EA-98-022 - Waterford 3 (Entergy Operations, Inc.)

May 24, 1999

EA 98-022

Charles M. Dugger, Vice President
Operations - Waterford 3
Entergy Operations, Inc.
P.O. Box B
Killona, Louisiana 70066


SUBJECT:  RECONSIDERATION OF ENFORCEMENT ACTIONS (EA 98-022)


Dear Mr. Dugger:

This refers to your letter dated July 29, 1998, in response to the Notice of Violation and Proposed Imposition of Civil Penalty (Notice) sent to you by our letter dated June 16, 1998. Our letter and Notice described five violations identified during an NRC engineering team inspection which concluded on February 5, 1998. Violations A, B, C and D primarily involved high pressure safety injection (HPSI) flow instrumentation concerns; Violation E involved a reduction in emergency feedwater (EFW) flow.

In your response, you denied Violations A, B and E, and agreed only in part to Violations C and D. You stated that the discussion presented in your letter related to Violations A, B, and D differed substantively from the information that you provided during the predecisional enforcement conference, and you requested reconsideration of the issues in light of those discussions.

The following describes the results of our deliberations on your request for reconsideration. In summary, Violations A, B, and E are being withdrawn, and Violations C and D are being recharacterized as Severity Level IV violations. Accordingly, the proposed civil penalty of $110,000 is also withdrawn. The violations, as originally issued, are restated in the enclosure for reference only.

Violations A and B

Your response, together with parallel concerns regarding emergency core cooling system analysis performed by an industry vendor, caused us to closely examine our application of the 10 CFR 50.46 rule. We have concluded that the requirements of 10 CFR 50.46 were inappropriately applied in Violations A and B and therefore, these violations are being withdrawn. 10 CFR 50.46 provides the acceptance criteria for emergency core cooling systems and sets forth the requirements of the evaluation models necessary to demonstrate conformance with the acceptance criteria. Errors in the evaluation models may be subject to enforcement action if the corrective action and reporting criteria established in 10 CFR 50.46 are not met. However, in this case, there was no error in the evaluation model, but rather the installed plant flow instrumentation, in conjunction with the surveillance testing requirements, was insufficient to ensure the minimum flow assumed in the analysis. Therefore, the NRC concludes that the principle issues here concern design and test control.

In your request for reconsideration of Violations A and B, you fundamentally argued that these types of instrument uncertainties did not need to be considered in the evaluation model since such uncertainties are encompassed by the margin inherent in an Appendix K methodology. The NRC disagrees with this position and it was not a factor in the consideration to withdraw Violations A and B.

The NRC concludes that the conservatisms integral to the Appendix K methodology were not intended to and do not encompass these flow measurement uncertainties. The NRC does agree that Appendix K evaluation models do not have to explicitly include specific analytical allowances to account for emergency core cooling system flow uncertainties. However, the uncertainty must be accounted for and this can be done either through the Technical Specification surveillance requirement or the evaluation model. In this particular situation, the uncertainty was not adequately accounted for and resulted in a condition in which it could not be assured that the measured flow was consistent with that assumed in the evaluation model. This concern is addressed in Violation D.

While the NRC now acknowledges that Entergy's failure to adequately account for HPSI flow measurement and throttle valve uncertainty does not constitute a violation of 10 CFR 50.46, the NRC notes that failure to properly account for such uncertainties can lead to violations of technical specifications. 10 CFR 50.36(b) states that the technical specifications will be derived from the analyses and evaluation included in the safety analyses report. Entergy's Final Safety Analysis Report (FSAR) for Waterford 3 indicates that a total HPSI flowrate of 621.8 gpm is needed to support the small break loss-of-coolant accident analysis. Surveillance requirements are defined by 10 CFR 50.36(c)(3) as being those requirements necessary to assure that limiting conditions for operation will be met. Limiting conditions for operations are defined by 10 CFR 50.36(c)(2) as being the lowest functional capability or performance levels of equipment required for safe operation of the facility. As derived from the safety analysis, a minimum HPSI flowrate of 621.8 gpm is required to meet this definition and assure operability. Given the as-found instrument and throttle valve uncertainties, a measured flowrate of 675 gpm necessary to satisfy the Technical Specification Surveillance Requirement 4.5.2.h did not assure that a flowrate of 621.8 gpm, and, consequently, the limiting condition for operation, were met.

While we are withdrawing Violations A and B because of the inappropriate application of 10 CFR 50.46, the issue of your failing to adequately account for these uncertainties is of concern for the reasons stated above.

Violation C

Violation C was a corrective action violation that cited four occasions in which Entergy had the opportunity to identify and correct the high pressure safety injection (HPSI) instrument uncertainty issue but did not. In your request for reconsideration, you agreed in part with the violation but maintained that, despite the missed opportunities, comprehensive corrective actions were in progress to identify and resolve instrument uncertainty issues. The NRC acknowledges that Entergy had developed its Technical Specification Instrument Uncertainty and Design Basis Review Program and that the program appeared comprehensive. However, given the multiple opportunities Entergy had to identify the noncompliance and the duration of time that the noncompliance could reasonably have been identified, the NRC concludes that a cited violation is appropriate.

Violation D

Violation D involved two examples of failure to comply with Criterion XI, "Test Control," of Appendix B to 10 CFR 50. The first example, which Entergy agreed with, involved failure to assure appropriate test instrumentation was used to measure HPSI flow. The instrumentation used had uncertainties of 18 gpm/injection leg when only 5 gpm/injection leg was assumed in the derivation of the Technical Specification Surveillance required analysis. In your request for reconsideration, you discussed that this problem was the result of an old design issue, was of low safety significance, and that extensive corrective actions had been taken. You requested mitigation of this violation example pursuant to Supplement I.D.3 of NUREG 1600, Rev.1, "General Statement of Policy and Procedures for NRC Enforcement Actions."

The second example involved Entergy's failure to provide an allowance for throttle valve position variability in HPSI surveillance testing procedures. In your response, you disagreed that the failure to include an allowance for throttle valve position variability was an example of a violation of Criterion XI. Just as in your discussion for the denial of Violations A and B, you discussed that accounting for such uncertainties was unnecessary given your interpretation that such uncertainties were encompassed by the conservatisms inherent in the Appendix K evaluation model.

The NRC has concluded that both examples of the violations are valid. The NRC disagrees with your position that the variability associated with throttle valve position is encompassed within the Appendix K evaluation model. As previously stated, such input uncertainties need to be accounted for and this can be done either through the evaluation model or surveillance testing program. In this case, throttle valve position variability was not accounted for.

Change to Violations C & D

Violations C and D were originally proposed as two of four examples of a Severity Level III problem. Given all the circumstances of this case, the NRC has concluded that Violations C and D are of lesser significance and, as such, are each assigned Severity Level IV.

Response to Violations C & D

In your response to Violations C and D, you demonstrated that this particular uncertainty was no longer a concern, but it was not clear how your ongoing Technical Specification Instrument Uncertainty Program would address the concerns discussed in this letter. In summary, it is the NRC's expectation that instrument and other uncertainties be appropriately accounted for. This is necessary to ensure that parameters assumed in approved analyses are protected. The uncertainties may be accounted for either through the surveillance testing program or through the approved analyses. Accordingly, for the specific instrument uncertainty issues explicitly addressed by this enforcement action, no further response is required.

On a related matter, during a recently completed inspection of open items conducted at your facility during the week of April 5, 1999, it came to our attention that there are three safety-related systems and multiple safety-related pumps (including the high pressure safety injection system) that may not have sufficient design margins to account for all instrument uncertainties (including orifice plate tolerances, tap locations, and process temperatures, etc.). These systems are documented in your ER Response, ER-W3-99-0428-00-00 (dated April 22, 1999). Section 2.0 of this document implies that it is your position that the application of instrument uncertainty does not apply to the high pressure safety injection system and several other safety-related systems noted in the subject document because the application of instrument uncertainty for these systems is not considered to be significant to safety. The NRC does not agree that this would be an acceptable criterion for exclusion of instrument uncertainty. Accordingly, we request that you respond in writing within 30 days of the date of this letter regarding the actions that you have taken or plan to take to address this issue.

Violation E

In your response, you also denied Violation E, involving a reduction in the capacity of the emergency feedwater pumps as stated in the Technical Specification Bases. The NRC had concluded that the reduction constituted a violation of 10 CFR 50.59 in that the change constituted an unreviewed safety question which required NRC review and approval prior to implementation. The feedwater flow reduction was determined to be an unreviewed safety question in that it constituted a reduction in the margin of safety as defined in the basis for a technical specification. Given that the "margin of safety" issue has been a source of confusion in the industry, that the proposed rule change for 10 CFR 50.59 would not employ the "margin of safety" terminology, and the lack of safety significance of this particular change, the NRC is withdrawing Violation E.

Should you have any further questions regarding the enforcement actions associated with this case, they should be directed to me or Terrence Reis of my staff.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter and the enclosures will be placed in the NRC's Public Document Room.

 

		Sincerely,
		R. W. Borchardt, Deputy Director Office of Enforcement

Docket No. 50-382
License No. NPF-38

Enclosure: As stated

cc w/Enclosure:
Executive Vice President and Chief Operating Officer
Entergy Operations, Inc.
P.O. Box 31995
Jackson, Mississippi 39286-1995

Vice President, Operations Support
Entergy Operations, Inc.
P.O. Box 31995
Jackson, Mississippi 39286-1995

Wise, Carter, Child & Caraway
P.O. Box 651
Jackson, Mississippi 39205

General Manager, Plant Operations
Waterford 3 SES
Entergy Operations, Inc.
P.O. Box B
Killona, Louisiana 70066

Manager - Licensing Manager
Waterford 3 SES
Entergy Operations, Inc.
P.O. Box B
Killona, Louisiana 70066

Chairman
Louisiana Public Service Commission
One American Place, Suite 1630
Baton Rouge, Louisiana 70825-1697

Director, Nuclear Safety & Regulatory Affairs
Waterford 3 SES
Entergy Operations, Inc.
P.O. Box B
Killona, Louisiana 70066

Ronald L. Wascom, Administrator
Louisiana Radiation Protection Division
P.O. Box 82135
Baton Rouge, Louisiana 70884-2135

Parish President
St. Charles Parish
P.O. Box 302
Hahnville, Louisiana 70057

Mr. William A. Cross
Bethesda Licensing Office
3 Metro Center, Suite 610
Bethesda, Maryland 20814

Winston & Strawn
1400 L Street, N.W.
Washington, D.C. 20005-3502

---

 

ENCLOSURE

Restatement of Violation A

 

A.

10 CFR 50.46 (a)(1)(i) requires, in part, that each pressurized light-water nuclear power reactor fueled with uranium oxide pellets must be provided with an emergency core cooling system (ECCS) that must be designed so that its calculated cooling performance following postulated loss-of-coolant accidents conforms to the criteria set forth in paragraph (b) of this section. 10 CFR 50.46 (b)(1) requires, "The calculated maximum fuel element cladding temperature shall not exceed 2200F." Contrary to the above, the facility was operated from July 28 through at least December 17, 1997, with an emergency core cooling system whose calculated cooling performance following postulated loss-of-coolant accidents did not conform to the criteria specified in paragraph (b) of 10 CFR 50.46. Specifically, using the licensing basis analysis and the high pressure safety injection (HPSI) flow available by design, the licensee identified that the calculated peak fuel cladding temperature would have exceeded 2200F.

Restatement of Violation B

 

B.	10 CFR 50.46 (a)(3)(ii) states, "For each change to or error discovered in an acceptable ECCS evaluation model or in the application of such a model that affects the temperature calculation, the applicant shall report the nature of the change or error and its estimated effect on the limiting emergency core cooling system (ECCS) analysis to the Commission at least annually as specified in 10 CFR 50.4. If the change or error is significant, the applicant shall provide this report within 30 days and include with the report a proposed schedule for providing a reanalysis or taking other action as may be needed to show compliance with 10 CFR 50.46." 10 CFR 50.46 (a)(3)(ii) further requires, "Any change or error correction that results in a calculated ECCS performance that does not conform to the criteria set forth in paragraph (b) of this section is a reportable event as described in . . . 10 CFR 50.72 and 10 CFR 50.73." 10 CFR 50.46 (b)(1) states that "The calculated maximum fuel element cladding temperature shall not exceed 2200F." 10 CFR 50.46 (c)(2) states, in part, that an evaluation model includes one or more computer programs and all other information necessary for application of calculational framework to a specific loss-of-coolant accident, such as the procedures for treating the program input and output information and the values of parameters. 10 CFR 50.72 (b)(ii)(B) states, in part, that "the licensee shall notify the NRC as soon as practical and in all cases within one hour of the occurrence of any of the following: . . . (ii) Any event or condition during operation that results in . . . the nuclear power plant being: . . . (B) In a condition that is outside the design basis of the plant." Contrary to the above:
	1.	On December 5, 1997, an error correction, which would have resulted in a calculated ECCS performance that did not conform to the criteria set forth in paragraph (b) of 10 CFR 50.46, was identified but was not reported within one hour. Specifically, the ECCS evaluation model for a small break loss-of-coolant accident used an input parameter of 621.8 g.p.m. to model the HPSI flow that would be available to cool the core. On December 5, 1997, the licensee determined, after test instrument uncertainty was considered, that only 599.3 g.p.m. of HPSI flow would be available. The licensee determined, using the licensing basis analysis and the available HPSI flow, that the peak fuel cladding temperature would have exceeded 2200F, a condition outside the design basis of the plant. This condition was not reported until December 18, 1997.
	2.	As of January 22, 1998, the licensee had not provided a proposed schedule for an ECCS reanalysis, which corrected the significant input parameter error (deficit HPSI flow), or for taking other action as may be needed to show compliance with 10 CFR 50.46.

Restatement of Violation C

 

C.	10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," states, in part, that measures shall be established to ensure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action is taken to preclude repetition. The identification of the significant condition adverse to quality, the cause of the condition, and the corrective action taken shall be documented and reported to appropriate levels of management. Contrary to the above,
	1.	Corrective action for CE Info Bulletin 91-05, dated October 11, 1991, which identified a case where instrument uncertainty had not been adequately incorporated into the Technical Specifications, was not prompt. On June 20, 1995, the licensee completed Revision 0 of Calculation EC-I95-011, "SI-HPSI Flow Instrumentation Calculation," for the purpose of assessing the impact of instrument uncertainty on the Technical Specifications. The impact review was not completed until December 5, 1997.
	2.	Prior to Refueling Outage 8 (between March 19, 1997 and July 29,1997), the corrective action to preclude repetition of a significant condition adverse to quality, identified on Condition Report CR-97-0649, was not effective. Specifically, Condition Report CR-97-0649 identified that after consideration of the calculated flow instrument uncertainty, the Technical Specification limiting condition for operation value for the low pressure safety injection system did not ensure that available flow would exceed the analytical value for low pressure safety injection flow assumed in the safety analysis. To ensure a similar condition did not exist on the high pressure safety injection, the licensee informally evaluated Refueling Outage 7 high pressure safety injection system flow balance test results to determine if enough flow was present after incorporating uncertainty. This corrective action for the low pressure safety injection deficiency was not effective at precluding repetition of a similar condition on the high pressure safety injection system. This corrective action was also not documented or reported to appropriate levels of management.
	3.	On May 30, 1997, a condition adverse to quality was not identified. During the design bases review, the licensee reviewed ABB/CE Calculation 612752-MPS-5CALC-001, "SIS: HPSI Technical Specification Development Based on Analysis of Reworked B Pump Test Results," and Calculation EC-I95-011, "SI-HPSI Flow Instrumentation Calculation," Revision 1. These two calculations contained conflicting estimates of HPSI flow instrument uncertainty; however, due to organizational interface weaknesses in the design basis review program, the conflict was not identified as a condition adverse to quality.
	4.	On December 11, 1997, the corrective action that was developed to preclude repetition of a significant condition adverse to quality identified on Condition Report CR-95-1242, and that was credited to preclude repetition of a significant condition adverse to quality identified on Condition Report CR-97-0649, was not effective. Condition Report CR-95-1242 identified that a component cooling water calculation was revised without assessing the impact of the results on other design basis calculations. As a corrective action to preclude recurrence, the licensee performed 10 CFR 50.59 screening reviews for all calculation revisions from January 1, 1990, to January 1, 1996, to determine if any design or license bases were changed without approval. The review of Calculation EC-I95-011, "SI-HPSI Flow Instrumentation Calculation," Revision 1, was not effective in precluding repetition of a similar condition on the high pressure safety injection system; Calculation EC-I95-011 was revised on September 18, 1996, without a 10 CFR 50.59 screening review, and the licensee did not assess the impact of the results of Calculation EC-I95-011 on Calculation 612752-MPS-SCALC-001.

Restatement of Violation D

 

D.	10 CFR Part 50, Appendix B, Criterion XI, requires, in part, that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is performed in accordance with written test procedures, which incorporate the requirements and acceptance limits contained in applicable design documents. 10 CFR Part 50, Appendix B, Criterion XI, further requires, that test procedures shall include provisions for assuring that adequate test instrumentation is used. Surveillance Procedure OP-903-108, "SI Flow Balance Test," Revision 3, Change 1, provides instructions for performing the flow balance of the HPSI system that is required by Technical Specification Surveillance Requirement 4.5.2.h. The bases section for Technical Specification 3/4.5.2 states that the surveillance requirements ensure that, at a minimum, the assumptions used in the safety analysis are met. In addition, Technical Specification Surveillance Requirement 4.5.2.g required the verification of the correct position of each electrical and/or mechanical position stop for the emergency core cooling system (ECCS) throttle valves each time the valve was cycled. Surveillance Procedure OP-903-010, "ECCS Throttle Valves Position Verification," Revision 3, implemented this Technical Specification requirement and allowed a +/- 2 percent tolerance band for the as-found flow control valve position from its set point value. Contrary to the above:
	1.	From April 10, 1994, until December 18, 1997, Surveillance Procedure OP-903-108 did not include provisions for assuring that adequate test instrumentation was used. Specifically, the minimum flow of 675 g.p.m. required by Technical Specification 4.5.2.h included an allowance of 5 g.p.m. per leg, to account for flow instrument measurement uncertainty. However, Surveillance Procedure OP-903-108 directed personnel to use flow instruments that had a flow measurement uncertainty of approximately 18 g.p.m./leg.
	2.	From April 10, 1994, until December 18, 1997, Surveillance Procedure OP-903-108 did not adequately incorporate the requirements and acceptance limits contained in Technical Specification 4.5.2.h, Surveillance Procedure OP-903-010, and the safety analysis. Specifically, the acceptance limit for flow in Procedure OP-903-108 did not include an allowance for throttle valve position variability allowed by Procedure OP-903-010. Consideration of this allowance was necessary to ensure that, for the worst case ECCS throttle valve position, the flow assumptions used in the safety analysis would be met.

Restatement of Violation E

 

E.

10 CFR 50.59(a)(1) states, in part, that a licensee may make changes in the facility as described in the safety analysis report and changes in procedures as described in the safety analysis report without prior Commission approval unless the proposed change involves a change in the technical specifications incorporated in the license or an unreviewed safety question. 10 CFR 50.59(a)(2) states, in part, that a proposed change, test, experiment shall be deemed to involve an unreviewed safety question (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any Technical Specification is reduced. From December 18, 1984, until July 10, 1997, Technical Specification Bases 3/4.7.1.2 stated: "Each electric-driven emergency feedwater pump is capable of delivering a total feedwater flow of 350 g.p.m. at a pressure of 1163 psig to the entrance of the steam generators. The steam-driven emergency feedwater pump is capable of delivering a total feedwater flow of 700 g.p.m. at a pressure of 1163 psig to the entrance of the steam generators." Until July 10, 1997, UFSAR Section 10.4.9.2, "Emergency Feedwater System Description," stated that the turbine driven pump or both motor-driven pumps together have been designed to provide 700 g.p.m. flow to the steam generators upon loss of feedwater flow in order to remove decay heat and to reduce reactor coolant system temperature and pressure to the shutdown cooling entry conditions. NUREG-0787, "Safety Evaluation Report related to the operation of Waterford Steam Electric Station, Unit No. 3," Section 10.4.9.1, "Emergency Feedwater System," states, "The major components of the Waterford 3 EFWS [Emergency Feedwater System] are three essential safety grade pumps, one 700 gal/min (nominal) steam turbine driven pump and two 440 gal/min (nominal) motor driven pumps." This section also states "The turbine driven EFWS pump or both motor driven pumps together are designed to provide 100% of the flow necessary for residual heat removal over the entire range of reactor operation including all postulated design basis accidents in accordance with the conservatisms assumed in the accident analysis." Section 10.4.9.2 of the Safety Evaluation Report, "Emergency Feedwater System Review (TMI-2 Considerations)," states, in part, "The staff has reviewed the applicant's response .... regarding the design basis for the EFWS flow requirements. The applicant provided this information in FSAR [UFSAR] Table 10.4.9A-3. The staff's evaluation of the applicant's response against the design basis accidents and transients as identified in Chapter 15 verifies that adequate EFWS flow is provided and, therefore, the design basis for the EFWS flow requirements is acceptable." Contrary to the above, on July 10, 1997, the licensee approved a change to the facility as described in the UFSAR, which involved an unreviewed safety question, without prior Commission approval. Specifically, Safety Evaluation 97-165 for Licensing Document Change Request (LDCR) 97-0034, revised Technical Specification Bases 3/4.7.1.2 to reduce the emergency feedwater pump capability requirements. The revised basis stated that: "The two electric-driven emergency feedwater pumps combined are capable of delivering a total feedwater flow of 575 g.p.m. at a pressure of 1102 psig to the entrance of the steam generators. The steam-driven emergency feedwater pump is capable of delivering a total feedwater flow of 575 g.p.m. at a pressure of 1102 psig to the entrance of the steam generator." The reduction in the emergency feedwater pump capability requirements below those specified in UFSAR Section 10.4.9.2, and below the values assumed in the safety analysis, resulted in a reduction in the margin of safety as defined in the basis for Technical Specification 3/4.7.1.2.