PY-CEI-NRR-2241, Responds to NRC 971118 NOV & Proposed Imposition of Civil Penalty - $100,000.Corrective Actions:Isolate/Operate Solenoid Valves Replaced & Turbine Control Sys Evaluated & Found Unaffected

Responds to NRC 971118 NOV & Proposed Imposition of Civil Penalty - $100,000.Corrective Actions:Isolate/Operate Solenoid Valves Replaced & Turbine Control Sys Evaluated & Found Unaffected

ML20197C399
Person / Time
Site:	Perry
Issue date:	12/18/1997
From:	Myers L CENTERIOR ENERGY
To:	NRC OFFICE OF ENFORCEMENT (OE)
References
PY-CEI-NRR-2241, NUDOCS 9712240179
Download: ML20197C399 (15)

Text

. . ..

l s Ivny iA&w fvw I%nt to Cew nom

' ~ ' ~ ^ ' ~

l'O lbn 91 fYny cho44:61 Lew W. Mydre 4to ?W$915 Vu l',vuwst ias 44oNO 40:9 December 18,1997 PY CEl/NIOt 22411.

Director Ollice of Enforcement United States Nuclear Regulatory Commission i1555 Rockville Pike Rockville, MD 20852-2738 Perry Nuclear Power Plant Docket No. 50-440 Heply and Answer to a Notice of Violation

Dear Sir:

Enclosed herewith is the Perry Nuclear Power Plant's (PNPP) response to the November 18,1997, Notice of Violation and Proposed imposition of Civil Penalty $100,000.

For Violation A (EA 97 047), which involved the inappropriate restoration to service of a Reactor Recirculation Flow Control Valve Ilydraulic Power Unit, the " Reply 1 . Notice of Violation" is provided in Attachment 1. Cleveland Electric liluminating Co. (CEI) management recognizes, understands and concurs with the NRC perspective on the importance of prompt, effective and lasting corrective actions for operationai events and equipment problems. Current management philosophy has resulted in a high level of attention to the corrective action program, and to management's active involvement in its implementation. Your recognition of the corrective actions taken for the November 1996 event reaffirms CEI objectives for continuous attention to the corrective action program and effectiveness reviews.

CEI also understands the need for diligent attention to reactivity manipulations and operations with potential effhets on reactor power. Plant management has taken extensive corrective action towards clarifying expectations for licensed operators, and contir.w s to strive for event free operations through understanding of risk and maintaining appropriate perspective in operational decision making.

Accordingly, pursuant to 10 CFR 2.201, Violation A is bdng accepted as cited in the Notice of.

Violation, No additional information is being provided in response to Violation B (EA 96 542), wl ich was fully addressed in Licensee Event Report No.96-008. .

CEI denies Violation C (EA 97-430), concerning a safety evaluation used to support continued acceptabihty of a non conforming condition, specifically, leakage in excess of the design assumptions for the Emergency Closed Cooling (ECC) system as described in the Updated Final Safety Analysis Report (USAR). During inspection actisities from February through August 1997, inspectors questioned 9712240179 971280 4 6.N_ t PDR ADOCK 05000440

i. ,Il,I!Il,ll,11,El ll .

PY ClINRR 224IL Denint.cr 18, IW7 page 2 of 4 the appropriateness of the conclusions provided in the subject 10 CFR 50.59 Safety Evaluation, which addressed the effects ofincreased boundary valve leakage on ECC System operability. Ultimately, the NRC concluded that the condition accepted by the plant statf under 10 CFR 50.59 constituted an Unreviewed Safety Question (USQ) on the bases of increased probability of equipment malfunction and increased consequences of an analyzed event. The increases in both consequences and probability were, by NRC conclusion, the direct result of the increased presence in the plant of operators who are fully trained and quatined fue the activities under consideration. CEI has closely reviewed this interpretation ofIl 50.59 and has concluded that it is inconsistent with the application of the regulation to date, by bo.h % .ndustry and the NRC. Accordingly, the " Reply to a Notice of Violation," pursuant to the provisions of 10 CFR 2.201 and the requirements set forth in your letter, provides the specine information to support the position, and is included in Attachment 1.

CEI believes that acceptance of this violation as stated would establish a position which would result in further uncertainty for licensees. The effects of such an approach would include a severe impediment to the responsible management of nuclear plant activities, as well as an unnecessary licensing activity. The positions established by the proposed violations, when carried through to their logical conclusions, would restrict normal plant operations as well as the development ofimprovements to procedures which address off normal c emergency conditions. In an extreme, but still logical application, additional operator actions for proactive monitoring of plant equipment could not be implemented without a license amendment, because the presence of an operator in safety related areas would increase the probability of an unimentional error, as well as increase dose conseg 'ences in the event of an accident.

As a result of the pre-decisional Enforcement Conference held on October 7,1997, and subsequent (orrespondence, CEI understands that proper application of 10 CFR 50.59 is primacily a regulatory issue, meant to preserve the necessary involvement of the NRC in the decision making process, as opposed to a safety concern. CEl also understands that, with respect to the determination of a USQ, the threshold for acceptable increases in consequence and probability from an existing allowable initial condition (e.g. dose limits established by regulation) is zero, llecause licensees can not apply reasonable discretion or engineeringjudgment where increases in probability or consequence are concerned, it is all the more important that the allowable initial conditions are reasonably established; are consistent with other applicable regulations; and preserve the regulatory process.

Pursuant to the provisions of 10 CFR 2.205 and the requirements set forth in your letter, Attachment 2 provides the requisite " Answer to a Notice of Violation," wherein the above discussed violations are denied in part, and full remission of the 550,000 Civil Penalty associated with Violation C is requested.

Accordingly, an electronic funds transfer in the amount of $50,000 was made on December 17,1997, for payment of the civil penalty associated with Violation A .

Denial of the violation by CEI s'iould not be construed to indicate any opinion that all aspects of this issue were handled appropriately. To the contrary, CEI management has revie,ved the circumstances surrounding this event and has identined several areas in which plant staff performance svas deficient, including application of the plant specinc 50.59 program. These factors are immaterial to the CEI position on the interpretation of 10 CFR 50.59; however, they are discussed here to demonstrate that CEI management has achieved a thorough understanding of the plant staff performance failures in resolving the ECC valve leakage issue.

1

PY-Cl;lHitit 224iL tweint4er iIt,1997 Pye 3 of 4 in October'1996, when it was realked that system leakage exceeded the assumptions stated in the USAlt, the issue was appropriately classi0cd as a non-conforming condition under the site Corrective Action Program. To determine the condition of the ECC system, Engineering Department personnel performed an evaluation, the conclusion of which was that the condition would not require the ECC sy stem to be considered inoperable. Thw non-confonning condition was disf.ositioned to be "use(d) as-is." Although operability was maintained, this disposition was inappropriate, based on the intent to repair the valves, thus restoring leakage to within the design basis as described in the USAR. The correct approach would have been to effect a " repair" disposition, and to document the operability determination in accordance with guidance provided to the industry under Generic Letter 91 18, "Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability." Provisions for these methods of addressing the issue are clearly provided in existing administrative procedures.

In support of the "use as-is" disposition for the non-conformance, a safety evaluation was required to ensure that no unreviewed safety question would be introduced by acceptance of the non conformance as an acceptable solution for degraded conditions. Although arguments are provided here;n to demonstrate that the change would not result in any increase in event probaMiity or consequence, the PNPP 10 CFR 50.59 Safety Evaluation process required the issue to be identined as a USQ, based on the reduction in a margin to safety as described in the Perry Safety Evaluation Report (SER). This provision of the PNPP Safety Evalunt on program is consistent with the guidance provided in NSAC 125; however, as discussed in the NRC letter of November 18,1997, the NSAC 125 "dennition of reduction in margin is more conservative than the NRC definition of reduction in margin as denned in the basis for a technical specification." Accordingly, while the evaluation of the proposed change is not considered to be a violation of 10 CFR 50.59, proper application of the Perry program would have forced a re-evaluation of the issue and would have likely resulted in the proper dispositioning of the situation. The Safety Evaluation was reviewed by Engineering management personnel, reviewed by the Plant Operations Review Committee, and ultimately accepted by senior plant management. In March 1997, the previously approved Safety Evaluation was used as the basis for a USAll change w hich incorporated the extended leakage limits for degraded conditions while preserving the original assumptions for system leakage under non-degraded condillons, it should be noted that the design basis of 0.5 gallons per hour (gph) was never changed. Thus, a repair of these valves under ASME Section XI requirements at the next available opportunity would eliminate the degraded conditions. In spite of the fact that the OPERAlllLITY of the ECC system was never in question and the resultant correctise action plan for the restoration of valve integrity was an acceptable solution under Generic Letter 91 18 guidance, it is clear tha' inappropriate decisions resulted in an improper basis for the course of action chosen.

CEI management considers this is a dc0ciency in the implementation of the process for reviewing intended changes to PNPP, and is committed to implementing, the actions necessary to upgrade the understanding and awareness of the regulatory and p ocedural requirements of 10 CFR 50.59. CEl clearly accepts responsibility for the proper application of all regulatory requirements and expectations, from both a safety and regulatory perspective; however, it is extremely important that appropriate and safety-benencial interpretations of regulatory requirements are established through the enforcement process.

PY-Clil/Nitit 224 tl, Deceintier 18,1997 l' age 4 of 4 11 is clear that the industry is in a state of fluctuation and uncedainty with respect to implementation of 10 Cl 1( 50.59. Although the October 7,1997 l're-decisional Enforcement Conference provided a limited op;wtunity to openly discuss the various aspects of this very complex issue, continued, open dialogue is essential until a common understanding is reached. CEI requests additional management meetings with NitC staff prior to the ultimate resolution of this enforcement action. Please contact Mr. llenry L llegrat, Manager llegulatory Affairs, at (440) 280 5606, to coordinate further communication, or to address any unanswered questions.

Very truly yours,

&- ( .J2AO v

Attachment 1, lleply to a Notice of Violation Attachment 2, Answer to a Notice of Violation cc: NitC Document Control Desk Nitt itegion til Administrator NitC ites; dent inspector NitC Project Manager

1, Lew W. Myctr, being duly swom state that (1) I am Vice President - Nuclear, of the Centerior Service Company, (2) I am duly authorized to execute and file this certification on behalf of The Cleveland Electric illuminating Company and Toledo Edison Company, and as the duly authorized agent for Duquesne Light Company, Ohio Edison Company, and Pennsylvania Power Company, and (3) the statements set forth herein are true and correct to the best of my knowledge, infomiation and belief.

C . NCN 9%

Lew W. iyers' s s Sworn to and subscribed before me, the /[ day of /W*b~ , /Ik7 4W JAN3 E. MOrr P

Nr.t rt ub30.Stateof Ohio Mycornm!:donEgrasFeb 20.2003 s (Co^o Min Ldc County) *

~~'~..n.n..

+

Attachment 1

?? ' '

PY-CEl/NRR-2241L Page I of 9 R

M REDLY TO A NOTICE OF VIOLArlON VIOL ATION A Bestatement of the Violation ,

During NRC inspections conducted from December 28,1996 to February 3,1997, and from July 21 through

] ' August 27,1997, violations of NRC requirements were identified. In accordance with the " General Statement of R 3 Policy and Proceder for NkC Enforcement Actions," NUREG 1600, the NRC proposes 'o impose a civil nenalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act),42 U.S.C. 2282, and 10

~

u 1205. The particular violations and associated civil penalty are set forth below:

A._ Violatbn Assessed a Civil Penalty Associated with Reactor Recirculation System Flor Control B in CFR Part 50, Appendix B, Criterion XVI," Corrective Actions." requires, in part. that measures shall be established to assure conditions adverse to quality, such as failurs , malfunctions, denciencies, deviations, defective materists and equipment, and nonconformances are proruptly identined and corrected, la the case of d signi5 cant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and errective action taken to preclude repetition. _

'\'

Contrary to the above, at of November 9,1996, the licensee failed to take adequate measures to determine the causes of a signiGeant condition adverse to quality and failed to take corrective action to preclude repetition.

Specifically, on July 27,1994, an uncontrolled reactivity change, e signincant condition adverse to quality, i occuned during uniatended movement of a reactor recirculation ILw control valve. As of November 9,1996, when a similar event occurrcd, the licensee had not detwained the causes of the July 24,1994 event, and the licensee had not implemented adequate corrective hetions tc preclude repc.ition of an uncontro!!ed reactivity change caused by aovement of a reactor recirculation now control valve. Further,(1) Operator training following the Juiy 27,1994 event failed to adequately inform the operators of the potential contequences of a hydraulic power unit (HPU) subloop operate / isolate solenoid valve failure, and (2) on November 9,1996, when a blown fuse was found in an HPU v hile the reactor recirculation 'A' Dow control va.v:(FCV) was being returned to service, the shift supervisor authorized the WU to be returned to service with a b own fuse based on a misunderstanding that a mispositioned solenoid valve would have no impact on the FCV even though the July 27, 1994 event demonstrated that a mispositioned solenoid valve could cause a positive reactivity addition by allowing the reactor recirculation FCV to open further. (01013)

This is a & <erity Level 111 violation (Supplement 1).

Civii Penalty - $50,000.

Beyh The violation is aNepted as written.

Beason for the Violation The reason for this violation was that the corrective actions put in place following the flow control valve event on July 27,19^4, did not correct the root cause of the operate / isolate solenoid valve failure. A solenoid valve failure on November 9,1996 presented a challenge to the operations staff. The cause of the 1996 event was that tne level ofinvolvement of the Shift Supervisor in the decision making precess for restart.ng the HPU subloop distracted from his oversight responsibilities. Contributing causes to tue 1996 event included two particular issues. First, a procedure compliance issue was identified in that subloop restoration continued without meeting

]

Anachment I

(

PY-CEl/NRR-2241L

• Page 2 of 9 the requirements of a procedural strp. Second, degraded itPU subloop material condition was tolerated. Prior to the 1996 event, equipment degradation had resulted in one subloop being unavailable for use; consequently, weekly shifting of the subloop, a corrective action put in place to help prevent solenoid valve sticking, had been suspended while troubleshooting and repair activities were underway. The past corrective actions were not effective in removing these challenges to the operators, The root cause of the llPU isolate / operate solenoid valve failures was determined to be a residue buildup on the isolate / operate valve ste.n resulting from a localized, heat-induced degradation of the hydraulic fluid. This residue is a brownish, varnish-like substance which causes the valve stem to stick, resuhing in solenoid coil over current, followed by blown control room fuses. The investigation identified that the ambination of the hydraulic Guid quality and the hem generated by the continuously energized coils rapidly degraded the fluid in localized, close tolerance sites on the valve stem. Contributing to this .nechanism, the solenoid valve vendor had begun supplying replacement solenoid coils which operated at higher temperatures, as a result of pressure and flow considerations in other hydraulic applications (e.g. industrial hydraulic control sys; ems). The full understanding of these degradation mechanisms was not achieved until after the 1996 event.

Corrective Stens Taken and Results Achieved The NRC recognized that high level management attention was given to the November 9,1996 event and an investigation into the event was completed. It was also recognized that corrective actions were taken to address the operational performance weaknesses nasociated with the event. The NRC recognized that other corrective actions included, but were not limited to: remedial action for the crew that caused the event; training on the event for the other ciews; and modifications to improve HPU reliability. Operations Section management instituted i.nmediate corrective actions for manipulating Reactor Recirculation system ilPUs. The Operations Superintendent published two Daily Instructions. These instructions provided operating policies and expectations aimed at all operators and addressed conservative decision making, objective thinking, utilization of management resources, and the potential for ' low control valve motion whenever any llPU manipulation is conducted, Other significant corrective actionc resulting from the investigatio.i inchide the following:

• Isolate / operate solenoid valves have been replaced with an improved design consisting of a wet-coil armature, which is less susceptible te va:nish buildup and sticking.

• N Turbine Control system was evaluated and found not to be affected by this phenomenon.

• Developed and installed t. means to monitor solenoid ceil currents to identify solenoid condition and aid in determining isolate / operate valve position prior to liPU opera' ion.

• The Operations Section defined expectations regarding communications of corrective action plans and  :

operational troubleshooting plans and developed a process for resolutio.i of risk significant and risk contributor system / component problems.

• The independent role of the Shift Technical Advisor (STA)in decision making and corrective action plan development was re-emphasized.

+ Conducted simulator scenarios spe.ifically directed at nservative decision making, teamwork, and resource management.

l l

\ttachment I PY-CEl/NRR-2241 L

• page 3 of 9

• Evaluated non operational SRO tasks and determined if any additional precautionary oprator actions are necessary when manipulating components that could affect reactivity.

• Clarined management expectations regarding communication between the Control Room and plant staff, speciGcally to emphasize the necessity to maintain a questioning attitude, to request all relative information from the Control Room when participating in decision making and insure hformation provided is thoroughly understood, and that all participants share the ownership of the results of the decision making process.

Although previous corrective action = did not ultimately prevent recurrence, they have contributed to improved system performar,ce. These corrective actions include the following:

• Air Breather Filters - Repetitive tasks to replace the Air Breather Filters every 2 months ce generated. Air Breather Filters contain a desiccant material to remose moisture. With the liPUs located on grating above the Supprer ion Pool, these filters are needed to prerrnt the moisture from entering the llPU reservoirs.

• Fulk rs Earth I ilters - Fullers Earth Filters are necessary to maintain oit quality by reducing the acid content of the hydraulic fluid. Repetitive tasks to change these filters were changed from once every 12 months to once every 6 months. The original extension of these task from 6 months to 12 months in 1990 is the root cause of the hydraulic Guid quality excursions in 1993 and 1995, it is necessary these tasks be performed every 6 months and performed early if oit quality resuits indicate negative trends.

e llydraulic Oil Samp'es Repetitive Tasks to take oil samples were changed from once every 3 months to once every 6 weeks. This was done 'o monitor oit quality more closely.

. Ilydraulic Gil change-out/ Flush valve change-out/91ter change-out - In November 1993, during s forced outage, the llPU reservoir oil was changed out. No system flush was performed, and the actuator and associated piping were not drained. During Refueling Outage 5, the llPU reservoir, actt : mr and associated piping were drained, Gushed and refilled. For the PNPP con 0guration, a flush was demonstrated to be both necessary and effective.

. Weekly Subloop Shifts - Prior to the 1994 event at Clinton, the subloops were shifted on a monthly frequency in response to vendor recommendation. Following the Clinton event, the frequency was increased to weekly, if the subloop was available. This was incorporated in the plar.t rounds as an evolution tu be perfoimed weekly. The periodic shifting was put in place to exercise the isolate / operate valves to avoid any residue buildt.p on the valve spool. Prior to the 1996 event, equipment degradation had resulted in one subloop being unavailable for use; consequently, regular shifting of the subloop had been suspended whik troubleshooting and repair activities were underway.

• Fuse Check - Steps were included in the system operating instruction to check the operatelisolate solenoid coil fuses prior to startup of the associated subloop. A blown fuse indicates a failed isolate / operate valve coil.

These steps were added in response to the Clinton overpo,ver event.

• Valve Replacement - Valve replacement was performed in 1990 to determine the extent of condition and to determine if the valve should be replaced on a regular frequency. Repetitive tasks for valve replacement exist on a 36 nonth frequency. Unfortunately, becausa the valve supplier increased the strength of the solenoid coils and consequently the operating temperature, in response to application concerns by other, non-nuclear users of the component, an additional contributor to valve failure wa; unknowingly introduced.

4 a

l Attachment I l'Y-CElHRR 224 t L Page 4 of 9 The comprehensive investigation and corrective actions taken in response to the 1996 event were the result of a signiGeant upgrade to the PNPP Corrective Action Program implemented in October 1994. This new program reducca the threshold for identiGcation of po:ential issues, incorporated multi-disciplined investigation teams for significant issues, includeJ development of trend reports, and added cross-functional management review of signincant investigations and corrective actions. The program improvements have continued as experience has accumulated, including the addition of collective signi0cance reviews, and renewed senior management ownership of significant issues as well as the program itself.

CorrectiveJLeps thaLWill be Taken to Avoid Further Violations An effectiveness review of the wet armature design will include removal and inspection of one of the valves to verify the conditions which led to 'he failure of the previous design have been corrected. This valve is scheduled to be removed the week of January 4,1998.

Although not in response to this violation, improvements to the corrective action progra n now include senior management review of signincant event investigations and corrective actions. The corrective action program also includes effectiveness reviews to ensure corrective actions are having the intended effect<. Additionally, a collective significance review has been added to the program to provide a periodic assessment of developing areas of weakness based on issue common factors.

Date When Full Comnliance Was Achieved Full comp nee was achieved in February 1997, following replacement of the of the isolate / operate solenoid valves with . e improved wet annature design.

s l

Attachmcnt 1

- PY-CEl/NRil 2241L

- Page 5 of 9 l

VIOIATION C Restatement of the Violation C. Yjolation Assessed a Civil Penalty Associated With Emereency Closed Cooline Svatems Surce Tanks 10 CFR 50.59, permits the licensee, in part, to make changes to the facility and procedures as described in the safety analysis report without prior Commission approval provided the changes do not involve an unreviewed safety question. Records of these changes must include a written safety evaluation which provides the bases for the determination that the changes do not involve an unreviewed safety question.

10 CFR 50.59 (a)(2)(i) states, in part, that a proposed change shall be deemed to involve an unreviewed safety question if, the probability of occurrence or the consequences of an accident or malfunction of equipment imponant to safety previously evaluated in the safety analysis report may be increased.

Updated Safety Analysis Report (USAR) Section 0.2.2.3 " Emergency Closed Cooling System Safety Evah.ation" states, the emergency closed cooling surge tank., are designed to maintain a 7xh., supply of water .

with normal system leakage without the need to provide ..akeup water. o Contrary to the above, Safety Evaluation No.96-128 prepared by the licensee on October 10,1996, and approved on October 21,1996, evaluated a change in the design basis for the emergency closed cooling system surge tanks.

The licensee changed the sizing basis of the surge tanks from a 7-day supply as stated in USAR Section 9.2.2.3 to a 30-minute supply, and the licensees analysis failed to identify that the chang was an unreviewed safety question. SpeciGeally, the safety evaluation did not adequately assess the increased probability of a malfunction of equipment important to safety associated with an increased potential for operator error as operators replenished the surge tanks on a 30-minute post accident basis instead of the previously evaluated period of 7 days. The safety evaluation also failed to recognize the increased consequences of a design basis loss of coolant d

accident associated with an increased projected dose to the operators as they renlie ^ turge tanks on an increased frequency. (03013)

This is a Severity Level 111 violation (Supplement 1).

Civil Penalty - $50,000.

Denialof the Allened Violation in accordance with 10 CFR 2.201(b), this violation is denied as written for the following reasons.

The NRC concluded that the condition accepted by the plant staff under 10 CFR 50.59 constituted an umeviewed safety question (USQ) on the bases ofincreased probability of equipment malfunction and increased consequences of an analyzcd event. CEI ..ereby denies Violation C. The increases in both consequences and probability were, by NRC conclusion, the direct result of the increased presence in the plant of operators who are fully trained and qualiGed for the activities under consideration. CEI has closely reviewed this interpretation, and has concluded that it is inconsistent with the intent and the requirements of 10 CFR 50.59 as well as the application of the regulation to date, by both the industry and the NRC. Accordingly, this " Rep!y to a Notice of Violation," pursuant to the provisions of 10 CFR 2.201 and the requirements set forth in your letter, provides the speciGc arguments to support the denial.

Attachment I

• PY CElHRR-22Cl-page 6 of 9 Reasp_ns for Denial of the Violation Reason 1. The design of the plaat, and the corresponding design bases for the ECC tystem, were not changed by the subject safety evaluation. The plant condition was identined as a non-conforming condition, and activities were planned to restore the system condition to the original licensing basis.

The Emergency Closed Cooling (ECC) system surge tanks are designed to ensure adequate net positive suction head (NPSil) is provided to the ECC pumps. Further, the design of the surge tanks provides a 7-day supply of water with normal system leakage,0.5 gallons per hour (gph), before makeup water is needed. Neither the design nor the design basis was changed.

As a result of an earlier event involving ECC leakage, the ECC systen. had been determined to be leaking in excess of 0.5 gph. Specifically, the A loop of the ECC system showed no discernible valve leakage; however, the D loop indicated valve leakage of approximately i.1 gallons per minute (gpm). A determination of operability for the ECC system with increased leakage concluded that it was acceptable to allow system leakage of 3,0 gpm for ECC Loop A and 3.5 gpm for Loop D. For the time period prior to correcting this degraded condition, the increased leakage limits would reduce the 7-day supply of water to a 30 minute supply and introduce the need for local operator action to ensure sustained adequate NPSH to the ECC pumps. Actual leakage would have resulted in no reduction in supply for the A loop, and greater than the 30 minute supply for the B loop.

While the discussion of the degraded condition and the allowable leakage therefrom may have been inappropriately included in the Updated Final Safety Analysis (USAR), it was done so to preclude the need for preparing additional degraded condition operability determinations should future leakage rates so mantiate. This USAR inclusion war never contemplated by CEI to represent a permanent design change. In fact, the original design leakage criteria of 0.5 gph was maintained both in the design documents and the USAR. The resulting USAR change was initiated:

The sentence "In addition, the emergency closed coolina, surge tanks are designed to maintain a s ven day supply with normal system leakage without the need to provide makeup water," was removed from page 9.2-27 and rep' aced with the following discussian on page 9.2-24: "Some leakage from the emergency closed cooling system can be expected. A conservative estimate of leakage from pump seals and valve ster.: packing is 0.5 gal / hour. With this leakage rate, the surge tank would not be emptied until aDer seven days. Undcr conditions of degraded system leakage, i.e., leakage in excess of 0.5 gal / hour including valve seat leakage or inter-system leakage, allowable total system leakage rates of 3.0 gallons per minute for the "A" loop and 3.5 gallons per minute from the "B" loop have been evaluated as acceptable. These higher leakage values are based on a 30 minute inventory available at the low level surge tank alarm. A manual opevor action is required to establish Emergency Service Water System as the emergency makeup water source within a time frame of approximately 50 minutes fcilowing a design basis event."

The revised USAR preserves the original design considerations of a seven dcy inventory supply, and distinctly identifies leakage in excess of 0.5 gph as a degraded condition.

The suspected leakage was intended to be corrected in Refueling Outage Six (RF06), which began on September 12,1997.- These intentions were documented and were being tracked in accordance with the site corrective action program, prior to identi0 cation of this issue as a potential concem by the inspectors. This information was provided to NRC staffin a telephone call on June 11 1997, and in a docketed letter (PY-CEl/NRR-2183L) on June 26,1997.

m . _

Attachment I PY-CEl/NRR-2241L Page 7 of 9 During the Jane 1997 forced outage, testing determined that the system leakage was both within the design basis tnd the USAR description, and therefore, there was no degraded condition. Because no actual change to the facility occurred, there is no basis for determining that 10 CFR 50.59 was violated.

Reason 2. The change to the to the description of the ECC system surge tanks in the USAR did not involve a USQ under 10 CFR 50.59 criteria because it did not irc.olve a potential increase in the probability of occurrence of a malfunction of equipment important to safety.

An increase in the probability of occurrence of a malfunction of equipment important to safety was not con:luded on the basis that manual actions employed were such that failure of an action would be equivalent to that of a single active failure. Chapter 15 of the USAR discusses application of" single failure" and " single operator error" criteria to the analyses of the postulated events discussed therein. Single active compo ont failure criteria are applied to design basis accident categories only. Ttansient evaluations are judged against a criterin of one single equipmer* fa4ure "or" one single operator error as the initiating event with no additional single fadure assumptions to the protective sequences. Under the plant design basis, the single failure application could involve either a single active failure or an operator error. When compared to the original evaluated design, the failure of the operator action would result in the loss of one train of the ECC system; a loss of no greater consequence than previously evaluated in the USAR.

Part 9900 inspection manual guidance on 10 CFR 50.59, issued on April 9,1996, states that the NRC has found compensating effects, such as administrative controls, acceptable in offsetting uncertainties and increases in probability of occurrence or consequences of an accident previously evaluated or reductions in margin of safety, provided the negative impact is negligible, and is clearly outweighed b) te compensatory actions.

To compensate for the temporary degraded condition, procedures were put in place to direct the necessary operator actions. This change required plant operators to reposition two, two-inch manual globe valves to align the Emergency Service Water (ESW) system to fill the ECC surge tanks. 'I hese valves are physically located in the Intermediate Building (IB) at the 599 foot elevation. Extensive time-motion analyses were conducted to verify that the evolution could be reasonably carried out without error. System drawings were also updated to reflect valve position changes made to support the compensatory operator actions. If the valves were leaking in excess of system design, the manual operator action would be required only in the unlikely event of a design basis accideat, not during normal operations.

The significant efforts put forth by tim PNPP staff to compensate for the additional actions and reduce the po,ential for erior is the basis for the conclusion that no increase in probability of equipment malfunction is introduced, if these compensating factors can noi be considered in determining that there is no increase in probability, no additional operator actions, for any normal or orf normal operating condition, could be permitted without also concluding an increase in the probability of a malfunction.

Reason 3. The change to the description of the ECC system surge tanks in the USAR did not involve a USQ under 10 CFR 50.59 criteria because it did not involve potential increased consequences of a design basis accident associated with increased projected dose to the public due to operators refilling the surge tanks on an increased frequency.

To evaluate the radiological consequences of these post-accident actions, a radiological assessment analyzed the physical actions, environment, and radiological conditions that would exist. A time-motion study determined that the time for the operator to enter the IB-599 foot elevation, traverse tl'e mea, unlock and open the valves, and exit the area, was expected to be less than 15 minutes. Based on this time period, dose was calculated utilizing the design basis area dose calculations. Dose was bounded by the NUREG-0737 defined limits of 5 rem. The expected dose projection would therefore be within USAR 12.6.1.a. guidelines for post accident dose rates in

Attachment 1

- PY-CEl/NRR-224 i L

- Page 8 of 9

- areas, designated as " infrequent occupancy" and the activity can be performed at any time throughout the acudent without exceeding the 5 rem whole body dose.

NUREG-0887, the Safety Evaluation Report relating to tne operation of the PNPP, in Section 12.3.2 determined that CEI has performed a radiation shielding review for vital areas and access routes in accordance with item II.B.2 of NUREG-0737 and conforms with the criteria of NUREG-0800. Considering the radiological conditions and time requirements along with the access routes to the ESW emergency makeup to ECC surge tank valves, PNPP continues to conform with the criteria as established in NUREG-0887 and NUREG-0737 to perform the operator action to mitigate the consequences of an accident.

An increase in the consequences of an accident previously evaluated in the USAR was not concluded since doses to the public were not increased above the current licensing limit and that doses to onsite personnel were not in excess of the limits as speci0ed in NUREG-0737 or the USAR such that actions required to mitigate the consequences of accidents were not impeded. Dose values were not explicitly pros ided within the body of the safety evaluation but were explicitly provided within the supporting documentation.

The safetv evaluation addressed the consequences of the required actions by stating that the specified actions could be performed at any time thioughout the course of the accident without the individual receiving in excess of 5 rem external dose. All operator actions, as described for the ECC system, can be performed within the dose limits allowed by 10 CFR 20 Subpart C -- Occupational Dose Limits. The maximum dose to an individual for any single entry is estimated to be 4.4 rem. Therefore, the dose to perform any of the operator actions is bounded by the " normal" dose limit (5 rem / year) allowed for occupational exposure.

NUREG-0737 states that the design dose rate for personnel in a vital area will be such that the guidelines of GDC 19 will not be exceeded during the course of the accident. This is referring to thc dose to each individual, not a collective dose for all personnel supporting the activity. The current PNPP design allows for the described operator actions to b performed within the design criteria of 5 rem. The dose expected to perform the operator actions does not increue the consequences of a design basis accident. Consequences are referring to the herlth and safety of the public. The proposed operator action, from a perspective of receiving the estimated dose, does not cause a change to the consequences.

The NRC position in the Notice of Violation seemingly rejects the regulatory limits r.s de0ning the limits for radic, logical consequences to plant staff, and further identiDes such a condition as a USQ. This literal interpretation that additional projected dose results in increased consequences, regardless of regulatory limits, would require ay additional personnel inside a radiologically restricted area (operator, engineer, visitor, etc.) to

-be considered a USQ. In addition to requiring that such consequences of normal and off-normal operational needs are approved by license amendment, this interpretation would render the existing regulation and guidance on the issue ineffective, since any non-conservative changes within the regulatory basis would need to be addressed through the plant licensing process.

Corrective Steps That Have Been Taken and the Results Achieved

' The PNPP change process as prescribed in Plant Administrative Procedure (PAP)-0305," Safety Evaluations" is based primarily upon the guidance and philosophy espoused in NSAC-125," Guidelines for 10 CFR 50.59 Safety Evaluations," dated June 1989. As the NRC stated at the October 7 meeting and reiterated in the letter transmitting the Notice of Violation, the definition of margin of safety as discussed in these documents is more conservative than the regulation requires. By the PNPP program, the reviewers should I, ave concluded that the change resulted in a reduction in the margin of safety, since the NRC Safety Evaluation Report (SSER 7)

- established the 7-day supply as the reviewed ECC surge tank design. Although CEI management does not agree t

l Attachm, - ,

. PY-CEI Ad-224 IL Page 9 of 9 that the regulatory deGnition of a USQ was exceeded, CEI management agrees that this situation would constitute a USQ by the conservative NSAC-125 dennition.

The PNPP program was not followed, and the expectations of CEI management were not met. Accordingly, several corrective actions are appropriate and are described below.

A self-assessment of the PNPP 50.59 program was performed, drawing upon previous evaluations of performance such o engineering assessments of speciGc safety evaluations; review of Company Nuclear Review Board Safety Evaluation Review Subcommittee minutes; independent Safety Engineering Group evah.ations; and NRC Notices of Violation. The self-assessment concluded that previous corrective actions performed as a result of other assessments die "aprove the program and program results; however, the overall rate ofimprovement has not been sufficient to stay abreast of evolving NRC and industry interpretations. The self-assessment recommended benchmarking other utilities with known effective safety evaluation programs, cliciting improvement areas, and developing implementation attributes to ensure success at PNPP.

- The CEI Senior Management Team endorsed several program improvement goals which include an enhanced training program, a solid understanding by program participants of their responsibilities, and improved over-ight processes. These goals are intended to result in consistently high quality safety evaluations with a high level of assurance that potential USQs are recognized and addressed appropriately.

Corrective Stens ti at Will be Taken To accomplish these goals staed above, a plan has been developed to :

• Determine which utilities have implemented a safety evaluation program which are considered to be in the upper quartile for performance.

. llenchmark those utilities with respect to implementation of that program.

• U'ilize the best attributes of those upper quartile utilities to implement a similar program at PNPP.

. Ensure that recent indestry and regulatory guidelines are incorporated, as applicable, into the implernentation progr un.

The current plan has scheduled plant visits during the first quarter of 1998 with improvement activities started by the end of the first quarter 1998.

Q3nclusion For the reasons stated herein, CEI does not believe that a violation of 10 CFR 50.59 has occurred in that CEI did not fail to identify rs USQ (as defined in regulation) for the ECC surge tanks. Since no change to the facility actually occurred, and since throughout the discussions of this issue, no question about the maintained operability of the ECC system has been raised, it is CEl's position that there was no afety signincance associated with this event. Therefore, CEI denies the Notice of Vic,lation as written. However, CEI acknowledges the failure to effectively follow PNPP's more conservative programmatic requirements for conducting safety evaluations.

9 Attachment 2 ,

- PY-CEl/NRR 2241L PageiofI ANSWER TO A NOTICE OF VIOLATION Pursuant to the provisions of 10 CFR 2.205, and in accordance with the requirements .;,g\ ith in the NRC letter of November 18,1997, this " Answer to a Notice of Violation is provided. The Clev;,bb ilectric illuminating Co. (CEI) denies, in part the viohtions cited.

Speci0cally, CEI accepts Violation A (EA 97-047), which involved t'j f' >priate restoration to service of a Reactor Recirculation Flow Control Valve 1lydraulic Power Unit. C  ; ment concurs with the NRC perspective on the importance of corrective actions and the need f< -

mtion to reactivity manipulations.

CEI does not conte t the imposition of a Civil Penalty in the ame ' f CEI denies Violation C (EA 97-430), concerning a safety evalua . j ,ustify continued acceptability of a non-conforming conditien, speci0cally, leakage in excess of the, 2 mptions for the Emergency Closed

?

Cooling (ECC) System as described in the Updated Final Safety , , eport (USAR). The basis for the

~-

denial is detailed in the " Reply to a Notice of Violation" provided i iment I pursusnt to the requirements of 10 CFR 2.201. On the same basis, CEI requests full remission. , ' posed Civil Penalty in the amount of

$50,000. Additionally, Chi incuired a significant expense of alp . million dollars by extending the June 1997 forced outage by ten days to resolve the ECC system leak- , as well as other NRC concerns regarding the tornado missile analysis and ECC temperature alve issues. This extensio o the forced shutdown was based on then current NRC policy preventin ? p with existing USQ's. That policy was subsequently overturned in a resision to Generic Letter 9) e Accordingly, an electronic funds transfer in the amoun - )0 was made on December 17,1997, for payment of the civil penalty associated with Violation /

x n b

h '!

I I ,

w d  :.

3 l

b .

t 4

\

A

j;-

l i

.