ML20248C747
| ML20248C747 | |
| Person / Time | |
|---|---|
| Site: | Pilgrim |
| Issue date: | 05/27/1998 |
| From: | Olivier L BOSTON EDISON CO. |
| To: | Lieberman J NRC OFFICE OF ENFORCEMENT (OE) |
| References | |
| GL-95-02, GL-95-2, LTR.#2.98.070, NUDOCS 9806020244 | |
| Download: ML20248C747 (32) | |
Text
___
Lcr PDe
.c 10 CFR 2.201 Boston EcHetm Pilgrim Nuclear Power Station 600 Rocky Hill Road Plymouth, Massachusetts 02360 l
L.J. Olivier Senior Vice President Nuclear May 27,1998 BECo Ltr. #2.98.070 Mr. James Lieberman, l
- Director, Office of Enforcement l
' U.S. Nuclear Regulatory Commission One White Flint North, 11555 Rockville Pike, Rockville, MD 20852 2738 Docket No. 50-293 License No. DPR-35 REPLY TO NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF civil PENALTY - $165.000.
AND PAYMENT OF civil PENALTY
References:
1.
NRC Letter, from H. J. Miller to L. J. Olivier, dated April 27,1998 (NRC Inspection Report Nos. 97-05,97-12 and 97-13).
2.
Pilgrim inspection Report 50-293/97-13, dated February 6,1998.
3.
NRC Letter, from J. T. Wiggins to L. J. Olivier, NRC A/E inspection, dated January 15,1998.
Dear Mr. Lieberman,
This letter provides Boston Edison Company's reply to the Notice of Violation and proposed imposition of civil penalty contained in the subject letter (Reference 1). A check in the amount of $165,000 is attached as full payment of the civil penalty.
The causes and corrective actions taken to address specific violations and the programmatic nature of the violations in the areas of design control, safety evaluations, and deportability were discussed with the NRC staff at the Enforcement Conference on November 21,1997 (Reference 2). The extent reviews and corrective actions are summarized in Enclosure A,
" Reply to the Notice of Violation".
/'
,/plI'
\\
l
^
9906020244 990527
/
PDR ADOCK 05000293 G
PDR x.
~
As described et th3 Enforc:m:nt Confersncs (R:fereness 2 and 3), wa aro focusing our
.s current efforts on implementing improvement initiatives in the areas of design basis information (DBI) and the design control process.
New Commitments
{
This letter contains the following commitments:
Plant documentation related to the regulating transformers (Vendor Manual V-1184, drawings E15A9 to E15A19, Specification EISA, and applicable station procedures) is being reviewed to ensure accuracy and completeness of information regarding the regulating transformers. This will be completed by August 31,1998. (l.8) l I&C and Electrical Engineering Department design guides will be revised to provide guidance on digital upgrades. In addition, NE3.08, " Specifications and Reports," will be revised to ensure the appropriate requirements for digital upgrades are included in procurement documents. This will be completed by August 31,1998. (l.B)
Plant modifications that were implemented since December 1993 that have microprocessors or solid state devices have been identified. These modifications will be reviewed for EMI impact and verification and validation by August 31,1998. (l.B)
A plant modification to replace RHR spray flow indicators and associated instrumentation will be completed during RFO #12. (l.C.4)
{
J The accuracy of the EDG kilowatt meter is being calculated and will be completed by July 1,1998. (l.C.5)
Calculation PS-79 is being revised to incorporate the additional loads identified as a l
result of the violation and will be completed by December 1,1998. (l.C.5)
Chanaes to Enforcement Conference (11/21/97) Commitments The following commitments that were made at the Enforcement Conference on November 21,1997, are revised as follows:
Review normal, abnormal and emergency procedures for safety-related systems to identify those which involve operator actions based on indication to verify consistency with FSAR and design basis (1/15/98). Procedures have been identified and evaluated.
Instrument uncertainty analysis will be completed by October 16,1998. (l.A)
Revise PNPS procedures to provide additional guidance to determine when a 10 CFR 50.59 evaluation is required (1/31/98).
This revision will also prohibit the use of engineering evaluations as the basis for procedure changes that allow operation outside the design basis. The revision based upon NEl 96-07 guidance document will be completed by June 30,1998. (l.A) 2
Scheduls third party assessment of 50.59 proc ss (6/30/98).
The assessment is o
planned for July 30,1998. (l.A)
Develop a procedure for performance of digital modifications (1/15/98).
This commitment evolved into revisions to NOP 83E5, " Safety Reviews", and NOP 95A2, "
Control of Computer Software." These have been revised and are in the review cycle to ensure GL 95-02 guidelines are followed when procuring and performing digital modifications. The revision to NOP 83E5 to include GL95-02 guidelines will be issued by June 30,1998, and the NOP 95A2 revision will be issued by August 31,1998. (l.B)
A recent review identified a need to further strengthen the linkage between Nuclear e
Engineering Procedures 3.01 and 3.05 to avoid any confusion over the governing procedure when reviewing vendor calculations. The changes will be made by July 31, 1998.
Please do not hesitate to contact me if there are any questions regarding the enclosed reply.
n iv r Commonwealth of Massachusetts
)
County of Plymouth
)
Then personally appeared before me, Leon Olivier, who being duly sworn, did state that he is Senior Vice President - Nuclear of Boston Edison Company and that he is duly authorized to execute and file the submittal contained herein in the name and on behalf of Boston Edison Company and that the statements in said submittal are true to the best of his knowledge and belief.
My commission expires: d[uo o Jet %2. -
A9I t
" / DATE NO ARY PUBLIC [
Attachment:
Boston Edison Company Check for $165,000 Enclosure A: Reply to the Notice of Violation cc:
U.S. Nuclear Regulatory Commission Document Control Desk Washington, D.C. 20555 Mr. Hubert J. Miller, Region i Administrator U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406 Mr. Alan B. Wang, Pilgrim Project Manager Office of Nuclear Reactor Regulation Senior Resident inspector l
Pilgrim Nuclear Power Station l
)
3
e r
Boston Edison Company Docket flo. 50-293 Pilgrim Station License No. DPR-35 ENCLOSURE A REPLY TO THE NOTICE OF VIOLATION EXTENT OF CONDITION REVIEW We recognize the programmatic weaknesses in our design control, safety evaluation and deportability programs. The root cause analyses conducted to determine comprehensive and complete corrective actions, when reviewed collectively, have revealed vulnerabilities in these key processes requiring a higher level of vigilance on our part to detect and correct problems earlier and at an ever lowering threshold.
Root cause analyses were performed in each of the problem functional areas (ref.
PR97.3097 for safety evaluations; PR97.3098 for design control; PR97.3099 for corrective action; and PR97.3100 for deportability). PR98.1085 documents the ties between the root cause analyses performed and additional specific examples cited in the notice of violation.
Because of this, each root cause analysis addressed several specific examples related to the respective process being evaluated. As such, the generic corrective actions associated with these root cause analyses will often be repeated during the discussion of each individual violation example.
The notice of violation requested results of any extent of condition reviews in the areas of design control, safety evaluations, and deportability. The design control and safety evaluation reviews are discussed below.
DESIGN CONTROL in the extent review for these findings, it was found that the detailed design basis information necessary to identify equipment design features is not easily obtainable. Without the equipment design feature information, the guidance provided in the operating procedures may not maintain plant parameters within the range assumed in the safety analysis. Design control and proper safety evaluations require the details of a design be understood, i
documented, and retrievable. Several examples of not having a clearly documented design l
basis have resulted in expenditure of significant engineering resources such as:
i Emergency Diesel Generator Allowable Ambient Temperature, Salt Service Water Discharge Header Isolation Requirements, l
Allowable Heat Sink Temperature.
The lack of current documentation to clarify the detailed original design basis is a problem that applies to many systems at Pilgrim Station.
SAFETY EVALUATIONS in November 1997, we performed a self-assessment of safety evaluations using problem reports written against safety evaluations.
Included in the sample were the findings documented in NRC SWOPI-related inspection reports. Deficiencies noted in the self-assessment are related to procedural guidance and the lack of clarity in license and design 4
bases. These results confirm the need for a design basis information program as well as the procedure improvements discussed later in this letter.
DEPORTABILITY See Reply"to Violation ll.A.B.C. and D.
ONGOING ACTIONS Extent reviews are incorporated into our design basis information program that will identify and resolve further design controlissues. Under this program, the detailed design basis will be recovered and documented in a user friendly format. For example, the flow rates given in the Pilgrim Station FSAR have histexically been analytical values. They are the values used in accident analysis calculations as representative of nominal values. As part of recovering the design Lasis, the level of information detail to be maintained in the FSAR will be established. By applying the level of detail standard to the FSAR, determining when a change to a procedure or plant component constitutes a change to the plant as described in the FSAR will be easier.
A detailed design and licensing basis will also provide the information necessary to make the correct decision on unreviewed safety question determinations and identify more readily when 10 CFR 50.59 reviews are required.
Our plans for design basis information program have been communicated to the NRC via our update' to the NRC 10 CFR 50.54(f) letter. The details of our DBI program were discussed with the NRC staff at a meeting on March 10, 1998. Additionally, we plan to conduct a series of vertical-slice reviews in the form of self-assessments along the lines of NRC Safety System Functional Inspections for verification and validation of Pilgrim plant design basis information. We plan to commence these self-assessments in June 1998.
In summary, the design basis program will identify and correct the extent of design control and safety evaluation problems. Our heightened sensitivity as to what constitutes an outside the design basis condition, and to what issues require 50.59 evaluations, and to what constitutes an unreviewed safety question, provide assurance that issues identified will be resolved in accordance with regulatory requirements.
Our recent identification and resolution of the reactor building quadrant area cooler issue (ref. LER 98-005) exemplifies the manner in which such issues will be treated.
Also, PNPS procedure 1.3.34.5,
" Operability Evaluation," was revised which provides tracking of open operability evaluations to allow mangement attention to ensure timely closure of identified problems.
I
' BECo letter,97-014, dated February 10,1997, and supplements, BECo letters,97-067, dated June 24,1997 and I
97-128 dated December 8,1997.
2 NRC Request for Information Pursuant to 10 CFR 50.54(O regarding Adequacy and Availability in timely manner, dated October 6,1996.
3 NRC Letter from J.T. Wiggins to LJ. Olivier, NRC A/E Inspection, dated January 15,1998.
5 i
I
NOTICE OF VIOLATION Dur,ing NR,C inspections conducted between May 14,1997, and October 10,1997, for which exit meetings were held on July 18, 1997, August 28, 1997, October 10,1997, and November 19,1997, violations of NRC requirements were identified. In accordance with the
" General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, the NRC proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy s Act of 1954, as amended (Act),42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalty are set forth below:
1.
VIOLATIONS ASSESSED civil PENALTIES A. VIOLATION ASSOCIATED WITH CONTAINMENT OVERPRESSURE 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Actions," requires, in part, that measures shall be established to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.
In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action is taken to preclude repetition.
10 CFR 50.59, " Changes, tests and experiments," permits the licensee, in part, to make changes to the facility as described in the safety analysis report without prior Commission approval provided the change does not involve an unreviewed safety question (USO). The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for th6 determination that the change does not involve a USO. A proposed change shall be deemed to involve a USO (i)if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.
Appendix B to 10 CFR 50, " Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants", Criterion ill, " Design Control," requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.
10 CFR 50.71(e) requires, in part, that the final safety analysis report (FSAR) be updated periodically to assure that the information included in the FSAR contains the latest material developed. Revisions to the FSAR shall be submitted annually or six months after each refueling outage provided the interval between submittals does not exceed 24 months. The revisions must reflect all changes up to a maximum of 6 months prior to the date of filing.
Contrary to the above, between January 1995 and January 20,1997, the licensee failed to take prompt and effective corrective action for a significant condition adverse i
to quality, failed to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and l
instructions, and failed to perform an adequate written safety evaluation which l
provides the bases for the determination that a design change did not involve a USO.
6 l
l I
The d:fici:ncy involvsd ECCS nnt positive suction h:ad (NPSH) calculations p rform:d to support saf:ty evaluations for a d: sign change to tha drywell piping insulation. Specifically, the calculations were changed to credit containment pressure as a result of modification of insulation on recirculation loop piping located in the drywell in 1984. BECo Safety Evaluation (SE) No.1638, approved on August 31, 1984, was performed to support the design change. The design change involved a USO in that the probability of a malfunction of the ECCS pumps (i.e., residual heat removal (RHR) and core spray) was increased due to the potentially higher line pressure losses caused by the collection of insulation debris on the pump suction strainers. The design change took credit for post-accident containment pressure to assure adequate ECCS pump NPSH.
Crediting of containment pressure was inconsistent with the plant design basis as described in Section 14.5 of the Updated Final Safety Analysis Report (UFSAR). However, the licensee failed to recognize that crediting containment pressure increased the probability of a malfunction of the ECCS pumps, and SE-1638 incorrectly concluded that the change did not involve a l
USO. Consequently, the change was made without NRC approval. This condition adverse to quality was not appropriately addressed until January 20,1997, when BECo requested NRC review and approval for including containment pressure as a component of NPSH margin in the Pilgrim licensing basis, despite prior opportunities j
to do so, namely:
1 1.
In 1995, the service water system operational performance inspection (SWSOPI) self-assessment identified that the 1984 safety evaluation may have improperly credited containment pressure in the NPSH calculations.
I 2.
On March 25, 1996, the licensee comp'eted a new safety evaluation (SE-2971) which supported the previous replacement of all piping thermal insulation in the drywell and superseded SE-1638. SE-2971 also incorrectly concluded that the 1984 plant modification did not involve a USO.
3.
The report of an independent review of the containment pressure issue performed by Yankee Atomic Electric Company, dated June 5,1996, concluded that containment pressure was not credited in the Pilgrim licensing basis; however, prompt action was not taken to correct the deficiency.
l In addition, between 1984 and June 1996, the licensee did not update Section 14.5 of the FSAR to reflect the design bases and methods for calculating the NPSH for the ECCS pumps as impacted by the modification to the ECCS pump strainers in 1984.
Specifically, to support the modification, containment pressure was credited in calculation of ECCS pump NPSH margin. FSAR Figure 14.5-10, "NPSH Availability for RHR and Core Spray System", was not revised to reflect the design bases and methods for calculating NPSH until June 1996. (01013)
This is a Severity Level lli violation (Supplement 1).
Civil Penalty $55,000.
7 l
l i
REPLY TO VIOLATION 1.A Admission or Denial of Violation
[
Boston Edison Company (BECo) admits that regulatory requirements were not followed as stated in the Notice of Violation.
. Reason for the Violation The cause of the failure to perform an adequate written safety evaluation, which provides the bases for the determination that a design change did not involve an unreviewed safety question (USO), was the licensing basis for Pilgrim for the use of containment pressure was ambiguous. BECo believed the licensing basis did not restrict the crediting of the available containment pressure to demonstrate adequate ECCS pump NPSH for a case where higher suction line losses were caused by debris. BECo believed the design basis NPSH margin, which is in-part derived from containment pressure, could be utilized in design calculations to compensate for the potentially higher suction line loss from insulation debris. This belief led to the conclusion that no USO was created by the installation of new insulation on recirculation loop in the drywell. (PR95.9417, PR97.3097, PR98.1085)
The cause of the failure to ensure that the applicable design basis was correctly translated into design calculations for ECCS pump NPSH was BECo's belief that the licensing basis did not restrict the crediting of the available containment pressure to demonstrate adequate ECCS pump NPSH for a case where higher suction line losses were caused by debris. A contributing cause of this misinterpretation of the design basis was lack of clearly documented limits on the use of containment pressure for ECCS pump NPSH.
(PR97.3098)
The cause of the failure to take prompt and effective corrective action was our failure to properly assess the issues identified in the salt service water system self-assessment. This error came from differing organizational interpretations of the design and licensing bases and the need to maintain them current. Also, once operability was established for a system in question, the organization believed the administrative issues could not be substantive, and therefore, the priority of their resolution and the potential for these issues to be significant upon further investigation was underestimated. (PR97.3099)
I The cause of our failure to update FSAR section 14.5 in 1984 to reflect the impact on accident analysis was that the preparer of the safety evaluation inappropriately concluded the change did not impact the FSAR (PR97.3102).
Corrective Action Taken and Results Achieved BECo requested NRC review and approval of NPSH USO issue by letter dated January e
20,1997.
NRC issuec License Amendment No.173, dated July 3,1997, resolving the NPSH issue.
l l
BECo updated the Pilgrim FSAR (Revision 21) to reflect the resolution of the NPSH e-issue, and the updated FSAR was submitted to the NRC in October 1997.
The containment analysis required by the License Amendment No.173 was completed e
on December 23,1997. A safety evaluation for the containment analysis (SE-3127) was completed on April 9,1998, and includes FSAR changes that will be incorporated by the next scheduled update.
This analysis addresses NPSH, SSW inlet temperature, 8
b
RBCCW flow rates, RHR flow rates, and drywell EO issues (violations 1.A, l.C.1, l.C.3, l.C.4 and l.C.7).
The Corrective Action Team was reorganized into the Quality Assurance Group to
. provide more independent assessment of the status of corrective action backlog and a greater focus on closure of open and overdue items.
Problem Reports were created for the remaining open SWOPl action items to allow them to be tracked in the normal station process.
PNPS procedure 1.3.121, " Problem Report Program," was modified for handling of special project items such as SWOPl.
ESP and operator training included a review of these violations as they relate to compliance with the licensing and design bases.
Corrective Action That Will be Taken to Prevent Recurrence Corrective actions that will be taken include the implementation of a dbl program which is discussed in the Extent of Condition Review.
Date of Full Compliance The NPSH issue was resolved and full compliance with regulations was achieved in July 1997 by the issuance of License Amendment No.173.
9
1.B. VIOLATION ASSOCIATED WITH 480/120 VOLT TRANSFORMER REPLACEMENT 10 CFR Part 50, Appendix B, Criterion XVI, " Corrective Actions," requires, in part, that measures shall be established to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected, in the case of l
significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action is taken to preclude repetition.
10 CFR 50.59, " Changes, tests and experiments," permits the licensee, in part, to make changes to the facility as described in the safety analysis report without prior Commission approval provided the change does not involve an unreviewed safety question (USO). The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for the determination that the change does not involve a USO. A proposed change shall be deemed to involve a USO (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.
The Pilgrim Final Safety Analysis Report (FSAR), section 8.8.3, Safety Design Basis I
for the 120 Vac safeguard control subsystem describes that the 120 Vac safeguard control subsystem was designed and installed in accordance with IEEE-279 Standard. IEEE-279 Standard section 4.6, Channel Independence, required that the signals from both channels to be independent to accomplish decoupling of the effects of electric transients. Section 8.8.3.3 of the FSAR stated that the 120 Vac safeguard control subsystem was arranged so that no single compone1t failure would prevent the system from providing power to the hydrogen / oxygen analyzer subsystem.
Contrary to the above, between April 1,1997 and October 10,1997, the licensee failed to take adequate corrective actions to preclude the recurrence of a significant condition adverse to quality, and failed to perform an adequate written safety evaluation which provides the bases for 9e determination thet a design change did not involve a USO. The deficiency involved an unintended trip function of the microprocessors associated with two transformers (X5S and X56), which provide the 120 Vac power to the safeguard control subsystem. The unintended trip function caused a common-mode malfunction (power loss) of both transformers due to a voltage transient on April 1,1997. Specifically, following the event on April 1,1997, the safety evaluation (SE 3091, dated April 10,1997) and engineering performed to support replacement of the microprocessors to eliminate the unintended trip function were inadequate in that the hardware and software of the microprocessors were not sufficiently evaluated to determine that the modification did not involve a USO. For example, voltage transients such as harmonic distortion or noise were not addressed, and the evaluation did not consider vendor configuration management, coding standards, or life cycle issues, all of which could have created a r,.alfunction of a different type and, therefore, involved a USO. Consequently, the modification of the transformers in April 1997, a change that involved a USO, was made without prior NRC approval. (02013)
This is a Severity Level lil violation (Supplement 1).
Civil Penalty $55,000.
10 l
___._____________J
I l
REPLY TO VIOLATION l.B Boston Edison Company admits that regulatory requirements were not followed as stated in the Notice of Violation with the following clarification. The replacement of the regulating transformers in 1992 created a USO because the transformers contained a new trip feature j
in the microprocessor that by its presence created a new failure mode.
The safety evaluations (SE-2664, SE-2706) for that modification did not recognize the presence of the new trip feature because the design specification for the regulating transformers did not correctly specify the input voltage transients that could cause a trip of the transformer.
Therefore, we consider this to be a failure to meet 10 CFR 50.59 requirements.
When the trip feature was discovered in 1997, another safety evaluation (SE-3091) was prepared to evaluate the modification to remove the tsp feature. This safety evaluation was I
deficient because it did not fully evaluate the digital modification in accordance with NRC GL 95-02, "Use of NUMARC/EPRI Report TR 102348, ' Guidelines on Licensing Digital Upgrades,' in Determining the Acceptability of Performing Analog-to-Digital Replacements
- nder 10 CFR 50.59". Because this safety evaluation was deficient, the implementation of I
me subject modification created the potential for another USO. However, SE-3091 was superseded by SE-3142 which was performed in accordance with the GL 95-02 guidance, and it confirmed that the modification to remove the trip feature did not create a USO.
Nonetheless, we also consider the failure to properly evaluate the modification in SE-3091 to be a failure to meet the requirements of 10 CFR 50.59.
Reason for the Violation Our assessment of the violation (PR97.2866) revealed the following:
The cause of the failure to perform an adequate safely evaluation or to implement effective corrective action was that the involved engineers were not sensitive to potentia l digital issues because the problem being solved was not an analog to digital upgrade.
Effective programmatic guidance and training were lacking on the unique issues affecting digital upgrades and modifications.
Thus, engineers did not sufficiently challenge the adequacy N the documents (e.g., SE-2664) that evaluated the original modification installing the digitally controlled transformers.
)
l Corrective Action Taken and Results Achieved The following corrective actions were implemented for an immediate resolution of the violation.
An engineering evaluation 97-029 was written to document operability of the regulating l
transformers. This evaluation remained in effect until SE-3142 was issued.
Safety Evaluation, SE-3142, was issued on May 7,1998, which superseded SE-3091 i
and all other SEs written on the regulating transformers. SE-3142 verified the regulating transformers are designed to meet the single failure criteria required by the FSAR l
including the affects of electrical transients. SE-3142 follows the guidelines of EPRI Report TR102348 and NRC GL 95-02 for digital upgrades. This SE verified no USO j
exists for the regulating transformers based on an acceptable software verification and i
validation analysis, EMI testing, review of the vendor commercial dedication program and qualification testing, and completed failure modes and effects analysis of each component in the regulating transformer.
11
i o FSAR s ction 8.8.3 was revis:d in October 1997 to remove tha crroncous referencs to lEEE-279 cs the 120VAC system was not licensed or designed to this standard.
Corrective Action That Will be Taken to Prevent Recurrence
'NOP83ES, " Safety Reviews", and NOP95A2, " Control of Computer Software", have been revised and are in the review cycle to ensure GL 95-02 guidelines are followed when procuring and performing digital modifications. The NOP 83E5 revision to include GL95-02 guidelines will be issued by June 30,1998, and the NOP 95A2 revision will be issued by August 31,1998.
Plant documentation related to the regulating transformers (Vendor Manual V-1184, drawings E15A9 to E15A19. Specification EISA, and station procedures) is being reviewed to ensure accuracy and completeness of information regarding the regulating.
transformers. This will be completed by August 31,1998.
l&C and Electrical Engineering Department design guides will be revised to provide guidance on digital upgrades. In addition, NE3.08," Specifications and Reports," will be revised to ensure the appropriate requirements the digital upgrades are included in procurement documents. This will be completed by August 31,1998. (l.B)
Plant modifications that were implemented since December 1993 that have microprocessors or solid state devices have been identified. These modifications will be reviewed for EMI impact and verification and validation by August 31,1998.
Other Corrective Actions to be Taken Engineering Support Personnel (ESP) training is being conducted to inform the engineers of the requirements of GL 95-02 when performing digital upgrades.
Date of Full ComDllance Full compliance with the resolution of regulating transformer issue was achieved on May 7, 1998 with the issuance of SE-3142.
12
\\
1.C. ADDITIONAL VIOLATIONS ASSOCIATED WITH INADEOUATE CORRECTIVE ACTIONS FOR KNOWN TECHNICAL ISSUES l
10,CFR Part 50, Appendix B, Criterion XVI, " Corrective Actions," requires, in part, that measures shall be established to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected, in the case of significant conditions adverse to qua!ity, the measures shall assure that the cause of the condition is determined and corrective action is taken to preclude repetition.
10 CFR 50.59, " Changes, tests and experiments," permits the licensee, in part, to make changes to the facility as described in the safety analysis report without prior Commission approval provided the change does not involve an unreviewed safety question (USO). The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for the determination that the change does not involve a USO. A proposed change shall be deemed to involve a USQ (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.
Appendix B to 10 CFR Part 50, " Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants", Criterion Ill, " Design Control," requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.
- 1. VIOLATION ASSOCIATED WITH SSW DESIGN INLET TEMPERATURE Contrary to the above, between July 1994 and August 28,1997, the licensee failed to promptly identify and correct discrepancies associated with operation of the plant with salt service water (SSW) system inlet temperatures higher than the design temperature specified in the UFSAR, a condition adverse to quality. Specifically, in July 1994 and August 1995, SSW system inlet temperature exceeded the design temperature of 65 F, as used in the accident analysis and as described in UFSAR Section 14.5.3. Additionally, plant procedures were not consistent with the UFSAR with respect to the SSW design inlet temperature. Procedure 2.2.32, " Salt Service Water System," contained no guidance regarding the temperature limit and procedure 2.2.30, " Reactor Building Closed Cooling Water System," specified a design inlet SSW temperature of 75 F, representing a failure to properly translate the SSW design temperature limit into procedures. This condition adverse to quality was not promptly identified and corrected, despite prior opportunities to do so, namely:
a.
In July 1994, tha licensee recognized that the elevated SSW temperature was a nonconforming condition and performed evaluations that concluded that the reactor building closed cooling water (RBCCW) system was operable with SSW inlet temperatures up to 75 F. However, the licensee failed to identify that operation of the plant with SSW system inlet temperature above 65 F was a condition outside of the design basis of the plant.
b.
Although the licensee had identified that a design basis change was needed to change the SSW inlet temperature from 65 F to 75 F in July 1994 and 13
l l
again during ths SWSOPl in 1995, they did not take prompt effective corrective actions to revise the design basis. A written safety evaluation to support a change to the design basis was not performed until March 1996.
However, the safety evaluation that was performed in March 1996 was inadequate in that it inappropriately credited post-accident containment pressure in the analysis. Use of containment pressure was inconsistent with the plant licensing basis.
c.
The licensee did not identify the procedural discrepancies until the SWSOPl was performed in 1995 despite prior opportunity in 1994. Procedure 2.2.32 was revised on February 23,1995, to include an administrative limit stating that the RBCCW system remained operable with a SSW inlet temperature up to 75*F. However, the design discrepancy was not corrected because the 75'F limit had not been incorporated into the licensee's current UFSAR analysis of record for design basis events and the performance of emergency core cooling equipment.
These analyses used an ultimate heat sink temperature of 65*F. Additionally, no written safety evaluation was performed to determine that the procedure change did not involve a USO.
l d.
Interim corrective actions taken by the licensee to incorporate the use of SSW temperature " rolling averages" into plant instructions were also ineffective because the needed design analysis to support this method of determining inlet temperature was not performed. Specifically, in August and September 1995, the licensee approved the use of " rolling averages" to justify SSW temperature excursions above the 65 F design limit. However, no formal detailed analysis was performed to verify that temperatures above 65'F for limited periods of time were bounded by the analyses for design basis events and ECCS performance. (03013)
- 2. VIOLATION ASSOCIATED WITH SALT SERVICE WATER SYSTEM SINGLE FAILURE VULNERABILITY Contrary to the above, between January 1995 and July 18,1997, the licensee failed to identify a design deficiency in the salt service water system that rendered the system vulnerable to a single failure, a condition adverse to quality, despite prior opportunity to identify the deficiency. The single failure vulnerability involved a loss of DC power during a design basis event at specific tidal conditions and Cape Cod Bay water temperatures. Under certain conditions, only one SSW pump would remain operating with the SSW headers cross-connected and insufficient NPSH; therefore, the single DC power failure could prevent the SSW system from performing its safety function. Although the licensee completed a single failure analysis on April 27,1997, in response to identification of single failure vulnerabilities in the SSW and RBCCW systems during the SWSOPl in 1995, the licensee failed to identify the vulnerability.
(03023)
- 3. VIOLATION ASSOCIATED WITH ISOLATION OF NON-ESSENTIAL RBCCW LOADS Contrary to the above, between February 1995, and August 28,1997, the licensee failed to promptly identify and correct a deficiency associated with isolation of nonessential RBCCW loads during design basis conditions. Specifically, the design basis was not correctly translated into procedures in that there was no guidance in procedure 2.2.19.5, "RHR Modes of Operation for Transients," for isolating nonessential RBCCW system heat loads during a design basis accident as described in Section 10.5.5.3 of the UFSAR and other design analyses. This condition adverse 14
l to quality was not promptly identified and corrected, dsspite prior opportunities to do so, namsly:
a.
Although the licensee identified that there was no procedural guidance to isolate the nonessential loads during the SWSOPl in 1995, they failed to l
recognize that the condition caused the plant to be outside the design basis of j
the plant.
b.
Although procedure 2.2.19.5 was revised on July 18,1997, to isolate non-essential RBCCW system heat loads if suppression pool temperature exceeded 130 F, this corrective action was not effective because no design-basis analysis was performed for the 130 F limit to demonstrate that the core spray pump bearing cooler would receive adequate flow during all design basis conditions. Additionally, no written safety evaluation was performed to determine that the restriction on isolation of the nonessential loads did not involve a USO.
A 50.59 safety evaluation was required because the i
description in the UFSAR did not restrict isolation of the non-essential loads I
based on suppression pool temperature. (03033)
- 4. VIOLATION ASSOCIATED WITH RHR SYSTEM DESIGN FLOW RATES Contrary to the above, prior to August 28, 1997, the licensee failed to promptly identify and correct a design deficiency associated with translation of the RHR design flow rate into plant procedures. The RHR design flow rate of 5100 gpm used in design basis containment heat transfer and pressure / temperature response calculations was not adequately translated into procedures. The RHR flow range of 4800 to 5100 gpm specified in Operating Procedure (OP) 2.2.19.5, "RHR Modes of Operation for Transients", was not supported by calculations that considered the effects of instrument accuracy on post-accident containment response or RHR heat exchanger integrity. After the deficiency was identified by the NRC in July 1997, the licensee failed to identify the significance of the deficiency and failed to take effective corrective actions to resolve the problem. Specifically, Operating Procedure 2.2.19.5 was revised on July 18,1997, to throttle RHR flow not to exceed 5600 gpm; however, this corrective action was not effective because the specification of the higher RHR flow rate was not adequately supported with the required calculations and analyses and was not representative of the design basis. Additionally, no written safety evaluation was performed to determine that the higher system flow rate did not involve a USO. Specifically, no evaluation was performed to ensure that a flow rate of 5600 gpm would not have an adverse effect on the RHR heat exchangers.
(03043)
- 5. VIOLATION ASSOCIATED WITH EDG LOADING CALCULATIONS Contrary to the above, between January 1995 and August 28,1997, the licensee failed to promptly identify and correct design deficiencies associated with emergency diesel generator (EDG) loading calculations and procedures. Specifically, calculation PS-79, " Diesel Generator Loading", did not include the power drawn during current limit operation for the 250 vdc battery charger and did not address the effect on generator load by motor driven pump frequency variation. The limit specified in the precautions of procedure 2.2.8, " Standby AC Power System", for EDG 2000-hour rating did not account for accuracy of the kilowatt meter. Additionally, the diesel generator loads documented in design basis calculation PS-79 wero not properly translated into the diesel generator loading information specified in procedure 2.2.8.
15 l
(
i Although diesal g:nerator loading was assess:d during the SWSOPl in 1995, the lic:nste did not identify ths deficienci:s in calculation PS-79 and procedure 2.2.8.
The licensee had identified the inconsistencies between design-basis information contained in calculation PS-79, and diesr* Jenerator loading information in procedure 2.2.8 prior to the SWSOPl in 1995 and had initiated a tracking item to revise procedure 2.2.8 during the SWSOPl. However, the licensee failed to take prompt corrective action to resolve the discrepancies. Although both calculation PS-79 and procedure 2.2.8 had been revised since the SWSOPI, as of August 28,1997, the calculation and the procedure were still inconsistent. (03053)
- 6. VIOLATION ASSOCIATED WITH EDG AMBIENT TEMPERATURE DESIGN LIMIT Contrary to the above, between January 1995, and August 28,1997, the licensee failed to promptly identify and effectively correct a design discrepancy associated with the EDG design maximum outdoor ambient temperature limit of 88 F specified l
in UFSAR Section 10.9.3.9 and Table 10.9-2. During certain summer periods since i
initial plant startup, ambient temperatures exceeded 88 F; however, the licensee failed to ensure that the design basis limitation for operation of the EDGs was translated into specifications. The licensee failed to promptly identify and correct this condition adverse to quality, despite prior opportunities to do so, namely:
a.
During the SWSOPl in 1995, the licensee identified that the maximum ambient temperature for operation of the EDGs had been exceeded in the past. However, they failed to recognize that the condition caused the plant to be outside the design basis of the plant.
1 b.
No limits were placed on EDG loading when operating above ambient temperatures of 88 'F until June 20,1997.
c The safety evaluations performed to support the change to a 100% water mixture in June 1997 (SE-3102) and the change back to a 50/50 glycol mixture in August (SE-3114) were not comprehensive and were based on preliminary input that was not properly validated. The safety evaluations did not address the effects of higher air temperature on key engine performance characteristics such as fuel consumption rate or the overall impact on accelerated engine wear and possible engine power de-rating. Although the testing performed to validate the analysis upon which these evaluations was based did not achieve the expected results, the EDGs were still considered operable. (03063)
- 7. VIOLATION ASSOCIATED WITH ENVIRONMENTAL QUALIFICATION RELATED TO DRYWELL TEMPERATURE PROFILE 10 CFR 50.49 (e) requires, in part, that the electric equipment environmental qualification program must include and be based on the time-dependent temperature and pressure at the location of the electric equipment important to safety. The time-dependent temperature and pressure must be established for the most severe design i
basis accident during or foilowing which this equipment is required to remain j
functional.
i
\\
' Contrary to the above, between January 1996, and August 28,1997, the licensee failed to take corrective action to preclude recurrence of a deficiency associated with the environmental qualification (EO) accident temperature profile for electrical l
l.
equipmsnt in the drywell, a significant condition adverse to quality. The condition involved a computer modeling error for certain small break sizes and an incorrect 16
4 assumption that resultsd in highsr avarage drywell tsmperatura than thn analysis of record for the containment tsmpsrature profile used for EO of elzctrical equipment in the drywell. The modeling error caused the analysis of record since 1987 to be nonconservative due to differences in the predicted peak temperature and drywell temperatures from one hour to approximately 220 hours0.00255 days <br />0.0611 hours <br />3.637566e-4 weeks <br />8.371e-5 months <br /> after the event, in January 1996, the licensee identified and corrected the errors in the drywell temperature profile; however, they failed to take action to preclude recurrence of the deficiency. Specifically, the licensee determined that the.cause of the error was failure to review the input values and assumptions used by the vendor in their analysis; however, as of August 28,1997, no change had been made to engineering procedures to preclude repetition of the condition.
From 1987 to January 1996, a condition existed in which design basis drywell accident temperature profiles would have exceeded equipment environmental qualification temperature limits during postulated main steam line break accidents, plac!ng the plant outside its design basis. Although the licensee identified the condition in January 1996, they failed to recognize that the condition caused the plant to be outside the design basis of the plant. (03073) i l
These violations (l.C.1 - 7) represent a Severity Level lli problem (Supplement I).
Civil Penalty - $55,000.
i 17 a
t REPLY TO VIOLATION l.C.1 SSW Declan inlet Tempernturo Admission or Denial of Violation Boston Edison Company admits tha' agulatory requirements were not followed as stated in the Notice of Violation.
Reason for the Violation The cause of the failure to perform adequate written safety evaluations and failure to exercise design control to limit operation of the facility to SSW inlet temperatures below 65 F I
was the manner in which we interpreted the licensing basis for Pilgrim for the allowable salt service water temperature. (PR97.3097)
Information contained in FSAR section 2.4 indicates that historically the Cape Cod Bay temperature frequently exceeds 65 F during the months of July through September, and temperatures as high as 75 F have been recorded. In lieu of the fact that PNPS was licensed based on an accident analysis that used 65 F as an input for SSW inlet temperature, and considering that no license or Technical Specification restriction was placed on the operation of the facility in this regard, BECo did not treat 65 F as a operational limit.
Because of the ambiguity surrounding the SSW inlet temperature, BECo did not translate the SSW inlet temperature into procedures as a limit. The cause of the failure to ensure the applicable design basis is correctly translated into procedures and instructions was lack of a clearly documented design basis and inadequate technical review of SSW, RBCCW, RHR, and EDG system procedures in accordance with PNPS procedure 1.3.4 4. (PR97.3098)
The procedure changes made to incorporate a SSW inlet temperature limit without a safety evaluation were based on an Operations Review Committee (ORC) approved operability evaluation for the higher SSW inlet temperature of 75 F and a preliminary evaluation checklist (PEC) from which the conclusion was drawn that this procedure change would incorporate an already approved ORC administrative limit and did not intend to change the FSAR Chapter 14 assumptions. (PR95.9493)
The cause of the failure to take prompt and effective corrective action was our failure to properly assess the issues identified in the salt service water system self-assessment. This error came from differing organizational interpretations of the design and licensing bases and the need to maintain them current. Also, once operability was established for a system in question, the organization believed the administrative issues could not be substantive, and therefore, the priority of their resolution and the potential for these issues to be significant upon further investigation was underestimated. (PR97.3099)
Corrective Action Taken and Results Achieved Pilgrim licensing and design bases have been revised to allow the use of a limited amount of pressure for ECCS pump NPSH, and the maximum seawater injection temperature is now established as 75 F.
These actions were completed by License Amendment No.173. Plant procedures include administrative SSW inlet temperature limits that are consistent with the FSAR and License Ameadment No.173.
A License Event Report, LER 97-017-00, "Past Operation with Service Water Temperature Greater than Design due to Licensing Basis Ambiguity," was issued on December 4,1997, in accordance with 10 CFR 50.73.
18 1
l
.J
t Th3 containment analysis required by the License Amendment No.173 was complstad o
on December 23,1997. A safety evaluation for the containment analysis (SE-3127) was completed on April 9,1998, and includes FSAR changes that will be incorporated by the next scheduled update.
This analysis addresses NPSH, SSW inlet temperature,
,RBCCW flow rates, RHR flow rates, and drywell EO issues (violations 1.A, l.C.1, l.C.3, l.C.4 and I.C.7).
Plant operation with respect to the SSW inlet temperature is administratively controlled.
Procedure 2.2.30 contains a limit on the SSW inlet temperature that takes into account instrumentation uncertainty.
BECo submitted a proposed ultimate heat sink technical specificavon by letter 98-017, dated February 20,1998.
All appropriate personnel have been trained on the requirements of performing technical review of procedures. Training was completed in December 1997.
ESP and operator training included a review of these violations as they relate to compliance with the licensing and design bases.
Corrective Action That Will be Taken to Prevent Recurrence Further corrective actions that will be taken include the implementation of a dbl program which is discussed in the Extent of Condition Review.
Date of Full Compliance The NPSH USO and 75 F SSW inlet temperature issue was resolved, and full compliance was achieved in July 1997 by the issuance of License Amendment No.173.
l-l 19 l
1
REPLY TO VIOLATION 1.C.2 Salt Servic, Wat r System Sinale Failura Vulner"bility Admission or Denial of Violation Boston Edison Company admits regulatory requirements were not followed as stated in the Notice of Violation.
Reason for the Violation As reported in LER 97-011-02, the cause of the violation was that the FSAR was ambiguous as to whether single failures (e.g., partiallosses of offsite power or loss of a single bus) that create the same configuration as the battery failure scenario are within the design basis for the system. This condition is an example of the PNPS UFSAR being ambiguous.
Corrective Action Taken and Results Achieved Corrective action has been taken to review the design and licensing basis for the SSW system with regard to single failures (PR97.9408), perform hydraulic analyses for a SSW configuration with one pump serving both SSW trains (Calculation M500), and perform pump testing to establish performance data and NPSH requirements for the expected range of flo.y (SUDDS/RF #97-95).
LER 97-011-00, " Service Water System Single Failure Vulnerability" was issued on August 1,1997. A supplement LER 97-011-01 was issued on September 30,1997, and a second Supplement LER 97-011-02, was issued on December 30,1997.
A proposed license amendment to clarify this issue was submitted (BECo letter 98-008, dated February 11,1998).
Corrective Action That Will be Taken to Prevent Recurrence As discussed in the Extent of Condition Review, the Design Basis Information program will address the cause of this deficiency. A thorough knowledge of the design basis for plant systems will aid in identifying the limiting scenarios for system design.
Oate of Full Compliance Full compliance with the resolution of the SSW system single failure vulnerability issue will be achieved upon NRC approval of the license amendment request (BECo letter 98-008).
L 20 l
REPLY TO VIOLATION l.C.3 Isolation of Non-Essential RBCCW Loads Admission or Denial of Violation Boston 2dison Company admits that regulatory requirements were not followed as stated in the Notice of Violation.
Reason for the Violation The cause of the failure to perform written safety evaluation was that individuals did not understand what constitutes a change in the facility as described in the FSAR. This resulted in preliminary evaluation checklist (PEC) reviews incorrectly concluding that a safety evaluation was not required of that a USO did not exist. (PR97.3097)
The cause of the failure to assure that the applicable design basis was correctly translated into specifications, drawings, procedures, and instructions was lack of a clearly defined documented design basis and inadequate technical review of procedures for the SSW, RBCCW, RHR and EDG systems. Also, adequate technical review of procedures in accordance with PNPS procedure 1.3.4-4 was not performed to resolve the issue, (PR97.3098)
Pilgrim Procedure 2.2.19 for the operation of the RHR system exl.sted at the time of the 1995 SWOPl self-assessment, and Procedure 2.2.19.5 (Rev. 0) for emergency operation was initiated in February 1996 in support of EOP-1 and EOP-2.
It was thought that this procedure, together with the EOPs, provided sufficient operator actions to control the RHR and RBCCW systems during abnormal and emergency conditions. The procedure directed operators to provide the maximum RBCCW flow that conditions allow to the RHR heat exchanger. The procedure did not specifically requiie the isolation of the non-essential RBCCW loads and, as such, presented a potential conflict with the assumptions used in design basis accident analysis.
The cause of the failure to take prompt and effective corrective action was our failure to properly assess the issues identified in the salt service water system self-assessment This error came from differing organizational interpretations of the design and licensing bases i
and the need to maintain them current. Also, once operability was established for a system in question, the organization believed the administrative issues could not be substantive, and therefore, the priority of their resolution and the potential for these issues to be significant upon further investigation was underestimated. (PR97.3099)
Corrective Action Taken and Results Achieved Licensee Event Report, LER 97-019-00," Analysis Assumption to Close Valves Supplying Cooling Water to Non-essential Heat Loads Not translated into Procedures" was i-submitted on December 4,1997.
Safety evaluation 3118 was written for the revisions made to the procedure 2.2.19.5, and Calculation M770 has been completed to demonstrate adequate RBCCW flow will be supplied to all safety-related loads when the non-essential RBCCW loads are not isolated.
1 The containment analysis required by the License Amendment No.173 was completed on December 23,1997. A safety evaluation for the containment analysis (SE-3127) was completed on April 9,1998, and includes FSAR changes that will be incorporated by the next scheduled update.
This analysis addresses NPSH, SSW inlet temperature, RBCCW flow rates, RHR flow rates, and drywell EQ issues (violations 1.A, l.C.1, l.C.3, 21 l
l l
i i'
l.C.4 and I.C.7). This FSAR ch nge also documsnts the fact that non-ess ntial RBCCW loads will b3 isolat:d at 130 F suppression pool 1 mpsrature during accidents. For the DBA LOCA, this limit is exceeded almost immediately.
,All app.ropriate personnel have been trained on the requirements of performing technical review of procedures. Training was completed in December 1997.
ESP and operator training included a review of these violations as they relate to compliance with the licensing and design bases.
Corrective Action That Will be taken to Prevent Recurrence Corrective actions to prevent recurrence associated with the dbl program and are discussed in the Extent of Condition Review.
Date of Full Compliance l
l Full compliance with the resolution of non-essential RBCCW flow was achieved on April 9, l
1998 (with the completion of SE-3127).
I 22
REPLY TO VIOLATION l.C.4 RHR Syst m De-lan Flow Rate 7 Admission or Denial of Violation Boston Edison Company admits that regulatory requirements were not followed as stated in the Notice of Violation.
l Reason for the Violation The cause of the failure to perform a written safety evaluation was that individuals did not understand what constitutes a change in the facility as described in the FSAR. This resulted in preliminary evaluation checklist (PEC) reviews incorrectly concluding that a safety evaluation was not required or that a USO did not exist. (PR97.3097)
The cause of the failure to assure that the applicable design basis vas correctly translated into procedures was lack of a clearly defined documented design basis and inadequate technical review of procedures for the SSW, RBCCW, RHR and EDG systems. Also, adequate technical review of procedures in accordance with PNPS procedure 1.3.4-4 was not performed to resolve the issue. (PR97.3098)
Pilgrim Procedure 2.2.19.5 (Rev. 0) for the emergency operation of the RHR system was initiated in February 1996 in support of EOP-1 and EOP-2.
It was thought that this procedure, together with the EOPs, provided sufficient operator actions to control the RHR and RBCCW systems during abnormal and emergency conditions. The procedure specified a range of flow rates for RHR from 4800 to 5100 GPM to cover all modes of operation of the i
RHR system, whereas EOPs would direct operators to maximize cooling when appropriate.
It was believed that the original design intent was to operate the RHR heat exchanger at its rated design flow rate (5100 GPM) using the plant fiev instruments and flow control throttle valves with adjustments made as needed based on actual plant conditions.
It is acknowledged that this philosophy did not rigorously account for instrument uncertainty and, as such, presented a potential conflict with the assumptions used in design basis accident analysis.
The cause of the failure to take prompt and effective corrective action was our failure to properly assess the issues identified in the salt service water system self-assessment. This error came from differing organizational interpretations of the design and licensing bases and the need to maintain them current. Also, once operability was established for a system in question, the organization believed the administrative issues could not be substantive, and therefore, the priority of their resolution and the potential for these issues to be significant upon further investigation was underestimated. (PR97.3099)
Corrective Action Taken and Results Achieved Licensee Event Report, LER 97-020-00, was issued on December 4,1997.
Procedure 2.2.19.5 has been revised to require the RHR system to be operated with MO-1001-36A/B or MO 1001-28A/B fully open when cooling is to be maximized. This procedure change was evaluated using 10 CFR 50.59 (SE-3127).
The RHR heat exchangers were evaluated for a flow rate of 5600 GPM and determined to be acceptable.
The containment analysis required by the License Amendment No.173 was completed on December 23,1997. A safety evaluation for the containment analysis (SE-3127) was completed on April 9,1998, and includes FSAR changes that will be incorporated by the next scheduled update.
This analysis addresses NPSH, SSW inlet temperature, 23
RBCCW flow retas, RHR flow rat::s, and drywall EO issues (violations 1.A, l.C.1, l.C.3, l.C.4 and I.C 7).
Procedure 1.3.34.5, " Operability Evaluations," was issued, which provides tracking of
.open operability evaluations to allow management attention to ensure timely closure.
All appropriate personnel have been trained on the requirements of performing technical review of procedures. Training was completed in December 1997.
Corrective Action That Will be Taken te Prevent Recurrence The broader corrective action will be to the formalize the process to translate ana:ytical limits into usable values for use in operating procedures. This corrective action is included in the design basis program which is discussed in the Extent of Condition Review. This is not a new commitment since this action was previously included in the scope of the DBI program.
Other Corrective Action to be Taken A plant modification is planned to replace the RHR containment spray flow indicators and associated instrumentation with state of the art equipment that will lower the instrument uncertainty to be in compliance with Regulatory Guide 1.105 (PR 97.9623).
This modification is planned for completion before startup from refueling outage 12 (currently planned April 24,1999).
Date of Full Compliance Full compliance with the resolution of the RHR system design flow rates was achieved on April 9,1998 (with the completion of SE-3127).
i 24
REPLY TO VIOLATION 1.C.5 EDG Loadina Calculation, Admission or Denial of Violation Boston Edisen Company admits regulatory requirements were not followed as stated in the Notice of Violation.
Reason for the Violation The cause of the failure to ensure that the applicable design basis was correctly translated into specifications, drawings, procedures, and instructions was lack of a clearly defined documented design basis and inadequate technical review of procedures for the SSW, RBCCW, RHR and EDG systems. Also, adequate technical review of procedures in accordance with PNPS procedure 1.3.4-4 was not performed to resolve the issue.
(PR97.3098)
The cause of the failure to take prompt and effective corrective action was our failure to properly assess the issues identified in the salt service water system self-assessment. This error came from differing organizational interpretations of the design and licensing bases and the need to maintain them current. Also, once operability was established for a system i
in question, the organization believed the administrative issues could not be substantive, and therefore, the priority of their resolution and the potential for these issues to be significant upon further investigation was underestimated. (PR97.3099)
In addition, procedure 2.2.8 was intended to provide guidance; it was n9ver intended to provide real time data on electrical loads. Also, calculation PS-79 did not reference procedure 2.2.8.
Corrective Action Taken and Results Achieved Procedure 2.2.8, Revision 44, made the necessary changes to be consistent with calculation PS-79.
Procedure 1.3.34.5, ' Operability Evaluations," was issued, which provides tracking of open operability evaluations to allow management attention to ensure timely closure.
ESP and operator training included a review of these violations as they relate to compliance with the licensing and design bases.
All appropriate personnel have been trained on the requirements of performing technical review of procedures. Training was completed in December 1997.
Corrective Action That Will be Taken to Prevent Recurrence The broader corrective action will be to the formalize the process to translate analytical limits into usable values for use in operating procedures. This corrective action is included in the design basis program which is discussed in the Extent of Condition Review. This is not a new commitment since this action was previously included in the scope of the dbl program.
25
r I
l
~
Other Corrective Action to be Teken The accuracy of the EDG kilowatt meter is being calculated and will be completed by July 1,1998.
'PS-79'is being revised to incorporate the additional loads identified as a result of the violation and will be completed by December 1,1998.
Date of Full Compliance Full compliance will be achieved with the revision of PS-79 on December 1,1998.
I 1
26
REPLY TO VIOLATION l.C.6 EDG Ambient Temperature Deslan Limit Admission or Denial of Violation Boston Edison Company admits regulatory requirements were not followed as stated in the Notice of Violation.
Reason for the Violation The cause of our failure to perform an adequate written safety evaluation was that the licensing basis for Pilgrim was ambiguous. The lack of clarity in the licensing basis resulted in differing interpretations. (PR97.3097)
The cause of the failure to take prompt and effective corrective action was our failure to properly assess the issues identified in the salt service water system self-assessment. This error came from differing organizational interpretations of the design and licensing bases and the need to maintain them current. Also, once operability was established for a system in question, the organization believed the administrative issues could not be substantive, and therefore, the priority of their resolution and the potential for these issues to be significant upon further investigation was underestimated. (PR97.3099)
The cause of our failure to translate design basis information into specifications 'was based on our interpretation that the 88 F temperature value listed in the FSAR was representative of the maximum summer temperature, and it was realistic to assume the temperature on occasion would exceed this value. This interpretation was due to a lack of a clearly defined documented design basis and inadequate technical review of procedures for the emergency diesel generator system (PR 97.9383). Due to ambiguity in the FSAR, the 88 F temperature value was believed to be a nominal design parameter and not a design limit and preliminary information from the vendor contributed to safety evaluations not addressing effects of higher air temperatures on key engine parameters.
Corrective Action Taken and Results Achieved Licensee event report, LER 97-021-00, was issued on December 4,1997.
Operability evaluations were completed that document the diesel generators are operable to 95 F. Further evaluation is in progress to demonstrate diesel generators can tolerate a temperature of 102 F without compromising operability.
Procedure 8.9.1 has been revised addressing ambient temperature limitations.
A revision was issued to PDC 97-15 for 50% glycol mixture in the diesel generators.
ESP and operator training included a review of these violations as they relate to compliance with the licensing and design bases.
Corrective Action That Will be Taken to Prevent Recurrence Following on-going analysis, the FSAR wil: be updated to revise the design ambient temperature limitations.
The design basis information program willinclude EDG design basis information.
l 27 I
t
.~
Date of Full Compliance Full compliance was achieved on December 30,1997, when procedure 8.9.1 was revised.
28 l
REPLY TO VIOLATION l.C.7 Environmental Qualification Relrted to Drywell Temperature Profile Admission or Denial of Violation Boston Edison Company admits that regulatory requirements were not followed as stated in the Notice of Violation.
Reason for the Violation in January 1996, BECo engineering personnel identified the drywell temperature profiles associated with 75 F SSW inlet conditions were not similar to the analysis of record (PR 96.9028). An engineering evaluation was completed documenting operability of electrical equipment in the drywell after the discovery of the General Electric Company error. All affected equipment was determined to be qualified on January 26,1996. As a part of the corrective action, Nuclear Engineering Procedure 3.01, " Review, Evaluation and Acceptance of Supplier Design Documents" was to be revised. The reason for the delay in revision of this and other procedures was belief an administrative issue such as this was not substantive, and therefore, insufficient urgency was focused on its resolution.
Corrective Action Taken and Results Achieved d
Nuclear Engineering Procedures 3.05,3.06,4.01 and 4.02 have been revised to incorporate a requirement to review all input values and assumptions prior to acceptance of a detailed vendor calculations. This was completed in April 1998. The changes made will strengthen the entire process for procurement of design analysis services from requirements analysis through product acceptance. The intent of the changes is to shift control for supplier design calculations from procedure 3.01 to procedure 3.05 " Design Calculations" which contains explicit requirements for the development and verification of inputs and assumptions.
Corrective Action That Will be Taken to Prevent Recurrence A recent review identified a need to further strengthen the linkage between Nuclear Engineering Procedures 3.01 and 3.05 to avoid any confusion over the governing procedure when reviewing vendor calculations. The changes will be made by July 31,1998.
Date of Full Compliance Full compliance will be achieved in July 31, 1998, based on the issuance of NESG procedures.
d NE 3.01," Review, Evaluation. and Acceptance of Supplier Design Documents."
NE 3.05, " Design Calculations."
NE 3.06," Design Verification."
NE 4.01, " Procurement of items /or Services" NE 4.02,"Specifying Supplier Engineering and Quality Verification Documentation" 29
11.
VIOLATIONS NOT ASSESSED A CIVIL PENALTY 10 CFR 50.72, "Immediate notification requirements for operating nuclear power reaptors," requires, in part, that the licensee shall notify the NRC as soon as practical and in all cases within one hour of any event or condition during operation that results in the nuclear power plant being in a condition that is outside the design basis of the plant.
10 CFR 50.73, " Licensee Event Report system," requires, in part, that the licensee shall submit a Licensee Event Report (LER) within 30 days after the discovery of any event or condition that resulted in the nuclear power plant being in a condition that was outside the design basis of the plant.
Contrary to the above, notifications and reports were not made within the required times as evidenced by the following examples, each of which represents a separate violation:
A.
As of August 28,1997, BECo had not reported in accordance with 10 CFR 50.72 and 10 CFR 50.73 that in July 1994 and August 1995, SSW system inlet temperature exceeded the design temperature of 65 F, as used in the accident analysis and as described in UFSAR Section 14.5.3., representing a condition outside the oesign basis of the plant. (04014)
This is a Severity Level IV violation (Supplement I).
B.
On June 6,1997, a design deficiency was identified in the SSW system that rendered the system vulnerable to a single failure in the event of a loss of DC power during a design basis event at specific tidal conditions and Cape Cod Bay water temperatures. UFSAR Section 10.7.2 indicates that no single active failure can prevent the system from achieving its safety objective. This condition was not reported to the NRC in accordance with 10 CFR 50.73 until July 18,1997. (05014)
This is a Severity Level IV violation (Supplement I).
C.
As of August 28,1997, BECo had not reported in accordance with 10 CFR 50.72 and 10 CFR 50.73 that in the past, as identified during the SWSOPl in 1995, the ambient temperature for operation of the EDGs had exceeded the maximum of 88 F as specified in UFSAR Section 10.9.3.9 and Table 10.9-2 representing a condition outside the design basis of the plant. (06014)
This is a Severity Level IV violation (Supplement 1).
D.
As of August 28,1997, BECo had not reported in accordance with 10 CFR 50.72 and 10 CFR 50.73 the identification of errors that resulted in higher average drywell temperature than the analysis for the containment temperature profile used for EQ of electrical equipment in the drywell as specified in the General Electric analysis of record, SUDDS/RF 87-917, "Drywell Temperature Analysis," dated September 2,1987, representing a condition outside the design basis of the plant. (07014)
This is a Severity Level IV violation (Supplement I).
30 i
j
REPLY TO VIOLATION li.A. B. C and D Admise,lon or Denial of Violation Bositon Edison Company admits regulatory requirements of 10 CFR 50.72 and 73 were not followed for the examples cited in the Notice of Violation.
Reason for the Violation We evaluated six examples of failure to report in accordance with 10 CFR 50.72 and 10 CFR 50.73 as part of our corrective action process (PR 97.3100). The four examples cited in this violation were among the six evaluated in that problem report. As documented in PR 97.3100.01, the causes for these violations were:
PNPS personnel failed to recognize our reporting philosophy was inconsistent with NRC expectations. This resulted in the practice of using operability evaluations which, at times, were based on engineering judgment versus completed analysis to determine if a condition was outside the design basis.
Existing deportability evaluation work instructions had focused on system functionality to determine whether conditions were outside the design basis.
For example ll. C., additional causes include:
Failure to consider historical temperatures for the EDG temperature issue.
The FSAR does not clearly distinguish design basis information from design information.
For example ll. D., additional causes include:
The misinterpretation of EOP guidance to maximize drywell cooling contributed to the erroneous conclusion the condition was not reportable.
Corrective Action Taken and Results Achieved The examples given in this violation were reported to the NRC as conditions outside the design basis of the plant pursuant to 10 CFR 50.72 and 73, as follows:
Example A: A 10 CFR 50.72 notification was made on November 4,1997, and LER 97-017-00 was issued on December 4,1997.
Example B: A 10 CFR 50.72 notification was made on July 18,1997, and LER 97-011-00, was issued on August 1,1997. Supplemental LER 97-011-01 was issued on September 30, 1997, and Supplemental LER 97-011-02 was issued December 30,1997.
Example C: A 10 CFR 50.72 notification was made on November 4,1997, and LER 97-021-00 was issued on December 4,1997.
Example D: A 10 CFR 50.72 notification was made on November 4,1997, and LER 97-018-00 was issued on December 4,1997.
RAD WI No. 3.06-01, " Deportability Evaluations," was revised incorporating new deportability guidance for evaluating potential conditions outside the design basis. This effectively lowered the threshold for reporting outside the design basis conditions.
31
e Problem Report procedure 1.3.121 was also revised to include the new deportability guidance.
. Nuclear engineering, regulatory affairs and operations supervisors and managers were briefed and personnel in those areas were subsequently trained on the new reporting considerations and the importance of conservative reporting.
The Pilgrim Regulatory Relations Group (RRG) Manager conducts audits of events and conditions determined to be not reportable as part of the group's quarterly self-assessment to ensure a low threshold for reporting is maintained.
Corrective Actions to Preclude Recurrence The Pilgrim FSAR will be upgraded to clearly distinguish design bases documentation from design information. This effort will be part of the design bases information program.
Results of Extent of Condition Reviews in order to focus the review on current design issues and not backfit the reporting i
l considerations to conditions which no longer exist, we reviewed open problem reports with I
operability evaluations using the revised reporting considerations to determine the extent of non-compliance, if any. Two reportable conditions were identified. One was reported to the NRC in LER 97-027-00, " Shutdown Cooling (SDC) Suction Valves Vulnerable to Damage from o tential Failure Mode involving Hot Shorts", on January 16, 1998.
An additional o
report bility evaluation conclusion was reversed concluding that the removal of floor plugs in the reador building during plant operation constituted a condition outside the design basis.
This con lition was referenced in LER 97-010-01 (May 22,1998) and will be reported in LER 98-012-OL Our corrective program will document the reasons for this late report.
Additionally, we reviewed the issue on the " Evaluation of the Effects of Using Various Damping Values in the Seismic Analysis of PNPS Piping Systems" (voluntary LER 92-001-
- 00) which involved the use of ASME Code Case N-411) as part of our extent review. We concluded this condition would have met our current reporting requirements as a condition outside the design basis from the time the condition was identified until the time analyses were ccmpleted that proved the affected systerr i and components were actually within their design bases. We have determined this is not trently reportable and will retract the LER.
An independent person with 50.73 ex.
ace reviewed a sample of 25 deportability evaluations for 1997 to verify there wert
, missed reports for other types of conditions or events. (completed 11/15/97)
Date of Full Compliance Full compliance with the reporting requirements of 10 CFR 50.72 and 50.73 will be achieved upon submittal of LER 98-012-00.
32
_-