IR 05000289/1999002
| ML20206S353 | |
| Person / Time | |
|---|---|
| Site: | Three Mile Island  |
| Issue date: | 05/14/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20206S347 | List: |
| References | |
| 50-289-99-02, 50-289-99-2, NUDOCS 9905210103 | |
| Download: ML20206S353 (32) | |
Text
s
.
U.S. NUCLEAR REGULATORY COMMISSION REGION 1
l Docket N License N DPR-50 Report N Licensee: GPU Nuclear,Inc. (GPUN) I Facility: Three Mile Island Station, Unit 1 Location: P. O. Box 480 Middletown, PA 17057 Dates: March 14,1999 through April 24,1999 j
inspectors: Craig W. Smith, Acting Senior Resident inspector I Neil S. Perry, Project Engineer, DRP Paul R. Frechette, Jr., Physical Security Specialist, DRS
- l 1 1 Approved by: Peter W. Eselgroth, Chief l Projects Branch No. 7 Division of Reactor Projects
.
"
l 805210103 990514 l PDR ADOCK 05000289 G PDR
I
.
.
EXECUTIVE SUMMARY Three Mile Island Nuclear Power Station Report No. 50-289/99-02 This inspection included aspects of licensee operations, maintenance, engineering, and plant support. The report covers a six week period of resident inspection supplemented by a regional physical safety specialist. The core security inspection assessed GPU Nuclear's (GPUN's)
ability to protect the facility against radiological sabotage and to determine whether the security program met safeguards program commitments and regulatory requirement GPUN operated Three Mile Island Unit 1 (TMI) safely at 100 percent power throughout the inspection perio ODerations
-
In response to repeated momentary alarms from the condenser offgas radiation alarm (RM-A-5), GPUN raised the alarm setpoint to reduce operator distraction while still providing adequate warning of an increasing primary to secondary leak rate. (Section O1.1)
-
Control room operators responded well to an integrated control system (ICS)
malfunction. However, repeated ICS malfunctions continue to be an operational challenge. (Section 01.2)
-
A plant operator added an incorrect lubricating oil to the "A" emergency diesel generator ,
(EG-Y-1 A) lubricating oil sump while the machine was operating. A subsequent evaluation found EG-Y-1A remained operable with no corrective actions required to flush the incorrect lubricating oil from the system. (Section 01.3)
-
GPUN conducted surveillance testing of "B" decay heat removal pump in accordance with approved plant procedures. (Section 01.4)
Maintenance l
-
GPUN completed the required annual inspections on both emergency diesel generators in accordance with the manufacturer's recommendations as required by the plant's Technical Specifications. Workers exhibited a lack of attention to detail for foreign materials exclusion controls during the conduct of the inspections. (Section M1.1)
-
GPUN conducted successful on-line maintenance to replace the pneumatic positioner for the "A" heater drain control valve that corrected a problem with secondary plant flow oscillations. While conducting the repairs, maintenance technicians identified that the replacement positioner was not properly configured. In one instance, communications to the control roorn during the troubleshooting efforts were not timely. (Section M1.2)
ii
.
- Enoineerina
.
The engineering department continued to provide good support to plant operations and maintenance activities. (Section E1)
Plant Suonort
-
GPUN conducted security and safeguards activities in a manner that protected public health and safety in the areas of access authorization, alarm stations, communications, and protected area access control of personnel, packages and vehicles. This portion of the program, as implemented, met commitments and NRC requirements. (Section S1)
.
Security's protected area assessment aids, protected area detection aids, and personnel search equipment were well maintained and reliable, and were able to meet commitments and NRC requirements. (Section S2)
- The security force members exhibited adequate knowledge necessary to implement the duties and responsibilities associated with their position. Security force personnel were trained in accordance with the requirements of the Training and Qualification Plan, and training documentation was properly maintained and accurate. (Sections S4 and S5)
- The level of management support was adequate to ensure effective implementation of the security program as evidenced by adequate staffing levels and allocation of resources to support programmatic needs. (Section S6)
. Audits of the security program were comprehensive in scope and depth, and findings were reported to the appropriate level of management. The self-assessment program was effectively implemented to identify and resolve potential weaknesses. (Section S7)
iii
i i
.
.
TABLE OF CONTENTS EXECUTIVE SUM MARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii TABLE OF CONTE NTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . lv 1. Ope rations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 O1 Conduct of Operations (71707, 61726) . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . 1 01.1 Operator Response to Condenser Offgas Radiation Monitor Alarm. . . 1 01.2 Operator Response to Integrated Control System Malfunction . . . . . . 2 01.3 Incorrect Lubricating Oil Added to Emergency Diesel Generator . , . . . 2 01.4 Surveillance Testing of"B" Decay Heat Removal Pump . . . . . . . . . . . 3 08 Miscellaneous Operations issues (92901) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 08.1 (Closed) LER 98-012-00 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 08.2 (Closed) Licensee Event Report 98-14-00 . . . . . . . . . . . . . . . . . . . . . . 4 l l . M aintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 M1 Conduct of Maintenance (61726, 62707) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 M1.1 Emergency Diesel Generator Surveillance inspections . . . . . . . . . . . . 5 M1.2 On-Line Maintenance to Correct Secondary Plant Flow Oscillations . . 6 M8 Miscellaneous Maintenance issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 M8.1 (Closed) Violation 97-09-03 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Ill . Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 E1 Conduct of Engineering (37551) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 E8 Miscellaneous Engineering issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 ,
E (Closed) Licensee Event Report 98-06-00 . . . . . . . . . . . . . . . . . . . . . . 8 i E8.2 (Closed) Licensee Event Report 98-007-00 . . . . . . . . . . . . . . . . . . . . . 8 E8.3 (Closed) Licensee Event Reports 98-13-00, 01 . . . . . . . . . . . . . . . . . . 9 IV. Plant Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 S1 Conduct of Security and Safeguards Activities (81700). . . . . . . . . . . . . . . . . . 9 S2 Status of Security Facilities and Equipment (81700) . . . . . . . . . . . , . . . . . . . 10 S3 Security and Safeguards Procedures and Documentation (81700) . . . . . . . 11 S4 Security and Safeguards Staff Knowledge and Performance (81700) . . . . . . 12 S5 Security and Safeguards Staff Training and Qualifications (81700) . . . . . . . 12 l S6 Security Organization and Administration (81700) . . . . . . . . . . . . . . . . . . . . . 13
.
l
'
S7 Quality Assurance (QA)in Security and Safeguards Activities (81700) . . . . 13 V. Management Meetings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 X1 Exit Meeting Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 X2 Exit Meeting Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 INSPECTION PROCEDURES USED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 ITEMS OPENED, CLOSED AND DISCUSSED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 LIST OF ACRONYM S U SED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 iv
.
-
Report Details Summary of Plant Status GPU Nuclear Inc. (GPUN) operated Three Mile Island Unit 1 (TMI) at 100 percent power throughout the inspection perio . Operations 01 Conduct of Operations (71707,61726)
l The control room staff operated the unit safely throughout the inspection perio Operators conducted routine surveillance testing safely and maintained good awareness of reactivity control during periodic control rod drive movement testing. On-line risk documents prepared for risk significant plant evolutions were thorough and contributed positively to the quality of pre-job briefings. Specific events and noteworthy observations are detailed in the sections belo .1 Operator Response to Condenser Offaas Radiation Monitor Alarm Inspection Scope The inspector reviewed control room operator response to several alert alarms received from the condenser offgas radiation monitor (RM-A-5). Observations and Findinas On March 21, the inspector observed control room operator response to an alert alarm from RM-A-5. The monitor momentarily increased above the alarm setpoint of 200 counts per minute (cpm) and then retumed to its previous value. A two-hour reactor coolant system (RCS) leakrate, obtained approximately one hour after the RM-A-5 alarm l
was received, showed no abnormal RCS leakage.
On March 28 and 29, three separate RM-A-5 alert alarms were received within a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period. Control room operators responded appropriately to each alarm, performing the actions required by the TMI Alarm Response Procedure. In response to the increased number of RM-A-5 alert alarms, GPUN raised the RM-A-5 alert alarm setpoint from 200 cpm to 480 cpm. The inspector reviewed the calculation supporting the setpoint change and found it to be appropriat Conclusion in response to repeated momentary alarms from RM-A-5, GPUN raised the alarm setpoint to reduce operator distraction while still providing adequate warning of an increasing primary to secondary leakrat .
.
01.2 Operator Response to Intearated Control System Malfunc_tio_n On March 26, the control room operators observed the integrated control system (ICS)
unit load demand output signal increasing above the demanded input; this causes reactor power to increase. Unlike previous occurrences of this event, this time the ICS did not respond to signals inputted by the operator to lower the unit load demand outpu The operator had to take manual control of the ICS to lower reactor power. The inspector noted that similar ICS malfunctions were documented in the previous two inspection periods. GPUN has installed diagnostic equipment in the ICS to aid in identifying a root caus Control room operators responded well to the ICS malfunction. However, the repeated ICS malfunctions continue to be an operational challeng .3 Incorrect Lubricatina Oil Added to Emeraency Diesel Generator Inspection Scope The inspector reviewed an instance where, on April 1, while retuming the "A" emergency diesel generator (EG-Y-1 A) to service following its annual inspection, a plant operator added approximately 10 gallons of an incorrect lubricating oil to the lubricating oil sump while the machine was operating. The sump holds approximately 350 gallons of oi Observations and Findinas GPUN evaluated that EG-Y-1 A remained operable as is, with no corrective actions required to flush the incorrect lubricating oil from the system. The correct lubricating oil to be added was identified in GPUN procedure 1407-4, "TMI Lubricating Program." The lubricating oil added was for use in a diesel generator other than the EG-Y-1 A. GPUN discussed the event with the diesel manufacturer, Fairbanks Morse, and the lubricating oil supplier, Exxon. The two oils were found to be physically compatible. Both were purchased to the same technical and quality requirements. An oil sample was taken after approximately two hours of operation. No detrimental effects were observed. The instance of adding incorrect oil to the emergency diesel generator was entered into the corrective action program, and at the end of the inspection period, the root cause and corrective actions had not been determine Conclusion A plant operator added an incorrect lubricating oil to the EG-Y-1 A lubricating oil sump while the machine was operating. EG-Y-1 A remained operable with no corrective actions required to flush the incorrect lubncating oil from the syste I
l
.
-
01.4 Surveillance Testina of "B" Decav Heat Removal Pumo On April 12, the inspector observed routine surveillance testing of the "B" decay heat removal pump (DH-P-1B). The pump was run in part to aid in the identification of a root cause for the increased pump vibrations that placed the pump in the alert range of the inservice test (IST) program. The irispector observed that the pump operation and valve manipulations were conducted in accordance with GPUN procedure 1300-3B, "lST of DH-P1A/B and Valves." In addition, during the conduct of the test, the inspector independently walked down and verified the line-up of the opposite decay heat removal trai The inspector observed that the surveillance testing of DH-P-1B was conducted in accordance with approved plant procedure Miscellaneous Operations issues (92901)
O8.1 (Closed) LER 98-012-00. Control Room Habitability Boundarv Ventilation Damoer Found Out of Position (90712,92700)
I Insoection Scope Licensee Event Report (LER) 98-012-00, dated September 25,1998, documented a condition where the control room habitability boundary was compromised as a result of ventilation damper AH-D-270 being found out of its normal position. AH-D-270 was found approximately 50 percent open which, in the event of a design basis accident, would have allowed unfiltered air from the auxiliary building to be drawn into the emergency control room air treatment system. This was a condition outside the design basis of the facility as described in the updated final safety analysis report (UFSAR). Observations and Findinas GPUN was unable to positively ascertain how the damper became mispositioned. It is unlikely the damper drifted into the open position. The damper was most likely repositioned by an individual not understanding the consequences of the actio GPUN determined in its investigation that the increased dose to the operator during a design basis accident, as a result of this damper being out of position, would have been minimal. Unfiltered air from the auxiliary building, which could have been drawn into the emergency air treatment system during an accident, would have passed through a high efficiency particulate absolute (HEPA) filter and charcoal absorber prior to being distributed to the control building habitability boundary. Therefore, GPUN determined the emergency control room filtration system remained operable during the time period AH-D-270 was ope l I
i
!
l l
.
-
l In response to finding the damper outside of its required position, GPUN identified several short and long-term corrective actions. Short-term actions included: immediately closing AH-D-270, placing a caution tag on AH-D-270 to ensure the damper stayed closed until permanent corrective actions could be put into place, and inspecting for other such ventilation dampers outside their required position. Long-term corrective actions included: updating procedures to identify the correct position for AH-D-270, providing additional guidance to plant personnel on maintaining the control room ventilation boundary during operations and maintenance, and identifying other ventilation openings that would require similar administrative controls. GPUN entered this LER into its corrective action process (CAP) to track final resolution. One of the CAP items assigned was to attach placards to the ventilation duct access doors and dampers which require administrative control to ensure the control room ventilation barrier is maintaine The inspector verified by field observation that the administrative controls were appropriat Conclusion ,
The inspector reviewed the specific details documented in the LER and verified through l document review and field observations that GPUN took appropriate corrective action l This LER is close .2 (Closed) Licensee Event Report 98-14-00. Missed Technical Specification Surveillance (90712)
The inspectors reviewed LER 98-14-00, dated January 8,1999, to verify GPUN completed a comprehensive evaluation and took adequate corrective actions when it was identified that technical specification surveillance requirements were not met for obtaining control rod drive absolute / relative positions. The root cause evaluation was thorough, and the corrective actions (both immediate and long term) were appropriat During the subsequent performance of the surveillance, no problems were identifie This failure to perform a technical specification required surveillance within the specifMx!
period constitutes a violation of minor significance and is not subject to formal enforcement action. This in-office review of the LER concluded that the LER properly addressed the requirements of 10 CFR 50.7 II. Maintenance M1 Conduct of Maintenance (61726,62707)
in general, GPUN performed observed maintenance activities well. Equipment reliability remained good throughout the inspection period with one notable exception, the repeated maNunctions of the ICS identified in the previous section. The inspector identified a concem with the foreign materials exclusion (FME) practices observed during the conduct of the diesel generator reduced scope inspection .
-
M1.1 Emeroency Diesel Generator Surveillance insoections Inspection Scope The inspector observed significant portions of the emergency diesel generator inspections conducted in accordance with GPUN procedure 1301-8.2C, " Diesel Generator Reduced Scope inspection (Mechanical)" on both the "A" and "B" emergency diesel generators (EG-Y-1 A/B) during this inspection period. The inspections were conducted in part to comply with Technical Specification (TS), Section 4.6.1.c, which requires in part that "each diesel generator shall be given an annual inspection at least annually in accordance with the manufacturer's recommendations... ." Observations and Findinas The inspector found that GPUN conducted the reduced scope inspections in accordance with the manufacturer's recommendations. The maintenance technicians were very knowledgeable of tasks they were performing and made good use of the technical advice provided by the manufacturer's representative present at the job sit GPUN and the inspector identified several FME issues during the conduct of the inspections. On March 30, GPUN identified that a metal tag attached to a feeler gauge, used during the conduct of the "A" diesel generator air intake blower inspection, became detached and fell into the blower housing. Subsequent video probe inspection located the metal tag and it was retrieved. A follow-up inspection by GPUN questioned whether a plastic tie wrap, that attached the tag to the feeler gauge, was also missing. The tie wrap could not be located inside the blower housing. GPUN dispositioned, through consultation with the diesel manufacturer, Fairbanks Morse, that operation of the machine with the missing tie wrap in the blower would not be detrimenta ,
On April 5, the inspector observed maintenance technicians removing the #14 main bearing from EG-Y-18. The job order and maintenance procedure both referenced FME controls be established in accordance with GPUN procedure 1030, " Control of Access to System / Component Openings." The inspector observed that GPUN did not establish adequate FME controls at the job site during the conduct of the bearing remova Specifically, maintenance technicians did not remove items from their shirt pockets prior l to leaning over the open lube oil sump cover, the lube oil sump openings were not covered when the work was stopped in progress to find additional tools needed to complete the job, some tools used to perform work in the open lube oil sump were not tied off to lanyards, and additional minor FME deficiencies existed that the inspector discussed with the job foreman at the work site. The inspector did not observe any items falling into the open lube oil sump and a subsequent closeout inspection by GPUN did not identify any foreign material concems. GPUN management initiated actions to increase the awareness of plant personnel to FME issues. This failure of personnel to
'
follow the FME procedure constitutes a violation of minor significance and is not subject to formal enforcement actio .
GPUN satisfactorily completed post maintenance testing on both diesel generators following completion of the inspections. The inspectors reviewed selected portions of the completed surveillance packages and found no discrepancie Conclusion GPUN completed the required annual inspections on both emergency diesel generators in accordance with the manufacturer's recommendations as required by the plant's Technical Specifications. Workers exhibited a lack of attention to detail for foreign materials exclusion controls during the conduct of the inspection M1.2 On-Line Maintenance to Correct Secondarv Plant Flow Oscillations Insoection Scope The inspector observed on-line maintenance activities to correct a minor secondary plant flow control error that resulted in feedwater flow oscillations to both steam generator Observations and Findinas On April 1, GPUN conducted on-line maintenance to replace a faulty pneumatic positioner on the "A" heater drain flow control valve (HD-V-3A). The installed positioner had exhibited erratic response during normal steady state operation, which resulted in minor feedwater flow and steam generator level oscillations. The pre-job briefing conducted by the shift supervisor was thorough and covered the expected plant response and contingency actions to be taken in the event of an unexpected plant response. HD-V-3A was gagged open during the positioner replacement and heater drain flow was controlled through the "B" heater drain flow control valve (HD-V-38).
After installing the new positioner on HD-V-3A, the maintenance technicians were unable to adjust the valve for proper operation in the system. The maintenance technicians performed troubleshooting on the replacement positioner while it was installed on the valve and controlling heater drain flow to the main feed pumps. The inspector was concemed that information on the troubleshooting efforts was not being communicated to the control room in a timely manner. At one time during the troubleshooting, the gag was removed from HD-V-3A and the positioner was adjusted such that the valve stroked to the full closed position. The control room was not immediately aware of this change in plant status. GPUN management agreed with this observation and coached the operating crew on the importance of timely communications during the conduct of off-normal plant evolution l l
Troubleshooting revealed that the cam attached to the feedback arm on the replacement positioner was installed backwards. This changed the control action of the positioner from direct acting to reverse acting. A direct acting positioner is required for HD-V-3A to function properly in the system. The cam shaft on the replacement positioner was most likely in this configuration when received from the manufacturer. GPUN did not realize this fact, despite performing bench testing on the replacement positioner prior to installing into the syste Following modifications to the feedback arm, the replacement positioner was installed in the system. The repairs were successful in correcting the secondary plant flow oscillation Conclusio_q l
GPUN conducted successful on-line maintenance to replace the pneumatic positioner for the "A" heater drain control valve that corrected a problem with secondary plant flow oscillations. While conducting the repairs, maintenance technicians identified that the replacement positioner was not properly configured. In one instance, communications to the control room during the troubleshooting efforts were not timel M8 Miscellaneous Maintenance issues (92902)
M8.1 (Closed) Violation 97-09-03: Power Operated Relief Valve Inocerable for an Operation Cycle l
This violation concemed an instance where the power operated relief valve (PORV) was inoperable for one operation cycle due to a wiring error. The inspectors performed an in-office review of the GPUN response to the violation, and reviewed corrective action documentation. GPUN determined the root cause for the wiring error to be personnel errors involving inadequate self-checking and inadequate independent verification, after 4 installation of the PORV during the outage. Additionally, a required post-maintenance test (PMT) was not completed. Contributing causes were insufficient detail on the installation procedure design drawing and a programmatic weakness regarding the verification of the performance of PMTs specified on job order Corrective actions for the identified causes included: the PORV was replaced, wired correctly, verified, and properly tested (via PMT); individuals involved with the incorrect wiring were coached regarding self-checking and examination techniques; the '
requirement to perform a PMT for the PORV replacement was clarified; and programmatic improvements were developed to reduce the possibility of a missed PM The inspectors concluded that the root causes and corrective actions taken were comprehensive and appropriate. This violation is close l
.
111. Enaineerina E1 Conduct of Engineering (37551)
The engineering department continued to provide good support to plant operations and maintenance activitie System engineers were actively involved in the surveillance testing of the "B" decay heat removal pum System engineers were actively involved in the annual inspections of the emergency diesel generators. The system engineer worked closely with the maintenance foreman and manufacturer's representative providing good technical advice and industry operating experienc Engineering provided good input to operations in raising the alert alarm setpoint for the condenser offgas radiation alarm. This helped reduce operator burden while still providing early indication of increasing primary to secondary leakag E8 Miscellaneous Engineering issues E (Closed) Licensee Event Reoort 98-06-00. Thermo-Lao Fire Barrier Found Outside Aooroved Joint Desian Arranaement (90712)
The inspectors reviewed LER 98-06-00, dated July 17,1998, to verify GPUN completed a comprehensive evaluation and took adequate corrective actions in response to a Therrr.o-lag fire barrier found incorrectly configured. The root cause evaluation was thorough, and the corrective actions (both immediate and long term) were appropriat This in-office review of the LER concluded that the LER properly addressed the requirements of 10 CFR 50.73. This improperty configured Thermo-l+g fire barrier j constitutes a violation of the fire protection program. This Severity Level IV violation is
'
being treated as a Non-Cited Violation, consistent with Appendix C of the NRC j Enforcement Policy, and is addrer., sed in the corrective action program as CAP T1998-0489. (NCV 50-289/99-02-01)
E8.2 (Closed) Licensee Event Reoort 98-007-00. Inocerable intake Screen and Pumo House l Floor Drain Check Valves Due to Lack of Preventative Maintenance and Periodic Insoection (90712,92700)
The inspectors reviewed LER 98-007-00, dated August 14,1998, to verify GPUN completed a comprehensive evaluation and took adequate corrective actions in response to finding degraded floor drain check valves in the intake Screen and Pump House. The inspectors performed an in-office review of the LER, and inspected the areas around the floor drains. The root cause evaluation was thorough, and the corrective actions appropriately addressed the root causes. The LER properly addressed the requirements of 10 CFR 50.73. This failure to maintain the floor drain check valves operable constitutes a violation of 10 CFR 50 Appendix B, Criterion XVI, l
.
.
-
Corrective Actions, since this condition adverse to quality was not promptly identified and corrected. This Severity Level IV violation is being treated as a Non-Cited Violation, consistent with Appendix C of the NRC Enforcernent Policy, and is addressed in the corrective action program as CAP T1998-0595. (NCV 50-289/99-02-02)
E8.3 (Closed) Licensee Event Reports 98-13-00. 01: Failure to Perform Fire Protection Proaram Surveillances at the Reauired Frecuency (90712,92700)
The inspectors reviewed LER 98-13 (revisions 00 and 01), dated October 15,1998, and January 22,1999, to verify GPUN completed a comprehensive evaluation and took !
adequate corrective actions when personnel identified that fire hose station inspections
]
had not been performed every 18 months as required. The inspectors performed an in-office review of the LER, and observed fire hose station inspection markings at various fire hose stations throughout the plant during various tours. The root cause evaluation was thorough, and the corrective actions appropriately addressed the root cause During the subsequent fire hose surveillances, no inoperable fire hoses were identifie This failure to perform the fire hose surveillances, as required by the fire protection program, constitutes a violation of minor significance and is not subject to formal enforcement action. The LER properly addressed the requirements of 10 CFR 50.7 IV. Plant SuDDort
S1 Conduct of Security and Safeguards Activities (81700) l I Insoection Scope l The security program was inspected during the period of Apni 5-8 to assess the conduct of security and safeguards activities against GPUN's commitments in the NRC-soproved physical security plan (Plan) and NRC regulatory requirements. The areas inspected j included: alarm stations; communications; and protected area (PA) access control of personnel, packages and vehicle Observations and Findinas Alarm Stations. Operations of the Central Alarm Station (CAS) and the Secondary Alarm Station (SAS) were reviewed. Both alarm stations were equipped with appropriate alarms, surveillance and communications capabilities. Interviews with the alarm station operators found them knowledgeable of their duties and responsibilities. Observations and interviews verified the alarm stations were continuously manned, independent, and diverse so that no single act could remove the plant's capability for detecting a threat and calling for assistance. The alarm stations did not contain any operational activities that could interfere with the execution of the detection, assessment and response function Communications. Document reviews and discussions with alarm station operators determined that the alarm stations were capable of maintaining continuous intercommunications and continuous communications with each security force member (SFM) on duty, and that alarm station operators were testing communication capabilities with the local law enforcement agencies as committed to in the Pla !
!
<
j
.
-
Protected Area Access Con'.rol of Personnel and Hand-Carried Packaoes. On April 6 and 7, during peak activity periods, the inspector observed personnel and package search activities at the parsonnel access portal. Positive controls were in place to ensure that only autho:ized individuals were granted access to the PA and that all personnel snd hand-carried items entering the PA were properly searche Protected Area Access Control of Vehicles. On April 6, the inspector observed vehicle search activities at the main vehicle access gate. The vehicle search was thorough and accomplished in accordance wi+h Plan commitments. The active land vehicle barrier was operated in accordance with Plan commitment Conclusions GPUN conducted its security and safeguards activities in a manner that protected public health and safety. This portion of the program, as implemented, met commitments and NRC requirement S2 Status of Security Facilities and Equipment (81700)
a. Inspection Scooe The areas inspected included: PA assessment aids; PA detection aids; and personnel search equipmen b. Observations and Findinas Assessment Aids On April 5,1999, the effectiveness of the assessment aids was I m evaluated by observing the PA perimeter on closed circuit television (CCTV), in the CAS l and the SAS, respectively. The evaluation of the assessment aids was accomplished by !
'
observing, on CCTV, an SFM walk the entire site perimeter. The assessmt nt aids had good picture quality, view and zone overlap. Additionally, to ensure Plan cammitments were satisfied, the licensee had procedures in place requiring the implementation of compensatory measures in the event the alarm station operator was unable to properly assess the cause of an alar ;
PA Detection Aids. On April 5,1999, while observing the assessment aids, testing was also observed of all intrusion detection zones in the plant protected area. The !
appropriate alarm was generated in each zone for each test. Through observations and review of the testing documentation associated with the equipment repairs, it was verified that repairs were made in a timely manner and that the equipment was functional and effective, and met the commitments in the Pla .
Personnel and Packaae Search Eauioment. On April 6,1999, both the routine use and the daily operational testing of personnel and package search equipment were observe Personnel search equipment was being tested and maintained in accordance with procedures and the Plan and personnel and packages were being properly searched prior to PA acces Observations and procedural reviews determined that the search equipment performed in accordance with licensee procedures and Plan commitments, c. Conclusions j The security facilities and equipment were well maintained and reliable, and were able to meet commitments and NRC requirement S3 Security and Safeguards Procedures and Documentation (81700)
a. Inspection Scoce The areas inspected included implementing procedures and security event log b. Observations and Findings Security and Proaram Procedures. Review of selected security program implementing procedures associated with personnel search, vehicle search, and equipment testing verified that the procedures were consistent with the Plan commitment Security Event Loas. The Security Event Log for the previous twelve months was I reviewed. Based on this review, and discussions with security management, it was determined that the licensee appropriately analyzed, tracked, resolved and documented safeguards events that GPUN determined did not require a one hour report to the NR c. Conclusions Security and safeguards procedures and documentation were being properly implemented. Event Logs were being properly maintained and effectively used to analyze, track, and resolve safeguards event o
-
S4 Security and Safeguards Staff Knowledge and Performance (81700)
a. . insoection Scope The area inspected included security staff requisite knowledge, Qhservations and Findinas Security Force Reauisite Knowledoe. A number of SFMs were observed in the performance of their routine duties. These observations included alarm station operations, personnel and package searches, and exterior patrol alarm respons Additionally, SFMs were interviewed. The inspector determined that the SFMs were
)i knowledgeable of their responsibilities and duties, and could effectively carry out their assignment Conclusions The security force members exhibited adequate knowledge necessary to implement the duties and responsibilities associated with their positio S5 Security and Safeguards Staff Trainbg and Qualifications (81700) Inspection Scope The areas inspected included security training, qualifications, and training record Observations and Findings Secunty Training and Quahfications (T&QL On April 7, T&Q records of 10 SFMs were reviewed. The results of the review indicated that these personnel were trained in accordance with the approved T&Q plan. In addition, on April 7, the inspector observed range re-qualification of the range instructors at the firing range. The training included a range operations and safety briefing. In addition, safety briefings were provided prior to each phase of the re-qualification. The training was conducted in a professional manner, with a strong emphasis on safety. The range instructor maintained positive control of all activitie Training Records. Through review of training records, the inspector determined the records were properly maintained, were accurate and reflected the current qualifications 1 of the SFM i 4 Conclusions Security force personnel were being trained in accordance with the requirements of the T&Q Plan. Training documentation was properly maintained and accurate, and the training provided by the training staff was effectiv .
S6 Security Organization and Administration (81700) l
.
. a. Inspection Scope The areas inspected included management support, management effectiveness, and level of staffin b. Observations and Findinas Management Support . Review of program implementation since the last program inspection identified that adequate support and resources continued to be available to ensure effective program implementatio Manaaement Effectiveness. The inspector rc tiewed the management organizational structure and reporting chain and noted that the Site Security Manager's position in the organizational structure provided a means for making senior management aware of programmatic need I Staffina Levels. The total number of trained SFMs immediately available on shift met the requirements specified in the Plan and implementing procedure c. Conclusions The level of management support was adequate to ensure effective implementation of 4 the security program as evidenced by adequate staffing levels and allocation of resources to support programmatic need S7 Quality Assurance (QA)in Security and Safeguards Activities (81700)
a. Insoection Scope The areas inspected included audits, problem analyses, corrective actions, and 4
! effectiveness of management control b. Observations and Findinas Audds. No new security program audit had been conducted since the last inspectio The 1998 fitness-for-duty audit (98-04) was reviewed. A review of the audit checklist showed that the audit included all components of the fitness-for-duty program and was comprehensive in scope. The audit was found to have been conducted in accordance with regulatory requirements and the audit team included an independent technical specialist. Findings from the audit were not indicative of program weakness and implementation of corrective actions for the findings were generally to effect program enhancement Problem Analyses. A review of data derived from the security department's self-assessment program indicated that potential weaknesses were being properly identified, tracked, and trende {
l
Corrective Actions. The inspector reviewed corrective actions implemented by GPUN in '
response to the QA audits and self-assessment program. All corrective actions had been implemented and the corrective actions were effectiv Effectiveness of Manaoement Controls. The inspector observed that GPUN had programs in place for identifying, analyzing and resolving problems. The programs l included the performance of annual QA audits, a departmental self-assessment program, and the use of industry data, such as violations of regulatory requirements identified by the NRC at other facilities, as a criterion for self-assessmen l Conclusions Audits of the security program were comprehensive in scope and depth, and findings were reported to the appropriate level of management. The self-assessment program was effectively implemented to identify and resolve potential weaknesse V. Manaaement Meetinas X1 Exit Meeting Summary The physical security inspector met with licensee representatives at the conclusion of the inspection on April 8,1994. At that time, the purpose and scope of the inspection were reviewed, and the preliminary findings were presented. The licensee acknowledged the preliminary inspection finding Following the completion of the inspection period, the resident inspectors conducted an exit i meeting with GPUN managers on May 7,1998. GPUN staff comments conceming the issues in
-
this report were documented in the applicable report sections. No proprietary information was
'nclude X2 Predecisional Enforcement Conference i
'
On April 23,1999, a predecisional enforcement conference was held to discuss issues involving an apparent violation related to changes made to the loss of feedwater accident analysis and ;
emergency feedwater system testing acceptance criteria used to ensure system capability to meet the analysis requirements. The meeting, held between the NRC and GPUN, was to obtain information to enable the NRC to make an enforcement decision. Handouts from the meeting are enclosed with this repor INSPECTION PROCEDURES USED IP37551 Onsite Engineering IP61726 Surveillance Observations IP62707 Maintenance Observation IP71707 Plant Operations IP71750 Plant Support Activities IP81700 Physical Security Program for Power Reactors IP90712 in-office Review of Written Reports of Non-routine Events at Power Reactor ;
Facilities IP92700 Onsite Follow-up of Written Reports of Non-routine Events at Power Reactor l
'
Facilities IP92901 Follow-up Operations IP92902 Follow-up Maintenance ITEMS OPENED, CLOSED AND DISCUSSED Opened / Closed:
99-02-01 NCV Thermo-Lag Fire Barrier Found Outside Approved Joint Design Arrangement. (Section E8.1)
99-02-02 NCV Inoperable intake Screen and Pump House Floor Drain Check Valves Due to Lack of Preventative Maintenance and Periodic inspectio (Section E8.2)
Closed 97-09-03 VIO Power Operated Relief Valve Inoperable for an Operation Cycle (Section M8.1)
98-06-00 LER Thermo-Lag Fire Barrier Found Outside Approved Joint Design Arrangement (Section E8.1)
98-007-00 LER Inoperable intake Screen and Pump House Floor Drain Check Valves Due to Lack of Preventative Maintenance and Periodic Inspection (Section E8.2) l 98-012-00 LER Control Room Habitability Boundary Ventilation Damper Found Out of Position (Section 08.1)
98-13-00,01 LERs Failure to Perform Fire Protection Program Surveillances at the Required Frequency (Section E8.3)
98-014-00 LER Missed Technical Specification Surveillance (Section 08.2)
Discussed:
Non f
.
'
LIST OF ACRONYMS USED CAP Corrective Action Process CAS Central Alarm System CCTV Closed Circuit Television cpm Counts per Minute FME Foreign Materials Exclusion GPUN GPU Nuclear, In HEPA High Efficiency Particulate Absolute ICS Integrated Control System IR inspection Report IST Inservice Test LER Licensee Event Report NCV Non-Cited Violation NRC Nuclear Regulatory Commission PA Protected Area I PDR Public Document Room Plan NRC-approved Physical Security Plan PMT Post-Maintenance Test QA Quality Assurance RCS Reactor Coolant System SAS Secondary Alarm System SFM Security Force Member T&Q Training and Qualification l
TMI Three Mile Island Unit 1 TS Technical Specification UFSAR Updated Final Safety Analysis Report I
i i
J
r
-
..
4/22/99
1
~*
-_ ;___ - -
.a . . , . , , ,,
<
l TMI-1 Predecisional Enforcement Conference Emergency Feedwater Design Basis issues and Safety Evaluation issues j Rockville, MD April 23,1999
Agenda I
.+.- . , . .
g , Introduction A.Rone System Description P. Walsh EFW Design Basis P. Walsh Chronology P. Walsh NRC losues/GPUN Response P. Walsh EFW Capability P. Walsh j Conclusions P. Wa!sh Enforcement Assessment J. Wetmore Discussion All l
EFW PDEC 1
.
4/22/99
.
Introduction
- - -m,, _m ,
Issues (Ref: IR 50-289/98-09)
GPUN failed to properly review a change to the design basis of the emergency feedwater system. Specifically:
1 Failed to complete a safety evaluation for a design basis change to the EFW flowrate to the steam generator I Did not identify the reduced EFW flow requirement as a US I Changed the analysis method for Loss of Feedwater(LOFW)
without prior NRC approva )
I Did not identify that the turbine driven EFW pump .vas less than 100% capaciy for required accident flowrate Introduction (continued)
~ -
'urz wc. . .,
,
_
GPUN Position:
I The safety determination (GPUN 50.59 screening process)
conducted in revising the EFW surveillance test was inadequate because it did not require a safety evaluatio I Changing the EFW flow requirement is not an US I Analysis method (RETRAN) is NRC approve I The capacity of the turbine-driven EFW pump is adequate for all design basis events for which it is require I The EFW system capacity continues to exceed that required for all design basis accident EFW PDEC 2
-
..
4/22/99 i
System Description
- . . . . -
_. _ _
B The Oriainal Desian: Not safety grade, TDP auto started on loss of I RCPs or MFPs, MDPs were manually started (and if necessary, EDG loaded).
I Post TMI-2 ASLB modifications: Significantly altered the physical system and introduced a revised set of design requirements and system design basis. Major changes were i MDP Auto-start & 1E power, control and indication upgrades 1 Cavitating Venturis to limit flow to failed OTSG and minimize overcooling I Redundant control valves ,
1 Pump recirculation valves blocked open I
l
$
System Description (original)
- ~
e- - -
, _
nacmc voco=o van a h5 EF V31%
EF-P 2A saou 4 M
u vum _
.,
{_
"
sv ,.,g,;
= *= . v .,
~
.~.
'8ar"* **
M EF V1A
'
- ' 'M ,;l:,c;.';
>
21 2 v.v EFA28 g l
EFW PDEC 1
-
.
4/22/99 i
l l
System Description with Modifications
_ . _ . . . . _ .
l
,
, __
_ .._ g ,_.Ler4p,
,,,,
W "~
.._ 4
~"
.
.n O' _
'~
u .., . =,. .- ~
[_
- 5 ~
)1
..
[- ____
m- "" m n - --
- M ==: ~
s
=> h .-
3.... ,
EFW Design Basis
~ ~? s ; .w , ..,,,
Oriainal Desian Basis (FSAR Amend. 41,7/73)*
I * Emergency feedwater pumps are provided to operate: 1) on loss of the two 230 kv buses in the substation, and 2) if both main j feedwater trains fail. They would operate after a main steam line break provided both main feed pumps are not operating. They are not required for startup, normal shutdown, or for the LOCA.*
(page 10-3), and I "The emergency feed pump turbine is automatically started on 1) loss of four reactor coolant pumps or 2) trip of both main feed pump turbines." (page 10-4)
EFW PDEC 4
-
..
4/22/99 EFW Design Basis
~
' ~ . . __ Y- m... .n, I Current Desian Basis 1 The system must be capable of withstanding a design basis event and a single active failure while still performing its function of supplying heat removal path to allow safe shutdown of the reacto I The design will ensure that a single active failure will neither inadvertently initiate EFW nor isolate the main feedwater (MFW)
syste I Technical Specification LCO (3.4.1.1) requires 3 operable pumps (to meet single failure criteria) and allows 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore an inoperable pum EFW Design Basis
-
m ,2 -, _ Event Performance Criteria Acceptance Criteria I
Loss of Feedwater. Requires 480 gpm Thermal power < 112%
Bounds all other loss @ 1050 psig to 2 OTSGs RCS Pressure < 110%
of heat sink event Pressurizer does not fill Steam Line Brea Limit EFW to less than OTSG tube loads Bounds overcooling 590 gpm to a single DNBR (overcooling)
event depressunzed OTS Intermediate building EQ Containment overpressure Station Black Ou Requires 350 gpm PORV does not open Bounding event for @ 1050 psig to 2 OTSGs Establish natural circulation the TD EFW PDEC 1
P
'
.
4/22/99 Chronology
- ---
_, t _ _ _ - _ .
I GPUN activities in 1997:
I Re-analyzed LOFW event to provide operational flexibility i EFW flowrate of 480 gpm total using RETRAN model i Revised outage surveillance procedure implementing the acceptance criteria for EFW pump testing. Safety determination did not identify that a safety evaluation was require I 12R testing demonstrated acceptance criteria were me Chronology (continued)
,, _ ,. m _ I September 1998: NRC Resident inspector identified problems with safety review of the surveillance test revision and inconsistencies in the FSAR and Technical Specification base (Ref: NRC IR 50-289/98-03)
I September 1998: GPUN issued a change to the FSAR with a Safety Evaluation to clarify the LOFW design bases for EF I March 1999: NRC identified apparent violation :. . -~
EFW PDEC 6
.. . .
..
. _ _ _ _ _ _ _ _ _
.
.
..
-
.
4/22/99 NRC lssues
--..____-. _ _ _ . . , , , _
lasue #1: Failure to perform a safety evaluation on changes to the EFW design basis I GPUN agrees that the safety determination conducted for rev; sing the outage surveillance test incorrectly concluded that a safety evaluation was not require I A safety determination is required for all implementing documents (e.g, the EFW surveillance procedure).
I The safety determination did not properly identify that a change in the FSAR was require I A root cause evaluation was performed to address the inadequate safety determination. Team included personnel from another utilit NRC lssues (continued)
m c
= a. , _= . ..
Root Cause Analysis Results:
I Root Cause i The FSAR contained confusing and incomplete EFW design basis informatio I Contributing Cause *
I Potential weakness in recognizing changes to analyses as a 50.59 ' change to the facility".
I Extent of Condition Review Conclusion i No programmatic deficiencies in the processes, the 50.59 l procedures, or initial training. Add;tionally, 50.59 Initial and refresher training are comprehensive and generally consistent with industry peer I EFW PDEC 2
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
c
,,
4/22/99 l
'
NRC lssues (continued)
-
- - -
,_ . Corrective Actions:
I Develop comprehensive, concise EFW design basis descriptions, and revise the applicable sections of FSAR Chapter 10,14, and the Technical Specifications base I Training will be given to all qualified RTRs end ISRs:
I Specifically address " Changes to a facility" and "Unreviewed, Safety Question *,
I Review the GPU Nuclear Safety Review process, and 1 Reiterate expectations regarding the accuracy and clarity of the FSA I Comprehensive review of all design basis accidents in FSAR ,
Chapter 14 I
NRC issues (continued) )
x ., ,
_
lasue #2: Changed EFW flow requirement without )
identifying the change as a USQ I TMI FSAR states that lower flow rates may be acceptable:
"It should be noted that [the B&W study) was for the purpose of showing the adequacy of 500 gpm and not to determine the minimum EFW acceptable for the transient. Therefore, it is possible that a lower flow rate would produce acceptable results given the same assumptions and acceptance criteria." FSAR 14.2.2.7, page 14.2-7 I EFW flow rate is an input parameter to the accident analysis, the acceptance enteria were me l EFW PDEC 8
-
.
4/22/99 NRC issues (continued)
m -
- _ lasue #3: Used a new analysis method (RETRAN) for LOFW design basis flow without obtaining prior NRC approval (USQ)
I GPUN analyzed the LOFW event using RETRAN
'
I RETRAN was approved for TMl-1 transient analysis including the LOFW event (Reference: GPUN Topical Report TR-078 and NRC SER dated 2/10/97)
l NRC ISSUES (Continued) !
- trz:, ~ .
. .- x issue #4: Failed to recognize that analysis showed the TDP was unable to meet the full flow requirements as described in the Technical Specification basis and FSAR I Original design basis required full capacity TDP for loss of all AC powe This requirement is still me I Post TMI-2 ASLB order required EFW to be able to delivery adequate flow with worst case single failure. The limiting event (maximum flow rate l demanded) is LOFW with RCPs ON. Any 2 pumps meet this capacity ;
'
requiremen I Technical Specification LCO (3.4.1.1) is consistent with the design basis. It requires 3 operable pumps (to meet single failure errteria) and allows 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore an inoperable pum EFW PDEC 2
,
.
4/22/99 NRC lssues (continued)
_. _ _._ - -_
_
,,
I Pump nominal capacities,920 gpm for the TDP and 460 gpm for the MDPs, are listed in both the Technical Specification bases and the FSAR. These values are not related to actual system capacity and are neither licensing nor design basis informatio These values are the original pump purchase specs. They represent the nominal design flowrate at 2700 ft of hea I These values were recognized as nominal pump design values (not system capacities) in the Restart SER (NUREG-0680).
I These flowrates are not used in any analysi I The FSAR and Tech Specs will be revised to eliminate confusion regarding system capacit EFW System Capability 4 m a , .,;~: ,
I EFW pumps continue to deliver required flow:
1 LOFW with RCPs ON requires 480 gpm total from any 2 of the 3 pumps I LOFW with no AC power (RCPs OFF) requires TDP to deliver 350 gpm I Comparison of 1974 and recent EFW pump testing shows that perfonnance has not degraded since installation testing in 1974 Total Pred:cted Flows Delivered to OTSGs at 1050 Dsla i I
Pump Combination Currentty Predicted Flow *
apm 1TDP 536 2 MDP 666 1 MDP & 1TDP 689
" Based on RELAP analysis benchmarked to actual system and pump performance
I EFW PDEC 10
___
i
.
4/22/99
.
Summary and Conclusions
. , . . . .
,
I The safety determination for changing the EFW surveillance test criteria was inadequate. A root cause team determined no programmatic deficiencies in the safety review process. Corrective actions are in progres I Changes to EFW flowrate were made in accordance with the FSAR. The approved acceptance criteria were me I RETRAN method was approved for TMI-1 prior to implementatio I The design basis for EFW is a single failure proof system. Only a loss of all AC power requires a full capacity turbine-driven pump. The TDP meets this requiremen I EFW performance continues to exceed that required for all design basis accident analysis. Further, the pumps have not degraded since initial installatio ,
Enforcement Assessment ,
L '~
- '2 e w ;; , .x
_
, , , ,
~ Apparent Violation Applicable Section of Identification Corrective Enforcement Enforcernent Policy Credit Adion Credit Discretion 1. Failure to Supp.1, Section N/A N/A N/A perform a safety Seventy LevelIV, item 5:
Evaluation for a "Relatively isolated ,
change to violation . . not indicative l required EFW of a programmatic safety I
flow rat concem with meeting
50.59 2. Failure to None. GPUN position is N/A N/A N/A identify the that no USQ was involved change as a because the FSAR allows US for lower EFW flows and the accident analysis acceptance enteria were me .
EFW PDEC 11
.
,
4/22/99
.
I
'
' -- -
g_ . =-
Discussion i l
)
i i
n )
l
.
I EFW PDEC - J2_