ML20203H396

Integrated Sys Functional Review for Mnps,Unit 3, Engineering Self Assessment Rept

ML20203H396
Person / Time
Site:	Millstone
Issue date:	12/31/1997
From:	Bonaca M, Jain N, Necci R NORTHEAST NUCLEAR ENERGY CO.
To:
Shared Package
ML20203H345	List: B17049, Provides Addl Info Re CAs Taken on Recirculation Sump Spray Sys,Per Discussion W/Nrc Staff at 980113 Predecisional Enforcement Conference Re Insp Rept 50-423/97-206.Results of Tests & Reviews,Encl.W/Three Videocassette Tapes ML20203H353 ML20203H366 ML20203H396
References
3-ESAR-97-043, 3-ESAR-97-43, NUDOCS 9803030212
Download: ML20203H396 (101)

Text

{{#Wiki_filter:- _ _ _ Docket No. 50-423 B17049 Integrated System Functional Review for Millstone Nuclear Power Station, Unit No. 3 Engineering Self Assessment Report (ESAR) 3 ESAR-97-043 (3DE-SA-97-10) - Cecember 1997 February 1998 9803030212 980226 DR ADOCK 050 4 --..J

Intigrated System Functional Review for Millstone Unit 3 - Integrated' System Functional Review for Millstone Nuclear Power Station, Unit 3 Engineering Self Assessment Report (ESAR) 3 ESAR-97-043 (3DE-SA-97-10) l December,1997 Prepared By: Nt'YNfMos Date I2-3 I-V i Nirmal Jain Team Technical Lead Evaluator Date /A-3/ O Reviewed By' Evaluator's Supervisor Approved By: NMMb-Dec 3# 'IS Mario Bonaca Director, Nuclear Engineering Dept. Approved By: Date /- S-7 3 Ray Necci Director, CMP 3-ESAR-97-043 PageI

integrated Sptem Functional Review for Millstone Unit 3 Executive Summary Millstone Unit 3 evaluated an integrated functional plant response to design basis accidents (DBAs) as a part cf the Station Self Assessment Program. The DBAs examined were Loss of Coolant accidents with and without the off-site power supply. The assessment focused on the interactions which take place among the safety systems and the support systems during the changing conditions caused by the accident. The assessment also factored in the external operating experience in the system evaluation. This was a limited scope assessment which took a." horizontal slice" across the entire plant, rather than concentrating on how individual systems perform in response to plant conditions. This approach complemented other assessments (such as Configuration Management Program) and inspections performed by both intemal and external organizations. To the best of our knowledge, this approach and the rigor of the review have not been used previously in the nuclear industry. The Loss of Coolant ac'cident was selected as the DBA ofinterest since its mitigation-involves almost all the safety systenis and thus maximized the number of system interactions in concert with each cther to be studied. This was an extensive efrort involving 6 full time and 7 part time team members over 8 weeks. The team evaluated over 25 systems. Engineering discussion sessions (brainstorming) were held to discuss the systems and question the design, the interfaces, the surveillances, the applicability of operating experiences at other plants, etc. Innumerable questions were asked, many of which had oeen previously addressed by the CMP process and could easily be discounted as not requiring further investigation. Although the purpose of this study was not to validate or assess the CMP effort, the overall effectiveness of the CMP was evident. The team identified 44 items which were investigated further. Of these items 14 resulted in " Condition Reports" of varying significance. Some of the CRs have operability / reportability considerations, a few require plant or procedure modification and others reco nmend enhancements to operating and surveillance procedures, Of these Condition Reports 12 need to be evaluated prior to plant start-up. Categorizing these CRs into functions; seven CRs can be attributed to incomplete or inadequate surveillance procedures, two CRs to Emergency or Abnomial Operating procedure deficiencies and/or training, and four CRs to inadequate design. Modification and/or a procedurai change may be required for eight of the CRs prior to MP3 going to mode 4. l The team recommends that the ongoing study of the Post Acc' dent Sampling System (PASS) include the thought process of this study in evaluating the system adequacy. Based on the extent of the Integrated System Functional reviews, the team concludes that sdditional review of different scenarios are likely to yield little new information for Millstone Unit 3 and therefore,is not warranted. 3-ESAR-97-043 Page 2

integrated System functional Review for Millstone Unit 3 I lit of Condition Heports 4 CR Number lasue M3 97 4130 liCCS Venting Surveillance procedures do not require an operability assessment if any gas is found. M3 97 4131 I!CCS Venting Surveillar.cc procedures do not include all sections of I!CCS piping with a potential for gas accumulation. M3 97-4156 Charging and Si suction side check valves are not being tested for an actual two train full flow. Currently only one train operation is being tested. M3 97 4157 A potential of AFW pump cavitation exists during switch over from the CST to DWST. M3 97 4158 QSS pumps do not have minimum flow lines. A single failure could result in a consequential breach of pressure boundary due to dead heading of the pump. creating a leak path for the RWST inventory. M3 97 4342 The operator will not be able to close Charging suction valves to the RWST for the post LOCA sump,veirculation if VCT level is low. M3 97 4343 A potential of112 leakage from the VCT to Charging suction exist. M3 97 4530 1.et down isolation is recommended in the leak AOP to control pressur;ter level. M3 97-4531 The operators are not being made aware of the limitations of extended operation of AFW pumps at !be minimum flow. M3 97-4532 A portion of!!CC3 piping inside he containment is being left in a potentially drained condition which would cause water hammer. M3 97 4535 Portions of the !!CCS piping inside the containment should be included in the surveillance for verifying full of water. M3 97 4536 The operators are not being specifically trained on cdtigating failure of Si to reset, which may be a critical failure for the SGTR to prevent SG overfill. M3 97-4640 Certain systems are not being declared " inoperable" when reconfigured for short durat on. For example, the accumulators are i not declared inoperable when me N2 vent ' calves are opened. M3 97 4648 The heat tracing on the RWST level indication is non safety grade. ( 3.ESAR 97 043 Page 3

integrated System Functior.nl Review for Millstone Unit 3 Table of Contents llackgrour.d 5 Purpose '5 Process 6 Results 8 Isn'es Recommended for Resolution Prior to Startup 9 l l Scope of Current Review 12 Recommendation for Further Review 13 Attar.hment 1 List of Team Members - Sil LOCA Scenario - List ofitems Pursued in the Review Copies of CRs Generated by the Reticw 3 ESAR 97 043 Page 4 .g-.

i int grated Splem I* unction:1 Review for Millstone Unit 3 t Hackground j i All of the systems, including the support systems, need to work in concert through changing conditions to successfully mitigate an accident. Detailed reviews of the l hiillstone 3 design have been perfonned on a system by system basis by the Chip. llowever, the interactions that occur between the various systems during an accident have not been reviewed in as much detail. The NSSS, which is designed by the PWR vendor, needs to interface with support systems designed by the Architect Engineering (AE) firm. The interfaces between the NSSS and support systems are fully understood under normal operating conditions, llowever, under accident conditions, the stand by safety systems are required to operate and interface with both the NSSS and support systems. Because experience with the stand by safety systems is limited to testing and surveillance, interface issues with these systems may remain undiscovered. This integrated system functional review focuses on the dynamic interactions that occur between the normal operating systems, the stand by which are sequenced to start and - support systems. The need for this review was identified by the Chip Effectiveness Review Group and supported by the Nuclear Safety Advisory Board. The need for this review was highlighted after the discovery of potential water hammer in the RSS piping by the NRC ICAVP out of scope iraspection (CR hi3 97-0128, LER hi3-97-03). i Purpose The purpose of this integrated system functional review is to consider the dynamic interactions that take place between various systems during an accident scenario. This type of functional review examines a horizontal slice across the various systems, rather than a detailed vertical slice through each individual system, it also examines the interface between the operator recovery actions and the systems under changing conditions. Both industry and unit operating experiences are factored into the review. This review relies on the result.uf the Chip design reviews, done to date, in ensuring that each individual system mecte the necessary design and licensing requirements, in other words, thic review compliments the : reviews done previously. The goal of this review is to ensure that the various systems (!ncluding the support systems) can perform their safety functions to mitigate the postulated event while interfacing with each other under changing conditions during the event. 3 ESAR 97 043 Page 5

Integrated Sptem functional Review for Milhtone Unit 3 Process The integrated functional system review was perforn ed using a team approach. The team followed Design Control hianual, Chapter 9. Revision 5 as it relates to performing a preemptive self-assessment. The self assessment method of the DChi provided the flexibility and freedom to use the engineering judgment and experience of the team members to highlight the areas where an issue might be hidden and to determine the validity ofidentified issues. Plant operations experience, and especially the external operating experience, was found to be very useful in asking the probing question. "Does this system have the same or a similar conditionT' The review team members were experienced personnel selected to cover the following areas: knowledge of the system design basis, operations, safety analysis and startup testing, In addition, a team member with operations experience from a sister plant was included for comparison and contrast to hiillstone Unit 3 operation. In house experts and experts from external organizations were also consulted to factor in operating event experience. The average work experience level of the full time team members was greater than 20 years. A list of the team meinbers is included in Attachment 1. The first step of the integrated system functional review was to determine which systems should be included in the review. The review focused on the safety significant stand-by systems, the systems which are realigned during the accidents, and the systems which span both the NSSS and AE scope of design. A list of the systems reviewed follows: Electrical Distribution Off site Power Supply Diesel Generator and auxiliaries, including room cooling EGLS (i.e., sequencer under various LOP scenarios) Auxiliary Feedwater System Accumulators, Sill, RllR, and auxiliaries e Charging Si mode, including auxiliaries such as lube oil cooling and room e cooling QSS and RSS hiain Steam and ADVs e Service Water System e RPCCW and other safety grade cooling systems such as CCI and CCE Next, an accident scenario was selected to examine the integrated response of the systems listed above. A LOCA scenario was selected because it uses all of the key safety significant systems and, along with operator recovery actions, uses most of the safety related interfaces between the AE and NSSS vendor systems. The postulated LOCA scenario is described in detail in Attachment 2. 3 ESAR 97-043 Page 6

l Integrated Sptem functional Review for Milhtone Unit 3 The simulator, system P&lDs, and the Millstone Unit 3 EOPs were used during the integrated system functionel review. The simulator was used to gain understanding and examine interactions between the normal operating systems and the safety systems during the pre trip phase of the LOCA event. The simplified flow diagrams were created from the detailed P&lDs to provide the review team with a common frame of reference for discussion and an overview of the system. The EOPs were used to identify the post trip operator recovery actions. For recovery from the LOCA event, the operator would go through emergency procedures E 0,"Itcactor Trip or Safety injection," E 1," Loss of Itcactor or Secondary Coolant", and ES 1.2 " Post LOCA Cooldown and Depressurization." If the break size were Inge enough to cause the itWST to drain to the level required for transfer to cold leg re circulation, the operator would enter ES 1.3, " Transfer to Cold Leg Ite-circulation" and subsequently go to ES 1 A. " Transfer to llot Leg Ile-circulation." The scope of the review was limited to design basis scenarios. Scenarios with non-limiting single failures, or failures occurring at different progression points in the scenarios, were postulated to flush out associated items. The ultimate safety function of the system was kept in focus. A detailed review of a specific item was pursued only upon agreement within the review team that the CMP may not have addressed or overlooked the importance of the item. Questions relating to scenarios involving multiple failures were not pursued. The review team used engineering discussion sessions (brainstorming) to review each safety system, versus a check list process. These brainstorming sessions provided the team with the most flexibility to identify potential items which required further review. The system engineer fbr the system, generally attended the brainstorming session. Many of the review team's questions were addressed by the system engineer when he provided an overview of his system. It is impractical to list all of the questions which were asked during a brainstorming session. The following is a partial list of topics that were discussed and covered by the team to give the flavor of the team's thinking and the review process: Potential for Pump Cavitation During Valve Lineup Changes Potential for Pump Deadheading During Valve Lineup Changes e e Potential for Water llammer Diesel Load;ng Sequence of Support Systems EITects of Active and Passive Failures on the System llesponse e Effects of Operator Itecovery Actions on the System llesponse Timing of Automatic Actuation Signals e

• Potentiai Itelease Paths for Off site and Control lloom Doses Adequacy of Surveillance e

Accumulation of non condensable gases in stagnant piping e 3 ESAR 97 043 Page 7

i e Integrated System Functional Review for Millstone Utilt 3 i Cavitation, deadheading, and water hammer problems are significant since they could lead to subsequent pump or valve failure that could place the plant outside its design basis. Considering the potential for pump cavitation and water hammer, the review team questions centered on ways non condensable gas or water vapor could get into the lines (potential valve leakage for example) and not be detected or vented. Considering the potential for pump deadheading, the review team questions centered on the adequacy of the mini flow lines and valves, particularly shared mini flow lines. lsometrie drawings were reviewed to identify the potential of gas accmulation or void formation. The team also relied on previous walkdowns and the familiarity of the system 4 enginects with the plant configuration to obtain geometry related details, in isolated instances, plant walkdowns were performed. The team did not perform a review of calculations. This was done in previous CMP reviews. For example, the team did not perfonn or review the available minimum NPSit calculations for the various pumps. i Also, the team did not look into internal flooding since we assumed this was covered in t the llEl,B program. Similarly, the scope of the review was kept limited to avoid re-review of the items reviewed in the CMP For example, the valves that need to change position during the transient were reviewed to make sure they are in the Gl.8910 program and to make sure that valves that are located in a harsh environment are in an EQ program. Ilowever, the details of the calculations as.ociated with these programs were not reviewed. A list ofitems were created to track the questions which could not be addressed during the brainstorming session. Review team members were assigned responsibility for addressing these open items, if required, additional engineering support personnel were contacted to help address the open itemsi Finally, the system engineers were brought back to address any remaining issues and if, in the opinion of the review team, these items could not be satisfactorily addressed, the team documented the item in a Condition Report (CR). Results The review identified a few design deficiencies, procedure inadequacies, and a few requiring operability /reportability considerations. The team identified 44 items which were investigated further in detail. Attachment 3 provides a discussion of all 44 items. Of these 44 items,16 remain open and unresolved. All of the open items are being tracked in CRs.14 items resulted in new CRs and the remaining two items had pre existing open CRs. A copy of all the CRs generated by this review is provided in. i Many of the 44 items were identified in previous reviews. This gave the review team confidence that the prior CMP reviews were effective in ferreting out the major issues. If a CR was already open on the item, the team did not generate a new CR, nor followed up into the details of addressing the issue to close the CR. 3 ESAR 97 043 Page 8

Integrated Spt:m Functional Review for Millstone Unit 3 The following major issues were found. The team recommends that these issues be resolved prior to start up since they potentially challenge the operability of the safety systems. The remaining issues contain suggestions for improvement and need not be impleme*d prior to startup. Issues Recommended for Resolution Prior to Startup

1. Potential for Non-condensible Gas In ECCS Pininn The hiillstone Unit 3 Technical Specifications require that the ECCS piping be verified to

- be full of water. Non condensable gas in the piping could result in a water hammer event or could gas bind a nmning pump. There have been many instances of non-condensible gas accumulation in the ECCS piping in the industry. Two principal sources for the gas have been leakage of hydrogen from the VCT, which can accumulate in the non-operating charging pump suction line, and nitrogen from the Si accumulators, which can accumulate in the RilR or Si piping. We have investigated these sources for hiillstone Unit 3. Millsbne Unit 3 vents the accessible ECCS piping every 31 days to meet the Technical Specification requirement. In practice, Millstone Unit 3 only vents the ECCS high points which are located outside containment because the vents inside containment are considered in accessible. This does not seem to be consistent with the industry practice. Discussions with Westinghouse revealed that other licensees do include portions of piping inside the containment for this surveillance. Also, the improvc.1 standard Westinghouse Technical Specifications do not differentiate between inside and outside containment, nor do they mention accessibility as a factor in scope of surveillance. Originally, Millstone Unit 3 was a sub atmospheric containment with a fairly low operating pressure; this may have been a factor for considering the containment in-accessible. Now that the Millstone Unit 3 containment operating pressure is very near atmospheric pressure, we recommend that the decision of assuming all piping inside the containment as automatically in-accessible, be addressed.(CR M3 97-4532 & 4535) For the piping outside containment, we reviewed the isometric drawings in detail to ensure that all locations where non-condensible gas could accumulate are being vented in accordance with the Technical Specification surveillance requirements. We found that about 50 feet of 6 to 8 inch ECCS piping is currently not being vented and therefore, not being verified to be full of water. This section of the ECCS piping is used during sump re-circulation. There are no vent valves for this portion ofpiping. Any non-condensible gas in this section of piping could cavitate both the charging and SI pumps after the transfer to sump re-circulation. (Open CR M3 97-4130 & 4131) We have also reviewed the potential of112 leakage from the VCT to the charging pump suction piping. On SI, the VCT is isolated from the charging suction. Ilowever, these isolation valves are not leak tested. Since the 112 overpressure in VCT is maintained on 3-ESAR 97 043 Page 9

integrated System l'unctional Review for Millstone Unit 3 Si, a potential of112 leakage to charging pumps exists. Our review identified at least two paths for leakage of112. (CR M3 97-4343)

2. Potential for Containment Sumn Inventory Leakace Outside Containment NRC Information Notice 91 56 requires consideration of all potential leakage paths in the off site and control room dose analyses. We believe that this IN notice was inadequately addressed by Millstone Unit 3. For example, both the charging and Si suction lines from the RWST header have both isolation and check valves to prevent leakage back to the RWST during re circulation. Ilowever, neither the isolation valves nor the check valves

- are leak tested. Any leakage past these valves would bypass the containment SLCRS boundary and accumulate in the RWST, which is vented to the atmosphere. Other paths, such as through the mini flow lines can also be postulated. Several CRs have been written to address this issue, and one of them is still open. This issue should be fully resolved prior to the unit start. (CR M3 97 3218)

3. Potential for Deadheadine the OSS Pumns The QSS pumps do not have mini flow lines, if either discharge valve (MOV 34A or 3411) fails to open on a Containment Depressurization Actuation (CDA) signal, the associated QSS pump would start and deadhead. The deadheaded pump could develop a leak. The elTect of such a leak on the RWST inventory or internal flooding has not been considered. The maximum leak rate for such a failure needs to be estimated to determine if this could pose a flooding or a significant loss of RWST inventory concern. (CR M3-97-4158)

4. Failure to Full Flow Test the Si and Charcine Pumn Suction Check Valves The two Si pumps have check valve 3 Sill Vil in the common line from the RWST header. Similarly, the two charging pumps have check valve 3 Sill V268 in the common line from the RWST header. Per the IST procedure, the check valves are tested by operating only one pump at a time. Since both Si and both charging pumps will start following a safety injection signal and subject the valves to higher flow rates, this IST test does not represent the full flow test, i.e., the procedure does not demonstrate full lifting of the check valves. Apparently, these check valves were not full flow tested during initial startup either. There could be inadequate NPSil for the pumps if these check valves failed to fully open. (CR-M3 97-4156)

5. Inability to isohite Chprcine Suction to RWST on Transfer to Sumn Re-circulation The charging pump suction isolation valves ( 3CllS LCV112D & E) to the RWST are controlled to open on low VCT level (<4.4%). This protects the running charging pump by transferring suction from the nearly empty VCT to the RWST.

3.ESAR 97 043 Page 10

__;o _,_gm2 4, ,,,.J.,,4a2_.:._.. .g. 21,s l,, w A.m_ +m, _,4 m_.s a ,s 4 _,._-_., gam Integrated System Tunctional Review for Millstone Unit 3 Following a LOCA event, these isolation valves need to be closed for sump re circulation to limit back leakage to the RWST. The control system, however, will keep them open if the VCT level were less than 4.4%. The VCT low level signal to open valves 3CilS. LCV112D & E can not be overridden nor the valves have a locked close position. The recovery procedure for transfer to sump re-circulation (EOP 35 ES 1.3) had been revised to remove power from these valves to keep them closed. The purpose of this revision was to address a scenario in which the VCT level were to fall below the low level transfer set point after the system had been placed in re circulation mode. That modification does not, however, properly address the scenario described above (i.e., closure of the valves when low VCT level is present). (CR M3 97-4342)

6. Differences fictween Opsrations and the Desien flasis Several minor differences between operation and the design basis were discovered during the review. These are described briefly below. They are described in more detail in.

The nonnal charging system was designed so that, with letdown isolated, the flow from one charging pump could keep up with the leck rate from a 3/8-in line break in the RCS. This would allow the operator to perfonn an orderly shutdown. In practice, Millstone Unit 3 avoids letdown isolation and instructs the operators to trip the reactor and generate an Si if both charging pumps cannot keep up with the leak. This approach results in Si for the scenarios which could have been mitigated by a controlled shutdown. (CR M3-97-4530; evaluation of the CR is not necessary prior to the unit start) A passive failure 24 hours into an event could disable both charging or both Si pumps during re-circulation if neither charging pump is available, the emergency procedures instruct the operator to align the RSS system to inject through the RilR lines, Currently no analyses to support this lineup exists.(analysis is in progress) The emergency operating procedures require Si to be reset before perfonning subsequent actions to trip ECCS pumps (to terminate or reduce the safety injection flow rate) or realign valves (prior to the transfer to re-circulation). The Si reset is vulnerable to single failure, yet there is no training or guidance in the procedure to address this failure.(CR M3-097-4536) Non safety grade piping is isolated from safety grade piping to ensure that the safety system will operate as intended when required. Non safety grade piping is used to fill the Si accumulators, test valves, etc., and is not automatically isolated on a safety injection signal. The associated safety equipment is not declared inoperable during the period it is connected to the non-safety grade piping. (CR M3 97-4640) 3 ESAR 97-043 Page 11

integrated Sptem functional Review for Millstone Unit 3

7. Pumns Runnine on Mini flow NRC bulletin 88-04 requested licensees to evaluate the sdequacy of the minimum flow bypass lines for safety related centrifugal pumps and to include verification from the pump manufacturer that current mini low rates are sufficient to ensure no pump damage from low flow operation.

The AFW flow rate is controlled by the operator to maintain SO level following an accident. For certain size LOCAs,little AFW flow may be required for heat removal so these pumps could be running on mini flow for an extended period. Design engineering received revised minimum flow rates from the pump manufacturer which were much higher than the original flow rates. The higher flow rates were not adopted since it was concluded that the original mini flows afTect only the long tenn operation of the pumps (when operating on mini flow). Operations was not aware of a time limit for running these pumps, so there is no guidance in the procedures and the operators are not trained to trip these pumps.(CR M3 97-4531)

8. Qualification ofIleat Tracinn The heat tracing on the sensing lines for the RWST level indication, although redundant and reliable, is not safety grade. This indication is used by the operator to determine when to transfer to re-circulation. The sensing lines are located out side in the yard and are vulnerable to freezing during accident. (M3 97-4698)

Scope of Current Review The focus of this review was to look at the types ofissues that may not have been addressed in detail by the previous CMP review process. CMP reviewed in detail system design, it did not specifically focus on how systems interact with each other. This review took a broader perspective of considering interactions between operating systems with stand by-systems or the interactions between stand-by-systems with each other and how this relates to each systems design. Operating event experience applied broadly, also led to the discovery of some issues. Most of the issues can be summarized in the following broad categories: potential of a void or trapped gas in the ECCS piping e inadequate testing of check valves e design deficiencies such as inadequate or no min. flow lines for pumps, uncertain e pedigree of heat tracing These findings were discovered by the review of safety systems credited in a LOCA scenario. This scenario captured the majority of the safety systems and the aspects of these systems which would also be credited for mitigation of other events (i.e., SGTR. 3 ESAR 97 043 Page 12 i

integrated System functional Review for Millstone Unit 3 St.B. Loss of Feedwater flow, etc.). llowever, given the extent of this review, the question arises if the remaining few safety systems have similar concerns. The systems which were not reviewed in this study include; VAC, Instrumentation & Logle, PASS, SLCRS, and containment isolation. Our basis for not expanding the review to include them can be summarized as follows: hip 3 design maintains separation & redundancy in electrical / instrumentation design e and Chip reviewed the design in detail. 'ihese are the main reasons for the absence of any findings in these areas. Therefore, the consensus of the team was that little added value would be gained by expanding the scope to include VAC, instrumentation or logie. Over the past few years SLCRS has been reviewed a number of times. Therefore, we did not anticipate finding anything new and the consensus of the team was that little added value would be gained in expanding the scope to include SLCRS. We looked at the functionality of various valves and raised issues relating to leak tightness. Our review fbund that the EQ and 8910 programs for the valves have captured all the relevant valves. Therefore, the team assumed that the Containment isolation Valve list is similarly complete and further review is not warranted. Recommendation for Further Review PASS was not reviewed by this effort. We understand that a study of PASS is currently in progress. We recommend, that this study include the type of review that was performed in this effort. 3 ESAR 97-043 Page 13

Integr3ed Sptem I'unctional Review for Millstone Unit.1 i l List of Team Members i = 3 ESAR 97 043 Page1 1

t Integrated System l'unctional Review for Millstone Unit 3 Evil Time Review Team Members Bill Stairs NU Project Lead Nirmal Jain ABB/CE - Technical Lead i John Rothert NU PRA kick Ofstun Westinghouse Analysis Allen Farlow Westinghouse Technical Support Mike Galle SCS - Operations Part Time Review Team Munbers Mike O' Conner NU Operations 11111 Cote NU Training John McInerney Westinghouse Licensing Joe Moore Westinghouse Site Service Richard Johnson NU. Operating Event Experience llob Stanley NU Oversight Mark Loeffler Westinghouse CMP Mike llorton SCS - Technical Services Mark 13owmont Westinghouse Operating Event Experience Contacts Alberto Alras NU RSS System Engineer Dan Aube NU - I&C Bob llain S&W Design Engineer Lamar Brown Westinghouse - Licensing llob 13rouillier NU IIVAC System Engineer Steve Chim NU - 1&C Fred Cletek NU PRA(IIVAC) Bob Ciminel INPO Operating Event Experience Joe Creamer S&W - Design Engineer Rich Debernardo NU - DC System Engineer Ray Deconto NU - RSS System Engineer Dave Fink Westinghouse - LOCA Analysis Jim Grover Westinghouse - Dose Analysis Rick llalleck NU - Electrical Design Tedllodge NU - FWA System Engineer Cris Janus NU SI System Engineer Steve Jonash NU - RilR System Engineer Geoge Konopka Westinghouse - Fluid System Design Neil Lewis Westinghouse - SGTR Analysis Bob Mcdonald NU -IIVAC System Engineer Chris Morgan Westinghouse Licensing /rechnical Specifications Dave Presutti NU - AFW llVAC System Engineer 3 ESAR 97-043 Page1 2

integrated Sptem I'unctioc! Review for Millstone Unit 3 Steve Pietryk NU. SW (Intake Structure) System Engineer - John Plourde NU. AC System Engineer Pete Quinlin NU Engineering lirlan Shanahan NU ElXI System Engineer 13 rand Sisk NU -IIVAC System Engineer Sheldon Stricker NU. System Engineering flob Teixeira NU - FWA System Engineer Pete Tirinzoni NU CVCS System Engineer l; 3 ESAR 9/C3 Page13

Int: grated Spt:m function:1 Review for Millstone Unit 3 l Scenario Description i i 3 ESAR 97 043 Page 21

Integrated System functional Rniew for Millstone Unit 3 The varying size 1.OCA event scenario described below will exercise the safety systems ofinterest. The discussion of the scenario is tailored to high light the varying system interactions The scenario involves an initial 100 gpm leak from the cold leg and is subsequently increased in size at varying times to allow lbr the c>bservation ofincractions and control functions. Various control functions automatically sequence to control pressurizer pressure and level and core power. Eventually the leak developed to suflicient size to cause a reactor trip and safety injection (SI) initiation. Cases with and without the off site power were considered. Charging, Si, and Residual ifcat Removal (RllR) pumps start and begin to inject when the reactor pressure drops below their respective pump delivery capability, lloth motor driven and turbine drive Auxiliary Feed Water (AFW) pumps supply the Steam Generator (SG) inventory. The SG pressure is controlled by the steam bypass valves (for the cases with off site power) and by the atmospheric dump valves (for the cases without the off site power). To show interactions with the containment spray system, conditions with and without the containment depressurization actuation (CDA) signal present are considered. On low refueling water storage tank (RWST) water level, the operator successfully initiates sump recirculation. At 11 hours,in accordance with the emergency operating procedures (EOPs), the operator would be required to initiate hot and cold side injection. The operator is expected to take various recovery actions during the small 1.OCA event. In the scenario, some operator actions are delayed or omitted to allow the automatic functions to sequence. initial Conditions: lleactor Power 100% Nornni contingent of equipment operating Pressurizer pressure and level controls in auto Rod Control system in auto Scenario Stens: 1.

l. cop 4 cold leg (RCP discharge) develops 100 gpm leak.

2. Charging flow increases. Second charging pump is started manually per AOP. 3555. Make-up to the volurae control tank (VCT)is normally controlled cutomadmily; however, for this scenario it was manually stopped to observe the VCT low mw level switch over to the RWST. Additionally, portions of VCT makeup are non safety grade and can not be credited form design basis space. Pressunzer back up heaters energize automatica!!y to control pressure. 3{SAR 97 043 Page 2 2

Integr:ted System functional Review for Millstone Unit 3 3. No immediate change in containment pressare and temperature is expected; however, the radiation monitors might alarm. The operator would diagnose the leak from the start of the VCT make-up pump, miss match between letdown and charging, decreasing VCT level and possibly by the changes in the pressurizer level. The operator actions specified in AOP 3555 are omitted to allow the automatic functions to sequence. The most significant operator action would be to perform a controled shutdown if the pressurizer level had stabilized, otherwise the operator would manually scram and initiate St. 4. On low low VCT level, the charging suction switches from the VCT to the RWST. The resulting boration will cause core power to decrease. Turbine control valves open to maintain turbine first stage pressure. Control rods will move out (if all are not out) to control Tavg. 5. At this time in the scenario the leak rate is assumed to increase (equal to about 3 inch line break). 6. 1,oss of Power (l.OPh The control rods fall in and trip the reactor. Si is generated on low pressurizer pressure. The reactor trip causes turbine trip, turbine stop valves go close, and when the main generator experiences reverse power, its output breaker opens. Case 1: Off site power through NSST continues to provide power to plant equipment. Case 2r Off site power is lost at the time of LOCA (step 5). L Case 3: OIT-site power is lost at the time of main generator trip. Case 4: Grid experiences degraded voltage (between 90 and 70 %) at the time of main generator trip. Case 5: Off site power is lost at some unspecified time afler the main generator trip. 7. Main feedwater isolates, motor driven AFW pumps start on SI, and turbine driven AFW pump starts on low SG level. SG pressure is controlled by the Turbine bypass valves (if main condenser is available) or by the Atmospheric dump valves. 8. DG Initiation: DGs are started on Si or LOP, which ever occurs earlier. Ilowever, it (DG) remains unloaded until the off site power is lost. 9. - Encineered Safety Features Actuation SicnalInitiation: The Si and RiiR pumps start and Charging injection transfers / switches from its nomial alignment to all 4 cold legs. 3 1 3 ESAR 97 043 Page 2 3

? Integrat:d System l'unctional Review for Millstone Unit 3 For the cases where off site power is available, all pumps start at the same time (l.c., no sequencing delays). Otherwise, the loads are sequenced on the DO. i Auxillaries for these systems, such as lube oil cooling, room cooling are also I automatically started. 10 Containment isolation: Si generates the containment isolation signal Cl A. Letdown and SO blowdown isolate, instrument air to the containment is isolated. Cooling How for the CAR fans is switched from the chilled water to the RPCCW. CAR fans A and B are started automatically, if not already running. 12. Auxillaries; Until the off si,e power is available, all operating loads (essential and non-essential), including SW, TBCCW continue to run. Also, the pressurizer heaters remain energized unless the pressurizer level drops below the cut oft L setpoint. t When (and ifi, off-site power is lost,2 SW and 2 RPCCW pumps are restarted. All non essential loads are secured. 13. CDA and Start of Containment Snravs: At a containment pressure of 23 psia a CDA signal is generated and the QSS pumps are started to provide containment spray (either on the off site power or by the DO). The Recirculation Spray Sump (RSS) pumps are started 11 min, after the QSS pumps start and recirculate the sump water to the containment spray headers. For small breaks, containment pressure may remain below the CDA setpoint, i Therefore, the QSS and the RSS pumps will not start automatically. CDA also generates containment signal Cl B. Reactor Protection Closed Cooling Water (RPCCW) to the containment is isolated, 14. Initiation of Sumn Recirculation: The RilR pumps trip on low low RWST level. The operator resets SI, CDA, LOP, and stops the RilR pumps by placing their switches in pull to lock and isolates a portien of the piping, if the RSS pumps are not already running (ie., the CDA had not been generated) the operator will start them and initiate the containment sprays to purge the lines of air, The Charging and the Si pumps will be aligned to the suction from the RSS pumps, then the suction valves form the RWST will be closed. 15. [ Lot em1A]d Side inlection: The operator will turn off the SI pumps and the charging pump continues to provide the cold leg injection. The Si pump will be restarted after the cold leg injection valves are closed and hot leg injection valves are opened. 4 2 3 ESAR 97 043 Page 2 4 . ~ . - ~

~ ^ Integrcted System functional Review foi Millstone Unit 1 1 List ofItems Pursued in the Review 4 I l 4 i 3 ESAR 97-04[ Page 31

Integrated System Functional Rwlew for Mllistone Unit 3 Item 1 - Transfer Charminn from VCT to RWST: VCT I,evel Set Point bh --t

• we llM y,4g l(nu w

.+ ?,5 a) The charging pump nomially takes suction from the VCT If the VCT level cannot be maintained for some reason, the charging pump suction is switched to the RWST. The valves from the RWST (l l2D&E) start to open once the VCT level reaches the low level set point (4.4%). Aner valves 112D&E are full open, the suction valves from the VCT (ll2B&C) start to close. Since the VCT is pressurized with hydrogen gas, it will continue to provide some How until either valve 112B or 112C fully closes. Does the 4.4% switch over set point ensure that sufnclent water is left in the VCT to provide a water seal between the hydrogen nlled VCT and the charging pumps? Is there a vortex preventative device in the VCT7 b) Valves 112B and 112C may not be leak tight. If the water seal is lost, hydrogen could leak by these two valves and Ond its way to the charging pump. Is the VCT vented aner valves ll2B&C are closed? What would the operator do if the VCT level dropped off scale 7 c) Another potential hydrogen leak path from the VCT to the charging pump suction is through check valve V542 and the normally locked close valve V541. This is a 3 in line between the VCT gas space and the seal retum line, Neither of these valves are in the leak check program. Leakage through this path could go undetected during normal operation because the seal return line is at a higher pressure than the VCT. Following safety injection, the seal return line is isolated and leakage through these valves could allow hydrogen to reach the charging pump suction. Why aren't these valves leak tested? A recent INpo SOER (971) deals with the industry experiences ofleakage of112 from the VCT to the charging suction. 3 ESAR 97-043 Page 3 2

--~ Integt:ted Sptem functionil Review for Millstone Unit 3 1 NOTE: It is possible that by the time 112B&C are fully closed, the indicated VCT level would fall off scale low, llased on our discussien with training (Bill Cote), the operator would not be mislead by the off scale low indication if either valve i 1211 or C are verified to be closed. Resolution - i CR M3 97 4343 has been generated to address items b) & c), the potential of112 leakage from the VCT. We recommend that this CR be resolved prior to MP3 start. a) Westinghouse performed a safety evaluation (NEU 97 308E) for increasing the stroke times for the 112 volves.. VCT design does not contain a vortex preventor device. Westinghouse has concluded that the current actpoint (4.4%) is adequate to provide the vortex protection, llowever, this conclusion does not take into account any potential leakage past valves 11211&C. b & c) Our review indicates that there has been no systematic evaluation to ensure that all potential leakage paths t~ rom the VCT to charging pump suction are identitled and addressed. For example our review identified the leakuge path via valves V541 and V542. This is a 3" inch line between VCT gas space and RCp seal return line. 'these valves are also not leak tested to ensule leak tightness for 112. During normal operation, the seal return is at a higher pressure than the VCT and therefore, any leckage will be from the seal return to the VCT, Such a leak will go undetected. Post Si, since the seal return is isolated, it (scal return) will be at lower pressure than the VCT and therefore, the leakt.ge will be from the VCT. 3 ESAR 97 043 Page 3 3 = w- -

Int 3 grated Spon functional Rovlew for Millstone Unit 3 Item 2 - Hasis for Houndary Hetween Class I and Class il Pipinn According to Westinghouse, the nomtal charging system is designed for one pump to keep up with a 3/8 inch line break, assuming letdown has been isolated. Therefore, piping with an ID less than or equal to 3/8 inch is designed as Class 11. Assuming a 3/8 inch or smaller leak in the RCS, the operator will try to recover using procedure AOP 3555. If the pressurizer levelis decreasing, AOP 3555 requires the operator to increase charging flow to maximum and start a second charging pump, but does not require letdown isolation prior to tripping the reactor and initiating SI. If the pressurizer level trend appears to be stable, AOP 3555 requires the operator to isolate both charging and letdown in an attempt to identify the source ofleakage. The Instructions in AOP-3555 are not consistent with the design basis assumption which defines the upper limit for Class 11 piping. What do other companies do for this small leak size, do they isolate letdown? Resolution CR M3 97-4530 was generated suggesting that Millstone Unit 3 consider modifying AOP 3555 to include letdown isolation before tripping the reactor and generating a safety injection. Our discussions with Operations (Mike O'Connor) at:d Safety Analysis (Don Parker) indicated that they believe the EOPs provide better guidance than the AOPs for RCS cooldown and depressurization following a leak. Therefore, if both charging pumps cannot provide enough makeup, the operator is instructed to trip the reactor and initiate safety injection (which also isolates letdown), then follow the EOPs to terminate Si and cooldown to cold shutdown. The current guidance given in AOP 3555, which prevents letdown isolation on decreasing pressurizer level, is band on a concern for thermal shock to the charging nozzle following letdown isolation. Letdown flow is used in the regenerative heat exchanger to warm the charging flow before it enters the cold leg. Mike Galle (Operations, Farley) indicated that at Farley, they would increase charging, then isolate letdown in order to avoid safety injection. They do not want to initiate Si for small leaks because they are concerned with the potential for overfilling the pressurizer before Si could be reduced and/or terminated through the EOps. Also, since a small leak is less likely than other events that could cause letdown isolation, they feel that having instructions to isolate letdown for a small leak is not going to significantly increase the number of themial cycles to the charging nozzle. According to 10CFR50.55a.2, paragraphs i and 11, the NSSS system must be designed such that the reactor can be shutdown in an orderly manner following a break in the class 3-ESAR 97 043 Page 3-4

integrated System Functional Review for Millstone Unit 3 11 piping. The charging system is sized to keep up with a 3/8"line break, provided the letdown is isolated. Therefore, piping smaller than or equal to 3/8" are designed as class 11 piping. Also, a leak is less likely than other potential letdown isolation events which will results in thermal eyeling of the charging nozzle, in this light, isolating letdown and performing a normal shutdown instead of a reactor trip with safety injection following a small leak (3/8" or smaller break) in the itCS would seem to merit further consideration. 3-ESAll-97 043 Page 3 5

Integrated System Functional Review for Millstone Unit 3 item 3, Transfer Normal Charulun to Safety Inketiont Potential for Air in Plninu 'Ihe line up of charging for safety injection requires the use of piping downstream of valves 8801 A&ll Gas in this piping could create a water hammer. Ilow do we verify the piping between 8801 A&D and the check valves is filled with water and remains that way? b To Cold . Las* 4 Gala NA 1 Y d k i vpon N-Ab01D I f Y$45i

to cois s..

y y 31 Pur'ip Resalution CR M3 97 4532 was written to address this issue. There is a potential for a void between valves 8801 A&Il and check valve V005 remaining undetected. This portion of the piping is not checked to ensure it is full of - water (TS surveillance 4.2.5). Infect leak testing of check valve V005, as discussed below, creates a potential of forming a void in the piping. Check valve SilPV005 is tested for leak tightness by applying safety injection pump discharge pressure to the downstream side of the check valve. The test frequency is a minimum of once per refueling interval or more frequently as conditions prevail. To perform this test, the upstream piping between valves 8801 A&B and check valve V005 is isolated and depressurized to measure the check valve leak rate by opening manual drain valve V883. After the leakage measurement is completed, the drain valve and the downstream valves are closed and Si pump is stopped. This leaves the downstream lines pressurized, but the upstream line depressurized and potentially drained. This portion of the piping (between valves 8801 A&B and Sill *V005 will require refilling and repressurization to eliminate potential voids in the line. 1 3 ESAR 97 043 Page 3 6

integrcled System functional Review for Millstone Unit 3 llem 4 - Leidown Isolation May Lift Relief Valvt Either a control fallure, that results in closure of valve FV131. or an inadvertent SI, with a single failure of the upstream isolation valve 8160 to close, is postulated. This exposes the relief valve located between 8160 and 8152 to the RCS pressure. The relief valve is designed to open at 600 psi to protect the dowmtream piping and heat exchanger. Lilling of the relief valve provides a leakage path from the RCS to the pressurizer relief tank inside containment. The relief valve is sized to relieve flow assuming all three orifices are open. Millstone Unit 3 normally operates at full power with only one oriflee line open. The flow rate through the relief valve would be limited at the orifice, if not the relief valve itself. It is likely that 2 charging /S1 pumps would be able to match or exceed the relief valve flow rate at normal RCS operating pressure. This would prevent the pressurizer level from dropping below the low level letdown isolation set point, which would automatically close letdown isolation valves 459 and 460 and MOVs 8149A,Il&C, Note, these are control grade valves but are designed to close on low pressurizer ;evel to isolate letdown. The review team had the following question: 1s acceptable design to have failure of a control system resulting in a RCS leak? h7: ( P*l T I 8149A l 460 459 51498 8160 l 8152 rv131 refm N X l RCS VCT IC ; OC i Resolution This item is considered closed. Westinghouse (George Konopka) compared the Millstone design with the standard 4 loop plant design (SNUpPs). Although the Millstone design is not exactly the same as the 3 ESAR 97 043 Page 3 7

integt:ted Sptem functional Review for Millstone Unit 3 standard design, it meets the same requirements, i.e., the relief valve is located between the two containment isolation valves and is set to protect 600 psi rated piping. We believe this meets the applicable design criteria. The operators are trained on the scenario described above. There is a temperature alarm on the reliefline, so the operator should notice the leak. Also, the PRT level, temperature and pressure indications will be available to alert the operator ofleakage. The operators would close valves upstream of the relief valve to terminate the leak. 3 ESAR 97 043 Page 3 8

-m l Integrated Sptem functional Review for Millstone Unit 3 Item 5 - Lou of RCP Seal Coolinn A CDA generated by high containment pressure following a LOCA or MSLD event would isolate CCP flow to the RCP thermal barrier. If flow control valve llCW182 in the seal injection line were to fall in the closed direction, seal injection would also be lost. This could lead to leakage of RCS inventory through the RCP seals. A loss of RCS inventory caused by a MSLB with an assumed controller failure has not been analyzed. 4 Resolution This item is considered closed. llCV 182 falls open on a loss of power or instrument air. The instrument air compressors are tripped on a safety injection signal, it :s not credible to assume a failure to close of a fail open type valve with a loss of air pressure (Ref.: e mail from John McInerny, Westinghouse). Therefore, a loss of seal injection is not credible. i t b 3 ESAR-97-043 Page 3-9

Integrated 3ystem Functional Review for Millstone Unit 3 Item * - Transfer Charrine from VCT to RWSTr Ilot Water to the YCI CCP cooling to the non regenerative heat exchanger in the letdown line is vulnerable to single failures. For example, only CCP train A provides cooling flow to the heat exchanger. A loss of cooling flow in the non regenerative heat exchanger will introduce hot letdown flow to the VCT llave the effects of hot water in the VCT been evaluated? For example, the operating charging p' imps could cavitate due to inadequate available NPSil or the piping temperature may exceed the design temperature limit. Resolution This item is considered closed Protopower calculated the maximum temperature in the VCT to be 286 F and the maximum temperature at charging pump outlet to be 152 F for this scenario (Protopower Calculation 97128, file 10 283). This :alculation credits the cooler seal return water mixing with the hotter water coming from the VCT for charging suction. The seal return heat exchanger is cooled t,y CCP train 13. Therefore, a single failure cannot fail both the letdown and seal return heat exchangers. Protopower calculation concluded that the charging pump cannot cavitate since the VCT pressure will increase as the temperature of the water in the VCT increases, liigher back pressure in the VCT will provide the additional NPSilA needed for the hotter water. The charging system piping is designed to a temperature of 150 F, A charging water temperature of 152 F (2 F above the piping temperature limit)isjustified. V i 3 ESAR 97 043 Page 310

integrated System Functional Review for Millstone Unit 3 Item 7 - Potential I cakane Path of Sumn Water to the RWST I NRC Information Notice 91-56 requires consideration of all potential leakag aths in the cfr-site and control roo.m dose analyses. Both the cluirging and Si i uion lines from the RWST header have both isolation and check valves to prevent leakage back to the RWST during recirculation, however, neither the isolation valves nor the check valves are leak tested. Any leakage past these valves will bypass the containment SLCRS boundary and will accumulate in the RWST, which is vented to the htmosphere. The impact of any such leakage on the calculated dose, both for off-site and in the control room, has not been taken into account. L Resolution CR M3-97-3218 was previously generated and its significance was under estimated. We recommend that it be fully resolved prior to unit re-start. This issue has been raised numerous plants by the NRC and therefore merits considerable attention to ensure proper 3 closure. IN 91-56 was inadequately addressed by Millstone Unit 3. Several condition reports have been written to address this iss i: J D-97-1936, M3-97-2140 and M3-97-3218). CR M3-97-3218 is open and therefore, ws tid not generate a new CR. Condition report M3-97-1936 was written to assess the leakage and the consequer.ces of the leakage. A conservative leak rate was estimated in response to M3-97-1936. This infonnation can be m 4 *, asess the impact of the valve leakage on the LOCA dose analysis as part of ti e corv.9c action plan for M3-97-3218. The dose analysis assessment has not yet L en completed. Condition report M3-97-3218 was written to address leak testing of the isolation and check valve.c The corrective action plan for M3-97-3218 includes identification of the valves which are affected by Technical Specification 6.8.4, assessment of the impact of valve leakage on the LOCA dose analysis, and development of surveillance procedures for the affected valves. L 3-ESAR-97-043 Page 3-11

Integrated System Functional Review for Millstone U..it 3 Item 8 - Potential for Volds or Non-Condensable Gas in ECCS_fi lng li Technical Specification 4.5.2.b requires verification that the ECCS piping is full of water. How does Millstone Unit 3 meet this surveillance requirement? Resoluti:n CR M3-97 4131 and CR M3-97-4130 (respectively) have been generated for the following two identified issues associated with item 8. To Cnnem o b m{2 ream messora Kwesoya T* si c 1; a y mvnov mveto18 tivtleiB Yl[ &J n imvrieva f Vs'[ I To si < u Vit3 a) The surveillance procedures and isometric drawings were reviewed to determine if all ECCS piping, including the portion used for sump recirculation are being verified to be full of water. After reviewing the piping isometries, it was discovered th: % SI pump suction piping downstream from MOV 8804A to check valve 982, between the vent valve 992 and MOV 8807, and between MOV 8804B to check valve 983 are not being verified to be full of water. These sections do not contain any vert or drain valves. The isometric of the piping suggest that gas could accumulate in these portions and therefore, would remain undetected. These segments of the piping are on the charging and SI pump suction side. Therefore, a void in these segments could gas bind both charging and SI pumps during sump recirculation. b) Detection of any gas in the ECCS piping raises the question of the system operability until the gas is purged. The current surveillance procedures do not provide any guidance on the need to do operability determination if any gas is detected. 3-ESAR-97-043 Page 3-12

Integrat:d System Function l Review for Millstone Unit 1 Item 9 - Transfer to Sumn Recirculation: ECCS Pumn NPSH In EOP 35 ES.I.3, step 2f, the operator is instructed to verify that recirculation spray - pumps A and B are running. If not, he is instructed to start pumps A and B. The operator can proceed to step 2g if eliher pump A or B starts. In this condition, I RSS pump could be supplying 2 SI,2 charging pumps and a spray header, A flow orifice was added to the discharge of each RSS pump to reduce the maximum flow rate from about 5000 gpm to about 3300 gpm to address the RSS pump ru'vut concern (see item 16);llave calculations been performed to determine the available NPSH for the ECCS pumps during recirculation under these conditions, considering the reduction in the RSS supplied flow rate aller the flow orifices have iseen installed? Resolution This item is considered closed. Westinghouse has done two calculations to evaluate the available NPSH for the ECCS pumps (SAE/FSE-C-NEU-079, SAE/FSE-C-NEU-0100). Two cases were run in the first calculation. In the first case,1 RSS pump was assumed to provide suction to 1 charging and 2 Si pumps; this assumption minimizes the suction flow to the charging pump. In the second case, I RSS pump was assumed to provide suction to 1 Si and 2 charging pumps; this assumption minimizes the suction flow to the SI pump. A sump temperature of 150 F was assumed in both cases. In the second calculation,2 RSS pumps were assumed to provide suction to 2 Si and 2 charging pumps. A sump temperature of 230 F was assumed in this second calculation. This assumption is consistent with a single failure loss of a i service water train. Consideration of a failure of the service water train and an additional (non-consequential) failure, that results in a single RSS pump having to supply both charging and both SI pumps, would be beyond the design basis. Therefore, no calculations have been performed to verify that adequate NPSH could be assured in this case. 3-ESAR-97-043 Page 3-13

integrated System Functional Review for Millstone Unit 3 Item 10 - Transfer to Sump Recirculation: llot Water in RSS Pininn Originally, the RSS piping was qualified to 150 F. Assuming failure of one train of SW, the RSS piping down stream of the respective heat exchangers can be subjected to much higher temperatures (sump water temperature and from pump heat up). Has the RSS piping been qualified to these possible higher temperatures? Was the potential for water hammer considered in the RSS piping qualification calculations. Resolution This item is considered closed. All RSS piping (and the relevant portions of the charging, RIIR, and Si piping) has been qualified to 250 F (DCRs M3 96054, M3-96056, MT-96063, M3-96068 and M3-96069). Additionally, potential water hammer concerns were addressed. Item 11 - Active vs. Passive Failures: Check Valves l l FSAR section 3.1.1.2 states that check valves are classified as active components. A check valve is located between the RWST header and the charging pump suction isolation valves. A failure of this check valve could disable both the charging pumps. A similar situation exists in the Si pump suction. Resolution - G. M3-97-2140 had previously been written on this issue. This item is considered

closed, in response to that CR, Westinghouse provided a letter (NEU-96-573) which states ht the check valves in the ECCS system are considered to be passive components. They are designed to a more stringent criteria which assures no gross deformation and thus minimizes the likelihood of failure.

The FSAR, page 3-1.4, states that there are ex.@tions in the ECCS system. The need for any FSAR changes to clarify the exception will be determined in CR M3-97-2140 resolution. 3-ESAR-97-043 Page 3-14

integrated S) stem Functional Review for Millstone Unit 3 Item 12 - RilR System: I.cakane from Accumulators The accumulators are pressurized to approximately 600 psi with a nitrogen cover gas. Leakage, during normal operation, of the nitrogen rich accumulator water through the check valves and into the low pressure RilR discharge piping could result in the gas coming out of solution. A nitrogen bubble at the RHR discharge could result in water hammer when the system is started A recent INPO SOER 97-01 deals with the industry experiences of N2 accumulation in the low pressure side of the ECCS system Resolution CR M3-97-4580 and CR M3-97-4581 were generated by Safety Engineering in response to the SOER, The accumulators are located at an elevation of-24 feet, while the connection to the SI system is at an elevation of about 13 feet. A significant volume of water must be displaced before water leaking from an accumulator can reach the check valve to the i R11R piping. This would cause the accumulator level and pressure to decrease notably, The accumulator leakage would not go undetected for long because Millstone Unit 3 has a relatively narrow opereting band on the accumulators. The Millstone Unit 3 accumulator low level alarm response procedure does not provide any instructions or guidance to determine where the water went. Millstone Unit 3 1 Operations (Keith Covin) say they would write a CR to determine where the water was going if an accumulator had to be repeatedly filled. Considering that Millstone Unit 3 has such a narrow operating band on the accumulators, and that only one instance of accumulator in-leakage has been observed to-date, and that a large volume of water must be displaced before accumulator water could reach the low pressure piping, accumulation of N2 in the RilR piping is not likely. 3-ESAR-97-043 Page 3-15 U

integrated System Functional Review for Millstone Unit 3 Item 13 - Vold in RfIR IIcat Exchanner at Low RWST Level The RHR pumps can be turned off by the operator following ECCS actuation if the RCS pressure (including uncertainties) is above the RllR pump shutoff had or if a transfer to recirculation is required, is it possible for the heat exchanger tubes to void aner the pumps are tripped? If so, there could be a problem with water hammer if the RHR pumps are restarted. Resolution This item is considered closed. The RIIR heat exchangers may begin to drain when the RWST level decreases and falls below the elevation of the heat exchangers. Therefore, to determine if voiding could occur, the fluid elevation in the RWST was compared to the elevation for the top of the RilR heat exchanger. The data was taken from drawings No. EP-11 t h! 8, " YARD PIPING SECTIONS SHEET 12"and D 74415," REFUELING WATER STORAGE TANK". The data is given below. I Bottom of RWST is at 24-0 6-in elevation. l Isolation valve 3SIL*VI is located at 29-R elevation. RWST Tank Diameter is 59-R. Description Volume Fluid Elevation RWST level Empty ~47,655 gal ~26-ft 9-in RWST level LO-LO ~520,000 gal ~49 ft Il-in RWST level LO ~1,171,000 gal ~81-n 9-in RWST level Ill ~1,189,000 gal ~82-ft 8-in RWST level HI-HI ~1,195,000 gal ~83-ft The top of RHR heat exchanger is at an elevation of approximately 51-n. Therefore, the RWST 1evel is higher than the RHR heat exchanger untiljust before the transfer to recirculation. At this point, the RWST level is slightly lower than the top of the RilR heat exchanger. RHR, if needed, is expected to be initiated before the RWST water level drops to the setpoint where the sump recirculation is initiated. Therefore, the amount of - void, if any, will be minimal when RHR is expectad to be initiated. The operator could start the RHR pumps after the transferring to sump recirculation, but only after consulting with the ADTS (see step 30d of ES-1.2). We are assuming that the TSC staff will provide the appropriate guidance at that time. l 3-ESAR-97-043 Page 3-16

Integrated System Functional Review for Millstone Unit 3 Item 14 Ileat-un of RilR Pumns on Mini-Flow I The CCP water supply to the RHR heat exchangers is isolated on a safety injection signal. The R11R pumps start following a safety injection signal, but may not provide flow to the RCS if the pressure is higher that the pump shutofThead. In this case, the pumps would run on mini flow The RilR pump mini flow return is routed threugh the RilR heat exchanger back to the pump suction. Because the cooling flow to the RiiR heat exchanger is isolated, there is a 30 minute limit for pump operation on mini-flow to prevent overheating. Should the 30 minute limit for RIIR pump mini flow operation be noted in the EOPs? Does the 30 minute limit take into account thermal expansion of the water trapped in the system? Resolution This item is considered closed. The EOPs instruct the operators to trip the RilR pumps if the RCS pressure (including instrument errors) is greater than the shutoff head of the pumps. The EOPs do not have a note or caution regarding running the R11R pumps for more than 30 minutes on mini-flow. According to training (Bill Cote), this is not required because the operators are trained on the RIIR mini-flow heat up problem. Relief valves on RIIR piping upstream of 8809A&B would open to limit the pressure increase due to thermal expansion. 3-ESAR-97-043 Page 3-17

integrated Syst;m Function:1 Review for Millstone Unit 3 Item 15 - EOP ES-1.3 Sten 2.n RNO vs. Desien Basis Assumption Recovery procedure ES 1,3 (Step 2.n, response not obtained column) requires the operator to line up the RSS through the RHR line if both charging pumps are not. available (due to a 50 gpm leak passive failure for example) llave analyses been done to show that the RSS pump in this line up would be able to support the NPSH requirements. of the running SI pumps? Have analyses been performed to show that the RHR piping (downstream of 8809A&B) is qualified for recirculation? Is this mode ofoperation consistent with what's described in the FSAR. Resolution CR M3-97-1545 had previously been written to address this item. This item is considered closed. The RNO instructions were developed to address what was originally considered to be an event that went beyond the design basis. The potential 50 gpm passive failure that would make both charging pumps inoperable after 24 hours is, however, a design basis assumption. The necessary analyses to support this line-up will be done to addrese the CR. Item 16 - RSS Pump Flow Design changes have been made that require the RSS spray header valves (20A&B) to be open and the cross tie valves (8838A&B) to be locked closed (DCR M3-97045). Does the flow rate in this configuration exceed the 5000 gpm li.mit for the RSS heat exchanger, especially soon after the pump start when the header is empty? Are the runout and NPSH requirements for the RSS pump met under these conditions? Resolution This item is considered closed. An orifice was recently installed in each of the RSS pump discharge lines to limit the flow rate to a maximum value of 3300 gpm when the header is empty. See Safety Evaluation E3-EV-97 0043 for DCR M3-97045. 3-ESAR-97-043 Page 3-18

Integrated System Function:1 Review for Millstone Unit 3 Item 17 - Possible Sump Boron Dilution Due to RHR Pinine Volume When the RilR system is in service, it is filled with vcater having a boron concentration equal to the cold shutdown boron concentration of the RCS. During surveillance testing, prior to startup, the operator opens valve V43, which recirculates back to the RWST, to ensure the boron concentration in each train is the same as the RWST (See operating procedures OP-3310B and OP-32088). This fills the RHR system behind valve - 8809A&B w%h RWST (bora;ed) water. The volume of water between valves 8809A&B and the RCS loops may be significant and may be at a lowe boron concentration. Following a LOCA, this water could be available for sump dilution. Has this been considered in the RWST boron concentration limits calculation? Resolution This item is considered closed. The RWST boron concentration calculation conservatively assumes all of the RHR piping is filled with water at the RCS pre-trip equilibrium xenon boron concentration. item 18 - OSS: Potential Deadheadine of OSS Pumn l The QSS pumps do not have mini-flow lines. If cither discharge valve (MOV 34A or 34B) failed to open after a CDA signal was generated, the associated QSS pump would deadhead. Assuming the operator did not trip the affected pump, would the pump seal or something else develop a leak? If so, what is the maximum estima*-d leak rate for such a failure? Does this pose a flooding concem, or a possible significant loss of RWST inventory? Resolution CR M3-97-4158 was written to request information regarding the leak rate and to address the potential flooding concern. l There are low flow and high temperature alarms that would alert the operator to this condition. However, according to training (Bill Cote), the operators would not trip the deadheaded pump as long as a CDA is present. 3-ESAR 97-043 Page 3-19

Integrated System Functional Review for Millstone Unit 3 Item 19 - OSS: Pumn Starts with MOV 34A Full Open if the QSS pump discharge valves (MOV 34A&B) fully open before the QSS pumps start, the pumps would be starting against an empty, low resistance system. This might require more than the normal starting current. Could the pump breaker trip? What happens if a loss of off-site power is assumed and either a safety injection or CDA signal occurs after the diesel sequencer passes the SI or QSS pump start point; could these pumps start immediately (i.e., out of sequence) and potentially overload the diesel? Resolution This item is considered closed. The flow rate is limited by an orifice at the QSS pump discharge. Even with an empty header, the pump horsepower would be less than the rated motor horsepower (500 hp). The breaker over-current setpoint is based on the rated motor horsepower. The sequencer is reset following a safety injection or CDA signal. None of the current diesel loads (that had been loaded during the LOP sequence) are stripped during the process. The QSS pumps would be started at the specified time on the CDA sequence and the other loads would continue to run when specified to be loaded again on the CDA sequence. The diesel loading calculations are done in calculation NL-033. I I i 3-ESAR-97-043 Page 3-20 1

Integrat:d Syst:m Functional Review for Millstone Unit 3 Item 20 - RWST Cooline isolation The RWST temperature is maintained by pumping the borated RWST water through a separate heating / cooling system. The RWST heat / cooling system suction valves (AOV 27 and 28) get a signal to close on an SI. These fail close valves are located outside in the yard, next to the RWST. Are these valves on EQ (or some other program) to make sure the solenoid is capable of opening (and thus closing the valve) when required, i.e. no snow or ice, etc. is blocking the solenoid? This same question applies to the DWST also (there are similar valves in its heating / cooling lines). Resolution This item is considered closed. -The RWST heating / cooling system suction valves have been tested ouarterly for 10_ years (per SP 3609.9) and only failed once. Since the valves have been operated no numerous occasions during' winter months with only one failure, we consider this design to be reliable. The DWST valves are in a doghouse. 3 ESAR 97-043 Page 3-21 s

int ^, grated System Functional Review for Millstone Unit 3 4 item 21 - ECCS Leakane Measurement liow is ECCS leakage controlled? Since the leakage is measured at cold conditions, does - this leak rate apply at hot conditions (during recirculation)? This issue was raised during a design inspection at another plant, Resolution This item is considered closed. Millstone Unit 3 has a design leak rate limit of 5000 cc/hr. The leak rates measured in the following surveillance procedures are summed to yield the total measured leak rate. 3604A.1-2 3604 A,1-3 3604A.2 2 3604A.3-2 3606.1-2 3606.2-2 3606.3-2 3606.4-2 3608.1-3 3 3608.2-3 3613A.2-1 3613 A.2-2 Standard Review Plan section 15.6.5, Appendix B states that the leak rate used for the dose analysis should be twice the design leak rate (" sum of the simultaneous leakage from all components in the recirculation systems above which the technical specifications would require declaring such systems to be out of service."). Accordingly, the LOCA analysis assumes a leak rate of 10,000 cc/hr.The use of a leak rate that is twice the_ design leak rate for the dose analyses should account for any increase in the measured leakage at hot vs. cold conditions. 7 a 3-ESAR-97-043 Page 3-22

lategrated System Functional Review for Millstone Unit 3 Item 22 - Thermal Shock to RSS Ilent Exchanner i The RSS heat exchanger is a once through heat exchanger. The RSS heat exchanger may be filled with cold service water prior to the start of recirculation. lias it been designed to withstand the thermal shock when 260 F sump water begins to flow through the tubes? Resolution DCR M3 96054 is the issuing document to identify all changes relating the RSS heat > xchanger. The heat exchanger manufacturer has analyzed the heat exchanger for mechanical and thermal performance based on the following revised design parameters: Shell side design temperature increased from 235 F to 260 F. Tube side design temperatitre iricreased from 200 F to 260F. The heat exchanger data sheet contained the l minimum temperature of 35 F for the service water. The design change is documented by DCN DM3 S-0324-96 and DCN DM3 S-0626-96. l 1 3-ESAR-97-043 Page 3-23

Integrated System Functional Review for Millstone Unit 3 Item 23 - RSS Water Hammer if containment pressure were to reach the CDA limit, then subsequently fall below 17.5 psia, EOP 35 E-1 (Step 8) would instruct the operator to turn off the QSS pumps, and also the RSS spray pumps (if RWST level were greater than 520,000 gal).' After the RSS. O pumps are tripped, the hot water from the sump could drain back, leaving steam void behind. When the RWST level falls below 520,000 gallons, the operator transfers to the sump recirculation and restarts the RSS pumps per EOP 35 ES-1.3. Could the restart of RSS pumps cause water hammer in the RSS pining? Resolution This item is considered closed. A recently installed orifice at the RSS pump discharge limits the flow rate to a maximum value of 3300 gpm. A baffle plate has also been added to the RSS heat exchanger inlet. . Stone and Webster has done a calculation which shows that the water hammer loads are acceptable at the 3300 gpm flow rate. See Safety Evaluation E3 EV-97-0043 for DCR M3-97045. Also, as part of the DCR, the EOPs will be reviewed to determine if the RSS pumps - should be allowed to stay running, instead of being tripped by the operator, The Emergency Response Guidelines (ERGS) trip the spray pumps, but these pumps do not provide recirculation cooling like the RSS pumps do at Millstone Unit 3. Allowing the RSS pumps to continue to run in the Millstone Unit 3 EOPs would not seem to de any harm to the system and would eliminate this potential water hammer concern. As a result of the review, a procedure modification could be suggested. 3-ESAR-97-043 Page 3-24

Integrated System Functional Review for Millstone Unit 3 Item 24 -Throttle Valve Settines Are Si and charging pump throttling flow valves set for hot (recirculation) or cold (injection) water temperature? Resolution This item is considered closed. The flow calculations were done assuming higher water temperature (Discussion with George Konopka, Westinghouse 12/10/97). At higher temperature, no adverse effect on the charging or Si pumps expected, but there would be some cavitation in the injection lines. The extent of cavitation would be small, since the injection conditions to the loops are very near to the suction conditions for the RSS pumps, and the fluid properties between these two locations is not expected to change, item 25 - S1 Pumns: Common Mini-flow Line Two Si pumps share a common 3 inch mini-flow line back to the RWST. Could the stronger pump could potentiaily deadhead the weaker pump? This was one of the NRC question also. Resolution This item is considered closed. .3 Each line from the pump discharge to the common mini-flow hne has a flow orifice D which takes most of the pressure drop, therefore, it is unlikely that one pump could be deadheaded. The NRC question was addressed. 3-E M R-97-043 Page 3-25

integrated System Functional Review for Millstone Unit 3 Item 26 - IIVAC: Intake Structure Cooline The intake structure has 2 SW pumps m each of the 2 cubicles. A separate fan is used to cool cach cubicle. The intake structure also has non-safety grade heating units for winter. The vr..tilation calculation assumes 1 SW pump running in each cubicle. By procedures, a sec;nd service water pump could be started aller 4 hours to provide flow for fuel pool cooling. The ventilation calculation is inconsistent with operation. Resolution I This issue is currently being addressed by a previous CR M3-97 3283 The ventilation calculation is being re-done. l l Item 27 - AFW Suction Swan from CST to DWST The AFW pump draws suction from the CST during startup and shutdown (below 10% power). If, during this period, an AFW initiation signal occurred, the suction valves to the o [ CST would automatically close and at the same time the suction valves to the DWST would automatically open. These are fast acting (< 2 second) butterfly valves but are not interlocked to ensure that flow path from the CST is not closed off before path from the DWST is established. Could the running AFW pumps cavitate during the transfer? Resolution CR M3-97-4157 was written to address this issue. 3-ESAR-97-043 Page 3-26

integrated System Functional Review for Millstone Unit 3 Item 28 - Mini Flow for AFW is there a time limit for running the AFW pumps on mini flow? The EOPs do not specify any time limit and the AFW pumps are not tripped. The minimum flow issue for the AFW pumps has been reviewed extensively in the past. Therefore, a background discussion in needed to show the remaining issue which has not - been addressed completely,

Background

Commercial operation commenced April,1986. A brief history of the AFW pump mini-flow issue is provided below, NRC Bulletin 88-04 issued. June 1989. Letter to NRC The auxiliary feed pumps do show some indications that damage may be accumulating due to operation at c Nmum flow, llowever NUSCO does not believe there is a problem with the minimtr < m orovided for these pumps. Engineering evaluations of these pumps are continuing t April 22,1992. Sulzer-Bingham advised NUSCO to increase minimum flows. May 8,1992. Phone conversation between NUSCO and Sulzer-Bingham Sultzer-l- Bingham was asked why the minimum flow rates were increased. The response was that the original analysis performed years ago did not identify pump damage at low flow, it was later identified that the flows should be increased to reduce the potentia! for impeller damage et low flows. Sultzer-Bingham indicated that the damage is gradual and not immediate. May 11,1992. Letter from Pete Clark to Gerry Drechsler (letter no. PSM3 92-310) indicates that there is a pump performance monitoring program, i.e. vibration monitoring, in place that is tracking pump degradation. Oct.16,1993. Inter office memo from Pete Clark to Barret Nichols indicates that the rotating assembly for pump #FWA*PI A was replaced in August 1993. There was some minor internal damage to the pump casing and upon inspection by Gerry Dreschler it was determined not to be significant nor did it occur from cavitation. The damage was easily weld repaired. The memo continues on to specify that the minimum flow will not change, and pump performmce will continue to be monitored along with additional inspections when the pumps are rebuilt in the future. March 7,1994. NRC inspector reviewed licensee's documentation of the minimum flow provisions for the AFW pumps and reported the following findings. 3-ESAR-97-043 Page 3-27 )

Int 3 grated System Functional Review for Millstone Unit 3' The adequacy was noted to be marginal, but the very limited frequency and duration of pump operation indicate that the pump minimum flow remains acceptable. There is some concem due to the previous indication of pump casing wear which required weld repair. Discussions with engineering personnel - indicated that the casing wear was attributable to an original casting problem and possibly minimum flow operation. However the wear was very minor and pump disassembly revealed no other indications of pump degradation due to minimum flow operation. The IST program on the safety related pumps is capable of detecting pump wear due to low flow operation via vibration monitoring. Operation of the pumps in minimum flow conditions is very limited. Auxiliary feed water pumps are tested quarterly in modes 1,2, or 3. Also the pumps are flow tested every refueling in modes 5,6, or 0, Operating procedure (OP 3322) or EOPs do not contain any precaution against extended operation at minimum flow. Outstanding Issue A CR (M3-97-4531) was written to address the issue of potential for operation for long term at the minimum fiow. At issue is the following; NRC Bulletin 88-04 requested licensees to evaluate the adequacy of the minimum flow bypass lines for safety related centrifugal pumps resulting from operation and testing in the minimum flow mode, and that the evaluation should also . include verification from the pump manufacturer that current mini flow rates are sufficient to ensure no pump damage from low flow operation. The revised minimum flow rates recommended by the Auxiliary Feed Water (AFW) pump manufacturer, Sulzer-Bingham, for the motor driven pumps went from 45 gpm to 90 gpm during intermittent operation or less than approximately 2 hours, and to 126 gpm for continuous operation or greater than 2 hours. For the turbine driven pump, minimum flow went from 81 gpm to 150 gpm during intermittent operation and to 230 gpm for continuous operation. Reason for the increase of flow requirements is that the original analysis did not identify or consider pump damage at low flow; Because the potential for pump damage at low flow occurs gradually and not immediately, Millstone Unit 3 did not increase the minimum rates as recommended by the manufacturer. Instead, a monitoring program (IST) was implemented to frequently monitor pump performance and vibration to maintain a historical record to predict future pump damage. 3-ESAR-97-043 Page 3-28

~ Integrated System Functional Review for Millstone Unit 3 - The IST program is implemented and appears to be cffective, llowes er, the extended -- operation concern for minimum now operation has not been conveyed to operations and training personnel. According to current operation procedures, the auxiliary feed water pumps can be operat_ed indennitely on minimum Dow which may enhance potential for pump damage from low How conditions. j Resolution CR M3 97 4531 was written to ensure that the extended operation concern at the minimum now be conveyed to the operators either through procedure changes or the

training, i

i I v. d 3 ESAR-97 043 Page 3-29

Integrated System Function:1 Review for Millst:ne Unit 3 Item 29 - Lona Term Usane of DWST The design basis for small LOCA is to continue to use the steam generators (AFW and steam relief) and RSS for long term cooling. Therefore, a safety grade water source for AFW will be required for long term cooling. What instructions are provided to the operator for aligning alternate sources for AFW7 Is another safety grade source for AFW available? Resolution This item is considered closed. The loss of secondary heat sink function restoration procedure, EOP 35 FR li.1, instructs the operator to transfer to the CST, if the DWST_ level is less than 80,000 gallons, and then refill the DWST with city water or the ecolochem system. Although the service water system is a long term safety grade source of water (MNPS-3 FSAR, July 1997, pg. i 10.4-45), these non-safety grade systems are preferred ov:r the safety grade service water system. The loss of secondary heat sink procedure does not explicitly instr..t the operator to align the AFW pumps to the safety grade service water system. Ilowever, if the heat sink could not be restored while using FR-li.1, the operators would contact the ADTS for additional instructions and the ADTS would recommend alignment to the service water supply at - that time. l 3-ESAR-97-043 Page 3-30

Integrated Syst3m Functioral Review for Millstone Unit 3 Item 30 - Full Flow Testine of Check Wives The Si pumps have check valve VI1 in their common line from the RWST header. Similarly, the charging pumps also have a check valve (V268) in their common line from the RWST header, lias full flow testing been done to assure these check valves will swing full open and assure adequate NPSli for the pumps? If the check valves fail to fully open, the pumps could cavitate, especially at low RWST tevel when the available NPSH will be low. Not testing at full flow may also be in violation of the intent of the IST program requirements. Resolution CR M3-97-4156 was written to address this item. These check valves are not full flow tested. The valves are tested by operating a single pump at a time. This is not full flow testing since both Si and both charging pumps i should and probably would start following a safety injection signal. 3-ESAR-97-043 Page 3 31

Integrated System Functional Review for Millstone Unit 3 Item 31 - Charmine Suction Valves from RWST The charging pump suction valves (112D&E) to the RWST are controlled to open on low VCT level (<4.4%). These valves are supposed to be closed for sump recirculation. If the VCT level is less than 4.4% at the time of transfer to sump recirculation, the operator will try to close valves !!2D&E, but the control system would try to keep them open.- Prior to initiating sump recirculation, the operator resets SI, however, he does not bypass the low VCT level signal to these valves. The valves do not have a pull-to -lock position. Does the procedure for transfer to sump recirculation (EOP 35 ES-1.3) consider this scenario? Q ~. wr 16:J m, J )(im -.g ? f z- ?.3 d Resolution c - CR M3-97-4342 was written to address this item. The procedure does not consider this scenario. The procedure had been revised to remove power from the valves to address the scenario in which the VCT level falls below the . VCT low level transfer setpoint after the system had been placed in recirculation mode. This modification does not, however, address the scenario described above. 3-ESAR-97-043 Page 3-32 r "r' W

Int:grat:d System Function:1 Review for Millstone Unit 3 Item 32 - Drainine of Servlee Water Pinine followine a Loss of Offsite Pow tr Following a loss of off-site power, both operating service water pumps would stop until picked up by the diesel generator, in the meantime, the service water header could drain in the fonvard direction; reverse draining is prevented by check valves. Tie outlet for the service water system is below the water surface and therefore, draining of tht; piping will cause low pressure (vacuum) and water vapor could form. Water hammer in the service water piping could occur aller the pump are restarted. LOP /SI tests one train at a time. The operating train will keep the other train under test pressure until MOV 71 closes, which has a stroke time of 30 seconds or so. lience, the test does not represent post. LOP condition where draining could occur.. Resolution This item is considered closed. A review of the isometrics (with Steve Pietrick) indicates there are no open vents or vacuum breakers for service water in the following locations: The CCP heat exchanger, The P3 pump e ' The diesel generator heat exchanger outlet piping. (The diesel generator header is e- . protected by the vent at the top of the llVK heat exchanger.) Pre-operational tests of the service water system (U-12179-1398," Service Water System liydraulic Transient Test", January 1985) show that the CCP heat exchanger header does not drain and no gap forms in the time needed to restart the service water pumps following a loss of normal power, including the diesel generator start time (40 seconds). During this time period, only the IIVK heat exchanger, which has a vacuum breaker, drained. Since the CCP heat exchanger and the rest of the system remains full, there are no water hammer concerns. 3-ESAR-97-043 Page 3-33 1

Integrated System Functional Review f;r Millst:ne Unit 3 I ("i Item 33 - Service Water: Sinele Failure if a safety bus (34C or 34D) is the single failure, one train of service water pumps will be inoperable. Assuming the A train has no power, MOV 71 A will remain open. The running SW pump on the B train will provide flow to both the non-essential header (via valve 71B) and to the essential header until the non essential header is isolated by closing of valve 71B. If MOV 71B does not receive a signal to close, the nmning pump could potentially fail to provide adequate flow to the essential header. Will MOV 71B get a closure signal under this condition? -{} m. A 'k 11a -t> Eg.a.... I'sg...t.m -e> Y" Tu,- B Resolution This item is considered closed. In this scenario, only one SW pump on B side will be operating. Valve 71B will initially be open. Therefore, the running pump will provide flow to both essential and non-essential headers. A calculation documented in memo MP3-DE-97-1310 shows that with one pump operating, pressure in the vicinity of valve 71B will drop to 19.7 psia (about 5 psig). Valve 71B gets a closure signal when pressure drops to 25 psig. Therefore, valve 71B will close on low pressure, Also, the second SW pump on Side B may start due to low pressure at the pump header. Isolation of valve 71B or start of the second pump will ensure of adequate flow to the essential header. 3 ESAR-97 043 Page 3-34

Integrated System Functional Review for Millstone Unit 3 Item 34 - CCI IIcat Exchanner and Assoelated Piping The CCI heat exchangers and piping are needed to remain operable for an extended period of time to provide lube oil cooling to the Si pumps. These heat exchangers are located near the Si pumps and may be inaccessible (due to radiation) during sump recirculation phase. There is a concern that the small bore piping in the heat exchangers could tail without prior warning, i Resolution This item is considered closed. A surveillance monitoring procedure is available for trending potential degradatio.4 of the heat exchanger tubing. Inspection of the CCI and CCE heat exchangers is performed via procedure EN 31084. Trending of heat exchanger performance data is performed via procedure SP 3626.13 and forms 3626.13-1, -2, and -3. In addition to heat exchanger performance, the U-bends of the heat exchanger are installed with threaded coupling and the U-bends are removed, inspected, and the findings documented. 4 k 3-ESAR-97-043 Page 3 35

Integrated System Functicnal Review for Millstone Unit 3 Item 35 - Sinnie Reference Lee to VCT Level Transmitter INPO recently issued SOER 97 1. This document describes a situation in which plants that have a common reference leg for the VCT level transmitters could have an erroneous level indication on both channels. Such an erroneous indication may go undetected due to common mode effect. Millstone Unit 3 has separate reference legs, however, they are connected to common upper and lower taps to the VCT. SWi O l E x (u) m u x 4e .. g l Resolution This item is considered closed. The isometric drawing for the VCT level transmitter instrumentation was reviewed and a walk down of the installation was performed to determine the configuration of the reference leg and taps into the VCT. The lower level tap which is common to both transmitters, is connected to an approximate 4 foot horizontal section of 1 inch diameter piping. The pipe slopes downward toward the transmitter diaphragm and capillary filled tubing. If a non-condensable gas were present in the horizontal pipe run, it would have a minimal impact on the indicated level. A void in the vertical capillary tubing connected to the transmitter would most definitely affect the transmitter level indication. MP3 design has separate vertical lines t'or each transmitter. ALso, the vertical line is physically separmed from the VCT by the diaphragm and is not subjected to the VCT internal atmosphere. Becaun of the level transmitter installation and diaphragm separating the VCT from the trar.smitter, the accumulation of non-condensable gas in the sensiag line affecting VCT level installation is not a concern. 3-ESAR-97-043 Page 3-36

Integra'~1 System Functhnal Review for Millstone Unit 3 Item 36 - EO for AOV 31 and MOV 17 Why aren't the steam isolation valves 31 and 17 to the Teny turbine in the EQ program? er..w ..ior.n z. r---------- I I CC ><C 5 Ta Terry l l ~~- u----------a / .n v l l Resolution This item is considered closed. According to NU calculation 97 ENG-1329-M3, Rev. I and NU memo RB-97-040, these valves are located in a break exclusion zone and non harsh environment. 3-ESAR-97-04i Page 3 37

Integrated System Functional Review for Millstone Unit 3 l Item 37 - Technical Snecification Bases Definition for " Accessible" In order to meet the Technical Specification surveillance requirement to verify that the ECCS piping is full (4.2.5.b.1), Millstone Unit 3 vents the " accessible" ECCS piping every 31 days. The word " accessible"is used in the Millstone Unit 3 Technical Specification Bases to describe which ECCS high points must be vented. In practice, Millstone Unit 3 enly vents the ECCS high points which are located outside containment. Is this definition for " accessible" still applicable (considering the Millstone Unit 3 normal operating containment pressure is closer to atmospheric now) and consistent with the rest of the industry? Resolution CR M3-97-4535 was written to address this item. According to Westinghouse (Chris Morgan), other licensees do not necessarily assume that all piping in side the containment as "in-accessible" and therefore, need not be checked to ensure that it is full of water every 31 days. He also indicated that the venting is not the only means of verif> lng that the line is full of water. Some licensees nddress TS requirement 4.2.5.b.1 by verifying the piping is filled prior to mode 4 (checked by vetting), then follow a checklist procedure every 31 days to verify that no valves were manipulated which could have introduced non-condensable gas in the piping. The checklist identifies all of the evaluations (such as filling the Si accumulators) which could potentially allow gas to enter the ECCS piping. These licensees assume that once the ECCS piping is filled, it should remain that way unless something is done to allow gas to enter the piping. There may be other options to venting which could be used to meet the TS requirement to verify that the ECCS piping is filled. Millstone Unit 3 should examine other opt'ons and/or make sure the definition of" accessible" is still applicable. 3-ESAR-97-043 Page 3-38 l

integrated Spt:m l'unctional Review for Milhtone Unit 3 Item 3N CC and SI Pumn Seal Oualincation The charging and Si pumps could be exposed to hot (230 F) water from the sump following the transfer to recirculation. Are there pumps and their seals qualificJ to this temperature limit? Hesolution This item is considered closed. i Westinghouse calculation F.!!C 326, rev. O states that the design temperature for both the pump suction and discharge is 300 F. Item 39 IhlyltkJaive Eronton The charging, Si and RSS pumps all have throttling valven downstream of their d!*harge. Are these valves susceptible to erosion during extended use following an W. dent. Resolution This item is considered closed. Erosion of throttling valve internals due to cavitation was previously identified as impairing the present design. DCR.M3 96077 was written and provided the design basis for implementing a plant modification to resolve this issue. Permanent barrel type orifices were installed in the injection lines !n series with the throttle valves. The orifices were sized to provide a large pressure drop and the throttle valve would only be used for fine tuning the pressure to the required value. The valve minimum opening requirement assures that the internal cross section corresponds to a velocity that will not promote any accelerated crosion. Similarly, crosion will be minimized in the barrel orifices because of the straight smooth path of the barrel insert and also due to the selection of special hardening materials. 3 ESAR 97-043 Page 3 39

integrated System functional Review for Milistone Unit 3 Item 40 Oualification ofIIcat TracInn 1he RWST level indication is used by the operator to determine when to transfer to recirculation. This parameter is classified as an essential post ace! dent monitoring instrumentation in the Technical Specifications and is classifles as Type A variable in RO 1.97. The sensing line to the transmitter is vulnerable to freezing during teident. Is the heat tracing on it safety related? i Resolution CR M3 97 4698 was issued to resolve this item. The original heat tracing specification 2286.000 274 specifies that separate, duplicate electrical heat tracing shall be installed where freeze protection is required in safety related lines, valves, and components. Backup tracing shall be provided if the primary section malfunctions, and the power supply for each section of the heat trachig will be connected to independent buses. The actual plant installation has two heat u icing panels,311TS-PNLF1 and 3 HTS-t PNLF2, that service the safety related requirements. These panels are powered from safety grade buses 32 1 R (3 Ells *MCC3 Al) and 32-1 W (3EllMS*MCC3B1), but the safety grade power is isolated from the panels by safety grade isolation transformers. It can therefore be concluded that the heat tracing system as well as the supplied power servicing the safety related system is nu safety grade. Investigations to provide the justificailon for installing the safety grade isolation transformers between the safety grade bus and the heat tracing panel that establishes the current condition of a non safety related system supporting the operability of a safety related system was to no avail. i 3 ESAR47 043 Page 3 40

l Integrated Sptem functional Review for Millstone Unit 3 i Item 41. System Omtsbility durinit Surveillance or Other non Standard l>lne-up. The review of the surveillance procedures, normal operating procedures and discussin.it with the operation personnel, suggest that certain systems are not declared inoperabh wu appropriate Tech Spec action statements are not entered when the system line up is modified during the surveillance. For example: Si pump mini flow valves ( 8920 and 8814) are stroked for surveillance purposes i (Sp 3608.6, a quarterly test). These valves do not receive an open signal on 31. Therefore, during the time when the mini flow valve is closed, if a pump start signal is generated, the pump could dead. head until the valve is opened by the operator, in other words, an operator action is needed to restore the system, which is supposed to be fully automatic. Therefore, the corresponding Si pump may have to be declared inoperable while the valve is closed. One could argue that since the valve is closed only for a very short period of time, we need not declare the pump inoperable. We are not sure of any cut off time period for such a decision. Our understanding is that other plants (e.g., Mpl) declare the equipment inoperable under similar circumstances. Accumulator pressure is controlled by opening the N2 supply valves or by opening N2 vent valves. N2 vent valves (SV-8875 and liCV.943) do not receive any accident signal to elose. Therefore, when the valves are open, the operability of the accumulator is a suspect since some N2 will leak out of the open line and thus would reduce injection to RCS. Various vent and drain valves in the ECCS system piping are opened to ensure that the piping is full of water (TS surveillance 4.51.b).110 wever, we don't know of any special provision in the program which implements TS 6.8.4.a (minimizing leakage from those portions of the ECCS systems which would see radioactive fluids) to allow opening of these valves. Our concern is that when these valves are opened, we may be violating the intent of TS 6.8.4. As we understand, the vent and drain valves are not left open unattended. Maybe that is all we need to ensure that the intent of TS 6.8.4.a is not violated, however, a more definitive / formal position may be needed. Resolution CR M3-97-4640 was generated to address this item. 3 ESAR 97-043 Page 3 41

Integrated System I'unctional Review for Millstone Unit 3 Itent 42 Si Hesef Shigle Failurg The operator is instructed to reset both trains of Si in the following scenarios: 1)in a LOCA prior to the transfer to sump recirculation,2)in an inadvertent safety injection signal to prevent overfill of pressurizer and 3) in a SOTR to prevent overfill of the S0. A single failure of the Si reset switch could hamper operator's task to terminate Si injection in a timely manner since additional actions will be needed befcre injection from the ECCS train with the failed Si reset switch could be tenninated. llence the total time needed to terminate Si injection would b: needed. The EOPs do not provide any guidance. (The response not obtained column contains no guidance.). Also, this scenario I is not one of the standard training scenarios. 1 Resolution CR M3 97 4536 recommends either a procedure modification or additional training be implemented to address this item. Failure to reset is probably most critical for SOTR, where timely termination ofinjection in needed to prevent SO overfill, llowever, generic analyses performed by Westinghouse show that the failure to reset Si is not the limiting failure for the SO overfill analysis (WCAP 10698 PA). There is at least 30 minutes for operator action between the time S1 was suppo.ed to have been reset and the time the charging /S1 pumps are realigned for normal charging. This allows plercy of time for the operator to recognize the failure to reset Si and to address the problem. I 3 ESAR 97 043 Page 3 42

integrated System functional Review for Millstone Unit 3 Item 43 Hrcaks in AFW Lines A break upstream of the cavitating vcaturies in the AFW lines is not analyzed. Such a break could iesult in a spillage of a l DAFW and one MDAFW pump, leaving only one MDAFW pump for mitigation. Resolution 1his item is considered closed. CR M3 97 2556 (generated by Jim Craffey) addresses this issue. A white paper " Technical Paper for Potential llELD lletween the CAV and the First Check Valve in the AFW System" provides the Northeast Utilities position. The review team agrees with the conclusions of this paper. A break in this area will result l in a 300 gpm leak for the affected steam generator. This leak rate does not result in a reactor trip and therefore, is not required to be postulated in the FS AR Chapter 15 Feed Water Line break spectrum. The llEl.B aspect of the break can be mitigated by either the normal feed water train (since no loss of off site power assumption is made) or the AFW

train, item 44. I.oad Center Rack Out A load center could be partially or completely removed for service, is the cabinet declared inoperable without the breaker? Is the cabinet seismically qualified without the breaker?

Resolution This item is considered closed. These issues have been addressed for the 4160V and 480V breakers at Millstone Unit 3. The 4160V breaker cabinets were addressed in CR M3 961142. An evaluation of the 480V breaker cabinet seismic qualification was documented in ER 96-0362. 3 ESAR-97 043 Page 3-43

integrated System functional Revice for Millstone Unit 3 l l l l Copies o# Condition Reports Generated by the Review l l 3 ESAR 97-043 Page 4.l

Intograted Syst3m functional Revi w for Millstone Unit 3 MP3 IfSR CR Listing CR# Subject Recommendation M3 97 4130 ECCS Venting Sury. Procedure procedure change prior to mode 4 Enhancement M3 97 4131 LCCS Suction Piping Gas modification required prior to mode 4 Entrapment M3 97-4156 Charging & St Check Valve I ull requires sury. procedure mod. pr or to mode 4 flow Testing M3 97 4157 CST and DWST to Al'W Valve evaluation may be needed prior to mode 4 Interlock M3 97 4158 l'otential QSS Pump l'ailure No Min- !ormal cale, required and mod. if needed prior to Ilow mode 4 M3 97 4342 CVCS ll2D&E and VCT Lowlow procedure change prior to mode 4 and eventual Level Interlock modification required M3 97 4343 VCI 112 Cover Oas Leakage into sury. proc edure mod. required and reportable if CVCS 15 sues as found condition indicates leakage prior to mode 4 M3 97 4530 CVCS Letdown isolation need not be implemented prior to mode 4 Recommendation considered an enhancement M3 97 4531 Al'W Min flow Requirements enhance training program M3 97 4532 LCCS l'otentially Drained in Surveillance procedure needs to be modified Containment from CV Testing prior to mode 4. M3 97 4535 ~1 S Claritication on ECCS evaluation required to revisit our position prior to " accessibility" plant startup M3 97 4536 Lop Enhancement for Si Reset evaluation required prior to mode 4 failure M3-97-4640 System Operability Determinations procedure mod, prior to mode 4 During Surveillance Line-ups M3-97-4698 Non Safety Grade llent Tracing On needs evaluation for exemption prior to mode 4 RWST Level Indication 3-ESAR 97 043 Page 4 2 n

__.m.. _m._..___ ~ 9r40/97 97.y /s/ P. D. Hinnenkarnp l Effective Date SDRC Meg. No. Forn Approved by o CR CR Form g g,g Initiation Sections 1r,To.be. completed.by initiator (please. type or print); -; '. ',. ~. ~~ Organization identifying condition: Discovery date; d.~08 Affected Unit (s): System #: ECCS SAB Discovery time: ////1/9 "/ 10 20 3t0 CO Condition description (including how condition was discovere'd, organization creating condition, what activity was in progress 1. when event was discovered): De foUowing surveillance procedures require enhancement to prompt action in the event that gas is detected during venting process; SP 3608.4/3608.41, . SP 3610A.3/3610A.3 1. These surveillance are performed to meet the Intent of TS 4.2.5.b 1) and currently do not require any action if gas is de undesirable condition) within the ECCS pump suction piping. This condition was discovered during a Functional System Review _sponsered by the NSAB. ~~ ~~ ~~ ~~ ~ ~ ~~ ~ ~ ~ ~ ~~ ~ ~ Componem Idin'tificati Number: Method of Discovery: Continuation Sheet O 2. Immediate corrective action taken none cnode 5 ~~D'UI' ~ AWOs Eng. Disp.# Cont %uation Sheet O ~ ~~ ~~ ~~ 3. Recernmended corrective action trend whether any gas is detected, then based upon trend or amount detected, require root cause and Impact upon e ggg 4. Initiator Name: J.K. Rotbert Time: _ tr o o Phone No.: N Date: ///6/92 CostControlCenter; I Initiator's Signature: f ff Initiator Requests Fo)fow up YES ' S.her'v{s5r Na'm's:= */&Nk'l- } ;$$ 5)'[ ' 'iune:' 'd W$5 ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' Date: ) / - ) 9-9 7 Phone No: Supervispr Sigen: [ z -~- billtfiSepeiIting:I)hi' keuSWh7M;;VCifAfd19!st iSeftfobEMMf6iiYpritei!Hiy;Openipility/R6iitht g Notes: 1. Does CR have an actual or potential effect on plant or personnel safety, operabiltty, reportabuity (e.g., NGP 2.25, EPIP 4400) or plant operation? Yes or Don't Know (Section 3 required to be completed.) i d No Xe:Yh Govhs I\\- \\ H 7 0f90 Date Time Designet yeontinuation sheets (RP 41, Poge 7) are required, ident[fy the section being continued by Form RP41 s Rev.5 Page 1 of 7 Sheet I -r+-s--g + -T, m -v--p ww-- -P-r47

• e

~ - - - ' --"N'i m-

• 7 5

/s/ P. D. Hinnenkamp 9/30/97 97 53: form Approved by Effective Date SORC Mtg. No. CR Form Ca N CR M3 97-4131 Initiation .: ~~~~-~~D",'.'

Section.It.To be completed by initiator (plbase. type or print)'

Organization identifying condition: Discovery date: O00 Affected Unit (s): System 8: ECCS SAB Discovery time: ////9/9*) 10 20 3C;0 CO l., Condition description (including how condition w.s discovered. 6tganization creating condition, what activity was in progress when event was discovered): Per TS 4.5.2.b !) the following ECCS piping has not been verified full of water at least once per 31 days;

• piping upstream of MV8807A & B andjust downstream of V981(common suction to SI purnps sump recirc.)
• piping between V982 & MV8804A (common suction to CHS and 51 pumps. sump recirc.)
• piping between V983 & MV8804B (common suction to SI pumps. sump recin:.)

l ~ 'The'se sections of piping are put into service when switching from the RWST to sump recirculation following an event. De associated piping has the potentir.1 for having air or H entrapment due to its physical arnntement. The following surveillance procedures and (sometric drawings were review to come to this conclusion; SP 3606.5/3606.51,3606.6/3606.61,3608.4/3608.41, 3610A.3/3610A.3 1, and isometric drawings SIH.12 sh ! of, SlH.13 sh 2 of 6, SIL 1 sh I of 3. S11. 8 sh 1 & 2 of 6, SIL 10 sh I & l 2 cf 6. Attached is a rough sketch of the piping layout based upon the previous iso's. This condition was discovered during a Functional System Review, sponsered by the NSAB. ~ ~ ' omponenEdTritification Number: C Method of Discovery: Self Continuation Sheet O 2. Immediate correctJve action taken None required. mode 5 ~~ ~~ ~~ ~ ~ ~ ~ ~~~ ~ ~~ ~ ~ ~ ~5I~~ AWON Eng. Disp ii ~ ' Continuation 5'he7c O T Recommended corrective action 4 Initiator Name: J.K. Rothert Time: fn oiD Phone No.: 832 4740 Initiator's Signamre: V Date: //*/9-9 7 Cost ControlCentet. Initiator Requesu Follh.up: YES O N.................... O Supervis,or Nune: /,JJ/,L/g M J./.ff;#Afr-Time: Date: //-/9-9) Phone No: Supervisor Signature: ( WRtiEiE%;;T(beicdixiplete4biQhEvbili@[cp6BiliilitWS4fZetsiidDsibreE:2@.9i#2t&iG WF2@% 1. Does CR bave an actual or potential effect on plant or personnel safety, operability, Notes: reportability, (e.g., NGP 2.25, EPIP 4400) or plant operation? (SYes or Don't Know (Section 'a requlted to be come!cted.) J No sef& b,_____,,____IW-97 0 72J Duign'ee Date Time Ifcontinuation sheett (RP 41, Page 7) are required Identify the section being continued by section number. Form RP41 Rev.5 Page 1 of 7 Sheet I

s ,-l /s/ P. D. Hinnenkamp 9/30/97 97 53: Form Approved by Effective Date SORC Mtg. No. CR M3 97 4156 CR Form CR Initiation l Sectio.ir@I"o. be'cdmpl6tsd by%nitiato.is(presishtitiR6fpErilit)t,Mi@Mgt.q:tssypNi Organization identifying condition: Discovery date: t/20/t ? Affected Unit (s): System #: CHS, SI SAB Discovery tine: Pro 10 20 3GJ CO l. Condition description (including how condition was discovered, organization creating condition, what activity was in progress whco event was discovered): Lack of full flow testing of check valves in suction lines in CHS and SI system. Check valves V261 and Vll are tested by rurtning only one pump at a time. However, post $1, both CHS and both $1 pumps will stan and subject the check valves to a much higher flow rate. Since the valves are not tested to this higher Dow condition,it cannot be demonstrated that these valves will fully lift Under cunent ISI test conditio..s the check valve is not expected to fully open. A partially open valve may restrict the flow and cause cavitation of the operating pumps. 'Ihis condition was discovered during a Functicoal System Review, sponsored by the NSAB. ~~~ Componcoildentincation Number. ~ Method of Discovery: Self Continuation Sheet O 2. Immediate cortective action taken none. mode 5 TR# AWO# Eng. Disp.# Continuation Sheet E 3. Recommended corrective action . implement a testing program which does full flow testing of check valves V262 and Vll using both CHS and both 51 pumps, (

spectively, e

Connnuation Sheet E 4 lainator Name: Nirtnal Jain/J.K. Rothert Time: ///24/g / Phone No.: &32 4740 initiator's Signature: NCMTe ' /ZDate: T' /D Cost Control Center. Initiator Requests Follow.up: YES Supervisor Name; /,))) f,j m j) J 7,.,q g f Time: O $86 Supervisor Signature: Date: //-l o-# 2 Phone No: d".9/.? ?ScM151i@Tg3iEsotiipli;tWOjiedhEiti7Rehhrtability,S6riHildJTehignigr.MM32.ETMAS49MJG 1. Does CR have an actual or potential eIIect on plant or persortnel safety, operability, Notes: reportability, (e.g., NGP 2.25, EPIP 4400) or plant operation? h Yes or Don't Know (Section 3 required to be completed.) _.C NO Mepflt Coin //-10-0 OWI Designee Date Time l ll continuation sheets (RP 4 l. Page 7) are requh ed. Identih the section being continued by section number. Form RP4 1 Rev.$ Page 1 of 7 Sheet I

,f4 /s/ P. D. Hirtnenkarnp 9/30/97 97 33 form Approved by Effccuve Date SORC Mtg. No. Cal CR M3 97 4157 CR Form Initiation )Se'effoiiflysgo?Re?,cynip!ct eMiWinitii&& GiUSMsii.E(oj@fpt).ihtWpfhnMmfpfgg;g Organization iGentifying condition: Discovery date: II/2cyt? Affected Unit (s): System #: N:d/ SAB Discovery time: t':00 102032CO_ l. Condition description (including how condition wu discovered, organization creating condition, what activity wu in progress when event was discovered): At low power or during shutdown, the motor ddven AFW pumps suenon is switched from the DWST to the CST. During this lineup, if an AFW initiation signal is generated the suction is automatically switched to the DWST. His is achieved by ope suction valves from DWST line while simultaneously closing the valves from CST line. 'the concern is that there is no time delay or interlock to ensure isolation of the CST line only when the DWST line is fully open and the potential for the running AFW pump (s) cavitating (any cavitation cf these pumps is an undesirable condition) under these circumstances. Note: these DWST AOVs are considered fast acting valves. stroke time <2 seccods, therefore,' a sustained cavitation is not i:ensidered likely. 'ntis condition was discovered during a Functional System Review, synsored by the NSAB. ~ ~~ ~~ ~ ~ ~~ ~ ~ ~ ~ ~CTmponen"tidentification Nurnber: Method of Discovery: Self Continuation Sheet (-) 2. Immediate correenve action taken none. mode 5 3. Recommended cortecove action k _ _.._. 7,g,,, 4 initiator Name: Nirmal Jain/J.K. Rothert Time: R'co Phone No; 832 4740 MW / Control Centen Inidator's Sigotture: M tb0 h --Date: I a[f; laitiator Requests Follow up: YES...... r. ..u.. ............,v,/4 L/4 ff //..f 7e~//......... Supervisor Name: L e Af Time: Date: //. 2 0. ) *7 Phone No: 6.9/ > Supervisor Signature:[ j g (S.citi5Ji.h-g7dbcW5si$letEd3ifmOpsrsbWt'y/RFpot6b ElittS pi%Ta~giD erayec#ii$5Kd%tE Notes: l. Does CR have an actual or potential efrect on plant or personnel safety, operab,i}ity, repottability,(e.g., NOP 2.25, EPIP 4400) or plant operadon't h Yes or Don't Know (Section 3 required to be completed.) _ ___D No Ker4 coa U ^ o #1 7 05?+r Time Date Designee ll continuation sheets (RP 41, Page 7) are required identfy the section being continued b Form RP41 Rev.5 Page 1 of 7 Sheet i

't, /s/ P. D. Hatnenkamp 9/30/97 97 53s ~ For n Approved by Effective Date SORC Mtg. No. I CR Form c, CR M3 97 4158 Initiation '..Si@MitisTo be.clifdpWfed!. P;ibitiifW(p~jEn~p3: fpR@pf, nit)tiGTSATrSyyf$$3RW.g: 5 Organization identifying condition: Discovery date: //AcyU Affected Unit (s): System #: QSS SAB Discovery time: fr:48 10 20 3@ CO l. Condition desenp. ion (including how condition was disecvereJ, organization creating cendition, what scavity was in progreu when event was discovered): ne QSS pumps do not have min fbw lines, thus, desdheading of the putnps could result if the downstream MOV34A or B falls to open, Thus, a deadheaded pump could leak (seal, cuing, etc.) resulting in a consequential unisclatable RWST distnage path. There is no interlock between pump motor ar.J valve open. Also discussions with training suggests that the operators would not trip the desdheaded pump as long as CDA is present. De effects of such leakage including laternal flooding may not have been evaluated. The potential amount of such leakage is ur.known ud therefore the severity et its efrects is unknown. Als condition was discovered during a Functional System Review, sponsored by the NSAB,

• ~ ~

~ ~~ ~ **~ ~~ ~~ ~~ ~ ~ ~ ' " " ComponenIlGtification'NTmben Method of D;scovery: Self Continuation Sheet O 2. Ltnmediata corrective action taken n:ne mode $ TRY~ AWO# ~ 'En* g. Disp'I ~ Continuation Sheet O ~ ~~ ~~ ~ ~ ~~'*~ ~ 3, Recornmended corrective action ( h Continuation Sheet O 4 Initiator Name: Nirmal Jain/J.X. Rothert Time: fr.'Of Phone No.: 832 4740 Initiator's Signature:,d{I,y,l 'h ?m 'Date: !/kob 7 Cost ControlCenten Initiator Requests Follow up: YES S'upebiso'r ha$ne:' ' l'/)'((/N' 'jd[88//l Time: 'd5I F *****'''' Date: //.20 9 ? Phone No: tr3/~) Supervisor Signature: $ectlid@if9 be.c5papretid.% '. Ops'r)5111tyIR'ep6rtatI11tflSdeemingD'eiigiies.1EGE$$${$MPSS$8Kl$iit$ 1, Does CR have a*a actual or potential effect on plant or personnel safety, operability, Notes: reportability, (e.g, NGP 2.25. EPIP 4400) or plant ope:aient Dif Yes or Don'tl'.now (section 3 required to be completed-) _ J No b4t< Covi ll-lo.fi7 oftf Designee Date Time Ifcontinuotton sheets (RP 41, Page 7) are required identi;9 the section being continued by section number. Form RP41 Rev.5 Page1of7 Sheet 1 _ ~ _

~. -. - - - - -. _ i _ ..g. ~ /s/ P. D. Hmnenkamp 9/30/97 97.$3s ~ form Approved try Effective Date SORC Mtg. No. I CR Form CR M3 97 434*, Initiation Section it To be completed.by tuitiator(please type orprint)., Organizanon identifying condition: Discovery d..te: /2 / 2 /* 7 Affected Unit (s): System #: QSS SAB Discovery time: /3: oO 10 20 39 CO Condition desenption (including how condition wu discovered, organization creating condition, what activity was 1. l when event was discovered): Unable to isolate Charging Suction Valves ll2D & E for Sump Rectre if VCT low. low levelis present EOP 1.3, step 3.a requires the operator to isolate LCV.I12D and E on semp recirculation. Step 3.c requires that the breaker for Cese valves be opened to ensure that the valves do not go open if a low. low level condition is achieved in the VCT during the surnp t rectreulation. However, this precaution does not address the possibility that the VCT low. low level was present at the time of switch over. In that case, Valves 112D and E w0l not remala closed. It is possible to assume that the VCT is at low. low level for small breaks where the St is generated after the VCT inventory is depleted. Also,it is ponible that the VCT level Inventory will decrease slowly since valves ll2D and C are not leak tested allowing level to reach the low. low serpoint before sump recirculation is initiated. Plene note the VCT make up is not safety grade and therefore, cannot be credited. This coadition was dise_ overed during a Functional System Review synsored by the NSAB. Component Identincation Numt.crt i Method of Discov+ry: Self Continuation Sheet ~ O 2. Immediate corrective action taken t;ne mode 5 i TR# AWOW Eng. Disp.# Continuanon Sheet O Recommended corrective action .br consideration reconfigure controls to valves ll2D and E to allow closure on transfer to recirculation with a low low VCT level signal present Continuation Sheet O ~~~ ~~ ~~ l 4 Initiator Name: Nirmal Jain/J.K. Rothert Time; wer Phone No.: 832-4740 Initiator's Signature: Nfd% k Date: 12//47 Cost Control Center: Initiator Requests Follow.up: YES jd ............/t//uprM //, Jr/fMJ Time: /JJf Supervisor Name: SupervisorSignature: [ f.[ Date: /.2- :t.-J.) Phone No: O /2 Secti$nEI*If@eN:bisp)cteiMVyipp06aWIRepbstalility Scieeising DesfgneedmihW74WMG 1. Does CR have an actual or potential effect on plant or personnel safety, operability, Notes: reportability,(e.g., NGP 2.25 EPIP 4400) or plant operation? MYes or Don't Know (Section 3 required to be completed.) _ J No Medh Ovih /2 4 -97 lefi a Date Tirne Designee Ifcontinuation sheets (RP 41, Page 7) are required identify the section being continued by section number. Form RP41 1! Rev 5 Page 1 of 7 Sheet 1

~ _ _ _ _ - -. _ _ - - _ _ = - _ _ _ - - _ _ _ _ _ _ _. ~ ~ ~ y C q, is/ P. D. Hmnenkamp 9/30/97 97.ns Form Approved by, Effective Date SORC Mtg. No. CR Form Cn CR M3 97-4343 Initiation Section h To be completed by initiator (please type or print) ... c.m.m. Organization identifytng condition: Discovery date: #2/2/57 Affected Unit (s): System a: CVCS SAB Discovery time:, tid 10 20 3@ CD 1. Condition desenption (including how condition was discovered, organization creating condition, what activity was in progress when event was discovered): Potential of H2 Leakage from VCT to Charging Pump Suction here are two potential ways 112 can be introduced to Charging purnp suction, causing purnp cavitation, which are: For a very small break LOCA Si may be delayed until after transfer of charging pumps from VCT to the RWST on low. low o VCT level (4.4%), Since this switch over point is so low, the amont of water which will remain available after the switch over is completed will be minimal (Please note, since the make up to VCT is not safety grade, it cannot be credited in the I.OCA scenario). However, the amount of water available in the VCT may be critical since it provides the water seal for valves ll2B i and ll2C, Rese valves are not leak tested and therefore, may leak. We have reviewed Westinghouse Safety Evaluat on (letter NEU.97 308E, dated Nov. 26,97) and it makes no allowance for the leakage. It is reasonable to assume that if the water snl is depicMd, valves 112B and C will leak H2 also,,leopardizing charging pump operation which is needed for long term operation, nrough valves V541 and V542. This is a 3 inch line eerween VCT gas space and seal return line, nese valves are also not o leak tested to ensure leak tightness for H2. During normal operation, the seal return line is at higher pressure than the VCT and therefore, any leakage will be from the seal return to the VCT Such a leak will go undetected. Post SI, since the seal return is isolated, it (seal return) will be at lower pressure than the VCT and therefore, the leakage will be frem 'he VCT, H2 overpressure in the VCT may deplete any water seal which may have existed at the time of St. Dese issues were discovered during a Functional System Review, sponsored by the NSAB. ~~~ ~ 7mponen~15tification Number: C Method of Discovery: Self Coctinuation Shtet O 4. Immediate correenve scuon taken none mode 5 ~ UI ~ AWOs En g. Disp.W Continuation Sheet O ~~ ~~ TI 3. Recommended correcuve i,ction For consideration. Isolate and vent Hs from VCT post $1 to remove the driving head g-gg 4 Initiator Name: Nirmal Jain/J.K. Rotbert a Time: /3 / 5 _ Phone No.t 832 4740 Initiator's Signature: IN5 fem O M e: M fl ) CostControlCenter: f i Initiator Requests Follow YES ............M. up: Sepervisor Name: / A4/,gA/ // @ ppppj Time: /l?JPo Supervisor Signature: Date: /,. p p p Phone No: #90 ifcontinuation shirts (RP 4 1, Page 7) are required ident{fy the section being continued by section number. Form RP41 i Rev.5 ) Page 1 of 7 Sheet I -. =,

i X-3 0'13 I /s/ P. D. Hinnenkamp 9/30/97 97 53s form Approved by Effective Date SORC Mtg. No. CR No f CR Form /U 9 '7 - 453 "i> Inlllallon i Section 11 To be completed by initiatoi-(please type or print) AW&$'M4b4W - Organization identifying condition: Discovery date: 12pp/97 Affected Unit (s): System #: CYCS Discovery time: N30 10 20 3@ CO SAB Condition description (including how condition was discovered, organization creating condition, what ac l. when event was discovered): Letdown Isolation in AOP 3555 Recommended AOP 3555 requires the operator to start the second charging pump and maximize the irdection fl level. If the pressurizer 'evel continues to decrease, the operator is instrveted to scram the Rx and m EOP E.0. ne procedure instructions do not allow the operator to isolate letdown in AOP 3555 in a level. This procedure is contrary to the design criterla of Class 1 and 11 piping. Piping equal to or sma !! p8 ping. The charging system is designed to keep up with a 3/8" line break, provided the letd shutdown could be inhiated. The ab;11ry to perforrn the normal shutdown for such breaks is consisten 10CFR 50.55a It can be argued that the letdown will be isolated when Si is generated. However, it wo shutdown and cooled down in an orderly rnanner (50.$$a wording). Also, manual initiation of Si increases the likelihood of a prenulzer over 011, especially for such loop plant, the letdown is isolated. In their approach, ifisolation of letdown stabilizes the lev complications associated with it will also be avoided. This approach may be preferable ev potential of charging nozzle is considered. This condition was discovered during a Functional System Review, sponsored by the NSAB. ComponenTidTntification Number: + Method of Discovery: Self Continuation Sheet O 2. Immediate corrective action taken None, since only a re:cmmertded improvement. Continuation Sheet O TR#- AWON Eng. Disp.# 3. Recommended corrective actio.n t Evaluate the benefit of implementing the !ctdown isolation option foi utcorporation it:to AOP 3555. ContinuationThe'E O 4. Initlator Name: NirmalJain / John Rothert Time: //SD Phone No.:O/J//832.WVO Initiator's Signature: [NNr & ib 6 Date: f-l 0-9 7 Cost ControlCenter b Initiator Requests Follow.up: YES SupervisorName: Q///fira J/e WJ)/J Time: /30o Date: /2. /o-f y Phone No: @/2 Supervisor Signature: WTb be cbuipletedi fOpcWbility/ Rip 6itability Sneciting Desl@ideW;NNil# 4 ~ b !SectioW2: L ll continuation sheets (RP 4 1. Pige 7) are required identify the section being co Form RP41 Rev.5 Page1ot7 Sheet I -.,.f. ..-,.--.--,.m...w_..-,~m_ ___-._,,-..,-_c ,,..----5m,--,,.rm,- ,,c-,mt,,%.m..,,,,,,,.v.,,y-,m----,m_.

/ /$/ P. D. Hinnekamp 9/30/97 97 535 Form Approved by Effective Date SORC Mtg. No. CR Form cn w Initiation ID & - 9 7 - M3 0 iSiit1.o',riAigoibe. dosnpipledjbM[htti.alorl(please tyl el0r firln()M7W/.9)!!fT@gg @y i 4 (continued) Initiator Requests Follow.up: YES ,;eiv,,;,u.e; viwwym>w searsr S Supervisor Signature:[/k_ /2 Date: /2.-/O-97 Phone No: d-9/2 lSefti,6ni2jkTo;b6:26nigijeteil b319@h,iljty/JWpfdubilitf;Stitenit g1)ellipici!.?!TECF;6y;.ffe,.;..; i l i. Does CR have an actual or potential effect on plant or personnel safety, operability, Notes: reportability,(e.g., NOP 2.25, EP!P 4400) or plant operation? ("] Yes or Don't Know (Section 3 required to be completed.) O N0 l Date Time Designee (fcontinuation sheets (RP 41, Page 7) are required identify the section being continued by sect Form RP41 Rev.5 Page 1 of 7 Sheet 2

/ V 3. O 9 ? /s/ P. D. Hinnertkamp 9/30/97 97 33e Form Appruved by Effective Date SORC Mtg. No. CR Form CRNm Initiation M3-T 7 -yfG / lSytioliW6?btnon,1hl6ts:d by_iril,tiaR(gil(iis,b tyhfo(p116t)@Ni$g((g/gregtp Organization identifying condition: Disavery date: 12/10/97 Affected Unit (s): System #: g MP3 Technical SupporuSAB Discovery time: 1000 10 20 39 CO l. Condition description (includtng how condition was discoured, organization creating condition, what activity was in progress when event was discovered): AUXILIARY FEED WATER PUMP MINIMUM FLOW REQUIREMENTS NRC Bulletin 88 04 tequested licensees to evaluate the adequacy of the minimum flow bypass lines for safety related centrifugal pumps resulting from operation and testing in the minimum now mode, and that the evaluation should also include verineation from the pump manufactarer that current mlnlmum Cow rate. ;.:e sufficient to ensure no pump damage from low now operation. The revised minimum flow rates recommended by the Auxiliary Feed Water (AFW) pump manufacturer, Sulzer Bingham, for the motor driven pumps went from 45 gpm to 90 gpm during intermittent operation or it h than approximately 2 hours, and to 126 gpm for continuous operation or greater than 2 hours. For the turbine driven pump, minimum Dow went from 81 gpm to 150 gpm during intermittent operation and to 230 gpm for continuous operation. Reason for the increase of flow requirements is that the original analysis did not identify or consider pump damage at low 0 ;w. Because the potential for pump damage at low Dow occurs gradually and not immediately, MP3 did not increase the minimum flow rates as recommended by the manufacturer. Instead, a monitoring program (IST) was implemented to frequently monitor pump performane and vibration to mairitain a historical record to predict future pump damage. The IST program is implemented and apbars to be effective. However, the long term or extended operation concern for low now operation has not been conveyed to operations and training personnel. Ac:ording to current operation procedures, the auxiliary feed water pumps can be operated indefinitely on minimum now which may enhance potential for pump damage from low Dow conditions. Ih,[s_cgn_d!!!gn,y,s jiseggj ju_riga,Qgc,tign_a[,Rgi w Sy}tym sgsgr3,b,y,!h,y,N,SQ, _ _ _ _ _,,,, _ _ _ _ _ _ _ _ _ _ _, _ l d Component identification Number: Method of Discovery: Self Continuation Sheet O 2. Immediate corrective action taken g---------------- ,g----- g ----------- g g,g-g g-3. Recommended corrective action incorporate into training and operation procedures to minimize the time period that auxiliary feed water pumps are operating at minimum flow conditions, i.e. Operating auxiliary feed water pumps on minimum flow should not exceed one hour. g 4. Initiator Name: Allen Farlow/ John Rothert Time: Phone No.: 0661/832-m 12 / O 4140 AU $Ww nl4 initistor's Signature: MJ[b// M7 ate:/ O!i ~I Cost Control Center: __ ' I ff Ifto.Mimdion sheets (RP 41. Page 7) are reguired, identify the section being continued by section number. Form RP4 1 Rev.5 page1of7 Sheet I ~

/ /s/ P. D. Hinnekamp 9/30/97 97.$33 Form Approved by Effective Date SORC Mtg. No. CR Form case Initiation MP3

• 9 7 - 453 f Sectifin4:2%bh com' leted.byinitiator(please type or prfnt)#

~ ' vei.r.s p 4. (continued) Initiator Requests Follow up: YES

• iuieM,o'r u*e:'
• Uh'a kA'J/ lSYMi ' ' ' ' 'ha? 'b 'di ' ' ' ' * * ' ' ' ' ' ' ' ' ' ' ' ' '

Supervisor Si nature: [/ t 2 [ Date: ) 1-/O-f 7 Phone No: 69/2 Sectio's:2yToJGo'r6[iletecthgOpsfabilit31 Rep.ortabilitt.Screetiing Disigneer.;n," ' A.::p 1. Does CR have an actual or potential effect on plant or personnel safety, operability, Notes: reportability,(e s., NOP 2.25. EPIP 4400) or plant operation? N 't Know (Section 3 required to be completed.) - - M s.... I6 8't ') l 3 2, [ (2l Date Time Designee rel4i44d b e/4. k T $$ M..t. d ) "Tb W 4-u4 e. pw ra em n ( tc. v ear e ( e. v e-t tT do e (* pl T re.'ETs S (fcontinuation sheets (RP 4 1, Page 7) are required identify the section being continued by section number. n Form RP4 1 Rev.5 Page i of 7 Sheet 2

/ /s/ P. D. Hinnekamp 9/30/97 97 535 ~ Form Approved by Effective Date SORC Mtg. No. CR Form cn = Initiation

1. 3 ~ T 7

• UJ /

i Sectl6n IrXFot c conipleted.byinitiator(please type otprint)~r' m.i.- b ~ 4. (contmued) d Initiator Requests Follow up: YES

• ' iciviso'r iam'e:' ' ?Jita kWJ/ WJ)L) ' ' ' ' *in;e! Wir ' * * * ' ' ' ' ' ' ' ' ' ' ' ' '
• su Supervisor Signature:

_f Date: ] 2. -/O -2 7 Phone No: d-9/2 Sect.ioYri2tXro;Uhico'rbril' tc4bZOlidafillity/ReportabilityScreening Designeed.; '-

s. e... :.

e 1. Does CR have an actual or potential ef fect on plant or personnel safety, operability, Notes: reportability,(e.g., NGP 2.25. EPIP 4400) or ptant operation?

• t Know (Section 3 required to be completed.)

- - _(4 o W (2 10 Ct *) ( *I 2. 'i~ Designee Date Time k T '$ % h(.e.d > *w b re 14lv< d bu e. wa V4 t-A N rn c. w ttvl C C., u eer e (e.v s. ( rT do e A pl ~T r.sTc h l l Ifcontinuation sheets (RP 41, Page 7) are required. ident.fy the section being continued by section number. Form RP4 1 Rev.5 Page 1 of 7 Sheet 2

/ /s/ P. D. Hinnekamp 9/30/97 97 535 Form Approved by Effective Date 50RC Mtg. No. CR Form ca so: Initiation

1. 3 ~ T 7

• U3 /

Sectilin irl.To be completed.byinitiator (please type orpMnt)~Y . c a.. v 4. (continued) d Initiator Requests Follow.up: YES iuseMsoridme: ?J/4)p Mys;4/ 'fWci W di' Supervisor Signature: / _/ g Date: )2.-/O-2? Phone No: d-9/2 SectioYi4!1To;linTeo'r6 ill:ted;bZO[idrability/ Rep.ortability Screeriing Designee > - c Q.d 1 I, Does CR have an actual or potential effect on plant or personnel safety, operability, Notes: reponab!!ity,(e.g., NOP 2.25, EPIP 4400) or plant operation? Yn ei 't Know (Section 3 required to be completed.) - h (2 Id 't ~l B2 f Designee Date Time re.5 4lv 4 d b ds /-( f k 'T ' S h 4.4 d ) *Tb w 8-V4 A Mw ru ca m n t CC. vere l( s t. ( do e r-pt~ x

r. 5T<-rTS l

l t {fcontinuation sheets (RP 41 Page 7) are required, identify the section being continued by section number. n Form RP4 1 Rev.5 Page1of7 Sheet 2 j

Y-3053 /s/ P. D. Hinnenkamp 9/30/97 97 53: Form Approved by Effective Date SORC Mtg. No.

1. T CR Form ca No:

Initiation /713 I6 31 Se'ction 1:.To be'comple.ted,by initiator.@liase.typi Mpririt)M69.imMyn:W,n m Organization identifying condition: Discovery date: il//C/97 Affected Unit (s): System #: ECCS SAB Discovery time: /030 10 20 2S] CO l. Condition description (including how condition was discovered, organization creating condition, what activity was in progress when event was discovered): ECCS piping inside containment potentially being left in a dralned condition. At issue is the adequacy of procedure SP360lF.4 'RCS Pressure Isolation Valve Test', Section 4.8,'t.eok Test of 3SlH.V00$', which monitors the leakage rate on the upstream side of this valve. He performance of this procedure could result in a portion of ECCS discharge piping that is not routinely survalled being potentially left in a drained condition. In performing check valve back leakage testing on check valve V005, per SP360lF.1, the potential exists that the ECCS piping between MV8801 A&B and V005 can be left in a drained condition. The back leakt.ge testing on V005 is performed once per post outage fill / vent and just prior to plant startup or more frequently as other conditions prevail. When this test is performed it has been discovered that the hose is connected to drain valve V883 and there is no guidance to refill this section of ECCS piping following completion of the back leak i testing. This conditlen was discovered during a Functional System Rey!cw, synsored by the NSAB. ~~ ~ ComponenIlfentification Number: Method of Discovery: Self Continuation Sheet O 3 Immediate corTective action taken none. mode $ TR# AWO# Eng. Disp.# ContinuationIheit' O ~ ~~ 3. Recommended corrective action + Consider revising procedure to sither direct operators to create a loop seat when using drain valve V883 to prevent draining of this portion of ECCS piping or consider using valve vent valve V990 for performing this test. The extent of this review was only for - Section 4 8; therefore, we recommend reviewing other sections which leak test other ECCS valves which have similar testing requirements and are not within a routine surveillance program, Continuation Sheet O 4 Initiator Name: Allen Farlow/ John Rothert Time: Phone No.: 0661/832 //t/f 4740 Initiator's Signature: /M i/ANa, A.b" Date: // 7 Cost ControlCenter: Initiator Requests Follow.up: YES r ' S'u 't' iso'r ha'm'e:' ' &))khh ')) &/l0' ' ' 'T'ltne? ' '/$l$ ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' Supervisor Signature: / Date: /2,/d 4*/ PhoneNo: [j iSectibn'2:!t gbclcMnpl:ete4by;Opethb.llity/.B6portsbility;Scr.eintrig-Desig~nseSW*sjsh%2MW T J l. Does CR have an actual or potential effect on plant or personnel safety, operability, Notes: reportability,(e.g., NOP 2.25 EPIP 4400) or plant operation? O Yes or Don't Know (Section 3 required to be completedJ _ J 'No Designee Date Time (( continuation sheets (RP 41, Page 7) are requirNd. Identify the section being continued by section number. Form RP41 Rev.$ Page 1 of 7 Sheet I

s

• [..)

is/ P. D. Hinnenkamp 9/30/97 97 53s Form Approvedby Effective Date SORC Mtg. No. CR Form CR $3 97 4535 Initiation Section&: To be completed.by initiator (please type or print). TM r Organization identifying condition: Discovery date:,J:ho/97 Affected Unit (s): System 8: ECCS SAB Discevery tbne: tytt f 10 20 39 CO Condition description (including how condition was discovered. organization creating condition, what activity was in progre, 1. when event was discovered):. Venting and filling of ECCS piplag inside containment De basis for considering containment "in. accessible" needs to be addressed with respect to venting (verifying full) of ECC inside of containment. TS 4.2.5.b 1) requires ECCS piping be vedfied filed every 31 days, ne basis section discusses that "accenible" ECCS piping be vented. Operation's currently considers all ECCS piping inside containment to be "In. ac therefore, this piping is not verified full per the 31 day TS requirement. Originally, MP3 was a much lower sub atmospheric containment, this may have been a factor in considering c 1 arcessible", he issue is, with MP3 now having a near atmospheric containment, have we changed the NRC's expectation w respect to the ECCS piping that should be surveillanced: especially when they compare us to other licenses c:ntainroent would now be considered accessible during power operation, even though extended an entry into containm desirable (demonstrated by what could be considered Scheduled entries I.nto containment). Rus, " accessible contalament may need to it be verifled filled with water every 31 days per TS requirement when in modes I,2, and 3 His obsen stion is based in part on discussions with Westinghouse (TS Support Group) that revealed that th discharge piping should be surveillanced. De improved standard Westinghouse TS does not differentia contalament and has eliminated all references to such terms as " accessible", ney did provide that justifiable exe based on significant ALARA considerations for certain locations within containment. Also Westinghouse state enses/ utilities verify that their ECCS piping inside containment. Examples ched; 1) a utility verifies full insid .nply ensuring that none of the valves which could drain a portion of ECCS piping were exercised pproach),2) others make containment entries to verify vented and filled. Additionally, CF. M3 97-4532 discusses a situation that has potentially left a portion of ECCS piping inside co drained condition. His condition was discovered duringu_nctional System Review, sfongred by the NSAB, o Component IEtification Number: Method of Discovery: Self Continuation Sheet O 2. Immediate corrective action taken none. mode 5 Gn*IInE h 5 TRW AWO# En. Disp.# 3. Recommended corrective action Recommendation is for MP3 to reconsider ifs position on what is considered " accessible" or "in-a develop method for ensuring applicable ECCS piping inside containment is full consistent with NRC ContinuationThe7 5 ~ s32 4740 Time: /4/fd Phone No.: 4. Initiator Name: John K. Rathert A C Date: Cost ControlCenter: _ taltiator's Signature: YES initiator Requests Follo.............................................. ............,/h/spp 44 #7pf44J Time: /4 54 Supervisor Name: -/f (fcontinuation sheets (RP 4 1, Phe 7) are required. Identify the section being continued by s ~ Form RP4-1 Rev.5 Page 1 of 7 Sheet I _(

'q.'l is/ P. D. Hmnenkarnp 9/30/97 97.$ 3s form Approved by Effective Date SORC Mtg. No. CR Form C Inittstion N3 97-4536 Section Ir. To be completed by initiator (picase type orprint) ~._ Organization identifying condition: Discovery dat3: /.?//0/97 Affected Unit (s): System c: SAB Discovery tinie: su30 10 20 3e CO l. Condition desenption (including how condition was dis: overed, organization creating condition. what activity was in progress when event was discovered): Failure of Si Reset Switch neither Covered in EOPs nor in Operator Training in EOPs, the operator is instnicted to reset 51 signal to stop injection or reconfigure valves; for example in E 0 and E.3: the Si is reset to stop charging or 51 pump injection. There are two reset switches, one for each Si train. A failure of one switch (the assumed single failure) will prevent the operator from stopping injection from the corresponding train without additional actions (most IIkely from outside the control room), which will delay the desired action. Westinghouse has postulated failure of the reset switch as a single failure in the SGTR Analysis Methodology to Determine Margin to Overfill (WCAP 10698 P.A) and therefore, we believe this is a legitimate single failure. (Also, as we understand that such a failure was actually experienced at CY). EOPs do not have any contingency action if 51 switch falls to reset. '!)e Respons: Not obtained column is blank for this step. Also, our discussion with a training instructor (Bill Cote) has lodicated that the operators are not tralned on this specific failure. H: wever, it is reasonable to assume that the operator will be able to stop Injection as needed. Timely action of stopping tr;jection i probably most critical in SGTR scenario (to prevent 50 overfill). Our rough review suggests that even for the SGTR scenario, operator will have enough time to stop the injection in time to prevent overfill, provided the failure to reset was noticed earli anempted. Ilowever, some additional guidance is warranted on this subject to improve th confidence that the operator would able to stop lajection in a timely manner. The additional guidance could be in the form of training on this failure or specific instructions in the EOPs. Since this is a recommendation for improvement, we do not believe this issue needs to be addressed before plant start up. stis condition was gcovered dugg a Functigal System Review, sgegred by g NSAB. Cornponent Identification Number: Method of Discovery: Self Continuation Sheet O 2. Immediate corrective action taken none. mode 5. Also, suggestion for improvement only. TR# AWO# ~ Ecg. Disp # Continuation Sheet Q ~ ~ ~ ~~~ ~~ ~~ ~~ ~~ 3. Recommended corrective action Consider providing guidance within applicable EOPs in the RNO column for recovery from failure of an Si reset an training on this scenario. Continuati nIhe7 O ~ 4. Initiator Name: Nirmat Jain/J.K. Rothert a Time: /u tl O Phone No.: 832 4740 initiator's Signature: MWwr by Zpate: /h/M9 7 Cost ContcolCenter:_- o i Initiator Requests Follow-up: YE,S /v

• 'uhr~viso'rNa'rn'e:' /U.2ddf M2M/MN' * * ' 'T'ir$ci
• M'[d# ~ * * * * * * * ' ~ * ' ^ ' '

S Date: fp/d-97 Phone No: 6'9/)- Supervisor Signature: / wwwmermwe.a m--w e ifcontinuation sheets (RP 4 1, Page 7) are required identify the section being continued by section number. q Form RP4-1 Rev. 5 Page I of 7 Sheet 1

' jI /s/ P. D. Hinnenkamp 9/30/97 97 53s form Approved by hffective Date SORC Mtg. No. 2 CR Form C Initiation N3 97-4536 Section it. To be completed by initiator (please type orprint) Organtr.atioa identifymg condition: Discovery date: /.?//o/i? Affected Unit (s): System 4: SAB Discovery time: iUM 10 20 3e CO 1, Condition desenption (including how condition was discovered, organization creatmg condition, what activity was m progress when event was discovered): Failure of SI Reset Switch neither Covered in EOPs nor in Operator Tr Ining In EOPs, the operator is instrveted to reset $1 signal to stop injection or reconfigure valves; for example in E-0 nr.d E 3: the St is reset to stop charging or 51 pump injection. There are two reset switches, one for each Si train. A fa' lure of one switch (the assumed single failure) will prevent the operator from stopping injection from the corresponding traln without additional actions (most IIkely from outside the control room), which will delay the desired action. Westinghouse has postulated failure of the reset switch as a single failure in the SOTR Analysis Methodology to Determine Margin to Overfill (WCAP 10698 P A) and therefore, we believe this is a legitimate single failure.(Also, as we understand that such a failure was actually experienced at CY). l EOPs do not have any contingency action if $1 switch falls to reset. The Response Not Obtained column is blank for this step. Also, our discussion with a training instructor (Bill Cote) has indicated that the opertters are not trained on this specific failure, lhwever,it is reasonable to assume that the operator will be able to stop injection as needed. Timely action of stopping injection is probably most crit! cal in SOTR scenario (to prevent 50 overfill). Our rough review suggests that even for the SOTR scenario, the operator will have enough time to stop the injection in time to prevent overfill, provided the failure to reset was noticed earlier when attempted. However, some additional guidance is warranted on this subject to improve the confidence that the operator would be able to stop lajection in a timely manner. The additional guidance could be in the form of traintnc on this failure or specific instructions la the EOPs. Since this is a recommendation for improvement. we do not believe this issue needs to be addressed before plant start up. Als condition was discovered during a Functional System Review, sgnsored by the NSAB. ComponenTidentification Number: Method of Discoveryt Self Co.'tinuation Sheet O 2. Immediate correcttve action taken none mode 5. Also, suggestion for improvement only. TR# AWOs ~ Tag. Disp 3 ~ TonInuanon'Ehe7 ~C__ ~~ -~~ ~~ ~~ ~~ ~~ 3. Recommended corrective action Consider providing guidance within applicable EOPs in the RNO column for recovery from failure of an $1 reset and/or provide training on this scenario. 4 Initiator Name: Nirmal Jain/J.K. Rothert _ m Time: /uuO Phone No.: 832-8740 /2 //M9 7 Cost ControlCenter: _ Initiator's Signature: Mh [bl.

DHte

g Initiator Requests Follow up: YES [, '*M' M'''''''''' [ ' S'uhiso'r Na'm'e:' /UddY M2M/M6 ' ' ' 'T'in'ie: Supervisor signature: / Date: /2-fo-97 Phone No: <.5'9/7 mcmemammwmuswim======> jfcontinuation sheets (RP 4 l, Page 7) are required identify the section being continued by section number. q rv.m RPl-1 Rev.$ Page 1 of 7 Sheet i 1

inq \\ '\\ 9/30/97 97 53s /s/ P. D. Hinnenkamp Form Approved by h\\ Effective Date 50RC Mtg. No. CR Form CR No Initiation ~ kh Section IPTo be~ completed.by initiator (please type or, print)Wl4Mer##gyme Organization identifying condition: Discovery date: Affected Unit (s): System #: SAB Discovery time: 10 20 3g CO l. Condition description (including how condition was discoverea, organization creating condition, what activity was in progress when event was discovered): Systems Operability During Surveillance Line up? The review of the surveillance procedures, normal operating procedures and discussions with the operation personnel, suggest that certain systems are not declared inoperable and appropriate Tech Spec action statements are not entered when the system line up is modlued during the surveillance. For example: SI pump mini How valves ( 8920 and 8814) are stroked for surveillance purposes (Sp 3608.6, a quarterly test). o These valves do not receive an open signal on St.- Therefore, during the time when the mini flow valve is closed, if a pump start signal is generated, the pump could dead head until the valve is opened by the operator, in other words, an operator action is needed to restore the system, which is supposed to be fully automatic. Theref e, the corresponding $1 pump may have to be declared inoperable while the valve is closed. One could argue that since the valve is closed only for a very shon period of time, we need not declare the pump inoperable. We are not sure of any cut off time period for such a decision. Our understanding is that other plants (e.g., Mpl) declare the equipment inoperable under similar circumstances, Accumulator pressure is controlled by opening the N2 supply valves or by opening N2 vent valves. N2 vent valves o (SV.8875 and HCV 943) do not receive any accident signal to close. Therefore, when the valves are open, the operability of the accumulator is a suspect since some N2 will leak out of the open line and thus would reduce injection to RCS. Various vent and drain valves in the ECCS system piping are apened to ensure that the piping is full of water (TS o surveillance 4.5.2.b). However, we don't know of any special provision in the program which implements TS 6.8.4.a (minimizing leakage from those portions of the ECCS systems which would see radioactive Gulds) to allow opening of these valves. Our concern is that when these valves are opened, we may be violating the intent of TS 6.8.4. As we understand, the vent and drain valves are not lea open unattended. Maybe that is all we need to ensure that the intent of TS 6.8.4.a is not violated, however, a more deunitive/ formal position may be needed. This condition w3s discovered dur ng a Functional System Review, sponsored by the NSAB _ _ _ t Component Ideritincation Number: Method of Discovery: Self Continuation Sheet O 2. Immediate corrective action taken none. mode $ TR# AWO# Eng. Disp.# Continuation Sheet O 3. Recommended corrective action Continuation Sheet O 4. Initiator Name: Nirmal Jain/J.K. Rothert Time: Phone No.: 832-4740 ll continuation sheets (RP 41. Page 7) are required, identify the section being continued by section number. Form RP41 Rev 5 Page 1 of 7 Sheet I

/s/ P. D. liinnekamp 9/30/97 97 53$ form Approved by Effective Date SORC Mtg. No. CR Form caso: Initiation ~.section 1: To be completed by initiator (please type or. print)s3M).M: age;&B,'/+N.vi 4. (continued) _ initiator's Signature: Date: Cost Control Center: Initiator Requests Follow.up: YES Supervisor Name: Time: Supervisor Signature: Date: Phone No: Section 2:,To be completed by Operability /Reportability Screening Designee a oMw.m.segG l. Does CR have an actual or potential effect on plant or personnel safety, operability, Notes: reportability,(e g., NGP 2.25, EPIP 4400) or plant operation? O Yes or Don't Know (Section 3 required to be completed.) J NO Designee Date Time Ifcontinuation sheets (RP 41. Page 7) are required. Identify the section being continued by section number. Form RP41 Rev.5 Page 1 of 7 Sheet 2

/s/ P. D. Hinnenkamp 9/30/97 97 53s Form Approved by Effective Date SORC Mtg. No. i CR Form CR No CR M3-97-4698 Initiation SectionETo be completed.byinitiator(please type or print)~ A h

1. d r

Organization identifying condition: Discovery date: 11/17/97 Affected Unit (s): System #: QSS MP3 Technical SupporuSAB Discovery time: 0800 10 20 39 CO l. Condition description (including how condition was discovered, organization creating condition, what activity was in progress when event was discovered): NON SAFETY ORADE HEAT TRACING The RWST level transmitters provide operator Information to determine actions requlted for accident mitigation and are designated as type A instrumentation by Regulatory Guide 1.97. Since the operator needs to initiate sump re circulation based on RWST level, the transmitters must remain operable and freezing of a sensing line could produce false Indications. The level transmitters are safety related transmitters and the sensing lines are heat traced. There are two heat tracing panels 3 HTS PNLF1 and 3 HTS PNLF2 pr:viding redundant heat tracing circuits powered from safety grade buses 32 lR (3EHS'MCC3 Al) and 32 lW (3ERMS'MCC3BI), but the safety grade power is isolated from the heat tracing panels by safety grade isolation transformers. Therefore the heat tracing and its power source is considered to be non safety grade. Redundancy in the design implies that the heat tracing is reliable, but discussions with system engineers, design engineers, CMP personnel, and Stone & Webster could not determine a basis for having a non safety grade heat tracing system. .?!$_candi! a_was glicen?2 guht a_r caign,aLSystem_Regm.igrad_by_NSAB.,,,,,,,,,,,,,,,,,,,,,,,,, s Component Identification Number: Method of D:scovery; Self Continuation Sheet O Immediate corrective action taken \\ TR# AWO# Eng. Disp.# Continuation Sheet O 3. Recommended corrective action Pravide basis for non safety grade heat tracing supporting operability of safety grade level transmitters. ___________________________________________________________g_,gs,g 4. Initiator Name: Allen C.Farlow/ John Rothert Time: @O Phone No.: 0661/832-4740 initiator's Signature: df(d [IA d Date: /h?d? Cost Control Center: Initiator Requests Follow-up: YES 'su;Jvair %'e:' ' ' ' ' ' v pwi/:' ' ' ' ' ' ' ' ' 'T'in;J - ) i,b b ' ' ' ' ' ' ' Supervisor Signature; Date: f ?,- ('7-9 ') Phone No: S')M y, __ is!BL9tMHii&NblishiftJE!5LQlifiEE.W[@pjEtiib111tRn#1ji@A2@P!*MP@fM'$&%W l. Does CR have an actual or potential effect on plant or personnel safety, operabilitvd Notes: reportability, (e.g., NOP 2.25, EPIP 4400) or plant operation? g[,Yes or Don't Know (Sect!on 3 required to be completed.) ,_Q,No-lfcontinuation sheets (RP 41, Page 7) are required identtfy the section being continued by section number. ~} Form RP4 1 Rev.5 Pag 1 of 7 I Sheet 1

/s/ P. D. Hinnekamp 9/30/97 97 535 form Approved by Etiective Date SORC Mtg. No. CR Form cnne Initiation Sectly '" T: Sampleted by Operability /Reportability Screening Designee : +..-. et-I f (continued) N. \\ X f Ns \\1 \\T S9 l(. l 7 Designee Date Time 4 r F 1 Y (fcontinuation sheets (RP 4 1, Page 7) are required identify the section being continued by section number. - I Form RP41 Rev.$ Page 1 of 7 Sheet 2

3 k

= -

Condition Report .r Sectiort A To Be Completed By Shift Manager ._i. egonne; Su.-cty l oes not uTect personnel safety Acnons taken to prote:: pe: sonne! I 1, Coer:bility assessmenc O Condiden does set 2dect SSC openbuity TS/TRM Action Statement O condinon made sSc inoperable but openbuity testored 1 O condition makes sse inoperable j Nos: " SSC cot currently required to be ope =ble but condison taust be correc:ed prior to openbility Mode Restraint Y 3 j With the exisung condition reason 2ble expe::stion of Councued Openbdity exists. Openbdity Deter::unsucn mm:te: (RP!) Due date: Resolunon assiped to: 1

3. Rep..dle?

3 O Yes:per: S [Reportabuity Deination Regmed 4 mmen:s (Including say immediate cer:ecuve scuous taken): Ab ( n /n[f //// Time:

1. . 7 C Dsce:

-e:- ~ R:sk Sigitile:nc:

1. %%".:$-S%W9pgu.*,7s.;;r

-"Mp... 2...... SCM (C.: 03

5 Man-4:t.EE%ua *ianMo"rrocirteirc:fo enc #.

STr;.rever, r w y s u." - %..s W. v.<.-:-5:..:y :m. 1/ CR

Title:

2. CR Owner:

Inv Due Date: Tracking #: Cornments: [ Syste:n EngineerNotined E CR close to TR/AWO# , no further documentanon required _O ca closed to cR# , no further documentation required CA Departnent: (Signature) Date: l Ifcontinuation sheets (RP 4-l, Page 7) are requ: red, idennfy the section being continued by sec: ion number. Foca RP4-1 Rev.5 P22e 2 cf 7 E

Docket No. 50-423 B17049 l l Millstone Nuclear Power Station, Unit No. 3 Response to Nuclear Regulatory Commission Request for Information - Nuclear Regulatory Commission Inspection { Report 50-423/97-206, Attachment 1 February 1998 _d

U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 1 Responso to Nuclear Regulatory Commisslor Request for Information Nuclear Regulatory Commission Inspection Report 50-423/97-206 Sulpmary of Nuclear Reaulatory Commission Roau yt inspection Report 50-423/97-206 identified two apparent vblations being considered for escalated enforcement and eight Severity Level IV Vio'ations of Nuclear Regulatory Commission regulations. The letter transmitting this inspection notes, " Based on our findings, your staff initiated an evaluation of the effectiveness of the Configuration Management Program. In your response to the Notice of Violation please include a discussion of the scope and results of your svaluation of the Configuration Management Program." NNECo's Response Backaround The original review of Millstone Unit 3 (MP3) configuration issues was performed in 1996 and took into consideration that Unit 3 was the newest of the Millstone units and recognized that: The unit's original design was reviewed against the Standard Review Plan, The unit met current industry standards for system design. The licensing and design bases documentation that was readily available when the unit was built was still available. / A multi-unit team, including Nuclear Oversight, developed the Configuration Management Program and a set of implementing instructions for conducting additional reviews. These reviews were designed to be a graded review, very detailed in areas that shc'ved weaknesses and less detailed where information supported that it was not necessary. The determination of key areas of weakness was performed through diagnostic assessments as described W NNECo letter dated July 2,1996, " Initial Results of Millstone 3 Recovery Activities." NNECs recognized that, due to the unprecedented type of reviews being done, feedback assessments would be required to check our results against the Configuration Management Program mission of restoring compliance with the licensing and design bases. Included in these internal assessments were the results from the Independent - Corrective Action Verification Program coatractors and Nuclear Regulatory Commission inspection teams. Lastly, the scope of the Configuration Management Program included a transition plan to move from the " restoration" phase to the " maintenance" phase.

U.S. Nuclear Regulatory uommission B16942\\ Attachment 1tPage 2 The scope of the Configuration Management Program was comprehensive in its breadth and depth. More then 700,000 man-hours went into the direct effort of restoration for Millstone 3. This does not includa many of the support activities performed by many organizations across the site, The scope included the 88 Maintenance Rule Group 1 and 2 systems and 19 topical areas. More than 60 programs also received graded reviews under the Configuration Managemerit Program. Meetings were also held with Nuclear Regulatory Commission to clarify the specific requirements of the Independent Corrective Action Verification Program order and factor that into the scope of the Configuration Management Program. The Final Safety Analysis Report was reviewed for key statements supporting the Unit 3 licensing and design bases. More than 30,000 annotations were made during this review providing the documentation of the bases for these statements of fact. The licensing basis reviews included a review of the licensing basis covered in the Final Safety Analysis Report, confirming key design parameters covered in the Technical Specifications and procedures, and a review of applicable correspondence. The reviews generally found compliar.ce with Nuclear Regulatory Commission requirements and commitments. NNECo's Configuration Management Program also included Nuclear Oversight reviews that resulted in expanding the reviews of design changes, expanding the type of walkdowns, and included 5 Independent Assessments that used a graded approach to confirm completion, Nuclear Oversight lookec' at both process and results. NNECo also used independent contractors to do system vertical slices to confirm readiaess for the start of the independent Corrective Action Verification Program and also tested the completion of discovery efforts. Enhancements were' made to program reviews, electrical separation walkdowns, and maintenance requirements for the Design Basis Summary documents as a result of these reviews. Confiauration Manaaement Proaram Effectiveness Assessment An effectiveness assessment of the Millstone Unit 3 Configuration Maaagement Program was undertaken in October of 1997 as discussed later in this section. The results of the assessment were summarized with the Nuclear Regulatory Commission at the Predecisional Enforcement Conference held on January 13,1998. NNECo's assessment of the effectiveness of the Configuration Management Program concluded that the program was effective in identifying deviations and restoring compliance with the Nuclear Regulatory Commission approved licensing and design bases. NNECo's review of this assessment and input from the ongoing inspections led us to conclude that supplemental review and/or corrective action was still required in the following areas:

U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Pago 3

1. Operating Experience (Nuclear Regulatory Commission Information Notices) reviews for issues involving system interactions and interfaces;

2. Controls to support identification and revision of key calculations;

3. Technical Specification Section 6.0 required programs for compliance with licensing basis requirements;

4. Final Safety Analysis Report to assure proper alignment of Architect Engineer and Nuclear Steam Supply System vendor design requirements; and S. Dose analysis calculations and assumptions.

Each of these areas,'except dose analysis, is discussed below. Dose analysis calculations and assumptions are currently under review by the NRC as part of an ongoing inspection. In response to Nuclear R gulatory Commission questions received at the January 13,1998 Predecisional Enforcement Conference, additional information on the use of Operating Experience in restoring configuration management is being provided. NNECo believes that the Configuration Management Program review process as expanded, is sufficient to bring the Millstone Unit 3 physical plant configuration and supporting documentation into conformance with the Nuclear Regulatory Commission approved licensing and design bases. The reviews conducted to date under the Configuration Management Program have improved upon the accuracy of the original Final Safety Analysis Report, the quality of the supporting documentation and have provided the necessary programmatic improvements essential to maintaining the licensing and design bases over the remainder of the operational life of the unit. Use of Operatina Experience The original scope of the Configuration Management Program included a review and validation of regulatory commitments communicated by NNECo to the Nuclear Regulatory Commission after the plant was originally licensed. This included a review of Millstone Unit 3 correspondence submitted by NNECo in response to Nuclear Regulatory Commission Generic Letters and Bulletins as well as Unit 3 Licensee Event Reports. In addition, Operating Experience was utilized extensively in the topical area reviews, and the Configuration Management Program team, assembled under the direction of Westinghouse and Southern Services Company, had extensive operational experience. As part of the Configuration Management Program, 37 Design Basis Summary documents were developed for Maintenance Rule Group 1 and 2 systems, in preparing these Design Basis Summary documents, Operating Experience was factored into the performance aspects of the Millstone Unit 3 systems. For example, potential industry issues, such as net positive suction head requirements,1/alve flow requirements, post loss of coolant boron precipitation issues, service water heat removal requirements, reduced feedwater temperature transients, etc., were appropriately factored into the

U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 4 Design Basis Summary documents by experienced system design and equipment engineers. Also, an extensive review of key system calculations was performed. This review focused on key inputs and assumptions in order to ensure that known industry issues, such as sump vortexing and flow requirements, instrument uncertainties associated with setpoint calcuhtions, performance characteristics of electrice equipment, structural methods, etc., were appropriately included in the calculations. As NNECo discussed at the January 13,1998 PredecHonal Enforcement Conference, a review of historical Nuclear Regulatory Commission Information Notices was not included in the original scope of the Configuration Management Program. Information Notices were excluded on the basis of the Configuration Management Program scoping and diagnostic assessments which did not show a significant number of discrepancies relating to the use of Operating Experience information. NNECo acknowledges that a review of information Notices could potentially have resulted in early identification and timely disposition of the Recau: ming Spray Syster,i air entrainment and Refueling Water Storage Tank backleakage concerns. As a result of the Configuration Management Program Effectiveness Assessment conducted following identification of the Recirculating Spray System air entrainment concern, NNECo initiated an Integrated System Functional Review as discussed below. This review included significant operating experience input. This input was derived both from the composition of the team and from the process followed. The team consisted of representatives from Westinghouse, ABB/CE and Southern Services Company. Personnel from the Nuclear Safety Engineering Group reshonsible for implementing the NNECo Operating Experience review program were also included on the team. The review considered input from many sources, including Operating Experience reports from other similar units. Drawing on the knowledge and experience of the team, Operating Experience reviews were factored into the review process. Chart 1 below provides a representative listing of the operating experience utilized in the review.

U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 5 Chart 1 Genera! Issue Associated OE, IN, or IR Leakage of N2 from the Accumulators IN 97 40 Leakage of 112 into the ECCS piping from VCT, ECCS IN 88 23 & sup 3 gas entrapment, and other Net Positive Suetion llead OE/LER 213 96006, CY concems OFlLER 88 006-01 Oconce OE/LER 97 015 00, Millstone OFlLER 97-028 00, Millstone OFlLER 90-012-00.CY OFlLER 88 006-00. Oconee F

• ER '8-008-00, Turkey Point s-261/97-201, Robinson IR 50 311/96-81, Salem IR $0-289/96-201, TMi Do we declare pumps inoperable when the min-Dow Oti/LER 92-007-00, Calvert Clifts valve is closed?

OE/LER 275-96001, Diablo Canyon Single failure o; * ! reset switch OE/LER 89-018-00, Turkey Point OE/LER 289 97009. TMI Dack leakage of Sump water to the RWST or VCT OE/LER 339-9600,6/5/96 NSAl 92-008 OFlLER 93-006-00, North Anna OFlLER 91-010-00, Oconee OE/LER 91023-00, Sequoyah IR 50-305/97002, Kewaunee IR 50-315/96013, Cook lR 50-346/97 201, Davis Besse Single reference leg feeding multiple level indicators SOER 01 (98), IN 97 3 I Erosion of flow orince/ valves in the ECCS lines OE/LER 91-010-01, Trojan OE 7127,03/02/95, Sequoyah Dead heading of ECCS flows during sump OE/LER 97 008-00, Crystal River recirculation when min-flow is isolated Internal flooding failing multiple trains OE/LER 97-046-00, h Gistone OE/LER 90-009-01, Millstone Mis-operation of non-safety electrical equipment OE/LER 93-002-00, Indian Point failing containment penetrations OE/LER 90-036-00, Millstone Order of St & LNP signal generation may affect DG IN 9317 performance OE/LER 255-92026, Palisades Single failure vulnerabilities of ventilation systems OE/LER 94 020-00, Millstone OE/LER 91-015-00, Trojan OE/LER 92-013 01, flatch IR 50-311/96-81, Salem

U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 6 I Adequacy or pamp min-Hows. Time restriction on IN 88 04 I continued operation on less than recommended min. OE/LER 86-001-00. Robinson Cow. IR 50 311/96-81, Salem Surveillance or ECCS piping rull of water IN 97-60 Column separation or system causing water hammer on IN 8710, sup i pump restart OE/LER 97 003-00, Millstone Common min How may result in dead heading of OE/LER 97 008-00, Crystal River I weaker pump OE/LER 90-029-00, McGuire i OE/LER 87-030-00, Turkey Point l OE/LER 87 018-00, Indian Point IR 50-311/96-81, Salem Potential pump cavitation during pump line-up change OE/LER 94-007 00, Millstone IN 97-60 l The methodology utilized to perform the Integrated System Functional Review was developed to_ evaluate safety system interactions in relation to accident mitigation capability. The system interactions selected considered Operatin.q 2xperience impact. l The need to do these reviews resulted from a scope limitation in the Configuration Management Program. While detailed reviews of the Millstone Unit 3 design were performed on a system-by-system basis by the Configuration Management Program, the interactions and interfaces that occur between the various systems during an accident had not been reviewed in as much detail. The Npclear Steam Supply System, which is designed by the PWR vendor, ne~eds to interface with support systems L designed by the Architect Engineering firm. The interfaces between the Nuclear Steam Supply System and support systerns are fully understood under normal operating nditions. However, under accident conditions, the standby safety systems are

quired to operate and interface with both the Nuclear Steam Supply System and support systems. Because experience with the standby safety systems is limited to testirv-md sunteillance, interface issues with these systems may remain undiscovered.

To address this aspect of the design basis, NNECc assembled a team of experts to perform an Integrated System Functional Review. The purpose of this integrated System Functional Review was to consider the dynamic interactions that take place between various systems during an accident scenario. The functional review process examines interfaces across the various systems, rather than a detailed vertical slice through each inoividual system. The functional review process also examines the interface between the operator recovery actions and the systems under changing conditions. Both industry and unit operating experiences were factored into the review. This review complimented the Configuration Management Program design reviews done previously. The goal of the review was to ensure that the various systems (including the support systems) can perform their safety functions to mitigate the

U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 7 postulated event while interfacing with each other under changing conditions during the event. The review team members were experienced personnel selected to cover the following areas: knowledge of the system design basis, operations, safety analysis and startup testing. In addition, a team member with operations experience from a " sister" plant was included for comparison and contrast to Millstone Unit 3 operation. in-house experts and experts frorn external organizations were also consulted to factor in operating event experience. The average work experience level of the full-time team members was greater than 20 years. An accident mitigation scenario was selected to examine the integrated response of the systems included in the review. The Strall Break Loss of Coolant Accident scenario was selected because its mitigation requires the use of approximately 25 key safety significant systems and operator recovery actions. Additionally, this accident scenario crosses most of the safety-related interfaces between the Engineer-Constructor and l Nuclear Steam Supply System vendor systems. The affected system drawings (P&lDs) and the Millstone Unit 3 Emergency Operating Procedures were used during the Integrated System Functional Review. The Millstone Unit 3 simulator was also used to gain understanding and examine interactions between the normal operating systems and the safety systems during the pre-trip phase of the Loss of Coolant Accident event. Simplified flow diagrams were created j from the detailed P&lDs to provide the review team with a common frame of reference l for discussion and an overview of the system. The Emergency Operating Procedures were used to identify the post-trip operator recovery actions. The review team used engineering discussion sessions to review each safety system. These sessions provided the team with the most flexibility to identify potentialitems which required further review, and included the System Engineers who provided overviews of their systems. The foilowing is a partiallist of topics that were discussed and covered by the team: Potential for Pump Cavitation During Valve Lineup Changes Potential for Pump Deadheading During Valve Lineup Changes Potential for Water Hammer Diesel Loading Sequence of Support Systems Effects of Active and Passive Failures on the System Response i Effects of Operator Recovery Actions on the System Response Timing of Automatic Actuation Signals Potential Release Paths for Offsite and Control Room Doses Adequacy of Surveillances Accumulation of Noncondensable Gases in Stagnant Piping

U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 8 The Millstone Unit 3 Integrated System FJnctional Review team completed its review of systems interactions on January 5,1998. Based on the results of the functional reviews,14 level 2 Condition Reports were generated with 12 of those Condition Reports designated as startup related with one reportable condition. Given the extent of the Integrated System Functional Review process, the team concluded that additional review of differcnt accident scenarios would yield little new information for Millstone Unit 3. The results of this review confirm NNECo's previous conclusion of the Configuration Management Program effectiveness in that the safety implications associated with the 14 identified Condition Report's are considered to be low. Based on the above efforts, there is reasonable assurance that the reviews conducted and corrective actions being taken have adequately considered industry operating experience. This conclusion is based on Institute of Nuclear Power Operation evaluations (i.e., most recent was August 1996) which specifically assess the effectiveness of actions taken to address Institute of Nuclear Power Operation E Significant Operating Experience Reports, an Institute of Nuclear Power Operation assist visit in the fall of 1997, and the Nuclear Oversight Audit of the Operating O Experience Program which was conducted in November 1997. The 1997 Nuclear Oversight Audit cornluded that industry operat!ng experience information was being collected, evalur and distributed to appropriate personnel and appropriately screened for app..cabilitv to the Station. The Nuclear Oversight Audit did not identify any findings, ani the deficiencies and observations noted were not related to programs or processes that could affect the licensing and design Bases. On January 29,1998, the Nuclear Safety Assessment Board confirmed the readiness of the Operating Experience Program to support Millston6 Unit -3 restart. NNECo has also reviewed the results and findings from the Independent Corrective Action Verification Program contractor and the Nuclear Regulatory Commisrion Tier I,11, and 111 inspections and has not identified any other significant weakness with respect to the use of Operating Experience. The expansion of the Configuration Management Program scope to address system interactions, integrated system functional responses, dose analysis and Technical Specification 6.0 operational programs targets the areas that were missed by the original Configuration Management Program and that need to be addressed prior to restart. Nevertheless, a further scree.9g of Nuclear Regulatory Commission Information Notices will be conducted over the next several weeks to ensure that no information Notices that are impcrtant to Millstone Un't 3 design, licensing and operating bases have been missed. An " expert panel" consisting of Engineering, Operations, and Nuclear Safety Engineering (Operating Experience) representatives will perform the screening. The screening process will identify those Information Notices not addressed previously by the Integrated System Functional Review Team. After the screening is completed, Information Notices selected for further review will be forwarded to the Integrated Syste a Functional Review Team. The Integrated System Functional Review Team will

Fr Ae-na,L +<- 6 A& A b4-e.n--1. 1,,& 6e e+,,.r- _m s,..&.a .,.4-ae--_ - --,y,.+.AA,e, + en 1-- a -,2 aam,- +s s--,w-4 w ,1.-h.- U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 9: i review the information Notices and determine if they impact any pre /ious conclusions. Condition Reports will be written for any adverse condition found dunag this phase of the review to document the condition, initiate appropriate operability and reportability determinations, and initiate the implementation of corrective actions. Several key enhancements have also been made to the Operating Experience Program to assure long-term effectiveness and are discussed below: An executive sponsor was assigned to provide a high level of management support to the Operating Experience Program. lasue Managers have been assigned representing all three units and Nuclear Safety Engineering to foster increased use of Operating Experience information by applicable station organizations. Access to the Institute of Nuclear Power Operation Nuclear Network and institute of Nuclear Power Operation event databases has been provided directly to more than 350 users to facilitate use of Operating Experience information in daily activities. 4 One post restart enhancement to the program involves identificath ; of Millstone events which are precursors to significant events which have oc. curred in the industry. The ability to correlate any Millstone precursor events-to significant industry events will provide an additional performance measure i the effectiveness of the Millstone Operating Experience program! This part of the program will be in place by June 1998. Calculation Control / Based on an assessment of the Independent Corrective Action Verification Program and Safety System Functional Inspection findings, NNECo concluded that existing Design Control Manual guidance did not support effective control and identification of key design basis calculations. This condition can result in confusion as to when a calculation was considered to be a " calculation of record" and the priorities assigned to making revisions. Improvements to the Calculation Control Program have been made and include revisions to the Design Coritrol Manual to differentiate between a " calculation of record" and those approved calculations which have not yet been incorporated into the licensing or design bases. This latter category of calculations is subject to final verification at the time of field installation or license amendment issuance. Applying this guidance, calculations that are performed to support plant modifications or Technical Specification changes are put on a hold status until the field installetion is completed and releaced to operations and/or the revised license condition ' in effect. These improvements are judged to be sufficient to ensure adequate design control in support of unit restart.

U.S. Nuclear Regulate Commission B16942\\ Attachment 1\\Page 10 in addition to the restart required changes described above, NNECo is moving forward with further = enhancements to the Calculation Control Program. Key calculations suppc:ving the Millstone Unit 3 licensing and design bases are currently being uniquely identified and existing Design Control Manual direction for determining when a calculation revision is required is also being strengthened. The Design Control Manual willinclude direction to further clarify the requirements for calculation updates based on the number of changes and type of calculation. Requirements for periodic review key calculations with outstanding Calculation Change Notices will also be included in the Design Control Manual. These improvements to the Design Control Manual will be completed by March 31,1998. Review of the Millstone Unit 3 Technical Specifications and Surveillance Procedures The preliminary results of the Nuclear Regulatory Commission's Tier il P.ad til l inspections, and the out of scope Tier i Safety System Functional Inspection identified i examples of implementation deficiencies associated with procedures used to satisfy Technical Specification Surveillance requirements and the programmatic requirements contained in Technical Specification Chapter 6.0. On the basis of these preliminary findings, an e 'sessment of Technical Specification reviews performed under the Configuration Management Program and other initiatives was performed. As further discussed below, the assessment concluded that implementing procedure and technical requirements reviews were sufficient to support unit restart. However, while many of the site-wide programs covered under Section 6.0 of the Technical Specifications hau previously been,*eviewed under the Configuration Management Program, the Millstone UEt 3 specific programs had cot. / Consequently, supplemental reviews have been initiated to confirm the adequacy of Millstone Unit 3 compliance with the programmatic requirements of Technical Specificatior Section 6.0. Millstone Unit 3 Technical Specifications and Technical Require c.s Manual, were rcviewed under the Configuration Management Program for consistency with the design parameters delineated in the surveillance procedures, associated analyses and calculations. The review required that the setpoints, flowrates, volumes, and concentrations referenced in the Technical Specification and Technical Requirements Manual be verified to be consistent with the calculations, associated analyses and operating experience. Approximately 200 analytical values specified in the Technical Specifications were validated. For exemple, Reactor Protection System and Engineered Safety Features Actuation Sysem setpoint basis documentation was reviewed for consistency with Technical Specifcation requirements. In performing this review, operating experience was also extansively factored into the process. Specifically, all Technical Bulletins and Nuclear Safety Advisory letters issued by Westinghouse since Millstone Unit 3 received its e 1erating license were factored into the calculation reviews. Industry issues impactir a instrumentation (e.g., Rosemount transmitter issues) were also factored into the review. The results of this effort was the

\\ U.S. Nuclear Regulatory Commission B16942\\ Attachment 1\\Page 11 submittal of a new Reactor Protection System / Engineered Safety Features Actuation System Technical Specifications to the Nuclear Regulatory Commission for approval. Additionally, Technical Specification issues associated with pressurizer level, :he allowable value for Reactor Protection System / Engineered Safety Features Actuation System setpoints, and updates to 10CFR50 Appendix G curves were all identified under the Configuration Management Program. A review of Technical Specification implementing procedures associated with response time testing was also included. This review was conducted to evaluate conformance with the guidance contained in Nuclear Regulatory Commission Generic Letter 96-01, in parallel with the Configuration Management Program project, NNECo has completed a review of those procedures implementing Technical Specification Surveillance Requirements. This review verified that the stated procedure objective was in alignment with the associated Surveillance Requirement, that appropriate triggers existed within the procedure for conditional Surveillance Requirements and that the tools used to support scheduling of Surveillances are accurate. A supplemental compliance review of Technical Specification Section 6.0 programmatic requirements is in progress. This review will be completed and any deficiencies appropriately dispositioned prior to entry into Mode 4. Einal Safety Anat sis Renort Accuracy t An assessment of the quality of NNECo's Final Safety Analysis Report reconstitution project was performed based on reviews of Discrepancy Reports generated through the Independent Corrective Action Verification Program. Those assessments concluded that the overall project had been effective in that no safety significant findings had been identified for those Discrepancy Reports that had been responded to. However, based on the Nuclear Regulatory Commission's out of scope Safety System Functional Inspection, a validation of this conclusion was undertaken. This effort consisted of an in depth review of the Independent Corrective Action Verification Program findings and Nuclear Regulatory Commission out-of-scope Safety System Functional Inspection issues and confirmed no programmatic deficiency associated with the Configuration Managernent Program review of the Final Safety Analysis Report. While no programmatic deficiencies were noted, this latter assessment did conclude that additional benefits could be gained through a supplemental review of Final Safety Analysis Report se.,tions (i.e., Chapters 3 and 6) containing design information for systems with significant Architect Engineer / Nuclear Steam Supply System vendor interface requirements and/or non-standard Westinghouse system designs unique to Millstone Unit 3. The intent of this review is to ensure effective coordination and integration of information between these Final Safety Analysis Report sections. Supplemental reviews of Final Safety Analysis Report Chapters 3 and 6 are being performed. These reviews are being conducted by the Integrated System Functional I

U.S. Nucicar Regulatory Commission B16942\\ Attachment 1\\Page 12 Review team with a focus on critied Architect Engineer / Nuclear Steam Supply System design interfaces and interactions and will examine the information contained in the Final Safety Analysis Report to ensure compatibility. This review will be completed with findings appropriately dispositioned prior to entry into Mode 2. Conclusion The Configuration i,*anagement Program methodology together with the supplemental reviews and actions previously discussed provides a high degree of assurance that Millstone Unit 3 will be operated in conformance with the Nuclear Regulatory Comm!ssion approved licensing and design bases. The Integrated System Functional Review process brought industry expertise and knowledge of. Operating Experience to focus on the complex system interactions and interrelationships and identifying associated design weaknesses. The limited number and relatively low safety significance of issues identified to date through this process has increased NNECo's level of confidence in the effectiveness of the Configuration Management Program. The Technical Specification reviews completed to date ensure that the operational and safety limitations imposed by Technical Specifications have been aligned with the licensing and design bases in support of plant operation. The additional reviews specified for Technical Specification Section 6.0 will provide an added level of assurance. With regards to Final Safety Analysis Report accuracy, an extensive review of the Nuclear Regulatory Commission's Safety System Functional Inspection findings and the findings provided through the Independent Conective Action Verification Program confirmed no programmatic deficiency in the original Configurstion Management Program review process. The supplemental review of Final Safety Analysis Report Chapters 3 and 6 under the Integrated System Functional Review process-further enhance the review of complex system interfaces and interactions to its logical conclusior.. For the reasons stated above, NNECo firmly believes that the Configuration Management Program has been effective in identifying safety significant equipment deficiencies and programmatic weaknesses. Appropriate actions have been or are being taken through the Corrective Action Program to address identified deficiencies. l _-_w}}