ML20245H747

Forwards Documents Describing Results & Methods of Planning & Conducting of Operational Safety Team Insp,Safety Sys Functional Insp & Ssomi,Per Asqc Conference in San Diego. Invitation to Include Author on Insp Activities Extended

ML20245H747
Person / Time
Issue date:	06/19/1989
From:	Grimes B Office of Nuclear Reactor Regulation
To:	Holliday C UNITED KINGDOM
References
NUDOCS 8906300077
Download: ML20245H747 (26)

Text

{{#Wiki_filter:_ _ _ _ _ _ _ - _ ~ June 19, 1989 i Mr. C. J. Holliday United Kingdom Nuclear Installations Inspectorate St. Peter's House Balliol Road Merseyside L304LZ f

Dear Mr. Holliday:

You asked us to provide you some examples of documentation that describe our activities involving three types of interdisciplinary team inspection reports that we conduct. These types of inspections are the Operational Safety Team Inspection (OSTI), the Safety System Functional Inspection (SSFI), and the Safety Systems Outage Modifications Inspection (SS0MI). I We briefly discussed these three inspection techniques at the ASQC conference in San Diego. In order to respond to this request, I am enclosing several documents, which both describe inspection results and our methods of planning and conducting these inspections. I enjoyed our conversations on inspection approaches and I think it would be beneficial for you to view our process firsthand. We would be most happy L to include you in our. inspection activities for a team inspection at a commer-l cial nuclear power plant. This would involve about six weeks in the U.S. Mr. Ron Hauber of our International Programs office indicates that the arrange-l ments can be quite informal. A letter or FAX from your Mr. Turner to Mr. Hauber would be adequate and we can then arrange the specific timing by telephone. Sincerely, Brian K. Grimes, Director Division of Reactor Inspection and Safeguards Office of Nuclear Reactor Regulation h[lA

Enclosures:

l See page 2 OF03 '\\ / 8906300077 890619 PDR ORG NRRB l /

• I PDC k

(HOLLIDAYLETTER) TIlp

D:DRIS:NRR

0FC

RSIB:

---

:--------------:--------------:--------------:-----------":"-~""""

s

NAME :CJHau h&Ncp

BGrimes

---

:--------------:--------------:-------------:"""-"-""-~~~--""-

---

:---h89

06/ /89 DATE :06/

NRC FILE CENTER COPY

m i ~ 2-June 1'9, 1989 Mr. C.-J. Holliday, g

Enclosures:

] -1. Appendix D, " Safety. System > Functional-Inspection dated 8/30/88. ]. 2. Ltr to L.,Burkhardt III from G. C. Lainas dtd 2/1/89 1 3. Ltr to Nebraska'Public Power -District from D. M.'Crutchfield dtd 9/22/87.- 4. Inspection Procedure 93802, " Operational Safety Team' Inspection"(OSTI) Draft 5. Ltr to'A'. Kaplan from D. M. Crutchfield dtd 6/30/88

6..Ltr 'to R. O. Williams,- Jr.,

i from G. M. Holahan dtd 9/16/88

7. 'Ltr to K.,J. Morris from G. M. Holahan dtd 2/9/89 8.

Inspection Procedure 93803, " Safety Systems Outage Modifications Inspection" dtd 4/27/89 9. Memo to Regional Directors, DRP FROM J.-G. Partlow dtd 6/6/86 10. Ltr to.0maha Public Power Distr.ict from J. M. Taylor dtd 1/21/86

11. Ltr to Omaha Public Power District from J. M. Taylor dtd 3/19/86 l

12. Ltr to Power Authority of the State of New York from S. A. Varga dtd 9/8/87

13. Ltr to Power Authority of l

the Stae of New York l from S. A. Varga dtd 10/21/87 DISTRIBUTION: w/ enclosures DISTRIBUTION w/o calclosures tCentral Files? il! DRIE R/F PDR RSIB R/F ' ~ " ~ ' ' ' ~ FJMiraglia HJFaulkner, IP RDHauber, IP BKGrines l' CJHaughney WDLanning JEKonklin EVImbro

c Y:. ) i APPENDIX D SAFETY SYSTEM FUNCTIONAL INSPECTION 1. INSPECTION OBJECTIVE 1 A. The objective of a Safety System Functional Inspection (SSFI) is to assess the operational readiness of selected safety systems by determining whether: 1. The systems are capable of performing the safety functions j required by their design bases. ] 2. Testing is adequate to demonstrate that the systems would 3 perform all of the safety function's required. i 3. System maintenance (with emphasis on pumps and valves) is adequate to ensure system operability under postulated ac-cident conditions. \\ 4. Operator and maintenance technician training is adequate to 1 ensure proper operations and maintenance of the system. 5. Human factors considerations relating to the selected sys-tems (e.g., accessibility and labelling of valves) and the supporting procedures for those systems are adequate to en-sure proper system operation under nomal and accident con-ditions. 6. Management controls including procedures are adequate to ensure that the safety systems will fulfill the safety functions required by their design bases. II. INSPECTION METHODOLOGY A. Review the design-basis requirements for the selected system (s) and detennine the operating conditions under which each active component will function during accident or abnomal conditions. This review should determine if the design basis is met by the installed, tested component and if the design basis is the correct one. 1. For valves: What permissive interlocks are involved? What differential pressures will exist when the valve strokes? Will the valve be repositioned during the course of the 1 event? What is the source of control / indication power? j 2515 D-1 Issue Date: 08/30/88 i _ __z______ j

y1 What control logic' is : involved?. W' hat manual actions are required to backup and restore.a degraded function?- 2. For pumps: What are the flow paths' the pump will eFperi-ence during accident scenarios? Do the flow paths change? What pemissive interlock / control logic apply? How is the pump controlled during accident conditions? What manual actions ' are ' required to back up and restore a, degraded function? What suction / discharge pressures can the pump be-expected to experience during accident conditions?.What is the motive power for the pump during all conditions? .3. For instrumentation and sensors: What plant parameters are used as inputs to the initiation and control systems? Is operator intervention required in certain scenarios? Are the range and accuracy of instrumentation adequate? What-is the extent of surveillance and/or calibration of such instrumentation? j B. Review the design of the selected system (s) as installed in the plant. l e 1. Determine if the as-built 6esign and installation matches.. j the current design / licensing basis requirements for that particular : facility. - For example, are fuses and' themal overloads properly sized; are current-de loads within the q capacity of the station batteries; and is the instruments-tion adequate in range and accessibility for operations to-control the system under normal and abnormal conditions? 1 2. Detemine if system modifications implemented since initial licensing have introduced any unreviewed safety questions. For example, have modified structures surrounding safety-related equipment, components, or structures been evaluated for seismic 2-over-1 considerations, and have modified equipment components falling under the scope cf 10.CFR 50.49 been thoroughly evaluated for'environroental. equipment qualification considerations such as temperature, radia-tion, humidity? 3. Evaluate the license'es drawing control program, the control and use of design input infomation, and the adequacy of design calculations from the perspective of modification made to the selected safety system. For R modifications to a safety system, verify that prior to the R modification (s) being declared operable, that the control. R led copy of all as-built documents used by the plant opera-R tors were either revised to incorporate all design changes, R g or have been legibly marked-up on an interim basis to show R all changes relating to the modification (s). Verify that R administrative controls and responsibilities have been R 1 clearly established for the following: R Issue Date: 08/30/88 D-2 2515 1 l L l

m Marking-~the as-built documen%s for the' design changes R a. on-an. interim basis. including document. review, R approval and safe guarding the marked documents and R related papers until the changes have been incorpora-R' ted on the revised documents. p b. -The program directs users of this as-built document to R use and refer to, the marked-up copy for the purpose R of testing, maintenance and future design change R activities, until the revised as-built document R incorporating all the marked-up changes is officially R issued. R i c. . Revision of documents incorporating all marked-up R changes, are issued and distributed in a timely R manner. R C. Review the maintenance and test records' for the selected system (s). 1. Detemine if the system components have been adequately tested to demonstrate, that they can perform their safety. 3 function under all conditions they might experience in an accident situation. Determination of adequate testing may require consideration of removing all actuator power, including.both electrical and pneumatic, for fail-safe valves' (see IE Information Notice No. 85-84, " Inadequate In-service Testing of Main Steam Isolation Yalves"). [' 2. Determine if the system components are. being adequately maintained to ensure their operability under all accident conditions. For example, are limit and torque switch set-tings proper; is the instrument air system. adequately maintained to ensure the reliability of pneumatic valves; are fuse and themal overload sizes correct; and 'are pipe supports,' seismic restraints and shielding being main-tained? 3. Determine the adequacy of the licensee's preventive main-tenance program for the system. As a part of this assessment, refer to the appropriate vendor technical manuals. j 4. Support system and plant modifications should be evaluated to the extent possible to ensure that system design capabi-lity as demonstrated by preoperational testing has not been ] compromised. For instance, the addition of a fire barrier in an ECCS pump room may compromise room cooling capabili-ties by altering air flow paths. ? D. Perform walkdown of selected systems. 1. Detemine if components are labeled and accessible. For example, can the components be operated locally / manually if required by the licensing basis, and is there HP/ security interference? 2515 D-3 Issue Date: 08/30/88 1L

~ .( t' 4 g 2. Determine if MOV operators and check valves (particularly~ lift-type) are installed in the orientation required by the manufacturer. Additionally, a human factors assessment of L' component orientation (such as-the direction of handwheel rotation for valves installed upside down) should be made. 3. Determine if system lineup is consistent with design /11cen-sing basis requirements.- This lineup inspection should include considerations of the nomal and backup power-supplies, control circuitry, indication and annunciation status, and sensing-lines for instrumentation. E. Review abnormal, emergency, and nomal operating procedures; maintenance procedures; and surveillance - procedures for the selected system (s). 1. ' Assess the technical adequacy of the procedures. L 2. Detemine if-the procedural steps will achieve required system-performance for nomal, abnomal, and emergency j conditions. This should include consideration of operator actions to compensate for shortcomings in design. l i 3. Detemine if operations and maintenance personnel receive l adequate training pertaining to the selected system (s) and if the degree of training provided is consistent.with the amount of technical detail included in procedures. .In particular, verify. that operators are trained on system j response, failure modes, and required actions involved in all credible scenarios in which the system is required to ) function. 4. Determine if surveillance test procedures comprehensively address required system responses. For example, does the tested lineup duplicate the accident response lineup; are check valves tested to provent reverse flow; and does the test establish any artificial initial conditions? I F. Review the operational experience of the selected system (s). This would include LERs, NPR05,10 CFR 50.72 reports, enforce-ment actions, nonconformance reports, and maintenance work requests. 1. Determine the historical reliability of the system and its components based on the review and analysis of the opera-tional experience. 2. Determine if the Itcensee has aggressively pursued, identified, and corrected root causes of failures. 3. Determine the extent of the maintenance backlog and ascer-tain if the licensee has a program to identify, prioritize and perfom timely safety-related maintenance activities. Is there a backlog of safety-related maintenance? i i j i Issue'Date: 08/30/88 D-4 2515 h

IM. INSPECT!ON GUIDANCE' A. Plant' Specific Probabilistic Risk Assessment should be reviewed .e as part of the' system. selection methodology, if available. Studies conducted by-AEOD also can provide useful. data for detemining which system to select. t. B. :Past experience with SSFIs has, demonstrated that identifying the.-detailed design-basis requirements for the selected safety systems can be.quite difficult and time consuming : for the inspection-team as well as for the licensee. The difficulty in-clearly identifying design-basis requirements at older plants is related to the fact that the infomation of ten has' never been assembled before and is typically scattered among the. records stored at the plant, at the licensee's corporate offices.'at the architect engineer.'s offices, and at the NSSS vendor's offices. Consequently, an effort should be made to provide the licensee with adequate _ advanced notice regarding the safety systems to be inspected to ' allow the licensee ~ time to begin collecting the -needed documentation. The inspector should compare the original FSAR system design description to that contained in the USAR as part of the e.ffort to identify detailed design-basis require-ments. C. The design' review portion of the inspection should be perfomed by ~ inspectors with extensive nuclear plant design experience. preferably comparable to the experience gained through previous employment with an architect engineering fim. It is important also.that the inspectors perfoming the design review have a ( good understanding of integrated plant operations, maintenance, testing, and quality assurance so that they are able to relate their findings to the other functional areas being inspected. D. When performing the review of maintenance and test records, it is essential for the inspector to focus on the technical details of how the activities were perfomed. For example, were the closing limit switches set with the motor-operated valve fully shut or four turns off the shut seat? The review of test records should go beyond a review of the in-service testing and surveillance programs for Technical Specifications. The inspec-tor should seek the answer to the fundamental question of whether or not the safety systems and all included components have been tested to demonstrate that they will perfom their intended safety functions as defined in the design-basis. When R i perfoming the review of maintenance and test records for the R modified system, the inspector should verify that for mainte-R nance and/or for testing purposes, in addition to latest R revised copies of the applicable documents, operations personnel R have referred to the marked-up copies of the control room R .j documents where applicable. This step is necessary because, R unless changes due to modifications are extensive, applicable R drawings are generally not revised but as an interim measure, a R controlled set of the control room documents are marked-up to R show the design changes. In such situations, an inspector R should verify that revision of the controlled documents incor-R porating the marked-up changes is performed in a timely manner R following the modification. The timeliness of document R , 2515 0-5 Issue Date: 08/30/88

m l (( r u,. ' revision 'should 'be consistent to' the safety. significance of' R the modified system. Effects of marked-up design changes should-R ~ not preclude the document being a " useable" reference document, P' i.e),without clutter which could cause difficulty in determin-R ing the actual installed configuration. 'R E. As part of the system walkdown, the inspector should analyze the adequacy of the. system lineup, accessibility, indications, relative to the most limiting design-basis conditions (e.g., degraded power and lighting,-single failure, loss of.non-safety-related indications, and harsh environments). F. As was the case for the review of maintenance and test records (discussed in III.C), it is essential for the inspector to focus on the technical ' details of - the operating, maintenance, and surveillance procedures reviewed.. The inspector should. verify that. the emergency and abnomal operating procedures are ade-quate to handle the most limiting design-basis events. Where.it is not reasonable for procedures to provide detailed guidance. the inspector should verify,that the licensee's' training program 3' ensures that the operators' are knowledgeable in the areas of ~ Concern. G. The effectiveness of the SSFI methodology.is greatly enhanced if the various inspection team members. are ' able to benefit from each other's inspection efforts. Accordingly, frequent, even { daily, team meetings are encouraged to allow the team members to share their findings. It has been the experience of the head-quarters-based SSFI effort that many of the more significant findings originate from team meeting discussions that allow ) related inspection findings in different functional areas to be pieced together. IV. . INSPECTION APPROACH A. Team Composition An inspector should be assigned to each of the following areas: electrical design. mechanical design, maintenance, surveillance and testing, operations, and training. The detailed system walkdown can be done by an additional inspector participating for only part of the onsite activities, or this aspect can be covered by the operations inspector. A full-time team leader without any-specific area assignments should have the primary responsibility to provide guidance and coordinate team activities. It 'is recomended that the team leader have several years of inspection experience. The senior resident inspector for the site being inspected should not be assigned as a participating team member; however, his/her involvement in the inspection process should be encouraged to the extent his/her resident duties will allow. Issue Date: 08/30/88 D-6 2515

b B. Schedule of Inspection Activities The following is a ' recommended schedule of inspection activi.. .) ties:- L Week 1. The merhanical and electrical inspectors start inspec-- tion of design activities focusing on recent design changes of.the selected safety system. These activi-ties should be conducted at the licensee's engineering ' 1 offices. 1 Week 2. .The inspection team starts their onsite activities. ' Week 3. No onsite or engineering office inspection activities are conducted. The licensee has: time to produce requested design information. The inspection team can. 'brief management and review the issues in-office. Week 4. Inspection team is back on-site. The ' exit meeting usually is held. Friday morning. A pre-exit meeting, e and rehearsal of inspector presentations is conducted late Thursday af ternoon with the participation of NRC management representatives. { At'least 2 weeks prior notification should be provided to the licensee before the inspection begins. The licensee should be told which safety system (s) will be inspected. At least I week of preparation time should be allowed for the. inspection team f - members before beginning their onsite activities, and the team should establish contact with licensee systems engineers when the team arrives on-site. C. Credit for Inspection Activities Inspection credit input should be made-to the 766 data base for the appropriate inspection procedures of IE MC 2515. Poten-tially appropriate inspection procedures include: ~ l 35701 - QA Program Annual Review-37700 - Design,' Design Changes and Modifications 37701 - Facility Modifications 37702 - Design Changes and Modifications Program 1 41701 - Licensed Operator Training 42700 - Plant Procedures 61700 - Surveillance Procedures and Records f 61725 - Surveillance Testing and Calibration Control Program 61726 - Monthly Surveillance Observations j 62702 - Maintenance Program j i 62703 - Monthly Maintenance Observations 62704 - Instrumentation Maintenance (Components and Systems) Observation of Work, Work Activities, and Review of Quality Records 62705 - Electrical Maintenance (Components and Systems) Observa-tion of Work, Work Activities, and Review of Ouality Records 71707 - Operational Safety Verification 71710 - ESF System Walk Down m..

. -;s.,# _,._ 3 J L. I -72701 - Modification Testing .~ 73051.- Inservice-Inspection - Peview of Program 73755,- Inservice Inspection - Data Review and Evaluation END l 1 I i ) i i t ) Issue Date: 08/30/88 D-8 2515 L___________________

,4 UNITED STATES

,) '.D.

't, NUCLEAR REGULATORY COMMISSION yi. i WASHINGTON, o. C. 20555 W /i b

l.. #

NRC INSPECTION MANUAL RSIs ~ INSPECTION PROCEDURE 93803 SAFETY SYSTEMS OUTAGE MODIFICATIONS INSPECTION PROGRAM APPLICABILITY: 2515, 2525 93803-01 INSPECTION OBJECTIVES i 01.01 To verify that the licensee has appropriate programmatic controls for accomplishing changes, modifications, and repairs. 01.02 To verify that the licensee is conducting activities related to design changes, modifications, and repairs in accordance with established proce-cures, commitments, and regulatory requirements. 01.03 To verify that completed modifications have been properly desianed, installed, inspected, and tested to ensure the adequate performance of the modified systems and components. 01.04 To determine that the design margins of,the modified safety-related systems and components have not been reduced. 01.05 To verify that the modified systems and components are ready for safe startup and operation of the plant. 93803-02 INSPECTION REQUIREMENTS The Safety Systems Outage Modifications Inspection (SSOMI) consists of a design inspection and an installation and testing inspection. 02.01 Advance Preparation. Each of the inspection teams should review the following applicable documents, before the start of the inspections. The teams should become familiar with the licensee's administrative programs for designing, installing, and testing modifications in addition to the compo-nents and systems for which modifications are planned. a. Final Safety Analysis Report (FSAR). b. TechnicalSpecifications(TS). c. Descriptions of the proposed modifications. d. Administrative documents used to implement modifications. Issue Date: 04/27/89 l }

e. Corporate and site engineering procedures. f. Licensee event reports for the past 2 years. l, g.. Past inspection reports. 'h. System descriptions.. 4 -02.02 Design Inspection. This part of the inspection should be performed by 'a ' design engineering team staffed with electrical and mechanical engineers who are familiar with: design. and analysis practice and techniques.- The -s -inspection should be conducted before the ' outage starts or soon after the start of a major outage, and should be done at the offices of the organiza-tion 'with principal engineering. responsibility for the modifications. The inspection-will verify the following for a sample of modifications selected during the advance preparation.for the SSOMI. ta. ' Regulatory requirements and design bases as specified in the FSAR and TS and as documented in NRC safety evaluations, have been correctly. reflected in the modifications. b. The licensee 'has adequately performed 10 CFR 50.59 safety evaluations for the modifications, as required.

c.

Design information 'is current and correct and ihe assumptions used in the design calculations are based on. sound engineering principles and practices.

1. d.

Design information has been properly incorporated into project docu-ments such as' specifications, drawings, procedures, and instructions used for the modifications. e. Design information is controlled and has been applied to the original design changes, including field changes. f. Field changes are properly recorded and evaluated. g. The licensee's engineering staff has sufficient technical guidance and experience to adequately perform the assigned engineering functions. h. The design verification process, such as alternate or independent calculation review or qualification testing, is performed correctly. 02.03 Installation Inspection. Sections 02.03 and 02.04 are performed by I multi-discipline teams with expertise in electrical and mechanical system ' { installation and testing requirements. The installation inspection should be conducted at the plant site at a time during the cutage when sufficient modification installation activities have been accomplished to warrant the inspection. i The inspection should verify the following for' a sample of modifications selected during the advance preparation phase of the SSONI. l a. The licensee has adequately performed 10 CFR 50.59 safety evaluations for the modifications, as required. . ) l l Issue Date: 04/27/89 93803 l

'.1

b..

The' installed modifications agree with design requir:ments-such - as ) those: pertaining to as-built dimensions, code requirements. ANSI -] g.- standards,. regulatory ~ guides, A/E specifications, welding and. NDE requirements, and seismic requirements. c. For the work packages selected, the proper maintenance procedures or work procedures were invoked and followed, QA/QC hold points were . properly accomplished 'and. verified, and all required forms were properly. completed, signed, and reviewed, a 1 d. -Required QA/QC audits and surveillance have been performed on the selected modifications, and the' audit and surveillance findings have been properly dispositioned. e. Work requests and maintenance orders are in agreement with the work - j originally authorized, and work requests, if revised, did not expand the scope of the work originally planned by the modification. f. Deficiency reports,. field change requests, engineering change notices, and similar documents recorded deviations' from original design requirements, and adequate engineering review was done before corree-j tive actions were accepted, g. QA' documentation for replacement items is in agreement with the material installed, and the material is properly environmentally 1 qualified (EQ) and agrees with design specifications. ) 'h. Maintenance or modifications on EQ components do not irvalidate the qualification. 1 1. All controlled documents (e.g., drawings, work procedures, site administration procedures, test procedures, TS, FSAR) affected by the modified component, system or structure have been revised or are i being revised. j l 02.04 Testing Inspection. The testir.g inspection should be conducted near the end of the outage at a time when a significant amount of post-modifica-tion testing is being performed. The inspection team should verify the 5 following for the systems modified: a. Modified systems and components were tested in accordance with ap-proved procedures, and the results were properly reviewed and approved j before startup testing occurred and the systems and components were placed into service. ] b. Performance of the modified systems and components conforms to j requirements and acceptance standards identified in licensee proce-j dures, and the operational margins of safety have not been compro-i mised. l c. Testing of individual modified components or subsystems takes into account the effects of the modifications on the operational' perfor-mance of the entire system and on affected interfacing systems. j d. Piping and instrumentation diagrams, critical drawings, including control room drawings, and operating procedures were revised to incorporate system changes before system operation. t 93803 Issue Date: 04/27/89 _____._____-___n_ __1______

l e. Operator training for significant operational changes occurred before. l. system startup, and operator training programs were revised in a reasonable time to reflect the design changes or modifications that were implemented. s f. As-built drawings were changed to reflect the current configurations, and this was accomplished not~only for the modified systems, but also for other systems, components or structures which were affected by the modification activities. g. Deficiencies were clearly identified, and appropriate corrective actions were implemented. I h. After corrective actions, or changes to the modifications, have been completed, tests were rerun as necessary to ensure that performance of the system is adequate. ii. Results of the evaluations are reviewed by appropriate licensee per-sonnel and/or contractor personnel, including the persons responsible for approving the original test procedures. j i 93803-03 INSPECTION GUIDANCE j 03.01 General Guidance i ,a. Team Composition. The design team normally is comprised of a team I leader and four to six engineers who are experts in the design areas 1 of electrical, instrumentation and control, machanical systems, and mechanical components. The installation and testing team normally consists of a team leader for each of the mechanical and electrical disciplines, with, typically, two or three additional inspectors per discipline area. The installation inspectors should be knowledgeable in construction or modification and maintenance activities, and the testing inspectors should be knowledgeable in component and system testing. Team compositions should be changed as necessary to meet changing inspection requirements or priorities for specific plants or specific outages. For example, one or more procurement specialists may be added to either the design team or the installation and testing team for a broader or more detailed inspection in that area. In addition, for major outages, separate teams may be warranted for installation activities and for testing activities. b. Inspection Scheduling. The design inspection and the installation and testing inspection are each normally four weeks long. The first week is typically devoted to in-office preparation, then two weeh are normally spent inspecting, with an interim week devoted to in-office review. If extensive or unusual findings are identified during the ~onsite inspection, team leaders should consider lengthening the onsite inspection period as necessary to complete the required inspections. Some other factors to consider when extending the inspection period include the complexity of the modifications to be reviewed, the length of the plant outage, travel time needed to get to the site, and the scope of the review. Following completion of the inspection activi- ) ties, report inputs should be provided by each inspector on a schedule determined by the team leader and NRC management. Issue Date: 04/27/89 93803

l ] 03.02 Sp;cific Guidance a. Inspection Requirement 02.01. Advance preparation should be performed by the design team and the installation and test team. The teams ~ should review the licensee's applicable administrative, corporate and i site engineering procedures in detail during this period so that they l thoroughly familiar with the utility's program for performing are i modifications. In addition, individual inspectors should become 1 familiar with the systems being modified so that they can understand the impact of the modifications. Before each team's advance review period, the team leader and selected team members should make a " bagman" trip to the utility to find and bring back the material needed during the advance preparation. The teams should also be familiar with other applicable documents such as the FSAR, Technical a Specifications, LERS, and NRC inspection reports. 1 b. Inspection Requirement 02.02. The design team inspectors will typically spend most of their time at the engineering offices where the organization responsible for the design of the modifications is located. Sharing of design findings and concerns with the installa-j, tion and test team is particularly important for the successful completion of the SSOMI. If practical, the installation and test team leader and discipline leaders should attend the design team preexit and exit meetings to become more familiar with the design i team findings and concerns. c. Inspection Requirement 02.02a. The inspector should verify that sys-tem information is consistent between the Technical Specifications, the FSAR, design documents, and other licensee technical manuals. d. Inspection Requirement 02.02d. Design documents and information should be numbered and categorized for future use and reference. Most 1,1censees with good design engineering department practices will have all of the design documents numbered so that future modifications can 1 be referenced to preexisting and accurate design information on the system rather than having to reser.rch existing design documents such as the TS and FSAR to resurrect good information whenever a system is modified. i e. Inssection Requirement 02.02e. All design calculations should have tec1nical independent reviews performed to ensure that design calcu-1ations are free from errors and that the assumptions made and the engineering approach taken are both conservative and reasonable. f. Inspection Requirement 02.03a. Proper safety evaluations should con-sist of more than a checklist and should state why the modification l does not need a safety evaluation, if so noted. Additionally, the inspector should review for potential unreviewed safety questions, f' g. Inspection Rec uirement 02.03c. All work performed for the modifi-l cations shoulc be with approved procedures which have been through the appropriate site approval process. If work has been completed with ? the use of a locally generated procedure, the assumptions made in the safety analysis may be incorrect and the licensee should perform a technical evaluation of the work performed to determine system operability. 1 93803 Issue Date: 04/27/89 L_________.

i i i i h.- Inspection Requirement 02.04. A. combined installation and test team may not have the opportunity to witness modification testing during a i SSOMI of. a short duration outage. Therefore, the team may have to 1 rely on reviews of test procedures, evaluation of completed test results and limited observation of testing. { l i. Inspection Requirement 02.04a. Test results should be compared with 'i the FSAR values (if values are specified in the FSAR) and the licen- . I see's In-Service Testing reference values in order to determine the effect of the new test results on the ASME Section XI requirements. s J. Inspection Requirement 02.04c. The site review and approval process for functional test procedures that have been written for specific modifications should be evaluated for adequacy and completeness. END 8 0 I I i 4 1 I ~) Issue Date: 04/27/89 93803 l j

s. =., 1 DET INSPECTION PROCEDURE 93802 l OPERATIONAL SAFETY TEAM INSPECTION..(OSTI) PROGRAM APPLICABILITY: 2515 93802-01 INSPECTION OBJECTIVES i 01.01 Verify that the~ plant is being operated safely and in confomance with regulatory requirements. 01.02 Verify that the organizations that control and support. plant operations are functioning effectively to ensure operational safety. These entities include operations, maintenance, surveillance, management oversight - . technical support, safety review, quality assurance, and corrective action. 01.03 Verify ~that the licensee has properly prepared the staff and the plant for resumed power operations after an extended shutdown. 93802-02 INSPECTION REQUIREMENTS 02.01 Inspection Planning. This inspection will emphasize the effectiveness of the licensee's activities to ensure the safe operation of the plant and of' other areas in the plant organization.in supporting operations. The focus of the inspection should not be on programs but should be directed at the licensee's, performance and whether the interfaces between operations and the - other areas are controlled and conducted in a manner that achieves plant-safety., In-general. the identification of-programmatic deficiencies should' be a by-product of the examination of the licensee's safety significant performance problems, including the evaluation of test data and any excep- ~ tions taken to test acceptance criteria. The OSTI will typically consist of a two-week on-site inspection conducted by a team of approximately seven inspectors and a team leader. Three team i l members will be assigned to the operations area and will go.on shift to moni-tor control room and related activities for approximately 72 continuous hours. When selecting team members, nuclear power plant operating experience should be a primary consideration, especially in the operations area. Since the inspection is directed at safe perfomance and not simply - compliance, direct observations of licensee activities are emphasized and are supplemented by personnel interviews and document reviews (e.g., completed maintenancerecords,surveillancetests,andaudits). l E Issue Date: XX/XX/XX

o DRAFI J 02.02 Conduct of.the Inspection. ~ A team member will be assigned the lead

l

responsibility-for the inspection _ in each of the areas listed below..The'-

i

-inspection procedures listed in Section 93802-03, " Inspection Guidance" may- -be used for additional.~. inspection guidance. Depending on. the particular .,-brt. inspected, the team may not be able to thoroughly complete each of the inspection. tasks described below. Team leaders must exercise discretion to guide;the individual inspectors toward topics of emphasis in each functional area. a. Operations Observe the conduct of operations personnel both' inside and outside the control room for approximately. 72 continuous hours. Based on these observations, make determinations as.to the quality of operator-professionalism, attentiveness, awareness of plant status', communications, conduct of plant evolutions, response to alarms' and other abnormal. indications, adequacy of

training, and overall planning and control of plant and shift activities.

Assess the effectiveness of shift turnovers by observing as many different turnovers as possible. Assure that adequate time is allotted for the conduct of turnovers. Make determinations as to the utility and availability)' of _ control room documentation, (e.g. shift logs, night orders, etc. In observing routine activities inside ' the control room, evaluate. access control and traffic in the control room. Determine whether operators collateral duties (i.e., filling out tag-outs', and interfac-ing with maintenance and surveillance test perfomers) impacts on their ability to operate the plant safely. Accompany an auxiliary operator during the conduct of routine rounds or otherwise tour the plant at least once per shift. During these tours, assess the ability of operators to observe areas secured due to' radiation levels or security ' plan requirements. Assess the adequacy of housekeeping, radiological controls, lighting, component / equipment labeling, and vital area access controls. Walk down portions of selected safety systems. Confirm that valve and breaker positions conform to procedure requirements and that positions required by procedure.are consistent with those on control-led plant drawings. Review jumper, lifted lead, or other similar temporary modification 1 logs. Detemine if an adequate technical review was performed prior to installation of the modification in the plant. Determine if plant drawings are updated, as needed, to reflect the changes before the operators must operate the plant as changed. Select one or more safety system tagouts for inspection. Determine if the tagout is adequate for the work to be accomplished using it. Detemine if the tags are properly hung and equipment has been placed in the designated position. Determine if equipment status changes and corresponding entry into or exit from technical specification action statements are appropriately documented. Determine if the Issue Date: XX/XX/XX 93802 i

licensee has adsquate controls to assure the independent verification of equipment status, particularly when equipment is returned to service. Determine the-availability and currency of normal and abnomal operating procedures in the control room. Observe the extent to which operations personnel appropriately refer to plant procedures during the conduct of plant evolutions. b. Maintenance Observe licensee personnel performing corrective and preventive maintenance in order to verify that maintenance is planned, control-led, and performed in a manner that enhances safe operation of the plant. Verify that the maintenance is performed in accordance with current written and approved instructions, which are detailed enough to perform the intended maintenance and adequately document the maintenance performed. Also, review a sample of completed work packages and verify that they demonstrate these same attributes. Verify that maintenance jobs that could effect technical specification limiting conditions for operation, safety-related equipment perform-ance, or otherwise influence the safe operation of the plant are appropriately prioritized and dispositioned in a timely manner. j Review the maintenance training program and selected craftperson's i training records to verify that training is adequate and appropriate for the level of work being performed by that individual. Determine the nature and extent of the licensee's backlog of corrective and preventive maintenance, especially concerning equipment of high safety significance. Deterrnine if any efforts are underway to reduce the backlog if it is excessive. Determine if engineering input into maintenance activities is at an i appropriate level to ensure safe and reliable plant operations. Determine whether quality control inspections are being conducted during the performance of maintenance. Determine if specific guidance exists with regard to designation of QC hold points and that the guidance is being effectively applied. Determine if appropriate post-maintenance testing is being specified following the conduct of maintenance activities. Observe activities and review documents related to the licensee's j control of meter and test equipment. Verify that calibrations are I being performed at the required frequencies and that the program includes a tracking system so that when measuring and test equipment are found to be out-of-calibration, an evaluation is made and docu-mented of the validity of previous inspection or test results and of the acceptability of items previously inspected or tested. c. Surveillance Observe a number of surveillance tests being performed by license

• personnel and verify that:

DRAFI 93802 Issue Date: XX/XX/XX

_7__ (a) Required administrative approvals were obtained prior to commencement of testing and when appropriate, entry into technical specification action statements is documented.

4) Testing is being accomplished by qualified personnel in 1

accordance with current and approved procedures that are j adequate to meet technical specification requirements. l (c) Test instrumentation is calibrated and properly used. 1 (d) Procedures are adequate to satisfy the test requirements of the technical specification surveillance. (e) Test results meet technicel specification acceptance criteria. (f) Test discrepancies or problems are documented and properly j resolved in a timely manner. (g) Surveillance testing is completed within the required tech-nical specification frequency. Review a sample of completed surveillance tests. Determine if the I test procedures used are of the correct revision and are technically accurate, and when performed by qualified personnel adequately test t the designated equipment. Determine if the acceptance criteria are clearly specified and shown to have been met in the tests reviewed. Where discrepancies are noted, detennine if 'they have been adequately evaluated and if any required corrective actions have been initiated. d. Engineering and Technical Support By interviewing personnel and reviewing documents related to equipment i performance problems, evaluate the effectiveness of the technical staff in supporting safe operation of the plant. Verify that the work backlog is manageable and that items that could impact safety are given a high priority and are addressed in a timely manner. i Verify that appropriate engineering guidance is requested and obtained to resolve technical problems. e. Management Oversight I { Interview licensee management personnel and observe activities concerning safety significant equipnient (i.e., plan-of-day meeting, outage planning meeting, etc.) to evaluate management involvement and effectiveness in plant activities, attitude toward operational safety, ALARA, response to events, identification and documentation of signi-ficant deficiencies, and corrective actions. Interview personnel at all levels on the plant staff to evaluate communications effective-ness. Do workers understand management directives, policies, and goals and does management have a good perception of what is going on in the plant? EWT _ Issue Date: XX/XX/XX 93802 f

~ Evaluate manag: ment's concern for keeping the plant on the line against it's concern for safe operation of the plant by assessing, for example, the thoroughness of management reviews conducted prior to plant restart (i.e. Post Trip and Event reviews) or root cause analyses of equipment failures and corrective actions. Review and discuss with licensee personnel the effectiveness of any current licensee initiated programs (e.g., procedures upgrade). .f. Safety Review Attend on-site and off-site safety review committee meetings and evaluate member participation, preparation, the approval process l (e.g., review adequacy, availability of technical experts to answer j questions,etc.). Evaluate whether the overall conduct of the comit-tees appropriately supports and enhances the safe operation of the plant. Verify that technical specification requirements for document reviews are being followed. g. Corrective Action p Using safety significant equipment which has had problems as the focus, review the licensee's program for identifying, documenting, and correcting problems. Determine if deficiencies are prioritized based on safety significance and if deficiencies that could impact on plant safety are corrected in a timely manner. Verify that deficiencies are reported to the appropriate level of j plant management and, if required, the NRC. Evaluate the effectiveness of the licensee's corrective action programs in supporting operational safety by interviewing personnel, observing activities, and reviewing procedures, deficiency reports, licensee event reports, and audit reports, especially those associated with equipment or plant problems. Determine if corrective action is structured to emphasize safety as ~ well as compliance. Verify that corrective action bounds the effects of any identified deficiency on operational safety. Verify that the licensee has an effective program for documenting and correcting identified deficiencies. The program should include a mechanism for raising significant deficiencies to an appropriate level of management control, f Verify that deficiencies are appropriately evaluated for deportability to NRC. Verify that the licensee's program for review and disposition of NRC Bulletins, Information Notices, and Generic Letters addresses all q safety aspects of these documents. j 1 DRH 93802 Issue Date: XX/XX/XX J

Verify. that' an effective root causeidetermination is made for all safety significant deficiencies.. l v ' Ft'After Prolonoed Outa'ge. Prior to ' plant startup from an Dm o exten W outage, the inspection should ensure the licensee has ' properly - q prepared the plant and staff for operations. This inspection supplements those 'found necessary to. assure satisfactory accomplishment of.the approved objectives of the licensee's' restart plan. The inspection should concentrate-on the plant operations and. assurance of quality areas. Other suggested inspection points include the following additional areas: a. Focus the ' inspection on activities with the greatest impact on safety such as reactor startup, heatup/cooldown, refueling,. and surveil-lances.. Direct observations are preferred and should be supplemented l by personnel interviews and document reviews. Systems should be. selected for inspection based upon their potential to cause a:signifi-cant' number of safety challenges. Also, the results of probabilistic-risk assessment studies should be used, if available. b. Evaluate licensee management attention to transitional controls. Cutage deficiency " punch" list items converted to maintenance work order items still represent incomplete work. Evaluate management j oversight and controls in daily work and preparation. activities. j Review licensee perfomance in conducting preventive ma.intenance activities on schedule and in exercising appropriate control over j deferred preventive maintenance. { c. Review the licensee's operating experience feedback program for an .j administrative control program that continually addresses lessons J learned and that establishes the safety significance of problems that have developed in the startup of similarly designed plants. Evaluata whether procedural. problems are being effectively identified and expeditiously corrected.. d. Evaluate the licensee's self-assessment capability as it relates to i the readiness for operation and evaluate the effectiveness of the d root cause analysis process and generic applicability review of self-identified problems, and the effectiveness of the corrective ~~ action program, e.. Determine whether operator training, including simulator usage, includes beginning-of-life core characteristics and system response. Through the conduct of operator interviews, control room observations, and review of alarm response procedures, establish whether shift personnel are prepared to properly respond to abnormal plant condi-tions,- I&C setpoint and display anomalies, and the potential for a high number of challenges to safety systems during testing. f. Evaluate differences in the QA organizational interfaces with other j station departments under operational versus outage controls. Noncon-formance reporting may trend downward but the station's operations problem reporting system will contain similar information requiring QA trending and review. Similarly, look for the adequacy of planning to complement startup testir.g activities under technical specification Issue Date: XX/XX/XX 93802

constraints, as opposed to the latitude for " troubleshooting" problems which exists under outage testing controls. Verify QA/QC presence - during back shifts. g. Determine whether the licensee has implemented an effective Technical Specification Appraisal processes and whether human factors improve-ments (e.g., color coding) for the ease of operations and maintenance are being continually assessed and implemented in a timely manner. Verify that plant procedures accurately reflect the correct technical specification section. h. Assess whether the licensee has an effective program to review and focus attention on balance-of-plant (BOP) operations tu reduce the I frequency of plant transients. 1. Evaluate the adequacy of licensee plans to deal with material and personnel access and work control problems when the radiologically controlled areas (RCA) and protected / vital areas are re-established. j. Evaluate the status of control room annunciators, alarms, and recorders. Verify the acceptability of the licensee's methodology for compensatory measures for those indications not operating properly. k. Evaluate the licensee's program to review and evaluate the impact of the maintenance work request backlog, including its collective impact on safety system availability. 1. Review some modifications to determine if 10CFR50.59 reviews were properly conducted and were appropriate (i.e., should a technical specification change have been initiated in conjunction with the 50.59 review? Was the evaluation adequate to determine whether the modification involved an unreviewed safety question?), m. With respect to completed modifications, review the conduct and adequacy of any additionally required operator training, the need for updating operating and emergency procedures, the adequacy of post-modification testing, and the proper control of affected drawing revisions to include the issuance of updated drawings to all control-led drawing areas (control room, technical support center, emergency operations facility, etc.) prior to making the modification opera-tional. n. Examine licensee adherence to commitments make in response to NRC Orders, Bulletins, Notice of Violations, etc. o. Inspect a sample of QA/QC records covering the conduct of outage activities to verify that the licensee has established the correct level of independent quality overview of the work and the specifica-tion of and compliance with meaningful inspection hold points, p. Review the scope of the licensee's restart plan to ensure comprehensive coverage of staffing and training requirements, system valve lineups, equipment operability, surveillance requirements, mode change checklists, and control of incomplete plant work. Special emphasis should be placed on the inspection of the completion of corrective actions for the causes of the extended outage. 93802 Issue Date: XX/XX/XX

q. Detemine whether senior management has been closely involved in the restart ' effort - whether management is effective in directing restart' activities for around-the-clock activities, and whether technical and other support staff coverage is available at all times. Where signi-ficant managenent turnover has occurred, verify that adequate training -was implemented. r. Evaluate the restart processes for problem identification and resolution, decision-making and established authority, and corrective action followup. Determine if these processes differ from those in practice during routine operations and whether quality goals _ are being achieved.- -The inspection of a startup after a prolonged outage should include 24-hour coverage of shift operations _ for at least a portion of the readiness review period. The perfomance of_ different operating crews and other station staff should.be monitored for effective communications, adequate support, and correct _ control of and response to major operational evolutions. Discussions with operations, maintenance, radiation control, technical support and other plant personnel should be conducted on backshifts and the cognizance. and effective control of backshift activities by plant management should be confimed. 93802-03 INSPECTION GUIDANCE 03.01 General Guidance Previous NRC~ evaluations disclosed that a team inspection focused on operational. safety can be of definitive value in detemining operational safety at a-plant and especially in identifying the root causes of any. operational problems disclosed. Teams have been found to be more effective than individual inspectors because operational problems contain implications for many functional groups including operations, maintenance, surveillance testing, management, technical support, safety review, quality assurance, and all groups responsible for participating in the completion of. required corrective actions. In general, the identification of programmatic deficiencies in the preventive '~ maintenance program should be a byproduct of the examination of the licen-see's safety significant performance problems, including the evaluation of test data and any exceptions taken to test acceptance criteria. 03.02 Specific Guidance q Detailed inspection guidance for each applicable functional area is provided in the following inspection procedures: NOTE: Appropriate sections of the inspection procedures are to be used as additional. guidance in perfoming the inspection. Inspection Procedure 42700, " Plant Procedures" should be used as guidance in assessing the adequacy and appropriate use of procedures in each of the areas. I 1 ' Issue Date: XX/XX/XX 93802 i -__m-

a. ' Inspection Requirement 02.02.a.. Operations 1. 71707 Operational Safety Verification 2. 71710 Engineered Safety Features System Walkdown 3. 71715 Sustained Control Room and Plant Observation j b. Inspection Requirement 02.02.b, Maintenance 1. 62702 Maintenance Program 2. 62703 Monthly Maintenance Observation 4 3. 62704 InstrumentationSystems(ComponentsandSystems) 4. 62705 Electrical Maintenance (Components and Systems) c. Inspection Requirement 02.02.c. Surveillance 1. 61700 Surveillance Procedures and Records 2. 61725 Surveillance Testing and Calibration Control Program 3. 61726 Monthly Surveillance Observation j 4. 73753 Inservice Inspection i d. Inspection Requirement 02.02.e, Management Oversight i 1. 36100 10 CFR Part 21 Inspection 2. 37700 Design. Design Changes, and Modifications 3. 10 CFR 50.59 Part 9800 CFR Discussions, Changes to facilities, Procedures and Tests (or Experiments) e. Inspection Requirement 02.02.f. Safety Review 1 1. 40500 Evaluation of Licensee Self-Assessment Capability f. Inspection Requirement 02.02.g, Corrective' Action 1. 35701 QA Program Annual Review 2. 40702 Audit Program 3. 92720 Corrective Action g. Inspection Requirement 02.03. Restart Following Prolonged Shutdown-Previous NRC evaluations and AE0D studies have shown that effective management attention to the transition from a long outage to opera-tions and the feedback of operating experience from other plants can significantly enhance the restart process and subsequent perform-This inspection will emphasize management oversight, corrective ance. action programs, root cause analysis, and the readiness to support operations. Also, programmatic problems and improved corrective action processes during periods of lengthy shutdowns or outages have benefited from an improved internal self-assessment capability. Effective station goals and actions which result from such self-assessment demonstrate an attitude of the readiness of the plant and its personnel for the resumption of safe operation. There is an absolute need for the establishment of an appropriate operating attitude well before plant restart. Programs that control outage activities should be phased out or merged with operational control programs in order to minimize the confusion associated with duplicate systems of controlling work. This is also true for DRAFT 93802 Issue Date: XX/XX/XX

DRAFI ~ ~ . Operational controls ] procedural use and personnel work assignments. should be. implemented as early as possible to allow for personnel q acclimation and training. ) I f t h also important that such operational controls, particularly in the areas of maintenance and modifications, be consistent with both the original bases of the. plant design, and the good work practices used during plant construction. All plants need to use design basis documents in order to ensure that all procedures affected by plant modifications have been correctly revised. 93804-04 INSPECTION RESOURCES Each inspection is planned for four weeks for seven to nine persons with two of the four weeks being onsite inspection ( 14 to 18 staff weeks) and two weeks in-office inspection, with expected additional effort by the team leader (a total of 30 to 38 staff weeks). This total includes preparation, i inspection, and report writing. I l DRR Issue Date: XX/XX/XX 93802 j

.t!! .;i [A [ eft Efe.A UNITED STATES h4 {;g NUCLEAR REGULATORY COMMISSION 1 f5 j; WASHINGTON, D. C. 20555 l [ f _p February 1, 1989 1 i ' Docket-No. 50-220 1 - Mr. Lawrence Furkhardt III Executive Vice President-Nuclear Operations 1 ~ Niagara Mohawk Power Corporation i 301 Planifield Road Syracuse, New York 13212 j i

Dear Mr. Burkhardt:

1 I l L

SUBJECT:

SAFETY SYSTEM FUFC* # 4L INSPECTION (50-220/88-201) I.i This letter forwards the report on the safety system functional inspection perfomed b 12, 1988 through 'l October 7, y an NRC team during the period from September 1988, involving' activities au'thorized by Operating License DPR-63 for Nine Mile Point Unit 1. The inspection was conducted by members of the Office of Nuclear Reactor Regulation, the Region I Office and NRC contractors. At the conclusion of the inspection, we discussed the findinos with you and the members'of your staff identified in Appendix A of the enclosed inspection f. report,.. The NRC effort involved an assessment of'the operational readiness and' functionality of the high' pressure coolant injection ' mode of the feedwater (HPCI/FW) system and the. core spray system. Particular attention'was directed to the details of modifications and design control, maintenance, operation, and testing of.the applicable systems. Additionally, the programs for assuring quality in these areas were reviewed to detemine their effectiveness. The inspection team concluded that design infomation for both the core spray and HPCI/FW systems was not adequately controlled or supported by sufficiently detailed analyses. As a result, significant concerns were identified with your Technical Specifications, Emergency Operating Procedures, surveillance i testing and design of these two systems. Collectively, these concerns prevented the team from determining whether the core spray and HPCI/FW systems would func-tion as stated in licensing documents. Additionally, it did not appear that you were adequately evaluating reportable events and available industry information. As a result of these findings, a letter sumarizing the ma.ior areas of concern from the inspection was sent to you on October 26, 1988.. At an inspection follow-up meeting held at our headquarters office on November 17, 1988, you provided your preliminary plans for addressing the issues identified in our October 26, 1988 letter. In addition, you provided calculations and written responses / commitments for these issues in your letters dated December 8 and December 16, 1988. Subsequently, your planned corrective actions for each of these was incorporated into the Nine Mile Point 1 Restart Action Plan submitted to the NRC on December 22, 1988. Two documents are enclosed with this letter: tl e executive sumary which provides an overview of the inspection team's findings in each area reviewed ,,. _ n n o m f lLL O 2 f' ) ww 4

_ _ _ _ ~ ~ O O

• s Mr. Lawrence Burkhardt III 2-and the inspection report which provides a more detailed explanation of the team's findings. The report includes unresolved findings that are currently under review for potential enforcement action. These unresolved items are listed in Appendix C to the enclosed inspection report and may be the subject of separate correspondence from the NRC Region I Office.

The enclosed inspection report and unresolved items list reflects the results of our ongoing review of the additional infomation that you provided to date. The inspection report includes two unresolved items that were not included in our October 26, 1988 letter. These issues concern design documentation deficiencies (50-220/88-201-0A1 and the adecuacy of operating aids and procedures (50-220/88-201-06). You are requested to respond to the unresolved items within 30 days from the date of this report. For the unresolved items that were responded to in your earlier correspondence, for which no updates or changes are necessary, you may reference your previous responses. In accordance with 10 CFR 2.790(a) a copy of this letter and the enclosure will be placed in the NRC Public Document Room. Should you have any questions concerning this inspection, we would be pleased to discuss them with you. ~ Sincerely, (lY Gus C. Lainas, Acting Director Division of Reactor Projects I/II Office of Nulcear Reactor Regulation

Enclosures:

1. Executive Summary 2. Inspection Report 50-220/88-201 l cc: See next page O

.E a Mr... Lawrence Burkhardt III ' ' cc:- L Mr. Troy B.. Conner, Jr., Esquire Mr. Kim A.' Dahlberg -Conner & Wetterhahn Unit.1 Station Superintendent Suite 1050 .Nine Mile Point Nuclear Station- .1747. Pennsylvania. Avenue, N.W. P.O. Box 32 . Washington, D.C. 20006 Lycoming, New York 13093. Mr.--Frank R. Church, Supervisor. Mr. Petter.E. Francisco, Licensing' Town.of Scriba Niagra Mohawk Power Corporation. R.D. #2. 301 Plainfield Road Syracuse, New York 13212 . Oswego, New York 13126 Mr.. James L. Willis Charlie Donaldson, Esquire General Supt.-Nuclear Generation Assistant. Attorney General Niagra_ Mohawk Power Corporation New York Department of Law 'P.O.. Box 32 120 Broadway Lycoming, New York 13093 New York, New' York 10271 - ResidentInspector Mr. Paul '. Eddy ~ D i U.S.. Nuclear Regulatory Comission New York State Public Service-P.O. Box 126 Commission Lycoming, New York 13093 9th Floor 3 Emprie State Plaza . Mr. Gary D. Wilson, Esquire Albany, New: York 12223 'Niagra Mohawk Power Corporatio. n Ms. Donna *Ross 300 Erie Boulevard West-Syracuse, New York 13202 New York State Energy Office-2 Empire State Plaza Regional Administrator, Region I 16th Floor U.S. Nuclear Regulatory Comission Albany, New York 12223 475 Allendale Road . King of Prussia, Pennsylvania 19406 Institute of Nuclear Power Operations 1100 Circle 75 Parkway Suite 1500~ Atlanta, Georgia 30339 I i l

j a EXECUTIVE SUM 4ARY INSPECTION REPORT 50-220/88-201 NINE MILE POINT UNIT 1 A team of NRC inspectors and contractor personnel conducted a Safety System Functional Inspection (SSFI) at Nine Mile Point Unit 1, to assess the opera-tional readiness of the core spray system and the high pressure coolant E injection mode of the feedwater (HPCI/FW) systam. The' assessment was accomplished by a thorough review of the design, 'ntintenance, operations, ~ quality assurance and testing of the systems. The following paragraphs sumarize the significant-findings and conclusions made by the inspection team: 3 The inspection team could not 'etermine whether the core spray system d 1.- would function as stated in the licensing documents for the.following reasons: a7 The Technical Specification limiting condition for operation (LCO) which allowed continued plant operations for up to seven days with an inoperable core spray loop appeared to be an unanalyzed condition. b. Analysis showing that adequate net positive suction head (NPSH) existed.for the core spray pumps did not accurately reflect conditions I that could be expected during.a large-break loss-of-coolant accident (LOCA) with containment sprays in operation. c. Pump vortexing analysis did not account for the interactive effects of the two pump suctions which are in close proximity to each other. Calculations perfonned after the onsite inspec-tion indicated that pump vortexing would not be a problem, d. System resistance curves did not account for all the components in the system. e. System pump curves did not appear to be controlled o. validated by testing over the full range of expected flows. f. Potential flow diversion from the reactor through the combined pump discharge relief valve was not considered in any safety , analyses. g. The system alarm setpoints and procedural responses appeared inappropriate for the core spray pump low suction and discharge pressure alarms, strainer high differential pressure alarm and core spray pump high discharge pressure alarm. f / ES-1

, sN 3 il i ~h. Emergency Operating Procedures (EOPs) did not appear to provide 1 adequate guidance for core spray system operations in accident ) conditions. 1.- The design of_the core spray keep fill. system did not' appear to completely fill the piping down stream of the topping pumps. As a result, the core spray system appeared susceptible to water hammer problems during large-break LOCA situations. j. The range of control roont flow instrumentation for the core spray system was not adequate to measure the full range of a expected system flows. 2. The inspection team could not determine whether the HPCI/FW system would function as stated in the licensing documents for the following reasons: a. Independent calculations performed by the team indicated that 'the condensate and booster pumps would not provide the flow specified in the Technical-Specification Bases-at a reactor epressure of 450 psig. j b. No' analysis was available to show that necessary water levels in the condensate storage tank could be adequately transferred 1 to the hotwell without vacuum to support HPCI/FW pump flows. Calculations performed after the onsite inspection indicated I ~ -that adequate flow would be achieved from the condensate [ storage tank to th'e hotwell to support HPCI/FW system, operation. c. The pump curves used for HPCI/FW testing appeared to be uncontrolled, and applied only to the motor-driven feedwater pumps (excluding the booster and condensate pumps)'. d. The motor-driven feedwater pumps were not designed to support the frequent starting that may be required by HPCI/FW system reactor water level' control modifications and operating procedures. -3. The electrical system design appeared adequate to support core spray and HPCI/FW systems operations. The licensee had previously initiated actions to reconstitute the electrical system design bases. l 4. The inspection team made the following observations about licensee j programs: a. Examples were found where Surveillance Test Program data collection, results review, and acceptance value determination would not ade-quately support system operability decisions. This weakness appeared to be a direct result of poorly defined system design requirements. b. Internal responses to industry information such as NRC Information 1 Notices, GE Service Information Letters and INPO infonnation did not always appear to be timely or sufficiently researched. Investigation into problems and assessment of deportability in c. accordance with 10 CFR 50.72 and 10 CFR 50.73 did not always 3 appear to be adequate. ES-2 g 1 i

1,! 'd. 'The' written periodic maintenance program did not include all recmunended maintenance activities of the equipment vendor manuals or. the actual periodic maintenance being performed on safety systoms during'the outage. A maintenance self assessment conducted by the licensee appeared to be a thorough review of the maintenance program i and identified areas for improvement. Motor-0perated valve testing appeared to be a strength, e. .The QA Audit Program concentrated on programmatic issues and would i not necessarily be able to identify significant technical issues t with safety system operation, testing, design or maintenance. The j QA Surveillance Program appeared to be more technically oriented and identified significant issues for resolution before restart. l f. System operating procedures had several deficiencies indicating. a lack of attention to detail. However, operators demonstrated i an excellent level of knowledge about the plant and system opera-l ting characteristics during system walkdowns and procedure walkthroughs. The capabilities of the site specific simulator also dappeared to be a strength. 1 ,t i I -1 4 ES-3

[. U.S. NUCLEAR REGULATORY-COMMISSION 0FFICE OF NUCLEAR REACTOR REGULATION Division of Reactor Inspection and Safeguards Report No.: 50-220/88-201 Docket No.: 50-220 License No. Niagara Mohawk Power Corporation 301 Plainfield Road. Syracuse, New York 13212 Facility Name: -Nine Mile Point 1 1 InspectionAt: Oswego, New York Inspection Conducted: Septemb'er 12 - October 7, 1988 Inspector : V[ dV M/ 7 ~ J. E. Dyet. Section Chief, NRR Date thb' // T b H. I. Grkgg, Sr. Reactor Engineer, RI Date n Y& Y/%fWS i i J.LA1 Isom actor Engineer, NRR Date . k. b R blM _ ll/3l89 Dati V..M.McCree,OqrationsEngineer,NRR Consultants:

• G. Morris, Westec Inc-
• D. Prevatte, Powerdyne, Inc.
• D. Waters, Prisuta-Beckman Associates
• J. Wilcox, Prompt Professional Services, Inc.

j Accompanying Personnel:

• C. Haughney, NRR; L. Norrholm, NRR; *R. Capra, NRR;
• J. Johnson, RI; *M. Haughey, NRR; *R. Benedict, NRR;
• W. Cook, SRI; *W. Schmidt, RI; R. Temps, RI;
• B. Clayton, OED0; *D. Johnson, INPO

[ /87 ///3/I'/ Approved by:[LC. J. Haughns /, Chief. RSIB, NRRDate cAttended Exit Meeting on October 7, 1988 l / /$$$ a

.w. +. f

(

~ ' Scope:- 'A special, announced inspection was performed of the operational readiness and -functionality'of the core spray system and the high pressure coolant injection mode of the feedwater (HPCI/FW) system at Nine Mile Point Unit 1 (NMP-1). The licensee's programs were reviewed in the following functional areas as'they applied to the selected systems: Mechanical and Electrical Design Maintenance Surveillance and In-Service Testing Design Change Control Operations Quality Assurance and Corrective Actions Results: The inspection team identified significant concerns about the ability of the core spray and HPCI/FW systems to function as required during accident scenarios. These concerns included deficiencies with system design analyses-and documentation, normal and emergency operating procedures and surveillance test.results. Additionally, problems were identified with the licensee's programs for investigating and~ reporting significant problems to the NRC and evaluating available industry information for NMP-1 applicability.- The team -did not identify any functional concer.ns with the electrical system design ' supporting the two systems. Operator knowledge and the site specific simulator were also considered to.be strengths. A total of 10 unresolved it' ens were identified during the inspection and are listed in Appendix C to this inspec-l ' tion report. f r 1

$1' TABLE OF CONTENTS

Page, 1

INSPECTION OBJECTIVES......................................

1 12 BACXGROUND................................................. 2 3-DETAILED INSPECTION FINDINGS............................... 5 e 3.1 Core Spray System Design............................... 5 3.1.1 Loss-of-Coolant-Accident (LOCA) Analysis....... 5 3.1.2 System Performance Analysis.................... 6 3.1.3 Net Positive Suction Head Analysis.............- 6 3.1.4 Pump' Suction Vortexing Analysis................ 7 3.1.5 System Susceptibility to Water Hammer.......... 7 '3.1.6 Adequacy of System Alarm Setpoints............. 8 ,3.1.7 Control Room Flow Instrumentation Range........ 9 3.2 High Pressure Coolant Injection /Feedwater (HPCI/FW) System Design.......................................... 10 3.2.1 System Performance Analysis.................... -10 3.2.2 System Availability During Loss-of-Offsite Power.. 3..........................,......:..... 11 '3.3 Electrical System Design.............................. 12 3.3.1 Circuit Breaker Coordination................... 12 3.3.2. Voltage Regulation Studies..................... 12 3.3.3 Battery Sizing Calculations.................... 13 3.3.4 HPCI/FW System Backup Power Supply............. 13 3.3.5 Electrical Protection of Motors................ 14 3.4 Design Change Control................................. 15 3.4.1 Safety Evaluations............................. 15 3.4.2 ' Documentation Updates.......................... 16 3.5 O pe ra t i o n s............................................ 17 3.5.1 Emergency Operating Procedure Guidance......... 18 3.5.2 HPCI/FW System Guidance on Loss-of-Instrument Air.......................................... 18 i 3.5.3 Operator Training.............................. 19 3.5.4 Water Source for the Core Spray System......... 19 3.5.5 Operating Procedures Review.................... 19 3.6 Maintenance........................................... 21 3.6.1 Core Spray System Material Condition........... 22 3.6.2 HPCI/FW System Material Condition.............. 23 3.6.3 Maintenance Procedure Guidance................. 24

.r - TABLEOFCONTENTS(Continued) Page

3. 6. 4 Gene ral Housekeeping...........................

25 3.6.5 Motor-Operated Valve Maintenance............... 26 3.6.6 Maintenance Sel f Assessment.................... 27 3.7 Surveillance'and Inservice Testing.................... 27 3.7.1 Core Spray System Testing...................... 27 l 3.7.2 HPCI/FW System Testing......................... 29 3.7.3 Battery Surveillance Tests..................... 30 3.7.4 Motor Control Center Starter Surveillance Tests....................................... 31 3.7.5 Inservice Testing Program...................... 31 3.8 Quality Assurance and Corrective Actions Programs..... 32-3.8.1 Corrective Actions for Ld'CA Analyses Results... 32- ~ 3.8.2 Corrective Actions for MOV Testing Results..... 34 3.8.3 Operational Experience Assessment Program...... 35 3.8.4 Quali ty Assu rance Prog ram...................... 37 4. MANAGEMENTS 5ITMEETING..................................... 39 APPENDIX A - PERSONNEL CONTACTED APPENDIX B - DOCUMENTS REVIEWED APPENDIX C - UNRESOLVED ITEMS 1

.w, f t , s i L' 1. INSPECTION, OBJECTIVES The primary objective of the Nine Mile Point Unit 1 (NMP-1) Safety System-Functional Inspection (SSFI) was to assess the operational' readiness and . functionality of the high pressure coolant injection mode of the feedwater system _ (HPCI/FW)' and core spray system by detennining whether: ] ) ,(1). : System design'was adequate to perform the safety functions required by _ :the design bases.- (2). Testing demonstrated that the system would perform the required' safety i functions. j (3) Maintenance of components ensured that the material condition would. support reliable system performance. 1 (4).Proceduresandtrainingprovidedtheoperatorswithsufficient' guidance - l to conduct system operations. (5) Suppdrting systems'such as electrical, instrument air and cooling were-adequ' ate to allow reliable safety system' operation under design bases I conditions. - A secondary objective of the SSFI was to assess the quality of the_NMP-1 'j programs for maintenance, operations, testi,ng, design control and quality ,assurapce. 9 1 l l I _ J

1 l' 2. BACKGROUND-1 f Nine Mile Point Unit 1 (HMP-1) is a Boiling Water Reactor, Model 2 (BWR-2) I located near Oswego, New York. The plant has been shutdown since December 19, l 1987 when the reactor was scrammed from 98 percent power because of an ( operating event. The event was initiated by a fractured feedwater flow control valve stem which started vibrating and was eventually felt by operators in the i control room. This event is discussed in NRC Region I Inspection Report .50-220/88-02. j \\ l Since the event, a number of problems have been identified with the quality of plant activities. Consequently, the plant has remained shutdown and defueled under.NRC' Region I Confirmatory Action Letter 88-17. -The licensee was in the process of developing a restart action plan to resolve a number of technical and managerial issues. The safety system functional inspection i (SSFI) team visited the site-while the plant was defueled to assess the readiness of the high pressure coolant injection made of the feedwater (HPCI/FW) system and the core spray system to support' plant operations in the future. The core spray system was the only emergency core cooling system designed to '3 inject water into the core. It was designed to adequately protect the core over the entire spectrum of loss-of-coolant-accidents (LOCAs) in conjunction with the automatic depressurization system and emergency condencers. The core spray system had two loops, each with two pump sets (core spray p/(RPV) from.the ump and topping pump), to provide. coolant to the reactor pressure vesse.1 torus at reactor pressures below 365 psig. The system' pumps had a rated flow of 3400 gpm at 299 psig pump discharge pressure. Nornially isolated from the RPV, the pumps received a start signal from the RPV low-low water level signal I i and the isolation valves. opened at an RPV pressure of 365 psig. A recircula-tion line, isolated by a relief valve, was provided from the combined discharge of the topping pumps to the torut to allow some flow through the pumps before the isolation valves would open. This feature prevented damage while the pumps were running in a shutoff head condition. High point vents and a keep fill system were provided to prevent voids from. developing in the core spray system piping. The system was also designed with a test line to the torus that would allow periodic testing during plant operations. A simplified flow diagram of the system is provided in Figure 1 on page 4 of this report. The HPCI/FW system was designed to provide a reliable source of high pressure i injection to the RPV in.the event of a small-break LOCA. The HPCI/FW system used the motor-driven feedwater pumps, booster pumps and condensate pumps to transfer water from the condensate storage tank to the RPV via the condenser hotwell. The system was not designed with a safety-related source of electrical power and was not considered in the LOCA analyses performed in accordance with 20 CFR 50, Appendix K. The HPCI/FW system did have a dedicated backup power supply from the Bennets Bridge Hydroelectric Plant and had specific operability requirements identified in the Technical Specifications. ] 1 l A number of,significant functional concerns with the systems were found during the SSFI. As a result, on October 26, 1988, the NRC issued a letter identifying th'e significant findings in advance of the inspection report so that corrective actions could be factored into the licensee's restart planning activities. On November 17 1988, a meeting was held at NRC headquarters to discuss the licen-see's proposed corrective actions and formal responses to the NRC letter were 1

lf <1 LissuedonDecember8andDecember 16. 1988. Section 3 of this report incorporates the applicable information provided by the licensee at the i ; -inspection followup meeting and in.the' formal responses, as well.as NRC staff I comments on the information. .c 8 9 0 4 9 N e 5 l } o I 1

g.

FIGURE 1 k l l N l E i a y g me E,- 5 t a li3 E = i 15 a 0 l 22 =-CONW l g> - --* C E-i w3 5 5 ga 3 m a a cx H E

n. W ---M--D(-D<

5 Lt) 00 '; R 2 s F- "E 2$ h gg 2 6 M la ",2 E-X > I 3 e gg m Q r 4, ~ o 1 PM b h 'e d b q m Q ^ Q_ I. ,a s

4 ze es M

y k 33 AI 1 r o ~ Q k 1 ' II = ns ga > c?J ~ 9 Pm d b U h W D s ~ ~ lE d ,2 2h 2h U 5 I I 3 g-{ p @j 9 O-y w L' r I m3 2 o a s Z S se-a-oc 2 _s u >. = sI E' E 5 I g -,4- -# 15 b - 2.-e+a-o L^ e 52 g g 83 l@ _ lI E I 8" >? r a s 5 EB -o4--*g, e 1 0 ~ ~

==.

p. ( - 1 j g j< ' o'

q a

G : '23..i ETAILED-INSPECTION' FINDINGS. R' D d t3.1' Core' Spray System Design- , o ~Theicore. spray system design was reviewed to determine whether design inputs D i to the various safety analyses and statementsLin the Final Safety Analysis Report (FSAR) Land Technical Specifications'were adequately supported by calculations and other analyses as required. Several aspects of the core spray: system design appeared to be improperly defined and were not supported 'by design analyses. As a result, the team could not determine whether the

j core spray system was adequately designed to perfonn its intended functions.

'l ,i s 3.1.1JLoss-of-CoolantAccideni(LOCA) Analysis

The

inspection team reviewed the licensee's analysis to demonstrate compliance

.with 10 CFR 50.46, " Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors," for the next operating cycle. General Electric.(GE) Report NEDC-31446P,. "Nine Mile Point Unit One SAFER /COREC00L/ _GESTR-LOCA Loss of Coolant. Accident Analys'is," was issued in June 1987 and fully complied with the requirements _of 10 CFR 50, App'endix'K,."ECCS Evaluation ~ -Models." This report showed that the calculated peak clad temperature, peak local. oxidation, and core-wide metal-water reaction were below the 10 CFR 50.46 n

limits for the proposed fuels under the analyzed spectrum of accidents. The

-licensee had reviewed the GE Report and revised the Technical Specifications , for.the fuel, limits based on the results of the report. In August 1987, during the licensee's review,-personnel in both the Design:, Engineering and'0perations ': organizations identified thatithe GE report assumed that both core spray loops. were always available.although this-assumption was inconsistent with a Technical Specification Limiting' Condition for Operation (LCO) for the system. Tcchnical Specification 3.1.4.d allowed continued plant operations for up to stven days with one core spray loop inoperable. The core spray system was

dssigned so that no single failure would take'a loop out of service so the isingle loop situation was not considered by the LOCA Analysis. The team concluded that the 7-day LCO was less conservative than any postulated single

' failure to the core spray system and was an unanalyzed condition. 1 Bsfore the inspection started, the licensee developed a draft Technical j Specification Interpretation (dated August 23,1988) to require shutdown.within 10 hours if a core spray loop was inoperable, and was in the process of developing a change to the Technica1 Specifications to be implemented after r start. The team disagreed with the licensee's schedule for corrective actions ] and concluded that problems with the Technical Specification should be resolved before the system was dec1cred operable. At the inspection followup meeting the licensee committed to revise the core spray system Technical Specification before declaring the system operable. ) The licensee will evaluate the possibility of a Technical Specification to i allow continued plant operation with one core spray loop operable after plant 1 restart. 'The apparent failure by the licensee to translate LOCA Analysis assumptions into Technical Specification requirements will remain unresolved panding followup by the NRC (50-220/88-201-01). Additionally, previous LOCA analyses had also assumed that two core spray loops were always available. The inspection team identified one instance, on November'11, 1987, where the licensee entered the 7-day LCO with the

I 4 reactor at power for a 17-hour aeriod to repair a leaking check valve. _As discussed in Section 3.8.1 of t11s report, it appeared that the licensee had not taken adequate corrective actions to investigate and report the full scope of this identified problem. 3.1.2 System Performance Analysis The inspection team reviewed the analyses supporting the assertions made in the FSAR, Technical Specifications and safety ar.alyses about core spray system per-formance and identified the following concerns: (1) The system resistance curves did not account for the resistances associated with the piping from the torus to the discharge of the topping pumps, system flow orifice, pump suction grating, system strainer and one check valve. Collectively, these additional resistances could significantly increase the resistance coefficient for the system curves. (2) The ystem flow analysis did not consider the flow that may be diverted from the reactor through the minimum flow relief valve during system operations. Design input provided to the team indicated that the valve reseat pressure could be as low as 280 psig which could divert " flow from the reactor to the torus during core spray system operation. (3) The text in Section VII of the FSAR stated that each set of pumps was ccpable of providini 3400 gpm.to the spray nozzles at 293 psig, but J this poiht appeared to be above FSAR Figure NII-2, " Core. Spray P, ump Characteristics." The curve shown in F1gure VII-2 was used for-determining acceptable pump performance during surveillance testing. At the inspection followup meeting, the licensee stated that calculations were found after the onsite inspection which supported the system performance curves and assumptions about flow diversion. The curves would be validated at several flow points by system testing before declaring the system operable. These calculations were submitted to the NRC and are currently being reviewed. This issue will remain unresolved pending NRC review of the core spray system per-formance analyis and test data as part of an overall unresolved item concerning the adequacy of the core spray system design (50-220/88-201-02). 3.1.3 Net Positive Suction Head Analysis The inspection team reviewed the licensee's analysis that showed the core spray pumps had sufficient net positive suction head (NPSH) for the' full range of anticipated system operating conditions. The analysis asserted that adequate NPSH would be provided for the pumps; however, the team identified the following deficiencies with the assumptions used in the calculations: (1) The pressure drop through the pump suc'cion grating in a loaded condition was not considered in the calculations. (2) The calculation for maximum torus water temperature achieved during the LOCA assumed a torus water temperature of 90*F at the beginning of the event. However, Technical Specification 3.3.2.e allowed the initial torus water temperature to be as high as 110*F before the reactor was required to be scrammed. -

1 i (3) The calculations assumed that the containment atmosphere would always ) e be saturated at the temperature of the suppression chamber water. Therefore, the pressure would a-1 ways be the saturation pressure l corresponding to this temperature plus the partial pressure increase of. the air caused by the temperature rise. However, should.the con- ,tainment spray system be. actuated, such an equilibrium condition may not exist. The atmospheric temperature and the conditions of satura-tion ~ in the containment could be significantly lower than the torus water temperature at the pump suctions, thereby providing less. total 1 { pressure to contribute to availab.le NPSH. f .The team was concerned that the design of the core spray system preve ted n throttling' flow to prevent cavitation. The core spray motor operated isolation valves received'an open signal upon system initiation that was " sealed in," thus preventing later throttling. At che inspection followup meeting,; the licensee stated that calculations had been perfomed which showed .that adequate NPSH was available. These calculations were submitted to the NRC and are currently being reviewed. This issue will. remain unresolved pending NRC review of the core spray system NPSH analysis as part of an overall uriresolved item concerning the adequacy of the core spray system design (50-220-88-201-02). 3.1.4 -Pump Suction Vortexing Analysis The inspection team reviewed the licensee's analysis to show that the core spray system. suction design was su~ch that vortexing would not occur at the torus suction points for the full anticipated range of system

• operating conditions. The licensee's analysis asserted that vortexing was not a problem; however, the team identified the following deficiencies with design inputs to the calculations:

(1) An incorrect, non-conservative inside diameter dimension for the piping at the suction point in the torus was used in the analysis. (2) The probable interactive effects of the two suction points for each loop being in close proximity to each other (approximately four feet apart) was not considered by the calculations. As with the concern about adequate NPSH discussed in Section 3.1.3 of this report, the team was concerned about pump suction vortexing because the core spray system design did not allow throttling of the system isolation valves to reduce flow. At the inspection followup meeting the licensee stated that calculations were performed that showed an insignificant amount of interaction between the two torus suction points and that vortexing was not a problem. The inspection team reviewed the new calculations and concluded that vortexing was not a problem for the existing core spray system design. 3.1.5 System Susceptibility to Water Hamer l i The. inspection team was concerned that the present configuration of the core spray system appeared susceptible to water hammer during large-break LOCA situations. In the present design, the keep-fill lines join the core spray piping at points downstream of Injection Check Valves 40-03 and 40-13. This filled the piping from these valves to Inboard Isolation Valves, 40-01, 40-09,

i l l l 7 40-10 and'40-11. However, the piping upstream of the injection check valves l was not supplied by the, keep-fill system. Much of the piping was above the l l torus level and free to drain'back to the torus through the pumps by way of i the topping pump discharge check valve bypass lines. This design would create l voids when the system was not running and create conditions conducive to water hammer upon system initiation in response to a large-break LOCA.- ) l With a large-break,LOCA situation, the pumps would start soon after the break, i and'because the vessel would depressurize very quickly, the injection valves { -would start tc open almost immediately before sufficient time would have passed for the air to have been removed through the relief valves. In this case, the water front in the pipe would travel very quickly toward the reactor vessel q i until it would reach the injection valves or other abrupt flow discontinuities, at which point the water hammer _would occur. This situation could simultaneously - occur in both lines and prevent the core spray system from fulfilling its safety function. lThe' licensee stated that no problems with water h'ammer had been observed during system. surveillance testing. The team was concerned that existing tests did not simulate large-break LOCA conditions. At the inspection followup meeting, the licensee stated that a special test would be performed before startup to demonstrate that water hammer would not occur du' ring worst-case system initia-tion conditions. This issue will remain unresolved pending NRC review of the water hammer analyses and proposed testing as part of an overall unresolved item concerning the adequacy of core spray system design (50-200/88-201-02). 3 '.'1 ' 6 Adequacy of System Alarm Setpoin'ts.' The inspection team was concerned that core spray. system alarfn setpoints were at values that would be expected during LOCA situations and that alarm response procedures directed actions that were not in the best interest of safety. The following observations lead the team to this concern: (1) The core spray loop low-pressure alarm was set at 225 psig, decreasing, as sensed by a pressure switch downstream of the flow element. The purpose of the alarm was to detect a failure of system piping, but during a LOCA condition the alarm would be received as the RPV depres-surized. Procedure OP-2, " Core Spray System," Revision 17, instructed the operator to check for various failure conditions, and if the opposite loop was operating normally, to shut down the affected loop. With the current. knowledge that both loops of the system were required, this response could place the plant in an unanalyzed condition. In addition, when the alann was received in one 1oop, it should soon be received in the cpposite loop. (2) The core spray pump low suction pressure alarm was set at 2.5 psig, decreasing. The function of the alarm was to warn the operator of impending cavitation, but according to the teams calculations, this setpoint was well above the required NPSH for the entire range of anticipated pump flow conditions. Procedure OP-2 directed operators to secure the train of pumps in which the alarm was received after ensuring that the other train in that loop was running. In an -s-

\\ ) accident condition this would unnecessarily reduce the system capability. Additionally, if the alarm were received in one train, it could be iminent i in the other train. After securing of the first train, the flow in the second train would increase, thereby lowering its suction pressure. This suction pressure drop could actuate the alarm in that train. A better response, were it available, would be to throttle flow to reduce the suc-tion pressure required and to increase the pressure available.

However, as previously described, the system design has no provisions for throttling the' system isolation valves.

(3) The strainer high differential pressure alarm for the large strainers between the core spray and topping pumps was set at 5 psid, increasing. The purpose of the alarm was to alert operators to strainer loading during surveillance tests and LOCA conditions, however the setpoint appeared to be too low for this purpose. In the past, several work ) requests had been written to clean the strainers due to alarms received during testing at 3000 gpm flow, but.no fouling was observed when the strainers were inspected. ] Procedure OP-2 directed that the affected train be secured upon j receiving the alartn. As with the low suction pressure alarm, to secure the affected train of pumps with both trains operating f would probably cause the alarm to actuate in the opposite train because of the, resulting increased flow. It appeared that the alarm setpoints and response procedures were intended to provide guidance for abnormal conditions during surveillance testing and not during actual accident response situations. At the inspection followup meeting the licensee stated that calculations to support new alarm setpoints had been performed for accident conditions and these new values would be implemented 1 before the core spray system was declared operable. The calculations supporting j the new setpoints were provided to the NRC and are currently being reviewed. The NRC staff expressed concern at the meeting that procedures contained action statements that operators were prepared to ignore under certain circumstances ~ because the responses were inappropriate for the situation. The licensee comit-tcd to review other safety-related systems to identify where response to system 1 alarms differs for testing and accident situations and make the necessary changes to procedures. This issue will remain unresolved pending NRC review of the new a alarm setpoints and supporting analyses as part of an overall unresolved item concerning the adequacy of the core spray system design (50-220/88-201-02). 3.1.7 Control Room Flow Instrumentation Range The control room flow instrumentation did not appear adequate to cover the full range of expected system flows. The range of the installed instrument was 0 to 5000 gpm and according to the licensee's analysis, the expected flow with two pump sets running in the loop was approximately 6400 gpm. Regulatory Guide 1.97, " Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant Conditions During and Following an Accident," specified that the range of the control room flow measuring instrumentation for emergency core cooling systems to be O to 110 percent of the maximum anticipated flow. At the inspection followup meeting, the licensee committed to increase the range of the core spray system flow instrumentation before declaring the core spray system .g.

m.- 5 operable. This issue will remain unresolved pending NRC review of the new core spray instrumentation range as part of an overall unresolved item concerning the adequacy of the core spray system design (50-220/88-201-02). 3.2. High Pressure Coolant Injection /Feedwater (HPCI/FW) System Design The design of the HPCI/FW system was reviewed to determine whether statements made in the FSAR and Technical Specifications actually reflected system per-formance. The HPCI/FW system was not considered by any 10 CFR 50, Appendix K. LOCA analysis, but was required to keep the core covered in th'e event of a small-break LOCA. During the onsite inspection, the team determined that several aspects of HPCI/FW system performance were not adequately defined and this resulted in incorrect and misleading statements in the FSAR and Technical Specifications. 3.2.1 System Performance Analysis The inspection team reviewed the licehsee's analyses that supported the state-ments in the Technical Specification Bases,about HPCI/FW system performance and_ identified the following discrepancies: (1) The Technical Specification Bases asserted that each train of the HPCI/FW system could deliver 3800 gpm to the reactor vessel at reactor pressure. The team determined that the calculation supporting this assertion failed to account for the higher elevation of the feedwater nozzles front the. condenser hotwell.. During the inspection, the licen-see, stated that.with th,e correction of thi,s error, the analysis still showed acceptable results. (2) The Technical Specification Bases asserted that at reactor pressures up to 450 psig, the condensate and feedwater booster pumps were capable of supplying 3800 gpm to the reactor vessel. Calculations performed by the inspection team and the licensee during the inspecticn revealed that these two pumps alone were incapable of delivering any flow to the reactor vessel at 450 psig. At the inspection followup meeting, the licensee stated that calculations were performed which indicated that 3800 gpm flow could be provided at 337 psig. The licensee stated that the Technical Specification Bases would be revised to reflect the correct pre.ssure. (3) The Technical Specification Bases specified that condenser hotwell level not be less than 75,000 gallons and inventory in the condensate storage tanks (CSTs) not be less than 105,000 gallons. However, during the onsite inspection, the licensee did not have an analysis to show that 1 these values were adequate to support the spectrum of small-break LOCAs that the HPCI/FW system was intended to mitigate. The inspection team was concerned that under worst-case conditions with the condenser vacuum lost, the gravity feed-flow rate from the CSTs to the hotwell would not provide sufficient water for the pumps. Once the hotwell was empty, the condensate pumps could be damaged and the HPCI/FW system would be inoper-able. At the inspection followup meeting the licensee stated that calcula-l tions were performed that showed adequate transfer of water from the CST l to the hotwell would be achieved to support the HPCI/FW system upon a loss of condencer vacuum. The inspection team reviewed the new calculations and concluded that existing system design was adequate. I

p3 ~ j q .) -(4)l TheLTechn1 cal Specification Bases stated that the motor-driven feedwater ) pumps would ' trip if a reactor high-water level was sustained for 10~ i seconds and the associated flow and low-flow control valves were closed. This modification was accomplished in 1984;to prevent over filling the reactor vessel to the point of spilling into the emergency condenser and-4 main' steam lines. The licensee recognized that frequent cycling.of the' -feedwater pump motors.was not desirable, therefore, a one-out-of-two-taken-twice. control logic was. included in the design to prevent cycling caused 1 .by a spurious signal. However, the licensee had no analysis to determine O whether. excessive cycling would~not occur during a normal system response to various small-break LOCA conditions. The feedwater pump motors were rated at 2500 horsepower and nonna11y, large motors of.this size can be restarted one-time at the normal running temperature, but then must be cooled down for at least one hour before subsequent restarts. To restart more frequently could cause. overheating of the motor and possible failure. The team was concerned that cycling. the pumps would' damage the motors and decrease the reliability.of the -HPCI/.FW system. At the inspection followup meeting.the licensee ~ stated that" pump cycling would occur. only if the flow control valves would fail. - Provisions for manual control of the flow control valves would be included' in the system. operating guidance. The inspection team considered these actions adequate. .The issue of. unsupported assertions in the Technical Specification Bases about the HPCI/FW system design wi.11 remain open pending NRC review of the licensee's

analyses supporting HPCI/FW system performance (50-220/88-201-03).

3.2.2 System Availability During Loss-of-OffSite-Power- <Section VII.I.4 of the FSAR stated that the HPCI/FW system was available with limited offsite power from the Bennetts Bridge Hydroelectric Station.6000 kVA generator. Since the transfer was a manual operation, the generator could require approximately two minutas to be on line and the HPCI System restart sequence could begin.. The restart sequence would take additional time before water could be delivered to the reactor vessel. The licensee could not provide an analysis that showed that with these delays, the design function of the HPCI/FW System, to prevent uncovering of the core for the small break LOCA, would be accomplished. The team was concerned that for break sizes at the large end of the small-break spectrum, the vessel level would not be stabilized before automatic depresturi-zation system (ADS) would be actuated, and the core would be uncovered. This would, in effect, turn a small-break LOCA,-in which no fuel damage should occur if.HPCI/FW perfomed correctly, into a large-break LOCA in which the core may be partially uncovered, and the probability of core damage and resultant radio-logical consequences is significantly increased. At the inspection followup meeting, the licensee stated that the HPCI/FW system was.not intended to support small break LOCAs during a loss of-offsite power. After further review, the inspection team found this response to be consistent with previous licensing information. No further action is required on this issue. . l

o d h;.f se, t 13[3D'ElectricalSystemDesign The station' electrical _' system was reviewed to determin'e whether_ power supplies F and electrical equipment were' adequately designed to support the intended. l operation of the~ core spray and HPCI/FW systems. This review included an ovaluation of the ' analyses for electrical system circuit breaker coordination, v_oltage regulation, battery sizing, motor overload protection and the alternate power supply.for the HPCI/FW system. No concerns were identified.during the inspection with the electrical. system design that would prevent. proper . system operation. The' licensee had previously initiated actions to collect system' design;information'and was performing an internal review of.the elec- 'trical system. The inspection team considered this review a strength. 3.3.1. Circuit Breaker Coordination .The inspection team reviewed the coordination studies for the 4160 Vac and 600.- Vac systems supplying HPCI/FW and core spray. systems loads. The team concluded that _the original studies performed in 1967 were adequate' for the current elec-trical' system configuration. The folicwio.g observations were made during the review: (1) The studies for'non-vital Power Boards 11 and 12 demonstrated good coordination between the largest load (2500 hp reactor feedwater pumps motor) and the bus feeder breaker. ~ (2) The' studies' for safety-related Power Boards 102 and 103 demonstrated. good coordinati6n between the bus feeder breaker and a 1000 hp motor. N This was conservative since the largest load on the safety-related power buses were the 500 HP containment spray raw water pump motors. (3) 'The. studies for safety-related Power Boards 102 and 103 did not include a review of the emergency diesel generator breaker overcur-rent relay. A preliminary study performed by the licensee during the inspection revealed that adequate coordination existed between . the' emergency diesel generator breaker and the largest load for up - to the locked rotor current of the load and for low resistance faults 1 above twice the locked rotor current in the motor feeder cables. I Overcurrent faults between these two current ve. lues could cause the emergency diesel generator breaker to trip before the load breaker tripped. The team concluded that this was a remote possibility end that adequate coordination existed. (4) No deficiencies were found with the. coordination for the 600 Vac System. 3.3.2 Voltage Regulation Studies The inspection team reviewed a voltage regulation study performed in 1981 and the corresponding test data that supported the analyses. The teams concluded that the study was adequate and made the following observations: (1) Impedance values used for Transformers 101N and 1015 did not agree with values on the elementary electrical diagram. The team confirmed that the impedance values used in the study agreed with the nameplate data ! i

~ J on the transformers and that the electrical diagram was incorrect. The licensee initiated actions during the inspection to correct the drawing. f L(2) The licensee had supplemented the main computer analysis for the safety-related buses with subroutines which detennined the voltage drop from 1 the 600 Vac buses to the major loads. The team considered this practice to be a streingth. (3) The licensee intended to perform new voltage regulation, load-flow and short-circuit studies for the electrical system, b,ut no schedule had been established for the update. 3.3.3 Battery Sizing Calculations The inspection team reviewed the battery sizing calculations for safety-related { Batteries 11 and 12. The batteries recently had been replaced with new cells of the same' type as the original cells. 'The inspection team found the i battery calculations to be adequate and made the following observations: (1) The current design assumed that the emergency diesel generator would load and the motor generator would charge the batteries after two minutes of. discharge. The licensee had preliminary calculations that showed the life of the battery could be 30 minutes if the diesel generator failed to start. The team determined that this preliminary analysis appeared correct for Battery 11 if the load profile were properly documented. The engineering department intended to reconsnend that the battery surveillance test be revised to reflect the 30-minute battery life when the calculations were approved. ~ (2) Conservative values were used for the cell capabilities and the calcula-tions were properly corrected for increased battery ambient temperature. (3) The safety riargins vere detennined for 58, 59 and 60 cells, allowing the licensee the optioa to operate with cells jumpered from the battery. I 3.3.4 HPCI/FW System Backup Power Supply The inspection team visited and reviewed the design of the Bennets Bridge Hydroelectric Station which provided a dedicated backup power supply for the l HPCI/FW System. The team made the following observations: 4 (1) The 115kV transmission line between Nine Mile Point Unit I and i } Bennets Bridge through the Light House Hill Substation appeared to { l' be a dedicated emergency line without any interferences from the l Fitzpatrick Nuclear Station. This condition was proparly reflected I on system transmission drawings. (2) Acceleration calculations and a test performed in 1974 demonstrated that Bennets Bridge could adequately support the HPCI/FW system starting loads as long as the. voltage regulator was functional. (3) Discussions with operators of Bennets Bridge and a walkthrough of lineup procedures revealed that the hydroelectric plant could be made available within approximately two minutes under the worst-case circumstances.

I~ j 3.3.5 Electrical Protection of Motors c l The inspection team reviewed the electrical protection for the motors associated l. with the HPCI/FW and core spray systems. Both the core spray and HPCI/FW-l. pump motors were supplied from the 4160 Vac electrical system. The reactor feedwater pump auxiliary oil pump and motor-operated valves (MOVs) were 550 Vac motors which were fed frem motor. control centers through combination motor starters consisting of thermal magnetic molded. case circuit breakers in series with motor contactors and thermal overload relays. The inspection team made the following observations during the review: .(1)- The pump' motor overloads were set to alarm at currents above the service factor of.the motors. Both the core spray and HPCI/FW systems-pump motors had a service factor of 1.15, which allowed.the motors to carry a 15 percent overload above rated horsepower. The motor overloads were l set to alarm at 120 percent of rated current, which allow indetected operation above theLservice factor and possible degradation of electrical insulation over the life of the jnotors because of elevated temperatures.- The inspection team concluded that this issue was not a significant safety concern and the licensee agreed to re. view the adequacy of the pump motor overload setpoints. (2) The reactor feedwater pump auxiliary oil pump overload protection was adequate. ~ (3) Core Spray Pump Isolation Valve 40-06 did not appear to have a t,hermal overload relay. "(4) The overload relays for Core Spray Drain Isolation Valves 40-30 and 40-31 were set so high that they would not detect the locked-rotor current of the motor. 1 (5) Major Order (MO). 2731 modified Feedwater Isolation Yalves 31-07 and 31-08 in 1982 and the new overload relays were incorrectly set. The licensee assumed the motors were a continuous-duty type with a service factor of 1.15 instead of short-time duty motors with a service factor of 1. This resulted in the overloads being set too high. (6) Thermal magnetic circuit breakers (15 and 20 amps) were used with the motor starters instead of the magnetic-only circuit breaker normally used with the thermal overload relays. This resulted in inadequate coordination between the circuit breakers and overloads for six core spray motor operated valves (40-01, 40-02, 40-09, 40-10, 40-11 and 40-12). In the case of Valves 40-09 and 40-10 (with 15 amps breakers) this inadequate coordination could result in the circuit breaker tripping before the overload relay. The team was concerned because this sequence of tripping would require an operator to enter the reactor building to reset the circuit breaker. The inspection team was concerned about the deficiencies identified with the MOV overload protection, but concluded there were no immediate safety concerns. At NMP-1, the safety-related MOVs had the motor overloads wired in series with the i automatic initiation circuitry. Therefore, actuation of the overload trips could prevent the system from fulfilling its safety function. By setting the motor overloads high, the licensee better assured reliable system operation, ) l

.r .but increased the possibility of long term motor insulation degradation. Before the start of this' inspection, the licensee had initiated a review of existing MOV electrical protection. This internal review consisted of combining on a single time-current plot, the valve electrical signature, the thermal over-load relay and the circuit breaker's characteristics. The motor's thermal limits were not included and the methodology and acceptance criteria were not defined in the study. The licensee agreed to factor the teams concerns into the overload protection review. 3'. 4 Design Change Control The inspection team reviewed the licensee's design control program which included I a review of the safety evaluations required by 10 CFR 50.59 and the updates of 1 the design' documentation when systems were modified. The inspection team l identified deficiencies with both design documents and safety evaluations; l however, the process for conducting safety evaluations appeared to be improving. 1 3.4.1 Safety Evaluations ] The inspegtion team reviewed Nuclear Technology Procedure NT-100.B. " Preparation and Control of Safety Evaluation," Revisiohs 5.and 6, and selected safety-evalua-tions to assess (1) the adequacy of design input to the safety evaluations, (2) the sufficiency.of the evaluation in accordance with the criteria in 10 CFR 50.59 to determine whether an unreviewed safety question existed, (3) the adequacy of technical justification for the conclusion, and (4) the completeness of approp-i riate safety evaluation reviews. The specific evaluations reviewed are listed in Appendix B of this report. The following observations were made.during the reviews: (1) Revision 6 to Procedure NT-100.B provided more comprehensive guidance and i better checklist " reminders" to the engineer performing a safety evaluation i than did Revision 5. In addition, a notable improvement in the quality and completeness of safety evaluations was evident in the later safety ~ evaluations reviewed. (2) In Safety Evaluation 86-005, " Diesel Generator Upgrade," neither the i narrative evaluation text nor the Compliance to NRC Standards Form NT-100.8-3 provided an adequate basis or discussion of the rationale for concluding that the probability of occurrence of a previously analyzed accident was not increased and that the modification did not create the possibility for a different type of accident than those previously evaluated. (3) Safety Evaluation 86-016,. for Modification 85-108, "kerouting of Core Spray System Control Cables," Revision 1, was prepared to support a modification designed to establish cable separation for the four core spray pumps and the four motor-operated core spray suction valves. With respect to margin of safety, only the Compliance to NRC Standards Form NT-100.B-3 addressed the issue and stated that the margin of safety was not reduced since the modification did not i affect any Technical Specification. NRC Regulation 10 CFR 50.59 requires that the evaluation consider whether the margin of safety as 2 idefined in the in the basis for any Technical Specification was reduced. The short statement provided by_the evaluator did not provide sufficient information to determine whether this attribute was evaluated.- (4) Safety Evaluation 87-029 "ATWS - Increase Liquid Poison Injection Capability," Revision 1, provided no analysis or justification for the conclusion that~the modification did not create the possibility for an accident-different from any previously evaluated. A restatement of the { conclusion was all that appeared:in the analysis, with no justification d or basis._ Similarly, no discussion or justification was provided in Safety Evaluation 88-003,." Emergency Generators.' Diesel Fuel Storage Tank L Replacement," Revision 1, for the conclusion that the modification did _ 1 not create'the possibility for an accident different from any previously { evaluated.- i n (5) In Safety Evaluation'88-009, " Analysis for Lost Pr:t In Feedwater System," Revision 1, sufficient basis for the no-unreviewr.d-safety-question con- ~ clusion was provided by combining the ovaluation narrative text and 1 Form NT-100.B-3. Part of this basis was provided in a referenced General Electric evaluation, that formed the primary justification for 'the situation not creating the'possi6111ty of an accident different from ~ any.previously evaluated. The completeness of this evaluation formed-part.of the basis'for the team concluding the safety' evaluations have recently improved.- ~ (6) Safety Evaluations 88-013 anf 88-015 were essentially,identic'al a'nd dealt with organizational changes. The narrative evaluation only -described the functions of the organizational units and their new location in the organization. The conclusion that the change did not constitute an unreviewed safety question was based on the "above analysis," but no analysis was included. These evaluations had been approved by the onsite review committee and were scheduled for offsite committee review during the inspection. 1 ~ In summary, the team concluded that, while the technical quality of safety . evaluations appeared to be improving, a significant number of the current -evaluations were not sufficient " stand-alone" documents to fully justify con-clusions supporting a determination that no unreviewed safety question existed. However, since the team did not identify any concerns which would alter the -conclusion of the reviewed safety evaluations, no additional reviews of ~ previous safety evaluations were required. ,3.4.2 Documentation Updates The inf,pection team identified the following 1nstances where design information was 'not properly translated into operating, test and safety study guidance: ) (1) In 1978, the licensee modified the mbtor-driven feedwater pumps to replace the pump impeller. The licensee determined and stated in the safety evaluation that new impeller was equivalent to the old impeller, j However, the team determined that the new impeller design provided i 200 feet less head at rated flow (3800 gpm) and 500 feet at maximum flow. The licensee had not updated their design pump head curves to account for j this impeller change.

~~E~ .7 (2); GE Study NEDE 30241, " Performance Evaluation of the Nine Mile Point -Unit 1 Core Spray Sparger," used design flow inputs of 5020 gpm at 30 psia RPV pressure and 4860 gpm at 55 psia RPV pressure for core spray ' flow from one pump set. These values appeared inconsistent with the inputs for GE study NEDC-31446P which icientifie'd runcut flow at 4000 gpm for each core spray pump set. (3)' In 1984, changes were made to the Technical. Specifications.which raised the setpoint for reactor vessel low-low-low level from elevation 294 feet-10 inches. to J296 feet-6 inches. This is the setpoint at which the automatic'depressurization system is actuated. The following. correspond-ing design documents were not changed: (a). Drawing Number C-35843-C, Revision 1, dated' July 24, 1985, " Reactor Vessel Instrumentation, Level Ranges, Actuation Points, and Water Volumes." (b) eDrawing Number.C-18015-C, Revision 87-039-C1., dated November 3, 1987,. " Vessel Instrumentation, Piping and Instrumentation Diagram." The team found applicable operating and test procedures were properly updated and the low-low-low level alarm was properly set in the plant and at the simulator. (4) The original design of the feedwater system had the reactor feedwater auxiliary oil pump motors be.ing powered from a.non-vital power. board that. could only be fed from offsite power. In 1972, the power supplies for' the auxiliary oil pump motor's were moved from Motor Control Center (MCC) 151 to MCC 1671, which was capable of being powered from the onsite diesel generators. Neither Figure IX-1 of the FSAR nor the Electrical System Description document was revised to show this change in power supply for .the reactor feedwater auxiliary oil pumps. (5) The. original design of the core. spray system had all safety-related 4160 Vac motors being stripped from Power Boards 102 and 103. In 1971, this design was modified to leave one core spray pump on each bus following an undervoltage condition so that they would be ready to start when the diesel generator was connected to the bus. Neither FSAR Figure IX-1 and text, nor Surveillance Test Procedure NI-ST-R2, " Loss of Coolant and Emergency. Diesel Generator Simulated Automatic Initiation Test" were modified to show i that one core spray pump motor on each bus did not trip on undervoltage p conditions. The apparent failure by the licensee to update design documentation and the FSAR after system modifications will remain unresolved pending further NRC review (50-220/88-201-04). 3.5 Operations' g i The team reviewed operating and administrative control procedures, performed walkdowns of systems and plant areas, and conducted interviews with licensed and non-licensed operations personnel regarding the HPCI/FW and core spray systems. The documents reviewed are identified in Attachment B to this report. Weaknesses were found in the general areas of emergency and normal operational I_ practices and procedures. l I I m

) ~ i 3.5.1 Emergency Operating Procedu guidance was providedThe inspection team reviewed th re Guidance emergency conditions. for operating the core se licensee's E0Ps to d review: The following deficiencies wpray and HPCI/F (1) Procedure E0P-4, " Primary C ere identified during this er 11.5 feet, the normal operaticontained instructions h; ,3 i 10 feet, the operator was r f n torus water level between 10, Step 7.7., t Step I.21 ng band. erred to Procedure OP-2, " Core SIf t tor to res.d., to add water to the torus e and core spray keetore water level e e ow

• • 1 spray system. p-fill system which required secto within the 1

The team determined that thi operating circumstances n era-uring one loop ofutilizing the tion when both core spra,y l but was unacceptable in thes was acceptable for th i repositioned without overridioutside isolation valves ( oops could be required. post-LOCA condi-normal the fill operation i Thus, the specified procedung system ~ ) specifyin'g a means. licensee concurred and prepa not be to add water to the torus d uring a LOCA event.re was def water from an alternative sour L red a revision to the procedu (2) 1,imitationsThe E0P General Instruction ce. The i re to supply .conoitions. of the RPV level instrumentation'under ps, i s Level Instruments LI 3619 a dThe tea that no warning was provided arious 1 ost-a \\ nstruction was'ccident injecting into the vessel concerning the limitations of lodeficient in n LI 36-20 when the core spray connected to the core spra. The lower legs of these inst w-1ow-low team was concerned that theffects of injection flow wou y lines so that the dynamic and b system was ruments were make the instruments inaccurateackpressure by the operators for casualtconfusion during an acciden e erroneous indication could pr d y management during training e, ever, t The ) Graphs 2.1 and 2.2 in E0P-2 not { provide vclutions. used However,d NFSH limitations for individual cor pump flow,vailable f1w indication in the control" I ( c rel " and there was no guidance in the e spray pump upera, tion. to this fact. room was for combined procedure alerting operator's the inspection followup me ti

edural errors with h-e the E0Ps had been correctedng, the licensee stated that t solvec pending NRC review of the 2 HPCI/FW System Guidance on Lo revised E0Ps (50-220/88-201-0 ca dure N1-SOP-6, "Special Operati ss-of-Instrument Air ion 0 gr v:s,sel water level udescribed actions to be taken ng Procedure, Instrument Air Failw et$ the Emergency Plan,pon loss of instrument air b] associated with a LOCA ure,"

if required, indicated that us The instruction to rol >concerning control of the air h condinsate, booster, and feedwater pumps Missing from this procedure w e of this procedure -operated bypass valves back to there any instruc-Upon instrument air failure e condenser _,_,,__-,.-m-~' - - - ~ f l wE 3., l.. J' Il 6 -many of. these valves move to the open posit 1 stated in the Technical Specification Bases L control of the air-operated bypass valves.see agreed reactor pressure as '. specific direction for lotal 3.5.3 - Operator Training. -j HPCI/FW systems. Procedures and lesson planThe team reviewed the i c related to the' core spray and appropriateness of the information presented. s were reviewed for adequacy and scanarios were run'with the assistance of the traini . In addition, six simulator .information presented to the operator during transients inp spray system, the HPCI/FW system and loss-of offsit ng staff to asse volving the core, Tha lesson' plans and simulator scenarios revi e power. in the. depth of information preser.ted and th ewed appeared to be 3 as related to approved 'opsrator programs were plant procedures. included in-the rev.Both licensed operator ande corre

since its installation in 1985 to simulate extrem primary cont'ainment pressure increases that would fieg.- T non-licensed --

dscisions, anticipated-transients-without-scram (ATWS)e of d;; pressurization scenarios and steam coolin orce containment venting simulate a wide range' of-severe plant conditions f conditions, emergency g events.

This capability to considered a stren,gth. }; or E0P training, was 1 .3.5.4 Water Source for-the Core Spray System' ) In addition to the concern raised in Section 3 1 1 adsquacy of the 7-day Technical Specification LCO for thof this re f. the tsam identified an additional concern .\\ operable with certain spe::ified conditionswork to be perf e core spray. system, The Technical Specifications allowed 3 -conditions was.available, adequate and redundant sources of { re sprey systom was drives without an available source of wate 1 er for injection. a worked on the control roo -the inspection, the licensee initiated a Technical Specifi corract this probiem. e core spray system. During } cation amendment to h 3.5.5' Operating Procedures Review The inspection team identified the following defi i procedures that provided guidence for the core sprayc encies with the L\\ (1) and HPCI/FW systeirs: There did not appear to be a requirement to cros j key instructions, and other vital information bet procedures,' training manuals, design documents or oths-referenc sm j ween plant draw'ngs, documents to ensure consistency following cha It appeared, and was confirmed in discussions with linges in any on i er. controlled I that a formal process to review the impact on censee personnel, k ussd when-temporary changes or permanent changes wereother docu i

documents.

made to controlled g

w y .'.(2). Proce. dures OP-2, " Core Spray. Pump to Reactor," had numerous typog,raphical ' between system drawings and pro er \\ errors, differences between j .the differences included: ons, and differences. p eets. Examples of. (a) Valves CRS 743, 745, 734, 736, 747, 709 OP-2 valve lineup sheets, Table 1, were,inc, iand 711 on' P 749 core spray system drawing regarding' normal' positions stent w (i.e.. closed or capped and closed vs .loded-closed);quirements' { on re (b) Spray. Topping Pump 11 Procedure OP-2, Section I.7. did n kj shutdown of } result in pump dama,ge;1 if Core Spray Pump 111 tripped, w. Core hich could (c),In Procedure OP-2, Table 1, Valves CRS L i valves. 3 .a.yalve lineup or verification;This could ' lead to operator c ng the conduct of. . {d). Procedure OP-16 Table 1, ha' d discrepancies b requirements and procedural valve requirements (ietween ac open/ closed versus open specified position for v/ closed). .e., locked Additionally, Table 1. re,quirement was,to,have the valve locked-openalve 50-64 wa -(3). Condenser hotwell level alarm setpoints p " Condensate System,"_ appeared to be inc onsistent with Technicalrovided'in Proce Specification requirements and actual plant low alarm at 42 inches while the Technical Sspecifi setpoints. Procedure OP-15A level to be maintained above 57 inches at 66 inches and the licensee determined that the instrument calibpecifications required low-level alarnt at 60 inches and the high-levelDuring the ins was initiated to the procedure to correct the er h; e alarm at 70 inches, also been programmed into the simulater, where th cations. A change This error had Ji6 ' was actually set at 42 inches. ' licensee to enrrect the simulator alarm s tCorrective action was initiat e low level alarm actual plant configuration. e points to agree with the '(4)'ProcedureOP-a6,"HighPressureCoolantInjectio { grid after a loss-of-offsite-power eventtion of the system r p-e 'some of the automatic and manual support systemsNotes were p restoration of the 115 kV p

allow operation of the HPCI/FW system.

The procedure did not providewhich must which cooled the condensate booster pump bea lubs oil and the instrument air s ng (RBCLC) system s the feedwater pump, s which. cooled the RBCLC system. operation of the HPCI/FW syste Both the RBCLC and emergency service i - generator by the operator. water _ systems had to be manually loade E ergency diesel 1) Procedure 'OP-2, Section 1.24, directed actions t oparator. in' case Annunciator K2-4-7, " Core Spray Pumps Di o be taken by the scharge ('

4 . Pressure High," was activated by high p the' core spray topping pumpof a stuck closed re e common discharge header ofre to remove the system from ser. s The procedure-directed the o the " ' pull-to-lock" positio n, but no direction was provided I reinitiate the system once perator - and the inboard isolation. v. reactor pressure decrease The' team was also concerned th n alves o core. spray system was.not requiredshutting opened to allow e ow 365 psi h uld be given to as firmly established that the (6) Procedure S-SUP-06 g 6 to provide for the control" Control of. 0perator Aids " w personnel from using unauthorioperator aids-to ens , authorization, documentation and r licensee as used by the in.the performance of their durrent and ccmplete and to preve t eview of i

ed o of this program and found that th uties.perating and maintenance information the number oand the required reviews were cond e program was appropriately im n

inspection. 'f active operator. aids was. entation ucted The team was concerned that 3 Many of instructions that could be mad emented operator aids did not contain athe operator aids appea excessive; 130 at the time of the i-i i e permanent. Additionally, the log ofo be panel or destroyed 9 i information o,n fileit would be difficult to rcopy of the aid. e i eplace exactly without suchIf an aid w room panels to corre. i late the readings between theOperator aid l instruments used by t { .. emergency'co;nditions*.he operator during startup n the main control g of paper copies taped to the pan l various water level and bottom of the active fuel was vwhich e s between the instruments 984, and consisted level aid had informational porti ery hard to read. zone instrument reading to th t The aid tha instruments. p 1 3 Narch 1988 to address the rec Proble:n Report 258 was generat d bons cut away to e( Lthe time of the inspectiand replace them with pennanent lab 5 eval of operator aids from the conty the licensee e etween ( k

the operator aids program to addres es i

The licens,ee committed to revibut no action h on. rol room im I inspsetion before restart ) ted on the number of deficis the concerns identified by tneew and revise ocedure issues discussed in Sencies identified above and prev Ged abcut % the proc. the adequacy of station ope.1.6 of this report, the ection 3 us alarm response { edures licens es correc.ted procedures and operatorThis issue will remain t con-hids (50-220/88-201-06)ved pending N ' Maintenance %eam reviewed the licensee's maint ter the material condition 3 support reliable:performanceff system componen enance practices and procedures to of the HPCI/FW and core spray syst assess \\ Maintenanc'e records were review dems compone Ued for adherence to procedure B the physical condition of thequately maintained IE e to deter-e system components.s, and system walkdowns,w 1 dad that there were several ryray systems that required resolutimaterial deficiencies w e to i se attention was required to improve mainton before re W and enance procedures. I

3~ 7.: J IThe licensee's maintenance self assessment and MOV testing progra te strengths.

3.6.1 Core Spray System Material Condition The inspection-team assessed the material condition of the core spray system '

during a walkdown of. portions of the system with licensee maintenance-personnel. the system that were to be corrected before restart.The licensee had pr The inspection team- ~ identified the following concerns which had not been previously addressed by the licensee: (1) The bolting for operators, yokes, and bonnets for core spray valves. 40-01, 40-02, 40-05,-40-06, 40-09, and 40-10 did not have full thread engagement. bolt length The Quality Assurance Topical Report established correct as one thread beyond the face of the nut. tion, the licensee issued Problem Report 458 to resolve this issue.During the inspe ,(2) Supports'were loose for safety-related conduits IF 57, IF 58, IF 47, and IF_ 48. The team was concerned that these conduits may not meet their seismic design' requirements. The licensee issued Work Request 144149 to correct these conditions. )t (3)' Cor'e Spray Relief Valve 81-11 Discharge Line 82-3-LT had a pipe b support installed near the relief valve that was not identified on the current. isometric drawing (C26845-C Sheet 3) for the system. . licensee issued Problem Report 462 to resolve this issue. ] The ) -(4) An indentation approxiniately two inches long existed on thJ i l'- core spray strainer. tool and had been freshly painted over.The dent appeared to be caused by a blow j Report 471 to resolve this issue.- The licensee initiated Problem (5) Grease and oil were lecking from the operator for Core Spray Suction Valve 81-01. replacing the 0-rings end gaskets.During the inspection, the licensee refurbishe The inspection team observed this .g maintenance activity and concluded that it was performed correctly. "i I (6) Core Spray MOVs 40-01, 40-09, 40-06. 40-10, 40-11, 40-12, and 40-05 had a significant amount of corrosion, surface oil, grinding dust and miscel-i laneous debris indicating a lack of general care during the outage. {j licensee issued Work Request 1425g4 to correct these deficiencies. The 1 h (7) There was a half-inch weld spatter on the core spray line between inside ") Isolation Valve 40-01 and the RPV. The team was concerned that this weld spatter on ASME piping was not properly evaluated. 142326 was written to correct this problem. Work Request i During the ' inspection, the licensee stated that it realized the core spray system was not ready for operations. ducted before the system was declared operable.A thorough walkdown of the system wo 8' The team was concerned that these walkdowns should be scheduled with sufficient lead time to allow proper resolution of identified problems, j i

y 13.6.2 -HPCI/FW System Material Condition i The. inspection team assessed the material curing a walkdown of. portions of the system condition of the HPCI/FW system personnel. were to be corrected before restartThe licensee had previously h with licensee maintenance following concerns which had not bee The inspection team identified the. severa n previously, addressed by the licensee: (1) Outlet Isolation-Valve 30-10 Feedwater H without an adequate engineering evaluation November 6 1987, 20 . eater appeared to be modified 6 retaining p, art of the valve, to inject 155 c biholes were dr to repair a leak. ange, a. pressure . assess the structural integrity of the valve flaThere was u drilled in it. erformed to to repair the steam cut leak and noncThe licensee had refurbis

that appeared to be the result of the "Fwas issued t i

urin 1-88-0004 licensee dispositioned this NCR as acc e bonnet of Valve 30 eptable based'on grinding tourmanit concerned that these modifications to repairemov The e rant test. The team was rendered'the valve unsuitable to support f tr Valve 30-10 may have licensee connitted to perform an engineeri u ure plant operations. configuration of Valve 30-10 and repair or replng evaluation of t The (2) 'The I-beam type pipe supports for Face the valve as necessary. '31-02, 31-07 eedwater Isolation Valves 31-01, and 31-08 had several fasteners that did not h . thread engage, ment. The Quality. Assurance Topical Report establi correct bolt length as one thread beyond the fa ave. full inspection, the licensee issued Proble shed ce of the nut. (3) A pipe clamp, with no support attachedm Report a79 to resolve this issued Problem Report 478 to resolve this ibuildin ve FW-738. The licensee (4) . One feedwater line and one main steam line drywell p ssue. 4 the rubber material portion of the drycontainment isola on.in the I issued Problem Report 461 to resolve this i well penetration seal. metal clamps which conta ssue. The licensee (5). Rsheat Stop Valve 16-21 was severely co periodic maintenance. this problem. The licensee issued Work Requestrroded and showed a lac b 142622 to 16)'. Several covers were missing from junction box correct j ~IF-41. The licensee issued Work Request 145404 tes on Conduit 16-1-SoA and ) A chain fall was used as a temporary restrai t o correct this deficiency. 112 and the second stage reheater drain tank n rubbing against a rod hange on Feedwater Heater The licensee issued Problem Report 460to prev to resolve this discrepancy.r. 71ng the inspection, the licensee stated that it realized th 8 3 tem was not ready to support plant operations 4 system would be conducted before the system was dA thoroug eclared operable. The { 3 \\ ~

team was concerned that these walkdowns should be scheduled w lead time allow proper resolution of identified problems. 3.6.3 Maintenance Procedure Guidance The inspection team observed the following practices that indicated that the licensee did not follow a policy of strict procedural compliance for all maintenance activities: (1) The vendor manual for the Core Spray Strainers be performed without relying on high differential press indicate a need for cleaning. existed for this task and maintenance personnel stated that the st were cleaned based on high differential pressure, which was contrary to the vendor recommendation. pump vendor manuals recommended performing semiannual and tenance and inspections, including oil changes cleaning and relubricating bearings. gland bolts and nuts, chec The licensee had no such main-tenance requirements identified for accomplishment on a periodic basis The team determined that the strainers were inspected as part of the Station Shift Supervisor (SSS) Instructions, which was an uncontrolled l document that listed certain checks.to be performed on plant equ [ such as checking the cleanliness,of strainers in the core spray,ipment, ment spray and raw water systems, centrifuging oil sumps on the reactor contain-recirculating pumps and performing other similar activities. When questioned about this activity, Operations personnel responded that no work requests were required to perform these checks nur were any proce-dures followed other than equipment markups and normal radiological control practices. The strainer checks were performed during plant refueling outages. The team was concerned that safety-related system boundaries were being breached and rnelosed without proper consideration I for QA oversight, cleanliness control, and proper torquing of flange i bolts. During the inspection, the licensee initiated a change to'the SSS instruction to require a work request with proper QA coverage to accomplish this maintenance activity and stated that this item would be i incorporated into the periodic maintenance program. (2) The team noted during the inspection of the torus water-level transmitter 1 that instructions were written on the reactor building wall adjacent to Level Transmitter LT 58-05 that appeared to be excerpts from a procedure b, directing the calibration of the transmitter. Further review of the calibration procedures revealed that the instructions were based on an earlier version of the procedure and were now in conflict with the current, y dpproved procedure. Discussions with maintenance personnel established that the instructions on the wall had not been used during the most recent calibration activities; however, it appeared that in the past these instructions had been used instead of approved procedures. there were two test water-column scales marked on the drywell wall withAdditionally, tygon tubing mounted on the wall above the written instructions. i l g the inspection the licensee determined that these columns no longerDuring l served a useful purpose and removed them and the instructions from the l core spray pump room wall. l

4 (3) to direct electrical preve,ntive maintenaProced s n s," was employed by the licensee were to conduct monthly nce rounds that plant personnel the monthly rounds were. A review of completed procedures March, and April 1988. The rounds were restarted in May 1 revealed that include checking the motors 'a require system did not identify the, missed rounds y, section of the procedure that the procedure ament in the p ut did not .be changed to quarterly, but this would occur after frequency for the rounds identified iThe team was accomplishment frequency would .i ended change to a quarterlye missed rou that.the frequency change was made with n the procedure, but was concerned requirements. i' (4). During a review of the licensee's out first revising the procedural suppressors (snubbers), maintenance personnel provid d May 1986 Technical Specification Inter reporting inoperable snubbers found durinpretation for determining e interpretation conflicted with the Technical S g testing. interpretation stated that if a snubber'w Two statements in the tionally, the interpretation stated that icold shtttdo specifications Eases. The engineering analysis be required if the snubb ity did not apply. t was only intended that an when the s Addi-that this ystem was required to be opera _ ble. er was found inoperable cancelled. :The. team reviewed three copinterpretation P", Licensee management stated Specification Interpretations and did n.ies of the controlled Tn error and h issued set.- uncontrolled document.It appeared that maintenance personnel weot echnical Interpretation and that inoperable snubb the licensing and operation personnel wh re working wi.th an t o make the decision on reporting e at rolled Technical. Specification team concluded that this uncontrolled o rs were properl Maintenance Department. documentation was. y reported. The limited to the ' (5) ~Several examples were noted _ specified by memoranda and performed without follow procedures. 1 " Housekeeping and Cleanliness Control " memo o site [ ecified in ' activities were implemented for safety-relat d r.ccrporated into AP 8 i with Memorandum NMP 38295 without'being incorpora e equipment in accordance procedure. i nto an approved e- ( L 6.4 Ems ! General Housekeeping j t !n pathways outside the nuring plant walkdowns, it was noted that the $1s was especially true in the main steam isolation v lormal tra pywell areas. s $t completing work activities and not cleaning up th iThe s. b addition, several examples were found where sit sult of individuals k 8.5 was not being followed; namely, the station e r respective work areas,, nduct tours weekly as required by Paragraph 6 0 e Administrative Proce m superintendent did not of the procedure, no target j ( - \\ L--_______-______------_-----

t

, t

~ Inspections and there was no record of an audit be e last~two Ltive action list'as required by the procedure e on the correc-licensee established a schedule and initiated plan: cleanlines During the inspection the [ of specific' zones. i 3.6.5 Motor-Operated Yalve Maintenance. 1 1 The: inspection team reviewed the licensee's maintenance practic

licensee had conducted a detailed testing progr es for periodic tions', using the Motor-Operated Valve Analysis and Testing Syst ngs.

The em condi- .as previously documented in. Inspection: Report em (M0 VATS) bases condition of safety-related systems as requ 50-220/88-24. Additionally, " Motor-0perated Valve. Common Mode Failures 'During Plant Transi esign i e n 85-03, Improper Switch. Settings." and, made. the following observations:The team reviewed the analyses and test results ents Due to

(1) because of an incorrectly set open limits.The test results i

~ c seating Valve 40-20 experienced a backseating thrust ofCore Spray.0utside Isolation

testing.. The licensee verified that the operator was rated for F

113,000 lbs during MOVATS' and performed an analysis which determined that this thrust wou ' stress the' stem. The inspection team was concerned'that there maybe other er-b. parts of the valve that would 'be more restrictive:than the stem '~ -(2) . was significantly greater than the expected values. Tes rust . appeared to be Core Spray System Outboard Isolation Valve 40-20, whic The worst-case was 40,800 pounds 'for a torque switch setting of 3.had rust !with..the operator vendor, Limitorque After consultation

the problem was with the spring pack.. Inc., the licensee concluded that the interim periodthe spring pack at the next outage and to closely mon The inspection team considered this appreach accept-uring able if the measure.

d thrust valves were below the allowable thrust for t most. limiting valve component. [5' 'M) The analyses for determining thrust valves for the torque switch setti j -did not consider reduced voltage at the motor for determining the a ngs of thrust available from the motor. { l(4) would be extremely close to the motor-operator stall to stall torque of the motor-operators as part of the t The licensee '(5) ~ were actuated by the same limit switch position.In many cas Section 3.8.2 of this report.in the part with the licensee's measuring of provide se The licensee was rewiring the MOVs to functions.parate limit switches for indication and torque switch bypass E{ 4,

y r 1, 1 ^ Lu L! '(6) There did not appear to be an adequate method of controlling-limit sw setpoints so thatl test personnel _would be advised.when switch position j changed. The licensee stated that when all the safety-related MOVs were i rewired so that valve position and torque switch bypass features'would be Leontrolled from separate limit switch rotors, the problem would be -the testing personnel should know when switch pos The team concluded that even with rewired control circuits, g' .During the inspection the licensee agreed to factor the teams observations in .the_ ongoing program.for control of MOV switch setpoints. 3;6.6 Maintenance Self. Asses'sment o Good: Practice 85-038, " Guidelines for the Conduct of j Power Plants.". The team reviewed the' content of the assess [ that it was a thorough review of the strengths and weaknesses within the j 1 ' licensee's Maintenance' Department. Many of the corrective actions identified-k ? in the assessment were under development on.in the process; of being impl 1 L during this' inspection. It. appeared that, when im lsignificantly. improve the quality of maintenance. plemented, these actions would . Additionally, the licensee- 'batween electrical, mechanical and instrumentation activitie 1 6, considered these corrective actions a-strength.

3. 7' Surveillance and Inservice Testing 1

HPCI/FW and the 125 DC electrical systems to ensure thaj L . and inservice test procedures used to verify the system functions were techni- { .cally correct.and adequate. 't 1each of:the test procedures'11sted in Appendix B of this report t.The revI isystem fenctions described in the FSAR and Technical Specification requiremen o verify that were properly demonstrated. sections of the ASME Codes were properly implemented in the in program. The team identified several deficiencies with the licensee's test program which appeared to be due to the poorly defined system design as discussed in Section 3.1 and 3.2 of this report. ; Also, the inservice test program did not appear to provide useful information for trending system ting proble'ns before the system was declared inoperable. performance and correc-3.7.1 Core Spray System Testing The inspection team reviewed.the terting performed for core spray system

piping, pumps and valves and'diade the following observations

) (1) The pump curve used for the LOCA analysis did not appear to be effectively l translated into surveillance test acceptance values to determine core spray system pumps operability. values were determined from the design basis pump curve specified inThe i Section VII of the FSAR, which was taken from GE Report NEDE-30241, " Performance Evaluation of the Nine Mile Point Unit 1 Core Spray W) Sparger." An uncontrolled copy of this curve was maintained in the i Control Room for use by station operators in determining the operability i i of the core spray system pumps. determined by adding and subtracting an instThe test acceptance va ~ define ~an acceptance band and operators were t pumps test data plotted within this bandThe tearument error to t I the instrument error band should only have been add dr I obtain~the minimum pump acceptance values. m was concerned that i to the curve to l the pump might not deliver the flow assumed bpum e could indicate that k (2) Pump testing practices did not appear to y the LOCA analysis. t 'an NRC Safety Evaluation Report (SER) for core sp. agree wit steam environment. The SER, dated July 24 ray effectiveness in a written verifies that core spray pump performance the full range of pressure and flow rat s h y as presently characteristics over - includes both pressure e l ave-not degraded. 30' psia vs. 5020 pgm."vs. flow points (i.e.,125 psia vs. 3400 gpm a Operated Valves Opera)bility Test," Revision 2 Procedure N1-ST-01,." Core Spray Pumps and M . system pumps at only one point determined by a throttle v or the tes't line to the torus. flows were approximately 3000 gpm at'300 psi which was less than the flow range specified in t e position on stated that single point testing had always been theg pump d e SER. The licensee j spray system surveillance testin ' 4000 gpm were achieved; however,g. Previously, test flow rates ofpractice for core necessit'ated reducing.the test flow. excessive vibration in test line pip 4 (3) The Technical Specification acceptance values f System Outside Isolation Valves 40-02 and 40 Valves 40-05 and 40-06 were designed to repositi c on. Core Spray n initiation signal during system testing est Line Isolation on upon receipt of an i tion Valves 40-01, 40-09, 40-10, and 40-11 werCore Spray System Inside Isola-team was concerned becaus,e the stroke time acc] z valves with similar functions were different y system lineup. The { nce values for these 40-02, 40-12, 40-50, and 40-60 had stroke time acc Valves t 25 seconds while Valves During the inspection the licensee could not resolv difference. eptance values of in stroke time acceptance values for these valves with functions. e the The team reviewed previous test data for all the determined that the actual stroke times were less th similar valves and . b__ the valves. an 20 seconds for all

(4)

Hydrostatic tests were conducted at insufficient ' of the core spray system between the Core Spray Suctipressure o p 81-09, 81-10, 81-29 and 81-30.01-01, 81-02, 81-21, and 81-22 on Isolation Valves Procedure N1-ISI-HY0-424 " Reactor Coreopping Spray System Hydrostatic Pressure Test," Revision 1 j every inspection interval and after system maintenance or alt, which i ) rsquired only an 80 psig test. i system design pressure if the design temarea of the core s

eration, g;

{ and there were no system relief valves. perature was greater than 200 F, o 1.25 times There were two design pressure V l 1 E _ ____ ___ _ -2%

y .7 4 . regions? within.the hydrostatic. test' boundary described above. 1 core spray pum From the.

topping pump, p suction isolation valves to the. suction of the core spray the design pressure was.340 psig, and, from the core spray-

. topping pump suction to.the topping pump stop valves, the design pressure was 465 psig...The team noted that by conducting the hydrostatic. test at 1.25 times design pressure, the licensee would not only comply with ASME CodeSection XI, but would also ensure a conservative test of system integrity that was consistent with the high pressures experienced j ' downstream of the. core spray pumps upon system initi,ation. At the inspection followup meeting, the licensee conmiitted-to validate the core spray system pump curves by testing over several points:and control the giump curves after issuance. -raconciled with inservice testing program requirements. Additionally the hydro q 1 . testing of the core spray system will remain unresolved pending NRC review ofThe,j the hydrostatic test, procedure, pump curves and test data-(50-220/88-201-07). 1 3.7.2 HPCI/FW System Testing ,i The inspection team reviewed the testing pPogram for determining the operability ~ of pumps, valves, storage-tank level, system initiation and automatic trips for 1 .l .the HPCI/FW system. appeared acceptable with one exception.The test program for determining.HPCI/FW The acceptance values for determining.HPCI/FW pump operability did not' appear i to accurately' measure system performance.. The.Technica.1 Specification requirements specified that the HPCI/FM system must be capable of meeting the pump head vers'us flow curve. The licensee limited testing to the motor-driver "feedwater pumps and the curves used in the control room to determine operability i .were not adequately controlled. The curves used in the control room were not part of a controlled document and could not be verified to be consistent with j the existing equipment installed in the plant. The team was also ccncerned that the actual performance of the HPCI/FW System was the combined performance of the condensate pumps, the booster pumps, and the feedwater pumps. The performance of the condensate and booster pumps were never checked with a sur-veillance procedure. 1 Therefore, the actual total performance of the HPCI/FW system was never verified. l The licensee!s position was that if the performance of the condensate or booster pumps were deteriorating, it would be detected during normal operation by the inability of the system to supply adequate flow to the reactor vessel. The' team dishgreed with this position because deterioration in pump performance could be very gradual, which would not necessarily be noticed, and the system [ had excess capacity to provide water to the reactor during normal operation. j 4 .Any deterioration would be covered by wider opening of the feedwater control valves, which, again, would not necessarily be noticed. Even if it were noticed, there was currently no procedure to quantify the deterioration and ,j - compare it with acceptable limits. j j At the inspection followup meeting, th.e licensee committed to issue controlled system pump curves, including booster and condensate pump performance, and i validate the curves at several setpoints. The issue of HPCI/FW system testing 5

i l will remain unresolved pending NRC review of th (50-220/88-201-08). ( e pump curves and test results i 3.7.3 Battery Surveillance Tests. batteries and identifie'd the followingThe inspectio 1 ance test program for the station (1) concerns: Weekly and monthly surveillance tests t ii did not identify values' at which to pe f r orm corrective actioo measure indivi stated acceptance valve of 2 voltage range of 2.20 Vdc to 2.25 Vdc for lbatt b The concerned that corrective actions should occthe ve ead calcium cells. an inoperable condition. oat ur befere the battery reachedThe team cell voltage of 2.12The one weekly surveillance data revi This value was below the acceptance cri of 2.13 Jdc; however,Vdc. data sheet. no notice was made in the " REMARKS" se The licensee later demonstrated, from co pilot cell data taken during the weeks pri eria on of the { able data, that the recorded value should ha mparison with other or to and following the question-j of the two digits to the right of the decimal) that the recording error had not bee ve been 2.21 volts (a reversal l the data sheets or by trending the dat n detected either during signoff ofThe t We'ekly and monthly surveillance proced (2) a. for the overall battery voltage of only 106ures have an accept should only be referenced in the battery servi i volts. weekly and monthly surveillance acceptance This low voltage based upon the product of the manufactur ce discharge test. The er's minimum float voltage andcriter the number of cells in the battery the mention of the lower acceptance valstatement tha The procedure did contain a t oper,ator confusion. an 132 volts." ue of 106 volts could lead toHowever, (3) The latest results of the battery servic reviewed. 8-hour test and this was considered accept blThe perfor battery service test consisted of the 2 min t load profile. e as baseline data.s of the factory a the load profile to be compensated foThe present battery service te "B" (,_.t The b:cause battery temperature affected capacitelect would have 15 percent greater capacity than a b The team was concerned e. design temperature of 65*F. y. A battery tested at 90*F attery at the minimum cells installed at NMp-1The team considered the 2-minute service j a It was the team's understanding that Designe ~ Engineering would recomme. nd that a longer test profile be used in fut into the surveillance test acceptance valssrvice discharg ure will also be factored

• l ure ues.

Il

p-9 y r 3.7.4 Motor Control Center M u ' compartments 'of selected coreThe team reviewe c iTh2se surveillance procedu spray and HPCI/FW systems moto breakers and overload relays res checked the timing on the molded-operated ntrol center tThe team questio associated with -test current did not correlate with thned the ttst verification data for th b s. Engineering personnel had r i e overicad relay heaters. iteria found on the ance cr .in May 1988, but no resolution had b a sed'the same question with ele manufacture The team also questioned the een reached. Design ectrical maintenance

for-the molded case circuit breakacceptance criteria procedure appeared to be based

? not on t ers. ' ctnters. he. specific circuit breakers i Acceptance criteria contained ie-delay tri I upon generic circuit breaker informati nstalled~in the licensee's motor n the 3.7.5 Inservice Testing Pr on and ogram control kplem nted oThe inspection team reviewed th

obsarva

tions n.the HPCI/FW and core spray'syste licen

[ p (1): The licensee. ems and made the following program as had not 'because it was not con. implemented the IST pro discharge of the feedwateparticularly concerned because i ~ t appeare or inspected. r and booster pum.d that check valveh at theThe t'eam, A gross functional check of th . pump discharge check valve was conducted o ps were not adequately tested but this. test did not accurately internal components e motor-driven feedwater measure the integrity of the puarterly wh i damage.could cause a loss'o. I f the motor-driven pump becaFailure of the f l Such a loss had previously o ump reported by 1 use of reverse rotationalp disch booster pump.ER 83-35. !; e Undetected failure of both th ccurred on November 5, 1983 and w discharge check valves could . pressurizatic n 1 1 , Th3 licensee could not adequately im lof cond e feedwater and as result in inadvertent over-imargin betwean the design ch'and: trending an core sp e piping. em MOVs and pumps because of ins f M-i operability requirements. aracteristics and the Technical S

wIra to~ degrade to the alert esting Before flow from the core spr Rumps would be declared i u icient IschnicalSpecificationrequirements noperable because they would notrange of specification as pgradsd by 25 percent to the action range,ilarly ne flow, the noperable by Technical Specificati Sim meet the bd3 performance trending'by the license on requirements.the valve would be declared mes klicsnsee 'did not specify the required inlet p Th e ineffective. is design feature

~ ) ray pumps as required by ASME C g

a. core spray pumps did not vary app,reciably duri ode Section XI.

sure for their core The inlet pressure for ng testing because the ~

L e g., n m.y pumps take suction on the torus and the torus level.was maintained in a . narrow band by.the Technical Specifications. the team did n'ot. consider this deficiency to be sipificant.Because of this consisten .(4). The data 'obtained during pump' flow testing was inconsistent with the pump testing..The licensee only measured pump flow and not pump head during curves. throttled position of the test valves.It was assumed that the system resistance However, the team'. reviewed the test results and concluded that the measured flow variations could mean that the pump head was fluctuating by as much as 15 psig. A.possible . explanation was that the pump mini-flow relief valve was unexpectedly-opening or leaking, thereby diverting flow from the reactor and changing r . system resistance. The licensee stated that this should not occur because-the relief setpoi_nt (320 psig) was above the pump test pressure (300 psig). Durin the licensee,g the inspection, th% ir. consistency could not be resolved by but will be unresolved as part of the verification of core spray system testing concerns-(unresolved item 50-220/88-201-07). 3.8. -Quality Assurance and Corrective Action Programs The inspection team reviewed the licensee's_' programs for ensurin' quality in .the plant and taking prompt corrective actions when deficiencies were identi-g fied from industry sources and.within the' plant. The specific documents reviewed are listed in Appendix B to this report. It appeared that the licensee's corrective action program was weak in investigating plant problems and reviewing available industry information. Additionally, the licensee had - previously identified improvements for the QA Audit and Surveillance Prograts which appeared to be implemented for the QA Surveillance Program and in progress for the OA Audit Program. 3.8.1 Corrective Actions for LOCA Analyses Results The inspection team reviewed the licensee's corrective actions taken with regard to the concern about the adequacy of the 7-day LCO for the core spray system discussed in Section 3.1.1 of this report. The inspection team deter-mined that the following sequence of events were pertinent: ,i In 1974, Technical Specification 3.1.4 was issued for the core spray system as part of the initial license. The system contained two loops with two pump sets per loop and was thought to be 400 percent 3 redundant. The LCOs were established at 15 days for one disabled y, b! pump set and 7 days for one loop out of service. i ~' In October 1975, the initial 10 CFR 50, Appendix X LOCA Analysis was performed assuming two core spray loops were always available. The a analysis used the SAFE / CHASTE Computer Model which identified the small l breah LOCA as the limiting (2200 F) condition.for reaching the 10 CFR 50 for peak clad temperature This analysis became the bases for a proposed amendment to the Technical Specification fuel limits submitted on October 31, 1975. The core spray system LCOs were not identified for revision to be consistent with the LOCA analysis design inputs as part of a this proposed amendment. l In 1983. GE Report NEDE 30241, " Performance Evaluation of the Nine Mile Point Unit 1 Core Spray Spranger," was performed, using a new SAFER /COPEC00L - - _ - - _ - - - _ - _ _ _ _ _ _ _ x _.

- g + . Computer Model to evaluate core s ray sparger operation in a steam . environment. ~ Although not formalky used as a bases for Technical . Specification limits, this more accurate analysis showed that the small break LOCA was no longer the limiting condition.for meeting 10 CFR 50.46-limits;. analyzed peak clad temperature for the small-break LOCA was now approximately 300 F below the limit. In June 11987, 10 CFR 50, Appendix K LOCA Analysis (NEDC 31446P) was. perfomed usin Specification ~g the SAFER /COREC00L/GESTR Model to determine Technical 11mits for. the next operating cycle.' The analysis assumed'that.two core spray loops were always available to support LOCAs. On August 17,1987, personnel. from Operations. Engineering and Licensing met to discuss a~ potential problem with an existing Technical Specifica-tion LC0 for the' core spray system and NEDC 31446P assumptions. The. concern was that.the 15-day LCD should be reduced to a 7-day LCO to be consistent with NEDC 31446P. Internal memoranda dated August 19 and 25, 1987, documented the meeting results and-indicated that the group decided the existing 15-day LCO was acceptable under the new analysis..The adequacy'of the existing 7-day LC0 for NEDC 31446P,was not discussed at the meeting. The licensee had contacted GE prior to the meeting and was told that the LCOs were both adequate as written. On September 1, 1987. Engineering issued an internal memorandum which i.dentified; that the' 7-day LCO for core spray system may be an unanalyzed condition by NEDC 31446P and require revision before the next. operating cycle. This memo wasf distribute ~d to Op'erations personnel but not the Licensing organization. On September 22, 1987, Licensing issued a memorandum in response to concerns raised at the August meeting which stated that the 15-day LCO should be changed to a 7-day LCO to be consistent with NEDC 31446P and other LCOs. The memo also identified that previous 10 CFR 50, Appendix K LOCA analyses had assumed two loops of the core spray system to always be available. The existing 7-day LCO was not discussed as being an unanalyzed condition. On November 10, 1987, operators took one loop of the core spray system out-of-service for 17 hours to repair a leak from a check valve. The operators entered the 7-day LCO without realizing it was an unanalyzed gj condition. a On December 19, 1987, the plant entered an extended outage after a i feedwater transient event. "] On August 23, 1988, after realizing that the 7-day LCO was an unanalyzed condition, the licensee drafted a Technical Specification Interpretation that ' prevented entering the 7-day LC0 for the core spray system. This . interpretation was still in the review process at the time of this inspec-tion, but was to be issued before startup. mj On September 15, 1988, the NRC. inspection team determined that the 7-day LCO was an unanalyzed condition by the licensee's 10 CFR 50, Appendix K 1 _ _ _ _ _ _

LOCA analyses and that the plant had entered the 7-day LCO when operating on November 10, 1987. The licensee completed the proper investigation and NRC reports upon notification by the team. In a September 22, 1988 letter to the licensee, GE confirmed that using only one core spray loop and the previous 10 CFR 50, Appendix K LOCA analyses assumptions, the SAFE / CHASTE Model Analyses would yield a higher analyzed peak clad temperature then previously determined. This new value wuuld be above the 10 CFR 50.46 limits. however, the GE letter also stated that previously used conservative design input assumptions concerning pump delivery pressure could be changed to reduce the analyzed peak clad tempera-ture below the 10 CFR 50.46 limits. The team agreed with this assessment and concluded that the previous SAFE / CHASTE Model Analyses could be revised to indicate acceptable results with one core spray loop. The inspection team was concerned about the licensee's corrective actions in this situation and drew the following conclusions about the sequence of events: ~ (1) The licensee's corrective action program was ineffective for resolving a potentially significant deficiency identified with the Technical Specifications for the core spray system that would allow plant. operation in an unanalyzed condition. Collectively, sufficient informationtwas available with the licensing, operations and engineering organizations to determine that the existing 7-day LCO was an unanalyzed condition before the plant unknowingly entered the 7-day,LC0 on November 10, 1987. The team found no evidence to suggest that the' licensee realized this fact until after the plant entered the current outage. (2) The licensee failed to take adequate corrective action to investigate and report the problems with the 7-day LCC when it was first realized in approximately August 1988. The corrective actions were limited to crafting a Technical Specification Interpretation. No investigation of previous operations was conducted to determine whether the plant had previously been operated in an unanalyzed condition; the NRC was not notified in accordance with 10 CFR 50.72 and 10 CFR 50.73; and a Technical Spec.ification change was not promptly initiated. (3) The initial cause of the problem appeared to be the improper translation of the 1975 10 CFR 50 Appendix K LOCA Analysis assumptions into Technical Specification requirements as required by 10 CFR 50.46. The licensee's failure to properly implement the requirements of 10 CFR 50.46 to revise its Technical Specifications to conform with the LOCA Analyses specified in 10 CFR 50, Appendix K and the failure to take adequate corrective action and make necessary reports to the NRC will remain unresolved as part of an overall unresolved item on the licensee's corrective action program pending followup by the NRC (5,0-220/88-201-09). 2.8.2 Corrective Actions for MOV Testing Results During a review of the MOV stroke time test results for core spray and HPCI/FW system valves, the inspection team identified three valves which appeared to have stroke times in excess of the Technical Specification limits; Core Spray System Vent Valves 40-30 and 40-31 and Feedwater Isolation Valve 31-07. In LER 88-14 (May 10, 1988), the licensee identified that Valve 40-30 stroke x

( i times had been out of specification since 1986. The root cause of the problem f was that indicating lights used to measure valve stroke times and the limit switch contacts used for the torque switch bypass function were driven from the same limit switch rotor. The limit switches were adjusted to provide adequate torque switch bypass functions but no adjustments were made for the valve stroke time detenninations. ' The inspection team review applied the same criteria described in' LER 88-14 for detennining actual valve stroke time from the measured stroke time during testing. For Feedwater Isolation Yalve 31-07, the most recent M0 VATS testing in 1986 indicated a disc bypass margin (DBM) of.886 (52.2 sec/58.9 sec). The DBM was the' fraction of valve travel measured by the indicating lights. There-fore, applying this DBM to a Technical Specification limit of 60 seconds for valve 31-07 would yield a measured acceptance valve limit of 53.2 seconds. A review of test results for Yalve 31-07 revealed measured stroke time of 55.8 seconds on January 25, 1986, 56.0 seconds on June 14,.1986 and b5.0 seconds on i October 21, 1987. The team concluded that each of these stroke times were above the Techni. cal Specification limits. For Valve 40-31, no M0 VATS data was avail-able for the most recent limit switch setp'oints, but data from the licensee's September 18, 1986 response to NRC Bulletin 85-03 " Motor Operated Valve Common Mode Failures During Plant Transients Due to Improper Settings," indicated that the closed torque switch was bypassed by 23 percent yielding a DBM of'.77. Applying this calculated DBM to a Technical Specification limit of 30 seconds yielded a measured acceptance valve of 23.1 seconds. This measured acceptance value had been exceeded 17 times during monthly stroke time tests since August l 1986. This issue of adequate investigation of. reportable events will remgin i unresolved as part of an overal1' unresolved 1. tem on the adequacy of the licen-see'sfcorrectice' action' program (50-220/88-201-09). 3.8.3 Operational Experience Assessment Program The team reviewed the adequacy of the licensee's Operational Experience Assessment (OEA) Program which included the review of documents such as NRC Information Notices and Circulars, INPO SOERs and SERs, and General Electric Company Services Information Letters (SIls), as well as interviews with licen-see personnel involved in the OEA program. Overall, the licensee's OEA program was weak. Discussions with licensee personnel revealed that the program was formalized around 1982 and responsibilities were assigned to the Technical Support Group as part of their job responsibilities without establishing a separate OEA group. This mode of operation continued until August 1988, when a group with specific responsibilities for OEA was established. The following specific concerns were identified during the inspection team's review: (1) Internal Memorandum NMP 31552 of March 10, 1988 closed out 11 related NRC Information Notices, INP0 SOERs and INP0 SERs concerning valve mispositioning because of human error during operations and maintenance activities. The response addressed the specific issue of valve mispositioning, but did not address the broader concerns of equipment, instrument and component labeling identified by NRC Information Notice 87-25 and INP0 SOER 85-2. Plant walkdowns conducted by the team revealed a labeling program that was below industry standards, and there did not ( appear to be a significant effort being made by the licensee to improve -M-

s* plant labeling. Additionally, the licensee stated in HMP 31552 that training of non-licensed operators in the manipulation of all of the m types of valves installed in the plant was conducted in theory lesson or NLT-20 " Nuclear Power Plant Fundamentals - Valves. Traps and Pip i included training on how to position the valve and how to verify its j position when performing a valve lineup. not included in the planwas renumbered as OPS-1-NLO-002-T20-activities to teach new o;perators this information.rather, the licensee relie , OEA memorandum appeared to be in error. The information in the error because an NRC Augmented Inspection Team had identified a J concern at Nine Mile Point Unit 2 as a contributing cause to an event as discussed in Inspection Report 50-410/88-01. (2) Internal Memorandum NMP 30292 of March 14, 1988 check valve failures.Information Notices, INPO SERs and an INP0 SOE I! Valve Failures or Degradation."The response concentrated on INPO SOER 86-3, " Chel INPO document encompassed all the issuds identified by the oth ments. INP0 SOER 86-3 discussed undetected check valve failu misapplication of the valve in the system and inadequate preventive maintenance. The 50ER made recommendations for improved testing and inspection of check valves and a design review to determine whether the propr valves were installed in the correct locations for the intended functions. nuclear service water, diesel starting air, suppression p main feedwater'and residual heat removal systems. the following concerns with the licensee's internal response:dentified The t.eam i (a) The memorandum referenced five related check valve failu from the period of August 1982 to June 1986 and concluded that this was an acceptable performance for ten years of operation. was concerned because it appeared that the number of check valve The team failures was increasing as the plant aged. i i (b) The response to the recommendation for improved testing and maintenance practices for check valves were in com regulatory requirements of 10 CFR 50, Appendix B and ASME Code, Section XI and that all the recommended systems were included in the program. Therefore no additional testing was required. This response appeared inconsistent with licensee practices since HPCI system check valves were not included as part of the IST program./FW The licensee performed a review of plant isometric diagrams, j (c) purchase orders and some visual inspections of check valves to satisfy the design review recommendation. Although this review identified several instances of improper location and orientation problems with these valves had previously been identif maintenance history. a The team concluded that the licensee was not taking advantage of the because NMP-1 had not experienced similar failures.informatio i I 9

(3) IE Circular 78-15 advised of problems with Anchor Darling tilting disc valves failing to close when installed vertically and requested licen-sees to verify the installation of similar valves to ensure adequate operation. The licensee closed this document with an internal memorandum dated November 17, 1978 which stated in part that "All check valves installed at Nine Mile Point #1 are horizontally installed Chapman Tiitir,g Disc Check Valves." Contrary to this statement, the team noted during plant walkdowns that the Core Spray Topping Pump Discharge Check Valve" 1 (81-07, 81-08, 61-27, and 81-28) were installed in the vertical position,- j along with check valves on the discharge piping of the RBCLC pumps and the condensate booster pumps. Thus, the team concluded that the licensee's l review of the concerns of IE Circular 78-15 appeared to be inadequate. l (4) GE SIL 375 addressed concerns with potential water hammer effec.ts caused by inadequacies in the keep-fill subsystems for emergency core cooling ] (ECCS) systems on BWR-4, 5,.and 6 designs. The licensee closed this document with an internal memorandum that noted that the concern was not j pertinent to NMP-1 since it was not one of the specified reactor designs. l At the top of the file memo was a note indicating that the plant did have a kesp-fill subsystem for the core sp' ray system, but no further evaluation-was evidently made. The design review conducted as part of this inspection identified in Section 3.1.5 of this report the potential for { water hanrner during a LOCA because of the location of the injection point for the keep-fill system. The team concluded that an adequate review of the subject document was not made, resulting in the conclusion that the -document was not applicable. ~ (5J. The team identified several instances where closure documentation was either not in the file or the closure documentation had notes that inoicated the response was not acceptable for closure. Examples of these were GE SIL 300, 323, and 375 and IN 84-37 and 85-76. The licensee had not resolved these discrepancies by the close of the inspection. (6) At the time of the inspection, the licensee had approximately 336 OEA items remaining open. The licensee had increased its staff with contrac-tors to review each OEA item before startup. This review, however, would not include past responses to industry items. 1 At the inspection followup meeting, the licensee stated that the inspection i team's findings were examples of past practices of industry information review and not indicative of the current program. The team agreed that the current program was not adeonately reviewed by the inspection sample, but was concerned that previous responses were not being reviewed. This issue will remain i unresolved pending NRC followup review of the licensee's prngram for evaluating industry information (50-220/88-201-10). 3.8.4 Quality Assurance Program The inspection team reviewed two quality assurance (QA) functions during the inspection; audits and surveillance. Selected QA audit and surveillance reports for activities similar to the areas covered by the NRC inspection were reviewed by the team to determine whether the licensee's internal QA organization was i capable of finding significant technical issues. The specific documents reviewed -

1 I are included in Appendix B of this report. The following observations were made by the team during the review: (1) Recent QA Surveillance Reports have identified significant and credible findings. Tso examples were the improper wiring found in the auxiliary control room cabinets during Surveillance SR88-20238 and the improperly performed snubber inspections identified during Surveillance SR88-203SI. In each case, the identification of the deficiency allowed the licensee to correct the problem before it was identified by external sources such as a plant event or an NRC inspection. (2) Past QA Audits for operations, maintenance, surveillance testing, and design modifications appeared to be programmatic and compliance oriented. The audits were limited to verifying that the existing procedure steps were being accomplished and documented properly, but did not verify that the steps were correct for the circumstances in the plant. Licensee management explained the difference between the QA audit and surveillance i programs as a delay in obtaining results from previous QA training. Earlier in 1988, the QA Department had initiated training and hiring to redirect the depart-ment to more technical, event-oriented audits and surveillance. The results of this redirection have been evident in the OA Surveillance Program because of the real-time nature of the program. The QA Audit Program had not yet benefited from l the redirection in the areas reviewed by the team because audits had not been comp.leted since the improvements were initiated. The team agreed with this conclusion, but was concerned that performance based audits should be completed in key areas to provide the licensee with assurances that quality activities are being adequately performed'before plant restart. 9 P' i e

j> t s. 4.0 MANAGEMENT EXIT MEETING 1 On~0ctober_17,41988 an exit meeting was conducted at the site'upon'the " conclusion;of the onsite inspection.- The licensee representatives at.this exit meeting are indicated in Appendix A of this. report.- Mr.:C.-J. Haughney, Chief, SpecialiInspection Branch, NRR; Mr. R. Capra, Chief,' Project Directorate.I-1, NRR; and Mr..J.LJohnson. Chief, Reactor Projects Section.20. Region I. represented NRC management at this' meeting. The scope of the inspection'was discussed and the licensee was informed'that the inspection would continue'with furtherfin-office data review and analysis by the team members..The team members presented their findings and responded to licensee questions. The licensee was11nformed that some of.the findings could become potential enforcement findings. On.0ctober:26, 1988 the NRC issued a letter summarizing the significant< findings of the. inspection for the licensee's restart planning purposes. A meeting'was subsequently conducted on November 17, 1988 between the NRC and the licensee to discuss the status of resolution of the findings discussed in the NRC letter. The results of this meeting.were documented in an NRC letter of November 23, 1988. 4 0 I I F

V k + 1 l APPENDIX A I Personnel Contacted' ~ l Organization R.' Abbott 'J. Aldrich NMPC Coord. SOER Review and Evaluation 'W. Bandla-NMPC Station Super.. Tech; Assist. h cP. Bartolini NMPC Assistant Operations Supervisor '*C.:Beckham NMPC Mechanical Design Basis Contact 1 'K.'Belden NMPC Mgr. Nuc. QA Ops cJ. Benzing NMPC Operations-C. Bessel. 'NMPC Assistant Maintenance Manager NMPC Operations .SL. Blasiak F. Borden-NMPC Electrical Consultant T. Breigle. HMPC Electrical Maintenance R. Butchington- .NMPC QA'. 4 C. Caltabiano NMPC Nuclear Inservice Inspector NMPC Mechanic-C. Cary W. Connally. NMPC Supervisor Training Nuclear NMPC QA-W. Cook -P. Close-NRC Senior Resident Inspector -*K.'Dahlberg NMPC Maintenance Evaluator. 1

• J. Dillon NMPC Unit'1' Station Superintendent
• S.

Domago-NMPC Supervisor QA Audits CP. Eddy .NMPC Assist. Ops. Supt. NMPC Site Representative -T..Egan (M. Falise. NMPC Engineering. R..Fenton NMPC Site Mech. Maint. Superintendent. C. Fischer NMPC Senior QA Technician

• P. Francisco NMPC Elect. Maint. Superintendent

M. Gasser NMPC Salina Meadows Team Leader.

'*D. Goodney 'NMPC Modification Consultant ..D. Green NMPC Modification Engineer (W. Hansen .NMPC Core Spray Cognizant Engineer H. F. Howley NMPC Mgr. Compliance QA D. Jakubowski NMPC Asst Supt.- Const. & Maint. W.: James-NMPC Battery Engineer - . L. Klosowski NMPC Supervisor Inst. and Control i T.' Kolceski' NMPC SSRI Team Leader I c 'Kronenbitter NMPC Operations

'.. Lachut -

NMPC Technical Support Engineer C. Lass NMPC Assist. Supervisor Mech. Maint. NMPC Mechanic R.,Longo A. Loveland NMPC Supervisor Mech. Maint. Nuclear

• C Mangan NMPC I&C Engineer

'J. Marshall NMPC Sr. Vice President, Nuclear

• k J

(M. Masuicca NMPC Erosion /Corrosfon Engineer ( 'R. Matteson HMPC Operations 4

• P.. Mazzaferro NMPC Chief Shift Operator E. McCaffrey NMPC Technical Support S. McCoy NMPC NPRDS Coordinator NMPC Supervisor of Stations as i i

1 1 1 e I a-t

- ;;G x j 1 APPENDIX A - Continued j . Personnel Contacted Organization G. Montgomery NMPC QA Surveillance Engineer $t'.. ' Mosier NMPC HPCI Cognizant Engineer T.*Newman. NMPC Quality Eng. and QC Supervisor 4L. Nowicki . NMPC Electrical Consultant-K. Parlee NMPC Assistant Mechanical Design Engineer J. Parrish NMPC Station' Shift Supervisor N. Patrou NMPC Operations i D. Pike NMPC Audits.and Reports J. Porter NMPC QA Technician CD Pracht NMPC Sr. Nuclear Engineer y (N. Rademacher NMPC Director of Compliance M. Randall' NMPC Chief Shift' Operator M. Restani NMPC Auxiliary Operator B

• T.

Roman NMPC Assist. to Vice President, Nuclear F. Slye e NMPC QC Lead U. nit 1 C. Soucy NMPC Supervisor Training Nuclear J. Spadafore NMPC Site Appendix J Test Engineer

• R. Strusinski NMPC Operations
• C Terry NMPC V.P. Nuclear Eng. and Licensing R. Tessier.

NMPC Outage Manager L. Wambsgan NMPC QA> . G. Whitaker NMPC Generation Engineer, Mechanical P. Wilde NMPC QA Surveillance Group Superintendent

• J. Willis

- NMPC General Superintendent P. Wolfe NMPC Licensing Engineer

• T.

Wood NMPC Training

• A. Zallnick NMPC Assist. to Senior Vice President, Nuclear
• Attended exit meeting on October 7, 1988, i

I ll 9 E -- --- _. ^-2

~ APPENDIX B Documents Reviewed . - 1. Electrical and Mechanicnal Design Documents: 125 VDC-Batt11ES "BatterySizing) Calc-59 Cells," Revision 1, (April 21,1988 'l 125 VDC-Batt12ES " Battery Sizing Calc - No spare capacity," Revision 0, (July 21, 1988) 125 VDC PB-16 " Power Board 16 Feeder Cable Voltage Drop," LF/VD. Revision 0, (July 21, 1988) 120 VAC-RPS11 " Reactor Core Spray Instrumentation Circuit Fuse 11 Loading," Revision 0, (July 20, 1988) 125 VDC-Train 11 '" Battery 11 Fault. Current," Revision 0, FS (September 20,1988) DC System Study "125 VDC Circuit Breaker Coordination Study." (February 28,1983) 600 V System Study "600 VAC Circuit Breaker Coordination Study," (July 11, 1969) 4160 V/115kV "Overcurrent Relay Coordination for Powe'r Boards System Study 11/12 and 101, 102, 103," (July 20, 1969) Fault Study "4160 V Power Board Relay Settings," (June 14,1965) Relay Setting "4160 V Power Board Relay Settings," (May/ June' 87) Load Study " Power Distribution Load Study and Test Data," (December 10,1981) Specification " Technical Requirements for the Rewind and Repair of i E-1241 Motors at NMP 1," (July 1, 1986) Work Requests WR 111270, 014032, 010566 G35337, 1 ki Maintenance N1-EPM-GEN-4Yl82, N1-CPM-GEN-R120 Procedures .? l Surveillance N1-ESP-SB-W276', N1-ESP-SB-R277, N1-ESP-SB-4Y272, Procedures N1-ST-R2, N1-ST-R2 1 Pump Motor GE205-61245#2(FWBP),RT 224657(FWP), Data Sheets RT MSJ 540(CSP), GE 309-90846-2(CSTP) VTP 17964-67 " Core Spray Pum Performance (BHP vs Flow)," 8 L (March 13, 1968 l i B-1

4 P-450105 (March 7, 1968)" Core Spray Topping Pump Perform Test Data Bennett's Bridge," (June" Test of HPCI System at t 27,1974) C-35843-C " Reactor Vessel Inst. Level Points, and Water Volumes," Ranges, Actuation File Code Rev. 1, (July 24, 1985) Pressure Relief Valves," (August 5,1987) NMP27205 Pump Curves P-443812(FWBP). E-206541(FWP)VRP-17964 B831005-74-11 " Flexible Ball Joint," Rev.C.(August 3,1966) \\ Unnumbered Calc. 4 "Startin Bridge,"g Feedwater Booster Pump from Bennett's I (Notdated) L Unnumb$ red Calc. (Notdated)" Starting Feedwater Pump from Bennett's Bridge Unnumbered Calc. " Calculation of Core Spray System Head Loss," (1/9/67) NMP-1 Core Spray, System Response to NRC k SSFIQuestions(Completepackage. including. i i references prepared b y MPR Associates, Inc.)," (September 29,1988) Unnumbered Calc. "High Pressure Coolant Injection Response to tlRC ( g SSFI Questions (Complete package including references prepared by MPR Associates, Inc.)," (October 3,1988) Unnumbered Calc. "MPR Calc Pressure,"., Core Spray Flow Rate vs. Reactor Vessel l. (September 16,1988) [ Unnumbered Calc. "MPR Cale. [ Pressure,",(JulyCore Spray System-Flow vs. Delivery V 13,1982) Unnumbered Calc. "MPR Calc., Core S (November 4,1982) pray System Flow Calculations," Unnumbered Calc. "MPR ltr., McCurd Characteristics,"y to Greene re Core Spray System (November 17,1982) Unnumbered Calc. "GE ltr., Aaugello to Tetley re LOCA Program Phase III," (April 22,1987) i. _ Unnumbered Calc. ltr.," (May 4, 1988)"NMPC ltr., Tetley to Augello, response NEDC-31446P as ; Class III "Nine Mile Point Unit One Safer /Corecool/Gestr-LOCA LOCA Analysis (GE)," (June 1987) l l l B-2 _________-___-_____-a

g w m y I ( 3[ .y ) Unnumbered Calc. " Calc. of Condi &'FW System Flow Resistance," .(November l10,1964) j j - *L

Req. 309-

"Feedwater Control System Design Criteria," 1 '90800 (July 1, 1964)" J 22A1350 '" Core Spray System Design Specification," Rev. O,. .(April 12,1968) - t System ~ "Cond. and FW Systems Function Spec. and Design' Description 20 Criteria"-

2. Testing Procedures:

N1-ISI-FUN-307. "CoreL Spray Functional Pressure Test," Rev. 0 N1-ISI-HYD-81b " Reactor Core Spray System Hydrostatic Pressure '81.1/93.1 ~ LTest," Rev. 3 + N1-ISI-HYD-424 " Reactor Core Spr'ay System Hydrostatic Pressure- ~ -Test," Rev. O and 1 N1-ISI-INS-203 "Feedwater Inservice Pressure Test," Rev. 0 -N1-ISP-R-031-502 Reactor Containment Isoolation Valve Leak Rate- -Test," Rev. 0 N1-ISP-R-040-501 " Type 'C' Containment Isolation Leak Rate Test

Core Spray High Point Vent Yalvesi " Rev.:0 N1-ISP-R-058-501'

" Type "C" Containment Isolation. Leak Rate Test Torus Water Makeup Flange," Rev. O N1-ISP-R-093-501 " Type 'C' Containment Isolation Leak Rate Test Raw Water Intertie To Core Spray Valves," Rev. O N1-ISP-R-201-514 " Type "B" Double Gasketed Seals Leak Rate Test Core Spray Flex Ball Joint Flange" N1-ISP-24.7 " Core Spray System Check Valves Keep-Fill System Leak Rate Test," Rev. I and 2 N1-ST-C3 " Automatic Start-up of High Presseure Coolant Injection System," Rev. 4 q 'N1-ST-IC3 " Core Spray Redundant Component or System Operability Test " Rev. 3 N1-ST-ICS- "High Pressure Coolant Injection Surveillance with Inoperable Component Test," Rev. 4 .N1-ST-Q1' " Core Spray Pumps and Motor Operated Valves Operability Test " Rev. 2 j 4 B-3 1

4 o 1 e e N1-ST-Q3' "High Pressure Coolant Injection Pump and Valve Operability Test,".Rev. 3 i-j N1-ST-R9 " Core Spray System Operability Using 1 Demineralized (C.S.T.) Water," Rev. 6 l f N1-ST-Y10- " Core Spray System Check Valves Leakage Test," l Rev. 0 i 3. Maintenance Procedures and Documentation f i N1-MSP-GEN-V353 " Snubber Visual Inspection," Rev. 1 Administrative 'AP-5.0, AP-8.1 Procedures Maintenance S-MI-GEN-004, S-MI-GEN-003, S-MI-GEN-002 Instructions J e Maintenance N1-NMP-81-501, N1-ISP-M.036-005, N1-MPM-29-R126 I Procedures N1-EMP-81E-201, N1-NMP-31-210, N1-NMP-51-100 N1-NMP-29-209, N1-NMP 29-211.2 hl-NMP-29-211.1 N1-NMP-30-248, N1-NMP-81-112, N1-NMP-81-113 Training NTP-9, NTP-3, NTP-7 . Procedures l

4. -

Operations Procedures and Documentation N1-ICP-C-49 " Condensate Hotwell Level," Rev. 6 S-SUP-Q6 " Control of Operator Aids." Rev. O N1-ST-SO " Shift Checks " Rev. 14 N1-ST-D0 " Daily Checks," Rev. 17 Station Guides " Operators Rounds Guides" [ Station " Station Shift Supervisor Instructions" Instructions OJT Manual "Non-Licensed Reactor Operator Candidate OJT Manual, System 209. Core Spray System," Rev 0 'I 00T-Manual "Non-Licensed Reactor Operator Candidate OJT Manual, j System 206, High Pressure Coolant Injection System," { Rev. O I Administrative AP-3.4.2, AP-4.0, AP-3.3.1 AP-4.1 i Procedures 3 Maintenance N1-IMP-209-J, N1-PM-Q3, N1-PM-QS I Procedures I B-4

E ) 'I,., j l ' Operating N1-0P-2, H1-SOP-5, N1-0P-15A, N1-0P-15b, N1-0P-16, N1-0P-20, N1-0P-30, N1-0P-33A, N1-0P-43, N1-0P-45, Procedures N1-0P-46, N1-0P-47A, N1-SOP-6 E0P-1 thru " Emergency Operating Procedures," (5/12/88) E0P-10 5. Quality Assurance Procedures and Documents QAP'15.01 " Control of Nonconforming. Items,",Rev. 5 Work Requests WR 127355, WR 131849 QA Surveillance Reports: SK-88-20270, SK-88-20308, SK-88-20238, SK-88-20271, SK-88-20351, SK-88-20296, SK-88-20297, SK-88-20247, SK-88-20381, SK-88-20366, l SK-88-20259 QA Audit Reports:

1. 87025-RG/IN, #SY-RG-IN-86012, NM-RG-IN-86021, NM-RG-IN-87006, SY-RG-IN-86015, SY-RG--86012, RG-IN-87025, SY-RG-IN-87007, SY-RG-IN-87025, SY-RG-IN-88003 Nonconfor1 nance Reports:

NCR 1-87-0027, NCR 'l-87-0061,'NCR 1-814'004 NC'R 1-88-0003.- NCR 1-88-0005, NCR 1-88-0006, NCR 1-88-0008 Corrective Action 88-2030, 88-2033 Requests " Core Spray System Loop 12 Inoperability Oue to Weld Occurrence Report 87-326 Reapir of Valve 40-03" 6. Safety Evaluations Modification Evaluation Number Title 86-005 Diesel Generator Upgrade N1-82-92 86-013 Fixes from Detailed Control Room 83-58-2 Design Review f 85-108 86-016 Rev 1 Rerouting of the Core Spray System i Control Cables f Local Leak Rate Testing of Feedwater NA 86-059 Isolation Check Valves Use of 100 psi Air to Simulate Reverse Flow 86 ' 87-016 DCRDR Phase II B-5

s. d.

1 ATWS - Increased Liquid Poison i 87-029 Rev 1 Injection Capability 87-066 88-003 Rev'1 ' Emergency Generators' Diesel. Fuel l Storage Tank Replacement .m ; NA Analysis of Lost Part in Feedwater 88-009 Rev-System NA Reflect the Nuclear Division Organi-88-013 zation as of May 31, 1988 kB ??* hm ) i i y j. l \\', ~ i I i 'f i B-6 I

C-APPENDIX C i l Unr: solved Items Report Section Description 3.1.1 Number 10 CFR 50.46 Technical Specification Amendment 01 Core Spray System Design Deficiencies 3.1.2 i 3.1.3 .i System Performance CurvesNet Positive Suction Head Analysis 02 3.1.5 y (a 3.1.6 (b Susceptibility to Water Hamer 3.1.7 (c Adequacy of Alarm Setpoints

== (d(e) Control Room Flow Indication 3.2.1 l l HPC1/FW System Design Deficiencies 3.4.2 03 Design Documentation Deficiencies 3.5.1 04 E0P Deficiencies 3.5.5 05 Operator Aids and Procedures Deficiencies 3.7.1 t 06 Core Spray System Testing 3.7.2 {- 07 HPCI/FW System Testing 3.8.1 and 3.8.2 ,08 Corrective Actions and NRC Deportability 3.8.3 09 Operational Experience Assessment Program 10 i l ,.)' l L 1 l l C-1 s

@ s8 C(

1. f'g o,

UNITED STATES 8 NUC,LE AR REGULATORY COMMISSION o g y . WASHINGTON, D. C. 20$55 g...../ j September 22, 1987 i I Docket No. 50-298 Nebruska Public Power District i ATTN: Mr. George Trevors, Manager Nuclear Support Division Nuclear Power Group P.O. Box 499. Columbus, Nebraska 68601 i Gentlemen:

SUBJECT:

SAFETY SYSTEM FUNCTIONAL INSPECTION REPORT NUMBER 50-298/87-10 i This letter forwards the report of the Safety System Functional Inspection i perform d by an NRC inspection team over the period May 11 to June 19, 1987, involving activities authorized by NRC Operating License Number DPR-46, for the Cooper Nuclear Station. This inspection was conducted jointly by members of Region IV, the Office of huclear Reactor Regulation, the Office for Analysis .t and Evaluation of Operational Data, and NRC contractors. At the conclusion of the inspection, the findings were discussed at an exit meeting with you and those members of your staff identified in the appendix to the enclosed inspec-tion report. l The NRC effort involved an assessment of the operational readiness and functionality of the emergency electrical system and auxiliary support systems. Particular attention was directed to the details of modifications and design control, maintenance, operation, and testing applicable to the systems. Additionally, the prograns for assuring quality in these areas were reviewed to determine their effectiveness, i The team identified weaknesses regarding the functionality of your emergency electrical; heating, ventilation and air conditioning (HVAC); and service water systems. These weaknesses included concerns that the station batteries, emergency transformer, startup transformer and 4160 Yac switchgear may not be properly sized to perform their safety function during design basis accidents; the HVAC system may not provide adequate temperature control for the ac switchgear, de switchgear and battery rooms during both normal operating and accident conditions; and the operating procedures, training and testing of the service water system did not ensure that adequate cooling would be provided to essential safety loads during design basis accident scenarios. Additionally, I significant deficiencies were noted with the implementation of your program j for identifying, reporting and correcting significant conditions adverse to f i 5 l 47

r. I Nebraska Public Power District 2-quality. These issues are sumarized in Section 2 of the enclosed report anc Section 3 of the report provides the detailed inspectier findings. Some of these items may be potential enforcement findings. Any enforcement actions will be identified by our Region IV Office. We recognize that you have either already taken or plan to take corrective actions relating to several of our concerns. At the Management Meeting held at our Region'1V Office on June 30, 1987, you addressed your corrective action-program for some of the more significant functionality issues. The status of this program was documented further by your letters dated July 24, 1987 and August 14, 1987. While planning corrective actions based on the weaknesses identified in the enclosed report, it is important that you realize that the focus of this inspection was only on the emergency electrical system and auxiliary support systens. Therefore, consideration shculd be given to identifying and correcting similar problems in other essential systems. Furtherineetings and inspections will be scheduled to pursue resolution of the - significant issues. To assist with the scheduling of these followup actions, we request that you respond to the significant findings identified in Section 2 of this report within 60 days. Given the numerous weaknesses identified with your engineering programs, your response should specifically address your intentions for assessing the design adequacy of additional systems and actions planned.for providing greater assurance that the design bases for all plant systems are maintained during future modifications. In accordance with 10 CFR 2.790(a) a copy of this lettee and the enclosure will be placed in the NRC Public Document Room. Should you have any questions concerning this inspecticr., we would be pleased to discuss thera with you. Sincerely. ] ~~/g 1 e Den N. Crutchfield, rector Division of Reactor Projects III/IV/V and Special Projects Office of Nuclear Reactor Regulation

Enclosure:

Inspection Report 50-298/67-10 cc: See next page l

liebraska Public Power District cc: w/ enclosure Guy R. Horn, Division Hanager of Nuclear Operations Cooper Nuclear Station P. O. Box 58 Brownville, Nebraska 69321 Kansas Radiation Control Prograra Director i Nebraska Radiation Control Program Director Institute of Nuclear Power Operations 1100 Circle 75 Parkway Suite 1500 Atlanta, Georgia 30339 SenjorResidentInspector Cooper huclear Station P. O. Box 216 Brownville, Nebraska 68321 1 l -__-_-_..-__--------------N}}