water Intake Structure
[
I A bottom contour map based on a 1994 survey of the area near the circulating water pump house showed relatively open access to the Back River and l
ultimately to the Atlantic Ocean. Therefore, an ample water supply was assured to the SW system.
1 i
i 2.2.2.3 Service Water Pump NPSH l
The service water pumps had sufficient margin of submergence over the range of operating tide levels.
In the installed configuration, the pump inlet flanges were at an elevation of
-14 feet 6 inches, and all pumps were shop tested to a water level of 2 feet 6 l
inches above the pump inlet. The water level at minimum submergence would i
i therefore be at elevation -12 feet. A review of tidal records from 1989 to present (except 1995 when the plant was not operating) showed that elevation
-7 feet (with small variations) was the low tide level.
2.2.2.4 circulating Water Pump House Flooding
\\
Adequate provisions were in place to mitigate the impact of flooding in the i
circulating water pump house. These provisions included level alanns, header 18 i
l i
i
i J
d pressure switches that provided information if the. headers failed, check valves to prevent d':in back, and a 7-1/2 feet seismic wall that separated the circulating water pumps from flooding the SW space.
In the event of flooding, 1
the operators had sufficient information and time to locate the problem and isolate it before damaging the SW pump motors.
i 2.2.2.5 Residual Heat Removal (RHR) Heat Exchanger Thermal Transient The ISA team found that, with the plant operating at 2700 MWt, the most limiting design-basis thermal transient, shifting to recirculation during a i -
LOCA, on the RHR heat exchangers was beyond their design specification and had l
not been analyzed. The consideration of this thermal transient, apparently j
not explicitly addressed in conjunction with the power upgrade to 2700 MWt, j
was considered a weakness.
Once again, these limiting conditions would exist i
only in the low probability event of a large break LOCA.
l The maximum heat transfer rate, according to the RHR heat exchanger vendor, j
was approximately 120 MBtu/hr during a transient of 10 seconds; the heat exchanger could sustain 50 cycles of this transient. The power upgrade to i
2700 MWt increased the maximum containment sump temperature to 255 'F, which l
resulted in a LOCA heat transfer rate of 137 MBtu/hr (calculation MYC-1742, l
Revision 1). A fatigue analysis of the heat exchangers at the higher thermal threshold was not performed; therefore some assurance was needed that the l
alternating stresses for the various subassemblies of the heat exchanger would 4
i not exceed their limits.
As a result of the ISA team's inquiry, the licensee investigated the impact of the higher thermal threshold. The original transient analysis calculation was no longer available. However, the vendor was able to provide a stress report for a heat exchanger of similar design and materials. The ISA team reviewed this information and concluded that these heat exchangers could be considered i
operable at the higher thermal values resulting from plant operation at j
2700 MWt.
l 2.2.2.6 SW and PCCW/SCCW Integrated Operation i
l Calculations demonstrating the design margin of the SW, SCCW, and PCCW systems (PCCW and SCCW will be referred to as the component cooling water (CCW) i systems) showed essentially no margin for the CCW systems in their ability to 1
perform their safety-related functions. The component inlet temperature of j
the CCW system loads was set at 118 'F, which appeared to be the maximum temperature for assuring adequate heat removal from system loads under i
i accident conditions. By the use of calculations, all of the available margin was transferred to the SW system to optimize operational flexibility. The limiting conditions of this analysis would be significant only in the low probability event of a large break LOCA.
The ISA team was concerned with this approach to operation of the SW and CCW systgms because of the lack of margin in the CCW supporting calculations and the material condition of the system (heat exchanger bypass valves). Despite these non-conservatisms, the ISA team concluded that it was appropriate to 19
consider the PCCW/SCCW systems operable at power levels up to 2440 MWt. The ISA team was unable to conclude, and the licensee did not demonstrate, that these heat removal systems would perform adequately under design-basis accident conditions originating from a power level of 2700 MWt.
On the basis of this integrated heat removal analysis, an engineering directive had been provided to ensure the SW system would be operated within certain limits. However, the operating limitations provided in the engineer.ing directive were not bounded by the licensing commitments.
Section 9.4.1 of the FSAR stated, "The component cooling water system ~ heat balance was performed in 1990... demonstrating adequate capacity for design basis post-LOCA conditions assuming a service water inlet temperature of 80 *F for CCW heat exchangers E-4B and E-5A, and 90 *F for CCW heat exchangers E-4A and E-5B."
The' engineering directive restricted the max.imus SW temperature to 70.2 *F for E-48 and E-5A (the older Cu-Ni units), and 78.5 *F for E-4A and E-5B (the newer titanium units). On the basis of the licensee's analysis, the CCW systems would not support plant operation up to the SW temperature values
'in the FSAR.
Integrated operation of SW and PCCW/SCCW was non-conservatively analyzed due to:
1.
CCW and RHR Heat Exchanger Fouling and Testing Fouling factors used for the CCW and RHR heat exchangers were not appropriately conservative given the lack of reliable testing done to confirm the assumed values.
The ISA team's review of heat exchanger test results and test practices identified that the test program was still being developed, and there was not enough reliable test results to support use of the fouling values used in the licensee's design calculations.
The ISA team had the following specific concerns with the licensee's heat exchanger testing program:
(a)
Instrument uncertainty was not accounted for in determining the fouling values.
(b)
The installed locations for the flow measuring devices were less than optimum to assure accuracy, and the flow measuring devices were not calibrated for their specific application or adjusted for the actual pipe wall thickness.
(c)
Heat exchanger tubes were cleaned on a periodic basis; however, there was no requirement to do performance testing just before the heat exchanger cleaning, thus the maximum fouling value was not being monitored.
(d)
The lack of surface mounted thermocouples made the measured tempyatures susceptible to potential streaming.
20
1 i
)
i 2.
Maximum CCW Heat Load The ISA team's review of calculation MYC-1742, Revision 1, found that the CCW i
l heat loads were modeled as one major load (RHR) and one auxiliary load that j
represented all other CCW loads. The RHR heat exchanger load was based on a
-maximum containment sump temperature, 255 'F, as determined in calculation MYC-1740, Revision 1.
The remaining loads were lumped as a single 10 Mbtu/hr
]
load. This value was developed as a sum of the emergency diesel generator (EDG) load, control room chiller, and other unidentified loads.
The ISA team questioned the basis for the 10 Mbtu/hr value, since in the case of the PCCW system, the heat load included the spent fuel pool (SFP) heat exchanger, which had a design load of 9 Mbtu/hr (prior to re-racking), and each emergen'cy diesel heat exchanger, which had a load estimated at 5 Mbtu/hr.
For the SFP load, the licensee assumed that the total load on the PCCW heat exchanger would not exceed the analyzed valve based on an assumption of initial SFP temperature of 110' F.
3.
Flow Diversion Temperature control for the PCCW and SCCW systems was accomplished by adjustment of the bypass flow around the heat exchangers (shell side). There was only one air operator per system that operated both the inlet valve and the bypass valve. The calculations assumed that during a design-basis accident the bypass valve would be fully closed and the inlet valve would be fully open, thus maximizing flow through the heat exchanger.
If the. bypass valves did not go to their safety related positions, the heat transfer capability of the heat exchangers could be significantly degraded.
In 1995 the licensee ' discovered that the CCW heat exchanger bypass valve, PCC-T-20, was open about 11' following an attempt to align it to its safety related position, closed. At the time, Maine Yankee was in an outage and an immediate operability determination was not required; however, the reportability determination had not yet been completed at the time of the ISA.
The ISA team found no calibration procedures for these valves, the controllers were not of the " fail safe" design, no procedures were found that tested ability of these valves to perform their safety related function, and the maintenance history of these valves identified 11 completed maintenance work orders (W0s) for these valves in the last five years. On December 26, 1995, maintenance work order (WO) 95-3194 was initiated which identified that the linkage between CCW heat exchanger bypass and inlet valves, PCC-T-20 and PCC-T-19, was misaligned. This WO was open at the time of assessment and scheduled for completion during the 1997 refueling outage. WO 93-04459-00, completed on January 1,1996, (PCCW), and WO 96-01785-00, completed August 9, 1996, (SCCW), did not demonstrate whather these valves would perform their safety related function. WO 96-01785-00 stated that a positioner failure appeared to be similar to PCC-T-20 and recommended to " watch as loads get added". WO 93-04459-00 had a recommendation to " rebuild /recal entire controller" in the event that controller continued to malfunction.
21
.. ~. - _ _ _ _
l On the basis of the ISA team's concerns, the licensee performed a test on the PCCW temperature control valve after the team left the site. This test was reported as successfully demonstrating the operation of this valve.
2.3 Electrical and Instrument and Controls The team found that the capability of the electrical system and instrument and control equipment to be generally robust and capable of performing their design function. Significant exceptions were noted with environmental qualification of components and ventilation systems.
2.3.1 115 kV Offsite Power Lines The 115 kV offsite power lines were not independently capable of supplying the plant auxiliary power system under certain conditions.
I.1 FSAR Section 8.2.3, the licensee stated that either of the incoming lines is independently capable of supplying the plant auxiliary power system.
In FSAR Criterion 39,
" Emergency Power for Engineered Safeguard Features" (FSAR, Vol III, Appendix
. A), the licensee stated, " alternate power systems shall be'provided and designed with adequate independence, redundancy, and capacity to permit functioning required of engineered safety features.
As a minimum, the onsite and offsite system shall each independently provide this capability assuming a single failure of a single active component in each power system."
The station had two incoming 115 kV lines, and the main generator was connected to a 345 kV line; all were interconnected to the New England area transmission network. The main generator was connected to the 345 kV switchyard. Startup and standby (reserve) offsite power was provided by the 115 kV switchyard (which used two incoming lines, Surowiec and Mason) through reserve station service transformers X14 and X16. Under heavy loading conditions, a capacitor bank was used to compensate for and reduce the reactive voltage drop on the Surowiec line.
In 1995 Central Maine Power (CMP) completed an update of its studies of the 115 kV system to verify that the system remained capable of supporting Maine Yankee licensing requirements. As a result of the CMP studies, the licensee found that the electrical system analyses in calculation MYC-430, Revision 3,
" Auxiliary Power System Voltage Study," failed to consider the effect of a motor-driven main feedwater pump (EFW) automatic start following fast transfer of plant loads to the 115 kV offsite reserve power system.
The CMP voltage study for the " full" 115 kV system, both Surowiec (Section 69) and Mason (Section 207) lines, indicated that the system could support fast transfer of plant loads and subsequent start of a MDFW pump. However, the voltage study for the Surowiec line only (Section 69) indicated that the 115 kV system was inadequate for the EFW pump start. The study confirmed that the Surowiec line voltage would not recover (after a fast transfer, a safety-injection actuation signal, and subsequent MDFW pump auto-start) within the allotted 5-second reset time interval of the degraded grid undervoltage relay to prevent offsite reserve power from being disconnected and automatic start and loading of the EDGs. The ISA team concluded that this situation (i.e., the limited capability of the Surowiec line) was contrary to the design 22
_ - - =
i i
% ~ and licensing-basis presented in the FSAR which stated that either of the 115 kV lines was independently capable of supplying the plant auxiliary power system.
As stated in a letter to the NRC dated July 19, 1996, the licensee became aware of this issue as a result of a 1995 CMP update of its studies of the 115 kV system.
In response to the ISA team's concerns in this area, the licensee stated that the 345 kV offsi';e system would serve as an alternate source of reserve power. The 345 kV system can be back-fed from the main transformer through the normal station service transformers to provide station power to the onsite 4160 Volt auxiliary power system. The licensee considered this circuit to be a delayed access circuit which could be completed in approximately six hours with disconnection of the main generator links.
The Maine Yanked Technical Specifications, Section 3.12, " Station Service Power,"
required one 115 kV incoming line to be in service when the plant was at power. Therefore, a Teghnical Specification Interpretation dated January 12, 1996, was initiated to r;equire that when 115 kV was in standby or was supplying plant loads, and either MDFW pump was in the automatic mode, then the Surowiec line (Sect % 69) was considered inoperable.
The ISA team did not consider the licensee's position that the 345 kV system back-feed operation, completed within six hours, was an acceptable basis for compliance with the FSAR and Maine Yankee Design Criterion 39. However, the ISA team considered this situation to be of low safety significance considering the historical stability of the grid, the existence of two independent reserve power transformers (X14 and X16), and the limited conditions (heavy loading and automatic start of MDFW pump) under which the Suroweic line would be unavailable.
2.3.2 Degraded Grid Undervoltage Relay Calibration Tolerance Band The ISA team found that the calibration tolerance band for tite degraded grid undervoltage relays may result in a setting that could cause a premature transfer of loads from offsite power to the emergency diesel generators (EDGs) following a LOCA. As a result of recently updated CMP voltage studies, the licensee was in the process of revising the electrical system analyses in calculation MYC-430 (Auxiliary Power System Voltage Study, Revision 3, May 14, 1990). As a result of these analyses, a vulnerability was found in the onsite auxiliary power system because the upper limit of the calibration tolerance band specified for the reset setpoint of the degraded grid undervoltage relays was set too high (95.5 percent of rated bus Voltage.) Under worst-case conditions these relays set at the specified upper limit of the tolerance band could cause premature transfer of loads from the 115 kV offsite reserve power system to the EDGs. This could have created a situation that would be contrary to FSAR Section 8.2.3, which required the offsite reserve power system to be capable of supplying the plant auxiliary power system.
In response to this issue the licensee stated the following: (1) A CMP grid load of 1,366 MW assumed in the full system base case is unlikely; however, Maine Yankee would again notify CMP to bring the Maine Yankee capacitor bank and Surowiec Transformer Auto Boost into service at grid loads greater than 23
i 1,300 MW. (2) CMP would be asked to perform a systes analysis based on a grid l
loading of 1,300 MW and the results would be used to verify an adequate system voltage to reset the degraded grid undervoltage relay. (3) The full system base case would be eliminated from calculation MYC-430 and replaced with a new case which is based on the grid at a 1,300 MW load. (4) The calibration j
tolerance band of the degraded grid undervoltage relay would be reduced. The ISA team agreed with the licensee that the potential for the as-found settings j
of these relays to cause a premature transfer of loads to the EDGs was unlikely.and considered:their planned actions acceptable.
2.3.3 EIectrical Protection, Coordination, and Cab 1'e Selection The ISA team reviewed the specifications, drawings, calculations, protection scheme, cable data, motor data, protective relay setting criteria, relay l
settings, calibration records, and coordination for the 4,160 Volt ac and i
480 Volt ac emergency buses, with particular emphasis on motor and bus j
protection associated with the HPSI, EFW and SW systems.
In addition, l
selected motor and MOV feeder cables were reviewed.for electrical equipment i
loading, cable sizing, cable routing, tray and conduit fill, and ampacity derating for these systems. Overall, the ISA team found that electrical protection and coordination calculations were good, protective relay setting j
criteria was consistent with industry standards and practice, protective relay calibration records were good, cable sizing was robust, ampacity derating was appropriate, and tray and conduit fill was acceptable. However, some minor discrepancies and errors were found (see Section 2.3.6).
J 2.3.4 125 Volt de Vital Station Batteries l
The ISA team concluded that the battery capacity was robust, and that all
)
vital station batteries had a capacity greater than 110 percent of the needed capacity.
i l
2.3.5 Emergency Diesel Generator Electrical Loading l
Although the EDGs were assessed non-conservatively, their capacity was sufficient.
h The onsite emergency ac power system consisted of two independent and redundant 4,160 Volt, 2,850 kW (2,000 hr/yr rating) EDGs. The ISA team reviewed calculation MYC-107, " Emergency Diesel Generator Loading," Revision 4, which evaluated the loading of equipment onto each EDG. The ISA team found that calculation MYC-107 was not well documented, EDG loading was assessed non-conservatively because all required loads were not included in the calculation, and the loading profile was inconsistent with FSAR and design requirements. The ISA team concluded, however, that the EDGs were able to start and carry all required 1:: ads, including the additional loads found by the ISf. team and not included in the calculation. The ISA team noted the following problems with the evaluation of EDG loading in calculation MYC-107:
(1)
Cable power losses in the 4-kV and 480 Volt ac systems were not incorporated into the calculation.
This additional load was estimated to be in the range of 30 to 40 kW.
24
a
~ (2)
The loading profile was inconsistent with FSAR and design requirements.
On the basis of FSAR Section 8.3.2 and the elementary system drawings, CS pump P-61A and PCCW pump P-9A automatically start 10 seconds after closure.of the EDG 1A circuit breakers when EDG 1A starts in response to j
a SIAS. Contrary to this, the EDG-1A loading profile in calculation MYC-107 showed these pumps loading at 20 seconds with EFW pump P-25C.
In response, the licensee stated that FSAR Discrepancy 25 (June 19, l'
1996) was. initiated to identify and resolve the discrepancy in the power demand for the loading steps; however, this specific problem was not noted in this document. The ISA team judged that this discrepancy would not have an adverse impact on the EDG operability.
t I
(3)
There was a lack of documentation in the calculation to support motor loads.* This was a minor weakness in the calculation.
l (4)
Pump motor loading was non-conservative.
LPSI pump loading in j
calculation MYC-107 was identified as 336 kW; however, the loading value i
at runout would be 364 kW. The EFW pump loading was also based on a nominal value of 378 kW rather than on the runout value~ of 441 kW.
j l
(5)
Control air compressor manual start, required by procedure ECA-0.2, 4
" Loss of All ac Power Recovery, SI Required," was not incorporated into the calculation. The licensee stated that the additional electrical load would be a cycling load of 24.5 kW for an unloaded compressor and 71 kW for a loaded compressor.
(6)
MOV replacements were not accounted for in the EDG loading calculation in that operators and motors for 14 MOVs were replaced under the MOV Upgrade Program, but the motor horsepower changes were not included in the electrical'one-line drawings and tracked as required by i
Procedure 17-227, " Electrical Distribution System Load Tracking,"
l Revision 1.
Although the load changes were mostly a decrease of a few horsepower, this was an example of a weakness in configuration control.
In response to the ISA team's concerns in this area, the licensee prepared a preliminary revision to calculation MYC-107 which showed that the loading on EDG-1B (worst-case) increased from 2,629 kW to 2,842 kW (a 213 kW increase),
still below the 2,000 hour0 days <br />0 hours <br />0 weeks <br />0 months <br /> / year rating limit of 2,850 kW.
2.3.6 Electrical calculations Despite the deficiencies noted with the EDG loading calculation and several other relatively minor weaknesses, electrical calculations were very detailed, comprehensive, and rigorous. Calculations prepared since 1993 were better documented and more sophisticated than earlier calculations.
However, the following additional calculational problems were noted:
(1)
Incorrect motor data were used for setting the HPSI pump motor protective relays in calculation MYC-1559, in that the incorrect locked rotor current was used. The error was in the conservative direction and 25
l l
l r
motor protection was still maintained; therefore, this issue had no 4
adverse impact on plant safety.
Incorrect cable data were used in the coordination curve for the EFW (2)
This error was in the pump P-25C motor in calculation MYC-1559.
conservative direction and motor protection was still maintained; i
therefore, this issue had no adverse impact on plant safety.
Cable data and cable damage curves were omitted from calculation 1
j (3)
Volt Circuit Breaker Coordination," Revision 5, where MYC-1063, "480 curves did not identify the feeder cable size and did not incorporate 1
]
the cable damage plot on the coordination curve to demonstrate that the j
cable was protected consistent with industry practice.
The lack of j-cable
- data and cable damage plots had no adverse impact on plant safety l
because cable sizing was conservative.
2.3.7 Inadequacies in Ventilation Systems f.
Although the licensee had previously identified inadequacies in the l
ventilation systems used to support safety-related electrical equipment, the j
ISA fou d ional significant inadequacies in the design of these 4
f 2.3.7.1 Protected Switchgear Room Ventilation Deficiencies were noted in the design of the protected switchgear room The licensee was aware of, and actively correcting, some ventilation system.
of these deficiencies. As a result of the ISA team's inquiries additional The net effect of these recently identified vulnerabilities were identified.
problems could be significant, possibly contributing from 1 percent to up to j
10 percent additional probability of core damage.
4 The battery and protected switchgear rooms were located in the turbine
{
The equipment building and serviced by a safety-related ventilation system.
for this ventilation system was located in the turbine building and consisted of motor-operated air supply and exhaust dampers, supply fan FN-31 (powered i
from train A 480 Volt emergency motor control center (MCC) 7A), a i
motor-operated recirculation damper, and exhaust fan FN-32 (powered from This ventilation system supported the train B 480 Volt emergency MCC-8A).
In operation of the plant's safety-related batteries, inverters, and MCCs.
FSAR Section 8.3.3, the licensee described the lack of redundancy for this ventilation system (single supply and single exhaust fans) and specified operator actions required to mitigate the consequences of a single fan 1
failure.
As part of the Individual Plant Examination - External Events (IPEEE) effort, the licensee recently evaluated the turbine building spectrum of steam line It was recognized that following a high-energy line break (HELB),
breaks.
operator action may be required to manually ventilate the protected switchgear 4
On the basis of calculations, assuming that the ventilation fans were not running, the licensee concluded that the steam ingress into the protected room.
1 i
2
)'
26
i i
i
'switchgear room was not sianificant, and the high-temperature alarm in the j
room would signal operators to open doors and set up portable fans.
f-Despite the licensee's work to mitigate the effects of a potential HELB in the i
turbine building, the licensee did not fully consider the impact of a LOCA or HELB event on the protected switchgear room ventilation system. The ISA team j~
found that the licensee had no calculations or analyses which evaluated the consequences of a supply or exhaust fan failure coincident with a LOCA or HELB f
j under worst-case electrical loading. Although the licensee had prepared calculation MYC-1570, " Protected Switchgear Room, Protected Cable Tray Room &
Battery Rooms 1-4 Temperatures," Revision 0, to address the transient 4
j temperature in the safety-related electrical areas for various scenarios, the ISA team found that the calculation did not address various fan failure modes.
Further, the' ISA team found that no emergency power source was available to power portable fans during a design-basis event which may include loss of normal ac power. Therefore, the compensatory operator actions to open doors and set up portable fans described in the FSAR and the licensee's analyses were not technically supported.
The original licensing-basis assumption for HELB inside the turbine building j
was for a break of a very large steam line that would result in enough damage to the turbine building that the effects of the line break would be rapidly mitigated by the failure of the building walls. However, the licensee recently concluded that the limiting HELB event was a smaller size break that would leave the turbine building intact, causing the harmful effects of the steam to be felt for a longer period of time. As a result of this finding by the licensee (before the ISA), compensatory measures were implemented to keep enough openings in the turbine building to mitigate the effects of a more limiting break.
In response to the ISA team's concerns, the licensee performed an additional j
analysis for calculation MYC-1570, taking into account all failure scenarios for the protected switchgear room ventilation system, including the scenario in which one fan (supply or exhaust) was assumed to fail. Air flow measurements for the ventilation system and switchgear room under various fan configurations were also taken. Based on the results of this analysis, the following actions were taken by the licensee:
(1)
The supply and exhaust dampers were blocked open and the recirculation damper was blocked closed under Work Order 96-02589-00, " Reposition Dampers," Revision 1.
(2)
Design Basis Screen (08S)96-006 (" Turbine Building MSLB Environment,"
Revision 3) was issued which concluded that the worst-case failure mode would be failure of a supply fan while the exhaust fan continued to run, resulting in the ingress of steam into the protected switchgear room which would be unacceptable. The heat load from switchgear and equipment was reduced by approximately 30 percent to eliminate unnecessary conservatism. The results of revised calculation MYC-1570 showed that the HELB scenario bounded the LOCA scenario and resulted in a heat buildup in the switchgear room which would require an operator to 27
~.. _ _. _ _
.i block open doors and set up portable fans within 15 to 30 minutes following the event to limit room temperatures to.135 *F.
(3)
An emergency stop switch was installed in the control room under Work Order 96-02824-00 to allow an operator to trip the exhaust fan to limit ingress of steam into the switchgear room during a HELB event in the turbine building.
j A temporary change was made to Procedure AOP-2-7, " Excess Steam Demand,"
(4)
Revision 16, to provide guidance to the operator for establishing protected switchgear room cooling following a turbine building HELB event.
A 350-foot power cord was provided to allow operators to plug into an (5)
EDG-backed power source (120-V ac vital power) for portable ventilation fans. A long-term, permanent modification was intended to install receptacles in the protected switchgear room which would be powered from EDG-backed emergency buses MCC-7A and MCC-8A.
l (6)
The current HELB evaluation covered suineer conditions only; the licensee was formulating plans to resolve this issue for winter conditions.
2.3.7.2 Spray Building Ventilation Deficiencies Deficiencies were noted in the design of the spray building ventilation system. The licensee was aware of, and actively correcting, one of these deficiencies. The ISA team identified a separate deficiency that had the potential to effect the performance of the CS and LPSI systems.
The spray building houses the CS pumps and LPSI pumps. The ventilation system for this building consisted of a supply unit (HV-7), two safety-related exhaust fans (FN-44A and FN-44B), and associated daarars and ducts. HV-7 comprised a heating coil, fan, and filter.
The licensee had experienced occasions in which ventilation flow through HV-7 had been restricted due to ice buildup on the external surface of the unit in the winter months and from leakage from the heating coil causing ice to build up on the filter portion of this unit. Such situations were significant because there was a potential to impact the CS and LPSI pumps, which required The adequate ventilation (removal of motor heat) in order to continue to run.
licensee recognized this problem and was in the process of implementing a design change to reconfigure the HV-7 supply unit to solve the existing design problems. The ISA team reviewed the licensee's plans to improve this design and found them acceptable.
As part of the review of this i; sue, the ISA team looked at the integrated j
operation of the spray building ventilation system and found that there were pneumatically pcsitioned dampers (VP-A-56 and VP-A-57) on the suction side of
)
the safety-related exhaust fans. Since the damper's air supply was non-safety-related, and considering the design of the dampers, there would be a reasonable potential for the dampers to close under accident conditions, 28
j thereby rendering this safety-related ventilation system inoperable. On the i
basis of this concern, the licensee prepared DBS96-051 and mechanically i
4 blocked open dampers VP-A-56 and VP-A-57.
After the ISA team identified this issue, the licensee informed the ISA team
?
that the desirability of blocking open these dampers had been raised in 1991 by a staff person from YAEC in a memorandum dated February 20, 1991, with the j
subject, " Minimum Ventilation Requirements for the Containment Spray Pump i
Area." This memorandum contained a specific recommendation to block open i
dampers VP-A-56 and VP-A-57 because, "If the controller fails, it could cause j
the inlet vanes for both fans to close, causing a reduction in the output of j
the system." The ISA team found no evidence that this issue had been entered
)
into a corrective action system or was being tracked by the licensee. This was an example of the licensee's failure to take appropriate action to address l
a plant problem.
l Although the plans and progress to resolve the problems with HV-7 were considered positive, the ISA team considered the licensee's performance weak l
j in regard to the lack of followup of the identification of. the damper concerns j
from 1991 and also weak in that the recent focus on the problems with this ventilation system did not result in identifying a vulnerability with dampers VP-A-56 and VP-A-57.
I 2.3.8 Procedure for Cross-Connecting DC Buses h
Plant Procedure 1-22-2 " AC and DC vital Bus Operation," allowed cross-connecting redundant 125-Volt dc vital buses for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> during plant operation, contrary to FSAR Appendix A, Criterion 39, " Emergency Power i
for Engineered Safety Features," which stated, " Alternate power systems shall J
i be provided and designed with adequate independency, redundancy and capacity, i
and testability to permit the functioning required of the engineered safety features. As a minimum, the onsite and the offsite power system shall each, i
independently provide this capacity assuming a failure of a single active component in each power system."
i The ISA team found no instance when these buses had been cross-connected and, in response to the ISA team's concerns, the licensee stated that no occurrences of cross-connecting 125-Volt de vital buses were documented after 1982, but cross-connection could have occurred before this period.
1 The licensee stated that this procedure was intended to be used only in limited conditions with due consideration given to overall plant risk.
However, as a result of discussions with the ISA team, Procedure 1-22-2 would be revised to limit cross-tieing of de buses to Condition 5 or lower (i.e.,
l plant not at power) for maintenance activities.
i l
2.3.9 Environmental Qualification (EQ) Program 3
The ISA team found that the licensee was not meeting 10 CFR 50.49 requirements j
in that there were certain electrical components that were not qualified for their expected environment following a design basis event. There were concerns in three separate areas: submergence inside containment, a
j 29
. - - =
4 4
EQ/ Regulatory Guide (RG) 1.97 instrument qualification, and backlog of EQ j
items. The ISA team also noted that there was no assigned staff engineer with i
primary responsibility in this area.
l 2.3.9.1 EQ Submergence As a result of a concern by the ISA team about EQ component elevations being below submergence level, the licensee conducted a walkdown on July 24, 1996, l
j of reactor containment that revealed 30 components outside of Maine Yankee's i
design basis. These components were found to be installed below the maximum submergence level of 1.7 feet inside containment and were not environmentally qualified for the installed location. The EQ Program worksheets and EQ database did, not reflect the actual component elevations.
The EQ components affected were distributed into three groups: containment isolation valve position indication; all channels of steam generator level (wide range and narrow range) indication; and primary inventory trend system level indication. Submergence levels for the EQ components ranged from 1/2 inch to 31 1/4 inches below the maximum submergence level of 1.7 feet.
j The Q submergence problem was reported to the NRC in licensee event report (LER)'96-026 dated August 22, 1996.
The licensee's EQ submittal dated October 31, 1980, and the NRC's safety evaluation report (SER) dated June 1,1981, identified approximately seven plant components that were below the submergence level that needed to be removed or replaced to meet the EQ rule. As a result of the ISA team's inquiry, the licensee identified 30 components below the submergence level.
Several of these components, such as HCV-257, HCV-271, and TV-3501, were the same components that were identified as below the submergence level in the licensee's 1980 submittal and the NRC's SER.
2.3.9.2 EQ/RG 1.97 Instrument Qualification The assumptions used to established EQ requirements for emergency feedwater (EFW) flow instrumentation were found by the ISA team to be inconsistent with Emergency Operating Procedure (EOP) E-1, " Loss of Primary or Secondary Coolant," operational requirements in that, under design-basis accident conditions, the use of the EFW flow instruments may not have been available.
The EQ worksheets for EFW flow transmitters FIT-1201A, FIT-1201B and FIT-1201C stated that EQ for these instruments during LOCA conditions was not required per YAEC memorandum, MYP 93-0293, Revision 2; however, E0P E-1, Step 3.a, required the operator to ensure minimum FW flow for decay heat removal.
In MYP 93-0293, the licensee stated that steam generator level was an acceptable 4
means of verification of EFW flow when referenced in the E0Ps. However, without qualified EFW flow transmitters, E0P E-1 requirements may not be able to be accomplished in those situations (large break LOCA) where minimum EFW flow is required to ensure heat sink availability. During these situations, EFW flow instrumentation would be required until steam generator level exceeded the specified level limits.
30
)
4 a
l Since the EFW flow transmitters would be exposed to a harsh radiation i
environment during a LOCA (MYP 93-0293), the EFW flow instrumentation may need i
to be environmentally qualified. The licensee stated that evaluation of this j
i issue was under way as part of a revision to DBS 96-41. This revision would 1
add an action item to provide a detailed review of the radiation dose at the j
instrument location.
In addition, the licensee's RG 1.97 submittal and Regulatory Guide Source Document, " Design and Qualification Criteria for Post j
Accident Monitoring Instrumentation," identified these transmitters as being appropriately EQ qualified with no deviations from NRC guidance. The licensee l
did not adequately categorize and identify the exceptions taken on the RG I.97 data sheets.
l 2.3.9.3 Backlog Of EQ Items There were other potentially significant EQ issues that remained open. The j
licensee had recently identified an expanded HELB concern in the turbine J
building that had the potential to impact safety related components in the l
turbine building.
i 2.4 FSAR Inconsistencies l
Prior to the ISA team arrival on site, the licensee initiated a FSAR and Technical Specification review to identify discrepancies with the licensing i
basis. The licensee placed priority on reviewing those systems being reviewed i
by the ISA team. Over 100 issues were identified. The ISA team identified additional discrepancies which are discussed throughout the report. Many of i
these nsues will require changes to the FSAR and 10 CFR 50.59 reviews since j
equipment and procedures at MYAPS have changed from that described in the FSAR.
i 2.4.1 Spent Fuel Pool Heat Exchanger Rating l
The nameplate rating on the spent fuel pool (SFP) heat excharger was not 4
consistent with the design values in the FSAR.
i Section 9.8.2 of the FSAR stated that the tube-side design of the heat exchanger (HX) was 225 "F and the nameplate stated that the tube-side rating of this HX was 200 *F.
This discrepancy was noted in 1996 by an NRC review i
before the formation of the ISA team. The ISA team was concerned that the i
200 *F HX tube rating could possibly prohibit the restoration of SFP cooling following a prolonged loss of SFP cooling and bulk boiling in the SFP. The l
licensee claimed a reasonable expectation that this HX could be used to i
restore normal cooling following bulk boiling and was tracking an action item j
to analyze by January 1,1997, the capability of this HX to go to 225 'F.
The j
ISA team considered the licensee's schedule reasonable because (1) the FSAR does not acknowledge restoration of normal cooling following bulk boiling, (2) the HX can be bypassed if necessary, and (3) there was an expectation for
]
margin in the capability of this HX.
i i
31 J
)
i
2.4.2 Atmospheric Steam Dump Rated For 2.5 Percent Power The FSAR assumptions made regarding the response to a steam generator tube rupture (SGTR) were not realistic.
In addition, the licensee assumed a capability of the atmospheric steam dump (ASD) of five percent power as part of its validation for E0Ps. Subsequent licensee analysis of the steam generator tube rupture (SGTR) and inadequate core cooling (ICC) events revealed that the 2.5 percent value was acceptable for SGTR but not for ICC.
The ICC event was beyond the design basis of the plant but was considered as part of the E0Ps.
(See Section 3.1.3.1)
FSAR, Section 14.12, stated, "The quantity of reactor coolant transported through the leak to the steam system is the same with or without offsite power. The' primary to secondary leakage is assumed to be tenninated within 30 minutes following the rupture." The ISA team considered that the additional complication of a loss of offsite power (LOOP) during an SGTR event would make it unlikely that the operators would be able to isolate the leak as quickly as would be the case with offsite power available. Without offsite power, the operators would lose their ability to vent steam to the main condenser, they would be limited in venting steam for cooldown through a single 2.5 percent capacity ASD valve. They would have to manually shut a valve locally in the vicinity of the steam generator relief valves before opening the ASD valve.
The time to isolate the affected steam generator would be longer than stated in the FSAR.
In a letter dated July 1,1996, to the NRC, the licensee connitted to make physical changes to the atmospheric steam dump system to improve relieving capacity and reduce the isolation time of the affected SG.
G 32
l l
I h
3.0 ASSESSMENT
OF OPERATIONAL SAFETY The ISA team assessed Maine Yankee's performance in the areas of operations, maintenance and testing, and engineering by evaluating the programs in each of l'
these areas and the licensee's implementation of these programs.
f 3.1 Operations Assessment The ISA team assessed the ability of Maine Yankee to safely operate the plant l
in accordance with its licensing and design bases. The areas assessed j
included the licensee's programs for identifying and resolving problems, the j
quality of the licensee's operations, and the programs established to operate j
the plant.
In addition, the radiation protection and the fire protection programs were reviewed. The team interviewed operators and managers, l
performed three days of continuous control room observations, conducted detailed walkdowns of safety systems, reviewed E0Ps, observed simulator j
requalification training, and observed the implementation of programs used to operate the plant.
Overall, performance in the area of operations was very good. Strengths were noted in the areas of operator performance during routine and transient operating conditions; shift turnovers and pre-evolution briefs; use of risk information to ensure safe operations; and the involvement of management in Areas for improvement include reducing the number of day-to-day operations.
operator workarounds and compensatory actions, log-keeping, and post trip reviews.
3.1.1 Problem Identification / Problem Resolution The team assessed the programs used by Operations to identify and resolve problems in the plant. The team found that Operations was effective in identifying problems, but noted weaknesses with problem resolution.
3.1.1.1 Operator Workarounds and Compensatory Actions Maine Yankee had several problems involving plant equipment, which created an additional burden on the operators during the plant shutdown and startup In addition, Maine Yankee had established several observed by the team.
compensatory actions to address weaknesses in plant design. Some of these compensatory actions would require operators to take manual actions during a Several workarounds and compensatory actions were plant transient.
longstanding issues or recurring problems which the licensee had not resolved.
the team During the performance of a plant shutdown on July 19 and 20,1996, observed that the operators experienced several equipment problems which complicated the shutdown. These problems involved the trip of a motor-driven main feedwater (MDFW) pump following an attempted start, the slow response of the main feedwater pump recirculation valve when the pump was started, leakage past a main feedwater regulating valve bypass valve which required additional operator attention and actions, and the inability to operate the control element assemblies (CEAs) in the manual sequential mode due to a plant computer which was easily overloaded. The manual sequential mode problems 33
l contributed to the operator's decision to manually trip the reactor from low power during the shutdown, i
Maine Yankee had also implemented or proceduralized actions to compensate for weaknesses in the design of the plant. Compensatory actions were taken as a result of design vulnerabilities associated with ventilation systems for the safety-related battery rooms, switchgear rocas, emergency diesel generator (EDG) rooms, and the containment spray buildiej; turbine building flooding concerns; the inability to remotely isolate a ruptured steam generator; a single, undersized, steam generator atmospheric steam dump (ASD) valve; and a degraded offsite power supply.
l J,
3.1.;1.2 Control Room Staffing i
In March 1996, following its review of NRC Information Notice (IN) 95-33, "Switchgear Fire and Partial Loss of Offsite Power at Waterford Generating Station Unit 3," and IN 95-48, "Results of Shift Staffing Study," Maine Yankee evaluated the ability of the operating crews, at their established manning levels, to respond to a plant fire similar to that experienced at Waterford Unit 3 in 1995. The team found that Maine Yankee's evaluation was thorough and that the licensee had identified weaknesses in (1) timely implementation of the emergency plan, (2) oversight by the Plant Shift Superintendent (PSS),
(3) workload of the remaining Control Room Operators (CR0s), and (4) normal i
Shift Technical Advisor (STA) oversight. Maine Yankee found that if a medical emergency occurred during a plant fire, the PSS, as the assigned medical emergency responder, and the Shift Operating Supervisor (SOS), as the assigned fi,re brigade leader, could both be summoned from the control room to perfonn th'ese duties.
The team was concerned that the licensee had established conflicting procedural requirements that would be impossible to comply with in the event of fire coincident with a medical emergency.
During this postulated event, the minimum staffing requirements required in the Technical Specifications would not be satisfied if the senior reactor operators responded as described in the licensee's administrative procedures. The team found that Maine Yankee has previously developed a comprehensive action plan to address the shift staffing issues which included: (1) using security personnel rather than the PSS as medical first responder, (2) using a second CR0 as the fire brigade leader rather than the SOS, (3) providing an additional security guard for the fire brigade to replace an auxiliary operator, (4) enhancing the dose projection process, and (5) enhancing STA effectiveness. However, the team determined that Maine Yankee's schedule for implementing these corrective actions by the end of 1996 was not timely. The team also determined that the licensee missed an opportunity to identify and correct this vulnerability
)
during its review of IN 91-77, " Shift Staffing at Nuclear Power Plants," which discussed Maine Yankee's response to a fire.
In response to the team's concerns, Maine Yankee reassigned the duties of the medical first responder to the security supervisor, thus removing these duties from the PSS.
Additionally, the licensee planned to add a third licensed reactor operator to the control room staff and assigned the duties of the fire brigade leader to the reactor operator.
34
3.1.2 Quality of Operations 3.1.2.1 Control Room Observations The team observed the performance of operators during a 3 day period of sustained control room observations. During this time, operators performed a plant shutdown and cooldown to correct a design deficiency in the PCCW system.
Operators perfomed well during the plant shutdown and cooldown. The team observed. good command ano control and good use of procedures.
In addition, operators quickly identified and responded well to several equipment problems experienced during each activity.
The quality of communications used by operators during plant activities was good; however, the use of repeat-backs was inconsistent.
In addition, control room alarms were seldom announced to the entire crew. The team observed similar weaknesses during simulator training sessions.
Control room logs lacked detail and did not meet the guidance provided in Maine Yankee's administrative procedures. For example, operators did not log the starting time and stopping time of an EDG, equipment problems experienced during the plant shutdown, and the initiation of a manual reactor trip to shut down the reactor when problems were experienced. with the CEA drive system. Observed shift turnovers and pre-evolution briefs were informative and provided operators with complete information about shift activities.
Auxiliary operator performance was identified as a strength. Team members accompanied auxiliary operators on their plant tours and found that they were knowledgeable, performed thorough rounds, took accurate logs, identified housekeeping deficiencies, and communicated well with operators in the control The utilization and performance of STAS was also a strength at Maine room.
Yankee. The STAS were very experienced, had a good knowledge of plant operations, and were assigned a wide range of responsibilities, including conducting independent reviews of operability determinations and technical specification interpretations, making reportability determinations, and assisting the PSS with emergency plan implementation. The STAS also had a good understanding of probabilistic risk assessment which they used in t
performing on-line risk assessments and shutdown safety assessments. STAS updated these assessments as plant conditions changed and evaluated the effect of emergent maintenance on the assessment.
STAS maintained the system unavailability log book and investigated unusual occurrences reported on their shift.
3.1.2.2 Safety Systems Walkdowns The team performed a detailed walkdown of the accessible portions of the high-pressure safety injection (HPSI) and the service water (SW) systems to verify they were properly aligned. The systems were found to be properly aligned for emergency operation in accordance with the licensee's system operating procedures and plant drawings. Valves in the systems were labeled properly.
Control room labeling of remotely operated valves was satisfactory with each remotely operated valve identified by number, noun name, and actuation signal (if applicable). Minor deficiencies, such as inoperable local valve position indicators and unidentified packing leaks, were identified by the ISA team and 35
i the licensee entered these deficiencies into its work order system. Material condition deficiencies associated with the SW system.are discussed in Section j
3.2.1.5 of this report.
}
3.1.2.3 Management Oversight of Operations l
Management oversight of plant operations was good. Managers were involved in the day-to-day operation of the plant and in the resoluti.on of emergent 4
problems.
In addition, managers were actively involved in the operator i
requalification training program. Managers observed and evaluated crew performance during siinulator training sessions, participated in the critique of crew performance, and reinforced their expectations for operator performance, including communications. Operations management met with crews i
during the training week to discuss operations issues. Management also conducted periodic assessments of the Operations Department as part of the Operations Performance Assessment Program. Control of overtime at Maine i
j Yankee was also very good.
4 l
3.1.2.4 Risk Management
~
l The use of Online Safety Assessments (OLSAs) and Shutdown Safety Assessments j
(SSAs) were strengths. The OLSA was used as a tool to assess the safety implications of scheduled maintenance, unexpected equipment failures, unscheduled maintenance, and for developing long-range maintenance schedules.
l The SSA provided a simplified indication of the level of plant safety when the plant was shut down. The STAS performed safety assessments each shift, or l
when major equipment was found inoperable or removed from service. These assessments were connunicated throughout the organization and risk insights were apparent in the licensee's decision-making process.
l The OLSA was based on key safety functions, PRA significance, external events, l
as well as operational and engineering judgment. Both the online and shutdown i
assessments used relatively simple, straight-forward methods to assess risk.
OLSA was computer based and provided a plant score which was converted to a risk condition, i.e., green, yellow, orange, or red (in order of increasing j
risk). The OLSA program allowed calculation and control of accumulated risk i
during power operation by use of simple methods. SSAs were qualitative rather than quantitative and resulted in an overall risk condition, i.e., green, yellow, orange or red.
Management controls required approvals for intentional entry into the higher
{
risk conditions and provided directions (such as immediate exit or development of contingency actions) for unplanned entry into higher risk states. Controls j
were established for exceeding calculated allowable times in higher risk l
states.
4 l
3.1.2.5 Operability Determinations Maine Yankee's operability determinations were generally acceptable, although
}
some weaknesses were noted. The team reviewed approximately 60 operability determinations performed in the past by Maine Yankee and found that the a
determinations were appropriate. However, while on site, the team noted that f
36
i i
i 1
[
the licens'ee made an incorrect operability determination associated with the performance of engineered safeguards feature relay testing.
i l
On August 15, 1996, the licensee initiated SIC 96-18 to address inadequate testing of safety injection actuation system relays associated with the HPSI and the containment spray swing pumps. The PSS and the STA performed an j
operability determination and appropriately declared these pumps inoperable.
1 On August 16, the licensee reported that the testing of HPSI pumps P-14A and 14B did not test all contacts in the pump start circuitry. On August 17, the Operations Manager issued a memorandum stating that these testing discrepancies did not render the ECCS pumps inoperable because the Technical l
Specifications (TSs) did not specifically require that all safety injection actuation system contacts associated with the pump start circuitry be tested.
l i
The team found that this interpretation of the TS requirements was incorrect.
The licensee inappropriately interpreted the relay tests required by TS Table 4.1-2, " Minimum Frequencies for Checks, Calibrations and Testing of Engineered i
Safeguards Systems Instrumentation Controls," were limited to verifying that the relays actuated properly. The licensee did not believe that TSs required I
contact actuation verification to confirm proper operation of the pump.
}
Following a conference call between Maine Yankee, NRC Region I and NRR l
personnel, the Operations Manager wrote a memorandum to the PSSs and STAS, which stated that if a safety-related logic circuit testing deficiency was j
identified, the associated components would be considered inoperable due to a j
f ailed surveillance and the appropriate TS would be entered.
3.1.2.6 Technical Specification Interpretations The team reviewed 64 TS interpretations and found that the licensee appropriately used the interpretations to clarify specifications which lacked I
detail. However, 2 of the 64 interpretations reviewed inappropriately changed the intent of the applicable TS.
1 Technical Specification 5.5.B.9 required Maine Yankee's Nuclear Safety Audit and Review Committee (NSARC) to audit facility activities at frequencies defined by Sections a through k of this specification. The licensee had incorrectly applied the provisions of TS 4.0.A and incorporated a maximum i
allowable extension of +25 percent to the audit intervals. Maine Yankee indicated that it planned to cancel the interpretation.
k TS 3.14 required two reactor coolant leakage detection systems of different j
operating principles to be operating, with one of the two systems sensitive to radioactivity in the containment, when the reactor was above two percent power.
In a TS interpretation approved in 1985, Maine Yankee determined that leak detection systems sensitive to radioactivity were the containment gaseous radiation monitoring system, the containment air particulate detector radiation monitoring system, and daily containment grab samples. The team concluded that including a daily containment grab sample in this interpretation was a change to the TSs because this did not represent a continuously operating system. The licensee disagreed with the team.
37
i At the conclusion of the assessment, the NRC was reviewing the appropriateness of this TS interpretation.
3.1.2.7 Post-Trip Reviews The The team reviewed five post-trip reviews (PTRs) from 1991 through 1996.
PTRs, in general, lacked rigor and completeness. The reviews did not have detailed event timelines, complete descriptions of the event, and operator The PTRs did not responses could not be determined from the documentation.
contain a complete list of required and completed short-term corrective actions and planned long-term corrective actions.
In addition, individual operator statements contained in the reviews generally did not contain i
sufficient detail to add value to the review. One PTR reviewed by the team indicated that data from the plant computer was unavailable because of problems associated with the plant computer and its inputs.'
p 3.1.3 Programs And Procedures 3.1.3.1 Emergency Operating Procedures Although the quality of the emergency operating procedures (EOPs) at Maine Yankee was good, some exceptions were noted.
In general, procedures conformed to the writer's guide and gave clear guidance. to the operators. However, Maine Yankee recently reported that E0Ps may not be adequate to address an inadequate core cooling (ICC) event and a steam generator tube rupture (SGTR) under certain conditions.
In 1986 Maine Yankee identified the inability to recover from an ICC event due The ICC to the small relief capacity of the atmospheric steam dump valve.
event is a low-probability event which requires a small-break loss-of-coolant accident coincident with a loss of condenser vacuum and loss of both trains of HPSI. Although the licensee planned to correct the problem, these plans were The licensee did not provide an deferred and ultimately canceled in 1992.
explanation as to why the plans to increase the relief capacity were canceled.
In February 1996, the E0P coordinator re-discovered Maine Yankee's inability to recover from an ICC event and brought the issue to plant management's Maine Yankee informed NRC on March 4, 1996, that the information attention.
contained in a previously submitted E0P generation package regarding the capacity of the atmospheric steam dump valve was incorrect.
In the Plant Root Cause Evaluation Report completed in July 1996, the licensee concluded that the ICC event was not a design-basis event and Maine Yankee was not required, nor did it commit, to have the capability to mitigate an ICC Nonetheless, the licensee did inform the team it intends to modify the event.
At the conclusion of the assessment, plant to increase steam relief capacity.
the NRC was reviewing Maine Yankee's commiitments with respect to the ICC j
event.
In May 1996, Maine Yankee found that it may take more time to isolate a ruptured steam generator than was originally assumed in the SGTR E0P analyses.
Specifically, in the event of a SGTR with a coincident loss of condenser
~
38 2m y
--,---y
i i
1 f
vacuum,, the time to isolate the ruptured steam generator could exceed 20 i
minutes; this is 15 minutes longer than the analysis assumption of five minutes. This increase was identified when Maine Yankee found that, due to a harsh environment created by the lifting of the main steam safety valves, an j
operator would have to don protective clothing to enter the main steam valve j
house in order to close a manual valve to isolate the ruptured steam generator. The licensee determined that, as a result of the additional time j
to isolate the steam generator, the potential existed to overfill the steam generator, releasing radioactive liquid to the environment, and possibly l
exceeding the limits of 10 CFR Part 100.
In response to its finding, the licensee conducted training to reduce the l
amount of time it would take an operator to don protective clothing and isolate the' steam generator. The licensee stated that opemors could isolate l
the ruptured steam generator prior to overfill. To ensure that the limits of l
10 CFR Part 100 would not be exceeded in the event'that an overfill condition i
did occur, Maine Yankee administrative 1y limited reactor coolant system activity to 10-percent of the maximum value allowed by TS.
s The team reviewed Maine Yankee's E0P transient analyses for two additional events, loss of secondary heat sink and post LOCA cooldown, and did not
}
identify any discrepancies with the information or assumptions used for these l
t i
The team conducted walkdowns of alected E0P operator actions performed outside of the control room. ' alkdown of actions outside of the control room i
for establishing HPSI and EFW/AFW, identified by the IPE as important recovery j
actions, revealed that the procedures were adequate to perform the tasks.
i Necessary tools were. available and valves were properly labeled. Sufficient emergency lighting was installed to allow proper identification of components, with the exception of the upper levels of the main steam valve 1trea. However, j
the licensee indicated that in an emergency, the operators would be wearing l
" bunker gear" which has a helmet light that would allow component j
identification. Also, the licensee was evaluating the installation of emergency lighting in this area.
Control room switches were properly j
labeled, and all valves that might require 1ccal operation were also properly j
labeled.
l 3.1.3.2 Configuration Controls 4
l Maine Yankee drawings were accurate with a low backlog of drawing revisions.
Control room drawings were of good quality and appropriately updated to l
reflect plant temporary modifications.
Equipment labeling was good. The team noted that labeling on major equipment (valves and pumps) was very good. Labeling on plant instrumentation and 4
gauges was not as good as on valves and pumps, but no deficiencies were noted.
4 During tours of the containment, the team found handwritten markings on the wall that included informal system drawings, component identifications, and a i
~i scale used in determining reactor vessel water level when in reduced inventory. The licensee indicated that these were old markings, were not used, and would be removed.
j 39 i
n~,
i i
During control room observations, the team witnessed locked valve controls and hanging of equipment tag-outs, including team verification of the adequacy of tagging boundaries. The team also reviewed controls associated with operator information postings.
Equipment tag-outs were appropriate and locked valves were properly positioned and locked.
During walkdowns of the SW and HPSI systems, the team found the systems properly aligned and valves properly locked.
3.1.3.3 ' Restart Readiness Program 1
~
The team reviewed the Restart Readiness Program initiated during the extended outage in 1995. The purpose of the program was to achieve an event-free startup, to operate the unit safely and reliably throughout the operating cycle, and to ensure that plant equipment, procedures and staff were well prepared for startup and continued power operation following the extended outage. By initiating the Restart Readiness Program, Maine Yankee management provided additional oversight of the restart effort and performed a systematic and thorough review of equipment readiness. Maine Yankee.also reviewed internal and industry operating experience to identify potential pitfalls and good practices related to restarting from an extended outage. The team found that the Restart Readiness Program was generally successful; however, it did not prevent several fuel handling events which occurred toward the end of the outage. As detailed in NRC Inspection Report IR 95-24, NRC staff noted weaknesses in the areas of preparation, training, decision-making, and problem 3
identification, as well as corrective actions associated with the incidents.
3.1.3.4 Operations Performance Assessment Program The Operations Perfonnance Assessment Program was effectively implemented.
The program consisted of periodic self-assessments in the areas of conduct of operations, housekeeping, training, and administrative controls. Management i
reviewed the results of the assessments for repetitive problems and to evaluate the effectiveness of corrective actions. Negative findings received management attention and adjustments were made to the assessment frequency, as necessary.
3.1.4 Plant Support 3.1.4.1 Fire Protection Program The team found that the Fire Protection Program at Maine Yankee was receiving increased management attention and resources to address previous problems in this area. Maine Yankee had experienced problems with penetration seals, control of combustibles, and fire protection equipment. As a result of these problems, Maine Yankee instituted a Fire Protection Improvement Plan (FPIP) in 1995. The team found that Maine Yankee had made progress in implementing the FPIP. Planned activities included documenting the design basis for the FP system, inspecting penetration seals, and upgrading the procedures for controlling combustibles and ignition sources. Maine Yankee added a Fire 1
Protection Engineer, planned to hire a new Fire Protection Coordinator, and
' created a Fire Protection Training Instructor position.
40
i 3.1.4.2 Training Program 4
l The team observed four simulator training sessions to evaluate the j
effectiveness of E0P training.
Crews performed well. Recent initiatives to improve training and evaluations, including increased involvement of the crews 1
in critiques, commitments by crews to improve in those areas identified as needing improvement, and objective evaluations of crew communications, were viewed as good enhancements to operator training. The team noted that there i
1 was an increased emphasis on improving crew communications.
In addition, the team observed that Operations management attended simulator training sessions and participated in the evaluation and critique of crew performance.
Simulator training was good and management's participation was a strength.
i The team observed a classroom presentation and found that it contained a good mix of lecture, questions, and crew participation.
3.1.4.3 Radiation Protection Program i
)
The team assessed the Radiation Protection Program in the areas of radiation l
exposure controls, the "as-low-as-is-reasonably achievable" (ALARA) personnel exposure program, contamination controls, and the effectiveness of earlier improvement programs.
l The licensee's ALARA program was generally effective in controlling personnel exposure. With the exception of 1995, which consisted of an extended outage to repair steam generators, yearly personnel exposure had declined for all years (outage and non-outage). Maine Yankee management was proactive in the implementation of the ALARA program and had established an aggressive personnel exposure goal for 1996. Daily exposure was discussed at the morning meetings and management recognized that the personnel exposure for the spent fuel pool rerack project was higher than previously expected. As a result, management initiated a review of the work to reassess the ALARA planning and determine if the proper controls were in place to minimize exposure.
ALARA planning packages reviewed by the team were thorough, comprehensive, and included ALARA hold-points, the use of training mock-ups, the identification of low dose rate waiting areas, and shielding evaluations. ALARA briefings observed by the team were comprehensive.
Maine Yankee was not effective in identifying and controlling contamination in areas of the plant considered to be clean. The team reviewed the personnel contamination events identified by Maine Yankee in 1996 and found that approximately 50 percent (44 out of 90) of the contamination events occurred in areas that were believed to be clean or uncontaminated.
The radiation protection program had been effective in identifying areas where improvement was needed, but had been less effective at resolving these problems. Specifically, recurring problems had been noted in the areas of unplanned exposure, the control of personnel contaminations, use of procedures, and supervisory oversight.
41
3.2 Maintenance And Testing Assessment The team determined performance in the Maintenance area was good overall, however, testing was weak. The results of the operating performance reviews for the auxiliary feedwater (AFW), emergency feedwater (EFW), high pressure safety injection (HPSI), and emergency diesel generator (EDG) systems showed i
mixed equipment performance. With some exceptions, safety-related pumps and valves operated well, and containment penetration testing has resulted in few problems, reflecting good plant material condition. Communications were found to be good among Operations, Maintenance, and Plant Engineering Department personnel. The Maintenance Department staff did an effective job at identifying material condition deficiencies however some deficient conditions were not identified, such as the poor condition of the circulating water pump building service water (SW) bay. space, and AFW deficiencies. The quality of plant maintenance was good as evidenced by minimal maintenance rework issues, and the overall good equipment operating performance. Several instances of equipment malfunctions which occurred during multiple plant shutdown and startup attempts in 1996 indicated declining material condition following the 1995 outage.
Inadequacies in the scope of testing programs were identified, as were weaknesses in the rigor in which testing was performed and in the evaluation of testing results to demonstrate functionality of safety equipment. A lack of a questioning attitude, and stressed resources resulted in the use of poor surveillance procedures and ineffective evaluation of surveillance test data.
In contrast to these weaknesses, the extent and types of eddy current testing of steam generator (SG) tubes was evidence of an aggressive and questioning attitude to determine the extent of SG tube crack ~ing. The results of that testing led to the decision to sleeve SG tubes in 1995.
Overall work order planning and tracking was good, however, some weaknesses were found in the work control process.
3.2.1 Equipment Performance Equipment performance was good overall with some areas being excellent and some being weak. Conditional probabilities which incorporate component availabilities and re11 abilities were poor for the AFW system, good for the EDG and HPSI systems, and excellent for the EFW system. Equipment perfomance of pumps and valves tested in the inservice testing (IST) program was excellent, and containment penetration testing results indicated the capability of the containment to withstand postulated accidents. There were some indications that plant material problems were increasing within the last year as evidenced by operational problems occurring during 1996 that were 4
caused by poor material condition. Plant walkdowns indicated some material condition problems including the poor material condition of the service water bay space in the circulating water pump building.
3.2.1.1 Equipment Performance of Auxiliary Feedwater, Emergency Feedwater, High Pressure Safety Injection, and Emergency Diesel Generators The team performed an 'indepth review of equipment operating statistics for AFW, EFW, HPSI, and EDG systems for the time period from January 1, 1992, 42
l through June 30,1996, (the time period) to determine their individual equipment conditional probaisilities. The calculated conditional probability value for each system represents the probability that the system would be able to complete its mission when demanded, and was calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in maintenance for operating conditions 5, 6, and 7), (2) the probability of start (cumulative successful starts / cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given that a successful start I
had occurred). The results of the conditional probability study for the four systems that were reviewed showed mixed equipment performance.
Performance of i
the AFW system was determined to be poor, EFW system was excellent, HPSI system was good, and the EDG system was good. Additional information showing time-dependent probabilities appears in Appendix C.
The findings for each system are detailed below:
(1)
Auxiliary feedwater system conditional probability Based on the results of testi.ng, the AFW system (consisting of one steam driven pump) performed poorly for the time period analyzed and was worse than the performance values assumed in the licensee's Individual Plant Examination (IPE). The licensee's IPE assumed conditional probability of approximately l
91-percent, however, the team found that the conditional probability of the AFW system responding to a demand varied over the time period (January 1, 1992 j
to June 30,1996) from a high of approximately 82 percent to its latest conditional probability of approximately 76 percent. The licensee was not fully aware of the poor condition of AFW pump P-258 and had not updated assumptions made in their IPE.
The AFW pump P-25B had difficulties both with failing to start and failing to run during surveillance testing.
It had a failure to run in October 1992, j
because of an overspeed trip, a failure to start in January 1993, due to a controller problem, a failure to run in October 1993, due to an overspeed trip, a failure to start in January 1995, due to a controller problem, and a failure to run in June 1996, due to water and oil leakage problems. Due to several overspeed trips and maintenance down time after June 30, 1996, the overall conditional probability would likely drop below 70-percent. The AFW l
system was a standby system that had not been used by the plant for actual demands, and was designed to be started manually by. operators.
(2)
Emergency feedwater pump conditional probabilities The EFW system (consisting of two electrically driven pumps) performed well during the time period analyzed and compared well with the performance values used in the licensee's IPE. The system responded to actual demands following reactor trips during-the time period. The system also responded adequately to demands during plant startups and shutdowns.
The system did not respond to all test demands during the period in that EFW pump P-25C had one failure to start during a surveillance test in December 1993, when a breaker tripped open. There were no testing failures for pump 5
43
l i
P-25A pump during the time period. The EFW system automatically started and ran successfully on three separate occasions following reactor trips during 4
i the time period from January 1, 1992 to June 30, 1996.
During each event, the pumps performed as designed.
(3)
High pressure safety injection system conditional probabilities Overall, the HPSI system performed reasonably well during the time period 4
j analyzed.and compared well with the performance values used in the licensee's IPE; with the exception of " failure to start on demand assumptions.".The licensee's IPE would indicate a conditional probability of approximately 99.5 percent, however, the team found that the conditional probability of the HPSI i
system was better for pump P-14A at 100-percent (does not include test failure l
in August 1996, caused by a cut wire in the start circulty), and lower for pumps P-14B and P-14S at approximately 98-percent but was improving. The 4
failure to start of HPSI pump P-14A occurred after the period of analyses.
i Had this test failure been included in the analysis, the conditional probability would have been lower.
The HPSI pumps had few failures during the time period analyzed. There was a failure to start of HPSI pump P-14B in March 1994, due to a breaker problem, and one failure to start of pump P-14S in August 1992, due to an interlock key in bus 6 that would not engage properly.
For the time period analyzed, there were no emergency actuations of the hrSI system.
j In response to a weakness identified by the team regarding lack of logic testing, the licensee performed some additional testing. A special test of pump P-14A resulted in a failure to start. Troubleshooting activities to determine the cause of the failure indicated that a wire had been inadvertently removed in the safety injection actuation signal (SIAS) start i
circuit for pump P-14A. Consequently, whenever pump P-14A had-been aligned as the alternate pump during normal operation, it would not have received an automatic start signal as designed.
If needed, the pump would have to be started manually. The licensee recalculated their IPE with this automatic signal missing to pump P-14A and found that the core damage frequency was increased by approximately six percent.
(4)
Emergency diesel generator conditional probabilities The performance of the EDGs (consisting of two diesels) during testing was good overall for the time period analyzed, and compared reasonably well with the values used in the licensee's IPE. The licensee's IPE would indicate a conditional probability of approximately 91 percent, while the team determined the conditional probabilities for EDG-1A and IB to be approximately 92 and 90 percent respectively. The'1B diesel had been slowly improving from a weak conditional probability of approximately 88 percent from December 1993, to June 1996, when it reached 90 percent. The latest trend for the IB diesel was downward to due increased planned and unplanned maintenance.
EDG-1A had one failure to run in April 1996, due to a cooling water pump shaft seal leak and a fuel oil fitting leak. EDG-1B had one failure to start (cause unknown) and one failure to run (cooling water pump seal leakage) in December 44
l 1993. The EDGs were not required to be started as a result of an emergency non-test actuation during the time period considered while at power j
operations.
i 3.2.1.2 Equipment Performance Demonstrated Through Pump and Valve Testing i
Results of pump and valve testing performed as part of the licensee's IST program were very good, and test results showed that critical pumps and valves j
i operated.well, indicating good plant material condition. Of the 21 pumps in the IST program, none were in the alert or action ranges which would require i
either accelerated testing or corrective actions.
In addition, of the 381 l
valves in the IST program, only three were on an accelerated test frequency program due to stroke times in the alert range. Along with the IST results, j
vibration data were collected through the predictive maintenance program which a
j was used to assess the performance of rotating equipment. The rotating equipment log was used effectively to document items requiring additional monitoring and correction.
i 3.2.1.3 Containment Performance Demonstrated Through 10'CFR 50 Appendix J Leak Rate Testing j
Results of testing performed in accordance with 10 CFR Part 50 (Appendix J) for containment penetrations revealed few problems. These test results indicated the acceptability of the containment as a barrier to fission product release and that containment leakage criteria were met. For example, seven integrated leak rate tests (ILRTs) were accomplished since 1972 (1972, 1975, 1979,1982,1985,1988, and 1992), resulting in one test failure (1985).
Some repetitive prob 1eas had occurred while performing local leak rate testing (LLRT). Testing of containment purge valves over the last few years has i
resulted in some failures that were adequately addressed by the-licensee in j
The main cause of the failed tests was determined by the licensee to be 1995.
an improper adjustment of an actuator during maintenance activities.
In addition, the licensee had established a close out plan to identify and track issues with purge valves in general. Additional repetitive testing failures j
involved the containment sump isolation valves caused by debris in the sump such as tie-wraps, weld rod and sat ty wire. The LLRTs for these valves had routinely exceeded the administrativ. limit of 2.0 pound mass (1bm)/ day and their inoperable limit of 10 lbm/ day. The last five tests (perfonned since December 1995) were above the administrative limit, but below the inoperable i
limit.
Proposals had been suggested to provide additional trench screens and to clean the sump and containment trenches during the 1997 refueling outage.
I 3.2.1.4 Equipment Problems Trending Upwards Plant material condition at Maine Yankee had been good over the last few years l
but during 1996 there were indications that equipment problems have been During the three years prior to the 1995 steam generator repair increasing.
outage, Maine Yankee experienced a generally good plant operating performance j
record and plant material condition.
l l
45 1
4
)
Since coming back on-line in January 1996, the overall performance of Maine Yankee had been mixed. Although the unit was placed in service on January 16, 1996, power was reduced from 18 percent to less than 10-percent, and the main generator was taken off the grid to repair a main generator cooling control valve. The reactor tripped on February 13, 1996, when a feedwater valve positioner failed, and on July 14, 1996, power was reduced to locate a small leak in a condenser waterbox.
A plant outage to perform modifications to the primary component cooling water (PCCW) system piping began on July 20, 1996. During the plant shutdown, l
several. equipment problems occurred, including the trip of a motor-driven main feedwater pump upon manual start, the slow response of main feedwater regulating bypass valves, and the inability to insert the control element -
assemblies it manual sequential mode. During the outage, additional equipment problems were identified that needed to be addressed prior to startup, including operability problems with AFW pump P-25B, excessive leakage of a residual heat removal valve (RH-4), and identification of safeguards equipment actuation logic testing deficiencies and associated equipment problems. The attempts to restart required the licensee to change operating conditions many times to address equipment concerns. After completion of repairs, the plant was returned to service on September 2, 1996. The number of equipment problems identified in 1996 indicated that problems were trending upwards following the 1995 steam generator repair outage.
3.2.1.5 Plant Walkdown Observations The team conducted walkdowns throughout the plant. There were noteworthy observations of PCCW piping corrosion, service water (SW) pump bay degraded.
components, and cleanliness problems within the containment building..The team observed extensive external corrosion on a large portion of the PCCW piping within containment during a walkdown. This problem was previously identified and was monitored by the licensee. The corrosion, while creating a visible appearance of an extremely poor material condition, did not prevent the piping from performing its safety function and had been monitored by the licensee. The licensee indicated that portions of the corroded PCCW piping located inside of containment would be replaced with stainless steel piping during the 1997 refueling outage.
Team walkdowns of the SW pump bay in the circulating water pump building also revealed extensive material condition problems, such as water on the floor, corroded fasteners, corroded supports, pump base plate corrosion, missing u-bolt hanger parts, and cracked grout pads. After the team identified these problems, the licensee performed an in-depth inspection of the SW pump area, and found additional problems, which included a disengaged support (caused by the lack of weld penetration) for the raw water line leading to SW pump P-298.
The pump was declared inoperable until a preliminary analysis indicated that the pump could withstand applicable loads despite the degraded support. The licensee indicated that resources would be made available to greatly improve the material condition of the SW pump bay.
The licensee had not effectively inspected the containment for cleanliness after the outage. Team observations inside the containment indicated that.
46 j
]
i housekeeping required greater attention to eliminate inappropriate foreign material or items left over from maintenance activities.
During inspections inside of the containment, the teans identified problems with housekeeping and l
cleanliness, such as items wrapped in unqualified plastic, and discarded tape.
During followup inspections, the licensee found uncontrolled tools in the l
containment. The licensee implemented an initiative to replace plastic coverings utilized inside the containment with high-temperature qualified i,
material.
{
3.2.2 Problem Identification And Resolution 1
j The Maintenance Department staff was effective in finding and documenting material condition deficiencies within the plant. They also identified and initiated the majority of corrective and non-corrective work orders (W0s). The i
WO process was the primary process used to initially identify and correct deficiencies. However, the effectiveness of the problem identification and l
resolution process was inconsistent. In many instances, testing was not an effective tool in identifying problems. A lack of a questioning attitude during test performance and evaluation was not conducive to discovering equipment problems, but rather to accepting equipment performance.
Walkdowns of plant systems indicated that some deficient conditions were not i
being identified by either of the three main groups (Maintenance, Engineering, l
and Operations Departments). These included the poor conditions of the j
circulating water pump building SW bay space and AFW pump P-25B deficiencies.
l Depending upon the type or severity of a deficient condition, the licensee i
used other corrective action processes to evaluate the cause. The main corrective action program used by the Maintenance Department to review rework was not fully effective and, in some cases, failed to identify substantive j
problems or trends. Procedure No. 67-300-1, " Maintenance Self-Assessment Program (MSAP)," established a system for maintenance rework identification and corrective action follow-through. The procedure provided a system for i
equipment trending to identify recurring problems and to determine appropriate corrective action, and provided a system to enhance availability of lessons learned during previous maintenance evolutions. For example, rework and repetitive failures associated with the AFW and EFW pumps were not identified i
by the program as issues.
Examples that were fNnd ino!cated that the program was not always effective and in some cases the organizations at Maine Yankee were not communicating and cooperating with each other to identify and prevent i
repeat problems. Maine Yankee had identified this deficiency and was in the process of integrating existing fragmented corrective action programs with the intent of being more effective in identifying, resolving, tracking 4
j deficiencies, and minimizing repetitive failures.
I The resolution of the Magne-Blast breaker problems demonstrated an effective program that corrected manufacturer equipment component defects and i*
workmanship. Beginning in September 1993, the licensee experienced many j
problems with 4.16 kV and 6.9 kV Magne-Blast breakers.
Problems with the i
breakers at other plants had also been observed and had continued to be i
identified by the industry during 1996. As a result of the various breaker issues commencing with the 1993 occurrence, a significant testing and s
J 47 1
i L
inspection program was implemented by Maine Yankee to resolve these problems,
~ including consultation with the manufacturer, General Electric. The process was characterized by good focus, proactive approach, organized and comprehensive tracking of issues, clear communication, and traceability of documentation.
3.2.3 Quality of Maintenance The quality of plant maintenance was good, as evidenced by good overall plant material condition, good equipment operating performance, and a competent Maintenance staff. However, several instances of equipment malfunctions which occurred during recent plant shutdown and startup attempts indicated a declining trend in material condition.
Equipment problems that delayed recent plant startups or complicated shutdowns included, repetitive AFW pump P-258 problems, leak-by of valve RH-4, foreign material in steam generator blowdown valve BD-T-12, a motor-driven feed pump trip, a slow response of a main feedwater (FW) regulating by-pass valve, and the inability to operate the control element assemblies (CEAs) in manual sequential mode.
The team observed or reviewed several maintenance activities.
Pre-job briefings were noted as excellent.
In general, procedure use and adherence were appropriate, but there were some instances of poor maintenance work practices.
(1)
Failure to implement vendor recommendations for EFW pump P-25A During 1995, the licensee overhauled EFW pump P-25A, as a result of vendor recommendations to replace certain carbon steel pump internals with stainless steel parts because of previous incidents of internal component cracking. At the same time, additional internal pump parts were replacad. After reassembly of the pump, the licensee noted a binding of the pump internals when the pump was hand rotated during troubleshooting activities. Because of the binding, the new internals were subsequently removed and the old internals were reinstalled.
During the final stages of the reinstallation of the old internals, the licensee had not perfomed a magnetic particle inspection of the "used" pump diffusers prior to reassembly as recommended by the manufacturer.
However, it was also noted that the pump had performed well since January 15, 1996.
(2)
Work order instructions not followed, service water system declared inoperable Licensee communication weakness resulted in a degraded condition of the SW system during maintenance on a seismic piping support. This event, which was discovered and reported by the licensee, related to a single event involving a problem of WO adherence and potential communication inadequacies. A maintenance Section head discovered that Maintenance personnel had removed a
~
seismically qualified pipe support on a seal water line for SW pump P-29C without tagging out the pump. The support was removed to the " cold shop" when only prefab work was allowed by the WO. This condition was reported to the 48
4 control room, and the operators declared the pump inoperable on August 13, l
l The support was repaired, and the pump was subsequently declared 4
1996.
operable on August 17, 1996.
Poor foreign material exclusion work practices resulted in a failure of i
i*
(3) steam generator blowdown valve, BD-T-12.
4 i
following repeated attempts to close valve BD-T-12 (a 18, 1996, On August containment isolation valve), the valve was declared inoperable because it l
When the valve body was disassembled, a piece of would not completely close.
The
{
weld rod was found lodged in the seat, preventing the valve from closing.
licensee was unable to determine the source of foreign material.
Lack of procedural detail for installation and control of fastener j
.(4)
-lockwire
}
A lack of WO detail resulted in a failure to reinstall fastener lock wire on The team discovered that i
components following maintenance activities.
lockwire was missing during a containment walkdown involving five in-core l
j instrumentation seal housings and on motor-operated valve (MOV) actuator These conditions did mounting bolts for reactor coolant (RC) valve RC-M-32.
not pose an immediate safety concern, however, the licensee generated W0s to j
install the missing lockwire. The licensee also took actions to review and i
revise procedures involving lockwire installations.
3.2.4 Testing Weaknesses The team found inadequacies in the scope of testing programs, and weaknesses s
l in the rigor in which testing was performed, and in the evaluation of testing Despite the many i
results to demonstrate functionality of safety equipment.
inconsistencies between information contained in the Final Safety Analysis j
Report (FSAR) and the as-built condition of the plant (Se l
A lack of a questioning l
design requirements, and to correct these errors. attitude resulted in the ineffective evaluation of surveillance test data to detennine equipment Of the test procedures that were reviewed, the team found operability.
several examples of tests that had been developed, performed, and evaluated l
Examples many times without questioning the validity of the test results.
i i
include:
l' (1)
Poor emergency diesel generator testing procedures A large number of important electrical time-delay relays were not verified for 4
The team proper operation and were-not in the licensee's calibration program.
identified that the 10 and 20 second EDG load sequencing relays had not been j
calibrated since installation, the tolerance band and acceptance criteria had j
not been established, and these relays were not in the Maine Yanke Calibration Program.
10 and 20 second sequencing time delay relays and the tolerance acceptance i
criteria for the relays were not logged on the surveillance procedure, and the I
The procedure f,
20 second timer actuation was not verified in the procedure.
2 j
49 2
i
4 was also incorrect in that the signoff for the 20.second timer actuation was listed in the procedure as 30 seconds. The procedure had-been performed many times without questioning the 10 second error in the timing sequence.
Based on the team's questions in this area, the licensee identified several other relays that were not tested or included in their calibration program.
These relays included, the motor-driven fire pump start permissive relay and the permissive relays to remove the low pressure safety injection (LPSI) pump trip 10 seconds after the recirculation actuation signal to allow manual restart of.the pump. The licensee indicated that an appropriate calibration interval would be assigned to these relays.
(2)
Control room ventilation test results not properly evaluated The licensee failed to question the adequacy of a surveillance test used to determine if a positive differential pressure (dp) existed between the control room (CR) and adjoining rooms or buildings, and the assumptions used in a Yankee Atomic Electric Company (YAEC) calculation issued to justify the 2
operability of the CR ventilation system. On October 31,.1995, a negative dp was observed during a surveillance test. The procedure required a positive dp to be acceptable. On December 12, 1995, YAEC issued a memorandum to the licensee, which justified operability of the CR ventilation system in response to the test results. However, the YAEC calculation failed to incorporate the negative pressure results in the calculation (based on engineering judgment and control room pressure history the analyst assumed that the pressure was positive). Subsequent to the YAEC memorandum, the licensee failed to question the assumptions in the YAEC response and declared the CR ventilation system operable. Based on the team's concern that no corrective actions had been taken to address the failed CR ventilation surveillance test, the licensee performed an extensive dp surveillance and determined that current CR dp was positive. Further review of the October 31, 1995, failed test -and the YAEC calculation assumptions by the licensee indicated that the CR ventilation system was inoperable from the failed test in October 1995, until the successful retest in August 1996.
(3)
Inappropriate inservice test procedures for check valvt testing The methodology used in test procedures to verify closure of safety-related pump discharge check valves in the IST program was inappropriate. The team observed the performance of surveillance test 3.1.22, Revision 15, " Emergency Feedwater System Cold Shutdown Flow Test," and questioned whether the specified pressure instrument and test methodology was acceptable to measure backleakage through the check valve. The licensee concluded that the instrumentation was not appropriate for the test application and retested using a pressure instrument at an alternate location. The licensee later determined that this too was an unacceptable test method because the EFW suction piping was connected to an open system. For the EFW system, the licensee determined that measuring reverse flow through the check valve was the method that should be used. The licensee initiated a review to determine if other systems were similarly affected, identified procedural inadequacies, and declared that the HPSI, LPSI, PCCW, secondary costponent cooling water (SCCW), and EFW systems were inoperable. The licensee reviewed results of 50
-. - -. _ _ - =. _ - - - -
i i
other tests of the affected systems, revised test procedures, and retested the i
valves to determine system operability. Subsequent test results were acceptable.
The licensee reported the issue to the NRC in LER 96-028 on August 28, 1996.
f (4)
Emergency equipment actuation circuitry not adequately tested and HPSI pump P-14A discovered incapable of starting on SIAS when in standby mode l
4 i
The team. reviewed procedt.re 3-1.15.2, Revision 17, "ECCS Operational Test Recirculation Actuation System," and identified that the recirculation actuation signal (RAS) circuitry for the CS pump P-61S was not tested and i
verified. The licensee concurred with this finding and concluded, due to the i
similarity of the circuits, that there were also portions of HPSI pump P-14S circuitry thht were not being tested.
i The licensee stated that even though the circuits were not fully tested, the l
systems were in compliance with the technical specifications (TS). The team i
disagreed with this interpretation on the basis of the TS definition of operable and the requirements in TS Table 4.1.2 that required complete testing l
of SIAS actuation relays. The licensee decided to perform additional tests i
prior to increasing power above two percent that would verify that the HPSI pumps (P-14A, P-14B and P-145) would start from the standby mode through 1
exclusive actuation of the SIAS relays. During this testing on August 17, l
1996, HPSI pump P-14A failed to start due to an open lead (cut wire) that interrupted the start signal from the logic relay to the pump controller. The l
cut wire was found to have been partially removed (about 15 feet of wire was missing) with the remainder of the wire marked as " spare" in the wiring bundle at the main control board. The plant was brought to cold shutdown to make repairs, and Unusual Occurrence Reports were written to document the testing problems found on the HPSI pump P-14A and CS pump P-615.
(5)
Additional examples of insufficient logic testing identified and l
equipment deficiencies discovered l
In response to the team's questions concerning the adequacy of logic testing and as part of its implementation plan in response to NRC Generic Letter (GL) 96-01, " Testing of Safety-Related Logic Circuits," the licensee initiated a i
surveillance testing closeout plan to identify and correct other potential testing discrepancies. Several additional examples of insufficient logic circuit testing were identified involving the SIAS, CS actuation, RAS, l
containment isolation, feedwater trip, EFW initiation, reactor protection, EDG actuation, and main steam isolation systems. For the circuit testing that was l
completed prior to startup, three additional equipment deficiencies were i
identified that required repair; (1) a stuck relay in the CS pump P-61S j
circuitry was ' replaced, (2) a suction pressure switch on HPSI pump P-14B was replaced, and (3) a breaker for CS pump P-615 cycled when the undervoltage device was reset. The breaker trip was being investigated by the licensee.
I (6)
Control board annunciator fault alarm circuits not periodically tested i
j The team reviewed the licensee's emergency core cooling system surveillance procedures and identified that four annunciator fault alarms were not tested 51 j-3 i
1
~
or operationally checked and verified by procedure.
These alarms provided l
indication of a defect, such as loss of continuity, in the circuit.
(7)
Standby power meters required by Regulatory Guide 1.97 not calibrated j
and periodically tested l
The team identified that the licensee had excluded most instrumentation meters j
required by NRC Regulatory Guide (RG) 1.97, " Instrumentation for Light-Water-Cooled Nuclear Power Plznts to Assess Plant and Environs Conditions During and Following an Accident," from its calibration program. The licensee stated j
that the volt meters and ammeters for the inverters, battery chargers, DC i
buses, EDGs and emergency buses were determined to be out of the scope of equipment that required calibration to support operability determinations.
The licensee had concluded that the only standby power instruments that required periodic testing and calibration were the power and reactive load i
meters for the emergency diesel generators. The team disagreed with this position. 1urther discussions with the licensee indicated that the additional l
meters would be added to its calibration program.
(8)-
Lack of calibration for EDG room exhaust fan thermostat l
The team identified that the EDG room thermostats were not periodically calibrated and were not in a calibration program. The thermostats were calibrated when installed in 1990, and they were functionally checked to ensure that the exhaust fan started; however, the thermostat actuation point l
was not recorded and no acceptance criteria was applied. Since the operation of the EDG room exhaust ventilation fan affects the ambient air temperature, the thermostat calibration could potentially increase the need to derate the EDGs kW output limit.
For example, ambient air temperatures above 90 'F,
combined with jacket water temperatures above 190 'F (LOCA conditions) would require a derating of the electrical output of the EDG. These factors were j
not accounted for in the EDG loading calculations.
i l
(9)
Recirculation actuation signal manual trip switch contacts not j
effectively tested
)
The team identified that trains "A" and "B" RAS manual trip switch contacts i
were not functionally tested in procedure 3-1.15.2, Revision 17, "ECCS l
Operational Test Recirculation Actuation System." The test procedure i
inappropriately tested the RAS manual contacts with the RAS automatic signal present, thereby not assuring that the RAS manual trip switch contacts were j
actuated during the RAS manual test.
(10)
Importance of air-operated valve testing recently recognized Although the air operated valve (A0V) testing program was in general j
compliance with the licensing basis and applicable regulations, the testing did not effectively verify the functionality of safety-related A0Vs in design
,i applications for safety-related systems. A large percentage of remotely operated valves at Maine Yankee were A0Vs rather than motor-operated valves j
(MOVs). The reliance on A0Vs to perform safety functions should have 52 1
1 l-commanded earlier management support for a comprehensive A0V testing program i
l that would ensure reliable operation. Although the regulatory requirements to j
verify design functions under realistic accident conditions were not as l
explicit as for MOVs, the licensee was mandated by their design criteria, 1
technical specifications and the FSAR to adequately test the safety-related j
valves to verify that they would operate under accident flows and pressures, In addition, inservice testing did not adequately verify functionality of A0Vs j
l under representative accident conditions.
4 There were examples of A0V testing failures at Maine Yankee that may have been 1
Recent preventable if a comprehensive testing program had been in place.
examples included the failure of the FW regulating bypass valves (FW-A-ll2, 212,312) to completely isolate during a reactor shutdown, the leakage' detected during IST testing in the EFW isolation valves EFW-A-101, 201, 301, l
338,339,340), and the failure of a blowdown trip isolation valve (BD-T-32) to close due to insufficient actuator spring pressure.
Additionally, approximately 10-percent of the station A0Vs were included in i
Many of the valves not included in the IST program performed the IST program.
i safety-related functions such as the temperature control valves for the PCCW and SCCW systems (PCCW-T-19, 20 and SCCW-T-23, 24). Despite a history of i
actuator problems, these valves were not in the IST testing program.
The Maintenance Department had recently recognized the need for a comprehensive A0V testing program and was in the process of obtaining funding to procure the required diagnostic and testing equipment, and program training.
(11) Reactor-Water storage tank level transmitters overheated During the ISA team's review of the temperature range used for RWST level setpoint calculations, a walkdown was performed by the licensee as a result of 1
the ISA team's inquiries. The walkdown resulted in finding transmitter enclosures for train B that were heated above the transmitters' design This condition caused the transmitters to be in an temperature of 130' F.
unanalyzed condition, invalidated the setpoint calculation for these The transmitters, and caused two transmitters to exceed their qualified life.
resultant.setpoint change was slightly non-conservative and did not affect the operability of the ECCS pumps. The transmitters were subsequently replaced.
3.2.5 Maintenance Work Order Control Overall WO planning and tracking wasiood. The use of the On-Line Maintenance Risk Management Program to set maintenance work priorities at Maine Yankee was Extensive risk-based methodologies were used at many levels by the excellent. The basis for some of the risk information may not be as licensee.
conservative as previously assumed, as was the case for AFW pump P-25B which had a conditional probability (overall probability for success) much less than that specified in the licensee's IPE because equipment failure data had not Both the licensee and the team had identified some been updated.
inconsistencies and inefficiencies with the WO process, and there was a large 53
4 i
backlog of open W0s (some dating back to 1991) where the actual work had been i
completed, although closeout of the work package was not yet performed.
l 3.2.5.1 Use Of Probabilistic Risk Assessment Methodologies I~n support of the licensee, the YAEC organization had established and implemented extensive probabilistic risk assessment (PRA) methodologies to j
assist in making risk-informed decisions to perform maintenance and testing activities.
Yankee Atomic personnel were very experienced in PRA techniques, and the licensee was accustomed to using PRA insights on a daily basis The licensee established an On-Line Maintenance Risk Management Program tc, manage risk. This program effectively used insights from the PRA to help plant personnel, on a daily basis, make decisions concerning maintenance and testing i
of equipment. Risk assessments used by the Operations and Maintenance staffs to plan and schedule work were relatively simple. These assessments may not be as conservative as assumed, as was the case for AFW pump P-25B who's performan_ce was much worse than that specified the licensee's IPE.
Individual j
W0s were prioritized using risk perspectives to ensure that the most risk significant work was accomplished first. To accomplish this task, the WO l
process established specific equipment priorities based upon PRA information.
i 3.4.B.2 Work Planning And Tracking i
j Overall WO planning and tracking was good. Some weaknesses were found in the work control process, however, the licensee was assessing how to improve WO 4
efficiency.
In addition, the database used to capture individual WO activities was useful ~in determining who initiated the WO, its priority, age, outage or nonoutage condition, safety or nonsafety-related condition, WO status, and many other parameters. The capabilities of the WO tracking system were under-utilized as a tool to aid management in understanding the status of W0s.
4 The licensee encouraged anyone, upon discovery of a deficient condition, to j
initiate a WO without intervention from others. However, a review of the 1995 steam generator outage WO statistics indicated there was a high percentage of j
W0s that were canceled, deferred or voided after the W0s were entered and prioritized. This practice produced administrative inefficiencies which were l
largely caused by duplicate W0s, lack of initial deficiency tagging of components, or a subsequent determination that a WO was not required after one j
had been initiated. A review of open W0s showed that there was a backlog of i
185 W0s (many greater than one year with the oldest being 1991), where the work had been completed, including functional testing, but the work package was not yet closed out.
The processes used to perform work within the Maintenance Department differed between the mechanical, electrical, and instrumentation and control groups which caused some minor work control inconsistencies in tracking and trending of work. These work control differences also affected the reporting of monthly WO statistics, in that preventive maintenance or surveillance testing activities may or may not have been included in W0 statistics.
54
Work involving temporary repairs using sealants or coatings such as Furmanite and Belzona were well controlled and tracked. The team identified that no temporary sealants were in use in safety-related applications at Maine Yankee.
3.3 Engineering Assessment The quality of engineering work was mixed but considered good overall.
Strengths were noted in the capability and experience of the engineering
~
staff, day-to-day engineering support of maintenance and operations, in the quality of most calculations, and in the routine use and application of analytic codes. However, engineering was stressed by a shortage of resources, and there was a tendency to accept existing conditions. Specific weaknesses were noted with inconsistent identifiestion and resolution of problems, inadequate te* sting, and work on some calculations and analytic codes.
l 3.3.1 Identification And Resolution Of Problems The team found that, although the overall contribution of engineering to the identification and resolution of problems was generally good, some significant weaknesses were evident.
There were many examples of appropriate resolution of problems. These included the addition of safety-related ventilation fans in the EFW pump room, the recent addition of relief valves in the PCCW piping, the sleeving of the steam generator tubes, and the modification in progress for improving the ventilation supply into the containment spray building. However, in some cases, these were longstanding design deficiencies, that could have been resolved much earlier. The Plant Engineering Department gave very good support to operations and maintenance in solving day-to-problems.
Through its IPE and IPEEE programs the licensee had either resolved or was in 4
the process of resolving other issues. Safety improvements had been made, such as resolution of the lack of safety-related ventilation for the EFW pump room (identified in late 1995 and corrected in early 1996), the addition of a spare inverter, consideration and compensatory measures to accommodate turbine building flooding, and consideration of a larger spectrum of high-energy line breaks in the turbine building, for which compensatory measures had also been taken.
However the team also found:
deficient design conditions that had not been entered in a e
corrective action system or were dropped, corrective action for problems that was not appropriately expanded e
to look for similar issues, and other long-standing deficient conditions.
e Examples of issues for which appropriate corrective actions were not taken were (1) a design deficiency noted in 1991 by a YAEC engineer who described the potential to lose safety-related ventilation flow into the containment 55
spray buf1 ding due to the closure of ventilation dampers utilizing a non-safety-related source ~of instrument air and (2) the limitation of the atmospheric steam dump valve to relieve only 2.5 percent _ power which was identified in the mid-1980s, dropped as an issue needing resolution, and resurfaced by the licensee in 1996.
~
Examples of deficiencies that could have been found if the corrective ad' s
were appropriately expanded to look for similar issues included problem, uth the ventilation systems in the protected switchgear room, the containment spray building, the control room, and the emergency diesel generator room.
Other examples of long-standing deficiencies missed, or not effectively pursued, were identified in the environmental qualification (EQ) program and equipment tbsting.
The team noted the lack of a conservative testing philosophy that resulted in the identification of numerous safety-related components that were not being periodically tested or calibrated. The team also found specific testing weaknesses with recirculation actuation signal (RAS) manual actuation, the P-61S CS pump, control room fault annunciators, the EDG room ventilation thermostat, Agastat relays used for timing safety-related components, and various safety-related valves (CCW bypass, check valves). As a result of the team's findings in this area, an operability problem was identified with HPSI pump P-14A. As a followup to the team's concerns, licensee testing revealed that HPSI pump P-14A would not have started automatically on a safety-injection signal with offsite power available, although the pump could have been started manually.
The service water operational performance inspection (SWOPI) performed by the licensee was effective at identifying problems; however the licensee stated that the evaluation and resolution of these problems were delayed by resource constraints resulting from the steam generator tube sleeving effort in 1995.
3.3.2 Engineering Programs The engineering staff was technically competent with particularly good historical knowledge of the plant. The relationship between Maine Yankee and Yankee Atomic (YAEC) appeared to be a significant positive factor. There was extensive technical expertise within the YAEC organization, and its degree of familiarity with the Maine Yankee facility surpassed what could be expected in a normal client / architectural engineering firm relationship.
The team assessed Engineering programs relating to (1) closure of NUREG-0737 responses to TMI action items, (2) modifications and temporary modifications, including the performance of 10 CFR 50.59 reviews, (3) erosion / corrosion detection in piping systems, (4) and the SWOPI effort. This assessment was performed by reviewing procedures and selected program documents, as well as by discussions and interviews with licensee personnel. Maine Yankee audits and assessments were reviewed to determine the effectiveness of Maine Yankee self-identification and correction of problems related to these programs.
4 56
_ -. ~. -. -.. -
l 3.3.2.1 Engineering Modifications And Temporary Modifications The team reviewed the program for plant design changes and modifications, including procedures and selected program documents, and held discussions and j'
interviews with licensee personnel. Audits and assessments were reviewed to l
determine if self-identified problems had been corrected.
The procedures were good, meeting the requirements of ANSI N45.2.11 " Quality Assurance Requirements for the Design of Nuclear Power Plants." Reviewed modification packages were also good. The 10 CFR 50.59 reviews and screening 3
documents reviewed were generally correct. Temporary modifications were j
acceptable; however, some temporary modifications had been installed for a long time (approximately 10 years). The licensee was aware of this condition, and had recehtly made some improvements in this area to reduce the number of temporary modifications. Licensee weaknesses and problems identified in self-assessments and audits in the area of modifications were appropriately corrected or were in the process of being corrected.
3.3.2.2 Erosion / Corrosion (E/C) Program The licensee's Erosion / Corrosion Program was difficult to assess because the common industry practice of using a computer based program to determine inspection points was not being used. Although weaknesses were noted, the E/C program was considered adequate.
The licensee strengthened its program following the failure of a moisture separator reheater scavenging vent elbow in.1992.
Imediate corrective action included a complete rewrite of the E/C implementing procedure to make it more i
The changes comprised a program and process _to facilitate effective.
consistent implementation, screening of all piping for susceptibility to E/C, a documented basis for any exclusion, qualitative analysis of all susceptible lines, a process for selecting components for inspection, and documentation of actions taken on all industry experience.
The licensee also stated that it was making plans to use the EPRI CHECWORKS software but did not comit to an implementation date.
In certain cases, the licensee had replaced adjacent piping when it replaced fittings as a result of E/C testing. Whenever possible, the licensee used replacement components fabricated of steel having 2.25 percent chrome content, The which the licensee stated reduced E/C rates by at least a factor of four.
licensee stated that its control of water chemistry by (I) the use of morphaline, (2) raising the cold condensate Ph to >9.2, and (3) maintaining oxygen in the condensate at <5 ppb had significantly reduced the corrosion rate for the affected systems.
The E/C program covered approximately 3000 fittings, of which approximately 826 had been replaced as a result of excessive wear. Historically, the plant has had limited success at preventing leaks. The plant had six small leaks in high-energy piping included in the program, four of these were pinhole leaks, and two of which were in fittings that had been inspected and had subsequently
' leaked.
57
1 1
There had been several small leaks in secondary drain ' lines to the main condenser, and during the last outage, the licensee failed to replace components on WO 94-02568-00 related to high pressure drain trap 15, which had been identified as having E/C.
3.3.2.3 Service Water Operational Performance Inspection The SWOPI, which the licensee perfonned in 1994, was comprehensive and insightful.
It identified over 155 findings related to the service water system, PCCW, and SCCW systems. At the time of this assessment, 18 SWOPI l
findings were not closed. These 18 findings involved the adequacy of cooling of the EDGs, testing and trending of heat exchanger efficiencies (fouling) required for safety analyses, and the absence of "a formal set of minimum heat transfer requirements related to containment heat removal" to support-containment safety analysis. Resource impacts of the SG sleeving outage impacted the scheduled completion of these potentially significant items.
The team reviewed the SWOPI report and the responses to its finding in detail. Many of the items discussed in this report in Section 2.2.2 were identified in the SWOPI self-assessment but were not yet fully resolved.
For example, even though work had been started, an effective program was not in place to ensure that the heat exchanger fouling did not exceed the bounding values assumed in calculations.
3.3.3 Design-Basis Information The quality and availability of design basis information (DBI), including drawings, calculations, and other documents containing detailed design information, was good overall but varied in quality depending on the functional area.
Design basis documents were reviewed for safety related and important to safety systems. Calculations varied with the engineering discipline.
Electrical calculations were typically excellent and recently revised.
Some mechanical calculations were easily misinterpreted because there were portions of various revisions to the same calculation considered applicable. The earlier calculation revisions were not annotated to identify that they were
" superseded" or " void."
In general, electrical DBI was excellent and mechanical DBI was good.
Design basis sumary documents (DBSDs) were produced as part of an ongoing program to consolidate available design information on selected systems. This program had been in effect for about 10 years. The design basis recovery (DBR) for each system was accomplished primarily by creating a DBSD for the system. The 10 functional areas for which DBSDs had been developed were HPSI, LPSI, CS, EFW/AFW, PCCW/SCCW/SW, instrument air, control room habitability, flooding, station blackout, and Appendix R (fire protection). There were no DBSDs as yet for nine areas identified in this program, including the emergency diesel generators (EDGs), electrical distribution, ventilation l
(partial), reactor protection, and safety-actuation signals (SAS). The overall quality of the DBSDs was good and they provided a valuable roadmap to other applicable documents and calculations. However, the team found that 58
i they could not be completely relied upon without verification in that there were some minor discrepancies. Maine Yankee implemented an Inputs and Assumptions Source Document (IASD) in 1986 in response to an NRC confirmatory action letter in 1982. The IASD contained key parameters (important to safety and operator controlled) that'were assumed in safety analyses. There was no similar document to provide configuration control of the numerous other safety-related parameters required in design and licensing-bases calculations and plant procedures. The licensee had identified weaknesses in the IASD and was working to replace it with a more comprehensive document called the Safety Analysis Inforniation Document (SAID), which had a projected completion date of 1997. Completion of this effort was delayed as a result of the SG sleeving project.
As-built drawings were identified for all safety-related piping covered by NRC Bulletin 79-14, " Seismic Analyses For As-Built Safety-Related Piping Systems,"
(which included most safety-related piping) and for other specific Maine Yankee projects such as main control board verification. Other drawings had been verified on an as-needed basis, and, as a result, other systems such as SW, lacked a complete set of as-built drawings. The team walked down portions of the HPSI, CS, and EFW/AFW systems, verifying the as-built drawings against the plant configuration. A few errors were noted on the drawings walked down by the team, but none of these errors were significant. The overall quality of drawings was very good.
j 3.3.4 Quality of Engineering The team reviewed numerous engineering calculations and found their quality to be mixed and good overall. Deficiencies included errors and inappropriate assumptions. A weakness was also noted in the overall control of calculations.
l Most of the calculations reviewed were detailed, comprehensive,-and rigorous, particularly in the area of electrical design. However, there were examples of significant calculational deficiencies including the EDG loading calculation (approximately 200 KW of load was not accounted for), the NPSH calculation for the containment spray pumps (incorrect suction piping head losses and other inappropriate assumptions), and the heat load calculation for the CCW systems (inappropriate assumptions). These and other examples are discussed in more detail in Section 2 of this report.
The quality of 10 CFR 50.59 analyses was considered good, however the team found several isolated deficiencies of these analyses, such as, for a change to the RWST high-level alarm, consideration was not given to the potential for the consequences of adding more water to containment following an accident thereby potentially impacting environmental qualification of instrumentation.
The licensee had recently identified other problems with regard to 10 CFR 50.59 analyses. Before the team arrived onsite, the licensee initiated a review of selected FSAR sections to insure that the licensing basis of the plant was correctly stated. At the time of the ISA, this effort was partially completed but resulted in over 100 Apparent Discrepancy Reports, of which approximately 50 will require FSAR changes and accompanying 10 CFR 50.59 reviews.
59
A weakness in the control of calculations was noted.
For example there were two active revisions of calculation MYC-272, "NPSH Study, Containment Spray Pump." Revision 2, of this calculation was the basis for the injection phase NPSH, and Revision 4 of this calculation determined the suction piping fr.ictional losses for the recirculation phase. Revision 2 was not annotated to identify that a portion of this calculation was superseded by a later revision. Calculation MYC-1731, Revision 0, dated August 26, 1994, calculated the post-LOCA containment sump temperature at 263 'F.
This calculation should have been superseded since the sump temperature of record was 255 'F,
developed from calculation MYC 1740, Revision 1, dated June 25, 1996.
The ISA team found the SW system design calculations, and the Engineering Directive that provided operational guidance based on these calculations, to be an example of excellent engineering work. This directive summarized a number. of complex interrelated parameters in a clear format. However, the j
limits established in this directive were not consistent with the FSAR (see Section 2.2.2.6), but this inconsistency was not safety-significant.
60
_.m.
4.0 SELF ASSESSNENT, CORRECTIVE ACTIONS, PLANNING, AM RESOURCES Weaknesses were identified in the areas of problem identification and resolution. While licensee self-assessments were generally good, they occasionally failed to identify weaknesses or incorrectly characterized the significance of the findings. Additionally, some corrective actions were not timely and others were ineffective, leading to repetitive problems. Licensee planning was generally effective, although some weaknesses were found in the overall implementation of improvement plans. Some economic pressures resulted in limitations on resources, which impaired the licensee's ability to complete improvement projects that affected plant safety. Equipment problems were not resolved and improvement programs were not effectively implemented because the licensee perceived them to be of low safety significance.
The team (1) assessed the licensee's programs, procedures, and actions in the areas of problem identification and resolution, planning, and resources and (2) evaluated timeliness and effectiveness of corrective actions. The team conducted more than 100 formal interviews, observed numerous meetings,.
reviewed relevant documents, and used the technical findings discussed in Sections 2 and 3 as a basis for its assessment.
4.1 Self Assessment The licensee's demonstrated ability to identify and assess problems affecting plant performance and safety has been adequate. Numerous examples of internal and external assessments revealed a pattern of identifying problems and characterizing them effectively for station management. However, while many problems discussed in this report had previously been identified by the licensee, some notable problems had not been adequately identified or characterized.
Management encouraged all levels of the plant organization to identify performance problems. There was no evidence of a general reluctance to raise perceived safety concerns to station management.
Interviews consistently i
indicated that the workers often highlighted problems in the plant and did not fear reprisals from supervisors or management. Management oversight of plant activities was adequate in assuring problem identification with some notable exceptions such as the failure to identify design problems in the ventilation systems and testing deficiencies of safeguards logic circuits. The active presence of key managers inside the plant, and the use of the. zone inspection program have strengthened the oversight of many programs and activities throughout the plant. However, the team noted that supervisors occasionally missed obvious problems within the plant such as deficient material conditions in the service water pump bay and foreign material that remained inside the containment after closeout.
The Performance Assessment Program was generally effective in providing line management assessment of performance in individual departments. Each department manager assigned specific areas to department supervisors and other qualified personnel for problem identification and assessment. The effectiveness of these programs varied between departments. The Operations and Maintenance Departments were effectively identifying problems; however, 61
the Engineering Department had implemented the program, but had not conducted a sufficient number of assessments to provide meaningful feedback.
The Quality Control (QC) Program was effective in identifying problems and maintaining the standards of quality for required activities at Maine Yankee.
Programmatic controls over work processes that were important to quality l
assured the proper qualification of QC inspectors and welders, the delegation of line responsibility for work quality, and the appropriate use of QC hold 1
{
points and controls during maintenance planning and work control.
1 l
The Quality Assurance (QA) Program had a generally successful record of l
assessing the overall quality of station activities and identifying specific j
areas of vulnerability before performance degraded or the vulnerabilities became the subjects of' regulatory enforcement. Annual audit and ' surveillance j
areas were selected using a weighted criterion of 11 factors that included safety, industry experience, regulatory impact, and power generation to assure i
that the most risk-sensitive areas are assessed. Most of the licensee's l
assessments were thoroughly performed and properly self-critical.
For i
example, in 1994, the Quality Performance Department (QPD)' identified and correctly characterized the problems with controlling the inputs to the safety analyses. However, the team identified a few areas as being adverse to quality which the licensee had not recognized as significant.
Examples of such areas included the failure to identify components in the containment that were below submergence level in the Environmental Qualification (EQ) Program i
and the lack of complete testing of emergency core cooling system (ECCS) actuation logic.
j Maine Yankee has effectively used outside organizations to characterize and objectively assess specific areas that had been identified by internal audits and assessments as requiring outside expertise. The licensee has commissioned at least 19 external assessments over the last three years that have often revealed aspects of the problem areas that eluded internal assessments.
Recent examples of the successful use of outside assessment in areas which were first highlighted by QPD included audits of the Radiological Protection Organization by Westinghouse (1990), Cove's Edge Inc. (1995), and Millennium Engineering (1996).
The Cultural Assessment Team (CAT) Report (1996) was another example of the effective and timely use of outside experts to evaluate and characterize problems. This team of organizational psychologists and human factors specialists conducted an objective assessment of plant organizational culture in response to worker and management concerns. The overall finding was that the cultural atmosphere at Maine Yankee was " conducive to the raising of concerns perceived as safety significant, but is not conductive to forthright and prompt reporting for issues and concerns which are perceived to have little or no safety significance." When interviewed by the ISA team, most employees and managers expressed agreement with the findings and the recomendations of the CAT report. The licensee was developing an action plan to address the concerns and recommendations of the CAT report.
Proposed actions included development of a new vision statement, increasing the Human Resources Section's presence on site, implementation of the Supervisory Improvement Program, and review of the End of Life Comittee's 62
i i
recommendations. Additionally, meetings were held with workers to emphasize the need to identify all problems.
Maine Yankee has made effective use of oversight committees to monitor the.
assessment process and to ensure that objective and independent views are
~
. presented to the Board of Directors. The Plant Operations Review Committee (PORC) effectively monitored such routine operational decisions as 10 CFR 50.59 reviews and procedure changes, and assessed how the licensee was handling. unusual occurrence reports (UORs). The Nuclear Safety Audit and Review Committee (NSARC) functioned as the licensee's independent oversight board for all station issues. This committee was comprised of senior managers from Maine Yankee as well as outside experts from other utilities and experts from Yankee Atomic Electric Company (YAEC). Conmiittee members effectively raised concerns as appropriate. NSARC members were observed to be actively involved in many assessment activities, including QA audit exit meetings and event reviews. However, the Chairman of the NSARC was also the Manager of QA for YAEC.
In the latter position, he provided audit resources for Maine Yankee. As the Chairman of the NSARC, he was in charge of committee oversight of his department's wor.k. This resulted in the appearance of a lack of
~
independence. The Nuclear Oversight Committee consisted of outside experts who reported directly to the Board of Directors regarding high-level issues that impacted the industry.
The licensee used numerous performance indicators and managers met monthly to i
examine them and discuss their meaning. Although this process was a comprehensive effort, there were several key performance indicators that were under development and that had only two months of data, thus limiting the usefulness of trending the data at the time of the assessment. Tracking and reporting of many performance indicators was discontinued during the 1995 outage. Consequently, some managers stated that they saw little management benefit from many performance indicators and they were continuing to adjust their content and presentation to aid in use and interpretation.
The team found that performance indicators for the Maine Yankee Task Tracking System (MYTTS) did not reflect the significance of open items or identify late items. During the assessment, the licensee corrected this weakness when informed by the team. Performance indicators for maintenance work orders included only approximately 25 percent of the total number of outstanding work orders that were listed in the Maintenance Information and Parts Procurement System (MIPPS). For example, the indicator used to reflect corrective maintenance backlog contained only approximately 15 percent of the relevant action codes. Consequently, the total workload in the backlog was not accurately characterized by the perfonnance indicator although the overall trend in the work off rate was representative.
The licensee's problem identification and tracking process consisted of approximately 29 individual systems. The fragmentation of the identification process was recognized by the licensee in several corrective action audits conducted over the past few years. Additionally, NRC Region I staff noted this issue in 1995. The licensee initiated the Learning Process Improvement Program to provide a plantwide methodology to integrate the separate tracking systems.
63
l A review of approximately 4 years of data indicated that the existing problem identification systems such as the UORs and the safety issue concerns (SIC),
were effectively highlighting station problems to managers.
Management had recently emphasized the need to lower the threshold for problem identification in response to the Cultural Assessment Team Report and the December 1995 allegations. One indication of the effectiveness of this threshold change was the increase since the beginning of the year in the number of design bases screens.(DBS).
In 1994 the number of DBSs identified by the licensee was 12.
The licensee had identified more than 50 issues in 1996.
Although the threshold for raising problems had decreased since the beginning of the year, the team found some examples where cultural barriers to problem identification still existed: for example, the poor foreign material controls for containment and the poor condition of the service water building.
Additionally, the licensee had not recognized a number of significant equipment and program deficiencies. These deficiencies included the inappropriate safety system check valve testing, the numerous environmental qualification concerns, and the lack of complete safety system logic testing.
4.2 Corrective Actions The team assessed the licensee's Corrective Action Program by evaluating the following areas: problem evaluation, problem resolution, and commitment tracking. Additionally, the team reviewed the licensee's new Learning 1
Process, a program for improving corrective actions. The root cause evaluation process was generally effective; however, tracking of corrective actions was fragmented. Overall, the Corrective Action Program was weak and resulted in instances of untimely and ineffective corrective actions.
4.2.1 Problem Evaluation The team reviewed the licensevs problem evaluation processes and determined that the Plant Root Causc Evaluation (PRCE) process and Human Perfomance Evaluation System (HPES), :ther. used, were effective in identifying root causes and recommending corrective actions. The individuals performing the root cause evaluations were trained in various root cause determination methods.
These methods were effectively used in the PRCEs reviewed by the team.
Although the departmental root cause determinations were less detailed than the PRCEs, they appeared effective at addressing lower level problems.
The licensee's Quality Perfomance Department (QPD) performed trending on various root causes (PRCEs, HPESs, LERs, SICS, and Radiological Incident Reports), QPDs nonconformance reports (NCRs), and corrective action requests (CARS). This information was provided to management annually in the Functional Area Assessment Report (FAAR). The department level (Operations and Maintenance) root causes were not trended. However, radiological controls issues such as personnel contamination events were trended separately. The lack of departmental root cause trending combined with the infrequent FAAR i
trend data did not give management the information it needed to assess adverse trends. Timely trending could have identified continuing problems in the areas of foreign material exclusion control, and auxiliary feedwater (AFW) 64 i
l system reliability. The licensee's new Learning Process was designed to address this issue.
1 4.2.2 Problem Resolution i
The team determined that the licensee's corrective action resolution process was weak. The licensee's tracking system was fragmented with approximately 21 individual systems. The backlog of corrective actions was relatively large and was. increasing.
Excluding work orders, there were approximately 1000 issues identified in the major tracking systems (CARS, Items for Investigation, and MYTTS). The other 17 systems had approximately 2200 items.
The average age of the items was 8 to 9 months, and some items were as old as 10 years. The licensee did not determine the resource requirements to complete corrective actions, but developed scheduled completion dates for the This The July 1996 MYTTS Report showed that 534 items were open.
items.
included 184 comitment items of which 42 percent were late, and 157 operational experience report items of which 28 percent were late.
The licensee's 1995 corrective action audit also questioned the comitment of management to timely problem resolution. The team reviewed a number of corrective action items and determined that the licensee continued to be untimely in correcting some significant issues. One example was the untimely actions to address concerns with the undersized atmospheric steam dump valve i
which the licensee first identified in 1986. A second example was the Service Water System Operational Performance Inspection conducted by the licensee in 1994. The report contained nine recomendations. None of the recommendations had been closed out and three were overdue. Additionally, numerous follow-up items were still open. One item identified a turbine hall flooding issue which was scheduled to be addressed in June 1997. However, the April 1996 IPEEE findings showed that the plant was outside of its design basis for a This design issue could have been identified and resolved turbine hall flood.
in 1994. A third example was the issue of the ventilation damper in the containment spray building. This issue was previously raised by Yankee Atomic in a 1991 memorandum, but had not been acted on by Maine Yankee.
Some of the licensee's corrective actions have been it. effective and have caused repetitive problems. An example of such ineffective corrective actions was the repetitive problems with the AFW control system and the continuing problem with the main feedwater pump P-2B tripping on low lube oil pressure.
An example of inadequate corrective action was how the licensee addressed the negative control room pressure identified during a surveillance conducted in October 1995.
The team reviewed the licensee's comitment tracking performance and found i
that the current comitment tracking system was good because of recent In the April 1996 "RELAP/5YA Self Assessment Report," the licensee changes.
In identified fragmented comitment tracking systems as a contributing cause.
response, the licensee adopted guidance outlined in the Nuclear Energy Institute's " Guideline for Managing NRC Comitments," dated Dece.aber 19, 1995.
In addition, the licensee reviewed earlier documentation to verify the t
inclusion of all comitments. At the close of the assessment, the licensee had reviewed all applicable documents for the preceding 5 years.
65 l
--__ -...- - -.~..
In response to self-identified concerns, the licensee developed an integrated Corrective Action Program, the Learning Process, which was scheduled for implementation in the fall of 1996. The development of the Learning Process was a reengineering effort which involved a team approach. The objectives were to integrate the processes of problem identification, problem 1
prioritization, root cause evaluation, problem tracking and resolution, and to develop a more useful trending process. The new system was designed to be a computer-based system. At the close of the assessment, the licensee was developing the implementing procedures and necessary training.
i 4.3 Planning And Resources Licensee planning was effective; however, weaknesses were identified in planning integration and improvement plan implementation.
Economic pressures, which resulted in limitations on resources, interfered with the licensee's ability to complete projects and other efforts that would bring improvements to plant safety and testing activities.
Equipment problems were not resolved and improvement programs were not effectively implemented because the licensee perceived them to be of low safety significance.
4.3.1 Plans The licensee did not have an integrated overall planning document. While many elements of an integrated plan existed, none of these elements contained information which identified required resources to achieve specified goals and objectives. Additionally, specific performance measurements to determine the level of accomplishment were not included. The licensee had independently identified the lack of an integrated overall plan and was in the process of incorporating the fragmented elements into a single document as part of the Business Plan Initiative and Executive Management Initiatives improvement plans.
Licensee work planning was organized and effective. On average, 80 to 90 percent of planned work was accomplished on the day scheduled. An additional strength of the planning process was the use of risk measurements to aid in timing of equipment and system outages and to increase employee awareness.
Outage planning was also organized and effective. The licensee used state-of-the-art computer planning aids and incorporated risk measurements into the overall outage plan. The licensee effectively incorporated industry guidance for shutdown risk management into the work planning process.
The licensee had a number of improvement plans for various purposes.
Improvement plans included the Learning Process described earlier, the Maintenance Improvement Program (including a Procedure Adherence Initiative),
the Engineering Quality Improvement Program, the Safety Analyses Improvement Plan, and the Supervisory Improvement Plan (a personnel training program).
These programs were well thought out, adequately documented, and promulgated to the appropriate staff.
Some past improvement programs were successful; for example, the licensee's efforts to improve industrial safety performance.
In April 1996, all maintenance work was stopped in response to industrial safety concerns 66
identified by licensee management. Several days were then dedicated to discussing and highlighting industrial safety prior to resumption of work.
This action, coupled with continuing emphasis on industrial safety issues 4
resulted in reductions in industrial safety hazards and lost time injuries.
The team observed good industrial safety performance during the assessment.
The team also found that some previous improvement plans were not effective.
For example, beginning in 1990, the licensee initiated several improvement Despite plans to correct problems in the Radiation Protection Department.
j Some these attempts at improvement, problems continued to repeat themselves.
l For improvement plans had not been accomplished because of lack of funding.
j example, the improvement initiatives associated with implementing a i
comprehensive air-operated valve (A0V) testing program had not been funded for l
the past 3 years and the Erosion Control Program was not fully funded for 1995. Also, 'some programs had received funding, but the licensee had j
discontinued them during times of resource stress.
For example, the Supervisory Improvement Program was discontinued during the 1995 refueling outage.
4.3.2 Economic Environment Like all licensees, the Maine Yankee Atomic Power Company (MYAPCo) has experienced competitive pressure to generate power at low cost. However, unlike others, Maine Yankee has not engaged in drastic staff reductions, work process reengineering or other budget cutback efforts to maintain competitiveness because it has historically maintained a lean and efficient organization. Staffing levels and budget expenditures have been constrained to that necessary to generate power efficiently.
The MYAPCo owners comprise 10 utilities in the New England region. The largest single owner, Central Maine Power (CMP), owns 38 percent of the Northeast Utilities, in combination with other subsidiaries, owns company.
approximately 20 percent of the company. The balance of the owners consist of other New England utilities.
The owners have exclusive rights to the power that is generated by the plant in proportion to their equity share. They are also required to provide for the operating and capital expenses to produce this power. The owners do not Instead, they funded the approved directly purchase the power from MYAPCo.
budget and cover any unexpected funding requirements in proportion to their share in equity. The owners can pass along their respective share of prudent operating costs to their rate payers.
The cost of producing power at Maine Yankee is lower than for most other base Maine Yankee has the capacity to produce load power in the area.
approximately 50 percent of the power in the State of Maine at a wholesale cost of 2.5 to 3.5 cents per kilowatt-hour. However, due to ownership shares, approximately 25 percent of the total power in the State of Maine is actually generated by Maine Yankee, and the remainder of the power is exported to out-of-state owner utilities. The owners have established multi-year contracts to resell approximately six to seven percent of the power produced by Maine Yankee to other utilities.
67
Senior plant management maintains control cver the capital and operating budgets by setting budget targets and monitoring expenditures. The budget i
targets are constrained by Federal Energy Regulatory Commission (FERC) regulations and are required to be justified as needed and as reasonable.
One of the criteria used by the FERC process to establish the rate for wholesale l
power is the avoided cost of power on the grid.
The rate structure in Maine was established by the Maine Public Utility i
Commission in December 1994, and constrains CMP to a multi-year Alternative Rate Plan (ARP) agreement which explicitly caps the cost of retail power to customers throughout the State.
In addition, CMP signed a series of long-term power contracts with smaller independent power producers (IPPs) and non-utility generators (NUGs) with wholesale rates that were previously set between 9 and 11 cents per kilowatt-hour. This combination of multi-year high-cost power contracts and ARP retail rate caps effectively forces CMP to balance the conflicting objectives by mitigating the higher cost of power from the numerous NUGs and IPPs in their service area with low-cost power from j
Maine Yankee.
4.3.3 Results Of Resource Constraints
~
l Unlike most utilities, MYAPCo does not retain earnings and does not set asside reserve funds for unplanned requirements, except those required by law. All 1
monies in excess of operational expenses are periodically returned to the owners. The owner utilities are required to either capitalize or immediately finance emergent requirements from their operating budgets. The 1995 steam generator sleeving project is an example of an unplanned requirement at the plant causing severe financial impact to several owners.
In order to respond to the immediate cash requirements, MYAPCo imposed a 10-percent reduction in operating and maintenance (0&M) costs across the board and terminated all outside contract labor on site. Except for the decommissioning fund, the nuclear waste trust funds, and pension funds which were mandated by law, the a
organization did not set aside reserve capital funding to provide for emergent needs.
MYAPCo used a sophisticated financial model to detennine the cost factors that could encourage large industrial customers to elect to generate their own power and erode the mix between industrial and residential users. These factors combined to internally constrain the utility budget targets to reflect the competitive position of the regional spot market for power which were even lower than the cost factors listed above.
In summary, Maine Yankee produced some of the least expensive power in the New England region and the regional i
utilities in Maine had limited budget funding to offset higher costs and competitive pressures.
Management has effectively operated the plant within the budget constraints established by the owners. However, the limitations on resources have delayed and deferred plant upgrades, improvements, and lower priority corrective actions which did not meet the threshold for safety, regulatory compliance, or i,
reliable production.
Projects which would likely have prevented problems were unfunded because of budget limits.
t 68
One illustrative example was the imposed delay of the completion of the Safety Analyses Inputs Document (SAID) which could have re-identified the problem with the undersized ASD sooner. The SAID project was the corrective action to prevent loss of control over the safety analyses inputs in response to concerns first documented in 1994 by the Nuclear Engineering Department and QPD. Development of the SAID was substantially delayed in 1995 when the steam generator _ sleeving project required the redirection of engineering resources.
A request from the Corporate Engineering Department (CED) in the 1995 budget request to add an additional engineer to continue the SAID development was not funded by the senior plant management.
Another example of a case in which limited resources interfered with performance was the decision not to implement a comprehensive A0V testing In'1995, the Maintenance Department proposed to implement the program.
testing program and to procure a diagnostic testing system for A0Vs. The consequence of not funding the effort was stated in the unfunded O&M budget list as " continue to work on A0Vs on an 'as fail' basis (reactive) rather than predictive maintenance." Despite these words of caution and a strong justification to proceed, management did not authorize the.5218,000 needed to correct this problem because the testing system was not explicitly required by NRC regulations.
If implemented, this testing system could have detected and prevented some of the A0V problems identified elsewhere in this report.
Another example of deferring needed projects because of a lack of funding is the halting of the mechanical / electrical /I&C specialty training program during the 1995 steam generator sleeving outage. This training prepared maintenance workers as journeymen and provided continuing proficiency training. All specialty training was halted in an effort to increase ths availability of maintenance workers to support outage work. Additionally, funds were not approved in the 1995 O&M budget to respond to industry reaccreditation issues.
Another example of the impact of limited resources on important projects was that the design-basis summary program was halted during the 1995 steamIf this generator sleeving outage because of constraints on staff resources.
program had continued, there would have been additional opportunities during the development of design-basis documents to identify some of the older design problems that were later identified by the team.
In addition, approximately 100 high priority work orders were deferred from the 1995 outage schedule at the end of the outage because of schedule constraints. With maintenance work order and corrective action tracking system backlogs increasing, sonior plant management has recently decided to add more staff.
e 69
5.0 CONCLUSION
S The conclusions drawn from this assessment and the underlying root causes for the significant safety findings follow.
5.1. Licensing And Design-Basis Maine Yankee was in general conformance with its licensing-basis although significant items of non-conformance were identified. The licensing-basis was understood by the licensee but lacked specificity, contained inconsistencies, and had not been well maintained.
Theluse of analytic codes for safety anak ses was very good.
Cycle specific core perfomhnce analyses were excellent. More complicated, less frequently performed safety analyses contained weaknesses, but the analyses were found to J
be acceptable based on compensating margin.
Conditions of use specified in the safety evaluation reports were found to be satisfied, but not documented.
The quality and availability of design-basis information was good overall.
Despite uncorrected and previously undiscovered design problems, the design-basis and compensatory measures adequately supported plant operation at a power level of 2440 MWt. However, the team could not conclude, and the licensee did not demonstrate, that the design-basis supported operation at 2700 MWt relative to assuring adequate NPSH for the containment spray pumps and for the heat removal capability of the PCCW and SCCW systems.
5.2 Operational Safety 5.2.1 Operations Overall performance in the area of operations was very good.
Strengths were noted in the areas of operator performance during routine and transient operating conditions; shift turnovers and pre-evolution briefs; use of risk i
information to ensure safe operations; and the involvement of management in day-to-day operations. Weaknesses were noted in the area of "workarounds" and compensatory measures which unnecessarily burdened the operators or complicated their response to transient conditions. Additionally, log-keeping practices and post-trip reviews lacked rigor.
5.2.2 Maintenance And Testing Performance in the area of maintenance was good overall however, testing was weak. The results of the review of equipment reliability for the auxiliary feedwater, emergency feedwater, high pressure safety injection, and emergency diesel generator systems showed mixed equipment performance.
Strengths were noted in the areas of knowledge and use of risk methodologies for planning, prioritizing, and scheduling work; the control and limited use of temporary sealants; and a motivated and dedicated work force. Although material condition was considered good overall, a number of significant material condition deficiencies were noted as was a decline in material condition following the 1995 steam generator tubing outage.
70
i 4
h
~
Inadequacies in the scope of testing programs were identified, as were weaknesses in the rigor with which testing was performed and the evaluation of testing results to demonstrate functionality of safety equipment. A lack of a questioning attitude and stressed resources resulted in the use of poor surveillance procedures and ineffective evaluation of surveillance test data.
5.2.3 Engineering The qual.ity of engineering work was mixed but considered good overall.
Strengths were noted in the capability and experience of the engineering staff, day-to-day engineering support of maintenance and operations, in the quality of most calculations, and in the routine use and application of analytic codes. However, engineering was stressed by a shortage of resources, and there was a tendency to accept existing conditions. Specific weaknesses were noted with inconsistent identification and resolution of problems, inadequate testing, and work on some calculations and analytic codes.
5.3 Root Causes of Significant Findings Overall performance at Maine Yankee was considered adequate for operation of the facility. However, a number of deficiencies were identified by the team in each of the areas assessed. These deficiencies, which included weak identification and resolution of problems; inadequate scope, and weak rigor and evaluation of testing; and declining material condition stemmed from two closely related root causes.
5.3.1 Root Cause 1: Economic Pressure Economic pressure to be a low-cost energy producer has limited available resources to address corrective actions and some plant improvement upgrades.
Management has effectively prioritized available resources, but financial pressures have caused the postponement of some needed program improvements and actions.
The economic pressures discussed in Section 4.3 resulted in limitations on resources and interfered with the licensee's ability to complete projects and other efforts that would improve plant safety and testing activities.
Examples include the failure to adequately test safety related components (Section 3.2.4); the long-standing deficient design conditions, such as the undersized atmospheric steam dump valve (Sections 3.1.3.1 and 3.3.1) and environmental qualification issues (Section 2.3.9); and the lack of effective improvement programs, such as the design basis reconstitution program (Sections 3.3.3 and 4.3.3).
These and other examples discussed in the report illustrate the licensee's willingness to accept existing conditions, many of which became operator workarounds (Section 3.1.1.1).
5.3.2 Root Cause 2: Problem Identification There is a lack of a questioning culture which has resulted in the failure to identify or promptly correct significant problems in areas perceived by management to be of low safety significance. Management appears complacent 71
1 e
j with the current level of safety performance and there does not appear to be a clear incentive for improvement.
Examples of issues which illustrate complacency and the failure to identify or promptly correct significant problems, include previously undiscovered deficient conditions of the service water and auxiliary feedwater water systems (Section 3.2.2); inadequacies in ventilation systems (Section 2.3.7);
post-trip reviews which lacked rigor and completeness (Section 3.1.2.7);
emergency operating procedures that may not adequately address an inadequate core cooling event and a steam generator tube rupture under certain conditions (Section 3.1.3.1); lack of a questioning attitude during test performance and evaluation that was not conducive to discovering equipment problems, but rather to accepting equipment performance (Sections 2.2.1, 3.2.2, 3.2.4); and licensee self-assessments that occasionally failed to identify weaknesses, or incorrectly characterized the significance of findings (Section 4.1).
In addition, some corrective actions were not timely and others were ineffective, leading to repetitive problems (Section 4.2).
9 4
72
i j
i j
6.0 REGULATORY ISSUES 4
i During the course of this assessment, a number of deficiencies were identified for which the NRC shares some responsibility. Certain of these deficiencies l-are identified here and will be developed and addressed as part of a separate NRC followup effort on the lessons learned from the Maine Yankee Independent 4
Safety Assessment.
i j
6.1 Analytic Code Validation The ISA team noted that the validation of RETRAN to known industry benchmarks j
for integral and separate effects test data was deficient. This validation is j
important to assure that the plant-specific application of the code effectively models known physical effects; however, the requirement for this validation was vague. The requirement can be traced to Generic Letter 83-11,
" Licensee Qualification for Performing Safety Analyses in Support of Licensing l
Action," issued on February 8,1993, which states in part:
... some licensees planning to perform their own safety analyses may not intend to demonstrate their ability to use the code by performing their own code verification. Rather, they plan to rely on the code verification work previously performed by the code j
developer or others.
i NRR does not consider this acceptable and each licensee or vendor i
who intends to use a safety analysis computer code to support i
licensing actions should demonstrate their proficiency in using the code by submitting code verification performed by them, not i
others.
?
The NRC has acted inconsistently relative to its expectations in this area.
In some cases, computer codes have been endorsed for use with little or no 4
validation accomplished. The NRC should review its expectations relative to validation and assure they are made clear to the industry.
j I
6.2 Compliance With Safety Evaluation Reports l
During the Maine Yankee ISA, compliance with conditions imposed on the use of analytic codes was verified for 67 SER conditions affecting 13 codes.
Although compliance was confirmed, an audit trail to assure compliance was not always available, necessitating, in some cases, additional analyses to verify compliance.
The regulatory status of an SER imposed commitment is unclear and should be reviewed.
If conditions within an SER are considered appropriate, clear NRC expectations relative to compliance, auditability, and reportability should be i
i established.
j j
6.3 Licensing Reviews For Power Uprates l'
The Maine Yankee ISA team identified a number of mechanical components for which confirmation of operability at the upgraded power level of 2700 MWt j!
73 li l
1 i
could not be confirmed.
The NRC should review the scope and rigor of the licensing reviews conducted for power uprates.
6.4 Safety Guide 1 NRC Safety Guide 1, " Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal System Pumps" issued on November 2,1970, states, NPSH for emergency core cooling and containment heat removal system pumps caused by increases in temperature of the pumped fluid under loss of coolant accident conditions can be accommodated without reliance on the calculated increase in containment pressure."
Emergency core cooling and containment heat removal systems should be designed so that adequate net positive suction head is provided to system pumps assuming maximum expected temperatures of pumped fluids and no increase in containment pressure from that present prior to postulated loss of coolant accidents.
The NRC should review and clarify its intent relative to relying on containment pressure for assuring appropriate NPSH for emergency core cooling and containment heat removal pumps.
Specifically, the issue of whether or not the containment can be assumed to be pressurized at the saturation pressure for the sump fluid temperature should be addressed.
6.5 Inspection Program The adequacy of the scope and implementation of the NRC inspection program should be reviewed in the following areas:
e the licensee-implemented testing programs for safety systems relative to its scope, rigor, and analyses of results the periodic review of licensee developed Technical Specification e
interpretations to assure consistency with the intent of the approved Technical Specifications assessment of the adequacy of the plant design-basis including a review e
of the disposition of significant findings from previous licensee efforts such as design-basis documentation or design-basis reconstitution programs.
74
l 7.0 EXIT MEETINGS Two interim exit meetings were held during the course of this assessment. The first was held on July 26, 1996, at the end of the first two week onsite assessment period, and the second was held on August 23, 1996, at the end of the second and final onsite assessment period. The purpose of the interim exit meetings was to provide an opportunity for the ISA team leader and functional area leaders to provide an integrated discussion of the assessment findings.to date.
A final meeting, open for public observation, will be held with Maine Yankee representatives at the Wiscasset Middle School, Wiscasset Maine on October 10, 1996. The conclusions of the report will be discussed at this meeting.
I i
i l
i l
1 75 1
A88REVIATIONS AEDD Office for Analysis and Evaluation of Operational Data (NRC)
AFW auxiliary feedwater ALARA as low as is reasonably achievable A0V air-operated valve ARP alternative rate plan ASD atmospheric steam dump BIRP Boron Injection RETRAN Post-processor i
. confirmatory action letter CAR corrective action request l
CAT cultural assessment team CCW component cooling water CDF core damage frequency CEA control element assembly CED Corporate Engineering Department 4
CMP Central Maine Power CR control room t
CR0 Control Room Operator CS containment spray CWPH circulating water pump house
)
DBA design-basis accident DBI design-basis information DBS design-bases screen l
DBSD design-basis summary document DBR design basis recovery DNB departure from nucleate boiling DNBR departure from nucleate boiling ratio DP differential pressure E/C erosion / corrosion ECCS emergency core cooling system EDG emergency diesel generator EFW emergency feedwater E0P emergency operating procedure EPRI Electric Power Research Institute EQ environmental qualification i
l
(
l A-1 Appendix A l
1
FAAR functional area assessment report FERC Federal Energy Regulatory Commission FME foreign material exclusion FP fire protection FPIP Fire Protection Improvement Plan FSAR Final Safety Analysis Report GDC General Design Criteria GL generic letter 1
HELB high-energy line break HFP 1 hot full power 4
HI
' Hydraulic Institute HPES
.. human performance evaluation system HPSI high-pressure safety injection HVAC heating, ventilation, and air conditioning HX heat exchanger IASD Inputs and Assumptions Source Document I&C instrumentation and controls ICC inadequate core cooling ILRT integrated leak rate test IN information notice IPE Individual Plant Examination i
IPEEE Individual Plant Examination of Externally Initiated Events IPP independent power producer ISA Independent Safety Assessment IST inservice testing LBLOCA large-break loss-of-coolant accident LER licensee event report LLRT local leak rate test LOCA loss-of-coolant accident LOOP loss of offsite power LPSI low-pressure safety injection MCC motor control center MDFW motor-driven main feedwater MIPPS maintenance information and parts procurement system MOV motor-operated valve MSLR main steam line rupture MSR moisture separator reheater mwd /MTU megawatt day per metric ton uranium MYAPCo Maine Yankee Atomic Power Company MYAPS Maine Yankee Atomic Power Station MYTTS Maine Yankee Task Tracking System A-2 Appendix A
NCR nonconformance report NPSH net positive suction head
- NPSH, net positive suction head available
- NPSH, net positive suction head required NRC Nuclear Regulatory Commission i
NRR Office of Nuclear Reactor Regulation (NRC)
NSARC Nuclear Safety Audit and Review Committee NUG non-utility generator
)
OIG Office of the Inspector General (NRC)
GLSA online safety assessment 0&M operating and maintenance PCCW
' primary component cooling water PED Plant Engineering Department PORC Plant Operation Review Comittee PRA probabilistic risk assessment PRCE plant root cause evaluation PSS Plant Shift Superintendent PTR post-trip review PWR pressurized-water rea'ctor QA quality assurance QC quality control QPD Quality Performance Department RAS recirculation actuation signal RCP reactor coolant pump RCS reactor co'lant system RG regulatory guide RHR residual heat removal RPS reactor protection system RWST refueling water storage tank SAID Safety Analysis Information Document SALP systematic assessment of licensee performance SAS safety-actuation signal SCCW secondary component cooling water SCU Statistical Combination of Uncertainties SER safety evaluation report SFP spent fuel pool SG steam generator SGTR steam generator tube rupture SIAS safety injection actuation signal l
SIC safety issues concerns SOS Shift Operating Supervisor SSA shutdown safety assessment l
STA Shift Technical Advisor SW service water SW0PI service water operational performance inspection l
A-3 Appendix A l
l
T/H thermal-hydraulic TS Technical Specification UOR unusual occurrence report WO.
work' order ~
4 YAEC Yankee Atomic Electric Company u
i i
i 1
J i
1 a
4 1
i A-4 Appendix A
l,!!i!I
!tl
\\l!!!
- t6Ij ll';!i
- jtftItf!Iil}
jl !o B
g ix n
d d
i r
n n
a e
ia w
p r
y p
T a
A I
re H
ga M..
na R
M Y
N eg A
a d
t r
e u
o P
r f
O k
8 o
m r,
ic M
k e
B t
c g
n a
a L.
M l
n R
O e s h
I B
dn c
WO a
t o
i i
et L
W M
C si e
a I
r r
R Pe M. -
R ep G-cO i
E V
W l
s a
s c
O i
e e
x s
n ll c
n c
u n
h o
e-e ga l
o i
ht e
r n
r r
s a
e n e
cr n
t P
m e o n
e gP h
l i
r a
g w
a S
a n ie S
Tp o
t r
a a
ng nt V
rp C
e e
t t an P.
eu C
s c
ne n
h an o
f din o
M Mn R.
Mi J.
i el n
a S
I gS M.
i r
f R.
a M M O S a
a r
A n
O a e g
n e le em d
I t
n J
l n c a
/
y t
M ed L
n e
a t
I z
v z
a C
L M
r r
a ei i
PA l
mi n
e&
S rD la I
idt r
O P
u o
F sc F.
I c
P.
i ie af h
ee D.
Vc T
Cd T.
P E C a
r x n
A ra D n
f i
o e
F Il B
i t
h r
E C
e o
t r
a p
t g
e r
p ng E
n g
n og s
u a
t n k r
a o
pn o
S e
i l
r K
l s
PW e
n) r u
ri r h
E b
aD e
o e c
e t e r
o n n e
r,e S
ei MS d
Ce i
H N
i n N dg N
n t
r,i L
g t
n h
cY A.
eg E.
r, R.
i t
a D.
l e
A mE W e(
n E
L.
gn e
I P &
o P
aE S
g J
aE j
Y eg D.
P a
n r
n a
M cn G
M a
i i E
Vo M
no N
cU I
lll A
sr g
M ia
/n m
f Din a
f le A
Pn h
l r
h Qa g
t s et e
n nn gv l
eu h
ao D rP ih i
e do c
nG t
c n
gi o
isC y
a&
R.
ag F
r l
el L
M L
ne ra c
at Pr Mr C.
a e
A.
il en b
t J
c M
u S
ie VG P
i l
APPENDIX C EQUIPMENT PERFORMANCE FOR AUXILIARY FEEDWATER, EMERGENCY FEEDWATER, HIGH PRESSURE SAFETY INJECTION, AND EMERGENCY DIESEL GENERATOR SYSTEMS FROM JANUARY 1, 1992 THROUGH JUNE 30, 1996 8
e
. _ _ _ _._.__ _._.._ _._.-.._ _ ___ _ _ _.. _ _.. -.... _ _ _ _ _. _ _ -.... _ _ _ _ _ - _ =. _.
L I
i Figure 1 i
Maine Yankee Independent Safety Assessment Team i
Emergency Feedwater Pump Train P-25A - Conditional Probab'ility 2
Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent'the probability that the emergency feedwater (EFW) pump train P-25A will respond to a I'
random demand, during power operations, for injection into the steam generators and will start and will inject into the steam generators for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7),-(2) the probability of start (cumulative successful starts / cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very high value.(over 99 percent) until January 1996.
On January 8, 1996, the pump was placed in maintenance to repair a bearing oil leak and stayed in maintenance for 143.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Therefore the standby availability dropped in January 1996 with a resultant drop in the conditional probability. There have been no failures to start or failures to run of the pump train over the time
[
period.
The value of the conditional probability as of June 30, 1996, was 97.9 percent. Thus it is expected that i
the EFW pump train P-250 would complete its mission approximately 98 out of 100 random demands.
t l
For these curves, high values are better than low values.
Total Starts 130 Successful Starts 130 Failures to Start 0
j i
{
Total Run Hours 487 Run Failures 0
r Planned Maintenance Hours 44.5 f
Unplanned Maintenance Hours 143.5 i
i Appendix C i
[
l l
l i
I. Allt
+.4
)' i ll5 1
8, l ult-ti.-
8'
.11 : +. -
i
- p.i 1
4 i
i u
l[s q
3 i
! l l ".*
i q
l
- n" l ***
g m
.i-
. og g N
I l
r o64 t
6 s
a 1.
F ww !.
i
.r i
L r
v i..
1 l
i 1
~
a r.-
j
{
a
.lg
..w j
..w A
l g.
s,
.s..
.y1 4.
zyi 1
11; 1
5 11 L
-i eli l
n c
,, L: -eI -
1 il i I
n
,= ~ ~
~
==. uw
.......n..._....gga t
s s
e e
s e
g a
g g
g s
a s
s e
e s
a s
a
. _....e f
i t.~
~
a i
J..,.,
)
J
. 1
,L lI l I.,
t i
i i
gi
.-i i-J l
I 8h! Y.*l I
1p!
I f.*
al l
leest -
1p
.s
- 99 5 j
}
j r
+
> seg,*
- se..
8
)f stege !
{
964Wii i'
r 8
""* f jk f
f *"",!
i se=Jer i
- 90 l
s l
\\
6 I
i eeend ES+*d '
t j
L i
&.4sg I 1,
. go. sus :
l:
r.
8 6
y y
- ts Jose
. te.mq l
i
' ESF 55w h[
y f.-
8 i,j e, T-il I
I
- }t L
i l u% 'l e
3
. 4ess i
L r.-i li i
i g
g 8
g a
g g
g g
g g
g j
y a
a s
a e
y s
a s
a e
l t
l l
i Figure 2
{
Maine Yankee Independent Safety Assessment Team Emergency Feedwater Pump Train P-25C - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probability that the emergency feedwater (EFW) pump train P-25C will respond to a l
random demand, during power operations, for injection into the steam generators and will start and will i
inject into the steam generators for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
The conditional probability is calculated by determining the product of (1) the standby availability (ratio of time not in maintenance to theitotal time in operating i
conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts / cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very high value (over 99 percent) until December 1993.
On I
December 6,1993, the pump failed to start due to problems with a breaker for the pump.
Therefore the probability of start dropped in December 1993 with a resultant drop in the conditional probability. There i
have been no failures to run of the pump train over the time period.
j The value of the conditional probability as of June 30, 1996, was 99.2 percent. Thus it is expected that the EFW pump train P-25C would complete its mission approximately 99 Out of 100 random demands.
}
For these curves, high values are better than low values.
i Total Starts 192 Successful Starts 191 Failures to Start 1
l Total Run Hours 992 f
0 Run Failures Planned Maintenance Hours 29.5 j
Unplanned Maintenance Hours 1.5 l
i Appendix C
?
- +-
_n_-
a sa, m
+
--m 2
_.4 a
- - a eaa.
ea a
I
' MW
' er*
-fI lI l uh
- a*
ww lhf
-+
[gj i
i ll1 j}j c
e.w s.w
' 45l
' t.454
..e at
,s g*
gj
. = =
s.w eew g ee.n er n
~
~T
[ ""
!a=
fj
- m i
Y i.
- a*'
ill T fi 1
- =*' :
Wi
[
.l t
2"#
i
.lg iI i"*" ~
N
, dfi il j.'-,;; r;"
- l
!w i
>l.
e ree
=~
t t
t l
E E
E E
E E
j E
E E
E E
E l
g s
a s
a e
g s
a s
a
=
ww
=w i
<. go.y
, gedy
'se w l
" eem fs --W
--W dll
- w=
jj t-l' jgi t w=
I
.);
e
.n
..w
. wen
.,,,e,,
" se.se l
se.ur
,i i,
(.
(!
g =l
.e, II 1
esesi se si t-4 :e=
F mm
' m*s g
m.s
},,
.1 l ]f, _m *
"mw s
_L 1
n E
E E
E E
E E
E E
E E
E g
a a
a e
g s
a s
a
i i
F Figure 3 Maine Yankee Independent Safety Assessment Team t
Auxiliary Feedwater Pump Train P-258 - Conditional Probability 30, 1996 Operating Conditions 5, 6, 7 from January 1, 1992 to June d to a These curves represent the probability that the auxiliary feedwater (AFW) pump train P-25 d will random demand, during power operation, for injection into the steam generators and will stl i
inject into the steam generators for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
i in operating product of (1) the standby availability (ratio of time not in maintenance to the total t m l tive total starts),
I conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts /cumu a l
and (3) the probability of-run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
There have been two failures The conditional probability curve shows a very low value over the time period.The standby av to start and three failures to run over time period.over the time period becaus 30, 1996, was 76.3 percent. Thus it is expected that The value of the conditional probability as of Junethe AFW pump train P-258 l
l For these curves, high values are better than low values.
[
59 Total Starts 57 Successful Starts 2
Failures to Start 26.5 Total Run Hours 3
l Run Failures i
l 132.5 Planned Maintenance Hours 441.0 Unplanned Maintenance Hours
?
l I
Appendix C i
I
~ - -
se**v
. seeir e
j
.e l
war f,e j
so-*
jj i-* !
j1
- ,,i jl,.
l sg
- =
,,,,y
,ew I
,,,d,,,
l
'seds.,
(
k llj I
..ean
- n afjc s{ Ig l]"
I i
If l
I ] [l.,
~
W 2
=**
3 i
1a e
l I
'g
' CHM
, gear
[ "*
\\
g r
T ***
'E : g F a*s
- I 3
'f I !
- ["
i
!=gls! [ljl]sg!;--
- ipM :mly 1!
i i is ji
~*:
i y,!
lj l
~
i-*-
e
- 1p.
,o 1
T i
I
)
,ew
. seds.,
j
}
l
,,,4,,,
I ill l(] {l, l !i i
i
~x
\\,
\\
' tr8P
{
T i
5 2
g 1,]
i l.
~
- =~
g L
{
f k
h k
Figure 4 Maine Yankee Independent Safety Assessment Team High Pressure Safety Injection Pump Train P-14A - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 i
These curves represent the probability that the high pressure safety injection (HPSI) pump train P-14A will e
respond to a random demand, during power operation, for injection into the reactor vessel and will start i
The conditional probability is calculated by deteretning will inject into the reactor vessel for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
the product of (1) the standby availability (ratio of time not in maintenance to the total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts / cumulative total starts),
l and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
P Thus it is expected that the The conditional probabil.ity curve shows a very high value (over 99 percent).
l HPSI pump train P-14A would complete its mission approximately 100 out of 100 Pandom demands.
i During the course of the independent safety assessment team evaluation, it was discovered that there wasI missing wire (hac been inadvertently removed) in the safety injection actuation system (SIAS) logic whic This i
would have prevented P-14A from starting if P-14A were the " alternate p
'i failure of the SIAS logic in the Maine Yankee Individual Plant Examination.
f For the curves, high values are better than low values.
5 79 Total Starts 79 j
Successful Starts 0
Failures to Start 9.996 Total Run Hours 0
Run Failures l
4.4 l
While aligned Planned Maintenance Hours 0.5 Unplanned Maintenance Hours Appendix C i
P
'.4 I
'e
. e&W
'W x
1=
1* -+. :
j j glI ww g
4 t
jfi llI
_ f
!= l
- i
[ ~~
"z s
fn ll
. If lll
..j s' :
I 11 L
!l, i
> - ~
1 i
lI 1
l>
~~
)
3,1 l:
31 i
2 p
c
}Ti I
f,""
l
} Igi r f-ls Sa*s' T
' g. me il iel> ; -:
llli 5
1
.un lill,l!!!
. !Li ix 1
- j ]
lJ y
i]I:i=~
='
f g
enew i
a
.wh j
li ->[*
<;I! 4["*
]
ll
("
i i
jI l
ll1 t ",.'.
i F
hW 3
i t,
l lj WP l l 5
l liI'
'{'i II q n
l1 i{.
l-lI i.
in t-3i I
t*
I j
i "*
k i
i y
j t
i 3
y 3
r >Inw
,)
I I
.mw
_ItL f
j gf
.t
.i 1;
- t
.n t
i i
i i
i i
l I
i i
i i
1
e Figure 5 Maine Yankee Independent Safety Assessment Team High Pressure Safety Injection Pump Train P-148 - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 These curves represent the probability that the high pressure safety injection-(HPSI) pump train P-148 will respond to a random demand, during power operation, for injection into the reactor vessel and will start and The conditional probability is calculated by determining will inject into the reactor vessel for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
the product of (1) the standby availability (ratio of time not in maintenance to ttie total time in operating conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts / cumulative total starts),
and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
The conditional probability curve shows a very high value (over 99 percent) un'til March 1994.
On March 23, There have been no failures to run of the pump 1994, P-148 failed to start because of control problems.
train over the time period.
30, 1996, was 98.5 percent. Thus it is expected that The value of the conditional probability as of June the HPSI pump train P-148 would complete its mission approximately 98 out of 100 random demands.
For these curves, high values are better than low values.
68 Total Starts 68 Successful Starts 1
Failures to Start Total Run Hours 6,592 0
Run Failures While aligned 9.5 Planned Maintenance Hours 0.7 Unplanned Maintenance Hours f
~
Appendix C '
i
a
+=A
-M.a
-...A_.e A.h2 a-4.4--4 4
---41 A
4-
--ha-m A
--.+**JJ-. - - - - - - *
-4 m
a-*
e 4
h N
4
. see, S
L
. sent i
90*d
[
3Had jI j
i
[
i l
4 i
e -r l
i
^
s 5 l s
i h
o M
i g
.tW s
., * =
..en
..edue l
..e.n l?g l
p<
l 4
- lg at i
- =
t p
[
l l C
*
l g
4
.=*=
l
.=
f f~
c 3
- r. n l
F..-
11!,
i x
,p k*-
ig ! F rew 3
Lg f
l 1,
! sl
,' tow l
3
' LI L Imen 8I 2
Itsen ll i
i-l J
j r-
- ~
t
{
7, 4
f 9
.s a
3 j
8M**
l d
s ;4 o
gs j l. 4l
]
w=
w-
! )l1
~
, ]
j{i i
,3 I
l l
ll/
l l
t
(
~
/]
1 w=r i
..=r 5-f
-epsu i
I
.seau
. = *,
i i
i
'.. = =
r
(
{
' 8pmN TF
'.*8N j
}
l 3
T
.=
3 4
. =
- 7 it t
j L
- [
- ,
l, i ;
t i
-r
==
i Figure 6 r.
Maine Yankee Independent Safety Assessment Team High Pressure Safety Injection Pump Train P-14S - Conditional Probability 30, 1996 Operating Conditions 5, 6, 7 from January.1, 1992 to June These curves represent the probability that the high pressure safety injection (HPSI) pump train P respond to a random demand, during power operation, for injection into the reactor vessel and The conditional probability is calculated by determining will inject into the reactor vessel for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
the product of (1) the standby availability (ratio of time not in maintenance to the total time in-o conditions 5, 6 and 7), (2) the probability of start (cumulative successful starts / cumulative total sta and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
TherewerenootNer'.failuresinthispumptrain On August 5, 1992, there was a failure to start of P-14S.The~ Conditional Probability curve show over the time period.
beginning of the period (93.7 percent) and has risen to 98.3 percent over the time period.
30, 1996, was 98.3 percent. Thus it is expected that The value of the conditional probability as of Junethe HPSI pump train P-14S wo r
For these curves, high values are better than low values.
i 60 l
Total Starts 59 Successful Starts 1
Failures to Start i
11.159 l
Total Run Hours 0
i Run Failures f
l While aligned 27.3 t
Planned Maintenance Hours 0.0 Unplanned Maintenance Hours Appendix C t
i f
i
j 1
.se w
. sew 999d x,
l l
. ww
'88* 4 l
'M 1
p
.i I
}
,$g f<:
i}
2;
=-
=*,
- ==
liIi
.ww
. s.,
f l
,.e.,
2 i
.M ip N
- "I j
i
!! i.
g t_.
l
}!
v :u*s !
- a.:
w
' !3l; if ;ll'h""
h!
.! f.'""
3 u
ignlt-!
Li a
i i
n
!r i
1 !!p -::
q.
a
- c h
h
- -l r
l 1
["
I ;.g(
l-- s it Ji!
jjl
' w-r a*
i i
llI
["'
}
)}I I
7
[""
IiI: k
.m g
- 3
l i
- i i
l 3:,;
. ww lll.1 1:
E
..*=
f a.i N
's t-
)
s b. 7{ i==
Tl E==
T !
{
[*"
i I'
l Lg L
1
.. ~,,
.=
.=
4 Figure 7 Maine Yanket Independent Safety Assessment Team Emergency Diesel Generator Train EDG-1A - Conditional Proba'bility 30, 1996 Dperating Conditions 5, 6, 7 from January.1, 1992 to June These curves represent the probability that the emergency diesel generator (EDG) train EDG-1A will respond to a random demand, during power operation, for ac electric power to its 4.16 kV bus and will start and The conditional probability is calculated by determining the product of (1) the power the bus for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. standby availability (ratio of time not in maintenance to the total time in 7), (2) the probability of start (cumulative successful starts / cumulative total starts), and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
a failure to run of EDG-1A. There were no other failures in this EDG train there was '
Dn April 23, 1996, The. conditional probability curve shows that the value was. relatively constant over over the time period.
the time period (90 to 92 percent).
30, 1996, was 91.7 percent. Thus it is expected that The value of the conditional probability as of June the EDG train EDG-1A would complete its mission approximately 92 out of 100 random demands.
For these curves, high values are better than low values.
67 Total Starts 67 Successful Starts 0
Failures to Start 113 Total Run Hours 1
Run Failures 367.5 Planned Maintenance Hours 86.2 Unplanned Maintenance Hours Appendix C 9
O e
.m
m e,
m.,, sa su u A
m.-.m.4.
__m4m.-__E=
_a. _.
-A.
._*_4A4de.
,._u_,J+
e a_-_
m 4--.
em_
4.4.,,
e l
~
seer sove 3Nev
. gNdy 8
i i !i lh. _.:
j!l -.
1st r, i i
IP I
I
.,,w
.,,,,y I
I a
I lg g
s 8
1
. geems
. Genes
{
g
.s j
.se j
..e.
l r
t
}
I ~.
s Ies*s f$
r-u*s T
ji S'll;!=~
j
!!!il{H:ith-iliia* :
!Lj if t-i 1 :..;-
1 in n ;-~
m l
{
~
-i y-(
gm T
I.
a
. enny lip! - !
<;k! -+ (: **
WI
[ **
1
(
1 IP i
t h
~~
t
- ~~
n n
I y
..c r 3/q
- .=
8 Ig I
i '*"
l
\\
g j
.a j
I P-6" t-
$I I
m T-].~m 1.
1
-l s]I w
Jlg 1
i i
e
=~
1 l
~
I
. ap.,
-l:a1 I
.4-----r 64 i
(
i fj p
. w*
fj
. ww
. ww 1
1-
- j: j 1
j j
. ww i
fj J
~
..eme
..ee I
,,,w
,,ew l
.we
.wd si Il g,
),
. = =
. wa j<
ll,
. wee
. se*e
. apw
. apw I
. sgJa,I 194 14 i
E T
[ **
I
,(~
3 6-P l-Eu I
j ll!
- i =.s -
I]i 5 ',ill.I~~.
w
?!
Ijia" i
4 lili !1 :)51 ;: ~-
I I
1 514-!
=1 j
j i
j L;-~
f ij ji s
l11
-+[
)
jj
~~
t
- j]j
,t" i
n I
I
.,ew
.,,w I
E
[
111 g :
l t
g I
gs :
'I I
5 I "g
.g It In I
todmit tede,I 1
t-i
(-
rbill t-i 1
1.1 1l, 3 1,1 t
1 l i._1
{
1 1-
.i i 4
Figure 8 i
Maine Yankee Independent Safety Assessment Team Emergency Diesel Generator Train EDG-1B - Conditional Probability Operating Conditions 5, 6, 7 from January 1, 1992 to June 30, 1996 l
1 These curves represent the probability that the emergency diesel generator (EDG) train EDG-1B will respond j
i to a random demand, during power operation, for ac electric power to.its 4.16 kV bus and will start and The conditional probability is calculated by determining the product of (1) the power the bus for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. standby availability (ratio of time not in maintenance to the total time in o i
7), (2) the probability of start (cumulative successful starts / cumulative total starts), and (3) the probability of run (run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a successful start).
thereNsbothafailuretostartofEDG-1Bandafailure't5rubofEDG-18.
There I
On December 17, 1993; f
were no other failuret in this EDG train over the time period. The conditional prdbability curve shows that the value varied over the time period from 88 to 92 percent. The overall trend has been negative except for i
the last few months.
j The value of the conditional probability as of June 30, 1996, was 90.1 percent.
Thus it is expected that I
the EDG train EDG-1B would complete its mission approximately 90 out of 100 random demands.
i For these curves, high values are better than low values.
j I
80 Total Starts 79 Successful Starts I
Failures to Start i
111
[
Total Run Hours 1
Run Failures 396.5 Planned Maintenance Hours 132.5 Unplanned Maintenance Hours t
Appendix C i
.j
-Mains Yankee independent Safety Assessment Team j
Edward L. Jordan
[
Team Manager AEOD Ellis W. Merschoff Team Leader Region 11 Uldis Vanags Patrick Dostle A
n ds nt David Decrow Region 11 j
State Representatives t
i I
I i
i Kriss M. Kennedy Ronald Lloyd Thomas O. Martin Alan L Madson Jack E. Rosenthal OPS / Training Maint./ Testing Eng.Desi ech.
Management & Organization Analytic Code Support Region IV AEOD RE AEOD AEOD t
Larry Bell Russell Bywater John Boardman Harold Christensen G. Norman Lauben TTC Region til AEOD Region il RES John Kauffman Peter Prescott George Hausman Brian Haagensen Leonard Ward f
AEOD AEOD Region lli Contractor Contractor L
Rpbert Christle Cyril Crane Contractor Oontractor
[
George Cha j
Contractor 7
f MichaelShlyamberg Contractor Appendix D j
i h
-