| |
|||
| Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us | |
||
SECY-98-119
May 28, 1998
| FOR: | The Commissioners |
| FROM: | L. Joseph Callan /s/ Executive Director for Operations |
| SUBJECT: | REMAINING ISSUES RELATED TO RECOVERY OF MILLSTONE NUCLEAR POWER STATION, UNIT 3 |
PURPOSE:
To provide the Commission with (1) the staff's assessment of the remaining issues related to the Restart Assessment Plan (RAP) for Millstone Unit 3 that were not addressed in SECY-98-090, "Selected Issues Related to Recovery of Millstone Nuclear Power Station Unit 3," dated April 24, 1998, and (2) the staff's recommendation regarding restart authorization for Millstone Unit 3. The staff has evaluated these issues to be acceptable for a Commission restart authorization for Millstone Unit 3. A summary discussion of these issues is presented in this paper and, where appropriate, a more detailed discussion is attached.
BACKGROUND:
SECY-98-090 provided the appropriate background on the issues surrounding the extended shutdown of the three Millstone nuclear station units, including major NRC and licensee (Northeast Nuclear Energy Company [NNECO]) activities. The staff has frequently communicated with the Commission through various Commission papers and status reports over the past two years since Millstone station was designated as a watch list Category 3 facility in June 1996. The Commission has also received briefings on approximately a quarterly basis since January 30, 1997, from the staff, the licensee, pertinent contract organizations involved in oversight activities, and in the most recent May 1 meeting, members of the public and state and local officials.
DISCUSSION:
At the Commission meeting on the status of Millstone on February 19, 1998, the Chairman presented issues for the staff to consider in preparation for upcoming Commission meetings. In its SRM of March 18, 1998, the Commission gave guidance to the staff on the information it needs to make a restart decision on Millstone Unit 3. In the SRM, the Commission directed the staff to provide crisp, clear analyses of the restart-related issues with recommendations (where appropriate) and a summary of independent NRC actions supporting staff decisionmaking on Millstone's restart. Three issues associated with restart readiness of Unit 3 discussed in the SRM were addressed in SECY-98-090 and discussed with the Commission in a May 1, 1998, meeting. These issues were (1) the licensee's progress in establishing a safety-conscious work environment (SCWE) and an effective employee concerns program (ECP); (2) an assessment of licensee improvements to oversight and quality assurance; and (3) NRC staff plans for monitoring licensee resolution of nonrestart-related issues or items (i.e., backlog management). In its May 19, 1998, SRM, the Commission agreed with the staff's conclusion that these areas were acceptable to support restart of Unit 3, with three noted conditions related to continued oversight and inspections. This SRM also directed the staff to provide the Commission information related to the staff's assessment of the Focus 98 document in which NNECO managers utilized the term "isolate cynics." The Commission will be briefed on this issue during a closed Commission meeting on May 29, 1998. Additionally, the staff's response to the 10 CFR 2.206 petition filed by the Citizen's Awareness Network related to this concern is expected to be issued soon, and will be submitted to the Commission. The remaining issues identified in the staff's RAP for Unit 3 and the March 18 SRM are discussed in more detail below.
For each Millstone unit, the staff developed a RAP which identifies the issues, including those related to the two NRC Orders, that require resolution before a unit restarts. Programmatic issues identified in the Unit 3 RAP include corrective action program improvements, work planning and control improvements, procedure upgrade programs, employee concerns program improvements, and oversight and quality assurance improvements. The RAP also includes staff activities to evaluate the completion of the ICAVP and the licensee's response to the NRC's 10 CFR 50.54(f) letters regarding Millstone. The actions listed in the Inspection Manual Chapter (IMC) 0350, "Staff Guidelines for Restart Authorization," restart checklist that are applicable to Millstone, such as those regarding management effectiveness and self-assessment capability, are also included in the plan. The plan provided for the conduct of an Operational Safety Team Inspection (OSTI), which was completed on April 24, 1998, and for which a public exit meeting was held on May 5, 1998. For key issues not addressed in SECY-98-090, the staff is providing its overall assessment related to restart readiness for Unit 3. Executive summaries of the basis for the staff's conclusions related to each of these areas follow. In addition to the executive summaries below, more detailed analyses of the licensee's and the NRC's activities to address three of the key issues are contained in Attachment 1 (Independent Corrective Action Verification Program); Attachment 2 (Corrective Action Program); and Attachment 3 (Operational Safety Team Inspection).
(1) Independent Corrective Action Verification Program (ICAVP)
The NRC has been maintaining heightened oversight of the corrective actions being conducted by NNECO at Millstone. On August 14, 1996, the NRC issued an Order requiring NNECO to perform an ICAVP. The ICAVP was intended to independently verify, beyond the licensee's quality assurance and management oversight, that the licensee's corrective actions had (1) identified and satisfactorily resolved existing nonconformances with the design and licensing bases; (2) documented and utilized the licensing and design bases to resolve nonconformances; and (3) established programs, processes, and procedures for effective configuration management in the future. Prior to the ICAVP review, the licensee carried out its own review (i.e., Configuration Management Plan [CMP]) to reestablish the design and licensing bases for all 88 of the Unit 3 Maintenance Rule (10 CFR 50.65) Group 1 and Group 2 systems. The development and implementation of the ICAVP involved an extensive level of effort (approximately 160,000 engineering-hours) by an independent contractor, Sargent and Lundy (S&L). Additionally, the NRC carried out an extensive program for both onsite inspection and in-office review and approval of the S&L audit plan and oversight of S&L activities.
S&L was selected by NNECO and approved by the NRC to conduct the ICAVP at Millstone Unit 3. Implementation of the Unit 3 ICAVP was carried out using a three-tiered approach as described in SECY 97-003, "Millstone Restart Review Process," and specified in an NRC-approved audit plan. In Tier 1, S&L performed a detailed review of the design and licensing bases of 15 of the 88 Maintenance Rule (10 CFR 50.65) Group 1 or Group 2 systems, including a validation of design interfaces of those 15 systems with an additional 51 other systems. In Tier 2, S&L reviewed the critical design characteristics (CDCs) of the 22 systems required for mitigating the consequences of design-basis accidents, which are described in Chapter 15 of the Final Safety Analysis Report. In Tier 3, S&L reviewed 11 change processes other than the principal design change process (i.e., procedure changes, drawing changes, setpoint changes, etc.) used at Millstone that had the potential to result in nonconformances with the design or licensing bases of the facility. The Tier 3 review also included an historical review of approximately 300 changes, spanning the interval of licensed operation of the unit, made through the application of the 11 change processes. In addition to the Tier 3 review, S&L reviewed the completeness and technical adequacy of the corrective actions for nonconformances that were identified by the licensee during the NNECO CMP and corrective actions in response to S&L discrepancy reports (DRs) that required completion before restart of Unit 3.
Throughout the ICAVP, the Special Projects Office (SPO) oversaw and provided guidance to S&L regarding its implementation of the ICAVP. The Connecticut Nuclear Energy Advisory Council (NEAC) monitored interactions between S&L and NNECO and participated in frequent meetings and teleconferences. The NEAC was also given the opportunity to observe the oversight activities conducted by the SPO staff. The SPO oversight activities included (1) review and approval of S&L as the ICAVP contractor, including interviews and approval of S&L's staff; (2) review and approval of the ICAVP Audit Plan, implementing procedures, and changes to both; (3) selection of the systems and specification of the systems' boundaries, including the scope of S&L's ICAVP Tier 1 reviews (NEAC selected two of the system groups representing 11 of the 88 systems); and (4) performance of an ICAVP implementation inspection, an NRC Tier 1 (out-of-scope) inspection of a system reviewed by the licensee's CMP but outside the ICAVP scope, an NRC Tier 1 (in-scope) inspection of a system reviewed by S&L, an NRC Tier 2 and Tier 3 inspection, and multiple corrective action inspections. The five NRC oversight inspections of the Unit 3 ICAVP, which were performed in addition to the S&L activities, represented approximately 12,000 inspection hours.
The public was provided an extensive opportunity to observe the staff's interactions with the licensee and S&L throughout the course of the ICAVP. In addition, the public was provided many opportunities to interact directly with the NRC. The staff held monthly meetings that were open for public observation at Millstone to discuss the status of the ICAVP. Further, the SPO staff held periodic evening meetings at about 6-week intervals, during which members of the public were given the opportunity to express their concerns and question the status and results of S&L's implementation and NRC's oversight of the ICAVP. In addition, most of the meetings, including inspection exit meetings and predecisional enforcement conferences held between the NRC, S&L, and NNECO were open for public observation and conducted at Millstone or in the surrounding communities. To provide public access to concerns raised by S&L during the ICAVP, S&L posted its DRs, NNECO's DR responses, and any S&L comments to a website on the Internet 2 days after issuance.
S&L issued an interim report on May 8, 1998, which gave the preliminary results of its implementation of the ICAVP at Unit 3. S&L and the licensee were still resolving a relatively small number (approximately 100) of DRs at the time the interim report was issued, and the resolution of the remaining DRs was not expected to affect the conclusions reached in the interim report. In this interim report, S&L concluded that:
S&L did not identify any Level 1 or Level 2 findings. These are defined as discrepancies in which nonconformances with the design and licensing bases would affect the functionality of a safety system. As of May 21, 1998, S&L had identified 18 nonconformances with the Unit 3 design and licensing bases. These 18 instances were documented in ICAVP Significance Level 3 DRs. Level 3 DRs were defined by the NRC as discrepancies that represented nonconformances with the design and licensing bases that would not have prevented the system from performing its intended functions. To date, the staff has inspected the implementation of NNECO's corrective actions for 12 of the 18 Level 3 DRs issued by S&L. Results to date indicate that the licensee's corrective actions are adequate for resolving the identified problems and for identifying and resolving similar issues in other systems. Thus, and in accordance with the staff's established criteria for evaluating the ICAVP findings, the SPO staff determined that it was not necessary to increase the scope of the ICAVP at Unit 3 for issues identified by S&L in Level 3 DRs.
In addition, as of May 21, 1998, S&L had issued 580 DRs that identified minor editorial errors, calculational errors that did not change the results or conclusions of the calculation, or inconsistencies between plant drawings and the plant configuration that did not result in nonconformances with the design or licensing bases. DRs that identify errors that do not result in the plant's being outside its design and licensing bases were defined by the NRC as ICAVP Significance Level 4 DRs. A number of these Level 4 DRs were identified as a result of a line-by-line review of calculations in which S&L identified minor errors. It was determined that the licensee, in order to focus on the identification of potentially safety significant issues, adopted a "graded systems review." The graded approach used during the CMP was a higher level review than the more detailed S&L review, concentrating on calculation inputs, assumptions, methodology and reasonableness of results. The fact that no Level 1 or Level 2 DRs and relatively few ICAVP Significance Level 3 DRs were identified by S&L indicates that the graded systems review methodology used by NNECO was effective. The number of Level 4 DRs that were identified by S&L's review was not viewed as indicative of a weakness in the CMP and did not, because of the minor significance of such findings, suggest the need for an expansion of the scope of the ICAVP.
In addition to the review of each individual issue identified by the DRs, S&L and the NRC examined DRs collectively to determine if any trends in these findings could be identified. On the basis of these reviews, a trend in the area of calculations (i.e., control and accuracy) was identified by S&L and the NRC. The safety significance of this trend was determined to be minor because of the fact that the noted calculational errors did not materially alter the results or conclusions of the calculations. Nonetheless, the trend indicates a need for improvement in calculational accuracy and in the thoroughness of the licensee's independent review. The staff determined that these improvements can be made on an ongoing basis. As specified in the NRC's ICAVP Order, NNECO is required to respond to the findings of S&L before entry into Mode 2 (restart). The staff will review the licensee's proposed corrective actions to the identified trend.
During performance of its ICAVP Oversight Inspection Plan, the SPO staff identified a number of issues that resulted in NNECO's taking additional corrective actions. As described in Attachment 1, these additional efforts by the licensee effectively resulted in a broadening of the scope of its CMP efforts to recover the design and licensing basis of Unit 3. In some cases, licensee corrective actions were significant. An example that has been previously discussed with the Commission is the issue involving the potential for air binding the charging and safety injection pumps. Although it was subsequently demonstrated to the NRC's satisfaction that the trapped air would not adversely affect system functionality, as part of its corrective actions, the licensee conducted an "Integrated Functional System Review" that included a review of about 25 systems that would be actuated to mitigate the consequences of a small break loss-of-coolant accident. For each finding documented in various NRC inspection reports related to oversight of the ICAVP, the SPO staff has completed, or will complete before restart, inspections to evaluate the effectiveness of the licensee's corrective actions. Results to date indicate that NNECO has taken adequate and timely corrective actions to address and resolve the specific issues, and to identify and resolve similar issues in other systems. Thus, the SPO staff determined that it was not necessary to increase the scope of the ICAVP at Unit 3 for ICAVP Significance Level 3 issues identified during NRC inspections.
On the basis of its oversight of ICAVP activities, the SPO staff has concluded that S&L adequately conducted the ICAVP at Unit 3. The ICAVP provided the staff valuable information that enabled it to make the determination that (1) NNECO's CMP was effective at identifying and satisfactorily resolving existing nonconformances with the design and licensing bases; (2) NNECO had adequately documented the licensing and design bases and used them to resolve nonconformances; and (3) NNECO had established programs, processes, and procedures for effective configuration management in the future. Although both S&L and the NRC staff identified a number of nonconformances with the Millstone Unit 3 licensing and design bases, none of the issues affected the functionality of the plant's safety systems. Additionally, the number of such issues were relatively few and are indicative of an effective effort by the licensee to establish confidence that Unit 3 is in compliance with its design and licensing bases.
The scope of the ICAVP, while large, did not review all aspects of all 88 Group 1 and 2 Maintenance Rule systems. Therefore, it is reasonable to assume that similar types of findings may exist in other systems. However, the extent of the ICAVP reviews and the low safety significance of the findings identified by S&L and NRC provides confidence that any other issues would also be of low safety significance. Additionally, the licensee has taken broad corrective actions for noted design and licensing bases issues that the staff has judged to be thorough and effective. Therefore, the staff concludes that the Unit 3 ICAVP has been satisfactorily performed and the results of the ICAVP and the staff's oversight provide confidence that Unit 3 is in compliance with its design and licensing bases.
(2) Corrective Action Program
Previous licensee self-assessments and NRC inspections had identified that NNECO's corrective action program had been historically weak in the identification of problems and ineffective in ensuring comprehensive and effective corrective actions. Many instances existed of narrowly focused corrective actions that failed to encompass all aspects of the underlying problem. Additionally, the licensee often did not follow up on corrective actions to ensure they were effective. A correlation also existed between the ineffectiveness of the corrective action program and the issues related to the handling of employee safety concerns and the SCWE at Millstone. An important element of an effective corrective action program is that workers are encouraged to raise issues willingly without fear of retribution or retaliation. Consequently, the RAP determined that the licensee's corrective action program was an important issue.
NNECO initiated efforts in early 1997 to improve the corrective action program by adopting industry standards and processes and formalizing them in its procedure Reports (RP) 4, "Corrective Action Program." The fundamental changes to the process included lowering the threshold level for reportable problems, management emphasizing the need for employees to identify problems, greater management involvement in the process, timely processing of operability determinations, development of performance indicators, training in root-cause analysis, and enhancement of the tracking and trending programs.
To verify the licensee's actions, the NRC, in addition to the day-to-day observations and interactions of the resident inspectors, performed a number of multi-purpose inspections to assess the effectiveness of the process. The NRC performed a team inspection using Inspection Procedure (IP) 40500, "Effectiveness of Licensee Controls in Identifying, Resolving, and Preventing Problems." The NRC conducted an inspection that assessed the effectiveness and the appropriateness of the licensee's corrective actions associated with design issues raised by the NRC in its ICAVP-related inspections, the licensee in its CMP, and S&L in its ICAVP. An Operational Safety Team Inspection (OSTI) was performed at Millstone Unit 3, which audited portions of the corrective action process. Within the context of the OSTI, the NRC staff reviewed the licensee's corrective action program and subordinate procedures, audit reports developed by NNECO's Oversight organization, the licensee's Independent Review Team Report on the Effectiveness of Corrective Actions, the NRC IP 40500 inspection team report, and outstanding corrective action items.
The NRC also obtained insights into the effectiveness of the corrective action program through its assessment of the licensee's implementation of the ECP and its efforts to establish an SCWE. Integral to the staff's evaluation of Millstone SCWE activities was its assessment of the licensee's programs for resolving safety issues raised in the line organization. Staff observations and interviews showed that managers and supervisors encouraged employees to identify problems. These observations and findings were consistent with those of Little Harbor Consultants, Inc. (LHC), the third-party organization specified by the NRC Order to oversee the licensee's implementation of the SCWE program. LHC also performed an assessment of NNECO's corrective action program and found the program and its implementation acceptable.
The foregoing inspections found that an appropriately low threshold exists at Millstone Unit 3 for the identification of conditions adverse to quality. NNECO management has effectively communicated new standards to the working staff so that problems are being identified and referred to the corrective action program for resolution.
Staff inspections have determined that the assessment and root cause evaluation process is functioning adequately to support restart of Unit 3, but the process is still maturing and warrants continued NNECO management oversight. The staff found that the licensee was effectively assessing root causes and assigning the proper corrective actions. However, in a few instances, the NRC staff found that the licensee did not identify associated proximal causes and, in one case, the licensee missed the actual root cause and failed to take effective corrective actions to prevent air binding of the boric acid transfer pumps.
The licensee staff responsible for managing the corrective action program have demonstrated that they can successfully evaluate and prepare appropriate corrective action plans. The NRC staff noted problems with a lack of thoroughness in corrective actions in the early stages of recovery during 1996 and early 1997. As the effects of the recovery process began to positively affect the work practices of the licensee's staff, the NRC found that assigned corrective actions were, with some exceptions, complete and appropriately addressed the problem.
Though the staff's observations indicate that the licensee's corrective action program is adequate to support restart of Unit 3, the effectiveness of the corrective action program can be more completely assessed by evaluating long-term performance. In view of this and the licensee's historical problems in maintaining an effective corrective action program, the staff believes that it should assess the corrective action program after the plant has been in a more normal mode of operation for a period of time. This evaluation includes assessing the effectiveness with which the licensee addresses the deferred items list, which was discussed in SECY-98-090. Therefore, the staff will assess the effectiveness of the corrective action program in about 1 year by performing another team inspection using IP40500.
(3) Operational Safety Team Inspection
The objective of the OSTI was to provide current information to the RAP by evaluating the readiness of staff and management programs and the adequacy of plant hardware to support restart and continued operation of Millstone Unit 3. The OSTI focused on providing assessment in the areas of management programs, independent oversight, operations, engineering, and maintenance and surveillance. The OSTI was an intensive inspection activity conducted at Millstone Unit 3 between April 13 -24, 1998. Members of the team also observed selected plant activities in the two months prior to the inspection. The 14 inspectors selected for the team represented all four regional offices, the Office of Nuclear Reactor Regulation (NRR), the Office for Analysis and Evaluation of Operational Data, and SPO. The team monitored licensee activities during plant transition between modes of operation during both normal and off-normal work hours. The OSTI represents more than 2000 person-hours of effort.
The team noted that significant progress had been made in enhancing overall station performance. In making this determination the OSTI reviewed the licensee's Fundamental Cause Assessment Team Report, the Joint Utility Management Association Report, and the Root Cause Evaluation for ACR 7007, as well as NRC's Special Inspection Report 96-201, to acquire a background knowledge of the historical problems at Millstone that resulted in the current extended shutdown. In particular, the team observed management involvement in directing plant activities, an intrusive and independent quality assurance organization, an improved corrective action program, and an effective self-assessment process.
The conduct of operations, procedure quality and adherence, and operator training were all determined to be acceptable to support plant restart. The quality of command and control was usually good and shift turnovers were comprehensive. However, the team identified two operational issues that require certain corrective actions before plant restart. The first issue concerned operator performance during the initial plant heatup. The licensee identified several causes for operator performance weaknesses and the OSTI observed several effective short-term corrective actions. The OSTI did not observe similar weaknesses in operator performance during the subsequent plant evolutions it observed. The staff is currently reviewing the licensee's pertinent corrective actions.
The second issue concerned the administration and implementation of certain aspects of the valve and system alignment program. Problems included two valves not properly aligned in accordance with the valve alignment procedure, errors in documentation of valve and breaker alignments, and deficiencies in the locked valve program. The team determined that certain actions to correct these deficiencies were necessary before plant restart. The licensee's corrective actions are currently being reviewed by the NRC staff.
The team identified good performance in the engineering and technical support areas. These organizations routinely provided timely and technically sound support to resolve emergent plant issues. The plant design change program administrative controls were detailed and the design changes reviewed were properly installed. The team noted that the licensee was making improvements in several engineering-administered programs, such as setpoint control, operational experience reviews, and vendor manuals.
The teams' findings in the areas of maintenance and surveillance were generally positive. Plant material condition was
good and deferred work items had been properly evaluated and prioritized. The team observed good work practices by the
maintenance staff, quality procedures, and strong management oversight of maintenance activities.
The overall conclusion of the OSTI is that the Millstone staff and management are suitable and plant equipment, programs, and processes are in place to support restart and continued operation of Unit 3. There are still several corrective actions from issues identified during the OSTI where the staff must verify completion prior to restart. Additionally, the licensee still has to complete a number of its own identified Mode 2 issues (currently about 75) that were reviewed by the OSTI .
(4) Work Planning and Controls
Work planning and controls are areas in which the licensee has shown weaknesses in the past. The ability to plan, control, and complete work is an important element in achieving timely and effective corrective actions. Additionally, effective work planning and controls are prerequisites for reducing and managing work backlogs.
The NRC staff reviewed the licensee's revised automated work order (AWO) process, which was implemented site-wide in 1997. The AWO process is an integral part of the work planning and control system. It is instrumental in establishing the scope of the work, providing the appropriate procedures, and establishing the tagging boundaries. This process has resulted in a noticeable improvement over previous processes at Millstone.
Substantial progress has been made in reducing the backlog of preventive maintenance work orders to the point that none are overdue. There has been continued progress in completing power ascension-related AWOs and reducing the corrective maintenance backlog. Although the backlog of work is still a challenge, the licensee is close to reaching its restart goal of less that 500 online AWOs. As a result of the licensee's low threshold for identifying problems, the future outage AWO backlog has continued to grow (approximately 550 items). The licensee has reviewed these AWOs in detail and concluded that none are required for startup.
The OSTI included an assessment of the adequacy of the licensee's work planning and controls. The principal focus of this assessment was to evaluate the adequacy of the licensee's program as it relates to ensuring the safety performance of personnel and plant equipment. The team found that the licensee's ability to accurately schedule and complete work continues to need improvement. On average, 60 percent of work orders on the 3-day look-ahead schedule were started, and 54 percent were completed on schedule. The licensee's self-assessment has resulted in corrective actions, such as instituting a 12-week rolling work schedule and appointing an experienced individual as a permanent Work Control and Outage Manager. The use of the 12-week rolling schedule should help improve planning and scheduling performance. These corrective actions are currently in progress.
The team did not find examples in which the noted inefficiency in planning and scheduling resulted in degradation of safety system performance. In fact, it was concluded that the material condition of safety-related systems was good. The team determined that the licensee had adequate controls in place to ensure that engineering work backlogs were properly screened for safety significance, and the work needed to support a safe plant restart had been identified. The team also did not observe any nonconservative decisions by plant managers for the purpose of meeting plant schedules.
The staff concluded that the work planning and scheduling process is adequate to support plant restart. It was determined that the noted inefficiencies in the work planning and scheduling process were not adversely affecting plant safety and that the root causes for the performance weaknesses had been identified by the licensee and program improvements were being implemented.
A recent issue occurred that indicates the need for the licensee to continue to emphasize the importance of work planning and control, particularly as the licensee transitions to normal operations. This issue involved the licensee's efforts to repack a leaking valve in the reactor coolant system. The licensee demonstrated appropriate decision-making in depressurizing the reactor coolant system to repair the 1½-inch loop equalization valve, even though the leakage was well within allowable limits. However, the maintenance and operations departments did not respond well to several precursors that indicated there was leakage past the valve's backseat and that there was separation between the valve stem and its disc. This situation led the licensee to treat the repair effort as a simple valve repacking and to not fully establish contingencies for repacking the nonisolable valve. The licensee's response to the issue, including a site-wide work standown, is an example of senior management's continued emphasis on assuring safe operations.
(5) Procedure Upgrade Program
The quality of and adherence to procedures had been a chronic problem at the Millstone site for all three units. The need to improve procedure quality was an element in the Improving Station Performance program (circa 1995) and the earlier Performance Enhancement Program (circa 1992). In response to NRC concerns, the licensee developed the Procedure Upgrade Program (PUP) in 1992 to improve station procedure quality on a site-wide basis. The licensee's PUP commitment was included in a letter to the NRC dated June 4, 1992, in which the licensee described its overall Performance Enhancement Program. Because of the licensee's longstanding commitment to complete the PUP and address past procedure adherence and quality problems, the satisfactory performance of the licensee's PUP was identified as a separate issue in the NRC RAP.
Although various procedure improvement programs had been ongoing since the late 1980s, the licensee committed to improve procedures to reflect industry standards for format and to standardize procedures at all three units in the PUP. As a result of this process, the station document control administrative procedures were developed to apply to the three units. Recent inspections by the NRC have verified that most of the commitments made in the letter of June 4, 1992, were met. As of May 1998, the Unit 3 PUP has been essentially completed except for two procedures.
Additional insights regarding procedure quality have been obtained through three NRC ICAVP inspections of the licensee's CMP. The three inspections reviewed a combined total of 97 licensee technical procedures, and only minor problems were identified. In addition, the OSTI reviewed the adequacy and implementation of procedures during licensee operations in Modes 4 and 3 (plant non-critical heatup). The OSTI concluded that the quality of operating procedures was good. With few exceptions, such as the reactor coolant system surveillance procedure and the conduct of operations procedure, the procedures reviewed by the OSTI were technically accurate and provided an appropriate level of detail. Also, recent licensee performance indicators developed by both the licensee's nuclear oversight and its line organizations indicate acceptable performance in both the areas of procedure performance and the technical adequacy of the procedures.
These NRC inspections and the licensee's own evaluations indicate that Unit 3 procedures are acceptable for restart. As previously noted, the NRC's inclusion of the PUP as a separate issue in the RAP was to assess the licensee's implementation of this longstanding program. In addition, the staff has also had many opportunities to assess the technical adequacy and quality of the procedures, as well as the licensee's adherence to procedures. Although there have been some minor problems noted, such as those found during the OSTI and ICAVP inspections, there has been a substantial improvement over the past 2 years in this area. The staff considers the current condition and use of procedures to be adequate to support restart of Unit 3.
(6) Significant Items List
As part of its execution of IMC 0350, "Staff Guidelines for Restart Approval," the staff developed a RAP. The RAP was developed to include all expected NRC actions required before the NRC-approved plant restart. The staff developed a RAP for each Millstone unit to incorporate the appropriate aspects of IMC 0350 and to address site-specific and unit-specific issues. One of the elements of the RAP is the significant items list (SIL). The SIL contains items that the NRC is using to audit and evaluate licensee programs and other significant safety and regulatory issues. The licensee provides a package to the staff when it has completed actions associated with a particular item on the SIL. The staff then reviews the package and performs any needed inspection activities before it closes out the issue.
The inspection and closure of the items on the SIL is about 98 percent complete. The RAP had identified 216 closure packages for the 83 items on the SIL and the licensee has submitted all 216 packages for NRC's review. The staff has closed 210 packages as of May 18, 1998. The licensee is providing additional information on two SIL packages related to the master equipment plant list and emergency preparedness (post-accident sampling system).
Early in the process, the quality of the SIL packages submitted by the licensee was sometimes insufficient to support the staff's review. However, the staff has observed substantial improvement in the past year, and has found the information provided by the licensee to be comprehensive and of good quality. The staff has substantially completed its efforts to review and close the 83 items on the SIL. The SIL items constitute the majority of the programmatic, technical, and regulatory issues included in the Unit 3 RAP.
(7) Licensing Issues
On the basis of the licensee's review of existing license amendment requests and an in-depth review of the Millstone Unit 3 TSs, the licensee has identified a number of licensing issues which required resolution before restart. By letter dated October 6, 1997, the licensee identified the known license amendment requests that were associated with Mode 2 and those associated with Mode 4. The licensee further updated the list by letters dated March 4 and 6, 1998.
As of May 27, 1998, the NRC had received 31 proposed TS changes, which the licensee initially determined were needed before restart. Of the 31 proposed TS changes, 24 have been issued, 5 have been withdrawn, 1 has been determined not to be needed before restart, and 1 is being reviewed by the NRC staff. The remaining issue involves TS 3/4.4.4, "Relief Valves," and would ensure that the power-operated relief valves will be capable of automatic cycling as well as manual cycling when in the TS action statements that allow indefinite continued operation. The staff is reviewing the licensee's submittal and supplemental information.
In addition, 7 of the 10 other licensing issues that had to be resolved before restart have been completed. Of the remaining three issues, two are under staff review and involve (1) the erosion of cement from the underlying porous concrete drainage system at Millstone Unit 3 and (2) recent changes to the Millstone station emergency plan. The remaining issue involves the use of alternative design provisions to the American Society of Mechanical Engineers Code related to the design of relief valve discharge piping. The staff has reviewed the licensee's May 20, 1998, submittal and requested that the licensee provide additional information to support its request.
The NRC has also received four license amendment requests that involve unreviewed safety questions (USQs). The licensee has also indicated that there is a potential for two additional amendments involving USQs to emerge. The licensee has indicated that the systems involved for all 6 existing or potential USQ issues are or will be determined to be operable and the amendments will not be required prior to restart. This approach is consistent with current guidance contained in Revision 1 to Generic Letter 91-18 regarding degraded and nonconforming conditions. Additionally, the staff intends to review the operability determinations associated with any USQs prior to restart of Unit 3.
With respect to two of the four USQ-related license amendment requests under review (associated with the recirculation spray system and the engineered safety features building sump pumping subsystem), the Citizens Regulatory Commission petitioned the NRC for leave to intervene in the proceeding on April 23 and May 21, 1998, respectively. Since the licensee has made the determination that the systems involved are or will be operable, approval of these amendment requests is not required to support Millstone Unit 3 restart.
(8) Enforcement
From January 1996 to December 1997, 51 potential escalated enforcement items (EEIs) (37 in 1996 and 14 in 1997) were identified at Millstone Unit 3 as a result of NRC inspection activities. The EEIs identified during 1996 were discussed with the licensee at a December 1996 enforcement conference. Subsequently, and in conjunction with enforcement actions against Units 1 and 2, a $2.1 million civil penalty was issued to NNECO on December 10, 1997.
Of the 37 EEIs identified in 1996, 33 were included in the $2.1 million civil penalty. Of the remaining four, two were determined not to warrant a civil penalty, one was granted enforcement discretion, and one was not a violation. Of the 14 EEIs issued in 1997, 8 were determined to be Severity Level IV violations, 1 was cited as a Severity Level III violation with a civil penalty, 3 were issued enforcement discretion notices, and 2 are yet to be dispositioned.
Thus far, for reports issued in 1998, one Severity Level III violation without a civil penalty was issued concerning the inoperability of the post accident sampling system. Recent inspection reports are currently under review and have issues under consideration for enforcement.
The corrective actions implemented by the licensee for the majority of the enforcement items issued in 1996-1998 have been evaluated by the staff and have been determined to be adequate. Prior to restart, the corrective actions for those issues that have not yet been assessed by the staff will be reviewed for both the adequacy of the corrective actions and any potential impact on the licensee's capability to safely conduct a plant restart and sustained power operations.
CONCLUSION
The staff concludes that for the issues discussed, the licensee has made appropriate improvements and has established adequate programs needed to support restart of Unit 3. The licensee's efforts to reestablish its licensing and design bases (LB/DB) and implement programs to maintain the LB/DB have been effective. An adequate corrective action program has been established, characterized by a low threshold for identification of issues, effective root cause analyses, and effective implementation of corrective actions. The recently completed OSTI indicates that the licensee has demonstrated its readiness to conduct power operations.
In addition to the staff's recommendations related to the areas covered in this paper, no issues have emerged since the Commission meeting on May 1, 1998, that would call into question the staff's recommendations related to the three key areas that were the focus of that meeting. Accordingly, the staff has substantially completed its assessment of the elements contained in the Millstone Unit 3 RAP, including evaluation of the licensee's actions in response to the two Orders issued in 1996. The staff concludes that the licensee has taken appropriate corrective actions to support restart of Millstone Unit 3.
RECOMMENDATION
That the Commission agree with the staff's conclusion that the licensee has
taken appropriate corrective actions to support restart of Millstone Unit 3.
The staff recommends that the Commission provide its restart authorization for
Millstone Unit 3. As described in the May 19, 1998, SRM, should the Commission
authorize restart, this would entail changing the watch list status of Unit
3 from Category 3 to Category 2 and designate the Executive Director for Operations
(EDO) as the senior manager responsible for (1) verifying that the appropriate
aspects of IMC 0350 are complete and (2) approving commencement of actions to
restart Unit 3. All remaining issues requiring NRC verification before Unit
3 enters Mode 2 will be completed before the EDO gives approval for restart
of Unit 3.
| /S/ L. Joseph Callan Executive Director for Operations |
| CONTACT: | William D. Travers, SPO/NRR 301-415-1200 |
| Attachments: |
In the Fall of 1995, the NRC determined that refueling practices and operation of the Spent Fuel Pool Cooling systems at Unit 1 were not consistent with the Final Safety Analysis Report (FSAR). In February 1996, the licensee issued Adverse Condition Report (ACR) 7007 - Event Response Team Report that described in detail the causes for numerous inaccuracies contained in Millstone Unit 1's FSAR. ACR 7007 documented a programmatic breakdown in the configuration management controls at Unit 1. ACR 7007 acknowledged that the potential existed for similar configuration management problems at Unit 3.
In March and April 1996, the NRC conducted a special inspection at Unit 3 that identified design and other deficiencies similar to those reported in ACR 7007. On March 30, 1996,
Unit 3 was shut down when the containment isolation valves for the Auxiliary Feedwater System turbine-driven pump were declared inoperable because the valves were not in compliance with NRC requirements. Shortly thereafter, the licensee discovered that the stress calculations for the containment recirculation spray system (RSS) piping and supports had not adequately addressed design temperature conditions resulting in Unit 3 being operated outside its design basis. Both of these deficiencies had existed since initial operation of Unit 3.
The licensee's own findings and NRC inspections indicated significant design control deficiencies, and degraded and nonconforming conditions existed at Unit 3. Three major types of design control problems had been identified that included (1) errors in the licensing and design bases documentation; (2) failures to translate design bases into procedures and hardware; and (3) inadequate engineering and modifications.
To recover the design and licensing basis of Unit 3, the licensee implemented its Configuration Management Plan (CMP). The scope of the CMP included those systems that it had categorized to meet the requirements of the Maintenance Rule (10 CFR 50.65) as either Group 1 (safety-related and risk significant) or Group 2 (safety-related or risk significant). Included within the licensee's CMP were reviews of the design and licensing bases for the Maintenance Rule systems and reviews of topical program areas (e.g., fire protection, high energy line break, and environmental qualification).
By July 1996, the licensee had identified 1187 design or licensing bases discrepancies, 597 of which it determined were required to be completed before restart of Unit 3. (During the April 1998, NRC-sponsored Regulatory Information Conference, the licensee indicated that the CMP had resulted in 491 changes to the FSAR, 195 procedure changes, 28 changes to Technical Specifications (TS), 138 drawing changes, 74 calculation changes, 223 modifications, and 141 Licensee Event Reports (LERs). Further the licensee indicated at the April 1998, Regulatory Information Conference, that it had expended approximately 700,000 person-hours of effort implementing its CMP at Unit 3.)
On August 14, 1996, the NRC issued a Confirmatory Order directing the licensee to contract with a third-party to conduct an Independent Corrective Action Verification Program (ICAVP) at all three Millstone units to verify the adequacy of its efforts to reestablish adequate design bases and implement effective design controls. The ICAVP was intended to provide additional assurance, prior to unit restart, that the licensee has identified and corrected existing problems in the design and configuration control processes.
The Order required that the ICAVP be performed and completed to the satisfaction of the NRC by an independent contractor approved by the NRC. Sargent & Lundy (S&L) was the contractor approved by the NRC to conduct the ICAVP at Unit 3. The Order required S&L to submit for NRC approval a plan for conducting the ICAVP. The plan was required to include
(1) provisions for an in-depth review of the design and design bases of selected systems; (2) the risk- and safety-based criteria for system selection; (3) an audit plan that provided assurance that the results of the licensee's problem identification and corrective action programs for the selected systems were representative of and consistent with that of other systems; (4) procedures and schedules for reporting findings to both the NRC and the licensee in parallel; and (5) procedures to comment on the licensee's resolution of the ICAVP findings and recommendations.
The Order defined the ICAVP scope as encompassing all modifications made to the selected systems since initial licensing, and included (1) review of engineering design and configuration control processes; (2) verification of current, as-modified conditions against design and licensing basis documentation; (3) verification that the design and licensing bases requirements were translated into operating, maintenance, and test procedures; (4) verification of system performance through review of specific test records and/or observation of selected testing; and (5) review of proposed and implemented corrective actions for licensee-identified design deficiencies.
The licensee was required, by the Order, to provide a written response to the NRC that addresses ICAVP findings and recommendations. The Order requires that the licensee's written replies to the ICAVP findings and recommendations include a statement of agreement or disagreement with the reason(s) for each ICAVP finding or recommendation, the status of implementation of corrective actions, and that subsequent written replies shall be made until all corrective actions have been implemented. The Order indicated that the replies were to be sent to the Regional Administrator, Region I, and to the Director, Office of Nuclear Reactor Regulation (NRR). With the creation of the Special Projects Office (SPO) within NRR, the replies will be sent to the Director of SPO and to the Director of NRR.
The purpose of the ICAVP, as stated in the August 14, 1996, Order, was to confirm that the plant's physical and functional characteristics were in conformance with its licensing and design bases. The ICAVP provided independent verification, beyond the licensee's quality assurance and management oversight, that the licensee's corrective actions had identified and satisfactorily resolved existing nonconformances with the design and licensing bases; documented and utilized the licensing and design bases to resolve nonconformances; and established programs, processes, and procedures for effective configuration management in the future.
Communication protocols were necessary to ensure the independence of S&L during performance of the ICAVP. The protocol required NRC to monitor all but administrative interactions between S&L and the licensee. To minimize the potential for adversely impacting the independence of S&L's technical reviewers, the protocol limited direct interaction between S&L's technical reviewers and the licensee's staff. Further, the protocol required that most of the communication between S&L and the licensee be in writing. In order to provide assurance to the public that S&L was maintaining its independence, the Connecticut Nuclear Energy Advisory Council (NEAC), was invited to observe the interactions between S&L and the licensee. During the conduct of the ICAVP, the NEAC has observed many of these interactions during meetings and telephone conferences. These, and other communication protocols, were incorporated into the ICAVP Audit Plan and implementing procedures prepared by S&L and approved by the NRC to maintain the independence of S&L during the ICAVP at Unit 3.
Imposition of the communication protocol made the exchange of technical information time consuming and inefficient. In many instances, S&L provided supplemental written requests for information in order for the licensee to understand the scope of the information requested, to clarify the question raised by S&L, or to request the licensee to clarify its responses.
To provide the level of assurance necessary to support a unit restart decision, the ICAVP was structured in a three tier format to validate many aspects of configuration management. In Tier 1, 15 systems were selected from the 88 Maintenance Rule (10 CFR 50.65) Group 1 and Group 2 systems to test the thoroughness of the licensee's reviews at identifying potential nonconformance with the design and licensing bases. S&L was tasked to conduct a thorough multidisciplined review of all design changes made to these systems after the issuance of the operating license, the remaining part of the original system configuration, and all operational aspects of these systems. Some of the design features included in the Tier 1 review for each system were system fluid flow and heat transfer characteristics, system capability to function assuming a single failure, piping and pipe hangers, equipment anchorages and supports, electrical power requirements, instrumentation and control, seismic design and electrical equipment environmental qualification. Also included in the Tier 1 scope were maintenance, surveillance testing, and training to insure that design requirements were appropriately translated into the applicable procedures. As a part of the Tier 1 effort, S&L was also tasked to review the licensee's corrective actions for previously identified design-related deficiencies for the selected systems, including the deficiencies discovered during the implementation of the licensee's corrective action programs. In order to provide a broader perspective on the adequacy of the licensee's corrective actions, S&L also reviewed a sample of corrective actions selected by NRC, for licensee-identified problems in systems outside of the 15 system Tier 1 ICAVP scope. The scope of the corrective action implementation reviews was a verification that the corrective actions were appropriate and that the documentation necessary to implement the corrective action (i.e., modification packages, revised calculations, procedure change requests, etc.) were prepared and appropriate to effectively resolve the issue. The type of multidisciplined, multifaceted review, performed in Tier 1, is referred to as a "vertical slice" design review because the review encompasses many aspects of system design necessary for a selected system to perform its specified function.
Tier 2 of the ICAVP was developed to review configuration management from a different perspective than the "vertical slice" Tier 1 review described above. The basis or starting point for the Tier 2 review was the accidents and transients analyzed in the FSAR. The purpose of the Tier 2 review was to validate the critical design characteristics (CDCs) of accident mitigation systems that formed the bases for the inputs to the accident and transient analyses contained in the FSAR. The Tier 2 review provided an additional level of confidence that plant configuration had been appropriately maintained and that changes to plant configuration affecting CDCs of accident mitigation systems had been properly translated in the accident analyses. Tier 2 included a validation of CDCs for the 22 Maintenance Rule Group 1 or Group 2 accident mitigation systems described in the FSAR. The validation of CDCs was performed by reviewing test and surveillance data, design calculations, instrument setpoints and setpoint analyses, and plant abnormal and emergency operating procedures.
Tier 3 of the ICAVP required the review of a sample of changes made to Unit 3's configuration since issuance of the operating license through processes other than the design change process. These included processes such as calculation changes, proposed Technical Specification (TS) changes, temporary modifications, drawing changes, procedure changes, set point change requests, and replacement item evaluations. Tier 3 provided insights into the effectiveness of the various change processes in controlling the plant's configuration over the lifetime of the plant.
In developing the process for implementing the ICAVP, the NRC established a threshold for handling findings identified by S&L. This threshold was defined in SECY 97-003, "Millstone Restart Review Process," dated January 3, 1997, as a "defect" that represents any condition resulting in the plant being outside its current licensing bases. In addition to a focus on the identification of any defects, S&L and the NRC evaluated deficiencies identified by S&L that did not meet the definition of a defect (such as a calculation error that does not place the plant outside the licensing bases), to determine if any programmatic trends existed. A very low threshold was established by the NRC for issues that S&L was required to document during the ICAVP.
S&L documented its ICAVP findings in discrepancy reports (DRs). The DR process allowed any of S&L's reviewers to initiate a DR after they identified that a potential for a discrepant condition existed. After being initiated, if S&L determined, based on further review of the information available that a discrepant condition did not exist, the DR was issued as an Invalid DR. As an Invalid DR, no response was expected from the licensee and the DR was considered closed by S&L. If S&L determined, based on a review of the information available at the time, that there existed a discrepant condition, the DR was issued as a Valid DR. All DRs (Valid and Invalid) were issued to the NRC and the licensee concurrently, with a copy provided to the NEAC. To allow public access to the DRs, S&L posted information related to the DRs, including the licensee's responses, to a website on the Internet 2 business days after the DR was issued.
When a Valid DR was issued, S&L assigned the DR an ICAVP significance level as a measure of the DR's importance to the design and licensing basis of the unit. The NRC established four levels of ICAVP significance for identified programmatic, procedural, or design issues, or editorial inconsistencies. The most significant DRs are considered Level 1 and the least significant are considered Level 4. Level 1 DRs are discrepant conditions that identify instances when the system does not meet its licensing or design bases and could not perform its intended function, i.e., has the potential to simultaneously affect redundant trains. Level 2 DRs are discrepant conditions that identify instances when a single train of a redundant system does not meet its licensing or design bases and that the train could not perform its intended function. Level 3 DRs are discrepant conditions that identify instances when a system does not meet its licensing or design bases, but the system is capable of performing its intended function. Level 4 DRs are discrepant conditions that identify instances when the system meets its licensing and design bases, however, there existed minor errors such as minor arithmetic errors that do not significantly affect the results of the calculation or are inconsistencies between documents of an editorial nature.
The licensee was required to respond to all Valid DRs. S&L reviewed the licensee's response, including any proposed corrective actions. While being reviewed by S&L, the DRs were considered In process. During its review of the licensee's response, S&L could disposition the DR in four ways as described below -
1. Followup: S&L requested additional information from the licensee to resolve any disagreements or to clarify the proposed corrective action.
2. Unresolved: When S&L and the licensee can not reach consensus on the ICAVP significance level, the adequacy of the proposed corrective actions, whether the issue was discrepant, or whether the issue was previously identified by the licensee. Unresolved DRs were forwarded to the NRC for review and final resolution.
3. Pending: Both S&L and the licensee agree that a new discrepant condition existed, that the assigned ICAVP Significance Level was appropriate, that the proposed corrective actions were adequate to resolve the discrepant condition, and that the corrective actions were required to be completed before restart, but the corrective actions to reestablish the design or licensing basis had not been completed at the time of S&L's review.
4. Closed: A DR was closed after S&L had completed its reviews of the licensee response and supporting information, and determined that the response was adequate to address the issues discussed in the DR. Based on S&L's reviews, Closed DRs fell into three categories -
a. Confirmed DRs - both S&L and the licensee agreed that a new discrepant condition existed, that the assigned ICAVP significance level was appropriate, that the proposed corrective actions were adequate to resolve the issue, and that the corrective actions required to reestablish the design or licensing basis had been implemented.
b. Nondiscrepant DRs - S&L agreed with the licensee that the issue described in the DR was not a discrepant condition based on its review of the additional information provided by the licensee.
c. Previously Identified DRs - S&L agreed that the licensee had previously identified the issue based on its review of the additional information provided by the licensee.
Confirmed Level 3 or higher (Level 1 or 2) DRs satisfy the definition of a "defect" as stated in SECY 97-003, but they may contain several issues, some of which may individually be Significance Level 4 in that the individual issue did not call into question conformance with the design or licensing bases. The corrective actions required to restore or reestablish compliance with design or licensing bases requirements for discrepancies identified in all Confirmed Level 3 and higher DRs were required to be completed before restart of the associated unit.
Confirmed Level 4 DRs were below the threshold of a "defect." These DRs generally represented enhancements to procedures or processes, or corrected minor editorial or calculational errors that did not adversely affect the design or licensing bases of the unit. The type of issues documented in Level 4 DRs would generally not be included in NRC inspection reports. However, during the ICAVP, a low threshold for documenting discrepant conditions was established to provide a method for identifying adverse programmatic trends. While S&L reviewed the licensee's response to individual Level 4 DRs to assess the licensee's response and proposed corrective actions, S&L also screened and sorted Confirmed Level 4 DRs to identify programmatic trends that required corrective action before restart of the associated unit.
S&L issued an interim report on May 8, 1998, based on the status of the ICAVP as of April 22, 1998. A final report is expected to be issued about May 30, 1998, documenting S&L's efforts, findings, recommendations, and conclusions regarding the effectiveness of the licensee's processes to reestablish the design and licensing basis for Millstone Unit 3. A summary of S&L's findings is provided in Section 6.0 below.
The August 14, 1996, Confirmatory Order, required that the ICAVP be conducted by an independent verification team whose selection must be approved by the NRC. The licensee submitted information regarding the selection of S&L as the contractor for the Unit 3 ICAVP on December 18, 1996. Additions and corrections to the proposal were submitted on January 8, February 21, and March 26, 1997. On February 5, 1997, the staff held a public meeting with the licensee to discuss the contractor selection process and the staff met with interested members of the public on evening of February 5, 1997, to obtain comments regarding the proposed contractor.
Members of the public expressed concern about the process used to select and approve S&L. The principal concerns related to the potential for bias by a contractor that derives a substantial portion of its income through work in the commercial nuclear power industry and was selected and paid for by the licensee. The staff included checks and balances in the ICAVP contractor selection and implementation processes to assist in ensuring independence. In conducting the organizational review, the staff recognized that a threshold existed for both technical and financial interactions above which the independence of the contractor could not be assured. In making the determination, the staff balanced the need to ensure adequate financial independence with the need to ensure that the contractor had the necessary skills and experience to effectively conduct the ICAVP.
The staff conducted a review of the information submitted by the licensee regarding the selection of S&L, to ensure that S&L was technically and financially independent of the licensee, and its design contractors, and technically capable of effectively performing the ICAVP. To complete this task, the staff performed the following activities -
The staff conducted interviews with each specialist during review of the ICAVP Audit Plan submitted by S&L. The interviews were conducted to confirm that the individual specialists had no financial interest in Northeast Nuclear Energy Company (NNECO) or other entities named on the operating license, the nuclear steam supply system (NSSS) vendor, or the architect-engineer (AE) for Millstone Unit 3 and to confirm that the team members had no prior technical involvement with Millstone Unit 3. As new team members were added to S&L's ICAVP team during the implementation of the ICAVP, the staff interviewed each new member and reviewed the conflict of interest statement completed by the new team member.
Regarding S&L's financial independence from the licensee, the staff found sufficient independence in that, organizationally, S&L, its subsidiaries, its Retirement Plan, and its Savings Investment Plan, did not directly own any licensee stock, bonds, or other financial instruments issued by Northeast Utilities (NU), NNECO, or other entities named on the Millstone Unit 3 operating license. In addition, each of the proposed ICAVP team members completed a written statement regarding conflict of interests that included financial interests that was reviewed by the staff. To further ensure the continued independence of S&L during the performance of the ICAVP at Millstone, the licensee stated that S&L will be restricted from performing or seeking new work at any NU facility for the duration of the ICAVP contract and that S&L will not seek work at any NU facility for 12 months following the completion of the ICAVP.
The staff determined that S&L was sufficiently independent from the design and operation of Unit 3, in that, it had not been involved in design activities that would affect its ability to perform the ICAVP, with the exception of interactions between nonseismic Category 2 systems and seismic Category 1 safety systems at Unit 3. The staff provided conditional approval, pending the receipt of sworn statements from S&L, and the licensee regarding the financial independence of S&L as the ICAVP contractor for Unit 3, in a letter to the licensee dated April 7, 1997. On August 1, 1997, the staff provided final approval of S&L as the ICAVP contractor for Unit 3 following receipt and review of the financial independence statements.
The staff reviewed and approved S&L's ICAVP Audit Plan and implementing procedures for Unit 3. The review was conducted to ensure that the plan accomplished the objectives of the August 14, 1996, Order, included sufficient scope and depth, and provided sufficient guidance and instructions to its specialists to effectively implement an assessment of the capability and effectiveness of the licensee's CMP at identifying and addressing design- and licensing-bases deficiencies. During its review, the staff verified that S&L's ICAVP Audit Plan and implementing procedures included the following attributes:
Based on the verification that the attributes listed above were satisfied, the staff, in a letter dated June 16, 1997, approved S&L's ICAVP Audit Plan and implementing procedures with the exception of the CDCs. S&L developed the CDCs after the Audit Plan was approved and submitted them for staff review and approval in a letter dated June 30, 1997. The staff completed its review and provided approval of the CDCs in a letter to S&L dated August 21, 1997. Throughout the implementation of the ICAVP, the staff reviewed and approved all of the changes made to the ICAVP Audit Plan and implementing procedures to ensure the conditions of the August 14, 1996, Order continued to be met.
SECY 97-003 stated that a minimum of four systems would be selected for the ICAVP Tier 1 review. These systems were to be selected from the 88 Unit 3 Maintenance Rule Group 1 and Group 2 systems. A minimum of two of the systems were to be selected by the NRC with the other two systems available for selection by the NEAC from a list of systems provided by the NRC.
In identifying the systems for inclusion within the ICAVP Tier 1 scope, the staff decided to take a broader definition of a system rather than using the method used by the licensee to identify Group 1 and Group 2 Maintenance Rule systems. The system definitions used by the staff were more aligned to the system functional descriptions provided in the FSAR, including the associated safety-related subsystems necessary for safety-related functions to be accomplished. The staff developed a set of attributes for evaluating the systems to identify those that would be the best candidates for ICAVP Tier 1 reviews. These attributes included -
On June 3, 1997, the staff forwarded to S&L the first group of Unit 3 ICAVP Tier 1 systems. Based on the Maintenance Rule classification, S&L was requested to review the service water system (SWS), the quench spray system (QSS), the recirculation spray system (RSS), and the reactor water storage tank (RWST). The staff considered these four systems to be the first "two" systems since it considered QSS, including the RWST, and RSS as one system (designated RSS) because they function in conjunction to remove heat from containment.
Consistent with SECY 97-003, NEAC was given the opportunity to select the remaining Unit 3 ICAVP Tier 1 systems. In Early July 1997, the NRC provided NEAC with a list of systems from which it could choose the remaining systems, using the method of its choice, for S&L to include within the ICAVP Tier 1 reviews. The list contained 24 Maintenance Rule Group 1 or Group 2 systems that when combined based on functional requirements, resulted in nine system groups that the NEAC could select.
On July 17, 1997, the licensee notified the NRC that the problem identification phase of its CMP was completed for the Maintenance Rule Group 1 and Group 2 systems. On that evening, the NEAC selected the last systems. The NEAC selected the Emergency Diesel Generator (EDG) and; the Auxiliary Building Heating, Ventilation, and Air Conditioning (HVAC) and Supplemental Leakage Collection and Release (SLCRS) system. These "two" systems included 11 Maintenance Rule Group 1 or Group 2 systems. A listing of the four system groups that encompasses 15 Maintenance Rule Group 1 or Group 2 systems is provided in Section 6.1.
To ensure that the ICAVP was being implemented to the satisfaction of the staff, as required by the August 14, 1996, Order, the staff provided instructions to S&L regarding the scope and depth of the ICAVP during meetings, teleconferences, through the review and approval of its audit plan and implementing procedures, and through the review and approval of changes to the Audit Plan and implementing procedures. The staff also reviewed and approved the S&L staff assigned to conduct the ICAVP reviews.
To assess the effectiveness of S&L's implementation of the ICAVP, the staff conducted a number of multidisciplined inspections, including inspections similar to the three tiers employed by S&L during the ICAVP. Details regarding the inspection plan can be found in SECY 97-003. The inspection plan included reviews of S&L's implementation of the Unit 3 ICAVP Audit Plan and implementing procedures, a design and licensing basis inspection of portions of the ICAVP Tier 1 systems that S&L reviewed (Tier 1 In-Scope), a design and licensing basis inspection of portions of one system that was not included in the ICAVP scope (Tier 1 Out-of-Scope), an inspection of the CDCs associated with two accident scenarios from the FSAR (Tier 2), an inspection of the design change processes (Tier 3), and an inspection of the implementation of corrective actions for issues identified during the CMP, the ICAVP, and NRC inspections. The implementation inspection, and the Tier 1 In-Scope, Tier 2, and Tier 3 inspections directly assessed S&L's implementation of the Unit 3 ICAVP Audit Plan, and implementing procedures by either directly observing S&L's activities or comparing the results of the NRC's inspections with the findings made by S&L. The results of these inspections are provided in Section 7.0.
During the ICAVP, the NRC was required to monitor all but administrative interactions between the licensee and S&L. To facilitate the communication and to reduce the inefficiency inherent with the requirement to monitor the interactions between the licensee and S&L, the staff made sure it was available when necessary to support these interactions, including attending frequent meetings at the site and monitoring frequent teleconferences. In addition, the NRC maintained a full time presence onsite (NRC ICAVP Site Coordinator). The NRC ICAVP Site Coordinator was responsible for ensuring the independence of S&L during the ICAVP by monitoring the interactions between the licensee's staff and S&L's onsite organization that conducted walkdowns in the plant; facilitating and monitoring telephone conference between the licensee and S&L; coordinating and monitoring meetings between S&L, the licensee, the NRC, and the NEAC; participating in inspections of both the licensee's and S&L's efforts; and maintaining a general awareness of the ongoing efforts and results of the ICAVP, CMP, and NRC inspections.
Throughout the ICAVP, the staff reviewed the DRs issued by S&L to identify issues that required additional NRC followup or that potentially impacted the design or licensing basis of the unit, determine the need to increase the scope of the ICAVP, verify that the DRs were properly classified and dispositioned, assess the thoroughness of S&L's review of the licensee's response, identify programmatic trends, and measure the effectiveness of the CMP. The DRs were reviewed and inspected by the staff using the steps outlined below:
During the review of the DRs, the SPO staff identified concerns with S&L's classification of a number of DRs. Shortly after the development of the ICAVP Significance Levels in July 1997, the SPO staff raised concerns with the Significance Levels assigned to a number of DRs. The staff requested S&L to review the DRs issued to date and revise the levels appropriately. Also, the SPO staff identified a number of DRs that S&L initially issued as Invalid based on them being minor editorial errors that the staff directed S&L to reissue to the licensee as Valid Level 4 DRs.
In assessing whether an issue could be deferred until after restart, the staff determined that the corrective actions required to restore or reestablish the design or licensing bases of the unit for all Level 3 and higher Confirmed or Pending DRs were required to be completed before the unit could restart. Since most of the issues identified in Level 4 DRs represent enhancements to procedures or processes, or corrected minor editorial or arithmetic errors that did not impact the design or licensing bases, the corrective action for Confirmed Level 4 DRs, and those corrective actions for Level 3 and higher Confirmed DRs that were not required to restore or reestablish the design or licensing bases, were determined by the staff to be deferrable till after restart. However, the staff recognized the importance of ensuring that the licensee completes the corrective actions for all of the issues identified during the ICAVP in a reasonable period. For the corrective actions associated with the ICAVP, the licensee committed to the following -
Based on its review of the licensee's implementing procedures for determining which corrective actions associated with Confirmed DRs could be deferred, its review and inspection of the DRs issued by S&L, and the licensee's commitments, the staff determined that the commitments made by the licensee regarding the closure of Confirmed DRs was reasonable.
3.6Assessment Method for Determining ICAVP Scope Increase
In response to a finding by the NRC's Office of the Inspector General, and concerns expressed by the NEAC and other interested members of the public, the staff defined four levels of significance that were used during the ICAVP to classify DRs. In addition to the four significance levels, the staff developed likely or potential NRC actions corresponding to each level. The public had asked that the staff develop and provide specific, predetermined NRC actions that were automatically triggered by ICAVP findings. However, the complexity inherent in detailed licensing and design reviews does not lend itself to the establishment of automatic thresholds to trigger the expansion of the ICAVP scope.
The staff provided the licensee with its discussions regarding the expansion of ICAVP scope in a letter dated January 30, 1998. In summary, this letter indicated that (1) if there was a Confirmed Level 1 finding, the NRC would likely increase the scope of the ICAVP by the selection of an additional system(s) for review; (2) if there was a Confirmed Level 2 finding, the NRC would likely expand the ICAVP scope to evaluate similar nonconformance issues in other systems; (3) if there were Confirmed Level 3 findings, the ICAVP scope could be expanded to evaluate similar issues in other systems if the staff determined that the licensee's corrective actions
were ineffective or that adverse trends were identified when multiple Level 3 findings were considered and the licensee had not implemented effective corrective actions to address the adverse trend; and (4) for Confirmed Level 4 issues, if the staff determined that these DRs identified an adverse trend that raised questions with the design and licensing bases, and the licensee had not implemented effective corrective actions, the ICAVP scope would be expanded as determined appropriate by the Millstone Restart Assessment Panel.
The NEAC was invited to observe ICAVP implementation at the Millstone site as part of NRC's efforts to provide additional assurance of public participation in the oversight of the ICAVP. The State of Connecticut established the NEAC pursuant to Section 17 of Public Act 96-245. The NEAC is required to hold regular public meetings to discuss issues relating to the safety and operations of nuclear power plants, and to advise the governor, legislature, and municipalities within a 5-mile radius of the plants on these issues. Also, the NEAC is responsible to work with Federal, state, and local agencies, and the companies operating nuclear power plants to ensure public health and safety.
In meeting its responsibilities, the NEAC has invited and NRC representatives have attended, the regularly scheduled meetings of the NEAC held on October 10, 1996, February 20, 1997, June 19, 1997, July 17, 1997, November 20, 1997, and May 14 ,1998, to discuss issues relating to the conduct of the ICAVP. In addition, the NEAC designated two members as observers and named two alternates, the NRC staff has kept apprised of NRC's oversight of ICAVP activities.
In order to facilitate NEAC's observations of NRC oversight activities, the designated observers entered into a Memorandum of Understanding (MOU) with the NRC. The MOU allows the NEAC representatives to be informed on nuclear-related matters that may involve proprietary, safeguards, and predecisional inspection-related information. Additionally, the MOU details the process used if the NEAC observers becoming aware of apparent nonconformance with safety or regulatory requirements and if the NEAC observers have conclusions or views that are substantially different from those of the NRC oversight team members. The NEAC has documented their involvement and reviews of the NRC's ICAVP process, in part, in their annual reports to the legislature dated January 9, 1997 and January 29, 1998. A number of actions were taken by the NRC to support the NEAC observation of ICAVP activities that included -
In a cooperative effort on the part of the NRC staff and NEAC to ensure the independence of the ICAVP, the public was afforded the opportunity to select the last two systems for the Tier 1 assessment. A NEAC subcommittee reviewed the system groupings provided by the NRC for the random selection process. Using data provided by the licensee and the NRC, the subcommittee analyzed the risk and safety significance of the relevant systems and approved the 9 groups of systems (consisting of 24 separate systems) as reasonable candidate systems to be used to validate the licensee's CMP. At the July 1997, NEAC meeting, members of the public then randomly selected two system groups for the Unit 3 ICAVP.
The Communications Protocol, a formal element used to facilitate independence of the ICAVP, included the NEAC as a means of ensuring that they were provided with documents, notifications, and opportunities to participate in the oversight of S&L activities. As such, requests for informal working conferences by any of the organizations involved in the conduct of the ICAVP included the prior notification of the NEAC. As indicated above, NEAC observed most of these interactions.
Starting early in the process, the public showed an active interest in all regulatory activities related to plant recovery and restart. In response, the SPO took extraordinary measures to assure that to the maximum extent possible regulatory business was conducted in a manner that was open to public observation. The staff used input from local public interest groups such as the Citizens Regulatory Committee, the Citizens Awareness Network, and the NEAC to structure evening meetings that provided an opportunity for the public to interact directly with the NRC staff. The staff established and implemented the following avenues of communication that allowed the public to observe NRC activities and interact with the SPO -
The SPO staff made a concerted effort to hold the vast majority of meetings in the vicinity of the Millstone Station to make them accessible for public observation.
S&L implemented the ICAVP at Unit 3 as described in its NRC-approved ICAVP Audit Plan and implementing procedures. A summary of the ICAVP process is provided in Section 2.0 above. S&L indicated to the staff that in implementing the ICAVP at Unit 3, it had expended approximately 160,000 person-hours of effort. Included, in part, within S&L's review were approximately 1,500 calculations, 2,600 drawings (P&IDs, one-line, logic diagram, etc.), 690 procedures, 2,000 maintenance work orders, 2,520 components, and 140 modifications to the Tier 1 systems. At Unit 3 the ICAVP started on May 27, 1997, after the licensee declared that they had completed discovery on one-half of the risk and safety significant systems, and is expected to end about May 30, 1998, essentially one full year of effort. During this period S&L stated that about 100 different individuals participated as technical reviewers for S&L, with about 75 people assigned at any given period. The scope and results of S&L's Tier 1, Tier 2, Tier 3, and corrective action reviews follows.
The Tier 1 system reviews performed by S&L focused on two objectives (1) to verify the system design elements being reviewed were technically adequate and consistent with the licensing and design bases, and (2) to verify the modifications implemented after receipt of the operating license were technically adequate and that configuration control of design documents was maintained. S&L accomplished these objectives by implementing reviews that included:
S&L's review verified the technical adequacy of all parameters, including operating ranges and/or limitations contained in procedures. Additionally, all operating modes not explicitly identified in the licensing basis were reviewed to verify that the design and analysis supported operation in that mode. The scope of the modification review during Tier 1 included all major modifications (Design Change Requests - DCRs), Minor Modifications (MMODs) and all Design Change Notices (DCNs) generated to support the DCR and MMOD processes. The modification review included only the modifications to the Tier 1 systems.
S&L also conducted a physical configuration review of the Tier 1 systems. This review focused on verifying that the current as built condition of the plant matched the current design and licensing bases documents. During this review S&L also performed a physical and functional walkdown of the Tier 1 systems to verify that the as built condition conformed to the modifications and to verify the modifications had been accurately incorporated into the affected design drawings or were posted against the affected design drawings.
Also, S&L reviewed operating, maintenance, and testing procedures to verify that these procedures and associated training documents conformed to the Tier 1 systems' design and licensing bases, including post-modification testing for selected modifications made to the Tier 1 systems to verify the testing was adequate to maintain the design and licensing bases. The w15 Maintenance Rule Group 1 or Group 2 systems that were selected to be included within the scope of S&L's Tier 1 review were combined into four functional groups as outlined below:
| RSS | SWS | HVX | DGX |
|---|---|---|---|
| 1. RSS | 1. SWS | 1. Auxiliary Building HVAC | 1. EDG Engine |
| 2. QSS | 2. SLCRS | 2. EDG Fuel Oil | |
| 3. RWST | 3. EDG Room Ventilation | 3. EDG Generator | |
| 4. EDG Lube Oil | |||
| 5. EDG Starting Air | |||
| 6. EDG electrical & control | |||
| 7. Station Electrical Service - | |||
| 8. Engineered Safeguards |
Legend: RSS (Recirculation Spray System); QSS (Quench Spray System); RWST (Refueling Water Storage Tank); SWS (Service Water System); HVX (Heating and Ventilation Systems); HVAC (Heating, Ventilation, and Air Conditioning); SLCRS (Supplemental Leak Collection and Release System); EDG (Emergency Diesel Generator); DGX (EDG Systems)
The Tier 1 systems interfaced with 51 other systems. Portions of these 51 interfacing systems were included within the scope of the Tier 1 review or were reviewed to a lesser extent as necessary to ensure the functions of the Tier 1 systems could be satisfied. Descriptions of the general approaches for establishing the Tier 1 interface boundaries for mechanical, electrical, and I&C systems are provided below -
Tier 1 Systems' Mechanical Interface Boundaries
For the mechanical systems, the boundary of the ICAVP Tier 1 system reviews extended to the first isolation valve in the interfacing system and to the first structural support outside the ICAVP Tier 1 system (beyond the isolation valve). For interfaces with mechanical systems, S&L reviewed the interfacing system calculations, drawings, and procedures to the extent needed to verify that the functions required to support the ICAVP Tier 1 system were addressed in the design of the interfacing system (e.g., the HVAC system was capable of maintaining environmental conditions required for the Tier 1 system), or that the Tier 1 system was capable of performing its functions necessary to support operation of the interfacing system (e.g., heat removal from the interfacing system).
Tier 1 Systems' I&C Interface Boundaries
For indirect I&C input signals, those signals that originated in another system and input into the Tier 1 system by first passing through another system (i.e. Reactor Protection System), the scope of the Tier 1 system review included a single channel for each of the process variables. The system that the indirect signal passed through was assumed to operate as intended. Direct I&C input signals were those signals that originated in another system and input directly into the Tier 1 system without passing through another system. For direct I&C input signals, the review included the signal path from the interfacing system instrument to its input into the Tier 1 system. Both indirect and direct I&C input reviews verified that the functions required to support the Tier 1 systems were addressed in the design of the interfacing system. The Tier 1 review of output signals, those signals that originated in the Tier 1 system and output to the interfacing system, included the I&C output signals from the Tier 1 system through to the input point (usually up to the control relay; or in the case of an analog signal, up to and including the signal isolator) of the interfacing system. The reviews included the signal paths as they appeared on interfacing system P&IDs, logic diagrams, and schematics as appropriate. During these reviews, signal parameters, divisional power supplies, setpoints, ranges, and accuracies were verified by S&L. Also, setpoint and loop accuracy calculations for the affected instrumentation were reviewed for technical adequacy.
Tier 1 Systems' Electrical Interface Boundaries
In addition to the detailed Tier 1 review of the EDG, S&L reviewed, in detail, the portion of the electrical distribution system from the motor control center (MCC) or switchgear, as applicable, to the Tier 1 system component loads. S&L performed a load path review for the remainder of the electrical distribution system (EDG to switchgear or MCC). S&L identified the busses that fed the Tier 1 system components (including indirect I&C signal input components) and determined their load-time profiles. The load paths from these busses were identified up to the onsite electrical sources (i.e. EDG, battery and charger, inverter). After the Tier 1 systems and most of the components that were fed from MCCs were identified, S&L selected two MCCs with different electrical loads for a review of feeder cable sizing, circuit breaker coordination, and other design attributes. S&L also reviewed the 10 CFR 50, Appendix R, and safe shutdown requirements for components and cables associated with the Tier 1 systems, including a detailed review of selected fire zones that addressed associated circuits that could impact the Tier 1 systems.
The load carrying components in the load path were checked for design sizing using the total operating load of the bus based on the bus loading calculations. Loading for components of non-Tier 1 systems were accepted (without verification) as shown in the bus loading calculations. S&L verified coordination of protective devices (i.e., relays, breakers, fuses) for the load paths required to supply the components of the Tier 1 systems to confirm acceptable coordination and that the required bus operating loading was addressed. S&L verified the onsite electrical source load-time profiles included the loads (including transient loads) associated with the components of the Tier 1 systems. The adequacy of the overall sizing of the onsite electrical sources were verified against total loading of the source using the associated bus loading calculations. In addition, the battery charger (or inverter) and its continuous loading profile were checked to confirm the size was appropriate, that the load path was complete to the EDG, and that the load profile matched or enveloped the EDG loading input from the charger (inverter).
S&L reviewed the initiating events in the Unit 3 FSAR and identified the accident mitigating systems and components within the system. The reload analysis and the FSAR were used to identify the specific CDCs that were required to mitigate the events. S&L verified that the CDCs were satisfied using a documented system or component test, a surveillance test required by the Unit 3 TS, a post maintenance test, or as applicable design bases calculations or analyses. The Tier 2 review was not as detailed a systems review as the Tier 1 review. Tier 2 of the ICAVP was developed to review configuration management from a different perspective than the "vertical slice" Tier 1 review described above. The bases or starting point for the Tier 2 review was the accidents and transients analyzed in the FSAR. The Tier 2 review did review in a limited manner 22 of the 88 Maintenance Rule systems. The systems for which the CDCs were validated during the Tier 2 review included -
| 1. Auxiliary Feedwater System | 12. Main Steam System |
| 2. Anticipated Transient without Scram (ATWS) Mitigation System Actuation Circuitry | 13. Nuclear Instrumentation Systems: shutdown margin; source, intermediate, and power range |
| 3.Auxiliary Building HVAC* and SLCRS* | 14. QSS* |
| 4. Chemical and Volume Control System | 15. Radiation Monitoring System |
| 5. Containment Purge system | 16. Reactor Coolant System |
| 6. Containment Structure (penetrations) | 17. Reactor Head - Missile Shield |
| 7. Control Room Ventilation | 18. Reactor Protection System (RPS) |
| 8. Engineered Safeguards Actuation System | 19. RSS* |
| 9. Feedwater System | 20. RWST* |
| 10.Fuel Building Ventilation System | 21. Rod Position Indication System |
| 11.High and Low Pressure Safety Injection Systems | 22. Spent Fuel Pool Cooling and Purification System |
*Included in the scope of the Tier 1 review.
The Tier 3 review conducted by S&L encompassed a programmatic review on a horizontal bases (a so called "horizontal" review is one in which the same design attribute, for example electrical equipment qualification, is reviewed across systems) to determine whether the licensee's change processes were effective at maintaining the design and licensing bases and whether the current change processes were satisfactory to maintain the design and licensing bases in the future. The licensee's current plant change processes were reviewed for both their adequacy with respect to industry standards and for the effectiveness by which they were being implemented. Both design change processes and procedure change processes were included in this review. As part of the Tier 1 review, S&L assessed the plant modifications made to the Tier 1 systems. The Tier 1 review evaluated the effectiveness of the change processes involved in these modifications (i.e. if the resulting modification was found to be acceptable, it was inferred that the process used in performing the modification was acceptable). In addition to the Tier 1 system review, S&L performed specific process-related reviews that included the following -
| 1. drawing changes | 5. temporary alterations | 9. changes to licensing documents |
| 2. specification changes | 6. minor modifications | 10. vendor manual updates |
| 3. calculation changes | 7. modifications | 11. like-for-like replacements |
| 4. procedure changes | 8. setpoint changes |
S&L evaluated the licensee's procedure for the processes listed above for content and completeness to determine whether the procedure exercised adequate controls on the change process and invoked appropriate interface reviews to ensure that the plant design bases and configuration were, and will be maintained in the future, consistent with the licensing bases. The evaluation was based on guidance provided in (1) Regulatory Guide 1.33, Quality Assurance Program Requirements (Operation), (2) NRC Inspection Manual, (3) Institute of Nuclear Power Operations (INPO) guidelines, (4) INPO 87-006, "Report on Configuration Management in the Nuclear Industry," and (5) Nuclear Energy Institute guidelines.
S&L also evaluated the adequacy of NU's implementation of the change processes and procedures for the modifications reviewed in Tier 1. Since the Tier 1 review assessed the technical adequacy of the changes, the programmatic review evaluated only the procedural adequacy of the change. The evaluation determined whether the current procedures were followed, that the required checklists were accurate and complete, and that other associated documentation was complete and accurate.
In addition to the process and implementation reviews noted above, S&L reviewed select past changes on a plant-wide basis. For each of the eleven change processes selected by the NRC (listed above) that are not generally associated with modifications, S&L selected a sample of changes made during each 5-year interval following receipt of the operating license and reviewed them for technical adequacy. The changes were selected from various systems other than the Tier 1 systems in order to maximize plant coverage. This review ensured that these past changes did not compromise the unit's design or licensing basis.
In addition to S&L's review of the proposed corrective actions associated with DRs, S&L reviewed the corrective actions for degraded or non-conforming conditions identified by the licensee and for the design deficiencies identified by the architect engineer before initial operation. This review was conducted for corrective actions associated with the Tier 1 systems and for a representative sample of corrective actions, identified by NRC, associated with the other CMP systems reviewed by the licensee. S&L assessed the corrective actions for the following -
In addition to the technical adequacy review of corrective actions, S&L evaluated the effectiveness and completeness of the implementation of certain corrective actions. The implementation reviews included restart required corrective actions associated with all Confirmed Level 3 DRs, other restart required corrective actions associated with the Tier 1 systems, and a sample of corrective actions identified by the NRC. The scope of these reviews included the review of (1) completed engineering assessments, (2) major calculation changes, (3) significant procedure changes, (4) significant FSAR changes, (5) training and personnel qualification requirement changes, (6) new test procedures, (7) inspection acceptance criteria changes, and (8) major changes to design or installation specifications.
(Note: Terms, such as "Preliminary, Valid, and Confirmed," used in this section are defined in Section 2.0.)
S&L issued 1100 preliminary DRs during the ICAVP at Unit 3. Of the Preliminary DRs, 126 were issued as invalid, with the remaining 974 DRs issued as valid. As the ICAVP nears completion, the status of the DRs changes rapidly. Based on information provided by S&L, the status of the DRs as of May 21, 1998, is that of the 974 Valid DRs, 934 were Closed, three were Pending, and seven were Unresolved. Following completion of S&L's review of the licensee's response and proposed corrective actions, as of May 21, 1998, two of the Pending DRs were categorized as Level 3 and one was categorized as Level 4; 595 DRs were closed as Confirmed DRs (16 as Level 3 and 579 as Level 4); 98 were closed as Previously Identified; and 241 were closed as Nondiscrepant. Section 2.0 provides a discussion of the DR process, including how the DRs were classified during various phases of their review and closure. For the Tier 1 systems, Valid Preliminary DRs were issued as noted in Table 1 to Attachment 1 for various discrepancy types based on information provided to the staff by S&L. S&L did not identify any Level 1 or 2 DRs during the ICAVP.
Using the information contained in Table 1 to Enclosure 1, the areas of calculations, component data, drawings, and installation implementation appear to standout as potential programmatic trends. Based on its review of Confirmed DRs, S&L determined that the potential for a programmatic trend existed in the area of calculations (calculational control and lack of attention to detail in the performance and checking of calculations). Table 2 to Enclosure 1 provides a breakdown by ICAVP Significance Level and discipline of the calculation area. The trends identified by S&L were consistent with the trends identified by the NRC, based on its independent classification of Confirmed DRs.
S&L issued an interim report on May 8, 1998. This report provide the preliminary results of its implementation of the ICAVP at Unit 3. S&L and the licensee were still resolving a relatively small number of (approximately 100) DRs at the time the interim report was issued, and the resolution of the remaining DRs was not expected to significantly affect the conclusions reached in the interim report. In this interim report S&L concluded that -
This conclusion was based on S&L's findings in each of the three tiers and the corrective action reviews conducted during the ICAVP. While S&L made the overall conclusion noted above, there were a number of areas that they determined improvements and enhancements could be achieved as noted below -
The licensee is required by the ICAVP Order to respond to S&L's findings. This response and any corrective actions will be reviewed by the NRC. It should be noted that the seven items listed above represent recommendations for program enhancements and are not required to be accomplished before restart.
In accordance with SECY-97-003, the SPO staff implemented an oversight of the ICAVP contractor (S&L) and performed independent inspections at Unit 3. NRC's oversight was planned to provide confidence that the licensee's configuration management corrective action programs have been effective, and to assure that the review conducted by S&L was performed (1) in a critical manner, (2) in accordance with the NRC-approved audit plan, and (3) in a manner independent of the licensee and its design contractors. The NRC inspections included vertical slice inspections of out-of-scope (i.e., not included in the scope of S&L's Tier 1 review), and in-scope systems (i.e., included in the 15-system Tier 1 ICAVP scope), to verify Tier 1 reviews, evaluation of CDCs of accident mitigation systems for Tier 2 reviews, and evaluation of change processes other than the principal design change process, to verify Tier 3 reviews. The inspections generally followed the guidelines of IP 93801, "Safety System Functional Inspection," IP 92701 "Followup," and IP 92702, "Followup on Corrective Action for Violations and Deviations," of the NRC inspection program. The licensee's corrective actions in response to all inspection findings were evaluated and the results are, or will be, detailed in inspection reports (IRs) IR 50-423/98-205 and IR 50-423/98-211. Table 3 of Enclosure 1 provides the level of effort associated with each of the various ICAVP oversight inspections. The implementation of all licensee corrective actions in response to Level 3 DRs identified by S&L or NRC Notices of Violation, necessary to restore compliance with the licensing and design bases, will be inspected by NRC prior to Unit 3 restart.
(IR 50-423/97-201)
The SPO staff initiated a plan to monitor S&L's implementation of the ICAVP. The plan encompassed the assessment of S&L's project manual and associated project instructions, the evaluation of the technical experience of project personnel, and scheduled inspections of implementation activities. Specifically, the team evaluated S&L's implementation of the ICAVP Audit Plan, as discussed in the Project Manual (PM) that was approved by the NRC on June 3, 1997. Critical aspects of the S&L ICAVP inspection included the evaluation of the system requirements checklist (SRC); FSAR Chapter 15, CDCs; S&L's threshold for writing DRs; the DR disposition process; the depth of checklist driven reviews on the Tier 1 systems; and the adequacy of S&L's internal oversight of the ICAVP.
The SPO staff inspected S&L's activities during the periods of July 28 - August 1; August 26 - 28; and September 15 -19, 1997. On October 6 - 10, 1997, a followup inspection was conducted to assess S&L's corrective action in response to the issues identified by the team. The team consisted of seven technical discipline specialist inspectors including a team leader. The SPO staff continued to assess the status and evaluate the quality of the ICAVP through follow-up activities that involved additional visits to S&L's offices, as part of scheduled NRC Tier 1 In-Scope and Tier 2/3 team inspections, and during monthly public status meetings with S&L.
The team concluded that S&L's Tier 1 reviews were being conducted in a critical manner. The review of system calculations were generally acceptable. Component checklists were compiled in accordance with the approved procedures. S&L established an adequate threshold for the identification of problems. Reviewers demonstrated no hesitancy in the generation of DRs. The team found no evidence of any attempt to minimize or prevent the issuance of a DR by S&L management. (At the time of this inspection, Tiers 2 and 3 were in there early phases of implementation and the team could not perform a meaningful assessment. These were subsequently reviewed in the Tier 2/3 inspection discussed below.)
The team identified weaknesses within the S&L's operations review group (ORG) that involved the lack of adherence to project instructions and a failure to anticipate documents that would be required from the licensee. NRC follow up in this area verified appropriate corrective actions were taken by S&L to resolve this concern.
(IR 50-423/97-206)
During the periods of August 18 - 29 and September 8 - 19, 1997, an SPO inspection team conducted an SSFI at Unit 3 as part of the NRC's oversight of the ICAVP. This inspection assessed the effectiveness of the licensee's CMP at identifying areas of nonconformance with the plant's design and licensing bases by inspecting a system that was not in the scope of S&L's ICAVP review. The team's review focused on the emergency core cooling and seal injection functions of the charging system. The multidisciplined inspection team consisted of six members, including the team leader. The inspection identified issues in the areas of operations, surveillance, and maintenance.
The issues found by the team included the potential for air binding the charging and safety injection pumps due to air trapped in certain portions of the dry RSS piping; the licensee's program for minimizing leakage outside the containment (a requirement of TS 6.8.4) did not address intersystem leakage through check valves that could potentially result in radioactive water leaking into places where it could be vented to the atmosphere, such as the RWST, following a loss-of-coolant accident (LOCA). Subsequent to the inspection, the licensee recognized that this issue had been discovered during CMP, and the valve lineup procedure for verifying the Technical Specification requirement that all charging pump injection flow path valves, not locked or otherwise secured in position, were in their correct positions every 31 days was found to be inadequate.
As a result of the fact that the potential for air binding the charging and safety injection pumps was not identified and evaluated during the CMP, the licensee initiated a review of other systems for similar issues that could occur during system actuation. This review was called the "Integrated Functional System Review" and included a review of approximately 25 systems that would be actuated to mitigate the consequences of a small break LOCA and applicable industry operating experience. The small break LOCA event was chosen because it results in the actuation of a majority of the accident mitigation systems. This review was conducted by a
6- person team with operations, design, accident analysis and startup testing experience. The review effort was for 8 weeks and resulted in 14 conditions reports, 12 of which are required to be closed before restart. This additional "Integrated Functional System Review" performed by the licensee and inspected by the NRC was considered to be equivalent to an expansion of the ICAVP scope. The licensee's response to correct inadequate conditions identified by the team, was prompt and effective. However, issues such as the effects of air entrainment in RSS piping, inadequate intersystem leakage monitoring of valves, and an example of a valve lineup procedure that failed to meet TS requirements, were expected to have been identified during the licensee's CMP. The NRC inspected the licensee's corrective actions and concluded that they were acceptable (see Section 7.5). Therefore, while these issues were considered to be equivalent to S&L identified ICAVP Significance Level 3 DRs, no expansion of ICAVP scope was necessary.
The team found the material condition of the charging system and associated support systems to be good. Other licensee strengths noted by the team included an aggressive licensee maintenance program, knowledgeable system engineers, and a document control organization that appeared to have a good understanding of the programmatic challenges that remained to improve the unit's calculation control program.
(IR 50-423/97-210)
For the periods of January 5 - 16 and January 26 - February 6, 1998, an SPO inspection team conducted a system functional inspection at Unit 3. Following the three weeks of inspection at Unit 3, the team spent a week at the offices of S&L. The multidisciplined inspection team consisted of six inspectors, including the team leader. This inspection was conducted to continue the assessment of the effectiveness of the CMP, as well as the effectiveness of S&L's review of the 15 ICAVP Tier 1 systems. The team focused its inspection on QSS, RSS, the EDG sequencer, and a portion of the plant's emergency ventilation system, all of which were included as part of S&L's ICAVP Tier 1 review.
During the onsite portion of the inspection, the team identified three violations and a number of other findings. Individually and in aggregate, these findings were considered of low safety significance. Overall, the team found that the material condition of the inspected systems to be good.
The team determined that S&L's assessments were generally thorough. Based on its onsite inspection of specific focus areas such as single-failure and ongoing modifications, the team requested that S&L augment their review to include, (1) single-failure vulnerability of electrical control circuits that have inputs from redundant trains; (2) a review, by S&L's Systems Review Group, of DRs written by ORG, and DRs associated with temporary modifications to determine whether there were any design weaknesses being resolved by temporary modifications or operator workarounds; (3) additional structural calculations for fans and steel component supports. S&L's augmented reviews did not identify additional issues thus confirming the adequacy of the CMP in these areas.
Based on the results of the team's independent design review, the team's assessment of the S&L's Tier 1 review, and the relatively small number of Confirmed Level 3 DRs identified by S&L, the team determined that preliminary indications were that the licensee's CMP was generally effective at identifying and correcting nonconformances with the plant's design and licensing bases.
(IR 50-423/97-209)
Between October 27, 1997, and January 28, 1998, an SPO inspection team conducted an inspection at Unit 3 and at the offices of S&L, in accordance with the guidance provided in SECY 97-003, of characteristics of the systems used to mitigate the consequences of accidents as described in Chapter 15 of the FSAR and of the processes by which the licensee could potentially change the design or licensing bases of the facility. The multi-disciplined team consisted of eight inspectors, including the team leader. The inspection was conducted to (1) independently assess the licensee's ability to identify and resolve licensing bases deficiencies; (2) determine if the licensee's change processes were adequate to maintain the Unit 3 design and licensing basis; (3) determine if the critical functions of accident mitigation systems credited in FSAR Chapter 15, can be accomplished; and (4) assess the effectiveness of S&L's Tier 2/Tier 3 ICAVP reviews.
For Tier 2, the team selected the spectrum of LOCAs and the steam generator tube rupture (SGTR) accident CDCs for its Tier 2 inspection. For the Tier 3 review, the team used risk-insights to select key change processes and a relatively large sample of recent changes to the facility. The selected change processes were evaluated to determine if they met regulatory requirements and were capable of maintaining the facility's design and licensing bases. The team reviewed approximately one hundred changes to the plant implemented since
January 1996. In addition, the team selected thirty past changes for which S&L had completed its ICAVP review.
The NRC determined that S&L successfully implemented the Tier 2 verification of the CDCs and the Tier 3 evaluation of plant configuration control change processes in accordance with the NRC-approved ICAVP Audit Plan and implementing procedures. However, based on observations during the inspection, the team requested that S&L expand its review efforts in several areas including I&C surveillances, operations, and verification of dose assessment calculations. The expanded reviews did not result in additional findings. The team also verified that adequate process and program control documents such as the Design Change Manual, Revision 5, and the Regulatory Affairs and Compliance procedure "Safety Evaluations" Revision 10, that are important to the maintenance of plant configuration, have been successfully implemented by the licensee.
The inspection team identified several issues that were not identified during the licensee's CMP. These issues included failure of the licensee account for RSS heat exchanger tube leakage in their TS 6.8.4 program reduce leakage from systems outside containment, errors and inconsistencies between the design and licensing bases associated with the control room and offsite dose consequences following a LOCA, calculations performed for temporary modifications that were not controlled to the same level as design changes, emergent conditions were not evaluated adequately on systems that had temporary modifications installed; and an incomplete corrective action in response to a licensee-identified issue regarding an inappropriately high threshold for writing a safety evaluation (SE) for an FSAR Change Request (FSARCR). S&L identified similar problems with the threshold for writing SEs.
As a result of this inspection, the licensee acknowledged that the CMP did not review the implementation or conformance to administrative requirements contained Chapter 6 of the plant's TS. The licensee is implementing corrective actions that include a comparison of the TS administrative requirements to established procedural controls to ensure that the intent of the requirements are clearly translated into the associated procedures and when implemented the procedures will confirmed that the requirements are satisfied. The NRC will complete its inspection of the licensee's corrective actions during the final corrective action implementation inspection before restart of Unit 3.
(IR 50-423/98-205 and IR 50-423/1998-211)
The ICAVP corrective action inspection is being conducted in several phases as corrective actions are completed by the licensee. To date, the SPO team inspecting corrective actions staff has spent four weeks on site. The first 2-week inspection is documented in Inspection Report 50-423/98-205. The scope of the corrective action inspections includes reviewing (1) a sample of licensee corrective actions in response to issues self-identified during CMP (including items that were reviewed within the 15-system ICAVP review scope and items that were not in the scope of the ICAVP); (2) corrective action for all Confirmed Level 3 DRs identified by S&L; (3) corrective actions implemented in response to findings identified during the NRC inspections associated with the NRC oversight of the ICAVP; and (4) corrective actions for a number of design-related LERs, including some of those associated with RSS. In addition, to further validate the conduct of the ICAVP process, the staff inspected a sample of Confirmed Level 4 DRs to verify that they were properly categorized in accordance with the ICAVP Significance Levels developed by the SPO staff. The team also inspected a sample of DRs that were determined to be either Previously Identified or Nondiscrepant to verify that a proper assessment had been made by the licensee and S&L. Also included in the scope of the corrective action inspection were the licensee's corrective actions taken in response to the RSS expansion bellows failure (Enclosure 2 provides additional information regarding this issue) and the corrective actions taken in response to the NRC-identified issues with Chapter 6.0 of the Unit 3 TS, and the potential for air binding of the charging and safety injection pumps.
The corrective action inspections to date have reviewed the corrective actions for 12 of 18 Confirmed or Pending ICAVP Significance Level 3 DRs currently issued. In addition, the team inspected the implementation of the corrective action for 22 of the 24 NRC violations. The teams preliminary conclusions are that the licensee has developed and implemented corrective actions that appropriately address the specific issue as well as identifying and correcting similar issues on other systems.
In addition, the NRC staff, as part of the ICAVP corrective action inspection, reviewed the licensee's evaluation of the effect of any remaining expansion bellows liner slivers on RSS functionality. On the basis of its inspection of the licensee's analyses, the staff concluded that the liner slivers, if any exist, would not affect the operability of the RSS, including pumps and motor-operated valves. As a result of the failed RSS expansion bellows, the licensee conducted a review of the approximately 195 plant modifications made during the current outage to verify that the root causes attributed to the failure of the RSS bellows did not adversely affect any of these modifications. Also, the licensee is reviewing, in detail, the RSS modifications made during the current outage. As of May 20, 1998, the licensee had not completed its review of current modifications to the RSS. Prior to restart, the staff will verify that the licensee's corrective actions were effective at ensuring problems similar to those identified on RSS did not adversely affect other modifications.
In its review of Level 4 DRs, the team focused on those DRs that identified instances where the existing plant configuration was different than that represented on plant drawings because these DRs had a potential to be Level 3 DRs, if the installed configuration was not bounded by the existing analyses. S&L in their initial categorization of preliminary DRs relied on engineering judgement in their determination of ICAVP significance level (i.e., if they had a reasonable expectation based on their design experience and professional judgement that an error or discrepancy would not rise to the threshold of a nonconformance with the plant's licensing and design bases, they categorized the preliminary DR as a Level 4). The team inspected the licensee's process for handling Level 4 DRs to determine whether Level 4 DRs that identified differences between design drawings and plant configuration were being reviewed to determine if in fact the existing physical condition was bounded by the plant's analyses and therefore in conformance with its design bases. The team reviewed approximately 70 Confirmed Level 4 DRs and concluded that the licensee had verified that the existing configuration was bounded by the existing analyses. The licensee recategorized one S&L Level 4 DR to a Level 3 DR as a result of its review. In all instances inspected, the team validated the licensee's determination of ICAVP significance level and that the original S&L categorization of ICAVP Significance Level 4 versus Level 3 was appropriate.
At this time the corrective actions inspection is substantially complete. The team needs to review the corrective actions for the remaining six ICAVP Significance Level 3 DRs currently identified and several other potential Level 3 DRs that are currently under discussion between the licensee and S&L that may be determined to be Confirmed DRs. In addition, the team needs to complete its inspection of corrective actions for several recently issued violations. Nonetheless, a sufficient a number of issues have been reviewed to allow preliminary conclusions to be drawn based on what has been inspected to date. The team's conclusions at this time indicate that the licensee's corrective action program has been effective in resolving the issues identified by both the NRC and S&L as well as those that were self-identified by the licensee during its CMP. NRC inspection of the implementation of all remaining corrective actions associated with ICAVP Level 3 issues required to restore compliance with the design and licensing basis is planned to be completed before restart of Unit 3.
The SPO staff, as described above, conducted its oversight of the ICAVP program through a series of inspections to verify that S&L implemented the ICAVP in accordance with the NRC-approved audit plan and to validate S&L's conclusions. The oversight inspections focused on the plant's conformance with its design and licensing bases, the licensee's corrective actions taken in response to self-identified, NRC- and ICAVP-identified nonconformances, and licensee programs currently in place to manage and control the plant configuration subsequent to unit restart.
The SPO staff, through its oversight, concluded that the ICAVP fulfilled the requirements of the NRC's August 14, 1996, Order and that the ICAVP provided valuable information to the NRC staff to make the determination that (1) the licensee's CMP was effective at identifying and satisfactorily resolving existing nonconformances with the design and licensing bases; (2) the licensee had adequately documented the licensing and design bases, and used it to resolve nonconformances; and (3) the licensee had established programs, processes, and procedures for effective configuration management in the future. Although both S&L and the NRC staff identified a number of nonconformances with the Unit 3 licensing and design bases, none of the issues impacted the functionality of the plant's safety systems. These issues are documented in ICAVP Significance Level 3 DRs issued by S&L and in NRC Notices of Violations contained in inspection reports. These are summarized in Enclosure 1, Tables 4 and 5, respectively. Table 6, of Enclosure 1, provides a list of NRC identified issues equivalent to ICAVP Significance Level 4. Additionally, the number of such issues were relatively few and indicative of a generally effective effort by the licensee to reestablish confidence that Unit 3 is in compliance with its design and licensing bases.
For each Level 3 DR, and the other comparable findings documented in various NRC inspection reports related to oversight of the ICAVP, the SPO staff determined, for those issues reviewed during the performance of its ICAVP corrective action implementation inspections as of May 15, 1998, that the licensee was taking adequate and timely corrective actions to address not only the specific issue, but to address the extent of condition, i.e, applicability to other systems, and correct other identified nonconformances. The review of the implementation of the remaining corrective actions, resulting from Confirmed Level 3 DRs and NRC violations, required to restore the design and licensing basis of Unit 3 will be reviewed by the SPO staff before restart.
The large majority of Confirmed or Pending DRs (580 of 598) identified by S&L as of May 21, 1998, were categorized as ICAVP Significance Level 4. ICAVP Significance Level 4 DRs document minor errors, e.g., calculation errors that do not significantly alter the results or conclusions of the calculation or minor errors of an editorial nature, that are not nonconformances with the design and licensing bases. These types of errors are not typically included in NRC inspections reports because they are not violations of NRC requirements or regulations. (Occasionally, NRC inspection reports contain inspector followup items (IFIs). For the purposes of drawing a comparison between NRC and the S&L ICAVP results, IFIs are being considered as equivalent to Level 4 DRs.) Nonetheless, S&L was required to identify, document and trend such errors to gain additional insights into areas where further enhancements could be made to licensee programs. Areas identified by S&L through trending of Confirmed Level 3 and Level 4 DRs that should be improved include calculational control and a lack of attention to detail in the performance and checking of calculations. NRC identified similar issues during the conduct of our inspections. The licensee is developing corrective actions in response to these issues that will be reviewed by the staff. However, the judgment of the staff is that these programs and the performance of the Unit 3 engineering organization is at an acceptable level to support restart of Unit 3.
There have been concerns expressed regarding the total number of DRs, even though the vast majority are ICAVP Significance Level 4. As previously discussed, Level 4 DRs are not instances of noncompliance with the plant's design and licensing bases. As a result of a line-by-line review of calculations, S&L identified a number of minor errors that it recorded in Level 4 DRs. The licensee adopted a "graded systems review" during the CMP in order to focus on the identification of potentially safety significant issues. The graded approach used during CMP was a higher level review, concentrating on calculation inputs, assumptions, methodology and reasonableness of results. The fact that no Level 1 or Level 2 DRs and relatively few ICAVP Significance Level 3 DRs were identified by S&L, indicates that the graded systems review methodology used by NNECO was effective. The number of Level 4 DRs that resulted from the graded review is not viewed by the staff as weakness in the CMP and does not, due to the minor significance of such findings, suggest the need for an expansion of ICAVP scope.
The scope of the ICAVP, while extraordinarily large, did not review all aspects of all systems. Therefore, it is reasonable to assume that similar types of findings may exist in other systems. However, the extent of the ICAVP reviews, the low safety significance level of the findings identified by the S&L and the NRC staff, and the corrective actions implemented by the licensee provides confidence that any other issues would also be of low safety significance. Therefore, the staff concludes that the Unit 3 ICAVP has been satisfactorily performed and the results of the ICAVP and the staff's oversight provide reasonable assurance that Unit 3 is in compliance with its design and licensing bases.
(5/21/98 data)
|
|
Totals | Other | SWS | RSS | HVX | DGX | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DISCR | Level 3 | Level 4 | Level 3 | Level 4 | Level 3 | Level 4 | Level 3 | Level 4 | Level 3 | Level 4 | Level 3 | Level 4 |
| 1. | 6 | 233 | 1 | 29 | 0 | 53 | 2 | 89 | 3 | 30 | 0 | 32 |
| 2. | 3 | 83 | 0 | 2 | 0 | 9 | 0 | 33 | 3 | 27 | 0 | 12 |
| 3. | 2 | 21 | 1 | 7 | 0 | 4 | 1 | 2 | 0 | 3 | 0 | 5 |
| 4. CA | 0 | 12 | 0 | 2 | 0 | 1 | 0 | 6 | 0 | 1 | 0 | 2 |
| 5. | 3 | 9 | 2 | 4 | 0 | 1 | 0 | 3 | 0 | 0 | 1 | 1 |
| 6. | 1 | 93 | 0 | 4 | 0 | 27 | 0 | 27 | 1 | 14 | 0 | 21 |
| 7. | 1 | 74 | 0 | 5 | 1 | 31 | 0 | 21 | 0 | 9 | 0 | 8 |
| 8. | 1 | 6 | 0 | 0 | 1 | 3 | 0 | 1 | 0 | 1 | 0 | 1 |
| 9. | 0 | 26 | 0 | 14 | 0 | 4 | 0 | 5 | 0 | 2 | 0 | 1 |
| 10. | 0 | 4 | 0 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 |
| 11. | 0 | 7 | 0 | 4 | 0 | 1 | 0 | 2 | 0 | 0 | 0 | 0 |
| 12. | 0 | 4 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 1 |
| 13. Test | 1 | 4 | 0 | 1 | 0 | 1 | 0 | 2 | 1 | 0 | 0 | 0 |
| 14. Test | 0 | 3 | 0 | 0 | 0 | 0 | 0 | 3 | 0 | 0 | 0 | 0 |
| TOTAL | 18 | 579 | 4 | 75 | 2 | 137 | 3 | 195 | 8 | 88 | 1 | 84 |
The RSS totals include DRs for the RSS, QSS, and new scope (RSS modifications)
(5/21/98 data)
|
|
|
Totals | Mechanical | Electrical | Piping/Stru | I&C | EQ | Other |
|---|---|---|---|---|---|---|---|---|
| 1. Calculations | Level 3 | 6 | 5 | 0 | 1 | 0 | 0 | 0 |
| Level 4 | 234 | 112 | 32 | 64 | 14 | 1 | 11 |
| INSPECTION | Team Size |
PREP and DOC days |
SITE or S&L days |
INSPECTION EFFORT staff-hours (8 X days X size) |
|---|---|---|---|---|
| 50-423/97-201
Implementation Inspection |
7 | 15 | 13 | 1568 |
| 50-423/97-206
Tier 1 Out-of-Scope Inspection |
6 | 15 | 22 | 1776 |
| 50-423/97-209
Tier 2/Tier 3 Inspection |
8 | 27 | 34 | 3904 |
| 50-423/97-210
Tier 1 Inscope Inspection |
6 | 15 | 20 | 1680 |
| 50-423/98-205
Corrective Action Inspection - Phase 1 |
6 | 7 | 11 | 864 |
| 50-423/98-211
Corrective Action Inspection - Phase 2 * |
7.5 | 2 | 5 | 420 |
| 6 | 0 | 5 | 240 | |
| 4 | 5 | 3 | 256 | |
| TOTAL EFFORT | 10708 | |||
| ICAVP SITE COORDINATOR LEVEL OF EFFORT (4/17/97 to 5/1/98) HOURS | 1545 | |||
| TOTAL INSPECTION EFFORT IN HOURS | 12253 | |||
(5/18/98 data)
|
|
DR Number | DR Title | Type of Discrepancy |
|---|---|---|---|
| 1 | DR-MP3-0001 | Consistency with Technical Specifications | Design Control Procedure |
| 2 | DR-MP3-0006 | PORC/SORC Review of Minor Modifications | Design Control Procedure |
| 3 | DR-MP3-0051 | Embedded plate calculation discrepancy | Calculation |
| 4 | DR-MP3-0331 | Filter Unit Drain Valve Normal Position | Drawing |
| 5 | DR-MP3-0355 | Cable Routing Is Not Consistent With TS02 | Installation Implementation |
| 6 | DR-MP3-0434 | Conclusions Documented in Technical and Reportability Evaluations for ACR No. 012327 | Corrective Action |
| 7 | DR-MP3-0588 | SLCRS and ABVS Filter Units Adsorbent Cooling | Component Data |
| 8 | DR-MP3-0624 | Storage of Reference Material as QA Records | Corrective Action |
| 9 | DR-MP3-0639 | Not Obtaining NRC Relief for Temporary Non-Code Repair | Installation Requirements |
| 10 | DR-MP3-0669 | Fan 3HVR*FN14A/B Motor Requirements | Component Data |
| 11 | DR-MP3-0670 | CCP & CHS Area Ventilation System Winter Operation | Calculation |
| 12 | DR-MP3-0686 | ABVS Filter Unit Bypass Leakage | Calculation |
| 13 | DR-MP3-0687 | Fan Blade Missiles | Calculation |
| 14 | DR-MP3-0762 | PDCR MP3-92-024 Fan 3HVR*FN12B Vibration Test | Test Implementation |
| 15 | DR-MP3-0795 | Specifications 2176.430-141 and 2170.430-140 Vibration Test Requirements | Component Data |
| 16 | DR-MP3-1011 | Unreviewed Safety Questions Concerning the MP-3 Emergency Diesel Generators | Design Control Procedure |
| 17 | DR-MP3-1016 | Secondary Containment Bypass Leakage Penetrations | Calculation |
| 18 | DR-MP3-1026 | Revision of Calculation US(B)-353 for DCR M3-97045 | Calculation |
| NRC Issue No. | Level | Issue Description | Type of Issue | |
|---|---|---|---|---|
| 1 | 50-423/97-206-01 | VIO 4 | Failure to update FSAR per 10 CFR 50.71, multiple examples | FSAR |
| 2 | 50-423/97-206-02 | VIO 4 | Failure to follow procedures, multiple examples | Procedure |
| 3 | 50-423/97-206-03 | VIO 4 | Failure to comply with ASME code | Design |
| 4 | 50-423/97-206-06 | VIO 4 | Failure to include valves in the environmental qualification program | Design |
| 5 | 50-423/97-206-12 | VIO 4 | Inadequate corrective actions, multiple examples | Corrective Action |
| 6 | 50-423/97-206-13 | VIO 4 | Failure to have adequate procedure, multiple examples | Procedure |
| 7 | 50-423/97-206-16 | VIO 4 | Structural amplification not considered in pipe support calculation | Design |
| 8 | 50-423/97-206-20 | EEI 3 | Failure to address air entrapped in RSS piping | Corrective Action |
| 9 | 50-423/97-206-21 | VIO 4 | Failure to vent RSS piping per TS 4.5.2.5.1 | Procedure |
| 10 | 50-423/97-209-01 | VIO 4 | Failure to include acceptance criteria in surveillance procedure | Procedure |
| 11 | 50-423/97-209-03 | VIO 4 | Failure to update FSAR per 10 CFR 50.71 | FSAR |
| 12 | 50-423/97-209-02 | VIO 4 | Licensee to implement valve leakage surveillance | Surveillance |
| 13 | 50-423/97-209-04 | NCV | Inadequate Service Water System surveillance procedure | Surveillance |
| 14 | 50-423/97-209-06 | VIO 4 | Failure to correct dose calculations | Corrective Action |
| 15 | 50-423/97-209-08 | NCV | Minor inadequacy in temporary modification procedure | Procedure |
| 16 | 50-423/97-209-09 | VIO 4 | Failure to meet EDG limiting condition for operation | Procedure |
| 17 | 50-423/97-209-10 | VIO 4 | Inadequate temporary design modification | Design |
| 18 | 50-423/97-209-11 | VIO 4 | Inadequate control of calculations for temporary modifications | Procedure |
| 19 | 50-423/97-209-12 | VIO 4 | Inadequate temporary design modification | Design |
| 20 | 50-423/97-209-13 | VIO 4 | Failure to include safety evaluations with FSAR changes | Procedure |
| 21 | 50-423/97-210-03 | VIO 4 | Failure to correct fire protection system water leak in SLCRS charcoal filter | Corrective Action |
| 22 | 50-423/97-210-04 | VIO 4 | Potential cycling of flow control valves with the potential loss of redundant ventilation fans | Design |
| 23 | 50-423/97-210-09 | VIO 4 | Inadequate procedures to maintain containment integrity and to implement TS 3.0.3 | Procedure |
| 24 | 50-423/98-205-01 | NCV | RSS Containment Sump Inspection Procedure Discrepancies | Surveillance |
| 25 | 50-423/98-205-02 | VIO 4 | Failure to incorporate corrective actions into applicable procedures | Corrective Action |
| 26 | 50-423/98-205-03 | VIO 4 | Failure to incorporate changes to relay settings into control documents | Corrective Action |
| 27 | 50-423/98-205-04 | NCV | Portion of Auxiliary Feedwater System outside of design basis | Design |
| 28 | 50-423/98-205-05 | NCV | Pipe supports not consistent with design basis | Design |
| NRC Issue No. | Issue Description | Type of Issue | |
|---|---|---|---|
| 1 | 50-423/97-206-08 | Licensee to verify cable short circuit qualifications | Procedure |
| 2 | 50-423/97-206-10 | Licensee to label hydrogen analyses indicators | Procedure |
| 3 | 50-423/97-206-14 | Licensee to correct
calculation errors -
CR M3-97-3169 |
Calculation |
| 4 | 50-423/97-206-18 | Adequacy of the licensee's proposed change to the bases of the pressurizer level TS | Procedure |
| 5 | 50-423/97-206-19 | Resolution of charging pump area temperature inconsistencies | Design |
| 6 | 50-423/97-209-05 | Minimum short circuit current not evaluated | Calculation |
| 7 | 50-423/97-209-14 | Licensee to upgrade safety evaluation procedure | Procedure |
| 8 | 50-423/97-209-15 | Licensee to develop operator response to Auxiliary Feedwater System pipe break | Design |
| 9 | 50-423/97-210-01 | Licensee to verify test acceptance criteria | Procedure |
| 10 | 50-423/97-210-02 | Switch over time from RWST to recirculation will be changed from 10 minutes to 25 minutes | Calculation |
| 11 | 50-423/97-210-05 | Licensee to provide water seal for radiation monitor enclosure | Design |
| 12 | 50-423/97-210-06 | Licensee to clarify methodology for waterhammer and seismic load calculations | Design |
| 13 | 50-423/97-210-10 | Operators to complete training on RSS modifications | Procedure |
| 14 | 50-423/97-210-11 | Licensee to assess RSS functions for risk significance | Procedure |
One of the more significant problems discovered by the licensee during the Configuration Management Plan (CMP) was that the net positive suction head (NPSH) required by the Recirculation Spray System (RSS) pumps was below that available following a loss of coolant accident. To correct this deficiency with the original design, the licensee decided to lower the flow of the RSS pumps by installing a flow restricting orifice at the discharge of each pump, immediately upstream of an expansion bellows. The licensee was aware that the installation of the orifice immediately upstream of the expansion bellows was not a standard configuration. However, as a result of other design considerations such as RSS pump NPSH, minimization of waterhammer, and a short run of piping in which to install the orifice, the licensee decided to proceed with the orifice installation after taking what they considered to be reasonable and prudent precautions (e.g., having Westinghouse perform a cavitation analysis and interacting with the manufacturer of the expansion joint). Available engineering data indicated that this modification would have functioned acceptably at its design condition. Nonetheless, during acceptance flow testing the licensee discovered that the bellows liners became detached from the bellows assembly and in some instances pieces were broken off the liners and swept downstream some distance. The licensee successfully recovered all of the liner pieces with the possible exception of nine small fragments. An engineering evaluation performed to determine the effect of the fragments on system operation concluded that the fragments would not degrade system functionality.
As a result of the staff's concerns about the failure of the RSS bellows, the staff requested Sargent & Lundy (S&L), as part of the scope of the Independent Corrective Action Verification Program (ICAVP), to review the modification that removed the expansion bellows and installed a rigid spool piece in its place. S&L's review included an assessment of the analyses that determined the ability of the RSS pump to handle the increased nozzle loads imposed by the connected piping due to the installation of the rigid spool piece. The S&L review also included and an assessment of the licensee's analyses that concluded that any slivers of the failed expansion bellows liner that might remain in the RSS will not inhibit or degrade the functionality of the RSS. In addition, the NRC staff, reviewed, as part of the ICAVP corrective action inspection, the licensee's evaluation of the effect of any remaining liner slivers on RSS functionality.
On the basis of its inspection of the licensee's analyses, the staff concluded that the liner slivers, if any exist, would not affect the operability of the RSS, including pumps and motor-operated valves. Further, prior to the licensee's entry into Mode 4, an operating mode defined by the plant's TS for which the RSS is required to be operable, a staff consultant performed a review of the results of the increased nozzle loads on the operability of the RSS pump and confirmed that the nozzle loads were acceptable. The NRC staff also met with the licensee's staff, including members of Nuclear Materials Engineering (NME) group (involved with the bellows structural analysis and development of the vibrational acceptance criteria), Condition Based Maintenance (CBM) group (responsible for obtaining the expansion bellows measurements during the flow testing), and Nuclear Oversight, to better understand the role of these organizations in this modification, and the sequence of events that resulted in the failure of the expansion bellows.
Nuclear Oversight appropriately identified the potential for the failure, documenting that concern in a condition report, and placed an administrative hold on the plant proceeding to Mode 4 until all of its concerns were addressed to its satisfaction. Nuclear Oversight did not object to the continued testing of the original modification as a means to address its concerns regarding the expansion bellows since it recognized that given the complexities of the analysis, testing was the most conclusive way to verify the performance of the expansion bellows.
The fact that the failure of the expansion bellows was only discovered following the testing of the last of the four RSS pumps was a concern to the NRC, as it initially appeared that the discovery of the failure could have been by chance. Our assessment ultimately determined that this was not the case. The staff of the CBM group performing the vibration measurement had been concerned with the vibrations observed during the testing of the previous three pumps. Their concern was that although the testing indicated the expansion bellows was well within the vendor's specified vibrational acceptance criteria, the vendor's acceptance criteria only addressed axial vibrations (along the flow path of the expansion bellows) and did not include the transverse vibrations (at right angles to the flow path) that the CBM group had observed during the testing. The CBM group raised this concern with the NME group. The vendor was contacted and additional acceptance criteria were developed that addressed the three-dimensional vibration that had been observed. This criteria was not available until the testing of the fourth pump which had been instrumented to measure the tri-axial vibration. The fourth pump failed to meet the acceptance criteria. As a result, a decision was made to relocate the flow restricting orifice to a position downstream of the expansion joint.
The licensee discovered the failure of the expansion bellows liner during disassembly of the piping to relocate the flow restricting orifice. Again, the reason the failure was detected on the last pump tested was that the acceptance criteria had been refined as a result of concerns raised by the test engineers and the vibrational measurement instrumentation had been augmented to measure the vibration in three directions. At no time was this modification declared to be acceptable for plant operation. Successfully completion of the testing program was required before the system could be declared operable.
Based on damaging the bellows liner, the licensee determined that a rigid spool piece would be installed in place of the expansion bellows. The expansion bellows was originally installed to minimize the loads on the pump nozzles due to thermal expansion of piping during operation. The licensee discussed the increased loading on the pump nozzle with the pump vendor and the pump vendor indicated that the loads on the pump nozzles with the rigid spool piece would still be acceptable. As a resulted, the licensee revised its modification to the RSS system to install the rigid spool piece with the flow restricting orifice downstream of the spool piece.
As a result of the failed RSS expansion bellows, the licensee conducted a review of the approximately 195 plant modifications made during the current outage to verify that the root causes attributed to the failure of the RSS bellows did not adversely affect any of these modifications. The licensee also conducted a detailed review of the RSS modifications made during this outage. The NRC inspected these licensee-initiated reviews during the ICAVP corrective action inspection.
A concern to the NRC was why this potential failure was not identified by S&L during its review. S&L stated in the meeting on April 8, 1998, that it relied on the results of the Westinghouse analysis that predicted only incipient cavitation at the RSS post-accident design conditions. The results of the analyses performed by Westinghouse are not in question. S&L also was aware of the testing to be conducted to verify the design configuration. Because of the test configuration and system alignments necessary to perform the flow testing, the test flows were on the order of 2700 gpm, substantially above the 2200-gpm condition analyzed by Westinghouse. The licensee did not anticipate that cavitation would occur at the test conditions because the water temperature during the test was less than 125 oF, which is significantly lower than the analyzed post-accident condition of 260 oF. The licensee's expectation that cavitation would not occur at the test conditions was based on engineering judgement which ultimately proved incorrect.
Testing is usually confirmatory in nature, therefore the expectation is that the test results will confirm the analyses, however failures occasionally occur. The licensee was aware that the installation of the orifice immediately upstream of the expansion bellows was not a standard configuration. As a result of other design considerations such as RSS pump NPSH, minimization of waterhammer, and a short run of piping in which to install the orifice, the licensee decided to proceed with the orifice installation after taking what they considered to be reasonable and prudent precautions (e.g., having Westinghouse perform the cavitation analysis and interacting with the manufacturer of the expansion joint). Engineering analyses and data available to the licensee prior to the testing indicated that this modification would have functioned acceptably at its design condition. As stated above the test conditions were more than twenty percent above the design flow conditions. After a review of this event, the staff concluded that licensee's engineering and support organizations had an appropriate questioning attitude and that the interaction between groups resulted in discovering the failure of the bellows liner, a problem that may have otherwise gone undetected.
Pending the results of the S&L review, the staff's preliminary assessment is that the replacement of the expansion bellows with the rigid spool piece is acceptable. Since the RSS piping and the spool piece are stainless steel, erosion in the RSS piping, including the portion immediately downstream of the flow-restricting orifice, is not a concern. As a result of the information obtained at the public meeting with the licensee, and the additional information obtained in subsequent meetings with the groups previously indicated, the staff is of the opinion that (1) the licensee's design control processes functioned in a reasonable manner; (2) the line engineering organization did not ignore the concerns raised by Nuclear Oversight, in that testing was being performed as part of the ongoing modification process, and the RSS had not been declared operable; and (3) Nuclear Oversight functioned in an effective manner.
The NRC places importance on licensees having an effective corrective action program. A major aspect of the NRC's regulatory philosophy is that a licensee be able to effectively identify, evaluate, and resolve problems. This ability to address and resolve problems effectively is particularly important because it can directly affect a broad range of licensee programs and activities. To achieve an effective corrective action program requires a questioning attitude within the organization that encourages critical self-identification, quality and timely root-cause evaluations, and effective and comprehensive corrective actions that prevent recurrence of the problems. Licensees that have programs that do not embody these elements are frequently the subject of increased NRC scrutiny and enforcement because of the incidences of problems, many of which are self-revealing and recurring. As described below, the corrective action program at Millstone has been a chronic issue that contributed greatly to the extended shutdown of all three units. A significant element of the NRC staff's Restart Assessment Plan (RAP) has been a broad-based assessment of the licensee's new program and process for corrective actions. A particular emphasis has been placed on evaluating the effectiveness of its implementation.
Previous licensee self-assessments and NRC inspections had identified that Northeast Nuclear Energy Company's (NNECOs) corrective action program had been historicaly weak in the identification of problems and ineffective in ensuring comprehensive and effective corrective actions. There have been many instances of narrowly focused corrective actions that failed to encompass all aspects of the underlying problem. Additionally, in many instances, the licensee failed to follow up on corrective actions to ensure they were effective. A correlation also existed between the ineffectiveness of the corrective action program and the issues related to the handling of employee safety concerns and the SCWE at Millstone. An important element of an effective corrective action program is that workers are encouraged to raise issues willingly without fear of retribution or retaliation. Consequently, the RAP determined that the licensee's corrective action program was a restart issue.
NNECO initiated efforts to improve the corrective action program by adopting industry standards and processes and formalizing them in its procedure Report (RP) 4, "Corrective Action Program." This document describes a site-wide program which has been in effect since February 1997. The fundamental changes to the process that occurred as a result of the introduction of this procedure and the philosophy it represented included the lowering of the threshold level for reportable problems, management emphasizing the need for employees to identify problems, greater management involvement in the process, timely processing of operability determinations, development of performance indicators, training in root-cause analysis, and enhancement of the applicable tracking and trending programs. The licensee has continually improved the process as evidenced by the number of revisions made to the governing procedure, RP 4. In addition, in order to improve corrective action resolution on a broad basis, NNECO has established tracking systems for corrective actions that are not typically identified by a condition report (CR), e.g., operating experience, training, preventive maintenance, employee concerns, and engineering.
Management established a corrective action assessment program and developed performance indicators to monitor the corrective action program effectiveness. In addition, the Nuclear Oversight Organization developed its own program for assessing the quality of the corrective action program and has provided NNECO management with independent evaluations of several attributes of the corrective action process.
Overall, through substantial management involvement, the licensee has applied a significant amount of effort to establish a structural framework for the corrective action program. NNECO management has also clearly established its expectations that there should be a very low threshold for problem identification. The licensee has focused much of its efforts during the current shutdown on identifying issues, properly classifying their safety significance, performing quality root-cause evaluations, and implementing effective short- and long-term corrective actions.
In determining how to assess the licensee's performance in this area, the NRC RAP identified licensee activities that would be evaluated to obtain an integrated assessment of the licensee's corrective action program. Since the corrective action program touches upon many different licensee programs and activities, it was determined that inspection efforts had to encompass a wide variety of licensee activities. For example, inspection activities were focused on areas such as corrective actions for enforcement items, the Significant Items List (SIL), the deferred items list, issues identified from employee concerns, Independent Corrective Action Verification Program (ICAVP) findings, licensee self-assessments, commitments, LERs and degraded and nonconforming conditions. Examination of the corrective action program also included the review of the action requests (ARs) from the Action Item Tracking and Trending System (AITTS) program, which is the licensee's program that translates issues identified by CRs into specific corrective actions.
In order to judge whether the licensee achieved needed improvements in the corrective action process, the staff assessed the completeness of the licensee's corrective actions for each of the areas it inspected within the corrective action program. The inspection process examined the identification and processing of problems, the assessment and root-cause evaluation of the problems, the corrective actions that were implemented, and the process used to close the issues. The NRC also inspected the licensee's efforts to improve its self-assessment capabilities.
A significant input to the staff's assessment of the licensee's corrective action program was derived from the normal inspection program where valuable insights regarding the effectiveness of corrective actions are routinely collected from the technical safety inspections. Major contributions to measuring the effectiveness of the NNECO corrective action program for Unit 3 were also provided by (1) the NRC team inspection performed using inspection procedure (IP) 40500, "Effectiveness of Licensee Controls in Identifying, Resolving and Preventing Problems"; (2) the NRC ICAVP Oversight Branch assessments of the licensee's corrective actions for degraded and nonconforming conditions; and (3) an Operational Safety Team Inspection, which audited portions of the corrective action process during the course of its activities. In addition to the direct inspections of the NNECO corrective action program, the NRC performed an Inspection Report No. 50-245/336/423/97-212, of the employees concern program and safety-conscious work environment at the Millstone station.
This inspection, along with other staff activities assessing NNECO's SCWE, evaluated aspects of the licensee's corrective action programs regarding willingness of employees to identify safety issues and existence of a questioning attitude at Millstone station.
1.Routine Inspection Findings
Because of the low threshold for problem identification established by NNECO management, a large number of CRs were generated by the licensee's staff during the recovery process. To assess how well the licensee addressed these issues, the Special Projects Office (SPO) inspection staff concentrated on reviewing specific issues identified by the CR process and audited the licensee's corrective actions for completeness. The staff periodically selected additional CRs for review, based on the licensee's assigned level of importance, or the risk significance as determined by the resident staff. Additionally, other less significant CRs were examined to ensure that a spectrum of safety significant and risk issues were reviewed to gain a perspective of the overall application of the program. The intent of this approach was to primarily assess the corrective action program while appropriately focusing on the safety significant technical issues.
The NRC inspection staff selected issues that were being processed within the NNECO corrective action program and these were tracked as part of the RAP within Item 37 of the SIL. These items represented technical issues related to safety that were, in most cases, identified by NRC inspections that required closure by the licensee. Additionally, assessments were made of the licensee's corrective action program as part of the routine resident inspection process. Through its observations of the licensee's resolution of the technical issues, the NRC staff evaluated the technical adequacy of the corrective actions while assessing the effectiveness of the licensee's corrective action program. The staff found that, as time progressed from the initiation of the licensee's new corrective action program in early 1997, the quality of the closure packages, which were what the licensee submitted to the NRC to document its efforts to resolve the issues, improved. This improvement was noted in NRC Inspection Reports 50/423-97-02; 97-202; 97-203; and 97-207. Over the past 12 months, the staff's review of the corrective actions addressed by these packages determined that the licensee comprehensively addressed and resolved the identified issues.
Additionally, the observations and findings generated through the more routine inspection efforts of the resident inspectors noted the same improvement over time in the licensee's ability to address and resolve issues. In coming to this conclusion, the resident inspectors reviewed a number of licensee activities such as corrective actions for enforcement items, the deferred items list, licensee self-assessments, commitments, LERs, and degraded and nonconforming conditions.
2. 40500 Inspection Findings
The NRC team inspection performed from February 9 through 20, 1998, using IP 40500 inspection, "Effectiveness of Licensee Controls in Identifying, Resolving and Preventing Problems" was one of the primary means of doing an integrated examination of the NNECO corrective action program.
In conducting its assessment of management processes, the team noted that the licensee's reorganization of the company resulted in almost all of the director level positions being replaced with new personnel, some from outside of the company. This was done to correct the root-cause concern that had been identified by the licensee that NNECO management's operational standards were not commensurate with accepted industry practices. The replacement of the managers and directors was intended to infuse new thinking into the organization. A major area of emphasis of the new management was to emphasize a questioning attitude and to encourage employees to identify and bring forward problems. The impact of promoting these expectations resulted in a lowering of the threshold for problem identification and the subsequent resolution of these issues within the formally established corrective action program. Team interviews and observations indicated that the new management was also successful in opening the lines of communication between departments and between management and the workers. This opening of communications and establishment of a new trust between the workers and management is viewed by those interviewed as allowing the workers to freely identify problems with the expectation of it being corrected. The team's observations and interviews with individuals indicated that the work environment was improved, management was receptive to problem identification, and there was no reluctance or reservation expressed by individuals to identify problems. As an example of the effect of the lower threshold for problem identification, the previous program captured an average of only 300 items per year for Unit 3. Currently, CRs are being identified at a rate of approximately 4,000 items per year. The team determined that the threshold for identification of issues, reportability reviews, the assignment of severity level and corrective actions were generally timely and appropriate.
The revisions made to the corrective action program resulted in a multi-disciplined management review process, as well as imposing the requirement that the shift manager review discovered conditions for operability and reportability. The overall CR program was considered to be acceptable, though further improvements can still be made. The licensee's root cause analyses and implementation of corrective actions was determined to be effective and thorough, though some problems were noted. Also, the program lacked controls in situations where multiple CRs addressing concerns in similar areas were combined into one CR. The team noted an effective self-assessment and trending program, but due to the relative newness of the program, was unable to assess the licensee's efforts in performing an effectiveness review. In order to conduct such an assessment, as well as in recognition of the substantial management involvement needed to get the program to the point where it is functioning adequately, the historical problems with ineffective corrective actions that have existed at Millstone, and the need to assess how well the licensee is managing its deferred items list, the staff will perform another IP 40500 inspection within the next year. This inspection will be conducted to assess whether the program has continued to mature and effectively function following a period of routine plant operations.
As noted earlier, the team did find some problems with the licensee's handling of several CRs. The most significant team finding was for the inadequate root-cause determination and corrective actions for recurrent Boric Acid Transfer Pump problems. The reportability evaluations were incomplete, operating experience was not considered and a potential Unreviewed Safety Question resulting from a nonconservative Boric Acid Tank level TS was not identified.
The overall assessment by the staff is that the corrective action program is functioning and adequate to support restart. However, the identified weaknesses indicate that management attention will be required to continue making improvements to the program and to sustain the current adequate level of performance. As noted above, the staff will conduct another IP 40500 inspection within approximately 1 year to ascertain how well the program is functioning.
3. ICAVP Inspection
Over the period of April 13 - May 15, 1998, the NRC conducted the last of its ICAVP inspections on Unit 3. This team assessed the effectiveness and the appropriateness of the licensee's corrective actions associated with design issues raised by the NRC in its ICAVP-related inspections, the licensee in its configuration management plan, and Sargent & Lundy (S&L) in its ICAVP. Although this inspection report is not issued, the preliminary results were incorporated into the staff's overall evaluation of the corrective action program and are summarized below.
The scope of the NRC's ICAVP corrective action inspection includes reviewing (1) a sample of licensee corrective actions in response to issues self-identified during its Configuration Management Plan (CMP) (including items that were reviewed within the 15-system ICAVP review scope and items that were not in the scope of the ICAVP); (2) corrective action for all Confirmed Level 3 discrepancy reports (DRs) identified by S&L; (3) corrective actions implemented in response to findings identified during the NRC inspections associated with the NRC oversight of the ICAVP; (4) corrective actions for design-related LERs associated with the recirculation spray system (RSS); (5) the licensee's corrective actions taken in response to the RSS expansion bellows failure; (6) the corrective actions taken in response to the NRC-identified issues with Chapter 6.0 of the Unit 3 TS; and (7) the Integrated Functional Systems Review performed by the licensee in response to the NRC-identified potential for air binding of the charging and safety injection pumps.
At this time the ICAVP Corrective Action inspection is substantially complete. NRC IR 50-423/98-205 documents the results of the first 2 weeks of onsite inspection. The remaining onsite inspection will be documented in IR 50-423/98-211, following completion of the inspection. The SPO Inspection team will review the corrective actions for the remaining six ICAVP Significance Level 3 DRs currently identified and several other potential Level 3 DRs that are currently under discussion between the licensee and S&L that may be determined to be Confirmed DRs. In addition, the team will complete its inspection of corrective actions for several recently issued violations. NRC's verification that NNECO has completed implementation of corrective actions necessary to restore compliance with its design and licensing bases will be completed before restart of Unit 3. Nonetheless, a sufficient a number of issues have been reviewed to allow preliminary conclusions to be drawn based on what has been inspected to date. The team's conclusions at this time indicate that the licensee's corrective action program has been effective in resolving the issues identified by both the NRC and S&L as well as those that were self-identified by the licensee during its CMP and restoring compliance to the unit's licensing and design bases.
4. OSTI Inspection
From April 13 through May 5, 1998, an OSTI was performed at Millstone Unit 3. The NRC staff reviewed the Corrective Actions Program and subordinate procedures, Audit Reports, the Independent Review Team Report on the Effectiveness of Corrective Actions, the NRC IP 40500 Inpsection Team Report, and outstanding corrective action items. Interviews were conducted with members of the plant staff to ascertain the adequacy of training and understanding of the corrective actions program. The licensee's Management Review Team (MRT) and Management Review Council (MRC) proceedings were observed to assess the quality and effectiveness of the corrective actions program's Event Review Team (ERT) and root-cause investigations. The NRC staff evaluated completed root-cause investigation packages to assess the quality of root-cause determinations and the licensee's use of a structured methodology.
The NRC inspection found that the corrective action program has a low threshold for condition report (CR) identification, and initiation, and the plant staff has been adequately trained in implementing the corrective action program. The evidence for this lies in the total numbers of CR's submitted to the corrective actions program. The corrective actions program has demonstrated that it can successfully evaluate and prepare appropriate corrective action plans.
The NRC staff reviewed a sample of both ongoing root-cause investigations and completed investigation reports. As noted in the IP 40500 inspection, the NRC staff found the level of detail and analysis varied with the composition of the investigation teams.
Previously, the Corrective Actions Department conducted the root cause analyses, but is now in the process of supporting and mentoring other departments in performing departmental root-cause analyses. Although, the staff found some weaknesses in the licensee's application of methodologies for root-cause analyses, the root-cause determinations themselves appeared to be adequate.
The backlog of open CR and Action Item Trending and Tracking System (AITTS) items were reviewed for issues that should be addressed prior to plant restart. The NRC staff reviewed a sample of open CR's using AITTS to determine the appropriate level assigned to the CR's. All CR's reviewed were assigned at the appropriate level.
The NRC staff determined that safety significant issues were tracked to completion. The process used to establish deferrals for the backlog of open Unresolved Item Reports, Nonconformance Reports, and Engineering Work Requests was commensurate with the safety significance of the issue, and that no items were deferred that should be completed prior to plant restart.
Overall, the aspects of the corrective actions program reviewed during the OSTI support the observation that the corrective actions program has been greatly improved and is functioning adequately to support restart of Unit 3.
5. Safety-Conscious Work Environment (SCWE) Evaluation
During the period from December 8 to December 12, 1997, and January 5 to January 9, 1998, the NRC staff performed an evaluation of the Employee Concerns Program and SCWE activities at Millstone station. Staff also assessed licensee implementation of these program areas through onsite monitoring, assessment of performance indicators, and participation in NRC inspections. Integral to staff evaluation of Millstone station SCWE activities was its assessment of the licensee's programs for resolving safety issues raised in the line organization. Emphasis of staff assessments in this area was directed toward the attitudes of Millstone station staff on use of the corrective action program and timeliness of resolution of issues that were identified. Staff observations and interviews showed that managers and supervisors encouraged employees to identify problems. The staff found that plant workers considered management to be receptive to problems brought forward and individuals generally characterized the environment as improved and receptive to problem identification. Further, the staff found that NNECO had made progress in timeliness of completion of condition reports.
Staff observations and findings were consistent with the results of assessments of the NNECO corrective actions program made by the third-party organization specified by the NRC Order to oversee licensee implementation of SCWE program implementation. Little Harbor Consultants Inc. (LHC), the third-party organization overseeing NNECO SCWE activities, conducted structured interviews of NNECO and contractor personnel at Millstone regarding the safety environment. The results of the last survey, conducted in February 1998, showed improved awareness of expectations related to SCWE, improved willingness
of the workforce to raise concerns, and improved confidence in the site's Corrective Action Program. LHC also performed an assessment of NNECO's corrective actions program and found the program and its implementation performing acceptably and supporting a SCWE.
The NRC staff examined the NNECO corrective action program for the identification and processing of adverse conditions to quality, the assessment and root-cause evaluation of those conditions, and the identification and implementation of the corrective actions. The staff also observed NNECO management's involvement in the process to ascertain its role in establishing and communicating appropriate expectations, standards and overall support to the program.
It is evident from the inspection record and the licensee's performance indicators that an appropriately low threshold exists at Millstone Unit 3 for the identification of adverse conditions to quality. There has been an order of magnitude increase in the number of CRs written since the implementation of the new corrective action program and the raising of management expectations and standards. NNECO management has effectively communicated these new standards to the working staff such that problems are being identified and placed in the corrective action program for resolution. Additionally, the overall process has proven capable of producing adequate results, albeit with substantial management involvement and oversight.
While the NRC has determined that the assessment and root-cause evaluation process is functioning adequately to support restart of Unit 3, it is still maturing and warrants continued management oversight. The staff found that the licensee was, in general, effectively assessing root causes and assigning the proper corrective actions. In a few instances, the NRC staff found that the licensee did not identify associated proximal causes and, in one case, the licensee missed the actual root-cause and failed to take effective corrective actions to prevent air binding of the boric acid transfer pumps. Overall, the NRC staff believes the assessment and root-cause evaluation portion of the licensee's corrective action program is effective.
The NRC staff noted problems with corrective actions not being thorough in the early stages of recovery, during 1996 and early 1997, and discussed this in the Inspecton Report 96-04 cover letter. As the effects of the recovery process and increased management attention and oversight positively impacted the work practices of the licensee's staff, the NRC found that assigned corrective actions were, with some exceptions, complete and appropriately addressed the problem. Currently, examples of completely missed root causes are few, and thus, the staff believes the corrective action process will support safe operations.
Though its observations to date indicate that the licensee's corrective action program is adequate to support restart of Unit 3, the effectiveness of the corrective action program can be more completely assessed by evaluating long-term performance, including the degree to which recurring problems manifest themselves over time. In view of this and the licensee's historical problems in maintaining an effective corrective action program, the need to assess the program
after the plant has been in a more normal mode of operation for a period of time, and to examine its efforts in addressing the deferred items list, the effectiveness of the corrective action program will be assessed in about one year by doing another team inspection using IP 40500 inspection.
As a final check included in the staff's restart evaluation of a plant that has been shutdown for an extended period of time to address substantial programmatic, technical, and/or safety issues, the staff conducts an inspection to verify that plant operations are being conducted safely and in conformance with regulatory requirements. Selected portions of NRC Inspection Procedure 93802, "Operational Safety Team Inspection," provide the framework for a team inspection of the pertinent issues. Elements of the inspection include operations, maintenance, surveillance, management oversight, technical support, safety review, quality assurance, and corrective actions. Additionally, the inspection is intended to verify that the licensee has properly prepared its staff and the plant for resumption of power operations.
The objective of the OSTI was to provide current information to the Restart Assessment Panel by evaluating the readiness of plant hardware, staff, and management programs to support a safe restart and continued operation of Millstone Unit 3. The OSTI was an intensive 2 week inspection activity conduct at Millstone Unit 3 during April 13-24, 1998. In addition, selected plant evolutions and activities were observed by various OSTI team members in the two months prior to the inspection. 14 inspectors were selected from all 4 NRC Regional Offices, NRR, AEOD, and SPO. The team monitored licensee activities during plant transition between Modes, both during normal and off-normal work hours. This inspection represents over 1 person-year of direct inspection effort. The OSTI performed an independent, broad scope assessment in four areas: management programs and oversight, operations, engineering and technical support, and maintenance and surveillance. The team's observations and assessment of each of these areas is contained below.
1.Management Programs and Oversight
(A) Management Processes
Appropriate standards and expectations for safety were established by senior management and were understood by subordinate managers and staff. Management's planning and direction for the restart and recovery of Unit 3 were effective, but planning and direction for post-restart activities were incomplete. Effective leadership was provided and management involvement in routine activities and emerging issues was adequate. Staffing was adequate for recovery and restart. The application of probabilistic risk assessment (PRA) insights to design and operation of the plant were adequate with one exception being the lack of risk assessments for removal of equipment from service during transitional modes of operation. This deficiency was adequately addressed by the licensee during the OSTI. Responsiveness to employee concerns, observed during the OSTI, was appropriate. Integration of quality assurance into the line organization was effective.
Management's expectations for safe plant operations were understood and followed. Senior plant management used a variety of effective means to reinforce expectations. Where expectations for communication or teamwork were not being met, plant management took appropriate and timely actions to correct the weaknesses and reinforce expectations.
(B) Corrective Action Program
The overall corrective action program was adequate to support plant restart. The threshold for including identified plant deficiencies in the corrective action program was low and a timely resolution of safety significant issues were generally being met. The team concluded that the root-cause evaluations reviewed identified appropriate causes. Issues that should be addressed prior to restart were identified and being tracked for completion.
(C) Self-Assessment Programs
The team concluded that the self-assessment programs are functioning well and are identifying and dispositioning issues which affect plant and personnel performance. The self-assessments were timely and self-critical. Management oversight ensured corrective actions initiated by the self-assessments were taken in a timely manner.
Self-assessment performance indicators prepared by the line organization were generally consistent with those prepared independently by the Nuclear Oversight organization and were consistent with NRC inspection findings.
(D) Independent Oversight
The Nuclear Oversight Restart Verification Plan provides effective independent assessment and performance measures for resolution of the Key Issues. The Nuclear Oversight Organization's involvement in operations, maintenance/surveillance and engineering has been satisfactory.
The Nuclear Oversight Organization's reporting mechanisms provide an effective means of capturing conditions adverse to quality and ensuring that those conditions were corrected. The reports reviewed by the team appeared to be adequately critical assessments and provided senior management with a useful "snapshot" of plant performance and areas requiring additional attention.
The startup support organization did not provide effective plant safety oversight during two events that occurred during plant heatups. The licensee independently reached a similar conclusion and took corrective actions to improve the Startup and Power Ascension Plan.
(E) Quality Review Committees
The conduct of the Plant Operations Review Committee (PORC), Site Operations Review Committee (SORC), Nuclear Safety Assessment Board (NSAB) were found to satisfy requirements. There are no outstanding PORC or SORC items that would adversely affect plant restart. The NSAB was providing effective independent oversight of plant operations.
(F) Training Programs
The overall implementation of the systematic approach to training for the technical training programs has improved and is adequate to ensure continued qualification of technical and non-licensed personnel.
2. Operations
(A) Operational Events
Two operational events occurred during the initial plant heatup. The events were an inadvertent opening of a pressurizer power operator relief valve and an automatic initiation of the auxiliary feedwater system caused by a low-low steam generator level. There were also three failures to meet Technical Specification requirements including: (1) not having the required number of operable reactor coolant system loops while in Mode 4; (2) the failure to record pressurizer temperature data during a plant heatup; and (3) the failure to complete a conditional surveillance requiring a dilution path valve alignment check with one shutdown monitoring channel out-of-service. While there were no safety consequences as a result of these events, the performance by plant operators during the initial plant heatup evolutions was weak.
The team conducted an independent evaluation of these events. The team determined that these events indicated weaknesses in several areas. These areas include operator knowledge, attention to detail, procedural adherence and control board awareness. The licensee initiated an Event Review Team (ERT) to evaluate these events. Based on the ERT findings, several corrective actions were taken including additional classroom and simulator training, re-enforcement of management expectations regarding the safe plant operation, a mentor for one Unit Shift Supervisor, and more clearly defined oversight responsibilities for the Startup Duty Manager. The licensee identified several causes for these events and implemented effective corrective actions. The team observed the effective implementation of many of the short-term corrective actions during the inspection. The OSTI did not observe similar weaknesses in operator performance during the subsequent plant evolutions observed. The staff will review the licensee's remaining corrective actions, including those required for restart.
(B) Conduct of Operations
During the periods of direct team observation, the licensee safely operated the plant. Operation's staffing levels were adequate. Operator log keeping was adequate; however, in two instances, incomplete logging contributed to operational events. Operator threshold for identifying deficiencies was generally good with a few exceptions noted.
(C) Procedures and Procedure Adherence
The quality of plant operating procedures was determined to be good. With a few exceptions, the procedures reviewed by the team were technically accurate and provided an appropriate level of detail. Risk significant operator actions were adequately proceduralized. However, the team identified two instances where the administrative control of procedures was not in accordance with TS. In one case, a procedural deficiency was a contributing cause to missing the TS requirement to have two operable reactor coolant system loops in Mode 4. The licensee took effective corrective action to address these issues prior to the conclusion of the OSTI.
While operators were found to generally adhere to procedures, the team identified a few exceptions where procedures were not followed. In one case, the failure to follow the procedure resulted in the inadvertent opening of the pressurizer power operated relief valve (PORV). During the OSTI, plant management reinforced their expectations for procedural adherence with plant operators.
(D) Operator Training
Requalification training was determined to be adequate to support plant restart. Each licensed operator was current in completion of requalification training and had passed required exams and evaluations. Operations management was effectively involved in training. A weaknesses in operator knowledge was noted as a cause for the failure that resulted in opening the PORVs. The licensee conducted focused training for all licensed operators to address this knowledge deficiency. Fire Brigade staffing and training were adequate.
(E) System Alignments
The team identified several problems with the administration and control of plant equipment configuration program. These problems included components not properly aligned, problems in the valve and breaker lineup process, and deficiencies in the locked valve program. It was concluded that certain corrective actions to address these deficiencies should be completed prior to plant restart. The staff will review the applicable corrective actions prior to restart.
The team determined that the safety tagging process was adequate and functioned as designed to improve personnel and equipment safety. The relatively few existing operator work-arounds and control room deficiencies did not impact safe operation of the facility.
(F)Command and Control
The quality of command and control was found to be generally good. Shift turnovers were typically comprehensive. The quality of pre-briefs varied with most being comprehensive. Operators were generally cognizant of plant conditions and control room annunciators. Operators appropriately controlled access to the control room.
Operations management was actively involved in operation activities. Plant support to operations was generally good.
3. Engineering and Technical Support
(A) Plant Modification Program
The plant modification program was appropriately controlled and implemented. The team found the design control process provided a detailed and comprehensive method for implementing plant design change activities. Modification package content, including the screening and safety reviews, were generally appropriate. Post-modification testing appeared to encompass verification of important design change attributes. The licensee had adequate commercial grade dedications and item equivalency evaluation like-for-like equipment replacements) programs in place to support plant restart.
The number of installed temporary modifications (TMs) was low and plans existed to further reduce the number of TMs. The TM process provided adequate controls to ensure that TM installation would not adversely impact plant operation.
(B) Plant Technical Support
The Engineering and Technical Support Departments were providing timely and effective support to the line organizations. The engineering department appeared to manage the day-to-day work activities well. Daily prioritization at morning meetings and by the management review team (MRT) appeared to set appropriate priorities for system and design engineering resources. The technical support organization was observed to provide good support for emergent plant hardware failures by leading Event Review Teams (ERTs).
The use of the condition reports (CRs) to document issues needing engineering evaluation appeared to be appropriate. A review of the CRs which remained opened determined that the CRs had been properly screened and no additional items were identified as needing resolution prior to restart. The System Readiness Reviews completed by Technical Support Department were comprehensive and did an effective job in identifying issues requiring resolution prior to restart.
The team conducted several safety-related system walkdowns and discussed the system status with the appropriate system engineers. The team found the system engineers were knowledgeable and the material condition of plant equipment was generally good.
The team also reviewed all open operability determinations finding them generally well developed and providing adequate justification for operability of the degraded condition.
(C) Engineering Programs
The team noted that the licensee was making improvements in several engineering administered programs such as setpoint control, operational experience reviews and vendor manuals. The setpoint control process appears to be adequate and meets industry standards. The operating experience program was functioning adequately to support restart. The licensee has initiated efforts to maintain the accuracy of vendor manuals and is taking appropriate actions to upgrade the key safety-related manuals and review affected procedures prior to restart.
Nuclear oversight and engineering self-assessment activities including engineering assurance provided good observations to improve performance.
4. Maintenance and Surveillance
(A) Plant Material Condition
Generally, overall plant material condition was good. The housekeeping practices and equipment storage were observed to be good. The team determined that processes were in place to maintain a satisfactory level of plant material condition. The backlog of open maintenance work activities is trending down, has been prioritized, and the overall impact on operations was assessed and found to be acceptable.
(B) Preventive Maintenance
The Preventive Maintenance (PM) Program was determined to be acceptable. However, the team noted a few minor deficiencies in the PM program that the licensee addressed during the inspection.
(C) Conduct of Maintenance Activities
The team concluded that procedure adherence by the maintenance staff was excellent. Several instances where work was stopped to clarify or revise maintenance procedures. The maintenance workers were knowledgeable of assigned maintenance tasks and had received appropriate training. Maintenance supervisory oversight in the field was strong. The Fix-It-Now (FIN) team had a positive impact on handling emergent work and automatic work order (AWO) backlog.
(D) Planning and Scheduling
The adherence to plant schedules has been poor. On average, 60 percent of work orders on the 3-day look ahead schedule were started and 54 percent were completed on schedule. The scheduled dates for achieving major milestones, such as mode changes, were rarely met. The difficulty in meeting schedules was attributed to several factors including emergent issues, inability to identify work scope, and lack of accountability to meet schedules. The use of the 12-week rolling schedule should help improve planning and scheduling performance.
The team did not find examples where inefficiency in planning and scheduling resulted in degradation of safety system performance. In fact, the team concluded that the material condition of safety-related systems was generally good. The corrective maintenance automatic work order backlog has been reduced to manageable levels and is nearing the licensee's restart goal of 500 open work orders. The team also did not observe non-conservative decisions by plant management for the purpose of meeting plant schedules.
(E) Surveillance Testing
The surveillance testing program was adequate to support plant restart. The team concluded that the surveillance test procedure quality was adequate. Tests required for restart have been defined and satisfactory progress is being made to complete these tests.
The OSTI findings are one input of many to be used by the RAP in making a restart recommendation to the Commission. The OSTI has determined that plant hardware, staff and management programs at Millstone Unit 3, are ready to support a safe plant restart and continued power operation. This conclusion recognizes that prior to restart, the licensee must complete, and the NRC will assess corrective actions resulting from the OSTI findings regarding operator performance and system valve alignments.
|
Privacy Policy |
Site Disclaimer |