ML20148S573
| ML20148S573 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 06/26/1997 |
| From: | Quinn S CONSOLIDATED EDISON CO. OF NEW YORK, INC. |
| To: | NRC OFFICE OF ENFORCEMENT (OE) |
| References | |
| 50-247-96-07, 50-247-96-08, 50-247-96-7, 50-247-96-8, 50-247-96-80, 50-247-97-03, 50-247-97-3, NUDOCS 9707080262 | |
| Download: ML20148S573 (14) | |
Text
.
.___m._
.__.m_..
....m_..__.
- _ _ _. _ _ _ _ -. _. _. _ _.. _. _ _. ~. _. _ _ _
r Stephen E. Quinn c
VloD Preescent l
Consolidated Edison Company of New York. Inc.
, Indian Point Station Broadway & Bleakley Avenue 1
Buchanan. NY 10511
. Telephone (914) 734-5340 1
j.
June 26,1997 l
i Re:
Indian Point Unit No. 2 i
Docket No. 50-247 t
Director, Office of Enforcement i
j US Nuclear Regulatory Commission i
One White Flint North
)
11555 Rockville Pike j
i Rockville, MD 20852-2738 l
2 ~
SUBJECT:
Reply to a Notice of Violation and Proposed Imposition of Civil Penalties - $205,000; and Exercise of Enforcement Discretion (NRC j
Inspection Report Nos. 50-247/96-80; 96-07; 96-08; 97-03).
i i
l The attachment to this letter is Con Edison's " Reply to the Notice of Violation and Proposed Imposition of Civil Penalties" in response to your May 27,1997 letter j
which referred to faur NRC inspections conducted between October 27,1996 and 1-April 5,1997 at the Indian Point 2 facility. An electronic funds transfer in the amount of two hundred and five thousand dollars ($205,000) in payment of the proposed civil penalty has been made to the NRC account.
j i
1 Should you have any questions regarding this matter, please contact Mr. Charles W.
Jackson, Manager, Nuclear Safety and Licensing.
[
l
}
Very truly yours, A
i
+,.
Attachment l
J i
Subscribed and sworn to f
)
before me this# day
.)
of June 1997,
.1 9707000262 970626 T
/
PDR ADOCK 05000247-;
e PDR ud Koeto Notary Public KAhEN L LANCASTER
' n}QOh4 Notary Public. Sta*e of New Yerk w
V No. 60-4fM 3659 Oualified in We:;tchester County '
. Term Expires gg
4 l
I E
E i
ccf.
Mr. Hubert J. Miller
~
Regional Administrator-RegionI j
US Nuclear Regulatory Commission
]
475 Allendale Road King of Prussia, PA 19406 i
Mr. Jefferey F. Harold, Project Manager
- Project Directorate I-l l
Division of Reactor Projects I/II US Nuclear Regulatory Commission Mail Stop 14B-2 l
Washington, D.C. 20555 Senior Resident Inspector US Nuclear Regulatory Commission l
PO Box 38 j
Buchanan, NY 10511 l
1 k
4
ATTACHMENT REPLY TO NOTICE OF VIOLATION AND 3
i PROPOSED IMPOSITION OF CIVIL PENALTIES INSPECTION REPORTS 50-247/96-80; 96-07; 96-08; 97-03 l
4
)
I i
i I
i CONSOLIDATED EDISON COMPANY OF NEW YORK, INC.
)
INDIAN POINT UNIT NO. 2 DOCKET NO. 50-247 June 1997
i NO.TI' E OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY C
The Notice of Violation and Proposed Imposition of Civil Penalty enclosed in an NRC letter dated May 27,1997 contained nine apparent violations listed as items I.A.(1), I.A.(2), I.A.(3)a through d,l.B II.A and II.B within the notice.
Violation I. A. (1) 10 CFR Part 50 Appendix B, Criterion XVI requires that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, l
deviations, defective material and equipment are promptly identified and corrected. For l
significant conditions adverse to quality, the measures shall assure that the cause of the i
condition is determined and corrective actions are taken to preclude repetition.
Contrary to the above, between June 1995 and January 26,1997, measures were l
not established to assure that a significant condition adverse to quality was promptly identified and corrected. Specifically, on January 27,1997, three main feedwater regulating valves (MFRVs) and one low-flow feedwater regulating valve failed in the open position. The MFRVs serve a safety-related function as part of the feedwater isolation system. The cause of the failures was the introduction of sandblasting grit material used in the high pressure turbine during the 1995 refueling outage. A June 1995 failure of a heater drain tank pump was i
recognized to be due to this same grit intrusion. However, after the June 1995 event, adequate corrective action measures were not taken to identify the extent of the impact, root causes, and preclude repetition of the grit intrusion in a timely l
manner.
This is a Severity Level III violation (Supplement I).
Civil Penalty - $50,000.
Resnonse to Anoarent Violation I. A. (1) l We acknowledge the concerns addressed in this apparent violation and agree that our evaluation of the circumstances surrounding the June 1995 heater drain pump failure and subsequent corrective actions were insufficient to predict whether grit intrusion occurring during the 1995 outage would degrade other plant systems. Consequently, on January 26,1997, Indian Point Unit No. 2 was manually shut down when it was determined that the feedwater regulating valves were not adequately responding to a closure demand. After the shut down, it was determined that one of the low flow feedwater regulating valves was also not responding to a closure demand. Subsequent investigation of the internals of these valves found damage of the valve plugs and cages caused by an abrasive grit material,later determined to be Amasteel HG-25.
This abrasive grit material had been used during the 1995 refueling outage for turbine maintenance work. At the time of the heater drain pump failure in June 1995, the determination for acceptable operability was made based upon examinations of the failed equipment, a review of the system's configuration, the potential failme mechanisms, and the conclusions from vendor analyses. In hindsight, the root cause analyses of the June 1995 heater drain pump failure were 1
l t
' insufficient in scope and depth. In a letter dated February 18,1997, our response to Confirmatory Action Letter (CAL) 1-97-002, we identified corrective actions implemented to determine the root cause of the main and low flow feedwater regulating valves non-closure. A multi-disciplinary team was assembled to assess the scope of foreign material intrusion to the feedwater regulating valves and balance of plant systems and components, and to aggressively pursue its removal. The root cause for this event was determined to be a failure of Foreign Material Exclusion (FME) barriers installed during the 1995 refueling outage, resulting in foreign material intrusion into the main feedwater regulating valves, low flow feedwater regulating valves, and a heater drain pump and other secondary plant components. A contributing factor, which resulted in the delayed identification and correction of this degraded l
condition, was the insufficiency of the scope of evaluation of the June 1995 heater drain pump l
failure. The evaluation was deficient for the following reasons:
l l
The priontization of the event and the resources applied to determine the root cause and corrective actions were inadequate.
Acceptance of the operabilityjustification was made by a single organization.
l The OIR process for documenting operability was not standardized.
The root cause methodology utilized during the investigation in 1995 was insufficiently l
l rigorous.
The review of the investigation results should have been more thorough.
l Ccn Edison's corrective actions in response to this event were provided to the NRC in our i
response to CAL l-97-002. These corrective actions included numerous inspections of the secondary plant and the steam generators to remove foreign material, performance of operability determinations for potentially impacted systems and/or components, and equipment testing.
Root cause analysis training has been provided to those station personnel who are responsible for the evaluation of such events. On February 19,1997, members of our staff met in Region I to l
discuss the issues posed by the NRC in CAL l-97-002 as well as the results of our on-going investigation into this matter. During the meeting, we provided a description of the event, the results of our root cause investigation, whether any precursors of this event existed, the safety significance of this event, and our on-going and completed corrective actions. Subsequently, NRC closecut of CAL l-97-002 was received via a letter dated February 21,1997.
Violation I. A. (2) 10 CFR Part 50 Appendix B, Criterion XVI requires that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment are promptly identified and corrected. For significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective actions are taken to preclude repetition.
Contrary to the above, between March 4-6,1997, measures were net established 2
l
l l
l to assure that a significant condition adverse to quality was promptly identified and corrected. Specifically, on March 4,1997, fire dampers in the control building inadvertently actuated after maintenance personnel drilling through an electrical box came in contact with control wiring for the damper actuation system. However, this actuation of the fire dampers was not identified and corrected by Con Edison personnel, despite multiple opportunities to do so, until the problem was identified by the NRC resident inspectors on March 6,1997.
These multiple opportunities include identification of damper actuation by an nuclear plant operator (NPO), a security guard, a Support Facilities Supervisor (SWS) and a watch engineer, but no follow-on corrective action was taken. The proper functioning of these dampers impacts on the operability of multiple pieces of safety-related, risk significant equipment in the control building, such as the 480 V switchgear and the 120 VAC & DC systems.
1 This is a Severity Level III violation (Supplement I).
Civil Penalty - S55,000.
Response to Accarent Violation I. A. (2)
We acknowledge the concern addressed by this apparent violation and agree that measures were not adequately established to assure that a significant condition adverse to quality was promptly identified and corrected. This apparent violation was documented within NRC Integrated Inspection Report 50-247/97-03, dated May 9,1997 as a concern being considered for escalated enforcement. The findings and observations that have been outlined within your report are not in dispute. However, there is one item within the report's discussion section which we would like j
to clarify. A modification performed in 1977 (not 1980 as stated in 50-247/97-03), which modified the deluge control circuit logic, defeats deluge actuation if voltage is present on the j
main transformer. Thus, the system can only actuate if a fire were to occur at the main transformer while it is de-energized. The control circuit operates independently of the generator output breaker position, not as discussed in the report.
The following is a brief synopsis of the event:
On March 4,1997 at approximately 0845 hours0.00978 days <br />0.235 hours <br />0.0014 weeks <br />3.215225e-4 months <br />, a mechanic inadvertently contacted fire detection system control wiring while drilling through an electrical box in the transformer yard. This resulted in a "21 Transformer Deluge System Trouble" alarm in the central control room (CCR). In accordance with procedures, a nuclear plant operator (NPO) was immediately dispatched to investigate the reason for the alarm. Subsequently, the NPO reported to the CCR that the fire deluge system had not actuated and that he had learned of the accidental contact of the control wires in the electrical box. At approximately 0900 hours0.0104 days <br />0.25 hours <br />0.00149 weeks <br />3.4245e-4 months <br /> the CCR received a battery ground alarm as well as indication that the fire main booster pumps had started. A shift facilities supervisor (SFS) and an NPO were dispatched to investigate 21 main transformer. This time the fire deluge system had actuated although no fire was observed. Subsequently, the deluge system was secured.
Although not realized at the time, this actuation of the transformer detection system also automatically isolated fire dampers for the 480V switchgear and cable spreading rooms.
3
l t
l Some of the dampers did not isolate as required. Later a security guard on duty observed l
that some of these fire dampers had fallen and communicated this information to the l
CCR. However, no action was initiated to formally document this condition within the l
problem identification system (i.e., work order), which would have addressed the need to reset the fallen fire dampers.
In accordance with Station Administrative Order (S AO)-132, a root cause analysis was initiated to investigate the human performance and equipment failure aspects of this event. The cause of this apparent violation is attributed to poor communication, inadequate procedural guidance, and a lack of understanding of the design and operation of the main transformer fire detection system.
A contributing factor in the failure to identify the problem and effect its timely correction was the DI tag which was attached to the dampers. The description field on the DI tag was inadequate as written. Also, each fire damper had not been uniquely assigned a tag number, making identification of specific damper units difficult. Immediately following the deluge system actuation, plant personnel believed that the problem had already been identified by the existing DI tag. This caused an inconsistent distribution and acknowledgment ofinfom1ation, resulting in inaccurate assumptions concerning system conditions. Consequently, information was not being entered into the problem identification system. The following corrective actions were taken to prevent a repetition of this type of event:
management's high expectation for the use of specificity and consistency when writing DI tags was communicated to operations personnel.
a summary of this event including the operation of the main transformer fire protection system interlocks was issued as required reading for operations personnel.
unique tag numbers for louvers and " electro thermo" links (ETLs) were generated.
applicable operator response procedures were revised to correct inaccuracies and provide additional guidance on deluge system actuations.
the deluge test was revised to include testing all 53 ETLs.
the ETL vendor's recommendations were incorporated to preclude installation-related problems.
the design of the fire damper conduit was modified to ensure that it would not block damper movement.
the degraded springs found during the root cause investigation were replaced and the dampers were functionally tested.
The above-mentioned corrective actions have been completed and are intended to prevent a repetition of this event. Additional training on the significance of this event with an emphasis on good communication skills and teamwork will be given to appropriate station personnel by October 31,1997.
4
i
(
e
' Violations I. A. (3) a through d 10 CFR Part 50 Appendix B, Criterion XVI requires that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment are promptly identified and corrected. For significant conditions adverse to quality, the measures shall assure that the cause of the l
condition is determined and corrective actions are taken to preclude repetition.
l Contray to the above, measures were not established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment were promptly identified and corrected, and that for significant conditions adverse to quality, the measures did not assure that the cause of the conditions were determined and corrective actions taken to preclude rcpetition, as evidenced by the following examples, each of which constitutes a separate violation:
a.
From April through October 1996, the steam driven #22 AFW pump failed three consecutive quarterly tests due to low discharge j
pressure. The quarterly testing procedure required the removal of condensate from the AFW steam supply lines prior to the test, the quantity of which could not be measured due to discharge into a common drain line. Thus, increased valve leakage from PCV-1139, #22AFW pump steam admission valve, could not be I
detected. Over the previous two years, valve stroke time of PCV-1139 also increased and leakage past the seat was observed since June 1996 and found to be increasing after the frequency of the steam supply line blowdowns were increased in November 1996.
However, measures were not taken to assure that the significant condition adverse to quality was corrected and its repetition precluded until subsequent inspection of the valve internals on December 21,1996, identified extensive damage.
b.
On July 31,1996, the steam driven AFW pump discharge flow control valve (FCV) FCV-405A, failed open on demand and FCV-405B and D stroked only 75% open during IST testing. This was the third consecutive FCV-405A valve failure during performance of this test and the fourth time this valve had failed to open since the 1995 refueling outage. Valves FCV-405B/C/D and FCV-406A/B/C also had multiple failures to stroke as required.
However, measures were not taken to assure that the significant condition aderse to quality was corrected and its repetition preduded urcP subsequent disassembly of the FCV-405 and FCV-406 series valves identified " basket" damage, as well as galling and cracking of the trim package seal retaining ring.
c.
On July 12,1996, the NRC identified that the Primary Auxiliary 5
Building, Containment Purge, and Boric Acid Building Charcoal Filter Deluge System had been inoperable for an undetermined J
period of time. Moreover, the control room annunciator alarm had
{'
been alarming intermittently since February 1996. However, measures were not taken to assure that the condition adverse to quality was promptly identified and corrected in that the alarm j
response procedure which required operators to be dispatched to the system control panel to determine the cause was apparently not followed as the system was identified by the NRC to be inoperable.
h d.
On December 3,1996, the Appendix R Alternate Safe Shutdown k
(ASSS) power supply transfer switch for service water pump j
(SWP) No. 24 failed to close during multiple attempts during a i
surveillance test. Five previous similar failures to transfer during testing occurred while other equivalent switches functioned satisfactorily, these two switches remained in-service, and measure l
were not taken to assure that the condition adverse to quality was corrected.
I This is a Severity Level III problem (Supplement I).
J Civil Penalty - $50,000.
Resoonse to Annarent Violation I. A. (3) a.
We acknowledge the concern addressed by this apparent violation and agree that measures were not established to ensure that significant conditions adverse to quality, such as failures and malfunctions, were promptly identified and corrected. This apparent violation was identified within NRC Integrated Inspection Report 50 247/96-07, dated January 28,1997 as a concern being considered for escalated enforcement. Con Edison recognizes that a key factor in each of these violations involves human performance, in that personnel did not take sufficient action to conclusively determine root causes of these recurring equipment failures. In additior.
managemed did not clearly establish its expectations with respect to these equipment issues or provioe a robust root cause analysis program. In February 1997, the services of an independent consultant were obtained to evaluate our root cause analysis program. The following programmatic weaknesses were noted:
the root cause process lacked the essential guidaia and specificity necessaiy to adequately identify precursors and related events the training and qualification of personnel conducting root cause analyses did not provide a
investigators with the required tools to perform effective root cause analyses station personnel were more aligned :owards the immediate resolution of problems, rather than the determination of the causes of such problems management rehed too heavily on the qualifications and experience of individuals and 6
_m
_m
1
~
had not established suf6cient oversight and review of the root cause investigations.
We believe these weaknesses led to an inability to identify corrective actions in a reasonable and timely fashion to prevent similar recurring operability concerns.
Con Edison's corrective actions in response to this event were discussed during the NRC enforcement conference h:ld at Region I on March 14,1997. As recommended by our root cause investigation consultant, Station Administrative Order (SAO) - 132, " Analysis of Station Events and Conditions," has been revised to enhaace the root cause investigation process. These impre :ments include as appropriate:
the use of formal root. cause analysis methods the use of multi-disciplinary teams for significant items the establishment of formal post-event critiques for significant items the establishment of peer reviews for the SAO-132A report a
training for investigators and others involved in root cause investigation analytical techniques including the Management Oversight and Risk Tree (MORT) system periodic review of assigned events by the Daily Management Review Group (DMRG) a These improvements to the SAO-132 review process are intended to prevent a recurrence of this type of event. We believe that our significantly strengthened root cause analysis program should now consistently arrive at valid root causes through methodical and complete evaluations.
Should the need arise, root cause analysis training may be scheduled for additional station personnel.
Response to Annarent Violation I. A. Q b.
We acknowledge the concern addressed by this apparent viol ^ m and agree that measures were not taken to assure that a significant condition adverse to quahty was corrected and its repetition precluded until a subsequent disassembly of the FCV-405 and FCV-406 series valves for an unrelated reason identified wear on the internal parts. However, in all of the surveillance test fal'uss noted, either a determination of acceptable operability was made or repairs to the affected valve (s) were performed in order to ensure that the valve (s) would be able to perform their intended safety function.
During the extensive inspections conducted following the plant shutdown on January 26,1997 as a result of inoperable main feedwater regulating valves, auxiliary feedwater system flow control valve, FCV-405A was disassembled and inspected for the presence of potential foreign materials (i.e., grit). Although no grit was found within valve FCV-405A, evidence ofinternal wear was noted. Consequently,it was decided that the inspection scope would be broadened to include the remaining auxiliary feedwater regulating valves. Upon disassembly wear was also observ d e on 7
the internal parts of valves FCV-405B, -405D, -406A, -406C, and -406D. The cause has been attributed to a gasket design deficiency which resulted in a mechanical misalignment between the plug and cage. The valves were repaired and a new gasket design installed. Enhancements to our SAO-132 root cause investigation processes, as mentioned above, were used to arrive at this i
solution.
Response to Apoarent Violation 1. A. (3).s We acknowledge the concern addressed by this apparent violation and agree that adequate measures were not taken to assure that a condition adverse to quality was promptly identified and corrected in that the alarm response procedure, which required operators to be dispatched to the system control panel to determine the cause, was not utilized.
On March 14,1997, an enforcement conference was held in Region I to discuss this apparent violation. At that meeting, we identified the root cause and corrective actions taken to address this apparent violation. The root cause of this event has been attributed to the lack of procedural adherence, as the alarm response procedure which required specific actions to be taken was not i
followed. The corrective actions that have been taken to prevent the recurrence of this event are:
Procedural adherer.ce and alarm response procedure usage has been re-emphasized to
)
operations personnel.
Log sheets have been revised to require the verification oflocal panel alarms.
The PAB/BAB/VC Purge and Exhaust charcoal filter fire deluge detection system was restored to operable status.
j A surveillance test for the detection system was developed.
Resoonse to Annarent Violation 1. A. (3) d We acknowledge the concern addressed by this apparent violation and agree that adequate measures were not taken to assure that a condition adverse to quality was promptly identified and corrected. This apparent violatiori was documented within NRC Integrated Inspection Report 50-247/96-07, dated January 28,199'i as a concern being considered for escalated enforcement.
On March 14,1997, an enforcement conference was held in Region I to discuss this apparent violation. At that meeting, we discussed the root cause and corrective actions taken to address this apparent violation. The root cause for these failures has been attributed to a component defect within the transfer switch which was not detectable using the manufacturer's preventive maintenance program. Repairs to the core stem links for both transfer switches have been completed and tested satisfactorily. To prevent recurrence of this type d failure, the frequency M preventive maintenance has been revised.
Violation 1. B.
10 CFR Part 50, Appendix R, Section III.G.1 requires, in part, that fire protection features 8
" shall be provided to limit fire damage so that one train of systems necessary to achieve and maintain the hot shutdown condition is free of fire damage.
Contrcry to the above, as of July 21,1996, it was determined that fire protection features were not provided to limit fire damage so that one train of systems necessary to achieve and maintain hot shutdown was free of fire damage.
Specifically, both the normal safe shutdown instrumentation and the alternate safe shutdown instrumentation that provide indication of pressurizer pressure and level, as well as steam generator level, would be subject to fire damage in certain fire areas and could be rendered inoperable by the same fire. Either the normal or the alternate instrumentation is needed to achieve and maintain hot shutdown.
This is a Severity Level III violation (Supplement I).
Civil Penalty - $50,000.
Resnonse to Ancarent Violation I. B We acknowledge the concern addressed by this apparent violation and agree that fire protection features were not provided to limit fire damage to certain pneumatically controlled alternat.: safe shutdown instrumentation control wires such that one train of systems necessary to achieve and maintain he' $utdown was free of fire damage. This apparent violation was documented within NRC Megrated Inspection Report 50-247/96-80, dated January 28,1997 as a concern being considered for escalated enforcement. On March 14,1997, an enforcement conference was held in Region I to discuss this apparent violation. At that meeting, we identified the root cause and corrective actions taken to address this apparent violation. The root cause of this event is attributed to an inadvertent oversight in the Indian Point Unit 2 Appendix R analyses regarding the need to perform an associated circuits review on pneumatically controlled instmments. A review of past Appendix R submittals indicates that these pneumatic instruments were erroneously assumed to be independent of electrical controls and thus unaffected by a postulated fire. No other pneumatically controlled instruments which are required for Appendix R compliance have been determined to be similarly affected by this oversight. Upon discovery, compensatory actions were immediately implemented consisting of the establishment of a fire watch and procedural revisions to allow the installation of a temporary pneumatic jumper. A modification was completed in November 1996, which provided a permanent alternate
(
pneumatic connection to ensure compliance with Appendix R.
Violation II. A.
Technical Specification Section 6.8.1. requires that written procedures be implemented covering activities referenced in Regulatory Guide 1.33, November 1972.
Regulatory riuide 1.33 requires written procedures for stanup, operation, and shutdown > Jety-related systems including the feedwater system from the main feedwater pumps to the steam generators.
Contrary to the above, on January 26,1997, during conduct of a plant shutdown 9
i with three stuck main feedwater regulating valves, water level in the three steam generators was controlled by varying the speed of the main feed pumps. At the time of the shutdown, this method of control was not proceduralized, even though sufficient time was available (i.e., about 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) to issue a temporary procedure change to the feedwater system operating procedure, as required by Station Administrative Order 133, Section 5.1, to recognize this control method.
i This is a Severity Level IV Violation. (Supplement 1)
Response to Apoarent Violation II. A.
We acknowledge the concern addressed by this apparent violation and agree that plant operating procedures were not appropriately revised to incorporate temporary procedure changes in accordance with Station Administrative Order (SAO) - 100, " Indian Point Station Procedure Policy." It is muagement's expectation that written procedures for plant operations shall be followed. However, in the cited event, the plant was in a configuration not fully covered by existing procedures. Elements of existing procedures combined with management direction as the evolution progressed were used in conjunction with the training previously received by the operators. In retrospect, there was sufficient time to write a Temporary Procedure Change (TPC) to AOI 21.1. to provide enhanced guidance for this evolution. At the time, however, the management personnel involved believed that the feedwater pump control training combined with the existing procedures was adequate, and that the procedural revisions could not be completed in time. In accordance with OAD-33," Procedural Adherence and Use," written acknowledgment that the existing procedural guidance was inadequate would have been more appropriate for this evolution. To prevent a repetition of this type of event, AOI 21.1.1 has been revised to account for a failure of a feedwater regulating valve. Additional operator training on the requirements for log keeping, TPC usage, and OAD-33 is scheduled for completion by October 31,1997
.Viglption II. B.
Regulatory Guide 1.33 requires administrative procedures for procedure use. Station Administrative Order (S AO) SAO-133, section 5.1.1, requires that all Station Nuclear Safety Committee (SNSC) approved procedures shall be followed. SAO-460, a SNSC approved procedure, section 4.13 mquires that safety evaluations prepared by an outside contractor shall be given cover sheets, assigned safety evaluation numbers and be processed for review in accordance with sections 4.10 and 4.1I which includes a SNSC review.
Contrary to the above, following identification of sandblasting grit in the 21 Heater Drain Tank failure, at Consolidated Edison's request on June 22,1995, Westinghouse issued an analysis of the effects of sandblasting grit on the secondary side of the Steam Generators. This analysis was used by engineerirg personnel as the basis for the conclusion that there was no impact on the safety related Steam Generators as a result of the grit intrusion. This conclusion was documented in tla Open Item Report closcout. As a result, this analysis was,in 10
effect, used as a safety evaluation justifying safety related equipment operability.
However, the requirements of SAO-460, specifying a safety evaluation number, cover sheet and processing, were not conducted and no SNSC review was performed.
This is a Severity Level IV Violation (Supplement 1)
Response to Anparent Violation II. B.
Con Edison respectfully disagrees with this apparent violation based upon our position that the June 22,1995 letter from Westinghouse regarding the postulated intrusion of grit in the secondary side and its affect on the steam generators, was not a safety evaluation and was not treated as such. Westinghouse was requested to evaluate the potential effects of the hypothetical grit intrusion into the steam generators. The conclusions and recommendations as a result of that evaluation were used to support the subsequent determination for acceptable equipment operability and plant restart. Consequently, the procedural requirement of SAO-460 regarding vendor safety evaluations did not apply.
Westinghouse safety evaluations are specific, procedurally controlled documents identified as safety evaluations and assigned a unique number (SECL-XX-YYY). They include a safety evaluation checklist and other elements as described in 10 CFR 50.59. The letter in question fell far short of the requirements of a safety evaluation, and it would have been a violation of SAO-460 if Con Edison had accepted it as a safety evaluation. Vendor letters and engineering evaluations are routinely used to resolve items identified in open item reports and other items entered into our corrective action system. It is Con Edison's position that safety evaluations are not required for all such items.
I1
_ _ _ _ _ _ _ _