IR 05000327/2001005

IR 05000327/2001-005 and IR 05000328/2001-005, Sequoyah Nuclear Plant, Inspection on 12/30/2001 - 03/30/2002 Related to Equipment Alignment, Maintenance Risk Assessments and Emergent Work Control, Operability Evaluations. Non-cited Violatio

ML021210321
Person / Time
Site:	Sequoyah
Issue date:	04/29/2002
From:	Fredrickson P NRC/RGN-II
To:	Scalice J Tennessee Valley Authority
References
IR-01-005
Download: ML021210321 (30)

Text

ril 29, 2002

SUBJECT:

SEQUOYAH NUCLEAR PLANT - NRC INTEGRATED INSPECTION REPORT 50-327/01-05 AND 50-328/01-05

Dear Mr. Scalice:

On March 30, 2002, the NRC completed an inspection at your Sequoyah Nuclear Plant, Units 1 and 2. The enclosed report presents the results of that inspection which were discussed on April 4, 2002, with Mr. Richard Purcell and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, the inspectors identified five issues of very low safety significance (four were Green and one was No Color), three of which were also determined to involve violations of NRC requirements. However, because of their very low safety significance and because they have been entered into your corrective action program, the NRC is treating these issues as non-cited violations, in accordance with Section VI.A.1 of the NRCs Enforcement Policy. If you deny any non-cited violation in the enclosed report, you should provide a response with the basis for your denial, within 30 days of the date of this inspection report, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Sequoyah.

The NRC received your response dated February 1, 2002, to a Notice of Violation which was issued in a letter dated January 10, 2002. This letter also transmitted NRC Inspection Report 50-327, 328/01-07 which discussed the inspection details of the NOV. We have evaluated your response and found that it meets the requirements of 10 CFR 2.201.

TVA 2 In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Paul E. Fredrickson, Chief Reactor Projects Branch 6 Division of Reactor Projects Docket Nos. 50-327, 50-328 License Nos. DPR-77, DPR-79

Enclosure:

NRC Inspection Report 50-327/01-05, 50-328/01-05 w/Attachment - Supplemental Information

REGION II==

Docket Nos: 50-327, 50-328 License Nos: DPR-77, DPR-79 Report Nos: 50-327/01-05, 50-328/01-05 Licensee: Tennessee Valley Authority (TVA)

Facility: Sequoyah Nuclear Plant, Units 1 & 2 Location: Sequoyah Access Road Soddy-Daisy, TN 37379 Dates: December 30, 2001 - March 30, 2002 Inspectors: R. Gibbs, Senior Resident Inspector R. Telson, Resident Inspector R. Carrion, Project Engineer (Section 1R06)

Approved by: P. Fredrickson, Chief Reactor Projects Branch 6 Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS IR 05000327-01-05, IR 05000328-01-05, Integrated inspection report, on 12/30/01 - 3/30/02, Tennessee Valley Authority, Sequoyah Nuclear Plant, Units 1 and 2. Equipment alignment, maintenance risk assessments and emergent work control, operability evaluations, and event followup.

The inspection was conducted by resident inspectors and a project engineer. The inspection identified five findings (four were Green and one was No Color), three of which were also non-cited violations. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609 Significance Determination Process, (SDP). Findings for which the SDP does not apply are indicated by No Color or by the severity level of the applicable violation. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described at its Reactor Oversight Process website at http://www.nrc.gov/NRR/OVERSIGHT/index.html.

A. Inspector Identified Findings Cornerstone: Mitigating Systems

• Green. The inspectors identified deficiencies in identifying, communicating, and addressing a common cause degradation of the air starting systems of the sites four emergency diesel generators during the period from January 2001 through March 2002.

The finding had a credible impact on safety because it could have affected the reliability of the backup AC power system. The finding was of very low safety significance because no actual loss of safety function was identified (Section 1R04.2).

• Green. The inspectors identified that the licensee did not effectively assess overall plant risk prior to removing an emergency diesel generator from service for an extended maintenance outage.

The finding had a credible impact on safety because it could have affected the overall reliability (i.e. defense in depth) of the backup AC power system. The finding was of very low safety significance because no actual loss of safety function was identified (Section 1R13).

• Green. The inspectors identified a non-cited violation of Technical Specification 3.8.1.1, for failure, following a start failure of an emergency diesel generators (EDGs), to demonstrate the operability of the remaining EDGs within one hour and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter.

The finding had a credible impact on safety and could have affected the operability of the remaining EDGs because it resulted in a potential common cause failure mode not being addressed. The finding was of very low safety significance because the remaining EDGs were subsequently started during their routine surveillance intervals which demonstrated that their safety function had not been lost (Section 1R15.2).

Cornerstone: Barrier Integrity

• Green. The inspectors identified a non-cited violation of License Condition 2.C.16, Fire Protection Program, for failure to maintain a door shut, which was required to be closed and latched to maintain the integrity of the auxiliary building secondary containment exclusion boundary and to prevent the spread of a fire.

The finding had a credible impact on safety because it could have potentially affected the operability of the auxiliary building gas treatment system. In addition, having the door unlatched potentially reduced the effectiveness of the fire barrier which separates a fire area containing redundant trains of safe shutdown equipment. The finding was of very low safety significance because it represented only a potential degradation of the radiological barrier for the auxiliary building. The finding, from a fire risk perspective, was also of very low safety significance because fire detection and suppression were operable on both sides of the door and there were no plant activities in the affected area to substantially increase the severity of a postulated fire (Section 1R15.1).

Other Activities

• No Color. The inspectors identified a non-cited violation of Technical Specification 6.8.1.a, Procedures and Programs, for failure to follow administrative guidance for making an intent change to a procedure. A containment pressure control procedure, which temporarily resets the steam generator low-low water reactor trip setpoint during venting, was used to make a change to this setpoint for a purpose unrelated to venting.

Failing to perform an intent change review before procedure execution was of more than minor significance because this programmatic requirement ensures that procedure changes are fully understood in advance of the facility change. However, the finding did not directly affect any initiating events or mitigation equipment (Section 4OA3).

B. Licensee Identified Violations Violations of very low safety significance which were identified by the licensee, have been reviewed by the inspectors. Corrective actions taken or planned by the licensee appeared reasonable. The violations are listed in Section 4OA7.

Report Details Summary of Plant Status: Units 1 and 2 operated at or near 100 percent power for the entire inspection period.

1. REACTOR SAFETY Cornerstones: Initiating Events, Mitigating Systems, And Barrier Integrity 1R04 Equipment Alignment

.1 Partial Walkdowns a. Inspection Scope The inspectors conducted equipment alignment partial walkdowns to evaluate the operability of selected redundant trains or backup systems, listed below, with the other train or system inoperable or out-of-service. The walkdowns included a review of applicable operating procedures to determine correct system lineups and an inspection of critical components (e.g., power supplies and support systems) to identify any discrepancies that could affect operability of the redundant train or backup system.

• Containment spray train 1B during emergent outage of containment spray train 1A heat exchanger

• Emergency diesel generator (EDG) 1A-A while EDG 1B-B was out-of-service for planned maintenance

• EDGs 1A-A, 1B-B, and 2B-B and associated switchgear during scheduled six-day EDG 2A-A planned maintenance outage b. Findings No findings of significance were identified.

.2 Complete System Walkdown a. Inspection Scope The inspectors performed a complete walkdown of accessible portions of the Units 1 and 2 EDG air start systems. The inspectors verified proper equipment alignment by comparing actual equipment configuration to plant procedures, drawings, and the Updated Final Safety Analysis Report (UFSAR). The inspectors reviewed outstanding work requests, problem evaluation reports (PERs), and the system health report, which discussed open engineering issues, to determine if any conditions existed that would have prevented the system from fulfilling its intended safety function. The inspectors also performed a review of the corrective action program for substantive material issues to assess the effectiveness with which the licensee was identifying and correcting problems.

Documents reviewed during the inspection are listed in the Attachment.

b. Findings A finding of very low safety significance (Green) was identified by the inspectors for deficiencies in identifying, communicating, and addressing a common cause degradation of the air starting systems of the sites four EDGs during the period from January 2001 through March 2002.

On January 23, 2001, PER 01-000489-000 identified a potential operability issue of the EDGs, noting that the regulated load side vent ports of the starting air pressure control valves (PCVs) of EDG 1A-A had been inappropriately sealed by pipe plugs. An extent of condition review identified that plugs had also been installed in the three remaining EDGs.

For relieving style PCVs, excess air pressure is expelled through the vent ports to compensate for regulator leakage and to permit the regulated pressure to be adjusted downward when the system is static. The licensee determined that the plugs created conditions in which the regulated pressure could exceed the air starting system design pressure. The licensee, without performing a detailed functional evaluation, concluded that there was no operability issue and no common mode failure concern. Although licensee management questioned the PER basis and logic for concluding that there was no operability issue, no formal functional evaluation was performed and the PER corrective action to address managements concern, completed March 24, 2001, documented only that a consensus was reached.

In March, 2001, as the licensee was replacing the 16 plugged PCVs (about half of which were found to be of the relieving-style discussed above) in the sites four EDGs with properly vented relieving-style PCVs, the system engineer became concerned that removing the plugs could result in an uncontrolled blowdown and the partial or complete depressurization of an EDG air starting system should a PCV malfunction occur. The EDG vendor was contacted about re-plugging the new PCVs. The vendor advised against plugging relieving style PCVs as it would cause hammering with potential adverse consequences. Neither the engineers nor the vendors concern nor a detailed functional evaluation were documented in a PER until the first of several uncontrolled blowdowns was recorded several months later as discussed below.

On August 14, 2001, PER 01-007184-000 identified an uncontrolled blowdown on EDG 1B-B. This uncontrolled blowdown was identified as a potential operability issue and was evaluated by Technical Operability Evaluation (TOE) 01-082-7184-000. Since EDG 1B-B started successfully, the blowdown self-terminated, and pressure recovered before the EDG was stopped, the EDG was declared operable. The inspectors observed that, although PER 01-007184-000 was annotated to indicate the existence of a degraded/nonconforming condition, TOE 01-082-7184-000 focused on operability and was ambiguous regarding the degraded condition. This ambiguity was confirmed by the inspectors through discussions with several plant personnel, each of whom understood that there were adverse conditions associated with the EDG air starting systems but were not aware that a condition, potentially common to all EDGs, had been characterized as a degraded condition.

Subsequently, PERs addressing additional uncontrolled blowdowns of EDG engines 2A2 on August 21, 2001, (PER 01-7350-000) and 2B2 on September 24, 2001, (PER 01-8578-000) were included in PER 01-007184-000 making some of the information in the original

TOE incomplete, but a revised TOE was not issued. The inspectors determined that not updating the TOE promptly following discovery of additional information represented a missed opportunity to clarify the significance and extent of the condition. At the conclusion of the inspection, the licensee was coordinating with the EDG and PCV vendors and anticipated a PCV design change to resolve the degraded condition in June 2002.

The finding of deficiencies in identifying, communicating, and addressing a common cause degradation of the air starting systems of the sites four EDGs had a credible impact on safety because it could have affected the reliability of the backup AC power system. Had there been a more thorough evaluation and a less ambiguous communication of the significance and extent of the EDG air starting system degradation, the licensee could have been more aggressive in resolving the condition while postponing other activities that increased backup AC power system risk in the interim. The inspectors determined that the deficiencies did not constitute a violation because the EDG air starting system degradation was ultimately identified, communicated, and addressed. The finding was determined to be of very low safety significance (Green) because no actual loss of safety function was identified.

1R05 Fire Protection a. Inspection Scope The inspectors conducted tours of areas important to reactor safety, listed below, to evaluate conditions related to (1) control of transient combustibles and ignition sources; (2) the material condition, operational status, and operational lineup of fire protection systems, equipment and features; and (3) the fire barriers used to prevent fire damage or fire spread. The inspectors referenced SPP-10.10, Control of Transient Combustibles, and prefire plans, as appropriate.

• 1B-B safety injection pump room

• Units 1 and 2 main turbine hydrogen seal oil areas

• Unit 2 reactor protection system motor generator set area

• EDGs 1A and 2A rooms

• Unit 1 penetration room

• Unit 2 penetration room b. Findings No findings of significance were identified.

1R06 Flood Protection Measures a. Inspection Scope The inspectors reviewed selected risk-important plant design features and procedures, and other documents (listed in the Attachment) intended to protect the plant and its safety-related equipment from internal and external flooding events. The inspectors reviewed selected risk-important internal and external flood protection barriers to evaluate

the adequacy of those attributes protecting risk-important equipment. The inspectors performed a walkdown of risk-significant areas, susceptible systems, and equipment to verify that the floor drain system, including room sump pumps and level sensors, were operable, including:

• Auxiliary building elevations 653' and 669'

• Turbine building elevation 662'

• Essential raw cooling water (ERCW) pump house elevations 704' and 720'

• EDG building

• 161-kV cable tunnel The inspectors also reviewed: (1) plant procedures for coping with flooding events to verify that the actions were consistent with the plants design basis assumptions; (2) flood related PERs written in 2000 and 2001 to verify adequacy of corrective actions; and (3)

selected completed preventive maintenance procedures and work orders for water level switches and sump pumps for completeness and frequency.

b. Findings No findings of significance were identified.

1R11 Licensed Operator Requalification a. Inspection Scope The inspectors observed operators in the simulator respond to several accident scenarios including a security threat and anticipated transient without scram with a subsequent steam generator tube rupture and an earthquake with reactor trip and subsequent large break loss of coolant accident. The inspectors referenced simulator guides OPL273S0204 and OPL273S0201. The inspectors assessed the following operating crew attributes: (1) clarity and formality of communication; (2) ability to take timely action in the safe direction; (3) prioritization, interpretation, and verification of alarms; (4) correct use and implementation of procedures, including the alarm response procedures; (5) timely control board operation and manipulation, including high-risk operator actions; (6) oversight and direction provided by the shift manager, including ability to identify and implement appropriate TS action such as reporting and emergency plan actions and notifications; and (7) the group dynamics involved in crew performance. The inspectors also reviewed discrepancies between the simulator and the plants main control room.

b. Findings No findings of significance were identified.

1R12 Maintenance Rule Implementation a. Inspection Scope The inspectors sampled performance problems listed below, from selected structures, systems or components (SSCs). The inspectors reviewed PERs and Cause Determination Forms (listed in the Attachment), to assess the effectiveness of the licensees maintenance practices for these problems. The inspectors evaluated the licensees Maintenance Rule (MR) implementation against Procedure SPP-6.6, Maintenance Rule Performance Indicator, Monitoring, Trending, and Reporting -

10CFR50.65 and Instruction 0-TI-SXX-000-004.0, same title as SPP-6.6. Reviews focused on: (1) MR scoping; (2) characterization of failed SSCs; (3) safety significance classifications; (4) 10CFR 50.65 (a)(1) or (a)(2) classifications; and (5) the appropriateness of performance criteria for SSCs classified as (a)(2) or goals and corrective actions for SSCs classified as (a)(1).

• Residual heat removal (RHR) pumps 1A-A and 1B-B manual start failures

• Watts Bar No. 1 transmission line breaker PCB 5018 unplanned interruptions

• Repetitive failures of Camflex II valve actuator diaphragms

• Use of integrated computer system indication in emergency operating procedures for emergency boration

• RHR heat exchanger bypass flow control valve failure to stroke

• Beta annunciator system failure b. Findings No findings of significance were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control a. Inspection Scope The inspectors evaluated, as appropriate for the selected work activities listed below: (1)

the effectiveness of the risk assessments performed before maintenance activities were conducted; (2) the management of risk that, upon identification of an unforseen situation, necessary steps were taken to plan and control the resulting emergent work activities; and (3) the adequacy with which maintenance risk assessments and emergent work problems were identified and resolved. The inspectors referenced Procedures SPP-7.1, Work Control Process, and Instruction 0-TI-DSM-000-007.1, Equipment to Plant Risk Matrix, and other documents (listed in the Attachment) during these inspection activities.

• EDG 2A-A six-day on-line preventive maintenance outage

• Containment spray system 1A heat exchanger ERCW system cooling supply piping through-wall leak

• Simultaneous emergent work on Unit 1 protection set III card failure, main feedwater master flow controller in manual, and main steam dump valve controller in steam pressure mode

• Simultaneous maintenance on Unit 1 turbine driven auxiliary feedwater pump and alternate feeder breaker to 6.9KV shutdown board 1B

• Repair of the A inter-tie sudden pressure relay b. Findings A finding of very low safety significance (Green) was identified by the inspectors for not effectively assessing overall plant risk prior to removing an EDG from service for an extended maintenance outage.

On February 18, EDG 1A-A was removed from service to perform a six-day preventive maintenance (PM) outage. Redundant EDGs were under review by the licensee at the time for two conditions adverse to quality. These adverse conditions were:

• The failure of EDG 2A-A to start from a standby condition, which the licensee had characterized as significant. However, the cause of the failure had been prematurely characterized as a random failure and was not fully understood nor corrected (discussed in Section 1R15.2).

• The periodic uncontrolled blowdown of the starting air systems for EDGs 1B-B, 2A-A, and 2B-B, a common-cause degraded condition of redundant EDG starting air systems. This problem was characterized by the licensee as a degraded condition in accordance with Generic Letter 91-18 (discussed in Section 1R04.2).

Prior to the EDG 1A-A outage, the inspectors discussed with licensee management the potential risk impact of initiating an extended EDG outage in light of the identified adverse conditions. Subsequently, the licensee elected to start EDG 1B-B prior to removing the EDG 1A-A to demonstrate its operability and continued with the outage.

Procedure SPP-7.1, Work Control Process states, in part, that an assessment of scheduled activities is performed before implementation of a work window and that assessment includes a review of significant performance issues of the in-service redundant SSCs. Although the licensee had, prior to the outage, conducted an SPP 7.1 assessment, and also had started redundant EDG 1B-B, the inspectors noted that the two adverse conditions discussed above had not been evaluated during the licensees pre-outage assessment. The licensee informed the inspectors that the adverse conditions discussed above had not been considered to constitute significant performance issues in the context of SPP-7.1 and therefore were not assessed nor documented during the work control process. The licensee acknowledged that the term significant performance issue was not well defined in work control procedures.

Based on this information, the inspectors considered the adverse conditions discussed above to constitute significant performance issues that should have been assessed and documented prior to removal of EDG 1A-A from service. As a possible consequence, operations and work control personnel understanding and consideration of the significance and extent of the adverse conditions when assessing plant risk varied. The licensee initiated PER 02-003168-000 to evaluate the work control process for potential vulnerabilities when assessing the risk of removing SSCs from service when other equipment has not been fully evaluated for potential degradation.

In addition, the inspectors observed that Instruction 0-TI-DSM-000-007.1, Equipment to Plant Risk Matrix, states, in part, that if a piece of equipment is operable, but is degraded, or is trending towards a degraded condition, its redundant counterpart equipment should not be removed from service for a routine PM action. The inspectors observed that the removal of EDG 1A-A for a scheduled PM action prior to resolving the cause of the EDG 2A-A failure-to-start and the periodic uncontrolled blowdown of the starting air systems for EDGs 1B-B, 2A-A, and 2B-B appeared contrary to the intent of the procedure.

The finding had a credible impact on safety because not effectively assessing the risk of the extended EDG outage could have affected the overall reliability (i.e. defense in depth)

of the backup AC power system by permitting a higher risk configuration to exist than might otherwise be allowed. The finding did not constitute a violation because a risk assessment, as required by 10 CFR 50.65(a)(4), had been performed. However, the inspectors determined that the risk assessment was of reduced effectiveness. The finding was of very low safety significance (Green) because no actual loss of safety function was identified.

1R14 Personnel Performance During Non-Routine Plant Evolutions a. Inspection Scope On January 4, while Unit 1 was operating at 100 percent power, the main feedwater system flow increased due to an ongoing maintenance activity which resulted in the feedwater system overpressurizing and feedwater heater relief valves lifting. The inspectors reviewed plant operating logs, plant computer information and plant procedures. The inspectors also reviewed the associated PER and discussed the transient with operations and engineering personnel.

b. Findings No findings of significance were identified.

1R15 Operability Evaluations a. Inspection Scope The inspectors reviewed selected functional evaluations (FEs) and PERs (listed in the Attachment) and related documents for issues affecting risk-significant mitigating systems to assess, as appropriate: (1) the technical adequacy of the evaluations; (2) whether continued system operability was warranted; (3) whether other existing degraded conditions were considered as compensating measures; (4) where compensatory measures were involved, whether the compensatory measures were in place, would work as intended, and were appropriately controlled; and (5) where continued operability was considered unjustified, the impact on TS limiting condition for operation (LCO) and the risk-significance in accordance with the SDP. The inspectors referenced Procedure SPP-3.1, Corrective Action Program, which provides guidance for operability determinations, as needed, during the course of these inspection activities.

• Failure to refill containment spray heat exchanger 1A-A after Unit 1 refueling outage

• EDG 2A-A generator C phase lead damage

• Failure to latch auxiliary building secondary containment exclusion (ABSCE) door A55

• Minor leakage at D-14 flux thimble since U1 cycle 11 startup

• RHR pump 1A determined operable following failure to start

• Inadequate common cause evaluation when EDG 2A-A failed to start from standby condition b. Findings

.1 Failure to Latch Auxiliary Building Secondary Containment Exclusion (ABSCE)/Fire Door A finding of very low safety significance (Green) was identified by the inspectors for failure to maintain a door shut, which was required to be closed and latched to maintain the integrity of the ABSCE boundary and to prevent the spread of a fire. The finding was also a non-cited violation of TS License Condition 2.C.16 (Fire Protection Program).

On February 5 while conducting a routine tour of the auxiliary building, the inspectors found ABSCE/fire door A55 ajar. The door is required to be maintained shut and latched for other than normal passage. The inspectors immediately secured the door and notified the licensee.

The licensee performed an operability evaluation because having door A55 unsecured presented a potential operability issue for the auxiliary building gas treatment system (ABGTS). The auxiliary building, under accident conditions, is maintained under a negative pressure relative to the outside environment by the ABGTS to ensure that potentially radioactive air is filtered before it is released through the plant stack. The evaluation concluded that having door A55 slightly open more than 0.3 inches could present an inoperable condition. When the inspectors found the door unsecured on February 5, it was opened less than 0.3 inches, therefore operability was not affected.

The inspectors reviewed the licensees operability assessment and concluded it was reasonable, including the licensees position that because fire detection had been operable on both sides of the door that fire operating requirements were satisfied.

The licensee had previously initiated several PERs related to both mechanical and human performance issues related to operation of door A55. In addition, as a result of the inspectors discovery on February 5, the licensee initiated Level B PER 02-001233-000 indicating that the condition was a significant condition adverse to quality. The inspectors later confirmed that the door was somewhat difficult to latch but noted that its mechanical condition did not prevent it from being properly secured. The inspectors review of the issue determined that licensee personnel were sometimes inattentive when using the door. This inattentiveness on at least two occasions led the inspectors to conclude that the door could be left more than 0.3 inches open.

The finding had a credible impact on safety because failure to properly secure door A55 could result in it being greater than 0.3 inches open therefore potentially affecting the operability of the ABGTS. In addition, from a fire risk perspective, having the door unlatched potentially reduced the effectiveness of the fire barrier which separates a fire area containing redundant trains of safe shutdown equipment. However, because the

finding represented only a potential degradation of the radiological barrier for the auxiliary building, and because fire detection and suppression were operable on both sides of the door and there were no plant activities in the affected area to substantially increase the severity of a postulated fire, the finding was of very low safety significance (Green).

TS License Condition 2.C.16 requires that TVA implement and maintain in effect all provisions of the approved fire protection program. Fire protection program requirements defined in the Sequoyah Fire Protection Report, Part II, Section 14.6, requires that all fire barrier penetrations barriers in fire zone boundaries protecting safety related areas shall be functional. Procedure 0-SI-FPU-410-703.0, Inspection of FPR Required Fire Doors, Rev. 0, Step 6.3.2, which implements the requirements of the Fire Protection Program, requires that all doors are shut and latched. Contrary to the above, On February 5, the inspectors found door A55 unlatched for other than normal passage. However, because the violation was of very low safety significance and was entered into the licensees corrective action program, the violation is being treated as a non-cited violation (NCV)

consistent with Section VI.A.1 of the NRC Enforcement Policy, and is identified as NCV 50-327, 328/01-05-01. Failure to Ensure ABSCE/Fire Door A55 Shut and Latched. This violation was entered into the licensees corrective action program as PER 02-001233-000.

.2 Inadequate Common Cause Evaluation Following EDG 2A-A Start Failure A finding of very low safety significance (Green) was identified by the inspectors for failure to demonstrate operability of the remaining EDGs following a start failure of EDG 2A-A.

The finding was also a non-cited violation of TS 3.8.1.1, Action b, (AC Sources).

On November 13, 2001, EDG 2A-A failed to start from a standby condition when given a local start signal. Following inconclusive troubleshooting, the licensee determined that a random failure had occurred. A common cause evaluation that was initiated to comply with TS 3.8.1.1, Action b, stated Since the exact cause could not be determined, it is concluded that a random failure of the devices occurred... Therefore, no common cause has been identified and running of the remaining three D/Gs is not required. PER 01-010452-000 that was initiated as a result of the start failure, however, remained open pending further troubleshooting that subsequently identified air-start component design and/or performance problems currently under review by the licensee. In addition, another air-start subsystem failure occurred on February 12 when EDG 2B-B failed to start as expected during testing with one air start subsystem disabled.

The inspectors concluded that the licensee failed to comply with TS 3.8.1.1 based on the inspectors review of the TS and associated bases, subsequent licensee troubleshooting findings, and discussions with the licensee and the NRC Office of Nuclear Reactor Regulation (NRR) staff. The TS Bases for TS 3.8.1.1 states, The action to determine that the OPERABLE diesel generators are not inoperable due to common cause failures provides an allowance to avoid unnecessary testing of OPERABLE diesel generators. If it can be determined that the cause of the inoperable diesel generator does not exist on the OPERABLE diesel generators, Surveillance Requirement (SR) 4.8.1.1.2.a.4 does not have to be performed. The inspectors and NRR staff concluded that the licensees random failure determination was not sufficiently supported by troubleshooting or

analysis to justify not performing SR 4.8.1.1.2.a.4 and that the required starts would not have constituted unnecessary testing.

The finding had a credible impact on safety and could have affected the operability of the remaining EDGs because not performing the required starts for the remaining EDGs resulted in a potential common cause failure mode not being addressed. The finding was of very low safety significance (Green) because the remaining EDGs were subsequently started during their routine surveillance intervals which demonstrated that their safety function had not been lost.

TS 3.8.1.1, Action b. requires in part that, within 24-hours following an EDG failure, the remaining EDGs be demonstrated OPERABLE by either determining that they are not inoperable due to common cause failure or by performing SR 4.8.1.1.2.a.4 which requires that they be started. Contrary to the above, on or about November 13, 2001, the licensees common cause evaluation, based on inconclusive troubleshooting and random failure characterization did not demonstrate that the remaining EDGs were OPERABLE nor was SR 4.8.1.1.2.a.4 performed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. However, because the violation was of very low safety significance and was entered into the licensees corrective action program, the violation is being treated as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy, and is identified as NCV 50-327, 328/01-05-02, Failure to Start Remaining EDGs When EDG 2A-A Failed to Start. This issue was entered into the licensees corrective action program as PER 02-003722-000.

1R16 Operator Work-Arounds a. Inspection Scope The inspectors evaluated operator work-around Sq01003, Excess Letdown Valve 1-FCV-62-56 Cannot Be Throttled to Control Excess Letdown Flow, and related PER 01-011436, for potential effects on the functionality of mitigating systems. The work-around was reviewed to determine (1) if the functional capability of the system or human reliability in responding to an initiating event was affected; (2) the effect on the operators ability to implement abnormal or emergency procedures; and (3) if operator work-around problems were captured in the licensees corrective action program.

b. Findings No findings of significance were identified.

1R19 Post-Maintenance Testing a. Inspection Scope The inspectors reviewed Procedure SPP-6.3, Pre/Post Maintenance Testing (PMT) which governs the licensees PMT process, and reviewed work orders (WO) and/or test activities, as appropriate, for the following maintenance activities to assess whether: (1)

the effect of testing on the plant had been adequately addressed by control room and/or engineering personnel; (2) testing was adequate for the maintenance performed; (3)

acceptance criteria were clear and adequately demonstrated operational readiness

consistent with design and licensing basis documents, (4) test instrumentation had current calibrations, range and accuracy consistent with the application, (5) tests were performed as written with applicable prerequisites satisfied; (6) jumpers installed or leads lifted were properly controlled; (7) test equipment was removed following testing; and (8) equipment was returned to the status required to perform its safety function. Documents reviewed during the inspection are listed in the Attachment.

• Unit 1 main feedwater pumps master controller repair

• Unit 1 main steam dump valve arming controller maintenance

• Unit 1 protection set III card failure

• Unit 2 main generator stator water cooling differential pressure instrument

• 125V DC vital battery charger III maintenance

• U1 No. 4 S/G level control valve, 1-LCV-3-171-A, positioner testing b. Findings No findings of significance were identified.

1R22 Surveillance Testing a. Inspection Scope The inspectors witnessed surveillance tests and/or reviewed test data of selected risk-significant SSCs conducted using the surveillance instructions, listed in the Attachment, to assess, as appropriate, whether the SSCs met TS, the UFSAR, and licensee procedure requirements, and to determine if the testing effectively demonstrated that the SSCs were operationally ready and capable of performing their intended safety functions.

• Unit 2 reactor coolant system leakage test

• Unit 1 train B hydrogen igniter operability test

• Failure to properly reschedule Unit 1 surveillance tests to meet required frequency

• Functional test of reactor coolant system cold overpressurization protection system

• U1 No. 4 S/G level control valve 1-LCV-3-171-A positioner testing

• EDG 2B-B ERCW cooling isolation valve return to service following repair b. Findings No findings of significance were identified.

1EP6 Drill, Exercise, and Actual Events a. Inspection Scope The inspectors observed the licensee perform simulated emergency classifications and notifications during licensed operator simulator training. The inspectors evaluated the emergency classifications and notifications that were made for accuracy and timeliness.

The inspectors also observed the training critiques to ensure appropriate feedback was given by the training instructors and emergency preparedness personnel.

b. Findings No findings of significance were identified.

OTHER ACTIVITIES 4OA1 Performance Indicator Verification Licensee records were reviewed to determine whether the submitted performance indicator (PI) statistics were calculated in accordance with the guidance contained in NEI 99-02, Regulatory Assessment Performance Indicator Guideline.

Cornerstone: Mitigating Systems

.1 Safety System Unavailability for High Pressure Injection a. Inspection Scope The inspectors sampled plant records and data against the reported PI data for the period from January 1 through December 31, 2001 to determine the accuracy and completeness of the PI data. In addition, the inspectors reviewed the licensees corrective action program to determine if any problems with the collection of PI data had occurred and if resolution was satisfactory.

b. Findings No findings of significance were identified.

Cornerstone: Barrier Integrity

.2 RCS Leakage a. Inspection Scope The inspectors reviewed TS surveillance tests results from the period beginning January 2001 through September 2001 for both units and compared those results to the NRC reported values. The inspectors discussed with engineering personnel any problems that had occurred related to collection and reporting of the leakage data. The inspectors also observed operators perform Procedure 0-SI-OPS-068-137.0, Reactor Coolant System Water Inventory, which was the source of reported data.

b. Findings No findings of significance were identified.

4OA3 Event Follow-up a. Inspection Scope The inspectors reviewed the licensees response to information provided by Westinghouse that indicated the setpoint for the reactor trip signal on low-low steam generator (S/G) water level was nonconservative. The inspectors reviewed operator logs and plant procedures, including administrative procedures for procedure changes. The inspectors also discussed the licensees response with numerous plant personnel and their management.

b. Findings A finding of greater than minor significance (No Color) was identified by the inspectors for the licensee failing to follow administrative guidance for procedure changes. The finding was also a non-cited violation of TS 6.8.1.a, Procedures and Programs.

On February 15, the licensee was informed by Westinghouse that the reactor trip setpoint for low-low S/G water level had a process measurement uncertainty which had not been previously accounted for in the S/G level calculation. The calculation had not accounted for a pressure drop across the moisture separator mid-deck plate in the S/G upper internals. The licensee elected to change the setpoint from 10.7 to 15 percent to account for this uncertainty. On that day, both units were operating at 100 percent power. Unit 1 was in the process of venting the primary containment for normal plant operations.

In order to change the setpoint to 15.0 percent, the licensee used the environmental allowance modifiers (EAMs). In order to change the setpoint to 15.0 percent, the licensee used the environmental allowance modifiers (EAMs). The EAMs are permanently installed devices that, under accident conditions (when containment pressure increases to 0.5 psig) automatically increase the S/G low-low water reactor trip setpoint from 10.7 to 15 percent to compensate for the adverse containment environment. They permit use of a lower trip setpoint under normal conditions while ensuring that the trip occurs when required under adverse conditions. During routine containment venting, the EAMs are manually adjusted from 10.7 to 15.0 percent to ensure the 0.5 psig automatic setpoint is unaffected by having an open containment vent pathway.

On Unit 1, the licensee, using Procedure 0-SO-30-8, Containment Pressure Control, Rev.

11, had already placed the EAMs at 15 percent for routine containment venting. When the licensee was informed about the S/G water level uncertainty issue on February 15, the EAMs were left at 15 percent and Procedure 0-SO-30-8 was exited. Operators N/Ad procedure steps that would have restored the EAMs back to their normal setpoint. On Unit 2, operators declared the associated S/G water level instruments inoperable and entered TS 3.0.3. Shortly afterwards, Procedure 0-SO-30-8 was entered for the sole purpose of changing the EAM setpoint to 15 percent.

The inspectors reviewed the purpose of Procedure 0-SO-30-8, Rev 11, and the licensees procedure for procedure changes, SPP-2.2, Administration of Site Technical Procedures, Rev. 8. The purpose of Procedure 0-SO-30-8 is to provide ...the steps necessary for the operation of the Containment Pressure Control System. SPP-2.2, requires that

procedure users follow current approved procedures as written, or obtain approval of necessary changes. Based on this review, the inspectors determined that Procedure 0-SO-30-8, which temporarily resets the S/G low-low water reactor trip setpoint during venting, was used to make a change to this setpoint for a purpose unrelated to venting.

As such, when the licensee changed the reactor trip setpoint on both units, based on the Westinghouse-provided information, an intent-change review of Procedure 0-SO-30-8 was required to be conducted. Although not completed before the change was implemented, the review was completed several hours later on February 16. The results of that review indicated that using Procedure 0-SO-30-8 as a means to leave the setpoint for both units at 15 percent did not present an unreviewed safety question.

The inspectors determined that failing to perform an intent-change review before implementing the procedure changes was of more than minor significance because this programmatic requirement ensures that when changes are made to the facility that corresponding procedure changes are fully understood in advance of the facility change.

This licensee performance issue did not directly affect any initiating events or mitigation equipment, and was thus not evaluated using the NRC Significance Determination Process (No Color).

TS 6.8.1.a, requires that written procedures shall be implemented covering the activities referenced in Appendix A of Regulatory Guide 1.33, February 1978, (Paragraph 1).

Paragraph 1 recommends that administrative procedures for procedure review and approval be established. Step 3.1.1 A of SPP-2.2, requires that procedure users follow current approved procedures as written, or obtain approval of necessary changes in accordance with SPP-2.2 before proceeding. Contrary to the above, On February 15, the licensee failed to complete the necessary procedure change review before N/Aing the steps and exiting Procedure 0-SO-30-8 on Unit 1 and before entering the procedure on Unit 2, for a purpose other than stated in Procedure 0-SO-30-8. However, because the failure to follow administrative procedures did not affect any initiating event or mitigation equipment and was entered into the licensees corrective action program, the violation is being treated as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy, and is identified as NCV 50-327, 328/01-05-03, Failure to Follow Administrative Guidance for Procedure Changes. This violation was entered into the licensees corrective action program as PER 02-003222-000.

4OA5 Other (Closed) TI 2515/146, Hydrogen Storage Locations The inspectors reviewed the UFSAR and walked down the plant to identify areas where bulk hydrogen gas was stored. The inspectors determined that all bulk hydrogen storage was greater than 50 feet from ventilation intakes, safety related water tanks, and safety-related or risk-significant SSC's.

4OA6 Meetings, Including Exit

.1 The inspectors presented the inspection results to Mr. Richard Purcell, Site Vice President, and other members of licensee management on April 4, 2002. The inspectors

asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.

.2 Annual Assessment Meeting Summary On March 18, 2002, the NRC Division of Reactor Projects Branch Chief and the Senior Resident Inspector assigned to Sequoyah met with Tennessee Valley Authority, to discuss the NRCs Reactor Oversight Process (ROP) and the Sequoyah annual assessment of safety performance for the period of April 1, 2001 - December 31, 2001. The major topics addressed were: the NRCs assessment program, the results of the Sequoyah assessment, and the NRCs Agency Action Matrix. Attendees included Sequoyah site management, members of site staff, and a local official.

This meeting was open to the public. Information used for the discussions of the ROP is available from the NRCs document system (ADAMS) as accession number ML020600179. ADAMS is accessible from the NRC Web site at http://www.nrc.gov/NRC/ADAMS/index.html (the Public Electronic Reading Room).

4OA7 Licensee Identified Violations The following findings of very low significance were identified by the licensee and are violations of NRC requirements which meet the criteria of Section VI of the NRC Enforcement Policy, NUREG-1600 for being dispositioned as NCVs.

NCV Tracking Number Requirement Licensee Failed to Meet 50-327/01-05-04 TS 6.8.1.a, Procedures and Programs, requires that written procedures be implemented covering the activities recommended in Appendix A of Regulatory Guide 1.33, Rev.

2 (Paragraph 1). Paragraph 1 requires written procedures for equipment control (e.g., locking and tagging) be implemented. Contrary to the above, on November 19, 2001, Tagout Number 1-TO-2001-001 was closed without performing release instruction number three. This instruction required the Unit 1A-A containment spray heat exchanger to be filled in accordance with the applicable operating procedure. The issue is in the licensees corrective action program as PER 01-011549-000 (Green).

50-327, 328/01-05-05 TS 6.8.1.a, Procedures and Programs, requires that written procedures be established covering the activities recommended in Appendix A of Regulatory Guide 1.33, Rev.

2 (Paragraph 3). Paragraph 3 recommends that instructions for filling the chemical and volume control system (CVCS)

be established. Contrary to the above, the licensee determined in response to a January 9, 2002 condition that the procedure for filling the CVCS, 1-SO-62-1, Chemical and Volume Control System, Rev. 27, was deficient because it did not provide adequate instructions to ensure piping

adjacent to the 1-FCV-63-8 valve was full after the system was drained. This issue is in the licensees corrective action program as PER 02-000281-000 (Green).

SUPPLEMENTAL INFORMATION PARTIAL LIST OF PERSONS CONTACTED Licensee T. Carson, Maintenance Manager R. Drake, Maintenance and Modifications Manager E. Freeman, Operations Manager J. Gates, Manager, Business & Work Performance C. Kent, Radcon/Chemistry Manager D. Koehl, Plant Manager M. Lorek, Assistant Plant Manager D. Lundy, Site Engineering Manager R. Purcell, Site Vice President P. Salas, Licensing and Industry Affairs Manager K. Stephens, Security Manager NRC R. Bernhard, Region II Senior Reactor Analyst ITEMS OPENED AND CLOSED Opened and Closed 50-327, 328/01-05-01 NCV Failure to Ensure ABSCE/Fire Door A55 Shut and Latched (Section 1R15).

50-327, 328/01-05-02 NCV Failure to Start Remaining EDGs When EDG 2A-A Failed to Start (Section 1R15).

50-327, 328/01-05-03 NCV Failure to Follow Administrative Guidance for Procedure Changes (Section 4OA3).

50-327/01-05-04 NCV Failure to Refill Unit 1A-A Containment Spray Heat Exchanger After Outage (Section 4OA7).

50-327, 328/01-05-05 NCV Inadequate Procedure for Filling ECCS (Section 4OA7).

Attachment

LIST OF DOCUMENTS REVIEWED 1R04 Equipment Alignment

• PERs 01-000489-000, 01-007184-000, 01-007350-000, 01-008578-000, 01-010452-000, 02-000896-000, 02-001424-000

• EASI Report of Open Work Orders for System 082, Units 1 and 2

• First Quarter FY02 System 082/018 Status Report, Units 1 and 2

• Function 82A Reliability/Availability Performance Reports, Units 1 and 2

• CCD No: 1,2-47W839-1 R29, Flow Diagram - Diesel Starting Air System 1R06 Flood Protection Measures

• UFSAR Sections 2.3 and 2.4, including Appendix 2.4A, Flood Protection Plan

• Emergency Operating Instruction 3, Secondary Containment Control

• System Operation Instruction 0-SO-84-1, Flood Mode Boration Makeup System

• Abnormal Operating Procedures AOP-N.03, Flooding

• PER 00-009050-000

• PER 01-000711-000

• PER 01-011639-000 1R12 Maintenance Rule Implementation

• PER 01-009681-000

• PER 01-010354-000

• CDEFs 1374, 1375, and 1401

• PER 01-011468-000

• PER 02-000282-000

• PER 01-008322-000

• PER 01-002283-000 1R13 Maintenance Risk Assessments and Emergent Work Control

• PER 01-010452-000

• PER 01-007184-000

• PER 02-001424-000

• 0-TI-DSM-000-007.1, Figure 1 Plan Checklist, competed November 29, 2002

• Operator log for February 5

• ORAM-SENTINAL printout during February 4 through February 8

• Plan of the day reports

• Operator logs for January 28

• PER 02-000515-000 1R15 Operability Evaluations

• PER 01-011549-000 and associated engineering evaluation

• Tagout number 1-TO-2001-001

• PER 02-001176-000 and associated FE

• PER 01-011739-000; Westinghouse letter TVA-01-198

• PER 01-009681-000

• PER 01-010354-000

• CDEFs 1374, 1375, and 1401

• PER 01-010452-000 1R19 Post-Maintenance Testing

• WO 02-000120-000

• PER 02-000133-000

• WO 02-000015-000

• PER 02-000027-000

• WO 02-000053-000

• PER 01-011752-000

• WO 01-011743-000

• PER 02-000332-000

• WO 02-00319-000

• PER 02-000785-000

• WO 02-00001-000

• WO 02-000783-000

• 1-SI-ICC-003-171.B, title

• 0-SI-OPS-000-206.0, title 1R22 Surveillance Testing

• 0-SI-OPS-068-137.0, Reactor Coolant System Water Inventory

• SI-305.2, Hydrogen Mitigation System Operability

• 1-SI-IFT-068-06D.3, Functional Test of Loop 1 Reactor Cooland Flow Channel F-68-6D (F-416) Protection Set II, Rack 9

• 1-SI-IFT-068-29D.3, Functional Test of Loop 2 Reactor Coolant Flow Channel F-68-29D (F-426) Protection Set III, Rack 9

• 1-SI-IFT-068-48D.3, Functional Test of Loop 3 Reactor Coolant Flow Channel F-68-48D (F-436) Protection Set III, Rack 9

• 1-SI-IFT-068-71D.3, Functional Test of Loop 3 Reactor Coolant Flow Channel F-68-71D (F-446) Protection Set III, Rack 9

• PER 01-011328

• 1-SI-IFT-068-455.0, Functional Test of RCS Cold Overpressurization Protection System PORV PCV-68-340A (PCV-455A)

• 0-SI-SXV-000-206.0, Testinf of Category A and B Valves After Work Activities, Upon Release From a Hold Order or When Transferred From Other Documents

• PER 02-000785-000

• WO 02-00001-000

• WO 02-000783-000

• 1-SI-ICC-003-171.B, Channel Calibration of Steam Generator 4 Motor Driven Auxiliary Feedwater Train B Level Loop 1-L-3-171

• 0-SI-SXV-000-206.0, Testing of Category A and B Valves After Work Activities