EA-97-482

April 27, 1998

EAs 97-482; 97-525; 98-052

Mr. Leon J. Olivier
Vice President - Nuclear
Boston Edison Company
Pilgrim Nuclear Power Station
600 Rocky Hill Road
Plymouth, Massachusetts 02360-5599

 

SUBJECT:

NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY - $165,000; AND EXERCISE OF ENFORCEMENT DISCRETION (NRC Inspection Report Nos. 50-293/97-05, 97-12 and 97-13)

Dear Mr. Olivier:

This letter refers to the three subject NRC inspections conducted between May 14, 1997, and January 6, 1998, at the Pilgrim Nuclear Power Station in Plymouth, Massachusetts, the findings of which were discussed with Mr. H. V. Oheim and members of your staff during several exit meetings, the last of which was held on January 30, 1998. The first of these inspections examined the corrective actions associated with the findings from a January 1995 self-assessment of the Pilgrim safety-related cooling water systems and other related issues. The second inspection reviewed various engineering activities, including the replacement and subsequent modification of two 480/120 volt safeguard control transformers. The third inspection was a routine integrated inspection which, in part, reviewed an issue related to the reliability of the salt service water (SSW) pump operation. The inspection reports were sent to you previously on October 21, 1997, December 17, 1997, and February 6, 1998.

On November 21, 1997, a predecisional enforcement conference (conference) was conducted with you and members of your staff, to discuss the violations related to the first two inspections, their causes, and your corrective actions. The apparent violations identified in NRC Inspection Report 97-12, issued on December 17, 1997, related to the 480/120 volt transformers, were discussed at the conference, even though the inspection report had not been issued at the time of that conference. On December 16, 1997, Mr. Oheim of your staff informed Mr. Wiggins of my staff that another conference was not needed to further discuss those issues.

Based on the findings of the inspections and information provided during the conference, two Severity Level III violations and one Severity Level III problem (consisting of multiple violations) are being cited and are described in the enclosed Notice of Violation and Proposed Imposition of Civil Penalty (Notice). These violations involved a number of failures to either promptly identify conditions adverse to quality and/or failures to promptly and effectively correct the conditions once they were identified, contrary to 10 CFR Part 50, Appendix B, Criterion XVI, as well as violations of design control requirements, and 10 CFR 50.59.

The first Severity Level III violation involved an unreviewed safety question (USQ) resulting from a modification involving insulation on recirculation loop piping located in the drywell performed in 1984. The design change involved a USQ in that the probability of a malfunction of the emergency core cooling system (ECCS) pumps (i.e., residual heat removal (RHR) and core spray) was increased due to the potentially higher line pressure losses caused by the collection of insulation debris on the pump suction strainers. To alleviate this, the design change took credit for post-accident containment overpressure to assure adequate ECCS pump net positive suction head (NPSH). Crediting of containment overpressure was inconsistent with the plant licensing basis as described in the Updated Final Safety Analysis Report (UFSAR). However, you failed to recognize that crediting containment overpressure increased the probability of a malfunction of the ECCS pumps, and the safety evaluation performed to support the modification incorrectly concluded that the change did not involve a USQ. Consequently, the change was made without NRC approval. In addition, this issue was not appropriately addressed until January 20, 1997 (when you requested NRC review and approval for including containment pressure as a component of NPSH margin in the Pilgrim licensing basis) even though there were prior opportunities to identify and correct the problem, namely: (1) the 1995 service water system operational performance inspection (SWSOPI) self-assessment that identified that the 1984 safety evaluation may have improperly credited containment overpressure in the NPSH calculations; (2) a subsequent safety evaluation completed on March 25, 1996 which also incorrectly concluded that the 1984 plant modification did not involve a USQ; and (3) the report of an independent review of the containment overpressure issue performed by Yankee Atomic Electric Company in 1996 that concluded that containment overpressure was not credited in the Pilgrim licensing basis.

The second Severity Level III violation involves a design deficiency which introduced an unintended trip function in the microprocessors that control the transformers which supply 120 Vac power to safety-related instrument busses. Following an event on April 1, 1997 in which the unintended trip function caused a common mode malfunction of two transformers, the safety evaluation performed to support replacement of the microprocessors failed to recognize the existence of a USQ.

The Severity Level III problem consisting of seven violations involved conditions adverse to quality that were not identified and/or corrected including: (1) operation of the plant with salt service water (SSW) system inlet temperatures higher than designed; (2) a single failure vulnerability in the SSW system design; (3) failure to translate, into procedures, the design requirement to isolate non-essential reactor building closed cooling water (RBCCW) system loads during accident conditions; (4) failure to adequately translate, into procedures, residual heat removal (RHR) system design flow rates for containment heat removal; (5) deficiencies in emergency diesel generator (EDG) loading calculations and procedures; (6) operation of the EDGs at ambient temperatures higher than the design limit; and (7) inaccuracies in the environmental qualification (EQ) drywell temperature profile for electric equipment important to safety.

Several of these adverse conditions resulted from failure to properly translate the design bases of the plant into specifications, procedures, and instructions. For example, the RHR system design flow rate of 5100 gpm used in design basis containment heat transfer and pressure/temperature calculations was not properly translated into procedures in that the flow rates specified in the system operating procedure were not supported by calculations that considered the effects of instrument accuracy. Specifically, the RHR operating procedure specified a flow range of 4800 to 5100 gpm for containment cooling during accident conditions. There was no analysis to confirm that adequate heat removal would be provided at the lower flow rate specified in the operating procedure, including the effects of instrument error. Similarly, there was no analysis to demonstrate that flows greater than 5100 gpm (which, after considering the effects of instrument error, could occur) would not exceed the design limitations of the RHR heat exchangers.

In some cases, you identified the design deficiency, but failed to take prompt action to correct the deficiency once it was identified. For example, during the service water system operational performance inspection (SWSOPI) self-assessment in 1995, you identified that no procedural guidance existed to isolate the non-essential RBCCW system heat loads during an accident, an action assumed in the licensing bases for the plant. However, at the time of the NRC inspection in 1997, no action had been taken to address the identified deficiency. The NRC is concerned that, although you identified inconsistencies between the safety analyses and plant specifications and procedures, you apparently failed to recognize the significance of the conditions in that prompt action was not taken to correct the discrepancies. You also failed to recognize that some of these conditions resulted in the plant being operated outside of the design basis as evidenced by the fact that the conditions were not reported to the NRC pursuant to 10 CFR 50.72 and 50.73.

Additionally, in some cases, your corrective actions to address the deficiencies after they were identified, were inadequate because you either failed to perform required safety evaluations, or performed safety evaluations that failed to identify unreviewed safety questions (USQs). In a number of cases, you limited your formal evaluations to operability determinations and often relied upon engineering judgement rather than formal analyses to support your actions. For example, although you identified as early as July 1994, that a design basis change was needed to support operation of the plant with SSW inlet temperatures above the design limit of 65F specified in Updated Final Safety Analysis Report (UFSAR), a safety evaluation to support a change to the licensing basis was not performed until March 1996 even though you operated the plant during the interim with SSW temperatures in excess of 65F. In the interim, you relied on an operability determination that concluded that the RBCCW system was operable with elevated SSW temperatures, and you used engineering judgement to support the use of "rolling averages" to justify operation of the plant with SSW temperatures above 65F. When a formal safety evaluation was performed, the evaluation was inadequate because post-accident containment overpressure was inappropriately credited in ECCS pump NPSH margin calculations contrary to the plant's licensing basis.

The NRC is concerned that the plant was operated outside of the NRC approved licensing bases because of an apparent fundamental misunderstanding of what constitutes a change to the design and licensing bases. While there were no resultant adverse safety consequences in any of these cases, the potential existed that, had a design basis accident occurred, safety-related equipment and systems were not assured of accomplishing their design functions. Additionally, the failure to identify and/or correct these conditions adverse to quality is of significant regulatory concern because the NRC relies upon licensees to operate the plant within the approved licensing basis and to correctly assess changes to the plant or its operations to assure that unreviewed safety questions do not exist.

The violations represent a failure to take corrective actions to resolve programmatic weaknesses in your design control and safety evaluation processes. The violations associated with inappropriately crediting containment overpressure in calculations of ECCS pump NPSH margin, and a design deficiency in the microprocessors that control the transformers which supply 120 Vac power to safety-related instrument busses, are each categorized as separate Severity Level III violations in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG 1600, in that each involved the creation of a USQ. The remainder of the violations are classified in the aggregate as a Severity Level III problem because they represent a failure to implement corrective actions in a number of different areas.

In accordance with the Enforcement Policy, a base civil penalty in the amount of $55,000 is considered for each Severity Level III violation or problem. Since Pilgrim has been the subject of escalated enforcement actions within the last two years, ⁽¹⁾ the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process in Section VI.B.2 of the Enforcement Policy for each Severity Level III violation and the Severity Level III problem. While you identified some of the technical issues, no credit is warranted for identification because the NRC identified the USQs and your failure to promptly identify and resolve these conditions adverse to quality. Your corrective actions, once you were put on notice by the NRC, included: 1) procedure revisions; 2) performance of the necessary safety evaluations; 3) broad scope UFSAR and licensing basis documentation reviews; 4) revision of the guidance for evaluating conditions for reportability; and 5) increased management attention to the corrective action process. Since these corrective actions appear comprehensive, credit is warranted for corrective actions.

Therefore, to emphasize the importance of timely identification and comprehensive correction of problems and in recognition of your previous escalated enforcement actions, I have been authorized, after consultation with the Director, Office of Enforcement, to issue the enclosed Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $165,000. This is comprised of a base civil penalty of $55,000 for each Severity Level III violation and for the Severity Level III problem in Section I of the Notice.

Four separate Severity Level IV violations for failure to make timely notifications and reports to the NRC in accordance with 10 CFR 50.72 and 10 CFR 50.73 for some of the situations described in Section I of the Notice are described in Section II.

Additionally, during your follow-up review of EDG loading, conducted as a result of the violations identified during the NRC SWSOPI follow-up inspection, you identified a design deficiency associated with the thermal overload relay trip settings for the SSW pumps that could have resulted in an inadvertent trip of the pumps and a loss of all SSW cooling. This issue was identified as an apparent violation of 10 CFR Part 50, Appendix B, Criterion III in NRC Inspection Report 97-13. The NRC has determined that the failure to assure that the SSW design bases were correctly translated into the overload trip settings constituted a violation of NRC requirements which could be considered for escalated enforcement and subject to civil penalties. However, after consultation with the Director, Office of Enforcement, I have been authorized to not issue a Notice of Violation and not propose a civil penalty for this issue in accordance with the provisions provided in Section VII.B.4 of the Enforcement Policy. This decision was made after consideration that: (1) the violation was identified by your staff as part of corrective action for violations that were subject to escalated enforcement action; (2) the violation has a similar root cause as the other design deficiencies for which escalated action is being issued; (3) it does not substantially change the safety significance or the character of the regulatory concern arising from the initial violations; (4) immediate corrective action was taken to reset the trip setpoints; and (5) you have planned long term corrective actions to address the root cause of the violation. The exercise of discretion acknowledges your effort to perform comprehensive actions to identify and correct similar violations to those for which escalated enforcement action was issued.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. Due to the programmatic nature of these violations, the NRC expects that your response will address not only the specific violations cited, but will also include the results of any extent of condition reviews that you have performed in the areas of design control, safety evaluations, and reportability. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response will be placed in the NRC Public Document Room (PDR).

 

Sincerely, Hubert J. Miller Regional Administrator

Docket No. 50-293
License No. DPR-35

Enclosure: Notice of Violation and Proposed Imposition of Civil Penalty

cc w/encl:
R. Ledgett, Executive Vice President - Operations
C. Goddard, Plant Department Manager
N. Desmond, Regulatory Relations
D. Tarantino, Nuclear Information Manager
R. Hallisey, Department of Public Health, Commonwealth of Massachusetts
The Honorable Therese Murray
The Honorable Joseph Gallitano
B. Abbanat, Department of Public Utilities
Chairman, Plymouth Board of Selectmen
Chairman, Duxbury Board of Selectmen
Chairman, Nuclear Matters Committee
Plymouth Civil Defense Director
P. Gromer, Massachusetts Secretary of Energy Resources
J. Miller, Senior Issues Manager
J. Fleming
A. Nogee, MASSPIRG
Office of the Commissioner, Massachusetts Department of Environmental Quality
Engineering
Office of the Attorney General, Commonwealth of Massachusetts
T. Rapone, Massachusetts Executive Office of Public Safety
Chairman, Citizens Urging Responsible Energy
Commonwealth of Massachusetts, SLO Designee

 

---

NOTICE OF VIOLATION
AND
PROPOSED IMPOSITION OF CIVIL PENALTY

Boston Edison Company Pilgrim Station

Docket No. 50-293 License No. DPR-35 EAs 97-482; 97-525

During NRC inspections conducted between May 14, 1997, and October 10, 1997, for which exit meetings were held on July 18, 1997, August 28, 1997, October 10, 1997, and November 19, 1997, violations of NRC requirements were identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, the NRC proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalty are set forth below:

I. VIOLATIONS ASSESSED CIVIL PENALTIES

A. VIOLATION ASSOCIATED WITH CONTAINMENT OVERPRESSURE

10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," requires, in part, that measures shall be established to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action is taken to preclude repetition.

10 CFR 50.59, "Changes, tests and experiments," permits the licensee, in part, to make changes to the facility as described in the safety analysis report without prior Commission approval provided the change does not involve an unreviewed safety question (USQ). The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for the determination that the change does not involve a USQ. A proposed change shall be deemed to involve a USQ (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.

Appendix B to 10 CFR 50, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants", Criterion III, "Design Control," requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.

10 CFR 50.71(e) requires, in part, that the final safety analysis report (FSAR) be updated periodically to assure that the information included in the FSAR contains the latest material developed. Revisions to the FSAR shall be submitted annually or six months after each refueling outage provided the interval between submittals does not exceed 24 months. The revisions must reflect all changes up to a maximum of 6 months prior to the date of filing.

Contrary to the above, between January 1995 and January 20, 1997, the licensee failed to take prompt and effective corrective action for a significant condition adverse to quality, failed to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions, and failed to perform an adequate written safety evaluation which provides the bases for the determination that a design change did not involve a USQ. The deficiency involved ECCS net positive suction head (NPSH) calculations performed to support safety evaluations for a design change to the drywell piping insulation. Specifically, the calculations were changed to credit containment overpressure as a result of modification of insulation on recirculation loop piping located in the drywell in 1984. BECo Safety Evaluation (SE) No. 1638, approved on August 31, 1984, was performed to support the design change. The design change involved a USQ in that the probability of a malfunction of the ECCS pumps (i.e., residual heat removal (RHR) and core spray) was increased due to the potentially higher line pressure losses caused by the collection of insulation debris on the pump suction strainers. The design change took credit for post-accident containment overpressure to assure adequate ECCS pump NPSH. Crediting of containment overpressure was inconsistent with the plant design basis as described in Section 14.5 of the Updated Final Safety Analysis Report (UFSAR). However, the licensee failed to recognize that crediting containment overpressure increased the probability of a malfunction of the ECCS pumps, and SE-1638 incorrectly concluded that the change did not involve a USQ. Consequently, the change was made without NRC approval. This condition adverse to quality was not appropriately addressed until January 20, 1997, when BECo requested NRC review and approval for including containment pressure as a component of NPSH margin in the Pilgrim licensing basis, despite prior opportunities to do so, namely:

1. In 1995, the service water system operational performance inspection (SWSOPI) self-assessment identified that the 1984 safety evaluation may have improperly credited containment overpressure in the NPSH calculations.

2. On March 25, 1996, the licensee completed a new safety evaluation (SE-2971) which supported the previous replacement of all piping thermal insulation in the drywell and superseded SE-1638. SE-2971 also incorrectly concluded that the 1984 plant modification did not involve a USQ.

3. The report of an independent review of the containment overpressure issue performed by Yankee Atomic Electric Company, dated June 5, 1996, concluded that containment overpressure was not credited in the Pilgrim licensing basis; however, prompt action was not taken to correct the deficiency.

In addition, between 1984 and June 1996, the licensee did not update Section 14.5 of the FSAR to reflect the design bases and methods for calculating the NPSH for the ECCS pumps as impacted by the modification to the ECCS pump strainers in 1984. Specifically, to support the modification, containment overpressure was credited in calculation of ECCS pump NPSH margin. FSAR Figure 14.5-10, "NPSH Availability for RHR and Core Spray System", was not revised to reflect the design bases and methods for calculating NPSH until June 1996. (01013)

This is a Severity Level III violation (Supplement I).
Civil Penalty $55,000.

B. VIOLATION ASSOCIATED WITH 480/120 VOLT TRANSFORMER REPLACEMENT

10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," requires, in part, that measures shall be established to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action is taken to preclude repetition.

10 CFR 50.59, "Changes, tests and experiments," permits the licensee, in part, to make changes to the facility as described in the safety analysis report without prior Commission approval provided the change does not involve an unreviewed safety question (USQ). The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for the determination that the change does not involve a USQ. A proposed change shall be deemed to involve a USQ (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.

The Pilgrim Final Safety Analysis Report (FSAR), section 8.8.3, Safety Design Basis for the 120 Vac safeguard control subsystem describes that the 120 Vac safeguard control subsystem was designed and installed in accordance with IEEE-279 Standard. IEEE-279 Standard section 4.6, Channel Independence, required that the signals from both channels to be independent to accomplish decoupling of the effects of electric transients. Section 8.8.3.3 of the FSAR stated that the 120 Vac safeguard control subsystem was arranged so that no single component failure would prevent the system from providing power to the hydrogen/oxygen analyzer subsystem.

Contrary to the above, between April 1, 1997 and October 10, 1997, the licensee failed to take adequate corrective actions to preclude the recurrence of a significant condition adverse to quality, and failed to perform an adequate written safety evaluation which provides the bases for the determination that a design change did not involve a USQ. The deficiency involved an unintended trip function of the microprocessors associated with two transformers (X55 and X56), which provide the 120 Vac power to the safeguard control subsystem. The unintended trip function caused a common-mode malfunction (power loss) of both transformers due to a voltage transient on April 1, 1997. Specifically, following the event on April 1, 1997, the safety evaluation (SE 3091, dated April 10, 1997) and engineering performed to support replacement of the microprocessors to eliminate the unintended trip function were inadequate in that the hardware and software of the microprocessors were not sufficiently evaluated to determine that the modification did not involve a USQ. For example, voltage transients such as harmonic distortion or noise were not addressed, and the evaluation did not consider vendor configuration management, coding standards, or life cycle issues, all of which could have created a malfunction of a different type and, therefore, involved a USQ. Consequently, the modification of the transformers in April 1997, a change that involved a USQ, was made without prior NRC approval. (02013)

This is a Severity Level III violation (Supplement I).
Civil Penalty $55,000.

C. ADDITIONAL VIOLATIONS ASSOCIATED WITH INADEQUATE CORRECTIVE ACTIONS FOR KNOWN TECHNICAL ISSUES

10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," requires, in part, that measures shall be established to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action is taken to preclude repetition.

10 CFR 50.59, "Changes, tests and experiments," permits the licensee, in part, to make changes to the facility as described in the safety analysis report without prior Commission approval provided the change does not involve an unreviewed safety question (USQ). The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for the determination that the change does not involve a USQ. A proposed change shall be deemed to involve a USQ (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.

Appendix B to 10 CFR Part 50, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants", Criterion III, "Design Control," requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.

1. VIOLATION ASSOCIATED WITH SSW DESIGN INLET TEMPERATURE

Contrary to the above, between July 1994 and August 28, 1997, the licensee failed to promptly identify and correct discrepancies associated with operation of the plant with salt service water (SSW) system inlet temperatures higher than the design temperature specified in the UFSAR, a condition adverse to quality. Specifically, in July 1994 and August 1995, SSW system inlet temperature exceeded the design temperature of 65°F, as used in the accident analysis and as described in UFSAR Section 14.5.3. Additionally, plant procedures were not consistent with the UFSAR with respect to the SSW design inlet temperature. Procedure 2.2.32, "Salt Service Water System," contained no guidance regarding the temperature limit and procedure 2.2.30, "Reactor Building Closed Cooling Water System," specified a design inlet SSW temperature of 75F, representing a failure to properly translate the SSW design temperature limit into procedures. This condition adverse to quality was not promptly identified and corrected, despite prior opportunities to do so, namely:

a. In July 1994, the licensee recognized that the elevated SSW temperature was a nonconforming condition and performed evaluations that concluded that the reactor building closed cooling water (RBCCW) system was operable with SSW inlet temperatures up to 75°F. However, the licensee failed to identify that operation of the plant with SSW system inlet temperature above 65F was a condition outside of the design basis of the plant.

b. Although the licensee had identified that a design basis change was needed to change the SSW inlet temperature from 65°F to 75°F in July 1994 and again during the SWSOPI in 1995, they did not take prompt effective corrective actions to revise the design basis. A written safety evaluation to support a change to the design basis was not performed until March 1996. However, the safety evaluation that was performed in March 1996, was inadequate in that it inappropriately credited post-accident containment overpressure in the analysis. Use of containment overpressure was inconsistent with the plant licensing basis.

c. The licensee did not identify the procedural discrepancies until the SWSOPI was performed in 1995 despite prior opportunity in 1994. Procedure 2.2.32 was revised on February 23, 1995, to include an administrative limit stating that the RBCCW system remained operable with a SSW inlet temperature up to 75F. However, the design discrepancy was not corrected because the 75F limit had not been incorporated into the licensee's current UFSAR analysis of record for design basis events and the performance of emergency core cooling equipment. These analyses used an ultimate heat sink temperature of 65F. Additionally, no written safety evaluation was performed to determine that the procedure change did not involve a USQ.

d. Interim corrective actions taken by the licensee to incorporate the use of SSW temperature "rolling averages" into plant instructions were also ineffective because the needed design analysis to support this method of determining inlet temperature was not performed. Specifically, in August and September 1995, the licensee approved the use of "rolling averages" to justify SSW temperature excursions above the 65°F design limit. However, no formal detailed analysis was performed to verify that temperatures above 65F for limited periods of time were bounded by the analyses for design basis events and ECCS performance. (03013)

2. VIOLATION ASSOCIATED WITH SALT SERVICE WATER SYSTEM SINGLE FAILURE VULNERABILITY

Contrary to the above, between January 1995, and July 18, 1997, the licensee failed to identify a design deficiency in the salt service water system that rendered the system vulnerable to a single failure, a condition adverse to quality, despite prior opportunity to identify the deficiency. The single failure vulnerability involved a loss of DC power during a design basis event at specific tidal conditions and Cape Cod Bay water temperatures. Under certain conditions, only one SSW pump would remain operating with the SSW headers cross-connected and insufficient NPSH; therefore, the single DC power failure could prevent the SSW system from performing its safety function. Although the licensee completed a single failure analysis on April 27, 1997, in response to identification of single failure vulnerabilities in the SSW and RBCCW systems during the SWSOPI in 1995, the licensee failed to identify the vulnerability. (03023)

3. VIOLATION ASSOCIATED WITH ISOLATION OF NONESSENTIAL RBCCW LOADS

Contrary to the above, between February 1995, and August 28, 1997, the licensee failed to promptly identify and correct a deficiency associated with isolation of nonessential RBCCW loads during design basis conditions. Specifically, the design basis was not correctly translated into procedures in that there was no guidance in procedure 2.2.19.5, "RHR Modes of Operation for Transients," for isolating nonessential RBCCW system heat loads during a design basis accident as described in Section 10.5.5.3 of the UFSAR and other design analyses. This condition adverse to quality was not promptly identified and corrected, despite prior opportunities to do so, namely:

a. Although the licensee identified that there was no procedural guidance to isolate the nonessential loads during the SWSOPI in 1995, they failed to recognize that the condition caused the plant to be outside the design basis of the plant.

b. Although procedure 2.2.19.5 was revised on July 18, 1997, to isolate non-essential RBCCW system heat loads if suppression pool temperature exceeded 130F, this corrective action was not effective because no design-basis analysis was performed for the 130F limit to demonstrate that the core spray pump bearing cooler would receive adequate flow during all design basis conditions. Additionally, no written safety evaluation was performed to determine that the restriction on isolation of the nonessential loads did not involve a USQ. A 50.59 safety evaluation was required because the description in the UFSAR did not restrict isolation of the nonessential loads based on suppression pool temperature. (03033)

4. VIOLATION ASSOCIATED WITH RHR SYSTEM DESIGN FLOW RATES

Contrary to the above, prior to August 28, 1997, the licensee failed to promptly identify and correct a design deficiency associated with translation of the RHR design flow rate into plant procedures. The RHR design flow rate of 5100 gpm used in design basis containment heat transfer and pressure/temperature response calculations was not adequately translated into procedures. The RHR flow range of 4800 to 5100 gpm specified in Operating Procedure (OP) 2.2.19.5, "RHR Modes of Operation for Transients", was not supported by calculations that considered the effects of instrument accuracy on post-accident containment response or RHR heat exchanger integrity. After the deficiency was identified by the NRC in July 1997, the licensee failed to identify the significance of the deficiency and failed to take effective corrective actions to resolve the problem. Specifically, Operating Procedure 2.2.19.5 was revised on July 18, 1997, to throttle RHR flow not to exceed 5600 gpm; however, this corrective action was not effective because the specification of the higher RHR flow rate was not adequately supported with the required calculations and analyses and was not representative of the design basis. Additionally, no written safety evaluation was performed to determine that the higher system flow rate did not involve a USQ. Specifically, no evaluation was performed to ensure that a flow rate of 5600 gpm would not have an adverse effect on the RHR heat exchangers. (03043)

5. VIOLATION ASSOCIATED WITH EDG LOADING CALCULATIONS

Contrary to the above, between January 1995 and August 28, 1997, the licensee failed to promptly identify and correct design deficiencies associated with emergency diesel generator (EDG) loading calculations and procedures. Specifically, calculation PS-79, "Diesel Generator Loading", did not include the power drawn during current limit operation for the 250 vDC battery charger and did not address the effect on generator load by motor driven pump frequency variation. The limit specified in the precautions of procedure 2.2.8, "Standby AC Power System", for EDG 2000-hour rating did not account for accuracy of the kilowatt meter. Additionally, the diesel generator loads documented in design basis calculation PS-79 were not properly translated into the diesel generator loading information specified in procedure 2.2.8.

Although diesel generator loading was assessed during the SWSOPI in 1995, the licensee did not identify the deficiencies in calculation PS-79 and procedure 2.2.8. The licensee had identified the inconsistencies between design-basis information contained in calculation PS-79, and diesel generator loading information in procedure 2.2.8 prior to the SWSOPI in 1995 and had initiated a tracking item to revise procedure 2.2.8 during the SWSOPI. However, the licensee failed to take prompt corrective action to resolve the discrepancies. Although both calculation PS-79 and procedure 2.2.8 had been revised since the SWSOPI, as of August 28, 1997, the calculation and the procedure were still inconsistent. (03053)

6. VIOLATION ASSOCIATED WITH EDG AMBIENT TEMPERATURE DESIGN LIMIT

Contrary to the above, between January 1995, and August 28, 1997, the licensee failed to promptly identify and effectively correct a design discrepancy associated with the EDG design maximum outdoor ambient temperature limit of 88°F specified in UFSAR Section 10.9.3.9 and Table 10.9-2. During certain summer periods since initial plant startup, ambient temperatures exceeded 88°F; however, the licensee failed to ensure that the design basis limitation for operation of the EDGs was translated into specifications. The licensee failed to promptly identify and correct this condition adverse to quality, despite prior opportunities to do so, namely:

a. During the SWSOPI in 1995, the licensee identified that the maximum ambient temperature for operation of the EDGs had been exceeded in the past. However, they failed to recognize that the condition caused the plant to be outside the design basis of the plant.

b. No limits were placed on EDG loading when operating above ambient temperatures of 88 F until June 20, 1997.

c. The safety evaluations performed to support the change to a 100% water mixture in June 1997 (SE-3102) and the change back to a 50/50 glycol mixture in August (SE-3114) were not comprehensive and were based on preliminary input that was not properly validated. The safety evaluations did not address the effects of higher air temperature on key engine performance characteristics such as fuel consumption rate or the overall impact on accelerated engine wear and possible engine power de-rating. Although the testing performed to validate the analysis upon which these evaluations was based did not achieve the expected results, the EDGs were still considered operable. (03063)

7. VIOLATION ASSOCIATED WITH ENVIRONMENTAL QUALIFICATION RELATED TO DRYWELL TEMPERATURE PROFILE

10 CFR 50.49 (e) requires, in part, that the electric equipment environmental qualification program must include and be based on the time-dependent temperature and pressure at the location of the electric equipment important to safety. The time-dependent temperature and pressure must be established for the most severe design basis accident during or following which this equipment is required to remain functional.

Contrary to the above, between January 1996, and August 28, 1997, the licensee failed to take corrective action to preclude recurrence of a deficiency associated with the environmental qualification (EQ) accident temperature profile for electrical equipment in the drywell, a significant condition adverse to quality. The condition involved a computer modeling error for certain small break sizes and an incorrect assumption that resulted in higher average drywell temperature than the analysis of record for the containment temperature profile used for EQ of electrical equipment in the drywell. The modeling error caused the analysis of record since 1987 to be nonconservative due to differences in the predicted peak temperature and drywell temperatures from one hour to approximately 220 hours after the event.

In January 1996, the licensee identified and corrected the errors in the drywell temperature profile; however, they failed to take action to preclude recurrence of the deficiency. Specifically, the licensee determined that the cause of the error was failure to review the input values and assumptions used by the vendor in their analysis; however, as of August 28, 1997, no change had been made to engineering procedures to preclude repetition of the condition.

From 1987 to January 1996, a condition existed in which design basis drywell accident temperature profiles would have exceeded equipment environmental qualification temperature limits during postulated main steam line break accidents, placing the plant outside its design basis. Although the licensee identified the condition in January 1996, they failed to recognize that the condition caused the plant to be outside the design basis of the plant. (03073)

These violations (I.C.1 - 7) represent a Severity Level III problem (Supplement I).
Civil Penalty - $55,000.

II. VIOLATIONS NOT ASSESSED A CIVIL PENALTY

10 CFR 50.72, "Immediate notification requirements for operating nuclear power reactors," requires, in part, that the licensee shall notify the NRC as soon as practical and in all cases within one hour of any event or condition during operation that results in the nuclear power plant being in a condition that is outside the design basis of the plant.

10 CFR 50.73, "Licensee event report system," requires, in part, that the licensee shall submit a Licensee Event Report (LER) within 30 days after the discovery of any event or condition that resulted in the nuclear power plant being in a condition that was outside the design basis of the plant.

Contrary to the above, notifications and reports were not made within the required times as evidenced by the following examples, each of which represents a separate violation:

A. As of August 28, 1997, BECo had not reported in accordance with 10 CFR 50.72 and 10 CFR 50.73 that in July 1994 and August 1995, SSW system inlet temperature exceeded the design temperature of 65°F, as used in the accident analysis and as described in UFSAR Section 14.5.3., representing a condition outside the design basis of the plant. (04014)

This is a Severity Level IV violation (Supplement I).

B. On June 6, 1997, a design deficiency was identified in the SSW system that rendered the system vulnerable to a single failure in the event of a loss of DC power during a design basis event at specific tidal conditions and Cape Cod Bay water temperatures. UFSAR Section 10.7.2 indicates that no single active failure can prevent the system from achieving its safety objective. This condition was not reported to the NRC in accordance with 10 CFR 50.73 until July 18, 1997. (05014)

This is a Severity Level IV violation (Supplement I).

C. As of August 28, 1997, BECo had not reported in accordance with 10 CFR 50.72 and 10 CFR 50.73 that in the past, as identified during the SWSOPI in 1995, the ambient temperature for operation of the EDGs had exceeded the maximum of 88°F as specified in UFSAR Section 10.9.3.9 and Table 10.9-2 representing a condition outside the design basis of the plant. (06014)

This is a Severity Level IV violation (Supplement I).

D. As of August 28, 1997, BECo had not reported in accordance with 10 CFR 50.72 and 10 CFR 50.73 the identification of errors that resulted in higher average drywell temperature than the analysis for the containment temperature profile used for EQ of electrical equipment in the drywell as specified in the General Electric analysis of record, SUDDS/RF 87-917, "Drywell Temperature Analysis," dated September 2, 1987, representing a condition outside the design basis of the plant. (07014)

This is a Severity Level IV violation (Supplement I).

Pursuant to the provisions of 10 CFR 2.201, Boston Edison Company (Licensee) is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, within 30 days of the date of this Notice of Violation and Proposed Imposition of Civil Penalty (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each alleged violation: (1) admission or denial of the alleged violation, (2) the reasons for the violation if admitted, and if denied, the reasons why, (3) the corrective steps that have been taken and the results achieved, (4) the corrective steps that will be taken to avoid further violations, and (5) the date when full compliance will be achieved. If an adequate reply is not received within the time specified in this Notice, an Order or a Demand for Information may be issued as why the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken. Consideration may be given to extending the response time for good cause shown. Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Within the same time as provided for the response required above under 10 CFR 2.201, the Licensee may pay the civil penalty by letter addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, with a check, draft, money order, or electronic transfer payable to the Treasurer of the United States in the amount of the civil penalty proposed above, or the cumulative amount of the civil penalties if more than one civil penalty is proposed, or may protest imposition of the civil penalty in whole or in part, by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the Licensee fail to answer within the time specified, an order imposing the civil penalty will be issued. Should the Licensee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalty, in whole or in part, such answer should be clearly marked as an "Answer to a Notice of Violation" and may: (1) deny the violation(s) listed in this Notice, in whole or in part, (2) demonstrate extenuating circumstances, (3) show error in this Notice, or (4) show other reasons why the penalty should not be imposed. In addition to protesting the civil penalty in whole or in part, such answer may request remission or mitigation of the penalty.

In requesting mitigation of the proposed penalty, the factors addressed in Section VI.B.2 of the Enforcement Policy should be addressed. Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 2.201, but may incorporate parts of the 10 CFR 2.201 reply by specific reference (e.g., citing page and paragraph numbers) to avoid repetition. The attention of the Licensee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing a civil penalty.

Upon failure to pay any civil penalty due which subsequently has been determined in accordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attorney General, and the penalty, unless compromised, remitted, or mitigated, may be collected by civil action pursuant to Section 234c of the Act, 42 U.S.C. 2282c.

The response noted above (Reply to Notice of Violation, letter with payment of civil penalty, and Answer to a Notice of Violation) should be addressed to: James Lieberman, Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, One White Flint North, 11555 Rockville Pike, Rockville, MD 20852-2738, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region I and a copy to the NRC Resident Inspector at the facility that is the subject of this Notice.

Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated at King of Prussia, Pennsylvania
this 27th day of April 1998

1. e.g., A Notice of Violation without a civil penalty was issued on October 21, 1996 for a Severity Level III problem involving a violation of containment integrity Technical Specification requirements and failure to correct deficiencies in electrical penetrations (EA 96-271).