ML20072K427
| ML20072K427 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 07/01/1983 |
| From: | Tucker H DUKE POWER CO. |
| To: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE) |
| References | |
| RTR-NUREG-0737, RTR-NUREG-737, TASK-1.C.6, TASK-TM NUDOCS 8307060275 | |
| Download: ML20072K427 (21) | |
Text
he-,... O 4
DUKE POWER GOMPANY P.O. nox 33180 CHAMLOTTE, N.C. 28242 II AL IL TUCKEli TELEPHONE vara emessare n (704) 373-4531 July 1, 1983 mu... ar==.
Director Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission Washington, D. C. 20555
Subject:
Oconee Nuclear Station
. Docket Nos. 50-269, -270, -287
Dear Sir:
By letter dated June 2, 1983, the NRC transmitted a Notice of Violation and Proposed Imposition of Civil Penalties for violations reported in Inspection Reports 50-269/83-11, 50-270/83-11, and 50-287/83-11. This letter contains the Duke Power Company response to both of these documents. A summary response to the Notice of Violation is provided in the following paragraphs with additional details provided in Attachment 1.
Also included herein is a summary discussion of the corrective actions that Duke took following the air lock incidents with additional details provided in Attachments 2 and 3.
Duke is also providing comment on the manner in which the Enforcement Policy has been implemented by the NRC in this matter.
Finally, Duke is providing a response to the proposed civil penalty with additional details in Attachment 4.
Within the Notice of Violation, the NRC asserts in Violation A that two incidents related to containment air locks occurred which were the result of failure to implement the requirements of NUREG-0737, item I.C.6, " Guidance on Procedures for Verifying Correct Performance of Operating Activities", into procedures.
Duke Power admits that the incidents occurred; however, Duke denies that their occurrence was caused by a lack of implementation of independent verification as asserted by the Staff.
The first incident was caused by an inadequate test procedure which failed to contain instructions to close the test valve upon completion of the test.
The second incident was caused by inadequate procedures and instructions on the operation of the air lock doors and failure of Control Room personnel to effectively evaluate the alarm.
These two incidents were unrelated to independent verification of the actions taken.
Furthermore, these incidents were only violations of the Technical Specification definition of containment integrity and did not conatitute physical breach of containment.
The NRC asserts in Item B of the Notice of Violation that Duke Power had not reviewed procedures to assure correct performanceof cperating activities as required by NUREG-0737 Item I.C.6 and NRC Confirmatory Order dated July 10, l
1981. Duke maintains that the record in this area does not support the NRC l
. assertion and denies this violation in total. As early as May 1979, Oconee
(
. personnel recognized the need for independent verification and started then to implement a program. The station directive which implements independent verification was initially established in February 1980.
The NRC in Inspection Report 50-269/81-10, 50-270/81-10 and 50-287/81-10 dated May 10, 1981 and in an NRC letter dated November 2, 1981 reviewed and found this program to be f(
8307060275 830701 PEWt AD(>CK 05KF00269 j1 0
6 Director Of fice of Inspection and Enforcement July 1, 1983 Page 2 acceptable for implementation of 1.C.6.
To assert now that this program is not in compliance is wholly unjustified. Details supporting our position on these violations arc provided in Attachment 1.
Following these two air lock incidents, Duke took prompt and aggressive action in several areas. These actions were discussed in detail with the NRC Staff, and detailed written information was provided to the NRC Staff well before the Notice was issued. However, the Notice fails to acknowledge either the actions taken or the communications.
These corrective actions were designed to address the specific causes of each incident as well as to review operating activities at Oconee. The review of procedures was expanded from those affecting only containment to include operating activities of the entire station.
- Further, the process by which station modifications are designed and processed was reviewed. Also, station directives were reviewed to assure compliance with applicable regulations and corporate requirements.
Finally, Duke established a Management Audit Team to specifically review operational activities at all of our nuclear stations. Additional discussions of these areas are provided in and in a copy of our letter dated April 29, 1983 (Attachment 3).
The Staff alludes to an incident which occurred in March 1982 for which a previous civil penalty was imposed.
That incident was a result of a personnel error in that a test-tee cap was not replaced on an instrument line following surveillance. Although the surveillance program had been very successful in the Instrumentation and Electrical (I&E) area in returning thousands of components successfully back to service, a personnel error created the incident wherein an instrument test-tee cap on a Reactor Building pressure switch was not reinstalled following testing. This resulted in procedural upgrades to properly identisy those specific items required to be executed and verified to assure proper return to service of the components.
Following a Station Manager requested QA audit in mid-1982, additional procedural improvements were made.
These included minor clarifications of actions necessary to assure proper removal or return to service. The corrective actions recently taken are different than those that were indicated necessary by this earlier incident.
The NRC letter of June 2, 1983 proposing civil penalty asserts that these actions were insufficient in that actions should have been taken that would have prevented the two incidents related to the containment air locks.
On the contrary, based on the fact that the program Duke had in place to implement independent verifica-tion had been found by the NRC to be acceptable, the fact that the test-tee cap incident was limited to testing of instrumentation, and that all other mechanical and electrical systems were being independently verified, no further corrective actions were warranted.
In fact, the review of procedures that was conducted following the air lock incidents identified only nine procedures of approximately 2,500 in place on January 1, 1981 where implementation of independent verification appeared to be deficient. The three operations procedures relate to electrica'l power distribution.
Five of the sin performance procedures relate to containment air locks; the sixth dealt with electrical penetrations.
These procedures were
F b
Director Office of Inspection and Enforcement July 1, 1983 Page 3 not originally considered to be covered by our interpretation of independent verification as confirmed by NRC acceptance of Station Directive 4.2.5.
The original station directive addressing independent verification, which was reviewed and found acceptable by the NRC, did not include operations associated with air lock doors. Considering the number of procedures involved and the fact that only nine procedures warranted changes, and that the causal factors in none of the incidents resulted from lack of independent verification, Duke does not consider that the Staff assertion of insufficient corrective actions is justified.
Duke believei that a misunderstanding of the facts exists and NRC has reached.
incorrect cc1clusions as a result. However, even assuming the facts were as the NRC reptesents them to be, the NRC has misapplied its Enforcement Policy with respect to the facts. First, the Staff has deviated significantly from its past practice of identifying the underlying cause of an alleged violation and assessing a civil penalty based on that underlying cause.
Second, the Staff improperly increased the base civil penalties in this case. Third, the alleged violations were miscategorized as Severity Level III.
Lastly, the civil penalty proposed in this enforcement action is inconsistent with that proposed in a previous analogous enforcement action. Therefore, we respectfully urge that the proposed civil penalty be mitigated as set forth in Attachment 4 to this letter.
The Enforcement Policy is designed to assure that the Staff and licensee focus on the underlying causes of alleged violations.
In this regard, the Policy states as follows:
[T]o emphasize the focus on the fundamental underlying causes of a problem for which enforcement action appears to be warranted, the cumulative total for all violations which contributed to or were unavoidabic consequences of that problem will generally be based on the amount shown in [the Table of Base Civil Penalties], as adjusted.1 In previous enforcement actions the Staff has generally applied this provision by identifying the underlying area of concern (e.g., failure to-follow procedures, management weakness, or programmatic weakness), identifying the alleged violations of NRC requirements resulting from the underlying area of concern, ar.d proposing a cumulative civil penalty derived from Table 1A and 1B of the Enforcement Policy.
Importantly, the cumulative civil penalty has been distributed among each of the specific violations linked to the specific area of concern.
1 47 Federal Register at 9992.
r a
Director Office of Inspection and Enforcement July 1, 1983 Page 4 For example, on March 29, 1983, the Staff proposed a $40,000 civil penalty against Philadelphia Electric for alleged violations of three plant Technical Specifications governing radiation protection at Peach Bottom. The Staff identified seven specific alleged violations of plant procedures, all of which according to the NRC stemmed from the same problem area, viz., the need for increased management attention in the implementation of the licensee's radiation protection program and an apparent lack of commitment by station personnel to adherence to radiation protection requirements.
Because the alleged violations stemmed from the same problem area, a single civil penalty of $40,000 (derived frma Table 1A and Table 1B) was assessed for all seven of the alleged violations. 2 Similarly, in another enforcement action involving the Nebraska Public Power District, the NRC Staff imposed a single civil penalty for three alleged material false statements (as opposed to imposing a separate civil penalty for each of three material false statements) upon concluding that the three statements were the result of a single underlying problem.
In doing so, the Staf! expressly recognized that the Enforcement Policy "provides that a single cumulative civil penalty will generally be assessed for similar violations stemming from the same fundamental cause."3 The civil penalty proposed against Duke in this case is inconsistent with these prior enforcement actions and with the Enforcement Policy itself.
First, the NRC Staf f identified (erroneously we believe) a single underlying cause for both violations, viz., failure to provide a satisfactory method of verifying operability of a system after maintenance. However, rather than proposing a single cumulative civil penalty for the two violations stemming from this underlying problem, it proposed a single civil penalty for each of the violations.
Moreover, it then proposed a separate, additional civil penalty for the under-lying problem itself. LAt bottom, this treatment of the alleged violations marks a radical departure f rom prior applications of the Enforcement Policy and is inconsistent with the overall thrust of that policy.
Second, Duke Power Company believes that the NRC Staff improperly increased the base civil penalty for each of the three alleged violations it identified.
Specifically, the Enforcement Policy provides that a base civil penalty may be increased by 25 percent for failure to implement previous corrective action and for prior notice of similar events. While we recognize that the Staff believes (again erroneously) that Duke failed to implement corrective action, the NRC did far more than increase the base civil penalty by 25 percent for each 2
See Philadelphia Electric Co.
(Peach Bottom Atomic Power Station, Units 2 and 3); Docket Nos. 50-277, 50-278; EA No. 82-7; March'29, 1983 Notice of Violation and Proposed imposition of Civil Penalties.
3 February 18, 1983 letter from Richard C. DeYoung, Office of Inspection and Enforcement, U. S. Nuclear Regulatory Commission to Mr. C. Jones, Assistant General Manager, Nebraska Public Power District at 1.
J t
r O
Director Office of Inspection and Enforcement July 1, 1983 Page 5 of the alleged violations in this case.
It also proposed an entirely separate civil penalty for Duke's alleged failure to implement such action. No basis is given in the Notice of Violation of Proposed Imposition of Civil Penalties to justify what amounts to this double escalation of the base civil penalty for each of the alleged violations.
Similarly, no justification is provided for increasing the base civil penalty for each of the alleged violations by an additional 25 percent for prior notice of similar events. First, the Enforcement Policy defines prior notice of similar events as " prior knowledge of a problem as a result of a licensee audit, or specific NRC or industry notification, and [ failure] to take effective preventive steps." Two of the three bases relied upon by the Staff in its proposed action against Duke clearly fall outside this definition. They include the enforcement conference and the Order Imposing Civil Monetary Penalties referenced in the Staf f's June 2,1983 letter, both of which (if relevant to this enforcement action) should fall within enforcement history and not prior notice of similar events.
Second, the Staff has not justified its reliance on NUREG-0737 as a basis for applying the additional 25 percent step-up for prior notice of similar events.
As indicated above, an entirely separate civil penalty was proposed for what the Staff believed was Duke's failure to satisfy TMI-related issues. Again, no basis is given to justify this multiple increase in the proposed civil penalty.
Duke next believes that the Staff mischaracterized the alleged violations in this case as Severity Level III.
In fact, the alleged violations should have been characterized as Severity Level IV in that they have minimal, if not minor, safety significance. The basis of this conclusion is provided in the attachments of this letter.
Finally, the proposed civil penalty in this case is simply inconsistent with another civil penalty proposed only eleven days later by Region I against Philadelphia Electric.
In that proceeding, the Staff proposed a $40,000 civil penalty for a three day breach of containment. The alleged violation occurred following the alleged failure of a technician to properly implement surveillance test procedure, thereby negating an administrative control in that procedure which required an independent verification to assure that affected equipment was returned to normal configuration. As the Staff recognized, this was the second failure of Philadelphia Electric to maintain primary containment integrity resulting from a failure to follow procedures, and it was the second civil penalty since March 29, 1983 proposed as a result.
We can find nothing in the record to justify the totally inconsistent approaches towards virtually identical alleged violations of NRC requirements in these two cases. We recognize that every enforcement action depends on the factual allegations raised by the Staff and that the Staff has the discretion to tailor e
a Director Office of Inspection and Enforcement July 1, 1983 Page 6 its proposed enforcement action to the facts in each case. However, Duke believes that in its case the Staff has adopted an enforcement posture totally at odds with both its past practices and the express language of the Enforcement Policy. Our view, we believe, is confirmed by the June 13 enforcement action taken against Philadelphia Electric. Accordingly, as a matter of law, we respectfully request that the proposed civil penalty be mitigated as set forth in Attachment 4.
In addition to the previous concerns stated, Duke would like to address the tone and character of the NRC letter proposing the civil penalty.
The purpose of our conference on April 19, 1983 with the NRC and our submittal of April 29, 1983 was to present all the relevant facts.
In this case, the NRC simply did not acknowledge these actions that were taken. Duke considers itself to be one of the most responsive and capable nuclear utilities in the country, and as such, is most disturbed by the NRC charges of failure to meet commitments and to take effective corrective action.
The NRC has stated:
1.
[Y]ou have a prior history of similar violations with the same causal factor.
2.
[Y]ou had prior notice of problems of a similar nature and failed to take effective actions to avoid future occurrences.
3.
[Y]ou clearly had sufficient information available so you should have known these violations existed.
The incident related to a missit.g test-tee cap which resulted in a civil penalty in 1932 was not at all related to the recent emergency air lock incidents. They were the results of different causes and required different corrective actions to prevent recurrence. To characterize these events under the umbrella require-ment of independent verification is totally unfounded and indicative of a lack of cogent definition of acceptable independent verification by the NRC.
It, taken together with the proposed enforcement action against Philadelphia Electric, also is another example of the lack of consistency in the NRC's application of its Enforcement Policy.
Duke would like to specifically address three points made by the NRC on page 2 of the letter proposing civil penalty. First, contrary to the NRC's assertions, the histories of containment violations were not results of the same causal factor. A detailed investigation of each incident resulted in different corrective actions.
In the March 1982 event, specific steps were added to instrument procedures to assure complete restoration. At the time of the incident, a total review of all station procedures was not considered warranted.
Following the first air lock incident, procedures for dissemination of completed modification information were revised to provide a broader scope of procedure review.
In the second air lock incident, the controlling procedures for all air lock surveillance were revised.
The causal factor here was inadequate personnel training.
Independent
o Director Office of Inspection and Enforcement July 1, 1983 Page 7 verification by the other personnel at the air lock and by Control Room operators was ineffective. Based on a review of approximately 2,500 station procedures, a total of only nine required some change to incorporate independent verification.
Second, with respect to the prior notice of problems of a similar nature, Duke's position is that the prior incidents alluded to by the Staff were not of a similar nature.
Each was responded to in an aggressive manner that addressed the specific causes of each incident.
In view of the acceptable reviews that had been previously completed by both Duke and the NRC, no other actions beyond review of instrument procedures were considered necessary.
And third, contrary to the NRC's allegations, sufficient information was not available to know that these violations existed prior to their discoveries.
Air lock testing is conducted routinely every three months on all three units.
The personnel involved in these two incidents had previously completed the testing satisfactorily several times and the routine testing has been reviewed by the NRC Resident Inspector.
In the first incident, the valve that was open has no remote indication and is only operated during test.
In the second incident, the Control Room indications were considered to be invalid as door "open" indications were noted during a 60 psi air test when the doors were known to be shut. A work request was written to check the indication and the alarm was tagged out of service. As soon as the incidents were discovered by Duke personnel, prompt and aggressive actions were taken. The results of the reviews conducted indicated that these incidents were isolated events and were not indicative of programmatic failures. Duke would also point out that these points were specifically addressed in the enforcement conference and in our April 29, 1983 letter. Based on the above discussion, Duke believes that the specific language quoted above is not justified.
In this proposed civil penalty the NRC is regulating by reviewing adequacy of implementation after the fact, and has essentially stated that all previous reviews of independent verification and applicable station documents are invalid because incidents occurred that should have been prevented by proper implementa-tion of independent verification. The stated intended purpose of Action Plan Item I.C.6 is to reduce human error and to improve the quality of normal operations.
It was never intended, and in a practical manner it is impossible, to achieve zero human errors. To propose a civil penalty in this case based on two incidents of minimal safety significance and alleged improper implementation of independent verification is wholly unjustified and is not based on explicit review of the pertinent events.
In conclusion, Duke discovered each incident, took immediate corrective measures, and developed and executed a multi-point program to determine fundamental causes.
Duke Power admits alleged Violation A, but denies that bases exist for the escalation of both items of Violation A and denies wholly Violation B and its escalation. Duke Power considers that the incidents that occurred were of i
o Director Office of Inspection and Enforcement July 1, 1983 Page 8 minimal safety significance and were not the result of lack of independent verification. Duke also considers that the requirements of Action Plan Item I.C.6 were correctly implemented and previously found acceptable by the NRC.
Finally, Duke considers that detailed information on prompt aggressive corrective actions taken by Duke and presented to Region II on April 19, 1983 and by letter dated April 29,1903 was not included in the NRC review associated with these alleged violations.
Duke objects to the proposed civil penalty on the basis that it is unjustified. Duke also objects to the NRC characterization of the actions that have been taken in response to these and other incidents and recommends that the NRC statements be revised or modified to eliminate inappro-priate interpretation of the facts and to accurately reflect all information relevant in this matter. This relevant information includes at a minimum the previous NRC approval of the Oconee independent verification program as well as the significant actions that were properly taken following the March 1983 air lock incidents.
Duke requests that the proposed civil penalty be fully rescinded.
Very truly yours, l
d4 4-
/Hal B. Ibcker RLG/php Attachments (4) cc:
Mr. James P. O'Reilly, Regional Administrator U. S. Nuclear Regulatory Commission Region II 101 Marietta Street, NW, Suite 2900 Atlanta, Georgia 30303 Mr. J. C. Bryant NRC Resident Inspector Oconee Nuclear Station Mr. John F. Suermann Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C. 20555
O OIE/RLG July 1, 1983 (Al)
Duke Power Company 4
Oconee Nuclear Station Response to Notice of Violation IE Inspection Report 50-269/83-11, 50-270/83-11, 50-287/83-11 Violation A.
Technical Specification 3.6.1 requires that containment integrity be maintained whenever reactor coolant system (RCS) pressure is greater than 300 psig and temperature is greater than 200*F.
Technical Specification 1.7.a defines containment integrity, as I
related to the emergency hatch, to exist only when both doors are closed and sealed except during refueling or personnel passage through the hatch.
1.
Contrary to the above, on March 17, 1983, a test valve was open on Unit 3 emergency hatch, effectively defeating the closing and seal of the outer hatch door. The unit was operating with reactor coolant pressure at greater than 500 psig and temperature greater than 200*F.
This is a Severity Level III violation (Supplement 1)
(Civil Penalty - $60,000) 2.
Contrary to the above, on March 21, 1983, the inner door I
on Unit 1 emergency hatch was open. The unit was operating l
with reactor coolant system pressure greater than 300 psig and temperature greater than 200*F.
This is a Severity Level III violation (Supplement I)
(Civil Penalty - $60,000)
Response to Violation Al
- 1) The alleged violation is admitted.
- 2) The reasons for the violation were as reported in Licensee Event Report R0-287/83-04 dated April 15, 1983 and in a supplemental letter from H. B. Tucker (Duke Power Company) to J. P. O'Reilly (NRC/ Region II) dated April 29, 1983.
-On March 17, 1983 at 0200, while preparing to perform the quarterly Reactor Building (RB) Emergency Lock Leak Rate Test, Oconee personnel discovered that air was leaking from the Unit-3 RB Emergency Personnel Air Lock Hatch (EPAL) pressurization connection valve. The valve does not connect into the Reactor Building but into the EPAL.
The valve is a containment isolation valve but was found to be open. The cause of this occurrence was personnel error.
In July 1981, a modification added the subject
a OIE/RLG July 1, 1983 (A1) valve on the 3/4 inch line extending from the Emergency Air Lock outside end.
In the process of modification review, one step is to check for necessary procedure changes. The procedure for the Leak Rate Test on the EPAL was not changed to specifically include the valve.
The procedure stated to " pressurize the hatch volume",
requiring the pressurization valve to be opened. The procedure stated " remove test equipment", for which in past tests the pressurization valve was closed.
In this case, the valve was.left open.
The cause of this event was the failure to review and revise the controlling test procedure following the modification to add the pressurization connection valve.
This conclusion on cause is consistent with that reported by the NRC Resident Inspector in Inspection Report 50-269/83-11, 50-270/83-11, 50-287/83-11. While it is agreed that a violation of the Technical Specification addressing containment integrity occurred, the safety significance was minimal. The NRC's conclusion that independent verification on the procedure would have prevented the incident is unjustified. Unless the specific valve was listed on the procedures, independent verification would not have prevented the incident.
- 3) Upon discovery, the pressurization valve was closed.
The RB Emergency Lock Leak Rate Test was successfully completed on March 17, 1983. Units 1 and 2 pressurization valves were verified closed. Revisions have been made to the procedures for the Leak Rate Test and the 0-ring Test for emergency and personnel hatches.
These changes require a procedural step to close the pressurization valve upon test completion and to independently verify the valve closed. Personnel involved have been counseled concerning their errors.
Additional corrective actions taken included the review of procedures affecting activities of the entire station; the review of the process by which station modifications are designed and processed; the review of station directives to assure compliance with applicable regulations and corporate requirements. Additionally, a Management Audit Team was established to specifically review operational activities at all of our nuclear stations. Details of these additional actions are provided in Attachment 2.
- 4) No further corrective actions are deemed necessary.
- 5) Full compliance was achieved March 17, 1983 upon closure of the pressurization valve at the completion of the test. '
1 L __.. _ _ _ _ _ _ _ _. _ _ _ _ _ _. _ _ _ _
OIE/RLG l
July 1, 1983 (A1)
Response to Violation A2
- 1) The al:.3ed violation is admitted.
- 2) The reasons for the violation were as reported in Licensee Event Report R0-269/83-10 dated April 15, 1983 and in a supplemental letter from H. B. Tucker (Duke Power Company) to J. P. O'Reilly (NRC, Region II) dated April 29, 1983.
The Unit 1 incident occurred when plant technicians entered the Emergency Personnel Air Lock through the outer door to perform the Reactor Building Emergency Local Leak Rate Test. After completing testing and leaving the emergency hatch area through the outer door, the outer hatch door was closed and due to personnel error the inner hatch door was inadvertently opened. During the performance of the test as well as after, the emergency hatch inner / outer door open statalarm in the Control Room was actuated. At the time of the incident, the statalarm was considered by the Control Room operators to be inoperable because the statalarm was on when both doors were known to be closed and the hatch was pressurized to approximately 60 psig. Therefore, a work request was written to have it checked. As a result, upon completion of the Air Lock Test, the operators did not acknowledge that the air lock had not been returred to normal. They failed to effectively follow up on the indication even though a substantial amount of trouble-shooting was conducted by maintenance personnel. At approximately 0930 on March 21, 1983 operations personnel visually verified that the inner door was open approximately 6 to 10 inches.
The cause of this incident has been classified as a personnel error due to inadequate training and/or instructions. The person involved in the closing of-the hatch door positioned the pointer on the handwheel outside the "both doors closed and latched" indication marks. The procedure used to perform the Leak Rate Test did not include a step to close the outer door.
The individuals involved were not properly trained on the operation of the air lock doors nor was sufficient instruction provided locally at the air lock. The independant verification that could have been made by the operators in the Control Room was ineffective because these operators had determined, in error, that the Control Room indications were' defective..
e OIE/RLG July 1, 1983 (A1)
- 3) The immediate corrective action taken was to close the inner door and to verify that the emergency hatch doors and the personnel hatch doors on all three units were properly closed. The Reactor Building Emergency Hatch Leak Rate Test procedure has been changed to include steps to properly close the emergency hatch doors.
The procedure was revised to require that an independent verification be performed to assure that both hatch doors are properly closed. The analogous changes have also been made to the Leak Rate Test procedure for the personnel hatch. The local indicator lights located outside the outer hatch door for all three units were repaired.
The remote indicator lights located in the Control Room and associated circuitry for all three units were verified to be functioning properly. The personnel involved in this incident have been counseled.
Per-formance personnel who conduct air lock testing have been trained and are responsible to assure that the entire air lock is properly restored following test.
Operators have received additional guidance to assure prompt and effective evaluation of alarm indicators.
A sign has been installed at each air lock providing detailed instructions on their operation.
Additional corrective actions were taken in the areas discussed in response to Violation Al and as detailed in.
- 4) No further corrective actions are deemed necessary.
- 5) Full compliance was achieved March 21, 1983 upon closure of the inner door.
With both these incidents, although the Technical Specifications were violated with respect to containment integrity, the Bases of Specification 3.6 state that " operation with a personnel or emergency hatch inoperable does not impair containment integrity since either door meets the design specifications for structural integrity and leak rate".
Thus, these incidents are truly minimal in safety significance.
Furthermore, the fact that independent verification was not explicitly contained in these procedures would have had no effect on prevention of the incidents.
The NRC, as part of its regulatory inspection program, routinely inspects surveillance testing at nuclear stations.
The surveillance tests are analyzed and/or witnessed by the inspector to ascertain procedural and performance adequacy. The completed test procedures examined are analyzed for embodiment of the necessary test prerequisites, preparations, instructions, acceptance criteria and sufficiency of technical content. The selected tests witnessed are examined to ascertain that current written approved procedures are available and in use, that test equipment in use is calibrated, that test prerequisites.-
.. _ ~
7 OIE/RLG July 1, 1983 (A1) i are met, system restoration is completed and test results are adequate. The selected procedures are perused for conformance with applicable Technical Specifications, for the required administrative review, and for performance within the surveillance frequency prescribed. The inspector employs.one or 4
j more of the following acceptance criteria for evaluating the above items:
10 CFR ANSI N18.7 l
Oconee Technical Specifications Oconee Station Directive Duke Administrative Policy Manual An extensive NRC review of procedures is performed--a review which is over and above that which is routinely conducted by station personnel.
In 1982, on at least three documented occasions, the NRC. Resident Inspector reviewed procedures related to personnel hatch surveillance and in all cases reported that within the areas inspected, no items of noncompliance or deviations were identified. The point here is that several previous reviews by both Oconee and the NRC Resident Inspector did not identify the need for independent verification.
In view of the foregoing discussions, Duke considers that this NRC proposed civil penalty of Violation A is not justified and the category of the violation
)
should be Severity Level IV.
There was no loss of safety function of the containment. Although a degraded condition did exist, sufficient information was not present to alert the operators that they were in an action statement.
Finally, the containment was able to perform its intended functions even though degraded, and there was no release of radioactivity off-site greater than the Technical Specifications limit.
4 4
i l
a I -
<-w.
.+ey.
-<-,,r-,,,,w-,
ese
,-ve~
s w ur ar,
,w+-
ew
+,,rvi
,,ew.-----,-we,,-t-,
y-wy-%,rww
,-.e,-,.--w.,w w r v,-
y,p e.-e, erw e+
,,w,--m, rw
a OIE/RLG July 1, 1983 (A1)
Violation B.
The licensee was issued an immediately effective Order confirming commitments on post-TMI related issues dated July 10, 1981.
This Order stated, "It is hereby ordered effective immediately that the licensee shall comply with the following conditions:
The licensee shall satisfy the specific requirements described in the attachment to this Order (as appropriate to the licensee's facilities) as early as practicable but no later than 30 days after the effective date of the Order."
The Order referred to and incorporated the licensee's submittal dated December 15, 1980, which committed to complete each of the actions specified in the Attachment to the Order. Attachment Item I.C.6, Correct Performance of Operating Activities, states that procedures would be reviewed and revised to verify correct performance of operating activities by January 1,1981.
Contrary to the above, after January 1, 1981, procedures had not been reviewed and revised to assure the correct performance of operating activities as evidenced by the violations of required containment integrity on Oconee Units 1 and 3 as described in Item A of this notice.
This is a Severity Level III Violation (Supplement I)
(Civil Penalty - $60,000).
Response to Violation B
- 1) The alleged violation is denied.
- 2) Duke denies the violation on the basis of a thorough review of the relevant history. This history was reviewed with NRC Region II management on April 19, 1983 and provided in a letter submitted April 29, 1983. This review confirmed that Duke had in fact implemented the concept of independent verification prior to the issuance of NUREG-0737 and was in compliance with NUREG-0737 when issued.
In early May 1979, directives from station management required that independent verification be applied to activities associated with removal and restoration of safety-related systems. Through-out 1979 and 1980, the program to implement the concept of independent verification was established and refined as necessary.
Station Directive 4.2.5, " Independent Verification Requirement",
was initially issued in February 1980.
Independent verification was implemented in procedures controlled by Operations, Maintenance, Performance, and other station groups as necessary, such that by January 1, 1981, the program was effectively implemented.
This program covered operating activities related to test and
=
01E/RLG July 1, 1983 (A1) maintenance of safety-related systems and components and required two individuals to verify that the equipment had been properly returned to service.
By letter dated July 10, 1981, the NRC issued a Confirmatory Order which, among other items, states that procedures would be reviewed and revised to verify correct performance of operating activities by January 1, 1981. The NRC had reviewed the implementation of this item with favorable results. During a routine safety inspection conducted from May 10, 1981 through June 10, 1981 and documented in Inspection Reports 50-269/81-10, 50-270/81-10, and 50-287/81-10, the NRC Oconee Resident Inspector provided the results of his review of the Oconee implementation of this action plan item. The inspector specifically reported:
Item I.C.6.
Guidance on Procedures for Verifying Correct Performance of Operating Activities The licensee responded to Item I.C.6. in a December 15, 1980 letter to NRC committing themselves to be in conformance to the above position by January 1, 1981.
The inspector employed Station Directive 4.2.5 " Procedure for Implementing Independent Verification Requirement" and ANSI N18.7 as guidance for reviewing the double verification practices at Oconee for verifying correct performance of Operating Activities.
The inspectors review on a daily lisis the Removal and Restoration Procedure OP/0/a/1102/06, the administrative mechanism through which station equipment is removed from service. Additionally, during monthly reviews of station surveillance and maintenance activities and procedures, the presence of double verification is constantly surveyed.
In these areas inspected, the incorporation of double verification appears to be adequate.
Later in the year, in a letter dated November 2, 1981, the NRC provided the results of their review of three TMI items, one of which was Item I.C.6.
This letter states:
Item I.C.6 - Guidance on Procedures for Verifying Correct Performance of Operating Activities Item I.C.6 requires a procedure review, and revision if needed, to assure that an effective system is provided to reduce human errors and improving the quality of normal operations. By letter dated December 15, 1980, Duke stated that procedures would be reviewed and revised as necessary. ONS~ Directive 4.2.5 was issued which described e
' 7-
o-OIE/RLG July 1, 1983 (Al) these implementing measures and addressed interim measures. Our review of this Directive has concluded that this Item has been acceptably addressed, and subject to inspector verification, has been resolved.
The relationship of independent verification to the two air lock incidents has been previously described. The station j
directive addressing independent verifications which had been found adequate by the NRC did not include independent verification of air lock doors. Thus, they were not in the air lock surveillance procedures. The first air lock incident was caused by a failure to revise procedures following a plant modification. The cause of the second air lock incident was inadequate procedures and instructions.
This scope of implementation of independent verification is not unique to Oconee.
The NRC Safety Evaluation Reports for McGuire and Catawba, in the section addressing Action Plan item I.C.6 - Independent Verification, do not include any reference to containment' air locks. Limited reviews of other NRC SERs issued since 1981 have also determined that independent verification requirements are not explicitly required for containment air locks.
Duke considers that the NRC had previously found the imple-mentation of procedures to meet Item I.C.6 to be acceptable and now to find that Duke is not in compliance is wholly unjustified.
- 3) No corrective action as a result of this violations is warranted.
1 i
- 4) No future corrective action to avoid further violation is warranted.
- 5) Full compliance was considered to be achieved January 1, 1981.
i' i
l l
- -. _ -... _.... _.~,
OIE/RLG July 1, 1983 (A2)
Duke Power Company Oconee Nuclear Station Actions Taken as a Result of March 1983 Air Lock Incidents In March 1983, two incidents occurred related to the personnel emergency air locks at Oconee. One occurred en March 17, 1983 on Unit 2 when the pressuriza-tion valve located outside the air lock was inadvertently left open following the quarterly air lock performance test.
The second occurred on Unit 1, also on March 17, 1983, and involved personnel inadvertently leaving the inner door of the emergency air lock ajar.
These have been reported to the NRC by Licensee Event Reports R0-287/83-04, dated April 15, 1983 and R0-269/83-10, dated April 15, 1983.
While the requisite specific actions for each unit, such as closure of the affected valve / door, check of the other units' similar equipment, and notification of the NRC were taken, these incidents also raised concerns within Duke relative to the effectiveness of programs which control activities affecting safety-related equipment. Aggressive actions were taken promptly in the review of activities in three areas. These were discussed with the NRC on April 19, 1983 and were included in a letter submittal on April 29, 1983.
Operation Controls With the area of control of operational activities, actions have been taken to review all operations procedures, to review all activities related to containment integrity, to establish a containment integrity controlling procedure, and to establish a means to assure prompt / effective follow-up to alarms / indications which monitor safety-related equipment.
Modification Process Within the area of control of the station modification process, actions have been taken to review the design process, the pre-implementation review process, and the post-implementation review process. The Duke program for verification of design activities and related documents is based on the requirements of 10 CFR 50, Appendix B.
Major station modifications which affect safety-related equipment are designed by Duke's Design Engineering Department (DED).
The Design Engineering Department program requires origination of design by qualified per-sonnel, checking of the design by equally qualified personnel and management approval of the final design.
Management Directives Following these incidents related to containment integrity, Oconee personnel undertook an extensive review of directives and procedures related to independent verification of performance of operational activities affecting safety-related equipment. This effort included a review of guidance provided in 1979 and 1980; of the procedures in effect at the times of these incidents previously described
OIE/RLG July 1 1983 (A2) 0 herein; of past incidents that have occurred as a result of personnel error or procedural deficiency; and of station directives currently in effect.
Details of all of these reviews were included in our April 29, 1983 submittal.
As a result of the review completed, Duke concludes that these incidents were isolated events, they were of minimal safety significance, 5nd they are not indicative of a programmatic deficiency at Oconee.
This result was not surprising. Duke has had in place a comprehensive program to implement independent verification at Oconee.
It is well beyond the minimum requirements published by the NRC in NUREG-0737 or that contained in the Safety Evaluation Reports issued by the NRC on McGuire and Catawba.
In these latter two items, the NRC specifically covers proper valve alignment and sources of power to those valves that are important to safety in safety-related systems.
No requirement is stated that is applicable to making sure air lock doors are closed.
In an effort to provide further improvement in our existing independent verifica-tion program, the incidents of the past rhree years have been reviewed to determine if other operating activities related to safety systems should be added to the program. To improve reliability, additional items have been identified which are intended to be included in the program. As a result of the reviews that have been conducted, the station directive which addresses independent verification has been revised.
Included are the definition, application, and implementation of independent verification.
Listed are specific examples of items to be independently checked such as valves, hatches, flanges, and lifted leads. The station directive on procedures has also been revised to state more explicitly the program to use, change, write, and review procedures.
Finally, in order to provide further assurance that the operational activities at all of our nuclear stations are conducted in a quality manner, a Management Audit Team was established.
Five specific areas were reviewed:
- 1) Process of review and determination of compliance with regulatory requirements;
- 2) The nuclear station modification process relative to safety evaluation, review of design, quality of implementation, procedural revisions, and training of personnel associated with a nuclear station modification;
- 3) Procedural development, implementation, and review;
- 4) Overall audit process to include QA, Nuclear Safety Review Board,
)
Nuclear Production Department, NRC, and insurance;
- 5) Personnel qualificatien.
The Audit Team was chaired by the Manager of the Catawba Nuclear Station and consisted of representatives from McGuire Nuclear Station, Quality Assurance, Design Engineering, Nuclear Production, and an outside consultant, Dr. Raymond
=
OIE/RLG July 1, 1983 (A2)
Murray (retired), North Carolina State University.
The review of each of the identified areas of concern was conducted to determine if the proper management controls and criteria are in place to assure a high degree of confidence that the efforts in each of the above areas will produce high quality results.
The audit verified that adequate 1,rograms are currently in place to assure regulatory compliance. The Audit Team also determined with a high degree of confidence that personnel are sufficiently familiar with program requirements and are dedicated to ensuring compliance with these requirements. The audit did contain a number of findings and recommendations directed towards improvement of these programs and additional training of personnel involved in execution of the administrative procedures.
The status of all actions taken is provided in the following table.
l i _
OIE/RLG July 1, 1983 (A2)
Duke Power Company Oconee Nuclear Station April 29, 1983 Submittal Status of Actions
-July 1, 1983-i l
Action Status 1.
Air Lock Door Open Incident - close Complete door, check other units, notify NRC, file LER l
2.
Air Lock Valve Open Incident - close Complete i
valve, check other units, notify NRC, file LER 3.
Establish Containment Integrity Complete Task Force e Compile master list of CI components Complete e Visual check of all accessible penetrations Complete e Label all CI components Complete e Control Room drawings updated Complete e' Controlled drawings revised 4.
Establish controlling procedure for Complete containment integrity
.5.
Establish quarterly and prior to S/U Complete surveillance of containment integrity 6.
Establish procedure to require effective /
Complete timely follow-through to alarm conditions 7.
Revise SD 4.4.4 to expand modification Complete process review to all affected sections 8.
Initial review of station procedures Complete 9.
Revise three Operations Procedures as a Complete result of initial review 10.
Revise six Performance Procedures found Complete as a result of initial review 11.
Review incidents of past three years for Complete incidents related to personnel error 12.
Review of past modifications to assure Complete procedures have been appropriately updated
. t
s t
OIE/RLG j
July 1,1983 (A2) j Action Status 13.
Revise / implement SD 4.2.5 to reflect Complete a
l-results of past/recent incidents i
l 14.
Revise / implement SD 4.2.1 on procedures Complete 15.
Revise / implement other SDs as required as As needed a result of these changes
- 16.
Review procedures, again, based on new SDs Complete 17.
Establish interim programs Complete 18.
Conduct an independent management audit Complete 19.
Incorporate Lessons Learned into operational Schedule to be established activities at McGuire and Catawba r
A 4
i,
- e L
T t
T
, -.. -, ~.. _,
_._.....,n..-,_..
...,,, - -, -...,.. - -. _ -. ~ -. -.. -.
q DUKE POWER GOMPANY P.O. DOx 33180 CHARLOTTE, N.C. 28242 HAL B. TUCKER rza,zynover
(' * * *
- vic===""
April 29, 1983 Mr. James P. O'Reilly, Regional Administrator U. S. Nuclear Regulatory Commission Region II 101 Marietta Street, NW. Suite 2900 Atlanta, Georgia 30303
Subject:
Oconee Nuclear Station Docket Nos. 50-269, -270, -287
Dear Mr. O'Reilly:
Duke Power Company is hereby submitting documentation relevant to LERs R0-269/83-10 and R0-287/d3-04 that was discussed in our meeting of April 29, 1983. At that meeting information was provided in the areas of incident investigation and response, review of operating, test, and maintenance procedure, review of design, implementation, and procedures revision pertaining to modifica-tions; and independent verification. The attached report provides documentation of Duke Power Company's response to the recent incidents at Oconee Nuclear Station related to containment integrity.
In addition, a management audit is currently in progress to provide further assurance that operating activities are conducted in a reliable, safe manner with due consideration to regulatory and corporate requirements. The Management Audit Team is headed by the Catawba Station Manager and is interdepartmental with outside-the-company representation.
If you have any questions regarding our incident investigations, station reviews, or management audit, please advise.
For your information, a summary list of completed and remaining activities with projected completion dates is provided in the attachment.
Very truly yours, (Cb/'f'<d Hal B. Tucker RLG/php l
Attachment cc:
Mr. J. C. Bryant NRC Resident Inspector Oconee Nuclear Station Dabe PbK QP m b m c'o y 9 wT-7 u
INTRODUCTION On December 12, 1982, Oconee personnel discovered two instrument air valves, 3IA-90 and -91, open. This incident was considered to be a degradation of containment integrity cnd was reported to the NRC in Licensee Event Report (LER)
R0-287/82-15.
In a follow-up action to this incident, the Oconee Operations Superintendent requested an investigation of activities related to containment integrity within the Operations group. This investigation resulted in the discovery of two additional incidents.
The first was discovered on March 3, 1983 and involved a manual sample valve, CF-19, being left in the open position by procedure, even though it is a containment isolation valve. This incident was reported to the NRC by LER R0-269/83-07.
The second involved the failure to meet containment isolation design criteria for the tie-in of the Standby Shutdown Facility to fuel transfer tubes of each unit. This incident was reported to the NRC by LER R0-269/83-05.
Following these events, two additional incidents related to containment integrity occurred during performance of the required quarterly surveillance tests.
In one incident, a pressurization valve was left open following the surveillance of the Emergency Personnel hatch on Unit 3, and in the other, the inner door of the Emergency Personnel hatch on Unit 1 was not fully closed.
Additional descriptions of these last two incidents are provided in the next section and were provided in LERs R0-287/83-04 and R0-269/83-10. The root causes of these five incidents are described later in this report.
Station personnel took such corrective actions as were necessary in each specific case and completed an investigation of each incident. However, to ascertain the effectiveness of the generic management controls associated with containment integrity and other safety-related systems, Duke initiated a review of procedures affecting operating activities to assure proper implementation of independent verification of containment integrity and other important procedures; a review of themodification process to assure modifications are properly designed, imple-mented, and appropriate procedures revised; and a review of station directives to assure compliance with the applicable regulations and corporate requirements.
Finally, Duke established a Management Audit Team to review operational activities at all our nuclear stations in order to assure ourselves that such activities are being conducted in a quality manner.
Descriptions of these activities are provided in later sections of this report.
Duke has met with the NRC, Region II Regional Administrator and his staff on March 23, 1983 and April 19, 1983 to discuss the last two incidents and the corrective actions taken as a result of the incidents.
In concluding this second meeting, Duke committed to document the information provided verbally and to submit a report by April 29, 1983. This report constitutes fulfillment of this commitment. I
SUMMARY
OF INCIDENTS Since December 1982, five incidents have occurred at Oconee related to containment integrity. The following paragraphs provide brief descriptions of each incident.
On December 12, 1982 two Manual Containment Isolation Valves (instrument air valves 3IA-90 and 3IA-91) were found open when operators were making prepara-tions to line up instrument air to the Unit 3 Reactor Building.
These valves had been opened during the previous forced outage due to the 3A Steam Generator Leak per Removal and Restoration (R&R) procedure. They were then kept open to supply instrument air to power tools used to furmanite Unit 3 Reactor Coolant Pumps (RCP) found leaking at the beginning of startup.
The work was completed on December 8, 1982.
Between the days of December 6, S
1982 and December 12,1982, Unit 3 was at or above 300 psig and 200 F with fuel in the core and in violation of Technical Specification 3.6.1 which requires that containment integrity be maintained.
The apparent cause of the incident was related to the documents used to control systems in an off-normal condition. The pre-heatup checklist section of the Unit Startup Procedure included a step to review the R&R Book for any items which may affect unit heatup. On December 4,1982, the Assistant Shif t Supervisor noticed that the subject valves were outstanding due to the need for instrument air for furmaniting the RCP during startup. This particular R&R was not required to be closed out prior to continuing heatup. The Assistant Shift Supervisor, assuming that another R&R audit would be done prior to going critical and would result in closing these valves, signed the step off as complete without noting the open IA valves. In the pre-heatup checklist, there was also a checklist for the manual Reactor Building isolation valves themselves. While reviewing these checklists, it was verbally noted that valves 3IA-90 and 3IA-91 were open.
Control Room personnel instructed the operators to sign these off as closed since an R&R was ou'tstanding on the valves to " flag" them as still being open.
The R&R was to have ensured that the valves were closed after the furmanite process was completed. Afterwards, however, no Control Room personnel noted the importance of the outstanding R&R on the Reactor Building manual isolation valves. An inadequate review of the unit's outstanding items was done by the Shift personnel during that four day period. This incident was caused by personnel error (incomplete review of the unit's outstanding items as required by turnover procedures), and also by a deficiency in procedure (deletion of R&R audit from precriticality check).
In a follow-up action to this first incident, the Oconee Operations Superintendent
. requested an investigation of activities related to containment integrity within the Operations group. The discovery of the next two incidents occurred as a direct result of this investigation.
On March 3, 1983 it was discovered that valve CF-19 was required to be closed by Oconee Technien1 Specifications, but was open, by procedure, on all three units.
CF-19 is a manual containment isolation valve on the sample line from the Core Flood Tanks. All manual containment isolation valves are required by Technical Specifications to be closed for containment integrity.......
Previously, a procedure change had been approved to allow CF-19 to remain open continuously. The reason for the change was to provide for easier sampling of the Core Flood Tanks. The cause of this incident is classified as personnel error since the Technical Specifications applications of opening the valve were overlooked during the usual review process for procedure approval.
On March 16, 1983, an engineering evaluation conducted as part of follow-up actions from the December 12, 1982 incident determined that the double isolation criterion was not met for the Standby Shutdown Facility (SSF) Reactor Coolant Makeup Pump tie-in to the Fuel Transfer Tubes. At the time of this determination the status of the valves inside the RB containment could not be confirmed.
- Later, during the course of the investigation, the position of the valves was determined by documentation review. This incident was determined to be a violation of the Final Safety Analysis Report (FSAR) General Design Criterion 53, and a degraded mode of operation per Technical Specification (T.S.) 3.6.
The SSF was designed to provide an alternate means of shutting down each Oconee unit to hot shutdown condition and maintaining the unit (s) at this condition for approximately three days.
It is not yet operational.
The design for the SSF was submitted in February 1978 to the NRC, and Duke received their conceptual approval in December 1978.
In July 1981, work was started on the SSF Reactor Coolant (RC) Makeup System on Unit 1 during its refueling outage.
Similarly, work was started on the same system on Units 2 and 3 in January 1982 and May 1982, respectively. The tie-ins were completed during each unit's outage. The cause of this occurrence was design deficiency resulting from inadequate review on the part of the designers and other responsible qualified personnel.
It was not recognized that the connection to the transfer tubes required double isolation.
In March 1983, two incidents occurred related to the personnel emergency air locks at Oconee. One occurred on March 17, 1983 on Unit 3 when the pressurization valve located outside the air lock was inadvertently left open following the quarterly air lock performance test. The second occurred on Unit 1, also on March 17, 1983, and involved personnel inadvertently leaving the inner door of the emergency air lock ajar. These have been reported to the NRC by Licensee Event Reports R0-287/83-04, dated April 15, 1983, and R0-269/83-10, dated April 15, 1983, respectively.
On March 17,1983 at 0200, while preparing to perform the quarterly Reactor Building (RB) Emergency Lock Leak Rate Test, it was discovered that air was leaking from the Unit 3 RB Emergency Personnel Air Lock Hatch (EPAL) pressurization connection valve. The valve does not connect into the Reactor Building but into the EPAL. The valve is a containment isolation valve but was found to be open.
The cause of this occurrence was personnel error.
In July, 1981, a modification added the subject valve on the 3/4 inch line extending from the Emergency Air Lock outside end.
In the process of modification review, one step is to check for necessary procedure changes. The procedure for the Leak Rate Test on the EPAL was not changed to specifically include the valve.
The procedure stated to
" pressurize the hatch volume", requiring the pressurization valve to be opened.
The procedure stated " remove test equipment", for which in past tests the pres-surization valve was closed.
In this case, the valve was left open. j
s l
J i
l The Unit 1 incident occurred when plant technicians entered the Emergency Personnel Air Lock through the outer door to perform the Reactor Building Emergency Local Leak Rate Test. After completing testing and leaving the Emergency Hatch area through the outer door, the outer hatch door was closed and due to personnel error the inner hatch door was inadvertently opened.
During the performance of the test as well as after, the Emergency Hatch j
inner / outer door open statalarm in the control room was actuated. At the j
time of the incident, the statalarm was considered by the control room operators to be inoperable because the statalarm was on when both doors were known to be closed. Therefore, a work request was written to have it checked. As a result, upon completion of the Air Lock Test, the operators did not acknowledge l
that the air lock had not been returned to normal. They failed to effectively follow up on the indication even though a substantial amount of trouble-shooting I
was conducted by maintenance personnel.
At approximately 0930 on March 21, 1983 operations personnel visually verified that the inner door was open approximately 6 to 10 inches. The apparent cause of this incident has been classified as a personnel error and defective procedures. The person involved in the closing of the hatch door positioned the pointer on the handwheel outside the "both doors closed and latched" indication marks. The procedure used to perform the Leak Rate Test did not include a step to close the outer door.
There was no step in the procedure to perform an independent verification to assure both 4
)
doors are properly q1osed. On March 21, 1983, the new oncoming shift investigated j
the alarm condition and found the inner door open 6 to 10 inches.
While the requisite specific actions for each unit, such as closure of the af fected valve / door, check of the other units' similar equipment, and notification l
of the NRC were taken, the39 incidents also raised generic concerns relative to j
the effectiveness of programs which control activities affecting safety related equipment. Aggressive actions were taken promptly in several areas. The review of procedures affecting operating activities was expanded to include the entire l
station; the process by which station modifications are designed and processed j'
was reviewed; and station directives were reviewed to assure compliance with applicable regulations and corporate requirements. Additionally, Duke established l
a Management Audit Team to specifically review operational activities at all of our nuclear stations.
Further descriptions of these actions are provided in the next two sections.
l i
i R
1 3
j -
i
O e
l i.
CORRECTIVE ACTIONS _
f activities at These incidents, as a group, indicate that the control oThis review has b Oconec warraats a broad review. control of operational activities; control of the The following directives.
process; and establishment of effective managementpa areas:
k Operation Controle i
have With the area of control of operational activities, act ll t blish a contain-activities related to containment integrity, to es at blish a means to l-ment integrity controlling procedure, and to es adications which monitor j
assure prompt / effective follow-up to alarms /in safety-related equipment.
since the d
The Operations group investigation which had been un erway 1982 j
incident involving the instrument air valves in Dece One being routinely involved manual outside containment isolation valves sociated l Transfer Tubes.
l with the Standby Shutdown Facility tie-in to Fue cy i
Upon discovery of the incident related to the Unit 3 Emergen this effort Personnel Air Lock, the number of personnel involved in ll station groups.
were expanded to include representatives from a l
f all This new Task Force, dedicated to the complete review o d several actions.
activities affecting containment, has accomplisheA m isolation To validate this i
function was compiled from existing procedures. list, al d
All acces-f el awareness sible components have been labeled to assure personnd is required to be 4
that the component is part of containment anInaccessible components will be functional to maintain integrity.
Actions have been taken to update
~
labeled as they become available.
drawings as appropriate.
i is properly In order to provide assurance that containment integr ty l
i ent integrity established and effectively maintained, a conta nmThe procedure will be refere ification procedure is being established.in the existing unit startup pro inment integrity are j
that all components which are related to contafunction Two ill be run during component checklists, isolation and verification, w A verification checklist will be run onIn all cases, th each refueling startup.
i startup from non-fueling cold shutdown.
hich require containment will be completed prior to plant conditions w integrity.
quarterly As an added measure, these checklists will be ru l'
tions. This
. _~
s -
frequency of surveillance ie considered to be reasonable in view of the number of components that will be checked and the fact that is is consistent with other quarterly surveillance such as routine pump,,
i and valve performance tests required by ASME Section XI and an existing system check program on ESF equipment and emergency feedwater that has been in effect at Oconee since 1979.
This system check program was instituted in the summer of 1979 when an incident occurred which effectively degraded the emergency CCW system. Quarterly, all accessible valves in the main flow paths and the requisite power supplies of the following safety-related systems are checked to assure the systems are capable of functioning:
l
- High Pressure Injection
- Low Pressure Injection
- Low Pressure Service Water
- Condenser Circulating Water
- Penetration Room Ventilation 1
- Reactor Building Spray
- Emergency Feedwater Since implementation of-this system check program, no system has been l
found in a degraded mode.
Oconee Operations personnel havealso recently reviewed the response to alarms / indicators which monitor safety-related equipment to ensure that control room operators will take the appropriate actions in response to alarms which monitor safety-related equipment. This action will include a comparison / check of relevant supporting parameters to validate the alarm. Training will be conducted to reemphasize this existing program. Additionally, an interim program will be i
developed by June 1, 1983, to provide additional assurance that operators will take specific actions to determine the status of safety-related equipment when the alarm / indicator for that equipment has been determined.or is believed to be faulty. Duke will also develop a program for use at all of our nuclear stations to address proper alarm response.
Modification Process Within-the area of control of the station modification process, actions have been taken to review the design process, the pre-implementation review process, and the post-implementation review process. The Duke program for verification of design activities and related documents is i
based on the requirements of 10 CFR 50, Appendix B.
Major station modifications which affect safety-related equipment are designed by l
Duke's Design Engineering Department '(DED).
The Design Engineering Department (DED) program requires origination of design by qualified r,
_~
9 i.
personnel, checking of the design by equally qualified personnel and 1
management approval of the final design. The final design products (e.g., drawings, specifications, procedures, etc.) are collectively defined as a Nuclear Station Modification (NSM) limited edition package.
Each NSM limited edition package is subjected to a safety-evaluation 3
i conducted by the engineering organizations developing the design.
This evaluation confirms the adequacy of the design regarding compliance with plant design criteria and safe plant operation. As a supplemental requirement, the department's Safety Review, Analysis and Licensing Division performs an independent safety evaluation of each NSM. The
{
results of this safety evaluation are documented in accordance with Department Quality Assurance procedures. The final NSM package is 1
then released to the station for implementation.
Any design deficiencies identified following document sign-off are l
considered design non-conformances (DNC).
Each DNC is documented and then carefully scrutinized to assure that any contributing process j
weaknesses are identified and strengthened to reduce the likelihood of similar occurrences in the future.
Each DNC is reviewed for regulatory reportability in accordance with 10 CFR 21 and 10 CFR 50.55(e).
The DNC is further reviewed in accordance with 10 CFR 50, Appendix B, Criterion KVI. On a quarterly basis, all department DNCs are trended i
to identify areas for improvement. Corporate QA Department and Design Engineering Department management formally evaluate each identified trend and take corrective action, as required.
DNC-0049, regarding reactor building isolation valve arrangements for the Standby Shutdown Facility connections to the fuel transfer tubes, j
was reported to the NRC. The evaluation of this DNC concluded that a similar connection at McGuire and Catawba Nuclear Stations was I.
designated properly and in accordance with station design criteria.
Other NSMs involving design of containment isolation valve arrangements at Oconee were-also reviewed and it was confirmed that these NSM designs fully complied with station design criteria. DNC trending history was reviewed and it was determined that the character of this DNC was not consistent with any identifiable trend for the responsible engineering section which performed the work.
The program-to assure proper implementation of station modifications at Oconee includes both pre-implementation and post-implementation j
reviews. For all modifications, the appropriate design criteria are established, a safety evaluation checklist is completed and reviewed by a second qualified individual. Additionally, to assure that.all the steps are conducted, a process record checklist is reviewed by a qualified reviewer and,-if appropriate, a cross-disciplinary review l
is conducted. An accountable individual reviews the modification package to ensure that all'of the preceding is properly completed.
As a final. step prior to implementacion of the modification, the station modification coordinator' verifies the proper' completion of all elements.
, 's
.e.e-
. g e
As part of the post-implementation review process, the accountable individual for the specific station modification assures that control of the modified system is effectively returned to t' Operations group for use.
This process includes verification
~that drawings, descriptions and component information are provided to the group accepting the system.
The planned changes to this process include a broader scope of review.
This, along with documentation of such a review, would assure that l.
all station personnel that are associated with activities that could be affected by a station modification are properly notified and that they complete the required procedural changes and training.
This process will be monitored through the station modification coordinator.
Additionally, a review of certain completed modifications will be conducted to assure that procedures and documentation have been appropriately updated as a result of the modification.
l Management Directives Following these incidents related to containment integrity, Oconee personnel undertook an extensive review of directives and procedures related to independent verification of performance of operational activities affecting safety-related equipment. This effort included a review of guidance provided in 1979 and 1980; of the procedures in effect at the times of these incidents previously described herein; of past incidents that have occurred as a result of personnel error or procedural deficiency; and of station directives currently in effect. The following paragraphs describe the results of these revieas.
Duke has reviewed the history at Oconee associated with the imple-j
- mentation of an independent verification program, and confirmed that Oconee implemented the concept of independent verification well before NUREG-0737 was issued.
In early May 1979, directives from station I
management required that independent verification be applied to activities associated with removal and restoration of safety-related l-systems. Throughout 1979 and 1980, the program to implement the
(
concept of independent verification was established and refined as l
necessary. Station Directive 4.2.5, " Independent Verification Require-l ment", was initially issued in February 1980.
Independent verification L
was implemented in procedures controlled by Operations, Maintenance, i
Performance, and other station groups as necessary, such that by January 1, 1981, the program was effectively implemented. This program l
covered operating activities related to test and maintenance of safety-related systems and components and required two individuals to verify that the equipment had been properly returned to service.
[
The procedure review recently conducted identified'only nine procedures i
of over 2,500 in place on January 1, 1981 where implementation of independent verification' appeared to be deficient (see Table 1).
The l.
O o
three Operations procedures relate to electrical power distribution.
Five of the six Performance procedures relate to containment air locks; the sixth dealt with electrical penetrations.
In early 1982, an incident occurred that caused a review of the program which was to implement independent verification. Although this program had been very successful in the Instrumentation and Electrical (I&E) area in retur:sf.ag thousands of components successfully back to service, a personnel error created the incident wherein an instrument test tee cap on a Reactor Building pressure switch was not reinstalled following testing. This resulted in procedural upgrades to contain specific items required to be verified to assure proper return to service of the components. Following a Station Manager requested QA audit in mid 1982, additional procedural improve-ments were made.
These included minor clarifications of actions necessary to assure proper removal or return to service. In late 1982, when an inadvertent reactor trip occurred due to personnel error associated with work on non-safety equipment, the program directive was again revised to require independent verification prior to actions which may, if not done correctly, degrade safety or plant operation.
In a further effort to assure that independent verification is eff ectively implemented, the incidents of the past three years have been reviewed to determine if other operating activities related to safety systems should be added to the program.
To improve reliability, additional. items have been identified which are intended to be included in the program. As a result of the reviews that have been conducted, the station directive which addresses independent verification has been drafted. After review and approval, this revised statica directive will be implemented.
Included will be the definition, application, and implementation of independent verification.
Listed will be specific examples of items to be independently checked such as valves, hatches, flanges, and lifted leads. The station directive on procedures is also being revised to more explicitly state the program to use, change, write, and review procedures. Other directives will be revised to support these directives, as necessary. Upon issuance of these revised station directives, all procedures will be revised as necessary.
Where appropriate, interim programs will be established until final procedure revisions are made.
.O Review of Procedures for Independent Verification PROCEDURES PROCEDURES ADDITIONAL GROUP REVIEWED INCORPORATING IV*
PROCEDURES REVISED 200 3
300 OPERATIONS
~
liAINTENANCE
- 1,700
- 1,300 0
500 100 6
TECilNICAL SERVICES
~
~
TOTAL
~ 2,500
~ 1,600 9
Il0TE:
NUMBERS ARE APPROXIMATE
- INDEPENDENT VERIFICATION TABI.E 1
MANAGEMENT AUDIT In order to provide further assurance that the operational activities at all of our nuclear stationa are conducted in a quality manner, a Management
]
Audit Team has been established.
Five specific areas will be reviewed:
- 1) Process of review and determination of compliance with regulatory requirements;
- 2) The nuclear station modification process relative to safety evaluation, review of design, quality of implementation, procedural revisions, and training of personnel associated with a nuclear station modification;
- 3) Procedural development, implementation, and review;
- 4) Overall audit process to include QA, Nuclear Safety Review Board, Nuclear Production Department, NRC, and insurance;
- 5) Personnel qualification.
The Audit Team is chaired by the Manager of the Catawba Nuclear Station and consists of representatives from McGuire Nuclear Station, Quality Assurance, Design Engineering, Nuclear Production, and an outside consultant, Dr. Raymond Murray (retired), North Carolina State University. The review of each of the identified areas of concern will be conducted to determine if the proper management controls and criteria are in place to assure a high. degree of confidence that the efforts in each of the above areas will produce high quality results. This review will be completed by May 13, 1983.
A report will be prepared shortly thereafter.
l
[
e -
-~ --
SUMMARY
Duke Power has taken effective and aggressive actions following recent incidents related to containment integrity:
Duke had implemented the concept.of independent verification j
e of safety systems prior to the issuance of NUREG-0737.
hDuke has in place a program to effectively review plant e
modifications.
)
Past modifications will be appropriately reviewed to assure e
proper inclusion of components into the appropriate procedures.
Duke established a Task Force to review all activities related e
to maintaining containment integrity.
e Duke has reviewed the recent incidents, identified the causes, and implemented the necessary corrective actions.
Incidents for the past three years have been reviewed to e
determine other causes of personnel error where independent verification would be effective to prevent recurrence.
A review of the independent verification program including some e
2500 procedures has been conducted and appropriate procedures will be revised.
A containment integrity controlling procedure will be established e
to assure that appropriate containment isolation is achieved on startup; the procedure will be conducted quarterly to confirm continued containment integrity.
Duke will conduct an independent management audit, utilizing o
resources from the corporate office and our other nuclear stations.
The lessons learned from this experience will be incorporated into the operational activities at our McGuire and Catawba Nuclear Stations, as All these actions have been summarized on the attached table necessary.
along with the current status.
m
__s..
e*
i l
Duke Power Company l
Oconee Nuclear Station April 29, 1983 Submittal Status of Actions Action Status 1.
Air Lock Door Open Incident - close Complete door, check other units, notify NRC, 4
file LER 2.
Air Lock Valve Open Incident - close Complete valve, check other units, notify NRC, file LER 3.
Establish Containment Integrity Complete Task Force:
o Compile master list of CI components Complete e Visual check of all accessible penetrations Complete e Label all CI components Complete e Control Room drawings updated Complete e Controlled drawings revised 4.
Establish controlling procedure for Complete by June 30, 1983 containment integrity 5.
Establish quarterly and prior to 'S/U Complete by June 30, 1983 surveillance of containment integrity 6.
Establish procedure to require effective /
Complete by July 1, 1983 timely follow-through to alarm conditions 7.
Revise SL 4.4.4 to expand modification Final by June 1, 1983 process review to all affected sections 8.
Initial review of station procedures Complete 9.
Revisa three Operations Procedures as a Complete by June 17, 1983 result of initial review
- 10. Revise six Performance Procedures found Complete as a result of initial review.
- 11. Review incidents of past three years for Complete incidents related to personnel error
(
l
- 12. Review of past modifications to assure Phase I review completed procedures have been appropriately updated April 27, 1983; Phdse II to be established l
o.
J j
Action Status i
- 13. Revise / implement SD 4.2.5 to reflect Complete by June 1, 1983 results of past/recent incidents
'14.
Revise / implement SD 4.2.1 on procedures Complete by June 1, 1983
- 15. Revise / implement other SDs as required as As needed a result of these changes
- 16. Review procedures, again, based on new SDs (Interim measures (and schedule for procedure review
- 17. Establish interim programs (be completed by June 1, 1983
- 18. Conduct an independent managemer t audit In progress, Complete by May 13, 1983
- 19. Incorporate Lessons Learned into operational Schedule to be established activities Jt McGuire and Catawba i
r i
e l
l l
l
-.,'l
0+
o OIE/RLG July 1, 1983 (A4)
Duke Power Company Oconee Nuclear Station Response to Proposed Civil Penalty In accordance with 10 CFR 2, 52.205, Duke Power Company hereby protests the proposed civil penalties, the basis of which is provided by the following.
1.
Violation A, Item 1 (test valve open on the Unit 3 emergency hatch) - Violation is admitted; however, escalation by 25 percent for failure to adequately implement corrective action for a prior similar problem, and 25 percent because of prior notice of this problem is denied for reasons stated previously.
This incident is not a result of lack of independent verification and was not similar in nature to a previous problem.
This incident is of minimal safety significance and as such should be classified as Severity Level IV.
Violation A, Item 2 (inner door of Unit 1 emergency hatch was open) - Violation is admitted; however, escalation by 25 percent for failure to adequately implement corrective action for a prior similar problem and 25 percent because of prior notice of this problem is denied for reasons stated previously. This incident is not a result of lack of independent verification and was not similar in nature to a previous problem. This incident is of minimal safety significance and as such should be classified as Severity Level IV.
Violation B (review and revision of procedures to assure correct performance of operating activities) - Violation denied, escalation denied.
2.
The NRC Notice is in error in that the apparent cause of the incident is incorrect and is not consistent with the conclucions provided in Inspection Report 50-269/83-11, 50-270/83-11, 50-287/83-11.
Further, the NRC Notice fails to acknowledge the previous NRC reviews that found both the air lock procedures and the independent verifica-tion program at Oconee acceptable.
Finally, the NRC Notice fails to acknowledge the prompt and aggressive corrective actions that were taken by Duke in response to the emergency air lock incident.
3.
The NRC asserts that the proposed civil penalties are to emphasize the need for significant improvements with respect to the adequacy and verification of safety system operability.
In light of the actions that have been taken by Duke in this matter well before the Notice of Civil Penalty was issued, and in view of the overall above average performance of Oconee personnel, the proposed civil penalty is punitive in nature rather than encouraging good licensee performance.
Duke considers that the proposed civil penalty is wholly unsubstantiated and requests that it be rescinded in its entirety.
(