ML20154R417
| ML20154R417 | |
| Person / Time | |
|---|---|
| Issue date: | 10/20/1998 |
| From: | NRC |
| To: | NRC |
| References | |
| NUDOCS 9810270026 | |
| Download: ML20154R417 (12) | |
Text
. - . . . ._, -
put
- 8 % UNITED STATES s f o
j NUCLEAR REEULATORY COMMISSION
, WASHINGTON, D.C. 20066.c001 QOTl#
October 20, 1998 PUBLIC MEETING
SUMMARY
On October 13,1998, members of the Nuclear Energy Institute (NEI), the Union of Concerned r Scientists (UCS), and other utility groups and the public met with the Director, Office of Enforcement, and NRC staff in the NRC's Rockville office to continue discussions on proposed changes to the NRC's enforcement program. Previous public meetings on possible changes in the enforcement program were conducted on September 3, and September 18,1998. The list of attendees from the October 13,1998 meeting is attached.
During the meeting, James Lieberman, the NRC Director of the Office of Enforcement, provided an updated status on the staff's proposed approach to Severity Level IV violations.
Mr. Lieberman explained that most Severity level IV violations would be dispositioned as Non-Cited Violations (NCVs)--an administrative method for tracking noncompliances that did not require a formal response from the licensee. Mr. Lieberman explained the four exceptions whereby an NOV would be issued for a Severity Level IV violation. The exceptions would be when: 1) the licensee did not place the violation into a corrective action program to address recurrence and provide the NRC with a file reference,2) the violation was willful but the willfulness did not justify an increase to Severity Level lil,' 3) compliance was not appropriately restored as evidenced by the licensee failing to take reasonable action to abate an existing, known violation, or 4) the NRC identified a repetitive violation after the licensee had a l
reasonable time commensurate with its safety significance to take effective corrective action to prevent recurrence. {
NEl expressed a previous concern about the level of detail in inspection reports about NCVs.
NEl also expressed concern that the poposed approach still maintained an assessment orientation.
The issue of regulatory significance was also discussed during the meeting. The NRC, NEl, and UCS agreed that actual safety consequences and potential safety consequences should be considered in assessing the safety significance of a violation for the purposes of assigning severity levels. While NEl took the position that severity level categorizations should not be based on " regulatory significance," NEl did identify other categories of violations where they l believed enforcement action would be important for deterrence reasons (e.g., willful violations, l' Inaccurate or incomplete information, employes discrimination). (These issues have traditionally been viewed as having regulatory significance by the NRC.) NEl provided a handout (attached) that included these types of issues in Table C. NEl continued to disagree l[ l with the NRC position that several programmatic Severity Level IV related or recurring violations K)\. 0g i
Willful violations would be handled consistent with Section Vll.B.1.(d) of the Policy, which allows the staff to exercise discretion and issue a NCV based on the level of the individual, significance,of underlying violation, licensee's response, etc.
9810270026 981020 eqq g N h1 PDR REVGP ERGNUMRC PDR ~d y Okd-N W'1
' be considered significant. The NRC provided a preliminary working handout to prompt further discussions on this issue (attached). NEl stated their position that root causes should not be considered as a factor in determining severity levels. UCS stated that focusing on Severity Level IV issues in this manner may not help to identify poor performers who actually may have more significant safety issues. UCS stated that processing escalated enforcement actions takes much longer when the action is based on regulatory significance versus actual or potential safety consequences, and that actions would likely be more timely if regulatory significance was dropped as a consideration in assessing the significance of violations.
NEl indicated that they were still continuing to refine their proposal on enforcement and that they would attempt to submit their recommendations later in October. NRC and NEi discussed l the staff's schedules on Severity Level IV violations and regulatory significance and whether an ,;
adjustment was warranted based on NEl's proposed schedule.
Attachments: As stated 1
l 2
l l
DISTRIBUTION:
JLieberman, OE '
l BBorchardt, OE RPedersen, OE BTravers, EDO
.PDR^
Day File t
l I
OE D:
RPepersen 10d(198 hJ 1 rman 8 i i
G:MTGSUM.RP 'I l
l l
3 e - r , . -. w , -.
Table A- Actual Consequences This table applies to violations of NRC requirements having actual radiological safety consequences.
CONDITION SEVERITY LEVEL r ,
= .
Offsite Release Due to =
Reactor Operating Event I/II/III or NSSI(criteria to be !
developed)
=
Offsite Release of =
Contaminated Material I/II/III or NSSI (criteria to be developed)
=
Onsite Releases or Exposures = I/II/III or NSSI(criteria to be
~
developed) l l
,s s --evme... - . ~ ~ ~ - - -, - , , , . +..we.n.
TABLE B - POTENTIAL CONSEQUENCES This table applies to reactor operations, maintenance, and design activities (including programs and procedures t apply to those activities) that are found to be in violation of NRC requirements. As referred to in this table,
' intended safety function
- refers to the function (s) that caused the system to be classed as a " risk significant" or
- high risk significant" system. Inability of all trains to perform safety function refers to cases in which each of those trains could not perform intended safety function pertinent to the event or circumstances at issue for a period beyond the allowed outage time (AOT) that would apply to each train if other trains were operable. For s systems with redundancy provided by diverse trains or systems, the single train system and the diverse redundant train or system should be treated as redundant trains of a single system.
CONDITION IIIGH RISK RISK #
NON-RISK SIGNIFICANT SSC SIGNIFICANT SSC SIGNIFICANTSSC '
All trains ofsystem fail to I* II* NSSI perform intended safety function when actually called upon.
All trains ofsystem cannot II* III* NSSI perform intended safety functions.
All trains ofsystem cannot III* NSSI NSSI -
perform intended safety functions under some circumstances.
One train ofmultitrain II' III* NSSI system fails to perform intended safety function when actually called upon.
Once train of multitrain III* NSSI NSSI system cannot perform intended safety function.
One train ofmultitrain NSSI NSSI NSSI system cannot perfomt intended safety function under some circumstances, j
or system or systems j
degraded but capable of I
performing intended safety. I
- If reasonable compensatory capability was available, or compensatory action was taken, lower i one severity level.
WAo3/1226791 l
ll
. L)-R-A-F-T October 13,1998 4
4 TABLE C DEFINED VIOLATIONS WITH DETERRENCE IMPLICATIONS Table C would address certain violations where enforcement action is important for deterrence reasons, apart from any remedial purpose. These include certain i violations of 10 C.F.R. Section 50.5 (deliberate misconduct), Section 50.7 (employee discrimination), and Section 50.9 (complete and accurate information).
I Table C may also address certain violations related to licensee programs that are not susceptible to treatment on Table B. However, use of Table C should not undermine the philosophy that the enforcement program should not assume the performance assessment function. With respect to programs and program implementation, Table C would focus on issues with realistic potential consequences because there is a failure to achieve a required program element, not on isolated implementation issues.
The following objectives and guidelines would be employed in applying Table C:
Table C addresses enforcement actions issued to power reactor licensees.
Severity Levels of actions issued directly to individuals (including licensed operators and licensee employees) would be assessed separately in accordance with the guidelines of Section VIII of the Enforcement Policy. I l
1
- Table C reflects the philosophy that licensees are held accountable for the I acts of their employees, but should not be held accountable for matters outside their control such as random equipment failures or certain examples of personnel wrongdoing.
- As with all violations, the presumption is made for Table C that the licensee has initiated corrective actions through the Corrective Action Program or other initiative.
l 1
Condition Guideline Licensed Operator Attentivenessl '
. Multiple instances ofinattentiveness by licensed operators in control room SLII e ~ Inattentive licensed operator in control room SLIII Section 50.59
- Failure to apply for required NRC approval SLIII i due to flawed safety evaluation (change /USQ "
later determined unacceptable)
- Change made without Section 50.59 safety Assess based on evaluation Table B or C e Failure to apply for required NRC approval due to flawed Section 50.59 safety evaluation (change /USQ otherwise acceptable) NSSI Deliberate / Willful Violationsi e Willful violation by licensee management Assess based on individual (licensed operator, or manager- Table A, B, or C and level and above), with actual or potential safety raise 1 Severity consequences Level e Willful violatinn by licensee management SLIII individual (licensed operator, manager-level and above), with minimal potential safety consequences
. Willful violation by low ranking individual, Assess based on with actual or potential safety consequences Table A, B, or C e ~ Willful violation by low ranking individual, NSSI ,
with minimal potential safety consequences '
l Severity Levels in this category may be adjusted iflicensee management has taken reasonable corrective actions, including disciplin ri action.
2 l l
= l l
Emniovee Discrimination
- Licensee official culpable?
e Remediated with individual (i.e., settlement)?
l
. Chilling effects addressed?
IncomDiete/ Inaccurate Information
. Incomplete or inaccurate information on SI II a matter that would have warranted an immediate i NRC order required by public health and safety if complete / accurate
. Incomplete or inaccurate information on SL III a matter that would have resulted in other regulatory action (enforcement, withholding an approval)if complete / accurate
. Deliberately incomplete or inaccurate information Raise Severity based with the knowledge of senior licensee management on above examples by 1 -
e Other examples _ of deliberately inaccurate or See " Deliberate /
incomplete information Willful Violations" above; consider '
individual actions taken by licensee, NRC e Other isolated example of incomplete NSSI or inaccurate information which would not have resulted in regulatory action if complete or accurate Fitness For Duty
. Licensed operator at controls makes errors See Table A/B/C; that cause or exacerbate an alert or higher consider raising one level emergency, and later tests positive - SL, but also consider with actual or potential safety consequences actions by licensee and NRC against individual 3
- Licensed operator at controls makes errors, SL III, but consider and later tests positive -- with minimal safety actions by licensee consequences and NRC against l
individual e Failure to implement a s'gnificant element o SLIII the FFD program as req'uired by NKU l regulations 'j
- e. Isolated FFD program implementation NSSI l deficiencies ,
Security
. Actual act of sabotage in which security SLI !
system did not function as required and, as a result, there was a significant event i such as accidental criticality, theft of formula quantity of SNM, or unauthorized '
production of SNM e Security system did not function as required SLII .
and, as a result, there was an unauthorized i entry into vital area by an individual who was a threat, or there was a theft of SNM of moderate strategic significance e Failure, inability, degradation, or other -
SLIII deficiency in the established security systems or procedures such that there was a reasonable potential for unauthorized personnel who represented a threat to gain access to a vital area or to circumvent systems to introduce contraband, in such a way that there were significant potential consequences e
- Isolated safeguards failures, including both NSSI system design and procedure implementation deficiencies 4
7 v g w
\
1
. g1 Significant failure to effectively respond to a general SLI emergency i
l Significant failure to effectively respond to a site I emergency - SL11 Significant failure to effectively respond,to an alert SL III L e Significant failure to maintain equipment and/or systems SLIII l such that a planning standard involving assessment or i
notification capability is compromised
- Failure to meet or implement an emergency NSSI planning standard not directly related to assessment or notification capability
. Isolated failures to implement emergency NSSI response procedures ,
l Fire Protection (Annendix R) -
e Actual fire event resulting in damage that Varies depending a Fire Protection program element should upon consequences; have prevented assess based on Table A or B ifpossible '
- Failure to implement more than one element Varies depending of the Fire Protection program as required by upon risk; consider NRC regulations more than I SL III e Faihire to implement one element of the Fire SLIII Protection program as required by NRC regulations
- Isolated failures in the implementation of the NSSI Fire Protection program 1-i These violations are separate from, and in addition to, any other violations that relate to causing an event at a nuclear plant.
5 l
l
.m .. .. . . . . _ . , - _ . _ . . . . .. ., , .___.. .. - .-.- . . .. _.
7 -
av == c- e w -W, -w
e i,
i
. CASES TO CONSIDER REGULATORY SIGNIFICANCE 10 13-98 l
t 1. Breakdown of a major program A licensee was experiencing frequent component failures during surveillance testing.
Inspectors selected two recent failures for in-depth inspection and discovered that observable adverse trends in component performance was evident in past surveillances i based on test records, although acceptance criteria was met. Further review indicated l that the licensee had improperly classified many SSCs according to the Maintenance
! Rule (did not require monitoring) and failed to classify many surveillance failures as l maintenance preventable.' Proper implementation of the rule would have resulted in earlier identification of declining equipment '
performance and prevention of component failures.
- 2. Repetition During an 18 month surveillance, the licensee found that the firing pressures on several diesel generator cylinders were offset beyond the manufacturer's specified differential .
tolerance. The licensee performed maintenance to re balance the engine and achieved '
a satisfactory retest. The diesel was considered to be inoperable in the as found condition based on that it was incapable of performing its design basis 30-day run, but all monthly surveillances had passed. The licensee did not consider the unbalance problem to be chronic and did not believe that an underlying deficiency had caused the unbalance to occur. During the next 18 month survelliance the same scenario repeated.
As before, successful efforts were undertaken to re balance the engine. The licenses found some clogging of fuelinjectors and concluded that the unbalance was being caused by clogging of the fuelinjectors. The licensee took corrective actions in response to this finding, and again the engine was successfully rebalanced. However, during the next outage, the same scenario occurred. At this time, an NRC inspector discovered that the root cause of the unbalance problem was a loose linkage in the fuel rack assembly that had not been tightened following a modification prior to the first instance. This discovery was based on visual observation of the linkage and followup inspection of records that revealed that a signoff was not made for tightening the linkage in the original maintenance work package. The licensee agreed with this finding.
- 3. Failure of Multiple Barriers During a refueling outage, maintenance was performed on the Unit 2 low pressure safety injection pump minimum recirculation flow valve. The valve was mistakenly left in a locked open configuration and the reactor was returned to full power operations.
During a surveillance test, operators noted that the valve was failing to close as designed when the pump started. A containment entry was made and the problem was corrected. The licensee determined that no actual or potential safety concem existed because existing boundary valve leakage was lower than assumed, thus sufficient flow would exist even when the minimum flow valve was stuck in the open position (less than design basis low pressure injection flow would exist with assumed boundary valve leakage). The NRC concurred with this evaluation. In the investigation of the root cause, the licensee determined that the maintenance technicians had failed to restore the valve to its normal standby configuration but had mistakenly signed steps on the i
l l
e
- j. O,
.i
)
2 maintenance work order indicating that this had been done. Subsequently, a QC Inspector, performing an inspection of the work, relied on verbal statements that he misunderstood from another QC inspector, and signed a surveillance report stating that the valve had been properly restored. The required post. maintenance test to ensure that the valve was operable following maintenance was mistakenly performed on the valve in the other train. A new Unit 2 system engineer not familiar with the system
- , performed a pre-critical valve lineup of the system and signed paperwork showing the
- valve to be in its proper configuration because he relied on his knowledge of Unit 1. It
- would of been acceptable for Unit 1.
, t Fallure of Multiple Barriers (second example)
During installation of a modification on the high pressure coolant injection system, a flow orifice was installed backward. The orifice was directional and restricted flow to a greater extent in its backward configuration. This error was missed by the maintenance technicians performing the work and a QC inspector who signed the modification .
, package stating that the orifice was installed correctly. Engineering specified a test that j
measured the flow rate through the system, but had mistakenly provided an incorrect i-
' value. Based on this invalid requirement, the system passed the test. The system was ,
placed into service and was operated for an 18-month operating cycle. During the
] subsequent refueling outage, a surveillance test of the HPCI system revealed a flow rate I
i that was less than the design (USAR) value though still above the Technical '
i Specification limit.
l e
l l
I
-..--,--------3---- _
- - _- - - - . _ . - - - - - - - - - - - -