ML20195D466
| ML20195D466 | |
| Person / Time | |
|---|---|
| Site: | Three Mile Island  |
| Issue date: | 04/29/1986 |
| From: | Beall J, Callan L, Caphton D, Isom J, Mary Johnson, Martin T, Mckee P, Saunders A, James Smith, Danielle Sullivan NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I), NRC OFFICE OF INSPECTION & ENFORCEMENT (IE) |
| To: | |
| Shared Package | |
| ML20195D446 | List: |
| References | |
| 50-289-86-03, 50-289-86-3, IEIN-83-64, NUDOCS 8606040217 | |
| Download: ML20195D466 (38) | |
See also: IR 05000289/1986003
Text
.
,
'
0FFICE OF INSPECTION AND ENFORCEMENT
DIVISION OF INSPECTION PROGRAMS
Report No.: 50-289/86-03
Licensee: General Public Utilities Nuclear Corporation
P. O. Box 480
Middletown, Pennsylvania 17057
Docket No.: 50-289 License No.: DPR-50
Facility Name: Three Mile Island - Unit 1
Inspection Conducted M ch 3-27, 1986
Inspectors: I # F4
L. X Callan :hief, Performance Appraisal Section, IE. / Date
Y Tfff
J. E'. B
7, PrJject Engpeer, Region I /Date/
JE - 6 yAr/a
-
D. L'. ton, enior Te nical Reviewer, Region I ' Oate/
v pf' 2ffM
J. A. I o , Reactor Opdrations Engineer, IE 'Date
~
'
f/h
M. R. J6Mson, Reactor Fperations Engineer, IE /Date
Tn.D& In pection Specialist, IE
aksk
'Datd
T. 0.'W74artin L v/u/x
A. H. agiers,Inspcti#nSpecialist,IE 'Aate/
) _ Mb6[Ab
nspection Specialist, IE //Da ~
J.} 'i
h
D.U. S llivan, Jr. , Inspec on Specialist, IE
O/R
@ath
Accompanying Personnel: *D. F. Humenansky, OCM
Cont cto 2: *E. T. Du 1 p, *G. W. Morris, *G. J. Overbeck
Approved by: Y/29/86
Phillip F. @ Kee, Chief Date
Operating Reactor Programs Branch, IE
- Present during the exit interview on March 27, 1986.
8606040217 860515
PDR ADOCK 05000289
G PDR
_- -- _ _ . - . - -
.
1 O
j SCOPE: This special, announced team inspection conducted an in-depth
assessment of the operational readiness of the emergency feedwater
system.
RESULTS: The licensee's operational readiness and management controls were
reviewed in six functional areas, primarily as they related to the
emergency feedwater system. The functional areas reviewed were:
Design Changes and Modifications
Maintenance
Surveillance Testing
Operations
Quality Assurance
Training
Eighteen potential enforcement findings, identified in this report as
Unresolved Items, and seven inspector followup items will be followed
up by the NRC Region 1.
!
,
4
J
.
I
i
,,___ _._-_,_,---___ - ._,.
.
. _ - .
_ . -_.- - . , . - . . . - .
,
.
!
s I. INSPECTION OBJECTIVE
The objective of the team inspection at Three Mile Island-Unit I was to
assess the operational readiness of the emergency feedwater (EFW) system by
~
determining whether:
o The system was capable of performing the safety functions required
by its design basis.
o Testing was adequate to demonstrate that the system would perform
all of the safety functions required.
o System maintenance (with emphasis on pumps and valves) was adequate
to ensure system operability under postulated accident conditions.
o Operator and maintenance technician training was adequate to ensure
proper operations and maintenance of the system.
o Human factors considerations relating to the EFW system (e.g.,
accessibility and labelling of valves) and the system's supporting
procedures were adequate to ensure proper system operation under
normal and accident conditions.
II. SUMMARY OF SIGNIFICANT INSPECTION FINDINGS ,
-
This section summarizes the safety effects of the more significant findings
on the operational readiness of the Three Mile Island (TMI)-Unit I safety
systems.Section III provides the detailed findings pertaining to the major
functional areas evaluated.
A. Safety Effects on the Emergency Feedwater (EFW) System
1. The NRC inspection team identified the following design concerns in the
EFW system.
a. The two-hour backup supply air system that supplies the pneumatically
operated EFW flow control valves did not meet the required single
failure criteria. Specifically, the team determined that a single
failure of either of two check valves, which were not part of a
routine test program, could have caused the depressurization of both
trains of the two-hour backup supply air system. In the event of
such a depressurization, the EFW flow control valves are designed to
fail full open.
b. Certain remote shutdown panel instrumentation for the EFW system was
imporperly designed in a design change package prepared by a licensee
contractor, Gilbert Comonwealth. This design change was initiated
as part of the licensee's program to comply with the requirements
of 10 CFR 50, Appendix R, and it had been approved and released for
implementation during the next TMI-1 refueling outage. Through
review of construction drawings in the design change package the
inspection team determined that the power supplied to the affected
EFW instrumentation on the remote shutdown panel would not be
isolated from the control room as required. Specifically, train A
EFW flow remote shutdown panel indication and train B EFW flow and
-1-
__ . . ._ -_ _ __ _ ___
! - -
, ,
- steam generator level remote shutdown panel indications were all
powered from circuits that were to be electrically cross-connected
with the control room. The team was concerned that, in the event of
a need to evacuate the control room due to a fire, the potential
,
existed for the EFW instrumentation discussed above not to be
l available for the operators at the remote shutdown panel. This
! same weakness was noted to exist in the current configuration of
'
the remote shutdown panel at the time of the inspection; however,
'
the licensee was not connitted to the NRC to have the affected EFW
instrumentation in compliance with the requirements of 10 CFR. 50,
Appendix R, until cycle 6 startup at the conclusion of the next
refueling outage.
2. Although the inspection team determined that the TMI-1 maintenance and
surveillance testing programs were generally effective, weaknesses were
identified regarding the manner in which certain components of the EFW
and supporting systems were tested and maintained.
,
a. The two-hour backup supply air system relied on various check valves
- to seat to establish the integrity of the seismic /non-seismic
boundary in the event of an earthquake. The team determined that
these check valves were not routinely tested. As a consequence, the
team was concerned that the system was susceptible to undetected
failures. .
b. The safety-related air system that accomplished the fail-safe posi-
tioning of the EFW flow control valves (full open) and the steam
,
generator atmospheric dump valves (shut) was not tested to verify
proper operation in the event of a loss of the two-hour backup supply
air system. This " final positioning" air system relied on the proper
> operation of various automatic valves and check valves that were not
]
included in a routine test program,
i c. The installation of the air cylinders in the two-hour backup supply
air system was not consistent with that specified in the structural
design analysis. Specifically, the seismic restraints (chains, turn-
buckles, eye-bolts, etc.) designed for the air cylinders had not
been adequately maintained after installation to ensure that
l
original design requirements were met. The team found loose chains
'
with open S links, missing turnbuckles, and eye-bolts not securely
fastened, which all contributed to the team's concern that vertical
l
movement during a seismic event could potentially cause the failure
j of connecting tubing.
'
d. The procedure for replacing the EFW pump packing was determined to
be not sufficiently detailed to ensure proper performance of the
,
task. The licensee had been performing this maintenance task using a
i
generic pump packing procedure that did not address several critical
steps that applied specifically to the EFW pump. The team
considered this issue significant because errors in perfonning the
'
omitted critical steps had led to a previous EFW pump failure.
[ e. Certain aspects of the routine EFW pump surveillance tests were
j determined to be weak because artificial initial conditions were
established.
2-
__. . . _ . - . _ - _ - _
.
..
.. 1) The steam supply lines to the turbine-driven EFW pump were
routinely blown dry of collected condensate immediately prior
to testing the pump. The licensee had not determined if the
collected condensate could impact the performance of the pump's
turbine driver in the event of an automatic start. This concern
was mitigated by the fact that the licensee was in the practice
of blowing down the steam supply lines each shift as a routine
precaution.
2) The EFW pump discharge check valves on the EFW pumps were not
tested in the reverse direction. During routine flow testing
of the EFW pumps, the pump being tested was isolated from the
idle EFW pumps. As a consequence, the ability of the discharge
check valves on the idle EFW pumps to prevent back-flow was not
routinely verified.
B. Effects on Other Safety Systems
In addition to the specific concerns discussed above that relate to the EFW
system, the team also identified several general concerns that have the
potential to affect the proper operation of other safety systems.
1. Several weaknesses were identified in the implementation of the TMI-1
design change program. .
~
a. Examples where the mini-mod process for accomplishing plant
modifications of limited scope was not being implemented as
intended by plant procedures,
b. Examples where the design verification process was not implemented
as required by plant procedures.
c Examples where design input was not always controlled as required
by ANSI N45.2.11. Cases were identified in both the mechanical and
electrical areas.
d. Examples where the boundaries between seismic and non-seismic systems
or components were not consistently shown on piping and flow diagrams.
In some cases, boundaries were not shown, were incorrectly shown, or
were contradictory between documents.
2. Weaknesses were identified in the program for control of permanent and
temporary lead shielding. The team found that 10 CFR 50.59 evaluations for
shielding installations were not being accomplished; that the engineering
calculations for a standard table in the shielding control procedure did
not consider the effects of seismic events, pipe configuration, types of
anchors, or concentrated loads; that the shielding control procedure did
not address installation techniques or requirements; that engineering
calculations for shielding installations were not being verified in a
timely manner; and that a permanent shielding installation did not conform
to the technical analysis.
3. It appeared that circuit breaker sizes had not been properly coordinated
to ensure fault clearing for certain safety-related and non-safety-related
power supply inverters. The team was concerned that a fault on a single
-3-
-
'.. -
,' circuit could result in the loss of an inverter fed bus. Related to this
concern was the additional observation that the licensee apparently had
not considered the effects on safety-related load centers of the failure
of loads that had not been qualified to operate in a harsh environment
following a high-energy line break.
4. Environmental qualification records were not maintained in accordance
with 10 CFR 50.49 with respect to the electrical cabling to the EFW
discharge header cross-connect valves. The team was concerned that
additional environmental qualification record problems may exist.
III. DETAILED INSPECTION FINDINGS
A. Design Changes and Modifications
1. Mechanical Systems Design Change Review
The inspection team examined the design aspects of restart modification
task RM-13H in detail. This modification added the safety-related two-hour
backup supply air system to provide compressed air for operation of
components within the main steam (MS) and emergency feedwater (EFW)
systems for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> without the availability of the plant
instrument air compressors. In addition, design analyses associated with
adding cavitating venturis (long term modification task LM-5), locking ,
open EFW pump recirculation control valves (task LM-12), and reducing the
-
setpoints of EFW turbine steam supply relief valves (task RM-13H) were
reviewed. The following observations were made:
a. The team determined that the the two-hour backup supply air system
did not meet the single failure criteria. Following a seismic event
which may require initiation of the EFW system, a single failure of
either of two check valves, IA-V-1451 and I A-V-1460, could cause the
depressurization of both trains of the two-hour backup supply air
system.
Figure 1 on page 5 illustrates that portion of the two-hour backup
supply air system containing check valves IA-V-1451 and IA-V-1460.
Following a seismic event and a subsequent loss of the non-seismic
i
backup instrument air header, the failure to seat of either check
valve IA-V-1451 or IA-V-1460 would depressurize train A of the
two-hour backup supply air system. After sensing that train A was
depre surized, proper functioning of switching valve IA-V-1632 would
cause train B to be depressurized because the check valves were
downstream of this switching valve.
The FSAR, Section 9.10.3.2, stated that the two-hour backup supply
air system would mitigate the loss of instrument air as a result of
design basis or seismic events and that the system design meets the
single failure criteria. Similar wording appeared in the licensee's
System Design Description (SDD) 424-C, " Division I System Design
Description for the Two-Hour Air Supply for Main Steam And Emergency
Feedwater System Controls," Revision 1. Division I system design
descriptions were comprehensive criteria documents that defined the
design, operation, maintenance, and testing requirements of systems.
-4-
_. ..
_ _
. - _ - , - . _-
. _ _ - - _
.
- ,
-
DET BE m
'
"$R "$ =
mas as l
sa am -
,
95 95 i
2 s ,, ,, IA-V1130 llA-V1449
mo 4 L 2
r ,
, x -
m o ci
> c 01 1
y-<m = ^ lA-V1450 elA-V1451
> -
_
- -
X [
E <
w -
X 's_ _ _i1
c % % T i
' ' ' 1A-V1646 iA-V1647
T& ~ -
l'\
,
_ "a
-
X / f i
l
m wV ,
hb
~
cn thw A ,
~ r 7 f I
y -
IA-V1459 'I A-V1460 I-
'iL__ y
o kn
g
gm@
$ cn I
M /V1X < ij
g)2
m
I
b rC = ,j1 ,L 1
1A-V1648 ilA-V1649
/
g-<m ' '
\
- $m$ 2MG 2e
05' TE m
6
i "
@ C '
m R9 R9
MH ms ~
m
l - 9,o H
"
<
00
CD
__
O
,
This design weakness was discussed with licensee management, and the
licensee subsequently made an immediate notification to the NRC
Operations Center as required by 10 CFR 50.72. The licensee also
implemented corrective actions, which included shutting valves
IA-V-1450 and IA-V-1459, to remove the susceptibility of the two-hour
backup supply air system to loss by a single failure. This item
will remain unresolved pending followup by the NRC Region I Office
(50-289/86-03-01).
b. The team found that two-hour backup supply air system check valves
were not periodically tested. Division II SDD 424C, "Two-Hour Air
Supply for Main Steam and Emergency Feedwater System Controls,"
Revision 0, required that these air system check valves be tested
once every refueling cycle. The team noted that an undetected
failure of any one check valve to seat in combination with a postu-
lated single active failure within the opposite loop could cause the
loss of the two-hour backup supply air system. This concern
resulted from the fact that the seismic /non-seismic boundary between
the two-hour backup supply air system and the instrument and backup
instrument air systems was maintained by a single check valve at each
air user, except for EFW flow control valves EF-V-30A and EF-V-30B
where a tripping valve was used instead of a check valve. The
two-hour backup supply air system depended upon the ability of the
check and tripping valves at each seismic boundary to seat to ensure,
proper system performance following a seismic event or events that
result in the loss of instrument and backup air compressors, such as
a high-energy line break in the intermediate building.
Further discussion of the apparent failure to provide adequate
testing for the two-hour backup supply air check valves is provided
in Surveillance and Testing observation 2.
c. Post-modification functional testing of the two-hour backup supply
air system was found to be inadequate. Low power natural circulation
test TP 700/2, Revision STR-3, was performed, in part, to verify
that the bottled air supply was capable of supplying air to valves
EF-V-30A/B, MS-V-6, and MS-V-4A/B for a minimum of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following
the loss of normal and backup instrument air systems. However, the
test was not structured to confirm that the design bases for the
two-hour backup supply air system had been satisfied. For example,
the test did not confirm that the system was adequately sized to
supply sufficient air to cycle all associated valves 20 times as
specified in the design or to observe a minimum of 10 strokes per
valve as required by the 500. In addition, the test did not establish
an initial condition to have the bottled air pressure be at its
minimum pressure of 1500 psig. .
Functional Test TP 248/2 was perfonned, in part, to demonstrate the
operability of the two-hour backup supply air system. The team found
little correlation between the design bases of the system and the
testing performed as demonstrated by the following table.
-6-
.. _. __ .-.
. =. . . - . --- . -- - - . _ _ . _ - _
.
,
REQUIREMENT DESIGN TESTING
..
Period of operation 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> I hour
i
Valves using air (excluding EF-V-30A/B EF-V-30A/B
- EFW pump recirculation valves) MS-V-4A/B MS-V-4A/B
MS-V-6
I
Number of times valves 20 5
are cycled
Minimum manifold pressure 1500 psig Not specified per
! initially test; however train
, A and B started at
1700 psig
Minimum manifold pressure 300 psig greater than 50
after two hours of use (Note 1) psig
System leakage rate 0.03 scfm at Not addressed
2500 psig.
Note 1: The pressure regulators were designed to supply maximum ,
- flowrate at a minimum inlet pressure of 300 psig. .
!- The team considered that a reduced number of cycles and a shortened
l
test period was reasonable provided they were correlated to the design i
'
l bases and that acceptance criteria would reflect that correlation.
ANSI N18.7 requires that tests be performed following plant modifi-
cations to confirm that the modifications produce expected results
and do not reduce safety of operations, and that test procedures
include appropriate quantitative or qualitative acceptance criteria.
The team considered the test performed on the two hatr-backup supply
air system did not confirm that the modification proauced expected
results per the design bases and did not have acceptance criteria
consistent with these system design bases.
, This item was discussed with licensee management and will remain
unresolved pending followup by the Region I Office (50-289/86-03-02).
d. The team found the site installation of the air cylinders for the
two-hour backup supply air system differed from that specified in
>
the structural design analysis. Calculation 609-0293, " Bottle Rack
i
for RM-13h," Revision 0, provided the rack design for restraint
3
of these air cylinders during a seismic event. The design included
chain restraints to preclude vertical movernent with turnbuckles
attached to the chain to assure adequate tension. The chain and
turnbuckle connections were to be made by open "S" chain links that
were intended by design to be closed af ter installation. Inspection
4
.
of the installation by the team revealed that no turnbuckles were
installed, the chain restraints were loose, "S" links were not
a
closed, and eye-bolts were not securely fastened to the frame.
- Although the existing arrangement differed slightly from the original
- design by not having turnbuckles installed, the intent to restrain
i the bottles from vertical movement may have been effective if the
i'
- 7-
,
. . - - e .- .,_.---, y . . - ~ _ _ - . . - . - _ _ _ _ . _ . - - .,,_-._,_,._.,-..--,----_,-.e-r.--,,-c,r.. ,.-_-,,..,---n . . - , - - - - - - -
1
.
-
,.
chains had been maintained snug. The team's concern regarding this
installation was that vertical movement allowed by loose chains
during a seismic event might cause the failure of conne.cting tubing
and loss of the air supply. One of the design requirements of the
two-hour backup supply air system was to provide a reliable source of
air following design basis events, such as an earthquake.
This item has been discussed with licensee management and will remain
unresolved pending followup by the NRC Region I Office (50-289/86-03-03).
e. Design input was not always controlled consistent with the require-
ments of ANSI N45.2.11. The following examples were noted:
1) Design input for the two-hour backup supply air system was
incorrectly selected and incorporated into the system design.
GPU calculation C-1101-852-5360-001, "Two Hour Backup Instrument
Air System Pressure Low limit," Revision 0, determined the
minimum allowable manifold pressure to maintain an adequate
stored air capacity to operate the EFW and MS valves for a
period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This calculation was based on system leak
rates obtained in leak rate testing performed in May 1983 which
essentially conducted a wld test for the high pressure portion
of the system. This t;st preceded system functional testing
accomplished by TP 248/2. The hold test on train A was .
terminated because of excessive leakage. The hold test on
'
train B was not representative because leaking air cylinders
were isolated. An approved test procedure did not exist, and
documentation consisted of handwritten observations by a test
engineer. As such, the team did not consider the test results
appropriate for use in the GPU design analysis.
During the team's walkdown of the system, air leakage was noted
from various fittings. The team was concerned that normal
leakage of both the high and low pressure portions of the system
may have been much greater than assumed in the calculation. The
team found no evidence that actual system leak rates were being
determined, such as by trending air leak rates, or through periodic
testing to determine actual leak rates.
2) Design input associated with sizing of regulating valves IA-V-1621A
and IA-V-1621B was provided by GPU to an architect engineer but
was subsequently changed by the licensee without notifying the
affected design organization. Specifically, the minimum bottle
pressure was reduced from 300 psig to 100 psig. As a con-
sequence, the regulating valves would not provide maximum design
flow at the reduced bottle pressure. .The team considered the
technical significance of this concern to be minimal as long as
air capacity was oversized and pressure was maintained high, but
the item illustrated how an apparently minor design input change
can have a significant effect on the design accomplished by an
external design organization.
As discussed above, the use and control of verified design input was
not consistently performed. In general, the weaknesses identified did
not adversely affect the design of installed hardware but could have
~
-8-
-
-
..
affected the assumed operating / design margin. However, the identi-
,~
fied weaknesses contributed to the team's concern with respect to the
overall control of the design process. Additional weaknesses in
implementing the requirements of ANSI N45.2.11 regarding control of
design inputs and design assumptions are discussed in Design Changes
and Modifications observation 2.a.
f. The team considered that the classifications for major systems,
components, and structures were not clearly identifiable by using the
Quality Classification List (QCL). This conclusion was based upon
the following observations.
1) The EFW system was not within a single classification. Portions
of the system were indicated in the QCL as being either important-
to-safety (ITS), nuclear safety-related (NSR), or benefits
reactor shutdown (BRS). Reference to the subsystems and
components for detailed classification identified the following:
a) The EFW pump suction from condensate storage tanks and
hotwell was identified as ITS.
b) The EFW pump control instrumentation was identified as ITS.
c) The EFW control system was identified as ITS. ,
- Other than these items, no other classifications were identified
for the EFW system. The team found this limited information
inconsistent with that implied on the EFW system pipe and flow
diagram. This drawing indicated that some portions of the
system were NSR but did not contain flags to further identify
what was NSR, ITS, or BRS. This lack of identification was
inconsistent with the other licensee pipe and flow diagrams
reviewed. Based on the above, the team could have concluded by
examination of the drawing that the entire system was NSR.
However, the team was informed by the licensee that the EFW
system would not be fully safety-grade until the completion of
long term modification task LM-13, and some components such as
the turbine-driven EFW pump would not be safety-grade because of
seismic considerations.
2) The two-hour backup supply air system was not identified in the
QCL. The team determined that the system was classified as ITS
based upon information in the Division I SDD and the pipe and
flow diagram.
The licensee acknowledged that the system level QCL required users to
obtain assistance from a QCL " interpreter" who was specifically trained
to render these interpretations. The licensee also indicated that a
component level QCL was currently under development. The progress of
this effort will remain an inspector followup item (50-289/86-03-04).
2. Electrical Systems Design Change Review
a. The inspection team examined design analyses associated with electrical
protection of the EFW pump motors and other large motors, battery
.g.
'.. *
..
sizing, the integrated control system (ICS) and EFW instrumentation
and control inverters, DC system power distribution, and motor-
operated valves. In each case, the team detennined that portions of
the calculations and design analyses reviewed were not consistent
with the design control requirements of ANSI N45.2.11. Specifically,
design inputs and assumptions often were not documented or verified,
and some calculations were not sufficiently complete to pemit design
verification without recourse to the originator. The following
examples were identified:
1) Design analyses for EFW pump motor overcurrent protection were
considered weak due to incorrect relay settings and the apparent
lack of consideration for long-term thermal degradation of the
motors. The EFW pumps and motors were originally not considered
to be nuclear safety-related components. The EFW system control
circuits and power supplies were upgraded in modifications
RM-13E and LM-13, task 10, from non-safety-related to safety-
related. The team found that the analyses performed around 1970
to detennine the setpoints for the overcurrent relays protecting
the EFW pump motors (and other large safety-related motors) had
not been updated.
For example, review of records revealed that the safe stall
time at rated locked-rotor current for the EFW pump motors was ,
5 seconds for hot restart when the motor had been running within
the previous hour. The signoffs on the original setting notice
in 1973 indicated that the overcurrent trip delay setting for
the EFW pump motors was set at 5.8 seconds. The licensee was
unable tc provide an analysis to support this relay setting.
The team was concerned that the overcurrent relay protection
provided for safety-related motors had not been verified against
actual motor data such as acceleration curves or motor thermal
damage curves.
2) Control of design inputs associated with battery sizing was
considered weak. The team reviewed the latest sizing calculation
for the new battery to be installed during the March / April 1986
outage and determined that the battery was sized based upon a
minimum battery temperature of 72*F. No reference was included
in the calculation for the basis of this minimum temperature.
The team reviewed the electrolyte temperature recorded weekly
in accordance with procedure 1301-4.6, " Weekly Surveillance
Check," to determine what temperatures the existing batteries
were experiencing. The weekly surveillance for the first 10
weeks of 1986 for both safety-related batteries indicated that
17 of 20 readings were below the miniinum design temperature of
72*F. Some of the temperature readings were as low as 65'F,
which could result in a battery capacity approximately 5% lower
than assumed in the analysis. The team noted that the battery
surveillance procedures did not include acceptance criteria for
battery temperature. The team also found that other design
input data used in the calculation, such as pump and valve
starting and running currents, lacked sufficient references to
permit complete verification of the calculations.
- 10 -
.
.
..
It appeared that the 25% margin included in the battery for
aging effects would more than compensate for any near term
capacity problems. However, the team wa:; concerned that an
unacceptable loss of battery capacity could result if the
battery room temperature were not maintained above the minimum
design temperature as the battery reached mid-life.
3) Design analyses were not available to demonstrate the capability
of some of the 118Vac power panel circuits providing power to
ICS and EFW instrumentation to clear electrical faults. The
safety-related power panels were fed solely from inverters and
did not have an alternate power source for fault clearing. The
power panel schedules indicated circuit breaker ratings as high
as 30 amperes on the safety-related panels and 50 to 70 amperes
on the non-safety-related power panels. The non-safety-related
power panels fed loads such as ICS and the backup manual con-
trollers for the EFW flow control valves. The team was concerned
that a fault on a single circuit could drag the associated
inverter into the current limit, low voltage mode and result in
loss of an entire inverter fed bus.
4) Preliminary, unverified design input was used as a basis for
fuse changes in the de system power distribution panels.
These changes were accomplished by Job Ticket CC 219, 10/4/83, ,
to increase the interrupting capability of the fuses. The
-
task was authorized by memorandum LAI 83-0037-8/24/83, which
referenced unissued Technical Data Report No. 374. The team was
concerned that the Technical Data Report referenced as the basis
for this change had yet to be completed, verified, or issued.
5) Design analysis for determining minimum motor starting voltages
for certain safety-related valves appeared to be inadequate.
An analysis for minimum motor starting voltage for safety-related
valves had been perfomed in 1979. This analysis resulted in
actuator modifications to 2 of the 31 valves analyzed so they
would operate at the minimum required voltage. The EFW system
Valves, and MS and Condensate valves supporting the EFW system,
were not reviewed at that time because they were not considered
safety-related. The team determined that analyses for these
valves had still not been accomplished even though several were
now considered safety-related valves. In addition, it did not
appear that the actual minimum voltage available at any of the
safety-related motor-operated valves had been determined to
support the assumption in the original analysis that the voltage
at the valve operators would not drop below 75% of the motor
rated voltage. .
The weaknesses discussed in the above five examples and the two
examples discussed previously in observation 1.e appear to reflect
inadequate implementation of the requirements of ANSI N45.2.11
regarding the documentation and verification of design inputs and
assumptions, and the conditions of design calculations. This item
was discussed with licensee management and will remain unresolved
pending followup by the NRC Region 1 Office (50-209/86-03-05).
- 11 -
N -
' ~
l b. A proposed design change to the remote shutdown panel failed to meet
'
the requirements of 10 CFR 50, Appendix R, by not isolating the power
supply for the EFW remote shutdown panel instrumentation from the
control room. This oi. sign change had been prepared by a licensee
contractor, Gilbert Commonwealth, and was approved and released for
implementation during the next TMI-1 refueling outage. The design '
i change was initiated as part of the licensee's program to comply
l with the requirements of 10 CFR 50, Appendix R. Appendix R, Sections
! III G2 and G3, require that alternate shutdown capability be
independent of the circuits which may fail because of the postulated
fire (such as circuits located in the control room). A review of the
construction drawings in the design change package revealed the
following examples involving EFW instrumentation where the require-
ments of 10 CFR 50, Appendix R, did not appear to be met:
1) Power panel VBB, breaker 22, fed train B signal conditioning
cabinet 81 via circuit EA 6824. Circuit EA 6856 fed the
power supply from cabinet 81 to cabinet B2. The electronics in
cabinet B2 developed train B EFW flow and OTSG 1evel instrumen-
tation on the remote shutdown panel. Power for the electronics
for this instrumentation on the remote shutdown panel came from
the receptacle circuit in cabinet B2. However, this receptacle
circuit was to be powered by the same circuit that provided power
to three other circuits (EA 6858. EA 6860, and EA 6868) that all
went to the control room.
2) Power panel V8C, breaker 20, fed the containment water level
cabinet C. The electronics in this cabinet developed train A
EFW flow indication on the remote shutdown panel. However,
the same circuit that provided power to containment water level
cabinet C also was to feed circuit EA 517, which went to the
control room.
The team also reviewed the existing installation for these remote
shutdown circuits and found the same problems. The team noted,
however, that the licensee was not committed to the NRC to have
the affected EFW circuits in compliance with 10 CFR 50, Appendix R,
l
'
until cycle 6 startup at the conclusion of the next refueling outage.
The weaknesses identified in the design change package for the remote
shutdown panel were discussed with licensee management and will
remain unresolved pending followup by the NRC Region I Office
(50-289/86-03-06).
c. The TMI environmental qualification file failed to meet the require-
ments of 10 CFR 50.49 by not including plant specific data on the
cabling to the EFW discharge header cross-connect valves. The team
identified that circuits CG 241 and CH 871 control EFW valves EF-V-2A
and EF-V-2B, respectively. The team determined from the pull slips
that both of these cables were type EK-9G and from purchase order
97099 determined that cable EK-9G was a KERITE Company Flame Retardant
insulation / Flame Retardant Jacket (KERITE FR), However, the System
Component Evaluation Worksheet (SCEW) for the KERITE cable used at
TMI(SCEW-TI-770-005) identified the cable as a KERITE HTK There was
no SCEW sheet available to support the use of KERITE FR insulated
i
'
- 12 -
t
l
'.
,.
cable at TMI-1. Although the TMI-1 environmental qualification records
were detennined to be incomplete in this instance, the licensee did
have a SCEW sheet (SCEW-0C-770-006) for KERITE FR cable used at their
Oyster Creek plant.
Subsequent to the completion of the team's on-site inspection activities,
the licensee identified additional potential concerns regarding the
adequacy of the TMI-1 environmental qualification file for installed
electrical cabling. This item was discussed with licensee management
and will remain unresolved pending followup by the NRC Region I Office
(50-289/86-03-07).
d. The team identified a number of loads connected to the Class IE power
system that were either not safety-related, or were safety-related
but not environmentally qualified for the ensironment in which they
would operate. For example, the EFW pump room cooling units AH-E-24A
and AH-E-24B were classified as nuclear safety-related and were
connected to 480Vac control centers IA-ES and 18-ES, re:pectively.
These loads were located in the intermediate building but had not
been qualified to operate in a harsh environment that would exist
following a high-energy line break in that area. Although cooling
from these units was not required for operation of the EFW pumps,
the units would continue to operate in the harsh environment. The
team considered that a postulated electrical fault on these relatively
small circuits probably would not affect the Class 1E power system;
however, the team was concerned that the licensee may not have
reviewed the effect of failures of other larger loads on the breaker
coordination of loaded motor control centers and unit substations.
It appeared to the team that the associated circuit overcurrent
protection coordination review performed by the licensee for 10 CFR
50, Appendix R, may not have included the effect of the remaining
load on a bus while comparing the breaker or fuse curves of the
feeder with those of the largest circuit load. This concern was
discussed with licensee management and will remain unresolved pending
followup by the NRC Region I Office (50-289/86-03-08).
e. During review of the control circuit modification for the EFW
control valves, the team noted that the cable shield was tied to the
signal common wire. The signal common wire was eventually connected
to ground. The original system designer included an installation
note on drawing 210-006, Revision 21, that cautioned that the (cable)
shields should be tied together and then connected to ground. It
appeared that the intent of the original system designer was to have
separate wires for signal comons and shield grounds and that the
shields be individually connected to the panel ground bus. The team
noted that such a grounding scheme would also be consistent with the
guidance provided by IEEE 518-1977. The as-installed condition,
however, was such that noise on the shield drain would now be
conducted to the ground bus via the signal common wire.
This grounding practice did not appear to present a problem for the
specific control circuits reviewed because of their relatively slow
response time. However, if this practice were used in higher speed
or digital circuits, then spurious noise affecting the signal common
voltage could result in improper control actions.
- 13 -
'.
,. 3. Design Change Program Review
a. Weaknesses were identified in the program for control of permanent
and temporary lead shielding. The use of shielding for ALARA con-
siderations was evaluated with regard to whether temporary or
permanent design changes hid been made to plant systems without
adequate design evaluation. The following five concerns were
identified in this review.
1) No documented 10 CFR 50.59 evaluations had been accomplished for lead
shielding installations in the plant since procedure 9100-IMP-
3282.01, "Use of Permanent and Temporary Shielding," was issued
in 1983. Further, the team noted that procedure 9100-TMI-3282.01
did not address the subject of 10 CFR 50.59 evaluations.
IE Information Notice 83-64, " Lead Shielding Attached to Safety-
Related Systems Without 10 CFR 50.59 Evaluations," dated
September 29, 1983, addresses lead shielding installations
and indicates that failure to analyze for possible seismic and
structural effects (both dynamic and static) of lead shielding
on safety-related systems potentially constitutes an unreviewed
safety question. At the time of this inspection lead shielding
installations were on safety-related decay heat system suction
piping to pumps OH-P-1A and DH-P-1B. ,
-
It was also noted that IE Information Notice 83-64 was reviewed
by GPU in 1983 and the determination made that procedure 9100-IMP-
3282.01 satisfied the 10 CFR 50.59 requirements identified in the
notice.
2) Exhibit 2 in procedure 9100-IMP-3282.01 was a load table for use
in determining allowable loads that could be installed on plant
piping without further engineering review. Based on a review of
the engineering calculation to support this table, four significant
discrepancies were noted:
seismic ef fects were not considered;
the effects of pipe configuration between supports were not
considered (other than straight pipe);
the effects of positive anchors at supports were not
considered; and
- the effects of concentrated loads, such as valves, between
supports were not considered. ,
In effect, the table could have been used for all applications
when, in fact, it only applied to straight pipe, simply
supported, at specified maximum spans.
3) Procedure 9100-lMP-3282.01 did not address installation require-
ments or approved techniques to assure that shielding was safely
- 14 -
'.
C
.. and correctly installed with approved installation materials
and procedures. This information was not available in other
procedures as well.
4) Calculations to support lead shielding installations were not
verified in a timely manner. There had been approximately 10
shielding calculations accomplished and only one had been
verified in accordance with EP-009, " Design Verification." The
practice apparently had been to accomplish supportive cal-
culations and to install the shielding prior to completing the
design verifications. The team considered that lack of
completion of design verification prior to installing temporary
shielding to be significant since shielded systems are not
necessarily isolated from plant use and no functional test
can be accomplished to assure adequacy of the temporary design
change.
5) One permanent shielding installation reviewed involved the use
of loose concrete blocks to shield drain lines for letdown
prefilters MU-F-2A and MU-F-28. The criteria established by
the licensee for installation of the blocks was that the
center of gravity of the top blocks be no more than 12 inches
off the floor, the blocks be no closer than 2 feet to important-
to-safety (ITS) equipment due to seismic considerations, and .
that a warning sign be installed identifying the 2 foot require-
ment. Site inspection of the as-installed blocks by the team
,
revealed that the top block center of gravity was 15 inches off
the floor in some locations, ITS valves SF-V-77 and SF-V-71 were
located within 6 inches and 19 inches of the blocks, respectively,
and no warning sign was installed.
The above inadequacies in the program for control of temporary and
permanent shielding were discussed with licensee management and
will remain unresolved pending followup by the Region I Office
(50-289/86-03-09).
b. The mini-mod process of procedure EMP-002, " Mint-Mods," was reviewed
in detail. This is an expedited process developed to provide rapid
response capability for accomplishing plant modifications which meet
the mini-mod criteria. The key criteria center around budgetary
constraints, capability of the on-site group, and scope of the modi-
fication. In addition, four mini-mod work packages were evaluated
for procedure compliance to EMP-002 requirements as well as appropriate
design change control requirements. The four mini-mods reviewed were:
BA 123164 "EFW Turbine Inlet Pressure Control Modifications";
installation documents were released for construction.
BA 123170 " Removal of Instrument Air to Valves EF-V-8A, B, C";
installation documents were released for construction.
BA 123166 "AH-VIC ESAS Test Group Modification"; installation
documents were released for construction.
- 15 -
.
BA 215504 " Fuel Handling Building Crane Modification";
,,
installation was complete and turned over.
In general, the basic program and controls of EMP-002 and other
associated procedures appeared to be adequate for the mini-mod
process. However, two types of procedural implementation problems
were noted:
1) 10 CFR 50.59 evaluations for two mini-mods were incorrectly
marked as no change being required to the FSAR when, in fact,
the text or drawings in the FSAR appeared to be affected.
BA 215504 added a second fuel handling crane limit switch
to improve reliability and safety. The FSAR had specific
wording regarding the fuel handling crane limit switches
in section 9.7.1.6 that this modification appeared to
affect.
BA 123170 removed instrument air tubing to valves EF-V-8A,
EF-V-88, and EF-V-8C. FSAR Figure 10.6-1 for EFW depicted
air tubing to these valves and that figure would have to be
revised once the air tubing was removed.
The team's concern, based upon examples such as those above, is,
that a proper analysis for an unreviewed safety question may not
-
be perfomed if it is not recognized that the FSAR is affected
by the modification.
2) The installation specifications issued to accomplish the four
mini-mods reviewed did not address the attributes required by
procedure EMP-002. Paragraph 4.0 of Exhibit 2 (Design Require-
ments) to procedure EMP-002 specified two attributes to be
addressed and paragraph 5 of Exhibit 2 (Design Description)
specified nine attributes to be addressed in installat'on
specifications. None of the four mini-mods reviewed covered
these entirely. The team considered that all of these attributes
were relevant to design requirements and description and should
be part of a controlled design change process for documentation
of design input and output.
The above weaknesses regarding implementation of the procedure
EMP-002, " Mini-Mods," were discussed with licensee management and
will remain unresolved pending followup by the NRC Region I Office
(50-289/86-03-10).
c. Implementation of the design verification process as required by
EP-009 was considered to be a weakness. The following problems were
identified in the inspection:
1) Three engineering calculations reviewed had no design verifica-
tion accomplished,
calc # 1101X - 322F-165 Flowrates for two-hour backup
air supply system
- 16 -
-.
".
" calc # 1101X-322F-424-1 - EFW system resistance
,,
calc # 1302X-5320-A50 - Shielding stress
2) Three design verifications reviewed had no checklists as required
by EP-009.
calc #1101X-322B-003 - Air consumption by EF-V-30 valves
calc # 1101X-322F-157 - EFWP turbine relief valve setpoint
calc # 1101X-3228-004 - Air consumption by MS-V-6
3) System Design Descriptions (SDDs) were not being design verified
as required by EP-009. This was true for Division I and II of
SDDs 474A, B, C, D and E. Further, discussions with licensee
personnel revealed that design verification was not considered
necessary for SDDs and that SDDs would not necessarily be
updated to reflect changes. The team considered use of SDDs
to be very beneficial and a practice that should be continued,
but the SDDs need to be updated and verified since they are used
for design and are considered to be a source of design input as
well as a training input document. ANSI N45.2.11 requires that
design inputs be verified. ,
- The team noted that Technical Functions Procedure EP-005, " Modi-
fication and System Design Descriptions," recognized SDD
Division I as a record of design inputs and indicated that
for future modifications the design engineer must know the
complete basis for the design. It was noted by the team while
at the licensee's architect engineer's offices that the SDD
Division I was considered to be design input for their design
work. These inputs were not verified by their design veri-
fication process but were considered to be fact. Team dis-
cussions with licensee personnel revealed that it was assumed
that the architect engineer was design verifying GPU SDD design
inputs.
The design verfication concerns identified above were discussed with
licensee management and will remain unresolved pending followup by
NRC Region I Office (50-289/86-03-11).
d. Design document updating procedures were considered weak. In this
review 75 documents were identified that had 6 or more change
documents posted against them. These documents were mostly drawings,
but also included installation specifications, an instrument list
(308001), an SDD Division II (232E), and a' master EQ equipment list
(990-1429). Procedure EMP-015 stated that documents with more than
five outstanding changes posted against them are subject to a
mandatory update.
The change document history for 10 of the documents identified with
six or more changes was reviewed with the following results:
- 17 -
- - ._
'.
. Total Number Date of
Document of Changes 6th Change
drawing ID-662-18-002 8 5/83
drawing 641-074 7 9/83
drawing 311-842 7 10/83
drawing 215-021 10 6/83
drawing 215-051 9 7/83
drawing 304-641 8 1/84
.
drawing 224-503 18 3/82
SDD 232E 6 5/83
Instrument List 20 9/8F
Master Environmental 9 4/85
Qualifications List
Based on above examples, it appeared that the drawing updating
criteria established by procedure EMP-015 was not being adequately
implemented.
During the inspection it was noted that the TMI-1 quality assurance
organization identified similar concerns in September 1985 in Audit
No. S-TMI-85-10. The Engineering Services response to that audit in
October 1985 indicated that:
,
The instrument list was being revised and the list is now subject
to routine, timely maintenance. However, the NRC inspection team
found that the instrument list still had 20 change documents posted
against it. Some of these outstanding changes dated back to 1981.
The 215 series drawings were redundant to other data and would be
voided. The NRC inspection team found that these drawings
apparently had not been voided, as indicated by the fact that
they were still listed as being in need of updating.
The desirability of maintaining the updating requirement for
certain drawings, installation specifications and SDDs was
< referred to the Manager-Engineering Projects, TMI-1. The NRC
inspection team found that apparently no decision had been made,
as these documents were still in need of updating and no other
correspondence had been issued.
The licensee stated that a change to procedure EP-002, "GPUN Drawings,"
that addresses the concerns discussed above was being prepared. The
progress of this effort will remain an inspector followup item
(50-289/86-03-12),
e. The team found that the Computer Assisted Records and Information
Retrieval System (CARIRS) was the established means of controlling
design documents that define or change the functional configuration
of TMI-1. EMP-016, " Plant Configuration Control Lists," established
the CARIRS method for maintaining plant configuration; however, the
team was concerned that there was no procedure for use of CARIRS as
- a tool for design, engineering, and general plant maintenance and
i
- 18 -
.__ _ _ _ . . _ ._ , _ . , . _ _ _ . _ _ _ _ _ _ _ _ . _ _ , _ . . _ _ _ _ _ ___ . . _ _ . _ _ . _ ,
'.
.
operations use. Discussions with licensee management representatives
revealed that use of and interpretation of CARIRS was n)t well under-
stood by TMI-1 plant personnel.
f. A sample of 20 as-built piping and instrumentation drawings (P& ids)
on file in the control room was checked for correct revision status,
and two P& ids were found to be out of date. This was contrary to
procedure EP-025, "As-Built Drawings," which stated that control
room drawings were to be maintained current to reflect actual plant
conditions. The affected drawings were:
P&ID 302-231 did not reflect the last three changes issued
for it (dated 8/85,11/84,10/85),and
- P&ID 302-660 did not reflect the last change issued for it
(dated 7/84).
The team was told that periodic audits were done by TMI-1 Design and
Drafting to assure control room drawings were up to date with no
change documents posted against them. However, the last audit was
done in July 1985.
This apparent failure to properly implement the requirements of
procedure EP-025 for control of as-built drawings in the control .
room will remain unresolved pending followup by the Region I Office
-
(50-289/-86-03-13).
g. Inconsistencies and errors in drawings and System Design
Descriptions were noted by the tean throughout this inspection.
1) Some of the drawings affected were:
Drawing Discrepancy
- 302-011 MS-V-13A & B shown as normally open, should
be normally closed;
MS-V-10A & B shown as normally open, should
bc normally closed;
- 600-520 Flow indicators were shown cross connected.
- 600-347 EFW logic did not show manual loader.
- 600-340 Old E/P converters were shown for both
EF-V-30A & B; backup t.ransfer switches
were not shown; remote transfer switches
were not shown; no reference was made to
either manual loader.
- 210-707 E/P converters shown for EF-V-30A & B when
E/I and I/P module combinations were actually
installed; this dwg was in conflict with
cable pull dwg 212-009-RF 126 for cables
RF 126 and 128 because E/P was shown on this dwg.
- 19 -
w - n--nx- s=..- .-.-_..w . - -. . . _ _ . - . _ ~ - - . . _ _, . _ _ - _ , . - ~ _ -
- -
.
- # 660-42-017 Dwgs showed + 10 volts supply to HIC-849/850
- 660-42-018 + 24 volts from power
when it was
supplies shown on 210 actually !959; dwg 017 showed l
,
alternate power from panel ATA, breakers 6
j and 16 when power actually came from ATB,
- breaker 15; dwg 018 showed alternate power
~j
from ATB, breakers 6 & 16 when it actually
came from breaker 16; dwg 018 did not show
output of HIC-850 connected to selector
,
switch; dwg also did not identify the transfer
switches by component identification number.
- 600-435 Relays 86-CVI and 86-1/CVI, contacts 3-1-4,
,i 7-6-5, 9-11-8 and 3-1-4 were shcwn twice with
different ITS designations in each case; these
relay contacts also appeared on dwg 600-319
,
and none were marked ITS.
t
- 600-346 Remote manual loader not shown
- 600-502 TB-4, connector 7 and 8 were identified with
conflicting information, i.e., cable RF 143 was
,
shown connected to HS-003/HY-003, but according
to 660-42-017, cable RF 147 connects to .
.
HS-001/HY-003.
- 302-273 Shows a solenoid enclosure on valves EF-V-30A
and EF-V-308, but these enclosures were not [
actually installed. This as-installed
'
arrangement was shown correctly on dwg 308-416.
'
However, these devices have been replaced with '
EQ I/P converters FY-849A and FY-8498.
p #302-271 Entire instrument air (IA) system was not depicted
! e392-273 on P& ids. Team walkdown found air users not shown
!
on dwgs and additional isolation valves, IA-V-98 and
IA-V-99, between IA system and two-hour backup
supply air system not shown on dwg. Dwg
302-273 indicated design pressures were 2500
psig u) to the regulating valves and 150 psig
!
from tiere on; but the FSAR indicated 2500 psig
up to the regulating valve. 600 psig between the
l regulating valve and the first switching valve,
and 150 psig from there on.
I
- 302-271 Seismic I/ Seismic !!! boundary between the
- 302-272 two-hour backup supply air system and the
i #302-273 instrumentation air / backup instrument air systemn
not shown
> r
i 2) Errors identified in the Division !! SDD 424C, "TMI-1 Two-Hour
l
Air Supply for Main Steam and Emergency Feedwater Controls,"
i
were:
! - 20 -
L __ -
_ . - . -_ - - - _ __ . - . .- - - - - - -
.
i
i
.
,
- -
J
'
-
- For EF-V-30A, the wrong valve number was listed for the
'
manual isolation valve between the I/P converter and the
- train A header of the two-hour backup supply air system.
For EF-V-8C, the wrong valve number was listed for the
manual isolation valve between the solenoid and train B
.
of two-hour backup supply air system. For EF-V-88, the
l
' wrong valve number was listed for the manual isolation
valve between the solenoid and trains A and B of the
two-hour backup supply air system. The correct valve
numbers were depicted on drawing 302-273.
EF-V-30A E/P and EF-V-30B E/P were identified as instrument
,
air users. However, these E/P converters were replaced by
< environmental qualified I/P concerters by long term
modification task LM-9. The correct instruments were
i '
FY-894A and FY-850B as shown on drawing IA-424-42-1000,
i
- The system relief valves were identified as CROSBY
J05-15-A when the valves were actually CROSBY J05-15-C.
The correct relief valve type was identified from
i nameplate data and was correctly shown on the valve data
sheet dated May 22, 1981. Likewise, the capacity of the
relief valve was listed as 48,000 scfh, while the nameplate
capacity was 87.660 scfh. ,
" * The 500 indicated that the high pressure instrument air
within the high pressure air storage bottles had a dew
l
point of less than or equal to -60*C. The team found that
a prncurement document for truck air specified a dryness
equivalent to -10*C. The actual dryness of the air supplied
,
was a -89'C. The Division I SDD required a dryness
a equivalent to that of the instrument air system (-40*C).
t
The SDD stated that no more than one train of the
two-hour backup supply air system can be out of service
at any one time and that this time shall be kept to a
)
minimum. The maximum length of time consistent with the
technical specification limit for one train of the EFW
l
system was not specified.
- While discrepancies such as the above will not necessarily lead to
design problems, they do make the documentation trail hard to follow
for determining actual design conditions. It appeared to the team
that while some of the examples cited were drafting or typographical '
errors, some were the result of the lack of proper updating of design
documentation. ANSI N45.2.11 requires tha,t personnel use proper and
current instructions, procedures, drawings, and design inputs. Design
documents and changes to them are to be controlled to ensure that
i
l
correct and appropriate documents are available for use. The drawing
deficiencies identified above and in Maintenance observation 5.b will
remain an unresolved item pending followup by the Region ! Office
,
(50-289/86-03-14),
h. Two other isolated areas of concern were identified by the team
i in the design change process.
I
I
- 21 -
._. - -_. -- . -__ -_. _ __ _ ._ . - - _ - _ - - - _ _ - . _ - . - . _ , _ _ - _ . . , - . - _ _ - . - . , _ . - _ - .
.
_
1) A minor design change was accomplished by a maintenance job
ticket when a section of the air supply line to valve EF-V-8A
_
operator wss removed. This modification was done without
following design change control measures required by EMP-019,
" Plant Modifications Proposed by Plant Engineering." The Plant
Engineering instructions attached to the job ticket made the
statement that this was not considered a modification per
EMP-019. The team considered this to be an incorrect judgment.
2) The temporary modification process of AP-1013. " Bypass of Safety
Functions and Jumper Control," was used for control of a jumper
on MS-V13B to defeat the auto start capability. The 10 CFR
50.59 evaluation for this modification was marked that no cnange
to the FSAR was required. However, Section 7.1.4.2.b of the
FSAR indicated that the turbine pump will auto start for train
6 actuation. This temporary design change defeated the auto
start capability and consequently affected the FSAR wording.
The team acknowledges that this was a temporary modification,
but one that definitely affected the FSAR.
B. Maintenance
1. Several strengths were noted in the THI-1 preventive maintenance program.
An extensive trending report was found to be routinely developed every 3 ,
months based on corrective maintenance activities performed over the
~
previous 12-month period. These reports identified problem areas on both
a system and component basis. A review of the PM activities conducted on
the non-safety-related integrated control system (ICS) revealed an ex-
tensive coverage of the system on a circuit by circuit basis, including
cleanings, calibrations, and refurbishments.
One weakness was found regarding preventive maintenance. Equipment
history records revealed that, prior to this inspection, preventive
maintenance had last been conducted on MU-V-16C, a high pressure injection
discharge isolation valve, in August 1981. The licensee's program identi-
fied this valve as requiring preventive maintenance every three years.
Licensee personnel advised the team that preventive maintenance was
conducted on this valve on the last day of the inspection, March 27, 1986.
2. A review was made of the licensee's program for the maintenance of motor-
operated valves (MOVs). The licensee was found to be aggressively pur-
suing the action items contained in IE Bulletin 85-03, " Motor-Operated
Valve Common Mode Failures During Plant Transients Due to Improper Switch
Settings." Design basis thrust values were being determined for MOVs and
subsequent MOV testing was being conducted with a load cell to ensure that
M0V torque switches were properly set to permit, the valves to achieve
their design basis thrust. The' licensee had completed this state-of-
the-art testing on 23 MOVs and planned to test approximately 70 more
during an outage starting in March 1986. Although the licensee's overall
program for maintenance of MOVs was determined to be adequate, several
specific concerns, discussed below, were identified.
a. The licensee had detailed procedures to cover the various aspects of
MOV maintenance. A review of these procedures revealed several
weaknesses.
l
- 22 -
.
.
(1) Procedure 1420-LTQ-2, "Limitorque Operator Limit Switch
'
Adjustment," Revision 8, described how to set the limit switch
that prevents an MOV from backseating while opening. This
procedure directed that this limit switch be set with the valve
slightly closed to allow for coasting of moving parts. This
was considered a weaknesses in that a more precise valve
position for setting this limit switch was not provided.
(2) Procedure 1420-LTQ-2 also described how to set the limit switch
that allows the valve to come off its shut seat without
tripping on high torque. This procedure directed that this
limit switch be set to remain closed for 3% to 10% of the valve
stroke time. This was considered a weakness because 3% of the
valve travel time may not be sufficient to overcome the
unseating forces on the valve. The licensee advised the
inspection team that this issue was currently under review and
that they expected to change the setting of this limit switch
to a more conservative 8% to 14% of valve travel.
(3) Preventive Maintenance Procedure E-13, "Limitorque Valves,"
Revision 12, directed the technician to jog the M0V to verify
proper direction of motor rotation. No direction was provided
as to how to jog the valve despite the fact that most MOVs have
a seal-in feature that prevents intermittent operation. .
-
The procedural weaknesses identified above were discussed with the
licensee and will remain an inspector followup item pending review
of the licensee's corrective action (50-289/86-03-15).
b. Weaknesses were noted regarding the control of M0V torque switch
se ttings . Equipment history records in some cases provided no
explanation for apparent changes in torque switch settings and, in
one case, indicated a change in a torque switch setting without
foreman review or approval. The following examples pertain.
(1) Maintenance was conducted on MU-V-168, a high pressure injection
isolation valve, on May 6, 1983. The data sheet for this
activity indicated "N/A" for the equipment history torque
values. The data sheet also indicated that the open torque
switch setting had been adjusted from 3/4 to 13/4 and the close
torque switch had been adjusted from 1/2 to 1 1/4. Despite the
fact that the data sheet provided places for review and approval
of these changes, neither was made. Additionally, the as-found
torque switch values, both less than one, were below the re-
commended values of 1 1/4 to 2 provided on the bill of materials
for this valve.
(2) Maintenance was conducted on MU-V-16D, a high pressure injection
isolation valve, on April 1, 1980. The as-found and as-left
values for both the open and close torque switch settings were
specified in the data sheet as 2 1/2. Maintenance was again
conducted on this valve on August 12, 1981. The as-found and
l
as-left torque switch settings were specified in the . data sheet
'
as open - 1 1/2 and close - 1 1/4. No records were available
providing an explanation or basis for the apparent change in
- 23 -
,
1
<
!
,
torque switch settings for this valve. Additionally, no torque
switch equipment history data was provided in the data sheets
indicating the correct values to which the torque switches
should have been set.
(3) Mainter,ance was conducted on MU-V-16C, a high pressure injection
isolation valve, on April 1,1980. The as-found and as-left
torque switch settings were specified in the data sheet as
open - 3/4 and close - 1/2. Main;enance was again conducted on
this valve on August 12, 1981. The as-found and as-Teft torque ,
switch settings were specified in the data sheet as open - 1 1/2
and close - 1 1/4. No records were available providing an
explanation or basis for the apparent change in torque switch
settings for this valve. Additionally, no torque switch equip-
ment history data was provided in the data sheets indicating the
proper values to which the torque switches should have been set.
Despite the weaknesses described above, the equipment history records
indicated that current torque switch settings were within the manu-
facturers recommended values. However, the team was concerned that
the administrative system to control and document M0V torque switch
settings may not be sufficient to maintain the new torque switch
settings being established through the analysis and testing process
described above. A licensee representative stated that MOV equipment
history records would be improved and updated to clearly identify the
~
correct torque switch setting for each valve. This issue will remain
an inspector followup item pending review of the licensee's cor-
rective action (50-289/86-03-16).
3. A weakness was noted in the maintenance procedures for replacing the
packing in the emergency feedwater (EFW) pumps. A review of maintenance
activities since January 1985 revealed several recent occasions when
corrective maintenance was conducted on EFW pump packing:
September 18, 1985 - Sone packing wa removed and adjusted on the
outboard side of the turbine-driven EFW pump.
t
December 9, 1985 - The outboard packing gland of turbine-driven EFW
pump was repacked. The packing and lantern ring
were found to be installed in such a way that
the cooling water supply to the stuffing box
was blocked. Additionally, the lantern ring
was found to be warped, which may have caused *
increased heat to be generated in the stuffing
box due to metal to metal contact.
April 4, 1985 - Someoftheinboardpickingwasremovedand
adjusted on EFW pump 2A.
The activities described above were conducted using generic procedures
1410-P-1, " Repack Pump," and 1410-P-2, " Add Packing to Pumps and Adjust
Packing Glands." These procedures were " generic" in the sense that they
were written to be applicable to a variety of pumps. The team considered ,
these procedures weak for use on EFW pump packing because they failed to
describe the method of installing the packing and lantern ring combination
.
- 24 -
.
., . , - - - - - - - - . . - - . . - . . . . - .
-
.
.
so as not to block cooling water flow into the stuffing box. This problem
~
had occurred, as identified above, during the December 9,1985, maintenance
activity. The generic packing procedures also did not identify the specific
combination of ribbon and braided packing to be used for the EFW pumps and
did not provide tolerances for the EFW pump packing lantern rings, again
related to a problem identified during the December 9,1985, maintenance
activity.
A licensee representative stated that improvements would be.made to the
procedural controls governing maintenance on EFW pump packing. This issue
will remain an inspector followup item (50-289/86-03-17).
4. The program for the use of vendor technical manuals as maintenance
procedures was reviewed. In general, this program was considered
acceptable. Numerous manuals had been reviewed and edited to provide
assurance of their applicability to specific installed components at
TMI-1. Procedure 1407-1, " Unit-1 General Corrective Maintenance
Procedure," Revision 24, contained clear requirements regarding the use
of technical manuals. This procedure allowed the use of a controlled
technical manual for the conduct of maintenance without further en-
gineering review of the manual. This procedure further required that,
when a non-controlled manual is used, engineering review and concurrence
be obtained to verify such things as torque values, dimensions and
tolerances, and proper lubricants. .
- A weakness was noted regarding the use of technical manuals. Instrument
calibration procedures generally stated that, if as-found data are out of
tolerance, the affected instrument is to be repaired using a specific
vendor manual referenced in the calibration procedure. Such vendor
technical manuals referenced in these procedures were found not to be
controlled in 2 out of 10 cases checked. The two uncontrolled manuals
were "Rosemont Model 1151 Level Transmitter," identified in Procedure
1302.5.15, " Core Flood Tanks Pressure and Level Channels," Revision 8;
and " Bailey Instrument Manual E92-79 (Bailey Buffer Module)," identified
in Procedure 1302.5.18, "High and Low Pressure Inspection Flow Channel,"
Revision 10.
This issue will remain an inspector followup item pending licensee review
and control of the two manuals identified above and further review of the
use of potentially uncontrolled technical manuals in calibration pro-
cedures (50-289/86-03-18).
5. The inspection team conducted a detailed walkdown of the EFW system to
verify that the system layout was as depicted in the system drawings, to
ensure that the system was aligned as required by licensee procedures, to
review component accessibility, and to evaluate the material condition and
cleanliness of the system. The team observed that the licensee had
expended considerable effort maintaining the general cleanliness and
material condition of the plant and the EFW system in particular. ,
Several weaknesses were noted:
a. The washer on an installed concrete expansion anchor on pipe support
EF-18 was loose and could easily be rotated by hand. This could
indicate an improperly installed anchor bolt. This issue will remain
unresolved pending followup by the NRC Region I (50-289/86-03-19). 1
- 25 -
_
.
.
1
- b. Actual component layout differed from the EFW system drawing, 5130
302-082, Revision 7, in several minor instances. Specifically:
(1) Pressure guages installed downstream of EF-V-48A and EF-V-50A,
EFW pump packing cooling supply valves, were not shown on the
system drawing.
(2) The location of EF-V-56, a drain valve on "A" EFW discharge
header, was different from that indicated on the system drawing.
(3) Part of the section of 6-inch diameter piping between EF-V-2A
and EF-V-30A was indicated on the drawing as 4-inch diameter
piping.
(4) The "B" condensate supply check valve, C0-V-168, was incorrectly
labeled C0-V-16A. Similarly, the "A" condensate supply check
valve C0-V-16A was incorrectly Iaoeled C0-V-16B.
(5) Check valve EF-V-198 was mislabeled EF-V-198.
Additional drawing deficiencies were identified in Design Changes
and Modifications observation 3.g.
c. EF-V-36A and B, EFW pump packing cooling valves, were identified in ,
the system valve lineup, Enclosure 1 to EFW Operating Procedure 1106-6,
~
as being throttled. These valves were not locked nor were their
approximate positions identified on the valve lineup. The team was
concerned that there appeared to be no way that the correct position
of these valves could be verified without operating the system.
d. The inspection team noted that the location and orientation of
EF-V-54, a recently installed motor-operated block valve for EFW flow
control valve EF-V-308, restricted manual valve operability due to
the valve handwheel's distance above the floor and proximity to a
wall. This observation was considered significant because the
licensee had deenergized the motor-operator to EF-V-54 and intended
to treat it as a manually operated valve. This will remain an
inspector followup item pending determination that the valve can be
manually operated (50-289/86-03-20).
. C. Operations
Procedures and system drawings relating to nonnal and abnormal operations of
the emergency feedwater (EFW) system and the integrated control system (ICS)
were reviewed in detail. The inspection team performed system walkdowns and
verified procedural adequacy. Equipment was observe,d in operation, valve
positions and equipment readiness were verified, and operator perfonnance
was observed.
1. Control room observations revealed the following strengths:
a. Operators were considered to be both knowledgeable and professional.
Control room activities were properly conducted. Conmunications were
!- both clear and concise.
- 26 -
_.
.
E
'
b. Shift turnovers were observed to be thorough. Similarly, the brief-
ing given to the on-coming shift on in-progress and planned work
activities was comprehensive.
c. Interviews with operators and observations of operational and
transient evolutions revealed they were knowledgeable concerning
the ICS, including operating procedures, failure modes, and emergency
procedures. The team noted that there were typically only four to
six control room annunciator alanns lighted during plant operation.
2. Weaknesses were observed relating to out-of-specification operator log
data entries. Specifically, the team identified examples where
out-of-specificaiton log data entries were not circled as required
by the instructions on the affected log sheets;
- explanatory notes were not made on the log sheets for out-of-
specification data entries as required by procedure 1001 G,
" Procedure Utilization," Revision 11; and
- log sheet discrepancies, such as those noted above, went uncorrected
and apparently unnoticed during shift turnover reviews of the logs
by the shift foreman and the on-coming operator. .
.
The most significant example noted by the team of recent problems with
out-of-specification log data entries occurred on February 6 and 7,1986,
when five consecutive operating shifts recorded decreasing EFW two-hour
backup supply air system supply pressure readings (1100, 800, All 580,
five 420,
of
and 400 psig) in the Secondary Auxiliary Operator's Log.
these readings were below the specified acceptance criteria of 1700 psig.
Further, the operators had not circled these out-of-specificaiton readings
and had made no explanatory log entries regarding the condition. The
problem was corrected on February 7,1986, when an operations engineer
reviewing the log sheets questioned the data entries, investigated, and
found a closed truck supply valve. The operations engineer opened the
valve to correct the decreasing pressure condition that had been indicated
for the five shifts by the logged data entries. The team noted that
during the five shifts in question the two-hour backup supply air
~
syctem's bottle pressure met procedural acceptance criteria required for
system performance.
In addition to the examples discussed above, the team noted several other
isolated instances where out-of-specification data entries in the Primary
and Secondary Auxiliary Operators' Logs were not circled during the
period of March 1-9, 1986. Of particular concern to the team for each of
the examples noted was that the discrepancies had not been identified and
corrected during the shift turnover process as required by procedure 1012,
" Shift Relief and Log Entries," Revision 26.
The weakness noted regarding the handling of out-of-specification log data
entries were discussed with the licensee and will remain unresolved
pending followup by the NRC Region I Office (50-289/86-03-21).
!
- 27 -
_ - - , -
-
.
- \
2
3. The inspection team identified deficiencies related to the procurement
of make-up instrument air for the EFW two-hour backup supply air system
which was being supplied continuously from a truck. This system was
identified by the licensee as being important-to-safety,
a. Air for this system was being procured under a purchase order
(TP-035330) with a safety classification of not-important-to-safety.
Consequently site QA engineering did not review the purchase order,
b. The purchase order specified " dry compressed air in bulk industrial
grade with a dew point less that or equal to -10 Deg. C at 100 psig."
The TMI-1 FSAR (Sections 9.10.3.2 and 9.10.1.1) requires that this
air to have a dew point of at least -40 F at 100 psig, filtered to
0.9 micron. The purchase order therefore specified an incorrect and
nonconservative dew point (-10*C is equivalent to -14 F) and failed
to invoke the filtration requirement.
c. The Secondary Auxiliary Operator's log specified, for the instrument
air system, a dew point reading range of -60 C to -10 C; and required
notification of the Shift Foreman when the dewpoint exceeded -10 C.
This upper limit of -10 C was not consistent with the upper limit of
-40 F specified in the FSAR.
Despite the lack of adequate administrative controls for the procurement
of backup instrument air, the team noted that the air was supplied by the'
~
vendor at a dew point of -128 F at 100 psig filtered to 0.1 micron which
exceeded the specification of the FSAR. Prior to the completion of the
inspection, the licensee had requested a Certificate of Conformance from
the vendor and was taking neasures to ensure that future air purchases
were made under an important-to-safety purchase order. This issue will
remain unresolved pending inspector review of the implementation of the
licensee's proposed corrective actions (50-289/86-03-22).
4. The team noted a minor weakness regarding the licensee's controls for
lifted leads, jumpers, and temporary modifications that affect safety-
related plent equipment. Procedure AP 1013, " Bypass of Safety Functions
and Jumper Control," Revision dated 10/23/85, required that existing
lif ted leads, jumpers, and temporary modifications be re-evaluated every
12 months using a fonn entitled, " Safety Evaluation / Design Review". This
new safety evaluation was required to be included with the original
safety-related evaluation in a log maintained in the control room. A
review of the log revealed that the licensee's practice was not to re-
submit a new Safety Evaluation / Design Review, but rather to initial or
sign and date the existing safety evaluation, thereby indicating that the
12-month re-evaluation had been performed. This item will remain unresolved
pending followup by NRC Region I (50-289/86-03,23).
D. Surveillance and Testing
The team reviewed the testing associated with assuring functionality of the
emergency feedwater EFW system, the two-hour backup supply air system, and the
integrated control system (ICS). In particular, the team sought to determine
! that system components had been adequately tested to demonstrate that they
could perform their safety functions under all conditions.
- - 28 -
.
.
.
1
'*
1. EFW system surveillance test (ST) procedures were found to be generally
adequate for demonstrating system functionality. However, the team
identified the following two weaknesses:
a. The monthly surveillance test of the turbine-driven EFW pump (ST
1300-3G A/B, Revision 21) was performed only after ensuring that
the steam supply lines were drained of condensate. This practice
appeared to create an artificial initial condition for the sur-
veillance test. The team noted, however, that the auxiliary
operators were instructed to blow down once per shift all steam trap
drains in the intermediate building where the turbine-driven pump is
located. This once-per-shift blow down policy was incorporated into
the auxiliary operators' logs and was intended to limit the amount
of condensate in the steam supply lines. The team was concerned
that the licensee was unaware of the effect that residual condensate
in the steam supply lines would have on the turbine-driven EFW ptmp
in the event of an automatic start.
b. The FSAR (Section 10.8.2.2.f) stated that the EFW system " flow test
is conducted with the EFW system valves in their normal alignment."
Technical Specifications (Section 4.9.1.6) governing EFW system
periodic testing placed no restriction on EFW valve alignment. In
practice, surveillance procedure ST 1303-11.42 isolated the in-
dividual pump being tested from other portions of the system not in .
the flow path to the steam generator being fed. Therefore, the EFW
-
pump discharge check valves (EF-V-11A, EF-V-11B, and EF-V-13) were
verified to pass flor, but their ability to seat and prevent reverse
flow was not periodically tested. The team was concerned that
isolating these check valves during pump flow surveillance testing
created an artificial initial condition that would prevent reverse
flow leakage past these valves from being considered. The team noted
that these check valves were part of a mechanical maintenance task
(>fi-000031) which required one EFW check valve to be disassembled and
inspected annually in a 5-year cycle. Although this activity was not
included in the licensee's inservice inspection and testing program,
it would, if implemented as intended, provide some assurance that the
discharge check valves would perform their intended function.
Licensee records indicated that this maintenance activity had not yet
been conducted on the EFW pump discharge check valves.
The two concerns listed above regarding EFW pump surveillance test
procedures were discussed with the licensee and will remain an unresolved
item pending followup by the NRC Region I (50-289/86-03-24).
2. The EFW two-hour backup supply air system was tested as part of its
modification acceptance process, but discussion.s with licensee personnel
and review of records revealed that no further testing had been performed
and no future testing of this system was planned. Specific examples of
testing weaknesses are discussed below:
a. Proper operation of the EFW two-hour backup supply air system was
found to depend on 10 identical isolation check valves that were
located at various points along the interface with a non-seismic air
system. These valves were not routinely tested and under normal
operating conditions experien:e no differential pressure. Two of
- 29 -
.
.
s
these untested valves (IA-V-1451 and IA-V-1460) were of particular
.
concern since they were located where a single failure following a
seismic event could depressurize both trains of the EFW two-hour
backup supply air system (See Design Changes and Modifications ob-
servation 1.b for further details). The failure of any of the
other eight untested valves could blow down the single train of air
supply associated with the failed valve.
b. The control of each EFW flow-control valve (EF-V-30A and EF-V-308)
was found to depend on the repositioning of a three-way air valve
(IA-V-1344 and IA-V-1440) to the EFW two-hour backup supply air
system. These three-way valves were not routinely tested.
c. The ability of the EFW system flow-control valves to fail in a safe
manner depended on a small pressurized air flask located at each flow-
control valve. Each air flask was protected from depressurizing
by a check valve, but those check valves were also not routinely
tested.
In summary, the availability of the EFW two-hour backup supply air system
and the fail-open feature of the EFW flow-control valves were dependent
on valves which were not tested in the position required to fulfill their
function. This weakness was discussed with the licensee and will remain
an unresolved item pending followup by NRC Region I (50-289/86-03-25). .
~
E. TRAINING
The team considered the management commitment to training at TMI-1 a strength.
This commitment was evidenced by the corporate training policies and plant
procedures establishing goals, priorities, resources, and authority regarding
the implementation of training. However, the most notable evidence of the
licensee's commitment to training was the quality of the various training
activities observed by the team. Details are provided in the following
observations.
1. The quality of the licensed operator requalification training programs
was considered a strength due to the following observations:
a. The requalification classroom training program was well balanced
between significant topics and review of plant and industry exper-
ience. There appeared to be effective communications between the
operations department and training staff.
b. The requalification program training materials generally consisted
of high-quality lesson plans, video aids, and trainee handouts.
c. The attendance at requalification training' sessions, including
off-shift licensed personnel, was determined to be consistently
good.
d. The requalification program weekly quizzes were comprehensive, and
a check of the grading against the examination key revealed no
discrepancies.
- 30 -
_
,
O
2
e. Annual requalification examinations were reviewed for compre-
'
.,
hensiveness, difficulty, and grading. The examinations were
determined to be challenging and had a good balance among various
types of questions, such as true and false, fill-in-the-blanks,
multiple choice, and essay questions. The grading of the
examinations was found to be adequate.
f. The inspector observed portions of the annual requalification train-
ing on the B&W Simulator by the licensed operators of one shift. The
inspector observed the shift's response to five abnormal plant drill
conditions and noted that the shift personnel displayed good team
work, excellent communications, procedure utilization, and rapid
identification of the problems. The drills were video taped with
sound to assist the shift in critiquing their actions. Additionally,
the inspector noted that senior plant management representatives
routinely participated in portions of simulator training. Their
primary function was to monitor and evaluate the perfonnance of the
operators being trained.
g. The Basic Principles Trainer provided strong reinforcement for
classroom and simulator training by demonstrating the effects of
individual instrument or component failures. The Basic Principles
Trainer appeared to be particularly effective in training operators
to recognize and respond to Integrated Control System (ICS) failures '
and for technicians to diagnose ICS failures.
.
h. The Operational Experience Feedback Program was comprehensive and
readily provided information to the plant staff by means of required
reading, training letters, and requalification lectures. Lessons
learned from reactor trips due to personnel errors and equipment
failures were emphasized as part of this program, with particular
emphasis placed on errors caused by failure to adhere to procedures.
1. S' .ificant plant modifications were incorporated into the requalifi-
cation training program and taught prior to plant startup. Informa-
tion on modifications that had only minor impact on plant operations
was provided to operating shifts by training letters,
j. Drills to practice cooldown from outside of the control room were
conducted annually. These drills appeared to be comprehensive and
covered:
(1) immediate control room evacuation, with all shutdown and
cooldown actions performed outside of the control room; and
(2) the initiation of a reactor trip and emergency boration prior
to leaving the control room. Personn'el performance during
these drills was evaluated by operations and training supervisors.
2. The team reviewed the emergency feedwater and the instrument air sections
of the Operating Plant Manual (OPM). The OPM was used as a reference
manual for training. No errors were found in the emergency feedwater
section; however, the instrument air section contained several errors.
These errnrs were not found in the instrument air lesson plan, and no case
was found where the OPM was directly used for training presentations.
- 31 -
.
.
4
.. 3. The instructor initial and advanced training courses were considered a
s trength. The initial instructor development course, taught semiannually,
was a comprehensive basic course conducted by the Training and Educational
Section. All operator training instructors were required to attend this
course. A review of records revealed that all operator training in-
structors had completed the initial training and most had attended the
advanced training courses.
4. Maintenance staff training was considered a strength due to the
indoctrination training program, the frequency of training, subjects
taught, vendor training, on-the-job training, and the selection and
training of instructors. The following observations were made:
a. The two-week indoctrination program appeared to be effective in
providing maintenance personnel with an overview of plant systems,
basic plant safety, and maintenance fundamentals.
b. The continuing training program for maintenance personnel appeared
to be effective and comprehensive. Maintenance personnel typically
attended one week of classroom training during each six-week rotation
cycle. The training topics included: industry experience, admin-
istrative procedures, and craft-specific training.
c. The Instrument and Control technicians had implemented a compre-
hensive entry level-to-journeyman qualification program, referred to'
'
as the Automatic Mode of Progression (AMP) Program. This program
required a technician to pass written tests and practical examina-
tions for advancement. In addition, a technician was required to
satisfactorily complete a requalification program, including a
written examination, every two years. Failure to successfully
complete this program could result in reassignment.
F. Quality Assurance
1. The Quality Assurance (QA) program was found to be generally strong and
effective. The team determined that the QA program exceededQA the minimum
auditors,
requirements of 10 CFR 50, Appendix B and ANSI Standards.
inspectors, and monitors appeared to have the necessary training and
experience to identify many of the design and design control problems
found by the NRC inspection team. An example of a GPUN audit with tech-
nical findings in the design area was a recent corporate audit of en-
gineering design calculations (Audit 0-COM-85-08). This audit resulted
in three findings and 14 recommendations regarding technical issues.
Other examples where audits produced in-depth technical findings were the
corporate audits of the GPUN Architect Engineer, Gilbert Commonwealth Inc.
(Audits 0-TMI-86-01 and 0-TMI-84-01). Likewise, on-site audits and
monitor reports uncovered some technical and de' sign problems similar to
those identified by the NRC inspectors. Overall, it appeared that the
GPUN QA organization was fully capable of identifying in-depth technical
and design issues.
2. Despite the demonstrated capability of the corporate audit group as
discussed above, the NRC inspection team identified design problems that
had not been previously discovered. Examples were the design and design
control problems with emergency feedwater (EFW) upgrade modification task
- 32 -
__ ,
,
.
'= RM-13H (see Design Changes and Modifications observation 1). Engineering
review by the corporate QA Design and Procurement Section apparently was
not in sufficient technical depth to reveal the deficiencies identified by
the NRC team.
In addition, a corporate audit of design control
(0-TMI-84-06) reviewed this modification as one of a sample of seven, but
identified only programmatic and procedural issues rather than technical
problems. Another example of a design review deficiency that had not been
previously identified related to theTheNRC team finding tha
on-site QA
Design Changes and Modifications observation 3.b).
engineering section design review of mini-mods failed to identify this
prograrunatic weakness.
3. The inspection team found efficient and effective systems in place at
TMI-1 to track and provide management review of actions required to
correct deficiencies identified by the QA organization and other sources.
Corrective actions by site personnel were usually prompt and complete.
Corrective actions by corporate groups appeared to take more time and An did
not seem to be as consistent in resolving the identified problems.
example of a deficiency where timely, effective corrective action did not
appear to have been taken by the responsible The licensee corporate
Changes and Modifications observations 3.d, 3.f, and 3.g).
was cited by the NRC in 1981 for eight instances of non-compliance due to -
improper drawing control. Corporate and site audits of design control,
,
drawing control, the construction and modification program, plant
engineering, and other areas had repeatedly identified discrepancies inThe
drawings and the drawing control process. verified that these drawing pro
action had apparently been ineffective.
4. The inspection team assessed the licensee's independent technical and
safety review process with emphasis on the activities of the P
Group (PRG)."GPU Nuclear Safety Review and Approval," which provided corpora
and controls for independent safety reviews, and TMI Division Procedure
1034, " Plant Review Group." This review verified that these procedures
satisfied the requirements of Technical Specifications with regard to
plant safety reviews.and an interview with the Manager, Nuclear Safety (who was
site safety reviews) revealed that the on-site review program apparently
adhered to these procedures.
Additionally, the NRC inspection team did
not identify evidence of deficiencies in the safety reviews perfonned by
the Plant Review Group. The training of the GPUN safety reviewers during
1985 was examined and was found to be satisfactory.
IV. MANAGEMENT EXIT MEETING
An exit meeting was conducted on March 27, 1986, at TMI. TheAn additional exit
licensee's
meeting was conducted on April 7, 1986, at Bethesda, MD.
representatives at each of these meetings are identified in the Appendix.
Mr. James M. Taylor, Director, IE; Mr. James G. Partlow, Director, Division
of Inspection Programs, IE; and Mr. H. B. Kister, Branch Chief, NRC Region I,
- 33 -
. _ _. _ . - . . - -
.
.
.
- l :
, -,
attended the March 27, 1986 exit meeting. The scope of the inspection was
j discussed, and the licensee was informed that the inspection would continue
i
with further in-office data review and analysis by team members. The licensee
was informed that some of the observations could become potential enforcement
findings. The team merrbers presented their observations for each area in-
spected and responded to questions from licensee's representatives.
.
i
l
I
.
l .
4
I
o
t
- 34 - l
1
l
- ..-- - -- _.. ., ,,_ _ _ _ _. _ _ . _ _ _ _
,
,
.
APPENDIX
,
Persons Contacted
The following is a list of persons contacted during this inspection. There
were other technical and administrative personnel who also were contacted.
All personnel listed are GPUNC employees unless noted otherwise.
+*R. F. Wilson, Vice President, Technical Functions
+D. K. Croneberger, Director, Engineering and Design
- H. D. Hukill , Director, TMI-1
- R. J. Toole, Operations and Maintenance Director
- 0. T. Shalikashvili, Manager, Plant Training
- N. C. Kazanas, Director, QA
- M. A. Nelson, Manager, Nuclear Safety
- R. J. Chisholm, Manager, Electric Power and Instrumentation
- F. P. Barbieri, TMI-1 Secondary Plant Manager
- G. R. Capodanno, Fluid Systems Director
- W. Behrle, Director, Startup and Test
- T. M. Hawkins, Manager Startup and Test
- C. W. Smyth, TMI-1 Licensing Manager
,
- R. J. McGoey, Manager, PWR Licensing
- J. J. Colitz, TMI-1 Plant Engineering Direc.or
,
- R. E. Neidig, Communications
- D. V. Hassler, Licensing Engineer
- C, A. Shorts, Manager, Technical Functions
- R. J. Smith, Project Manager, Gilbert Commonwealth, Inc.
- J. H. Brendlen, Jr., Project Engineering Manager, Gilbert Commonwealth, Inc.
D. Shovlin, Manager, Plant Maintenance
P. Snyder, Preventive Maintenance Manager
R. Harper, Corrective Maintenance Manager
J. Bowman, Lead Electrical Foreman
R. Natale, Lead Mechanical Foreman
C. Hartman, Manager, Plant Engineering
B. P. Leonard, Operator Training
R. W. Zechman, Technician Training
M. J. Ross, Plant Operations Director
H. B. Shipman, Senior Operations Engineer
D. W. Atherholt, Operations Engineer
L. L. Ritter, Plant Operations Administrator
C. Incorvati, QA Audits Supervisor
J. Fornicola, QA Systems Engineering Manager ,
J. Marsden, QA Engineering Manager
L. Wickas, Operations QA Manager
1
- Attended exit meeting on March 27, 1986.
+ Attended exit meeting on April 7,1986
- 35 -
.
.
_,' G. Sadavskas, Technical Functions I&C Manager
S. Divito, Design and Drafting Supervisor
D. G. Slear, Engineering Services Director
D. J. Shivas, Engineering Data and Configuration Control Manager
R. L. Summers, Plant Engineering and Mechanical Engineer
J. H. Horton, Engineering Mechanics, Engineer
J. W. Schmidt, Radiological Engineer
S. Ku. Technical Functions Mechenical Systems Engineer
.
.
- 36 -