EA-98-175 & 98-231 - Quad Cities 1 & 2 (Commonwealth Edison Co.)

September 11, 1998

EAs 98-175 and 98-231


Mr. Oliver D. Kingsley
President, Nuclear Generation Group
Commonwealth Edison Company
ATTN: Regulatory Services
Executive Towers West III
1400 Opus Place, Suite 500
Downers Grove, IL 60515

SUBJECT:

NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY - $88,000 (NRC Inspection Report Numbers 50-254(265)/97023(DRS) and 50-254(265)/98011(DRS))

Dear Mr. Kingsley:

This refers to two inspections conducted from October 14, 1997 to May 22, 1998, at the Commonwealth Edison Company's (ComEd) Quad Cities Nuclear Power Station (Quad Cities). The inspections identified several apparent violations associated with ComEd's (1) implementing procedures for the post-fire safe shutdown analysis and, (2) changes to safe shutdown procedures that involved an unreviewed safety question. The NRC discussed significant inspection findings with members of the ComEd staff at a public management meeting conducted in the Region III office on December 19, 1997. The results of the inspections were discussed at exit interviews conducted on April 15 and May 22, 1998. On June 18, 1998, an open predecisional enforcement conference was held in the Region III office to discuss the apparent violations.

Based on the information developed during the inspection and the information provided by ComEd representatives during the predecisional enforcement conference, the NRC has determined that violations of NRC requirements occurred. These violations are cited in the enclosed Notice of Violation and Proposed Imposition of Civil Penalty (Notice), and the circumstances surrounding them are described in detail in the subject inspection reports.

The violations in the Notice represent inadequacies in ComEd's capability to shutdown the Quad Cities facility following a postulated design basis fire. When it identified in September 1997 that it may not be able to shutdown the Quad Cities facility following a postulated design basis fire, ComEd implemented compensatory measures including shutting down Unit 2. However, during a December 19, 1997, public meeting that occurred after several months of NRC inspections, ComEd acknowledged NRC inspection findings that concluded that despite the compensatory measures, ComEd had not demonstrated and could not demonstrate that the Quad Cities design basis fire safe shutdown analysis and implementing procedures were adequate. Subsequently, ComEd shutdown Unit 1 and kept Unit 2 shut down while the analysis and procedures were revised and validated. These violations indicated a broad lack of understanding on the part of the Quad Cities' staff for the importance of having analyzed, proceduralized, and validated means for achieving and maintaining safe shutdown following a design basis fire. During the enforcement conference, ComEd acknowledged that inadequate knowledge and ownership of the fire protection program, along with inadequate management involvement and support for correcting identified deficiencies in the safe shutdown program were several of the root causes for these violations. ComEd stated that it expected that operators would have been able to achieve and maintain safe shutdown based on their training and various procedures including abnormal and emergency operating procedures (EOPs) and equipment not described in the Quad Cities safe shutdown analysis. However, the NRC concluded that some equipment necessary to achieve safe shutdown may not be available or accessible and that reliance on unanalyzed impromptu measures such as combining sections of EOPs during the fire would not provide reasonable assurance that operators could achieve post-fire safe shutdown conditions.

Additionally, in response to the safe shutdown issue, ComEd changed its safe shutdown procedures to permit the use of the station blackout diesel generator in lieu of the emergency diesel generators without first performing a safety evaluation to confirm that the departure from the Updated Final Safety Analysis Report (UFSAR) did not constitute an unreviewed safety question. The required safety evaluation was performed after substantial intervention by the NRC staff. When performed, the NRC staff identified that the safety evaluation was deficient because it did not consider all necessary manual actions required to operate the station blackout diesel generator. These actions included manual unloading and reloading of electrical buses and diesel engine refueling sooner than previously anticipated. ComEd subsequently determined that the additional manual actions needed to utilize the station blackout diesel involved an unreviewed safety question that required Commission approval prior to implementation of the change. The failure to perform a safety evaluation for a change to the facility as described in the USFAR that was subsequently determined to be an unreviewed safety question constitutes a violation of 10 CFR 50.59, "Changes, Tests, and Experiments."

These violations represent a very significant safety concern because they involve inadequacies in ComEd's capability to shutdown the Quad Cities facility following a postulated design basis fire. Due to the design of the Quad Cities facility, the alternative shutdown capabilities relied heavily on administrative controls to use opposite unit equipment and to implement a large number of manual actions. If a design basis fire occurred in certain fire areas, the capability of meeting shutdown performance goals, such as reactor coolant makeup, reactor heat removal, process monitoring, and support functions, varied from area to area. Also of concern is ComEd's ability to evaluate fire protection issues as demonstrated by the weaknesses in its preparation of the safety evaluation. In sum, because a postulated fire would so damage equipment that reasonable assurance did not exist that safe shutdown could be achieved and maintained using analyzed equipment and procedures, the violations were classified in the aggregate, in accordance with NUREG-1600, "General Statement of Policy and Procedure for NRC Enforcement Actions (Enforcement Policy)," as a Severity Level II problem.

In accordance with the Enforcement Policy, a base civil penalty in the amount of $88,000 is considered for the Severity Level II problem. Because the Quad Cities facility has been the subject of escalated enforcement actions within the last two years ⁽¹⁾, the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process in Section VI.B.2 of the Enforcement Policy. Identification credit was warranted because the Quad Cities engineering staff identified all of the technical concerns regarding the inadequacies in the Quad Cities alternative shutdown capabilities.⁽²⁾

Corrective Action credit was not warranted due to the extensive involvement by the NRC, including involvement in identifying the 10 CFR 50.59 violation, to focus ComEd resources to obtain comprehensive corrective actions. The NRC's involvement culminated in the December 19, 1997 management meeting, during which the NRC pointed out significant deficiencies in ComEd's corrective actions. This meeting resulted in ComEd shutting down the remaining operating unit and maintaining both units shutdown until these safe shutdown violations were corrected. Since Identification credit was warranted and no Corrective Action credit was warranted, the civil penalty assessment for the violations is $88,000.

Therefore, to emphasize the importance of maintaining the post-fire safe shutdown capabilities for all fire areas and the acknowledgment of ComEd's recognition that the Quad Cities10 CFR 50.59 program was in need of comprehensive corrective action, I have been authorized after consultation with the Director, Office of Enforcement, and the Deputy Executive Director for Regulatory Effectiveness, to issue the enclosed Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $88,000.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. Notwithstanding the apparent comprehensiveness of your corrective actions associated with the 10 CFR 50.59 violation, and in light of the prior similar violations, you should describe why you believe your actions will be effective in preventing additional violations of 10 CFR 50.59. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response will be placed in the NRC Public Document Room.

		Sincerely,
		Original Signed By
		James L. Caldwell Acting Regional Administrator

Docket Nos. 50-254; 50-265
License Nos. DPR-29; DPR-30

Enclosure: Notice of Violation and Proposed Imposition of Civil Penalty

---

NOTICE OF VIOLATION
AND
PROPOSED IMPOSITION OF CIVIL PENALTY

Commonwealth Edison Company Quad Cities Station

Docket Nos. 50-254; 50-265 License Nos. DPR 29; DPR-30 EAs 98-175 and 98-231

During an NRC inspection conducted from October 14, 1997 to May 22, 1998, several violations of NRC requirements were identified. In accordance with NUREG-1600, "General Statement of Policy and Procedure for NRC Enforcement Actions," the NRC proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalty are set forth below:

A.	10 CFR 50.48(a), "Fire Protection," requires, in part, that each operating nuclear power plant must have a fire protection plan so that the capability to safely shutdown the plant is ensured. 10 CFR 50.48(b) requires, in part, that all nuclear power plants licensed to operate prior to January 1, 1979, shall satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III.G and III.J. The Quad Cities facility was licensed before January 1, 1979.
	1.	10 CFR 50, Appendix R, Section III.G.3, requires, in part, that alternative or dedicated shutdown capability is provided where the protection of systems whose function is required for hot shutdown does not satisfy requirements of Section III.G.2. 10 CFR 50, Appendix R, Section III.L.1, requires, in part, that alternative or dedicated shutdown capability provided for a specific fire area shall be able to: (a) achieve and maintain subcritical reactivity conditions in the reactor;(b) maintain reactor coolant inventory; (c) achieve and maintain hot shutdown conditions; (d) achieve cold shutdown conditions within 72 hours; and (e) maintain cold shutdown conditions thereafter. 10 CFR 50, Appendix R, Section III.L.2, requires, in part, those performance goals for accomplishing safe shutdown shall include reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and support functions. Contrary to the above, as of September 26, 1997, the licensee failed to provide alternate shutdown capability for some fire areas of the Quad Cities facility containing safe shutdown equipment. A postulated fire in certain fire areas would render safe shutdown equipment inoperable such that safe shutdown would not be ensured in each of the following examples. Each of the following examples is considered a separate violation:
		a.	The fire area for safe shutdown path A consisted of the torus area north of column line 16; the 1A residual heat removal (RHR) pump room; the 1A core spray room; the high pressure coolant injection (HPCI) pump room; the ground floor and all areas above the ground floor in the Unit 1 reactor building; and 4kV Bus 13-1 and 480V Bus 18 and 19 areas in the turbine building. A postulated fire in this fire area would render inoperable the emergency diesel generator (EDG), safe shutdown makeup pump (SSMP), HPCI system, and several main steam line (MSL) drain valves and RHR valves for high/low pressure interface for the reactor coolant makeup function. In addition, the RHR system and the automatic depressurization system (ADS) would be rendered inoperable for the decay heat removal function. There would be no RHR service water (SW) flow indication available to meet the process monitoring function for safe shutdown. In addition, the RHR room coolers would be rendered inoperable for the support function. (01012)
		b.	The fire area for safe shutdown path D1 consisted of the 1B RHR pump room (Fire Zone 11.2.2), the 1B core spray pump room (Fire Zone 11.2.1), and Unit 1 torus south of column line 16 (Fire Zone 1.1.1.1.S). A postulated fire in this fire area would render inoperable the EDG, the SSMP, and the HPCI system for the reactor coolant makeup function. In addition, the RHR system and ADS would be rendered inoperable for the decay heat removal function due to the inability to reject water from the torus. (01022)
		c.	The fire area for safe shutdown path D2 consisted of Bus 14-1 area (equivalent Fire Area 8.2.8.A) in Unit 1 turbine building. A postulated fire in this fire area would render inoperable the EDG and the SSMP for the reactor coolant makeup function. (01032)
		d.	The fire areas for safe shutdown path D3 consisted of the Unit 1 cable tunnel, any portion of the southern turbine building on the basement, ground, and mezzanine floor elevations except the Unit 1 B and C RHR service water (SW) pump room. A postulated fire in this fire area would render inoperable the EDG, SSMP, the HPCI system, and several MSL drain valves for high/low pressure interface of the reactor coolant makeup functions. In addition, the RHR system and ADS would be rendered inoperable for the decay heat removal function. Fire induced damage to the CCST level indication and a lack of RHR SW flow indication would not satisfy the process monitoring function for safe shutdown. (01042)
		e.	Safe shutdown path D4 consisted of the 1B and 1C RHRSW pump room. A postulated fire in this fire area would render inoperable the EDG and SSMP for the reactor coolant makeup function. No RHRSW flow indication would be available to satisfy the process monitoring function for safe shutdown. (01052)
		f.	The fire area for safe shutdown path E21 consisted of the central turbine building area on the ground and mezzanine floor elevations (Fire Zones 8.2.6.C and 8.2.7.C). A postulated fire in this fire area would render inoperable the reactor core isolation cooling (RCIC) system and several MSL drain valves for high/low pressure interface for the reactor coolant makeup functions. In addition, the RHR system and ADS would be rendered inoperable for the decay heat removal function. (01062)
		g.	The fire area for safe shutdown path E22 consisted of the control room, the auxiliary electric room, the cable spreading room, and the computer room. A postulated fire in this fire area would render the RCIC system, and several MSL drain valves for high/low pressure interface inoperable for the reactor coolant makeup functions. In addition, the RHR system and the ADS would be rendered inoperable for the decay heat removal function. (01072)
		h.	The fire area for safe shutdown path B consisted of the torus area north of column 10 in the 2A RHR pump room, the 2A core spray pump room, and the ground floor (including all areas above the ground floor in the Unit 2 reactor building). A postulated fire in this fire area would render inoperable the EDG, SSMP, the HPCI system, and several MSL drain and RHR valves for high/low pressure interface for the reactor coolant makeup function. In addition, the RHR system and the ADS would be rendered inoperable for the decay heat removal function. There would be no RHRSW flow indication available to satisfy the process monitoring function for safe shutdown. In addition, the RHR room coolers would be rendered inoperable for the support function. (01082)
		i.	The fire area for safe shutdown path C1 consisted of the cable tunnel or any portion of the northern turbine building on the basement, ground, and the mezzanine floor elevations in the Unit 2 turbine building. A postulated fire in this fire area would render inoperable the EDG, the SSMP, the HPCI system, and several MSL drain valves for high/low pressure interface for the reactor coolant makeup function. In addition, the RHR system and the ADS would be rendered inoperable for the decay heat removal function. There would be no RHRSW flow indication available to satisfy the process monitoring function for safe shutdown. (01092)
		j.	The fire area for safe shutdown path C2 consisted of the Buses 24-1, 28, and 19 in the Unit 2 turbine building. A postulated fire in this fire area would render inoperable the EDG and SSMP for the reactor coolant makeup function. There would be no RHRSW flow indication available to satisfy the process monitoring function for safe shutdown. (01102)
		k.	The fire area for safe shutdown path H consisted of the central turbine building area on the ground and mezzanine floor elevations. A postulated fire in this fire area would render inoperable the RCIC system for the reactor coolant makeup function. In addition, the RHR system and ADS would be rendered inoperable for the decay heat removal function. (01112)
		l.	The fire area for safe shutdown path K1 consisted of the turbine building Bus 23-1 area. A postulated fire in this fire area would render the EDG and the SSMP inoperable for the reactor coolant makeup functions. (01122)
		m.	The fire area for safe shutdown path K2 consisted of the control room, auxiliary electric room, cable spreading room, and computer room. A postulated fire in this fire area would render inoperable the EDG, the SSMP, and several MSL drain valves for high/low pressure interface for the reactor coolant makeup function. In addition, the RHR system and the ADS would be rendered inoperable for the decay heat removal function. (01132)
		n.	The fire area for safe shutdown path L consisted of south of column line 10 in the torus area, the 2B RHR pump room, the 2B core spray pump room and the HPCI pump room in the Unit 2 reactor building. A postulated fire in this fire area would render the EDG, the SSMP, the HPCI system inoperable for the reactor coolant makeup functions. In addition, the RHR system and the ADS would be rendered inoperable for the decay heat removal function. (01142).
	2.	10 CFR 50, Appendix R, Section III.J, "Emergency Lighting," requires, in part, that emergency lighting units with at least an 8-hour battery power supply shall be provided in all areas needed for operation of safe shutdown equipment and in access and egress routes thereto. Contrary to the above, as of September 26, 1997, the licensee failed to provide adequate emergency lighting units with at least an 8-hour battery power supply in the Unit 1 and 2 HPCI rooms and 1B and 2B RHR pump rooms, areas needed for operation of safe shutdown equipment. (01152)
B.	10 CFR 50.59(a)(1) "Changes, Tests, and Experiments," requires, in part, that the holder of a license authorizing operation of a facility may make changes in the facility as described in the safety analysis report and make changes in the procedures as described in the safety analysis report without prior Commission approval, unless the proposed change involves an unreviewed safety question. 10 CFR 50.59(a)(2) requires, in part, that a proposed change shall be deemed to involve an unreviewed safety question if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created. Quad Cities Updated Final Safety Analysis Report (UFSAR), Section 9.5.1, "Fire Protection System," states, in part, that Sections 3.1 and 3.2 of the Safe Shutdown Report (Fire Protection Report Volume 2) identified systems and equipment that can be used to bring the plant to hot and cold shutdown in the event of a fire in any fire area or equivalent fire area and loss of offsite power. Fire Protection Report Volume 2 ,Section 3.1.1.6.1, "On-Site AC Power," states, in part, that power for the reactor core isolation cooling valves, the safe shutdown makeup pump, and the residual heat removal system was provided by a diesel generator which normally starts automatically upon a loss of offsite power. In addition, the diesel generator was supplied from a 750 gallon day tank which was supplied from a 15,000 gallon fuel oil tank. The Technical Specification required a minimum of 10,000 gallons fuel onsite for each diesel. The fuel supply of 10,000 gallons will supply each diesel generator with a minimum of two days of full load operation. Contrary to the above, in December 1997, the licensee made a change in the facility as described in the Quad Cities UFSAR which involved an unreviewed safety question without obtaining prior Commission approval. Specifically, on December 2, 1997, the licensee implemented revised Quad Cities Appendix R procedures without performing a written safety evaluation to use a diesel generator that did not start automatically upon loss of offsite power, to provide onsite AC power. In addition, the licensee failed to evaluate that the diesel generator fuel tank capacity was only 22 hours instead of two days of full load operation. The manual action to refuel this diesel generator was an unreviewed safety question because it created a malfunction of a different type than previously evaluated. (01162)

This is a Severity Level II problem (Supplement I). Civil Penalty - $88,000.

Pursuant to the provisions of 10 CFR 2.201, ComEd is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, within 30 days of the date of this Notice of Violation and Proposed Imposition of Civil Penalty (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each alleged violation: (1) admission or denial of the alleged violation; (2) the reasons for the violation if admitted, and if denied, the reasons why; (3) the corrective steps that have been taken and the results achieved; (4) the corrective steps that will be taken to avoid further violations; and (5) the date when full compliance will be achieved. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken. Consideration may be given to extending the response time for good cause shown. Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Within the same time as provided for the response required above under 10 CFR 2.201, the Licensee may pay the civil penalty by letter addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, with a check, draft, money order, or electronic transfer payable to the Treasurer of the United States in the amount of the civil penalty proposed above, or the cumulative amount of the civil penalty if more than one civil penalty is proposed, or may protest imposition of the civil penalty in whole or in part, by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the Licensee fail to answer within the time specified, an order imposing the civil penalty will be issued. Should the Licensee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalty, in whole or in part, such answers should be clearly marked as an "Answer to a Notice of Violation" and may: (1) deny the violations listed in this Notice, in whole or in part; (2) demonstrate extenuating circumstances; (3) show error in this Notice; or (4) show other reasons why the penalty should not be imposed. In addition to protesting the civil penalty in whole or in part, such answers may request remission or mitigation of the penalty. In requesting mitigation of the proposed penalty, the factors addressed in Section VI.B.2 of the Enforcement Policy should be addressed. Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 2.201, but may incorporate parts of the 10 CFR 2.201 reply by specific reference (e.g., citing page and paragraph numbers) to avoid repetition. The attention of the Licensee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing civil penalty.

Upon failure to pay any civil penalty due which subsequently have been determined in accordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attorney General, and the Penalty, unless compromised, remitted, or mitigated, may be collected by civil action pursuant to Section 234c of the Act, 42 U.S.C. 2282c.

The response noted above (Reply to Notice of Violation, letter with payment of civil penalty, and Answer to a Notice of Violation) should be addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, One White Flint North, 11555 Rockville Pike, Rockville, MD 20852-2738, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region III and a copy to the NRC Resident Inspector station at the Quad Cities facility.

Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated at Lisle, Illinois
this 11th day of September 1998

---

¹ EA 97-591 issued two Severity Level III problems with a $330,000 civil penalty on March 12, 1998, for inadequate procedures for surveillance testing of the primary coolant system boundary and an inadequate 10 CFR 50.59 safety evaluation associated with changes to the surveillance procedures.

² While the NRC was involved in identifying the 10 CFR 50.59 issue, for purposes of assessment, this was considered in determining Corrective Action credit.