ML20202J722

Notice of Violation & Proposed Imposition of Civil Penalty in Amount of $2,100,000.Violation Noted:Licensee Did Not Translate Design Features Into Work Instructions & Did Not Verify Adequacy of Designs

ML20202J722
Person / Time
Site:	Millstone
Issue date:	12/10/1997
From:	NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:
Shared Package
ML20202J663	List: IR 05000245/1950336 ML20202J722
References
EA-96-034, EA-96-067, EA-96-086, EA-96-106, EA-96-145, EA-96-183, EA-96-197, EA-96-198, EA-96-331, EA-96-332, EA-96-333, EA-96-34, EA-96-350, EA-96-351, EA-96-352, EA-96-67, EA-96-86, EA-97-141, NUDOCS 9712110226
Download: ML20202J722 (29)

Text

.-

i. NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF civil PENALTIES Northeast Nuclear Energy Company Docket Nos. 50 245, 336,423 Millstone Station Units 1,2, and 3 Lloonse Nos. DPR 21, DPR 65, NPF 49 EA Nos.96-034; 96-067;96-066; 96 106; 96 145;96-183; 96 197; 96 198; 96 331; 96 332; 96 333; 96 350; 96 351; 96 352;97-141 During NRC inspections conducted between October 24,1995, and December 31,1996, vloistions d NRC requirements were idered. In accordance with the " General Statement of Policy and Proccdures for NRC Enforcement Actions," NUREG-1600, the Nuclear Regulatory Commission proposes to impose civil penalties pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act),42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalties are set forth below:

1. -

VIOLATIONS RELATED TO INADEQUATE ENGINEERING A. ERRORS IN DESIGN BASIS DOCUMENTS 10 CFR Part 50,' Appendix B, Criterion lil, " Design Control," states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into

' specifications, drawings, procedures, and instructions. These measures shall include provisions to assure that appropriate quality standards are specified and included in design documents and that deviations from such standards are controlled. Additionally, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of attomate or simplified calculational methods, or by the performance of a suitable testag program.

Contrary to the above, the licensee did not translate design features into work instructions, did not verify the adequacy of designs, and did not adequately establish design measures, as evidenced by the following examples, each of which constitutes a separate violation.

1?' in 1978 and 1988, spent fuel pool (SFP) rarack modifications were made at Unit 1; however, the licensee did not translate the 0.5 inch diameter siphon break hole design feature into proper work instructions for incorporation into the modified SFP retum piping. As a ,uutt, the licensee operated the SFP cooling system without the siphon break holes until the situation was identified by the licensee in August 1995, and corrected in November 1995. (01012)

~'

Violations annotated with an asterisk (*) are violations occurring beyond the pys year statute of limitations period for assessing civil penalties or are violations for which definitive dates to establish their cccurrence are unavailable to determine the statute of limitations' applicability. In either case, these violations were not considered for purposes of determining any c! Al penalties.

h N 5

i.

No

• cf Vi:lation 2

2. In January and February 1994, the licensee did not properly translate a design requirement into adequate instructions for tb4 reactor building component cooling water (RBCCW) system at UnV,1. Specifically, various design information, such as valuss of RB0CW flow and temperature, was provided by the licensee to one of its vendors (Hohoc) to perform analyses to define acceptable hold times prior to fuel movement during refueling outage (RFO) No,14. These hold times were then incorporated into Special Procedure (SP) 9417 which was used to perform a Unit 1 full core omond during RFO 14. Although -

the licensee instructed Holtec to use a normal (expected) RBCCW flow of 1250 GPM in their analyses, there were no specific instructions in SP 9417 for the operators to control RBCCW flow to 1250 GPM. (01022)

3. As of March 14,1996, the licensee did not identify design inputs potentially impacting the Unit 1 SFP cooling system flow model which had been developed by its vendor (Holtec) to technically support a license amendment request describing the use of a shutdown cooling (SDC)/SFP cooling system cross-connect modification. Specifically, the temporary TriNuclear filter assembly located and used in the SFP was not evaluated for its impact on the thermal and hydraulic design work performed in 1995 in support of the license amendment. Also, the SFP cooling system flow model had not been updated to reflect recent piping changes that installed a thermal expansion loop. In addition, the licensee dki not implement adequate design verification activities regarding the Unit 1 SFP cooling system flow model developed ' 'its vendor in that the SFP cooling system flow model was not formany vertfied against actual plant data. (01032)

4. As of March 11,1996, design control measures associated with a tempo 1ery modification (bypass jumper 2 95-045, dated April 14,1995) to the Unit 2 reactor building closed cooling water (RBCCW) surge tank, were inadequate to assure seismic capability. Specifically, Calculation 95 ENG 1198 M2, Revisions 1 and 2, dated April 14,1995, and April 3, 1996, respectively, used to support the modification, contained numerous errors in assumptions and calculations, including inaccurate bolt dimensions, omitted seismic loads and nonconservative response spectra. Also, the installed design was not in accordance with the approved temporary modification design package, in that the installation included the use of ropes and hoists (rigging). (01042) 5.

Design control measures were inadequate to assure that the design basis requirements for the Unit 2 post accidant hydro 9en monitoring system and post accident sampling system were maintained.

Spec fically, in October 1995, the licensee identified that these systems did not meet the single failure criterion because a loss cf one vital 125-vDC bus would render the system inoperable because a flow path could not be established in that both trains of containment monitoring are isolated; however, instead of correcting the deficiency, the licensee

I s

Notice of Violation 3 implemented a procedure change and a bypass jumper as a

! compensatory measure on January 12,1996, and that compensatory

measure did not preserve the design basis. (01052) t

6. Design control measures were not adequately established for the steam j

generator replacement modification (ABB-CE Calculation 006 AS92-C.

010, " Millstone Unit 2 LOCA Containment Pressure / Temperature  !

Analysis for Steam Generdor Replacement," dated October 15,1992), i j

as evidenced by the foNng examples' 4

s. NUREG 0737 (committed to by the licensee and confirmed by l Order, dated July 10,1981), item ll.F.1.6, " Containment Hydrogen Monitor," stated that if an indication is not available at  ;

all times, continuous indication and recording must be functioning within 30 minutes of the initiation of safety injection.

i On March 14,1983, NRC issued an Order confirming the

! licensee's commitments on post TMI related issues that i

indicated that item ll.F.1.6 was completed. In a letter dated j

March 27,1984, the licenses stated that it was unable to satisfy the 30 minute requirement of NUREG 0737, item II.F.1.6,

{ because the hydren monitors must remain isolated until containment pressure is between 0 and 10 psig. The letter 1'

stated that containment pressure for the design basis Loss of j ,

4 Coolant Accident (LOCA) will be less than 10 psig in approximately three hours after the initiation of the event.

However, due to the resulting higher peak containment pressure from the modification, the hydrogen monitors could not be placed in service for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. ,

i

b. NUREG 0737, 'TMI Action Plan Requirements,' Item II.B.3,

~.

! " Post Accident Sampling Capability,' requires the capability to promptly obtain reactor coolant and containment atmosphere i samples. The combined time allotted for sampling and analysis should be three hours or less from the time a decision is made

[;

to take a sample. In a letter to be NRC, dated November 1, 1982, the licensee stated thN the entire r> 3pling operation, including preparation, sample incirce Mui sample isolation.

purge of the system piping, s6mple rt.Wyg transport to the

chemistry laboratory, and analysis, for botn reactor coolant and containment air samples, can be completed within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. In a safety evaluation report (SER) dated June 14,1984, the NRC

{

- stated that based on a review of the licensee's letters dated January 12 and April 19,1984, the provisions of NUREG 0737,

- Hem ll.B.3 were satisfied The SER stated that the licensee has provided the capability to promptly sample and analyze -

containment atmosphere samples within three hours from the i

time the decision is made to take the sample. However, due to 4

the resulting higher peak containment pressure resulting from

[ the modification, the licensing basis requirement to promptly I

i i

i

-+.-ce-,,-:,--, - c-y,- . --,,,..,3., , -mw,%- - . - , - ,,m_,,~m. ...,,,,,_m------.- -

- - . , , --- - ,n.. w--,,-yw,.rmm_mm,,.,e-, .. . . - ,

Notice of Violation- 4 sample and analyze containment atmosphere samples within three hours could not be met because the containment atmosphere post accident sampling system could not be placed in service for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. (01062)

7. Design control measures were inadequate to assure that the Design Basis Documentation Packages (DBDPs) at Units 2 and 3 were adequate source documents for design applications. Nuclear Generation Procedure (NGP) 5.28, " Development, Review, *)pdate and Use of Design Basis Documentation Packages (DBDPs)," hovision 1, dated August 2,1994, states that DBDPs are quality related design documents and are acceptable for use during safety related design

• applications. The HU Design Control Manual states that design input source documents include DBDPs. However, as of March 20,1996, programmatic inadequacies were identified in the development, revision, and control of DBDPs, in that DBDPs were developed using information spot checks with little field verification, were not being updated through the design change notice (DCN) process, and were not being maintained as quality records. (01072)-

8.* Design control m.asures associated with Engineering & Design Coordination Report T-P-06677, dated August 1,1985, were inadequate. Specifically, T-P-06677 introduced two 0.375-inch restricting orifices, RO 153A and B, into the Unit 3 service water (SW) system without assuring that the system would still adequately mitigate water hammer effects (a previous calculation Stone and Webster Engineering Corporation (SWEC) P(T)-1070, dated January 26,1985, found that a 0.5 inch orifice was acceptable). (01082)

9. Design control measures associated with temporary modifications at Unit 3, namely, housekeeping filters taped on battery room fire dampers 3HVC'DMPF33, 38,40, and 43, were inadequate to assure operability of the fire dampers. Specifically, filters were installed in 1984 without any measures to ensure that the ventilation systems would provide adequate ventilation or that the dampers would be able to close in the event of a fire. The condition existed until April 1995 when Calculation 95-ENG 1109 MS evaluated the filter impact on air flow to the battery rooms and concluded that the ventilation systems in the battery rooms ,

could adequately ventilate the rooms with clean filters installed.

However, as of May 20,1996, the lack of acceptance criteria for the cleanliness requirements for the air filters, and the impact on the operation of the fire dampers, had not been evaluated. (010g2)

10. Design control measures were inadequate to assure operability of the Unit 3 turbine driven auxiliary feedwater (TDAFW) pump following a

- loss of all electrical power. Specifically, Calculation g1-074 324M3, .

dated March 1,19g3, assumed an incorrect and nonconservative steam exhaust pressure, which had the potential to adversely impact the effectiveness of operator actions contained in Emergency Operating I

^ ~

Notice cf Viol:ti:n 5 Procedure EOP 35 ECA-0.0, Revision 11, dated October 3,1995, to assure TDAFW pump operability in that the higher turbine exhaust pressure may have limited turbine horsepower to less than required.

(01102) 11

• Design control measures were inadequate to assure that the Unit 3 TDAFW pump containmont isolation valves (3FWA*HV36A, B, C, and D) were capable of isolating the containment under design basis accident conditions, as required by Ur.it 3 TS 3.6.3, " Containment isolation Valves." Specifically, bench testing conducted on March 30, 1996, demonstrated that since initialinstallation the valves were only capable of remaining closed when exposed to a differential back pressure of up to 8 paid, rather than the design-basis peak containment accident pressure of 38.6 psig specified in Millstone 3 FSAR Section 6.2, " Containment Systems." This resulted in these containment isolation valves being declared inoperable and requiring the Unit 3 shutdown on March 30,1996. (01112)

12. Design control measures were inadequate to assure that the design

' basis was correctly translated into drawings and that the selection of-material and parts was reviewed for the suitability of application to the safety roisted function of the effected component. Specifically, the Millstone Nuclear Power Station Unit 3 FSAR in Table 3.21 lists the letdown heat exchanger as an ASME lil, Class 2 component on its tube side. The ASME Code, Section ill (1963 edition, summer 1983 addenda) specifies in subsection NC 2123 the requirements for the design allowable stress values for ASME lil, Class 2 material.

However, as of November 1993, a plant design change request (PDCR)

MP3-90 243, Revision 1, did not correctly translate the Unit 3 design basis into the revised drawings for the letdown heat exchanger.

Specifically, flange studs were replaced with new studs and credit was taken for a minimum yield strength that was greater than the design allowable stress values for ASME lil, Class 2 material. Furthermore, the design change control measures applied to PDCR MP-3-90-243 did not assure adequate review of the modification detailin that the replacement of a certain number of the originalletdown heat exchanger studs with the specified material was not controlled with regard to the suitable application of structural integrity to the safety-related Class 2 pressure boundary. (01122) 13.* Provisions to assure that appropriate quality standards are specified and included in design documents and that deviations from such standards are controlled were inadequate. Specifically, filter regulators originally installed upstream of 48 ASCO safety related solenoid-operated valves (SOVs) to limit the differential pressure on the SOVs in accordance with SWEC design specification No. 2472.110185,

" Electro-Hydraulic and Air Operated Control Valves," were procured as non safety-related components. This resulted in the installation of 48 SOVs in Unit 3, procured in accordance with SWEC design specification

)

f i

j Notice of Violation 6 i<

j No. 2472.110-185, that could be subject to air presmnt % : 9 psig) in excess of the component designed maximum operatn.g ;iNwn differential (e.g,60 psid)If there was a failure of the non d%y-related l_ air regulator located upstream of each SOV, (01132) 14.* At some unknown time subsequent to initial licensing, an inadequate

! modification to the Unit 2 service water system common strainer t

backwash line was made that added a horizontal piping section to the existing vertical section. This resulted in minor leakage past the strainer backwash valves forming an ice plug when it contacted the j horizontal leg of piping that was exposed to a long period of sub-l freezing temperatures. There were no records of a formal engineering

review of this modification. This inadequate modification permitted the j formation of an ice plug which rendered the service water system l

j inoperable on January 8,1995. (01142)

B. INADEQUATE. OR LACK OF SAFETY EVALUATIONS AND FAILURES TO j UPDATE THE FINAL SAFETY ANALYSIS REPORT i 10 CFR 50.5g, " Changes, tests and experiments," in part permits the licensee j to make changes to its facility and procedures as described in the safety analysis report and conduct tests or experiments not described in the afety j analysis report without prior Commission approval provided the change does not involve a change in the technical specifications or an Unreviewed Safety Question (USQ). The licensee shall maintain records of changes in the facility i

and these records must include a written safety evaluation which provides the

! bases for tbs determination that the change does not involve a USQ.

10 CFR 50.71(e) requires, in past, a licensee to update the FSAR originally j

submitted as part of the application for the operating license to assure that the j information included in the FSAR contains the latest material developed. The-

~

updated FSAR shall be revised to include the effects of, in part, all safety j evaluations performed by the licensee in support of conclusions that changes did not involve a USQ.

I

! 10 CFR 50.9(a) requires, in part, that information provided to the NRC by a licensee or information required to be maintained by a licensee shall be

} complete and accurate in all material respects.

(

1. Unit 3 TS 3.7.1.2, " Auxiliary Feedwater System," requires that in operating Modes 1,2, and 3 at least three independent AFW pumps j and associated flow paths are required to be operable.

J l Contrary to the above, on May 10,1994, the licensee made a .

j procedural change to shut the TDAFW pump discharge isolation valve

] during startup and shutdown operations, rendering the TDAFW pump-inoperable, when the motor-driven AFW (MDAFW) pumps were being F used for steam generator water level control. The licensee's safety

evaluation to support this change was inadequate in that the need to

'1

l N:tice cf Viol:ti:n 7  !

revise the TS was not recognized. in addition, the updated FSAR was not complete and accurate in all material respects in that it did not reflect this change. (01152) l 2. Unit 2 UFSAR, Chapter 7, states that the engineered safety features j

actuation system is designed to meet the provisions of institute of Electrical and Electronic Engineers (IEEE) 2791971, " Criteria for Protection Systems for Nuclear Power Generating Stations." IEEE 27g  ;

i specifies, in part, that the system be designed to meet the single failure criterion, j Contrary to the above, on January 12,1996, the licensee approved Revision 18 to operating procedure (OP) 2313C, " Containment Post-Incident Hydrogen Control,"'o address the fact that the as-built containment gas and partlw, ate radiation monitors, the post accident sampling system, and the hydrogen monitors did not meet the single i

' failure criterion (the licensee had identified that the loss of one vital DC bus would render these systems inoperable). This revision was made i without an adequate safety evaluation to ensure that it did not involve a i

USQ, in that the possibility of a malfunction of a different type than previously evaluated was not appropriately considered and evaluated.

The safety evaluation was also inadequate in that the design bases were not approp4tely considered. (01162)

3. Unit 1 UFSAR, Section 11.2, " Liquid Waste Management Systems,"

3 (LWMS), states, in part, that the LWMS are designed to be operated and maintained to collect, store, process, and dispose of, or recycle, safely, all radioactive or potentially radioactive liquid waste generated by plant operation. The Radweste Building and equipment arrangement provide assurance that the Radweste Building will form a radioactive waste boundary and prevent excessive radioactive material

release.

Contrary to the above, the licensee changed the LWMS and as of February g,1996, did not perform an evaluation to ensure that the change did not involve a USQ. Specifically, the redweste facility would not perform the function for which it was designed due to long standing i

leakage of radioactive waste, deterioration of numerous pipe flanges ar.d valve aodies, significant cracking and deterioration of the sludge

tank boundary, and overfill of the spent resin tank resulting in an uncontrolled release and dispersal of highly radioactive material in that room, and deterioration of transfer piping, pipe supports and restraints.

As a result, not all radioactive liquid waste was etored or processed by the LWMS as described in the UFSAR. The licensee, by its inaction over years to correct the degradation of the LWMS, made a decision to maintain the LWMS in a manner different from that described in the UFSAR. Therefore, the facility was changed but no evaluation existed

_. ___ . . _ _ _ _ _ _ - _, . . _ _ _ _ ~ - _ __-_

i .

l Notice cf Vi lation 8 1

to determine that the conditbns did not constitute a USQ. In addition, I

i the updated FSAR was not complete and accurate in all material '

respects in that it did not reflect the differing use of the LWMS from that i described in the UFSAR. (01172)

4. Unit 1 UFSAR, Section 9.1.3.3, states that water circulates to the heat i

exchan9ers, filter dominerallrer, and back through diffusers at the  !

i bottom of the SFP. >

Contrary to the above, from 1988 until November 1995, the facility was l not as described in the FE AR in that a Unit i spent fuel pool cooling (SFPC) system modificatbn, PDCR 124-88, SFP Rorack, existed that i- removed the SFPC diffusers without an adequate safety evaluation.

4 The safety evaluation for the PDCR performed prior to the change was i i

inadequate in that the removal of the SFPC diffusers was not

! addressed. An adequate safety evaluation that addressed the removal j of the SFPC diffusers was not conducted until November 1995. In addten, the updated FSAR was not complete and accurate in all j

i rr :,lerial respects in that it did not reflect this change. (01182)

5. Unit 1 UFSAR, Section 8.3.1.1.5,1, " Diesel Generator System," states, in part, that the starting air system consists of one AC motor-driven j compressor capable of recharging the empty dual air receivers in 30 '

l minutes. This compressor is backed up by a DC air compressor. The i

two air receivers are each capable of a minimum of three independent

! cold diesel engine starts without recharging when the starting air pressure is 250 psig. The air starting system automatically maintains j- the necessaty inventory of compressed air. The two air compressors j

are started if the pressure in the reservoirs falls to 225 psig and are stopped when the pressure reaches 250 psig.

Contrary to the above

! a. From at least February 14,1991, to 1996 ths facility was not as

' described in the UFSAR in that the diesel starting air receiver

• discharge check valve intemals were removed, which defeated the capability for each air receiver to provide three independent

cold diesel engine starts. No evaluation existed to determine

!' that this change did not constitute a USQ. In addition, the i

updated FSAR was not complete and accurate in all material respects in that it did not reflect this change.

b. Prior to December 31,1996, the Emergency Diesel Generator (EDG) startbg air system was configured in a manner different

!- than described in the UFSAR in that (1) while the ability to start t

i the diesel engine three times at 250 psig witnout recharging the receivers was successfully demonstrated in the preoperational test,'no supporting documentation was found that provided reasonable assurance that the receivers would contain sufficient j

i i

~

i Notice of Violation g

inventory for three starts when the air receiver pressure is as

} low as 220 psig; (2) both compressors do not simultaneously

receive a start signal; and (3) while the AC compressor starts at 225 psig, the DC compressor starts at 220 psig. No evaluation -

existed to determine that the change did not constitute a USQ.

j i

i in addition, the updated FSAR was not complete and accurate in j ,

all material respects in that it did not reflect this change,

j. (011g2)

I: 6. Unit 1 UFSAR, Section 8.3.2.2, states that the Class 1E 125 vDC power i j

sources and the DC distribution system have sufficient independence,

• redundancy, and testability to prform their safety functions assuming a

,',' redundant and independent DC systems. single failure. Th l

1' Contrary to the above, since initial constnaction, an electrical separation l deficiency existed which constituted a change to the facility as

{ described in the UFSAR. Specifically, on April 11, igg 5, the licensee j identified an electrical separation deficiency associated with a feedwater

) regulating valve (FRV) interlock, due to its dependency on both 125 vDC logic trains. No evaluation existed to determine that the change

' did not constitute a USQ. Further, this change to the facility as i described in the UFSAR remained until November 4, igg 5 without a written safety evaluation in that the licensee chose to resolve the issue using an analytical basis without a sul. porting safety evaluation rather than restore the configuration as described in the UFSAR, in addition, the updated FSAR was not complete and accurate in all material j respects in that it did not reflect this change. (01202) '

j 7. Unit 2 UFSAR, Section g.2.3.3, states that (1) the operator does not insert the shutdown group of control element assemblies (CEAs) until j the cooldown is completed; srd (2) the boron concentration is increased to the cold shutdown value prior to the cooldown of the piant.

!. Contrary to the above, from initial licensing until July 7, igg 6, Unit 2 OP l 2206, " Reactor Shutdown," and OP 2207, " Plant Cooldown," required i

operators to insert all shutdown group CEAs prior to starting a plant

! cooldown, and allowed a plant cooldown to proceed prior to the boron concentration being increased to the cold shutdown value. This constituted a change in procedures described in the FSAR. No i evaluation existed to determine that the change did not constitute a l USQ. In addition, the updated FSAR was not complete and accurate in j all material respects in that it did not reflect this change. (01212)

• 8. Unit 3 UFSAR, Section 8.3.1.1.7, "Altemate AC Design Criteria and Compliance," describes the licensee's response to 10 CFR 50.63 and states that (1) 4160 V power cables are protected from adverse weather by running the cables almost entirely in buried ductbanics,

[ except for a small transition area where the power cables are supported i

. . . _ . . . . . , - , _ _ ~ . , _ . _ . . _ _ _ . . _ _ - _ , . . ~ . , _ . _ _ . _ . - _ - _ _ _ , . . _ . . , . . - - . . . . - _ _ - . , _ . _ ., , . _ .-...,m__.-_

Notics of Violation 10 by rigidly mounted cable trays, (2) a start and fullload test of the Station Blackout (SBO) EDG is performed every refueling outage, and (3) the surveillance and maintenance procedures for SBO equipment are designed and maintained with due consideration for vendor recommendations, the history of past maintenance practices, and engineering judgement.

Contrary to the abovs, as of March 11,1996; (1) two approximately four foot sections of 4160 V cable were not protected from sdverse weather in that they were not in buried ductbanks or supported by rigidly mounted cable trays; (2) the credited tests of the SBO EDG did not test the EDG start times and did not reach the expected accident loads; and (3) no maintenance or surveillance had been performed on the

- electrical support equipment for the SBO EDG despite

\ recommendations in the related vendor manuals. This as-built configuration of the plant and accompanying maintenance and surveillance practices constituted a change in the facility from the description in the FSAR. No evaluation existed to determine that the inaccuracy did not constitute a USQ. In addition, the updated FSAR E was not complete and accurate in all material respects ir. that it did not reflect this change. (01222)

9. Unit 3 UFSAR, Section 9.2.1, " Service Water System," describes the SW system and includes a description of the motor control center (MCC) and rod control area booster pumps and the design features that provide the automatic valve actuation and pump start.-

Contrary to the above, on May 3,1990, the licensee changed the facility as described in the FSAR by installing a temporary modification in the Unit 3 SW system which added jumpers to the booster pump initiation circuit in order to address a fire protection concem regarding both trains of SW being in the same fire area. This temporary modification, which was stillin effect in May 1996, defeated portions of the automatic initiation and alignment of the booster pumps, and added steps to alarm response procedures to prompt the operator to manually align and start the booster pumps when needed. While a safety evaluation was performed, it was inadequate in that it did not address (1) the substitution of a manual operator action for an automatic feature and (2) the removal of an automatic pump actuation. Further, the added compensatory alarm response steps were deleted in a subsequent revision to the alarm response procedure without a written safety evaluation being performed, in addition, the updated FSAR was not complete and accurate in all material respects in that it did not

.eflect this changa. (01232)

~

10.

Unit 3 UFSAR, Section 10.4.9.2, "AFW System-System Description,"

describes .ie automatic starts of the TDAFW pump to be either of two signals: low level in two of four steam generators or a sensed loss-of-power event. l

, ' Notice of Violation 11 Contrary to the above, in the G-built condition prior to 1995, only the SG low level signal would automatically start the TDAFW pump,-

constituting a change in the facility from the description in the FSAR.

No evaluation existed to determine that the change did not constitute a USQ. Following recognition of the discrepancy, FSAR Change Request 95-MP3-12 deleted the description in the UFSAR of the TDAFW autostart on loss of offsite power so as to match the as-built corifiguration, without performing a written safety evaluation to assure that the as-found condition did not involve a USQ. In addition, the updated FSAR was not complete and accurate in all material respects in that d did not reflect this change. (01242)

11. Unit 2 UFSAR, Section 6.6.3.1, states that the hydrogen monitoring system is manually initiated within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following an accident.

Contrary to the above, the licensee's letter to the NRC, dated March 27, 1984, in response to NUREG 0737 (committed to by the licensee and -

confirmed by Order, dated July 10,1981), item II.F.1.6, " Containment Hyr!rogen Monitor," states that the system is initiated within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

Follswing installation of steam gene.ator replacement modification (which included ABB-CE Calculation 006-AS92-C-010, " Millstone Unit 2 LOCA Containment Pressure / Temperature Analysis for Steam Generator Replacement," dwt October 15,1992), the actual time for containment pressure to fall below 10 psig, at which point the hydrogen monitors can be placed in service, was determined to be 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

These conditione constituted changes in the facility as described in the FSAR. An inadequate evaluation existed to determine that the changes did not constituta a USQ in that the licensee feiled to identify that the time needed to place the hydrogen monitors in service could no longer >

be met. In addition, the updated FSAR was not complete and accurate in all material respects in that it did not reflect theses changes. (01252)

12. Unit 3 UFSAR, Section 8.3.1.2.4, " Cables and Routing Analysis," and Table 8.3-2, " Cable in Trays," specified the allowable electrical fill for safety-related cable trays.-

Contrary to the above, since initial construction, several trays were filled '

above too limita which constituted a change to the facildy as described in the UFSAR. SpeciTically, es of May 22,1996, five safety-related L-service cab!e trays had electrical fill greater inan the allowable 100-percent (i.e., Tray 3TL1070 at 105-percent fill, Tray 3TL2040 at 132-percent fill, Tray 3TL204P at 108-percent fill, Tray 3TL2060 at 132-percent fill, and Tray 3TL210P at 108-percent fill) and four safety-related C-service cable trays had electrical fill greater than the allowable 157 percent (i.e., Tray 3TC402P at 159-percent fill, Tray

Notico of Violation 12 3TC442P at 158 percent fill, Tray 3TC4430 at 173 percent fill, and Tray 3TC4620 at 172-percent fill). An inadequate evaluation existed to determine that the change did not constitute a USQ. In addition, the updated FSAR was not complete and accurate in all material respects in that it did not reflect this change. (01262)

13. Unit 3 UFSAR, Section 9.4.8.1, " Circulating and Service Water Pumphouse Ventilation System," indicated that total exhaust air flow from the circulating and SW pumphouse during the summer and winter months is 8200 cfm and 3100 cfm, respectively.

Contrary to the above, as of May 22,1996, the calculated total fan flow was 16,500 cfm and 15,500 cfm, respectively, which constitutes a change in the facility as described in the FSAR. No evaluation existed to determine that the change did not constnute a USQ. In addition, the updated FSAR was not complete and accurate in all material respects in thet it did not reflect this change. (01272) 14.

Unit 3 UFSAR, Section 10.4.9.2, "AFW System - System Description,"

specified the recirculation flow minimum acceptance criteria of 45 gpm for the MDAFW pumps and 90 gpm for the TDAFW pump.

Contrary to the above, as of May 22,1996, surveillance procedures (SPs) 3622.1 and 3622.2, "MDAFW Pump 3FWA*P1 A&B Operational Readiness Tests," and SP 3622.3, 'TDAFW Pump 3FWA*P2 Operational Readiness Tests," specified minimum acceptance criteria of 43.2 to 52.8 gpm and 87.3 to 106.7 gpm, respectively, which constitute a change in procedures as described in the FSAR. No evaluation existed to determine that the change did not constitute a USQ. In addition, the updated FSAR was not complete and accurate in all material respects in that it did not roflect this change. (01282)

15. Unit 3 UFSAR, Section 8.3.1.1.4.2.e, " Electrical System Protection -

Motor Feeder, Emergency Switchgear," for the 4.16-kV safety-related motors stated that an overload condition alarm is set for 125 percent of motor fullload current and that the instantaneous overcurrent trip is set at 175 percent of motor locked-rotor current.

Contrary to the above, as of May 22,1996, the values used in licensee Specification SP-EE-321, Revision 0, "NUSCO Control of Electrical Setpoint Data Base," for the 4.16-kV safety-related motors overload condition alarm and the instantaneous overcurrent trip are 115 and 200 percent, respectively, and the values used in the Stone & Webster document which provided design criteria for protective relay settings, NERM-46, "4.16kV and 6.9kV Station Service Protection Philosophy,"

are 115 and 190 percent, respectively, which constitutes a change in the facility as described in the FSAR in that the actual settings were based on these documents. No evaluation existed to determine that the change did not constitute a USQ. In addition, the updated FSAR

. . .__ ~

9 Notice of Violation 13 was not complete and accurate in all material respects in that it did not reflect this change. (01292)

16. Unit 3 UFSAR, Table 6.2-65, " Containment Penetration," identified the AFW flow control valves as containment isolation valves and indicates that they are motor operated and fall "as is." UFSAR Section 6.2.4,

" Containment isolation System," states that "all air and solenoid.

operated containment isolation valves fallin tha closed position."

Contrary to the above, as of May 22,1996, the AFW flow control valves as originally installed are solenold operated and fail "open,"

which constitutes a change in the facility as described in the FSAR. No evaluation existed to determine that the change did not constitute a USQ. In addition, the updated FSAR was not complete and accurate in all material respects in that it did not reflect this change. (01302) 17, Unit 3 UFSAR, Section 8.3.1.1.6, "Aftemate AC System Description,"

states that the attemate attemating current (AAC) system switchgear enclosure contains a battery with a 125 ampere hour rating.

Contrary to the above, as of May 22,1996, the FSAR was not accurate in all material respects in that the installed battery in the enclosure had a 80 ampere hour rating. The AAC system was installed and tested in August 1993 with the 80 ampere hour rated battery. However, when the UFSAR was updated by the licensee to include the AAC system description, the information provided did not reflect the correct as-installed battery configuration. (01312)

These violations in Sections 1.A and I.B represent a Severity Level ll problem (Supplement 1).

Civil Penalty - 5500,000 11.

VIOLATIONS RELATED TO INADEQUATE OR LACK OF CORRECTIVE ACTIONS A.

10 CFR Part 50, Appendix B, Criterion XVI, "fktractive Action," requires ,a part, that measures be established to assure that conditions adverse to quality are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.

Contrary to the above, the licensee did not assure that conditions adverse to quality were promptly identified and corrected. Moreover, the causes of

• sign 5 cant conditions adverse to quality were not determined, nor were corrective actions taken to preclude repetition, as evidenced by the following examples, each of which constitutes an individual violation:

1

Notice of Violation 14

1. On March 30,1995, the licensee identified that incorrect stud material existed in Unit 1 Reactor Water Cleanup valve 1-CU 3; however, as of April 27,1995, adequate measures were not established to correct this condition adverse to quality in that the licensee did not perform short term reviews or inspections following the identification of the incorrect stud material to determine if the incorrect bolting material was used in other applications, in June 1995, incorrect studs were identified in other safety-related valves, namely, low pressure coolant injection valves 1 LP-10A&B,1-LP-29A, and 1-LPA, B & D. (02012)

2. '

On June 7,1996, the licensee completed an Event Review Team (ERT) report that assessed the findings of a QA Services audit of the adverse condition report (ACR) process. The ERT report indicated a continued inadequate implementation of the corrective action program at Unit 1, and the licensee did not establish measures to assure that the cause of the condition was determined and corrective actions taken to preclude repetition. Specifically, the ERT root cause report, causal factors, and corrective action plan took credit for a draft Operating Experience Manual which was part of the Nuclear Excellence Plan. This plan was

' not implemented and, therefore, no corrective actions were taken.

(02022)

3. On November 17,1995, the licensee identified a significant condition adverse to quality at Unit 2. Specifically, a 1992 containment temperature profile analysis was performed using an incorrect RBCCW system flow rate through the shutdown heat exchangers. Upon discovery of the error in November 1995, the licensee issued ACR 8344 to document the issue; however, the ACR was closed without identifying the cause of the error and did not document s.ctions to ensure that the other assumed values in the analyses were correct.

(02032) 4.

Conditions adverse to quality identified in 1992, related to the adequacy of the environmental qualification (EQ) of the Unit 2 MCC enclosures which surround MCCs B51 and B61, were not corrected. Specifically, in 1993 and 1994, similar additional concems were identified by the licensee related to assumptions in the EQ analysis, as well as with regard to the operator actione needed following an accident, and the cooling capability of the MCC enclosures. However, when excessive door seal gaps were identified in the Unit 2 MCC enclosures in March 1996, degrading the capability of the MCCs to mitigate the effects of a harsh environment, it was determined that the licensee had not taken or planned corrective actions to address those conditions adverse to quality identified in 1992,1993, and 1994. (02042) 5.

On September 29,1995, the licensee identified that Unit 2 seismically-qualified, vital switchgear room cooler X-182 would not be available following a seismic event. As a result of modification PDCR 2-064-94,

' Vital Switchgear Ventilation System-Service Water isolation,"

1

Notice of Violation 15 completed June 22,1995, cooler X-182 would be isolated in the event of any leakage in the vital switchgear room, including leakage from the non seismically-qualified fire protection piping above. Although the licensee issued DCN DM2 S-1246-95, " Modification to Fire Protection Piping Cable Cpreading Area Turbine Building," on February 27,1996, to address potential leakage from Victaulic couplings, this corrective action was inadequate because the fire protection system's 2-over-1 seismic design criteria were less conservative than the criteria for the safety related cooler and switchgear below the piping. As a result, as uf May 22,1996, the licensee had not taken adequate corrective action to assure the availability of cooler X-182 following a seismic event.

(02052)

6. In 1993, the licensee identified deficiencies in the maintenance and to4ing of dual-function containment isolation valves at Unit 2 which resulted in certain of those valves being unable to fulfill their safety function, a significant condition adverse to quality. The licensee's valve maintenance and test program had failed to specify the proper bench-settings ur retest requirements for certain pneumatic valves. As a result, certain containment isolation valves would not be able to close 2

against full system pressure in performing their line-break isolation

( function. The NRC issued an NOV for this issue on February 2,1994 (NRC Inspection Report 50-245/93-27; 50-335/93-20; and 50-423/93-23). Also, the licensee identified on June 8,1995, that corrective actions specified to address this significant condition adverse to quality had not been taken. However, as of March 20,1996, the licensee had not implemented corrective actions for this deficiency. (02062)

7. Procedure NGP 2.40, *lssues Management and Action Tracking

• states that Level A and B Adverse Condition Reports (ACRs) represent significant conditions adverse to quality, and specifies that Level A ACRs be resolved within 30 days and Level B ACRs be resolved within 45 days. NGP 2.40 states that Level A ACRs represent events or issues of such importance they deserve the immediate, undivided attention of whatever resources are required to mitigate the consequences, determine the causes, and implement at least sufficient interim corrective measures to prevent recurrence. However, as of May 22,1996, numerous Unit 2 Level A and B ACRs had not been promptly resolved within the time periods specified by NGP 2.40. Specifically, nine Level A and B ACRs were identified that remained open for over 90 days, with several that had been unresolved for over 9 months.

(02072)

8. The environmental qualification required by 10 CFR 50.49 of certain Unit 2 valves subject to a harsh environment was discussed in NRC inspection Report No. 50-336/88-20, issued on October 14,1988, and in a related Enforcement CcMerence conducted on July 20,1988. At that time, the licensee determined that only one of the 10 valves, an B

Notice of Violation 16 atmospheric dump valve, had terminations that required environmental qualification because this was the only valve that required energization to perform its safety function (i.e., valve opening). The other nine valves, all feedwater or containment isolation valves, were said to reposition to their safe (i.e., closed) positions when their coils are deenergized. The licensee failed to identify, however, that four containment isolation valves also had a safety related function to open.

As a result, in part, until March 26,1996, seven of those safety significant solenoid valves (listed in Licensee Event Report (LER) 50-336/96-19) that are required to function in a harsh environment were electrically connected using devices for which no record of qualification existed for that environment. Thus, equipment required to perform post accident functions, including containment air radiation and hydrogen monitoring, sampling, reactor coolant charging, pressurizer auxiliary spray, and containment hydrogen purge were not demonstrated to be environmentally qualified. (02082)

9. A third-party audit entitled " Station Blackout Assessment," Report 24-00116, Revision 0, dated October 1994, hcd identified deficiencies in the licensee's implementation of the NRC's SBO requirements in 10 CFR 50.63 at Units 2 and 3. The deficiencies included potentially inadequate loading calculations, voltage drop calculations, and battery sizing calculations. In addition, the licensee's failure to address the issues was identified in a QA surveillance of October 1995 and a Nuclear Safety Engineering Group report of February 1996. However, as of May 22,1996, the licensee had not taken corrective action to address the deficiencies identified in the third-party audit of 580 equipment. (02092)

10. Licuasee Audit Reports Nos. A25092, A21065, A22065 and A23065, entitled "Nonconformance Reports," dated July 14,1994, identified that NGP 3.05, "Nonconformance Reports," was inadequate in that there were no procedural controls associated with the timeliness of resolving nonconforming conditions, a significant condition adverse to quality.

However, as of March 11,1993, the licensee had not taken measures to correct this condition adverse to quality to assure the timely resolution of identified nonconformances, as evidenced by several uncorrected MP3 nonconformance reports (NCRs), which dated back to 1988-1989, associated with damaged air-operated valves in the Unit 3 Volume Cor: trol System, deficiencies associated with 480V load centers, and nonconforming conditions in the containment recirculation spray system (RSS). (02102)

11. Between May 1990 and March 1996, a Unit 3 temporary modification resulted in the deletion of the SW booster pump autostart interlock described in Unit 3 UFSAR Section 9.2.1. A specialinstruction to manually re. start the booster pumps was subsequently deleted from an alarm response procedure. This constituted a condition adverse to quality because the SW supply to the motor control center / rod control

Notice of Violation 17 area (MCC/RCA) air handling units would not automatically initiate on high temperature in the retum duct. This condition adverse to quality was not previously identifed, despite numerous opportunities to do so following installation of this temporary modification, including approximately 70 required monthly audits of temporary modifications by the Operations Department, four reviews by the Plant Operations Review Committee, and the August 1994 reviews associated with the Design Basis Documentation Package program. (02112)

12. On May 20,1996, Unit 3 safety-related SW booster pump 3SWP*3B was found to be significantly degraded in that its concrete support pedestal had been damaged for an extended but indeterminate period such that there was no longer assurance that the pump would meet applicable seismic requirements; however, this condition had not been previously identified and evaluated by the licensee. (02122)

13. In May 1992, the licensee determined that there was no assurance that <

there existed an adequate combined inventory of the Unit 3 Condensate Storage Tank (CST) and the Domineralized Water Starage Tank (DWST). Specifically, existing procedures required a minimum combined CST and DWST inventory of 334,000 gallons, even though a minimum of 364,000 gallons was required to meet design basis requirements, because '30,000 gallons of water in the CST were unusable due to the tank configuration. Although a proposed TS change was submitted to the NRC in May 1995 to correct the TS, the proposed change was withdrawn in June 1995 because of other unrelated issues. Also, as of March 11,1996, the licensee had not revised the applicable procedures or taken interim measures to correct this condition adverse to quality by assuring adequate CST and DWST inventory. (02132)

14. NRC Inspection Report 50-423/95-07, dated April 26,1995, included a violation for inadequate control of scaffolding that did not prevent safety-related components from being potentially impacted. The licensee response to the NOV, dated June 12,1995, stated the actions taken to resolve the identified problems including actions to prevent recurrence. However, additional examples of inadequate control of scaffolding with the potential to impact safety-related equipment were identified at Unit 3 on March 12,1996. (02142)

15. DCN DM3-S-0677-93, dated August 12,1993, documented that the Unit 3 protective relay criteria documents for safety-related motor design had previously not been adequately controlled. However, as of March 12, 1996, the licensee had not taken adequate corrective measures to control those documents in that Stone & Webster design specifications NERM-45 and NERM-46, which were used as design criteria for protective relay settings, were uncontrolled and inconsistent with the UFSAR and NUSCO specification SP-EE-321. As result, a quench spray pump motor overcurrent relay needed to be reset. (02152)

l i

) Notice of Violation 18 '

i*

16. On March 12,1996, unauthorized temporary 1 beams were identi d j

. above 3 of 4 Unit 3 RSS heat exchangers. This constituted a significant condition adverse to quality because during a seismic avmn, the resulting damage from the falling beams could have rendered i

multiple trains of RSS inoperable. The licensee had no instructions or j

i technicaljustification for the installation; however, this condition had not been previously identified and corrected by the licensee. (02162)

17. In March 1996, the licensee identified that the No. 9 upper main bearing for the "B" EDG at Unit 2 was significantly degraded, a j

significant condition adverse to quality, in that excessive 'oearir,g-to-i hhaft clearance was detected. However, the cause of the condition was i

not determined and corrective actions were not taken to preclude repetition in that on April 17,1996, the "B" EDG engine experienced l severe damage to the upper crankshaft main and connecting rod

! bearings during surveillance testing from causes related to the earfier No. 9 upper main bearing degradation. (02172) i

B.

10 CFR 50.9(a), " Completeness and Accuracy of Information," requires, in part.

{ that the information provided to the Commission by a licensee be complete and accurate in all material respects.

Contrary to the above, the licensee submitted Letter B154600, dated

' December 13,1995, to the Commission concoming the Radwaste Facilities at i

i Millstone Unit 1, which was not accurate in certain material respects.

Specifically, the letter stated that "Upon determining the degree to which the

! material conditions had deteriorated, an ACR was initiated to document the i

findings. The ACR was assigned a significance Level"B", thus requiring a root

! cause analysis." The letter also discussed the results of a root cause j

investigation. However, the only Level"B" ACR on this issue was ACR 2372,

dated January 18,1996, and the root cause evaluation associated with ACR 2372 was completed on March 8,1996. Both of these occurred after the December 13,1995, letter was issued. (02182) 1 These violations in Section ll.A and II.B represent a Severity Level ll problem j (Supplement 1).

- Civil Penalty - $1,000,000 i 111.

VIOLATIONS OF TECHNICAL SPECIFICATIONS 7

A. Unit i TS 3.7.B.1, Containment Systems, Standby Gas Treatment System,"

I requires that both trains of the SGTS and their associated power sources

} required for operation of such circuits shall be operable at all times when j containment integrity is required.

j Contrary to the above, between July 5,1995 and November 19,1995 when containment integrity was required, whenever the outside temperature was less i

than 45'F, the B train of the SGTS was inoperable, and whenever the outside j temperature was less than 30'F, the A train of the SGTS was inoperable. On a

Notice of Violation 19 several occasions during this period the ambient temperature dropped below 45'F, with a low of 26'F, rendering one or both trains inoperable. Specifically, if actuation of the SGTS had occurred during the time period that the temperature was less than the values stated herein, coincident with a loss of-normal power and a single failure in one train, the required negative pressure may not have been maintained throughout the secondary containment, thereby resulting in a reduction of the system's ability to perform its intended safety function. (03012)

B. Unit 1 TS 3.9.B.4, " Auxiliary Electrical System," requires, in part, that when either emergency power source is made or found inoperable for any reason, reactor operation is permissible according to specification 3.5.F/4.5.F.

Unit 1 TS 3.5.F, " Minimum Core and Containment Cooling System Availability,"

Items 3.5.F.2 and 3.5.F.3 respectively require, in part, that from and after the date that the EDG is made or found to be inoperable for any reason, continued reactor operation is permissible only during the succeeding seven days provided that the gas turbine generator is operable; and from and after the date that the gas turbine generator is made or found to be inoperable for any reason, continued reactor operation is permissible only during the succeeding four days provided that the EDG is operable.

Contrary to the above,

1. On multiple occasions since May 18,1994, and continuously from July 14,1995, until January 1996, the gas turbine generator was inoperable because one of its two fuel forwarding pumps was inoperable and unnble to transfer fuel from the fuel storage tank to the gas turbine, and during those times, reactor operation was continued in excess of the succeeding four days;

2. On multiple occasions between May 18,1994 and January 1996, the EDG was inoperable (taken out of service) at times when the gas turbine was also inoperable because one of its two fuel forwarding pumps was inoperable and unable to transfer fuel from the fuel tank to the gas turbine, and during those times, reactor operation continued.

(03022)

C. Unit i TS 3.5.B.1, " Containment Cooling Subsystems," requires, in part, that both containment cooling subsystems shall be operable whenever irradiated fuelis in the reactor vessel. A subsystem includes two emergency SW pumps and associated valves.

Unit 1 TS 3.5.F.1, " Minimum Core and Containment Cooling System Availability," requires, in part, that both emergency power sources shall be operable whenever irradiated fuelis in the reactor. TS 3.5.F.2 states that from and after the date that the EDG is made or found to be inoperable, for any reason, reactor operation is permissible only during the succeeding seven days provided that the feedwater coolant injection (FWCl) system subsystem shall

, Notice of Violation 20 be operable. The SW system is a support system for the EDG and the FWCl subsystem.

.g Contrary to the above, from initial plant operation until 1996, neither containment cooling subsystems, the EDG nor the FWCl subsystem were operable, including periods with irradiated fuel in the reactor vessel.

Specifically, these systems were inoperable because the operability for the emergency SW pump motors could not be demonstrated during several postulated loss of intake structure ventilation scenarios, and with the emergency SW pump motors inoperable, there would be insufficient cooling of the containment cooling subsystems, the EDG and the FWCl subsystem.

(03032)

D.

Unit 1 TS 3.6.F, " Structural Integrity," states that the structural integrity of the primary boundary shall be maintained as specified in TS 3.13. Unit 1 TS 3.13,

" Inservice Inspection," states that the structural integrity if ASME Code Class 1,2, and 3 equivalent components shall be maintainec at an acceptable level in accordance with 10 CFR 50.55a(g).

10 CFR 50.55a(g)(4) requires, in part, that components (including supports) which are classified as ASME Code Class 1,2, and 3 components meet the requirements set forth in ASME Code, Section XI. ASME Code, Section XI, requires that unacceptable flaws be evaluated per Paragraph IWB-3640.

Contrary to the above, between 1984 and 1995, the licensee did not evaluate unacceptable flaws in six ASME Class 1 reactor coolant components (RCAJ-2, RCBJ-1 A, RRJJ-4, RREJ4, RRCJ-4 and CUBJ-18) as required by ASME Section XI,1986 Edition, Paragraph IWB-3640. The rmponents were placed back into service without flaw analyses with an unacceptable structural integrity and a high probability of abnormalleakage. (03042)

E.

Unit 2 TS 3.5.2 and 3.5.3, " Emergency Core Cooling Systems (ECCSs),"

requires ECCSs to be maintained operable during plant operations in Modes

14. Unit 2 TS 3.6.2," Containment Spray System," requires two separate and independent containment spray systems to be maintained operable during plant operations in Modes 1-3.

Contrary to the above, prior to February 1996, the ECCS systems and the Containment Spray Systems were inoperable in that several deficiencies with the containment sump strainer existed. Specifically, debris much larger than the screen mesh size could pass through the strainer because (1) two end panels and a center partition of the strainer were constructed of wire mesh greater than the 0.187 square inch designed openings; and (2) there were ten locations where openings as large as 0.25 inches by 2 feet were identified.

(03052)

F. Unit 2 TS 3.6.4.1 requires that two !ndependent hydrogen monitors be operable in modes 1 and 2. Unit 2 UFSAR Section 6.6.2.1 states that two full capacity hydrogen concentration monitoring systems are provided outside the

N:tice of Violation 21 containment for periodic or continuous analysis of hydrogen concentration of the containment atmosphere and that uniform mixing of the containment post-accident atmosphere is provided by the post-accident recirculatisn system.

Contrary to the above, since original installation, during operation in modes 1 and 2:

1. Two full capacity hydrogen monitors were r'.ot operable or available for periodic or continuous analysis because vacuum regulating valves PCV-7852 and PCV-7856 would have prevented air flow through the monitor cell when containment pressure was low, thereby rer'dering both trains

, of hydrogen monitors inoperable.

2. 'IThe hydrogen monitors could not provide continuous analysis of hydrogen concentration of a uniformly mixed post accident containment atmosphere because the hydrogen monitor suction lines were tied into suction ductwork of the non-vital containment auxiliary circulating fans rather than the vital post-incident recirculation fans. This condition would have resulted in a non-representative containment sample, thereby rendering both trains of hydrogen monitors inoperable (this condition also rendered both trains of the containment atmosphere post-accident sampling system inoperable since the system was installed in 1983). (03062)

G.

Unit 2 TS 1,6, " Operable - Operability," defines, in part, that a system, subsystem, train, component or device shall be operable or have operability when it is capable of performing its specified function (s) and when all other auxiliary equipment that is required for the system, subsystem, train, component or device to perform its function (s) is also capable of performing its related support function (s).

Unit 2 TS 3.7.4, " Service Water System," requires that two independent service water loops be operable while in modes 1,2,3 and 4. The associated action statement states that with one service water loop inoperable, restore the inoperable loop to operable status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in cold shutdwn within the next 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Unit 2 TS 3.0.3 states that when a Limiting Condition for Operation is not met, except as provided in the associated action requirements, within one hour action shall be initiated to place the Unit in a mode in which the specification does not apply by placing it, as applicable, in:

1. At least hot standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />,

2. At least hot shutdown within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and

3. At least cold shutdown within the subsequent 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Contrary to the above, at approximately 1:00 a.m. on January 8,1996 both independent service water loops were identified as being in a condition such that the service water system and auxiliary equipment, the service water

Notice cf Viol . tion 22 strainers, would not perform their functions, thus requiring entry into TS 3.0.3, and the service water system was not declared inoperable and no action was initiated within one hour to place the unit in a mode in which the specification did not apply. Specifically, at approximately 12:10 a.m. an operator identified that no service water strainer backwash flow existed despite high differential pressure across the service water strainers, a condition for which strainer backwash flow was required. At approximately 1:00 a.m., licensee personnel concluded that an im plug had formed in a common horizontal backwash line for the service water strainers, which resulted in the inability to backwash the strainers, thus rendering the service water system inoperable but did not declare the service water system inoperable. (03072)

H. Unit 3 TS 3.7.1.2, " Auxiliary Feedwater System," requires that at least three independent steam generator AFW pumps and associated flow paths be operable in Modes 1,2, and 3. The associated action statement requires that with one ARN pump inoperable, the required pump be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least het standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in hot shutdown withS I le following 6 houc . Unit 3 TS 3.0.4 states that entry into an operational move shall not be made when the conditions for the LCO are not met and the associated action requires a shutdown if they are not met.

Contrary to the above, on at least five occasions (June 1,1995 (entry into Mode 3), June 3,1995 (entry into Mode 2), June 4,1995 (entry into Mode 1),

and December 15,1995 (entries into Mode 2 and Mode 1)), Unit 3 entered an operational mode with an inoperable TDAFW pump in that the pump discharge isolation valves were closed. (03082)

These violations in Section til represent a Severity Level ll problem (Supplement 1).

Civil Penalty - $500,000

-IV.

OTHER VIOLATIONS OF NRC QUALITY ASSURANCE REQUIREMENTS ASSESSED A CIVIL PENALTY A. 10 CFR Part 50, Appendix B, Criterion II," Quality Assurance Program," states in part that the licensee shall identify the structures, systems, and components to be covered by the QA program. The QA program shall provide control over activities affecting the quality of the identified structures, systems, and components, to the extent consistent with their importance to safety.

3 Contrary to the above, as of March 14,1996, the licensee's QA program did not provide control over activities affecting the quality of the Unit 1 SFPC system in that the system was modified ed operated in advance of the full knowledge of the quality standards of the SDC system which was part of the modification. Specifically, the licensee installed a cross connect between the SDC system and the SFPC system and declared the systems operable after completing the modification work; however, the licensee did not determine if the SDC system components fully met the QA Category I classification similar to the SFPC system. (04013)

, Notice of Violation 23 B. 10 CFR Part 50, Appendix B, Criterion V, " Instructions, Procedures, and Drawings," requires in part that activities affecting quality shall be prescribed by documented instructions and accomplished in accordance with these instructions.

1. Vendor manuals for the Unit 3 motor-driven AFW pumps (Bingham Willamette 01M041-001C and -002C) direct that the pumps be lubricated every 30 days if they are normally in standby service, in 1987, that interval was extended to 40 days with the concurrence of the vendor. Surveillance Test Procedures SP 3622.1 and 3622.2 directed the operator to manually prelubricate the pump bearings if the pump had not been operated during the previous 40 days.

Contrary to the above, as of March 20,1996, the licensee failed to ensure that the 40 day lubrication requirement was met or appropriately changed after the AFW pump surveillance test interval was changed in January 1995 to 90 days. (04023)

2. Unit 3 OP 3208,

• Plant Cooldown," Revision 16, Steps 4.3.10 and 4.3.11, requires the operator to monitor reactor plant closed cooling water (RPCCW) system retum temperatures from the outlet of the A --

and B residual heat removal (RHR) heat exchangers to ensure the design maximum RPCCW temperature of 115'F is not exceeded. The procedure also requires that operators initiate an ACR and notify system engineering personnel if this temperature is exceeded.

Contiary to the above, during a shutdown on December 1,1995, Unit 3 operators failed to maintain RPCCW below 115*F and failed to initiate an ACR to document and notify system engineering that the temperature had been exceeded, as required by OP 3208. Specifically, the RPCCW temperature at the outlet of RHR heat exchanger A exceeded the 115 'F limit and reached a maximum temperature of 120

'F. Subsequent to the identification of this occurrence, the licensee identified that during Unit 3 shutdowns on September 9,1994, and April 15,1995, the RPCCW temperature limit of 115 'F had also been exceeded. (04033) 3.

10 CFR Part 50, Appendix B, Criterion XV," Nonconforming Materials, Parts, or Components," requires, in part, that measures shall be established to control materials, parts, or components which do not conform to requirements in order to prevent their inadvertent use or installation.

NGP 6.01, " Material, Equipment, and Parts Lists (MEPL) for Inservice Nuclear Generation Facilities," implements the licensee's QA program and procedural controls associated with the classification of safety-related equipment.

Notice of Violation 24

s. Contrary to the above, neither NGP 6.01 nor NGP 3.05, "Nonconformance Reports," provided adequate guidance regarding the evaluation of the adequacy of non-QA material identified in safety-related applications. As a result, between 1993 and 1996, approximately 25 MEPL deficiencies that had been identified by the licensee at Units 2 & 3 were not  ;

corrected, and the justification for not doing so was inadequate.

(04043)

b. Contrary to the above, as of May 22,1996, several instances were identified in which the requirements of NGP 6.01 were not followed for Unit 2, resulting in the inappropriate reclassification of safety-related equipment as non-safety. Specifically, the technical review requirements of NGP 6.01, section 6.1.2.4, were not propedy executed such that required discipline reviews were not completed; the requirements of section 6.1.2.6 were not met in that the specified review verifications were signed prior to reviews; and the requirements of section 6.1.2.2 were not complied with in that revisions of completed individual MEPL determinations were issued which superseded portions of existing MEPL determinations. (04053)

C.

10 CFR Part 50, Appendix B, Criterion XI, " Test Control," requires in part that a test program be established to assure that all testing required to demonstrate that strur . ires, systems, and components will perform satisfactorily in service is identiwd and performed in accordance with written test procedures that incorporate the requirements and acceptance limits contained in applicable design documents.

1.

Contrary to the above, on several occasions between September 30, 1994, and January 2,1995, written test procedures were not property performed at Unit 2. Specifically, the licensee failed to follow PI-13,

" Evaluation of Dynamic Test Results," which stated that negative load sensitive behavior could not be used to increase motor-actuator capability at the control switch trip for Valve MS-202 (No. 2 steam generator to Terry Turbine steam supply valve), and that thrust calculations were to be updated with dynamic test results prior to the next static test. Consequently, the licensee used an incorrect acceptance criterion and on three occasions erroneously evaluated the design-basis capability of valve MS 2 '2. (04063) 2.

Contrary to the above, testing required to demonstrate that components will perform satisfactorily in seNice was not property performed in that as of May 21,1996, test data taken in December 1995 following the May 1995 replacement of safety-related cooling coils for the Unit 3 SW MCC/RCA room coolers, accomplished as part of PDCR MP3-94-122, l

. l 1

1 Notice of Violation 25 l' l "3HVR*ACU1 A/B Service Water Cooling Coil Replacement," had not I been evaluated to assure that the design change had been adequately implemented. Specifically, upon review, the test results differed significantly from the purchase specification, necessitating additional i

analysis. (04073)

3. 10 CFR 50.55a(f) and (g) require that licensees comply with ASME Code, Section XI requirements associated with inservice testing and inservice inspection. Paragraph IWC-5222(a) of ASME Code (1986),

4 Section XI, requires that hydrostatic testing of systems be conducted at

' a pressure of at least 1.25 times the corresponding relief valve setting if the system design temperature exceeds 200*F.

i Contrary to the above, on September 26,1993, per Engineering Form 31063-1, " Hydrostatic Pressure Test," the licensee accepted by*ostatic l

~ test results on the Unit 3 high pressure safety injection (SlH) syste;a. an -

ASME Code system with a design temperature greater than 200'F, et i

' pressures less than 1.25 times the settings of relief valves 3SlH*RV-8851, -8853A, and -8853B. (04083) 4.* 10 CFR 50.55a(s)(3) requires that attomatives to the ASME Code inservice testing and inservice inspection requirements must be j authorized by the NRC.

L Contrary to the above, as part of PDCR MP3-91-075, dated April 11,

{. 1991, the licensee deferred conduding the ASME Code required 4

hydrostatic testing of the Unit 3 SlH system withot.t coproval of the NRC. (04093)

D. 10 CFR Part 50, Appendix B, Criterion XV," Nonconforming Wterials, Paid. or Components," requires in part that measures shall be estcblished to control materials, parts, or components which do not conform to requirements in order l to prevent their inadvertent use or installation.

4 NGP 3.05, "Nonconformance Reports," Section 6.1.1, written to comply with 10 CFR Part 50, Appendix B, Criteria XV and XVI, states that in the field, the NCR

! is not used to identify deficiencies but to provide engineering direction when a 4

condition adverse to qur"+y cannot be made to conform to requirements or

' when an organization requres engineering direction conceming an identified deficiency. In the field, deficiencies in installed plant equipment are identified by trouble reports, automated work orders, ACRs, surveillances, inspections, and audits which require a prompt assessment of operability for degraded or

! nonconforming conditions.

4 Contrary to the above, on April 8,1996, the licensee used NCR 1-96-248

(rather than a trouble report, automated work order, ACR, surveillance, inspection, or audit), to identify a degraded concrete base beneath a SW pipe i support. As a result, a prompt assessment of operability for this degraded

] condition on insta!!ed plant equipment was not conducted. (04103)

I i

F Notice of Viol: tion 26 E. 10 CFR Part 50, Appendix B, Criterion XVil, " Quality Assurance Records,"

requires in part that sufficient records be maintained to fumish evidence of activities affecting quality, and that such records be identifiable and retrievable.

Contrary to the above, as of March 11,1996, two technical evaluations, entitled "MP3 Service Water Operability Under a Loss of Offsite Power Given a 77'F U4imate Heat Sink Temperature" and "MP3 S3rvice Water Operebility During a Steam Generator Tube Rupture Event Without a Loss of Offsite Power Given a 77'F Ultimate Heat Sink Temperature," listed as references to support a Unit 3 TS Amendment dated April 28,1995, were neither retrievable nor retained within the licensee's QA reconde. (04113)

These violations in Section IV represent a Severity Level lil problem (Supplement 1).

Civil Penalty - $100,000 V.

VIOLATIONS C F NRC REQUIREMENTS NOT ASSESSED A civil PENALTY A.

10 CFF. 50.59, " Changes, tests and experiments," permits the licensee, in part, to ma'<e changes to the facility as described in the safety analysis report witho Jt prior Commission approval provided the change does not involve a USQ. The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for the determination that the change daes not involve a USQ.

Unit 3 UFSAR, Section 9.4.6, " Emergency Generator Enclosure Ventilation

' System," describes the EDG room ventilation system, including the room low temperature alarm setpoint of 45'F.

Contrary to the above, in October 1995, the licensee changed the EDG room low temperature alarm setpoint from 45'F to 52*F without performing a written safety evaluation to assure that the change did not involve a USQ. (05014)

This is a Severity Level IV violation (Supplement 1).

B.

10 CFR 50.73(a), " Reportable Events," requires that the holder of an operating license for a nuclear power plant (licensee) shall submit an LER for any event of the type described in 50.73(a)(2) within 30 days after the discovery of the event.

Contrary to the above, the licensee did not submit en LER for certain svents of the type described in 50.73(a)(2) within 30 days after the discovery of the event. Specifically:

1. On November 9,1995, a condition prohibited by the Unit 1 TS was identified, involving a loss of secondary containment, because the SGTS was inoperable with the reactor mode switch not in the shutdown condition; however, LER 50-245/95031, which describes this event, was not issued until January 25,1996.

2. On January 9,1996, a condition outside the design basis of Unit i was ,

identified involving the isolation condenser makeup water being less I

__-- j

Notice of Viofation 27 than the design basis limit; however, LER 50-245/9600g, which describes this event, was not issued until March 5,1996.

3. On March 6,1996, a condition outside the design basis of Unit 1 was identified involving movement of new fuel assemblies over the SFP; however, LER 50-245/96023, which describes this event, was not issued until April 19, 1996. (05024)

This is a Severity Level IV violation (Supplement 1).

Pursuant to the provisions of 10 CFR 2.201, Northeast Nuclear Energy Company (Licensee) is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. hiuclear Regulatory Commission, within 30 days of the date of this Notice of Violation and Proposed imposition of Civil Penalties (Notice). This reply should be clearly marked as a " Reply to a Notice of Violation" and should include for each alleged violation:

(1) admission or denial of the alleged violation, (2) the reasons for the violation if admitted, and if denied, the reasons why, (3) the corrective steps that have been taken and the results achieved, (4) the corrective steps that will be taken to avoid further violations, and (5) the date when full compliance will be achieved, if an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken Consideration may be given to extending the response time for good cause shown. Under the authority of Section 182 of the Act 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Within the same time as provided for the response required above under 10 CFR 2.201, the Licensee may pay the civil penalties by letter addressed to the Director Office of Enforcement, U.S. Nuclear Regulatory Commission, with a check, draft, money order, or electronic transfer payable to the Treasurer of the United States in the cumulative amount of the civil penalties proposed above, or may protest imposition of the civil penalties, in whole or in part, by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the Licensee fail to answer within the time specified, an order imposing the civil penalties will be issued. Should the Licensee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalties, in whole or h part, such answer should be clearly marked as an " Answer to a Notice of Violation" and may: (1) deny the violations listed in this Notice, in whole or in part, (2) demonstrate extenuating circumstances, (3) show error in this Notice, or (4) show other reasons why the penalties should not be imposed. In addition to protesting the civil penalties, in whole or in part, such answer may request remission or mitigation of the penalties.

In requesting mitigation of the proposed penalties, the factors addressed in Section VI.B.2 of the Enforcement Policy should be addressed. Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 2.201, but may incorporate parts of the 10 CFR 2.201 reply by specific reference (e.g., citing page and paragraph numbers) to avoid repetition. The attention of the Licensee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing civil penalties, d

• L j4 Notice of Violation 2f, Upon failure to pay any civil penalties due which subsequently have been determined in accordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attomey General, and the penalties, unless compromised, remitted, or mitigated, may be

collected by civil action pursuant to Section 234(c) of the Act,42 U.S.C. 2282c.

The response noted above (Reply to Notice of Violation, letter with payment of civil penalties, and Answer to a Notice of Violation) should be addressed to: Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555 with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region i, and a copy to the NRC Resident inspector at the facility that is the

subject of this Notice.

Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. However, if you find it necessary to include such information, you should clearly indicate the specific information that you desire not to be placed in the PDR, and provide the legal basis to support your request for withholding the infom,ation from the public.

Dated at Rockville, Maryland

this 10th day of December 1997 1

1 4

4 l

1 4

e

$