ML031360572

M030515 - Briefing on Results of Agency Action Review Meeting - Exhibit

ML031360572
Person / Time
Site:	Davis Besse
Issue date:	05/15/2003
From:	NRC/OCM
To:
References
M030515
Download: ML031360572 (17)

Text

JoStarefos -34.wd - : zi z z Page i 3.4 The NRC and Industry Failed to Establish Adequate Requirements and Guidance for Addressinn AlloY 600 Nozzle Cracking and Boric Acid Corrosion of Carbon Steel Components The task group found that one of the contributing causes of the DBNPS event was that neither the NRC nor industry established adequate requirements and guidance for addressing VHP nozzle cracking and boric acid corrosion of carbon steel components. This is a cross-cutting conclusion that transcends all three other contributing causes. The task group determined that:

• The NRC failed to provide adequate requirements for the inspection of RCS components for leakage and degradation from boric acid accumulation.

• The NRC failed to provide adequate guidance to NRC staff to effectively implement the reactor oversight process.

• The industry failed to provide adequate requirements for detecting and correcting Alloy 600 nozzle cracking and corrosion from boric acid accumulation.

3.4.1 The NRC Failed to Provide Adequate Requirements 3.4.1. 1 Detailed Discussion The Task force reviewed applicable regulatory requirements, including Section Xl of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, 10 CFR Part 50.55a, and Davis-Besse technical specifications. The team found that these requirements were not sufficient to direct the licensee to identify and resolve VHP nozzle leaks.

The Code of Federal Regulations require compliarice with the ASME Boiler and Pressure Vessel Code (10 CFR 50.55a). The ASME Code, however, does not require the non-visual examination of VHP nozzles. The ASME Code does not require the removal of RPV head insulation to conduct visual inspections of the RPV head. More than any other single issue, the DBNPS event could be directly attributed to inadequate inspection guidance. These issues have already been recognized by the NRC staff, and actions were already being taken to address them. The enforcement of more general requirements involving RCPB leakage has also been problematic. While the GDC's proscribe RCPB leakage, they do not appear to be l enforceable and the existing enforcement guidance is outdated. The enforcement history, pertaining to RCPB leakage and Alloy,600 nozzle leakage appears inconsistent The task force attributed this to: 1) inappropriate licensee interpretations of plant Technical Specifications in which RCPB leakage found while the plant is shutdown is not reported the NRC as a Technical Specification violation because a licensee could not definitively determine when the leak started while the plant was operating; 2) the view by the NRC staff that such leaks are bound to occur through no fault of the licensee but are typically isolated in nature, which has undoubtedly resulted in undocumented enforcement discretion; and 3) no definitive enforcement guidance in this area. Additionally, the NRC had not consistently enforced violations resulting from pressure boundary leakage, nor had the staff effectively maintained corporate knowledge of enforcement regarding vessel head corrosion in 1987. In conducting its review, the task force found inconsistent levels of understanding of the scope and applicability of Code requirements among staff and management responsible for nuclear power plant oversight. -

ASME Code and Regulatorv Requirements - Requirements for in-service inspection (ISI) are I

- - , ___ 4 - -_ 1-_____--_-- -_ _... --.- -- __-_-__. _-._-__.__-_-_-

FJoelle tarefo's -^ .', page 2 kJoelle Starefos -: 3-4.WPd 3-4.wpd **. Pae2 contained in 10 CFR' 50.55a and plant technical specifications at section 4.0.5. Both of these reference Section Xl of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code. DBNPS was committed to the ISI requirements of the 1986 edition of the code from September 21, 1990, through September 20, 2000; since then, the licensee has been committed to the 1995 Edition through the 1996 Addenda.

Per the requirements of Table IWB-2500-1 of Section Xl, and the licensee's ISI plan, the licensee is required to conduct an RCS leakage test at nominal operating pressure prior to plant startup following each reactor refueling outage. IWA 5241 requires a direct visual examination, known as a VT-2, of the accessible external exposed surfaces of pressure retaining components for evidence of leakage from non-insulated components. Regarding insulated components (at Davis-Besse, the RPV head), IWA-5242 states that VT-2 may be conducted without removing insulation by examining the accessible and exposed surface and joints of the

'insulation. When doing such examinations, the surrounding area shall be examined for evidence of leakage. Discoloration or residue on surfaces examined shall be given particular attention to detect evidence of boric acid accumulations from borated reactor coolant leakage.

Corrective measures are specified in article IWA-5250, which requires leakage sources of boric acid residues, and areas of general corrosion, to be located. IWA-5250(b) also requires that components with areas of general corrosion that reduce the wall thickness by more than 10%

shall be evaluated to determine whether the component may be acceptable for continued service, or whether repair or replacement is required.

The code does not require non-visual examinations, such as surface or volumetric NDE of VHP nozzles as a means to identify and characterize cracks in those nozzles.

In September 2001 (roughly concurrent with the review of licensee responses to Bulletin 2001-01), NRC staff members who serve on ASME code committees wrote to ASME and proposed that the inspection requirements be changed to VT-2 examination of 100% of the reactor vessel head surface or under the head NDE capable of detecting and sizing cracking.

ASME is considering changes'to the inspection requirements, but has yet to implement revisions. '

The Code requirements for mechanical joints (e.g., CRDM flanges at DBNPS) in the RCS differ from those for welded joints. Provided that the licensee performs an assessment of any leakage from m'echanical joints, and the leakage volume is within technical specification limits, it is permissible for plants to start up from refueling outages with known leakage from mechanical joints. The Task Force found that the licensee's practice of operating with known CRDM flange leaks helped to mask the VHP leakage. The Task Force concluded that the looseness in the applicable ASME Code requirements, i.e., the ability to analyze, rather than fix, known RCS leakage, enabled the licensee to tolerate leakage on the RPV head.

As discussed in Section 3.1 of this report, there have been several cases of through-wall cracking of VHP nozzles. In fact, the licensee for Arkansas Nuclear One has concluded that a through wall cracking of VHP nozzles to be a'statistical certainty. In the case of Davis-Besse, the Task force determined that the lack of a requirement in the ASME code to remove the vessel head insulation during system pressure tests contributed to the missed opportunities for early identification of nozzle leakage and resulting corrosion of the vessel head. Also, the failure to conduct periodic volumetric NDE on the nozzles prevented the licensee from detecting cracks before they progressed to the point of leakage. This is because that even under ideal 2

[Joelle Starefos-3-4.wpd - age 3a conditions, a visual examination is incapable of determining the extent of cracking. It is only capable of determining that cracking has advanced sufficiently to allow RCPB leakage.

Enforcement of RCPB Leakage Requirements - Plant technical specifications typically prohibit operation with known pressure boundary leakage. Therefore, relying on boric acid residues to show that through wall nozzle leakage has occurred is a lagging indicator. In cases where pressure boundary leakage has occurred, the NRC's responses have been inconsistent over the years. Based on staff interviews and document reviews, the task force found a range of agency responses, from no action taken in the case of Arkansas Nuclear One, to the granting of enforcement discretion in the cases of VC Summer and Oconee, to taking enforcement action against Palisades arid San Onofre. Several factors contributed to this phenomenon, including intenal communications, varying licensee interpretations of technical specifications and 10 CFR 50.73 reporting requirements, staff variability regarding the treatment of passive component failures, the introduction of the ROP, and lack of enforcement guidance. As of the preparation of this report, the NRC's Office of Enforcement was working with NRR to develop a uniform policy for dealing with pressure boundary leakage.

For example, EA 97-414 involving Inconel Alloy 600 RCS instrument nozzle cracking at SONGS 2 and 3 cited the Maintenance Rule (10 CFR 50.65) because of a lack of staff support to cite against the licensee's Technical Specification for reactor coolant pressure boundary leakage.

The violation was cited at a Severity Level IV because there was a lack of unanimity as to whether the violation should have been cited as a Severity Level IlIl violation. During the PEC, the licensee presented information in which they asserted that'the'NRC and industry have recognized that leakages due to PWSCC are not an immediate safety concem because the staff believes that catastrophic failure of a penetration is extremely unlikely. In reference to the Technical Specification requirement proscribing pressure boundary leakage, the licensee quoted from NUMARC 93-01, 9.3.1, which states: "Entry into a Technical Specification Limiting Condition for Operation, although important, is not necessarily risk significant." The entire licensee argument was focused on the nozzle ejection stemming from catastrophic failure rather than from boric acid wastage. In the case of the event at VC Summer, the licensee did not make a 10 CFR 50.73 report for the underlying technical specification violations associated with operating with RCPB leakage until after enforcement discretion was issued some time following discovery of the problem.

The Task Force discussed with OGC staff the enforceability of the General Design Criteria (GDCs) in Appendix A of 10 CFR Part 50. The GDCs are referenced in licensing documentation and, often, in generic communications. The current OGC advice is that the GDCs are generally not legally enforceable because 10 CFR Part 50.34 requires applicants to address them in their license applications and Preliminary Safety Evaluation Reports. The GDC requirements are then embodied in licenses on plant-specific bases. In order to be able to enforce a GDC at a particular plant, the NRC would have to be able to show: that there is nothing else in a plant's license that would cover the matter in question, and; how adequate protection requirements have not been met by the existing licenses.

Technical Specifications Related to RCPB Leakage - DBNPS technical specification 3.4.6.1 requires the containment sump level and flow monitoring system and one containment atmosphere radioactivity monitor.to be operable. The basis for this specification states that these detection systems are consistent with the recommendation of Regulatory Guide 1.45, "Reactor Coolant Pressure Boundary Leakage Detection Systems." The regulatory position in 3

Joelle Starefos 4.wd - , Pase4 RG 1.45 states, in part, that these systems should be adequate to detect an unidentified leakage rate of I gpm in less than one hour.

Regarding the sensitivity of leakage detectors, RG 1.45 states: "Sumps and tanks used to collect unidentified leakage and air cooler condensate should be instrumented to alarm for increases of from 0.5 to 1.0 gpm in the normal flow rates. This sensitivity would provide an acceptable performance for detecting increases in unidentified leakage by this method."

Beyond this reference, neither the technical specifications nor the regulatory guide discuss situations in which unidentified leakage increases noticeably from normal steady state values while still remaining below 1 gpm. Additionally, these documents do not contain any requirements for responding to leakage detection system alarms. 'At DBNPS, leakage detection system alarms occurred, but the licensee's response to them did not lead to identification of the pressure boundary leakage that occurred on the RPV head.

Technical specification 3.4.6.2a specifies that there shall be no RCS pressure boundary leakage. The basis for this specification states: "Pressure boundary leakage of any magnitude is unacceptable since it may be indicative of an impending gross failure of the pressure boundary. Therefore, the presence of any pressure boundary leakage requires the unit to be promptly placed in cold shutdown."

The surveillance requirements for the leakage detection systems require various channel checks, calibrations, and functional tests, as appropriate for the systems and instrumentation involved. The surveillance requirements applicable for pressure boundary leakage include monitoring the containment atmosphere gaseous or particulate radioactivity at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, monitoring the containment sump level and flow indication at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and performance of an RCS water inventory balance at least once per 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> during steady state operation.

From 1995 through the middle of 1998, unidentified leakage from the DBNPS RCS averaged about 0.05 gpm every month.' In August, 1998, unidentified leakage began to icrease steadily, and it was above 0.5 gpm in December, approximately a tenfold increase in four months. This leakage was primarily due to leakage from the pressurizer relief valve, which is discussed elsewhere in this report. Unidentified leakage continued to increase until it exceeded the RCS condition monitoring criterion of 0.75 gpm in April 1999. This criterion had been established by the licensee as part of its response to the Maintenance Rule (10 CFR Part 50.65). After the relief valve was repaired, unidentified leakage ranged from about 0.15 to 0.27 gpm until the plant was shut down for the 12 th refueling outage in the Spring of 2000. This amount of leakage was about three to five times as high as the long term average steady state leakage from 1995-1 998.

Based on the above, the Task Force concluded that the licensee failed to follow up on reliable indications of increased unidentified leakage. Factors contributing to this failure included: a) the lack of requirements for responding to leakage detection system alarms, and b) the lack of a Maintenance Rule leakage criterion based on deviation from normal, in addition to the single threshold criterion.

Probabilistic Treatment of Passive Components - The treatment of piping within the framework of risk-informed regulation appears to have been a complicating factor in addressing issues with RCS pressure boundary integrity. Based on interviews with knowledgeable NRC staff and 4

. 4oelle Starefos 4.wpd - Page 5, management, the Task Force leamed that the degradation of passive components, specifically, wastage from outside the pressure boundary, has not been explicitly accounted for in PRAs. -

Although risk estimates of the rapid failure of a pressure boundary are used as inputs into PRA LOCA models, in practice, piping is generally treated deterministically. Deterministic requirements include the GDCs and Sections III and Xl of the ASME Code, and these are used in conjunction with available risk information to establish baseline assumptions for PRAs. This factor has led to difficulty among regional, NRR, and OE staffs in characterizing the significance of,-and responding accordingly to, instances of pressure boundary leakage.

BL 2001-01 Required Shutdown Date - BL 2001-01 required high susceptibility plants to shutdown by December 31, 2001, and inspect their RPV head penetrations. The task force found through interviews with NRC staff, that the basis for the date was predominantly logistical. It was chosen to give licensees time to allow plants to use the fall outages to information from inspections that could be provided in responses to the NRC. The proposed order to shutdown DBNPS by December 31, 2001, (see memo from Travers to the Commission November 11, 2001) cited inspection results at facilities with similar susceptibility ratings as DBNPS and large uncertainties in the cracking mechanism and extent of cracking at the plants.

It also characterized the Oconee circumferential cracking as "potentially risk-significant condition" that could result in gross RCPB failure and LOCA. The proposed order explained that inspecting for leakage was not sufficient to detect extent of nozle damage. It clearly stated that VT-2 methods do not provide reasonable assurance that leakage from though-wall flaw would be detected. The proposed order also highlighted other shortcomings of the ASME code inspection requirements, i.e., no insulation removal, NDE not required, head cleanliness not addressed.

In considering the proposed rule, the NRC staff surmised that RCPBs could be compromised at DBNPS and DC Cook, therefore the December 31, 2001, shutdown was to be required. The proposed order stated that near term inspections were required due to damage detected in other plants and uncertainties/variability in plant susceptibilities:

"Operation of facilities considered to be highly susceptible to this cracking phenomenon beyond December 31, 2001, is unacceptable unless the recommended inspections to identify this potentially hazardous condition are completed and found acceptable by the staff."

The proposed order also provided a risk-based argument for the unacceptability of operation past December 31, 2001. The staff cited B&W design-specific information, D-B TS3141416 for pressure boundary leakage and applied risk-informed decision criteria in RG 1.174 (small in crease in CDF, and that the basis for the licensee's risk estimate could not be verified without inspection).

The licensee submitted additional risk-related information on November 30, 2001, and made several commitments that the NRC considered sufficient to allow continued plant operation (see December 4, 2001, NRC letter to the licensee). However, as stated in Section 3.3.7 of this report, the staffs technical basis was not clearly documented. In interviews with NRC staff, the task force found that the additional information from the licensee affected the perceived risk of the situation and affected the staffs decision. In interviews with the task force, the staff recalled little discussion amongst the staff about the requirement to maintain RCPB leakage integrity. As discussed in Section 3.3.7, some staff members thought that the reliance on a risk analysis in such stuations undercut the ability to apply regulatory requirements. The task force concluded that the weaknesses in application of regulatory requirements for RCPB 5

IJoelle Starefos 4.wpd - .

leakage integrity, and the reliance on risk estimates rather than assuring RCPB leakage integrity affected the decision to allow DBNPS to operate past the date in BL 2001-01.

3.4.1.2 Recommendations 3.4.1.2.1 Recommendations for NRC

• The NRC staff should continue to pursue ongoing efforts to encourage the ASME Code requirement changes for inspections of reactor vessel heads, including nozzle penetrations, strengthened (NRR), or as an altemative, pursue changes to 10 CFR 50.55a.

• The NRC should pursue revision of the ASME Code to reduce the ability for plants to start up with known leakage from RCS mechanical joints.

• The NRC should establish a clear enforcement policy for RCS leakage and should not grant enforcement discretion for nozzle cracking.

• NRC should review the bases for the I gpm unidentified leakage limit to deterrnine if this criterion is adequate to address low levels of leakage from the RCS pressure boundary.

• NRC should review, and revise as necessary, the Maintenance Rule requirements and guidance pertaining to RCS unidentified leakage. The results of this review should-address requirements to establish a normal level of unidentified leakage and methods for establishing acton levels based on deviations from normal.

3.4.1.2.2 Recommendations for Industry Industry should revise related ASME code requirements to address the shortcomings in VHP inspections arid reduce the ability for plants to start up with known leakage from RCS mechanical joints.

6

Pace 7 .1 I -

Jelle Starefos - 34.wrpd - I

-JQelle

---

P e 3.4.2 The NRC Failed to Provide Adequate Reactor Oversight Process Guidance There is no specific reactor oversight process guidance that would have caused the NRC to focus on the issues associated with this event, particularly in the area of boric acid corrosion control. This transcends the significant changes to the NRC's reactor oversight process that became effective in April 2000. Prior to this time, the NRC had a nonmandatory inspection procedure in the area of boric acid corrosion control that was never used at DBNPS and rarely used at other plants. This procedure and dozens of other inspection procedures, including one that was occasionally used to perform inspection follow-up of NRC generic communications, were canceled in 2001 because of their lack of use during the first year of the revised reactor oversight process. Additionally, neither the previous nor the current Inspection program places much emphasis on the inspection of passive components, such as the RPV. The NRC's significance determination process is not well suited to assessing the significance of degraded passive components. Some of the inspector good practices, such as the review of startup mode restraints and containment closeout inspections that were routine prior to April 2000 were not evident after April 2000. Little or no specialized training is provided to the inspection staff on boric acid corrosion control. Some inspectors did not follow up on symptoms of the RPV degradation because they believed the baseline inspection procedure guidance did not specifically address these areas .

The current NRC programs and processes, even if effectively implemented, would not address all the negative safety culture characteristics and attitudes evident at DBNPS. The elements of the NRC's reactor oversight process and otherprograms (e.g., allegations) involving the cross-cutting areas of human performance, corrective actions, and safety conscious work environment have not been nor would be fully effective in assessing the significant DBNPS safety culture deficiencies in the absence of a significant underlying performance issue such as this. These cunrent tools are extremely limited in scope or have no regulatory teeth. While it is true that the implementation of corrective action inspections did not result in an accurate assessment of the licensee performance in this area, it is not at all clear that meaningful licensee actions would have been taken even if the assessments were accurate absent the identification of a significant issue. The team attributed part of this lack of implementation effectiveness to insufficient guidance. The broader issue, however, is the NRC has no effective means of dealing with a poor safety culture at a plant prior to the onset of serious operational events or conditions. This problem is well recognized, but past actions to address it have not been fully effective. DOES THIS OVERVIEWPARAGRAPH STAY IN THIS SECTION 3.4.2.1 Detailed Discussion The DBNPS event identiFied a lack of guidance for assessment and inspection activities that involve alloy 600 nozzle cracking and boric acid corrosion of carbon steel components. Specific areas where the improvements in the guidance are warranted include inspection, enforcement, and significant detemination. In addition,-the team identified other areas of the ROP that lacked adequate guidance which were not directly related to alloy 600 nozzle cracking and boric acid corrosion of carbon steel components. This section of the report discusses in detail some of the guidance weaknesses and refers to other sections of the report that mentions guidance weaknesses. The intent of this section is to identify all NRC guidance related to the ROP that should be reviewed for areas of improvement. Some of these weaknesses transcended the 7

1,Joelle Starefos - -4.WPCI *. Pat3 8 2

.wpd Joelle Starefos 3ao~8?-

ROP and pertained to the guidance that existed prior to ROP implementation in April 2000.

The only specific inspection guidance for boric acid corrosion was provided by IP 62001, Boric Acid Corrosion Prevention Program, which was issued on August 1, 1991, and subsequently canceled on January 17, 2001. The purpose of the IP was to determine if licensee boric acid corrosion control program and its implementation satisfied the requirements of GL 88-05.

During IP development, the recommended implementation frequency was once every other refueling outage. When it was issued, the IP was included in Appendix B to the old IMC 2515 program which listed regional initiatve inspection procedures. The team was unable to determine the rational for the change in implementation frequency. During the 10 years the IP was part of Appendix B, it was used on a limited basis for inspections at only 15 docketed reactors. The decision to implement IP 62001 as a regional initiative activity under Appendix B and subsequent limited usage resulted in the inspection program guidance for boric acid*

corrosion being ineffectiveness in ensuring that licensees were properly dealing with boric acid leakage. The decision to not make IP 62001 a mandatory inspection under the "core program" is consistent with the level of importance exhibited by the NRC staff for boric acid corrosion (see Section 3.1._ for additional discussion). In interviews with the NRC staff, some members indicated that the inspection resource estimation of 8-hours was not sufficient to review a boric acid corrosion program and its implementation. In reviewing DBNPS's boric acid corrosion program the team agreed that the estimate was low.

An NRC inspection area that is related to alloy 600 nozzle cracking is the review of inservice inspections (ISI) activities. Applicable inspection guidance is provided by Inspection Procedure Attachment 71111.08, Inservice Inspection Activities. Prior to the ROP, the guidance was prescribed in IP 73753, Inservice Inspections. There was no explicit inspection guidance in either documents to review alloy 600 locations that are potentially venerable to PWSSC. As noted in Section 3.3.2, NRC inspections in the 1998 and 2000 RFOs reviewed CRDM and reactor head areas but did not identify any unusual conditions with boric acid that had been in the areas.

As noted in Section 3.1 _, GL 88-05 did not have a corresponding temporary instruction for follow up inspection of licensee implementabon of actions resulting from the GL, however, an audit was performed at ten sites to review boric acid corrosion program. The team noted that the audit guidance did not include reactor nozzle penetrations or other Alloy 600 penetration that are potentially venerable to PWSSC.

DBNPS's failure to learn from operating experience and properly manage VHP nozzle degradation and boric acid corrosion is discussed in Section 3.2.4. The team reviewed the previous two NRC inspections of the DBNPS's corrective action program, IP 40500 inspection in August 1998 and PI&R inspection in February 2001, and noted that operating experience implementation was reviewed in each inspection. No significant problems with DBNPS's operating experience activities were identified in these inspections. IP 71152, Identification and Resolution of Problems, provides very limited inspection guidance for reviewing licensee Resolution of operating experience issues. IP 90700, Feedback of Operational Experience Information at Operating Power Reactors, was a regional initiative inspection under Appendix B of IMC 2515 before the IP was canceled in September 2001. Between November 1994 and October 1999, IP 90700 was used at 29 docketed reactor sites (data on IP 90700 usage for the remaining time frame that it was in place was not available). The rational provided by NRR for canceling this IP, along with IP 62001, was the limited utilization of the IPs under the ROP.

8

-. 1" I Joelle Starefos'-- J I

.wpa) - Pnp C911 Starefos -

i Joelle ll-4.W Both IPs were included in Appendix B, Supplemental Inspection Program, as part 6f the ROP until they were canceled. As discussed in Section 3._._ the team questioned the rational of canceling IPs from Appendix B, based on limited ROP usage since the ROP structure provides limited opportunities to use the IPs in Appendix B. Based on DBNPS's poor OE usage, the frequent use of IP 90700 as a regional initiative inspection and the limited OE guidance in IP 71152, the team concluded that the ROP does not properly emphasize the review of OE.

To assess the NRC's ability;to have recognized and acted upon the symptoms of RCS leakage in containment and boric acid on the reactor head the team reviewed related inspection guidance, the actual number of inspector containment entries, and questioned the inspectors on their containment activities. Inspection Procedure Attachment 71111.20, Refueling and Other Outage Activities, lists only a few specific activites that would require a containment entry during a refueling outage. One example is the guidance for a containment walkdown prior the reactor startup to verify that debris has not been left which could affect containment sump performance. While this does require an actual containment entry, interview with inspectors suggested that the scope of the containment walkdown inspection was not broad enough. They mentioned that prior to the ROP, inspectors would typically performed perform a thorough inspection and walkdown of containment prior to restart. With the current guidance in 71111.20 and the more prescriptive nature of the ROP there is uncertainty if this "good practice" will continue to be performed. In light of DBNPS head degradation the team believes that inspections of structures and passive components in containment during the refueling outage has merit. This could entail a review of important component for obvious signs of deterioration, such as the containment liner, the reactor vessel and major RCS components. When reviewing previous DBNPS inspection reports another good practice was noted which is not captured in current inspection guidance and may not be performed in the future. This dealt with the review of Mode restraints and verification that they are properly disposition prior to startup.

During discussions with some inspectors the team was informed that observation of fuel movement in the containment was previously required by the inspection guidance, but that Attachment 71111.20 now allows this to be done by remote video cameras from outside the containment. The team reviewed 71111.20 and noted that verification of the proper location for fuel assemblies is allowed by review of videotape or core physics testing, but that the guidance for verification of foreign material controls during refueling activities would require a containment entry. The team concluded that inspection guidance related to fuel movement does require containment entries but that some inspectors were confused by the wording in the IP.

When questioned if they reviewed the symptoms of RCS leakage in containment, some-inspectors stated that the ROP inspection scope did not include a review of some of the symptoms. Radiation monitor fouling and inspection of the head were examples that were mentioned. The team disagreed with this view because fouling the radiation monitors with iron oxide and reddish brown boric acid on the head were indication of potentially significant.,

problems tbat can be inspected under the ROP. Determining an adequate number of containment entries by inspectors during refueling outages is directly related to inspection scopes and corresponding inspection activities. In 1998 and 2000 the resident inspector and senior resident inspector had a total of seven containment entries during each RFO. To benchmark this information the team obtained resident inspector containment entries for five other sites. DISCUSS RESULTS The team concluded......

9

E-.

X oelle Starefos 4.wDd P:;nt- in I t .ioeiie tareros - i-4.WDd - Pn1fl4 As noted in Section 3.3.2, Appendix D, Plant Status, to IMC 2515 provides limited guidance on the methodology for reviewing corrective action documents routinely initiated by the licensee.

Specifically the team questioned if the senior resident inspector read the CR description pertaining to boric acid found on the reactor head in' 12RFO of if the senior resident inspector was aware of the issue by some other means, such as log review, abbreviated description review or meeting discussions. Since there is no specific guidance for these reviews, the team concluded that future reviews of corrective action documents could also miss crucial opportunity to follow up on licensee resolutions of potentially significance safety issues.

The February 2001 P&R inspection, as discussed in section 3.3.2, did not review any of the issuesl problems'related to RCS leakage or boric acid on the reactor head. Clearly, the longstanding nature of the problems and the ineffective licensee corrective actions satisfied the expectation that a PI&R inspection would review this type problems. The guidance in IP 71152 for screening issues to be reviewed by the PI&R was a potential area that could revised to address this situation.

Review of the ROP significance determination process (SDP) and interaction with DBNPS head degradation identified two noteworthy points. First, the SDP review to determine the safety significance of the head degradation has'required a large amount of time and resources.

Currently the SDP review is not completed and has been ongoing for five months.- This review highlights the difficulty in determining the probability of failure for degraded, but still functioning components. The NRC has had difficulty with other SDPs in which the performance deficiency did not result in an actual failure but there was some degradation in the component or system to satisfy its design basis function. Part of the difficulty stems from technical limitations of risk assessments and SDPs in that pressure boundary integrity does not appear to be treated explicitly in PRAs. The second point involves the RC-2 event from 1998 (see Section 3.3.2) and the fact that an SDP review for this issue would most likely result in a Green finding. In 1999 this event received escalated enforcement, Severity Level lIl violation. This event also dealt with a degraded pressure retaining function, however. an analysis concluded with three body-to-bonnet fasteners corroded the valve would since maintain the integrity of the RCS under design loading conditions. These two items point out difficulties and limitations of the SDP.

As noted in Section 3.3.3, the ROP performance indicators for DBNPS in the barrier cornerstone have been Green since ROP implementation. Given that the VHP nozzle through wall leakage was ongoing during this time frame, the usefulness of the ROP barrier Pis to provide meaningful information regarding the condition of the three barrier is questionable. The current barrier Pis should be reviewed for possible improvements.

The ROP structure doesn't allow the implementafion of non-baseline inspections unless a greater than green finding is identified. Prior to this event, all ROP Performance Indicators and inspection findings were Green, indicating a lack of risk-significant issues at DBNPS.

Subsequent to the identification of the DBNPS head degradation, Region IlIl invoked Manual Chapter 0350, Oversight of Operating Reactor Facilities in a Shutdown Condition with Performance Problems, without meeting the prerequisites of the procedure. Specifically, DBNPS performance was not degraded into the multiple/repetitive degraded comerstone, or the unacceptable performance columns of the action matrix. The LLTF concluded that timeliness of the risk assessments and the ROP structure, allowed an issue such as this being viewed as significant from a deterministic perspective, yet the staff having limited option for further NRC 10

t Joel = - pPgs _af action from a program standpoint.

NRC enforcement focus was shifted by the risk-impact of issues and enforcement actions have not been implemented consistently due to differing staff views. Enforcement (EA 97-414) was issued citing the Maintenance Rule (10 CFR 50.65) involving Inconel Alloy 600 RCS instrument nozzle cracking at SONGS 2 and 3 due to a lack of staff support for enforcement against the licensee's Technical Specification for reactor coolant pressure boundary leakage. In addition, the staff issued the citation as a Severity Level IV, versus a Severity Level IlIl when the staff could not come to full agreement. The licensee presented an argument that was focused on nozzle ejection stemming from catastrophic failure rather than from boric acid wastage.

The team conducted a limited review of past NRC lessons-learned reviews to determine whether there were any recurring problems. This included lessons leamed reviews for Millstone, IP2, and South Texas Project). The task force identified a number of problem areas that were identified in these past reviews that are similar to some of the regulatory process issues associated with this review. These issues are described in Appendix F.

3.4.2.2 Recommendations 3.4.2.2.1 Recommendations for NRC

• Review the significance determination process for limitations in evaluating degraded conditions and applying risk assessments. Consideration should be given to the use of deterministic methods in assessment evaluations;

• Review the ROP inspection effort during refueling outages given the large of amount of licensee activities in the relatively short outage time frame, limit future opportunities during operating cycle, and a lack of previous inspections for passive components;

• Consideration should be given to proceduralizing "good practices" such as containment building tours, Mode restraint reviews prior to startup, etc;

• Evaluate performance indicators in barrier integrity comerstone to determine if improvements are needed;

• Evaluate the reactivation and implementation of inspection procedures 90700 and 62001 or provide comparable level of guidance for operating experience and boric acid corrosion program inspections;

• Consider risk of repetitive LCO entries or continuing problems; develop inspection guidance to focus on repetitive multiple tasks for significance (i.e. CAC cleaning/ALARA);

• Develop inspection guidance for resident inspector samples of licensing requests to understand the basis and provide necessary feedback to the project manager,

• PI&R guidance should be strengthened in the area of utilizing experience from members of the staff to develop area of review, i.e., handing off issues to the PI&R team, and 11

L'-:- _--_'I kJoelle Starefos 4.wpdaget1j screening corrective action issues when deterrnining issues for follow up review; Develop NRC criteria for inspection of industry initiatives.. Provide inspection guidance to address selected industry operational experience. Initiate GC-specific inspection procedures. Incorporate GC references in inspection procedures

• Assess the need for changes to the ROP to allow regional follow up on issues of potential safety significance

• Deternine if the results from reviewing previous lessons-learned task force efforts suggest a need for programmatic guidance in this area 12

Jvo.eUle Starefos 4.wpd e,i 3.4.3 The Industry Failed to Provide Adequate Guidance for Detecting and Correcting VHP Nozzle Cracking and Boric Acid Corrosion Despite many years of industry operating experience and research results related to boric acid corrosion and VHP cracking, industry guidance did not result in the timely detection of VHP nozzle leakage at DBNPS. Some of the guidance associated with VHP nozzle cracking and boric acid corrosion control appeared to be wrong or incomplete. For example, the acceptability of visual inspections alone does not appear to account for the worst case corrosion rates, which could result in an unacceptable level of wastage in one cycle. Other guidance reinforced the licensee's view that it was acceptable to leave boric acid deposits on the head because it stated that a coating of boric acid was actually beneficial under certain circumstances. No guidance was provided on how to'actually remove boric acid deposits from the head, for example, by power washing with water. Also, the RPV head insulation was not deflected by the large amounts of boric acid deposits even though the BWOG guidance indicated that such bulging would be an indication of VHP nozzle leakage. Further, industry organizations did not follow up on implementation of existing guidance nor provide effective oversight of licensee activities related to boric acid corrosion control or VHP degradation.

The task group determined that the combination of inadequate industry guidance in some areas, misapplication of some guidance by DBNPS, and a lack of oversight by industry groups and commercial organizations all contributed to the underlying causes of the DBNPS event.

3.4.3.1 DetailedDiscussion Industry Technical Guidance - The industry effort to address boric acid corrosion control provided general guidelines to licensees to establish their programs'that was based on conducting a few exploratory tests to gage the potential for damage due to boric acid corrosion.

However, the extrapolation of the test results and the underlying message may have de-emphasized plant vulnerability to a significant mode of corrosive affack on VHPs.

The Electrical Power Research Institute (EPRI) and Nuclear Maintenance Application Center (NMAC) joined to provide assistance to the utilities in addressing the requirements of Generic letter 88-05, "Boric Acid Corrosion of Carbon Steel Reactor Pressure Boundary Components In PWR plants," issued in March 1988. The EPRI "Boric Acid Corrosion (BAC) Guide Book,"

issued in April 1995, was the product of this joint effort. A subsequent revision to the Guide Book was'issued in November 2001. Its objective was to provide a single source of comprehensive information to help utilities address plant boric acid control and general leakage reduction issues:

The BAC Guide book draws a conclusion (Section 8.3.3 in Revision 1and 8.1.2 in Revision 0) that "It is hypothesized that, under certain conditions, boric acid deposits on the vessel head actually protect the surface from corrosion by keeping the water away from the surface. ...lf the leakage rate is low and its-source is above the boric acid deposits, heat transfer through the deposits will evaporate the incoming water and thereby keep the surface dry. On the other '

hand, if the leakage rate is high or if the source is located within the boric acid deposits, the deposits will be wetted, leading to high corrosion rates at the vessel head." This phenomenon explains a probable chemical reaction that happened at DBNPS.'iHowever, the illustration of this problem is given to a sketch with boric acid deposits building up from a flat surface as result of dripping boric acid from above, akin to CRDM flange leakage.' RPV head penetration 13

4~Joelle Starefos - 344.wpd .Pa.gei4j cracking was a well known problem for more than two decades and the task force judged that the industry should have analyzed more conservative scenarios for corrosion as it relates to VHPs.

The BAC Guide Book Revision 1, Section 4.7, discusses the various tests performed by EPRI and CE. The CE tests were performed with the nozzle pointed downwards contrary to the typical plant application. The EPRI tests had the nozzles mounted upwards and the tests demonstrated that the maximum corrosion depth is near the point where the borated water is injected into the annulus. The assessment further states that "Corrosion occurring at this location would not be seen during the visual inspection of the vessel surface, although boric acid deposits on the metal surface would indicate that there has been a leak." This significant finding of corrosion hidden from' visual surface inspection was not investigated further to understand more conservative or worst-case scenarios. The test results indicate a maximum corrosion rate of 4 inches per year. Such a high rate of corrosion, not identified in the visual inspection at its early stages, could propagate to a point of rupture in a typical 18 month-to-two-year cycle. The possibility of observing surface deposits and its quantity would depend on the rate of leakage and the rate of corrosion at the time of the inspection. Leaving rusty deposits on the surface while corrosion continues in the inner layers at more than one VHP appear to be a clear possibility. The present inspection program was not evaluated by industry for its capability to detect such impending failures. The team concluded that the industry continued to rely on visual inspections that did not require the removal of the RPV head insulation, after having identified this critical vulnerability of VHP area corrosion and recognizing a wide range in the rate of corrosion.

The task force judged that these deficiencies in the industry technical guidance may have contributed to misunderstandings by the licensee regarding implications of boric acid corrosion and the effects of VHP leakage. The misunderstandings in tum contributed to a lax approach taken by the licensee in addressing RCS leakage and boric acid corrosion issues. In the view of the task force, the industry and NRC should take steps to ensure that accurate technical information and guidance is made available to licensees.

In the initial edition of the book, Section 6.2 addresses detecting leakage during operabon. This guidance could have alerted DBNPS to the continuing boric acid leakage. The Containment Air Particulate Monitor was identified in the report to have the capability to monitor 0.1 gpm assuming normal primary system activity and no failed fuel. The containment Air Cooler Condensate Monitors were referred to as another system capable of providing clear, sensitive informabon. Continued clogging of containment air coolers and the contairtment monitor filter clogging were important indications of RCS leakage at DBNPS. This condition prevailed even after 12RFO when CRDM flange leakage was corrected through repairs. In this instance, the task force judged that if the licensee had been more cognizant of the guidance, the RPV head leakage may have been detected earlier.

The task group found examples of industry policy contributing to misconceptions of the consequences of RCPB leakage and associated corrosion. The NUMARC position on CRDM VHP cracking was discussed in the June 16, 1993, letter to NRC. The letter forwarded the PWR owners groups safety assessments of VHP cracking. The owners group reports concluded that cracking was not an immediate safety concem. NUMARC added that if a through-wall crack would occur, the boric acid deposition expected would be detectable by inspection activity conducted in accordance with GL 88-05. NUMARC believed that detection of 14

~~~~ - - _ _ ~ ~~~

Joelle Staefs - 3 . Paae'.15:1 Joelle Starefos 3 4.wpd

- 4.wpd

• Paae'.15:i leakage would prevent any significant BA-induced wastage that would challenge ASME limits.

This was a relatively early indication that a connection was made by industry between VH penetration cracking and the potential for head wastage.

The NEI letter to NRC dated May 24, 1995, provided the status of industry activities related to VHP cracking. It discussed pilot plant inspection results, refers to NUREG/CR-6245, the owners group safety evaluations, GL 88-05 programs, crack growth rate model development, and VHP re-inspection efforts. However, it maintained the position that VHP degradation was a problem with low safety significance. The task force judged that, given the operating experience overseas, the range of experimental results (published in industry reports), and the regulatory requirements associated with RCPB leakage, that the industry position was not appropriate and that industry groups were not sufficiently aggressive in addressing RPV head penetration integrity concems.

B&W, nor the B&W Owners Group made formal recommendations to licensees in the areas of RCS leakage or boric acid corrosion control, and specifically to follow up on generic communications or industry guidance. Based on discussions with industry representatives, the task group determined that B&W/Framatome has not issued formal recommendations to, licensees in the areas of boric acid control, RCS leakage or leak detection. The task force found no follow up on GL88-05 by the B&W owners group. The owners group referred to report BAW-2301 as the B&W owners group follow up to GL 97-01 (Review BAW-1403 for guidance to licensees.) The task force found important areas that needed guidance to be lacking. For example, no guidance was provided to licensees on how to remove boric acid deposits from the RPV head. DBNPS used several methods, including a water wash. Prior to RFO 12, the licensee considered the possible effects of water washing the RPV head, but lacked technical guidance from industry to aid its decision. Also, despite industry guidance that bulging insulation is a reliable indicator of leakage and boric acid corrosion, no insulation bulging or defects were observed at DBNPS before February 2002.

In 1996, NEI issued a document that included a discussion about an economic model that licensees could use to aid decision-making related to RPV head penetration inspection and repairs. The NRC mentioned the model in GL 97-01, disagreeing with NEI that economic factors were a primary consideration. However, the task force found no evidence that the staff actually reviewed the model, nor that the industry changed its position relative to the GL 97-01 statement. The task force surmised from interviews with licensee personnel (see Section 3.2.??) That the licensee did indeed place undue weight on economic factors associated with RPV head cleaning, RCPB leak detection and correction, and VHP degradation issues. The task force concluded that industry emphasis of economic factors evidenced by providing licensees with economic analysis "tools" could have been a contributor to the approach taken by the DBNPS licensee and, in turn, contributed to the 2002 event.,

Industry Self-Assessment - The task force reviewed Institute of Nuclear Power (INPO) and World Association of Nuclear Operators (WANO) evaluation reports involving DBNPS to determine whether INPO or WANO had assessed and documented any problems involving VHP nozzle cracking or boric acid corrosion of the RPV head. Two of these evaluations documented problems involving boric acid corrosion of pumps and valves. For example, the March 10, 1998 interim report of WANO-AC's 1997 peer review of the DBNPS, documented an area for improvement in the maintenance area for not identifying and correcting boric acid 15

I Joelle taretos - 34.Wod .Paae 16il PaQe 16]

I Joelle Staretos 3-4.wpd accumulation on pumps and valves. The November 1999 INPO Evaluabon of DBNPS, noted that in September 1998 the reactor coolant system pressure boundary was degraded because of boric acid corrosion of the pressurizer spray valve (refer also to Section 3.3. of the report), as well as nine other valves that were discovered with boric acid corrosion.

These evaluations did not result in the integration of the symptoms and potential indicators of the VHP nozzle leaks. For example, the November 28, 2001, interim report of INPO's 2001 evaluation of DBNPS identified a strength in the radiological protection area involving radiation dose control. One of the supporting examples pertained to the DBNPS radiation protection servicemen setting up and operating the hot water pressure washer in a non-radiological control area, which allowed them to identify and correct several problems with the operation of the unit prior to its use inside the containment. INPO concluded that this contributed greatly to the CAC cleaning being completed with no delays or problems, which resulted in a savings of about 100 millirem over previous cleaning methods. There was no assessment in the report regarding why the CACs required cleaning in the first place (i.e., chronic RCS leakage). There was no discussion regarding the past use of a kerosene burner (i.e., open flames) inside the containment to heat the water for the power washer. Additionally, there was no discussion that this activity, which was a work-around caused by the active RCS leak, was one of the highest.

dose jobs during 2001. The task force considered the results of the these assessments to be lacking, in that apparent weaknesses in the licensee's boric acid corrosion control program and RCS leakage detection/correction were not highlighted.

The task force attempted to determine if the vendor that conducted the RPV head inspection at DBNPS (Framatome) tracked plant conditions for comparison. The task force did not find this to be a priority with the vendor. The task force considers the experience and information available to the vendor by virtue of assessing a number of plants to be a valuable resource that the industry should exploit. Licensees should develop a mechanism to tap this information to contrast the condition of their facility with those found throughout the industry.

VHP Cracking Model and Other VHPs - The VHP crack susceptibility model predicted that cracking at DBNPS would begin in 2003. [Ask Ed to confirm] NRC staff interviewed by the task force discussed the range of uncertainties involved in the model. Some staff thought that additional testing was needed to improve the model over the full range of existing plant conditions. Given the operating experience contained in the French data on VHP cracking indications, the task force questioned the basis of the model. The task force concluded that industry should direct resources toward providing an improved experimental basis for crack susceptibility modeling.

The task group review found examples of other RCS penetrabons (see section 3.1 for examples) that are susceptble to corrosion similar to RPV penetrations. For example pressurizer heater, lower RPV head, and thermo-well penetrations have or could (by virtue of composition. construction, and operating environment) exhibit cracking and leakage. The task force concluded that efforts should focus on assessing other alloy 600 nozzles for susceptibility to leakage.

3.4.3.2 Recommendations 3.4.3.2.1 Recommendations for NRC 16

Joelle Starefos 4.wpd Page 17'

• - NRC should work with industry to develop guidance for voluntary initiatives such as testing to more fully understand boric acid corrosion effects. NRR should take steps to review guidelines in industry topical reports (see Recommendations in Section 3.3.7). A possible step would be to assign NRC technical project managers to evaluate industry tests and review the widely distributed guidelines for adequacy and suitability.

3.4.3.1.2 Recommendations for Industry

• Industry should review and revise existing guidance related to boric acid corrosion control and RPV head penetration inspection and repair to better support licensee decision making involving these issues.

• Industry should utilize plant condition information gained by vendor organization conducting inspection and repair activities at multiple plants.

• Industry should review the approaches used by licensees to consider economic factors involved with RPV head penetration inspection and repair. This might include conducting representative cost/benefit analyses of RPV head inspections that would include factors for dose, cost, and time involved.

• Industry groups should improve dissemination of information to members and hold members accountable for following guidance/recommendations. For example, one mechanism that would aid dissemination is for licensee staff to regularly attend Owner's Group meetings related to RPV degradation and inspection.

• The industry should conduct further testing and analysis to develop a more reliable crack model and should assess the susceptibility of other RCS components fabricated from Alloy 600.

17