EA-98-150

October 13, 1998

EA Numbers 98-150, 98-151, 98-152 and 98-186

Mr. John Sampson
Site Vice President
Nuclear Generation Group
Indiana Michigan Power Company
500 Circle Drive
Buchanan, MI 49107-1395

SUBJECT:

NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY - $500,000 (NRC Inspection Reports 50-315(316)/97201(NRR), 50-315(316)/97017(DRP), 50-315(316)/98004(DRS), 50-315(316)/98005(DRS), and 50-315(316)/98009(DRS))

Dear Mr. Sampson:

The NRC conducted five inspections at the Indiana Michigan Power (IMP) Donald C. Cook Nuclear Power Plant from August 4, 1997 through April 15, 1998. These inspections included evaluations and assessments of the: (1) ice condenser surveillance program, (2) corrective action program, (3) facility design basis, (4) safety evaluation program, and (5) control of foreign material in the containment. Because of the seriousness of the issues resulting from these inspections, lengthy public meetings were held on December 12, 1997, December 22, 1997, and January 8, 1998. The NRC held an open predecisional enforcement conference in the Region III office on May 20, 1998, with video viewing by members of the public and NRC staff in the NRC Rockville, Maryland office.

Based on the information developed during these inspections, provided during the public meetings, and provided during the predecisional enforcement conference, the NRC has determined that numerous violations of NRC requirements occurred. The circumstances surrounding these violations are described in detail in the subject inspection reports and the violations are cited in the enclosed Notice of Violation and Proposed Imposition of Civil Penalty (Notice). The violations have been grouped into four areas: (1) section A, performance of surveillance test activities, (2) section B, implementation of the corrective action program, (3) section C, control of the facility design basis, and (4) section D, conduct of safety evaluations.

During the predecisional enforcement conference, IMP admitted all the apparent violations that formed the basis for the conference, described its assessment of the root causes, and presented its corrective actions to address these issues. IMP stated that a root cause for many of these apparent violations was the failure to establish and communicate adequate performance standards.

As a consequence of the violations, extensive degradation of the design of each unit's containment and emergency core cooling systems (ECCS), including the ice condensers, refueling water storage tanks (RWST), and containment sumps occurred, adversely impacting the ability of both of the remaining design barriers (fuel cladding and containment) to prevent fission product release to the environment in the event of an accident. With regard to the fuel cladding barrier, deficiencies were identified involving: (1) a large quantity of fibrous materials within containment which would likely have clogged the ECCS suction strainers in the recirculation mode, (2) a single failure ECCS vulnerability, and (3) the amount of water available in the ECCS sump. With regard to the containment barrier, the effects of the degradation to the ice condenser from blocked ice bed flow passages, missing ice segments and ice basket damage represent a serious impairment of the function of the ice condenser to condense steam and suppress peak pressure. These conditions resulted in a serious impairment of the safety function for all redundant trains of ECCS and for containment. Further, beyond the specific systems addressed by this enforcement action, two additional systems related to the containment, the hydrogen ignition and containment spray systems, were also degraded during the same period and following analysis the licensee declared these systems inoperable.

The eight violations in section A of the Notice demonstrate that the surveillance program intended to ensure the continued availability of safety systems was inadequate. Procedures implemented to ensure post refueling outage containment cleanliness inspections were inappropriate as demonstrated by the thousands of pounds of debris present in containment for several operating cycles. The debris, which consisted of insulation, coatings (paint), labels, tape, and granular charcoal would, during a loss of coolant accident (LOCA), deposit on suction strainers used for long-term recirculation cooling and significantly impede reactor core cooling. Several procedures implemented for ice condenser testing were inadequate as demonstrated by (1) visual examinations that failed to detect excessive ice blockage of ice condenser flow passages, (2) acceptance criteria that failed to account for measurement errors, and (3) the selection of a population of baskets to weigh that was not representative of conditions within the ice condenser. In addition to the procedure problems, IMP failed to monitor the quality of services provided by contractors performing ice condenser surveillance activities and to detect rough handling practices that caused structurally significant ice basket damage to go undetected. These violations represent a programmatic breakdown in the control of IMP's surveillance program for the ice condenser.

The six violations in section B demonstrate a failure of the Donald C. Cook corrective action program to promptly identify significant conditions adverse to quality, to take appropriate corrective actions to determine the cause of each condition, and implement corrective actions to preclude repetition. For example, dented/buckled ice basket webbing and missing ice from the ice baskets identified by NRC inspectors were readily apparent conditions not previously identified by IMP staff. Further, NRC intervention was necessary to prompt licensee corrective actions for numerous deficiencies associated with the ice condenser such as missing or broken ice basket sheet metal screws found repeatedly by IMP staff in the ice melt system since 1991 without investigation or corrective action. The failure to effectively implement the corrective action program represented a programmatic breakdown in the control of licensed activities such that conditions adverse to quality were not aggressively pursued and resolved.

The sixteen violations in section C represent a programmatic breakdown of IMP's design change program. Design control deficiencies resulted in the degraded condition of the ice condenser, containment sump, and the RWST level instruments. For the ice condenser, IMP failed to follow the design control process pertaining to changes in the method to secure ice baskets in place, and the repair of damaged baskets. For the containment sump, IMP failed to implement adequate controls for the installation of material in the containment that would have affected long-term post-LOCA recirculation cooling. Most notable was the routine installation of fibrous insulation material without appropriate controls. For the RWST, IMP failed to verify the adequacy of instrument uncertainty calculations which allowed the establishment of improper swap over setpoints. This condition could result in insufficient water inventory in the containment sump for ECCS during a LOCA also resulting in reduced/inadequate core cooling.

The seven violations in section D represent a programmatic breakdown of IMP's ability to perform safety evaluations to adequately assess the consequences of changes and ensure the plant was maintained as designed and specified in the licensing basis. For example IMP created an unreviewed safety question and a single failure vulnerability when they changed the proceduralized system lineup to transfer ECCS pump suction from the RWST to the containment sump using the west residual heat removal (RHR) pump. Specifically, failure of this RHR pump would cause the loss of both trains of emergency core cooling. Another example included several safety evaluations that failed to identify that operating the facility with the ultimate heat sink above its maximum temperature was an unreviewed safety question. Operation under these conditions could have affected the ability to reach cold shutdown. In addition, when the licensee did address elevated equipment operating temperatures, the associated safety evaluation failed to provide the basis for the determination that the higher temperatures were not an unreviewed safety question.

The violations in the four sections of the Notice have been collectively categorized in accordance with the NRC Enforcement Policy (NUREG-1600) as a Severity Level II problem. This Severity Level is warranted for the breadth and number of the violations that, taken in total, resulted in a lack of reasonable assurance that following a design basis LOCA, i.e., large break, the ECCS and containment would have functioned.

Accordingly, I have been authorized, after consultation with the Commission to exercise discretion pursuant to Section VII.A.1 of the NRC Enforcement Policy to assess a penalty in the amount of $500,000. Specifically, the escalated civil penalty reflects the consideration of the particularly poor licensee performance, the duration of the problems, the impact on ECCS and containment, and the NRC's concerns regarding the violations. The purpose of this enforcement action is to emphasize: (1) the need to take timely and effective corrective actions for identified deficiencies, (2) the need for effective surveillance testing and for plant personnel to challenge and investigate discrepancies identified during surveillance activities, (3) the need for rigorous safety evaluations to determine if changes to the plant or procedures constitute unreviewed safety questions, (4) the need to maintain systems' design bases, and (5) the need for a strong self-assessment program. The staff would have proposed higher civil penalty had it not been for IMP's decision to take comprehensive corrective actions and commitment to keep the facility shutdown until these problems are resolved.

Finally, the violations described in the Notice are not all of the apparent violations present or identified during the various inspections, but serve to represent the systemic nature of the significant regulatory problems existing at the D.C. Cook facility. The breadth and number of violations identified resulting in the significant degradation of multiple systems raise questions about the condition of other safety systems at D.C. Cook. This enforcement action emphasizes the need for IMP's ongoing review of the condition of other systems to be effective. Other apparent violations described in the inspection reports referenced in the Notice are not being addressed in this enforcement action. Nevertheless, they need to be considered as part of your corrective actions.

IMP is required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing its response. The NRC will use IMP's response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and IMP's response will be placed in the NRC Public Document Room (PDR). IMP's response may, as appropriate, make reference to the material IMP provided at the predecisional enforcement conference on May 20, 1998. To the extent possible, IMP's response should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction.

	Sincerely,
	Original Signed By
	James L. Caldwell Acting Regional Administrator

Docket Nos. 50-315; 50-316
License Nos. DPR-58, DPR-74

Enclosure: Notice of Violation and
                     Proposed Imposition of Civil Penalty

cc w/encl:

J. Sampson, Site Vice President
R. Eckstein, Chief Nuclear Engineer
D. Cooper, Plant Manager
R. Whale, Michigan Public Service Commission
Michigan Department of Environmental Quality
Emergency Management Division
MI Department of State Police
D. Lochbaum, Union of Concerned Scientists

---

NOTICE OF VIOLATION
AND
PROPOSED IMPOSITION OF CIVIL PENALTY

Indiana Michigan Power Company Donald C. Cook Nuclear Plant

Docket Nos. 50-315; 50-316 License Nos. DPR-58, DPR-74 EA Nos. 98-150, 98-151,                98-152 and 98-186

During NRC inspections conducted from August 4, 1997 through April 15, 1998, violations of NRC requirements were identified. In accordance with NUREG-1600, "General Statement of Policy and Procedure for NRC Enforcement Actions," the NRC proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalty are set forth below:

A.	Performance of Inspection and Test Activities for Continued Availability and Operability of Safety Systems
	1.	10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," requires, in part, that activities affecting quality shall be prescribed by documented instructions and procedures of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions and procedures.
		a.	Contrary to the above, as of February 27, 1998, the licensee had not provided instructions appropriate to the circumstances for an activity affecting quality in that visual examinations of ice condenser flow passages using procedure 12 EHP 4030 STP.250 ( Revision 1), "Inspection of Ice Condenser Flow Passages," failed to detect ice blockages in the flow passages. Specifically, this procedure lacked instructions to perform visual examinations from accessible areas above and below the ice condenser flow passages. Further, the procedure permitted an arbitrary flow passage selection process to be used by the Test Engineer which resulted in non representative samples being examined. (01012)
		b.	Contrary to the above, as of February 27, 1998, the licensee failed to ensure that instructions appropriate to the circumstances for an activity affecting quality were provided in procedure 12 EHP 4030 STP.211 (Revision 2), "Ice Condenser Surveillance." Specifically, step 4.8 of procedure 12 EHP 4030 STP.211 authorized unpinning up to 60 ice baskets in Modes 3 and 4 without an analysis to determine if the integrity of the containment structure was affected with the ice condenser in this condition. (01022 )
		c.	Procedure No. 01-OHP 4030.001.002 (Revision 14), "Containment Inspection Tours," defines how to perform containment inspections, an activity affecting quality.
			Contrary to the above, as of September 11, 1997, 01-OHP 4030.001.002 was not appropriate to the circumstances because it did not require an individual to look for insulation that could restrict flow to the containment recirculation sump. Specifically, Fiberfrax insulation material was installed in 1985, 1986, and in 1995 during maintenance outages, and Temp-mat insulation was installed in 1989. Numerous containment inspections were made by the licensee during the last 12 years which never identified the need to remove fibrous insulation material. On September 11, 1997, fibrous insulation material which could restrict flow to the containment recirculation sump was found installed in the Unit 2 containment. (01032)
	2.	10 CFR Part 50, Appendix B, Criterion XI, "Test Control," requires, in part, that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents.
		a.	Contrary to the above, as of February 27, 1998, the licensee had failed to adequately incorporate the acceptance limit of design document WCAP-11902, "Reduced Temperature and Pressure Operation for Donald C. Cook Nuclear Plant Unit 1 Licensing Report," dated October 1988 into test procedure 12 EHP 4030 STP.250, "Inspection of Ice Condenser Flow Passages." Specifically, test procedure 12 EHP 4030 STP.250 incorporated the 15 percent uniform ice condenser flow blockage acceptance criterion of WCAP-11902 without accounting for measurement errors, which when considered in the procedure, would result in a flow passage blockage acceptance criterion in excess of that previously analyzed. (01042)
		b.	Contrary to the above, as of February 27, 1998, the licensee had failed to adequately incorporate the analyzed acceptance limit (Westinghouse evaluation "Indiana Michigan Power D.C. Cook Nuclear Power Plant Ice Condenser Seismic Load Study New Ice Basket Design," dated February 28, 1990) for the combined ice basket with ice weight (gross ice basket weight) into Attachment 4, "Ice Condenser Basket Work Sheet," of test procedure EHP 4030 STP.211, "Ice Condenser Surveillance," Revision 2. Specifically, the 1877 lb. acceptance criterion used in the procedure did not account for measurement errors, which when considered, would result in a maximum gross ice basket weight acceptance criterion in excess of that previously analyzed. (01052)
	3.	10 CFR Part 50, Appendix B, Criterion VII, "Control of Purchased Material, Equipment, and Services," requires, in part, that the effectiveness of the control of quality by contractors shall be assessed at intervals consistent with the importance, complexity and quantity of services.
		Contrary to the above, the licensee had not assessed the effectiveness of the control of quality by the ice basket weighing contractors performing ice condenser surveillance testing since the 1995 refueling outage. Numerous ice baskets sustained potentially detrimental damage. Specifically, on March 3, 1998, November 12, 1997, and February 28, 1997, the licensee attributed ice baskets damage (documented in CR 98-388, CR 97-3244, CR 97-0544) to weighing practices and associated activities performed by contractors during ice condenser surveillance testing. (01062)
	4.	Technical Specification 4.6.5.1.d, "Ice Condenser - Ice Beds," requires, in part, that the licensee visually inspect accessible portions of at least two ice baskets from each 1/3 of the ice condenser and verify that the ice baskets are free of detrimental structural wear, cracks, corrosion or other damage.
		Contrary to the above, on March 20, 1997, the licensee visually inspected the accessible portion of ice basket 6-3-4 (a basket selected for the Technical Specification 4.6.5.1.d inspection) but failed to verify the basket was free of detrimental structural wear, cracks, corrosion or other damage in the applicable surveillance procedure 12 EHP 4030 STP.212 (Revision 0) "Ice Condenser Basket Inspection." Specifically, the licensee failed to identify structural damage at ice basket 6-3-4 lower rim assembly which was accessible. (01072)
	5.	Technical Specification Surveillance Requirement 4.6.5.1.b.2 requires, in part, that the licensee weigh a representative sample of at least 144 ice baskets and verify that each ice basket contains at least 1333 pounds of ice.
		Contrary to the above, during the 1995 refueling outage, the licensee failed to select a representative sample of ice baskets to meet Technical Specification 4.6.5.1.b.2 for the ice weight surveillance. The selected ice baskets constituted a non-representative sample, in that azimuthal row 5 ice baskets were excluded, which were lighter than other azimuthal rows (e.g., contained a significant percentage of ice baskets below the 1333 pounds of ice required). Further, the selection was nonrepresentative in that the same ice baskets were repetitively weighed (particularly in radial rows 8 and 9) during sequential surveillance intervals. (01082)
B.	Implementation of a Corrective Action Program to Assure Conditions Adverse to Quality are Effectively Corrected
	10 CFR Part 50, Appendix B, Criterion XVI requires, in part, that measures shall be established to ensure that conditions adverse to quality such as defective material and non conformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.
	1.	Contrary to the above, as of January 25, 1998, the licensee failed to identify or implement corrective action for the failed ice basket sheet metal screws, a condition adverse to quality, which had been repeatedly found in the ice melt system filters for both units since 1991. (01092)
	2.	Contrary to the above, as of February 4, 1998, the licensee failed to identify, or implement corrective action for the numerous ice baskets in Units 1 and 2 with missing ice segments (six to eighteen feet in length) representing a significant reduction of basket ice mass, which was a condition adverse to quality, located near the lower end of the ice basket. (01102)
	3.	Contrary to the above, as of February 4, 1998, the licensee failed to identify or implement corrective actions for the dented/buckled webbing, a condition adverse to quality, located near the bottom ice basket rim assembly on more than 40 Unit 1 and more than 100 Unit 2 ice baskets. (01112)
	4.	Contrary to the above, as of February 27, 1998, the licensee failed to implement adequate measures to preclude repetition of loose U-bolt nuts at the bottom ice basket assembly, significant conditions adverse to quality. Loose U-bolt nuts were identified on ice baskets in 1990 for Unit 1 (documented in PR 90-1639). Preventive actions taken by the licensee to preclude recurrence of this condition included modifying surveillance procedure 12 THP 4030 STP.211, "Ice Condenser Surveillance" to inspect ice baskets for loose or missing nuts. Subsequently, loose U-bolts were again identified on Unit 1 ice baskets in 1992 (documented in PR 92-1386) and in Unit 2 (documented in PR 92-0360). (01122)
	5.	Contrary to the above, as of February 27, 1998, the licensee failed to implement adequate measures to identify the cause and preclude repetition of separated Unit 1 ice basket assemblies, a significant condition adverse to quality. The licensee had not established a definitive root cause for the separated ice baskets documented in CR 1-07-83-647 and CR 1-08-83-771. Further, no corrective action measures had been implemented for these failures. On February 28, 1997, the licensee identified another separated basket as documented in CR 97-0554. Again, the licensee failed to determine the cause for the separated basket and did not implement any corrective actions to preclude recurrence. (01132)
	6.	Contrary to the above, as of February 27, 1998, the licensee failed to implement adequate measures to identify the cause and preclude repetition of failed fillet welds at the ice basket bottom hold down bar, a significant condition adverse to quality. Licensee corrective actions completed in 1992 and documented in PR 92-1181 for failed fillet welds at the ice basket bottom hold down bar were not adequate to resolve this significant condition adverse to quality. Specifically, FSAR Appendix M, Section 3.1.4 required application of the design basis accident loads in qualifying the design of the ice baskets. WCAP-8304, "Stress and Structural Analysis and Testing of Ice Baskets," dated May 1974, defined the design basis accident lateral and compressive loadings used in analysis and testing of the original ice baskets. Licensee engineering evaluations dated July 27 and August 13, 1992, failed to apply these lateral or compressive loadings in accepting the ice baskets with the failed fillet welds. (01142)
C.	Control and Maintenance of the Facility Design Basis
	1.	10 CFR 50.9(a) requires, in part, that information required by statute or by the Commission's regulations, order, or license condition to be maintained by the licensee shall be complete and accurate in all material respects.
		10 CFR 50.71(e), "Maintenance of Records, Making of Reports," requires, in part, that each person licensed to operate a nuclear power reactor shall update periodically, the final safety analysis report (FSAR) to assure that the information included in the FSAR contains the latest material developed. This submittal shall contain all the changes necessary to reflect information and analyses submitted to the Commission by the licensee or prepared by the licensee pursuant to Commission requirements since the submission of the original FSAR or, as appropriate, the last updated FSAR. The updated FSAR shall be revised to include the effects of all changes made in the facility or procedures as described in the FSAR and all safety evaluations performed by the licensee either in support of requested license amendments or in support of conclusions that changes did not involve an unreviewed safety question.
		a.	Contrary to the above, as of February 27, 1997, the licensee failed to update FSAR Section 5.3.1, "Design Consideration," to incorporate analysis WCAP-11902, "Reduced Temperature and Pressure Operation for Donald C. Cook Nuclear Plant Unit 1 Licensing Report," dated October 1988, which established the limit for ice condenser flow passage blockages used as the basis for the acceptance criterion in surveillance procedure 12 EHP 4030 STP 250 (Revision 1), "Inspection of Ice Condenser Flow Passages." WCAP-11902 is a safety evaluation that was submitted to the Commission in support of a license amendment request for new limits for an ice condenser flow passage blockage. The information the licensee submitted to the NRC in the FSAR was not complete and accurate. (01152)
		b.	Contrary to the above, as of February 27, 1998, the licensee failed to update FSAR Figure 6.4.1, "Typical Bottom Ice Basket Assembly," of FSAR Appendix M, "Ice Condenser Component Evaluation Report," to conform to the as-built ice basket bottom assembly configuration that involves a welded hold down bar, versus a bolted rectangular tube support assembly. The information the licensee submitted to the NRC in the FSAR was not complete and accurate. (01162)
		c.	Contrary to the above, as of February 27, 1998, the licensee failed to update FSAR, Appendix M, Section 6.4.2 to incorporate the latest material developed. Specifically, the following modifications made to the facility as described in the FSAR had not been included in a licensee update submittal. The information the licensee submitted to the NRC in the FSAR was not complete and accurate. (01172)
			i.	Modification 02-MM-032, "Ice Basket Reinforcement - Problem Report #88-914," installed clamps, a pipe brace, and a cable to repair a damaged Unit 2 ice basket on February 10, 1989.
			ii.	Modification 01-MM-048, "Minor Modification Temporary Repair of Damaged Ice Baskets," installed clamps, a pipe brace and cables to repair eight damaged Unit 1 ice baskets on July 11, 1989.
		d.	Contrary to the above, as of February 27, 1998, the licensee failed to update FSAR, Appendix M, Table 4.3 -1 to incorporate the current maximum analyzed ice basket weight of 1877 lbs., which had been established in a Westinghouse evaluation "Indiana Michigan Power D.C. Cook Nuclear Power Plant Ice Condenser Seismic Load Study New Ice Basket Design" dated February 28, 1990, accepted by the licensee on March 1, 1990, and incorporated into surveillance procedures. The information the licensee submitted to the NRC in the FSAR was not complete and accurate. (01182)
	2.	10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that the licensee shall establish measures to assure that design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design and be approved by the organization that performed the original design. Further, these measures shall assure that the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions; and that design control measures provide for verifying or checking the adequacy of design, such as the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.
		*(1)a.	Contrary to the above, as of February 19, 1998, changes had been made to Unit 1 ice baskets without being subject to design control measures commensurate with those applied to the original design. Specifically, a galvanized bolt had been installed in place of the clevis pin that connected the ice basket to the support structure for ice baskets 4-1-9, 5-9-1 and 20-3-6. (01192)
		*b.	Contrary to the above, as of February 19,1998, changes had been made to a Unit 2 ice basket without being subject to design control measures commensurate with those applied to the original design. Specifically, a six-inch wide curved sheath of sheet metal had been installed onto the ice basket mesh of ice basket 1-7-9. (01202)
		*c.	Contrary to the above, as of February 19, 1998, changes had been made to a Unit 2 ice basket without being subject to design control measures commensurate with those applied to the original design. Specifically, nine rivets had been installed in place of sheet metal screws at the bottom ice basket rim coupling of ice basket 14-6-8. (01212)
		d.	Contrary to the above, inadequate measures were established to assure that the containment sump design basis was correctly translated into specifications for the installation of Fiberfrax refractory insulation in the containment. Specifically, FSAR Section 6.2.2, "ECCS, System Design and Operation," states, in part, that the containment sump provided adequate net positive suction head for the residual heat removal pumps and containment spray pumps to operate in the recirculation mode. However, specification DCC-FP101-QCN (Revision 14 and Change Sheet 1), dated February 28, 1995, "Fire Barrier Penetration Seals," Section 3.5, which details the requirements for the installation and maintenance of fire barrier penetration seals and fire stops states that Fiberfrax refractory insulation can be left in place in containment following the sealing operation. Further, procedure no. 12CHP5021.ECD.005 (Revision 9), "Installation, Replacement, and Repair of Silicone Fire Barrier Penetration Seals," which provides the instructions for cable tray and conduit fire barriers/stops installation, permitted Fiberfrax damming material to remain in place following the installation in containment. Following a LOCA, Fiberfrax material could become dislodged and collect on the sump suction strainers restricting post loss of coolant accident recirculation capability. (01222)
		*e.	Contrary to the above, inadequate measures were established to assure that the containment sump design basis was maintained and correctly translated into specifications because the specifications were changed without using design control measures commensurate with those applied to the original design. Specifically, the Updated Final Safety Analysis Report at Section 6.2.2, "ECCS, System Design and Operation," states, in part, that the containment sump provided adequate net positive suction head for the residual heat removal and containment spray to operate in the recirculation mode. Specification DCC-PV450-QCS (Revision 6), "Thermal Insulation," at Section 4.3.9, "Metal Jackets Within Containment," states, in part, that all applied pipe insulation within the containment area shall be covered with prefabricated 0.010" thick, type 304 stainless steel jackets. However, a January 25, 1989 memorandum permitted the use of Temp-mat insulation without a 0.010" thick stainless steel (type 304) jacket as a replacement for metallic insulation contrary to Design Specification DCC-PV450-QCS, and incorrectly indicated that "the replacement is not considered to be a design change." This design change was not subject to design control measures that were commensurate with the original design. Following a LOCA, without the metal jackets, Temp-mat debris could be swept from its installed location and be transported to the containment sump where it would block the sump screens and contribute to degraded post loss of coolant accident recirculation capability. (01232)
		f.	Contrary to the above, the licensee failed to ensure that the RWST design basis was correctly translated into specifications by failing to implement measures to verify or check the adequacy of instrument uncertainty calculation Engineered Control Procedure (ECP) 1-RPC-09 (Revision 2), "Refueling Water Storage Tank (RWST) Level" dated December 2, 1993. Specifically, the RWST level channel uncertainty calculation did not include the RWST discharge pipe entrance friction head loss and the velocity head loss during maximum emergency core cooling flow rates. These head losses (biases) caused the indicated RWST level to read lower than actual tank level. This could affect emergency core cooling system (ECCS) and containment spray (CTS) pumps suction transfers from the RWST to the containment recirculation sump during a design basis accident. The premature transfer could cause ECCS and CTS pump loss due to vortexing (air entrainment) and/or the loss of net positive suction head (NPSH) from insufficient sump water level. (01242)
		g.	Contrary to the above, the licensee failed to ensure that the RWST design basis was correctly translated into specifications by failing to implement measures to verify or check the adequacy of instrument uncertainty calculation No. ECP 1-CG-39 (Revision 1), "Refueling Water Storage Tank (RWST) Level" dated October 21, 1994. Specifically, the RWST level channel uncertainty calculation did not include vortexing or air entrainment that could occur at the RWST discharge pipe during maximum emergency core cooling flow rates before the suction for the pumps was transferred from the RWST to the containment sump. Vortexing could cause ECCS and CTS pump loss due to air binding. (01252)
		h.	Contrary to the above, the licensee failed to ensure that the ECCS design basis was correctly translated into specifications by failing to implement measures to verify or check the adequacy of instrument uncertainty calculations ECP 1-2-N3-01, 1-RPC-14, and 2-RPC-14, Revisions dated March 16, 1994, May 17, 1994, and May 17, 1994, respectively. Specifically, the containment sump level instrumentation loops did not account for the loop uncertainty impact on post-accident containment levels, did not include considerations for residual heat removal (RHR) and CTS pumps NPSH requirements, and did not account for pump vortexing (air entrainment). As a consequence, this could impact ECCS or CTS pumps during transfer from the RWST to the containment sump when implementing emergency operating procedure 01(02)-OHP 4023.ES-1.3, "Transfer to Cold Leg Recirculation." (01262)
		*i.	Contrary to the above, as of September 10, 1997, the licensee did not correctly translate the required containment water inventory design into specifications, drawings, procedures, and instructions. Specifically, engineering reviews did not evaluate the effects of reactor coolant flow diversions into the inactive portions of the containment sump where it would not be available during a design basis accident. Therefore, it was not known if sufficient water could be recovered during a design basis accident to prevent ECCS or containment spray pump vortexing (air entrainment) during containment sump recirculation. This could jeopardize long term pump operation. (01272)
		j.	Contrary to the above, in 1996 and 1997, the licensee failed to translate into specifications, drawings, procedures, and instructions for the design basis of the ¾-inch containment recirculation sump roof vent hole. The design basis, which was to minimize air entrapment under the containment sumps roof slab, was specified in AEP:NRC:00110, dated December 29, 1978. However, in 1996 for Unit 2 and 1997 for Unit 1, the licensee sealed the vent holes without using the design control process. (01282)
		*k.	Contrary to the above, the licensee did not correctly translate the ¾-inch containment recirculation sump particulate retention design basis into specifications, drawings, procedures, and instructions. Specifically, design change DC-12-236, dated March 27, 1979, was deficient because it permitted the installation of fine particulate screens with gaps in excess of ½-inch at the edges of individual screen sections together with no screens over the ¾-inch sump vent holes. As a consequence, a common mode failure of both CTS trains could have occurred because of the size of the particles that was permitted to enter the sump. The screens' purpose was to prevent introduction of debris that could plug the -inch containment spray nozzles. (01292)
		*l.	Contrary to the above, the licensee had not implemented adequate measures to assure that the correct design values were used to calculate the maximum heat loading for the containment spray heat exchanger room per DCCHV12AE06N, dated June 3, 1992, "Heat Gain Calculation - AES System." Specifically, the calculation incorrectly used an essential service water flow of 3300 gpm and a containment sump inlet temperature of 170°F. According to FSAR Table 9.8-5, "Essential Service Water System Minimum Flow Requirement," at note 4 the minimum essential service water flow was 2400 gpm and according to FSAR section 6.3.2, "System Design," the maximum containment sump temperature was 190°F. (01302)
D.	Conduct of Safety Evaluations to Assure Facility and Procedure Changes do not Create Unreviewed Safety Questions.
	1.	10 CFR 50.59(a)(1), "Changes, Tests and Experiments," states, in part, that the holder of a license authorizing operation of a utilization facility may, (1) make changes in the facility as described in the safety analysis report, and (2) make changes in the procedures as described in the safety analysis report without prior Commission approval, unless the proposed change involves a change in the technical specifications incorporated in the license or an unreviewed safety question.
		a.	10 CFR 50.59 (a)(2) states, in part, that a proposed change, test, or experiment shall be deemed to involve an unreviewed safety question: (1) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (2) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (3) if the margin of safety as defined in the basis for any technical specification is reduced.
			i.	Contrary to the above, safety evaluations of March 11and March 20, 1996, for the core off-load were inadequate because they failed to recognize that the Unit 1 CCW system could not perform its function under the design basis assumptions described in the FSAR and failed to conclude that this change involved an unreviewed safety question. Specifically, during the Unit 2 full core off-load outage and with Unit 1 at 100% power, both Unit 2 CCW and essential service water (ESW) trains were taken out-of-service, leaving one Unit 1 CCW train available to supply spent fuel pool cooling. A single CCW train operating at 95°F could not maintain the spent fuel pool (SFP) bulk water temperature less than the temperature (160°F) specified in FSAR Section 9.4, "Spent Fuel Pool Cooling System." In addition, with a single Unit 1 CCW train providing SFP cooling, a Unit 1 design basis accident would isolate CCW causing a loss of SFP cooling. As a consequence, the SFP time-to-boil margin could be reduced to less than the 5.74 hours specified in FSAR. Operation of the facility with one unit off loaded, the other unit at full power operation, and only one train of spent fuel pool cooling available created the possibility for an accident or malfunction of a type not previously evaluated in the FSAR. (01312)
			ii.	Contrary to the above, during July and August of every year between 1994 and 1997, the licensee made a change to the facility without Commission approval, that involved an unreviewed safety question (USQ). Specifically, the licensee made a change by operating the facility above its maximum ultimate heat sink (lake) temperature limit (76°F) as stated in FSAR Tables 6.3-2 and 9.5-3. However, no safety evaluation was performed and the UFSAR had not been updated to reflect operation above the 76°F limit. For example, on July 17, July 18 and August 4 of 1997, the temperature exceeded the 76°F limit. Operating the facility with the ultimate heat sink above its maximum temperature involved a USQ because the higher temperatures increased the probability for failure of equipment important to safety previously evaluated in the UFSAR. (01322)
		b.	10 CFR 50.59, "Changes, tests and experiments," in part, permits the licensee to make changes to its facility and procedures as described in the safety analysis report and conduct tests or experiments not described in the safety analysis report without prior Commission approval provided the change does not involve a change in the technical specifications or an Unreviewed Safety Question (USQ). The licensee shall maintain records of changes in the facility and these records must include a written safety evaluation which provides the bases for the determination that the change does not involve a USQ.
			10 CFR 50.71(e) requires, in part, a licensee to update the FSAR originally submitted as part of the application for the operating license to assure that the information included in the FSAR contains the latest material developed. The updated FSAR shall be revised to include the effects of, in part, all safety evaluations performed by the licensee in support of conclusions that changes did not involve a USQ.
			10 CFR 50.9(a) requires, in part, that information provided to the NRC by a licensee or information required to be maintained by a licensee shall be complete and accurate in all material respects.
			i.	Contrary to the above, from June 1992 to January 1997, the facility was not in conformance with the FSAR in that the licensee revised emergency operating procedure Nos. 01(02) - OHP 4023.ES -1.3, Revision 2, "Transfer to Cold Leg Recirculation," to operate in series (piggy-back) both centrifugal charging and safety injection trains onto the west residual heat removal (RHR) pump and there was not an adequate safety evaluation performed to determine that there was not a unreviewed safety question. Specifically, FSAR Section 6.2.2 stated that the transfer to cold leg recirculation is performed by trains and specified a transfer sequence from the injection phase to the recirculation phase. However, because the west RHR pump would be operating to supply both centrifugal charging and safety injection pumps, the failure of the west RHR pump would cause the loss of all emergency core cooling. In addition, ES-1.3, Revision Nos. 3 and 4, and their corresponding safety evaluations failed to identify the single failure vulnerability and the fact that the FSAR section 6.2.2 specified a transfer sequence from the injection phase to the recirculation phase that was not implemented by ES-1.3. As a result, the 50.59 safety evaluation for this procedure revision failed to identify that an unreviewed safety question (single failure vulnerability) was created by this procedure change because of the possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report was created. In addition the updated FSAR was not complete and accurate in all material respects in that it did not reflect this change in operation of the plant. (01332)
			ii.	Contrary to the above, as of September 10, 1997, the licensee had operated the component cooling water (CCW) system at temperatures (120°F) above FSAR Table 9.5.3 specified design value of 95°F without a written safety evaluation providing the basis for the determination that operating the reactor coolant pump (RCP) seals with higher CCW temperatures was not an unreviewed safety question. In addition the updated FSAR was not complete and accurate in all material respects in that it did not reflect this change in operation of the plant. (01342)
			iii.	Contrary to the above, as of September 10, 1997, the licensee operated the RCP thermal barrier heat exchanger, for both units, with a CCW flow between 25 and 35 gpm for a total flow of 100 - 140 gpm without a written safety evaluation providing the bases for the determination that operating with reduced RCP thermal barrier heat exchanger flow was not an unreviewed safety question. Specifically, FSAR Table 9.5-2 stated that the minimum flow was 140 gpm total or a minimum flow of 35 gpm to each RCP thermal barrier. However, the licensee operated the RCP thermal barriers with flow as low as 25 gpm. In addition the updated FSAR was not complete and accurate in all material respects in that it did not reflect this change in operation of the plant. (01352)
		c.	10 CFR 50.59 (b)(1) requires, in part, that the licensee shall maintain records of changes in the facility made pursuant to this section, to the extent that these changes constitute changes in the facility as described in the safety analysis report. These records must include a written safety evaluation which provides the bases for the determination that the change does not involve an unreviewed safety question.
			i.	FSAR Table 9.5.2 "Component Cooling Water System Minimum Flow Requirements Per Train (GPM)" listed the letdown heat exchanger maximum flowrate during normal and cooldown operations as 984 gpm.
				Contrary to the above, safety evaluation SECL-97-198, "FSAR Change to Support Increased CCW Temperature," dated November 12, 1997, was inadequate in that an evaluation had not been performed to determine that the change to the system configuration specified in FSAR Table 9.5.2 did not involve an unreviewed safety question. Specifically, the letdown heat exchanger control system could automatically open the CCW outlet flow control valve in an attempt to maintain outlet temperature at 120F causing flow to potentially reach 1400 gpm. No written evaluation was performed to address this change from the FSAR design maximum flow of 984 gpm. (01362)
			ii.	FSAR Section 6.2.2, "System Design and Operation," page 6.2-12, describes the changeover from the injection phase to the recirculation system phase. Specifically, this section describes the low level setpoint of the refueling water storage tank as 131,980 gallons.
				Contrary to the above, procedure no. 01(02)-OHP 4023.ECA-0.2 allowed plant operation with the low level setpoint changed from 31 percent to 20 percent. The 10 CFR 50.59 screening, dated January 3, 1998, evaluating the change, failed to recognize and evaluate the change to the plant as described in FSAR Section 6.2, which listed a volume of 131,980 gallons which corresponds to 31 percent of the tank volume for the low level setpoint. (01372)

These violations represent a Severity Level II problem. (Supplement I) - Civil Penalty $500,000

Pursuant to the provisions of 10 CFR 2.201, Indiana Michigan Power Company (Licensee) is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, within 30 days of the date of this Notice of Violation and Proposed Imposition of Civil Penalty (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each alleged violation: (1) admission or denial of the alleged violation; (2) the reasons for the violation if admitted, and if denied, the reasons why; (3) the corrective steps that have been taken and the results achieved; (4) the corrective steps that will be taken to avoid further violations; and (5) the date when full compliance will be achieved. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as why the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken. Consideration may be given to extending the response time for good cause shown. Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Within the same time as provided for the response required above under 10 CFR 2.201, the Licensee may pay the civil penalty proposed above in accordance with NUREG/BR-0254 and by submitting, to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, a statement indicating when and by what method payment was made, or may protest imposition of the civil penalty in whole or in part, by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the Licensee fail to answer within the time specified, an order imposing the civil penalty will be issued. Should the Licensee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalty, in whole or in part, such answer should be clearly marked as an "Answer to a Notice of Violation" and may: (1) deny the violation(s) listed in this Notice, in whole or in part, (2) demonstrate extenuating circumstances, (3) show error in this Notice, or (4) show other reasons why the penalty should not be imposed. In addition to protesting the civil penalty in whole or in part, such answer may request remission or mitigation of the penalty.

In requesting mitigation of the proposed penalty, the factors addressed in Section VI.B.2 of the Enforcement Policy should be addressed. Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 2.201, but may incorporate parts of the 10 CFR 2.201 reply by specific reference (e.g., citing page and paragraph numbers) to avoid repetition. The attention of the Licensee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing civil penalty.

Upon failure to pay any civil penalty due which subsequently has been determined in accordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attorney General, and the penalty, unless compromised, remitted, or mitigated, may be collected by civil action pursuant to Section 234c of the Act, 42 U.S.C. 2282c.

The response noted above (Reply to Notice of Violation, statement as to payment of civil penalty, and Answer to a Notice of Violation) should be addressed to Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, One White Flint North, 11555 Rockville Pike, Rockville, MD 20852-2738, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region III, and a copy to the NRC Resident Inspector at the facility that is the subject of this Notice.

Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim for withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated this 13th day of October 1998

---

1. Violations annotated with an asterisk (*) are violations which occurred beyond the five year statute of limitations period for assessing civil penalty or are violations for which definitive dates to establish their occurrence are unavailable to determine the statute of limitations applicability but likely occurred more than five years before the inspection. In either case, these violations were not considered for purposes of determining any civil penalty.