ML20211F229

Responds to Violations Noted in Insp Rept 50-289/86-12. Corrective Actions:Procedure for Installation of Lead Shielding Revised.Engineering Evaluation Will Be Performed Prior to Installation of Temporary Shielding

ML20211F229
Person / Time
Site:	Three Mile Island
Issue date:	10/13/1986
From:	Hukill H GENERAL PUBLIC UTILITIES CORP.
To:	Murley T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
References
5211-86-2169, NUDOCS 8610310107
Download: ML20211F229 (11)

Text

_. .

GPU Nuclear Corporation Nuclear  :::,ome: s 48o Middletown, Pennsylvania 17057 0191 717 944 7621 TELEX 84 2386 1

Writer's Direct Dial Number:

October 13, 1986 5211-86-2169 Dr. Thomas E. Murley Region I, Regional Administrator US Nuclear Regulatory Commission 631 Park Avenue King of Prussia, PA 19406

Dear Dr. Murley:

Three Mile Island Nuclear Station, Unit 1 (TMI-1)

Operating License No. DPR-50 Docket Nos. 50-289 Response to Notice of Violations on Inspection Report 86-12 Attached is the GPUN response to Appendix A of Inspection Report No.

l 50-289/86-12 " Notice of Violation."

In addition, as you requested, GPUN provides the following summary of actions taken on other modifications.

A broad program has been implemented to ensure PAT I identified problems will be corrected in Cycle 6 (6R) Outage work. This has been accomplished by increased management involvement, training sessions, and audits of specific 6R modifications. This three prong approach was geared to ensure proper implementation of the modification control procedures. Specifically, GPUN targeted four 6R projects to have a comprehensive audit performed. These projects were chosen based on their overall importance and to access a broad range of engineering disciplines. The four mods chosen were HSPS, ESF Ventilation, Appendix R - Remote Shutdown, and Radwaste Pumps.

The detailed audits have been performed and the results are being tabulated.

Concerns or weaknesses found during the audits will be resolved prior to completion of the project. Should the concerns or weaknesses identified indicate generic questions, other projects may be chosen to undergo detailed design verification reviews.

goQh G

GPU Nuclear Corporation is a subsidiary of the General Public Utilities Corporation fECI l

5211-86-2169 October 13, 1986 For work performed by Architect-Engineers (AEs), GPUN had each of the three AEs prepare a review of the status of engineering documentation. The AEs per/ormed reviews on key projects for 6R. The results have been tabulated and items identified will be resolved.

Sincerely,

[ .

)

H. D. k:11 Vice President & Director, TMI-1 HDH/DVH/spb:0685A cc: R. Conte Sworn beforeand mesubscrib{d this d day to of of def f.f u ; , 1986.

aint b blL 'U}G Notary Put)1ic 4

/

SEARON P, ERO?!N NOTARY PUEL'C MIDDLETOWN BORD DAUPHIN COUNTY MY COMFIS$10N EXPIRES JUNE 12,1989 Member, rennsylvania Association of Notaries l

l l

l i

i

ATTACMENT 1 As a result of an inspection conducted between March 3-27 and July 7-11, 1986 and in accordance with the NRC Enforcement Policy (10 CFR 2, Appendix C), the following violations were identified:

Violation A 10 CFR 50.59(b) states, in part, that, "... Licensee ... records [of changes in the facility or procedures as described in the safety analysis report]

shall include a written safety evaluation which provides the basis for the determination that the change ... does not involve an unreviewed safety question ...."

7 Technical Functions Procedure EP-016, Revision 1-00, dated January 18, 1985, " Nuclear Safety / Environmental Impact Evaluation," Exhibit 3, paragraph 3.3, requires, in part, that the written safety evaluations for facility changes describe how the proposed change will or will not affect the safety functions by addressing concerns such as: (3.3.1) system performance; (3.3.3) natural phenomena with respect to seismic classification; (3.3.9) electrical isolation criteria; and, (3.3.11) single failure criteria.

Contrary to the above, licensee safety evaluations for various safety grade modifications did not fully address various safety performance functions as noted below.

-- As of March 27, 1986, lead shielding was installed on important-to-safety piping without a proper evaluation on system performance during a design basis seismic event.

-- As of March 26, 1986, the two-hour backup instrument air system for the Emergency Feedwater System (EFW) was susceptible to single f ailure.

2. Administrative Procedure 1001 A, Revision 10, dated April 17, 1986,

" Procedure Review and Approval," Figure AP 1001 A-5 on procedure change safety evaluations, paragraph 2, requires, in part, that a determination be made that the procedure change does not cause an unreviewed safety question.

Contrary to the above, as of March 27, 1985, safety evaluations related to EFW pump surveillance test (SP 1303-11.42) changes did not adequately determine that an unreviewed safety question existed, in that the surveillance test provided a test lineup that was inconsistent with the applicable section of the updated safety analysis report.

Response to Violation A Action Taken to Resolve Specific Concerns All temporary shielding was removed from TMI Unit 1 important to safety systems prior to startup from the SM Outage. At that time, the shield blocks installed at the letdown prefilters MU-F2A and 2B were considered to be a permanent installation. Since then, this installation has been re-evaluated and is now considered to be a temporary installation. This installation has had an engineering evaluation which included a safety determination. These blocks presently satisfy correct installation requirements. Additionally, after startup one temporary shielding installation was completed. This installation was made only af ter an engineering evaluation which included a Safety Evaluation was performed.

GPUN is revising the procedure for Installation of Lead Shielding. This procedure revision is in the final approval cycle and is scheduled to be completely signed off by the end of October 1986. This procedure revision incorporates the following points:

-- 'An engineering evaluation will be performed prior to each installation of temporary shieldin.g.

To ensure that plant conditions are maintained consistent with possible restrictions imposed by a temporary shielding engineering evaluation, the shif t supervisor shall provide approval for proposed temporary shielding installations.

-- The engineering technical evaluation will consider the

- piping size, code allowables, seismic constraints, and system, operating parameters. The procedure will also specify shielding fastening requirements when applicable.

-- The Safety Evaluation wi.ll follow established GPUN procedure requirements. Additional questions specific to shielding installation following INP0 recommended good practices will be incorporated in the procedure revision.

The Two-Hour Backup Instrument Air system configuration was corrected prior to startup from the SM Outage to allow the system to withstand a single active failure identified during the PAT inspection. A safety evaluation and procedural changes were completed before TMI-l returned to power. This was reported to the NRC by phone and by License Event Report 86-07 (forwarded April 25,1986). With three independent sources for supplying air to the EFW system, the piping arrangement was overly complex. The corrective action was to simplify the design by isolating piping that was not seismically qualified.

A comprehensive Single Failure Analysis on the air supply system to the EFW valves has been completed by the architect-engineer and is currently being reviewed by GPUN. This review will be completed in October,1986. This '

analysis is to ensure that the system will perform its safety design function during design accidents with a single active failure.

EFW pump surveillance test procedure 1303-11.42 has been revised to agree with the FSAR. This revision includes checks for potential back leakage through idle pump check valves. The safety evaluation now properly represents agreement between the surveillance and the FSAR.

Action to Prevent Reoccurrence The revised Lead Shielding Procedure will prevent similar problems in the future. The past problems were due to weak procedure requirements.

Management continued attention to full and precise procedure implementation for Safety Evaluations and the detailed design verification reviews will identify weaknesses such as the single active failure identified by PAT I.

Further programmatic changes in the design area are covered in the response to Violation B.

l t

i . _ _ . . - . _ - . _ -. - . - - . _

Violation B The 10 CFR 50 Appendix B Criterion II and the NRC approved Quality Assurance Plan (QAP), dated November 1985, establish overall quality assurance program requirements for the design and construction of safety-related structures, systems, and components. To implement these requirements, the QAP Appendix C commits to the implementation of Regulatory Guide 1.64, Revision 2, June 1976, and ANSI N45.2.11,1974, on " Quality Assurance Requirements for the Design of Nuclear Power Plants."

1. ANSI N45.2.ll, paragraphs 3.1 and 4.2, require, in part, that applicable design inputs and bases be identified in sufficient detail, documented, and their selection reviewed and approved.

Contrary to the above, as of March 27, 1986:

-- The design input review and approval process permitted battery sizing calculations to be performed using a minimum temperature for which no basis was referenced.

(Actual battery temperatures were lower than the minimum

used in the calculation.) Also other design input data used in the battery sizing calculation, such as pump and valve starting and running current, lacked sufficient references to permit the complete verification of the calculations.

-- The design input review and approval process permitted the use of preliminary, unverified design input as a basis for fuse changes in de power distribution panels.

2. ANSI N45.2.11, paragraph 5.1.3, requires, in part, that systematic methods be established for communicating needed design information across external design interfaces.

Contrary to the above, as of March 27, 1986, design input associated with sizing of regulating valves installed in the two-hour backup supply air system was provided by the licensee to an architect-engineer but was subsequently changed without notifying the affected design organization.

l

3. ANSI N45.2.11, paragraph 6.1, requires, in part, that measures shall be applied to verify the adequacy of design. Technical Functions Division Procedure 5000-ADM-7311.02 (EP-009 ), Revision 1-00, dated July 31, 1985,

" Design Verification," requires, in part, the verification of calculations, the preparation of verification checklists, and the l verification of system designs.

1

Contrary to the above, as of March 27, 1986, design verification requirements had not been fully adhered to, as noted below:

-- Three engineering calculations, Calculation No.

1101X-322F-165 - Flow Rates for Two-Hour Backup Air Supply System; Calculation No.1101X-322F-424 EFW System Resistance; and Calculation No.1302X-5320-A50 - Shielding stress, had no calculation verifications performed.

-- Three design verifications, Calculation No.1101X-3228-003

- Air Consumption by EF-Y-30 Valves; Calculation No.

110lX-322F-157 - EFW Pump Turbine Relief Yalve Setpoint; and Calculation No.1101X-3228-004 - Air consumption by MS-V-6, did not have required verification checklists prepared.

-- System Design Descriptions 424A, B, C, D, and E, Division I and II, involving the EFW system, its backup instrument air supply, and supporting instrumentation, had not been design verified.

-- Nine shielding installations were installed prior to the calculations to support the shielding having been verified.

4. ANSI N45.2.11, paragraph 6.3, requires, in part, adequate pre-operational testing be specified. Technical Functions Procedure 5000-ADM-7335.01 (SP-001), Revision 0-00, dated November 15,1984, "Startup and Test Program and Test Requirements," paragraph 4.7.1 requires, in part, that functional test procedures verify that modifications perform their intended functions.

Contrary to the above, as of March 27, 1986, post-modification testing of the two-hour backup air supply modification did not confirm that the modification produced expected results per the design basis and did not have acceptance criteria consistent with the system design basis.

Response to Violation B Action Taken to Resolve Specific Concerns The battery sizing calculation has been redone using correct parameters and has undergone a design verification and review. No safety issues were identified.

The preliminary, unverified design input referred to in the violation was a GPUN Technical Data Report (TDR). The fuse change modification had been approved based on this unissued TDR. Since then, this TDR has been properly complete d. In addition, the fuse changes modification was reviewed for any possible impact and none was found.

GPUN is re-evaluating the design input for the sizing of the regulating valves. This evaluation is a portion of an overall evaluation of the Two-Hour Backup Instrument Air system. This overall evaluation will consider the concerns expressed by PAT I, other concerns, and test results. The result of this evaluation will be a document (s) that will be used to maintain the system to the design basis intent. This evaluation is scheduled to be completed by the end of November,1986.

The three calculations noted have had the verifications performed.

The three design verifications noted have had the checklists prepared and completed.

The design verification of System Design Descriptions 424A, B, C, D, and E, Division I & II is being performed as part of a technical audit review by GPUN.

This is presently in progress and is scheduled to be completed by December 31, 1986. A verification plan will be finalized in the documentation package.

For Lead Shielding see Violation A response.

The evaluation of post modification testing of the Two-Hour Backup Air system conducted is part of the previously stated evaluation in the third paragraph of this response. As such, validity of the test results will be considered in this evaluation.

Action Taken to Prevent Reoccurrence Following the PAT I Inspection, GPUN reviewed the existing Design Program.

This review found that many of the problems identified in the PAT I Inspection were due to not following procedures. To correct this problem, two things were done. Procedures were revised to provide clearer direction and correct deficiencies, and a Training / Instruction Program was developed for all i

Technical Functions personnel.

Two of the key procedures, EP-006 (Calculations) and EP-009 (Design Verification) have been revised. Other procedures were revised or in the final approval stages.

The Training / Instruction Program was given to all Technical Functions personnel during the summer. This program reviewed the PAT I major items, procedure changes and reinforced the need to follow all procedures.

GPUN believes the above improvements and training along with continued management involvement will provide positive results. Management controls are being implemented in the modification process to ensure full procedure implementation in this area. Also, as stated in the GPUN response to the l SALP, one or two balanced performance appraisal type audits will be conducted before the end of 1987. This audit (s) will provide the feedback of the effectiveness of our program improvements.

! GPUN has re-emphasized to the Projects group personnel who deal with the architect / engineers that any change to a design document must be formally transmitted to the AE.

l l

l

\ /

i

Violation C The 10 CFR 50 Appendix B Criterion XVI and the NRC-approved Quality Assurance Plan (QAP), dated November 1,1985, Sections 8.1.1 and 8.2.1 require, in part, that the licensee assure conditions adverse to quality; such as, deficiencies, deviations, and nonconformances, are promptly corrected.

Contrary to the above, as of March 27, 1986, the licensee did not assure that the below-noted conditions adverse to quality were promptly corrected.

-- At various times between October 3,1985, and March 27, 1986, out-of-specification data for important-to-safety systems existed on auxiliary operator log sheets without being properly identified as such and without being properly explained as required by licensee adninistrative control s.

Design documents, which included control room and engineering drawings for various important-to-safety systems, either (1) were not updated in accordance with licensee administrative control or (2) contained errors.

Response to Violation C and Action to Prevent Reoccurrence Additional emphasis has been placed on Auxiliary Operator (A/0) log sheets.

This emphasis has proven effective in correcting this problem. To ensure our continued success in this area, additional documentation of Operations Engineering review has been added to the daily A/O log sheets. Additionally, review of log sheets has been emphasized in the off-duty management tour program.

The control room drawings have been revised and are up to date. This was confirmed in the PAT II inspection. All of the drawing deficiencies which were identified by PAT I have been corrected. Continuing awareness is being given to this area.

A revision to the GPUN drawings procedure has been issued. This revision establishes priority levels for initiating drawing revisions. The plan is to subdivide the over 60,000 drawings at TMI-l into four separate priority categories with varying drawing revision requirements. For example, a revision priority 1 drawing "must be revised expeditiously (scheduled immediately - target for completion is 30 days) to incorporate any outstanding change document." After review, we have determined that many of the 75 documents discussed in the PAT'I report will be classified a revision priority 3, which will allow six or more change documents to be outstanding because of their infrequent use. Thus, the outstanding posting status for many of these drawings will no longer be procedurally deficient. Those which are deficient are being corrected. The recoding of the TMI-l Plant Configuration Control List, with the drawing revision priorities, has commenced and is scheduled for completion during 1986.

i .- . . .

i l

Violation D i The 10 CFR 50 Appendix B, Criterion V requires that activities affecting quality shall be prescribed by instructions, procedures or drawings and shall be accomplished in accordance with those instructions, procedures, or drawings.

1 i 1. Technical Functions Procedure 5000-ADM-7350.05 (EMP-002), Revision 0-00, dated September 13,1985, " Mini-Mods," in Exhibit 2, paragraphs 2 and 7, require, in part, the documentation of sections of the safety analysis report that need updating for important-to-safety modifications.

] Exhibit 2 also requires the documentation of various design information.

Contrary to the above, as of March 27, 1986, the documents associated with two mini-mods (additional limit switches for the fuel handling crane and removal of instrument air line from EFW pump recirculation valves) were incorrectly marked as no change being required to the FSAR when, in fact, changes to the FSAR were required. For these and other important-to-safety mini mods, not all the design information required to be addressed by EMP-002 was addressed.

2. Installation specification for lead shielding around letdown prefilters, 3

MU-F2A and 2B, required that the center of gravity of the top blocks be 4

no more than 12 inches off the floor, the blocks be no closer than 2 feet to important-to-safety (ITS) equipment due to seismic considerations, and that a warning sign be installed identifying the 2 foot requirement.

I Contrary to the above, as of March 27, 1986, the lead shielding

. installation on MU-F2A and 2B had the top block center of gravity 15 l inches off the floor in some locations. ITS valves SF-V-77 and SF-V-71 were located within 6 inches and 19 inches of the blocks, respectively, j and no warning sign was installed.

1 Design Calculation No. 609-0293, Revision 0 " Bottle Rack for RM-13h" (EFW 3.

! Two-Hour Backup Instrument Air (TBIA) Subsystem), required that the air i bottle chain restraints preclude vertical movement with turnbuckles i attached to the chain to assure adequate tension. The chain and

turnbuckle connection were to be made by open "S" chain links, which were l to be closed after installation.

i Contrary to the above, as of March 27, 1986, the TBIA air bottle i restraints had no turnbuckles, certain restraints were loose, and "S" l links were not closed.

Response to Violation D Action Taken to Resolve Specific Concerns

{ A Task Request was issued to update the FSAR for the two mini mods stated.

I The issued Task Request will result in the FSAR being updated. The Safety Evaluations for these two mini mods are part of the Installation Specifications and are not stand alone documents. Since these mods are complete and a Task Request was issued, the Safety Evaluation itself will not be revised. An audit was performed on the remaining mini mods and no FSAR update problems were found.

t

.- r.

The design information required to be addressed by EMP_002 (Mini Mods)

Exhibit 2 was interpreted by the NRC to be mandatory. Previous guidance had been that the items in Exhibit 2, Procedure Task Requirement outline, were suggested points to address. If the item was not pertinent to the modification, then it need not be addressed. The procedure is being revised to clearly specify that each item need only be addressed if applicable.

The installation of the shielding blocks is covered in Violation A response.

The loose chain restraints for the Bottle Rack have been corrected and the "S" links have been closed. The " missing" turnbuckles are not required as documented in a 1982 Field Change Request.

Action Taken to Prevent Reoccurrence The two examples stated for not correctly completing the Safety Evaluation resulted from a misunderstanding of the FSAR updating requirements. GPUN has clarified the applicable procedure, specifically instructed the individuals involved, and has conducted widespread training on this issue. These actions are considered to be appropriate to address this issue.

The revised lead shielding procedure will eliminate f uture shielding problems.

The issue of the loose chains appears to be an isolated case. Maintenance did check other items in this area and found no similar problems. Therefore no further action is anticipated.

l

_g .

RECElVED-REG 10tl i 1985 GCI lg pit 2: 57

/

er

/

d, . .,-

. _ . _ _ _ _ _ . _ . , _ _ _ _ . _ . _ . . . , , . _ . . - _ _ _ _ _ . . , , . . _ _ _ . _ , _ . _ . . _ . _ . _ _ _ _ . - _ _ _ . , . . . _ . , , _ _ _ , _ . . . _ _ _ - _ . _ _ _ . _