EA-96-457, 96-458, 96-464 - Saint Lucie 1 & 2 (Florida Power & Light Co.)
Florida Power and Light Company
ATTN: Mr. T. F. Plunkett
President - Nuclear Division
P. O. Box 14000
Juno Beach, FL 33408-0420
SUBJECT: NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTIES - $100,000 (NRC INSPECTION REPORTS NOS. 50-335 AND 50-389/96-19, 96-18, AND 96-22)
Dear Mr. Plunkett:
This refers to three inspections conducted during the period October 7 through November 26, 1996, at your St. Lucie Nuclear Plant. The inspections included a review of the plant security access control program, the emergency preparedness program, and recent modifications to nuclear instrumentation. The results of the three inspections were formally transmitted to you by letters dated November 15 and 26, 1996. A closed predecisional enforcement conference was conducted in the Region II office on December 10, 1996, with you and members of your staff to discuss the apparent violations, the root causes, and corrective actions to preclude recurrence. A list of conference attendees, NRC slides, and a copy of Florida Power and Light Company's (FPL) presentation materials are enclosed.
Based on the information developed during the inspections and the information provided during the conference, the NRC has determined that violations of NRC requirements occurred. The violations are cited in the enclosed Notice of Violation and Proposed Imposition of Civil Penalties (Notice). The circumstances surrounding the violations as well as the other issues addressed at the conference were described in detail in the subject inspection reports and are addressed in the enclosures with respect to NRC's disposition of the issues, actual and potential safety consequence, and application of the Enforcement Policy.
Overall, the violations involved issues of significant regulatory concern in three areas: the security access control program, the emergency preparedness program, and the design control process as described below:
· The failure of the access control program to limit access to protected and vital areas of the plant to only those individuals who were authorized, as required by 10 CFR 73.55. In addition, upon identification of an unauthorized entry, there was a failure to notify the NRC within one hour, as required by 10 CFR 73, Appendix G. (EA 96-458)
- The failure to appropriately implement various aspects of the Radiological
Emergency Plan (REP), including maintaining the capability to augment
the onsite staff in a timely manner, adequately incorporating REP requirements
into implementing procedures, and conducting required training for emergency
response organization personnel. (EA 96-464)
- The failure to accurately translate design requirements into drawings and to provide independent review of a modification to excore nuclear instrumentation. The failure to specify clearly design requirements for incore flux monitoring software and a failure to provide independent review of the adequacy of the new software. In addition, the failure to prepare a Condition Report as required by plant procedures when markings for electrical terminal connectors on a replacement excore neutron detector were found to be different from existing cable markings. (EA 96-457)
To emphasize the importance of prompt recognition of violations and the need for timely and comprehensive corrective actions, I have been authorized, after consultation with the Director, Office of Enforcement, to issue the enclosed Notice with proposed civil penalties totalling $100,000. A proposed civil penalty of $50,000 was assessed for a Severity Level III problem in Part I of the enclosed Notice that related to the access control program (EA 96-458). A proposed civil penalty of $50,000 was assessed for a Severity Level III problem in Part II of the enclosed Notice that related to emergency preparedness (EA 96-464). The application of the Enforcement Policy and the assessment process for each of the cases are discussed in detail in the enclosures to this letter. Although the violations in these three areas are functionally unrelated, the NRC is concerned that collectively they reflect particularly poor overall performance by FPL.
You are required to respond to this letter and should follow the instructions prescribed in the enclosed Notice (Enclosure 4) when preparing your response. In addition, your attention is also directed to Enclosure 2 which requests you to provide a response regarding the identified emergency preparedness program weakness. The NRC will consider your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.
In addition, the NRC is very concerned about FPL's apparent lack of responsiveness and sensitivity to emergency preparedness issues that were raised by a concerned employee with FPL management. As discussed in
Enclosure 2 to this letter, there were multiple opportunities to pursue these concerns when they were brought to your attention yet you failed to do so. We will be contacting you in the near future to confirm arrangements for a meeting to further discuss your views as to the actions required to maintain a safety-conscious work environment, the effectiveness of your programs designed to ensure employees are free to raise safety concerns, and your actions to ensure that employee concerns are promptly dispositioned with appropriate resolution feedback to the concerned employee. We would also expect to discuss at this meeting the results of the NRC's Annual Report of the Allegation Advisor, dated October 7, 1996, which contains an analysis indicating a substantial increase in the number of allegations received regarding activities at the St. Lucie facility during the period October 1992 through May 1996.
In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosures, and your response will be placed in the NRC Public Document Room.
Sincerely, Original signed by E. W. Merschoff Luis A. Reyes Regional Administrator
Docket Nos. 50-335, 50-389
License Nos. DPR-67, NPF-16
1. Description of Violations for EA 96-458
2. Description of Violations for EA 96-464
3. Description of Violations for EA 96-457
4. Notice of Violation and Proposed Imposition of Civil Penalties
5. Conference Attendees (Not to be Published in NUREG-0940)
6. Licensee Presentation Material (Not to be Published in NUREG-0940)
7. NRC Presentation Material (Not to be Published in NUREG-0940)
J. A. Stall
Site Vice President
St. Lucie Nuclear Plant
P. O. Box 128
Ft. Pierce, FL 34954-0128
H. N. Paduano, Manager
Licensing and Special Programs
Florida Power and Light Company
P. O. Box 14000
Juno Beach, FL 33408-0420
Plant General Manager
St. Lucie Nuclear Plant
P. O. Box 128
Ft. Pierce, FL 34954-0128
E. J. Weinkam
Plant Licensing Manager
St. Lucie Nuclear Plant
P. O. Box 128
Ft. Pierce, FL 34954-0128
M. S. Ross, Attorney
Florida Power & Light
11770 US Highway 1
North Palm Beach, FL 33408
John T. Butler, Esq.
Steel, Hector and Davis
4000 Southeast Financial Center
Miami, FL 33131-2398
Office of Radiation Control
Department of Health and
1317 Winewood Boulevard
Tallahassee, FL 32399-0700
Joe Myers, Director
Division of Emergency Preparedness
Department of Community Affairs
2740 Centerview Drive
Tallahassee, FL 32399-2100
Thomas R. L. Kindred
St. Lucie County
2300 Virginia Avenue
Ft. Pierce, FL 34982
PROPOSED IMPOSITION OF CIVIL PENALTIES
Florida Power and Light Company Docket Nos. 50-335, 50-389 St. Lucie Nuclear Plant License Nos. DPR-67, NPF-16 Units 1 and 2 EA 96-458, EA 96-464, and EA 96-457
During NRC inspections conducted during the period of October 7 through November 26, 1996, violations of NRC requirements were identified. In accordance with the "General Statement of Policy and Procedures for NRC Enforcement Actions," NUREG-1600, the NRC proposes to impose civil penalties pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalties are set forth below:
I. Violations Assessed a Civil Penalty Related to Security Access (EA 96-458)
A. 10 CFR 73.55(7) states that licensees shall establish an access authorization system to limit unescorted access to vital areas during non-emergency conditions to individuals who require access in order to perform their duties.
The licensee's Physical Security Plan (PSP), Revision 48, dated February 23, 1996, states, "Only those individuals with identified need for access and having appropriate authorization shall be granted unescorted Vital Area access."
Contrary to the above, between July 28 and September 19, 1996, an individual, whose employment terminated on July 28, 1996, had unescorted access to protected and vital areas without appropriate authorization, and on August 7, August 9, and August 15, 1996, actually entered the protected area and had access to vital areas. In addition, as of the end of the onsite inspection on October 25, 1996, five additional individuals whose employment terminated during the period July 27 through September 19, 1996, were identified by the licensee as having had unescorted access to the protected and vital areas, without appropriate authorization. (01013)
B. 10 CFR 73, Appendix G, Section I(b) requires that an actual entry of an unauthorized person into a protected area or vital area be reported to the NRC within one hour of discovery.
10 CFR 73, Appendix G, Section II(a) states that any failure, degradation, or discovered vulnerability in a safeguards system that could have allowed unauthorized or undetected access to a protected area or a vital area had compensatory measures not been established, be recorded within 24 hours of discovery in the safeguards event log.
Contrary to the above, on October 9, 1996, the licensee failed to report to the NRC an actual entry of an unauthorized person into the protected area within one hour of discovery. Specifically, on October 9, 1996, the licensee discovered that an unauthorized individual who had been terminated on July 28, 1996, had entered the protected area on five different occasions, yet the licensee did not report the incident to the NRC until October 16, 1996. In addition, on September 19, 1996, the licensee failed to record a vulnerability of the safeguards system in the safeguards event log. Specifically, the licensee discovered three individuals who had been terminated on July 27, 28, and August 24, 1996, who could have accessed the protected areas of the plant due to their access badges not being terminated. The licensee failed to report this discovery in the safeguards event log. (01023)
These violations represent a Severity Level III problem (Supplement III).
Civil Penalty - $50,000
II. Violations Assessed a Civil Penalty Related to Emergency Preparedness (EA 96-464)
10 CFR 50.54(q) requires that nuclear power plant licensees follow and maintain in effect emergency plans which meet the planning standards of 10 CFR 50.47(b) and the requirements in Appendix E to 10 CFR Part 50.
A. Section 2.4 of the licensee's Radiological Emergency Plan (REP), Revision 31, stated that activation of the Technical Support Center (TSC) and the Operational Support Center (OSC) will be initiated by the Emergency Coordinator in the event of an Alert, Site Area Emergency, or General Emergency, and that arrangements have been made to staff the TSC and OSC in a timely manner. Also specified is that activation of the Emergency Operations Facility (EOF) is required for a Site Area Emergency or General Emergency, and that arrangements have been made to activate the EOF in a timely manner.
The REP requirements delineated above were implemented, in part, by Emergency Plan Implementing Procedure (EPIP) 3100023E, "On-Site Emergency Organization and Call Directory," Revision 72. The instruction in Section 8.2 of this procedure stated that, upon the declaration of an emergency classification, "the Duty Call Supervisor will initiate staff augmentation" using the "Emergency Recall System or Appendix A, Duty Call Supervisor Call Directory, to notify persons...."
Contrary to the above, from approximately July 22 to October 3, 1996, arrangements were not available to staff or activate the TSC, OSC, or EOF in a timely manner because the licensee did not have the capability to adequately implement either the primary method (using the Emergency Recall System) or the backup method (using the Duty Call Supervisor Call Directory) for notifying its personnel during off-hours. (02013)
B. Section 1.3 of the REP stated, "This plan outlines company responsibilities within the framework of the overall emergency response organization, and provides a conceptual basis for the development of the detailed procedures necessary to implement the plan."
Section 1.4 of the REP stated, "Associated with this Emergency Plan are implementing procedures which provide a source of pertinent information and data required by the response organization during an emergency."
Contrary to the above, as of November 1, 1996, detailed procedures to provide a source of pertinent information required by the response organization during an emergency were not adequately developed with respect to the following aspects of the Emergency Plan:
- recovery activities, as discussed conceptually in REP Section 5.4, and
- the description and delineation of the licensee's emergency response organization (ERO) and the detailed means for notifying ERO members in an emergency, as discussed generally in REP Section 2.2. (02023)
C. REP Section 7.2.1, "Objectives," stated the following: "The primary objectives of emergency response training are as follows: 1. Familiarize appropriate individuals with Emergency Plan and related implementing procedures. 2. Instruct individuals in their specific duties to ensure effective and expeditious action during an emergency. 3. Periodically present significant changes in the scope or content of the Emergency Plan. 4. Provide refresher training to ensure that personnel are familiar with their duties and responsibilities."
REP Section 7.2.2, "Training of On-Site Emergency Response Organization Personnel," stated, in part, "For employees with specific assignments or authorities as members of emergency teams, initial training and annual retraining programs will be provided. Training must be current to be maintained on the site Emergency Team Roster." REP Section 7.3.2 stated, "The Plant Training Manager will ensure that on-site Emergency Response Organization personnel are informed of relevant changes in the Emergency Plan and Emergency Plan Implementing Procedures."
Contrary to the above, the licensee failed to adequately implement the training requirements specified in the REP as evidenced by the following examples:
- In calendar year 1994, the licensee failed to provide initial training or annual retraining for 17 positions (approximately 92 individuals) identified as part of the onsite response organization. In calendar year 1995, the licensee failed to provide initial training or annual retraining for eight positions (approximately 54 individuals) identified as part of the onsite response organization.
- During calendar years 1994 and 1995, the licensee's training program failed to include initial training or annual retraining on certain procedures required to be implemented by ERO personnel in several identified positions. Examples include: EPIP 3100027E, "Re-entry," required to be implemented by the Emergency Coordinator, Radiation Team Leader, Operations Support Center (OSC) Supervisor, Re-entry Team Supervisor, Re-entry Team Member, OSC Status Board Keeper, and OSC Dose Recorder; EPIP 3100026E, "Criteria for and Conduct of Evacuation," required to be implemented by the Emergency Coordinator, Assembly Area Supervisor, and TSC Security Supervisor; and EPIP 3100035E, "Off-site Radiation Monitoring," required to be implemented by the Radiation Team Leader and TSC Supervisor.
In addition, during calendar years 1994 and 1995, the Plant Training Manager failed to ensure that ERO personnel in several identified positions were informed of relevant changes in procedures. Specifically, EPIP 3100026E was significantly revised in September 1994 and in February 1995 yet the positions required to implement it, the Emergency Coordinator, Assembly Area Supervisor, and TSC Security Supervisor, had not been informed of the changes.
- For calendar year 1995, the licensee failed to remove from the emergency response organization two individuals who had not completed retraining as required and whose qualifications had expired in 1994. The licensee also failed to remove six individuals from the emergency team roster effective October 6, 1996, who had not remained qualified to fill response team requirements as a result of allowing their respirator qualifications to lapse. (02033)
These violations represent a Severity Level III problem (Supplement VIII).
Civil Penalty - $50,000
III. Violations not Assessed a Civil Penalty Related to Unit 1 Nuclear Instrumentation (EA 96-457)
A. 10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established to assure that applicable regulatory requirements and the design basis, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. The design control measures shall provide for verifying or checking the adequacy of the design. The verifying or checking process shall be performed by individuals or groups other than those who performed the original design, but who may be from the same organization.
FPL Topical Quality Assurance Report, TQR 3.0, Revision 11, "Design Control," Section 3.2.4, "Design Verification," stated, in part, "Design control measures shall be established to independently verify design input....Design verification shall be performed by technically qualified individuals or groups other than those who performed the design."
Engineering Quality Instructions (QI) 1.7, Design Input/ Verification, dated July 5, 1995, stated, in part, "Design verification is the process whereby a competent individual, who has remained independent of the design process, reviews the design inputs.... and design output to verify design adequacy. This independent review is provided to minimize the likelihood of design errors in items that are important to nuclear safety."
Engineering QI 3.7, Computer Software Control, dated July 5, 1995, stated, in part, (1) a Software Requirements Specification shall be prepared which identifies and describes the function, performance, constraints, attributes, external interfaces, and user documentation requirements of the computer software; (2) validation and verification (V&V) of newly developed computer software shall be completed prior to use; and (3) V&V results shall be reviewed by an independent individual other than the developer of the software.
Contrary to the above:
- As of July 30, 1996, the licensee failed to verify the adequacy of design change PC/M 009195 by individuals other than those who performed the original design, in that design change PC/M 009195, which was utilized to install new safety-related nuclear instrumentation system drawers on Unit 1, did not receive an independent design verification by a competent individual independent of the design process.
- As of July 30, 1996, the licensee failed to provide for verifying the adequacy of a new core flux monitoring computer code on Unit 1, which was procured as category SQA1 software, in that the software constraints and attributes with regard to adjustments for the core midplane offset were not clearly documented and verification and validation by a competent individual independent of the design process was not conducted. (03013)
B. Technical Specification 6.8, Procedures and Programs, Paragraph 6.8.1, requires, in part, that written procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2, dated February 1978, shall be established and implemented.
Administrative Procedure No. 0006130, Condition Reports, Revision 4, dated March 22, 1996, Paragraph 8.1.1.A, stated, in part, that "Any individual who becomes aware of a problem or discrepant condition...should initiate a CR [Condition Report]. If doubt exists, a CR form should be initiated."
Contrary to the above, on July 30, 1996, Instrument and Control technicians installing Modification PC/M 009-195 did not initiate a Condition Report when they became aware of a discrepant condition, i.e., that markings for electrical terminal connectors on replacement detectors differed from cable markings identified on the control wiring diagrams. The failure to resolve the discrepant condition resulted in incorrectly installing an excore nuclear instrumentation system detector in Unit 1. (03023)
These violations represent a Severity Level III problem (Supplement I).
Pursuant to the provisions of 10 CFR 2.201, the Florida Power and Light Company (Licensee) is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, within 30 days of the date of this Notice of Violation and Proposed Imposition of Civil Penalties (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each alleged violation: (1) admission or denial of the alleged violation, (2) the reasons for the violation if admitted, and if denied, the reasons why, (3) the corrective steps that have been taken and the results achieved, (4) the corrective steps that will be taken to avoid further violations, and (5) the date when full compliance will be achieved. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken. Consideration may be given to extending the response time for good cause shown. Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.
Within the same time as provided for the response required above under 10 CFR 2.201, the Licensee may pay the civil penalties by letter addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, with a check, draft, money order, or electronic transfer payable to the Treasurer of the United States in the amount of the civil penalties proposed above, or may protest imposition of the civil penalties in whole or in part, by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the Licensee fail to answer within the time specified, an order imposing the civil penalties will be issued. Should the Licensee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalties, in whole or in part, such answer should be clearly marked as an "Answer to a Notice of Violation" and may: (1) deny the violations listed in this Notice, in whole or in part, (2) demonstrate extenuating circumstances, (3) show error in this Notice, or (4) show other reasons why the penalties should not be imposed. In addition to protesting the civil penalties in whole or in part, such answer may request remission or mitigation of the penalties.
Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 2.201, but may incorporate parts of the 10 CFR 2.201 reply by specific reference (e.g., citing page and paragraph numbers) to avoid repetition. The attention of the Licensee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing a civil penalties.
Upon failure to pay any civil penalties due which subsequently has been determined in accordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attorney General, and the penalties, unless compromised, remitted, or mitigated, may be collected by civil action pursuant to Section 234c of the Act, 42 U.S.C. 2282c.
The response noted above (Reply to Notice of Violation, letter with payment of civil penalties, and Answer to a Notice of Violation) should be addressed to: Mr. James Lieberman, Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, One White Flint North, 11555 Rockville Pike, Rockville, MD 20852-2738, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region II and a copy to the NRC Resident Inspector at the St. Lucie Nuclear Plant.
Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.
Dated at Atlanta, Georgia
this 10th day of January 1997
DESCRIPTION OF VIOLATIONS
Violation A described in Part I of the Notice involved your failure to implement adequately the provisions of the required access control program to prevent unauthorized individuals from gaining access into the St. Lucie facility. As a result, an unauthorized individual gained access to the protected area and had the potential to access vital areas. Specifically, on July 28, 1996, a temporary employee was favorably terminated from St. Lucie; however, due to multiple program implementation failures, the individual's access badge was not terminated, and on August 7, 9, and 15, 1996, the individual returned to the site and entered the protected area. Furthermore, on October 9, 1996, security personnel discovered that the individual had accessed the protected area after his termination, yet a required one-hour report to the NRC was not completed until October 16, 1996. The failure to make a report to the NRC within one-hour as required by 10 CFR Part 73, Appendix G is identified as Violation B in Part I of the Notice.
At the conference, you admitted that Florida Power and Light Company (FPL) failed to follow established plant procedures for site access and failed to submit a timely one-hour report to the NRC. In addition, at the time of the onsite inspection, you had initiated an internal review of all FPL nuclear employees released between January 1 through October 30, 1996, and as of October 25, 1996, five additional individuals whose security access had not been terminated following employment completion had been identified. At the conference, you stated that this review had been completed with a total of 27 individuals identified whose badges had not been terminated despite completion of employment. You further stated that none of these individuals actually gained access to protected or vital areas of the plant. Subsequent to the conference, you provided the NRC information which amended the number of individuals to 24 and indicated that the maximum period of potential access by any one of the individuals was approximately 8 months following termination.
The individual who inappropriately gained access to the site had worked at the St. Lucie facility a number of years, was terminated favorably, and did not appear to have malevolent intent. Nevertheless, the violations are of significant regulatory concern, particularly in light of the tampering event that recently occurred at the facility. In the case of the individual who actually gained unauthorized access, multiple barriers failed including:(1) the failure of the individual's supervisor to notify security of the termination; (2) the failure of the 31-day vital area access review to identify the individual as no longer needing access; (3) the failure of the individual to follow termination procedures and General Employee Training; and (4) the failure of human resources personnel to notify security of personnel changes. Lastly, the failure to provide a timely one-hour report to the NRC demonstrates a flawed understanding of security requirements and a lack of sensitivity to reporting requirements by lower level management. Specifically, it was approximately seven days until upper management became aware of the access by the terminated employee, identified the access as unauthorized, and directed notification of the NRC Operations Center. This failure is particularly significant in that a similar failure to notify the NRC in a timely manner was identified for the tampering event as documented in NRC Inspection Report No. 50-335, 389/96-16, and as demonstrated by your repeat failure in this case, corrective actions were not effective in preventing recurrence. Therefore, in accordance with the Enforcement Policy, Violations A and B in Part I of the Notice have been categorized in the aggregate as a Severity Level III problem.
In accordance with the Enforcement Policy, a base civil penalty in the amount of $50,000 is considered for a Severity Level III problem. Because your facility has been the subject of escalated enforcement action within the last two years1, the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process described in Section VI.B.2 of the Enforcement Policy. The NRC concluded credit was warranted for Identification, in that members of the FPL staff identified the violations. At the conference, you stated that your corrective actions included: (1) revocation of the access badges of each individual who was identified as having an active entry badge but was terminated; (2) initiation of an investigation on October 21, 1996, of all FPL employees released since January 1, 1996, to determine if they had active access badges or had accessed the plant; (3) review and validation of all individuals currently granted unescorted access and establishment of a strengthened program for monthly validations; (4) development of a termination checklist to assure proper out-processing of terminated employees is completed; (5) conduct of training for appropriate individuals on termination procedures and reporting requirements; and (6) the reporting of the unauthorized access on October 16, 1996, followed by submission of Licensee Event Report 96-S02.
Notwithstanding these actions, the NRC determined that credit was not warranted for Corrective Action in that, collectively, your actions were not timely. Specifically, on August 19, 1996, FPL identified that a permanent employee's access had not been deactivated 12 days following his 45-day notice of termination. This should have alerted you that an access control problem existed. Additionally, on September 19, 1996, FPL identified three terminated temporary employees whose access had not been deactivated as required. Although the access for these individuals was immediately terminated, as appropriate, these events were considered isolated with no actions taken to determine the extent of the condition. It was only fortuitous that a query from the Turkey Point facility, during the in-processing of an individual for employment, led to the October 9, 1996, identification of that individual's unauthorized plant entry. In addition, it was not until October 16, 1996, when upper management became aware of the unauthorized access that the significance of the issue was realized, comprehensive corrective actions were initiated, and a report made to the NRC. In view of these facts, the NRC is assessing the base civil penalty of $50,000 for this Severity Level III problem.
DESCRIPTION OF VIOLATIONS
Violation A in Part II of the Notice involved your failure to maintain the capability for augmenting your onsite staff following declaration of an Alert or higher emergency classification. Specifically, during the period of approximately July 22 through October 3, 1996, the primary method for notification of personnel, the Emergency Recall System or Autodialer, was inoperable due to an improper "as-left" configuration following revision of the personnel database. In addition, during this period of Autodialer inoperability, the backup augmentation method specified by the Emergency Plan Implementing Procedures (EPIPs) was also determined to be deficient. This method relied on emergency response organization (ERO) personnel to systematically notify other responders. However, a controlled copy of the procedure for implementation of the notification scheme was not distributed to all individuals expected to implement it, not all personnel who were expected to implement the scheme were fully cognizant of their role, and, as identified by your own investigation, the procedure contained errors. At the conference, you acknowledged the deficient status of these capabilities, but you did not believe that a substantial delay in staffing would result due to the existence of routine departmental rosters and the availability of Control Room operators to supply any needed information. However, your evaluation did not take into account an additional delay of approximately 15-30 minutes that would be required to identify and confirm an Autodialer failure prior to implementation of the backup scheme.
Violation B in Part II of the Notice involved your failure to adequately establish detailed EPIPs to implement two specific requirements described in the Radiological Emergency Plan (REP), post-accident recovery operations and the ERO structure and notification methodologies. Although information related to these topics was available in resources outside the EPIPs (i.e., the Recovery Plan and the Autodialer database), the information was not formally part of the EPIPs, and therefore was not subject to the same administrative controls, distribution requirements, and periodic reviews as the REP and EPIPs. At the conference you acknowledged that the ERO description and Recovery Plan were not described in detail in the EPIPs; however, you stated that information generally provided outside the EPIPs had been considered adequate by FPL.
Violation C in Part II of the Notice involved multiple failures to implement the REP training program requirements for onsite emergency response personnel. Numerous individuals expected to respond in an emergency during calendar years 1994 and 1995 were identified who had not received initial training or annual retraining for their designated positions. Principally, this failure affected positions in the Operational Support Center (OSC). In addition, ERO training primarily consisted of "read and sign" training; however, ERO positions were identified for which this training did not include the specific EPIPs that were expected to be implemented or did not include significant revisions to the applicable EPIPs. Lastly, individuals whose qualification training had expired were not removed from the ERO response roster and precluded from responding to an emergency. The seriousness of these training deficiencies was exacerbated by the fact that the St. Lucie emergency drill and exercise program permitted participation by only a limited number of individuals. A substantial number of personnel on the response roster had not participated in any drill or exercise in the past several years. At the conference, you acknowledged the violations; however, you stated that FPL had considered certain positions in the OSC to function similarly to their normal duties, and thus did not require position specific REP training (e.g., mechanics).
Although you have successfully demonstrated your response capability during recent annual emergency exercises, the violations are of significant regulatory concern in that they represent a breakdown in critical elements of the emergency preparedness program. Together, the failure to maintain the primary and backup methods for augmentation of onsite staff had the potential for substantially impeding FPL's ability to staff and activate the Technical Support Center (TSC), the OSC, and the Emergency Operations Facility (EOF) within 60 minutes of an emergency declaration warranting such activation.
Furthermore, the lack of specialized training and practical demonstration, as well as appropriately inclusive procedures, calls into question the ability of personnel to effectively fulfill their response functions. As you stated at the conference, the root cause of the violations was the lack of management priority given to the emergency preparedness program. However, the NRC is also concerned that several of these issues or their precursors were previously identified to FPL management from various sources such as a member of the plant staff, internal self-assessments, and critiques; yet timely actions to review the issues, determine their impact on REP commitments, and initiate proper resolution were not taken. Such management inaction, particularly in response to issues raised by a concerned employee, is clearly not acceptable. Therefore, in accordance with the Enforcement Policy, Violations A, B, and C in Part II of the Notice have been categorized in the aggregate as a Severity Level III problem.
In accordance with the Enforcement Policy, a base civil penalty in the amount of $50,000 is considered for a Severity Level III problem. Because your facility has been the subject of escalated enforcement action within the last two years2, the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process described in Section VI.B.2 of the Enforcement Policy. The NRC concluded credit was not warranted for Identification, in that you did not identify all of the violations described in the Notice related to emergency preparedness. At the conference, you stated that your corrective actions included: (1) placement of the Autodialer in an operable status and institution of post-update and weekly functional testing; (2) distribution of applicable procedures and conduct of training for personnel designated to implement the manual callout; (3) development of an ERO Weekly Duty Roster and conduct of four augmentation drills; (4) inclusion of the ERO description in the EPIPs, and projected inclusion of elements of the Recovery Plan in the EPIPs by January 31, 1997; (5) development of a training and qualification matrix for ERO personnel; (6) conduct of multiple facility drills and two integrated facility drills; (7) institution of a quarterly drill program with the commitment that all ERO initial responders participate in a drill or exercise in 1997; and (8) upgrade of the emergency preparedness training modules by January 1997 with training completed by April 1997. Regarding the current status of your ERO, at the conference you stated that all unqualified workers had been removed from the response roster, and that each of the minimum staffing positions in the ERO could be staffed with three individuals who had been retrained and had recently participated in a drill or exercise. Based on the above, the NRC determined that credit for Corrective Action was warranted, which results in a base civil penalty of $50,000 for the Severity Level III problem.
At the conference, several additional issues were discussed which are dispositioned as follows. First, an apparent deviation identified in Inspection Report No. 50-335, 389/96-18 was discussed regarding your failure to incorporate the requirements to "establish, maintain, and implement" procedures for the Emergency Plan and the Security Plan into these same documents following the removal of the requirements from the Technical Specifications, as committed in your August 16, 1995, license amendment application. After considering your arguments at the conference, the NRC has concluded that, although no specific revisions to the Emergency Plan or Security Plan were implemented to meet the aforementioned commitment, the requirements to establish, maintain, and implement procedures are addressed in a general manner in both documents. Plan references to procedures in concert with your administrative requirements for procedural adherence have been deemed an acceptable approach for complying with your August 16, 1995, commitment. However, the NRC continues to believe that the language utilized in both the plans is imprecise and could be revised to improve clarity and intent.
Second, after considering your statements at the conference, the apparent violation originally identified in Inspection Report No. 50-335, 389/96-18 regarding inadequate EPIPs for the relocation of the OSC is being characterized as a program weakness. Although your procedure addressed the need to consider relocation of this facility in an emergency, no guidance or selection criteria were provided to emergency management personnel to facilitate this decision-making process. In your response, we request that you address this emergency preparedness program weakness and describe any actions you have taken or will take to correct it.
Violation A in Part III of the Notice involved two examples of the failure to establish adequate design control measures. The first example involved a failure to translate design requirements correctly into drawings and a failure to provide adequate independent review of a modification to excore nuclear instrumentation. The second example involved a failure to identify clearly design constraints and attributes for software designated as SQA1 and the failure to verify independently the adequacy of newly developed software. Specifically, the use of a modeling offset in the core design software was not formally documented, and an independent review of the BEACON software specifications was not performed. As a result, the software was inappropriately modified to account for a physical shift in the reactor core midplane.
The root causes of Example 1 of Violation A in Part III of the Notice were (1) errors introduced into the Unit 1 controlled drawings as a result of inaccurate assumptions that a Unit 2 excore instrumentation modification could be used to derive information for a Unit 1 modification; (2) development of the modification without approved vendor manuals and drawings and the subsequent failure to check vendor documents against the modification package when the vendor documents were received; and (3) a weakness in the verification process that resulted in a drafting check of the drawings rather than an independent review to confirm that the drawings implemented the necessary wiring instructions. The root causes of Example 2 of Violation A in Part III of the Notice were (1) the failure to document formally the use of a modeling offset in the safety analysis for the core midplane offset such that individuals working on subsequent software input would understand that the core midplane offset had already been incorporated, and (2) the failure to verify independently that the final software assumptions corresponded to the safety analysis assumptions that formed the basis for the design input for software development. The actual safety consequence of Example III.A.1, i.e., reversing the detector inputs for the excore instrumentation, was a reduction in the margin between the thermal margin/low pressure trip setpoint and the analysis limit. Although the actual safety consequence of Example III.A.2 was minimal, the NRC is concerned that it also exemplifies deficiencies in the design control process and the lack of adequate independent verification.
Violation B in Part III of the Notice involved the failure of your plant staff to prepare a Condition Report as required by plant procedures when markings for electrical terminal connectors on a replacement excore neutron detector were found to be different from existing cable markings. The wires were connected incorrectly, and the miswired detector was placed in service before the error was identified. A Condition Report on the marking differences would have provided an independent review of this discrepancy and could have prevented the installation error. The root causes of Violation III.B were personnel error and the informal approach used for resolving discrepancies identified in the field.
The NRC is concerned that the root causes of Violations III.A and III.B both point to a serious lack of attention to detail in the design control area. The violations are of significant regulatory concern because of the potential adverse impact of concurrent errors in both the excore nuclear instrumentation and the core flux monitoring systems. Considering the vital role of these systems and the scope of the modifications made to these systems during the same outage, additional precautions to ensure proper implementation of these modifications should have been instituted. Therefore, Violations A and B in Part III of the Notice are classified in the aggregate in accordance with the Enforcement Policy as a Severity Level III problem.
In accordance with the Enforcement Policy, a base civil penalty in the amount of $50,000 is considered for a Severity Level III problem. Because your facility has been the subject of escalated enforcement action within the last two years3, the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process described in Section VI.B.2 of the Enforcement Policy. In this case, the NRC has concluded that credit for Identification was warranted because Violations III.A and III.B were identified by your staff during routine review of reactor physics data. At the conference, you stated that your corrective actions included: (1) immediate corrective actions to ensure equipment operability; (2) procedural revisions to ensure adequate testing and independent verification; (3) revision of the BEACON software; (4) verification of the accuracy of the BEACON software; (5) revision of fuel design standards to incorporate a list of key design features; and (6) review of Condition Report procedural requirements with your staff. In considering these facts, the NRC concluded that credit was warranted for the factor of Corrective Action, resulting in no civil penalty. However, significant violations in the future could result in a civil penalty.
NRC Inspection Report 50-335/96-22, 50-389/96-22 also identified an apparent violation for failure to verify and validate the BEACON software against the results from the functionally equivalent and previously validated INPAX software. This comparison could have identified the design error concerning core midplane offset. During the enforcement conference, your staff indicated that your procedures allowed for different methods of verifying and validating software performance characteristics. Your staff stated that FPL performed a site validation acceptance test for BEACON that met your procedural requirements. In view of the determination that the software error was introduced by differences in the safety analysis and the software design, which is cited in Example 2 of Violation III.A this apparent violation is withdrawn.
1. A Notice of Violation was issued on September 19, 1996, associated with the failure to comply with 10 CFR 50.59 (EA 96-326). A Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $50,000 was issued on March 28,1996, for multiple violations associated with a dilution event (EA 96-040). A Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $50,000 was issued on November 13, 1995, related to inoperable power operated relief valves (EA 95-180)
2. A Notice of Violation was issued on September 19, 1996, associated with the failure to comply with 10 CFR 50.59 (EA 96-326). A Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $50,000 was issued on March 28, 1996, for multiple violations associated with a dilution event (EA 96-040). A Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $50,000 was issued on November 13, 1995, related to inoperable power operated relief valves (EA 95-180).
3. A Notice of Violation was issued on September 19, 1996, associated with the failure to comply with 10 CFR 50.59 (EA 96-326). A Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $50,000 was issued on March 28,1996, for multiple violations associated with a dilution event (EA 96-040). A Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $50,000 was issued on November 13, 1995, related to inoperable power operated relief valves (EA 95-180).