ML20141G943

Insp Rept 50-219/97-03 on 970414-0525.Violations Noted.Major Areas Inspected:Operations,Maint,Engineering & Plant Support

ML20141G943
Person / Time
Site:	Oyster Creek
Issue date:	07/03/1997
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20141G935	List: ML20141G931 ML20141G940 ML20141G943
References
50-219-97-03, 50-219-97-3, NUDOCS 9707110363
Download: ML20141G943 (48)

See also: IR 05000219/1997003

Text

{{#Wiki_filter:. ._ __ . _ . . . . _ - . . _ . _ _ _ ._. . _ . _ _ _ . _ __ _ . . _ . ._ . . . . , ! , .. j ! U. S. NUCLEAR REGULATORY COMMISSION j REGION 1

! ! ! ! Report No. 97-03 i i Docket No. 50-219 l 72-1004 I License No. DPR 16 . f Licensee: GPU Nuclear incorporated ! 1 Upper Pond Road j Parsippany, New Jersey 07054

! Facility Name: Oyster Creek Nuclear Generating Station ! ! Location: Forked River, New Jersey

i inspection Period: April 14,1997 - May 25,1997

Inspectors: Stephen M. Pindale, Senior Resident inspector (Temporary) i David C. Lew, Senior Resident inspector, Indian Point 3 l Barry S. Norris, Senior Resident inspector, Nine Mile Point 1&2 l Gregory C. Smith, Senior Physical Security inspector l ! Approved By: Peter W. Eselgroth, Chief Projects Branch No. 7 -

f l ~ 9707110363 970703 PDR ADOCK 05000219 G PDR , ,\\ i _ - .. __ , - . .

. - - . - - _ . . - - -- - _ - _ . ~ _ - - - . .- . l ' i EXECUTIVE SUMMARY t ! Oyster Creek Nuclear Generating Station i Report No. 97-03 This integrated inspection included aspects of licensee operations, maintenance, engineering, and plant support. The report covers about a six-week period of inspection. This report includes the NRC's follow-up for the four apparent violations identified in NRC Inspection 50-219/97-02. Two of those four apparent violations, as well as two additional

events from this inspection period, represent violations of station procedures. In total, ' these four violations are characterized as a procedure violation with multiple examples (50- 219/97-03-01a through 01d). Poor communications among the various station groups and human performance weaknesses were primary factors in several of the violation examples. l Plant Operations ! !. l

The "B" shutdown cooling system pump automatically tripped while it was in service for decay heat removal during a plant shutdown. The pump's suction pressure switch was not placed in service as required due to personnel error (failure to follow procedure and inadequate communication between operations shift personnel). Corrective actions for a prior similar occurrence were ineffective in i preventing this event, and is a violation. (01.1) t l l

The licensee's response to excessive nitrogen makeup to the primary containment . ' during a refueling outage plant startup on October 23 - 25,1996, was weak and the operability determination was not timely. The inspector concluded that the licensee focused their assessment more on operability not being conclusively

challenged rather than taking prompt actions to ensure that the degraded condition ! did not affect containment operability Also, the licensee's corrective actions l following the event were not comprehensive, and the basis for the licensee's ! safety assessment in the associated licensee event report was weak. The overall ! response to the event reflected a poor safety perspective. (01.2) ! l

Safety systems were properly aligned for plant operations, and the appropriate technical specification actions were implemented for unavailable equipment. Shift ' personnel were knowledgeable of the reasons for anomalous indications and !. annunciators. However, the control room environment was informal: good communication techniques were not used by operators; access to the "at-the-

! controls" area was not strictly controlled; and annunciator response for an observed alstm was poor. Also, shift supervision generally did not demonstrate good command and control. (O2.1)

The licensee's process for identifying, tracking, and resolving control room deficiencies was adequately managed. Overall, control room deficiencies were ! resolved in a timely manner. Operator work-arounds did not adversely impact safe plant operation. (O2.1) ! ii

- - .

!* 1 . Activities related to testing and restoring an inoperable control rod were poorly

implemented, coordinated and managed. There was no pre-planned structured and documented action plan to outline and assess the multiple activities performed for the inoperable control rod. Written and verbal communications were poor, including incomplete log-keeping, inappropriate use of electronic mail to communicate operability guidance, and an inadequate reactivity management brief to control room operators. The multi-discipline review group inappropriately determined that i this was a minor log-keeping issue only, and assigned the deviation report a low priority response. Implementation of the established reactivity management program was weak. (O4.1) e Overall, the deviation report program was adequate, although, there was a large reliance on a single deviation report coordinator to manage the system. (O7.1) Maintenance l )

The routine maintenance and surveillance activities observed by the inspectors were conducted safely and in accordance with station procedures. (M1.3)

Several performance problems resulted in a small (one - two gallons), unplanned and unmonitored release of slightly contaminated demineralized system water to j the discharge canal. There were inadequate communications among maintenance workers, as well as among the various station groups (i.e. chemistry, maintenance, operations). Also, a leaking isolation valve in the demineralized water system, i previously identified in July 1996, contributed to this occurrence. At the time the i leaking valve was identified, the licensee implemented ineffective corrective and ' compensatory actions for the resultirsg degraded demineralized vvater system l boundary. Finally, corrective actions for a similar event (July 1995) were ' ineffective in preventing recurrence, and this occurrence was characterized as a violation. (M1.4) e The licensee appropriately responded to an unexpected start of train 2 of the standby gas treatment system. The surveillance was halted, the system configuration was returned to normal and system flows were verified. Engineering's initial review of the event was appropriate. (M1.5) 1 o The operability acceptance criteria specified in an emergency diesel generator (EDG) surveillance test was unclear and inconsistent, when compared to EDG loading requirements specified within the body of the procedure. Although the EDG was considered operable, degraded EDG loading was noted during the test as well as prior tests although test acceptance criteria were satisfied. Identification of the cause and corrective actions for the degraded EDG performance is an inspector follow-up item. (M3.1) ! t lii

- .. . - . -. - _ _ - - . . - - - - . _ _ ._ _ -.. - - . . L ! !

1 . l Enaineerina

l

Overall, licensee response to the identification and follow-up for " slow" control rod ' l start of motion times due to scram solenoid pilot valve (SSPV) problems were very

good. However, the initial response to the test results was poor (untimely), and I , l was due to inadequate communications between operations and engineering ! L personnel. This resulted in a delay in evaluating the control rod test results. Once

' the actions were initiated, they were conducted conservatively and appropriately, i ! Engineering evaluation of the observed problems during the installation of the new SSPV diaphragms were thorough and probing, resulting in the further identification l of an additional safety significant pilot valve seat problem. Operations and l maintenance personnel effectively processed and implemented a large amount of ! tagouts and related work activities for this highly visible issue in an error free

manner. (E1.1) i e The licensee's efforts in identifying net positive suction head concerns with the core spray system while evaluating a design change were conservative and thorough. However, additional information is needed (licensee to complete an ongoing evaluation) to determine whether this discovery represents a condition in j conflict with the UFSAR, and is an unresolved item. (E1.2)

A system engineer appropriately evaluated an elevated temperature indication for an electromatic relief valve to determine the impact on valve operability. (E1.3)

The licensee did not perform a 10 CFR 50.59 evaluation when the UFSAR was updated in December 1989 to reflect that the original design of the standby gas treatment system was vulnerable to a single failure. The vulnerability was not reviewed and assessed during the original plant license process. When the licensee identified this single failure vulnerability in 1984, and subsequently incorporated in the UFSAR, the licensee did not review the implication of this on the technical specification basis. Although this failure to perform a 10 CFR 50.59 evaluation occurred in December 1989, it is reflective of the licensee's current performance because the licensee's approach to this type of change to the UFSAR remained the ' same. The licensee has not taken actions to resolve this specific issue, and the failure to perform a 10 CFR 50.59 evaluation is a violation. (E2.1)

Problems identified with the implementation of the component classification l process at Three Mile Island prompted a similar review for the common process at i Oyster Creek. The licensee's actions taken to date concerning the Quality Classification List programmatic weaknesses were acceptable. Additional licensee findings will be evaluated as they are identified, and further tracking and evaluation of this issue is an unresolved item. (E2.2) l I , iv I l

. . Plant Support The licensee effectively implemented the radiation protection program. (R1.1)

The licensee maintained an effective security program. The alarm station operators and security officers were knowledgeable of their duties and responsibilities, and security training was being performed in accordance with the NRC-approved training. Qualification plan and management controls for identifying, resolving, and preventing programmatic security problems were effective. Maintenance and testing of security equipment were effectively performed. The vehicle barrier system was installed and was being maintained in accordance with applicable regulatory guidance and requirements. Vehicles were being searched and controlled prior to entry into the protected area as described in the Security Plan and applicable procedures. (S1 - S8) 1 1 ! . v

_ > __ -__ __ _ _ _ _ _ _ .__ . _ _ _ - _ _ ;

l e ! . TABLE OF CONTENTS I EAER 1 i EX ECUTIVE SU M M ARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii TAB LE O F CO NTENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi , ! l. OPERATIONS (37551, 40500, 71707, 90712, 92901, 93702) 1 ............. 01 Conduct of Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 01.1 Inadvertent Shutdown Cooling System Pump Trip Due to Failure to Properly Align Pressure Switch During System Startup (Violation 50-219/97-03-01 a) 1 ................... 01.2 Containment Leakage Above Technical Specification Limits . . . . . 3 02 Operational Status of Facilities and Equipment . . . . . . . . . . . . . . . . . . . 6 , O2.1 Review of Control Room Switches, Indications 6 ....-........ 04 Operator Knowledge and Performance 8

........................ 04.1 Performance Weaknesses While Testing and Restoring an l Inoperable Control Rod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 ' l 07 Quality Assurance in Operations 12 ........................... 07.1 Implementation of the Deviation Reporting Program . . . . . . . . . 12 08 Miscellaneous Operations issues (Violation 50-219/97-03-01 b) . . . . . . 13 l l 08.1 (Closed) eel 5 0-219/9 7-0 2-01 . . . . . . . . . . . . . . . . . . . . . . . . 13 08.2 (Closed) eel 50-219 /9 7-0 2-02 . . . . . . . . . . . . . . . . . . . . . . . . 13 ! 11. MAINTENANCE (61726, 62707, 90712, 92902) 14 ...................... l M1 Conduct of Maintenance 14 ................................ l M 1.1 Maintenance Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 l M 1.2 Surveillance Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 l M1.3 Maintenance and Surveillance Activities Conclusions 15 ........ l M1.4 Failure to Obtain Satisfactory Chemistry Sample of Demineralized Water Prior to Using System for Maintenance l (Violation 50-219/97-03-01c) 15 ........................

M1.5 Refueling Floor Radiation Monitor Surveillance Test 17 ......... i M3 Maintenance Procedures and Documentation . . . . . . . . . . . . . . . . . . . 18 l M3.1 Emergency Diesel Generator Rated Load Surveillance Test I (Inspector Follow-up Item 50-219/97-03-02) . . . . . . . . . . . . . . 18 l M8 Miscellaneous Maintenance issues (Violation 50-219/97-03-01d) 20 .... M8.1 (Closed) eel 50-219/97-0 2-03 . . . . . . . . . . . . . . . . . . . . . . . . 20 , ! 111. ENGINEERING (37551, 40500, 71707, 90712, 92903) . . . . . . . . . . . . . . . . . . 20 i E1 Conduct of Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 l E1.1 Forced Plant Shutdown Due to Equipment Deficiencies . . . . . . . 20 E1.2 Core Spray System Response During Specific Postulated Scenario (Unresolved item 50-219/97-03-03) 24 ............. E1.3 High Indicated Tailpiece Temperature for Electromatic Relief Valve 25 ......................................... E2 Engineering Support of Facilities and Equipment . . . . . . . . . . . . . . . . . 26 4 vi

. . .. __ ___.- - _ _ _ _ _ . - - , !

! ! !,* !

! E2.1 Standby Gas Treatment System Single Failure (Violation '( 50-219/97-03-04) 26- i ................................ E2.2 Quality Classification List and Component Downgrade Program

Deficiencies (Unresolved item 50-219/97-03-05) . . . . . . . . . . . 27 ) E8 Miscellaneous Engineering issues (NCV 50-219/97-03-01e) 29 l ........ E8.1 (Closed) eel 50-219/97-02-04: 29

....................... .! IV. PLANT SUPPORT (71707, 71750, 92904) 29

.......................... R1 Radiological Protection and Chemistry Controls . . . . . . . . . . . . . . . . . 29 l R1.1 General Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 ' . S1 Conduct of Security and Safeguards Activities 29 ................. S1.1 General Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

S2 Status of Security Facilities and Equipment . . . . . . . . . . . . . . . . . . . . 30 , S2.1 Protected Area (PA) Detection Aids 30 i .................... ~ S2.2 . Alarm Stations and Communications 31 i ................... S2.3 Testing, Maintenance and Compensatory Measures . . . . . . . . . 31 I S5 Security and Safeguards Staff Training and Qualification (T&O) . . . . . . 32 j S6 Security Organization and Administration 32- l ..................... S7- Quality Assurance in Security and Safeguards Activities . . . . . . . . . . . 33 S7.1 Effectiveness of Management Controls . . . . . . . . . . . . . . . . . . 33

S8 Miscellaneous Security and Safety issues . . . . . . . . . . . . . . . . . . . . . 33 ! S8.1 Vehicle Barrier System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 ! S8.2 Bomb Blast Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 S8.3 Procedural Controls 35

............................... S8.4 Security Computer and Compensatory Measures . . . . . . . . . . . 35 ! ! S8.5 Review of a Previously identified Violation 36 j ............... i V. M AN AG EMENT MEETINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 l X1 Exit Meeting Summ ary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 I X2 Review of Updated Final Safety Analysis Report (UFSAR) . . . . . . . . . . 36 l ATTACHMENT 1 38 i ...................................... ATTAC H M E NT 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 { ATTA C H M E NT 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

, 4 ! I i 1 l I 1 , l l vii l ~ i - . . - - . .--

.. . ! Report Details Summarv of Plant Status ! l The plant was operating at full power at the beginning of this inspection (April 14,1997). ! On April 18, control room operators commenced a load reduction in order to perform I required quarterly testing of the main steam isolation valves. Reactor power was reduced to about 35% and the testing was satisfactorily completed. Reactor power was then increased to about 65% where several other planned maintenance and testing activities were completed. Full power operation resumed on April 21. Then on April 22, after l evaluating and confirming test results from control rod scram insertion testing, a controlled plant shutdown was initiated because the average start of motion time for the seven (of 137 total) control rods tested exceeded expected values. The reactor reached Cold l Shutdown (less than 212 F) at 7:44 p.m. on April 23. !

The licensee found that the " slow" start of motion times were attributed to material i ' problems within the scram solenoid pilot valves (SSPV). Repairs to all SSPVs were j subsequently completed, and a reactor startup commenced on May 3. The reactor was made critical at 8:29 p.m. on May 3, and full power was reached on May 8. Full power j operation continued through the end of the inspection period (May 25). l 1. OPERATIONS (37551, 40500, 71707, 90712, 92901, 93702) 01 Conduct of Operations' 01.1 Inadvertent Shutdown Coolina System Pumo Trio Due to Failure to Properly Alian Pressure Switch Durina System Startuo (Violation 50-219/97-03-01 a) a. Insoection Scope On April 24,1997, with the "A" and "B" shutdown cooling (SDC) system pumps in service, the "B" pump inadvertently tripped due to low pump suction pressure. The inspector reviewed the licensee's response and followup activities, corrective actions, and prior similar events (deviation report database). b. Observations and Findinas During a plant shutdown to repair scram solenoid pilot valve assemblies, control room operators placed the SDC system in service at 5:30 p.m. on April 23,1997, l using procedure 305, "SDC System Operation." Two of the three pumps ("A" and "B") were placed in service. The procedure directs the operator to open and then close the isolation valve associated with each SDC loop's pump suction pressure ' Topical headings such as 01, M8, etc., are used in accordance with the NRC standardized reactor inspection report outline. Individual reports are not expected to address all outline topics. l l l

__ _ _ - _ _ _ _ _ _ - - . . 2 switch in order to verify that pump suction pressure is above 4 psig prior to starting the SDC system pump. The switch is maintained isolated until flow in the respective loop has stabilized. Then, the procedure directs the operator to unisolate the pump pressure switch associated with each operating loop. The purpose of the pump suction pressure switch is to ensure that its associated pump has sufficient net positive suction head for operation. Upon actuation of the switch at its low setpoint of 4 psig, the associated SDC system pump trips automatically. The "B" SDC syster pump auwmatically tripped at 2:14 a.m. on April 24/1997. Reactor coolant temperature was approximately 165 F at the time, and the "A" pump continued to operate. Electricians verified that there was not an electrical problem with the breaker. Operators attempted to restart the "B" pump at 3:00 a.m., but it immediately tripped on low suction pressure. Additional followup identified that the pump suction pressure switches for both the "A" and "B" SDC system pumps were still isolated. The "C" was also isolated, but it had not been started. The licensee stated that the pressure within the isolated portion of tubing (up to the pressure switch) decayed from about 20 psig over several hours due to minor tubing fitting and instrument valve packing leaks. They have experienced and repaired similar minor leaks in the past on these components. The operators realigned and restarted the "B" SDC system pump at 3:10 a.m., and both the "A" and "B" pump suction pressure switches were un-isolated. There was no notable increase in reactor coolant temperature during the time that only one SDC system pump was operating (about one hour). The licensee's followup of this event determined that the lead onshift senior reactor operator instructed the control room operators to maintain the pressure switches isolated, apparently because flow was not fully stabilized. He stated that the configuration would be communicated to the next shift, however, it was not. The inspector found that a similar event occurred while performing shutdown activities during the most recent refueling outage on September 13,1996. Deviation report (DR) 96-723 documented that the SDC pump suction pressure switch isolation valves were found closed for the three running SDC pumps. The DR stated that the procedure was deficient in that the valves were closed during the I weekly pump rotation step but were not properly controlled when starting the system. The corrective actions included revising procedure 305. Although the root causes for the two events appear to be different, the result was the same. The SDC system was operating without the required pump protection in the event of a reduction in pump suction pressure. Procedure 305, Section 4.3 (System Startup for Cooldown Operation) directs the operators to valve in the pump suction pressure interlock for the operating pumps by opening the respective pressure switch isolation valve when flow in the operating loop has stabilized (step 4.3.18). Section 5.5 (Placing an Additional SDC Loop in Service With One or More Operating) of procedure 305 contains similar guidance when placing additional SDC system loops in service (step 5.5.13). The failure to follow procedure 305 is a violation. (VIO 50-219/97-03-01a) _ _ - _ _ _ _ _ _ _

l

l . l 3 c. Conclusions The "B" SDC system pump automatically tripped due to I) personnel error (failure to follow procedures, inappropriate supervisory oversight, and inadequate communications), and 2) inadequate corrective actions for a prior similar occurrence. 01.2 Containment Leakaae Above Technical Specification Limits a. Inspection Scope (37551. 71707. 92702) i During the NRC inspection of a radiation monitor surveillance test and a standby gas treatment system single failure vulnerability as documented in sections M1.5 and E2.1 of this report, respectively, the inspector noted an event related to these two issues as documented in NRC inspection report 50-219/96-11 and licensee event report (LER) 96-11. This prior event involved primary containment leakage in excess of technical specifications identified after the 16R refueling outage. After , inerting the contair. ment on October 23,1996, the licensee identified that nitrogen mr.keup to the containment was excessive. The plant was subsequently shut down i due to an unrelated issue associated with main generator stator cooling on October 25,1996. The inspector reviewed the appropriateness of the licensee's actions , between October 23 and October 25, and the licensee's assessment of and corrective actions in response to the event. b. Observations and Findinas j On October 23,1996, the licensee noted excessive nitrogen makeup to the primary containment after completion of containment inerting at 11:47 a.m. This excessive makeup was recognized by the operators and resulted in the investigation of the j nitrogen system valve lineup by 6:30 p.m., and management's direction to the shift technical assistants (ETA) to monitor containment leakage. As the investigation into the nitrogen makop issue continued, the licensee continued power ascension, j achieving full power on October 25 at 4:56 a.m. Seven hours later, the plant was { manually scrammed fotbwing a main turbine runback due to a stator cooling problem. On October 26, the licensee identified that a torus-to-drywell vacuum breaker, valve V-26-5, had a cover plate leak and primary containment leakage was j about 874 standard cubic eet per hour (scfh). The technical specification (TS) limit was 426 scfh. j The licensee's documented assessment of the evert indicated that the safety significance of the event was minimal and focused on the maintenance and local leak rate testing aspects of the event. However, the inspector's review of the event raised concerns with (1) the quality of the licensee's determination of safety l significance, (2) the thoroughness of the corrective actions, and (3) the narrowness j of the event review, particularly with regard to the appropriateness of licensee

actions after the identification of the excessive nitrogen makeup. l l l

. . 4 Regarding the adequacy of the safety significance determination, LER 96-11 ' indicated that the significance was minimal because the primary leak rate of 874 scfh was well below the standby gas treatment system (SGTS) of 2600 standard cubic feet per minute (scfm). However, the inspector noted that the TS basis for primary containment leakage (TS 4.5) already accounted for a 90% filter efficiency of halogens by the SGTS. After SGTS filtration, a leak rate of 426 scfh, which corresponds to the TS limit, would result in a maximum thyroid dose at the site boundary of 139 rem over an exposure of two hours. The 10 CFR Part 100 limit for thyroid dose at the site boundary for two hours is 300 rem. The inspector noted several factors which would result in higher doses than assumed in the TS basis. i These factors were:

The primary containment leakage was found to be about 874 scfh. This leakage was a factor of 2.05 greater than allowed by TS. TS basis indicated that the allowable primary containment leakage could be twice the TS limit before 10 CFR Part 100 limits would be exceeded. '

The primary containment leakage estimated by the licensee did not account for two factors, which would increase the estimated primary leakage. The , leakage by other leak paths such as the main steam isolation valves was not factored into the overall containment leakage. This leakage was meastred to be a total of 16.84 scfh during the last local leak rate test. Also, the leakage measured at 2 psig assumed that the leak path was independent of the force acting on the valve cover. In fact, the force of just over 1 psig during the initialinerting of containment, likely caused the degraded containment condition. A force of 35 psig during a design basis loss of coolant accident I wou:d result in forces which were 17 times higher than tested.

The SGTS was assumed to have a 90% efficiency for halogen removal, which is the primary contributor for thyroid dose. However, as documented in the UFSAR and NRC inspection report 50-219/89-09, the SGTS is vulnerable to the single failure for automatic initiation. Since a design basis accident assumed a worse case single failure, the SGTS would not provide 90% efficiency. The automatic initiation single failure could cause a loss of the SGTS heaters and result in higher relative humidity within the charcoal filter. At 100 percent relative humidity in the charcoal, the efficiency of the SGTS to filter halogens would drop to 78%. This represents a factor of about 2.2 times the radioactive halogens release to the site boundary. Further, manual initiation would result in a half hour delay in placing the SGTS in service. The inspector concluded that the licensee's corrective actions were weak. As described above, the licensee did not thoroughly assess the safety significance, and did not perform a critical review to ensure that 10 CFR Part 100 limits would be maintained after a postulated design basis accident. The licensee did not perform a critique of this significant event and focused primarily on the maintenance and testing aspects of the event. Considering that TS requires that the plant be in cold shutdown in 24 hours if primary containment integrity is inoperable, the licensee t l l

l

j \\ - l 5 l had no documented review of the timeliness of the actions in response to excessive i nitrogen makeup and no documented review of the adequacy of the process for determining operability for a degraded condition. The licensee did not initiate a deviation report in response to a significantly large makeup to primary containment. The inspector noted tnat the trigger for ensuring that the degraded condition would be addressed was changed from 2,600 units to 250 units in procedure 312.11, " Nitrogen System and Containment Atmosphere Control," Revision 11. This indicated that the licensee identified that the trigger point previously was not adequate but no documented deviation report was generated. The inspector also noted that the LER was reviewed by the Plant Review Group and the General Office Review Board. These groups failed to identify the weaknesses in the LER. The inspector concluded that the licensee's response to the excessive makeup to the containment was not timely. More timely actions should have been taken in light of the significance of primary containment and the indications that primary containment was ciegraded. The logged usage of nitrogen on October 24 was 827.7 units. Nitrogin makeup was not excessive before inerting the containment, which indicated that leakage was not likely to be external to containment. The LER indicated that the licensee's gross leakage indicated that TS limits could be exceeded at 8:00 a.m. on October 24. However, the inspector found that the licensee did not choose to rely on the gross leakage information at that time despite their inability to identify the leakage source from ongoing activities. Instead, they- , continued to raise power and did not ensure a timely operability datermination. The loss of containment integrity required the plant be in cold shutdown in 24 hours. Based on documentation and interviews, the inspector concluded that the licensee focused their assessment more on operability not being conclusively challenged rather than taking prompt actions to ensure that the degraded condition did not affect containment operability. The licensee indicated several reasons for questioning the excessive makeup; however, these reasons did not provide assurance of operability. These reasons included:

The accuracy of the calculated leakage was low as containment conditions continued to change during power ascension. However, the inspector noted that the magnitude of the change was not quantified to determine if it would account for excessive usage in nitrogen. Power ascension was not terminated to allow containment conditions to stabilize so that this issue may be resolved.

A significant contributor to the leakage was the compressor case leak located outside containment. However, the inspector determined that the leakage was not quantified or estimated to determine whether it could l account for the leakage. The excessive makeup was present before the nitrogen compressor was put into service. .

. e 6 c. Conclusions The licensee's response to the excessive nitrogen makeup to primary containment from October 23 through 25 was weak. The recent response to this event reflected poor safety perspective. Also, the licensee's corrective actions after this event were poor. The basis for the licensee's assessment of the safety significance of the October event was weak. The assessment relied on information which was already factored into the leakage limit for primary containment. The licensee's documented corrective actions did not assess the appropriateness of actions during the event. Enforcement for the primary containment leakage in excess of technical specification was addressed previously (NRC Inspection 50-219/96-11). The LER quality weaknesses were discussed with the licensee, who stated that they would complete further analysis and resubmit the LER. 02 Operational Status of Facilities and Equipment O2.1 Review of Control Room Switches, Indications, and Deficiencies a. Insoection Scope (71707) The inspector performed a detailed comparison of the control room operating panels against a checklist of expected normal indications and switch positions. The Operational Safety Verification (OSV) Checklist was developed by the inspector using, as a basis, the operators' daily logs, the Technical Specifications (TS), the Updated Final Safety Analysis Report (UFSAR), and system operating procedures. In addition, the inspector reviewed the system for identification, tracking, and resolution of control room deficiencies, including defeated annunciators, c,perator " work arounds," and operator aids. b. Observations and Findinas OSV Checklist Using the OSV Checklist, the inspector reviewed the control room switch positions and indications on May 22,1997. During the OSV, the unit was at full power and safety systems were aligned properly for full power operation. All differences between the OSV Checklist and actual plant status were verified for those systems removed from service for maintenance, and the inspector verified that any applicable actions were implemented for the respective TS. The inspector also verified that shift personnel were knowledgeable of the reasons for the anomalous ! indications and annunciators. l During performance of the OSV, the inspector verified that shift staffing was in compliance with TS requirements. in general, communications were adequate. However, repeat back and confirmation techniques were not utilized during the routine activities observed. The Operations Director informed the inspector that he

l

i . 7 ! expects operators to use these techniques during routine activities. In addition, operator annunciator response for routine alarms was weak; the individual acknowledging the alarm did not announce which alarm annunciated, nor were the control room alarm response procedures referenced. For one alarm, the inspector noted that the lead control reactor operator (LCRO) had his back to the panel, yet l the reactor operator (RO) who acknowledged the alarm did not state which alarm annunciated or whether it was an expected condition. . The inspector noted an informal control room environment in that entry into the "at- the-controls" area was not strictly controlled. Some individuals needing to talk to the control room shift personnel entered the area without permission from the SRO, although they were people who periodically enter for routine purposes, such as fire watch personnel. Control Room Deficiencies The inspector reviewed licensee procedures governing control room deficiencies, which provided administrative guidance relative to defeated annunciatc,rs. A " defeated annunciator" is an annunciator window having a temporarily altered circuit because of a design deficiency, malfunctioning component, or tagout for pre- planned maintenance. A defeated annunciator could have one, or all, inputs altered. Compensatory actions for those annunciators whose inputs were defeated were discussed with the control room staff. All defeated annunciators appeared to have one or more alternate means for readily identifying an abnormal occurrence. On the front panels, there were 23 defeated annunciators, approximately 5 percent. Of the 7 that were greater than 6 months old, none would be considered safety significant.

it appeared that significant defeated annunciators were generally resolved in a l timely manner, although a few were awaiting resolution. The inspector reviewed i the Defeated Annunciator Log maintained in the control room and determined that all were appropriately logged. The overall number of control room deficiencies was about fifty. This backlog has been steady for about three months. Additional attention is needed to reduce the number of these deficiencies. 4 The inspector also reviewed the operator work-arounds in the control room and discussed the conditions with the shif t staff and managernent. The term " work- around" refers to actions performed by the operating crew to compensate for equipment not functioning as designed. The inspector concluded that the current work-arounds had no adverse impact on safe plant operations. General Observations The inspector noted the following observations in the control room: l The reactivity control notebook was located on the main control panels, near

the control switch for the "E" reactor recirculation pump. This is a poor work practice which had the potential to cause a reactivity transient. The licensee moved the book to a different location in response to this concern. l

, t . 8 The inspector considered the chart recorder for the telltale temperature of the

electromatic relief valves (EMRV) to be inoperative. Position 8, which monitored the temperature of "C" and "D" EMRVs was erratic with readings from 130 F to 495 F; this caused the pen to write over the readings for the , other 7 switch positions. In response to the inspector's concern, the licensee processed a defeated alarm evaluation and appropriately defeated that input. Compensatory readings were discussed in the evaluation. The control room SRO was very busy with administrative details, such as

reviewing and approving maintenance activities. This can potentially distract the SRO from providing sufficient oversight of control room activities. The licensee recognized this concern, and was evaluating the establishment of a dedicated work control SRO, located outside the control room, to process tagouts and maintenance activities to minimize control room distractions. Control room logs and shift turnovers were generally good and in accordance

with procedures, c. ,Qonclusions Safety systems were properly aligned for plant operations, and the appropriate TS actions were implemented for unavailable equipment. Shift personnel were knowledgeable of the reasons for anomalous indications and annunciators. However, the control room environment was informal: communication techniques exhibited some weaknesses; access to the "at-the-controls" area was not strictly controlled; and annunciator response for an observed alarm was weak. i The licensee's process for identifying and tracking control room deficiencies was- adequately managed. Overall, control room deficiencies were resolved in a timely manner. However, continued emphasis is needed in this area to reduce the overall number of deficiencies. Current operator work-arounds did not adversely impact on safe plant operation. 1 04 Operator Knowledge and Performance ' 04.1 Performance Weaknesses While Testina and Restorina an Inocerable Control Rod j i ' a. Insoection Scoce (71707. 37551. 40500J The inspector reviewed a deviation report (DR) submitted by the licensee related to l apparent problems while returning an inoperable control rod to service. The inspector interviewed several operations and engineering personnel and reviewed logs and procedures. 1 ! , 1

._ . _ . _ . _. - _ . _ _ . _ _ __ _. l* l 9 b. Observations and Findinas , i The inspector's review found that on May 22,1997, while troubleshooting, testing l l and restoring an inoperable control rod, several process and performance l deficiencies occurred. Control rod 10-1 i was declared inoperable on May 7,1997, when operators could not move it from its fully inserted "00" position. It had been

l successfully scram time tested following scram solenoid pilot valve maintenance during the reactor startup from the April 22,1997, plant shutdown. l t Several maintenance and testing activities were parformed on control rod 10-11 since it was declared inoperable, such as scrarn flushing the control rod drive, < l collecting thermography data on certain hydraulic control unit components, and replacing two of the four directional control valves. After all of these activities were performed, however, the control rod still could not be moved. Operations management requested that engineering personnel conduct a formal review of the l completed actions to determine adequacy of those actions and to develop an l l appropriate plan for additional activities. The licensee then convened a formal root cause analysis session on May 14, which outlined all activities performed to date, i and developed recommendations for additional troubleshooting, including replacing another one of the directional control valves. l The system engineer subsequently requested the control room operators (CRO) to perform another scram flush for the 10-11 hydraulic control unit (HCU) to assist I troubleshooting activities in accordance with procedure 235, Attachment 8. This i l activity was completed on May 22,1997 at 1:53 p.m. Core engineering personnel i l were in the control room for the activities. Although the control rod was located - ' l near the core periphery, it was calculated to contain relatively high worth. Accordingly, core engineering determined that the rod could be moved out to notch

"10" while still meeting technical specification (TS) 3.2.A shutdown margin requirements. If the control rod was required to be moved further out than notch

l "10" while it was stillinoperable, then additional control rod manipulations would l j have been necessary to ensure proper shutdown margin. ' l_ After the scram flush, the operators attempted to exercise the control rod to i

determine whether it would move. The control rod did move that time, and the ! l CRO log documented that HCU 10-11 was exercised from "00* to "04" at 2:09 p.m. The log entry further states " excess rod speed observed." The CROs involved

! informed the inspector during a followup discussion that the rod moved significantly faster than expected and that they immediately operated the emergency-in switch . to return the rod to "00." The operators adjusted the needle valves on the HCU's i directional control valves to reduce the rate of normal rod travel, which reduced the speed, but it was still excessive. By the end of the shift (4:00 p.m.), the CROs and , l the control room senior reactor operator (SRO) considered CR 10-11 inoperable due to the excessive rod travel speed. Operations personnel informed the system engineer that control rod 10-11 moved, although at a very fast speed. The system engineer felt that, since the control rod could be moved with control rod drive pressure and a prior acceptable scram time , , h

- , o i 1 . i 10 , test was done, the control rod could be declared operable. This was consistent with the licensee's interpretation of the associated Technical Specification (TS 3.2). Normal control rod speed is not considered for TS operability. The system engineer informed the inspector that he also recognized that further speed adjustments would have to be made for the control rod to be fully functional. j The inspector concluded that the next sequence of activities were not well documented or controlled. The CRO log status for the beginning of the 4:00 p.m. - 12:00 a.m. shift (May 22) documented that load was limited by HCU 10-11. The following summarizes the subsequent relevant CRO log entries: l 5:20 p.m. Control room SRO completed a reactivity management briefing to control room personnel on the upcoming power reduction to about i 90% to support the return of CRD 10-11 to en operable status 5:25 p.m. Comrnenced power reduction j 5:43 p.m. Achieved 92% power 5:44 p.m CRD 10-11 moved from "04" to "00" - satisfactorily l 5:45 p.m. Took CRD 10-11 from "00" to "48" in 34.1 seconds - adjustment required (Withdrawal time acceptance range, per procedure 235; 46 ' to 60 seconds) 5:48 p.m. Took CRD 10-11 from "00" to "48" in 57.4 seconds - adjustment required (Insert time acceptance range, per procedure 235; 40 to 56 seconds) 7:03 p.m. Completed three consecutive timings for HCU 10-11 -in specification. Left control rod at "48" position. Control room SRO declares HCU 10-11 operable These log entries indicate that control rod 10-11 was withdrawn beyond notch "10" while it was still inoperable. However, per Core Engineering, shutdown margin could not be met if the rod remained inoperable and withdrawn beyond notch "10." The inspector interviewed several operators, and determined that the individual who wrote the log, the lead CRO, believed control rod 10-11 was inoperable, but failed to recognize the shutdown margin concern. The control SRO, however, who was the on shift reactivity manager (per procedure 106.11, " Reactivity Management"), informed the inspector that he considered control rod 10-11 operable before it was l moved beyond notch "10". He also stated that he recognized the shutdown margin I concern. Apparently, the reactivity management briefing, conducted by the control room SRO at 5:20 p.m., inadequately described the upcoming evolution for control rod 10-11 and failed to communicate his operability determination for the control rod. A subsequent log entry, made several days later, May 27, stated that rod 10- 11 was declared operable on May 22 at 5:20 p.m. based on the fact that it can be l ! !

- . - . . .- _- - - .- - . , . ! 11 moved with normal drive pressure. However, the inspector determined that this was more than just a log-keeping deficiency. If the lead CRO (as the on shift reactivity coordinator, per procedure 106.11, " Reactivity Management") believed - that control rod 10-11 was inoperable, he should have recognized or questioned the shutdown margin consideration before moving the rod beyond notch "10." There were other factors which contributed to operator confusion early in the 4 - 12 shift. The control rod drive system engineer electronically sent a message at 3:55 p.m. to operators and technical and operations management regarding rod 10-11 status and expectations, including the operators' experience with the fast rod i withdrawal speed. The note stated that in order to completely adjust and measure l the withdrawal stroke time for rod 10-11, it must be fully withdrawn and timed for full travel (as per procedure 235), and that core engineering is providing instructions for accomplishing this step. Finally, the system engineer's note stated that, i provided the stroke times for the rod are within the acceptable range, the rod will meet the requirements for being declared operable. The system engineer informed the inspector that he recognized the control rod could be declared operable at the j time he sent the note because the rod moved with control rod drive pressure and it had an acceptable scram time. However, the note was interpreted by some j operations and technical staff to mean that the control rod can be declared operable only after the stroke time is adjusted to within specification. This interpretation j resulted in additional confusion as to when the control rod should be declared i operable. Since the note was sent electronically, not all of the key personnel received and read the message in a timely fashion (if they were not at their computer), nor were they able to question the engineer on his intent. The deviation report was reviewed by the multi-discipline review group on May 26, 1997, who assigned a low risk and low uncertainty, requiring the least rigorous root cause effort (Category D). In addition, the subject of the deviation report was deemed not significant and not a reactivity management issue. It was assigned to the shift technical advisor who wrote the deviation report, with a medium response due date (Level B - 4 months). The group was informed that this was a log-keeping issue only. The inspector determined that the multi-discipline review group assigned an inappropriately low level response to this potentially significant issue, and failed to recognize the potential reactivity management concerns. By the end of the inspection period, the licensee had initiated a formal event review to determine ! the details and corrective actions for this event. Based on interviews with several of the personnel from the two shifts involved with the May 22,1997, activities, the inspector determined there were significant , communication weaknesses among personnel within the shifts and between the two shifts. The inspector determined that ultimately, the licensee had sufficient basis to confirm that control rod 10-11 was operable before it was fully withdrawn for additional directional control valve needis valve adjustments. Therefore, the shutdown margin TS was not compromised when the control rod was moved out of the core beyond notch "10" for full travel response time measurement and j- adjustment.

. _ . _ _ _ _ .__ _ - . . . __ __ _ . . _ , . _ _ . n L l , , 12 l c. Conclusions ! This activity was poorly implemented, coordinated and managed. There was no pre-planned structured and documented action plan to outline and assess the multiple activities performed for control rod 10-11. There were poor written and verbal communications, including unclear log-keeping, inappropriate use of electronic mail to communicate operability guidance, and an inadequate reactivity management brief. The multi-discipline review group inappropriately assigned a low i priority and low safety significance to this event, but subsequently initiated a more . ' formal review based on the inspector's review of and conclusions from the event. The inspector determined that overall implementation of the established reactivity management program was weak. 07 Quality Assurance in Operations 07.1 Imolementation of the Deviation Reportina Prooram

j a. Insoection Scoce (40500) i i ! The inspector reviewed the Oyster Creek program for identification and resolution ! of deviations. The review included the applicable procedure, discussions with the j station staff and management, and review of a select portion of the deviation reports. b. Observations and Findinas l At Oyster Creek, the program for documenting and dispositioning of deviations is . detailed in procedure 104, " Control of Nonconformances and Corrective Action," Revision 24. Material nonconformances and events / conditions which require further review are documented on a deviation report (DR). An individual in the ! Safety Review Group is designated as the DR Program Coordinator. The inspector reviewed the DR procedure, discussed the process with the coordinator, attended a monthly DR status meeting, and reviewed the monthly DR status reports for 1997. The DR Coordinator was knowledgeable with respect to all aspects of the process. All DRs are processed through the coordinator, including l extensions and closures. The DR process works adequately, with some weaknesses in the implementation. A large number of DRs get extended at least once for disposition or corrective action completion, with minimal justification. l The inspector's review of the monthly status reports identified two notable issues. The majority of DRs, including those greater than one year old, belong to engineering. Of the 307 DRs open as of the end of April 1997,188 were assigned to engineering. Ten of the 15 DRs that are greater than one year old also belong to engineering. Of the old DRs, seven are refueling outage related. Also, trending by Oyster Creek identified that 51 % of the DRs that are classified as significant had an , i ' ,

. . . . - - - - - - - . . . - . . . - - - - - . . . - - - - - . - . - . _ - .. l t t i l L l l . i f 13 , initial root cause of human error, yet there was no adverse trend DR initiated to ( document the high human error rate. ' l , , c. Conclusion i ! .Overall, the DR program was adequate; although, there were some minor l

l' weaknesses that had already been identified by Oyster Creek management. { ! 08 ' Miscellaneous Operations issues (Violation 50-219/97-03-01b) l , t QHd (Closed) eel 50-219/97-02-01: This item was one of severalissues characterized as an apparent violation in NRC Inspection 50-219/97-02 to be considered ' collectively for escalated enforcement actions. The NRC subsequently determined that escalated enforcement was not warranted, however, normal enforcement

sanctions were appropriate. Accordingly, eel 50-219/97-02-01 is administratively 'i closed, and this issue is now characterized as one of several examples of a ! i l procedure violation, as follows. j i Procedure 108, " Equipment Control," step 9.1.1, requires the control room operator to determine the appropriate isolation boundaries for work activities using Attachment 108-6 (Guidelines for isolation Boundaries). Item 2.4 of Attachment

108-6 states that the effects on the system if a valve is physically moved during ! maintenance work shall be considered and additional isolation boundaries shall be .! added to the outage as appropriate. Step 10.1 of procedure 108 requires the l licensed operations supervisor to review the switching order for compatibility with ! license requirements and station operating conditions. Contrary to procedure 108, the control room operator did not determine an , l appropriate isolation boundary for maintenance to torus spray valve V-21-18 in the i containment spray system. The valve was physically moved several times during the maintenance without adequately considering the effects on the system or adding additional isolation boundaries to the outage. As a result, the pressure suppression function of the torus was degraded during the times that maintenance personnel had V-21-18 opened (total of about 10 minutes). Also, the licensed i ' operations' supervisor failed to identify that the switching order was not compatible with license requirements and station operating conditions. (VIO 50-219/97-03- . , 01b) l ! 08.2 (Closed) eel 50-219/97-02-02: This item was one of several issues characterized i ' as an apparent violation in NRC Inspection 50-219/97-02 to be considered i collectively for escalated enforcement actions. The NRC subsequently determined ' that neither escalated enforcement nor normal enforcement was appropriate for this item (discrepancies identified by the licensee's Nuclear Safety Assessment staff). l

Accordingly, eel 50-219/97-02-01 is administratively closed.

' 4 ! i ~- . - - - . , - - - , - - - - -

. l , 14 11. MAINTENANCE (61726, 62707, 90712, 92902) M1 Conduct of Maintenance M 1.1 Maintenance Activities a. Insoection Scope (62707) The inspectors observed selected maintenance activities on both safety-related and non-safety-related equipment to ascertain that the licensee conducted these activities in accordance with approved procedures, Technical Specifications, and appropriate industrial codes and standards. The inspectors observed all or portions of the following job orders (JO):

JO (Various) Replace SSPV diaphragms. Replace pilot valve head assemblies.

JO 507628 Replace Control Rod Drive Pump Rotating Element

JO 512113 Concrete Repair of De-laminated EDG-2 Roof Panels

JO 515635 Replace 123 Solenoid Valve for Control Rod 10-11 b. Observations and Findinas The inspectors concluded that the above activities had been approved for performance and were conducted in accordance with approved job orders and applicable technical manuals and instructions. Personnel performing the activities were knowledgeable of the activities being performed and were observing appropriate safety precautions and radiological practices. M1.2 _ Surveillance Activities a. Insoection Scone (61726) The inspectors performed technical procedure reviews, witnessed in-progress surveillance testing, and reviewed completed surveillance packages. They verified that the surveillance tests were performed in accordance with Technical Specifications, approved procedures, and NRC regulations. The inspectors reviewed all or portions of the following surveillance tests:

617.4.002 Control Rod Drive and Flow Test / Inservice Test Cooling Water Header Check Valve l

617.4.003 Control Rod Scram insertion Time Test and Valve Inservice l Test l

636.4.003 Diesel Generator Load Test

. .- - . . . . . . _. . . . _ . - _ . _ . - -- . ..- - - - -. -. f . , . i 15 i

b. Observations and Findinas l A properly approved procedure was in use, approval was obtained and prerequisites I were satisfied prior to beginning the test. Surveillance test instrumentation was - properly calibrated and used, radiological practices were adequate, technical ' specifications were satisfied, and personnel performing the tests were qualified and . knowledgeable about the surveillance test procedure. ! , ^ M1.3 Maintenance and Surveillance Activities Conclusions The maintenance and surveillance activities observed by the inspectors were l conducted safely and in accordance with station procedures. l l M 1.4 Failure to Obtain Satisfactory Chemistrv Samole of Demineralized Water Prior to ' L Usino System for Maintenance (Violation 50-219/97-03-01 gl _ a. Insoection Scope On April 14,1997, instrument technicians utilized the demineralized water system, which is slightly radioactively contaminated, to flush the service water system ! radiation monitor without obtaining a satisfactorily analyzed sample prior to use. The inspector reviewed the licensee's followup to this event, including the event critique and corrective actions.

! b. Observations and Findinas l The instrument technicians were performing a job order (515026) to flush the service water system radiation monitor (SWRM) due to suspected blockage in the- instrument tubing. The local piping arrangement for the demineralized water (DW) , ! system consisted of a normally locked closed 1 1/4 inch valve (V-12-229) that ' branches from a larger 2 inch DW line. Downstream of V-12-229 is another manual valve, V-12-228 (normally closed). Immediately downstream of V-12-228 are two check ' alves and then another'(un-labelled) valve before the final service v I connection. The above piping is located in the heating boiler building. i , The DW system has a low level of radioactive contamination due to a crost- ! contamination event several years ago. As a result, boundary valves have been l identified and locked closed, with placards placed at the boundary valves ( documenting the sampling before use requirement. Prior to using the DW system, personnel are required to obtain a sample, and flush as necessary, until less than minimum detectable activity (MDA) levels are achieved. On April 14, one of the instrument technicians connected a hose to a previously ' connected hose to the DW service connection in the heating boiler building. The technician opened V-12-228 and the unmarked downstream valve. The end of the I hose was connected to a flush connection associated with the SWRM. The I technician heard flow through the hose and some debris was observed being discharged from the SWRM drain, directed to the room drain, which in turn, was i. I - .m . . , . _ _ _ . . . - _ . _ . .

,- - , . . . . -. .- - . _ _ - - - . . . - . ! - ' , t- .

16 discharged to an overboard drain (to the discharge canal). After a short time, flow through the hose stopped. The technician found that the upstream V-12-229 was , ' stilllocked closed, but determined that no further flushing was required because debris was cleared from the SWRM tubing. The technicians closed V-12-228 and i the un-labelled valve. The licensee estimated that the amount of water that had l been flushed through the SWRM was between one and two gallons. They i l apparently failed to recognize the placard and the sampling requirement. l

' l During the process of placing the SWRM back in service, which requires filling the j system with DW, an operations senior reactor operator (SRO) questioned chemistry , l and maintenance personnel whether the DW system had been sampled prior to ' l flushing the SWRM. The SRO then determined that samples had been taken, but l they were slightly greater than MDA. l The installed hose was then tested to determine if V-12-229 leaked by, which

l would have accounted for the minimal flow during the SWRM flush. It was j ' determined to be leaking nearly 1 GPM. Any flow was directed to the radioactive ] waste processing system. Operations and maintenance personnel identified that V- 12-229 had a deficiency tag on it, dated July 25,1996, stating that the valve leaks l by. After the leakage test of V-12-229, an additional sample was taken, which indicated acceptable results (less than MDA). l The licensee conducted a formal event critique on April 17,1997. During the l critique, the licensee found that the technicians believed that sampling had been ! satisfactorily performed previously and no further sampling was necessary. l However, the prior sampling that was done indicated an activity that was greater i than MDA. Personnel performing the critique found that not all maintenance l personnel understood the sampling requirements for the DW system. A prior shift connected the first length of hose to the DW system and a sample (unsatisfactory

l results) was taken. This information was not properly communicated during maintenance shift turnover. Also, after V-12-229 was known to be leaking, no action was taken to ensure that the administrative control (lock) was moved to an , adequate (downstream) isolation boundary. The licensee's corrective actions ! included notifying all operations and maintenance personnel of the need to address and compensate for a degraded system boundary. l ' The critique concluded that the root cause was equipment failure (V-12-229 leaked , by). Significant contributing causes were 1) the instrument technicians used poor work practices in that they did not use self-checking to ensure that an adequate sample had been obtained, and 2) there was inattention to detail because the technician failed to notice signs referencing sampling. The inspector found the 3 critique details to be factual, however, the inspector determined the root causes to ) i be the improper communications and ineffective corrective actions following a prior i event. Specifically, a similar prior event occurred (deviation report 95-481; event date - July 28,1995) where the SWRM was flushed with DW water that contained '

activity greater than MDA (sample taken but not verified less that MDA prior to ) flush of SWRM). . i r

- - - . ~. -- - . . __ - . .. -. . .- 17 The inspector reviewed job order 515026 that was used to accomplish this task on l April 14,1997. It was classified as simplified maintenance, meaning the work did not require a detailed work plan but may require the support of other than those performing the work. However, the job order did not identify any specific pre-job i requirements, except for notifying chemistry that the SWRM is being removed from ! service.

Procedure 320.1, " Demineralized Water Transfer System," Step 3.2.3, states

i " Portions of the Demineralized Water System are contaminated. Per Safety ' Evaluation SE-000523-011, Demineralized Water cannot be used outside any contained radiological control area (i.e.; yard, flush water overboard) unless specifically sampled just prior to use and found to have no detectable activity." The failure to follow the requirements of procedure 320.1 is a violation. (VIO 50- ' 219/97-03-01c) c. Conclusions ! The inspector concluded that there were several performance problems related to this event. There were ineffective communications among maintenance shift l workers, as well as among the various station groups (i.e. chemistry, maintenance, ' operations). The job order may have provided a reasonable barrier in preventing this event by listing the appropriate pre-job actions, but it did not contain the necessary precautions. Upon discovery of the leaking isolation valve in July 1996, the DM isolation boundary should have been modified to compensate for the degraded boundary. Finally, corrective actions for a similar event (July 1995) were l ineffective in preventing recurrence. M1.5 Refuelina Floor Radiation Monitor Surveillance Test a. Inspection Scope (61726) The inspector observed portions of the surveillance test 621.3.005, "High Radiation l Monitor (Reactor Building isolation) and Area Radiation Monitor Power Supply Calibration." During the test, standby gas treatment system (SGTS) train 2 inadvertently started. The inspector reviewed the licensee's actions and resolution of this issue. b. Observations and Findinas On April 14, during the performance of surveillance test 621.3.005, SGTS train 2 inadvertently started during the testing of reactor building operations floor sensor RO14-B9. The unexpected start occurred during the performance of step 8.4.9.9 when the lead fan (train 1) start switch was taken from the " auto" position to the " hand" position. Train 1 was already operating per the surveillance test. The , control room response to this unexpected start was appropriate. The operators and instrument technicians stopped the surveillance and backed out of the procedure in accordance with administrative procedures. Operation procedures 329, " Reactor Building Heating Cooling and Ventilation System," and 330, " Standby Gas

l

l e 18 Treatment System," were used to restore the configuration of the system to normal. The control room personnel verified that SGTS flows were adequate and initiated a deviation report to document the unexpected train 2 system start. ! System engineering indicated preliminarily that the likely cause of the event was a momentary reduction of differential pressure when the lead fan switch was taken to l the " hand" position. During this switch manipulation, the switch is taken through the "off" position. The system was walked down by the licensee to determine if the system configuration was changed. No deficiencies were identified during the walkdown. The licensee was processing a procedure change at the end of the inspection period to install an electrical jumper across the switch before it is moved from " auto" to " hand." l c. Conclusions The licensee appropriately responded to an unexpected start of train 2 of the standby gas treatment system. The surveillance was halted, the system 4 ' configuration was returned to normal and system flows were verified. Engineering's initial review of the event was appropriate. M3 Maintenance Procedures and Documentation

i M3.1 Emernencv Diesel Generator Rated Load Surveillance Test (Insoector Follow-ua item j 50-219/97-03-02) I 1 a. Inspection Scope (40500, 61726) i Because the No. 2 emergency diesel generator (EDG) was inoperable for maintenance, a load test was performed on the No.1 EDG, as required by the Oyster Creek Technical Specifications (TS). The inspector independently reviewed the results of the surveillance test, the procedure governing the surveillance test , program, and discussed the results with shift supervision, plant management, and engineering personnel. b. Observations and Findinas On May 22,1997, operators performed a load test of the No.1 EDG in accordance with surveillance test procedure 636.4.003, " Diesel Generator Load Test," Revision 55. The surveillance test was required to meet the Action requirement associated with one EDG inoperable, per TS 3.7.C. The shift supervisor determined that all acceptance criteria were met and considered the completed test to be acceptable and the EDG to be operable. l The inspector reviewed the completed surveillance test and questioned whether the No.1 EDG should be considered operable based on the following inconsistencies within the procedure: I

_ . _ . _ . . - _ _ _ , 4 l l \\ 1 j l -

19 f Step 4.3, under " Precautions and Limitations," states that the minimum load ! l

for the diesel generators is restricted to 2500 kilowatts (KW). i i Step 4.4 states that the normal maximum load for the diesel generator j

should be controlled to the fullload rating of 2750 KW i 50 KW. j , i l Step 6.11 states to observe that the EDG to automatically loads to 2750 i l

l 50 KW: Initial loading was 2420 KW. Step 6.12 states that if full load (2750 50 KW) is not attained within 10 j

minutes, attempt to manually raise load. After ten minutes, load was 2600 l KW: manual operation was able to increase load to 2630 KW. -l Step 6.16 states that after a mir.imum of ten minutes at full load record the !

, ! EDG KW load in the control room and locally; both readings were to be .l within full load limits (2750 i 50 KW). The control room reading was 2640 ! l KW, and the local reading was 2670 KW. .

' l None of the readings that were indicative of degradation were identified as j- unacceptable, although a deviation report was submitted. The EDG finally achieved , l full load after an hour of operation. l I l l Step 7.1, under " Acceptance Criteria," states the component must be declared ~i i' inoperable if any of the acceptance criteria are not met. Section 7.1.1 requires the

EDG to start and assume full load, as specified in the surveillance. Section 4.4 j L defines full load as 2750 * 50 KW. Discussions with the shift supervisor and the l Director, Operations & Maintenance indicated that 2750 KW was not an ! . acceptance criteria but a design load and was not considered required for an . ! l operability determination. In contrast, acceptance criterion 7.1.2 requires that load l achieved is greater than 2600 KW for one hour, which was achieved during the j ' test. i

l The licensee acknowledged that several of the EDG loading criteria within the procedure body as well as the acceptance criteria appeared to be in conflict with l each other. The licensee determined that achieving 2600 KW for one hour satisfied the EDG operability determination. However, they stated that they would review the procedure for enhancement and clarification to resolve acceptance criteria inconsistencies. Engineering personnel did not complete a formal operability determination following the May 22 test. Rather, they reviewed the data and informed operations personnel that the EDG was operable based on exceeding the minimum load required (2335 KW) in the design basis accident scenario, and that diagnostic activities would continue. This EDG has experienced similar recent performance l problems. Some of the diagnostic testing previously done indicated preliminarily . i that the problem was within the portion of the EDG test circuit only (load control- j operation in parallel). The inspector noted, however, that the maximum load . l_ achieved during the recent testing was still lower than normal (although within i l ! - - - .. . - .. - ,

_ . - - . . _ - _ __

? , l- 20 procedure acceptance criteria), even when operators attempted to control EDG load ! manually. Engineering and operations personnel acknowledged the inspector's comments, and were planning additional troubleshooting activities. At the end of the inspection period, licensee troubleshooting activities were continuing. Although current testing satisfies procedure and TS criteria, additional efforts are warranted to identify and correct the lower than normal EDG loading. Pending licensee actions, this item will continue to be reviewed. Procedure enhancements will also be reviewed as part of this item follow-up. (IFl 50-219/97-03-02) ' ! c. Conclusions The acceptance criteria for determining operability was unclear and inconsistent compared to EDG loading requirements specified within the procedure, although the , licensee considered the EDG operable. Identification of the cause for the degraded . but acceptable performance, including corrective actions and an associated subsequent evaluation for operability, is an inspector follow-up item. M8 Miscellaneous Maintenance issues (Violation 50-219/97-03-01d) i M8.1 (Closed) eel 50-219/97-02-03: This item was one of severalissues characterized as an apparent violation in NRC Inspection 50-219/97-02 to be considered , collectively for escalated enforcement actions. The NRC subsequently determined i that escalated enforcement was not warranted, however, normal enforcement i sanctions were appropriate. Accordingly, eel 50-219/97-02-03 is administratively closed, and this issue is now characterized as one of several examples of a ) procedure violation, as follows. Surveillance procedure 621.3.005, "High Radiation Monitor (Reactor Building Isolation) and Area Radiation Monitor Power Supply Calibration," steps 6.6.14 and 6.7.14, for reactor building ventilation exhaust radiation monitors A-1 and A-2, i respectively, require that IE Upscale or Downscale Trip Points are not within the tolerances specified (13 mR/hr), THEN adjust the trip points. Contrary to procedure 621.3.005, on January 22,1997, while performing surveillance procedure 621.3.005, instrument technicians miscalibrated both the A- l 1 and A-2 reactor building ventilation exhaust radiation monitor upscale trip setpoints to 30 mR/hr and 40 mR/hr, respectively. (VIO 50 219/97-03-01d) ' i 1 111. ENGINEERING (37551, 40500, 71707, 90712, 92903) E1 Conduct of Engineering E1.1 Forced Plant Shutdown Due to Eouioment Deficiencies l

- - . . - - - . . . . _ . . - . l 21 l l a. Inspection Scope (37551. 40500. 62707. 71707) On April 22,1997, the licensee commenced a controlled plant shutdov'vn due to ( equipment problems related to the control rods. The inspector monitored the plant ! shutdown and reviewed the troubleshooting, repair and evaluation activities

associated with the control rod problems. The inspector observed activities, interviewed station personnel and reviewed applicable documentation. b. Observations and Findinas

1 BACKGROUND The control rod problems were identified by the licensee as a result of insertion l (scram) time testing. During the Fall 1994 refueling outage, all of the scram solenoid pilot valve (SSPV) assemblies (one for each of the 137 control rods) were replaced with new SSPVs due to industry-wide problems associated with the prior diaphragm material (Buna-N). The new diaphragm material, Viton A, has ' subsequently been shown to experience operational problems. Specifically, the material could become sticky over time, resulting in slower SSPV response and a corresponding delay in control rod start-of-motion time during a reactor scram. The 5% scram insertion time (i.e. 5% of total control rod travel) is the most effective of ' the existing required testing to monitor start-of-motion times. By letter to the NRC dated April 9,1996, the licensee committed to perform control rod scram time tests to monitor SSPV performance with the Viton A material ' installed. The quarterly tests monitored 5% scram times of seven designated control rods (reference sample), and 14 additional control rods, selected on a rotating basis (representative sample). A 5% scram time of 0.49 seconds was 4 selected as the operability criterion for an individual control rod, above which the control rod would be declared inoperable. The average of the reference and 1 representative samples were compared to the 0.375 second technical specification (TS) 3.2.B.3 criterion for the average of all control rods. The quarterly tests had indicated consistent 5% average scram times for the prior three quarterly tests (between 0.353 and 0.364 seconds). Accordingly, the licensee was in the process { of reducing the sample test scope as permitted by BWR Owners Group recommendations. TEST RESULTS AND LICENSEE RESPONSE l i On April 19,1997, the licensee tested only the reference sample (seven rods). One

of the 5% scram times was O.49 and the average of the seven was O.404. The licensee noted the average scram time acceptance criteria in the test procedure i ! (617.4.003 - Control Rod Scram insertion Time Test and Valve IST Test) as "Not

l Applicable," and viewed the procedure as data collection for system engineer ' i review. The completed test procedure was reviewed by operations supervision. in addition, test results were discussed via telephone in general terms between core j ' engineering personnel (in the control room) and the system engineer (at home),

however, quantitative results were not discussed. It was not until the system l ' ,

__. .. . 2 - __ __ - - . _ - _ - . _ _ _ _ _ _ _ _ _ _ . _ . _ . _ i '

l - .- t ! L 22 ! engineer reviewed the actual 5% test data on April 22,1997, when he identified l that the 5% times had increased notably. The inspector found that the procedure acceptance criteria were not used, there was a lack of attention to detail during the i . i completed procedure review, and there were poor communications among various ! station groups in discussing and evaluating the test results. As a result, there was l , l- a three day delay in evaluating the control rod test results following the 5% scram ! I time testing. l . . i

The licensee discovered and confirmed the condition that the average 5% scram

-{ insertion time for the seven control rods had exceeded the TS value (average for ! ALL control rods) at 11:16 a.m. on April 22,1997. They conservatively and j appropriately considered all control rods to exhibit a similar response, and therefore j entered TS 3.0.A, requiring the plant to be placed in cold shutdown within 30 l hours. The plant shutdown was initiated at 11:42 a.m. After the licensee

confirmed the slow 5% scram times for the seven control rods, they tested an j additional 18 control rods during the plant shutdown to obtain a larger sample. j Tnose results likewise were above the 0.375 seconds average 5% time limit (0.381 j seconds), and the shutdown continued. At 12:23 p.m. on April 23, all control rods j were fully inserted, and the operators exited TS 3.0.A. Cold shutdown was [ reached at 7:44 p.m. on April 23. SSPV DESCRIPTION AND PROBLEM RESOLUTION l Each of the 137 SSPV assemblies have two solenoid valves, and each solenoid j - valve has two 2-inch diameter elastomer diaphragms (548 diaphragms). In j addition, each of the solenoid valves has a pilot valve (plunger) whose seat is ! similarly made of an elastomer material. During the 1994 refueling outage, the l - licensee ordered new SSPVs to replace the Buna-N diaphragms and pilot valve seats ! with the new Viton A elastomer.

! During the next several days after discovery, the licensee contacted the SSPV , vendor (Automatic Switch Company - ASCO), and General Electric (GE) for ll repair / replacement options. The licensee purchased the newest diaphragm i ' replace' ment material, Viton A-B, which is designed to prevent the sticking phenomenon identified with the Viton A material. On April 24,1997, GPUN completed replacement of the diaphragms for all 137 SSPV assemblies (four diaphragms per SSPV assembly) with the upgraded Viton A-

B elastomer. Gross air leakage tests, as a part of the post-maintenance testing, , identified air leakage from the pilot valve seat on several of the SSPVs. Subsequent laboratory testing and chemical analysis identified that the pilot valve seats j chemically resembled the Buna-N material vice the previously specified (1994 i Outage) Viton A matenai. The testing identified the hard and relatively brittle pilot ! valve seats could potentially shatter upon failure, calling into question the safety j function of the SSPVs. Consequently, the licensee elected to replace the pilot i valve head assemblies associated with all 137 SSPVs (two per SSPV). This ! activity, along with " cold" scram time testing, was completed on May 2,1997.

The scram time testing was completed with the reactor in a depressurized i 1 -.- - .- - . - - . -. - - - - - - -,

. . _- .- . - - _ -

. ! i f . l ' 23 l condition. i ! l The operations staff successfully processed, coordinated, and implemented a large- number of tagouts associated with the SSPV work. These activities were well controlled and were conducted in an error-free manner. i The reactor was subsequently restarted on May 3,1997 (reactor critical at 8:29 p.m.). The " hot" scram time testing was started on May 6, while at approximately 40% power. The testing was completed on May 7. One control rod, No. 06-43, - was " slow" when compared to the control rod test procedure's acceptance criteria . of between 1.9 and 3.6 seconds (actual time was 4.49 seconds). As a result, rod 06-43 was declared inoperable and was valved out of service. Also, although its scram time met acceptance criteria, control rod 10-11 could not be moved out of the core from its fully inserted position following the scram time test. That rod likewise was declared inoperable and valved out of service. (See Section 04.1 for . additional follow-up activity for CR 10-11).

Engineering personnel evaluated the slow response time for 06-43, and consulted i with the NSSS vendor (GE). A troubleshooting action plan (97-13) was subsequently developed and was implemented on May 16. The plan adequately assessed potential consequences of the planned activities. The plan involved ' scramming the control rod, (from notch "12") using reactor pressure as the driving force to exercise the control rod drive ball check valve. Core engineering provided the approp-iate instructions regarding shutdown margin considerations. This activity was accomplished conservatively and appropriately by operations and l engineering personnel. The reactivity management brief was thorough and solicited questions and concerns from the personnel involved with the activity. The licensee's efforts were successful in that subsequent scram time testing yielded acceptable scram times, and the control rod was declared operable on May 16th at 5:35 p.m. The licensee attributed the slower control rod response time for rod 06- 43 to be from a small amount of debris within the control rod hydraulic system. GENERICIMPL1CA TIONS AND REPORTING On April 29,1997, ASCO submitted a 10 CFR Part 21 notification to the NRC to notify the Commission of the potential safety-related problem with the specific ASCO SSPV model that was likely supplied (through General Electric Company) to several BWR nuclear plants. The report specifically identified that the pilot valve discs may have been fabricated from commercial grade Buna-N material rather than the required nuclear-grade fluorocarbon material. The NRC is currently reviewing this report and its applicability and impact at other nuclear power plants. c. Conclusions i The inspector concluded that overall licensee response to this issue was good. The initial response to the " slow" 5% scram time testing was poor and was due to ' inadequate communications, resulting in a delay in evaluating the control rod test results. Once the actions were initiated, they were conducted conservatively and . - - - - -

_ _ ._ _ _ .__ . - - . . _ _ _ _ _ _ _ . _ . . _ _ . _ . _ _ _ _ _ _ _ .- g ! r i '*. i 1 24 ( ! appropriately. Engineering evaluation of the observed problems during the l installation of the new diaphragms were thorough and probing, resulting in the- ) further identification of the safety significant pilot valve seat problem. Operations j and maintenance personnel effectively processed and implemented a large amount

of tagouts and related work activities for this highly visible issue in an error free j manner. j EL2, Core Sorav System Response Durina Soecific Postulated Scenario (Unresolved item 50-219/97-03-03) [. a. Insoection Scone (375511 l l l L On May 15,1997, the licensee identified that, under specific postulated conditions, l j_ the core spray system's available net positive suction head (NPSH) could be slightly i less than required NPSH. The inspector reviewed the licensee's response, including .I their immediate compensatory actions and planned longer term actions. The i inspector also interviewed responsible engineering personnel, and reviewed the j associated deviation report and relevant portions of the UFSAR. ! l i b. Observations and Findinos i While performing calculations in support of a future plant modification (torus j suction strainers), the licensee identified a potential concern related to current ! design basis assumptions during accident conditions for the core spray system. - ' The existing design basis calculation for core spray system NPSH considerations ] ,

assumed 4100 gpm for each of the two core spray subsystems. However, ) ' maximum achievable core spray flow rates, which are close to 5000 gpm, result in j - s - a more limiting NPSH value. The recently performed calculations assume- ) conservatively this higher flow, that torus water level is at its minimum required i value, torus and intake water temperature are at maximum value (95' F), and the ! worst-case single failure occurs (which requires operation of the core spray main l pump with the least amount of NPSH margin). The analysis also assumes that the , containment spray systems are simultaneously operating at runout conditions. The preliminary results indicated that the "C" core spray main pump could be slightly beyond its NPSH criteria. The other core spray system pumps had sufficient NPSH margin and were not adversely impacted. The emergency operating procedures (EOP) for the majority of the design basis l' scenarios instruct the operators to secure the unnecessary core spray pumps while j monitoring the NPSH limit curves. However, in the event that reactor vessel level cannot be maintained above 61 inches above the top of active fuel, the EOPs j ' currently require the operators to maintein maximum core spray flowrates. This situation could represent an NPSH proble.m with the "C" core spray main pump. In response to the concern, the licensee provided interim guidance to the operators. .

- A core spray system operability determination was promptly completed by '- engineering personnel. In the event that torus temperature reaches 85' F, the operators were to declare the "C" core spray main pump inoperable and follow the - \\ ' , l - . . . - . . . - - - - . -- - , .

. . i 25 applicable technical specification action requirements. The licensee has processed a change to EOPs to provide additionalinstruction for the scenario where reactor vessellevelis less than 61 inches above the top of active fuel and thereby obviate the need to declare the "C" pump inoperable. The change will continue to maximize core spray flowrate, however,it will provide specific f?PSH considerations. , At the end of the inspection, the licensee's engineering personnel were developing additional evaluations for the various NPSH scenarios. They stated that this condition was not reportable under 10 CFR 50.73 (Licensee Event Report) because- l the calculation of record was performed to demonstrate that minimum required core cooling flowrates were achievable. That is, the calculations did not specifically evaluate the worst case scenario from an NPSH stand point, which would have considered the maximum achievable core cooling flowrates. However, the ] inspector identified a relevant section of the UFSAR that may indicate that this discovery is potentially reportable, depending on the results of the ongoing . evaluation. Section 6.3.2.2.3 of the UFSAR states that a calculation of available NPSH for the core spray system pumps (August 1986) has reconfirmed that adequate NPSH margin is available for the expected torus conditions over the full l range of pump operation for both a small break and the design loss of coolant accident (LOCA). It also stated that the calculation demonstrates that in the absence of any torus overpressure, there is adequate available NPSH for the main core spray pumps for both of the LOCA cases considered. Therefore, it appears that confirmed inability to meet required NPSH over the full range of accident scenarios would be a reportable condition. Pending the completion of the licensee's evaluation and their final determination on event reportability (as related to the UFSAR), this is an unresolved item. The review of the finalinformation will also assess prior core spray system operability status. (URI 50-219/97-03-03) c. Conclusions The licensee efforts in identifying the NPSH concerns while evaluating a design change were conservative and thorough. The associated immediate and planned corrective actions were appropriate. However, additional information is needed to determine whether this NPSH deficiency represented a condition beyond the design basis of the facility. _E_L3_ Hioh Indicated Tailoiece Temoerature for Electromatic Relief Valve a. IrLspection Scope (37551) , , l The inspector noted that the "C" electromatic relief valve (EMRV) had an elevated tailpiece temperature of 185*F. The inspector reviewed the licensee's actions and assessment of this condition. l i ,

. . 26 b. Observations and Findinas On February 8, the "C" EMRV tailpiece temperature indicated a sudden increase from 150'F to 228'F. The inspector discussed this condition with the system , engineer to determine what actions were being taken to monitor the elevated i temperature and to assess valve operability. ' System engineering indicated that the sudden increase in tailpiece temperature was not accompanied by a corresponding increase in the additional common i downstream temperature indicator. Also, these EMRVs are six-inch Dresser Electromatic Relief Valves, Type 1525VX, potential leakage by the pilot valves is i not indicated by the downstream tailpiece temperature since this leakage is ported to the drywell atmosphere. The system engineer determined that the valve remained operable and no potential existed for degradation of the valve that may result in inadvertent lifting of the EMRV. The inspector also noted that the reactor , I coolant system and torus unidentified leak rates and torus temperature changes did not support significant EMRV main seat leakage. The system engineer was monitoring tailpiece temperatures daily. The system engineer also indicated that the torus level and torus temperature were stable. The "C" EMRV is scheduled for replacement during the next outage. c. Conclusions l i The system engineer appropriately monitored the system status for degradation and i potential impact on operability. Although it was still uncertain whether this effect was a result of a non-functioning temperature indicator or minor main seat leakage, pilot seat leakage (which could affect the EMRV lift setpoint) was not a contributor . to the elevated temperature indication because pilot seat leakage would be to containment atmosphere, not through the EMRV tailpiece piping. E2 Engineering Support of Facilities and Equipment E2d Standbv Gas Treatment System Sinale Failure (Violation 50-219/97-03-04) a. Insoection Scope (37551) As discussed in section M1.5 of this report, the standby gas treatment system (SGTS) train 2 unexpectedly started during a surveillance. The inspector reviewed the SGTS with respect to the technical specifications (TS) and the updated final safety analysis report (UFSAR). ' b. Observations and Findinas The inspector noted that the licensee revised the UFSAR in December 1989 to reflect that the SGTS was originally constructed with a single failure vulnerability, which was identified by the licensee in 1984, and would require manualinitiation of the system and reduce charcoal filter efficiency to 78% for the removal of

-- -. . . .-- - .- _ - . -, ~. .. . 27 halogens. NRC inspectors noted this vulnerability in licensee documentation in 1989. The NRC findings were documented in inspection reports 50-219/89-06 and 89-09, and, at the time, noted that the vulnerability of the system was not - reflected in the UFSAR. During this inspection, the inspector requested the documentation which evaluated the change to the UFSAR. The licensee indicated that the single failure vulnerability was original design, and a 10 CFR 50.59 evaluation would not be required, since they were correcting or adding information in the UFSAR. However, the inspector questioned if the identification of this original design vulnerability was a change to , l the system as described in the UFSAR, and would require a written 10 CFR 50.59 , j evaluation to provide the basis for the determination that this change did not ' l involve an unreviewed safety question. '

l ! The inspector also considered this change to be in conflict with the TS basis for

l primary containment integrity (TS 4.5), which indicated that the limits for containment leakage were based on 90% charcoal filter efficiency. However, calculations performed by the licensee indicated that the single failure vulnerability 1 could reduce filter efficiency to 78%. The licensee indicated that they did not consider the 90% SGTS efficiency in the TS basis to be in conflict with the single l failure vulnerability of the SGTS in the UFSAR, because the TS basis reflecter' the l design capability of the system rather the systern performance considering a l postulated failure. The inspector concluded that the licensee's position with regard ! to TS basis could be incorrect, and that the TS basis, specifically the basis for primary containment leakage limits, must consider the limiting single failure l vulnerability in order to assure public health and safety. c. Conclusions The licensee did not perform a 10 CFR 50.59 evaluation when the UFSAR was l updated to reflect the original design of the SGTS to be vulnerable to a single l failure. Although this was the original design, it may not have been reviewed during the original license as having a single failure vulnerability. As a result, when l this single failure vulnerability was identified in 1984, and subsequently incorporated in the UFSAR, the licensee did not review the implication of this on the TS basis. Although this failure to perform a 10 CFR 50.59 evaluation occurred in December 1989, it is reflective of the licensee's current performance because the licensee's approach to this type of change to the UFSAR remained the same, and no actions have been taken to resolve this specific issue. The failure to perform a 10 CFR 50.59 evaluation is a violation. (VIO 50-219/97-03-04) E12 Quality Classification List and Component Downorade Proaram Deficiencies (Unresolved item 50-219/97-03-05) a. insoection Scope (37551. 40500) The inspector reviewed the licensee's quality classification list (QCL) in response to programmatic questions identified at Three Mile Island (TMI), which are also

- . 28 applicable to Oyster Creek. The inspector participated in a telephone conference call between GPUN and ti,e NRC, interviewed engineering and operations personnel, and reviewed selected documentation (e.g., safety evaluations, operability determinations, deviation reports). b. Observations and Findinas

! A' conference call was held on March 3,1997, to discuss to QCL component [ downgrade concerns that were initially identified at TMI. Oyster Creek was

similarly affected, and discussions included actions for both TMl and Oyster Creek. ! The QCL issue was related to downgrading the equipment classification of [ important components and/or systems without processing the appropriate j: evaluations or other supporting engineering documentation. i . j The NRC issued a Confirmatory Action Letter (CAL) to GPUN on March.4,1997, to 2 document the NRC's understanding of the immediate and long term corrective I . actions to which GPUN committed in order to resolve the OCL downgrade issues. [ By letter dated April 30,1997,' GPUN responded to one of the items listed in the.

CAL, which was to determine the impact of the equipment classification downgrade ! program, as implemented, at TMl and Oyster Creek. At Oyster Creek, a process i was implemented which reviewed planned daily maintenance and modification ! activities involving equipment that was downgraded in order to assure that the 3 parts of the correct quality classification were used. ).I Oyster Creek described the several categories in which prior QCL downgrades were. }' performed. For the 605 items initially classified as " nuclear safety related" (NSR) and subsequently downgraded to " regulatory required" (RR) or "Other," a list of u those items was generated to prevent work on those components until safety . reviews were completed to either 1) confirm the adequacy of the downgrade, or 2) restore the original NSR classification. The licensee's deviation report system, a corrective action process, was used to evaluate operability concerns. As a result of the safety reviews,16 (of the 605) required re-classification to NSR. - The inspector reviewed selected safety reviews, deviation reports and operability determinations. Overall, the inspector found that the licensee's reviews were acceptable. In some instances, the inspector questioned specific aspects of the above documentation. There were no current operability questions identified. - 'There are additional actions to be completed by the licensee as per the commitments documented in the CAL. These actions will be addressed upon ' licensee submittal and is an unresolved item. (URI 50-219/97-03-06) c. Conclusions The licensee's corrective actions taken to date concerning the OCL programmatic weakness were acceptable. Additional licensee findings will be evaluated as they are identified. Further tracking of this issue will be accomplished via an unresolved item.

~ - . . - . . . . . ~ . . -._. . - - - ~ . - - .. - ..... . - -.. . . - - . . . ~

• Jn ..

4

.. 29 . i E8 Miscellaneous Engineering issues 3

EQd (Closed) eel 50-219/97-02-04: This item was one of several issues characterized as an apparent violation in NRC Inspection 50-219/97-02 to be considered ! collectively for escalated enforcement actions. The NRC subsequently determined that escalated enforcement was not warranted, however, normal enforcement ' sanctions were appropriate. Accordingly, eel 50-219/97-02-04 is administratively closed, and this issue is now characterized as one of several examples of a l - procedure violation, as follows.

Procedure 108, " Equipment Control," step 4.2, requires that the act of positioning ! components shall be controlled and coordinated by the operations department. l- Step 5.2.2 of procedure 108 requires that components bearing a red tag shaling1 { be operated or activated. [ Contrary to procedure 108, on March 19,1997, the No. 2 heating boiler discharge [ . damper, which was administratively closed by use of a red tag, was partially. opened by an engineering representative'to facilitate maintenance activities, and . , was not controlled and coordinated by the operations department. This licensee ' identified and corrected violation is being treated as a Non-Cited Violation,

. consistent with Section Vil of the NRC Enforcement Policy. l (NCV 50-219/97-03-01e) L IV. PLANT SUPPORT (71707,71750,92904) .;.

4 ! -R1 Radiological Protection and Chemistry Controls ! R1.1 General Observations

4 4 During entry to and exit from the radiologically controlled area (RCA), the inspectors verified that proper waming signs were posted, personnel entering were wearing , proper dosimetry, personnel and materials leaving were properly monitored for i radioactive contamination, and monitoring instruments were functional and in calibration. During periodic plant tours, the inspectors verified that posted extended , j Radiation Work Permits (RWPs) and survey status boards were current and !. accurate. They observed activities in the RCA and verified that personnel were 4 complying with the requirements of applicable RWPs, and that workers were aware of the radiological conditions in the area. S1- Conduct of Security and Safeguards Activities $12 General Observations During routine tours, access controls were verified in accordance with the Security Plan, security posts were properly manned,' protected area gates were locked or guarded, and isolation zones were free of obstructions. Vital area access points were examined and verified that they were properly locked or guarded, and that

_ _ _ _ _ _ _ _ _ _ _ . . 30 access control was in accordance with the Security Plan. a. Insoection Scope The inspector reviewed the security program during the period of April 28- May 2,1997. Areas inspected included: review of a previously identified weakness; effectiveness of management controls; management support; protected area (PA) detection equipment; alarm stations and communications; testing, maintenance and compensatory measures; training and qualification; the vehicle barrier system; and control of vehicles. The purpose of this inspection was to determine whether the licensee's security program, as implemented, met the licensee's commitments in the NRC-approved security plan (the Plan) and NRC regulatory requirements, b. Observations and Findinas Management support was evident by the upgrades to the Firearms Trainirg Program, the intrusion Detection System (IDS) to minimize nuisance alarms, and the development of a lighting upgrade program. Alarm station operators were knowledgeable of their duties and responsibilities and security training was being performed in accordance with the NRC-approved training and qualification plan. Management controls for identifying, resolving, and preventing programmatic problems were generally effective. The PA detection equipment satisfied the Plan commitments and security equipment testing was being performed as required by the Plan. Maintenance of i , security equipment was being performed in a timely manner as evidenced by . minimal compensatory posting associated with non-functioning security equipment. The vehicle barrier system was installed and was being maintained in accordance

with applicable regulatory guidance und requirements. I c. Conclusions The inspector determined that the licensae was conducting its security and I safeguards activities in a manner that protected public heelth and safety. ] l S2 Status of Security Facilities ar.d Equipment i S2,1 Protected Area (PA) Detection Aids a. Insoection Scom The inspector conducted a physical inspection of the PA intrusion detection systems (IDS) to verify that the systems are functional, effective, and meet the Plan commitments. I i

. . 31 b. Observations and Findinas On May 1,1997, the inspector determined, by observation and selected testing, that the IDSs were functional and effective, and were installed and maintained as described in the Plan. c. Conclusion The PA IDSs met the Plan commitments. S2.2 Alarm Stations and Communications a. insoection Scoce Determine whether the Central Alarm Station (CAS) and Secondary Alarm Station (SAS) were: 1) equipped with appropriate alarm, surveillance and communication capability, 2) continuously manned by operators, and that 3) the systems were independent and diverse so that no single act can remove the capability of detecting a threat and calling for assistance, or otherwise responding to the threat, as required by NRC regulations. b. Observations and Findinas Observations of CAS and SAS operations verified that the alarm stations were equipped with the appropriate alarm, surveillance and communications capabilities, as described in the Plan. Interviews with CAS and SAS operators found them knowledgeable of their duties and responsibilities. The inspector also verified through observations and interviews that the CAS and SAS operators were not required to engage in activities that would interfere with their assessment and response functions, and that the licensee had exercised communications methods with the locallaw enforcement agencies as committed to in the Plan. c. Conclusions The alarm stations and communications met the Plan commitments and NRC requirements. l S2.3 Testina, Maintenance and Comnensatorv Measures l a. Inspection Scone [ ' Determine whether programs are implemented that will ensure the reliability of security-related equipment, including proper installation, testing and maintenance to replace defective or marginally effective equipment. Additionally, determine that when security related equipment f ails, the compensatory measures put in place are comparable to the effectiveness of the security system that existed prior to the failure. l l r

. . i 32 b. Observations and Findinas Review of testing and maintenance records for security-related equipment confirmed that the records we' 3 on file, and that the licensee was testing and maintaining systems and equipr ont as committed to in the Plan. A priority status was assigned to each work request and repairs were normally being completed in a timely manner for all work necessitating compensatory measures. c. Conclusions , Security equipment repairs were timely. The use of cornpensatory measures was found to be appropriate and minimal. The maintenance and testing being implemented were reasonable to ensure equipment reliability. S5 Security and Safeguards Staff Training and Qualification (T&O) I a. Insoection Scope Determine whether members of the security organization are trained and qualified to perform each assigned security-related job task or duty in accordance with the T&O plan. b. Observations and Findinas i On May 1,1997, the inspector met with the security training staff and discussed the training requalification program and its effectiveness. Additionally, the inspector interviewed a number of supervisors and officers to determine if they ' possessed the requisite knowledge and ability to carry out their assigned duties and reviewed the initial training records for three new officers hired since the last inspection. C. Conclusions The inspector determined that training had been conducted in accordance with the T&Q plan. Based on the supervisor and officer responses to the inspector's questions, the training provided by the security training staff was considered effective. S6 Security Organization and Administration a. Inspection Scope Conduct a review of the level of management support for the licensee's physical security program. b. Observations and findinas The inspector reviewed various program enhancements made since the last program l

. . 33 inspection, which was conducted in June 1996, and discussed them with security management. These enhancements included: upgrades to the Firearms Training Program, which include the procurement of new training weapons for the firearms simulator system, additional training for instructors and security management in the use of the firearms simulator equipment and the expansion of the firearms training program to include observation and documentation techniques; upgrades to the IDS system to minimize nuisance alarms in the areas under the site high voltage lines; the addition of heaters to the assessment aids to improve their cold weather reliability; and the development of a comprehensive lighting program upgrade that is scheduled to begin this summer. c. Conclusions Management Support for the physical security program was determined to be good. S7 Quality Assurance in Security and Safeguards Activities SZd, Effectiveness of Manaaement Controls a. Insoection Scope Conduct a review to determine if the licensee has controls for identifying, resolving and preventing programmatic problems, b. Observations and Findinas The inspector reviewed the licensee's controls for identifying, resolving and prevanting security program problems. These controls included the performance of. the required annual quality assurance audits, an ongoing self-assessment program and ongoing security shift supervisor oversight. The licensee was also using . industry data, such as violations of regulatory requirements identified by the NRC at other facilities, as a criterion for self-assessment. c. Conclusions A review of the licensee controls, including results, indicated that performance errors were being minimized and that controls were effectively implemented to identify and resolve potential weaknesses. S8 Miscellaneous Security and Safety issues S8.1 Vehicle Barrier System General On August 1,1994, the Commission amended 10 CFR Part 73, " Physical Protection of Plants and Materials," to modify the design basis threat for radiological sabotage to include the use of a land vehicle by adversaries for i

_ . - .. - -. -. . . i 34 transporting personnel and their hand-carried equipment to the proximity of vital ! , areas and to include the use of a land vehicle bomb. The amendments require i l reactor licensees to install vehicle control measures, including vehicle barrier

systems (VBS), to protect against the malevolent use of a land vehicle. Regulatory

Guide 5.68 and NUREG/CR-6190 were issued in August 1994 to provide guidance

acceptable to the NRC by which the licensees could meet the requirements of the amended regulations. ' ! A March 15,1996, letter from the licensee to the NRC forwarded Revision 36 to its , physical security plan. The letter stated, in part, that vehicle control measures meet the criteria of 10 CFR 73.55(c)(7), (8) and (9) and the design goals of the i " Design Basis Land Vehicle" and " Design Basis Land Vehicle Bomt,," An NRC { September 26,1996, letter advised the licensee that the changes submitted had ) been reviewed and were determined to be consistent with the provisions of 10 CFR

50.54(p) and were acceptable for inclusion in the NRC-approved security plan. i i This inspection, conducted in accordance with NRC Inspection Manual Temporary Instruction 2515/132, " Malevolent Use of Vehicles at Nuclear Power Plants," dated i January 18,1996, assessed the implementation of the licensee's vehicle control ' measures, including vehicle barrier systems, to determine if they were commensurate with regulatory requirements and the licensee's physical security j plan. a. Insoection Scope The inspector reviewed documentation that described the VBS and physically inspected the as-built VBS to verify it was consistent with the licensee's summary description submitted to the NRC and was in accordance with the provisions of 1 NUREG/CR-6190, . b. . Observations and Findinas I The inspector's walkdown of the VBS and review of the VBS summary description disclosed that the as-built VBS was consistent with the summary description and met or exceeded the specifications in NUREG/CR-6190. During the physical inspection of the VBS, the inspector noted that the VBS in one area was only j marginally acceptable. After discussion between the licensee and the inspector, it was determined that the effectiveness of vehicle barriers could be significantly enhanced through a simple modification. The modification was completed at this location prior to the conclusion of the inspection, c. Conclusions The inspector determined that there were no discrepancies in the as-built VBS or the VBS summary description. i

i ' l

_ . 35 S8.2 Bomb Blast Analysis a. Inspection Scone l The inspector reviewed the licensee's documentation of the bomb blast analysis and verified actual standoff distances provided by the as-built VBS. b. Observations and Findinas The inspector's review of the licensee's documentation of the bomb blast analysis determined that it was consistent with the summary description submitted to the NRC. The inspector also verified that the actual standoff distances provided by their as-built VBS were consistent with the minimum standoff distances calculated ' using NUREG/CR-6190. The standoff distances were verified by review of scaled ' drawings. c. Conclusions No discrepancies were noted in the documentation of bomb blast analysis or actual standoff distances provided by the as-built VBS. S8.3 Procedural Controls a. Insoection Scooe The inspector reviewed applicable procedures to ensure that they had been revised to include the VBS. b. Observations and Findinas The inspector reviewed the licensee's procedures for VBS access control measures, surveillance and compensatory measures. The procedures contained effective controls to provide passage through the VBS, provide adequate surveillance and , inspection of the VBS, and provide adequate compensation for any degradation of the VBS. c. Conclusions The inspector's review of the procedures applicable to the VBS disclosed no l discrepancies. l l S8.4 Security Computer and Comoentatory Measures a. Inspection Scone The inspector reviewed documentation and interviewed security management and alarm station operators relative to the security computer reliability and online availability. The inspector also reviewed the procedures for compensatory measures to be implemented in the event of a security outage. i !

e . 36 b. Observations and Findinos The inspector's review disclosed that a backup security computer was installed in 1985, and that although there is no automatic transfer between the primary and backup computers in the event of a problem, the system has been very reliable. The online availability for the security computer has been 99.98% since February 1996 and fullimplementation of compensatory measures for a security computer outage have not been necessary for an extended period of time (over 5 years). In the event of a problem with the security computer, the primary system can be rebooted or transferred to the backup computer within approximately three minutes. The last computer outage occurred in October 1996, and compensatory measures were initiated irl accordance with security Procedure OSEC-lMP-1530-12, Revision 7, dated March 24,1996; however, the security computer was back online within three minutes and the need for the compensatory measures was terminated before they were completely implemented. The requirements are that the compensatory measures should be implemented within ten minutes. c. Conclusions 1 ' The security computer system is very reliable. Adequate compensatory measures have been developed for use in the event of a computer failure; however, they have not needed to be implemented for an extended period of time. S8.5 Review of a Previousiv identified Violation (Closed) Violation 50-219/96-08-01: Failure to properly search a vehicle entering- the protected area. Corrective actions were prompt and comprehensive. The inspectors reviewed the corrective actions associated with the violation and concluded that the corrective actions was adequate. This violation is closed. 1 V. MANAGEMENT MEETINGS X1 Exit Meeting Summary A verbal summary of preliminary findings was provided to the senior licensee , l management on June 20,1997. During the inspection, licensee management was periodically notified verbally of the preliminary findings by the resident inspectors. No written inspection material was provided to the licensee during the inspection. No proprietary information is included in this report.

X2 Review of Updated Final Safety Analysis Report (UFSAR) The discovery of a licensee operating its facility in a manner contrary to the UFSAR

description highlighted the need for a special focused review that compares plant practices, procedures, and parameters to the UFSAR description. Since the UFSAR , } does not specifically include security program requirements, the inspector compared ! licensee activities to the NRC approved physical security plan, which is the applicable document. While performing the inspection discussed in this report, the , .- - ..

. _ . . . . _ _ . . _ - -- ._ _. _ . _ _ . _ . _ . _ ___ _ ___ __._, _ _ _ ! !

,. , l 37 l inspector reviewed Section 3.2".2'of the Plan, entitled " Vehicle and Cargo Access ! Portals and Posts." Based on direct observations, discussions with security ! i supervision and procedural reviews, the inspector determined that all vehicles were -l being properly searched prior to entry into the PA and controlled while in the PA, as ' described in the Plan and applicable procedures. One concern identified during this inspection was related to discrepancies among the UFSAR, Technical Specification ' (Basis Section), and the actual plant configuration is discussed in Section E2.1 of r i this report. l l i ! ' , i I I ! i l >

I !

l ! ' ' l

' , i l l ! i J

! I l I i- i ' ,,-

, . . _ - _. - . - .. . . . . - - . -- . . . _ . . - - . r r l ' ! f

' 38

- ! ATTACHMENT 1 i PARTIAL LIST OF PERSONS CONTACTED i i i ! ' Licensee (in alohabetical order) l l G. Busch, Manager, Regulatory Affairs D. Croneberger, Director, Equipment Reliability ' S. Levin, Director, Operations and Maintenance ' i K. Mulligan, Manager, Plant Operations . J. Perry, Plant Maintenance Director ' M. Roche, Director, Oyster Creek D. Slear, Director, Configuration Control l l R. Tilton, Manager, Nuclear Safety Assessment ! - l a ! ! . - NRC (in alohabetical order) l j 1 D. Lew, Senior Resident inspector, Indian Point 3 8. Norris, Senior Resident inspector, Nine Mile Point 1&2 J l S. Pindale, Senior Resident inspector, Oyster Creek (Temporary) l G. Smith, Senior Physical Security inspector i

l ! I l t . i l l !

- .. - -- .. -. -. . - - - - . . -. .

I i

L l 39

i i

t ATTACHMENT 2 INSPECTION PROCEDURES USED ' i , ! Procedure No. Title ! , i l ' ' i 40500 Effectiveness of Licensee Controls in Identifying, Resolving, '

and Preventing Problems ' ' t l 37551 Onsite Engineering

61726 Surveillance Observation 62707 Maintenance Observation I L 71707 Plant Operations l i 71750 Plant Support i 90712 Inoffice Review of Written Reports of Nonroutine Events at Power Reactor Facilities ., 92901 Followup - Operations 92902 Followup - Maintenance 92903 Followup - Engineering 92904 Followup - Plant Support i 93702 Onsite Event Response I I i ,

I r !

) , . e , 40 i ATTACHMENT 3 ITEMS OPENED AND CLOSED ' ! Opened , ' Number Tvoe Descriotion i 97-03-01 a VIO Inadvertent shutdown cooling system pump trip due to failure to properly align pressure switch during system startup. (01.1) , ' Failure to determine an appropriate isolation 97-03-01 b VIO

boundary for maintenance of torus spray valve

V-21-18 in the containment spray system, ~ ' resulting in degrading the torus pressure suppression capability. (08.1) ' 97-03-01 c VIO Failure to Obtain Satisfactory Chemistry Sample of Demineralized Water Prior to Using system Maintenance. (M1.4) 1 97-03-01 d VIO Instrument technicians mis-calibrated the A-1 and A-2 reactor building ventilation exhaust ) ' t radiation monitors. (M8.1) 97-03-01 e NCV Heating boiler discharge damper, which was administratively closed by use of a red tag, was inappropriately re-positioned by an un-authorized engineering representative. (E8.1) 97-03-02 IFl Licensee to evaluate emergency diesei generator rated load surveillance test results that indicated degraded performance. (M3.1) l 97-03-03 URI Available core spray system pump "C" net positive cuction head (NPSH) potentially less than required NPSH. (E1.2) , 97-03-04 VIO Standby gas treatment system single failure j vulnerability not evaluated per 10 CFR 50.59. (E2.1) j ! 97-03-05 URI Quality Classification List and component downgrade program deficiencies. (E2.2) 2 \\ l

. . _ . _ _ . _ _ _ . _ . _ ._ _ _. . . __ __ . _ . . . _ . . _ . . _ . . _ . .

• /

l l~g. l ,

.. f ' 41 i Closed t Number Type Descriotion l 97-02-01 eel The pressure suppression tapability of the , l suppression pool was degraded due to - inadequate review of system line-up. (08.1) ' l 97-02-02 eel I.luitiple switching and tagging issues (trend ' , identified by Nuclear Safety Assessment). (08.2) i

l 97-02-03 eel Reactor building ventilation exhaust radiation j monitor mis-calibration due to personnel error j l and ineffective post work review. (M8.1)

i 97-02-04 eel Heating boiler tagged-closed exhaust damper mis-positioned by unauthorized individual. (E 8.~1) 96-08-01 VIO Failure to properly search a vehicle entering the protected area. (S8.5) l 1-

l '

j. ! i I l ) 't ' , ' .

! i l l l

, 1 f , l l , i i t { , w a }}