ML20237H850
| ML20237H850 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 08/28/1987 |
| From: | Phyllis Clark GENERAL PUBLIC UTILITIES CORP. |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| 5211-87-2165, NUDOCS 8709030408 | |
| Download: ML20237H850 (10) | |
Text
- _ - - _ _ _ _ _ _ _ _ _ _ - -
GPU Nuclear Corporation
'~
arsippany, New Je sey 07054 j
201-316-7000 TELEX 136-482 Writer's Direct Dial Number:
August 28, 1987 5211-87-2165 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555 Gentlemen:
Three Mile Island Nuclear Station, Unit 1 (TMI-1)
Operating License No. DPR-50 Docket No. 50-289 Response to Inspection Report 50-289/87-08 This letter is in response to Appendix A, " Notice of Violation", of Inspection Report 50-289/87-08 dated July 29, 1987.
Your letter transmitting Inspection Report 50-289/87-08 asked that we address adeauacy of implementation of technical and safety review requirements, and that we focus on root causes of problems.
As identified in the enclosure to this letter, we believe that the safety review process in place at GPU Nuclear Corporation is satisfactory and meets Technical Specification requirements.
However, we agree that there have been l
problems in implementation. We believe the root cause of these problems is that we underestimated the extent of training and familiarization needed and the extent of guidance which should be available to the many people involved.
Since the PAT II inspection, actions to enhance the quality of safety reviews have included a revision of the Corporate Procedure to require explicit statements for negative responses on the Safety Determination form, development of guidance with respect to definition of Licensing Basis Documents, and self assessment of the effectiveness of the safety y
review process.
In addition, retraining has been and will continue to be conducted where our review determines the necessity.
Sincerely, O h h hh G9 G
PDR P. R. Clark President PRC/SMK/lt(5210g)
I Enclosure cc:
W. T. Russell, NRC gl R. Conte, NRC G. Edison, NRC N8 GPU Nuclear Co9 oration is a subsidiary of General Pubhc Utihties Corporation
ATTACHMENT A General Discussion of GPUN Safety Review Process and Basis For Conclusion of Complianco With Technical Specifications.
In accordance with 10 CFR 50.59(b), the safety review process which was in effect prior to September 1, 1986 (one step process) reauired that a written safety evaluation be prepared for changes to the f acility and procedures as described in the Final Safety Analysis Report, of sufficient detail to provide a basis for the conclusion that the change did not involve an unreviewed safety question.
Similarly, the safety review process which became effective September 1,1986 (two step process) rriuires a written determination of the basis for the conclusion that changes to the f acility and procedures as described in the Final Safety Analysis Report do not involve an unreviewed safety auestion.
In accordance with 10 CFR 50.59(a), Form 1 of the two-step process, which is entitled ~" Safety / Environmental Determination and 50.59 Review,"
auestions (a) whether the change reauires revision of the system / component description in the FSAR; (b) whether the change requires revision of any procedural or operating description in the FSAR; or (c) involves tests or experiments which are not described in the FSAR.
If the answer to any of these questions is affirmative,10 CFR 50.59 applies and the Corporate Procedure 1000-ADM-1291.01 directs that Form 2 be used as well as Form 1.
The Procedure also directs that Form 2, which includes the criteria for determining if an unreviewed safety Question exists, be accompanied by a written safety evaluation of sufficient detail to provide the bases for the conclusion that an unreviewed safety question does not exist. This is in strict accordance with the specific requirements of 10 CFR 50.59.
If the activity under review does not involve a change to facility or procedural descriptions provided in the FSAR, or does not involve a test or experiment not described in the FSAR, then 10 CFR 50.59 does not apply and an unreviewed safety auestion as oefined in 10 CFR 50.59 cannot exist.
T.S. 6.5.2.5 reauires independent safety review of written evaluations of changes in the f acility as described in the Safety Analysis Report, of changes in procedures as described in the Safety Analysis Report, and of tests or experiments not described in the Safety Analysis Report, which are completed without prior NRC approval under the provisions of 10 CFR 50.59(a)(1).
This review is to verif y that such changes, tests or experiments did not involve a change in the Technical Specifications or an unreviewed safety auestion as defined in 10 CFR 50.59(a)(2).
I 5210g
4, I L l
l T.S. 6.5.1.12 does not. refer to the FSAR, but reouires that individuals o
responsible for reviews in the following areas render determinations as to whether or not the _ activity constitutes an unreviewed safety auestion:
(1)
Each procedure required by Technical Specification 6.8<
(2)
Other procedures, including those for tests and experiments, which are important to safety (3
Changes thereto which are important to safety (4
Proposed changes to the Appendix "A" Technical Specifications
.(5 Proposed modifications to unit structures, systems and components important to safety (6)-
Proposed tests or experiments that are important to safety
-(7)
Investigation of'all violations of Technical Specifications In addition to the' questions. associated with 10 CFR 50.59(a), Form 1 of the two step process cuestions whether the proposed change reauires revision to the Technical Specifications, and also questions whether the change has the potential to adversely affect nuclear safety or safe plant operations. This ensures'that the requirements of T.S. 6.5.1.12 are met.
In r esponding to this question, Procedure 1000-ADM-1291.01 directs that consideration should be given to the potential interaction with safety related items (i.e. systems, structures, or components) which may result fr0m the change.- If-the answer to any of these questions is yes, Form 2 is reouired with the associated detailed safety evaluation.
Procedure 1000-ADM-1291. 01-also includes requirements for review of investigations of violations of Technical Specifications.
l In summary, the scope of 10 CFR 50.59 is limited to the safety analysis report and the Technical Specifications.
10CFR 50.59 identifies the category of changes for which prior NRC authorization is required;i.e.
those involving changes to the Technical Specifications and those involving an unreviewed safety auestion.
10 CFR 50.59 gives the basis for concluding that changes to descriptions provided in the safety analysis I
report do not' involve unreviewed safety questions, and reauires that the bases for such conclusion be documented.
The TMI-1 Technical Specifications include and exceed the requirements of 10 CFR 50.59.
. Corporate Procedure 1000-ADM-1291.01 ensures that the requirements of both
'10 CFR 50.59 and the TMI-l Technical Specification. are satisfied.
I l
1 l
4 52109
. - - - _ g_
g s,s.,
~,
f sy
- )
- i If j
F S jf M-g
/
I '
c' 3-
.A r
y 1,;,; s
- /
d l,$ l,
e f
/g,
., 4 V10' MION 1
, ;j Q
. a+,
,y
^
TS $'5.1.3 requires thit'l proposed modifications to ugit strd 4
-systems and components shall be reviewed.
f'
-( $:-
,"y m
'+s
~
Contrary-to the above,'certain proposed modifi,catio$;s' were not adeouately
- 77 i
~!
f O' reviewad as evidenced by the following..
4 5
s -
y,
'/
~. As of September 5, 1906, Plant Engineering Modificat1<w a
85-279-P authorized,its a " replacement-in-kind [ttun / /
- ',.4 generic replaceme4t throughoat the plant of Fisher"$9ipf 7,
i 3560 valve positioHrs 'f rom the original aluminum seat,ts t l
a mccnenical brass insert withou D adequate identifi6ation
- /,/
'l of where these positioners were l' cated in the plant.4nd o
.f i
without adeauate eteluation tnt this replacement weald.<
li l
cai,!cause an unreviewed safety' auestion..At least one.of 1
these., positioners 14s an impbrtant-to-safety functina;. >
f; nesgly, MS-Vy6, stu m pressure regulator for the steam s'
driven emerWncy feedwater (EFW) pump, 2
e y; ;,
i 9";'/
b.' As of March 3, +1987, Revision 1 to the, safety evaluations for modifications to the HSPS and EFW Svstems. (BA No.
,7 41?024) did not indicati that all safety performance characteristics su/h as 9re protection, electrical 4[ i protectico, and environmerttifoualification, were reviewed kf for 4f fecVon sfjetyl bp th'at reirision, y-GPUN'RESPONS_E[TO(_IOLATIDNla 1
o f
,j.,GPUN disagrees with this v!;olation.
l J
F The text, of Inspection, Import 87-08 includes the following addiuga)discussionCof,,this' item:
j y
'r, f~
?The specific item cited in the, PAT 11 report was on the
^
rep?acement of a Fisher Swies 560 valve positioner used for instrument valve cont'rol using a machine brass insert instead of that made of' aluminum. The modification was i
made to several secondary non-safety related valves and to 7
. j'
\\' the MS-V-6, which has an important-to-safety function;-
l.e. steam pressure regulator for the steam-driven emergency feedwatpp oumpe A supplemental engineering evaluation was issued justifying no seismic and, consequently,no s'afety concerns.
However,' for the period prior to the PAT IL this is an example of f ailure to properly evaluats* changes to the f acility as described in a
- the' final safety analyc% report..." (Section 4.2) f
,t "Sdction4.2ofthisreport"identifiedlicenseeapparent
'h l f ailure to fully evaluate tne replacement-in-kind of an
/
instrument air valve positioner (Fisher Series 3560) for the steam-admission pressure regulator
<r the 7'h.,[ steam-driven emergency feedwate' pump.
There was-no r
'f.o
~r-
.c 52109,
1 4
x t
J.
. )
detailed basis in the engineering evaluation for Plant I
Engineering Modification No. 85-279-M on the location of the j
valve positioners and whether or not the work activity l
created a seismic concern or unreviewed safety auestions.
This is an example of apparent failure to follow 10 CFR 50.59 and TS 6.8.2(6.5.)". (Section 5.2)
The above discussions are at variance with the earlier finding in the Pat 11 Report that:
o "The engineering evaluation stated that this work did not create a seismic concern and did not constitute an F
unreviewed safety Question. However, these assertions were not substantiated in the evaluation and the various locations and uses of the Fisher Series 3560 positioners were not listed or evaluated for the modification.
This appears to be a case of inadequate design analyses and will remain unresolved pending follow up by the NRC Region 1 (289/86-14-02)".
The following clarifications are provided:
1.
In response to the PAT II finding, Engineering Evaluation Report 85-279-M was reviewed.
The scope of the evaluation involved the installation of a machined brass insert in Fisher Series 3560 valve positioners in an attempt to rebuild the relay supply valve seats.
Acceptance of the' repair method was based on (1) successful calibration and (2) a functional test (stroking) of the control valve.
PAT inspectors were troubled by the conclusions in the original evaluation, which were perceived to be unsubstantiated, that the activity did not present a seismic concern and did not constitute an unreviewed safety auestion. An additional concern was that the locations and uses of the modified positioners were not specified.
2.
The Fisher 3560 valve positioner is a commercial grade item which is not seismically aualified. Therefore, the only seismic consideration associated with an insert to this valve positioner is that of a missile hazard caused by the increased weight of the valve positioner or the projection of the insert itself.
The total additional weight of the valve positioner is less than 2 grams, and the weight of the insert is approximately 2.62 grams.
(The weight of the valve positioner is approximately 5.5 lbs.
The valve actuators themselves are typically greater than 100 lbs.)
Clearly, this is not sufficient to degrade the existing supports.
In addition, the insert is totally enclosed by the valve positioner case.
As stated in the original evaluat~n, 3560 positioners are used in various locations.
The modified positioners may be installed to replace any or all of the faulty 3560 valve positioners if the calibration / acceptance criteria cre met, and therefore, individual evaluations are not requirea.
52109
. The Fisher 3560 valve positioner is not used in MS-V-6,-but was replaced with a Fisher 3582 positioner as part of the EFW System upgrade which was completed in Outage 6R.
3.
T.S.6.5.1.3 addresses proposed modifications to unit structures, systems and components important *.o safety, as opposed to " proposed modifications to unit structures, systems and components" as cited.
4.
T.S.6.8.2 specifies that "Further, each procedure required by 6.8.1 above, and changes thereto which are important to safety, shall be-reviewed and approved as described in 6.5.1 prior to implementation and shall be reviewed periodically as set forth in administrative procedures." The nexus is not apparent.
The relationship of this modification with T.S.6.8.2, as cited in Section 5.2 of IR 87-08, is not apparent.-
In summary, the Fisher valve positioner is a commercial grade component not used in safety applications. GPUN considers that the original Engineering Report provided a level of detail appropriate for the significance of the design change.
GPUN RESPONSE TO VIOLATION lb GPUN disagrees with this violation.
Section 5.2 of I.R.87-08 expands on Violation lb as follows:
"NRC Inspection 50-289/87-06 identified that revisions to safety evaluations for the safety grade emergency feedwater system (BA No. 412024) did not readdress all the elements of the previous evaluation (including, in part, fire protection, electrical separation, environmental qualification, and natural phenomena protection) with respect to the effect of changes to the system.
This is apparently contrary to 10 CFR 50.59 and T.S.6.5.1.3" A safety review package is required for each modification. The original safety review package is designated " Revision 0" Subsequent revisions to the safety review package, including the safety evaluation, may become necessary as a result of design evolutions, in whico case the entire safety review package undergoes review by the appropriate personnel, and the revision is reissued as a complete document.
During the Startup Readiness Assessment conducted by Region I during the period f rom February 17 to March 3,1987, the inspectors noted that Revision 0 of Safety Evaluation 412024-004 was issued in August 1984 and revised in December 1986.
The original safety evaluation was revised, with the next higher revision number (Rev. 1) indicated on any revised pages. Revised portions were indicated by vertical lines in the right l
margin. A Suonary of Change sheet was attached to the evaluation as the 5210g
- _ - _ _ _ _ = _ - _ - _ _ _ _ - _ - _ -
, last page. The cited elements of Rev. 0 (fire protection, electrical separation,' environmental qualification, and natural phenomena protection) were unchanged as a result of the design evolution, and were included-unchanged in Rev. 1.
The entire revised package received a technical review and an independent safety. review, as designated by the signatures of the reviewers on the Summary of Change page.- (This safety evaluation had not yet received independent safety review at the time of NRC review.
This was subsequently accomplished, prior to system turnover.). Copies of f all safety review package revisions are stored in CARIRS for document traceability.
This process is in accordance with 10 CFR 50.59 and T.S.6.5.1.3, which requires that each proposed modification to unit structures, systems and components-important to safety be designed by knowledgeable individuals and independently reviewed.
l I
1
)
52109
= - _
. VIOLATION 2 TS 6.8.2 and 6.5.1.1 require that procedures and changes thereto which are important to safety shall be reviewed for adequacy.
Contrary to the above, certain procedures and procedure changes important to safety were not adequately reviewed as evidenced by the'following:
a.
Several special temporary procedures and temporary procedure changes involving important-to-safety (ITS) systems were issued between January 5 and September 8,1986, that described important-to-safety activities and were not classified ITS in accordance with then current licensee administrative controls, and consequently, they did not receive an adeauate technical review, and in some cases, received no documented safety review.
These included, in part, procedures for flushing a valve in the makeup and purification system, for testing an EFW pump, for diluting an intermediate conling system, and for testing leakage of a waste gas decay tank.
(
Reference:
NRC Inspection Report No. 50-289/86-14, paragraph 3.4.l(1) and (3), ano Report No. 50-289/86-17, paragraph 6.2).
b.
As of March 3,1987, the Heat Sink Protection System (nuclear safety related initiation and control system for the EFW system) functional (startup) test procedures were not classified ITS and consequently did not receive a documented safety review (reference: NRC Inspection Report No. 50-289/87-06, paragraph 6.2.6).
c.
As of September 1,1986, the safety evaluation for Revision 2 to Corporate Procedure 1000-ADM-1291.01, " Procedure for Nuclear Safety and Environmental Impact Review and Approval of Documents" did not discuss whether the proposed changes conflicted with existing technical specifications.
GPUN RESPONSE TO VIOLATION 2 Clarification is required with respect to the cited Technical Specifications.
Both T.S.6.8.2 and 6.5.1.1 address procedures which are important to safety and changes thereto which are important to safety.
a.
Review of the classification of the subject Special Temporary Procedures (STP's) indicated that additional guidance for appropriately classifying STP's was needed.
This guidance was initially provided by a memo to all Plant Review Group members, dated January 28, 1987.
Guidance was subsequently incorporated in the procedure for " Procedure Review and Approval", dated June 26, 1987.
Full compliance was achieved at that time.
It should be noted that no instance of misclassification of temporary I
procedure changes has been identified.
]
52109
. b.
GPUN disagrees with this violation.
IR 87-06, paragraph 6.2.6 specifies that "In the testing area, test activities on HSPS were classified as not important to safety apparently because of the poor understanding of the corporate policy which tends to deemphasize the not-important to safety /important to safety (NITS /ITS) classification methodology..."
Since specific procedures have not been cited and our review indicated appropriate classification, GPUN auestioned the resident inspector on 8/12/87 as to the substance of this finding. The resident inspector identified that the finding did not relate to ITS vs. NITS classification of startup test procedures themselves, but rather to (1) the use of the two-step safety review process to determine the necessity for evaluation of new procedures and (2) using data collected from NITS procedures to satisfy Tech. Spec. testing requirements.
As discussed in the General Discussion above, the two-step process requires a detailed safety evaluation of all procedure changes which have a potential impact on safety, as well as all procedural changes which result in changes to the FSAR.
This is in accordance with the requirements of the TMI-1 Technical Specifications and 10 CFR 50.59.
Sometimes the Plant (based on ALARA/ cost effectiveness / schedules) will elect to use Startup and Test test results to satisfy Technical Specifications requirements in lieu of the initial performance of all or portions of surveillance tests.
If Star tup and Test is notified f ar enough in advance, they designate the test procedure an ITS activity and subject the procedure (and subsequent substantive changes) to safety reviews / documented determinations / evaluations, as appropriate.
This process helps to ensure the adeauacy and integrity of test results.
1
(
If Startup and Test is not notified ir advance, an alternative that the Plant employs is to perform a Plant Review Group (PRG) review of I
test procedure results to satisfy themselves that the results are technically acceptable and valid (i.e., a subsequent test evolution did not invalidate a setpoint, etc.).
The real issue is the acceptability of test results in lieu of surveillance procedure performance (not nuclear safety consequences of test performance), and so, this after-the-fact review is still a technically acceptable approach and satisfies Technical Specifications.
In order to provide a better documentation trail of the methodology and thought processes involved, two changes are currently being made:
- 1) The Plant is making a change to Administrative Procedure 100lJ (Technical Specification Surveillance Testing Program) to formally identify the procedure for using Startup and Test data in lieu of J
surveillance test performance.
52109 1
l 4
_______._______________J
. 2).Startup and Test'is changing SP-002 (Test Procedure Generation / Approval / Change) to specifically define the process of-safety review / documented determination / evaluation for all' test procedures generated by Startup and Test.
c.
GPUN disagrees'with this violation.
. Contrary, to finding' 2c, the safety evaluation' for Revision 2 to Corporate Procedure 1000-ADM-1291.01 identified that "the procedure continues to ensure adherence to Technical Specification requirements."
Neither 10 CFR 50.59 nor the TMI-l Technical Specificationsirequire documentation of-the basis for a conclusion that a change does/does not conflict with Technical Specification compliance.
I i
l 5210g 1