NUREG- 1275 

Vol. 14

Causes and Significance 

of Design-Basis Issues 

at U.S. Nuclear Power 

Plants 

U.S. Nuclear Regulatory Commission 

Office Nuclear Regulatory Research 

Washington, DC 20555-0001 ,
AVAILABILITY OF REFERENCE MATERIALS 

IN NRC PUBLICATIONS

NRC Reference Material 

As of November 1999, you may electronically 

access NUREG-series publications and other 

NRC records at NRC's Public Electronic Reading 

Room at www.nrc.gov/NRC/ADAMS/ndex.html. 

Publicly released records include, to name a few, 

NUREG-series publications; Federal Register 

notices; applicant, licensee, and vendor 

documents and correspondence; NRC 

correspondence and internal memoranda; 

bulletins and information notices; inspection and 

investigative reports; licensee event reports; and 

Commission papers and their attachments. 

NRC publications in the NUREG series, NRC 

regulations, and Title 10, Energy, in the Code of 

Federal Regulations may also be purchased from 

one of these two sources. 

1. The Superintendent of Documents 

U.S. Government Printing Office 

P. 0. Box 37082 

Washington, DC 20402-9328 

www.access.gpo.gov/su-docs 

202-512-1800 

2. The National Technical Information Service 

Springfield, VA 22161-0002 

www.ntis.gov 

1-800-533-6847 or, locally, 703-805-6000 

A single copy of each NRC draft report for 

comment is available free, to the extent of 

supply, upon written request as follows: 

Address: Office of the Chief Information Officer, 

Reproduction and Distribution 

Services Section 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001 

E-mail: DISTRIBUTION@ nrc.gov 

Facsimile: 301-415-2289 

Some publications in the NUREG series that are 

posted at NRC's Web site address 

www.nrc.gov/NRC/NUREGS/indexnum.html 

are updated periodically and may differ from the 

last printed version. Although references to 

material found on a Web site bear the date the 

material was accessed, the material available on 

the date cited may subsequently be removed 

from the site.

4

The NUREG series comprises (1) technical 

and administrative reports and books 

prepared by the staff (NUREG-XXXX) or 

agency contractors (NUREG/CR-XXXX), (2) 

proceedings of conferences 

(NUREG/CP-XXXX), (3) reports resulting 

from international agreements 

(NUREG/IA-XXXX), (4) brochures 

(NUREG/BR-XXXX), and (5) compilations of 

legal decisions and orders of the Commission 

and Atomic and Safety Licensing Boards and 

of Directors' decisions under Section 2.206 of 

NRC's regulations (NUREG-0750).

Non-NRC Reference Material 

Documents available from public and special 

technical libraries include all open literature 

itemc, such as books, journal articles, and 

transactions, Federal Register notices, Federal 

and State legislation, and congressional reports. 

Such documents as theses, dissertations, foreign 

reports and translations, and non-NRC 

conference proceedings may be purchased from 

their sponsoring organization. 

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory 

process are maintained at

The NRC Technical Library 

Two White Flint North 

11545 Rockville Pike 

Rockville, MD 20852-2738 

These standards are available in the library for 

reference use by the public. Codes and 

standards are usually copyrighted and may be 

purchased from the originating organization or, if 

they are American National Standards, from

American National Standards Institute 

11 West 4 2 nd Street 

New York, NY 10036-8002 

www.ansi.org 

212-642-4900
NUREG-1275 

Vol. 14

Causes and Significance 

of Design-Basis Issues 

at U.S. Nuclear Power 

Plants

Manuscript Completed: October 2000 

Date Published: November 2000 

Prepared by: 

R.L. Lloyd, J.R. Boardman, S.V. Pullani 

Division of Systems Analysis and Regulatory Effectiveness 

Office of Nuclear Regulatory Research 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001 

t. ,o 
ABSTRACT

This report documents the results of a systematic 

and comprehensive study of design-basis issue 

trends and patterns following a limited review that 

began in early 1997 by the former Office for 

Analysis and Evaluation of Operational Data*. The 

study provides insights from reported design-basis 

issues with respect to: (1) their causes, significant 

patterns within both the power reactor industry and 

power reactor systems, frequency trends, safety 

consequences, and risk significance; (2) the 

lessons that may be useful in assessing regulatory

effectiveness of NRC's evolving inspection and 

plant performance assessment processes and the 

definition of plant design basis and; (3) regulatory 

burden implications related to NRC licensee event 

reporting requirements for design-basis issues. It is 

intended that the insights from this study assist 

NRC and industry ongoing efforts to make NRC's 

regulatory framework and oversight process more 

risk informed and performance based and to 

reduce unnecessary regulatory burden.

Effective March 28, 1999, the Office for Analysis and Evaluation of Operational Data (AEOD) was disbanded. The work 

described in this report which was initiated by AEOD is being completed by the Regulatory Effectiveness Assessment 

and Human Factors Branch of the NRC's Office of Nuclear Regulatory Research.

iii
CONTENTS 

A B S T R A C T ................................................................ iii 

EXECUTIVE SUMMARY ...................................................... ix 

ACKNOW LEDGM ENTS ..................................................... xiii 

ABBREVIATIO NS .......................................................... xv 

1 INTRO DUCTIO N .......................................................... 1 

1.1 Background ......................................................... 1 

1.2 S cope .............................................................. 3 

2 D ISC U SSIO N ............................................................. 4 

2.1 Event Reporting Requirements and Guidance for Design-Basis Issues ........... 4 

2.2 Review of Design-Basis Issues .......................................... 4 

2.2.1 Design-Basis Issue Determination .................................. 4 

2.2.2 Licensee Event Reports Classified as Actual or Potential Events .......... 4 

2.2.3 Special Design-Basis Issue Database of Licensee Event Reports for 1997 .. 5 

2.2.4 NRC Sequence Coding and Search System Database ................. 5 

3 ANALYSIS OF DESIGN-BASIS ISSUES REPORTED IN LICENSEE EVENT REPORTS.. 6 

3.1 Trends of Plants with Design-Basis Issues for the Period 1985-1997 ............ 6 

3.2 Analysis of Design-Basis Issues Reported in 1997 ........................... 7 

3.2.1 Design-Basis Issues by Plant Age .................................. 7 

3.2.2 Design-Basis Issues by Plant ..................................... 8 

3.2.3 Design-Basis Issues by Plant Systems ............................. 11 

3.2.4 Design-Basis Issues for Boiling Water Reactors and 

Pressurized Water Reactors .................................. 11 

3.2.5 Mode of Discovery and Reporting of Design-Basis Issues .............. 12 

3.2.6 Reportability Reasons of Design-Basis Issues ....................... 13 

3.2.7 Causes of Design-Basis Issues ................................... 14 

4 NRC ENGINEERING AND DESIGN INSPECTION EFFORT AND 

DESIGN-BASIS ISSUE IDENTIFICATION .................................... 16 

4.1 Trends in Engineering Inspection Effort by Region and Industry ................ 16 

4.2 Variations in Engineering Inspection Effort by Plant During 1997 ............... 18 

4.3 Variations in the Number of Engineering Inspection Hours per 

Reported Design-Basis Issue .......................................... 21 

4.4 Correlation Between Design-Basis Issues and NRC Engineering 

Inspection Effort .................................................... 23 

4.5 Design-Basis Issues Reported in Safety System Engineering Inspections 

Perform ed in 1997 ................................................... 24 

4.6 The Effect of Engineering Inspection on Facility Assessments ................. 25

v
CONTENTS (Continued)

5 SAFETY SIGNIFICANCE OF LICENSEE EVENT REPORTS WITH DESIGN-BASIS 

ISSUES BASED ON ACCIDENT SEQUENCE PRECURSOR DATA ............... 27 

5.1 Accident Sequence Precursor Program Information ......................... 27 

5.2 Accident Sequence Precursor Observations ............................... 27 

5.3 Trends and Patterns of Important Accident Sequence 

Precursor Events (1992-1997) ......................................... 29 

6 DESIGN BASIS ISSUE SAFETY SIGNIFICANCE ANALYSIS ...................... 31 

6.1 Risk Characterization and Deterministic Significance Classification Framework ... 31 

6.1.1 Risk Categories ............................................... 31 

6.1.2 Deterministic Significance Classifications ........................... 32 

6.1.3 Risk-Informed, Deterministic Significance Framework .................. 33 

6.2 Overall Design-Basis Issue Safety Significance Analysis Results ............... 33 

6.3 Distribution of Group I Design-Basis Issues ............................... 35 

6.4 Distribution of Group II Design-Basis Issues .............................. 36 

6.5 Distribution of Group I Design-Basis Issues by Plant Age ..................... 37 

6.6 Group I Design-Basis Issues for Single and Multi-Unit Sites ................... 37 

6.7 Group I Design-Basis Issues for Boiling Water Reactors and 

Pressurized W ater Reactors ........... ............................... 39 

6.8 Group I and Group II Design-Basis Issues by Plant Systems .................. 39 

6.9 Group I Design-Basis Issues by Region .................................. 40 

7 DESIGN-BASIS SCOPE, FUNCTION OPERABILITY, AND LICENSEE EVENT 

REPORTING REQUIREMENTS ............................................ 42 

8 REGULATORY EFFECTIVENESS AND REGULATORY BURDEN INSIGHTS ......... 43 

9 STATUS OF LICENSEE PROGRAMS AND PROCESSES TO CONTROL 

AND MAINTAIN DESIGN-BASIS INFORMATION .............................. 45 

10 DESIGN-BASIS ISSUES IN NRC GENERIC COMMUNICATIONS ................. 47 

11 O BSERVATIO NS ........................................................ 49 

11.1 The Most Common Causes of DBIs Were Original Design Error, 

Procedure Deficiency and Human Error .................................. 49 

11.2 There Was a Significant Variation Among Plants in the Number 

of Reported DBIs ................................................... 49 

11.3 A Few Safety-related Systems Accounted for about Half of the DBIs ........... 49 

11.4 A Small Fraction of the DBIs Were Classified as Group I 

(Potentially Risk Significant) ........................................... 49 

11.5 Three Safety-Related Systems Accounted for a Majority of the Group I DBIs ..... 49 

11.6 Older Plants Generally Reported More DBIs than Newer Plants Reported ....... 49 

11.7 Group I DBIs Were More Likely at Multi-Unit Sites than Single-Unit Sites ........ 50 

11.8 During 1990-1997, the Percent of LERs with DBIs That Were ASP Events Steadily 

Decreased, While the Number of DBIs Increased ......................... 50 

11.9 Between 1992-1997, All of the "Important" ASP Events Involving DBIs 

Occurred at PW Rs .................................................. 50

vi
CONTENTS (Continued)

11 OBSERVATIONS (Continued) 

11.10 Increases in the Number of Reported DBIs Coincided with NRC Initiatives ...... 50 

11.11 Group I DBIs Varied by NRC Region .................................... 50 

11.12 For 1995-1997, DBIs Appeared to Correlate with NRC 

Engineering Inspection Effort .......................................... 50 

11.13 Licensee Engineering Performance Ratings Often Declined with Increased 

Engineering Inspection Effort .......................................... 51 

11.14 The Importance and Applicability of DBIs Discussed in NRC Generic 

Communications Occasionally Takes Several Years for Licensees to 

Recognize and Address .............................................. 51 

12 REFERENCES .......................................................... 52 

APPENDICES 

Appendix A 1997 Licensee Event Reports With Design-Basis Issues 

Appendix B Partial Listing of Generic Communications Involving Design-Basis Issues 

Appendix C NRC Guidance in Defining Operability and Functional Capability, 

Resolving Degraded or Nonconforming Conditions, and 

Using Risk Assessment Techniques in Assessing Design-Basis Issues 

Appendix D Significant 1997 Safety System Engineering Inspection Findings 

Appendix E Generic Plant System Groups 

TABLES 

Table 1 Plants having more than 1000 engineering inspection 

hours/year (1994-1997) .......................................... 18 

Table 2 Plants with the largest total number of design-basis issues (1990-1997) .... 26 

Table 3 Accident sequence precursor event trends (1990-1997) ................. 27 

Table 4 Accident sequence precursor events (1997) .......................... 29 

Table 5 Important accident sequence precursor events (1992-1997) .............. 30 

Table 6 DBI Risk-informed, Deterministic Significance Framework ................ 34 

Table 7 Plants having four or more Group I design-basis issues (1997) ............ 40 

Table 8 Generic communications on pressurized-water reactor containment sump 

strainer and boiling-water reactor emergency core cooling 

system strainer clogging .......................................... 48 

FIGURES 

Figure 1 Trend of design-basis issues reported for 1985-1997 .................... 6 

Figure 2 Plant age and design-basis issues per plant ........................... 8 

Figure 3 Region I plant distribution of design-basis issues for 1997 ................. 9 

Figure 4 Region II plant distribution of design-basis issues for 1997 ............... 10

vii
CONTENTS (Continued)

FIGURES (Continued) 

Figure 5 Region III plant distribution of design-basis issues for 1997 ............... 10 

Figure 6 Region IV plant distribution of design-basis issues for 1997 .............. 11 

Figure 7 Distribution of design-basis issues by plant system in 1997 ............... 12 

Figure 8 Activity that initiated licensee event reports with design-basis issues for 1997..13 

Figure 9 Reportability reasons for design-basis issues for 1997 .................. 14 

Figure 10 Causes of design-basis issues for 1997 .............................. 15 

Figure 11 Engineering inspection hours vs. total inspection hours .................. 17 

Figure 12 Trend in NRC engineering inspection hours per plant ................... 17 

Figure 13 Region I plant engineering inspection hours for 1997 .................... 19 

Figure 14 Region II plant engineering inspection hours for 1997 ................... 19 

Figure 15 Region III plant engineering inspection hours for 1997 ................... 20 

Figure 16 Region IV plant engineering inspection hours for 1997 .................. 20 

Figure 17 Region I plant engineering inspection hours per design-basis issue for 1997 . 21 

Figure 18 Region II plant engineering inspection hours per design-basis issue for 1997. 22 

Figure 19 Region III plant engineering inspection hours per design-basis issue for 1997 22 

Figure 20 Region IV plant engineering inspection hours per design-basis issue for 1997 23 

Figure 21 Engineering inspection hours and design-basis issue relationship (1995-1997)24 

Figure 22 Percent of licensee event reports with design-basis issues classified as 

accident sequence precursor events ............................... 28 

Figure 23 Distribution of design-basis issues by safety significance category ......... 34 

Figure 24 Distribution of Group I and Group II design-basis issues ................. 35 

Figure 25 Plant distribution of Group I design-basis issues ....................... 36 

Figure 26 Plant distribution Group II design-basis issues ......................... 37 

Figure 27 Group I design-basis issues by plant age ............................. 38 

Figure 28 Percentage of single-unit and multi-unit plants with 

Group I design-basis issues ....................................... 38 

Figure 29 Group I design-basis issues for boiling water reactors and 

pressurized water reactors ........................................ 39 

Figure 30 Group I and Group II design-basis issues by plant system ................ 40 

Figure 31 Regional distribution of Group I design-basis issues .................... 41

viii
EXECUTIVE SUMMARY

For a number of years the Nuclear Regulatory 

Commission has been concerned about the 

continuing discovery and reporting of design-basis 

issues (DBIs) at nuclear power plants. These 

concerns were heightened in 1995 when design 

issues emerged at Millstone and at other nuclear 

power plant facilities, raising concerns regarding the 

ability of licensees to operate their facilities within 

their design basis. In January 1997, the Office for 

Analysis and Evaluation of Operational Data 

(AEOD)* was requested by the Executive Director 

for Operations to assess and periodically report on 

the trends and patterns of DBIs identified by 

nuclear power plant licensees in event 

notifications and licensee event reports (LERs). 

This report documents the results of a systematic 

and comprehensive study of DBI trends and 

patterns following a limited-scope AEOD review 

that began in early 1997. The goal of the study was 

to develop and document insights from reported 

DBIs with respect to: (1) their causes, significant 

patterns within both the power reactor industry and 

power reactor systems, frequency trends, safety 

consequences, and risk significance; (2) the 

regulatory effectiveness of NRC inspection and 

plant performance assessment processes and the 

definition of plant design basis applicable at the 

time the DBIs were reported in LERs and; 

(3) regulatory burden implications related to current 

NRC licensee event reporting requirements for 

DBIs. It is intended that the insights from this report 

assist NRC and industry ongoing efforts to make 

NRC's regulatory framework and oversight process 

more risk-informed and performance-based and to 

reduce unnecessary regulatory burden. 

For this study, a DBI was generally defined and 

captured in accordance with the licensee event 

reporting requirement in 10 CFR 50.73(a)(2)(ii). 

This requirement states that licensees shall report

an actual or a potential event (condition) that 

resulted in the nuclear power plant, including its 

principal safety barriers, being seriously degraded, 

in an unanalyzed condition, in a condition outside 

the plants design basis, or in a condition not 

covered by the plants operating or emergency 

procedures. The initial data for the study came 

from a special database of DBIs reported in LERs 

for 1997 and compiled by AEOD. All of the LERs 

for 1997 were reviewed manually to determine if 

they involved a DBI as documented by the 

licensee. Although there was agreement with the 

licensees' determinations in most cases, there were 

some differences. Automated searches and sorts 

of the Sequence Coding and Search System 

(SCSS) LER database, maintained by the Oak 

Ridge National Laboratory (ORNL), were 

performed to determine the trends and patterns of 

DBIs over the period 1985-1997. The Accident 

Sequence Precursor (ASP) database was used to 

obtain risk perspectives in terms of conditional core 

damage probability (CCDP) of the DBI events. 

The study found that U.S. nuclear power plants 

reported over 3100 LERs with DBIs during the 

period 1985-1997, or on average, about 240 per 

year. For the period 1985-1987 the number of 

DBIs ranged from 155-184 per year. For 1988 and 

1989, the number significantly increased to 254 

and 251, respectively. This increase coincided with 

the broad implementation, beginning in 1987, of 

NRC safety systems functional inspections and 

safety systems outage modification inspections. 

There was another significant increase in the 

number of DBIs reported in LERs in 1996 (from 

194 to 377) and again in 1997 (from 377 to 563). 

These increases appeared to coincide with certain 

NRC initiatives including: NRC team inspections 

with a significant design element, NRC surveys of 

licensees on DBIs, licensee review in response to 

elevated NRC focus on DBls, and NRC generic 

communications.

* Effective March 28, 1999, the Office for Analysis and Evaluation of Operational Data (AEOD) was disbanded. The 

work described in this report which was initiated by AEOD is being completed by the Regulatory Effectiveness 

Assessment and Human Factors Branch of the NRC's Office of Nuclear Regulatory Research.

ix
For 1997, the study identified 1975 LERs (when 

considering multi-plant applicability) that were 

submitted for the 110 nuclear power plants in the 

United States. As indicated above, of these, 563 

involved DBIs, or about 29 percent of the total. For 

1997, the most common causes of DBIs were 

original design error, procedure deficiency and 

human error. Licensees often cited multiple causes 

of DBIs. The most frequent contributing causes 

included design errors dating back to the time of 

original plant licensing (70 percent), procedure 

deficiencies (28 percent), human error (23 percent), 

poor work control practices (15 percent), and plant 

modifications (14 percent). 

The study found a significant variation among 

plants in the number of reported DBIs. For 1997, 

the average number of DBIs reported in LERs for 

the 110 operating plants was 5.1. However, 6 

PWRs accounted for about 28 percent of the 

reported DBIs: Crystal River 3 (37 DBIs), Point 

Beach 1 (27 DBIs), Point Beach 2 (26 DBIs), 

Millstone 3 (26 DBIs), D.C. Cook 2 (22 DBIs), and 

D.C. Cook 1 (19 DBIs). Additionally, during the 

period 1990-1997, 11 plants (9 pressurized water 

reactors [PWRs] and 2 boiling water reactors 

[BWRs]) accounted for about 29 percent of the 

reported DBIs. 

Only a few safety-related systems accounted for 

about half of the DBIs. For 1997, 6 of the 26 safety

related plant system categories used for the study 

accounted for approximately 64 percent of the 563 

DBIs reported in LERs. These systems were: 

emergency core cooling (16 percent), emergency 

ac/dc power (14 percent), containment and 

containment isolation (12 percent), primary reactor 

(9 percent), essential service water (6 percent), and 

auxiliary/ emergency feedwater (7 percent). 

Older plants (those licensed before 1975) 

generally reported more DBIs than newer plants 

(licensed after 1984) reported. For 1997, newer 

plants reported an average of about 3.6 DBIs while 

older plants reported an average of about 6.1 DBIs. 

Of the 563 DBIs reported in LERs for 1997, 449 

were screened, characterized and ranked by 

potential risk significance. The remaining 114 LERs

with DBIs which were not risk ranked involved 

either seismic or fire protection deficiencies. These 

were excluded because significant uncertainties 

exist in the current risk assessment methods for 

these kinds of design issues. The risk category for 

each DBI was assessed on the basis of the Phase 

1 process step documented in SECY-99-007A, 

"Recommendations for Reactor Oversight Process 

Improvements," Appendix A, "Process for 

Characterizing the Risk Significance of Inspection 

Findings." The specific guidance used for 

characterizing DBI risk significance was the generic 

risk information matrices (RIMs) tables for PWRs 

and BWRs documented in "Development of Risk

Informed Baseline Inspection Program," dated 

February 10, 1999. DBIs were categorized as 

either "potentially risk significant," "minimal risk," or 

"no risk significance." A DBI was categorized as 

potentially risk significant if it involved structures, 

systems, and components (SSCs) which were in 

the RIMs table and it was relevant to one or more 

of the sequences which placed the SSC in the 

RIMs table. A DBI was categorized as invoMng 

minimal risk if it involved an SSC that was either 

not in the RIM table or it involved an adverse effect 

on an SSC which was not relevant to any of the 

reasons the SSC was in the RIMs table. A DBI 

was categorized as having no risk significance if 

the DBI was only programmatic. That is, it involved 

inadequate design basis analysis documentation 

and where the remedial actions only involved 

correcting or completing the design basis analysis. 

Of the 449 DBIs reported in LERs in 1997 that 

were screened for risk significance, a small 

fraction (22 percent) were identified as potentially 

risk significant. The majority (78 percent) were 

determined to only involve either minimal risk or no 

risk significance. A sorling of these DBIs by system 

found that 3 of the 26 safety-related systems 

accounted for about 58 percent of the of the 

potentially risk significant DBIs. These systems 

were: emergency core cooling (33 percent) 

emergency ac power (15 percent) and 

containment and containment isolation (10 

percent). 

In general, "older" plants (operating license 

between 1964 and 1974) reported more

x
potentially risk significant DBIs than "newer' plants 

(operating license between 1985 and 1997). About 

57 percent of the "older' plants had at least one 

DBI categorized as potentially risk significant, 

whereas, about 19 percent of the "newer" plants 

had at least one DBI categorized as potentially risk 

significant. This tendency was also more 

pronounced at murlt-unit sites than at single-unit 

sites. Consequently, "older" multi-unit sites had a 

higher percentage of potentially risk significant 

DBIs than did "older" single-unit sites. The 

apparent reasons for the difference included: 

generally lower quality, level of completeness and 

accessibility of plant design basis information at 

older plants. Shared systems was believed to be 

the major reason for the higher percentage of 

potentially risk significant DBIs for multi-unit sites. 

The percentage of plants associated with mult-unit 

sites that had at least one potentially risk significant 

DBI was 63, 50, and 21 for "older," "medium" 

(operating license between 1975 and 1984) and 

"newer" licensed plants respectively, whereas, for 

single-unit sites that had at least one potentially risk 

significant DBI, the percent was 50, 33, and 17 for 

"older," "nedium," and "newer" licensed plants 

respectively. 

Potentially risk significant DBIs also varied by NRC 

region. For 1997, plants in Regions I and III 

reported the largest number (35 and 36 

respectively) of potentially risk significant DBIs, 

while plants in Regions II and IV reported the 

fewest number of potentially risk significant DBIs 

(22 and 6 respectively). Region III plants also had 

the highest percentage of plants with at least one 

potentially risk significant DBI (59 percent), 

followed by Region I (52 percent), Region 11 (36 

percent) and Region IV (19 percent). The lower 

incidence of potentially risk significant DBIs in 

Regions II and IV may have been due in part to the 

generally fewer engineering inspection hours and 

the higher percentage of newer plants (i.e., better 

design basis documentation) in these regions. 

During the period from 1991 to 1997, the percent of 

DBIs reported in LERs that were ASP events 

steadily decreased, while the number of DBIs 

reported in LERs increased. In 1991, about 8.3 

percent of DBIs reported in LERs were determined

to be ASP events (i.e., CCDP > 10"). However, by 

1997, only about 0.5 percent of the LERs with DBIs 

were classified as ASP events. However, 3 of the 

5 ASP events in 1997 involved DBIs indicating that 

DBIs were an important contributor to the relatively 

few risk significant operating events which 

occurred. The study also found that during 

1992-1997 there were a total of 14 "important' 

ASP events (CCDP > 104) . Of these, 12 occurred 

at PWRs and 2 occurred at BWRs. However, three 

of the 14 important ASP events during this period 

involved DBIs, and all of these occurred at PWRs. 

The study also examined apparent correlations of 

the number of DBIs (total and potentially risk 

significant) reported in LERs with other NRC 

program areas and initiatives. These efforts were 

intended to explore insights and potential lessons 

which might be associated with NRC regulatory 

effectiveness and regulatory burden. 

The study found that increases in the number of 

reported DBIs coincided with NRC initiatives. The 

number varied from a low of 155 in 1985 to a high 

of 563 in 1997. Significant increases in the number 

of reported DBIs from the previous years were 

observed in 1988 and 1989, and again in 1996 and 

1997. The increases appeared to coincide with 

certain NRC initiatives including: NRC team 

inspections with a significant design element, NRC 

surveys of licensees on DBIs, licensee reviews in 

response to elevated NRC focus on DBIs, and 

NRC generic communications. 

For the period from 1995 to 1997, the number of 

reported DBIs appeared to correlate with NRC 

engineering inspection effort. The study found that 

during this period, as NRC engineering inspection 

hours at a plant increased, the number of DBIs 

reported by the plant generally increased. The 

increase was considered to be the result of both 

NRC inspection teams finding DBIs at the plant and 

licensees increasing their efforts to identify DBIs in 

connection with these NRC inspections. NRC 

generic communications on DBIs during the period 

was also considered a factor. Conversely, thirteen 

of the 20 plants that reported no DBIs during 1997, 

received less than the median number of 

engineering inspection hours.

xi
As noted above, if a plant had a thorough 

engineering inspection for design compliance, it 

often reported more DBIs. The study also found 

that this often resulted in the plant receiving a lower 

plant engineering rating (under the former 

Systematic Assessment of Licensee Performance 

(SALP) program) in the subsequent assessment 

period. In some instances, the lower assessment 

rating led to increased regional or agency oversight 

The correlation between engineering inspection 

effort, the number of reported DBIs and 

subsequent performance ratings was evident for 

the SALP program, and may also be relevant to 

the NRC's revised reactor oversight program which 

features decision criteria leading to additional 

inspection efforts for selected plants that meet an 

established performance threshold. 

Also as noted above, the majority of the DBIs 

reported in LERs involved minimal or no safety 

significance. In this regard, it would appear that the 

staffs ongong efforts to make 10 CFR 50.73(a)(2)() 

more risk-infor-ed should have a significant impact 

on reducing unnecessary regulatory burden. 

NRC engineering inspection teams and design 

inspection teams have been particularly successful 

in identifying DBIs at nuclear power facilities. When 

DBIs are identified as part of an NRC inspection 

they frequently resulted in the licensee submitting 

an LER for the DBI and the staff documenting the 

finding in an inspection report. However, based on 

the ASP program insights, most DBIs, by 

themselves, have been of relatively low safety 

significance. It is anticipated that the inspection 

reports which conforms to the revised reactor

oversight program will screen out DBI-related 

inspection findings that are of low risk significance 

and include only those that are significant in a risk

informed, performance-based context. 

NRC and industry awareness and recognition of 

significant and potentially generic DBIs have 

emerged over time from the coalescing of insights 

that are drawn from operating experience, 

performance information, safety analyses, and 

system analyses and reviews. The safety 

importance and applicability of DBIs documented 

and fed back to industry in NRC generic 

communications occasionally has taken several 

years for some licensees to fully recognize and 

address. However, with NRC's generic 

communications program and reactor inspection 

program becoming more risk-informed, the 

timeliness and reliability of licensee corrective 

actions for applicable risk-significant DBIs in NRC 

generic communications should be expected to 

improve. 

As a final observation, as evidenced by the ASP 

program, over the period from 1990 to 1997, there 

has been a steady decline in the ratio of the 

number of ASP events with DBIs to the total 

number DBIs reported in LERs. By 1997, less than 

1 percent of all DBIs reported in LERs were ASP 

events. However, 60 percent (3 of 5) of the ASP 

events for 1997 involved DBIs. Thus, although the 

percentage of DBIs that are risk significant is very 

small, it may be expected that, to the extent that 

ASP events occur (and risk significant NRC 

inspection findings are identified), DBIs may 

continue to be an important contributor.

xii
ACKNOWLEDGMENTS

The authors acknowledge the technical assistance provided by the following people. 

"* Willis P. Poore, Ill, Oak Ridge National Laboratory, for providing licensee event report sorts and 

background information on the Accident Sequence Precursor analysis processes. 

" Stuart D. Rubin, Division of Systems Analysis and Regulatory Effectiveness, Office of Nuclear 

Regulatory Research, for his technical reviews of the report, and his assistance in analyzing the 

safety significance of design-basis issues and implications with respect to regulatory 

effectiveness and regulatory burden. 

"* Dr. Patrick D. O'Reilly, Operating Experience and Risk Analysis Branch, Risk Analysis and 

Application Division, Office of Nuclear Regulatory Research, for his input from the Accident 

Sequence Precursor studies of licensee event reports. 

"* Dr. Dale M. Rasmuson, Operating Experience and Risk Analysis Branch, Risk Analysis and 

Application Division, Office of Nuclear Regulatory Research, for his statistical analysis of the 

relationship of engineering inspection hours and reported DBIs. 

"* T. Jerrell Carter, Events Assessment, Generic Communications and Special Inspection Branch, 

Division of Reactor Program Management, Office of Nuclear Reactor Regulation, for his input 

on significant events from the events tracking system. 

Thanks also to other members from the Office of Nuclear Reactor Regulation who provided ongoing 

review of the draft of this report.

xiii
ABBREVIATIONS

AEOD Analysis and Evaluation of Operational Data, Office for (NRC) 

ASP Accident Sequence Precursor 

BWR boiling water reactor 

CCDP conditional core damage probability 

CFR Code of Federal Regulations 

DBI design-basis issue 

ECCS emergency core cooling system 

EDSFI Electrical Distribution System Functional Inspection 

GL generic letter 

IN information notice 

LER licensee event report 

LOCA loss-of-coolant accident 

NRC Nuclear Regulatory Commission, U.S. 

NUMARC Nuclear Management and Resources Council (now the Nuclear Energy Institute) 

NUREG NRC technical report designation (Nuclear Regulatory Commission) 

ORNL Oak Ridge National Laboratory 

PIM Plant Issues Matrix 

PRA probability risk assessment 

PWR pressurized water reactor 

RHR residual heat removal 

RIM risk information matrix 

SCSS Sequence Coding and Search System 

SDP Significance Determination Process 

SSC structures, systems, and components 

SSEI Safety System Engineering Inspection 

SWSOPI service water system operational performance inspection 

TS technical specification

xv
1 INTRODUCTION

1.1 Background 

In Title 10 of the Code of Federal Regulations 

(CFR) Section 50.2 (10 CFR 50.2), design 

bases is defined as follows: 

... information which identifies the 

specific functions to be performed by a 

structure, system, or component of a 

facility, and the specific values or 

ranges of values chosen for controlling 

parameters as reference bounds for 

design. These values may be (1) 

restraints derived from generally 

accepted "state of the art" practices for 

achieving functional goals or 

(2) requirements derived from analysis 

(based on calculation and/or 

experiments) of the effects of a 

postulated accident for which a 

structure, system, or component must 

meet its functional goals. 

The licensing process for the operating U.S. 

nuclear power plants required each applicant 

to submit a preliminary safety analysis report, 

including the principal design criteria for the 

facility (10 CFR 50.34). The principal design 

criteria establish the necessary design, 

testing, and performance requirements for 

structures, systems, and components (SSCs) 

important to safety; that is, the SSCs that give 

reasonable assurance that the facility can be 

operated without undue risk to the health and 

safety of the public. The general design 

criteria in 10 CFR Part 50, Appendix A, 

establish minimum requirements for the 

principal design criteria in general terms. Each 

plant's design bases are usually derived from 

these criteria. 

The preliminary safety analysis report contains 

a preliminary analysis and evaluation of the 

design and performance of SSCs of the facility 

important to safety. The objective of the 

analysis and evaluation was to assess the risk 

to public health and safety resulting from the

operation of the facility. This assessment 

included a determination of (1) the margin of 

safety during normal operations and transient 

conditions anticipated during the life of the 

facility and (2) the adequacy of SSCs provided 

for the prevention of accidents and the 

mitigation of the consequences of postulated 

accidents (10 CFR 50.34). The final analysis 

and evaluation were included in the final 

safety analysis report. These analyses and 

evaluations were usually performed using the 

deterministic approach and established that 

the facility could be operated safely within its 

design bases. 

The deterministic method used for the safety 

analysis could be supplemented by a 

probabilistic method, to estimate the 

probability and risk of an accident. However, 

the probabilistic method alone cannot provide 

all analyses required by the current 

regulations. 

For the purposes of this study, a "design-basis 

issue" (DBI) is defined by the licensee event 

reporting requirements contained in 10 CFR 

50.73(a)(2)(ii), which states that licensees 

shall report: 

"Any event or condition that resulted in the 

condition of the nuclear power plant, 

including its principal safety barriers, being 

seriously degraded; or that resulted in the 

nuclear power plant being: (A) In an 

unanalyzed condition that significantly 

compromised plant safety; (B) In a 

condition that was outside the design basis 

of the plant; or (C) In a condition not 

covered by the plant's operating and 

emergency procedures." 

Section 2.1 of this report provides additional 

discussion of the scope of DBIs considered in 

this review. 

For a number of years the Nuclear Regulatory 

Commission has been concerned about the

1
continuing identification and reporting of DBIs 

at nuclear power plants. In the latter years of 

the 1980s, NRC inspection teams found that 

some power reactor licensees were not 

properly maintaining design-basis information 

for their facilities and were making 

modifications without having a complete or 

accurate understanding of their facility's 

design bases. The NRC staff viewed this 

situation as having the potential to be a 

significant contributor to DBIs being either 

unintentionally introduced or not recognized by 

nuclear power plant licensees. The NRC took 

several actions to resolve these concerns. In 

1989, the NRC staff surveyed nuclear power 

plant design control practices and design 

reconstitution efforts at six nuclear utilities and 

one nuclear steam system supply vendor 

(NUREG-1397, "An Assessment of Design 

Control Practices and Reconstitution 

Programs in the Nuclear Industry," January 

1991 (Ref. 1)). Following this assessment the 

Commission issued a policy statement, 

"Availability and Adequacy of Design Bases 

Information at Nuclear Power Plants," August 

1992 (Ref. 2). The NRC staff also published 

for comment a draft generic letter (GL), 

"Availability and Adequacy of Design Bases 

Information" (Ref. 3). In addition, because the 

NRC's findings heightened the nuclear 

industry's awareness of the potential safety 

issues associated with the adequacy and 

availability of design documentation, the 

Nuclear Management and Resources Council 

(NUMARC), now the Nuclear Energy Institute, 

issued guidelines on the subject in 

NUMARC 90-12, "Design Basis Program 

Guidelines," October 1990 (Ref. 4). This 

document provided guidance to licensees that 

had participated in the NUMARC voluntary 

initiative to develop a program for collecting 

and organizing design-basis data and 

supporting design information. 

In 1995, design issues emerged at Millstone 

and at other nuclear power plant facilities and 

raised concerns regarding the licensees' 

ability to operate and maintain their facilities in 

accordance with the facility's design basis.

Because of the potential scope of these DBIs 

and the potential generic applicability of these 

or other design issues, the staff asked 

licensees to describe their programs and 

processes for ensuring that they were 

operating their facilities in accordance with 

their facility's design bases. With Commission 

approval, in October 1996 the NRC issued a 

letter in accordance with 10 CFR 50.54(f) to 

each nuclear power plant licensee, asking 

licensees to describe the programs and 

processes established to control and maintain 

operations within the facility's design basis. 

Additionally, licensees were asked to describe 

the effectiveness of these programs and 

processes, and any initiatives they had 

implemented for design-bases documentation. 

The NRC staff's review of the licensees' 

responses is described in SECY-97-160, "Staff 

Review of Licensee Responses to the 10 CFR 

50.54(f) Request Regarding the Adequacy and 

Availability of Design Bases Information," 

July 24, 1997 (Ref. 5). 

On the basis of its review, the staff concluded 

that although licensees had established 

programs and processes to maintain their 

facilities' design basis and that no further 

generic action was required, the NRC needed 

to perform some plant-specific followup 

because of instances in which: (1) a licensee's 

regulatory performance brought into question 

the effectiveness of its design control program 

and processes or (2) the staff determined that 

there was a need to validate the effectiveness 

of a particular element of a licensee's program 

and processes. 

In January 1997, the Office for Analysis and 

Evaluation of Operational Data (AEOD) was 

requested by the Executive Director for 

Operations to assess and periodically report 

on the trends and patterns of DBIs that were 

being reported by reactor licensees in event 

notifications in accordance with 10 CFR 50.72, 

"Immediate notification requirements for 

operating nuclear power reactors" (Ref. 6), 

and subsequently in licensee event reports 

(LERs) for 1997 in accordance with

2
10 CFR 50.73, "Licensee event report system" 

(Ref. 7). This formal report is an extension and 

closure of that effort. 

The purpose of this report is to document the 

results of a systematic and comprehensive 

analysis and evaluation of the DBI trends and 

patterns review that began in early 1997. In 

particular, the goal of this expanded study is to 

develop and document insights from reported 

DBIs with respect to: (1) their causes, 

significant patterns within both the power 

reactor industry and power reactor systems, 

frequency trends and their causes, safety 

consequences and risk significance; (2) the 

lessons that may be useful in assessing 

regulatory effectiveness of NRC's evolving 

inspection and plant performance assessment 

processes, in the period associated with the 

data, and the definition of plant design basis 

and; (3) regulatory burden implications related 

to NRC licensee event reporting requirements 

for DBIs. It is intended that the insights from 

this report would be useful to NRC and 

industry ongoing efforts to make NRC's 

regulations framework and oversight process 

more risk-informed and performance-based 

and to reduced unnecessary regulatory 

burden. 

1.2 Scope 

For this study, LERs for 1997 were individually 

reviewed and those that had DBIs identified 

were entered into a special DBI database. The

special database included fields to capture 

information on events and plant design. LERs 

with DBIs received a second review to verify 

the identified DBIs. During the second review, 

events which involved the failure of equipment, 

missed surveillance testing, or work control 

practices that did not involve an actual DBI 

were eliminated. The LERs for 1997 were 

analyzed to identify the DBI initiators, bases 

for trends, and the safety consequences of the 

DBIs. 

Automated searches were also performed 

using the Sequence Coding and Search 

System (SCSS) database (Ref. 8) to find the 

same 1997 DBIs entered in the special DBI 

database. This search indicated a very good 

agreement between the two databases. Based 

on this result, the SCSS database was used to 

find DBIs for the period 1985-1997. The LERs 

for this period were used to identify DBI trends 

and the bases for the trends. 

The Accident Sequence Precursor (ASP) 

database (Ref. 9) was used to obtain risk 

perspectives in terms of the conditional core 

damage probability (CCDP) of the DBI events. 

The NRC's events tracking system database 

(Ref. 10) was also reviewed to identify DBIs 

that were reported during 1997. Event data 

were screened to determine the reportability 

reasons, the extent of corrective actions, 

whether a forced outage was declared, and 

the emergency classification, if any.

3
2 DISCUSSION

2.1 Event Reporting Requirements and 

Guidance for Design-Basis Issues 

10 CFR 50.73(a)(2)(ii) states that licensees 

shall report the following: 

Any event or condition that resulted in 

the condition of the nuclear power 

plant, including its principal safety 

barriers, being seriously degraded; or 

that resulted in the nuclear power plant 

being: 

(A) In an unanalyzed condition that 

significantly compromised plant 

safety; 

(B) In a condition that was outside 

the design basis of the plant; or 

(C) In a condition not covered by the 

plant's operating and emergency 

procedures. 

These conditions apply whether or not the 

plant was operating at the time the condition 

was discovered. 

Licensee event report review experience has 

shown some inconsistency among licensees 

in interpreting event reporting requirements 

and definitions, and some inconsistency in 

reporting thresholds for DBIs (i.e., when a 

plant is in a condition outside its design basis). 

In NUREG-1022, Revision 1, "Event Reporting 

Guidelines 10 CFR 50.72 and 50.73," January 

1998 (Ref. 11), examples of DBIs are provided 

that the NRC staff considers reportable errors 

in actual design. Examples include the 

emergency core cooling system design not 

meeting the single-failure criterion contained in 

Appendix K to 10 CFR 50; hardware problems 

such as high-energy line break restraints not 

being installed; fire protection commitments for 

safe shutdown not being met; and one train of 

a required two-train safety system not being 

capable of performing its design function for

an extended period during plant operation. 

Such deficiencies indicate that the plant may 

be outside its design basis. 

2.2 Review of Design-Basis Issues 

2.2.1 Design-Basis Issue Determination 

All LERs for 1997 were reviewed to determine 

if they involved a DBI as documented by the 

licensee. Although there was agreement with 

the licensees' determinations in most cases, 

there were some differences. 

Although technically they could be considered 

to place a plant outside its design bases, the 

following kinds of DBIs in LERs were not 

included in this DBI study: (1) components that 

had never been tested or verified to determine 

that they would, or could, perform in a manner 

that would support the design bases of the 

plant, but upon subsequent testing were found 

to be acceptable, (2) temporary plant 

conditions caused by operator error, such as 

mispositioning of controls or improper 

procedural requirements, (3) failure to perform 

required testing within specified time 

requirements, (4) expiration of environmental 

qualification of applicable components, (5) 

certain minor deviations from Appendix R 

requirements that appeared to have marginal 

safety significance, (6) certain improper 

setpoint calculations, and (7) failure to control 

heavy loads. 

2.2.2 Licensee Event Reports Classified as 

Actual or Potential Events 

Design-basis issues were classified as either 

an "actual event" or a "potential event." An 

"actual event" is an actual operational 

occurrence (e.g., an actual failure of a 

structure, system, or component to operate 

within design requirements) which takes place 

while the plant is operating at power or 

shutdown. A "potential event" exists when it is 

found that a structure, system, or component

4
might not operate as designed given some set 

of postulated conditions. 

2.2.3 Special Design-Basis Issue Database 

of Licensee Event Reports for 1997 

The initial data for this study were derived from 

a special DBI database established by AEOD. 

The database contained the following data for 

each LER having an event date in 1997: 

(1) whether an LER involved a DBI, (2) 

whether it involved an "actual event" or a 

"potential event," (3) the NRC region 

responsible for regulatory oversight of the 

plant, (4) the event date, (5) the docket 

number(s) of affected plant(s), (6) the nuclear 

steam supply system vendor, (7) the 

architect-engineer, (8) the operating license 

date, (9) the event initiator (activity that 

resulted in the DBI being reported), (10) the 

NRC generic communication number (if 

issued), (11) the plant system(s) involved, and 

(12) the CCDP if the event was analyzed by 

the ASP program and was greater than or 

equal to 1 X 10-6.

2.2.4 NRC Sequence Coding and Search 

System Database 

The SCSS database was searched to identify 

the LERs that met the "reportability" criterion of 

10 CFR 50.73(a)(2)(ii), "unanalyzed condition." 

Although LERs identifying DBIs were reported 

by licensees under several other criteria, the 

majority of LERs were reported under the 

above criterion based on comparing the actual 

LERs with DBIs during 1997 and the 

corresponding LERs with DBIs found with the 

above SCSS search criteria. The difference 

appears due to plant applicability coding. The 

SCSS database counts an event applicable to 

multiple units of the same design at the same 

site, as a single LER with a DBI. To be 

compatible with this report, the SCSS 

database sort results were revised to account 

for multi-plant applicability of the reported DBI. 

The adjusted results (i.e., DBI count) of these 

SCSS searches were used to make general 

observations on the long-term trend of plants 

with DBIs for the period 1985-1997.

5
3 ANALYSIS OF DESIGN-BASIS ISSUES REPORTED IN LICENSEE EVENT REPORTS

3.1 Trends of Plants with Design-Basis 

Issues for the Period 1985-1997 

U.S. operating plants reported over 3100 

LERs with DBIs during the period 1985-1997, 

or about 240 per year. The number of DBIs 

on a year-to-year basis for 1985-1997 is 

shown in Figure 1. The portion of DBIs that

WO 

500 

xr 400 

cc 

0 cc 

W 

"-'0O 

0 

z

100

6- /

IDBIs CLASSIFIED AS ACCIDENT 

SEQUENCE PRECURSOR (ASP) "EVENTS ............

/

7 / 

/

85 86 87 88 89 90 91 92 93 94 95 96 97 

Figure 1 Trend of design basis issues reported for 1985-1997

n7-n-FIi 

/ -F/

met the ASP CCDP of at least 1 X 106 is 

shown in black for each year. From 

1985-1997, LERs have identified increasing 

numbers of DBIs involving both trains and 

systems, however the majority of these DBIs 

have been of low safety significance from an 

ASP perspective.

For 1985-1987 the number of DBIs ranged 

from 155-184 per year. For 1988 and 1989, 

the number significantly increased to 254 and 

251, respectively. This increase coincided with 

the broad implementation, beginning in 1987, 

of NRC safety systems functional inspections 

and safety systems outage modification 

inspections. For 1985-1995, the number of 

DBIs varied between 155 and 194. There was 

a significant increase in DBIs in 1996 (from 

194 to 377) and again in 1997 (from 377 to 

563). This increase appeared to coincide with 

certain NRC initiatives including: NRC team

inspections with a significant design element, 

NRC surveys of licensees on DBIs, licensee 

review in response to elevated NRC focus on 

DBIs, and NRC generic communications. 

During the early 1990s, based on voluntary 

industry activities, the NRC reduced its 

general emphasis on design-basis and 

licensing-basis reviews and design-basis 

reconstitution activities. However, from 1990 

through 1993, the NRC performed 75 electrical 

distribution system functional inspections 

(EDSFIs), which led to the identification of 620

6

d I ....

.............. 

7/ ......... . 

7 7/ 7x/
electrical system DBIs (Office of Nuclear 

Reactor Regulation EDSFI database). 

Similarly, from 1993 to 1995, NRC performed 

18 full scope service water system operational 

performance inspections (SWSOPIs) and 2 

reduced scope SWSOPI inspections, and 

there were 27 reduced scope licensee 

SWSOPI self-assessments (a total of 47). 

Based on a comparison of the EDSFI and 

SWSOPI databases with the LERs reported 

for this period, there appeared to be significant 

under-reporting of the EDSFI and SWSOPI 

DBI findings. Also, the Maine Yankee 

Independent Safety Assessment Team report 

(1996) stated that 18 SWSOPI findings were 

still unresolved, noting that an effective 

program was not yet in place to ensure that 

heat exchanger fouling did not exceed the 

bounding values assumed in calculations. 

These DBI findings were not reflected in 

LERs. 

The NRC and industry refocused their design

basis and licensing-basis efforts in response 

to DBIs for 1995-1997 identified in response 

to GLs and inspection findings at Millstone, 

Haddam Neck, Maine Yankee, Crystal River, 

Clinton, D.C. Cook, and other plants. 

3.2 Analysis of Design-Basis Issues Reported 

in 1997 

For 1997, there were 1975 LERs (when 

considering multi-plant applicability) for the 

110 operating nuclear power plants in the 

United States. Approximately 29 percent (i.e., 

563) involved DBIs. This section provides data 

and observations on all 563 reported DBIs and 

the effects of plant age, plant location, system 

affected, reactor type, discovery mode, 

reportability reasons, causes, and the extent 

of corrective actions. Section 6 provides data

and observations on a subset (99 DBIs) that 

were determined to be potentially risk 

significant. Similar observations can be made 

about both sets of data (i.e., the total 

population of DBIs and the subset population 

that was determined to be potentially risk 

significant). 

3.2.1 Design-Basis Issues by Plant Age 

To analyze the effects of plant age on the 

number of DBIs reported by licensees, the 

110 operating nuclear power plants in the U.S. 

were divided into three age groups. Group A 

represented the "older' plants, group B 

represented the "medium" age plants, and 

group C represented the relatively "newest" 

plants. Group A plants obtained their operating 

licenses between 1964 and 1974; group B 

between 1975 and 1984; and group C 

between 1985 and 1997. Each group spanned 

about one-third of the 34-year plant operating 

license period (1964-97). There are 44 plants 

in group A, 35 plants in group B, and 31 plants 

in group C. 

Figure 2 shows the average number of DBIs 

per plant for 1997 for the three age groups. 

Group A, B, and C plants had 6.1, 5.3, and 3.6 

DBIs per plant, respectively. Older plants 

(group A) had significantly more DBIs per plant 

than the newer plants (groups B and C). The 

industry average was found to be 5.1 DBIs per 

plant. 

Analysis identified several apparent reasons 

for the higher number of DBIs for older plants. 

Apparent reasons included less rigorous 

design-basis information, missing design 

information, and differences in both 

computational methodologies and applicable 

design code criteria.

7
.......... 

OPERATINGQLICENSE 

: .196461974::

. . . . . . . . . . . . . . . . .................... . . . . . . . . . . . . . . . . . . 

:OPERATING: LICENS ............. 

.... . .................. .. .............. ..................... ................. I . .. . .. . . . .. . . . 

Group A 

Group B 

Group C

* .1 

* I INQUSTRY 

AVERAGE 

'1~ - -

0 1 2 3 4 5 6 7 

NUMBER OF DESIGN-BASIS ISSUES PER PLANT 

Figure 2 Plant age and design-basis issues per plant

3.2.2 Design-Basis Issues by Plant 

The number of DBIs for 1997 varied widely 

among plants. Figures 3 through 6 show the 

number of DBIs for 1997 for plants located in 

each of the four NRC regions. As noted 

earlier, in 1997 the industry average for all 110 

operating plants was 5.1 DBIs per plant. In 

addition, the industry median was 3 DBIs per 

plant as shown in Figures 3 through 6. Other 

observations include: 

" Six pressurized water reactors (PWRs) 

accounted for approximately 28 percent of 

the total number of DBIs; Crystal River 3 

(37 DBIs), Point Beach 1 (27 DBIs), Point 

Beach 2 (26 DBIs), Millstone 3 (26 DBIs), 

D.C. Cook 2 (22 DBIs), and D.C. Cook 1 

(19 DBIs). 

"* Twenty plants reported no DBIs during 

1997

The number of DBIs for each plant could be 

influenced by the following factors: (1) the 

quality, completeness and accessibility of the 

plant's design-basis documents (2) regulatory 

actions that cause licensees and the NRC to 

look for DBIs, (3) the capability of the 

licensee's engineering programs and 

organization to avoid introduction of DBIs and 

to find pre-existing DBIs, and (4) the rigor of 

the plant's reporting of the identified DBIs in 

LERs to the NRC. 

As noted in Section 1.1, in 1997 the NRC staff 

reviewed all licensee responses to the NRC's 

10 CFR 50.54(f) letters on licensees' 

design-basis document programs. The staff 

noted that most licensees had initiated a 

design-basis document program; however, the 

depth and scope varied significantly. The staff 

concluded that no further generic NRC action 

was required on this issue, but that 

plant-specific followup actions might be

8

.................... .................... ................... 

.................... ................... ................. 

:: ................... :QF!ERATING:L1.QEN$F,;: ':.: . . . .. . . . . .. .................... :::1985-1997:: .................... .................. .................... ................... .................

8
warranted to verify certain features of licensee 

programs. As a part of these followup actions, 

the NRC conducted design team inspections 

and other design-type inspections at selected 

sites. 

In 1997, comprehensive design inspections 

were performed at 4 of the 20 plants that did

BEAVER VALLEY I 

BEAVER VALLEY 2 

CALVERT CLIFFS I 

CALVERT CLIFFS 2 

GINNA 

HADOAM NECK 

HOPE CREEK 

INOIAN POINT 2 

INDIAN POINT 3 

FITZPATRICK 

LIMERICK I 

LIMERICK 2 

MAINE YANKEE 

MILLSTONE 1 

MILLSTONE 2 

MILLSTONE 3 

NNE MILE POINT I 

NIE MILE POINT 2 

. OYSTER CREEK 

PEACH BOTTOM 2 

PEACH BOTTOM 3 

PILGRIM 

SALEM I 

SALEM 2 

SEABWROK 

SUIOVEHA NNA I 

SUBOUIEHA NNA 2 

THREE MILE ISLAND 1 

VERMONT YANKEE

not report DBIs for 1997-Ginna (Ref. 12), 

Arkansas Nuclear One 1 (Ref. 13), Perry 

(Ref. 14), and Washington Nuclear 2 (Ref. 15). 

A review of the team inspection reports 

indicated that some potential DBIs had been 

identified by the teams and had been left as 

unresolved items at the end of inspections 

pending further review by the NRC.

0 5 10 15 20 25 30 35 40

NUMBER OF DESIGN-BASIS ISSUES 

Figure 3 Region I plant distribution of design-basis issues for 1997 

9

=,DT , 

lq INDUSTRY MEDIAN: 3i

I

NUMBER OF DESIGN-BASIS 

ISSUES 

Figure 3 Region I plant distribution 

of design-basis 

issues for 1997
BROWNS FERRY 1 

BROWNS FERRY 2 

BROWNS FERRY 3 

BRUNSWICK I 

BRUNSWICK 2 

CATAWBA 1 

CATAWBA 2 

CRYSTAL RIVER 3 

HATCH I 

HATCH 2 

ROBINSON 

FARLEY I 

FARLEY 2 

MCGUIRE I 

MCGUIRE 2 

NORTH ANNA I 

NORTH ANNA 2 

OCONEE¶ 

OCONEE 2 

OCONEE 3 

SEOUOYAH 1 

S IEOLOVAN 2 

SHARON HARRIS 

ST LUICIE 1 

ST LUCIE 2 

BURRY 1 

SURRY 2 

TURKEY POINT 3 

TURKEY POINT 4 

SUMMER 

VOGTLE I 

VOGTLE 2 

WATTS BAR 1

0 5 10 15 20 25 30 35 40 

NUMBER OF DESIGN-BASIS ISSUES 

Figure 4 Region II plant distribution of design-basis issues for 1997

Pf 

Pf

KiD ROCK POINT 

BRAIDWOOD I 

SRAIDWOOD 2 

BYRON I 

BYRON 2 

CLINTON 

DAVIS-BESSE 

DC COOK I . . .I . . . . .. . . ZII 

DC COOK 2 

DRESDEN 2 

DRESDEN 3 Z ' 

DUANE ARNOLDO 4 INDUSTRY MEDIAN: 3 

KEWAUNEE 

LASALLE I ... . .. . . . . . 

LASALE 2 

PALUADES 

POINTB . . .BE, , 

POWI BEACH2 

ARIEI ISLAND I 

RAJRE ISLAND 2 

QUAD CITIES I 

OUAD CITIES 2 

ZION 2

0 5 10 15 20 25 30 35 40 

NUMBER OF DESIGN-BASIS ISSUES 

Figure 5 Region III plant distribution of design-basis issues for 1997 

10

I. 

1 4-'----INDUSTRY MEDIAN: 3 

_I 

I .

8
ARKANSAS NUCLEAR I 

ARKANSAS NUCLEAR 2 

CALLAWAY 

COMANCHE PEAJ I 

COMANCHE PEAK 2 

COOPER STATION 

DIABLO CANYON I 

DIABLO CANYON 2 

FORT CALHOUN 

GRAND GULF 

PALO VERDE I 

PALO VERDE 2 

PALO VERDE 3 

RIVER BEND 

SAN ONOFRE 2 

SAN ONOFRE 3 

SOUTH TEXAS I 

SOUTH TEXAS 

WASHINGTON NUCLEAR 2 

WATEWOR 3 

WOLF CREK

0 10 15 20 25 

NUMBER OF DESIGN-BASIS ISSUES

30 35 40

Figure 6 Region IV plant distribution of design-basis issues for 1997

3.2.3 Design-Basis Issues by Plant Systems 

The DBIs reported in LERs for 1997 involved 

plant systems that have deterministic 

importance with respect to ensuring plant 

safety. A generic list of 26 plant system groups 

was used to categorize the system(s) reported 

in LERs. For a complete listing of systems that 

are listed under each group, see Appendix E. 

Some of the LERs reported more than 

one DBI, resulting in a total of 684 DBI-system 

counts for the 26 plant systems. Figure 7 

shows the DBI count for each plant system. 

Analysis results (based on the 684 DBI-system 

counts) included the following observations: 

Six pLant systems acmounted for approximately 

64 percent of the 563 LERs with DBIs. These 

systems were the emergency core cooling (16 

percent), emergency ac/dc power (14 percent), 

containment and containment isolation (12 

percent), primary reactor (9 percent), essential 

service water (7 percent), auxiliary/emergency 

feedwater (7 percent).

* Approximately 13 percent of the LERs with 

DBIs did not mention the specific system 

or component that failed to meet design 

requirements (i.e., classified as "other"). 

Most of these DBIs involved multiple 

nonspecific systems, fire, or external 

events such as floods. 

3.2.4 Design-Basis Issues for Boiling Water 

Reactors and Pressurized Water Reactors 

For 1997 there were slightly fewer DBIs per 

plant for boiling water reactors (BWRs) than 

there were for PWRs. There were 158 DBIs for 

BWRs and 405 for PWRs. On the basis of the 

number of operating BWRs (37 plants) and 

PWRs (73 plants), this represents an average 

of 3.6 DBIs per BWR plant and 5.5 per PWR 

plant. As discussed later in Section 5.1, of the 

14 most risk significant events (as determined 

by ASP analysis) for the period 1992-1997, 

12 occurred at PWRs and 3 involved DBIs. All 

three of the important ASP events that 

involved DBIs occurred at PWRs.

11

INDUSUTRY MEDIAN: 3. 

23
3.2.5 Mode of Discovery and Reporting of 

Design-Basis Issues

A review of the 563 DBIs for 1997 

the following six predominant 

categories (identifying activities) as 

Figure 8:

identified 

initiator 

shown in

" Unspecified (206 DBIs). If the licensee did 

not specifically mention the initiating 

activity that identified the DBI, it was 

categorized as unspecified. 

" Self-revealing (119 DBIs). This initiator 

consisted of fortuitous discoveries of DBIs 

through activities not specifically 

performed to look for or find the DBI. 

These resulted from operational problems 

at the plant or a routine plant activity. 

* Design-basis review (113 DBIs). This 

category was chosen if the licensee 

indicated that the DBI was discovered

(L 

0 

OI 

tU CL, 

CL, 

0

Accdt Mon Instrum 

AuxlEmerg FW 

Combust Gas CntrI 

Comp Cool Water 

Cont & Cont Isol 

Cont Cooling 

Contrlrm Ventil 

Emerg AC/DC Power 

Emerg Core Cooling 

ESF Instrument 

Essent Comprs Air 

Essent Serv Water 

Fire Det/Supprs 

Isol Condenser 

LT/OP Protection 

MS Isol Valves 

Primary Rx 

Rad Mon Instrum 

Rx Core [Sol Cool 

Ax Trip Instrum 

Residual Ht Remvl 

Safety/Relief VIv 

Spent Fuel 

Stndby Liq Contrli 

Ultimate Ht Sink 

Other( 25)

0 10 20 30 40 50 00 70 s0 

NUMBER OF DESIGN-BASIS ISSUES

during an ongoing design basis or 

reconstitution program efforts. 

" Generic communications (70 DBIs). This 

category was chosen if the licensee 

indicated that the DBI was discovered as 

a result of followup to an NRC generic 

communication (GLs, bulletins, or 

information notices [INs]). Generic Letter 

96-06, "Assurance of Equipment 

Operability and Containment Integrity 

During Design-Basis Accident Conditions," 

(Ref. 16) was the predominant contributor. 

" NRC identified (41 DBIs). This category 

was chosen if the licensee mentioned in its 

LER that the NRC discovered the DBI and 

reported it to the licensee. 

" Industry initiatives (14 DBIs). This category 

was chosen if the licensee indicated that 

the DBI was discovered as a result of 

followup activities prompted by nuclear 

industry identified design issues.

90 100

Figure 7 Distribution of design-basis issues by plant system in 1997

12

(2) . .. .. .. 

(3) 

(4 ) 1 .I ' '. . . . . 

(5 ) 1 1 1 1 1 1 1 1 1 ' , , ! . j 

(6) ] . 3II . . . [ 

(8 ) i t i I l l ? i ' I = i r t 

(9 ) I. . . . .I .I .I .1 . . II i i a 

10) . . . ' • ' • 

11) 

12 ) , , , , , , I , , , , , , I 

13) ' + ' ' 

14) n[SOME -- UERs UST MORE:n-HAN 

(15) "•ONE AFFE .CTED SYSTEMI 

16e) ::3 

(19) -"3 " 

(20) 

(21) == ... = '= ' 

(22) : (23) . . . . 

(24) •
REVIEW

Figure 8 Activity that initiated licensee event reports with design-basis issues for 1997

3.2.6 Reportability Reasons of Design-Basis 

Issues 

Licensee event reports containing DBIs for 

1997 were analyzed using the SCSS database 

to determine (1) the reportability reasons and 

(2) plant status at the time of discovery 

(i.e., operating at power or shutdown). When 

LERs are coded in the SCSS database by Oak 

Ridge National Laboratory (ORNL), some may 

receive inputs in more than one category. 

Consequently, some of the LERs with DBIs 

discussed in this section, and in Section 3.2.7, 

may have more than one "reportability

reason," "primary cause," or "corrective 

action." 

As shown in Figure 9, the most frequent 

reportability reason (85 percent of DBIs) was 

"Unanalyzed Conditions," as required by 10 CFR 

50.73(a)(2)(ii). Other significant reportability 

reasons were "Could Affect Safety Function" 

(15 percent of DBIs) [10 CFR 50.73(a)(2)(v)], 

and "Technical Specification Violations or Plant 

Shutdown by Technical Specification 

Requirements" (12 percent of DBIs) 

[10 CFR 50.73(a)(2)(v)].

13

113

GENERIC COMML 

70

41

INDUSTRY IN 

14

UNSPECIFIED 

206

1
TECHNICAL SPECIFICATION VIOLATIONS 

-OR 

PLANT SHUTDOWN BY TECHNICIAL: 

SPECIFICATION REQUIREMENTS

COULD AFFECT SAFETY FUNCT

UNANALYZED

"ION: 

CONDITIONS

0 10 20 30 40 50 60 70 

CONTRIBUTOR PERCENTAGE

80 90 100

Figure 9 Reportability reasons for design-basis issues for 1997

3.2.7 Causes of Design-Basis Issues 

Licensees often cited multiple causes for DBIs 

as shown in Figure 10. As such, individual 

LERs with DBIs can contribute to more than 

one cause category. Of the 563 LERs with 

DBIs reported for 1997, the most frequent 

contributing causes included design errors 

dating back to the time of original licensing (70 

percent), procedural deficiencies (28 percent),

human error (23 percent), poor work control 

practices (15 percent), and plant modifications 

(14 percent). Because most DBIs were 

reported while the plants were shut down, 

licensees typically stated that the risk 

associated with the DBI was minimal, even 

though in some instances, multiple trains or 

systems had been outside their respective 

design basis over several operating cycles.

14
0 10 20 30 40 50 60 70 80 90 100 

CONTRIBUTOR PERCENTAGE 

Figure 10 Causes of design-basis issues for 1997

15

PLANT MODIFICATIONS 

POOR WORK CONTROL PROCESSES 

IIHUMAN ERROR 

:PROCEDURAL DEFICIENCY 

___________ _ ORIGINAL DESIGN 

ERROR
4 NRC ENGINEERING AND DESIGN INSPECTION EFFORT 

AND DESIGN-BASIS ISSUE IDENTIFICATION

NRC inspections, especially those which focus 

on engineering and design activities, 

contribute to the identification of DBIs that are 

subsequently documented by licensees in 

LERs. Engineering and design inspections 

typically have included the areas of onsite 

engineering, engineering modifications, safety 

evaluations, configuration control, design 

control, evaluations of licensee engineering 

assessment activities, followup of engineering 

activities, and testing activities to verify design 

adequacy. To assess the relationship, if any, 

between NRC engineering and design 

inspection effort (including contractor support) 

and the identification of DBIs during the period 

1994-1997, several factors and analyses were 

considered: 

"* The average number of engineering 

inspection hours at each plant during 

1994-1997. 

"* The number of engineering inspection 

hours at each plant during 1997. 

" The number of engineering inspection 

hours at each plant during 1997 divided by 

the number of DBIs for 1997 at the plant. 

(A low quotient value would indicate a high 

relative incidence of DBIs, while a high 

value would indicate a low relative 

incidence of DBIs). 

" The relationship between the total number of 

reported DBIs for the period 1995-1997 and 

the average number of NRC engineering 

inspection hours for the same period.

4.1 Trends in Engineering Inspection Effort 

by Region and Industry 

In each year during the period 1994-1997, 

plants located in Regions I and III had more 

engineering inspection hours than plants in 

Regions II and IV. During this period, Regions 

I and III averaged approximately 730 hours of 

engineering inspections per plant per year, 

whereas plants in Regions II and IV averaged 

approximately 535 hours of engineering 

inspections per plant per year. During the 

same period, plants in Regions I and III also 

received more total inspection hours for all 

inspection areas (see Figure 11). These 

results may have been influenced by the 

higher percentage of older plants in Regions I 

and III (i.e., older plants tend to report more 

DBIs, see Section 3.2.1), and the greater 

number of plants that were the focus of 

increased regulatory attention both at the 

regional level and the agency level during the 

period. 

The total number of engineering inspection 

hours increased from 1994 through 1996 and 

then decreased in 1997, largely as a result of 

the changes in inspection effort by Regions I 

and III during this period (see Figure12). For 

example, Table 1 provides a listing of plants 

that averaged more than 1000 hours of 

engineering inspection effort annually for the 

period 1994 through 1997.

16
BEAVER VA 

BEAVER VA 

CALVERT CL 

CALVERT CL 

HADDAM 

HOPE 

INDIAN P 

INDIAN P 

FITZPA 

UME 

UME 

MAINE Y. 

MIUtST 

MILLST 

MILLST 

NINE MILE P4 

NINE MILE PR 

OYSTER 

PEACH aOT 

PEACH BOT 

P1 

SA 

SEAB 

SUSOUEHA 

3USOUEHA 

THREE MILE I181 

VERMONT YA

.EM 2 

BROOK 

NNA I 

NNA 2 

AND 1 

'NKEE

0

ENGINEERING INSPECTION HOURS (Thousands) 

Figure 11 Engineering inspection hours vs. total inspection hours

7001

z•B00-• 

0. 

Goo

,o, 

z 

400 

0 

() 

LU 

200

UJ 

ULJ 

z 

0 z 

., 0oZ2 0 

LU.

10071

1994

Figure 12 Trend in NRC engineering inspection hours per plants

17

£iLEY I 

L.LEY2 I 

IFFS I 

IFFS 2 

GINNA 

NECK 

DINT 2 

DINT 3 

ATRICK 

RICK i -INDUSTRY MEDIAN 

RICK2 I 

ANKEE I 

ONE 1 tO N E 2 . .. I .I . i , i i , , , , i r , 

ONE 3 . . . . . .. 

•INT i -•--• 

DINT 2 

CREEK 

"TOM 2 

I.GRIM

== , = I

2 3 4

5321

16131

1995 1996 1997
Table 1 Plants having more than 1000 engineering inspection hours/year (1994-1997) 

Year I! Region I Region II Region III Region IV 

Ginna Crystal River 3 Clinton ANO-1 

Millstone 2 Robinson Davis-Besse WNP-2 

Millstone 3 St. Lucie 1 Perry Waterford 3 

1997 Pilgrim 

Salem 1 

Salem 2 

TMI-1 

Vermont Yankee 

R.E. Ginna Crystal River 3 Dresden 2 Cooper 

Haddam Neck Dresden 3 WNP-2 

Maine Yankee Fermi 2 Waterford 

1996 Millstone 1 Monticello 

Millstone 2 Palisades 

Millstone 3 Point Beach 2 

Salem 1 

Salem 2 

Millstone 1 Browns Ferry 3 Fermi 2 

1995 Millstone 2 Watts Bar 1 Palisades 

Salem 1 Perry 

Indian Point 2 Watts Bar 1 Dresden 3 Cooper 

1994 Fermi 2 

Palisades 

Perry I

4.2 Variations in Engineering Inspection 

Effort by Plant During 1997 

Figures 13-16 show the engineering 

inspection hours for each plant in Regions I-IV 

for 1997, respectfully. The 1997 industry 

median and average for NRC engineering 

inspection hours per plant were 452 hours and 

613 hours, respectively. Browns Ferry 1 

(Region II) had a low of approximately 90 

engineering inspection hours, while Millstone 3 

(Region I) had a high of almost 3700 

engineering inspection hours. As shown in

Figure 2, older plants reported significantly 

more DBIs than new plants during 1997. Since 

plants in Regions I and III include a 

disproportionately higher percentage of older 

plants, plant age appears to be a factor for the 

larger number of DBIs in these regions. 

However, another possible reason was the 

higher level of engineering inspection effort in 

these regions. The hypothesis that NRC 

engineering inspection effort had a direct and 

indirect effect on the number of DBIs reported 

by licensees is evaluated in Section 4.4.

18
BEAVER VALLEY I 

BEAV/ER VALLEY 2

CALVERT CLIFFS I 

CALVERT CLIFFS 2 

GINNA 

HAD•AM NECK 

HOPE CREEK 

INDAN POINT 2 

INDIAN POINT 3 

FITZPATRICK 

UMERICK I 

UMERICK 2 

MAINE YANKEE 

MILLSTONE 1 

MILLSTONE 2 

MILLSTONE 3 

NINE MILE POINT I 

NINE MILE POINT 2 

OYSTER CREEK 

PEACH SOTTOM 2 

PEACH BOTTOM S 

PILGRM 

SALEM I 

SALEM 2 

SEABPOOK 

SUEOUEANNA I 

SUSGUEHANNA 2 

THREE MILE ISLAND I 

VERMONT YANKEE

2 3 4

ENGINEERING INSPECTION HOURS (Thousands) 

Figure 13 Region I plant engineering inspection hours for 1997

1 2 3 

ENGINEERING INSPECTION HOURS (Thousands)

4

Figure 14 Region II plant engineering inspection hours for 1997 

19

=3= 

=I 

== 

1

4-INDUSTRY MEDIAN 

= I = I 

:==:= I 

= I

BROWNS FERRY 2 

BROWNS FERRY 3 

BRUNSWICK I 

BRUNSWICK 2

CATAWBA S 

CATAWBA 2

- I 

= I. 

= I 

S4-INDUSTRY MEDIAN 

=1 

=:= I 

:= I 

= I

CRYSTAL RFIER I

HATCH. I 

NATCIS 2 

ROSWSON 

FARLEY S 

FARLEY 2

MOGUWRE 

I.CGUIRE 2 

NORTH ANNA I 

NORTH ANNA 2 

OCONEES 

OCONIE 2 

OCONEE 3 

SEOOYAH I 

SE•UOYAIH 2

SHARON HARRIS 

ST LUCIE I 

ST LUCE 2 

BURRY t 

BURRY 2 

TUR.KEY POINT 3 

TURKEY POINT 4 

SUMMER 

VOGTLE I 

VOGTUE 2 

WATTS BAR I
BIG ROCK POINT =OI 

BRAIDWOOD 2 

BRAIOWOOD 2 

BYRON I 

BYRON 2 

CLINTON . . . . . . . . 

DAVIS BESSE 

DC COK 1i DC COOK 2 i i i i i , i , 

DRESDEN 2. . .. 

L L I 

LASALUE 2 " 1 4-INDUSTRY MEDIAN MONTICELLO I 

PALISADES . . . "'' " 

PERRY I. . . . I . . I. . . . 

POINT BEACH I POINT BEACH 2. .. J 

PRAIRIE ISAN I 

PRAIE ISLAND 2 

QUAD CITIES I .... F: = 

QUAD CITIES 2 

ZION I 

ZION 2 

0 12 3 4 

ENGINEERING INSPECTION HOURS (Thousands) 

Figure 15 Region III plant engineering inspection hours for 1997 

ARKANSAS NUCLEAR 1 

ARKANSAS NUCLEAR 2 I 

CALLAWAY 

COMANCHE PEAK 1 I 

COMANCHE PEAK 2 ==C= 

COOPER STATION .... 

DIASLO CANYON I 

DIABLO CANYON 2 

FORT CALHOUN = I 

GRAND GULF 3 

PALO VERDOE 1 3= 

PALO VERDE2 3 

PALO VWSHE 3 3== 4-INDUSRTR MEDIAN 

rNER SEND 

SAN ONOPRIE 2 

SAN ONOFRE 3 

SOUTH TEXAS I 

SOUTH TEXAS 2 

WASHINGTON NUCLEAR 2 

WATERFORD 3 .. .. . .. 

WOLF CREEK 

0 1 2 3 4 

ENGINEERING INSPECTION HOURS (Thousands) 

Figure 16 Region IV plant engineering inspection hours for 1997

20
4.3 Variations in the Number of Engineering 

Inspection Hours per Reported 

Design-Basis Issue 

Figures 17-20 show the number of 

engineering inspection hours per DBI for each 

plant during 1997 for Regions I-IV, 

respectively. These figures were produced 

using the information shown in Figures 13-16 

which shows the plant-by-plant distribution of 

NRC engineering inspection effort (in hours) 

for 1997, and Figures 3-6, which shows the 

plant-by-plant distribution of DBIs for 1997. 

Dividing the inspection hours for each plant by 

the total number of DBIs (found from all 

initiators), provides the number of engineering 

inspection hours per DBI for each plant. The 

1997 industry median for engineering 

inspection hours per DBI was 135. 

The results for the 20 plants with no DBIs 

during 1997 (which would result in an infinite

BEAVER VALLEY 

BEAVER VALLEY 

CALVERT CUFFS 

CALVERT CUFFS 

GINN 

HADDAM NEC 

HOPE CREE 

INDIAN POINT 

INDIAN POINT 

RTZPATRIC 

UMERICK 

UMECICK 

MAINE YANKE 

MIL.STONE 

MILLSTONE 

MILLSTONE 

NINE MILE POINT 

NINE MILE POINT 

OYSTER CREBT 

PEACH BOTTOM 

PEACH BOTTOM 

PILGRJ 

SALEM 

SALEM 

SEABROO• 

SUSOLEHANNA 

SUSOLEHANNA 

TIHREE MILE ISLAND 

VERMONT YANKE

ratio) are not plotted, but are annotated as "no 

DBIs." Of the 20 that had no DBIs during 

1997, 15 came from either Region II or IV. In 

addition, 13 of the 20 plants that reported no 

DBIs during 1997, received less than the 

median number of engineering inspection 

hours. In many cases, the plants that did not 

submit LERs with DBIs for 1997 had similar 

designs to plants that did submit LERs with 

DBIs. Additionally, DBIs documented in 1997 

generic feedback correspondence was 

typically applicable to a broad range of nuclear 

power plant facilities. Similarly, the 10 CFR 

50.54(f) letter issued in 1996 requesting 

reviews of design-basis control programs and 

processes contributed to the identification of 

DBIs during 1997. Had comprehensive NRC 

engineering team inspections been conducted 

at more facilities reporting no DBIs for 1997, it 

would be expected that additional DBIs may 

have been discovered and reported.

0 100 200 300 400 500 600 700 

ENGINEERING INSPECTION HOURS PER DESIGN-BASIS ISSUE 

Figure 17 Region I plant engineering inspection hours per design-basis issue for 1997

21

2 

2 

ANO DSM 

K 

3l . . . . . . ., : 

K 

2 

2 2 N- IDD S RYMDAN 3 

3 . . . . . . . . 

2:==X=3= 

II l
BROWNS FERRY I BRWNS FERRY 2 ==• I 

BROWNS FERRY 3 •I 

BRUINSWICK I 

BRUNSWIK . . . . : , , , 

CATAWBA I . . .. ." , . . , 

CATAWBA 1 

CRYSTAL RIVER 3 ... ...

HATCH I 

ROCNSONI 

FARLEY I FARLEY 2 . . . 

MCrUIRE INODO 

MCGUIRE 2 NO DUoI NORTH ANNA INO DO0IDUTY EDA NORTH ANNA 2 NO 0819l 

OCONEE I . . . 

OCONEE 2 . . I 

OCONEE 3 ===1 I 

8SEOUOYAH I . . . .3"';,,= .. . . .. 

SEOUOYAH 2 NO DOW . 

SHARON HARRIS 

ST LUCIE 2 . . . . 

ST' LUCIE2 

BURRYV I . . . .. . . " 

SURRY 2 

TURKEY POINT 3 "TURKEY POINT 4 3 

SUMMER .. . . . .. 

VOGTLE I NO 561. 

VOGTLE 2 NO 06 ' 

WATTS BAR I

0 100 200 300 400 500 600 700

ENGINEERING INSPECTION HOURS PER DESIGN-BASIS ISSUE 

Figure 18 Region II plant engineering inspection hours per design-basis issue for 1997

BIG ROCK POINT 

BRAIDWOOD I 

BRAIDWOOD 2 

BYRON I 

BYRON 2 

CUNTON 

DAVIS-BESSE 

DC COOK I 

DC COOK2 

DRESDEN 2 

DRESDEN 3 

DUANE ARNOLD 

FERI 2 

KEWAUNEE 

LASALLE 

LASAL.E 2 

MONTICELLO 

PAUSADES 

PERRY 

PONIT BEACH I 

PONIT BEACH 2 

PPAJRE ISLAND i 

PRAIRE ISLAND 2 

QUAD CMlES I 

QUAD CITIES 2 

ZION I 

ZION 2

0 100 200 300 400 500 600 700 

ENGINEERING INSPECTION HOURS PER DESIGN-BASIS ISSUE 

Figure 19 Region III plant engineering inspection hours per design-basis issue for 1997

22

135

= 

=. . , , , , , ,

NO ON.

INDUSTRY MEDIAN:: 135 =a = 4 

NO DIN. 

= I 

= I
ARKANSAS NUCLEAR i 

ARKANSAS NUCLEAR 2 

CALLAWAY 

COMANCHE PEAK i 

COMANCHE PEAK 2 

COOPER STATION

DIABLO CANYON I

DIABLO CANYON 2 

FORT CALHOUN 

GRANO GULF 

PALO VERDE I 

PALO VERDE 2 

PALO VERDE 3 

RIVER BEND 

SAN ONOFRE 2 

SAN ONOFRE 3 

SOUTH TEXAS i 

SOUTH TEXAS 2 

WASHINGTON NUCLEAR 2 

WATERFORD 3 

WOLF CREEK

0 50 100 150 200 250 300 350 400 450 500 550 600 650 700

ENGINEERING INSPECTION HOURS PER DESIGN-BASIS ISSUE 

Figure 20 Region IV plant engineering inspection hours per design-basis issue for 1997

4.4 Correlation Between Design-Basis 

Issues and NRC Engineering Inspection 

Effort 

NRC inspection programs are routinely 

supplemented to address inspection or 

operating experience issues. As the number or 

significance of DBIs increases, a licensee (and 

the NRC) may increase its effort to determine 

the extent, root causes and corrective actions 

necessary to resolve the findings. With respect 

to DBIs, an escalation of engineering 

inspection effort by both the industry and the 

NRC appears to have resulted in additional 

DBI findings. 

During 1995-1997, the NRC average annual 

number of engineering inspection hours for a 

plant correlated with the total number of DBIs 

for the plant as shown in Figure 21. 

Consequently, an increase in the number of

engineering inspection hours generally was 

accompanied by an increase in the total 

number of reported DBIs. The total number of 

DBIs reported by the industry was a direct 

result of NRC inspection findings; or the 

indirect result of licensee actions in response 

to NRC inspection findings or generic 

communications related to DBIs, and self

revealing design problems. 

A linear regression analysis of the average 

number of annual engineering inspection 

hours and corresponding total number of 

reported DBIs was performed. For this 

analysis, the first variable was the three year 

(1995-1997) total number of DBIs from all 

initiators for a given facility, and the second 

variable was the average annual number of 

engineering inspection hours (1995-1997) for 

that facility. For example, a dual unit facility 

having identical units counted as one data

23

NO OIR1 

=9 NO Dub 

= 

= 

• 1'4-I NDUSTRY MEDIAN: 135.

NO DBA~ 

NOOSs I 

NO D6 

NOD~l,

NODB9S

. .Ili ~. . .. i . i . l . l . . . . . . . .
point for the analysis. Similarly, if the dual unit 

facility had different reactor type designs, it 

was counted as two separate data points. In 

addition, the three year total number of DBIs 

and the average number of annual 

engineering inspection hours used in the linear

0) 

I 

z 

0 cc 

0 

:3 0~ 

z 

0 

z 0 

w 

z 

z 

'U 

0

0

model was the value reported by the lead unit 

only. The data set was also truncated to 

remove the facilities that reported five or fewer 

DBIs over the three year period. The result of 

the regression analysis is shown in Figure 21.

0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 

TOTAL NUMBER OF REPORTED DESIGN-BASIS ISSUES FOR 1995-1997

Figure 21 Engineering inspection hours and design-basis issue relationship (1995-1997)

The statistical analysis results indicated that 

the linear relationship between the two 

variables had a correlation coefficient of 0.73, 

indicating a moderately strong relationship 

between the variables. The "P" value was less 

than 0.01, indicating a statistically significant 

relationship between the two variables at the 

99 percent confidence level. The "R-Squared" 

statistic indicates that the linear model as fitted 

explains approximately 54 percent of the 

variability in the dependent variable 

(engineering hours expended). A "Lack-of-Fit" 

test was performed to determine whether the 

linear regression model was adequate to 

describe the observed data. This test indicated 

that the linear regression model was adequate 

for the observed data. 

As shown in Figure 8, there are several 

initiators for DBIs, the largest category being

"Unspecified" (206 of 563). A review of the 

LERs which specified an initiator resulted in 

the following observation; 63 percent (224) of 

the LERs with DBIs during 1997 were in the 

categories "NRC identified," "generic 

communications," and "design-basis review." 

Each of these initiator categories appears to 

be the result of NRC engineering and design 

focus, initiatives, or NRC inspection efforts. 

4.5 Design-Basis Issues Reported in 

Safety System Engineering Inspections 

Performed in 1997 

In response to DBIs discovered at Millstone 

and at other facilities during the mid-1 990s, the 

NRC developed the Safety System 

Engineering Inspection (SSEI) program. 

Implementation of SSEIs began in early 1997. 

Plant selection criteria at the time included

24
NRC ratings of the licensee's engineering 

area, NRC watch list status, region insights 

from other inspections, plant age, and the 

status of design-basis reconstitution. Plant 

systems selected for review were based on 

individual plant examination results, and 

previous NRC inspection experience with the 

system. 

NRC IN 98-22, "Deficiencies Identified During 

NRC Design Inspections," lists the most 

significant technical and programmatic issues, 

including: (1) modifications or evaluations that 

resulted in operation of the plant outside the 

licensing bases, (2) errors in analyses of the 

pump suction swap over from the refueling 

water storage tank/borated water storage tank 

to the reactor sump during a loss-of-coolant 

accident (LOCA), (3) inadequate testing of 

safety-related components, (4) issues 

concerning implementation of computer 

evaluation models used for analyzing 

emergency core cooling system (ECCS) 

response to design-basis accidents, 

(5) system operation at a temperature in 

excess of the design basis, (6) errors made in 

evaluating post-accident temperatures for 

safety related pump rooms, and (7) lack of 

controls or specified outage times for limiting 

system lineups that could challenge 

design-basis considerations. 

The IN (98-22) states that most issues have 

resulted from errors in the original-design or in 

design modifications, calculational errors, 

inadequate corrective action, inadequate 

testing, and documentation discrepancies. 

Many of the original design, design 

modifications, and calculational errors can be 

attributed to the inadequate specification and 

control of system and discipline interfaces, 

inadequately verified calculational 

assumptions, or the use of superseded 

calculations. Some licensees did not fully 

evaluate the impact of calculational revisions 

on other calculations, or on operating and test 

procedures. Changes to operating and test 

procedures were not always reviewed against 

the design calculations to ensure that the 

assumptions in the calculations were still 

bounding. Also, the lack of a controlled, easily

retrievable design-basis documentation had, in 

some instances, hindered the ability of 

licensee engineers to identify all design-basis 

safety functions of a system or component. 

Appendix D, "Significant 1997 Safety System 

Engineering Inspection Findings," lists the 

14 SSEls performed during 1997 and their 

major findings. 

4.6 The Effect of Engineering Inspection 

on Facility Assessments 

The analyses in this section relate to NRC 

inspection program activities which have been 

substantially superseded by the NRC's revised 

reactor inspection program in support of the 

revised plant assessment process. However, 

these analyses were conducted to provide 

insights on relationships between the level of 

inspection effort and plant performance 

assessment which may be of value in 

identifying issues and assessing the 

effectiveness of the revised reactor inspection 

program. 

Plants with a High Number of DBIs for 1997 

The routine engineering inspection program of 

the mid-1990s (e.g., other than engineering 

team inspections) resulted in more favorable 

engineering assessments of licensees. Most 

plants with a large number of DBIs for 1997 

had previously received favorable engineering 

assessment ratings. Sometimes the more 

favorable assessments in the engineering area 

appeared to have been the result of more 

limited inspection effort. Of the 20 plants that 

reported no DBIs in LERs during 1997 (see 

Figures 3-6), 13-received less than the median 

number of engineering inspection hours. 

A review was conducted of the trends in 

regional plant engineering assessments for 

those plants issuing a high number of DBIs for 

1997. The review found that plants often 

reported more DBIs following a more thorough 

engineering inspection for design compliance 

using contractor support. The increase in the 

number of DBIs, however, generally lowered 

the engineering assessment in subsequent 

assessment periods. In some instances, this

25
lower assessment rating led to increased 

regional or agency oversight. 

Based on the correlation between engineering 

inspection hours and reported DBIs discussed 

in Section 4.4 (i.e., an increase in the number 

of engineering inspection hours results in an 

increase in the number of DBls) it could be 

concluded that plants with a higher number of 

DBIs and subsequent lower engineering 

assessments, were caused, in part, by the 

increase in engineering inspection hours. 

Plants with a High Number of DBIs Between 

1990-1997 

As shown in Table 2, during the period 

1990-1997, 11 plants were responsible for 29

percent of the DBIs. Each of these plants had 

an NRC inspection of its design basis. These 

data suggest that the number of DBIs reported 

in LERs by a plant was elevated by an NRC 

design-basis review, beyond those that 

resulted from NRC generic documents, such 

as GL 96-06 (which also influenced the 

increase of DBIs in 1996 and 1997). For 

example, this hypothesis appears to be 

supported by Pilgrim, which had 21 DBIs for 

1990-1997. Seventeen of these DBIs were for 

1997 and many were the direct result of an in

depth Region I design inspection (50-293/97

05) conducted after the plant completed a 

design-basis review in response to the 1996 

10 CFR 50.54 (f) letter. Accident Sequence 

Precursor DBIs are discussed in Section 5.

Table 2 Plants with the largest total number of design-basis issues (1990-1997) 

Plant Name Number of DBIs Number of Accident Sequence Precursor DBIs 

Crystal River 3 93 0 

Millstone 1 85 0 

Indian Point 3 59 0 

Millstone 3 55 0 

Palisades 55 0 

Fort Calhoun 45 2 

Millstone 2 43 1 

Maine Yankee 41 1 

Dresden 2 41 0 

Haddam Neck 36 3 

Salem 1 36 1

26
5 SAFETY SIGNIFICANCE OF LICENSEE EVENT REPORTS WITH 

DESIGN-BASIS ISSUES BASED ON ACCIDENT SEQUENCE PRECURSOR DATA

A review of ASP data for selected events 

occurring between 1990 and 1997 was 

performed to assess the potential risk 

importance of DBIs at nuclear power plants. 

ASP Program information and findings related 

to DBIs are contained in Section 5.1 through 

Section 5.3. 

5.1 Accident Sequence Precursor Program 

Information 

The ASP program reviews and evaluates 

operational events (primarily reported in LERs) 

at U.S. operating reactors. The ASP program 

identifies and categorizes precursors to 

potential severe core damage accident 

sequences. Accident sequences are those 

that, if additional failures occurred, would have 

resulted in inadequate core cooling, causing 

severe core damage. For example, in a 

postulated LOCA with a failure of a high-pressure 

injection system, the precursor would be the 

high-pressure injection system failure. The ASP 

program analyzes potential precursors and 

calculates their CCDP (Ref. 17). The CCDP is 

the probability that the event or condition could 

have progressed to core damage given the

existence of the failed or degraded protective 

or mitigating features or initiating event. To be 

classified as an ASP event, the event must 

have a CCDP of at least 1.0 x 106. ASP 

program limitations that may result in either an 

over or under-estimation of risk are provided in 

Ref. 17. 

5.2 Accident Sequence Precursor Observations 

Accident Sequence Precursor Event Trend 

Results (1990-1997) 

A review of trends of the number of LERs that 

were classified as ASP events from all causes 

(human performance, maintenance, 

operations, design, or others) indicates a 

significant reduction since 1990. An 82 

percent reduction (see Table 3) in the number 

of ASP events occurred from 1990 through 

1997. The reduction in the number of ASP 

events is an indicator that plant performance 

has improved, which is in agreement with 

many other plant performance indicators used 

by the industry and NRC. The reduction in the 

number of ASP events is also due in part to 

ASP selection criteria and model changes.

Table 3 Accident sequence precursor event trends (1990-1997) 

Year Number of events 

1990 28 

1991 27 

1992 27 

1993 16 

1994 9 

1995 10 

1996 14 

1997 5

27
Trends of Design-Basis Issues Classified as 

Accident Sequence Precursor Events 

(1990-1997) 

A similar reduction in the number of ASP 

events can be seen when considering only 

LERs with DBIs. From 1992 tol 997 there was 

an increasing trend in the number DBIs 

reported in LERs, but the number which were 

ASP events (CCDP of at least 1 X 10.6) 

generally decreased during the period. In 

1991, DBIs that were classified as ASP events

C,, I

Z W Uii w 

co 

U_ 

w 

cr "i 0 

0 

I

LU 

W 

-J 

U

0 

'U 

0 

'U 

0.

Figure 22 Percent of licensee event reports with design-basis issues 

classified as accident sequence precursor events

peaked at approximately 8 percent of reported 

DBIs, by 1997, this percentage had dropped to 

approximately 0.5 percent (See Figure 22). 

The reduction in the percentage of DBIs that 

are classified as ASP events may indicate that 

many of the most significant DBIs have been 

discovered through many years of design 

reviews and inspections. Caution should be 

used in extrapolating the line shown in Figure 

22, since it is expected that DBIs will continue 

to be reported by licensees, and that some of 

them will be potentially safety significant.

Accident Sequence Precursor Events Results 

(1997) 

A search using the ORNL ASP database, 

showed that three (approximately 0.5 percent) 

of the 563 DBIs reported in 1997 had a CCDP 

of at least 1.0 x 10'. For all the LERs for 1997, 

the ASP computer search algorithm selected 

797 for engineering review as potential 

precursors. Of these, 48 LERs (55 including 

revisions) were determined to be potentially

significant. Of these 48, 31 LERs were 

rejected after detailed analysis, 2 LERs were 

determined to be impractical to analyze, and 8 

LERs (5 events) were documented as 

"interesting" events. Review and analysis of 

the events described in the remaining seven 

LERs led to the identification of five 

(0.25 percent) of the 1975 total number of 

LERs as ASP events as shown in Table 4. All 

five ASP events involved older PWRs located 

in either Regions I or II.

28

90 91 92 93 94 95 96 97 

YEAR
Table 4 Accident sequence precursor events (1997)

5.3 Trends and Patterns of Important 

Accident Sequence Precursor Events 

(1992-1997) 

Between 1992 and 1997, PWRs had more 

"important" ASP events than BWRs. In the 

ASP program, an ASP event with CCDP 

greater than or equal to 1.0 x 104 have 

traditionally been referred to as "important" 

ASP events. Table 5 lists the important ASP 

events occurring between 1992 and 1997. 

Observations include: 

* PWR plants were more likely to have 

important ASP events than BWR plants. 

Of the 14 important ASP events shown in

Table 5, 12 occurred at PWRs and 2 

occurred at BWRs. All three of the 

important ASP involving DBIs occurred at 

PWRs. 

" There has been a downward trend in the 

number of important ASP events during 

1992-1997, with no important ASP events 

occurring during 1997. 

" Between 1992-1997, a total of 1735 DBIs 

were reported, of which 4 (0.23 percent) 

were determined to be important ASP 

events.

29

Plant Event LER Description Involved CCDP 

I Date Number _ DBI 

Maine 01/22/97 309/97-004 Reactor coolant system loop fill Yes 1.3 x 10

Yankee header motor-operated valve 

overpressure 

Oconee 2 04/21/97 270/97-001 Unisolable reactor coolant leak No 2.2 x 105 

due to inadequate surveillance 

program 

Oconee 3 05/03/97 287/97-003 High-pressure injection system Yes 5.4 x 10-6 

inoperable due to design 

deficiency and improper work 

practices 

TMI 1 06/21/97 289/97-007 Generator output breaker No 9.6 x 106 

failure resulting in a loss of 

offsite power and reactor trip 

St. Lucie 1 11/02/97 335/97-011 Nonconservative recirculation Yes 3.4 x 10s 

actuation signal set point
Table 5 Important accident sequence precursor events (1992-1997)

Plant Event Event Description Involved CCDP 

IDateý DBI II 

Ft. Calhoun 07/03/92 285/92-023 Reactor Trip Due to Invertor Malfunction and No 2.5 x 104 

Subsequent Pressurizer Safety Valve Leak 

Robinson 2 08/22/92 261/92-17 Unusual Event Due to Loss of Off-Site Power No 2.1 x 104 

and Reactor Trip 

Turkey Pt. 3, 4 08/24/92 250/92-S01 * Loss of Offsite Power Due to Hurricane Andrew No 1.6 x 104 

Oconee 2 10/19/92 270/92-004 Loss of Off-site Power and Unit Trip Due to No 2.1 x 104 

Management Deficiencies, Less than Adequate 

Corrective Action Program 

Sequoyah 1, 2 12/31/92 327/92-27 Reactor Trip as a Result of a Switchyard Power No 1.8 x 104 

Circuit Breaker Fault and a Unit 2 Entry Into 

Limiting Condition for Operation [LCO] 3.0.3 

when Both Centrifugal Charging Pumps were 

Removed from Service 

Catawba 1, 2 02/25/93 413/93-002 Technical Specification 3.0.3 Entered Due to Yes 1.5 x 104 

Inoperable Pump Discharge Valves 

Perry 04/19/93 440/93-011 Excessive Strainer Differential Pressure Across No 1.2 x 104 

the residual heat removal (RHR) Suction 

Strainer Could Have Compromised Long Term 

Cooling During Post-LOCA Operation 

LaSalle 1 09/14/93 373/93-015 Unit 1 Scram and Loss of Off-Site Power Due to No 1.3 x 104 

Bus Duct Water Intrusion 

Haddam Neck 02/16/94 213/94-004 Automatic 480 Volt Bus Transfer Failure Due to No 1.4 x 104 

Circuit Breaker Malfunction 

Wolf Creek 09/17/94 482/94-018* Reactor Coolant System Blows Down to No 3.0 x 10-3 

Refueling Water Storage Tank During Hot 

Shutdown 

St. Lucie 1 08/02/95 335/95 Failed PORVs, Reactor Coolant Pump, Seal Yes 1.1 x 10"' 

-004, Failure, Relief Valve and Subsequent Shutdown 

-005, Cooling System Unavailability, Plus Other 

-006 Problems 

Wolf Creek 01/30/96 482/96-001 Loss of Circulating Water Due to Icing on No 2.1 x 10-4 

Traveling Screens Causes Reactor Trip 

Catawba 2 02/06/96 414/96-001 Loss of Off-Site Power Due to Electrical No 2.1 x 10i3 

Component Failures 

Haddam Neck 08/01/96 213/96-016 Potential for Inadequate RHR Pump Net Positive Yes 1.1 x 104 

Suction Head During Sump Recirculation 

"Not an LER number

30
6 DESIGN BASIS ISSUE SAFETY SIGNIFICANCE ANALYSIS

Of the 563 DBIs reported in LERs for 1997, 

449 were screened, characterized and ranked 

by potential risk significance. See Appendix A 

for a complete listing of all 563 LERs with 

DBIs in 1997. The remaining 114 LERs with 

DBIs for 1997 that were not included in the 

analysis consisted of either DBIs involving 

seismic or fire protection deficiencies. These 

LERs were excluded because significant 

uncertainties exist in the calculated risks using 

current risk assessment methods for these 

kinds of design issues. As discussed in the 

following section, the framework for screening 

and characterizing safety significance of the 

other 449 DBIs involved both risk insights and 

traditional engineering (i.e. ,deterministic) 

insights. 

6.1 Risk Characterization and Deterministic 

Significance Classification Framework 

The risk category for each DBI was assessed 

on the basis of the "Phase 1" step process 

documented in SECY-99-007A, 

"Recommendations for Reactor Oversight 

Process Improvements," Appendix A, "Process 

for Characterizing the Risk Significance of 

Inspection Findings" (Ref. 18). The description 

and effect of the DBI based on the narrative 

information documented in the LER was used. 

The LER abstracts and full narrative texts 

provided the information needed to identify the 

SSC equipment impacted by the DBI. Direct 

impacts and consequential impacts (at the 

level of SSC operability and functionality) were 

based on the information documented in the 

LER. (Licensees were not contacted to obtain 

additional information.) 

The specific guidance for characterizing DBI 

risk significance was the generic risk 

information matrices (RIMs) tables for PWRs 

and BWRs documented in BNL letter report 

JCN W6234, "Development of Risk-Informed 

Baseline Inspection Program," dated February 

10, 1999 (Ref. 19) The RIMs tables document 

the systems, initiators and human actions that

are important to the risk of BWRs and PWRs 

and the reasons for their importance. The 

generic risk insights used to develop the RIMs 

are based on the IPE insights reports 

(NUREG-1560), the IPE database (NUREG

1603), lessons learned from maintenance rule 

implementation and, insights from other 

sources such as shutdown PRAs. 

Overall, the process is expected to identify 

more DBIs as potentially risk significant than 

would be characterized as such by a more 

detailed, plant-specific process. The 

conservatism results from the fact that the 

generic RIMs tables contain those systems 

and human actions that are important to most 

of the plants in the population, plus the items 

that are potentially important to only some of 

the plants in the population. Thus, applying all 

of the items in the generic RIMs tables to all 

the plants would be conservative for individual 

plants. 

Finally, the phase I step of the significance 

determination process (SDP) provides a first 

step screening of inspection findings. 

Subsequent steps in the SDP result in the 

elimination of many potentially risk significant 

findings based on further more detailed risk 

assessment. These additional steps were 

beyond the scope of this study. It is expected 

that findings from the phase I step of the SDP 

which are subsequently determined to be risk 

significant will be a small fraction of the total. 

For this study, DBI risk characterizations were 

blended with traditional deterministic 

significance classifications that are based on 

the concepts of defense-in-depth against 

certain design-basis events. 

6.1.1 Risk Categories 

The safety-significance characterization 

framework for screening and ranking the 449 

DBIs involved three broad risk significance 

categories:

31
" "Potentially Risk Significant." Those DBIs 

which involved SSCs which met one or 

more of the reasons for importance 

documented in the RIM table. 

" "Minimal Risk." Those DBIs which either 

involved an SSC which was not on the 

RIMs table, or involved an SSC on the 

RIMs table, but the effect of the DBI was 

not relevant to the reasons why the SSC 

was important. 

" "No risk significance." Those DBIs which 

were programmatic (i.e., involved 

inadequate design basis analysis 

documentation and where the remedial 

actions only involved correcting or 

completing the design basis analysis). 

Design-basis issues characterized as either 

potential or minimal were further classified and 

ranked by deterministic significance described 

in Section 6.1.2. 

6.1.2 Deterministic Significance Classifications 

The DBI deterministic significance 

classification scheme involved a taxonomy 

based on the effects of the DBI. The 

classification scheme considered three 

factors: 

(1) The presence or absence of a safety 

demand for the SSC that was adversely 

effected by the DBI. 

Higher classification (safety demand) 

The higher classification of deterministic 

significance involved an occurrence of a 

safety demand that required proper 

functioning of the SSC. The DBI would be 

evaluated whether or not an initiating 

event occurred that caused an actual 

safety demand for the SSC that was 

adversely effected by the DBIs. The higher 

classification involved an occurrence of a 

safety demand for the SSC while the DBIs 

adversely impacted the ability of the SSC

to successfully perform in response to the 

demand (e.g., a demand for high pressure 

injection at a time when the DBIs caused 

the high pressure injection pumps to be 

degraded or failed). 

Lower classification (no safety demand) 

The lower classification of deterministic 

significance involved no occurrence of a 

safety demand that required proper 

functioning of the SSC. 

(2) Whether the DBI resulted in an actual or a 

potential failure of the adversely affected 

SSC. 

The second element of the classification 

evaluated the type of effect of the DBI in 

terms of whether the DBI resulted in an 

actual or potential failure or degradation of 

the affected SSC. 

Hiqher classification 

The higher classification involved an actual 

failure or degradation in performance of 

the SSC due to the DBI. To be classified 

as an "actual" failure would require an 

actual operating performance deficiency to 

be present. 

Lower classification 

The lower classification involved a 

potential failure or degradation of the 

affected SSC for a given set of conditions. 

(3) The extent to which the DBI failed or 

degraded the affected SSC. 

The third element of the classification 

evaluated the extent to which the DBI 

affected the SSC in terms of whether the 

DBI involved a system failure, a system 

degradation or a train failure (or 

degradation). The highest classification of 

deterministic significance involved a failed 

system, the second highest classification

32
involved a degraded system, and the 

lowest classification involved a degraded 

or failed train. For purposes of these 

classifications a degraded condition was 

defined as the SSC being capable of 

operating but judged as marginally failing 

to meet minimum design requirements. A 

failed condition was defined as the SSC 

having a gross or complete loss of design 

function. 

6.1.3 Risk-Inforrned, Deterministic Significance 

Framework 

Table 6 shows the risk category and 

deterministic significance classification 

combinations in decreasing safety significance 

order used for the study. Potentially risk 

significant DBIs were sorted by decreasing 

deterministic significance in the upper half of 

the table. DBIs of minimal risk or no risk 

significance were sorted by decreasing 

deterministic significance in the lower half of 

the table. Overall, the detailed framework 

involves 19 significance sorting "bins." The 

resulting framework provides a qualitative 

relative ordering of DBI safety significance. As 

shown in Table 6, each of the 19 safety 

significance categories in the framework is 

assigned a unique alpha-numeric designation 

(e.g., la, 1b, 1c, 2a, 2b). These categories 

were used to construct a safety significance 

histogram for the 449 DBIs analyzed. 

Imbedded in Table 6 is a simplified framework 

which drops the "effect extent" element in the 

deterministic significance classification and 

was used for most of the DBI distribution 

analyses. The simplified framework reduces 

the number of safety significance categories 

from 19 to 7. Finally, DBIs that were 

categorized as potentially risk significant (i.e., 

safety significance categories 1, 2 and 3) were 

grouped together and designated as Group I,

while DBIs that were determined to be either 

minimal risk or no risk significance (i.e., safety 

significance categories 4, 5, 6 and 7) were 

designated as Group II. 

6.2 Overall Design-Basis Issue Safety 

Significance Analysis Results 

The overall results of the detailed sorting of 

the 449 DBIs into the 19 DBI safety 

significance categories is shown in Figure 23. 

As seen in Figure 23, during 1997 there were 

no Group I DBIs involving a safety demand 

(Category 1) for an SSC whose function was 

adversely impacted by the DBIs. 

Consequently, there were no DBIs in the 

category of highest safety significance. As 

shown in the figure, the DBIs which were ASP 

events in 1997 were in either Category 2 or 3. 

Category 2 had 13 DBIs and Category 3 had 

86 DBIs. Most of the DBIs (78percent) were in 

Group II (Categories 4, 5, 6, and 7) where their 

risk significance was classified as either 

minimal or none. 

Group I (Potentially Risk Significant) 

There were 99 Group I DBIs. That is, as noted 

above, about 22 percent (99 out of 449) of the 

DBIs in 1997 were judged to have a potential 

to be risk significant. Of the 99 Group I DBIs, 

about 13 percent (13 out of 99) were in Category 2 

(i.e., actual failures or degradations). However, 

most of these (69 percent) involved degraded 

systems as opposed to failed systems or 

degraded or failed trains. Of the 99 Group I 

DBIs, about 87 percent (86 out of 99), were in 

Category 3 (i.e., potential failures or degradations). 

The DBIs in category 3 were dominated by the 

combination of potential system-level failures (49 

percent) and potential system-level degradations 

(33 percent).

33
Table 6 DBI Risk-informed, Deterministic Significance Framework

DBI DBI DETERMINISTIC SIGNIFICANCE CLASSIFICATION 

RISK CATEGORY 

GROUP DBI Safety Effect Type Effect Extent 

SAFETY Demand 

SIGNIFICANCE 

CATEGORY Potential Minimal None Yes No Actual Potential Failed Degraded Degrade 

System System or Failed 

Train 

a x x x x 

1 b x x x x 

C x x x x 

a x x x x 

2 b x x x x 

C X X X x 

a x x X X 

3 b x x x x 

C X X S S 

a x x x x 

4 b x x x x 

C X X X X 

a x x x x 

5 b x x x x 

C X X X X 

a x x x x 

6 b x x x x 

C X X X x 

1 7 1 - I x _ _ I_ _ _ __ _ _ _ _

03 

z 

0..

140 

120 

100 

80 

60 

40

20

S1 lb 1o 20 20 20 32 30b 30 fl 4b e , 6 b sc 0. 00 SC 7 

SAFETY SIGNIFICANCE CATEGORY 

GENERALLY DECREASING SAFETY SIGNIFICANCE 

Figure 23 Distribution of design-basis issues by safety significant category

34

.ASP EVENT WITH D81 .

.......... .... 

IN.\\

; I I .. . .. .. .. . . .. .... .. .. . .. . . . . . .... .. .. . .. . .. .. .
The distribution of DBIs across the safety 

significance categories of the simplified 

framework (i.e., Categories 2 and 3 in Group I;

Categories 5 and 6/7 in Group II) are shown in 

Figure 24.

GROUP 1: POTENTIALLY RISK SIGNIFICANT 

POT SYS FAILURE 

44

*ACT SYS FAILURE 3 

ACT TRAIN LOSS'OEG 

T

, TRAIN 4POT. LOSSDEG 1 4 ACT SYS 

9

Category 2: Actual system or train 

failure to meet design requirements

POT. SYS DEG 28 

Category 3: Potential failure of a 

system or train to meet design

GROUP 11: MINIMAL OR NO RISK SIGNIFICANCE

ACT SYS. FAILURE 16

T TRAIN LOSS/DEG. 

12 POT. SYS. DEG. 149

Category 5: Actual system or train 

failure to meet design requirements

POT. TRAIN LOSS/DEG. 33 

Categories 6/7: Potential failure of a 

system or train to meet design 

requirements; or no failure

Figure 24 Distribution of Group I and Group II design basis issues

6.3 Distribution of Group I Design-Basis Issues 

As noted in Section 6.2, there were 99 Group 

I DBIs. These DBIs were reported at 47 of the 

110 licensed operating nuclear power plants. 

The distribution of number of plants vs the

number of Group I DBIs for 1997 is shown in 

Figure 25. About 57 percent of the plants (63) 

had no Group I DBIs while about 28 percent 

had only one Group I DBI (28 plants). Crystal 

River 3 had the greatest number of Group I 

DBIs at 10.

35

ACT. SYS. DEG. 

47

POT. SYS FAILURE 128

.NONE 

46
1 2 3 4 5 6 7 8 9 10 11

NUMBER OF GROUP I DESIGN-BASIS ISSUES 

Figure 25 Plant distribution of Group I design-basis issues

6.4 Distribution of Group II Design-Basis 

Issues 

Figure 26 shows the distribution of the number 

of plants with varying numbers of Group II 

DBIs. For 1997, out of the 449 DBIs analyzed, 

350 DBIs were of minimal risk or no risk 

significance (Group II). These 350 Group II 

DBIs involved 85 different plants. A total of 20 

plants had no DBIs during 1997. The most 

frequent number of Group II DBIs submitted by 

a plant was one, which occurred at 22 plants.

However, in 1997, 17 plants submitted from 7 

to 19 Group II DBIs involving minimal risk or 

no risk significance - an average of about 10 

LERs with minimal or no risk significant DBIs 

per plant. As shown in Figure 26, a significant 

number of plants reported a relatively large 

number of LERs with DBIs having minimal or 

no risk significance, indicating that the LER 

rule in effect at the time was not effective in 

discriminating (screening out) the reporting of 

DBIs having minimal or no risk significance.

36

35 

30 

25

201-

151

10

C,) 

a.

0. 

U

o 

z

51-

0

V71A 7)I/ 

I///
15

10o.

5 

A

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

NUMBER OF GROUP II DESIGN-BASIS ISSUES 

Figure 26 Plant distribution Group II design-basis issues

6.5 Distribution of Group I Design-Basis 

Issues by Plant Age 

For 1997, as shown in Figure 27, "older' 

plants generally had a higher percentage of 

Group I DBIs than plants of "medium" age or 

the "newer" plants. This result is similar to the 

relative distribution shown in Figure 2 which 

shows that plants in Group C (operating 

license between 1985 and 1997) had much 

fewer DBIs per plant than plants in Group A 

(operating license between 1964 and 1974). 

For example, for 1997, the approximate 

percentage of plants with Group I DBIs for 

plants in plant age Groups A, B, and C was 57 

percent, 46, percent and 19 percent. The 

apparent reasons for the difference included: 

generally lower quality, completeness and 

accessibility of plant design basis information 

at older plants. The impact of NRC 

engineering inspection in Regions I and III 

(which have more older plants) compared to 

Region II and IV plants was also considered a 

factor.

6.6 Group I Design-Basis Issues for Single 

and Multi-Unit Sites 

As shown in Figure 28, for 1997, plants 

associated with multi-unit sites had a higher 

percentage of Group I DBIs than did single

unit sites. Shared systems was believed to be 

the major reason for the higher percentage of 

Group I DBIs for these sites. In addition, plant 

age was also a factor for both single and multi

unit sites, in that older plants, whether single 

or multi-unit had a greater percentage of 

Group I DBIs than did newer plants. The 

percentage of plants associated with single

unit sites that had at least one Group I DBI 

was 50, 33, and 17 for plant age groups A, B, 

and C respectively, whereas, for multi-unit 

sites that had at least one Group I DBI, the 

percentage was 63, 50, and 21 for plant age 

groups A, B, and C respectively. Plant age 

group A represents older licensing dates (plant 

licensed before 1974), and group C represents 

the newer licensing dates (plants licensed 

after 1984). See Section 3.2.1 for plant age 

group definition.

37

25

201

0) 

cc 

z 

-J 

a

U

0 

w• 

zL

PLANTS HAVING NO ObIs 

.............-....l
on5 

0 40 

W30 

z/ 

S120 

LU 

CLi 

GROUP A GROUP B GROUP C 

PLANT AGE GROUP 

NEWER PLANTS 

Group A: Operating [icense betweon 1964 and 1974 (44 Unfts) 

Group B: Openrting ticansa between 1975 and 1994 (35 unitu) 

Group C: Operaing license between 1985 and 1997 (31 unit) 

Figure 27 Group I design-basis issues by plant age 

70 

S 60.. .. . .. . . . . 

O 5 0 . . . .. . . ... . . .. . . . ... .. . . .. 

(5 

(0 

U

20 ..... .. .. 

z 

LU 

0 

cc 10 .. . . .. . . . 0U 

SINGLE-UNIT MULTI-UNIT 

PLANT AGE GROUP 

Figure 28 Percentage of single-unit and multi-unit plants 

with Group I design-basis issues

38
6.7 Group I Design-Basis Issues for Boiling 

Water Reactors and Pressurized Water 

Reactors 

Boiling water reactors had a higher percentage of 

Group I DBI than PWRs as shown in Figure 29. 

For BWRs, about 57 percent had at least one 

60 

• 50 

a 40 • 40 

I30 z 

20 

Ui 

0 - 0 .. .... o_ 10 .. . .

Group I DBI, while for PWRs, about 36 percent 

had at least one Group I DBI. Although for 

1997, BWRs had a higher percentage of 

Group I DBIs than PWRs, from an ASP 

perspective, all of the ASP events in 1997 

involving DBIs occurred at PWRs.

Figure 29 Group I design-basis issues for boiling-water reactors 

and pressurized water reactors

6.8 Group I and Group II Design-Basis Issues 

by Plant Systems 

For 1997, each Group I DBI (99 total) and 

Group II DBI (350 total) was sorted into the 

generic plant systems listed in Appendix E*. 

For each Group I DBI, only the system that 

was determined to be important to risk as 

discussed in the LER was included, resulting 

in 99 DBI-systems affected. For Group II DBIs, 

up to two systems may have been associated 

with each DBIs, which resulted in 418 DBI

systems. The analysis results shown in Figure 

30 indicate that relatively few systems 

disproportionally accounted for the Group I

DBIs. Three plant systems accounted for 

approximately 58 percent of the Group I DBIs 

ECCS (33 percent), and emergency ac/dc 

power (15 percent), and containment and 

containment isolation (10 percent). The 

auxiliary/emergency feedwater system, which 

is generally considered a very risk significant 

system, had a total of 27 DBIs, however only 

six were classified as Group I. This may 

indicate that many of the risk significant DBIs 

for this system have been previously 

discovered and corrected through intensive 

licensee and NRC design reviews and 

inspections.

Does not include fire protection related and seismic related DBIs (114 Total as discussed in Section 6.0).

39
Accdt Mon Instrum (1) 

Aux/Emerg FW (2) 

Combust Gas Cntrl (3) 

Comp Cool Water (4) 

Cont & Cont Isol (5) 

Cont Cool Sys (6) 

ContrIrm Ventil (7) 

Emerg AC/DC Power (8) 

Emerg Core Cooling (9) 

ESF Instrument (10) 

Essent Comprs Air (11) 

Essent Serv Water (12) 

Fire Det/Supprs (13) 

Isol Condenser (14) 

LT/OP Protection (15) 

MS Isol Valves (16) 

Primary Rx (17) 

Red Mon Instrum (18) 

Rx Core Isol Cool (19) 

Rx Trip Instrum (20) 

Residual Ht Remvl (21) 

Safety/Relief Vlv (22) 

Spent Fuel (23) 

Stndby Liq Contrl (24) 

Ultimate Ht Sink (25) 

Other (26)0 5 10152025303540455055606570758085 9095100 

NUMBER OF DESIGN-BASIS ISSUES

Figure 30 Group I and Group II design-basis issues by plant system

6.9 Group I Design-Basis Issues by Region 

For 1997, plants in Regions I and III had 

reported the largest number of Group I DBIs 

(35 and 36 respectively), while plants in 

Regions II and IV reported the fewest number 

of Group I DBIs (22 and 6 respectively). Figure 

31 shows the percentage of plants in each 

region that had at least one Group I DBI. As 

shown in the figure, Region III had the highest 

percentage of plants with at least one Group I

DBIs (59 percent), followed by Region I (52 

percent), Region 11 (36 percent) and Region IV 

(19 percent). Possible reasons for the lower 

incidence of Group I DBIs in Regions II and IV 

may involve the generally fewer engineering 

inspection hours, decreased regulatory 

attention, and a higher percentage of newer 

plants having better design documentation 

(discussed in Section 4). Plants having four or 

more Group I DBIs during 1997 are shown in 

Table 7.

Table 7 Plants having four or more Group I design-basis issues (1997)

40

0 

2 

cc 

U.

in I.U., 

z

.SOME DBI MAY UST MORE THAN: 

:ONE AFFECTED SYSTEM) 

__. . . . __ . __ . . . .. GR P

OJUP II DOI 

CUP I DBI

PLANT NAME NUMBER OF 

GROUP IDBIs 

Millstone 1 4 

Pilgrim 4 

Crystal River 3 10 

Point Beach 1 6 

Point Beach 2 6 

D.C. Cook 1 5 

D.C. Cook 2 5

11111111111K= == : : : : : ý : : . . . . . . . . . .

l•ltJ
70

60 . . .. 

2 

co 5 

53 0V / / A ... .... , . . . •....... . ..... . . . . 0 

CD 

tx40 

3, 

z 

f//30 - /....... CL 

0 

I.Z 2 0 .... ........ 

w 

1 0 . . . . . . . . . . . . . . .. . . . . 

REGION I REGION II REGION III REGION IV 

Figure 31 Regional distribution of Group I design-basis issues

41
7 DESIGN-BASIS SCOPE, FUNCTION OPERABILITY, AND 

LICENSEE EVENT REPORTING REQUIREMENTS

There are a number of views within the NRC 

and the nuclear industry on how best to 

assess DBIs, including their associated risk, 

compliance with license requirements, and the 

timeliness and scope of needed corrective 

actions. Differences in plant designs, license 

requirements, code requirements, and 

licensee commitments add to the difficulty of 

assessing DBIs. Additionally, since some DBIs 

involved license requirements, in some cases 

licensees have not been in compliance with 

their operating license. However, very few of 

these DBIs have been risk significant from an 

ASP perspective. 

Regardless of low risk significance (from an 

ASP perspective), the current regulatory 

principle is to ensure adherence to the design 

basis and that appropriate corrective actions 

are taken. For example, Regulatory Guide 

1.174, "An Approach for Using Probabilistic 

Risk Assessment in Risk-Informed Decisions 

on Plant-specific Changes to the Licensing 

Basis" (Ref. 20), provides guidance on the use 

of probabilistic risk assessment findings and 

risk insights in support of licensee requests for 

changes to a plant's licensing basis. Section 

2.2.1 of the regulatory guide (Evaluation of 

Defense-in-Depth Attributes and Safety 

Margins) states:

One aspect of the engineering 

evaluations is to show that the 

fundamental safety principles on which 

the plant design was based are not 

compromised. Design-basis accidents 

play a central role in nuclear power 

plant design. Design-basis accidents 

are a combination of postulated 

challenges and failure events against 

which plants are designed to ensure 

adequate and safe plant response. 

During the design process, plant 

response and associated safety 

margins are evaluated using 

assumptions that are intended to be 

conservative. National standards and 

other consideration such as defense

in-depth attributes and the single 

failure criterion constitute additional 

engineering considerations that 

influence plant design and operation. 

Current NRC guidance in defining operability 

and functional capability, resolving degraded 

or nonconforming conditions, and using risk 

assessment techniques in assessing DBIs are 

provided in Appendix C.

42
8 REGULATORY EFFECTIVENESS AND REGULATORY BURDEN INSIGHTS

On the basis of the observations discussed in 

the previous sections, a number of insights 

and potential lessons are evident with respect 

to NRC regulatory effectiveness and 

regulatory burden. These insights and 

lessons, involve (1) reporting of DBIs in LERs, 

(2) identification of DBIs by NRC inspection 

activities, (3) impact of identified DBIs on past 

NRC plant performance assessments, and (4) 

low risk significance of the identified DBIs 

which typically bear on the assumptions in the 

current design-basis scope. These regulatory 

effectiveness and regulatory burden insights 

and lessons are provided in the following 

paragraphs. 

Licensee Event Reporting Thresholds and DBI 

Risk Significance 

As discussed in Section 2.1, event reporting 

requirements and guidance for DBIs in 

paragraph 50.73(a)(2)(ii)(B) of 10 CFR 

requires that nuclear power plant licensees 

report any event or condition that resulted in 

the condition of the nuclear power plant, 

including its principal safety barriers that is 

outside of the plant's design-basis. 

However, as discussed in Section 6, for 1997, 

the majority of LERs with DBIs that were 

ranked for risk significance, 78 percent were 

found to be of minimal risk or no risk 

significance. The study found that 17 plants 

reported from 7 to 17 LERs with DBIs which 

were of minimal or no risk significance. 

Additionally, by 1997 approximately 0.5 

percent of the LERs with DBIs reached the 

threshold of an ASP event. These results 

indicate that opportunities exist for reducing 

unnecessary regulatory burden with respect to 

reporting of DBIs. 

The staff is continuing its efforts to examine 10 

CFR 50.73 for the purpose of making the LER 

rule and supporting regulatory guidance more 

risk-informed. These efforts are being pursued 

in order to reduce the number of LERs that are

submitted by licensees that are of low safety 

significance and thereby reduce unnecessary 

regulatory burden. In this regard, it would 

appear that there may be opportunities for 

reducing unnecessary regulatory burden by 

making 10 CFR 50.73(a)(2)(ii) more risk

informed. The data from this report could be 

used to refine the revised LER reporting 

requirements that would screen out the DBIs 

having minimal risk significance. 

NRC Inspection Findings Involving Design

Basis Issues 

As discussed in Section 4, NRC engineering 

inspection teams and design inspection teams 

have been successful in identifying DBIs at 

nuclear power facilities (based largely on lack 

of compliance with license requirements that 

were initially established using deterministic 

analyses). When DBIs are identified as part of 

an NRC inspection they frequently result in the 

licensee submitting an LER for the DBI and 

the staff documenting the finding in an 

inspection report. Based on the risk 

categorization of LERs discussed in Section 6 

and the ASP program insights, most DBIs 

discovered through the inspection process 

have been of relatively low risk significance. 

The staff is currently in the process of 

implementing a revised reactor oversight 

program. The new program incorporates a 

risk-informed inspection program component. 

For each inspection finding, the new 

inspection program involves the screening and 

characterization of the potential risk impact of 

specific inspection findings using the SDP. 

Accordingly, inspection reports in support of 

the revised reactor oversight program will 

document the new screening and 

characterization process results for DBI 

findings in a risk-informed, performance-based 

context. It may be appropriate to examine the 

new significance determination process by 

using it on a sample of 1997 DBIs to 

determine whether this process would screen 

out DBIs of minimal risk-significance.

43
The Effect of Increased Inspection Effort on 

Licensee Performance Assessment 

As discussed in Section 4.6, a review of plant 

engineering assessments for plants issuing a 

high number of DBIs in 1997 found that plants 

often reported many additional DBIs in LERs 

after a more thorough engineering inspection 

for design compliance using contractor 

support. The increased number of DBIs often 

had the effect of lowering the NRC's 

assessment of licensee performance in 

subsequent years. The NRC's new reactor 

oversight process will also involve a baseline 

inspection for all plants, supplemented by 

additional inspection follow up for selected 

plants having performance assessment results 

which meet the threshold criteria. The 

additional findings from these supplemental 

inspections will also be documented in the 

Plant Issues Matrix (PIM). Although the 

inspection findings will be screened from a risk 

perspective, this additional inspection effort 

may result in additional risk important issues 

documented in the PIM when compared to the 

PIMs of plants that did not receive a 

supplemental inspection. Consequently, The 

additional findings might affect the 

assessment of plant performance and 

decisions to increased NRC oversight 

compared to comparable plants that did not 

receive additional inspection effort. Thus, in 

connection with the staff's bench marking 

efforts for the new reactor oversight process, 

the staff may consider evaluating the general 

effect of supplemental inspection on 

(increasing) the total number of risk significant

inspection findings in the PIM, the effect of this 

on plant evaluations, and its eventual effect on 

regulatory oversight decisions. 

Design-Basis Scope 

The staff has been evaluating the regulatory 

interpretation of the scope and content of plant 

design-basis information including the 

functionality assumptions related to SSCs. 

The staff has been developing guidance that 

provides a clearer understanding of what 

constitutes design-basis information, and 

involves a clarification of the terms design

basis functions and design-bases values as 

used in 10 CFR 50.2. Reducing the scope of 

the design basis would reduce unnecessary 

regulatory burden associated with the 

regulations framework and broader regulatory 

framework which references the plant design 

basis. Most DBIs involved a structure, system, 

or component that has traditionally been 

considered important to safety. However, as 

discussed in Section 6, the majority of 

identified DBIs reported in LERs are of 

minimal risk or no risk significance. That is, the 

majority of DBIs involve either SSCs which are 

not risk significant or design issues which do 

not impact the risk important accident 

sequences of risk significant SSCs. Thus, the 

results of this study would appear to provide 

useful risk insights and information for any 

future staff efforts aimed at re-evaluating the 

scope and content of a plant's design basis 

scope based on risk significance.

44
9 STATUS OF LICENSEE PROGRAMS AND PROCESSES TO 

CONTROL AND MAINTAIN DESIGN-BASIS INFORMATION

Based on the review of licensee responses to 

the 10 CFR 50.54(f) letter, the staff concluded 

in SECY-97-160 (Ref. 5) that while licensees 

had established programs and processes to 

maintain their facility's design bases, there 

was a need to implement plant-specific 

inspection followup activities. This 

determination was based upon the staff having 

identified: (1) instances in which licensees 

failed to reconcile regulatory performance with 

their assertions that their programs and 

processes were effective in maintaining their 

design bases, or (2) that there was a need to 

gain a better understanding or to validate a 

particular aspect of a licensee's programs and 

processes. 

As part of this study, a sampling of the 

licensee 10 CFR 50.54(f) responses for 27 

sites representing 42 of the operating plants 

were reviewed with the following results: 

"* Responses typically concerned design 

control methodologies. 

"* Certain responses indicated that design-basis 

reviews were for document retrievability only. 

" One response indicated that the plant was 

in compliance with its design basis, but a 

subsequent 1997 regional inspection 

identified design-basis problems that 

resulted in a Severity Level III enforcement 

action. 

" One licensee response included a list of 

25 safety-significant systems (out of an 

identified 29 systems) for which 

design-basis verification actions were not 

complete, including areas such as 

design-basis accidents and events, 

primary containment, environmental 

qualification, separation and single failure, 

electrical design considerations, and 

equipment seismic requirements. 

Immediately before this plant's response,

an NRC regional inspection report stated 

that it had raised concerns about an 

apparent gradual erosion of the plant's 

design and licensing bases. 

"* None of the licensees' responses to the 10 

CFR 50.54(f) letters that were reviewed 

indicated that all plant safety systems had 

been reviewed, that there were no design 

problems, or that their design-basis 

reviews of safety-significant systems 

would be completed in the near future. 

"* NRC design inspections had subsequently 

found design-basis problems affecting 

plant safety after licensees stated they had 

reviewed their design basis. 

" Certain licensees stated that they were 

collecting original design-basis data, but 

did not state that this data would be re

verified for completeness and accuracy. 

The staff concluded (Ref. 5) that no further 

generic NRC action was required on this issue 

(the adequacy and availability of design-basis 

information), but that plant-specific followup 

actions might be warranted to verify certain 

features of licensee programs. As a part of 

these followup actions, the NRC conducted (or 

planned) design team inspections and other 

design-type inspections at selected sites. In 

this regard the staff planned to implement a 

change to the reactor inspection program to 

evaluate licensee design control programs and 

processes. At that time, the SSEI process was 

to provide an alternative method to assess a 

licensee's engineering effectiveness. 

However, as noted earlier, the core inspection 

program is being replaced with a new risk

informed baseline inspection program. The 

baseline inspection program has a strong 

design element and assesses the risk 

significance of design issues. Additionally, the 

revised inspection program also will include a

45
safety systems functional inspection capability. 

The new baseline inspection program will also

emphasize licensee problem identification and 

resolution, including the resolution of identified 

DBIs.

46
10 DESIGN-BASIS ISSUES IN NRC GENERIC COMMUNICATIONS

Some risk-significant DBIs have taken many 

years to be identified in NRC generic 

communications. This is because the 

significant DBIs described in generic 

communications often are not self-evident but 

have periodically emerged and been fed back 

in generic correspondence over time with 

insights from operating experience, 

performance information, safety analyses and 

system analyses and reviews. The emergence 

of these insights enable industry and NRC 

personnel to recognize a significant new DBI 

(e.g., inadequate RHR pump NPSH during 

sump recirculation). Therefore, significant new 

DBIs continue to be identified despite several 

hundred reactor-years of operating 

experience. Additionally, significant and 

potentially generic DBIs identified in NRC 

generic communications, in some cases, take 

several years to be fully recognized by 

licensees as applicable to their plants and 

resolved on a plant-specific basis. For 

example, DBIs identified by NRC inspectors 

and licensees in the mid-1 990s at Millstone, 

Haddam Neck, Crystal River, and Maine 

Yankee typically had been cited previously in 

NRC generic communications. However, as 

the NRC's generic communications program 

and reactor inspection program become more 

risk-informed, it is expected that the timeliness 

and reliability of licensee corrective actions for

risk-significant DBIs in NRC generic 

communications will improve. NRC generic 

communications related to DBIs covering the 

period 1987-1997 are listed in Appendix B. 

Like the DBIs reviewed as part of this study, 

most DBIs described in generic 

communication documents such as INs, 

bulletins, and GLs existed since initial plant 

startup. For example, in May 1988, IN 88-28, 

"Potential for Loss of Post-LOCA Recirculation 

Capability Due to Insulation Debris Blockage," 

was issued to address problems with both 

PWR containment sump strainer and BWR 

ECCS strainer clogging. NRC generic 

communication history on this general issue 

(excluding supplements and revisions) are 

shown in Table 8. This issue is still pending 

final resolution for PWRs, for which a 3 year 

study has recently been funded by the Office 

of Nuclear Regulatory Research as Generic 

Safety Issue 191. Actions are being taken by 

the staff to improve the generic communication 

processes (e.g., INs, bulletins, and GLs) and 

the generic issue program to be more timely, 

more risk-informed, and to reduce regulatory 

burden for areas of limited risk significance. A 

new pilot program to address generic issues 

began in 1999.

47
Table 8 Generic communications on pressurized-water reactor containment sump 

strainer and boiling-water reactor emergency core cooling system strainer clogging 

Date Information Notice/ Title 

Issued Bulletin Number 

05/88 IN 88-28 Potential for Loss of Post-LOCA Recirculation Capability Due to Insulation Debris 

Blockage 

11/89 IN 89-77 Debris in Containment Emergency Sumps and Incorrect Screen Configurations 

01/90 IN 90-07 New Information Regarding Insulation Materials Performance and Debris 

Blockage of PWR Containment Sumps 

09/92 IN 92-71 Partial Plugging of Suppression Pool Strainers at a Foreign BWR 

04/93 IN 93-34 Potential for Loss of Emergency Cooling Function Due to a Combination of 

Operational and Post-LOCA Debris in Containment 

05/93 IEB 93-02 Debris Plugging of Emergency Core Cooling Suction Strainers 

10/95 IEB 95-02 Unexpected Clogging of a RHR Pump Strainer While Operating in Suppression 

Pool Cooling Mode 

10/95 IN 95-47 Unexpected Opening of a Safety/Relief Valve and Complications Involving 

Suppression Pool Cooling Strainer Blockage 

05/96 IEB 96-03 Potential Plugging of Emergency Core Cooling Suction Strainers by Debris in 

Boiling-Water Reactors 

10/96 IN 96-059 Potential Degradation of Post Loss-of-Coolant Recirculation Capability as a 

Result of Debris 

05/97 IN 97-027 Effect of Incorrect Strainer Pressure Drop on Available Net Positive Suction Head

48
11 OBSERVATIONS

11.1 The Most Common Causes of DBIs 

Were Original Design Error, Procedure 

Deficiency and Human Error 

For 1997, the most common causes of DBIs 

were original design error, procedure 

deficiency, and human error, Licensees often 

cited multiple causes of DBIs. Of the 563 

LERs with DBIs reported for 1997, the most 

frequent contributing causes included design 

errors dating back to the time of original plant 

licensing (70 percent), procedure deficiencies 

(28 percent), human error (23 percent), poor 

work control practices (15 percent), and plant 

modifications (14 percent). 

11.2 There Was a Significant Variation Among 

Plants in the Number of Reported DBIs 

For 1997, the average number of DBIs 

reported in LERs for the 110 nuclear plants 

was 5.1. However, 6 PWRs accounted for 28 

percent of the reported DBIs: Crystal River 3 

(37 DBIs), Point Beach 1 (27 DBIs), Point 

Beach 2 (26 DBIs), Millstone 3 (26 DBIs), 

D.C. Cook 2 (22 DBIs), and D.C. Cook 1 (19 

DBIs). Additionally, during the period 1990-1997, 

11 plants (9 PWRs and 2 BWRs) accounted for 

about 29 percent of the reported DBIs. 

11.3 A Few Safety-related Systems Accounted 

for about Half of the DBIs 

For 1997, 6 of the 26 safety-related plant system 

categories used for the study accounted for 

approximately 64 percent of the 563 reported DBIs. 

These systems were: emergency core cooling (16 

percent), emergency ac/dc power (14 percent), 

containment and containment isolation (12 

percent), primary reactor (9 percent), essential 

service water (7 percent), and auxiliary/emergency 

feedwater (7 percent).

11.4 A Small Fraction of the DBIs Were 

Classified as Group I (Potentially Risk 

Significant) 

For 1997, of the 563 DBIs that were reported 

in LERs, 449 were categorized for risk. Of 

these, 99 DBIs (22 percent) were categorized 

as Group I. The majority (78 percent) were 

determined to involve either minimal risk or no 

risk significance. 

11.5 Three Safety-Related Systems Accounted 

for a Majority of the Group I DBIs 

For 1997, 3 of the 26 safety-related plant system 

categories used for the study accounted for about 

58 percent of the 99 Group I DBIs. These systems 

were: emergency core cooling (33 percent) 

emergency ac/dc power (15 percent) and 

containment and containment isolation (10 

percent). 

11.6 Older Plants Generally Reported More 

DBIs than Newer Plants Reported 

For 1997, newer plants (licensed after 1984) 

reported an average of about 3.6 DBIs while 

older plants (licensed before 1974) reported 

an average of about 6.1 DBIs. Additionally, 

about 19 percent of the newer plants had at 

least one DBIs categorized as Group I, while 

about 57 percent of the older plants had at 

least one DBIs categorized as Group I. The 

apparent reasons for the difference included: 

generally lower quality, level of completeness 

and accessibility of plant design basis 

information at older plants. The impact of NRC 

engineering inspection in Regions I and III 

compared to Region II and IV plants was also 

considered a factor.

49
11.7 Group I DBIs Were More Likely at Multi

Unit Sites than Single-Unit Sites 

Plants associated with multi-unit sites had a 

higher percentage of Group I DBIs than did 

single-unit sites. Shared systems was believed 

to be the major reason for the higher 

percentage of Group I DBIs for these sites. In 

addition, plant age was also a factor for both 

single and multi-unit sites, in that older plants, 

whether single or multi-unit, had a greater 

percentage of Group I DBIs than did newer 

plants. The percentage of plants associated 

with single-unit sites that had at least one 

Group I DBI was 50, 33, and 17 for plant age 

groups A, B, and C respectively, whereas, for 

multi-unit sites that had at least one Group I 

DBI, the percent was 63, 50, and 21 for plant 

age groups A, B, and C respectively. Plant age 

group A represents older licensing dates 

(plants licensed before 1974), and group C 

represents the newer licensing dates (plants 

licensed after 1984). 

11.8 During 1990-1997, the Percent of LERs 

with DBIs That Were ASP Events Steadily 

Decreased, While the Number of DBIs 

Increased 

In 1991, approximately 8.3 percent of DBIs 

reported in LERs were accident sequence 

precursor (ASP) events (i.e., CCDP > 10'). 

From 1992 to 1997, there was an increasing 

trend in the number of DBIs reported in LERs 

but the number which were ASP events 

generally decreased during the period. By 

1997, approximately 0.5 percent of the LERs 

with DBIs were classified as ASP events. 

11.9 Between 1992-1997, All of the 

"Important" ASP Events Involving DBIs 

Occurred at PWRs 

During this period, there were 14 important (CCDP 

> 10.4) ASP events. Of the 14 important ASP 

events, 12 occurred at PWRs and 2 occurred at 

BWRs. Three of the 14 important ASP events 

involved DBIs, and all three occurred at PWRs.

11.10 Increases in the Number of Reported 

DBIs Coincided with NRC Initiatives 

U.S. nuclear plants reported over 3100 LERs 

with DBIs during the period 1985-1997, or 

about 240 per year. The number varied from a 

low of 155 in 1985 to a high of 563 in 1997. 

Increases from previous years were observed 

in 1988 and 1989, and again in 1996 and 

1997. The increases appeared to coincide with 

certain NRC initiatives including: NRC team 

inspections with a significant design element, 

NRC surveys of licensees on DBIs, licensee 

reviews in response to elevated NRC focus on 

DBIs, and NRC generic communications. 

11.11 Group I DBIs Varied by NRC Region 

For 1997, plants in Regions I and III reported 

the largest number (35 and 36 respectively) of 

Group I DBIs, while plants in Regions II and IV 

reported the fewest number of Group I DBIs 

(22 and 6 respectively). Region III plants also 

had the highest percentage of plants with at 

least one Group I DBI (59 percent), followed 

by Region I (52 percent), Region II (36 

percent) and Region IV (19 percent). Possible 

reasons for the lower incidence of Group I 

DBIs in Regions II and IV may involve the 

generally fewer engineering inspection hours 

and the higher percentage of newer plants 

(i.e., better design basis documentation). 

11.12 For 1995-1997, DBIs Appeared to 

Correlate with NRC Engineering Inspection 

Effort 

For 1995-1997, as NRC engineering 

inspection hours increased, the number of 

reported DBIs generally increased. The 

increase was considered to be the result of 

NRC DBI inspection findings and increased 

licensee efforts to identify DBIs as a result of 

NRC inspections and NRC generic 

communications on DBIs. Thirteen of the 20 

plants that reported no DBIs during 1997, 

received less than the median number of 

engineering inspection hours.

50
11.13 Licensee Engineering Performance 

Ratings Often Declined with Increased 

Engineering Inspection Effort 

For 1997, a correlation between engineering 

inspection hours and the number of DBIs was 

identified. If a plant had a thorough 

engineering inspection for design compliance, 

it often reported more DBIs. This often 

resulted in the plant receiving a lower plant 

engineering rating in the subsequent 

assessment period. In some instances, the 

lower assessment rating led to increased 

regional or agency oversight.

11.14 The Importance and Applicability of 

DBIs Discussed in NRC Generic 

Communications Occasionally Takes 

Several Years for Licensees to 

Recognize and Address 

Some risk-significant DBIs have taken many 

years to identify in NRC generic 

communications. NRC and industry 

awareness of significant and potentially 

generic DBIs have emerged from insights 

drawn from operating experience, 

performance information, safety analyses, and 

system analyses and reviews. Most DBIs 

described in generic communication 

documents such as NRC information notices, 

bulletins, and generic letters existed since 

initial plant startup.

51
12 REFERENCES

1. U.S. Nuclear Regulatory Commission, "An Assessment of Design Control Practices and 

Reconstitution Programs in the Nuclear Industry," NUREG-1397, January 1991. 

2. U.S. Nuclear Regulatory Commission, Policy Statement on "Availability and Adequacy of 

Design Bases Information at Nuclear Power Plants," August 1992. 

3. U.S. Nuclear Regulatory Commission, "Availability and Adequacy of Design Bases 

Information," Draft Generic Letter (final not issued). 

4. Nuclear Management and Resources Council (now Nuclear Energy Institute), NUMARC 90

12, "Design Basis Program Guidelines," October 1990. 

5. U.S. Nuclear Regulatory Commission, "Staff Review of Licensee Responses to the 10 CFR 

50.54(f) Request Regarding the Adequacy and Availability of Design Bases Information," 

SECY-97-160, July 24, 1997. 

6. U.S. Code of Federal Regulations, Part 50, "Domestic Licensing of Production and 

Utilization Facilities," Section 72, "Immediate notification requirements for operating nuclear 

power reactors," January 1, 1997. 

7. U.S. Code of Federal Regulations, Part 50, "Domestic Licensing of Production and 

Utilization Facilities," Section 73, "Licensee event report system," January 1, 1997. 

8. U.S. Nuclear Regulatory Commission, Sequence Coding and Search System as of May 1, 

1998. 

9. U.S. Nuclear Regulatory Commission, Accident Sequence Precursor Program as of May 1, 

1998. 

10. U.S. Nuclear Regulatory Commission, Event Tracking System as of May 1, 1998. 

11. U.S. Nuclear Regulatory Commission, "Event Reporting Guidelines 10 CFR 50.72 and 

50.73," NUREG-1022, Rev. 1, January 1998. 

12. U.S. Nuclear Regulatory Commission, R.E. Ginna Nuclear Power Plant Design Inspection," 

NRC Inspection Report No. 50-244/97-201, September 24, 1997. 

13. U.S. Nuclear Regulatory Commission, Arkansas Nuclear One, Unit 1, Design Inspection 

Report No. 50-313/97-201, July 24,1997. 

14. U.S. Nuclear Regulatory Commission, "Perry Unit 1, Design Inspection," NRC Inspection 

Report No. 50-440/97-201, June 10, 1997. 

15. U.S. Nuclear Regulatory Commission, "Washington Nuclear Project No. 2 (WNP-2), Design 

Inspection," NRC Inspection Report No. 50-440/97-201), April 15, 1997.

52
16. U.S. Nuclear Regulatory Commission, Generic Letter 96-06, "Assurance of Equipment 

Operability and Containment Integrity During Design-Basis Accident Conditions," September 

1996. 

17. U.S. Nuclear Regulatory Commission, "Precursors to Potential Severe Core Damage 

Accidents 1997, A Status Report," NUREG/CR 4674, Vol. 26, December 1998. 

18. U.S. Nuclear Regulatory Commission, SECY-99-007A, "Recommendations for Reactor 

Oversight Process Improvements," March 22, 1999. 

19. Brookhaven National Laboratory, Letter Report JCN W6234, "Development of Risk-Informed 

Baseline Inspection Program," February 10, 1999. 

20. U.S. Nuclear Regulatory Commission Regulatory Guide 1.174, "An Approach for Using 

Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the 

Licensing Basis," July 1998.

53
Appendix A 

1997 Licensee Event Reports 

With Design-Basis Issues
INTRODUCTION

Of the 563 design-basis issues (DBIs) 

reported for 1997 and shown in this appendix, 

449 were reviewed and categorized to 

determine whether the DBI function that was 

reported was potentially safety significant 

(referred to in this report as potentially safety 

significant design-basis issues [PSSDBIs]) 

using guidance provided in Brookhaven 

National Laboratory Letter Report JCN 

W6234, "Development of a Risk-Informed 

Baseline Inspection Program," (Ref. 19). In 

some instances, site-specific risk information 

was available and was used in lieu of the 

Brookhaven report. The remaining 114 DBIs 

involved either fire or seismic issues are not 

adequately discussed in the Brookhaven 

report to provide an accurate risk estimation, 

and therefore were not rated. Fire and seismic 

DBIs are shown as not rated-fire (NRF) or as 

not rated-seismic (NRS) in the table. In 

addition, this report did not attempt to assess 

the risk or safety significance of multiple trains 

or systems being outside their respective 

design basis over several operating cycles. 

For the 449 DBIs that were rated for safety 

significance, two major DBI groups were 

developed having a total of seven categories. 

Group 1: (PSSDBIs) 

Design-basis issue Categories 1 through 3 

(1) an actual system or train failure to meet 

design requirements during a safety demand, 

(2) an actual system or train failure to meet 

design requirements without a safety demand, 

and (3) potential failure of a system or train to 

meet its design requirement. 

Group 2: (DBIs having very low or no safety

significant functions) 

Design-basis issue Categories 4 through 7 

(4) an actual system or train failure to meet 

design requirements during a safety demand,

(5) an actual system or train failure to meet 

design requirements without a safety demand, 

(6) potential failure of a system or train to meet 

its design requirement, and (7) no impact on 

the plant. 

For the purpose of analysis, DBI Categories 1 

through 6 were further divided into three 

subcategories "a," "b," and "c." Subcategory "a" 

representing a system loss, 'b" representing a 

system degradation, and "c" representing a 

degradation or loss of a train. For example, a 

Category 3c rating would indicate a PSSDBI 

that involved a potential failure of an SSC to 

perform its design function at the train level 

(either a degradation or loss). Similarly, a 

Category 5a rating represents a very low or no 

safety significant DBI that involved an actual 

failure of an SSC to perform its design function 

at the system level. 

The characterization screening involved a 

review of the description of the DBI and the 

stated impact of the DBI based on the 

narrative information documented in the LER. 

The LER abstracts and full narrative texts 

provided the information needed to identify the 

equipment potentially or actually impacted by 

the DBI. Direct impacts and consequential 

impacts, at the level of operability and 

functionality of structures, systems and 

components (SSC) were based on the 

information documented in the LER. The risk 

significance characterization screening 

process did not involve contacting the licensee 

to obtain additional information. In most cases 

the LER contained sufficient information on 

the status of the effected equipment and 

occasionally included explicit statements onm 

the effect of the DBI on equipment operability. 

In all cases, LERs specified the conditions 

(scenario) under which the effected equipment 

would not be operable and/or functional. For a 

few of the LERs, the narrative did not provide 

the consequential impacts of the DBI at the 

level of the SSC (e.g., did not document the 

specific redundant systems or functions that

A-1
might be degraded or lost. Generally, sufficient 

information was provided to assess whether 

the effected SSC equipment was inherent in 

either the direct cause or was assumed as 

part of the potential consequences associated 

with the DBI. Engineering judgement was 

utilized when appropriate, to assess the 

probability of the specific single failures for 

assessing the potential risk characterization. 

When documented, licensee probabilistic risk 

analysis results were utilized to characterize 

the risk. 

The basic approach to characterizing the risk 

significance of each DBI was based on the 

application of the generic risk information 

matrices (RIMs) tables for PWRs and BWRs 

contained in Ref. 19. The RIMs tables 

document the systems and human actions that 

are important to the risk of PWRs and BWRs 

and the reasons for their importance. The 

generic risk insights used to develop the RIMs 

are based on the individual plant examination 

(IPE) insights report (NUREG-1560), the IPE 

database (NUREG-1603), lessons learned

from maintenance rule implementation and 

insights from fire and shutdown PRAs. These 

considerations were based on IPEs which only 

cover internal events. External events, such as 

caused by natural phenomena (e.g. seismic, 

extreme weather conditions) are not included 

in the generic RIMs. 

Overall, the risk significance characterization 

process is considered conservative. That is, in 

the aggregate, the process is expected to 

identify more DBIs as potentially safety 

significant than a more detailed, plant-specific 

process would find to be actually safety 

significant. The conservatism results from the 

fact that the generic RIMs tables contain those 

systems and human actions that are important 

to most of the plants in the population, plus the 

items that are potentially important to only 

some of the plants in the population. Thus, 

applying all of the items in the generic RIMs 

tables to all the plants would be conservative 

for individual plants.

A-2
1997 Licensee Event Reports With Design-Basis Issues

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

155-97-003 6a POWER LEVEL - 000%. During the evaluation of NRC Generic Letter 96-06: 'Assurance of Equipment Operability and 

(Big Rock Point) Containment Integrity During Design Basis Accident Conditions' two systems were discovered to be susceptible to the over 

pressurization of isolated piping segments that could affect containment integrity during a postulated design basis accident. 

The two susceptible piping segments at Big Rock Point are in the functionally non-safety-related treated waste and 

demineralized water systems. A detailed response to Generic Letter 96-06 with commitments was provided to the NRC by 

Consumers Power Company letter dated January 28, 1997. Big Rock Point was designed prior to codes requiring 

consideration of fluid expansion affects (1955 ANSI B31.1.0). This code pre-dates most nuclear plant designs and likely did 

not consider the environmental effects of a containment structure during post-accident conditions. Corrective action 

includes an evaluation of surge protection for the demineralized water piping, and procedure changes for the treated waste 

system, to eliminate susceptibility to over pressurization during design basis accident conditions. 

155-97-004 3a POWER LEVEL - 100%. On March 19, 1997, a load test was conducted on feeder breaker 72-12, DC Distribution Panel #1 

as part of an action plan to verify breaker performance. The plant was in the cold shutdown condition. Following what was 

believed to be a successful performance of the magnetic load test, breaker 72-12 would not manually reset. Breaker 72-12 

was opened, and verified to contain only a magnetic trip feature. Plant drawings indicated that it should have a thermal trip 

feature. On April 10th, 1997, approximately 1600, the Big Rock Point Staff concluded from an additional calculation that a 

loss of selective coordination over a minor portion of the interface between breaker 72-12 and other DC breakers in the 

circuit could have resulted in a loss of the panel due to a nonsafety-related fault. The safety-related loads supplied by the 

panel that could have been affected are MO-7064, Primary Containment Spray valve, and the Liquid Poison System squib 

valve control circuits. The root cause for this event is an inadequate design control program prior to 1976. No design review 

program covered the physical verification of this breaker. Breaker 72-12 was removed and replaced with a load-tested, 

thermal-trip-only spare breaker. Long term corrective actions include the performance and development of preventative 

maintenance tasks to remove and test the DC breakers associated with the panel. 

155-97-005 6b Big Rock Point's Operating License prohibits storage of materials in the area between spent fuel rack B and the east wall of 

the spent fuel pool so that local temperatures in the fuel pool will remain consistent with the cooling analysis of record. 

Contrary to this requirement, a stainless steel bucket was discovered on the spent fuel pool floor between rack B and the 

east wall of the spent fuel pool on October 9, 1997, at approximately 1330. In addition to the bucket, additional debris (such 

as old pvc padding, hook and cable) were discovered. The cause of the materials resting on the floor between the "B" rack 

and the east SFP wall cannot be determined. The reason for not discovering the bucket earlier can be attributed to the lack 

of a surveillance procedure to confirm that materials were not located in this area. The bucket was removed, and facility 

procedures have been revised to ensure that this area is kept clear. An analysis confirmed that there was no immediate or 

past operational safety concern.

A-3
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

213-97-001 7 POWER LEVEL - 000%. On January 14, 1997, at approximately 1530 hours, with the plant in a defueled mode, a 

(Haddam Neck) reportability evaluation determined that the plant had been in a condition outside of the analyzed service water supply 

temperature range. Both the Haddam Neck Updated Final Safety Analysis (UFSAR) and the service water supply piping 

stress analysis reference 35 degrees F as the minimum service water supply temperature, however, historically, there have 

been times when the average supply (river water) temperature was below 35 degrees F. This condition was previously 

identified in February 1996 (LER 96-002-00). Although actions were initiated to update the UFSAR, the changes were never 

made resulting in a recurrence of the same condition. The cause was a program deficiency in that the design basis 

calculations were not updated in a timely manner. It was determined that there are no limiting effects associated with 

overcooling any components and that the lower supply temperature had no effect on existing emergency core cooling 

calculations or on the structural integrity of the service water system. Corrective action consists of revising the UFSAR and 

the design basis calculations to reflect the normal operating temperatures of the service water system. In addition there is a 

formal, ongoing effort to identify and correct UFSAR inaccuracies. 

213-97-004 6a POWER LEVEL - 000%. On February 19, 1997, at 1415 hours, with the plant defueled, a preliminary engineering 

evaluation determined that fuel assembly loads in excess of the Technical Specification limit of 1650 pounds could have 

been potentially moved over spent fuel assemblies within the spent fuel pool. The cause of this condition was due to 

removing the exclusion for fuel assemblies from the Technical Specification requirements in 1989 in an attempt to remove 

ambiguity. During the time frame of the change, it was likely concluded that the weight of a fuel assembly would never 

exceed the 1650 pound limit; therefore the exclusion was not deemed necessary. Since then, new core designs for 24 

month cycles have resulted in heavier fuel assemblies which have reduced the available load margin. Immediate corrective 

action was to prohibit movement of fuel assemblies over the fuel pool. The long term corrective action will be to amend the 

Technical Specifications in accordance with the guidance for Improved Standard technical Specifications to restore the 

exclusion for fuel assemblies. This event is reportable under 10CFR50.73 (a) (2) (ii) (B) as a condition outside the design 

basis of the plant. It is also reportable under 1 OCFR50.73(a)(2)(I)(B) as a condition prohibited by the plant's Technical 

Specifications. 

213-97-007 6a POWER LEVEL - 000%. On March 11, 1997, at approximately 1730 hours, with the plant defueled, a reportability 

evaluation determined that the service water (SW) supply line to the spent fuel pool (SFP) heat exchangers (HX) was 

inoperable. Following a loss of normal power (LNP), a potential exists for water hammer in the high point of the SW lines to 

the SFP HXs upon restart of a SW pump. The apparent cause of this event was that the original design of the plant and 

other earlier analyses did not identify the potential for water hammer. Short term corrective action consisted of revising a 

procedure and staging materials to allow installation of a temporary cooling line, using fire hose, in the event of the failure of 

the SW supply line to the SFP HXs. Long term corrective action consists of installing a check valve in the SW supply line to 

the SFP HXs which will hold the line full of water until pump restart following a LNP, thereby preventing water hammer.

A-4
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

213-97-008 NRS POWER LEVEL - 000%. On March 26, 1997 at 1905 hours, with the plant defueled, the service water return line from the 

spent fuel pool heat exchangers was declared inoperable based on a Generic Letter 90-05 wall thinning analysis. The 

degraded 3 inch area of piping had previously been examined in October 1996, using ultrasonic inspection techniques, and 

was determined acceptable with sufficient margin to last one year. The degraded area was found during a routine followup 

inspection. The cause of the wall thinning appears to be microbiologically influenced corrosion (MIC). At the time of 

discovery the SFP cooling system had already been declared inoperable since March 11, 1997 due to a potential water 

hammer issue in the service water supply line. Initial corrective actions taken as a result of the degraded return line 

consisted of approving a temporary procedure change to allow using fire hoses to establish an alternate flow path during 

piping replacement and/or following a seismic event. Other spent fuel pool service water piping areas were examined during 

augmented inspections which did not reveal any additional flaws below code allowable limits. Previously inspected areas of 

the supply piping will continue to be monitored for any changes in corrosion rates. The degraded piping has been replaced 

and the system was returned to operable status on April 17, 1997. 

213-97-009 5b POWER LEVEL - 000%. On April 4, 1997, with the plant permanently shutdown, it was determined that the sample nozzle 

for the vent stack radiation monitor (R-14A) was not drawing the sample from the process stream in an isokinetic fashion as 

described in the plant FSAR. Isokinetic sampling is required for representative sampling of particulates in the process flow. 

The apparent causes of this condition were (1) the original design does not meet the later ANSI N13.1-1969 standards, and 

(2) an inadequate understanding of system design and operational requirements by Chemistry and Engineering personnel. 

Immediate corrective action was to declare the R-14A sample system out of service and perform compensatory sampling in 

accordance with the Technical Specifications. An alternate backup particulate and iodine sample system is being evaluated 

and a corrective action plan for the entire Radiation Monitoring System (RMS) has been developed which includes resolving 

the R-14A nozzle issue. This event is reportable under 1OCFR50.73 (a) (2) (ii) (B) as a condition outside the design basis of 

the plant. 

213-97-010 6a POWER LEVEL - 000%. On April 10, 1997, at approximately 1200 hours with the plant in the permanently defueled 

condition, an engineering review of design basis documents determined that prior to 1975 the available net positive suction 

head (NPSH) for the spent fuel cooling pump at the maximum pool temperature (identified in historical licensing basis 

documents) could potentially be below the required NPSH. Cavitation of the pump could have occurred if the pool 

temperature exceeded approximately 153 degrees F with a single suction line open. The apparent cause of this event was 

a deficiency in the original (pre 1975) system design basis. Corrective action consisted of confirming that the existing design 

is adequate to support licensed operating conditions. As follow-up to the recent engineering review, the normal and 

abnormal operating procedures for the spent fuel pool cooling system were revised to include a caution that both suction 

valves are to be open prior to exceeding 140 degrees F to prevent pump cavitation. The applicable procedures) will also be 

revised to throttle the pump discharge valve as necessary to provide adequate NPSH for elevated fuel pool temperatures.

A-5
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-6

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

213-97-011 6b On June 30, 1997 at 1430 hours, with the plant permanently shutdown and defueled, an engineering evaluation determined 

that the Spent Fuel Pool Cooling (SFPC) system was incapable of removing the maximum design basis heat load of the 

spent fuel pool (SFP). The current design bases require the SFPC system to be able to remove 22.4million Btu/hr following 

an emergency core offload at the end of the last licensed operating cycle (year 2007) with 90 degree F cooling water, while 

maintaining the pool at less than 150 degrees F. Calculations performed during normal operating conditions revealed the 

SFPC system could not currently meet this requirement. Also, on August 1, 1997 at 2108 hours, during surveillance testing 

of a check valve in the SFPC Service Water supply line, it was discovered that design basis flow could not be provided to 

the SFPC system. The design basis requires a minimum of 855 g.p.m., while only 820 g.p.m. was measured. However, the 

system was fully capable of meeting the emergency full core off load requirements prior to the 1996 refueling. The cause of 

both events is believed to be siltation of the inservice SFPC heat exchanger. Since the current SFPC heat load is less than 

3 million BTU/hr and decreasing, significant heat removal margin still exists. 

213-97-012 6a On July 24, 1997, at approximately 2011 hours, with the plant permanently defueled, a check valve in the service water 

(SW) supply line to the spent fuel Pool (SFP) heat exchangers (HX) failed its seat leakage surveillance test and was 

declared inoperable. The valve had been installed in April 1997 to eliminate the potential for water hammer after a loss of 

normal power and restart of the service water pumps. The apparent cause is believed to be due to the variation in the 

surveillance test methodology which may have allowed debris to be backflushed into the valve seating area during system 

filling operations. Following an engineering determination, this event was reported on July 29, 1997. The valve was 

satisfactorily retested on July 29, 1997, using the original test lineup. Short term corrective action consisted of revising a 

procedure and staging materials to allow installation of a temporary cooling line, using fire hose, in the event of the failure of 

the SW supply line to the SFP HXs. Additionally, the test procedure was revised to ensure the surveillance test is performed 

in a manner which cannot backflush debris into the check valve. Although it is uncertain as to whether the valve was ever 

I_____ Iactually inoperable this event is being conservatively reported as a condition outside the design basis of the plant.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-7

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

213-97-016 6a On August 25, 1997, with the plant permanently shut down and defueled, while preparing to perform air flow testing, a 

positive pressure was observed in the spent fuel building (SFB) following startup of the SFB supply fan. The SFB design 

basis states that the design flow of the exhaust unit exceeds the supply capacity maintaining a small continuous air 

infiltration into the SFB to prevent release of contamination from the building. Since the supply flow exceeded the exhaust 

flow from the building, this continuous infiltration was not met. Testing was conducted to determine the cause of this 

condition (i.e., whether the supply fan is supplying greater than design flow or the exhaust fan is exhausting less than 

design flow). It was noted that a positive building pressure only occurred while the SFB supply fan was operating. Since the 

SFB supply fan is required to be shutdown during fuel movement or crane operation with loads over the storage pool, a 

positive pressure was not experienced during the time the fuel storage building air cleanup system was required to be 

operable by the Technical Specifications. This event is reportable under 1 OCFR50.73 (a) (2) (ii) (B) since the system was 

outside its design basis. This supplemental LER details the test results, cause of the event and associated corrective 

actions. 

213-97-018 5b On October 3, 1997, with the plant permanently shut down and defueled, air flow testing of the Spent Fuel Building (SF8) 

Ventilation System indicated that the SFB exhaust fan did not meet its design basis of exhausting 13,000 cfm when aligned 

to bypass the HEPA and charcoal filters. The fan exhausted approximately 11,500 cfm with one Primary Auxiliary Building 

(PAB) purge fan operating. When two PAB purge fans were operating, the SFB exhaust fan flow rate was approximately 

6,500 cfm. The cause of the low SFB exhaust flow is a higher than expected pressure in the PAB exhaust ductwork. This is 

the ductwork into which the SFB exhaust discharges. The higher pressure is a result of a PAB purge fan modification in 

1974 which replaced the original PAB fans with higher capacity fans. The original fans each had a capacity of approximately 

35,000 cfm. The replacement fans are rated for 52,000 cfm each. The cause of this event is personnel error, in that the 

modification was not adequately designed or tested. Long term corrective action was to reduce the SFB supply fan flow and 

establish a design flow range for the exhaust fan. The purpose of this supplemental report is to provide information on the 

corrective action that has been implemented.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

219-97-001 6b POWER LEVEL - 100%. On January 3, 1997, during a review as requested by Generic Letter (GL) 96-06, 'Assurance of 

(Oyster Creek) Equipment Operability and Containment Integrity During Design Basis Accident Conditions', seven penetrations in five 

systems did not meet the requirements as described in GL 96-06. Under the postulated conditions contained in GL 96-06, 

these seven penetrations are only required for containment integrity. An analysis was performed of each penetration while 

isolated. The analysis modeled the effects on internal fluid and piping in response to an external ambient temperature 

increase. The results revealed that although the piping did not meet the design requirements, the postulated pressures did 

not exceed ASME Section III, Appendix F criteria for piping. Additionally, the potential effects on the respective isolation 

valves were considered. A catastrophic failure of the valves is not considered credible. Therefore containment integrity for 

the penetration was maintained and the safety significance of this discovery is considered minimal. The cause for this 

condition was that previous analyses were performed without using the more conservative assumptions described in GL 

96-06. Operability determinations were performed and further evaluations are ongoing to determine the need for 

modifications or procedural revisions. 

219-97-003 5b POWER LEVEL - 100%. On March 11, 1997, while post maintenance testing was in progress on torus spray valve V-21-18, 

operations personnel identified that the pressure suppression function of primary containment had been inadvertently 

degraded. By opening valve V-21-18, a flow path was created from the drywell to the torus airspace which would have 

bypassed the suppression pool in the event a loss of coolant accident (LOCA) occurred. This could result in inadequate 

steam suppression from the drywell and over-pressurization of the torus. The condition existed for a total of about ten 

minutes, therefore, exposure to the risk was minimal. The cause of this event has been determined to be an inadequate 

safety review of the change of PM 9441 M from an outage task to an on-line task. This resulted in inadequate precautions in 

the job order and maintenance procedures that controlled the evolution. Upon discovery, shift supervisors notified affected 

operations personnel that when a torus spray valve is cycled, the associated test valve must be closed. A process will be 

developed and implemented to allow review of work activities and preparation of switching orders by operations personnel 

other than the on-shift control room staff. The process for revising PMs will be reviewed and revised to address potential 

impacts on performing a PM when the plant is in a different mode than specified. 

219-97-004 6a POWER LEVEL - 100%. During a detailed review of motor operated valves for periodic verification in response to Generic 

Letter 96-05, it was discovered that reactor water cleanup valve V-16-2 was being used to fill and vent the cleanup system 

while the reactor is at power and operating pressure. If V-16-2 is open and the downstream pipe were to break, V-16-2 

would be required to close against normal reactor operating pressure. Delta pressure (delta p) calculations for V-16-2 did 

not address this event. Therefore, the valve was not set up to close against reactor pressure of 1020 psig. This oversight is 

attributed to personnel error in that the prior review missed the use of valve V-16-2 during power operation. V-16-2 was 

declared inoperable and deactivated in the closed position to prevent it from being opened with reactor pressure greater 

than 125 psig. AR engineers will be informed of this event and the importance of design verification through required 

reading of this LER.

A-8
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

219-97-010 2b A manual scram was initiated in response to sparking in the main generator exciter commutator. The sparking was caused 

by a brush failure due to the use of incorrect parts. As a result of a low voltage condition, the emergency buses separated 

from off-site power and were subsequently energized by the emergency diesel generators. Several engineered safety 

features actuated. The two control rod drive pumps failed to start as designed. During a review of the transient, it was 

identified that the startup transformer voltage regulators were set to regulate voltage outside the plant's design basis as 

described in the degraded grid voltage study. A design defect in the control rod drive pump breaker control logic was also 

identified. Corrective actions include repair of the exciter, resetting the transformer voltage regulators and adding a time 

delay to the control rod drive pump start sequence. 

219-97-015 NRS On Dec. 4, 1997 it was discovered that some of the mounting screws were missing from a number of static time delay units 

(STDUs) in unit substation switchgear cubicles. Some of these cubicles are associated with safety related loads. This is 

contrary to the configuration on which their seismic qualification was based. This condition was caused by improper 

installation with contributing factors of panel configuration, lack of a questioning attitude, and lack of sensitivity to seismic 

mounting concerns. In the event of a seismic event, reliability of containment heat removal capability could have been 

reduced. Redundant components were available to accomplish the heat removal function and emergency operating 

procedures provide alternate methods even in the event redundant components were to fail as well. The STDUs have been 

properly mounted restoring operability to affected equipment. Additional information and guidance relating to seismic 

mounting requirements will be contained in future job orders (both preventative and corrective maintenance) and required 

reading will be assigned for appropriate personnel. 

219-97-016 6b On December 12, 1997, it was determined that an omission in a design basis calculation would have prevented the H sub 2 

O sub 2 system from operating for the full 48 day post LOCA design interval if called upon. This is a condition outside of the 

design bases. The cause of the omission was a failure to allow for sufficient margin in the low pressure reagent gas setpoint 

to allow for increasing gas flow rates over the life of the analyzer. Corrective action was taken to increase the low pressure 

limit of the reagent gases and ensure that the installed gas bottles had sufficient pressure. This omission was discovered as 

part of a program to verify and evaluate existing calculations. The scope, determination, and implementation of this program 

are ongoing. The primary containment atmosphere is monitored and oxygen is maintained at a level which would preclude 

any hydrogen/oxygen reaction in a post LOCA environment.

A-9
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

220-97-001 NRS POWER LEVEL - 100%. On February 6, 1997, with Nine Mile Point Unit 1 (NMP1) in the RUN mode and reactor thermal 

(Nine Mile Pt. 1) power at approximately 100 percent, Niagara Mohawk determined that 16 pipe supports in the Reactor Building Closed 

Loop Cooling System (RBCLC) inside the drywell did not meet the design basis criteria for seismic loads as descried in the 

Updated Final Safety Analysis Report (UFSAR). This deficiency was identified as a result of a design analysis being 

performed as part of the corrective actions previously identified in voluntary Licensee Event Report (LER) 96-09, concerning 

potential over stressed pipe supports in RBCLC. The apparent cause of this event is a design deficiency resulting from the 

design methods used in the original design of RBCLC piping and supports. The RBCLC system has been determined to be 

operable. Engineering Analysis had demonstrated that the piping will remain intact and capable of performing its safety 

function after a design basis seismic event. The affected supports will be modified during the next refueling outage. 

220-97-002 5b POWER LEVEL - 000%. On March 18, 1997, it was determined that one Core Shroud Repair Assembly was degraded. 

Subsequent inspections revealed that each Core Shroud Assembly had experienced some degradation. The cause of the 

degradation has been determined to be that assumptions used in the design did not appropriately account for installation 

tolerance and the potential for tie rod subcomponent damage due to this unanticipated movement. NMPC intends to modify 

and reinstall the Core Shroud Stabilizer Assembly, and to perform a re-inspection coincident with the core shroud vertical 

weld re-inspection schedule. NRC approval of the repair assembly modification is required prior to unit restart. 

220-97-003 6b POWER LEVEL - 000%. On April 3, 1997, Niagara Mohawk Power Corporation (NMPC) determined that thermal sensors 

used to detect line breaks were not appropriately located in the RWCU system auxiliary pump room as described in Section 

10.1.3 of the Nine Mile Point Unit 1 (NMP1) Updated Safety Analysis Report (USAR). The cause of this event is that the 

original designers of the plant in the 1960s did not locate thermal sensors in the reactor water cleanup (RWCU) auxiliary 

pump room. To correct the deviation, thermal sensors have been installed in the RWCU system auxiliary pump room. 

220-97-004 NRF On May 13, 1997, Niagara Mohawk Power Corporation (NMPC) determined that Nine Mile Point Unit 1 (NMP1) was not in 

compliance with the requirements of 10CFR50 Appendix R, Section IIl.J. Deficiencies were identified during NMPC's 

evaluation of NRC Information Notice (IN) 95-36 "Potential Problems With Post-Fire Emergency Lights.' The cause of this 

event has been determined to be ineffective change management in that the development of safe shutdown procedures 

and physical changes to the plant were not properly evaluated for compliance to 10CFR50 Appendix R, Section IIl.J 

requirements. Initial compensatory actions include utilization of hand held lights and installation of portable eight hour 

capacity lights in critical areas of the plant. Subsequently, installation of permanent eight hour capacity lights has begun.

A-10
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

220-97-005 6a On June 12, 1997, Niagara Mohawk Power Corporation (NMPC) determined that during surveillance testing of the core 

spray system containment isolation valves, a pressure locking condition could occur which would prevent the core spray 

system from performing its safety function. This discrepancy was discovered during NMPC's review of design documents 

for closure of the Nine Mile Point Unit 1 (NMP1) Generic Letter (GL) 89-10 Program. This reportable condition was caused 

by an original design deficiency in that the design did not consider this failure mode. Additionally, previous evaluations of 

pressure locking susceptibility performed in response to NRC Information Notice (IN) 92-26, "Pressure Locking of Motor 

Operated Flexible Wedge Gate Valves" and GL 95-07, "Pressure Locking and Thermal Binding of Safety Related Power 

Operated Gate Valves," failed to reconcile this design deficiency. Corrective actions included modification of the valves to 

preclude pressure locking. 

220-97-007 6a On August 15, 1997 at 1600 hours, the Nine Mile Point Unit 1 (NMP1) staff identified a reportable condition whereby the 

Control Room Emergency Ventilation (CREV) system would not have been able to perform its design function. Specifically, 

the Control Room Smoke Purge system has been operated at times when the CREV system was required to be operable. 

Per design, the Smoke Purge system does not have an automatic isolation feature. If the Smoke Purge system was in 

operation when an initiation of the CREV system occurred, the CREV system would not have been able to maintain the 

design requirements for Control Room habitability. The root cause of the event is inadequate evaluation (on two occasions) 

of the interface between the Smoke Purge system and the CREV system. The Control Room Smoke Purge system was 

operated for reasons other than smoke removal from a fire and operation in this manner was not considered for impact on 

Technical Specification (TS) operability of the CREV system. The implementation of the modification process failed to 

identify these deficiencies both in 1980 and again in 1984. The immediate corrective actions included placing administrative 

controls on the Smoke Purge system to limit its operation. The procedures controlling operation and testing of the system 

will be revised to restrict the operation of the system to its intended design function (smoke removal) and to ensure that the 

system is only tested when the CREV system is not required to be operable. In addition, selected modifications will be 

reviewed to determine if similar interface problems exist. 

220-97-012 NRF On October 15, 1997, Niagara Mohawk Power Corporation (NMPC) identified an area of Nine Mile Point Unit 1 (NMP1) 

which does not meet the requirements of Section IIl.J Emergency lighting. This area was identified during a design bases 

review of the NMP1 Updated Final Safety Analysis Report (UFSAR) Section 10B. The cause of this event has been 

determined to be a cognitive personnel error which resulted in an analysis deficiency in Fire Protection Engineering 

Evaluation (FPEE) 1-90-014, Revision 1.

A-11
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

237-97-003 6a Between October of 1996 and January of 1997, systems that penetrate containment were reviewed to identify piping that is 

(MULTI-UNIT susceptible to the thermally induced pressurization issue identified in NRC Generic Letter 96-06. Based on the results of the 

APPLICABILITY) review and subsequent operability determinations, on January 27, 1997 it was determined that the systems identified as 

(Dresden 2) susceptible to over-pressurization in post-accident conditions did not account for post-accident pressurization in their 

original design, and as a result were outside the design basis of the plant. Operability Assessments were performed to 

document the basis for continued operability of these affected penetrations and systems/components. The systems were 

determined to be operable but degraded. Permanent correction of the degraded condition will be accomplished by installing 

over pressure protection or by penetration specific analysis. 

237-97-007 6b Power Level - 100%. During the Dresden Station Key Parameter Screening Review effort, a discrepancy was identified 

(MULTI-UNIT relating to the LPCI loop selection initiation logic setpoint. The UFSAR identified the design limit for this setpoint as /= value, 

APPLICABILITY) the existing setpoint was calculated and set above the UFSAR limit. The LPCI loop selection logic ensures the LPCI 

injection flow is directed to an unbroken recirculation pump loop. This function was in question. Therefore, the LPCI 

injection subsystem was declared inoperable at 1920 hours on February 26, 1997, and a 7 day LCO was entered per 

Technical Specification 3.5.A.2.b. Immediate corrective action was initiated to review the setpoint calculation and recalibrate 

the pressure switches to be in compliance with the UFSAR limit. The system was restored to operability on March 03, 1997, 

at 0132 CST. Long term corrective action is in place to improve the quality of calculations performed for the Dresden 

station. This event was determined to be reportable pursuant to 10 CFR 50.73(a)(2)(ii)(B). The safety significance 

concerning the non-conservative setpoint was minimal, based upon completion of an analysis demonstrating that the loop 

select function would have functioned properly with the as-found setpoints. 

237-97-011 6a Dresden Design Engineering reviewed LaSalle LER 97-005 (Docket 05000373), dated March 24, 1997, regarding the 

(MULTI-UNIT potential loss of Standby Gas Treatment Systems and the Containment Pressure Suppression function following a Loss of 

APPLICABILITY) Coolant Accident. Subsequent investigation determined that the only applicable concern was the potential to partially 

bypass the pressure suppression pool function if a LOCA should occur during the time when the drywell and suppression 

pool were interconnected by purging or venting operations. In resolving this issue, it was determined at 1200 on April 30 

that this condition was reportable. A Four (4) hour phone call to the NRC was initiated under 10CFR50.72(b)(2)(I). The root 

causes of the event are 1) a failure in the original operating procedure for purging and its associated safety evaluation to 

address all interactions among the drywell and suppression chamber, and 2) failure to ensure that consistent operating 

alignment and philosophy were used in incorporating the design basis into operating procedure development. Corrective 

actions include revising station procedures to preclude the possibility of operation with a pressure suppression bypass flow 

path. The safety significance of this event is moderate.

A-12
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY] 

237-97-017 3b While assisting the Quad-Cities Station during an NRC inspection, Dresden engineering personnel became aware of a 

(MULTI-UNIT technical issue regarding vortexing at the High Pressure Coolant Injection (HPCI)/Reactor Core Isolation Cooling suction 

APPLICABILITY) nozzle in the Condensate Storage Tank (CST). No previous calculations addressing vortexing at the HPCI suction nozzle 

on the CST had been performed for Dresden Station and the issue was judged applicable to Dresden Station. An operability 

determination found that significant amounts of air could be entrained into the HPCI suction piping before the CST low-low 

level would be reached and automatic transfer of the HPCI suction from the CST to the torus initiated. The Unit 2 and Unit 3 

HPCI systems were declared inoperable and the applicable Technical Specification Limiting Condition for Operation was 

entered. Dresden has two CSTs and HPCI is generally aligned to one CST. Based on alignment of both CSTs to the HPCI 

systems and administratively maintaining water level in the CSTs and torus above low level alarm limits, it was determined 

that there was no line break accident scenario where the low-low CST level switches would be needed to initiate a transfer 

of the HPCI pump suction. For line breaks inside containment, automatic transfer of the HPCI pump suction from the CST 

to torus would be initiated by high level in the torus before the low-low CST level setpoint is reached. For line breaks outside 

of containment, the amount of water required for HPCI is small compared to the available inventory and no automatic 

transfer of the suction path is required. The primary root cause appears to be an original design error. The effect of 

vortexing on the useable CST volume was not considered in the original design of the HPCI system. Further evaluation will 

be performed to ensure that the HPCI suction path from the CSTs is automatically transferred to the torus prior to entraining 

significant amounts of air into the HPCI pump. No previous occurrences were identified. The safety consequences of a 

degraded HPCI system would have been minimal at the time of the event since the automatic depressurization system and 

other ECCS systems were available as a backup to the HPCI subsystem to mitigate the consequences of an accident. 

245-97-004 6b POWER LEVEL - 000%. On January 27, 1997, at 1200 hours, with the plant in COLD SHUTDOWN, a single failure 

(Millstone 1) vulnerability of Reactor Building Closed Cooling Water System (RBCCW) was identified. Containment Isolation Valve 

1 -RC-206 has an allowable closure time of 35 seconds per Technical Requirements Manual. The valve is powered from 

MCC-E3 which is connected to the Gas Turbine (GT) for its emergency power source. Following a Loss of Normal Power 

(LNP) event, AC power will not be restored to MCC-E3 for a maximum Technical Specification limit of 48 seconds. A time 

limit of 60 seconds is assumed in the offsite dose calculations to establish primary containment integrity. On a Loss of 

Coolant Accident (LOCA) with a LNP, a failure of DC operated valve 1 -RC-207 will result in penetration X-24 taking longer 

than the assumed 60 seconds to completely isolate. Any post-LOCA gas escaping from primary containment through this 

penetration would be released into secondary containment. This leakage would be in addition to the 300.3 SCF per hour 

Appendix J leakage from the Drywell assumed in the off site dose calculations. Thus, this condition could exceed the 

existing calculated site boundary dose limits. The cause of this condition was the failure to adequately establish a design 

basis for RBCCW containment isolation. An engineering evaluation was performed that determined that the leakage from 

containment would be an additional volume of approximately 25.1 SCF from the post-LOCA containment atmosphere. The 

radiological impact of this additional leakage has been determined to be an unacceptable potential safety consequence due 

to limited margin to the design basis limits in areas related to control room habitability and EEQ integrated radiation doses.

A-13
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORYT 

245-97-005 6b POWER LEVEL - 000%. On January 15, 1997, with the plant in the COLD SHUTDOWN condition, it was discovered that 

the Radwaste Storage Building (RSB) vent exhaust fan HVE-14 discharges directly to the atmosphere without continuous 

radiation monitoring. On February 6, 1997, this event was determined to be reportable and a report was made pursuant to 

1 OCFR50.72(b)(1)(ii)(B) as a condition that is outside of the design basis of the plant. The HEPA filter for the exhaust fan 

has not been tested to verify the efficiency of the filter. The airborne activity in the RSB was exhausted directly without an 

operable HEPA filter. Operation of exhaust fan HVE-14 was prevented immediately upon discovery of the event. A review of 

a sample of the Health Physics airborne radioactivity surveys for the RSB has determined that there was no significant 

unmonitored release based on the low levels of airborne activity in the RSB. Prior to returning HVE-14 to service, the HEPA 

filter will be tested and a program for periodic testing of the filter will be established. The Design Change Manual will be 

reviewed to verify adequate design change controls for HVAC systems. 

245-97-007 6a On January 31, 1997, at 0930, with the plant in COLD SHUTDOWN, it was discovered that the Average Power Range 

Monitor (APRM) Flow-Biased High Flux Reactor Scram is credited in establishing the initial conditions for limiting plant 

transients but is not redundant and not single failure proof. This event was immediately reported on January 31, 1997 

pursuant to 10CFR50.72(b)(1)(ii)(B) as a condition that is outside the design basis of the plant. There were no automatic or 

manually initiated safety system responses as a result of this event. The cause of this event is that the loss of stator cooling 

was not sufficiently analyzed, as a potential initiating event for a loss of feedwater heating event, due to programmatic 

weaknesses ensuring adequate engineering review for purchased engineering activities. The safety significance of this 

event is that a single failure which disables the APRM Flow-Biased High Flux Reactor Scram results in the fuel thermal 

limits being exceeded during the transient. However, there were no safety consequences as a result of this event. The 

design will be enhanced to provide an appropriate protective system for this transient prior to startup for operating Cycle 16. 

Millstone Unit No. 1 is currently involved in a 1 OCFR50.54(f) design basis reconstitution effort that would identify past 

design basis inadequacies. The existing QA/QC and Engineering Standards will be reviewed to ensure that adequate 

review and processes are in place for in-house and purchased engineering activities prior to startup for operating Cycle 16. 

245-97-008 3c POWER LEVEL - 000%. On February 3, 1997, with the plant shutdown and the reactor in the COLD SHUTDOWN 

condition, a review of the Gas Turbine Generator (GTG) preoperational test has revealed that the test did demonstrate that 

the starting air receiver does contain sufficient inventory for three starts without recharging, however, the initial start was 

performed at 250 psig and the system pressure has since been maintained between 200 psig and 235 psig. Therefore, the 

starting air system has been operated outside the Plant Design Basis and is being reported in accordance with the 

requirements of 10 CFR 50.73(a)(2)(ii). There were no automatic nor manually initiated safety system responses as a result 

of this event, properly identify and verify the design basis of the GTG air start subsystem and the corrective action is to 

establish the design basis, document it in the UFSAR and verify it by testing. There were no safety consequences as a 

result of this event. The safety significance of this event is low since the GTG air receiver has been demonstrated to contain 

sufficient inventory to provide at least one GTG start each month.

A-14
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

245-97-009 6b POWER LEVEL - 000%. On February 12, 1997, with the plant in COLD SHUTDOWN, a review of a previously completed 

setpoint calculation from October 25, 1994, identified the reactor vessel low-low level Emergency Core Cooling System 

(ECCS) and Primary Containment Isolation System (PCIS) initiation setpoints were potentially non-conservatively set. 

associated with the low-low level ECCS and PCIS initiation functions revealed that the instrument uncertainty error is 

greater than the instrument trip setting band required by Technical Specifications (TS). Therefore, ECCS and PCIS initiation 

could occur beyond the required TS limits. This event was promptly reported on February 12, 1997, pursuant to 

1OCFR50.72(b)(2)(I) as an unanalyzed condition. The ECCS and PCIS low-low level initiation instrumentation was 

determined to be inoperable as a result of this discovery. The cause for exceeding TS limits is the use of an original setpoint 

methodology which did not explicitly evaluate individual contributors to the overall instrument uncertainty. There were no 

safety consequences as a result of this event. The TS will be changed or a new analysis will be performed to ensure that 

ECCS and PCIS actuation will occur consistent with the plant's design basis including consideration of instrument 

uncertainties. All calculations that have been completed as part of the Setpoint Verification Program will be reviewed to 

determine if other non-conservative setpoints exist. 

245-97-012 NRS POWER LEVEL - 000%. On February 14 1997, at 1400 hours, with the plant in COLD SHUTDOWN, a design deficiency 

was identified in the Gas Turbine Generator (GTG) digital control system which could have resulted in misoperation during 

a seismic event. The design deficiency was discovered during the implementation of the corrective actions from the USI 

A-46 seismic review of the GTG where the interface between control system input relays and the digital control system was 

being evaluated. The results of the evaluation indicate a potential for the digital control system to respond to relay contact 

chatter of durations less than 2mS which could render the GTG inoperable. This was immediately reported pursuant to 

10CFR50.72(b)(1)(ii)(B) as a condition that is outside of the plant's design basis. There were no automatic or manually 

initiated safety system responses as a result of this event. There were no safety consequences as a result of this event as 

the relay contacts have never been challenged by a seismic event. The safety significance is that with the GTG in this 

condition, a seismic event could occur that would cause a loss of normal power, and if concurrent with a single failure to the 

diesel generator, subject the unit to a Station Blackout (SBO) condition. The SBO condition has been previously analyzed 

and the safety significance of this event would be minimized as a result of Millstone Unit No. l's ability to negotiate an SBO 

condition as documented in Standard Specification SP-EE-361 in response to 10CFR50.63. Corrective actions include 

implementing a physical modification to resolve this design deficiency.

A-15
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

245-97-013 6b On February 17, 1997, with the plant in COLD SHUTDOWN, it was discovered during a document review that the weight of 

the lower mast sections of the Refueling Platform fuel grapple were not added to the fuel assembly weight, to determine the 

total potential impact load for the design of the spent fuel pool storage racks. When moving fuel in the fuel pool, in the event 

of a single active failure of a hoist component, such as a cable break, could result in a dropped fuel assembly failing with 

portions of the mast onto fuel stored in the spent fuel storage racks or in an empty storage rack cell. In the course of 

reviewing potential interactions between the refueling mast and the spent fuel storage racks, it was also discovered on 

February 24, 1997, that a similar interaction may occur when the mast would be operated over the reactor vessel. In the 

event of a break in the hoist cable, the mast would not reach its full extension and consequently, a portion of the mast could 

remain attached to a dropped fuel assembly and strike the top of the fuel or the reactor vessel internals. These conditions 

were determined to be outside the design basis of the plant and reported on February 18, 1997, and February 25, 1997, in 

accordance with 10CFR50.72(b)(1)(ii)(B). The cause of the event has been determined to be the failure to maintain the 

design basis as stated in the Updated Final Safety Analysis Report (UFSAR) based on a revised analysis by General 

Electric (GE) in 1987. The revised analyses were subsequently performed for postulated drops over the fuel pool storage 

racks and reactor vessel core area. Changes were processed for incorporation of the revised analysis into the Millstone Unit 

No. 1 UFSAR. 

245-97-016 6a POWER LEVEL - 000%. On April 1, 1997, at 1100 hours, with the plant in COLD SHUTDOWN condition, it was discovered 

that during vent/purge operations using the Standby Gas Treatment System (SGTS), the opening and closing sequence of 

the Atmospheric Control (AC) and the SGTS inlet valves (1-SG-1A/B) creates a temporary flow path between the Reactor 

Building and primary containment prior to isolation of the AC system. The flow escaping into the Reactor Building through 

this path during a Loss of Coolant Accident (LOCA) could be sufficient to lift the blow-out panels in the Reactor Building, 

especially if purging/venting was conducted with the 18' AC valves. Since the differential pressure (DP) in the Reactor 

Building would be at the 6 in Wg relief pressure of the panels, 1OCFR100 limits would be exceeded before the SGTS could 

restore the -.25 in Wg DP and begin filtering the release. The potential safety consequences of this condition is a loss of 

safety function since without secondary containment, SGTS would be unable to mitigate the consequences of a LOCA. It 

should be noted that, Technical Specification 3.7.B.3.6 requires primary containment to be purged through SGTS whenever 

primary containment is required. The potential to pressurize the Reactor Building during vent/purge evolutions results from 

the fact that the design of the SGTS system did not consider a LOCA coincident with these operations. This event is 

considered outside the plant's original design basis.

A-16
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-17

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

245-97-018 6a POWER LEVEL - 000%. On February 24,1997, with the plant in COLD SHUTDOWN, a review of the as-left limit switch 

settings of valves that have a torque switch bypass feature indicated that four valves may not fully isolate a downstream 

pipe break. These four valves have a spring pack compensator which allows the stem to move upward during the closing 

valve stroke. This movement was not accounted for in determining the physical location on the valve seat where the valve 

disc would stop. the valve seats, thus not isolating the flow through the valve, before the bypass of the torque switch is 

electrically removed and the valve is assumed to stop. These valves (1-IC-1, 1-IC-4, 1-CU-2 and 1-CU-28) isolate the 

Isolation Condenser system and the Reactor Water Cleanup systems respectively. This condition was immediately reported 

as outside the design basis of the plant on February 24, 1997. The cause of the event is the lack of adequate design 

change process guidance and limited vendor and industry documentation availability. To prevent reoccurrence, a design 

change to compensate for the potential upward movement of the stem nut and stem during a high energy line break 

condition is required. This will include adjusting the close torque switch bypass percentage setting in the field. This 

corrective action will be completed prior to startup for operating Cycle 16. 

245-97-024 3a POWER LEVEL - 000%. On April 9, 1997, with the plant in COLD SHUTDOWN and fuel off-loaded, a review of a breaker 

panel design calculation identified several breaker to breaker coordination problems associated with the 125 VDC system. 

The loss of safety to non-safety isolation is due to the miscoordination between breakers 101 B-29 (normal) or 101 A-30 

(emergency) and the other panel 11 A-1 breakers. Also, 101A-31 (normal) or 101B-30 (emergency) and panel 11A-2 

breakers do not coordinate. Both 125 VDC panels supply safety and non-safety related loads. The fault current due to 

failure of a non-safety related component on either bus would over trip the upstream safety related feeder breaker. This 

over trip event would prevent safety related loads on panels 11 A-1 and 1 1A-2 from performing their safety related function. 

The potential safety significance of this condition is that the mis-coordination of breakers results in the loss of safety to 

non-safety isolation which could trip the panel supply breaker. The panels were evaluated to determine that 1 1A-1 and 

11 A-2 are functional for the current plant conditions. The panels will be reviewed and modified to eliminate the breaker to 

breaker mis-coordination. This event was reported pursuant to 10 CFR 50.72(b)(2)(1) as an unanalyzed condition that 

significantly compromises plant safety.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-18

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORYF 

245-97-026 6a POWER LEVEL - 000%. On April 14, 1997, with the plant shut down and the reactor in the COLD SHUTDOWN condition, it 

was discovered based on a historical review that a significant amount of coating work inside the Millstone Unit 1 Torus may 

be unqualified. A number of different coating materials and systems have been used inside the Torus. The locations and 

extent of various coating systems is not clear. The potential safety consequence of this condition is that these coatings may 

not remain in place and intact after a loss of coolant accident (LOCA) and could compromise Engineered Core Cooling 

Systems (ECCS) recirculation flows. This unanalyzed condition was reported on April 16, 1997, pursuant to 

1OCFR50.72(b)(2)(l). An above waterline survey of the Torus will be performed to establish the present condition of the 

coating systems as applied based on sampling and testing to enable their precise or generic identification. The need for a 

hydrodynamic transport analysis will be evaluated to potentially determine the affect of delamination of coatings within the 

Torus on ECCS recirculation flows. The results of the survey will be used to determine the need for additional surveys and 

to evaluate the various coating materials and systems within the Torus. The results of the survey and the potential 

hydrodynamic analysis will be evaluated and, if required, sections of the Torus will be recoated. 

245-97-027 6B On April 23, 1997, with the plant shutdown, the reactor in the cold shutdown, and the fuel off-loaded, it was found that some 

molded case circuit breakers in safety related Motor Control Center (MCC) compartments do not have adequate current 

interruption capability. The breakers in the MCC compartments are sized to protect the cable downstream of the MC by 

being able to interrupt the currents from short circuits occurring within or downstream of the motor control center. This event 

was prompt reported on April 23, 1997, pursuant to 10 CFR 50.72 (b)(1)(ii)(B) as a condition that is outside the design basis 

of the plant. No safety consequences have resulted from this event. A review has been completed to identify all circuit 

breakers requiring a design review. A design review will document the current interrupting capability of the existing safety 

related MCC breakers, compare the interrupting current with the calculated short circuit current of the MCC for each 

breaker.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-19

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

245-97-028 3a On April 24, 1997, at 1300 hours, with the plant in the COLD SHUTDOWN condition, an engineering review of a previously 

prepared Failure Modes and Effects Analysis determined that there existed several Non-QA components and circuits whose 

postulated failure could adversely affect the ability of safety related components or systems to perform their required safety 

functions. The following safety related components or systems were affected: Diesel Generator (DG), Gas Turbine 

Generator (GTG) and Feedwater Coolant Injection System (FWCI). This event was promptly reported on April 24, 1997, 

pursuant to 10CFR50.72(b)(2)(l), as an unanalyzed condition that seriously compromises plant safety. There were no actual 

safety consequences as a result of this event. A review of systems to identify and resolve design basis discrepancies is 

ongoing as part of the design basis verification program to address 10CFR50.54(f) concerns. The specific failure modes 

identified affecting the DG, GTG, FWCI will be corrected by plant changes or analysis. Engineering guidance delineating the 

detailed requirements for application of the single failure criterion will be prepared and training on the proper application of 

the single failure criterion will be conducted for personnel identified by the Manager, Design Engineering. All non-QA 

electrical interfaces with a safety system will be evaluated to assure that the ability of the safety systems to perform their 

required safety functions will not be affected. 

245-97-033 6a On August 1, 1997, at 1300 hours, with the plant in COLD SHUTDOWN, it was determined that several conditions existed 

on site which could create potential unmonitored airborne radioactivity release paths. As an example, roll-up doors in the 

turbine and solid radwaste buildings are opened at times without appropriate process controls in place to provide a method 

of monitoring the pathway for potential releases. Additionally, walkarounds have identified several structural openings in the 

turbine hall, and documentation indicating an airborne release evaluation is not apparent. The cause of this condition was 

the lack of an adequate monitoring program. The immediate corrective action was to place low volume air samplers at the 

areas in question. The work control administrative procedure has been revised with appropriate process controls in place to 

provide a method of monitoring of pathways for potential releases. Radiological assessments of these conditions will be 

performed and a structured monitoring program developed based on the assessment prior to startup from this refueling 

outage.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

245-97-034 6a On August 12, 1997, at 1500 hours, a deficiency was identified with the original assumptions for a postulated High Energy 

(MULTI-UNIT Line Break (HELB) in the Millstone Unit No. 2 Main Steam System. The Architect Engineering firm (A&E), Bechtel, 

APPLICABILITY) performed the original analysis assuming that the limiting HELB occurred in a 12-inch steam line leading to the Main 

Turbine bypass valves. Postulated breaks downstream of the Main Turbine stop valves were not analyzed since it was 

assumed that the stop valves would rapidly close and terminate blowdown. This assumption was not conservative since 

there is a time delay before the stop valves receive a signal to close. The increase in time required for the valves to close 

results in more limiting breaks downstream of the stop valves which significantly increases calculated pressure in the Unit 2 

Turbine Building. The door on the South side of the Unit No. 2 Turbine building could fail due to the higher pressure 

reached during the accident. This door leads to a corridor between the Unit 1 Turbine Building and the Unit 2 Turbine 

Building which could allow steam from the HELB to enter the switchgear room for the Unit 1 Emergency Onsite Power 

Supply System. The cause of this condition was an incorrect assumption for HELB analysis performed by the A&E, which 

was not identified during the original licensee review of the analysis. Engineering will evaluate the replacement of door 

203-31-001 with a HELB door, the need for blowout panels in the Unit 2 Turbine Building external siding, and qualifying 

other paths and barriers between Unit 1 and Unit 2 prior to Unit 2 entering Mode 4. An adequacy review will be conducted 

of HELB barriers in Unit 1 for Unit 2 HELB events by March 1, 1998. A review of the Unit 1 HELB analysis will be conducted 

and the analysis revised as required for issues similar to those described in this LER by March 1, 1998. 

245-97-036 6a On September 29, 1997, with the plant in the COLD SHUTDOWN condition, through configuration management efforts 

ongoing in response to the 50.54(f) letter, it was determined that the fire pump house was vulnerable to flooding in a 

Postulated Maximum Hurricane (PMH) event. The Fire Water system provides makeup for the Isolation Condenser system 

during design basis flooding conditions. The flood protection actions to prevent flooding during a PMH are contained in Off 

Normal Procedure ONP-514A, "Natural Occurrences". This procedure outlines the requirements to plug floor drains and 

close flood gates 12 hours prior to the anticipated arrival of a hurricane. The building contains a total of three drains which 

provide the potential for flooding. Two of the three are traditional floor drains which are addressed by ONP-514A and 

plugged. The third drain path is a pressure relief fitting on the discharge of the relief valve from the Diesel Fire Pump which 

is not included in the procedure. The cause of this event was a weakness in the design change process in place in the early 

80's which failed to identify this potential leakage path while modifying the building to provide flood protection. NNECO will 

evaluate the shutdown path for the PMH event, inspect the fire pump house to identify any additional leakage paths, and 

implement a plan to address the specific leakage path identified prior to restart.

A-20
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-21

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

245-97-038 NRS On October 8, 1997, at 1430 hours, with the plant in COLD SHUTDOWN, it was determined that the Reactor Building roof was not analyzed for the Millstone Unit No. 1 seismic Shutdown Earthquake (SSE). The roof decking and welds to the roof 

steel were designed to transfer horizontal shear loads for the Operating Basis Earthquake (OBE). The existing welds are at 

their full capacity based on the OBE analysis, and the higher SSE loads have not been addressed. It is expected that the 

welds would exceed the code allowable stresses during the SSE loads. The function of the Reactor Building roof is to 

enclose the reactor and associated equipment and to provide secondary containment. The cause of this condition is failure 

to analyze the Reactor Building roof for the higher loads during a SSE due to a limited sampling method used during the 

assessment of the seismic capacity of the facility. Administrative controls are in place to prevent fuel movement until the 

Reactor Building roof has been qualified for the SSE. An analysis of the Reactor Building roof will be performed for the SSE 

loads and potential modifications made to the roof prior to startup from this refueling outage. 

245-97-039 3a On October 31, 1997, at 1020 hours, with the plant in COLD SHUTDOWN, it was discovered during a review of industry 

events that a valve alignment could exist during primary containment purging which would create a flow path that would 

allow the steam released during a Loss Of Coolant Accident (LOCA) to bypass the suppression pool if the inboard 

containment isolation valves fail to close. This bypass flow path could degrade the pressure suppression function of the 

suppression pool and possibly over-pressurize the containment. This valve alignment occurs when inerting or purging the 

drywell and suppression chamber simultaneously during plant startup or shutdown. The root cause was a design error, in 

that no interlock precluded the bypass flow path, nor did design output or the Updated Final Safety Analysis Report caution 

against this alignment. The operating procedures permitted simultaneous purging or inerting of the drywell and suppression 

chamber. Appropriate system operating procedures will be revised prior to startup from this outage to prohibit simultaneous 

opening of the drywell and suppression chamber inboard isolation atmospheric control valves whenever primary 

containment is required. A change to the UFSAR will be made to specify that the inboard isolation valves may not be 

operated in a manner that would provide a flow path that would bypass the suppression pool prior to startup from this 

outage. The potential for other lineups that may result in a similar bypass flow path Will be evaluated prior to startup from 

this outage.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

1 247-97-006 6a POWER LEVEL - 100%. On March 20, 1997, with reactor power at 100 percent, non-operations personnel were 

(Indian Pt. 2) transporting scaffolding materials through the pipe penetration area (PPA) to the electrical penetration area (EPA). A door 

between these two areas was held open longer than needed for personnel passage to facilitate the transfer of the scaffold 

materials. This door is an environmental barrier intended to preclude postulated design basis accident harsh environments 

from entering the EPA. This area has not been evaluated or qualified for harsh environs per 1 OCFR50.49. The result of 

keeping the door to the EPA open longer than needed for personnel passage is the that the EPA becomes unanalyzed for 

that period of time. Nuclear Plant Operators (NPO's), as part of their routine inspections, check that the door remains in the 

closed position. This activity is procedurally required to be performed four times a day (approximately, every 6 hours). The 

door was immediately closed once discovered by a nuclear plant operator on routine tour of the plant. The plant remained in 

operation throughout this event. 

247-97-013 6B On June 8, 1997, with the reactor at zero percent power and the plant in cold shutdown, it was determined that test data 

pertaining to the "as found" lift set points for pressurizer safety valves did not meet the test acceptance criteria as required 

by Technical Specification 3.1.A.3.c and American Society of Mechanical Engineers (ASME) Section XI, OM-1. An 

evaluation of the effect from "as-found" safety valve setpoints on various postulated accident response and outcomes has 

been completed, and indicates that the Updated Final Safety Analysis Report (UFSAR) analysis would remain bounding for 

the worst case safety valve setpoint of 2581 psig. During the 1995 Refueling Outage (RFO) a plant modification 

permanently removed the pressurizer enclosure roof. The temperature effect of removing the pressurizer enclosure roof 

combined with a subjective definition of "ambient temperature," per the requirement of recently implemented Section XI, 

OM-1, resulted in the 1995 temperature test criteria not being reflective of the as installed environment. 

247-97-015 5c During the 1997 refueling outage, Con Edison personnel recognized that a check-off list specified the closed, rather than 

the open, position for manual valve 1863, which is in a high-head recirculation alternative flow path described in the 

UFSAR. Valve 1863 must be opened to provide a flow path for core decay heat removal in the event of multiple active 

failures of safety related equipment or a passive failure of the suction piping to the safety injection pumps. Certain accident 

scenarios have the potential for excessive post-accident radiation fields in the areas which provide access to the valve and 

at the location of the valve. This could render the flow path unavailable for use, if required, as the valve could not be 

accessed to be opened. The position of valve 1863 was changed to "open"prior to restart from the 1997 refueling outage. 

Further, a modification was completed on valve MOV-883 to address the concern of a single failure in an electrical system 

resulting in loss of capability to perform a safety function in accordance with Branch Technical Position EICSB 18. The 

Corrective Actions section identifies the completed, and ongoing activities. The currently ongoing corrective actions are 

scheduled for completion by March 1, 1999.

A-22
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT CATEGORY[1 

247-97-022 6b On October 28, 1997, with the unit in cold shutdown mode, Westinghouse informed Con Edison, along with other utilities, of 

issues regarding fuel rod internal pressure (RIP), the status of the Westinghouse PAD code, and concerns with fuel rod 

design criteria. When initially notified, Con Edison was advised that Westinghouse could not preclude the possibility that 

plants with Zircaloy-4 clad integral burnable absorber fuel (IFBA) may be outside their design criteria due to fuel clad gap 

reopening, in that the 17 percent maximum cladding oxidation limit, as delineated in 10 CFR 50.46, may be exceeded. 

Since that time, and based on the LOCA analyses which have been performed to date by Westinghouse, an initial pre

transient 12 percent oxidation has been established as a screening criteria to permit assessment of plants regarding 

compliance with the 17 percent maximum cladding oxidation criterion of 10CFR 50.46. Based on the screening criteria, 

plants with IFBA rods in the first half of their operating cycle or returning from a refueling outage are determined to be in 

compliance due to either no gap reopening or low levels of pre-transient oxidation due to steady-state corrosion 

accumulation. Subsequent communication from Westinghouse indicates that a plant specific fuel rod performance 

assessment has been completed for Indian Point Unit 2 Cycle 14. Specifically, Westinghouse has informed us that the 

Indian Point Unit 2 Cycle 14 Reload Safety Evaluation (RSE) continues to remain valid through 23110 MWD/MTU. 

250-97-005 NRF During planning for a modification, Florida Power & Light Company determined that the design of the Reactor Coolant 

(MULTI-UNIT Pump (RCP) Oil Collection System does not capture leakage from all potential leakage sites. Specifically, the level 

APPLICABILITY) switches, their associated piping flanges, the level sightglasses, and the lube oil cooler piping drain are not protected from 

(Turkey Pt. 3) being potential leakage sites, and are not provided with leakage collection. This condition places both Turkey Point units 

outside the design basis as stated in the Updated Final Safety Analysis Report. The original RCP Oil Collection System 

design did not consider these component parts to be potential leakage sources. The NRC's Safety Evaluation Report 

approving Turkey Point's Oil Collection System was received several months prior to the time that 10CFR50 Appendix R 

was issued. It appears that when Appendix R was issued, the design was not reconciled with respect to the exact wording 

of section 111.0. The Oil collection System will be modified to collect potential leakage from these points. In the interim, the 

Oil Collection System is considered operable. 

250-97-008 3a On September 9, 1997, Turkey Point Unit 4 was in Mode 5 in preparation for a refueling. Inspection of the containment 

(MULTI-UNIT recirculation sumps revealed several gaps and a hole in the sump screens which were in excess of the design 

APPLICABILITY) requirements. On September 11, a similar condition was found on Unit 3 while in Mode 1. The gaps would allow debris 

larger than 3/8 inch to enter the flow stream to the containment spray nozzles, during the recirculation phase following a 

loss of coolant accident. Therefore, the screen damage resulted in both units operating outside the design basis. The 

causes of this event were inadequate procedural guidance, and personnel error (utility non-licensed personnel). The Unit 3 

screen was repaired on the spot. The Unit 4 screens have also been repaired. FPL is clarifying the containment 

recirculation sump screen design basis. Additional procedural guidance is being developed to verify containment 

recirculation sump screen design details. Discussion of the event will be incorporated into the continuing training program at 

Turkey Point.

A-23
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-24

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

251-97-001 5c POWER LEVEL - 100%. On March 27, 1997, Florida Power & Light Company's Turkey Point Unit 4 was operating in Mode 

(Turkey Pt. 4) 1 at 100% power. At 1440 hours eastern standard time an engineering evaluation found leakage on the 4A high head safety 

injection pump casing joint to be outside the design basis for recirculation loop leakage. The cause was believed to be a 

leaking gasket. While torquing the casing bolts at the leak location, the leak increased significantly to a level determined to 

be outside allowable limits. With the static head of the refueling water storage tank, the estimated leakage was 38 liters per 

hour. The limit used was that which could cause exceeding the dose criteria of General Design Criterion 19 dose levels. 

The leak was repaired using injection sealant, and the pump was returned to operable status. On April 3, 1997, at 2030 

hours, the 4A safety injection pump was discovered leaking at about 3.4 liters per hour while the pump was running. The 

pump casing gasket was replaced to return the pump to operability. The NRC operations center was notified after each 

event in accordance with 10 CFR Section 50.72(b)(1)(ii)(B), 'condition that is outside the design basis of the plant.' The April 

3 event was retracted. 

254-97-002 6b POWER LEVEL - 100%. On 012797, with both Units in Mode One at 100% power, it was determined that several isolable 

(MULTI-UNIT piping sections could experience stresses above Updated Final Safety Analysis Report Allowables due to Post-Loss of 

APPLICABILITY) Coolant Accident thermal pressurization. In response to NRC Generic Letter 96-06, several calculations were performed to 

(Quad City 1) evaluate piping and containment penetrations for thermal over pressurization caused by a Main Steam Line Break 

(MSLB)/Loss of Coolant Accident(LOCA). These calculations identified five penetrations(per Unit) that could experience 

over pressurization under accident conditions. The affected piping systems include: Reactor Building Closed Cooling Water, 

Reactor Recirculation Sample lines, Residual Heat Removal, Reactor Water Clean-up, and Clean Demineralized Water. 

The affected piping sections were determined to be operable, but degraded. The cause of the event was inadequate 

original design. Based on the results of the operability assessment, there is minimal safety significance to the station or the 

health and safety of the public as a result of this event. The affected penetrations would maintain containment integrity 

following an accident. In the event of an accident, any radiological release would remain within analyzed limits. The 

corrective actions taken to resolve this issue are being developed and will be provided in a supplemental report.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-25

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

254-97-006 NRF POWER LEVEL - 000%. On 032797, during a review of a Problem Identification Form (PIF) written on 022796, station 

(MULTI-UNIT personnel concluded that the PIF had been incorrectly dispositioned as non-reportable due to incomplete understanding of 

APPLICABILITY) the Quad Cities Appendix R Safe Shutdown Analysis. Appendix R Conformance Safe Shutdown Analysis (SSA), plant 

personnel discovered that the Reactor Water Cleanup (RWCU) system had been identified as a high/low pressure interface 

requiring isolation during certain design basis fires. However, no actions to isolate the RWCU system during a fire were 

included in the safe shutdown procedures due to a cognitive personnel error on the part of the procedure writer. Failure to 

properly isolate the RWCU system during a design basis fire could have prevented station operators from attaining safe 

shutdown prior to reactor level reaching the top of active fuel. The potential blowdown path was resolved by turning off the 

power feed breaker to the normally closed RWCU blowdown orifice bypass valve M01(2)-1201-76. All other high/low 

pressure interface paths were reviewed to ensure that each was resolved correctly. This event had the potential to pose a 

safety concern in the unlikely event of a design basis fire. 

255-97-008 NRF On September 12, 1997, at approximately 1330 hours, with Palisades operating at approximately 100% power, an 

(Palisades) Appendix R Program Engineering Analysis was discovered to have failed to properly evaluate the potential for spurious 

opening of Service Water (SW) cross-tie valves (CV-0879, CV-0880 and CV-0951). These three valves supply backup SW 

to cool Engineered Safeguards pump seals and bearings if a loss of Component Cooling Water (CCW) would occur. 

Specifically, a fire in one of several areas could result in a single spurious opening of any of these valves which could 

potentially result in a loss of CCW inventory to the lower pressure SW System. This condition was found during a planned 

review of Appendix R Program engineering analyses. This review determined the analysis contained errors which could 

potentially place the plant in a scenario which was not specifically addressed in the Appendix R program analyses. This 

event is reportable to the NRC in accordance with 10 CFR 50.73(a)(2)(ii)(B) as a condition outside the plant design basis. 

This Appendix R issue is reportable because the analysis failed to identify a condition which could potentially result in a loss 

of CCW inventory due to a fire in certain fire areas. This loss of CCW would jeopardize the ability to achieve the 10 CFR 50, 

Appendix R, Part Ill, L required plant conditions.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

255-97-009 NRF On September 23, 1997, at 1105 hours with the plant at approximately 100% power, it was recognized that an operator action to support an Appendix R program analysis had not been implemented in the appropriate Off-Normal Procedure 

(ONP). Specifically ONP 25.2, "Alternate Safe Shutdown Procedure" did not include the action to trip all four primary coolant pumps if the control room had to be evacuated. Instead, the procedure directed the control room operators to "...trip 

two primary coolant pumps and leave two operating ... " Once the control room is evacuated, no instrumentation is identified 

to provide the operational status of the primary coolant pumps or the status of the component cooling water to the primary coolant pump motor and seals. It has been identified that a fire-initiated hot short could cause one of the component cooling 

water containment isolation valves to spuriously close, isolating cooling flow to the primary coolant pumps. Palisades' 

primary coolant pump operation has not been analyzed for operation without seal or motor bearing cooling. The 

manufacturer indicates that no damage to the seal or pump motor will occur if operated without cooling for no more than ten 

minutes. ONP 25.2 has been revised to require tripping of all four primary coolant pumps when evacuating of the control room. Having not implemented the action to support the analysis is contrary to 10 CFR 50 Appendix R direction that during 

post fire shutdown, the fission product barrier shall not be affected, i.e. there shall be no rupture of primary coolant 

boundary. This is reported as a condition outside of the plant's design basis. 

255-97-010 NRF A 10 CFR 50, Appendix R analysis concluded the simultaneous opening of two main steam line atmospheric steam dump valves (ASDVs) required termination of the steam generator blowdown by local manual actions within ten minutes. In the 

analysis, opening of two of the four main steam ASDVs occurred spuriously from a hot short. Recent reviews of the 

Appendix R analysis determined it should have accounted for all four main steam ASDVs and the turbine bypass valve 

(TBV) spuriously opening. A new evaluation indicates that local manual actions must be completed within six minutes to 

close the ASDVs in the event of the Appendix R fire scenario resulting in all four ASDVs and the TBV opening. A 

walk-through verification concluded that the ASDVs could be closed within six minutes. The procedure has been revised 

and operator training of the procedure revision has been completed. This event is reportable in accordance with 10 CFR 

50.73(a)(2)(ii)(B) as a condition outside the plant design basis. The earlier Appendix R analysis contained errors which 

could have potentially placed the plant in a scenario which was not addressed with approved procedures. 

259-97-001 6b POWER LEVEL - 000%. On February 3, 1997, with Units 2 and 3 at approximately 29 percent and 83 percent power, (MULTI-UNIT respectively, and Unit 1 shutdown and defueled, a TVA engineering evaluation determined that during a design basis APPLICABILITY) accident a pipe which penetrates the containment is susceptible to thermal over pressurization stresses resulting in pipe (Browns Ferry 1) stresses in excess of BFN UFSAR allowable stresses. The cause of this condition results from a potentially filled and 

isolated pipe that penetrates the containment and is susceptible to thermal expansion during some design basis accident 

conditions. The corrective action to resolve this condition is to revise plant procedures to ensure that a sufficient quantity of 

water is drained from the affected pipe at the end of an outage. This report is being submitted in accordance with 10 CFR 

50.73 (a)(2)(ii)(B) as a condition outside design basis of the plant. No Previous LERs on similar events were identified.

A-26
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY I 

259-97-003 6a On May 12, 1997, during a review of industry reportable events, a valve alignment was identified which could, if a Primary 

(MULTI-UNIT Containment Isolation System (PCIS) Division I failure occurred, create a flow path that would allow the steam released 

APPLICABILITY) during a loss of coolant accident (LOCA) to bypass the suppression pool, degrading the pressure suppression function of 

the containment. This valve alignment occurs when inerting or purging the drywell and suppression chamber simultaneously 

during plant startup and shutdown. A subsequent analysis of the design basis LOCA showed that peak containment 

pressure could exceed the maximum design pressure of 62 psig while in this configuration if Division I of the PCIS failed. If 

Division I of PCIS isolates as designed, containment design pressure would not be exceeded. Appropriate procedures have 

been changed to prohibit this alignment except during cold shutdown conditions. This report is submitted in accordance with 

10 CFR 50.73 (a)(2)(ii)(B) as any event or condition that resulted in the nuclear power plant being in a condition that was 

outside the design basis of the plant. 

259-97-004 3b On June 24, 1997, BFN engineering personnel identified an apparent inconsistency between the BFN FSAR and the plant 

(MULTI-UNIT Technical Specification 3.5.C, RHR (Residual Heat Removal) Service Water and Emergency Equipment Cooling Water 

APPLICABILITY) (EECW) Systems, regarding the number of Residual Heat Removal Service Water (RHRSW) pumps required to remove 

heat from a unit following a design basis accident. The BFN FSAR states that two RHRSW pumps per unit are required to 

serve the core and containment cooling function following a design basis accident. There are eight pumps that can be 

aligned to RHRSW service. The current BFN Technical Specifications for the RHRSW system require a total of seven, five 

and four pumps to be operable and assigned to RHRSW service with three, two and one units fueled, respectively. Since 

two RHRSW pumps are supplied from emergency diesel generator A and two are supplied from emergency diesel 

generator B, then the potential exists for a single failure of diesel generator A or B to reduce the number of available 

RHRSW pumps to less than the number required by the FSAR for the case of two or three unit operation. Immediately upon 

the discovery of this condition, administrative controls were implemented to require two operable RHRSW pumps per unit. 

On October 10, 1997, after completing an analysis that confirmed the validity of the RHRSW pump requirements as stated 

in the FSAR, this condition was reported to NRC in accordance with 10 CFR 50.73(a)(2)(ii)(B) as a event or condition that 

resulted in the nuclear plant being in a condition that was outside the design basis of the plant. A request for a change to 

Technical Specification 3.5.C will be submitted to the NRC to correct the non-conservatism.

A-27
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

260-97-006 2b On October 19, 1997, at 1629 hours CDT, TVA declared the Unit 2 High Pressure Coolant Injection (HPCI) system 

(Browns Ferry 2) inoperable as a result of a HPCI turbine inlet steam line drain pot high level. As required by Technical Specifications (TS), 

TVA entered a seven day Limiting Condition For Operation (LCO) for an inoperable HPCI system. On October 21, 1997, at 

0650 hours following successful completion of the cold start portion of Surveillance Instruction, HPCI Flow Rate Test At 

Normal RPV Pressure, the Unit 2 HPCI system was returned to standby readiness and declared operable. TVA's 

investigation into the cause of this event was inconclusive. As part of Unit 2 Cycle 9 Outage, TVA replaced the turbine 

steam supply valve, which is located downstream of the HPCI turbine inlet steam line drain pot, as well as the steam trap, 

and steam trap bypass valves which are both located downstream of the HPCI turbine inlet steam line drain pot. During the 

replacement of the turbine steam supply valve the retaining welds were removed with an abrasive cutting tool. It is believed 

that during the removal operation fines may have entered the system. Corrective actions will include a review the 

maintenance and modification processes and procedural controls. If necessary, the controls will be modified. TVA intends to 

replace the Unit 3 HPCI turbine steam supply valve during the next scheduled Unit 3 refueling outage. The modification 

package that will replace the valve will provide instructions to ensure that the affected piping is inspected following the 

activity. TVA is providing this report in accordance with 10 CFR 50.73(a)(2)(v), as an event or condition that alone could 

have prevented the fulfillment of the safety function of a structure needed to mitigate the consequences of an accident. 

261-97-005 6a On April 22, 1997, with H. B. Robinson Steam Electric Plant (HBRSEP) 3 Unit No. 2, operating at 100% power, the results 

(H.B. Robinson) of an investigation revealed that certain spent fuel shipping cask handling activities had been conducted outside the design 

and licensing basis of the plant. Specifically, a IF-300 spent fuel shipping cask is configured for fuel loading by removing the 

cask valve box covers. The loaded cask is then lifted with a non single failure proof crane decontamination facility to the 

cask rail car, where the cask valve box covers are then installed. Lifting the cask with the non-single failure proof crane with 

the valve box covers removed is not covered by the shipping configuration drop analysis. An evaluation was completed that 

concludes this condition represents an unreviewed safety question. Accordingly, this report is being submitted in 

accordance with 10 CFR 50.73(a)(2)(ii) as a condition outside the design basis of the plant. There have been no significant 

adverse safety consequences associated with this condition. A postulated spent fuel shipping cask drop with the valve box 

covers removed could lead to an off-site release that exceeds the "no release" result of a cask drop specified in the 

licensing basis. However, results of the final evaluation, completed on July 14, 1997, concluded that the off-site doses 

resulting from a postulated cask drop with a less than fully ,secured cask are a small fraction of the 10 CFR 100 limits and 

the acceptance criteria in the Standard Review Plan. This condition was caused by inadequate evaluations for cask 

handling procedures. Personnel conducting these evaluations failed to identify the limitations of the drop analysis as it 

applied cask handling operations, versus shipping configuration accident conditions. Procedures for spent fuel cask 

handling operations have been administratively placed on hold, pending resolution of this condition.

A-28
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

261-97-006 NRF On May 21, 1997, with H. B. Robinson Steam Electric Plant, Unit No. 2 operating at 100% power, engineering personnel 

discovered that auto-start and manual start cables for Safety Injection (SI) Pump C were routed in the same cable tray 

stack as the auto-start cables for SI Pumps A, and B (when aligned in the safety Train A configuration), a condition outside 

of the design basis of the plant. A modification was implemented on May 25, 1997, that replaced the cables in new routes 

that achieved normal design basis separation. This condition was caused by an original plant design installation error. 

There have been no significant adverse safety consequences associated with this condition. The results of a review 

concluded that the cable routing error did not introduce a condition that had significant adverse safety consequences. A 

review of other SI pump cables was performed, and additional deviations to the redundant cable separation criteria that 

were identified were dispositioned. Current electrical installation practices provide conservative separation criteria that is 

based on the concepts of safety train separation. Additional emphasis will be placed on incorporating the review of electrical 

separation during appropriate engineering self-assessments. 

261-97-007 5b On June 10, 1997, with the H. B. Robinson Steam Electric Plant (HBRSEP), Unit No. 2 operating at 100% power, plant 

operators noted that the Reactor Protection System (RPS) Over Power Delta-Temperature (OPDT) channels were not 

responding properly, and at 1101 hours, declared the OPDT channels inoperable. The NRC Operations Center was notified 

of this condition at 1155 hours pursuant to 10 CFR 50.72(b)(1)(ii)(B). An investigation determined that the circuit for the 

OPDT summator in each of the three RPS loops was not properly calibrated. This event is attributed to inadequate 

programmatic controls which led to a personnel error. In 1979, personnel failed to specify the low limit setpoint for the 

summator on the data sheet used for the calibration. As a result, the OPDT channels were not calibrated using the proper 

setpoint. The safety significance of this event is minimal. Although the OPDT trip function is required by Technical 

Specifications, it is an additional trip which is available, and is not credited in the safety analyses. Procedure and calibration 

data sheet changes were implemented specifying the correct low limit setpoint, and the OPDT channels were re-calibrated 

and placed back in service on June 10, 1997. This event was reviewed by Maintenance Instrumentation and Control (I/C) 

craft personnel, Maintenance Unit I/C procedure writers, and Operations shift personnel. A review was performed to 

determine which summators in the RPS required high and low limits to be set, and calibration data sheets were reviewed 

and verified to ensure the limits are specified. This report is submitted in accordance with 10 CFR 50.73 (a)(2)(ii) as a 

condition that was outside the design basis of the plant. __________ J. ________ A

A-29
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT CATEGORY 

261-97-008 3a A review of calculations related to the available Net Positive Suction Head (NPSH) for the Safety Injection (SI) system 

determined that following a postulated large break Loss of Coolant Accident (LOCA), and assuming a single active failure of 

one SI pump, the remaining operating SI pump might not have sufficient NPSH under certain operating equipment 

configurations to respond to a design basis accident. The NRC Operations Center was notified of this condition on June 27, 

1997, at 1152 hours. This condition was caused by personnel error. Personnel involved in a 1988 design change to the SI 

system did not adequately assess the impact of a single pump on SI system flow and pump NPSH requirements. Assuming 

a single failure, failure of the other Sl pump could lead to increased fuel cladding temperatures and fuel damage during a 

LOCA, which could result in an increase in consequences beyond those considered in the current safety analysis. 

Therefore, during the period of inadequate available NPSH, the plant operated in a condition outside of the design basis. 

Modifications have been implemented to assure adequate NPSH is available to respond to a design basis event. ECCS 

flow modeling and calculations were completed on November 24, 1997, to document the capability of the ECCS system's 

pumps to perform their design functions. The SI system piping will be modified to gain additional NPSH margin during the 

next outage of duration, but prior to startup from Refueling Outage 18. Assessments of other systems will be conducted and 

will include evaluation of system modifications and related design calculations for potential inadequacies. 

261-97-010 5c On August 20, 1997, at approximately 1544 hours, plant operations personnel determined that the output breaker control 

switch for the "B" Emergency Diesel Generator (EDG-B) was in the tripped position. In the tripped position, the breaker 

would not be able to supply power to the associated emergency bus. The switch was immediately returned to the neutral 

position. During the time the EDG-B was considered inoperable, certain equipment in its redundant train did not meet the 

TS definition of OPERABILITY, a condition prohibited by TS. Operations personnel applied Technical Specifications (TS) 

Section 3.0 to this condition, which requires the plant to be placed in hot shutdown within eight hours and in cold shutdown 

within the next 30 hours. This condition also represents a condition that was outside the design basis of the plant. The NRC 

Operations Center was notified of this condition on August 20, 1997, at 1634 hours. Investigation of this event could not 

determine the specific cause of the switch mispositioning. A check of other selected switches in the plant was performed to 

verify they were in the correct position and to detect other evidence of tampering. A review of other switches outside the 

control room that could disable safety significant equipment without giving indication or annunciation in the control room will 

be completed, and a method will be provided for protecting and periodically checking the positions of these switches. 

Training will be provided to plant personnel on the switches outside the control room that could disable safety significant 

equipment without giving indication or annunciation in the control room. This report is submitted in accordance with 10 CFR 

50.73(a)(2)(ii)(B) as a condition that was outside the design basis of the plant, and 10 CFR 50.73(a)(2)(i)(B) as a condition 

prohibited by the plant's TS.

A-30
1997 Licensee Event Reports with Design-Basis Issues (Continued)

ILER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

263-97-003 6b POWER LEVEL - 100%. During the assessment of Generic Letter 96-006, it was determined that during certain accidents 

(Monticello) several primary containment penetrations could exceed the allowable stresses specified in the Updated Safety Analysis 

Report. These design errors were made by the original architect engineer and not identified by subsequent plant reviews. 

Installation of a permanent pressure relieving device will be pursued for these penetrations. 

263-97-007 6a POWER LEVEL - 100%. After reviewing an LER from Quad Cities Nuclear Station, it was discovered that the net positive 

suction head available for the core spray pumps was less than required. Two issues were identified: increased head losses 

associated with the ECCS suction strainers and a more limiting net positive suction head case. These issues were 

determined to be applicable to Monticello. An operability evaluation determined that the pumps were still operable. 

Following evaluation of an additional issue, debris generation from the drywell piping insulation during post design basis 

loss of coolant accident conditions, the prudency of continued operations was questionable and the plant was brought to 

cold shutdown. The plant will remain there until new ECCS suction strainers are installed. 

263-97-012 6b The Condensate Storage Tank low level setpoint was discovered to be inadequate since excessive air entrainment in the 

suction piping caused by vortexing could occur prior the HPCI and RCIC suctions transferring from the Condensate Storage 

Tanks to the suppression pool. Regulatory Guide 1.82, "Water Sources for Long-Term Recirculation Cooling following a 

Loss-of-Coolant-Accident", was conservatively used as a reference to determine the Condensate Storage Tank level 

required to prevent excessive air entrainment. The cause of this event is a design deficiency in the original Condensate 

Storage Tank low level setpoint. Level setpoints corresponding to higher tank levels have been determined and the level 

switches have been adjusted accordingly. A review of other suction sources for safety related pumps will be performed to 

assure that the effect of vortexing is properly addressed. 

263-97-014 3a A missed Technical Specification surveillance was discovered by a system engineer while addressing Generic Letter 96-01 

(Testing of Safety-related Logic Circuits). During review of logic circuit surveillance tests, it was determined that the Division 

II ADS (Automatic Depressurization System) Inhibit Switch was not being tested. Technical Specification 4.5.A.4 requires 

that "ADS Inhibit Switch Operability" be performed "each operating cycle." Following issuance of the License Amendment 

which added this requirement, an existing surveillance test was changed to verify the operability of the switches. However, 

the change only tested the Division I ADS Inhibit Switch. This was a cognitive error by the preparer and the reviewer of the 

surveillance test. Following discovery of this problem, a temporary change was made to the surveillance test to verify the 

operability of the Division II ADS Inhibit Switch. A surveillance procedure will be written or revised to verify operability of the 

Division II ADS Inhibit Switch. Completion of the Generic Letter 96-01 logic testing reviews will identify any additional logic 

testing inadequacies.

A-31
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

265-97-004 6b Quad Cities Nuclear Station Unit Two was shutdown for refueling with no fuel in the reactor at the time of discovery for this 

(Quad Cities 2) event. Chemistry personnel were sampling the drywell sumps when they noticed that the sump covers appeared to be 

opposite to what they were expecting. Investigation proved that the Drywell Equipment Drain Sump and the Drywell floor 

Drain Sump cover were not constructed per design drawings. This sump cover problem affects the accurate measurement 

of the Technical Specification for primary containment leakage. The plant was shutdown at the time of the event and there 

was no immediate consequences. The drywell sump covers construction error had no impact on the current operation of 

this or any other system. The apparent cause of this event was an error during plant construction. The actual root cause is 

unknown. The long term response is to visually verify the Unit One sump covers are installed as per design during the next 

refueling outage. There was no impact on health/safety of on-site personnel or to the public. The effect of wrong sump 

covers on identification of reactor coolant leakage was minimal. 

265-97-005 3a On 060897 at 0542, Unit 2 was in Cold Shutdown at 0 percent power and Unit 1 was in Power Operation at 100 percent 

(MULTI-UNIT power when the Unit 2 Mode switch was placed in Startup with neither the Unit 2 nor the 1/2 Emergency Diesel Generators 

APPLICABILITY) (EDGs) operable as required by Technical Specification (TS) 3.0.D. On 5/24/97 Unit 1 was at 100% power and was not in 

compliance with Tech Spec 3.9.A which requires that the unit be in hot shutdown within 12 hours following 7 days of unit 12 

EDG inoperability. 061297, an ENS call was made when a concern was raised that the installation of replacement air start 

motors (ASMs) indicated the new motors may not have started the EDGs. On 061897, both EDGs were declared operable 

when the rebuilt model ASMs were installed on both EDGs. The cause of the event was the installation of replacement 

ASMs which didn't have the same characteristics as the original ASMs. The installation resulted in the introduction of a new 

failure mode which had not been analyzed. The root cause of the installation was vendor information stating there was no 

difference in function of a replacement ASM when one existed and the failure of the station to adequately address the 

difference. Corrective actions include revising the alternate parts replacement procedure to ensure that the differences in 

form fit and function are reviewed by design engineering and to ensure that the differences are adequately addressed. This 

event was potentially safety significant since the Unit 1/2 and or the Unit 2 EDG may not have started on a start signal in the 

unlikely event of a Loss of Offsite Power coupled with a loss of coolant accident. 

266-97-001 3b POWER LEVEL - 090%. On January 8, 1997, with Unit 1 operating at 90% power and Unit 2 in a refueling shutdown, 

(MULTI-UNIT licensee engineers determined that the delay times assumed for high and low head safety injection (SI) flow in the Large 

APPLICABILITY) Break Loss of Coolant Accident (LBLOCA) analysis were not conservative. The LBLOCA licensing basis analysis assumed 

(Point Beach 1) that the high and low head SI systems were capable of providing full flow within five and ten seconds respectively. A 

conservative licensee evaluation concluded that the total delay times may be as high as 8.0 seconds for high head SI and 

23.7 seconds for low head SI. The delay time assumptions for the licensing basis analysis did not account for time delays 

associated with SI signal processing, sequencer delay time uncertainty, or an increased time for pump acceleration to full 

speed due to degraded voltage conditions. A Westinghouse safety assessment concludes that the increased safety 

injection delay times do not result in exceeding any design or regulatory limit for Point Beach Units 1 and 2.

A-32
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

266-97-002 6b POWER LEVEL - 090%. On January 9, 1997, with Unit 1 operating at 90% power and Unit 2 in a refueling shutdown 

(MULTI-UNIT condition, licensee engineers discovered a potential to overpressurize the Unit 1 reactor coolant pump seal return piping. 

APPLICABILITY) This potential exists in the event that both containment isolation valves (CIV) shut as designed during a design basis loss of 

coolant accident (LOCA), and the ambient temperature increase heats the trapped fluid. Immediate actions were taken to 

render one CIV inoperable in the open position; thereby eliminating the potential for pressurization beyond design basis 

code allowables. The containment Technical Specification limiting Conditions for Operation (LCOs) were entered. When 

thermal insulation was installed and analysis demonstrated pipe operability based on interim criteria (based on ASME Ill, 

Appendix F), the containment and CIV were restored to operation and LCOs were exited. Subsequently, we have identified 

one other penetration susceptible to pressurization beyond code allowables. Analysis of that line also demonstrated 

operability based on interim criteria. Plans for permanently restoring these penetrations to full compliance are described in 

the report. 

266-97-004 3a POWER LEVEL - 090%. On January 13, 1997, with Unit 1 operating at 90% power and Unit 2 in a refueling shutdown 

(MULTI-UNIT condition, licensee engineers discovered the potential for a particular common mode failure in the Vital DC Electrical (VDC) 

APPLICABILITY) System that could affect opposite trains of Unit 2 safeguards equipment. This flaw stems from the unreliability of VDC 

molded case circuit breakers (MCCBs) to trip in the magnetic-trip region and the lack of physical separation provided for 

non-safety-related circuits powered from VDC panels. For one postulated fault between two insulated conductors (fed from 

different VDC power panels), the calculated short circuit current exceeded the maximum operating limit of the thermal trip 

elements in the associated MCCBs. This would cause the associated upstream fuses to blow and de-energize 

opposite-train VDC panels; thereby disabling opposite-train safeguards equipment. The coincidental loss of opposite-train 

safeguards equipment is not analyzed in the FSAR. Subsequently, a similar common mode failure was identified for Unit 1. 

In each case, a non-safety related circuit was de-energized to isolate the potential fault. 

266-97-006 NRS POWER LEVEL - 090%. On January 20,1997, with Unit 1 operating at 90% power and Unit 2 in a refueling shutdown 

condition, licensee engineers discovered a plant condition that could cause retention of a significant water inventory in the 

refueling cavity during a design basis loss of coolant accident (LOCA); thereby diverting water that is assumed to 

accumulate in the containment sump. The condition was discovered during review of 1983 modifications which installed a 

flapper valve and remote cable operator over the refueling cavity drain for Unit 1 and Unit 2. The modifications also 

removed the original cavity drain grate in each unit and reduced the size of the drain line to a 2-inch nozzle. The design was 

not evaluated for seismic considerations or effects on the containment sump level. If the drain failed during a LOCA, as 

much as 46,000 gallons could be retained in the refueling cavity, which would invalidate the assumptions in the design 

basis accident analysis. To accommodate the potential loss of this sump water inventory, the emergency operating 

procedures were revised to ensure that a greater amount of water is transferred from refueling water storage tank to the 

containment during the LOCA recovery.

A-33
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-007 3c POWER LEVEL - 090%. On January 24, 1997, Point Beach Nuclear Plant (PBNP), Unit 1, was operating at 90 percent 

(MULTI-UNIT power and Unit 2 was shut down and defueled during its annual refueling outage. During evaluation of procedure reviews 

APPLICABILITY) for performing high-head safety injection (HHSI) system fill and venting, plant personnel determined that the potential 

existed for an emergency diesel generator (EDG) overload condition. When one EDG is aligned to supply the safeguards 

buses for both units and a HHSI pump is operated on one unit, an opposite unit safety injection actuation and a total loss of 

off-site power would result in the starting of the opposite unit's HHSI pump. This would result in two HHSI pumps being 

powered by one EDG, which is outside the design basis of the plant and creates the potential for a EDG overload condition. 

Procedure changes are being implemented to prevent EDG overload when testing HHSI pumps when a EDG is being 

shared between units. A Unit 1 one-hour report and a Unit 2 four-hour report was provided to the NRC in accordance with 

10 CFR 50.72. The NRC resident inspectors were also notified. 

266-97-008 NRS POWER LEVEL - 090%. On January 31, 1997, with Unit 1 operating at 90% power and Unit 2 in a refueling shutdown 

(MULTI-UNIT condition, licensee engineers discovered a plant condition that could affect the operability of safety-related equipment inside 

APPLICABILITY) the steam generator (SG) cubicles of containment. During a routine walkdown of Unit 2 containment, licensee engineers 

noted that SG channelhead ductwork located in the steam generator cubicles appeared to have insufficient support. Based 

on the general similarity of Unit 1 and Unit 2 designs, it was assumed that the Unit 1 configuration could also be inadequate. 

Unit 1 reactor power was reduced to three percent to allow access to the SG cubicles for inspection. The inspection 

indicated that the ductwork in the SG cubicles did not appear to be seismically supported in Unit 1. During the Unit 1 

containment entry, some of the suspect ductwork was removed and the remaining ductwork was seismically restrained with 

a temporary modification. Seismic analyses are planned for Unit 1 and Unit 2. If necessary, modifications will be made to 

install supports or remove the ductwork such that the design and design documentation are restored to full compliance. 

266-97-009 3c POWER LEVEL - 090%. On February 14, 1997, with Unit 1 operating at 90% power and Unit 2 in a defueled condition, 

(MULTI-UNIT licensee engineers discovered a plant condition that could cause a potential for safety injection failure during filling of a 

APPLICABILITY) safety injection accumulator. Condition report 97-0517 documents the discovery that the emergency core cooling system 

analysis does not include the effect of an open safety injection (SI) system accumulator fill valve. This condition could cause 

diversion of flow from the high head safety injection pump being used to fill the accumulator from the reactor coolant system 

into the accumulator that is being filled. The cause of this condition is considered to be due to a situation that was not 

adequately covered by the procedure. The procedure used for filling a safety injection accumulator has been changed to 

preclude the use of the Train B Sl pump for filling an accumulator and to enter the applicable limiting condition for operation 

(LCO) for inoperability of the Train A SI pump while it is being used to fill any accumulator.

A-34
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-013 5c On March 4, 1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in a hot standby condition and Unit 2 was shut down 

(MULTI-UNIT during its annual refueling outage, component cooling water (CCW) pump discharge cross-connect Valve CC-722B failed to 

APPLICABILITY) open during valve manipulation tests. As a result, this valve was declared inoperable. PBNP FSAR Section 9.3 states that a 

cross-tie may be opened under abnormal conditions to allow unit-designated CCW pump(s) to supply the opposite unit. 

Since this cross-tie feature was not available due to the inoperability of Valve CC-722B, the plant was in a condition outside 

its design basis. An operability determination concluded that the Unit 1 CCW system was operable. A 4-hour report to the 

NRC was made under 10 CFR 50.72. The NRC resident inspectors were also notified. 

266-97-014 3c POWER LEVEL - 000%. On March 21, 1997, with Unit 1 in cold shutdown and Unit 2 in a defueled condition, licensee 

(MULTI-UNIT engineers discovered a condition that alone could have prevented the Auxiliary Feedwater (AFW) System from 

APPLICABILITY) automatically performing its safety-related function during design basis accidents involving a loss of instrument air and 

reduced steam generator pressures. A loss of instrument air during the accident would cause both motor-driven AFW pump 

(MDAFWP) flow control valves to fail open. Without automatic flow control, the MDAFWPs' flowrate would be determined by 

steam generator pressure. If steam generator pressure is below the relief valve setpoints, which may occur for a low decay 

heat history, the pump motor breakers could trip on time-overcurrent. After discovery of these conditions, the AFW System 

was declared inoperable and the design was evaluated. The existing plant conditions did not require operability of the AFW 

system. The AFW system will be restored to operable status prior to establishing conditions that would require the system 

to be operable. The potential loss of both MDAFWPs during certain accidents has been attributed to a latent design 

characteristic of the original design of the AFW system. 

266-97-015 5a POWER LEVEL - 000%. On March 24, 1997, with Unit 1 in cold shutdown and Unit 2 in a defueled condition, during 

(MULTI-UNIT inspection and repair of the control room ventilation system, a condition was discovered that could have prevented proper 

APPLICABILITY) operation of the control room ventilation system. After discovery of these conditions, the control room ventilation system 

was declared inoperable and repairs were initiated. The existing plant conditions did not require operability of the control 

room ventilation system. It is expected that the control room ventilation system will be restored to operable status prior to 

establishing the conditions that would require the system to be operable. The failures of the backdraft damper and the vent 

duct access door have been attributed to original installation of the control room ventilation system. It has been judged that 

the control room dose consequences of these failures could have been mitigated. Offsite dose consequences were 

unaffected.

A-35
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-018 6b POWER LEVEL - 000%. On April 3, 1997, with Unit 1 in cold shutdown and Unit 2 in a defueled condition, licensee 

(MULTI-UNIT engineers discovered a potential for a section of the Residual Heat Removal (RHR) System inside containment to 

APPLICABILITY) overpressurize during a design basis accident. The piping section is isolated by normally-closed RHR inlet isolation valves 

(RH-700 and RH-701), and is normally water-filled, but is not provided with relief valve protection. During a design basis 

accident which elevates containment temperature, the trapped fluid would be heated by the containment accident 

environment and could pressurize the isolated section. If unmitigated, the overpressure condition could lead to pipe rupture 

or valve damage, which would affect the capability of the RHR System to achieve and maintain cold shutdown if required 

later In the accident. This condition is a latent characteristic of the original RHR System design and is generic to both 

nuclear units. Prior to the startup of a nuclear unit, appropriate overpressure protection will be provided to that unit. 

266-97-020 NRF On April 14, 1997, with Unit 1 in cold shutdown and Unit 2 in a defueled condition, a review of open condition reports related 

(MULTI-UNIT to the Fire Protection Program resulted in discovery of six (6) previously-unreported conditions that should have been 

APPLICABILITY) reported: (a) For a postulated fire in the Cable Spreading Room (CSR), an operator may need to perform actions inside the 

fire area; (b and c) For a postulated fire in the Auxiliary Feedwater (AFW) Pump Room, loss of DC power to all four 

Emergency Diesel Generators (EDGs) and instrumentation essential for safe shutdown could occur; (d) For a postulated 

fire in the plant, actions to operate EDGs could not be demonstrated; (e) There is no analysis to demonstrate operability of 

safe shutdown equipment without room ventilation available; (f) There is no operator guidance for de-energizing 4KV 

switchgear 2A05 and 480V bus 2B03 to preclude spurious operation of plant equipment. The root cause for the failure to 

report these conditions has been identified, and will be remedied. Compensatory measures were originally implemented as 

deemed necessary, and will be supplemented. Long-term corrective actions include a re-verification of Appendix R safe 

shutdown analyses. 

266-97-021 NRS On April 30, 1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in cold shutdown and Unit 2 was shut down and 

(MULTI-UNIT defueled during its ongoing refueling outage, two interfaces between seismic Class I and seismic Class Il/111 piping in the 

APPLICABILITY) spent fuel pool cooling system were identified as being accomplished via normally open manual valves. This is contrary to 

the PBNP Final Safety Analysis Report (FSAR), Appendix A, which requires interfaces between Class I systems and lower 

class systems to be at a normally closed valve or a valve which is capable of remote operation from the control room. Since 

these manual boundary valves were maintained in the open position, the plant was in a condition outside its design basis. 

The valves were immediately closed and tagged shut. An operability determination concluded that the spent fuel pool 

cooling system is operable. A 4-hour report to the NRC was made under 10 CFR 50.72. The NRC resident inspectors were 

also notified.

A-36
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-022 NRF May 7, 1997, with Unit 1 in cold shutdown and Unit 2 in a defueled condition, the licensee's Appendix R Rebaselining 

(MULTI-UNIT Project team discovered that a postulated Control Room fire may cause an electrical "hot short" that bypasses (i.e., 

APPLICABILITY) disables) the limit or torque switches for certain motor-operated valves (MOVs) that are essential for achieving an Appendix 

R safe shutdown. Fifteen (15) MOVs may be affected by this "hot short" condition. The Auxiliary Feedwater System, 

Service Water System, Component Cooling Water System, and the Residual Heat Removal System are affected. Spurious 

operation of an MOV with a disabled limit switch could cause the valve operator to generate thrust and torque values which 

exceed the design limits of the valves; causing physical damage to the valve that precludes its manual-handwheel 

operation. The inability to operate these essential valves would affect the capability to achieve the Appendix R safe 

shutdown. This discovery was made by our Appendix R Rebaselining Project team during a review of NRC Information 

Notice IN 92-18. Modifications have been initiated to remedy the condition. 

266-97-023 NRF On May 8, 1997, with Unit 1 in cold shutdown and Unit 2 in a defueled condition, the licensee's Appendix R Rebaselining 

(MULTI-UNIT Project team discovered that certain plant areas lacked adequate emergency lighting to demonstrate compliance with 10 

APPLICABILITY) CFR 50 Appendix R Section IlI.J requirements for 8-hour battery-powered lighting. This discovery was made during a 

review of Appendix R safe shutdown access/egress routes and locations of manual operations in the plant, in conjunction 

with a review of IN 95-036 "Potential Problems with Post Fire Emergency Lighting". Two of the five exterior buildings 

requiring access during certain fire scenarios lack the emergency lighting to comply with Section III.J. In addition, all of the 

access/egress routes to these buildings do not comply. The original plan for implementing Appendix R safe shutdown only 

provided for hand-held lighting to illuminate the two particular buildings and the access/egress routes. Corrective actions 

include revising the safe shutdown analysis, installing emergency lighting in the Service Water and Fire Pump House, and 

requesting an exemption to Appendix R Section II.J for emergency lighting along outdoor roadways to the support 

buildings. 

266-97-024 5a During reviews of the performance history for the Unit 2 containment atmosphere post-accident sampling system sample 

(MULTI-UNIT pump, it was determined that excessive leakage occurs at the leak test pressure of 15 psig. Evaluation of the leakage 

APPLICABILITY) determined that the dose received by personnel obtaining a sample under worst case post-accident conditions would be in 

excess of the GDC 19 dose limits specified in NUREG 0737, Item Il.B.3. This condition also applies to the Unit 1 sampling 

system. Additional design reviews of the containment atmosphere and reactor coolant post accident sampling systems also 

determined that in order to place the systems in service, instrument air, which may not be available post accident, would be 

required to be restored to containment. The containment atmosphere sample system will be upgraded to allow sampling at 

up to containment design pressure. Containment isolation provisions for the containment and reactor coolant sample 

systems are being evaluated.

A-37
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-025 6b On May 20, 1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in a cold shutdown condition and Unit 2 was in a 

(MULTI-UNIT defueled condition, it was discovered that three Operating Procedures (OP) allow manual control of pressurizer level 10% 

APPLICABILITY) higher than assumed in the PBNP FSAR section 14.2.5 rupture of steam pipe analysis assumption of 20%. This condition 

was discovered by Reactor Engineering personnel while reviewing operations and reactor engineering procedures in 

anticipation of the impending restart of Unit 2. These procedures were changed in the mid-1 980's to allow manual control of 

pressurizer level at 30% in lieu of the automatic program level of 20% at zero power operation. This condition was caused 

by inappropriately changing the procedure without adequate consideration of potential affects on the PBNP accident 

analyses. The affected procedures will be revised prior to restart of Unit 2. It was determined that the consequences of the 

PBNP FSAR section 14.2.5 "Rupture of a Steam Pipe" analysis would not exceed 10 CFR 100 limits, even if some fuel 

damage could occur based on the use of a higher pressurizer level. 

266-97-030 2b On June 11, 1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in a cold shutdown condition and Unit 2 was in a 

(MULTI-UNIT defueled condition, it was discovered that an actual alignment previously used does not conform with the assumed 

APPLICABILITY) configuration used in the service water (SW) system hydraulic analyses. Specifically, service water was provided to a 

second component cooling water (CCW) heat exchanger during previous periods of higher than normal service water 

temperatures and for some changes in plant operating conditions. This alignment is not in conformance with current 

analyses that assume one CCW heat exchanger is being supplied with service water. This condition was caused by 

operation of the service water system in a condition that did not conform with the analyses for the service water system. In 

a letter dated June 25, 1997, Wisconsin Electric committed to operation of the service water system in accordance with 

analyses as implemented by approved procedures. Recent flow analyses show that minimal excess capacity exists in the 

service water system. Therefore, some safety equipment supplied by the service water system could receive less than 

desired flow for accident mitigation. 

266-97-031 NRS On June 19, 1997, with Unit 1 in cold shutdown and Unit 2 in a refueling shutdown, the licensee's Design Basis team 

(MULTI-UNIT discovered that the auxiliary feedwater (AFW) pump low suction pressure trip setpoints may not ensure adequate suction 

APPLICABILITY) pressure protection for the AFW pumps following a postulated seismic or tornado event. Portions of the AFW pump suction 

piping, including the condensate storage tank (CST), are not classified Seismic Class I and are not protected from tornado 

missiles. A postulated seismic or tornado event could cause a loss of offsite power, a loss of normal feedwater, and a break 

in the unqualified suction piping. At the postulated break locations, limited suction head will be provided to AFW pumps. If 

all pumps automatically start as designed, the suction piping could be swept of all water before the low suction pressure trip 

devices can secure the pumps; resulting in damage to the AFW pumps, and the potential loss of the secondary heat sink 

during the event. At the time of discovery, neither unit required the operability of the AFW System.

A-38
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-032 NRF On June 30, 1997, with Unit 1 in cold shutdown and Unit 2 in a refueling shutdown, the licensee's Appendix R Rebaselining 

(MULTI-UNIT Team discovered that a previously-identified issue related to electrical switchgear ratings had implications on the plant 

APPLICABILITY) capability to achieve a safe shutdown for Appendix R fire scenarios. A calculation concluded that for certain AC buses, the 

fault current for a postulated zero-impedance ("bolted") three phase fault may be larger than the current-interrupting 

capability of the equipment involved. The licensee evaluated the potential for a fire in one fire area to cause a bolted 

electrical fault that exceeded the interrupting capability of the associated switchgear. If the associated switchgear is located 

in a different fire area, the overcurrent condition of the switchgear could lead to another, secondary fire. The capability of 

the plant to achieve and maintain safe shutdown for fires in multiple fire areas has not been demonstrated. Calculations 

determined susceptible fire areas and electrical circuits. Compensatory measures were established. 

266-97-033 NRF June 30,1997, with Unit 1 in cold shutdown, the licensee's Appendix R Rebaselining Team discovered two power 

(MULTI-UNIT distribution cables located in the auxiliary feedwater (AFW) pump room that do not meet the requirements of 10 CFR 50 

APPLICABILITY) Appendix R, Section III.G.2, and are not specifically identified in the NRC-approved exemption to Appendix R. Specifically, 

these redundant safe shutdown cables associated with the AC power distribution system do not meet the requirement for 

20' separation criterion with no intervening combustibles. Since the safe shutdown configuration described in the exemption 

does not include these cables, the capability to safely shutdown the plant for a fire in the AFW pump room is not adequately 

described in the plant licensing basis. An operability determination verified system operability pending restoration of the 

condition to full qualification. Compensatory fire watches have been established. 

266-97-034 7 On July 7, 1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in a cold shutdown condition and Unit 2 was in a 

(MULTI-UNIT refueling shutdown condition, during loss of power testing, the emergency diesel generator, G-03, output breakers tripped 

APPLICABILITY) open while it was supplying power to the Train B 4160 and 480 volt safeguards buses for both units. Affected equipment 

was restored based on guidance contained in the applicable abnormal operating procedures. Decay heat removal remained 

operating during the entire event because Train A was not affected within a short time, the Unit 1 and Unit 2 Train B 

safeguards buses were re-energized from off-site power. It was determined that the G-03 output breaker trip was caused by 

the "loss of field" trip signal when the emergency diesel generator was released from emergency run mode during test 

restoration. The "loss of field" output breaker trip is bypassed by an emergency run signal. Subsequent investigation 

revealed that the "loss of field" relay was not wired properly. The incorrect wiring was reworked and both Train B 

emergency diesel generators have been tested successfully.

A-39
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-035 NRS On May 15, 1997, with Point Beach Nuclear Plant Unit 1 in a cold shutdown condition and Unit 2 in a refueling shutdown 

condition, the seismic adequacy of the support frame for the Unit 1 reactor coolant pump (RCP) rotor stand was questioned. 

On May 16, 1997, a calculation confirmed that the structure was not seismically adequate and would not meet design 

criteria if subjected to safe shutdown earthquake lateral loads. Failure of this support has the potential for dropping the RCP 

rotor stand onto the residual heat removal (RHR) or safety injection (SI) system piping. The rotor stand was not been known 

to have been used since initial plant construction. Subsequent to this determination, the Unit 1 RCP rotor stand was moved 

to a more secure location within the Unit 1 containment structure. 

266-97-036 NRS On August 26, 1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in a cold shutdown condition and Unit 2 was 

(MULTI-UNIT operating at 100 percent power, licensee engineers discovered a potential common mode failure in the DC power supply 

APPLICABILITY) system that could result in the loss of three auxiliary feedwater pumps during seismic or tornado events that cause the loss 

of the normal AFW suction source. The remaining AFW pump would not be capable of providing the feedwater flow rate 

that is assumed in the accident analysis for both units. The common mode failure is not a consequence of the postulated 

earthquake or tornado, but has been considered to be a single failure that should be considered during this design basis 

event. The common mode condition was created in a modification that assigned a common DC power supply to three (of 

four) AFW pump low suction pressure trip devices. Plant modifications will be performed to eliminate the potential common 

mode failure described herein. 

266-97-037 6c On September 3,1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in a cold shutdown condition and Unit 2 was 

(MULTI-UNIT operating at 100 percent power, a condition was discovered in which the coincidental start of the Train A containment spray 

APPLICABILITY) pump and the third Train A service water pump could cause the voltage on the 480 V system to drop sufficiently low to 

cause actuation of the 480 V undervoltage protection function. If this were to occur, 480 V load shedding would occur. This 

would cause the Train A residual heat removal pump, electric motor driven auxiliary feedwater pump, service water pumps, 

and containment spray pump to trip at about 25 seconds into the loading sequence. Only the Train A portion of the 

emergency power system is susceptible to this condition. Unit 2 was shutdown due to the conclusion by the Manager's Staff 

that the LCO would expire before the condition could be corrected. Cold shutdown was achieved at 1142 hours on 

September 8. A modification restored the operability of the EDG during load sequencing. Unit 2 was returned to criticality at 

1810 hours on September 21, 1997.

A-40
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

266-97-040 6a On October 17, 1997, Point Beach Nuclear Plant (PBNP) Unit 1 was in a cold shutdown condition and Unit 2 was operating 

at 100 percent power. Licensee engineers reviewing a vendor calculation for pressures and temperatures of reactor coolant 

pump seal water return lines, discovered that a potential existed for the Unit 1 lines to fail due to thermal stresses induced 

during a full loss of cooling to the reactor coolant pump seals. A formal thermal effects analysis had not been completed for 

this line in the past. The line will be modified to provide appropriate supports for the hypothesized scenarios. This condition 

was reported to the NRC in accordance with 10 CFR 50.72(b)(2)(1), "any event, found while the reactor is shut down, that, 

had it been found while the reactor was in operation, would have resulted in the nuclear power plant, including its principal 

safety barriers, being seriously degraded..." 

266-97-041 6b On October 23, 1997, while Point Beach Nuclear Plant (PBNP) Unit 1 was in a cold shutdown condition, licensee engineers 

discovered a potential common mode failure in the auxiliary feedwater (AFW) pump control circuits that could result in the 

loss of two auxiliary feedwater (AFW) pumps; 1 P-29 and P-38A. The Final Safety Analysis Report provides for failure of 

only one AFW pump. The remaining AFW pump (P-38B) may not be capable of providing the feedwater flowrate that is 

assumed in the accident analyses. The postulated common mode failure to the adjacent cables is not a consequence of the 

accident, but has been considered to be a random, design basis single failure that should be considered. The common 

mode condition was created by a modification that installed a low suction pressure trip function on each AFW pump. Plant 

modifications will remedy the potential common mode failure described herein. 

269-97-002 NRF In response to NRC Generic Letter 96-06, Oconee Engineering has been performing conservative analyses to determine if 

(MULTI-UNIT the Low Pressure Service Water (LPSW) System piping which serves the Reactor Building Cooling Units (RBCU) may be 

APPLICABILITY) susceptible to water hammer. On 1/24/97, at 1426 hours, the NRC was notified per 10 CFR 50.72 because the analysis 

(Oconee 1) determined that, during certain design basis scenarios, water hammers might occur in piping to the non-safety related 

auxiliary cooling units (ACUs). This might prevent the safety related RBCUs from performing their intended function. At that 

time, Units 1 and 2 were at Cold Shutdown and Unit 3 was in a refueling outage. On 2/20/97, revision 0 was submitted as a 

partial LER because more detailed analyses were still in progress. On 7/31/97, revision 1 was submitted to better describe 

the potential impact of water hammers in the ACUs. On 8/13/98, after further analysis identified some initial conditions that 

might result in severe water hammer and breach LPSW piping serving the RBCUs, the NRC was again notified per 10 CFR 

50.72. The root cause is deficient Design Analysis, Unanticipated interaction of systems. Corrective actions included initially 

isolating and draining the ACU piping, and revising operating procedures as required. This event is considered to be of no 

significance with respect to the health and safety of the public.

A-41
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

269-97-003 6af While Oconee Units 1, 2, and 3 were in an extended outage, Engineering began an evaluation of Generic Letter 96-06. To 

(MULTI-UNIT eliminate present operability concerns related to thermal over pressurization in post-Loss of Coolant Accident (LOCA) boron 

APPLICABILITY) dilution flow paths, procedures were revised to partially drain between valves LP-1 and LP-2 and between 3LP-103 and 

3LP-104 during unit startup. On March 17, 1997, Units 1 and 2 were operating at 100 percent and Unit 3 was at 63 percent, 

an operability evaluation concluded that calculations could not prove that these valves could be opened post-LOCA with the 

lines full. Further engineering evaluation has revealed that the previous operability evaluation had conservatively neglected 

the impact of the holes drilled in the upstream disks of LP-1. The holes were drilled in LP-1 in April 1986, March 1985 and 

February 1987 on Units 1, 2, and 3, respectively. Therefore, the post-LOCA boron dilution flow path using LP-1 has been 

operable since the holes were drilled in the mid 1980s. However, this flow path is considered technically inoperable prior to 

the time the holes were drilled. The post-LOCA boron dilution flow paths using valves LP-103 and LP-104 were declared 

technically inoperable from the original installation until October, 1996 when the recent outages began. The root cause is a 

Deficient Design Analysis, unanticipated interaction of components. Additional corrective actions include developing and 

implementing future modifications. 

269-97-005 7 The Oconee original design criteria, as stated in the Updated Final Safety Analysis Report (UFSAR), requires Engineered 

(MULTI-UNIT Safety (ES) Features to be protected from turbine generated missiles by means of shielding or separation. In addressing a 

APPLICABILITY) concern found during the Service Water Upgrade Project, Oconee Engineering began a review in September 1996 to verify 

that the Low Pressure Service Water (LPSW) [EIIS:BI] system piping met the separation criteria for turbine missiles. On 

October 3, 1996, an evaluation determined that Low Trajectory missiles, thought to be most limiting, were not a concern. On 

April 26, 1997, Units 1 and 3 were at 100% full power and Unit 2 was at cold shutdown, when it was determined that 

portions of the LPSW system piping did not meet the Oconee separation criteria for High Trajectory Missiles. Separation 

was addressed by Engineering in the original design of ES systems, but these portions of LPSW piping do not have 

separation or documentation of adequate shielding from High Trajectory Missiles. The root cause of this event is Unknown. 

This event is not recurring and had no personnel injuries, exposures or releases of radiation. Corrective action included 

submitting an amendment to the UFSAR to allow for current industry and NRC guidance concerning vulnerable target area 

and probability of impact of a turbine missile without shielding or separation protection. This license amendment was 

approved by the NRC on May 16,1997. When applying the NRC approved methodology, the LPSW system piping in 

question provides an acceptably low probability target. Therefore, the health and safety of the public was not impacted by 

this event.

A-42
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

271-97-001 6a POWER LEVEL - 100%. On 02/07/97 during an investigation for an unrelated issue, Vermont Yankee (VY) discovered the 

(Vermont potential for a postulated electrical failure in the containment isolation control circuitry to challenge primary containment 

Yankee) integrity. Plant design ensures that either the drywell vent and purge (VP) outboard isolation valves or the corresponding 

inboard isolation valves will close as designed given any postulated single failure. However it was recognized that the failure 

to close at least one of the inboard vent or purge isolation valves could challenge containment integrity. Were a Loss of 

Coolant Accident (LOCA) to occur, concurrent with the postulated single failure in the torus/drywell VP valve control 

circuitry, while containment inerting/deinerting was in progress, a flow path would be present which would allow a portion of 

the steam to bypass the available heat sink (suppression pool), potentially overpressurizing the containment pressure 

vessel. This flow path was possible because VY containment inerting procedures allowed simultaneous opening of the torus 

and drywell inboard VP paths while inerting and/or deinerting the containment. VY has established administrative controls to 

preclude simultaneously opening both the torus and drywell vent or purge paths during normal plant operation. The Root 

Cause of this condition is that the impact of these valves failing to close during a LOCA, was not correctly evaluated or 

understood. Because plant Technical Specifications only allow the high volume drywell and torus VP paths to be opened 

with the plant in cold shutdown (or for 24 hours after plant startup, or for the 24 hours preceding shutdown); the affected 

circuit is tested each operating cycle; and a LOCA must occur coincident with the electrical failure; the probability that the 

containment over pressurization could occur is exceedingly low. Therefore this event is not considered to have presented 

an increased threat to public health or safety. 

271-97-002 6a On 02/21/97 VY discovered the potential for water intrusion into the Vital Switchgear Rooms via underground conduits 

during Maximum Postulated Flood Conditions (MPC). Were the MPC to occur, switchgear providing electrical power to 

Division I and II safety systems would need to be de-energized, placing the plant in a vulnerable condition. This potential 

exists due to an inadequate initial plant design. Presently a Basis for Maintaining Operation (BMO) has been completed to 

support continued safe plant operation. In-place plant procedures require the Shift Supervisor to initiate plant shut down 

with flood waters approximately 10 feet below the level at which the switchgear rooms would be challenged should 

conditions continue to degrade. VY is installing high density silicone seals in conduits which otherwise allowed intrusion of 

external flood waters into the Switchgear Rooms. This will reduce water introduction into the Switchgear Rooms to an easily 

manageable rate. Procedures are being revised to specify additional actions to be implemented if a flood occurs. To date 

the maximum river level that has occurred at the site was an elevation of 231.4 ft. mean sea level (MSL). Because the 

probability of a MPC flood is extremely low, and the highest level achieved during a previous high water condition was 17.1 

ft. below the elevation of concern; this event is not considered to have presented an increased threat to public health and 

safety.

A-43
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT CATEGORY1 

271-97-003 6a On 3/5/97, during investigation for a similar issue, it was discovered that the design for Turbine building overpressure 

protection, described in the Vermont Yankee Final Safety Analysis Report, was never installed. The VY FSAR description of 

Turbine Building overpressure protection includes a 1000 sq. ft. blowout panel that would actuate at an internal pressure of 

0.25 psi. No venting areas of this size have been found in the Turbine Building, and investigation to date has been unable to 

identify any other venting methods that may have been assumed, in lieu of the blowout panels, when the plant was 

constructed. The analysis for high energy line breaks (HELB) in the Turbine Building credits the blowout panel. Absent the 

blowout panel, the potential higher pressure raised concern for the structural capability of certain block walls and ductwork 

in the building. Analysis has been performed to assess the potential effects on safety related equipment and to justify 

continued operation. Where appropriate, compensatory measures are in place to reduce the areas potentially susceptible to 

an HELB absent the mitigating effects of the Turbine Building blowout panel. The affected ventilation system has been 

modified to prevent steam intrusion into the vital switchgear room in the event of an HELB. Blowout panels have been 

designed, and the design package is currently being reviewed. The devices, when installed, will provide overpressure 

protection for the Turbine Building and meet the intent of the original FSAR description. Because there has been no 

occurrence of an HELB in the turbine building during the plant's lifetime, and an accident of such magnitude is of extremely 

low probability (VY FSAR 14.4.3), this event is deemed to have presented no increased risk to the health and safety of the 

public. 

271-97-004 NRS On 3/7/97 through 5/20/97 deficiencies were identified during an internal flooding review by Vermont Yankee. The review 

identified that a failure in fire suppression water, and other non-seismic piping systems in areas adjacent to the switchgear 

rooms could potentially affect the vital switchgear. Additional investigation determined that similar potential flood sources 

with the capability of challenging redundant ESF's existed. Major failures in the affected lines have been estimated to 

produce flowrates of sufficient magnitude to challenge redundant safety systems within 20 minutes. The causes of this 

event included inadequate licensing bases documentation relative to internal flood protection requirements and incorrect 

interpretation of design drawings. Bases for Maintaining Operation (BMO's) were written which support continued safe plant 

operation in light of each postulated scenario. Administrative controls have been put in place to direct operators should any 

of the theorized flood conditions occur. A detailed report articulating the VY current licensing bases relative to internal flood 

protection attributes is currently under development. Because the postulated pipe failures, 1) would generally be slow in 

developing to a point where redundant safety significant SSC's could be challenged, 2) would generally actuate control 

room annunciators which would prompt an immediate investigation and appropriate mitigating actions, and, 3) the 

probability of such major failures occurring is very low, this event is not considered to have presented a significant increase 

in risk to public health and safety.

A-44
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORYI 

271-97-005 5a On 03/24/97 during the review of a plant status report for an occurrence at another station, VY determined that a similar 

condition existed at VY. Specifically, the potential exists during primary containment inerting and deinerting operations at 

power to overpressurize the Standby Gas Treatment System filter train housings, should a major LOCA occur. While the 

SBGT system will isolate automatically from the primary containment on a LOCA signal, it was determined that the valve 

stroke times were such that the potential for system over pressurization existed. The potential over pressurization would 

challenge secondary containment in the event of a LOCA concurrent with containment inerting or deinerting activities. The 

potential for over pressurization existed because VY Technical Specifications and containment inerting procedures allowed 

inerting and/or deinerting the primary containment while at power. VY has established administrative controls to preclude 

the system alignment which creates the potential for overpressurizing the Standby Gas trains. On 4/24 and 5/1 2/97 there 

were recurrences of this event due to an inadequate disposition of the issue by VY. Further reporting on this issue is 

contained in VY LER 97-14, reported on 9/5/97. Because plant Technical Specifications only allow normal containment 

inerting and deinerting operations with the plant in cold shutdown (or for 24 hours after plant startup, or for the 24 hours 

preceding shutdown) and the postulated LOCA must occur coincident with an inerting or deinerting activity, the probability 

of the Standby Gas train over pressurization is exceedingly low. Therefore this event is not considered to have presented 

an increased threat to public health or safety. 

271-97-006 NRF On 3/26/97 during Appendix R program enhancement efforts, Vermont Yankee discovered an electrical cable installation in 

variance with the VY FSAR requirements for separation of electrical cables, Specifically, it was discovered that a non-safety 

lighting panel supply cable passed in proximity to both division I and division II Engineered Safety Feature actuating and 

power cables. This configuration conflicts with VY's single failure criteria for safety systems, creating a condition where a 

single failure of an active component (the safety-class circuit breaker providing protection for the non-safety lighting circuit) 

could challenge redundant ESF trains. This configuration has been in place since initial plant construction due to the use of 

an inadequate installation guideline. VY has rerouted the subject lighting cable to conform to the applicable separation 

criteria. Follow-up investigation has revealed similar cable routing non-conformances including a single electrical box which 

houses cable potentially affecting one Low Pressure Coolant Injection subsystem and a cable providing DC power to the 

High Pressure Coolant Injection system. VY has performed an extensive, systematic assessment of its cable routing. Cable 

separation non-conformances discovered have been evaluated for their safety implications. Compensatory measures and 

bases for maintaining operation were developed as necessary. The non-conforming cables are typically low-voltage 

signal/control cables and/or protected by multiple safety class protective devices. These devices provide highly reliable 

protection against faults which could reasonably be expected to challenge the cable insulation. Additionally, the cable 

mixing found was bounded by VY's current Appendix R analyses. Therefore this event is not considered to have presented 

an increased threat to public health or safety.

A-45
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

271-97-012 7-None On 5/2/97 at 1300 hours, during the AE inspection preparation it was determined that the Residual Heat Removal (RHR) 

Service Water (SW) flow rate during a LOCA could potentially have been below the required design flow. The design flow of 

the RHRSW heat exchanger and required flow for a LOCA is 2700 Gallons Per Minute (GPM). Instrument accuracy for flow 

indication is +/- 150 GPM, which could have resulted in an actual RHRSW flow rate as low as 2550 GPM. This condition 

was evaluated and it was determined that the RHRSW system can meet its design cooling capacity at existing flow rates, 

provided that the plant is only operated if river water temperature is equal to or less than 70 degrees F. Additionally, if flow 

for the RHRSW system was 2850 GPM, with instrument inaccuracy in the conservative direction, it was determined that the 

remaining loads would still have the required amount of cooling with the river water temperature restriction in use. The root 

cause of this event is a management decision to accept existing setpoints as adequate, and only expend resources for 

applying standard setpoint methodologies to Environmentally Qualified (EQ) instruments and new instruments installed 

under a design change. Immediate corrective actions included the initiation of an Event Report to document the concern, 

notification of the Nuclear Regulatory Commission (NRC), the initiation of a Basis for Maintaining Operation (BMO) 

document and the establishment of a river water temperature administrative limit of 70 degrees F and a mandatory read 

and sign BMO training form for the Operations on-shift crews. Subsequent analysis has shown that the administrative river 

water temperature limit of 70 degrees F is unnecessary. The RHRSW System is capable of maintaining Torus temperatures 

less than 176 degrees F with a river temperature of 85 degrees F. The administrative temperature limit has been returned to 

the original 85 degrees F. 

271-97-014 5a On 08/07/97, while preparing to update the docket relative to Vermont Yankee (VY) LER 97-05, it was determined that VY 

had inappropriately dispositioned the issue, which led to an event recurrence. On 03/24/97 VY had determined that the 

potential existed to overpressurize the Standby Gas Treatment System should a large break LOCA occur during primary 

containment inerting and deinerting operations at power. This could potentially challenge secondary containment. The 

potential for over pressurization existed because VY Technical Specifications (TS) and containment operating procedures 

allow inerting or deinerting the primary containment while at power. VY established controls prohibiting the cited system 

alignment. VY, after consultation with the NSSS Supplier, concluded that postulating the LOCA coincident with purge and 

vent operations at power was not consistent with its licensing bases due to its extremely low probability. Therefore, on 

04/24/97 standard purge and vent operations were resumed. Following the resumption of normal purge and vent activities, 

VY management was made aware of licensing correspondence which commits VY to meeting 1OCFR100 limits under the 

postulated conditions. This commitment had not been previously considered by the Plant Operations Review Committee 

due to a lack of understanding of plant licensing bases on the part of the personnel conducting the original investigation. 

Administrative controls prohibiting the vulnerable configuration were established. Because VY TS's only allow inerting and 

deinerting while in cold shutdown (or within 24 hours of a startup/shutdown) and the LOCA must occur coincident with 

inerting or deinerting activities, the probability of the SBGTS over pressurization is exceedingly low. Therefore this event did 

not present a significant increase in risk to the public.

A-46
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

271-97-019 NRF On 09/18/97, while evaluating Fire Suppression System code compliance, Vermont Yankee found that a change made to 

the fire suppression system had degraded the system such that required performance capabilities could not be 

demonstrated. The affected sprinkler system provides fire suppression capability in the Emergency Diesel Generator rooms 

(EDGRs). A 1982 modification rendered the system incapable of delivering 0.3 g.p.m. per square foot of the protected area, 

a water density communicated to the NRC staff via a 1978 letter. While the water delivery capability of the current system 

has been assessed as comparable to systems designed for "ordinary [fire] hazards," the category ascribed to environments 

like electronic plants, automobile repair garages and paper mills; the 0.3 g.p.m. cited implies that the system was to be 

treated as an "extra hazard" area. The system was therefore declared inoperable and compensatory measures were 

implemented per plant Technical Specifications (TS). Because TS require compensatory measures be implemented when 

the subject sub-systems are inoperable, and they have been in the described condition since 1982 this event is being 

reported as a condition prohibited by TS. As this condition was discovered while performing corrective actions to address 

similar conditions for another event, it is expected that those same corrective actions, combined with addressing the 

disparity between this system's current delivery capability and the committed flows, will adequately address this event. 

Because the fire suppression systems have no nuclear safety functions, and the EDGR sprinkler systems have consistently 

possessed significant fire suppression capabilities, this event did not pose an increased threat to the health and safety of 

the public. 

271-97-020 5a On 10/30/97, while responding to concerns noted during an NRC architect engineer inspection of the facility, VY concluded 

that the plant having operated with a torus temperature greater than the initial temperature assumed in current analyses 

may have allowed conditions to occur which were subject to the reporting requirements of 10CFR50.72 and 10CFR50.73. 

No 10CFR50 Appendix B calculation exists which bounds the full range of suppression pool (torus) temperatures permitted 

by plant Technical Specifications (TS). The current containment response analysis assumes an initial pool temperature of 

90 degrees Fahrenheit (F), while TS allows unlimited plant operations with torus temperatures as high as 100 F. Upon 

noting the lack of detail in the formal analysis used to justify the TS limit of 100 F, administrative limits were established 

prohibiting normal plant operation with torus temperature > 90 F. Preliminary calculations and evaluations performed as 

corrective actions for this event have led to a further reduction in allowed torus temperature (80 F maximum). The cause of 

the event was the inappropriate assignment of a technical review to a single work group which lacked the breadth of 

knowledge needed to address all of the implications of the change. Other causes included inadequate self-checking and a 

lack of procedural guidance. Procedures have since been improved, and VY has trained on the lessons learned from the 

event. VY is currently performing a reconstitution of the licensing basis for the maximum suppression pool temperature 

allowed. Because engineering evaluations performed since the discovery of the disparity indicate that conditions achieved 

would not have undermined the functionality of safety systems, this event did not present an increased risk to public health 

and safety.

A-47
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY7 

271-97-021 6a On 10/09/97, while operating at 100% power, it was determined that energized cables from one divisional raceway system 

traverse both Division SI and Division SIl equipment. This is contrary to the Final Safety Analysis Report (FSAR) section 

8.4.6.3 and the Vermont Yankee Cable Separation Specification VYS-027. The non-conforming cables supply the alternate 

feed from either Motor Control Center (MCC) 8C or 9C to Cooling Tower Fan CT 2-1 which is a part of Vermont Yankees 

Alternate Cooling System (ACS). The fan is normally fed from a Start-up transformer bus; however, if a loss of off-site 

power were to occur, the fan, which is fed from MCC SC and 9C, would ultimately be powered by the Emergency Diesel 

Generators (EDG). The non-conforming cables run in separate wireways from manhole 27, where they are spliced together, 

until they enter the wireway in the MCC's and consequently violate the separation criteria. The MCC breakers for the 

alternate supply, one normally open and the other normally closed, are key interlocked to prevent the closing of both 

breakers at the same time. The Apparent Cause of this event was due to the use of inadequate design specifications and 

installation procedures during initial plant construction. Immediate corrective action was taken to open the normally closed 

breaker and tag both breakers open. With the breakers open, the intent of the separation criteria is met. Although the 

original configuration violated the separation criteria, the alternate supply breakers to CT 2-1 would have provided the 

necessary breaker trip function to isolate any fault prior to the fault affecting either EDG. Additionally, operators have 

approximately two hours to establish the ACS following a loss of Service Water. This provides sufficient time to close the 

breaker for the fan. There was no threat to the health and safety of the public from this event. 

271-97-024 NRS On 12/16/97, while performing a routine inspection of cooling tower structural components, VY discovered that a vertical 

support column in the safety class portion of the cooling tower had failed. The column (a safety class 4"x 4" wooden 

structural member) had apparently failed in the past and a repair had been completed. The cooling tower materials records 

do not describe any details regarding the repair. The cause for the failed member is a combination of inadequate analysis 

of, and guidance for, the application of construction techniques for the splicing of vertical support members in repair efforts. 

The alternate cooling system having been declared inoperable to support the inspection, remained in the inoperable status 

until the broken column was replaced. During subsequent maintenance efforts a second column was found to be 

inoperable. It too has been replaced. The appropriate guidance for the application of the splicing technique will be 

developed. Recently improved cooling tower inspection methodologies will continue. Current VY design requirements for 

structural loading of the safety class portion of the cooling tower requires that the system be demonstrated capable of 

performing under the combined effects of design snow loading, maximum cooling water inventory, and a design basis 

seismic event. Because the structural load combination which must be postulated to preclude the cooling tower's ability to 

perform as designed is highly unlikely, this event is not considered to have presented a significant increase in risk to public 

health and safety.

A-48
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

ICATEGORYI 

272-97-002 6b POWER LEVEL - 000%. Recent re-evaluation of the Chilled Water System has determined that to provide the design 

(MULTI-UNIT support function and assume a single failure, three chillers and two chilled water pumps are required to be operable for 

APPLICABILITY) each Salem unit. With less than this configuration, the Chilled Water System may not be able to perform its design support 

(Salem 1) function and withstand a single failure. In the past, the plant has operated with less than three chillers or two chilled water 

pumps. The cause of this occurrence is that at the time of the original plant design, the ability to withstand a single failure 

with a component out of service for maintenance, was not recognized as a design input. Because the system did not have 

specific Technical Specifications associated with it, the impact of having components out of service was not recognized. 

Corrective actions include submission of a License Change request and an Operability Determination addressing the 

actions to be taken if less than three chillers or two chilled water pumps are operable. This event is reportable in 

accordance with 10 CFR 50.73(a)(2)(ii)(B), any condition that resulted in the nuclear plant being outside the design basis of 

the plant. 

272-97-003 3a POWER LEVEL - 000%. During the development of a Failure Modes and Effects Analysis, in support of NRC Generic 

(MULTI-UNIT Letter 96-06, 'Assurance of Equipment Operability and Containment' for the Service Water System (SWS), a SWS 

APPLICABILITY) alignment that is more hydraulically challenging than previously analyzed was discovered. The previous alignment 

assumed, during a Loss of Coolant Accident, a single failure of the Component Cooling Water (CCW) heat exchanger 

valve, and resulted in three SW pumps supplying flow to two full open CCW Heat Exchangers, five Component Fan Cooling 

Units (CFCU), and three Emergency Diesel Generators (EDGs). The new more limiting alignment assumes a single failure 

of a 125 Vdc channel, and results in two SWS pumps being in a runout condition, that could cause insufficient SWS flow 

rates. The cause of this occurrence was the hydraulic impact of a modification was not considered. Corrective actions 

include modifications to restore the system hydraulics and reviews of the modification process. This LER is being submitted 

pursuant to 10CFR50.73(a)(2)(ii), any condition that was outside the design bases of the plant. 

272-97-009 2b As a result of an NRC Special Inspection 311/97-11, several issues concerning past operation of the Salem Emergency 

(MULTI-UNIT Core Cooling System were identified. On April 18, 1997, a determination was made that prior to March 1996, Salem 

APPLICABILITY) Generating Station was operated in the past in a condition that was outside the design basis of the plant due to the 

following reasons: 1) excessive Residual Heat Removal (RHR) system flows during the recirculation mode of Loss of 

Coolant Accident (LOCA) mitigation, and 2) the inability to ensure the successful completion of the switchover from the 

injection mode of LOCA mitigation to the recirculation mode without the possibility of interrupting ECCS pump flow to the 

core since the installation of the semiautomatic switchover modification in 1989. The root cause evaluation for the 

introduction of the USQs into the design and licensing basis identified the following causes: 1) failure to address all accident 

scenarios that could affect the assumptions made, and 2) failure to adequately review the licensing and design bases for 

the semi-automatic swapover. These issues are reportable under 1OCFR50.73(a)(2)(ii)(B) and 1OCFR50.73(a)(2)(v).

A-49
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

272-97-011 7 On November 19, 1997, the Salem Technical Specification Surveillance Improvement Project (TSSIP) identified that the 

(MULTI-UNIT Steam Generator blowdown isolation valves (GB4 valves) and the Steam Generator blowdown sampling isolation valves 

APPLICABILITY) (SS94 valves) were not being functionally tested to verify that these valves would isolate on an automatic start of the 

Auxiliary Feedwater (AFW) pumps. This concern was identified following a review of the applicable drawings and 

surveillance test procedures in accordance with the guidelines of NRC Generic Letter (GL) 96-01. Isolation of these valves 

is assumed to occur in the evaluation of the Loss of Normal Feedwater accident. The cause of this occurrence has been 

attributed to the inadequate incorporation of design basis accident mitigation features into plant testing procedures. The 

evaluation of surveillance test procedures in accordance with the guidelines of GL 96-01 is continuing and will be completed 

by December 31, 1997. This event is reportable under 10 CFR 50.73(a)(2)(ii)(A) for the past operation of Salem in an 

unanalyzed condition that significantly compromised plant safety. 

275-97-001 6b POWER LEVEL - 100%. On January 31, 1997, at 1130 PST, with Units 1 and 2 in Mode 1 (Power Operation) at 100 

(MULTI-UNIT percent power, PG&E determined that the component cooling water (CCW) and auxiliary saltwater (ASW) systems have 

APPLICABILITY) operated with procedural guidance that permitted, following a loss of coolant accident and the loss of power on either Vital 

(Diablo Bus F or G, operation in a condition outside the design basis of the plant. A 1-hour, non-emergency report was made to the 

Canyon 1) NRC at 1220 PST, in accordance with 10 CFR 50.72 (b)(1)(ii)(B). The cause of the event is unknown, but it occurred during 

the original design of the plant. The cause is attributed to incomplete or incorrect application of the single failure criteria 

design requirement to ASW and CCW systems operation during post-accident split train, hot leg recirculation. Emergency 

Operating Procedure E-1.4, 'Transfer To Hot Leg Recirculation,' has been revised to no longer require immediate 

separation of the ASW and CCW systems into separate trains after the transfer to hot leg recirculation. The decision to 

separate has been transferred to the Technical Support center, where a decision will be made after an evaluation of plant 

conditions. This action precludes placing the plant into a configuration where this vulnerability would be created without a 

thorough assessment being performed.

A-50
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

275-97-002 3b POWER LEVEL - 100%. On February 26, 1997, at 1530 PST, with Units 1 and 2 in Mode 1 (Power Operation) at 100 

(MULTI-UNIT percent power, PG&E determined previous revisions of Emergency Operating Procedure (EOP) E-1.3, 'Transfer to Cold 

APPLICABILITY) Leg Recirculation,' could have resulted in the plant being outside its licensing basis. At the completion of switchover to cold 

leg recirculation, the procedure would have left a remaining usable volume in the refueling water storage tank (RWST) less 

than the licensing basis margin of 32,500 gallons. A 1-hour, non-emergency report was made to the NRC in accordance 

with 10 CFR 50.72(b)(1)(ii)(B) as a condition outside the design basis of the plant. This event was discovered by PG&E 

engineering personnel during the review of Final Safety Analysis Report (FSAR) Update Table 6.3-5, following questions by 

NRC resident inspectors. The root cause of this event was personnel error (cognitive). Personnel who prepared the original 

FSAR made nonconservative assumptions in calculating pump flow rates for the sequence of events following a 

loss-of-coolant-accident. PG&E has approved a change request for the FSAR Update and has revised EOP E-1.3 and 

Administrative Procedure OP1 .DC1 1, 'Conduct of Operations - Abnormal Plant Conditions.' These corrective actions will 

provide assurance of maintaining the licensing basis RWST volume margin. 

275-97-003 5b POWER LEVEL - 100%. On March 5, 1997, at 1302 PST, with Units 1 and 2 in Mode 1 (Power Operation) at 100 percent 

(MULTI-UNIT power, PG&E determined that the reactor vessel level instrumentation systems (RVLIS) for both units were inoperable due 

APPLICABILITY) to failure to perform normalization of input parameters following each refueling outage. This vendor basis requirement had 

not been previously identified or performed; therefore, the system has operated outside design basis requirements. A 

1-hour, non-emergency report was made to the NRC at 1316 PST, in accordance with 10 CFR 50.72 (b)(1)(ii)(B). On March 

5, 1997, following performance of the revised surveillance test procedure for RVLIS dynamic range indication, Trains A and 

B were returned to operable status. The cause of this event was utility personnel error, knowledge exceeded, and 

inadequate vendor communication. The RVLIS System Manual did not provide clear documentation of required periodic 

normalization of RVLIS dynamic range indication to assure continued operability. Corrective actions include a review of 

instrumentation and control systems that were installed late in the construction period that may not have had completed 

vendor manual information. The systems identified that require review are the core exit temperature monitoring system, the 

subcooled margin monitor, and anticipated transient without scram system. Since current design processes and criteria 

preclude recurrence of similar events, PG&E determined that no additional corrective actions are necessary.

A-51
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

275-97-005 3a On March 14, 1997, at 1601 PST, with Units 1 and 2 in Mode 1 (Power Operation) at 100 percent power, PG&E determined 

(MULTI-UNIT that the residual heat removal (RHR) system had operated in a condition that was outside the design basis of the plant. 

APPLICABILITY) Administrative controls did not require sufficient refueling water storage tank (RWST) level channels to meet the single 

active failure criteria and ensure adequate availability of the automatic tripping function for the RHR pumps during transfer 

to recirculation. A 1-hour, non-emergency report was made to the NRC at 1648 PST, in accordance with 10 CFR 50.72 

(b)(1)(ii)(B). The 1-hour, non-emergency report was updated on March 19, 1997, at 1300 PST, to report an additional 

scenario that could prevent the automatic start or cause the premature tripping of the RHR pumps. PG&E attributes the 

inadequate administrative controls to personnel failing to consider the consequences of an RWST level channel failure 

concurrent with another level channel in test or maintenance on the functioning of the RHR system when a third level 

channel was added to the design in 1974. A license amendment request was submitted to include all three RWST channels 

in the technical specification (TS). Until the TS change is issued, administrative controls have been implemented. 

275-97-006 NRF On April 28, 1997, at 1627 PDT, with Unit 1 in Mode 6 (Refueling with the reactor vessel defueled) for a refueling outage, 

(MULTI-UNIT and Unit 2 in Mode 1 (Power Operation) at 100 percent power, PG&E determined that Units 1 and 2 reactor coolant pump 

APPLICABILITY) (RCP) lube oil collection systems do not meet the requirements of 10 CFR 50.48 and 10 CFR 50, Appendix R. A 1-hour, 

non-emergency report was made to the NRC in accordance with 10 CFR 50.72(b)(1)(ii)(B) on April 28, 1997, at 1634 PDT. 

The 1-hour, non-emergency report identified lift oil pump tubing that was unshielded on Units 1 and 2. It was also 

determined that some drip pans of the RCP lube oil collection system were missing or damaged on Unit 1. Based on a 

review of inspections, photographs, and video tapes, the drip pans in Unit 2 were evaluated to be acceptable. Due to the 

lack of documentation and the amount of time that has passed since the instrument tubing was routed outside the shielding, 

a definitive root cause could not be established. The cause is presumed to be personnel error (non-cognitive), knowledge 

exceeded on the part of the individuals who performed and approved the tubing modification. Unit 1 RCP lube oil collection 

system modifications have been completed. Unit 2 modifications will be completed during the next Unit 2 forced outage or 

refueling outage, whichever occurs first. An inspection of the RCP lube oil collection system will be required coming out of 

each refueling outage to verify that proper configuration is maintained.

A-52
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT F jCATEGORY 

275-97-011 6a On July 3, 1997, at 1608 PDT, with Unit 1 in Mode 1 (Power Operation) at 100 percent power, and Unit 2 in Mode 3 (Hot 

(MULTI-UNIT Standby), PG&E determined that inoperable check valves in the drain lines for the auxiliary saltwater pump (ASWP) vaults 

APPLICABILITY) could cause the auxiliary saltwater systems to be outside their design basis. A 1-hour, non-emergency report was made to 

the NRC in accordance with 10 CFR 50.72(b)(1)(ii)(B). At the request of the NRC Senior Resident Inspector, PG&E 

reviewed past valve inspection results and determined that the valves were inoperable on a number of occasions. This 

review also identified that, on August 9, 1991, with Units 1 and 2 in Mode 1 at 100 percent power, PG&E failed to report that 

Technical Specification 3.7.4.1 was not met for approximately 24 hours when the check valves were concurrently removed 

from both ASWP vault drain lines on Unit 1 for inspection and maintenance. The root cause was inadequate corrective 

actions due to personnel error (cognitive). Personnel performing maintenance activities did not fully understand the role of 

the check valves in supporting Technical Specification operability of the ASWPs. Corrective actions include placing the 

valves in maintenance rule goal setting, increasing the frequency of inspections, revising work orders to flush the lines with 

valves removed, and protecting the drain lines from the entry of debris. 

275-97-018 5b On October 22, 1997, at 1500 PDT, with Units 1 and 2 in Mode 1 (Power Operation), at 100 percent power, PG&E 

(MULTI-UNIT determined that the anticipated transient without scram mitigating system actuation circuitry (AMSAC) had been originally 

APPLICABILITY) installed with a C-20 permissive setpoint that was outside design basis. The C-20 permissive had been set at 40 percent 

turbine power instead of 40 percent reactor thermal power as stated in the current licensing basis. A-1 hour non-emergency 

report was made to the NRC in accordance with 10 CFR 50.72(b)(1)(ii)(B) at 1520 PDT. This condition existed because 

PG&E personnel were unaware of a conflict between the actual C-20 setpoint and the setpoint stated in the licensing basis. 

The C-20 permissive was adjusted to the equivalent of 40 percent reactor thermal power. Design documents were revised 

accordingly. The administrative procedure regarding incoming regulatory correspondence will be revised to require a review 

of safety evaluation reports for consistency with information provided by PG&E. 

280-97-007 NRF On September 30, 1997, it was identified that during an earlier time frame Surry Units 1 and 2 had been outside the 

(MULTI-UNIT Appendix R design basis due to a 120 VAC vital bus isolation issue. From July 1988 on Unit 1 and September 1989 on Unit 

APPLICABILITY) 2 when Appendix R isolation switches were removed until August 1997 when the procedures containing interim 

(Surry 1) compensatory measures were revised, Operations did not have adequate procedural direction necessary to ensure 

isolation of the required power supplies and/or replacement of UPS fuses. Without proper isolation, power to the Appendix 

R panels may not have been available, thereby placing Surry Units 1 and 2 outside the Appendix R design basis during this 

period. Therefore, this report is being submitted pursuant to the requirements of 1OCFR50.73(a)(2)(ii)(B). When it was 

determined that Surry was outside the Appendix R design basis, appropriate compensatory measures had already been 

defined and put into place. This condition resulted in no significant safety consequences or implications, and the health and 

safety of the public were not affected at any time.

A-53
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

280-97-012 NRF On October 27, 1997, tripping of two breakers in a security distribution panel resulted in loss of power to security systems, 

(MULTI-UNIT as well as loss of power to the latching mechanism on several doors, causing the doors to become unlatched. The affected 

APPLICABILITY) doors have security, EQ, and/or fire protection functions. At the time of occurrence, Unit 1 was at 100% power and Unit 2 

was at intermediate shutdown in the process of starting up following completion of a scheduled refueling. Compensatory 

measures were implemented, as required, including security provisions. It was determined that having multiple EQ doors in 

an unlatched condition simultaneously resulted in an unanalyzed condition because the defined allowed breach times for 

the EQ doors assume no simultaneous EQ door breaches. It was also concluded that fire doors being unlatched resulted in 

being outside the Appendix R design basis because the unlatched doors may not have prevented the spread of a fire from 

one fire area to others. A design change to revise the power failure mode on the affected doors from energized-to-latch to 

energized-to-unlatch has been implemented. This report is being submitted pursuant to 1 OCFR50.73(a)(2)(ii)(A) 

[unanalyzed condition] and 1 OCFR50.73(a)(2)(ii)(B) [outside design basis]. Upon further review, it was determined that a 

previous situation also resulted in an EQ unanalyzed condition; therefore, this LER supplement is being submitted pursuant 

to 10CFR50.73(a)(2)(ii)(A). 

282-97-001 5b POWER LEVEL - 100%. On January 8, 1997 it was determined that the 125 ton Auxiliary Building Crane had been used to 

(MULTI-UNIT handle a spent fuel cask while two protective features had been defeated by wiring errors. A new radio control transmitter 

APPLICABILITY) had been procured and placed in service. The controller has critical and non-critical positions which are chosen by the 

(Prairie Island 1) crane operator. The new controller was wired differently than the old one and choosing the critical position actually put the 

controller in the non-critical position. When this was done, the main hoist drum overspeed protection was defeated as was 

the spent fuel pool roof slot limit switch. However, some overspeed protection remained functional, roof slot alignment lights 

were functional, and the crane still met the single failure proof criteria. The controllers are being made to agree with one 

another and procedures are being changed to provide additional assurance that the controller is in the correct position. 

282-97-003 6a POWER LEVEL - 100%. During preparation of a safety evaluation to justify changing the setpoints for the low discharge 

(MULTI-UNIT pressure switches for runout protection of the auxiliary feedwater pumps, a scenario was discovered where the auxiliary 

APPLICABILITY) feedwater system would not be capable of performing as assumed in the ATWS analysis as described in the plant Updated 

Safety Analysis Report (USAR). For two specific ATWS events (loss of offsite power and complete loss of feedwater), both 

auxiliary feedwater pumps could cease operating early in the transient and not be available unless the operator(s) took 

action to restore them. The ATWS analysis in the USAR assumes that both auxiliary feedwater pumps are operating 

throughout the event. This loss of the AFW pumps during either a loss of offsite power or a complete loss of feedwater 

ATWS event is not within the plant's current licensing basis. An operability evaluation was performed, with the support of 

Westinghouse, and it was concluded that the auxiliary feedwater system, as currently configured, is capable of mitigating 

the complete loss of feedwater and loss of offsite power ATWS events. Long term corrective actions to resolve the 

discrepancy between the performance capability of the Prairie Island auxiliary feedwater system and the assumptions in the 

ATWS analysis are being actively investigated.

A-54
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

282-97-004 6a POWER LEVEL - 100%. During review of system documentation by the System Engineer, it was determined that the 

(MULTI-UNIT AMSAC C-20 Permissive Setpoint was non-conservative with respect to the USAR value. As stated in USAR section 7.11, 

APPLICABILITY) the C-20 permissive arms AMSAC when turbine load is greater than 40% power. It was determined that the actual setpoint 

used by AMSAC corresponded to a turbine (reactor) power of approximately 48% power. This is non-conservative to the 

USAR requirement of 40% power. This condition has apparently existed since original installation of the AMSAC systems in 

1989/90. The AMSAC timer function (Variable Actuation Delay of 27.5 to 225 seconds) was also found to have the incorrect 

setpoints. The effect on the time delay was to shift the setpoint line described in USAR Fig. 7.11-2 towards the maximum 

time delay curve and actually exceeded the maximum time delay curve between approximately 46% and 55%power. The 

cause of the event was the assumption that First Stage Turbine impulse pressure was linear from 0% to 100% turbine load 

when, in fact, it is non-linear less than 10% turbine load. The AMSAC setpoints were revised within approximately 24 hours 

of discovery. Other setpoints that could have been mis-set by a similar error were reviewed for problems. 

282-97-006 6a POWER LEVEL - 100%. On April 11, 1997 a condition was identified that is considered outside the 1967 proposed GDC 

(MULTI-UNIT Criterion 20 requirements for protection against single failures. Specifically, a design deficiency exists which could result in 

APPLICABILITY) the failure to automatically isolate control room outside air supply upon detection of high radiation levels (for conditions 

where a safety injection would not be required) in the control room. Control room outside air supply isolation logic may be 

inadequate to assure that control room habitability is not adversely impacted during a radiological release event with a 

concurrent single failure of the control room radiation monitors. This deficiency has existed since the beginning of plant 

operation. Corrective action has been taken to ensure the outside air supply to the control room is isolated prior to 

conducting any plant operations which may result in a radiological release with the potential to exceed control room 

allowable doses. A design change to modify the logic to make the high radiation actuation logic meet the single failure 

criterion is being developed. 

282-97-011 NRF On October 3, 1997, Unit 1 was in coastdown at 94% power and Unit 2 was at 100% power. As part of investigations under 

(MULTI-UNIT way per Generic Letter 96-01, it was determined that the low pressure auto-start of No. 121 Motor-Driven Cooling Water 

APPLICABILITY) Pump was not being tested as required. Plant walkdowns and analysis also revealed that inadequate electrical separation 

exists between the No. 121 Motor-Driven Cooling Water Pump low header pressure switch and the No. 12 Diesel-Driven 

Cooling Water Pump low header pressure switch.

A-55
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

282-97-012 6a On October 9, 1997, Unit 1 was in coastdown at 89% power and Unit 2 was at 100% power. As part of the USAR review 

(MULTI-UNIT and update project, the engineering staff identified that operation of the plant during hot or cold shutdown with the shutdown 

APPLICABILITY) margin required by Technical Specifications would not provide the time identified in the USAR for operator action to mitigate 

an inadvertent boron dilution. The engineering staff also identified a potential boron dilution accident not described in the 

USAR resulting from RHR directly injecting to the vessel without adequate mixing. Procedures have been modified to 

maintain increased shutdown margin during hot and cold shutdown. Procedures are being reviewed to identify activities with 

RHR direct vessel injection and to appropriately modify these activates. This event will be analyzed and any necessary 

revision to the Technical Specifications will be submitted. 

282-97-015 5a On November 3, 1997 events were identified which previously had resulted in the inoperability of both trains of control room 

(MULTI-UNIT ventilation. Inoperability of both trains of control room ventilation is a condition prohibited by Technical Specifications. These 

APPLICABILITY) events had occurred during previous performances of a monthly surveillance, in which the outside air supply dampers to the 

control room ventilation system were opened. Some of these dampers would not have closed on a safety injection signal or 

high radiation in the control room. These dampers must close in order for the system to be on 100% recirculation, which is 

the initial post-accident configuration. Because operation with outside air supply dampers open after an accident could have 

resulted in a condition where neither train may have had the capacity to maintain control room operator doses below GDC 

19 criteria, both trains of control room ventilation should have been considered inoperable. 

282-97-016 NRF/S On November 19, 1997, Unit 1 was in Mode 6 and Unit 2 was in Mode 1 at 100% power, when a preliminary conclusion 

(MULTI-UNIT based on engineering judgment was made that the lube oil collection systems installed on the Unit 1 Reactor Coolant 

APPLICABILITY) Pumps (RCP) did not fully comply with the prescriptive requirements of 10 CFR 50 Appendix R Section 111.0. A potential 

pressurized leakage site from the oil lift pump and associated piping for 11 RCP and 12 RCP would not be captured by the 

collection pans of the installed RCP lube oil collection system. Before restarting Unit 1, a seismically qualified splash shield 

was installed over the oil lift pump and piping to divert any potential leakage to the collection pan directly below the pump. 

At the next refueling outage for Unit 2 (or mid-cycle if conditions permit), a seismically qualified splash shield will be 

installed over each RCP oil lift pump and piping to divert any leakage to the collection pan directly below the pump.

A-56
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGOR 

282-97-017 NRF On December 6, 1997, Unit 1 was in Mode 5 after completing a scheduled refueling outage. A meeting of the plant 

Operations Committee (OC) was held that afternoon to evaluate the reportability of issues associated with a modification 

package presented for OC review that morning. This modification package was for the installation of a noncombustible 

radiant heat shield around cabling to pressurizer level transmitter 1 LT-433, where it is within 20 ft of cabling to pressurizer 

level transmitter 1 LT-426. After reviewing the available materials and questioning the involved staff, it was concluded that 

the condition of cabling to 1 LT-433 and 1 LT-426 did not satisfy the separation criteria of 1 OCFR50 Appendix R Section 

III.G.2. Notification was made pursuant to the requirements of 1OCFR50.72(b)(1)(ii) for the plant being in a condition that is 

outside its design basis. A noncombustible radiant energy shield has been installed over the cabling associated with 

transmitter 1 LT-433 where it is within 20 ft of cabling associated with transmitter 1 LT-426. 

285-97-001 6b POWER LEVEL - 100%. Following the report by Millstone Unit 2 of a problem with the calculation of Main Steam Safety 

(Fort Calhoun) Valve (MSSV) setpoints on September 3, 1996, Fort Calhoun Station (FCS) began an investigation to determine if similar 

issues applied. It has been determined that on only one occasion, over the life of the plant, have the number of inoperable 

MSSVs exceeded the design basis as recalculated due to this incident, discovered that the pressure drop to the MSSVs 

was not being taken into account. The root cause of this event was an inadequate vendor review of a CESEC code 

modeling. When the code modeling was originally developed, the analysis methodology should have accounted for piping 

pressure losses associated with flow. CESEC does not have the capability for directly modeling pressure drop in the piping. 

Therefore, the potential existed for pressure to exceed the code allowed during a single Main Steam (MS) isolation valve 

closure event. OPPD has performed the necessary analysis to update the design basis of the plant to account for the error 

discover and reported in this LER. Guidance has been provided to the operating staff to ensure that the design basis is 

maintained. A revision to the FCS Technical Specifications will be submitted to appropriately reflect the new design basis. 

285-97-004 NRF During an April 1997 review of the equipment credited for Control Room/Cable Spreading Room fire safe shutdown, it was 

determined that the Diesel Generator No. 2 (DG-2) speed sensing circuit's analog output was not capable of being isolated 

from the Control Room/Cable Spreading Room. A fire in the Control Room could have caused a short circuit of the 

tachometer or applied 120 VAC or 130 VDC voltage across the speed sensing switch tachometer loop output terminals, 

which could have damaged the speed switch built-in power supply. In addition to providing output to the tachometer circuit, 

the speed sensing switch also provides power to four set-point relays. Three of these four relays function to prevent the 

secondary air start motor from engaging if the engine exceeds 40 rpm, disengage the air start motors and open the DG-2 

outside air dampers at 100 rpm, and flash the generator field at 750 rpm. Since the speed sensing switch has a common 

built-in power supply for the tachometer circuit as well as for the set-point relays, its damage could have resulted in not only 

the tachometer circuit becoming inoperable, but also could have de-energized or rendered the set-point relay circuits 

inoperable. This could have adversely affected the operation of the DG-2. The issue does not involve any common mode 

failure, only DG-2 is credited for meeting the Appendix R requirements.

A-57
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

285-97-015 7 During a review of the Direct Current (DC) Distribution System described in the Updated Safety Analysis Report (USAR), a 

discrepancy regarding the operation of the station batteries without battery charger operation in the event of a Design Basis 

Accident (DBA) was identified. No analysis exists to support the Fort Calhoun Station (FCS) USAR battery capacity 

requirements without a charger during a DBA. There is an analysis of the 8-hour battery capacity for the Station Blackout 

(SBO) scenario. The station batteries are considered operable based on the similarities in DC loads needed to operate in 

response to the DBA and SBO scenarios and minimizing DC loads if a battery charger is lost. It has been concluded that 

the root cause of the plant being in an unanalyzed condition is the lack of a detailed plant design calculation and/or analysis 

to provide the supporting information related to the eight-hour capacity requirement for the station batteries in the event of a 

DBA without battery charger operation. The USAR verification project that discovered this issue is continuing. The approach 

of this USAR review will help ensure that other errors like this will be caught and corrected. A calculation is being developed 

to support the USAR requirement for the station batteries. 

285-97-016 7 On October 28, 1997, Westinghouse informed Fort Calhoun Station (FCS) of issues regarding fuel rod internal pressure, 

the status of the PAD code (a Westinghouse fuel performance code), and concerns with the fuel rod design criteria. When 

initially notified, FCS was advised that Westinghouse could not preclude the possibility of plants with Integral Fuel Burnable 

Absorber (IFBA) fuel being outside their fuel design criteria due to fuel clad gap reopening, and that the 17 percent 

maximum cladding oxidation limit, as delineated in 1 OCFR50.46, may be exceeded. Since that time, and based on the 

LOCA analyses which have been performed to date by Westinghouse, an initial pre-transient 12 percent oxidation has been 

established as a screening criteria to permit assessment of plants regarding compliance with the 17 percent maximum 

cladding oxidation criterion of 10CFR50.46. OPPD was informed by Westinghouse that FCS will not exceed the 12 percent 

oxidation criteria prior to the end of the current operating cycle. FCS had previously planned on replacing Westinghouse 

Zirc-4 fuel with either Westinghouse ZIRLO fuel or non-Westinghouse fuel during the 1998 refueling outage. This fuel 

replacement will help resolve this issue. 

285-97-017 6b While reviewing recent industry operating experience on the potential for nitrogen voiding in safety injection systems, the 

Omaha Public Power District (OPPD) determined that a similar condition may exist for the Fort Calhoun Power Station 

(FCS). An engineering susceptibility evaluation was performed for the FCS which indicated that the Low Pressure Safety 

Injection (LPSI) and High Pressure Safety Injection (HPSI) systems at FCS have the potential for water hammer should 

nitrogen voiding occur in the systems. The evaluation indicates that several supports would have reaction loads exceeding 

design allowables for the LPSI system from water hammer if voiding existed. Based on previous SI tank leakage and 

potential for low header pressure, the SI system may have voided and been in an unanalyzed condition in the past. No 

comparable voiding has occurred in the HPSI system. Based on a review of design documents it has been inferred that the 

plant's architect engineer did not consider water hammer in the piping and support design. OPPD will modify the system to 

install vents at appropriate locations. System performance will be monitored to determine the effectiveness of this solution.

A-58
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT F I~CATEGORYI 

286-97-003 NRS On March 13, 1997, with the plant at 100 percent power and normal temperature and pressure, operations reported the 

(Indian Pt. 3) plant outside design basis as a result of an engineering determination that there was a design deficiency in the 125 volt DC 

Electrical Distribution System (EDS) power supplies due to an inability of the system to meet single failure criteria during 

use of a backup battery charger (BC). The reported condition existed periodically since a design modification added a 

backup battery charger (BC-35) to the 125 volt DC EDS and powered it from a 480 volt AC bus that is supplied from one of 

three Emergency Diesel Generators (EDG-33). When BC-35 is used in lieu of a normal charger to sustain the DC power 

supply supporting one of the other two EDGs, a Loss of Offsite Power or Safety Injection and a postulated single failure to 

EDG-33, or its associated bus/power circuit could result in loss of two BCs. Subsequent battery depletion could result in 

loss of one of the two remaining EDGs. The potential loss of two of three EDGs places the plant outside its design basis. 

The event was caused by the original classification of BC-31, 32, 33 as non-seismic which was relied upon for the 

modification to add BC-35 and resulted in no consideration of cross-tie effects. Further review determined that the 

non-safety classified BC's perform a safety function. The cause of classifying the BC's originally as non-seismic was the 

unavailability of qualified BCs, but the failure to adequately justify their classification could not be determined. Corrective 

actions include an evaluation to document the BC's design basis, re-classification of BCs 31, 32, 33, 35 as Seismic Class 

I/QA Category I, revision of procedure and issuance of a temporary modification for limited use of BC-35. This event had no 

significant effect on the health and safety of the public. 

286-97-006 NRS On May 8, 1997, with the plant at 95 percent power, Engineering determined that the plant had been operated outside the 

design basis in the past when the Refueling Water Storage Tank (RWST) was aligned to the non-seismic purification loop of 

the Spent Fuel Pit Cooling Loop because design requirements for isolation had not been identified and proceduralized. A 

failure of the purification loop pressure boundary, without proper provisions for isolation, would affect the RWST inventory 

available for the safety injection system. The event was due to personnel error during the original design process. The 

corrective action was to establish administrative controls to require a trained person at isolation valves AC-727A and 

AC-727B during operation of the RWST purification loop while above cold shutdown to assure the system is isolated 

following an earthquake, safety injection or as required by the control room. The feasibility of plant modifications is being 

assessed. An extent of condition review is underway. There was no significant effect on public health and safety.

A-59
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

286-97-007 2b On May 20, 1997, with the plant in a cold shutdown condition, NYPA determined that the sequence of emergency operating 

procedure (EOP) steps to re-position the service water discharge throttle valves on the component cooling heat exchangers 

had potentially placed the plant outside its design basis. The EOP may not have ensured the design basis accident 

minimum service water flow requirements were met. During a postulated loss of coolant accident and prior to going on 

recirculation these manual valves needed to be repositioned open to a predetermined throttled position to provide sufficient 

heat removal capability. During normal operation these valves were throttled below the prescribed setting to maintain 

component cooling water temperature within the normal operating range due to seasonal river water temperature 

conditions. The cause was human error during the revision of the EOPs and non-formal implementation of design basis 

information. An operability determination established the minimum required throttle positions for fifty degree river water and 

this requirement was implemented until the current outage started. Service water and component cooling water EOP steps 

have been verified to comply with design. Additional review of EOPs may be required and this will be identified prior to plant 

startup. A procedure change will be issued to include the operational limits required to ensure the design is maintained. This 

event had no affect on the health and safety of the public because, based on preliminary engineering evaluation, the 

associated components are believed to be able to perform their function during the postulated event. 

286-97-014 5b This Licensee Event Report (LER) describes events pertaining to the lack of Weld Channel and Containment Penetration 

Pressurization System (WCCPPS) air supply to the 80' and 95' airlock shaft seals, equalizing ball valve flanged joints and 

containment penetration welds. At the time of discovery of these events, the plant was in cold shutdown condition due to a 

refueling outage. On August 5, 1997, at approximately 1852 hours, during installation of the 80' airlock shaft seal upgrade, it 

was discovered that the weld channel port to the existing door mechanism shaft seal had been blocked by the seal housing 

flange gasket. This condition prevented weld channel supply to the airlock door shaft seal. On 8/7/97, at approximately 

1655 hours, the Authority discovered that the 3/4" pipe associated with 80' inner door seal pressure gauges P1-1434 A & B 

that directly penetrates the 80' airlock inner bulk head did not have WCCPPS air supplied to the containment boundary 

weld. It was also discovered that the equalizing ball valve flanged joints had no WCCPPS supply. An extent of condition 

review indicated that the same discrepancies existed on the 95' airlock. Corrective actions have been completed that 

ensure supply of WCCPPS air to the 80' and 951 airlock shaft seals, equalizing ball valve flanged joints and containment 

penetration welds. The purpose of WCCPPS is to prevent potential leakage of the Vapor Containment air to the surrounding 

environment and eliminate offsite doses in the event of a design basis accident. However, without WCCPPS, offsite doses 

would still be within the limits of 10 CFR Part 100. The cause of these events was personnel error. Repairs were made to 

correct these deficiencies. These events had no effect on the health and safety of the public.

A-60
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

286-97-020 6b On September 3, 1997, with the plant in hot shutdown, the Independent Safety Engineering Group determined that the main 

boiler feed pump motor operated discharge valves would not close upon receipt of a feedwater isolation or safety injection 

signal if they were opening. These discharge valves have been opened in the past while starting up and following repairs 

while the plant was in a condition where the valves were credited for mitigation of a feedwater addition accident or a steam 

pipe rupture. The discharge valves, manufactured by Crane-Teledyne, have an "RY" relay circuit which is operated by the 

valve closed torque switch and valve open limit switch. The "RY" relay circuit is designed so that the valve closed torque 

switch (actuated when the valve is torqued shut) de-energizes the valve closing circuit and blocks re-energization until the 

valve reaches the full open position. If a feedwater isolation or safety injection signal is received while the valve is in an 

intermediate position, during the opening stroke, the valve will stop opening and reclosure is prevented. The cause is 

probably personnel error in original plant design. Administrative controls are in place to assure feedwater isolation, 

considering a single failure, when the valves are opened during startup. These administrative controls will be maintained 

until Engineering has assessed and completed corrective action. This event had no significant effect on the public health 

and safety. 

286-97-022 3a On September 11, 1997, at approximately 1634 hours, with the plant at 30 percent power and normal temperature and 

pressure, NYPA determined that inadequate Emergency Operating Procedure (EOP) instructions could have caused two 

motor driven High Head Safety Injection (HHSI) pumps to operate without flow during the transfer to hot leg recirculation 

following a postulated Loss of Coolant Accident. Containment Isolation Valves on the discharge header for the HHSI pumps 

are re-positioned to the closed position in accordance with EOP ES-1.3 when the HHSI system is not in operation. EOP 

ES-1.4, for re-aligning the plant for hot leg recirculation, did not account for this prior re-positioning. This could have 

resulted in the HHSI pumps being operated in a dead-headed configuration. The cause was an inadequate procedure 

review attributed to the lack of instructions in the EOP review process and ineffective verification and validation when the 

requirements were added to the EOP ES-1.3 on June 12, 1989. ES-1.4 was revised on August 25, 1997 to require the 

HHSI valves to be opened. A review of other safety related pump operation in the EOPs determined that isolation of 

non-automatic valves would not impact a system operation. This event did not cause a significant increase in risk to the 

public health and safety.

A-61
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

286-97-030 6a On November 7, 1997, while operating at 100 percent power, the New York Power Authority (NYPA) reported that the 

Indian Point 3 (IP3) plant was outside it's design basis because the ATWS Mitigating System Actuation Circuitry (AMSAC) 

automatically arms at 40 percent turbine impulse pressure rather than 40 percent reactor core power. AMSAC was declared 

inoperable and an administrative limiting condition for operation action statement was entered. The cause is personnel error 

that led to an inconsistency in the topical report between the specified requirement for the AMSAC setpoint and the 

analytical basis. NYPA performed a reasonable assurance of safety that found that the AMSAC is capable of performing its 

design function at the current setpoint. NYPA is assessing what the proper permanent corrective action should be. There 

were no effects on public health and safety due to the deviation from the AMSAC setpoint requirement since AMSAC would 

have performed its intended design function. 

286-97-031 3c On December 12, 1997, with the plant operating at 100% power, Engineering determined that the plant might have been 

outside of its design basis during past operation. A design configuration was discovered in which, for a specific and limited 

set of plant conditions, the Auxiliary Feedwater (AFW) System would not meet single failure criteria. The design 

configuration is that certain AFW System controls associated with two motor-driven pumps are powered from the same 

instrument bus. The specific condition required is a safety injection signal or loss of offsite power at the same time that 

Instrument Bus 33 is connected to its backup power supply. The result is the tripping of both motor-driven pump motors due 

to flow runout, so that a single failure of the remaining turbine-driven pump would prevent the AFW system from performing 

its design function. The cause of the event could not be definitively determined because the design configuration was 

present at initial plant startup. A probable cause is that design personnel did not recognize that certain controls for the 

motor-driven pumps were required to prevent flow runout and thereby protect the pump motor from tripping on excess 

current. Corrective actions were taken to modify the design configuration. The event did not affect the health and safety of 

the public because the actual length of time when plant conditions were subject to the single failure was minimal. 

287-97-002 6c On April 1, 1997, while reviewing previously identified problems on Unit 3's Reactor Building Cooling Units (RBCU) fan 

(Oconee 3) motor circuits, it was recognized that a potential past operability concern existed. Potentially underrated fuses had been 

replaced with fuses of a higher rating on June 21, 1995. On May 1, 1997, with Unit 3 operating at 100% full power, an 

Engineering evaluation concluded that the Unit 3 RBCUs were technically past inoperable, prior to June 1995, because the 

fuses in the primary circuit of Unit 3's RBCUs control power transformer were underrated. This might have prevented the 

RBCUs from re-starting during a LOCA/LOOP upon receipt of an Engineered Safeguard signal. The root cause is 

manufacturing deficiency, functional design deficiency, electrical. Corrective actions included replacing all three units' RBCU 

fuses.

A-62
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-63

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

287-97-003 2c On May 3, 1997, Unit 3 was being shutdown to verify the integrity of the High Pressure Injection (HPI) System nozzles. Unit 

3 was at approximately 240 degrees and 270 psig with a Low Pressure Injection pump and a Reactor Coolant Pump in 

operation. At approximately 0915 hours, the 3A and 3B HPI pumps were damaged due to operation with an inadequate 

suction source. Both Letdown Storage Tank (LDST) level instruments erroneously indicated level was 55.9 inches for about 

one hour and forty five minutes prior to the damage to the HPI pumps. However, at the time of the failure, the tank was 

essentially empty. Subsequent investigation determined the reference leg of the LDST level to be partially drained. The 

Operators responded to the event and placed the unit in a stable condition. On May 5, 1997, an Engineering evaluation 

determined that the inaccurate level made the HPI system inoperable at some point between February 22, 1997 and May 3, 

1997. This is significant because operation in this condition is outside the design bases of the HPI System. The root cause 

is a combination of a design weakness of a common reference leg for the LDST level instruments and a leaking instrument 

fitting due to an inadequate work practice. A contributing cause was the failure to adequately apply available operating 

experience. Corrective actions include a modification of the LDST level instruments. 

289-97-001 6b POWER LEVEL - 100%. On January 17, 1997, during a review of piping systems that penetrate containment as requested 

(Three Mile Is. 1) by Generic Letter (GL) 96-06, 'Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident 

Conditions,' GPU Nuclear determined that most of the eleven (11) affected piping segments could be stressed beyond the 

piping design code (B31.1-1967) allowable stresses during a design-basis accident. This condition was found to be 

reportable in accordance with 10CFR50.73(a)(2)(ii)(B) as a condition in which the plant was found to be outside of its 

design basis. The analysis modeled the effects on internal fluid and piping in response to an external ambient temperature 

increase. The results revealed that although the piping did not meet the design requirements, the postulated stresses did 

not exceed ASME Section III, Appendix F criteria for piping. Therefore containment integrity would be maintained during an 

accident. Using the guidance in NUREG/CR-5455, 'Development of the NRC's Human Performance Investigation Process 

(HPIP),' the root cause was found to be that the applicable design standards were 'less than adequate - confusing or 

incomplete.' Operability determinations were performed and further evaluations are ongoing to determine the need for 

modifications or procedural revisions. There were no adverse safety consequences or safety implications. The event did not 

affect the health and safety of the public.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

289-97-002 6b POWER LEVEL - 100%. On January 29, 1997, GPU Nuclear reviewed the operability of Feedwater Startup Block Valves, 

FW-V92 A/B. Improvements to the GL 89-10 program had led to more conservative assumptions being used in the valve 

thrust calculations. The new assumptions increased the calculated thrust requirements for the valves. Although calculations 

were not yet design verified,' there was reason to believe the valves may not close fully during a Main Steam Line Break 

(MSLB). FW-V92A/B are required to close by a signal from the Heat Sink Protection System (HSPS) when Once Through 

Steam Generator (OTSG) pressure decreases to less than 600 psig. Technical Specification 3.5.1.9 requires HSPS 

operability when the reactor is critical and establishes a 72 hour allowable outage time with a single train inoperable. With 

FW-V92A/B inoperable for greater than 72 hours, this condition is an event which is reportable in accordance with 10 CFR 

50.73(a)(2)(I)(B) as a condition in which the plant was-not in compliance with its Technical Specifications. The torque switch 

settings for FWN92NB were increased to ensure full valve closure during a MSLB. The root cause was weakness of the 

Motor Operated Valve (MOV) Program. All valves in the GL 89-10 MOV program are being reevaluated using justifiable and 

conservative assumptions. The safety consequences associated with this event were minimal. 

289-97-003 6b On February 24, 1997, GPU Nuclear determined that suction piping for Make Up pumps A & C may have been stressed 

beyond the piping design code (B31.1-1967) allowable stresses during ES Testing and could be similarly over stressed 

during system response to a design-basis accident. This condition was found to be reportable in accordance with 10CFR 

50.73(a)(2)(ii)(B) as a condition in which the plant was found to be outside of its design basis. An analysis of the effect of 

the overpressure condition on the piping and components was performed. The results revealed that although the piping and 

components may not have met the design requirements, the postulated stresses did not exceed ASME Section III, 

Appendix F criteria. Therefore system integrity would be maintained. Using the guidance in NUREG/CR-5455, Development 

of the NRC's Human Performance Investigation Process (HPIP), the root cause was found to be "standards, policies, or 

administrative controls (SPAC) Less than adequate - technical errors." The system was determined to be operable and 

procedure changes will be implemented prior to startup from the 12R outage to prevent future occurrence. There were no 

adverse safety consequences or safety implications that resulted from this event, and the event did not affect the health and 

safety of the public.

A-64
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-65

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY_1__ 

289-97-009 6b On July 25, 1997, as a result of reviewing a plant event reported to the NRC by the Crystal River Unit 3, GPU Nuclear 

personnel determined that a similar condition existed at TMI-1. It was identified that a loss of 'A' station DC distribution and 

a concurrent loss of offSite power would affect both trains of Engineered Safety Features (ESF) equipment. As expected, 

the 'A' train of ESF equipment would be made inoperable by this event due to the loss 'A' train AC and DC power. In 

addition, 'B' Train Engineered Safeguards Actuation System (ESAS) would actuate with inability to bypass the "B" train of 

ESAS. If this failure were to occur concurrently with a large break loss of coolant accident, no procedural guidance was 

available to operators to allow them to bypass ESAS and take control of components as required to throttle reactor building 

spray flow and complete switchover to the reactor building sump. The inability to bypass "B" train of ESAS upon loss of 

power on "A" Train results from a design arrangement in which three analog channels fan out to two trains of logic. Two of 

the analog channels are powered from "A" Train power. This design has existed since initial plant operation. The root cause 

of the condition was determined to be a failure of the plant's designers to properly consider the bypass of Train B of ESAS 

on a loss of offsite power and a loss of 'A' DC. Procedure changes were implemented which restored the ability to control 

the 'B' Train ES components. The condition was reported per 10 CFR 50.72(b)(2)(iii). 

289-97-010 2a On October 13, 1997, GPU Nuclear (GPUN) Inc. determined that the Pilot Operated Relief Valve (PORV) installed during 

the 11 R refueling outage was not capable of being opened during the operating cycle prior to refueling outage 12R. GPUN 

reached this conclusion on the basis of post-maintenance testing of the PORV replacement installed during the 12R outage 

and from observation of lead landings on the valve removed from service. This condition was found to be reportable in 

accordance with 1OCFR50.73 (a) (2) (I) (B) as a condition which is prohibited by the plant Technical Specifications, in that 

Inservice Testing (IST) required by ASME code and the TMI Inservice Inspection Program was not properly conducted on 

the PORV following its replacement during 11 R, and which if conducted properly would have led to the early discovery of its 

inability to be cycled. The root cause of the event was identified as personnel error. During the valve reinstallation in 11 R, 

the power supply leads to the PORV solenoid were improperly terminated; and the error went undiscovered because of a 

failure to perform the required PMT on the valve following its installation pursuant to Technical Specification 4.2.2. There 

were no adverse safety consequences or safety implications resulting from this event, and the event did not affect the 

health and safety of the public.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

293-97-011 3c The Pilgrim Station design basis includes a requirement for redundant and independent salt service water (SSW) system 

(Pilgrim) trains such that no single active failure can prevent the SSW system from fulfilling its safety objective (i.e., to provide 

cooling water to the reactor building closed cooling water (RBCCW) system). The design basis of the SSW system also 

includes the requirement for the normally cross-connected SSW trains be automatically isolated upon loss of the preferred 

AC power source. During a Service Water Operational Performance Inspection (SWOPI) follow-up NRC inspection, a single 

failure vulnerability was identified which placed the unit in a condition thought to be outside the design basis. Specifically, a 

single failure of a 125 Vdc battery, under certain conditions, would compromise the redundancy and independence of the 

SSW system and potentially lead to a SSW pump cavitation condition. It was determined that a single failure of a 125 Vdc 

battery might defeat the SSW loop independence and redundancy if the SSW swing pump was selected for dedication to 

the opposite safety train and a loss of off-site power occurred. Such a DC failure would disable the associated diesel 

generator and one of the SSW discharge header division valves. As a result, the SSW loops would remain 

cross-connected, and one SSW pump would supply both loops of SSW for a short time, potentially in a cavitating condition. 

A temporary modification was implemented that required closing one of the division valves in the common SSW discharge 

header to effect redundant and independent cooling water loops and to preclude the potential pump cavitation condition. 

The condition posed no threat to public health and safety. 

293-97-015 3a On November 4, 1997, while reviewing the results of recent off-site performance testing of the bowl assembly of a salt 

service water (SSW) pump, it was identified that with a single pump operating and supplying one cooling loop, the pump's 

brake horsepower will approach 113 HP. The current drawn by the pump motor at this load, in particular under a 

conservative assumption of ten percent decrease in motor terminal voltage, could have resulted in an overload (OL) relay 

trip with the (then) existing trip setting of 100 percent of the pump motor thermal OL relay. Both containment cooling system 

loops were declared inoperable and a twenty-four hour cold shutdown limiting condition for operation (LCO) was entered in 

accordance with Technical Specifications at 1940 hours on November 4, 1997. The root cause of the condition involving the 

SSW pumps is attributed to a variation in SSW pump BHP characteristics due to the Original Equipment Manufacturer 

(OEM) for these pumps being changed from Goulds Pumps to Johnston Pump. Immediate corrective action taken consisted 

of sequentially removing the SSW pumps from service and resetting the OL relay for each service water pump motor to 115 

percent. Prior to declaring the SSW pumps operable, each OL relay was tested satisfactorily. The LCO was terminated at 

0300 hours on November 5, 1997. The condition was discovered during power operation while at 100 percent reactor 

power. The reactor mode selector switch was in the RUN position. The reactor vessel pressure was about 1035 psig with 

the reactor water at the saturation temperature for that pressure. The condition posed no threat to public health and safety.

A-66
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

293-97-017 7 On March 21, 1998, the measured temperature in the "A" Diesel Generator Room went below the updated FSAR Table 

10.9-1 design temperature of 60 degrees Fahrenheit (F). LER 97-027-00 and LER 98-002-00, described prior events where 

the emergency diesel generator (EDG) building air temperature went below the design value. These events were strongly 

influenced by the wind direction and speed. Several corrective actions discussed in LER 98-002-00 had been implemented 

at the time of this event, and the Pilgrim Station operations staff was able to monitor the temperature in the EDG building 

more effectively. Design changes necessary to prevent recurrence are being evaluated and are statused in this 

supplemental LER. Corrective actions taken since the previously reported event (LER 98-002-00) include completion of an 

engineering evaluation and vendor confirmation which provided the basis for the lower limit of EDG starting capability at an 

air temperature of 40F and procedure revisions to increase operator awareness of EDG room temperatures. This condition 

was identified while at 100 percent reactor power with the reactor mode selector switch in the RUN position. The reactor 

vessel pressure was approximately 1035 psig with the reactor water temperature at the saturation temperature for the 

reactor pressure. The condition posed no threat to public health and safety. 

During certain periods of past operation, the inlet seawater temperature of the open loop, safety-related salt service water 

(SSW) system was greater than 65 degrees F. The 65 degree F parameter is significant because, prior to the issuance of 

license amendment 173 on July 3, 1997, 65 degrees F was assumed in safety-related heat removal analyses described in 

the updated final safety analysis report (UFSAR). The cause of operating with seawater/SSW inlet temperatures greater 

than 65 degrees F was ambiguity in the licensing basis. Actions taken included the issuance of a safety evaluation, and a 

license amendment request. UFSAR changes identified in the safety evaluation were included in the 1996 update of the 

UFSAR. Subsequently, license amendment 173 authorized plant operation with seawater temperatures to 75 degrees F. 

This report is submitted as part of corrective actions identified in response to NRC findings contained in Inspection Report 

97-05. Broader corrective action planned regarding licensing basis ambiguity will be tracked as part of the commitments 

made during an enforcement conference held on November 21, 1997. The condition occurred while operating at various 

power levels and included 100 percent reactor power operation. The condition posed no threat to public health and safety. 

293-97-018 7 The drywell temperature analysis of record (1987) was nonconservative until 1996 due to a NSSS supplier computer 

modeling error. The computer modeling error involved certain small steamline breaks and an incorrect assumption that 

drywell temperature would be equal to the reactor vessel temperature. Subsequently, a new NSSS supplier analysis 

predicted a higher drywell temperature profile than the analysis of record. An immediate evaluation of the environmental 

qualification of all affected safety-related equipment inside the drywell determined that all equipment was qualified except 

the position indicators of five containment isolation valves which were subsequently verified qualified through retesting. A 

new NSSS supplier analysis has been accepted and the environmental specification revised to incorporate the new drywell 

temperature profile. A more conservative containment analysis has been mandated by License Amendment 173. All input 

values and assumptions are being approved by BECo prior to acceptance of the analysis. This report was submitted 

following reassessment of reportability as a result of NRC Inspection 97-05.

A-67
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

293-97-019 3b During past periods of reactor operation when the reactor building closed cooling water (RBCCW) system was required to 

be operable, actions to close RBCCW valves that supply cooling water to non-essential heat loads were not contained in a 

written procedure (s). Specifically, the closure of RBCCW system valves to isolate non-essential loads during design basis 

loss of coolant accident conditions was not translated into a procedure (s) , contrary to the updated FSAR. The cause was 

inadequate design control in that the action to isolate RBCCW flow to non-essential heat loads during accident conditions 

was not translated into a procedure. Corrective actions taken included performing a safety evaluation and revising a 

procedure to include the action, and initiating calculations to demonstrate adequate RBCCW flow will be supplied to all 

safety-related heat loads when the non-essential RBCCW heat loads are not isolated. This report is submitted as a result of 

findings stemming from NRC Inspection Report 97-05. Broader corrective actions to be taken will be tracked as part of 

commitments made at an enforcement conference held on November 21, 1997. The condition existed since initial plant 

startup. During that time, reactor operation occurred at various reactor power levels including 100 percent. 

293-97-020 7 During past periods of reactor operation when the RHR system was required to be operable, Pilgrim Station operated 

outside the design basis because procedures to establish an RHR flow-rate that did not comport with the analysis of record 

or the design-basis as described in the UFSAR. Specifically, containment heat removal during a design-basis loss of 

coolant accident with a flow-rate as low as 4800 g.p.m. in procedures was less than the 5100 G.P.M. established in the 

analysis of record (UFSAR Chapter 14 and calculation M-664). The cause was inadequate translation of analysis 

parameters to operating procedure parameters. Corrective actions taken included performing a safety evaluation and 

revising the RHR operating procedures to reflect the UFSAR Chapter 14 and calculation M-664. Broader corrective action 

will be separately tracked as part of commitments made at an enforcement conference held on November 21, 1997. This 

report is submitted as a result of findings stemming from NRC Inspection Report 97-05. The condition could have existed 

since initial plant startup. During that time, reactor operation occurred at various reactor power levels including 100 percent. 

293-97-021 6b During past periods of reactor operation when the emergency diesel generators (EDGs) were required to be operable, 

Pilgrim Station operated outside the design as described in FSAR Table 10.9-2 because ambient air temperatures 

experienced during certain periods were greater than the 88 degrees F shown on the table. The cause has been attributed 

to ambiguity in the FSAR; the 88 degree value is believed to be a nominal design parameter and not a design limit but the 

FSAR is not clear on this point. Since the system sections of the FSAR only describe the safety design basis and the safety 

design objectives, not the bounding parameters for analysis, it is difficult to objectively determine which parameters 

constitute the design basis as defined in 10CFR50.2 and which provide design information. Broad corrective action includes 

a design basis recapture project and upgrading the FSAR to clearly describe design basis information. These commitments 

will be tracked as part of the commitments made at an enforcement conference held on November 21, 1997. This report 

was submitted as a result of findings contained in NRC Inspection Report 97-05. This condition has occurred during certain 

summer periods since initial plant startup. During those periods, reactor operation occurred at various power levels 

including 100 percent.

A-68
1997 Licensee Event Reports with Design-Basis Issues (Continued)

TY EVENT ABSTRACT 

ORY I 

On October 31, 1997, at about 1230 hours, PNPS engineers discovered the Radwaste Building in a configuration not 

considered in the Updated FSAR or tornado depressurization analysis. Thus, a design basis tornado could have affected 

the availability of Class 1 equipment stored or housed in (and adjacent to) the Radwaste Building. The tornado 

depressurization analysis assumes the truck doors (a single set) to the Radwaste Building will fail at a differential pressure 

of 0.5 psi. Engineers discovered two complete door assemblies installed in the doorway, both in the closed position. As a 

result of the discovery, one of the doors was tagged open. The cause was inadequate control of the subcompartment 

barriers. Immediate corrective actions included opening and tagging one of the doors. Longer term corrective actions 

include implementing a formal program to control subcompartment barriers and evaluating the Radwaste Building trucklock 

doors to confirm the acceptability of both doors being closed. The condition was discovered during power operation while at 

100 percent reactor power. The reactor mode selector switch was in the RUN position. The condition posed no threat to 

public health and safety. 

On October 23, 1997, during a review of the primary containment atmosphere control system as a result of a General 

Electric (GE) notification of a potential 10CFR21 issue regarding suppression pool (torus) bypass leakage, one potential 

bypass flow path was identified through which the drywell air space could communicate with the torus air space. The 

potential for this event existed while in the valve line up for inerting the primary containment because a single failure could 

occur that causes valves AO-5035A and PCIS AO-5036A to fail open on a primary containment isolation signal. These 

valves share a common actuating relay, RPWA1 and relay contact 1-2, that provide the primary containment isolation 

system signal to these valves. If the plant was in the process of changing from torus to drywell inerting and a LOCA event 

occurred, a single failure of relay RPWA1 to de-energize or the single failure of relay RPWA1 contact 1-2, to open would 

prevent AO-5035A and AO-5036A from closing, resulting in a steam bypass path from the drywell to the torus air space 

without passing through the torus downcomers. This operating configuration was determined to be outside the design basis 

of the of the plant. Immediate action was taken to establish administrative controls that preclude entry into the inerting 

portion of Pilgrim Nuclear Power Station Procedure 2.2.70, "Primary Containment Atmosphere Control System." Procedure 

2.2.70, will be revised to eliminate this vulnerability. This event posed no significant threat to the public health and safety

A-69

293-97-023

293-97-024

4
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-70

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

293-97-027 5b During past periods of reactor operation, when the emergency diesel generators (EDGs) were required to be operable, 

Pilgrim Station operated outside the design as described in FSAR Table 10.9-1 for the diesel generator room heating and 

ventilation because room air temperatures experienced during certain periods were less than the 60 degrees F shown on 

the table. The cause has been attributed to ambiguity in the FSAR. Because the system sections of the FSAR describe the 

safety design basis and the safety design objectives, not the bounding parameters for analysis, it is difficult to objectively 

determine which parameters constitute the design basis, as defined in 10CFR50.2, and which provide design information. 

Compensatory measures will be instituted when the diesel generators are not running and the room air temperature is 

below 60 degrees F. Broad corrective action includes a design basis recapture project and upgrading the FSAR to clearly 

describe design basis information. An analysis to determine the design temperature limits for the diesels will be performed 

in conjunction with the design basis reconstitution project. This condition has occurred during certain winter periods since 

initial plant startup. During those periods, reactor operation occurred at various power levels including 100 percent. 

293-97-028 6a On December 17, 1997, at 1708 hours, PNPS personnel informed the NRC that the tornado depressurization analysis did 

not consider all of the depressurization pathways in the intake structure. Thus, a design basis tornado could have affected 

the availability of Class 1 equipment stored or housed in the intake structure. The station tornado procedure requires 

operators to secure open all intake structure doors, thereby creating large openings not considered in the tornado 

depressurization analysis. The cause was inadequate control of the tornado barriers. Operations declared the intake 

structure operable based on an engineering evaluation (EE 97-068) that showed the additional vent paths, not considered 

in the tornado analysis, are insignificant compared to other larger openings already considered in the analysis. Long term 

corrective actions include resolving the inconsistencies between the tornado depressurization analysis for the intake 

structure and the station tornado procedure. PNPS also plans to implement a formal program to control compartment 

barriers. The condition was discovered during power operation while at 100 percent reactor power. The reactor mode 

selector switch was in the RUN position. The condition posed no threat to public health and safety.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-71

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

293-97-029 3a On December 16, 1997, while reviewing the results of a previous reportability evaluation (August, 1997), the determination 

was made that the SDC suction isolation valves were vulnerable to mechanical damage from a potential failure mode 

involving hot shorts and that this condition was outside the design basis of the plant. The condition could have caused a 

spurious operation of these MOVs during a control room or cable spreading room fire, resulting in damage to either of these 

valves such that the SDC mode of the RHR system would not be available to support the safe cooldown of the plant. The 

cause of this condition is attributed to the failure to recognize the new failure mode discussed in NRC IN 92-18. Immediate 

corrective action consisted of implementing a temporary modification on August 21, 1997, when the condition was originally 

discovered. The temporary modification de-energized both valves by opening their respective breakers which removes the 

potential failure mode for a postulated hot short damaging either valve. Long term corrective action will consist of either 

converting the temporary modification to a permanent change or developing another design change to modify the control 

circuits for these MOVs. The condition was discovered during power operation while at 100 percent reactor power. The 

reactor mode selector switch was in the RUN position. The reactor vessel pressure was approximately 1035 psig with the 

reactor water at the saturation temperature for that pressure. The condition posed no threat to public health and safety. 

293-97-030 7 On December 24, 1997, a discrepancy was identified between FSAR Table 5.2.1 which identifies the approximate drywell 

free volume to be 147,000 cubic feet and draft engineering calculations which indicate the actual free volume to be 

approximately 137,000 cubic feet. The 147,000 cubic feet drywell free volume value was used as a design input for a 

variety of design basis calculations and analyses. The inappropriate use of FSAR Table 5.2.1 drywell free volume value in 

design basis calculations and analyses appears to have resulted from incomplete understanding and validation of its basis. 

Corrective action taken included reviewing affected calculations and verifying operability. Corrective action planned includes 

revising the FSAR Table 5.2.1 to clarify the drywell free volume value and completion of drywell volume calculations. The 

condition was identified while at 100 percent reactor power with the reactor mode selector switch in the RUN position. The 

reactor vessel pressure was approximately 1035 psig with the reactor water temperature at the saturation temperature for 

the reactor pressure. This report is submitted in accordance with 10 CFR 50.73(a)(2)(ii)(B). The condition posed no threat to 

public health and safety.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

295-97-001 2a On 1-10-97 while in mode 5, during a dimensional verification for a pending modification, it was noted that two 1" holes 

(MULTI-UNIT were not in the Unit 2 containment recirculation sump cover plate as detailed on a plant structural drawing. At approximately 

APPLICABILITY) 0700 on January 11, 1997 inspection of the Unit 1 sump cover plate verified that the holes on that plate were missing also. 

(Zion 1) Because adequate venting capability of the sump could not be proven, the operating department declared both Residual 

Heat Removal (RHR) [BPI Pumps inoperable, entered Technical Specification 3.8.3 and placed Unit 1 on a 4 hour limiting 

condition for operation (LCO). The sump covers on both units were removed, holes were drilled and the covers replaced. 

Upon completion of this work the RHR Pumps were declared operable. The holes are believed to have been missed 

because of an original plant construction installation error. The investigation could not determine why the holes were 

missing. An evaluation has been performed to show there was ample time for operators to align alternate water sources to 

the Refueling Water Storage Tank (RWST). Therefore the safety significance of this event is minimal. 

295-97-008 7 POWER LEVEL - 000%. On March 21, 1997, while investigating applicability of a vendor notification letter, Station 

(MULTI-UNIT Maintenance Engineering discovered High Efficiency Particulate Air (HEPA) filters containing aluminum were installed in 

APPLICABILITY) unit 1 and 2 reactor containment buildings. The surface area of aluminum installed as a result of these HEPA filters 

exceeded the 915 square foot limit established by the Updated Final Safety Analysis (UFSAR). This condition can cause 

excessive Hydrogen gas concentrations during the Design Basis Loss of Coolant Accident (LOCA) as a result of the 

reaction between the aluminum and the sodium hydroxide solution in the containment spray fluid. The originally installed 

HEPA filters were certified by the manufacturer on 16-OCT-73 to comply with the non-aluminum requirement of the design 

specification. The original filters were in place in the Containment Charcoal Filter Units (CCFU), two in unit 1 and two in unit 

2, until replaced as corrective work to address decreasing filter efficiencies. The plant's four CCFU HEPA filters were 

replaced in the period between April, 1992 and January, 1994. This event was caused by failure to verify the parts were 

correct. Public safety was not adversely affected during this period. The assessment of safety consequences shows the 

lower flammability limit for hydrogen would not have been reached within 30 days of the LOCA, and venting the 

containment to alleviate excess hydrogen would not have been necessary. Therefore, 10CFR100 limits would not have 

been impacted due to this event. Corrective actions for this event are removing or replacing the aluminum containing HEPA 

filters, strengthening standards and control of part specification practices in work package preparation, and training 

appropriate personnel. (NUREG 1022 CODE E).

A-72
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-73

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORYT 

295-97-011 5c On April 23, 1997, the Main Steam Line pressure transmitters were declared inoperable. The pressure transmitter 

(MULTI-UNIT instrument setpoints were based on a loop accuracy calculation that did not utilize the correct cable lengths or take into 

APPLICABILITY) account the elevated temperature resulting from a Main Steam Line Break (MSLB). Use of the proper (longer) cable lengths 

and elevated temperature introduces inaccuracies into the instrument loops because of increased leakage currents from the 

instrument cables that could prevent the performance of safety functions. The safety significance of this issue is minimal 

because there are other devices that perform the same protective functions and indications. The root cause of the event is 

management deficiency since ComEd exercised inadequate control over contractor prepared calculations in 1991. 

Contributing to the event, the CoinEd EQ group failed to transmit the necessary information to the affected groups as 

required by procedure. The corrective actions are to revise the instrument loop insulation resistance (IR) calculations, 

replace the Fischer Porter pressure transmitters, assess the need to perform a modification to upgrade the instrument 

cables, and conduct training to emphasize the necessity for interdisciplinary review. LER 1-97-020 resulted from the 

performance of corrective actions for this LER. Additional corrective actions are discussed in LER 1-97-020. (NUREG code 

A,E) 

295-97-018 6c Since original start-up, Zion has cross-tied 125 VDC buses to accommodate battery and charger testing and equalization 

(MULTI-UNIT charging without restricting loads on the bus. In 1996 detailed battery calculations were performed to model the cross-tie 

APPLICABILITY) configurations. During cross-tying of buses, it was determined that a bus with a disconnected battery could not fulfill its 

design basis requirements. The root cause was an inadequate Technical Specification review process. The Nuclear Safety 

significance is dependent upon the plant configuration and equipment out-of-service at the time the cross-tie was used. A 

Safety analysis performed indicates that the risk imposed by cross-tying buses is minimal due to the station's three division 

design. Corrective actions include document revisions and training.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-74

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

295-97-020 5a On September 8, 1997 a review of Safety Evaluation (97-472) and Appendix 3A of the UFSAR, "Analysis of the Effects of a 

(MULTI-UNIT Main Steam or Feedwater Pipe Break Outside the Containment" identified an apparent discrepancy between the as-built 

APPLICABILITY) plant conditions and the assumptions made in the UFSAR analysis. UFSAR Appendix 3A states that all electrical cabling 

associated with the nuclear safety related (autoclose) operation of the Main Steam Isolation Valves (MSIVs) are routed 

outside the steam tunnel but, in fact, the cables for the main steam pressure transmitters are routed inside the tunnel. 

These transmitters initiate a close signal to the MSIV when high main steam flow exists. Low-low RCS temperature 

concurrent with high main steam flow will also close the MSIVs for this design basis steamline break outside containment. 

The UFSAR is not clearly worded regarding which safety related cables may run through the main steam (MS) tunnel. 

Consequently there is an incomplete description of the assumptions used for the Zion Design Basis and for UFSAR 

Appendix 3A. The root cause investigation is continuing and further contributing causal factors and corrective actions will be 

included in the supplemental report which will follow this initial report. Immediate actions were to review the as-built 

configuration against design basis events, supported functions and post accident monitoring. Preliminary results of this 

review show the ability of the MSIVs to autoclose after the Appendix 3A event is not compromised. But it is not conclusive 

regarding other safety related cabling in the area of concern. 

295-97-022 6a On October 22, 1997 it was concluded that the station potentially relies on a non-safety related heating system to keep the 

(MULTI-UNIT Control Room Habitable during an accident. The findings to date indicate that an unacceptable Administrative Limiting 

APPLICABILITY) Condition for Operation (LCO) has allowed continued plant operation which will not insured that the Control Room remains 

habitable following a combined Loss of Offsite Power and Loss of Coolant Accident (LOOP/LOCA). The UFSAR clearly 

states that the Control Room will remain habitable during various accidents including a LOCA. A potential safety concern 

exists which must be resolved prior to restarting either Unit 1 or Unit 2 and prior the movement of irradiated fuel. The 

potential existed after instituting the unacceptable Administrative LCO not maintain the Control Room habitable during a 

LOCA. Immediate actions were to place an ENS phone call and review the as-built configuration against design 

requirements. The results of this review are to complete repairs to the safety-related outlet damper OPDV-OV01 and revise 

applicable station procedures. The root cause is still under investigation.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-75

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

295-97-023 6b During review of the operator actions to align the Auxiliary Building Ventilation System during the transfer to cold leg 

(MULTI-UNIT recirculation phase of a LOCA, it was discovered that placing hand switch OHS-AV95 in the "cubicle mode" does not also 

APPLICABILITY) align the exhaust air flow from the pipe tunnels through charcoal filters. Because the Class I pipe tunnel and the Fuel 

Building exhaust air flow dampers react to the radiation monitors. there will be a time delay between the radiation detection 

in the pipe tunnel and damper repositioning to direct the air flow through the charcoal filters. This time delay will result in a "puff" of air unfiltered by charcoal to atmosphere. The radiation release described in the UFSAR for Control Room 

Habitability did not consider this unfiltered release. The off-site dose analysis for the general radiation release also did not 

consider this unfiltered release. The cause of the event is an original analysis error. The safety significance of this event is 

minimal with regard to the affect on Control Room Habitability and off-site dose release. A modification is being performed 

to assume all required ventilation is filtered through charcoal when done so manually. 

298-97-001 6b POWER LEVEL - 100%. While performing engineering evaluations in response to NRC Generic Letter 96-06, it was 

(Cooper) determined that six containment penetrations are susceptible to thermally induced over pressurization during certain design 

basis accidents. At 1340 hours on January 30, 1997, it was determined that this situation was reportable as a condition 

outside design basis. The apparent cause for this condition is the failure to recognize and address the potential failure 

modes described in Generic Letter 96-06 during original plant design and construction (NUREG 1022, Appendix B, Cause 

Code B). An evaluation of the structural integrity of the bounding configuration demonstrates that continued operability is 

assured for all six penetrations. Evaluation of the six affected penetrations to quantify the impact and required corrective 

actions is continuing. Corrective actions planned or taken to resolve this issue will be communicated to the NRC in follow up 

response to Generic Letter 96-06.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-76

LER NUMBER SAFETY EVENT ABSTRACT F CATEGORY 

298-97-010 6a On July 16, 1997, at 1054, a design deficiency was discovered wherein during a Design Basis Accident (DBA) concurrent 

with a Loss Of Offsite Power (LOOP), the Standby Gas Treatment (SGT) system would not have been capable of fulfilling 

its function. This was discovered when a half group 2 isolation isolated the steam supply to the Augmented Off Gas (AOG) 

system (Ref. LER 97-009). Subsequent to this AOG isolation, about 5200 gallons of water were pumped from the Z sump. 

The Hi-Hi-Hi sump level alarm was not annunciated, indicating that the pump was able to maintain the water level in the 

sump within normal levels. The safety function of the Z sump is to maintain the water level in the sump below the level 

where it could back into the SGT system discharge line and adversely affect SGT operation. Since the Hi-Hi-Hi sump level 

alarm is below the bottom of the SGT discharge lines operability of the SGT system was maintained throughout the event. 

Subsequent investigations revealed the design deficiency described above. Since the Z sump pumps are not required to be 

provided with essential onsite power until several hours after event initiation, the Z sump could have been sufficiently 

flooded to have prevented SGT operation. On 7/16/97 at 1054, a one hour notification was made as a condition outside 

design basis. On 7/21/97 surveillance procedure 6.SUMP.101 was performed, with AOG in service, to demonstrate 

operability of the Z sump. This procedure injects demineralized water into the 48" holdup line drain line which would then 

flow to the sump to verify pump and level switch operation. Water was injected into the drain line for about 30 minutes 

(about 750 gallons) without any water entering the sump as evidenced by the fact that neither of the pumps started nor did 

the Hi-Hi-Hi level alarm annunciate. The AOG system was secured and subsequently about 1000 gallons of water was 

pumped from the sump. A one hour notification was made as a condition outside design basis. On August 30, 1997, the 

AOG system was returned to service without affecting the operability of the SGT system.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY I EVENT ABSTRACT 

CATEGORY 

298-97-012 5b On 8/4/97 at approximately 0338, after completion of a quarterly High Pressure Coolant Injection (HPCI) surveillance, it was 

discovered that the suppression pool level had risen to nearly 3 inches above normal water level. This exceeded the 

Technical Specification (TS) 3.7.A.1 .b maximum water volume of 91,100 cubic feet (i.e., 2 inches above normal water 

level). This TS limit is also a design basis limit. This situation occurred because of inadequate operations crew supervisory 

oversight. The suppression pool level was not adequately monitored and controlled to prevent the level from exceeding the 

TS and design basis limit. Contributing factors to this situation included: failure of an operator to perform the actions 

required by an annunciator response procedure; an inadequate HPCI surveillance procedure that did not provide preventive 

measures to ensure the suppression pool level did not exceed the TS limit; an inadequate annunciator response procedure 

that did not provide instructions to restore the level below the alarm point and preclude exceeding the TS limit; and 

Operations crew supervision's decision to proceed with the HPCI surveillance because it had been delayed twice in the 

shift. Corrective actions taken were: 1) lowered the suppression pool volume to below the TS limit; 2) issued Operations 

Night Orders to ensure the suppression pool level is maintained below alarm levels and alarm response procedures are 

followed; 3) revised the HPCI surveillance procedures to ensure that the initial level is sufficiently low so that the final level 

does not exceed the alarm level; and 4) revised the suppression pool high level annunciator procedure to provide direction 

for restoring level to below the alarm point and to indicate the level corresponding to the TS volume limit. In addition, Priority 

1 and 2 alarm response procedures were reviewed for similar inadequacies and found to have adequate instructions. To 

prevent recurrence, a formally approved Crew Improvement Plan will be implemented and Operations crews will be trained 

in the lessons learned from this situation. 

298-97-014 5b On November 3, 1997, during activities to evaluate Reactor Equipment Cooling (REC) system integrity, three manual 

sample valves to the REC filter demineralizer skid located on a header which supplies cooling flow to non-critical loads, 

were determined to have a normally open position to permit continuous sampling of the REC system chemistry. The 

resultant REC system inventory loss of approximately 228 gallons per day, combined with the loss of non-essential 

make-up water, could have affected the ability of the REC system to meet its design basis function. This condition was 

determined to be reportable on November 8, 1997. The cause of this event is attributed to a failure to fully understand the 

design basis functions of the REC system which resulted in an inadequate design review and 1OCFR50.59 Safety 

Evaluation of the Design Change that installed the filter demineralizer skid. Immediate action was taken to close the three 

sample valves.

A-77
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-78

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

301-97-001 NRS POWER LEVEL - 000%. On January 7, 1997, while Point Beach Nuclear Plant (PBNP) Unit 2 was shut down and defueled 

(Point Beach 2) during its annual refueling outage, plant personnel identified one location where the clearance between internal Unit 2 

containment structures and the containment liner was not in accordance with the plant design basis. 2, plant personnel 

noted that the Unit 2 'A' containment accident fan platform was in contact with the containment liner located opposite to an 

indicated void between the containment liner and concrete containment structure. This configuration could have resulted in 

a containment breach during a safe shutdown earthquake which is contrary to the plant design basis. The Unit 2 

containment structure was immediately declared inoperable. Plant engineers walked down the remainder of the Unit 2 

containment and documented eight additional locations of concern. The Unit 1 containment was also inspected, and 

although several areas of concern were identified, further evaluations determined the Unit 1 containment to be operable. 

301-97-002 NRS On April 15, 1997, with Unit 1 in cold shutdown and Unit 2 in a defueled condition, pipe stress calculations indicated that the 

Unit 2 Reactor Coolant System (RCS) Loop "B" RTD (resistance temperature detector) branch connection to the top of the 

RCS hot leg piping could be stressed in excess of the design basis code allowable limits. The calculated stresses did not 

exceed the interim operability limits described by the licensing basis; therefore, the piping is considered operable. 

Evaluation of similar piping in Unit 2 Loop "A" and in Unit 1 did not identify stresses in excess of code allowables. The 

potential stress problem was identified during an engineering consultant's programmatic review of Point Beach 

safety-related tubing. This calculated stress condition may have been inherent to the original design, but should have been 

identified and remedied when the configuration was analyzed in 1987. Those calculations applied RCS thermal/seismic 

anchor movements in the wrong direction, which provided non-conservative results. Support modifications are planned to 

restore the stresses to within their design basis limits.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-001 6c POWER LEVEL - 000%. On January 28, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in 

(Crystal River 3) MODE 5 (COLD SHUTDOWN). Discussions with NRC inspection personnel identified that FPC had not explicitly reported a 

condition that existed prior to May, 1996 involving inadequate net positive suction head (NPSH) affecting one of the two 

Emergency Feedwater Pumps (EFP). On a loss of 'B' DC power, the turbine-driven pump's (EFP-2) flow control valves 

would remain fully open and EFP-2 would start in a maximum flow condition resulting in cavitation from inadequate NPSH 

which could lead to pump failure. In addition to an Emergency Diesel Generator load management concern, the postulated 

loss of 'B' DC power single failure coincident with a Small Break Loss of Coolant Accident and Loss of Offsite Power, a low 

probability event, could have resulted in two situations in which emergency feedwater may not have been available to 

perform its intended safety and accident mitigation functions. These include a design feature which trips the motor driven 

pump, EFP-1 at a Reactor Coolant System pressure of 500 pounds per square inch gauge, and a point in time at which 

EFP-1 would need to be secured in order to load the Low Pressure Injection pump onto the EDG in order to provide 

adequate NPSH to the High Pressure Injection pump. As a result, CR-3 was in an unanalyzed condition which could have 

rendered the emergency feedwater system incapable of fulfilling its intended safety and accident mitigation functions. The 

cause of this event was ineffective configuration change management. Corrective Actions include a power upgrade of the 

'A' EDG, EFW system modifications to eliminate NPSH concerns, and a failure modes and effects analysis. 

302-97-004 6b On February 7,1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

FPC performed a design review of the Nuclear Service Closed Cycle Cooling Water (SW) and Industrial Cooling Water (Cl) 

systems in accordance with Generic Letter 96-06. Based on the review, FPC determined the selection of the thermal relief 

valves did not take into consideration the back pressure inside the reactor building (RB) during main steam line break 

(MSLB) and loss of coolant accident (LOCA) conditions. The engineering evaluation concluded that the containment 

integrity was not adversely affected due to the relief valves in the SW and Cl systems. The conditions inside the RB during 

a MSLB and LOCA were not adequately considered during the selection of the thermal relief valves due to personnel error. 

No immediate corrective actions were necessary because CR-3 was in MODE 5. FPC will issue a Modification Approval 

Record (MAR) to replace the existing thermal relief valves and reinstall the inappropriately removed relief valves in the SW 

and CI systems inside the RB by November 20, 1997. Nuclear Engineering Procedure NEP-213, "Design Analysis 

Calculations," has been revised to include a requirement for a review of the design by the system engineer, plant 

operations, and other organizations, as applicable. No other LERs have been issued related to thermal relief valves in the 

SW and CI systems.

A-79
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-005 3b POWER LEVEL - 000%. Florida Power Corporation's Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN) on 

February 14, 1997. A team studying Emergency Diesel Generator (EDG) capacity and Emergency Feedwater (EFW) 

system dependency issues discovered an unanalyzed condition involving a Small Break Loss of Coolant Accident 

(SBLOCA) in the reactor coolant cold leg discharge piping line coincident with a Loss of Offsite Power (LOOP) and single 

failure of the turbine-driven Emergency Feedwater Pump, EFP-2. CR-3 has two limitations related to EDG load margin 

concerns which trip the motor-driven emergency feedwater pump, EFP-1. EFP-1 is automatically tripped when the Reactor 

Coolant System (RCS) depressurizes to 500 pounds per square inch gauge (psig). Also, EFP-1 may be manually tripped 

when the Low Pressure Injection (LPI) pumps would need to be loaded onto the EDG in order to take suction from the 

Reactor Building Sump to provide adequate net positive suction head (NPSH) to the High Pressure Injection (HPI) pumps 

upon depletion of inventory from the normal source. For a certain range of small breaks, the RCS may repressurizes. For 

an unisolable cold leg pump discharge line break or an isolable broken HPI line that may not be identified, if emergency 

feedwater is lost early in the transient, there may be inadequate HPI flow to the core, even with two HPI pumps operating. 

With a combination of insufficient HPI injection and no EFW, 10 CFR 50.46 requirements may not be met. The cause of this 

condition was a misunderstanding of the reliance on emergency feedwater for SBLOCA mitigation. Action will include an 

upgrade of the EDGs and development of accident mitigation strategies to ensure EFW remains available and operator 

guidance exists for HPI flow management with or without EFW. 

302-97-007 6b On, March 6,1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

FPC made a four hour report to the NRC in accordance with 10 CFR 50.72(b)(2)(1), as being in an unanalyzed condition 

(Reference Event Number 31903). On February 13, 1997, FPC discovered the temperatures in the plant are not being 

maintained in accordance with the Environmental & Seismic Qualification Program Manual (ESQPM). On March 6, 1997, 

after an engineering evaluation, FPC declared CR-3 was in an unanalyzed condition because the instrument uncertainties 

were unknown due to inadequate temperature controls and may effect the setpoints for safety related instrumentation. If 

actual temperature variations were greater than those used in the development of these calculations, instrument 

calibrations and equipment performance could potentially be adversely impacted. A lack of commitment to configuration 

management resulted in controls and procedural guidance being insufficient to ensure ambient temperatures were 

maintained within the required temperature ranges in the buildings. Procedural guidance to ensure engineering 

requirements specified in the calculations and implementing procedures receive adequate review by implementing 

organizations, is scheduled to be completed by October 15, 1997. Nuclear Engineering Procedure NEP-213, was revised to 

require a review of the FSAR, Enhanced Design Basis Document and Improved Technical Specifications as part of the 

calculation approval.

A-80
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-81

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-008 3b POWER LEVEL - 000%. On March 7,1997, Crystal River Unit 3 (CR-3) was in COLD SHUTDOWN. A review was 

completed which determined that a condition previously identified in October, 1996 as a restart issue had not been 

adequately reviewed and evaluated for reportability. This resulted in the discovery that the plant had been in an unanalyzed 

condition during a Small Break Loss of Coolant Accident (SBLOCA) that could result in transfer of contaminated water from 

the Reactor Building sump to the Auxiliary Building via the Makeup Tank resulting in dose rate increases. In addition, 

another scenario could result in a failure to establish High Pressure Injection (HPI) pump recirculation which could lead to 

HPI pump failure. This condition was reported as a 4-hour report at 1748 hours in accordance with 10 CFR 50.72(b)(2)(1). 

The scenario of concern occurs during certain SBLOCAs after regaining subcooling margin (SCM). The cause of the event 

was design error in that CR-3's original design did not adequately consider the full range of break sizes and did not address 

a very small break LOCA that would result in a requirement to throttle HPI to the point where minimum flow recirculation is 

required. CR-3 will remain shut down until this and other design margin deficiencies are resolved. A plant modification will 

ensure recirculation capability to the makeup pumps will be provided to assure adequate pump protection and prevent 

overflow of the makeup tank. 

302-97-009 NRF On March 19, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5, (COLD SHUTDOWN). 

As a result of a walkdown of the Reactor Coolant Pump [AB, P] (RCP) Motors [AB, MO] performed as part of the system 

readiness review, FPC identified several leakage sites in the RCP motor lubricating oil system that were outside the 

boundary of the oil collection system [LM] (LOC) and therefore, not in compliance with the requirements of 10CFR50, 

Appendix R, Section 111.0. This condition is outside the design basis of the plant. The cause of potential leakage sites 

outside the LOC was an inadequate design of the LOC system due to programmatic deficiencies and lack of attention to 

detail. RCP motor lubricating oil system piping components located outside the oil collection system are a potential fire 

hazard associated with uncontained RCP motor lubricating oil. FPC performed a walkdown of five RCP motors (four 

installed and one in storage) to identify potential lubricating oil system leakage sites on the RCP motors that are outside the 

lube oil collection system. Potential leakage sites determined to be outside of the LOC system, for the installed RCP 

motors, will be in compliance with 1 OCFR50, Appendix R, Section 111.0 by November 26, 1997. There have been three 

previous reportable events involving the RCP motor LOC system at CR-3.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

302-97-010 NRF On March 27,1997 Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). A 

Precursor Card was generated by FPC questioning the habitability of areas in the plant that contain safe-shutdown 

equipment in post-fire conditions. On April 21, 1997, after the review of the CR-3 Appendix R Fire Study and the Fire Study 

supporting documents, FPC discovered that heating, ventilation, and air conditioning (HVAC) consideration in support of 

post-fire manual actuation of safe-shutdown equipment has not been specifically evaluated and documented in the Fire 

Study. This condition was evaluated by FPC on April 21, 1997, and was determined to be reportable pursuant to 

1OCFR50.73(a)(2)(ii)(B). The CR-3 Appendix R Fire Study did not take into account the loss of ventilation for the manual 

operation of post-fire safe shutdown equipment. FPC will perform calculations and/or revise the procedures necessary to 

manually operate equipment for post-fire safe shutdown for elevated temperature environment. The action plan identified in 

Problem Report PR 96-0401 will be annotated to identify the above condition, during the complete review of the post-fire 

shutdown analysis, as a corrective action step. PR 96-0401 will be utilized to evaluate and track concerns and initiate 

corrective actions for the CR-3 Appendix R program. 

302-97-011 6a On May 29, 1997, Florida Power Corporation's Crystal River Unit 3 was in MODE 5 (COLD SHUTDOWN). A reportability 

determination was made based on a condition previously discovered on March 15, 1997 during the system readiness 

review of the Emergency Feedwater System (EFW). A re-evaluation of EFW isolation valves EFV-32 and EFV-33 

determined they are potentially susceptible to pressure locking during a very specific set of conditions in which a steam 

environment is caused by a pipe break and the valves cannot reopen after they close on a steam generator [AB,SG] overfill 

signal. If pressure locking did occur, EFW would not be able to provide a continuous emergency supply to the steam 

generators, possibly placing the plant in a condition outside its design basis. This condition was caused by an inadequate 

calculation prepared to assess the potential for occurrence of pressure locking and thermal binding (PLTB). The planned 

installation of cavitating venturis in the EFW pump discharge lines will reduce the maximum flow rate and increase the time 

to overfill the steam generators. EFV-32 and EFV-33 will be modified or replaced prior to plant restart. The PLTB calculation 

will be reviewed by October 26, 1997. The procedure for preparation of calculations has been revised to ensure system 

engineers and plant operations review assumptions and results. 

302-97-012 NRS On May 31, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

FPC engineering personnel were performing an assessment of containment integrity. During the review, FPC determined 

that a portion of the industrial cooling (CI) piping system, located within the reactor building (RB), failed to meet the 

Engineered Safeguards (ES) requirements applicable to a closed piping system. At the time the deficiency was identified, a 

reportability evaluation was conducted, which concluded that this deficiency comprised a condition outside the design basis 

of CR-3. Currently, there is minimal safety significance associated with the present condition, since with the plant in MODE 

5, containment isolation valve operability is not required. The cause of this event was a design error by the engineering 

organization. Corrective actions include the upgrading of the associated piping, supports and coolers inside containment to 

meet safety classification and seismic requirements. Similar events were reported in LERs 88-016, 89-012, and 95-025.

A-82
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-83

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY I 

302-97-013 6b On May 30,1997, Florida Power Corporations's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5, COLD SHUTDOWN. A 

reportability determination was made based on a condition previously discovered on February 1, 1997, during a functional 

test on the emergency diesel generators (EDG). FPC determined a potential exists for the EDG rooms to exceed the design 

basis temperature of 120 degrees F, when the outside air temperature is 95 degrees F, or greater. Exceeding the 

temperature limit in the EDG rooms would result in CR-3 being in a condition outside the design basis. The 120 degrees F 

limit is to provide an acceptable environment for the electrical equipment in the EDG room. The electrical component 

temperatures were recorded and evaluated during the functional tests. FPC concluded the components will perform their 

required function in the increased temperature environment and the EDGs will perform their intended function. There is no 

impact to the general public health and safety. Inadequate EDG room cooling resulted in a potential to exceed the design 

basis temperature limits. FPC will improve cooling air flow to the EDG rooms during EDG operation to maintain the 

temperature at or below 120 degrees F by December 1, 1997. 

302-97-014 6b On June 11, 1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN) 

when the evaluation of a suspected design basis issue concluded that the issue represented a condition outside FPC's 

design basis. FPC personnel were performing a review of reactor building penetrations as a corrective action to resolve 

penetration surveillance concerns documented in LER 50-302/96-018-01. During the review, FPC determined that a portion 

of the Reactor Building Pressure Sensing & Testing, Spent Fuel Cooling, and Nitrogen, Hydrogen & Carbon Dioxide 

Systems may not be adequately designed and/or tested to ensure post accident reactor building integrity. A subsequent 

evaluation of the suspected design basis issues concluded that the deficiencies constituted conditions outside the design 

basis for CR-3. Currently, there is minimal safety significance since containment isolation valve operability is not required in 

MODE 5. The cause of this event was a design error by the engineering organization during plant construction. Corrective 

actions include a review of other reactor building penetrations for similar conditions and the implementation of appropriate 

actions (modifications, analyses, and/or testing) to ensure that reactor building penetrations meet the design bases for 

CR-3. Similar events were reported in LER 50-302/96-018-01 and LER 50-302/97-012-00.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-015 3b On June 12,1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

During a review of the differential pressure calculation for the Letdown Line [CB] Inboard Containment Isolation Valves, 

FPC discovered that the evaluation of the maximum differential pressure (dP) that these valves could be subject to is in 

error. These valves are rated to close against a maximum dP of 1800 pounds per square inch (psi), but could be subjected 

to a dP in excess of 2000 psi in the event of a letdown line rupture downstream of outboard containment isolation valve 

(MUV-49), concurrent with a failure of MUV-49 to close and operator action in accordance with Emergency Operating 

Procedure (EOP) 3. Upon further evaluation, on August 19, 1997, FPC discovered that outboard containment isolation 

valve MUV-49 would not be capable of closing if subjected to 2000 psi dP. Isolation at Penetration 333 requires either 

MUV-49 or MUV-40/41/505 to close. The cause of this event was the use of inappropriate assumptions in the calculation for 

the determination of maximum valve dP. In accordance with 10 CFR 50.72(b)(2)(1), a Four Hour Non-Emergency 

Notification was made on this issue (Event # 32472). A Modification Approval Record (MAR) is being developed to install a 

new inboard containment isolation valve prior to restart of CR-3. In addition, the air operator on MUV-49 will be modified to 

allow closure against the predicted dP. 

302-97-016 3b On June 13,1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN) 

when the evaluation of a suspected design basis issue concluded that CR-3 was in an unanalyzed condition. Specifically, 

FPC engineering personnel had questioned the coating used on Core Flood Tanks CFT-1 A and CFT-1 B. The existing 

coatings were not approved for use in the reactor building. Additionally, the coatings were not identified in the calculations 

addressing reactor building coating failures. Personnel resolving the coatings issue subsequently identified three open 

south "D" wall penetrations which provided open debris transport paths that were not accounted for in the reactor building 

coating failure calculations. The latter condition was the subject of a four-hour notification to the NRC on June 19, 1997. 

Currently, there is minimal safety significance since Emergency Core Cooling System train (Reactor Building Emergency 

Sumps) operability is not required in MODE 5. The cause of this event was cognitive engineering error during the 

development and review of engineering calculations that evaluate reactor building coating failures. Corrective actions 

include correcting the specific deficiencies and performing reviews to ensure that coatings are qualified and open debris 

transport paths have been identified inside the reactor building. No similar events have been reported.

A-84
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-85

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-017 6b On June 21, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

On May 1, 1997, while performing a modification in the main control board, FPC personnel noticed that electrical separation 

materials previously installed was different than that being currently installed. On June 21, 1997, FPC concluded the 

materials previously installed (Nextel) was incorrect. The materials was used to sleeve cables for electrical separation 

during the installation of a modification to the HPI Flow Indicators. The modification to the HPI flow indicators was 

performed during the tenth refueling outage (11 OR), spring 1996. Electrical separation ensures a failure in one cable will 

not disable other related trains or systems. The HPI flow indicators assist the reactor operators in isolating a faulted HPI line 

during certain design basis accidents. Personnel error during the installation resulted in the incorrect materials being used 

for electrical separation. A walkdown of other areas is scheduled to be completed by September 15, 1997, to identify areas 

where Nextel may have been used. Two other LERs were issued by FPC concerning electrical separation. 

302-97-018 NRF At 1949, on July 2,1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN) when an issue was determined to be reportable under 1 0CFR50.72(b)(2)(l) (Event No. 32580) and 

1OCFR50.73(a)(2)(ii)(A). In 1990, FPC became aware of the potential for losing both control complex chillers following a 

high energy line break (HELB) in the Intermediate Building (IB). FPC implemented a Modification Approval Record (MAR) 

installing a manual valve for isolating the Chilled Water System from the lB. The 1OCFR50.59 evaluation for the MAR 

considered failure of the operating chiller and a single active failure being the standby chiller. The evaluation inappropriately 

took credit for the nonsafety-related Appendix R chiller and a temporary chiller for concluding that an unreviewed safety 

question did not exist. Prior NRC approval was not requested. The cause for the initial condition was design error during 

construction. The cause for the current condition was an inadequate 1OCFR50.59 evaluation. A loss of control complex 

cooling could affect the control complex habitability envelope and allow temperatures in vital areas to exceed limits for 

ensuring continued operation of electrical equipment. Currently, minimal safety significance is associated with the existing 

condition. A HELB is not credible in MODE 5. Corrective actions include re-evaluating a HELB in the Intermediate Building, 

continuing the System Readiness Review program, and the recent 1OCFR50.59 program enhancements.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-019 3b On July 3,1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). As 

part of the effort to support the power upgrade modifications of the Emergency Diesel Generators (EDG), testing of EDG-1A 

identified elevated EDG radiator, control and engine room air temperatures. This increase is due to a portion of the radiator 

discharge air released to atmosphere from the roof of each EDG building being recirculated back into the EDG radiator 

room. The recirculated air can cause the supply air to the EDG rooms to be increased 10 to 15 degrees Fahrenheit (F), 

depending on wind conditions, above the design basis outside air temperature of 95 degrees F. Analysis of EDG capability 

at these temperatures identified that EDG-1A&B are in a degraded condition. A reportability determination was made on 

July 3, 1997, and in accordance with 10 CFR 50.72(b)(2)(I) and (b)(2)(iii)(D), a Four Hour Non-Emergency Notification was 

made regarding this issue (Event Number 32589). Failure to identify this effect was due to a design oversight during initial 

plant design. A modification to reduce the recirculation of the radiator discharge air is being developed. Implementation and 

testing will be completed by February 28, 1998. Previous Licensee Event Report (LER) 97-013, dated June 26, 1997 

identified a potential for temperatures in the EDG engine rooms to exceed their design basis temperature of 120 degrees F 

when outside air temperature was 95 degrees F or greater. The results of LER 97-013 are affected by this current LER. 

302-97-021 6c This LER is being supplemented to revise the corrective actions. On July 21, 1997 Florida Power Corporation's (FPC) 

Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). During the Class 1 E Electrical Direct Current (DC) 

Failure Modes and Effects Analysis (FMEA) review, FPC identified that during a loss of offsite power (LOOP) coincident 

with loss of the train "A" 250 volt (V) battery prior to starting the Emergency Diesel Generator (EDG) 1 A, the ability to 

bypass the "B" Engineering Safeguards (ES) train actuation signals is lost. A four hour report was made to the NRC 

pursuant to 10CFR50.72(b)(2)(l) (Event Number 32659). When the "A" battery is inoperable and EGDG-1A does not start, 

train "A" ES components do not operate. During a LOOP event, coincident with the loss of "A" 250V battery and EGDG-1A, 

power to the "A" and "C" inverters is lost (Vital Bus "A" and "C"). Loss of the train "A" 250V battery will also prevent ES 

analog channel 1 and channel 2 Trip Bistables from being bypassed after actuation. Therefore, ES actuation signals for 

train "B" components remain actuated. The apparent cause is an inadequate FMEA for the original plant design. This cause 

resulted in inadequate procedures and training on event recovery. FPC will install a new relay with contacts in parallel to the 

existing bypass permissive bistable contacts and the bypass permissive indication light contacts for "B" train, channel 1, 

HPI and LPI.

A-86
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-87

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-022 6a On July 21, 1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN) 

when the cumulative effect of several recently discovered deficiencies was determined to be reportable under 

10CFR50.73(a)(2)(ii)(B). Design deficiencies associated with past modifications to the Control Complex Habitability 

Envelope (CCHE) and Control Room Emergency Ventilation System (CREVS) could have the combined effect of allowing 

post-accident doses to Control Room operators to exceed allowable limits. Minimal effect exists for the current condition. 

CREVS is only required to be operable in MODES 1-4 and during irradiated fuel movement. Deficiencies were caused by 

design engineering process weaknesses. Current engineering processes contain adequate guidance to prevent recurrence. 

Improved Technical Specification (ITS) 5.6.2.12.c CREVS charcoal adsorber laboratory test requirements for humidity will 

be amended or a calculation will be performed to support the 70% humidity test requirement. New calculations for Control 

Room operator dose and design of CREVS will be developed. Physical modifications and testing will be implemented. 

Similar events were reported in LERs 50-302/96-016-00 and 50-302/97-020-00. 

302-97-023 3a On July 30,1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN) 

when a design basis deviation was determined to be reportable under 1OCFR50.72(b)(2)(l) and 1OCFR50.73(a)(2)(ii)(A). At 

1015, on July 30, 1997, FPC completed the four-hour notification (Event No. 32699) required by 10CFR50.72.(b)(2)(I). FPC 

personnel discovered a trip coil in the control circuitry for vital bus inverters VBIT-1A/1C direct current (DC) input breakers 

that was not analyzed when their replacement was implemented during Refueling Outage 10. The batteries, in combination 

with the inverters, are designed to provide an uninterruptible source of power to support the Station Blackout requirement 

for CR-3. The inverter DC input breaker low voltage trip circuit could interrupt this source of power prematurely. The cause 

for this condition was a weakness in the engineering process for component procurement. The inverter design will be 

reviewed. The inverters will be modified, as appropriate. Nuclear Engineering Procedures will be revised to provide 

guidance for ensuring correct design requirements are reflected in component procurement documents. No similar LERs 

were identified.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-024 6a On July 31, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). On 

June 13, 1997, while performing the System Readiness Review (SRR) for the Feedwater System (FW), FPC identified a condition whereby the differential pressure (dP) across feedwater suction valves FWV-14/15 could prevent the valves from 

closing in response to a signal from the Emergency Feedwater Initiation and Control System (EFIC)[JB]. Upon completion of an evaluation on July 31, 1997, FPC determined this was a condition outside of the design basis. A Steam Line Break 

(SLB) or Feedwater Line Break (FWLB) is not a credible event while in MODE 5, therefore no immediate actions are necessary. These deficiencies were caused by inadequate design and calculation errors. The reanalysis of the Final Safety Analysis Report (FSAR) Chapter 14 SLB will be completed by September 30, 1997. A modification to upgrade the actuators on feedwater suction valves FWV-14 and FWV-1 5 is scheduled to be completed by November 20, 1997. The Final Safety Analysis Report (FSAR) will be updated by November 30, 1997 to reflect the new analysis, which will include conservative 

assumptions for Moderator Temperature Coefficient (MTC), High Pressure Injection (HPI) and slower closure times for low 

load block valves FWV-31 and FWV-32. These corrective actions are included in the FPC Restart Plan. Incorrect design assumptions have been identified and described in LERs 50-302/97-015-00, 89-033, 89-013, and 87-007. 

302-97-025 6b On August 12, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

FPC determined the analysis supporting the increase of the ultimate heat sink (UHS) design basis temperature from 85 

degrees Fahrenheit (F) to 95 degrees F contained non- conservative assumptions which could have resulted in the Nuclear 

Services Closed Cycle Cooling (SW) system exceeding its peak design basis temperature of 110 degrees F. FPC 

implemented a modification to limit the start of the Reactor Building Cooling Units to one on an Engineered Safeguards 

Actuation Signal to reduce the amount of heat rejected to the SW system following a Loss Of Coolant Accident. This 

modification ensured that the SW system was within the design basis with a maximum UHS temperature of 95 degrees F. 

The cause of the non-conservative assumptions was personnel error. Improvements to the processes that govern design 

calculations have been implemented. FPC previously reported two other events regarding incorrect design assumptions in 

the SW system. 

302-97-026 NRF On August 14, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

As part of the corrective action to LER 50-302/96-001 -00, "10CFR50 Appendix R Fire Study Review and Drawing Validation," which is on ongoing, FPC discovered a conduit containing control circuitry for components necessary for safe 

shutdown not protected from the effects of a design basis fire. Air Handling Fan AHF-54B is used to supply cooling to the 

Emergency Feedwater Initiation and Control (EFIC) room for safe shutdown operation. A design basis fire could fail control 

power resulting in a loss of chilled water to AHF-54B and cause a loss of cooling for the EFIC Rooms. The apparent cause of the failure to protect the control power conduit with a one hour fire barrier was inadequate incorporation of the Appendix 

R Fire Study requirements into the Modification Approval Record (MAR) creation process. FPC will either reroute the 

affected conductors for the above control circuits to eliminate this condition or protect the conduit with an acceptable one 

hour fire barrier by December.

A-88
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-89

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-027 7 On July 7, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

While performing a review of the Emergency Diesel Generators (EDG) [EK] upgrade modification, FPC engineering 

personnel discovered antifreeze was not used in the Diesel Generator Coolant (DJ) [LB] System to prevent freezing when 

the ambient temperature is below 35 degrees Fahrenheit (F). FPC submitted a 1OCFR50.72 report on July 7, 1997 (Event 

Number 32596). On August 29, 1997, FPC personnel discovered that a written report had not been submitted to the NRC 

within 30 days of discovery as required by 10CFR50.73. Isolated freezing of the radiator coolant in the radiator could cause 

a rupture of the radiator coil and loss of coolant. Also, freezing within the radiator core could result in reduced flow due to 

the blockage thereby causing the coolant pumps to be dead headed. The cause of the event was cognitive personnel error. 

FPC is replacing the radiators for EGDG-1A and 1B and will add antifreeze to the DJ system by November 30, 1997 to 

eliminate the potential for freezing. FPC has reported one other LER regarding failure to pursue vendor recommendations, 

50-302/90-002-01. 

302-97-029 NRF On September 17,1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). During the ongoing 10CFR50 Appendix R Fire Study Review and Drawing Validation as part of the 

corrective action and extent of condition review for LER 50-302/96001-00, FPC discovered cables used to select the power 

source for a motor control cabinet (MCC) [MCC] were not protected from the effects of a postulated Appendix R fire. A 

postulated Appendix R fire in Fire Area CC-124-1 11 could result in a loss of power to Pressurizer Relief Isolation Valve 

RCV-1 1 and Makeup Gear Oil pump MUP-4B, while a fire in Fire Area CC-1 34-118A could result in the loss of power to 

Makeup Valve MUV-27 and MUP-4B. Each of these components have been identified in the CR-3 Fire Study as necessary 

for safe shutdown. A field validation of the Appendix R Fire Study was not performed, resulting in a failure to ensure 

components necessary for safe shutdown were protected from the effects of a postulated Appendix R fire. FPC will protect 

the affected circuits to preclude the loss of MCC-3AB in Fire Areas CC-124-1 11 and CC-134-1 18A by December 15, 1997. 

Also, the Appendix R design drawings and Fire Study will be revised to reflect the modified field condition by March 31, 

1998.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-031 7 On September 26, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). While performing a review of the preliminary electrical cable operability evaluation, FPC discovered three 

cable trays where the cables may have experienced temperatures in excess of the cable insulation temperature rating. 

Also, on October 9, 1997, FPC found the cables for the Reactor Building Cooler Air Handling Fans AHF-1A, 1B, and lC 

were inadequately sized for the current load during operation of the fans. The cable sizing was based on de-rating factors 

and anticipated electrical current loads. Based on the results of the evaluation, FPC determined this is a condition outside of 

the design basis of CR-3. This report is being submitted pursuant to 1OCFR50.73(a)(iii)(B). The preliminary result of the 

testing indicates that there is no measurable degradation in the cables previously identified. A nonconservative de-rating 

factor for TSI Thermo-Lag was used to determine cable ampacity sizing. Based on the results of the testing and evaluation, 

FPC concluded that the cables identified in this LER will not exceed the remaining qualified life through the next refueling 

outage and will not exceed the cable insulation temperature rating. Conservative cable ampacity correction factors have 

been included in the cable selection criteria for CR-3, "Cable Ampacity Sizing," Revision 2. 

302-97-032 7 On April 6, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

While performing a review of the CR-3 electrical systems, FPC discovered a discrepancy where a non-safety related 

solenoid valve was receiving power from a safety related distribution panel without the appropriate electrical separation or 

isolation. After completing an engineering evaluation, on October 8, 1997, FPC determined that this condition was contrary 

to the CR-3 design basis. FPC determined that electrical isolation was not provided between the safety related indication 

and the non-safety related circuit for solenoid valve RW-63-SV. Solenoid valve RW-63-SV, which is powered from Vital Bus 

Distribution Panel VBDP-4, breaker 8, is used to test the emergency Nuclear Services Seawater Pump RWP-2B. The loss 

of solenoid valve RW-63-SV would not affect the ability to start and run RWP-2B because the circuit is only used for pump 

testing. This discrepancy was caused by an incorrect interpretation of the electrical separation design criteria specified in 

IEEE 279-1968 and IEEE 308-1969 (Proposed) during initial construction of CR-3. CR-3's current electrical separation 

design criteria clearly defines requirements for the isolation of safety and non-safety related electrical components. An 

isolation device will be installed or the solenoid valve will be replaced with a safety related solenoid valve prior to MODE 4.

A-90
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-033 NRF On August 7,1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

During the ongoing 1 OCFR50 Appendix R Fire Study Review, FPC discovered that automatic closure of Electro Thermo 

Link (ETL) and Fusible Link (FL) fire dampers located in the Control Complex Ventilation System ductwork was not 

evaluated in the Appendix R Fire Study. Specifically, the effects of fire induced damper closure on Appendix R safe 

shutdown equipment room temperatures were not evaluated. Control circuitry for ETL fire dampers located in the Control 

Complex Ventilation System common ductwork were reviewed. Results indicated that the ETL fire dampers controlled by 

High Temperature Switches located in the Control Complex are susceptible to hot short conditions causing damper closure. 

Preliminary time versus temperature heatup curves for Appendix R safe shutdown equipment rooms were developed. The 

curves indicated that a loss of ventilation results in room temperatures exceeding the current design temperature limit of 

104 degrees Fahrenheit. On October 10, 1997, FPC determined this condition to be outside CR-3's design basis. The CR-3 

Fire Study did not consider the effect of hot shorts causing ETL fire damper closure. This spurious closure isolates Control 

Complex ventilation to Appendix R safe shutdown equipment. The appropriate procedures will be revised to include 

operator actions to reestablish ventilation in affected rooms. The Fire Study will be revised to include effects of ETL and FL 

fire damper closure and additional operator actions as required. 

302-97-034 3b On October 8, 1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). While performing an investigation into the recent spurious trip of a nonsafety-related molded case circuit 

breaker (MCCB), FPC personnel determined setpoint calculations for safety-related MCCBs with adjustable instantaneous 

trip settings do not provide adequate allowance for breaker tolerances and for greater than nominal voltages at motor 

terminals. The potential for unexpected tripping of safety related MCCBs is being reported under 1OCFR50.73(a)(2)(ii)(B). 

This condition could affect the ability of safety-related equipment to mitigate the consequences of design basis accidents. 

However, most MCCBs have a long history of operating without spurious tripping. The cause for this condition was a 

nonconservative assumption in MCCB setpoint calculations. FPC will recalculate trip settings for safety-related MCCBs with 

adjustable instantaneous trip settings. Necessary changes will be implemented prior to MODE 4 entry. By January 31, 

1998, the Electrical Design Criteria document will be revised to reflect the methodology for determining the instantaneous 

trip setting and the revised lower limit setting multiplier for MCCBs. Nonconservative assumptions have been reported in 

LERs 97-024-00, 97-01 5-01, and 89-033-01.

A-91
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-035 NRF On October 16, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). During the ongoing 10CFR50 Appendix R Fire Study Review, Drawing and Procedure Validation, FPC 

discovered that the power supplies used to power the Makeup and Purification System High Pressure Injection (HPI) valves 

and normal inventory makeup valves were not protected from the effects of a postulated Appendix R fire in the Main Control 

Room (MCR) or Cable Spreading Room (CSR). As a result, components necessary to maintain safe shutdown may not 

have been available following an Appendix R fire. Manual action could have been taken by the operators to restore flow for 

inventory makeup. Therefore, the postulated Appendix R fire would not have increased the risk to the health and safety of 

the public. Appendix R requirements associated with the operation of the Makeup valves were not adequately considered 

during the design of the Remote Shutdown Panel. FPC will provide an alternate means of restoring power to the HPI 

valves. Subsequent to the installation of the Remote Shutdown Panel, Nuclear Engineering Procedures (NEPs) have been 

revised by FPC to improve the design process. 

302-97-036 6b On October 24, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). During a walkdown of the High Pressure Injection (HPI) system, FPC discovered that the overload relays for 

the Makeup and Purification (MU) System HPI valves, MUV-23, MUV-24, MUV-25, and MUV-26, were not in the automatic 

reset mode of operation. The CR-3 Final Safety Analysis Report (FSAR) states "Automatic overload reset is provided." The 

risk to the public health and safety was not significantly increased because the overload relays set in the manual position 

did not affect the normal operation of the MUVs. The requirement for the Emergency Core Cooling System (ECCS) Motor 

Operated Valves (MOVs) to have automatic reset capability was not included in the development of the modification. FPC 

will review and reset, as necessary, the ECCS MOV overload relays to assure the correct setting is used. This action will be 

completed under the CR-3 12 week rolling work schedule process. The Nuclear Engineering Procedures (NEPs) were 

revised to enhance the development and verification of designs. FPC has reported two previous LERs regarding thermal 

overload relay settings.

A-92
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-038 NRS On March 17,1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD SHUTDOWN). 

While performing a system readiness review of the Radioactive Waste Disposal (WD) System, FPC identified that the WD 

system liquid outlet piping did not meet the Seismic Class I requirements. The Final Safety Analysis Report (FSAR), Section 

5.1.1.1 (1), specifies the WD system liquid outlet piping is required to be Seismic Class I. On April 7, 1997, FPC engineering 

prepared an evaluation using Regulatory Guide 1.143 as a basis for acceptance and concluded the WD system liquid outlet 

piping was not outside of the design basis. On October 24, 1997, FPC re-reviewed the engineering evaluation and 

determined the evaluation was invalid because Regulatory Guide 1.143 was not part of the licensing basis and is not 

applicable to CR-3. Therefore, WD system liquid outlet piping is outside of the design basis. Any postulated liquid leaks 

from the non-seismic liquid outlet piping would be contained in either the Auxiliary Building or the Reactor Building. The 

discrepancy between the FSAR and the as-built condition was due to engineering oversight. FPC is performing an 

evaluation to determine WD system operability and its capability to perform its intended safety function during a seismic 

event. The liquid outlet piping will be upgraded to Seismic Class I, prior to restart from the next scheduled Refueling Outage 

(11 R). 

302-97-039 3b On November 8, 1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). While evaluating the existence of polystyrene found permanently installed inside the Reactor Building, FPC 

personnel determined the materials was not analyzed for impact on post-LOCA (Loss of Coolant Accident) cooldown. At 

1454 hours, on November 8, 1997, a four-hour notification (Event No. 33239) was made in accordance with 

10CFR50.72(b)(2)(I). This report is being submitted pursuant to 1OCFR50.73(a)(2)(ii)(A). Dislodged polystyrene could 

interfere with post-LOCA recirculation flow by obstructing the sump screens and/or entering the recirculation flow stream, 

adversely affecting the ability to mitigate the consequences of a LOCA. The cause for the presence of polystyrene in the 

Reactor Building is cognitive personnel error during construction of CR-3. FPC personnel walked down the Reactor Building 

and concluded polystyrene was not permanently installed anywhere else within the Reactor Building, other than between 

the incore pit/letdown cooler structure and the Reactor Building liner. Prior to entering MODE 4, the permanently installed 

polystyrene will either be removed from the Reactor Building or analyzed for impact on post-LOCA cooldown. Current CR-3 

procedures would identify and control polystyrene brought into the Reactor Building as a transient combustible. No previous 

similar events have been reported by FPC.

A-93
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 6b 

302-97-041 6b On November 10, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). FPC discovered a condition where the Control Complex Chilled Water System and Control Room 

Emergency Ventilation System (CREVS) fans could be unavailable for a time greater than assumed in the calculation for 

the Control Complex transient temperature response. The calculation assumes the CREVS fans will be started within 30 

minutes and the Control Complex Chilled Water System will be started and remain in service within 90 minutes after the 

event. This was discovered during the validation of an Emergency Operating Procedure (EOP) for a Small Break Loss of 

Coolant Accident (SBLOCA) concurrent with a Loss of Offsite Power (LOOP) and a single failure. This condition was 

determined to be reportable pursuant to 10CFR50.73(a)(2)(ii)(B), as a condition outside of CR-3's design basis. If the 

CREVS fans and Control Complex Chilled Water System are not started within the required time frames, the rated ambient 

temperature of Control Complex equipment that is relied upon to remain functional could be exceeded during and following 

a design basis event. The apparent cause of this event was a design error in a pre-1987 modification for upgrading the 

Control Complex Chilled Water System to safety-related. A modification to remove the subsequent Engineered Safeguards 

(ES) actuation load shedding by deleting the Undervoltage/ES Lockout Relay output contacts from the control circuits will 

be implemented prior to the restart of CR-3. 

302-97-043 3b On December 8, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). FPC was performing a review of an electrical calculation and discovered the trip set points for the Control 

Complex Chiller (CHHE) Motor overloads were set below the vendor recommended set point. The low set point could cause 

the CHHEs to trip, resulting in insufficient cooling for the Control Complex during a design basis accident. If the CHHEs 

were to trip, temperatures could exceed the rated ambient temperature for the Control Complex equipment necessary to 

mitigate the consequences of the accident. The low set points of the CHHE motor overloads were incorrect since the initial 

installation. FPC will reset the motor overload set points to the vendor recommended value prior to entering MODE 4. 

Procedures will be revised to assure periodic surveillance of the motor overloads is performed.

A-94
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-95

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

302-97-044 3c On December 9, 1997, Florida Power Corporation's (FPC's) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). During an evaluation of 480 volt switchgear breakers that supply power to Engineered Safeguards (ES) 

Motor Control Centers (MCCs), FPC discovered that the long-time overcurrent trip setpoint for the feeder breaker (number 

3351) to ES MCC 3A2 was set too low. During design bases accident conditions involving an ES actuation with off-site 

power available, the steady state current on ES MCC 3A2 could be above the potential trip range for the breaker long-time 

overcurrent trip setpoint. Loss of ES MCC 3A2 does not affect components powered from remaining Train A ES MCCs 3A1 

or 3A3. Also, redundant components supplied by Train B ES MCCs 3B1, 382, and 383 remain operational. The cause for 

the incorrect long-time overcurrent trip setpoint was inadequate setpoint criteria. Prior to entering MODE 4, FPC will reset 

the long-time overcurrent trip setpoint for breaker number 3351 and implement administrative controls to prevent 

simultaneous loading of the two largest nonsafety-related loads onto ES MCC 3A2. The Electrical Design Criteria for CR-3 

will be revised by April- 15, 1998, to include criteria for determining the long-time overcurrent trip setpoint for 480 volt 

switchgear breakers. FPC has submitted one recent LER associated with incorrect breaker setpoints. 

302-97-045 NRS On December 5, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). While performing a walkdown in preparation for maintenance work on the Chemical Addition (CA) System, 

FPC personnel discovered two valves in the CA System that did not meet the Seismic Class I qualification requirement. 

Outside Containment isolation valves CAV-6 and CAV-7 actuators were not restrained as originally designed. In the event 

of a postulated seismic event, the 0.375 inch tubing connected to CAV-6 and CAV-7 creates the potential for a Containment 

breach pathway to the adjacent Auxiliary Building. The supports for the valve actuators were to be installed during the 

original construction of CR-3. The specified supports did not fit the actuators. FPC has installed the necessary supports to 

return the valves to Seismic Class I. This error occurred during the original construction of CR-3. The current installation 

and modification controls in place at CR-3 would prevent this type of error from recurring. FPC has submitted two previous 

LERs regarding equipment not installed and four LERs regarding components which did not meet the Seismic Classification 

criteria.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

302-97-046 NRF On December 20, 1997, Florida Power Corporation's (FPC) Crystal River Unit 3 (CR-3) was in MODE 5 (COLD 

SHUTDOWN). FPC discovered circuits required for the operation of the Emergency Diesel Generator (EDG) exciters were 

not protected from the effects of a postulated Appendix R fire in the Main Control Room (MCR) or the Cable Spreading 

Room (CSR). As a result, components necessary to achieve and maintain safe shutdown of the plant may not have been 

available following an Appendix R fire. In the event of the postulated Appendix R fire, the EDGs may not have been readily 

available to respond to a loss of offsite power, as required by the Appendix R safe shutdown analysis. The apparent cause 

of this event was an engineering oversight and an incorrect assumption when developing the CR-3 Appendix R Fire Study 

in 1985. FPC has installed isolation fuses in the identified circuits. The design drawings and the Fire Study will be revised to 

reflect the vendor and block drawings by March 31, 1998. Since the initial development of the CR-3 Appendix R Fire Study 

in 1985, FPC has improved the process of design validation. FPC has previously submitted six LERs regarding 

misinterpretation of drawings, engineering oversight or information not correctly translated onto drawings. 

304-97-004 5c On October 15, 1997, while performing an engineering review, a 3/4" Reactor Coolant Drain Tank line (2DT0403/4"), exiting 

(MULTI-UNIT the Unit 2 Reactor Containment through penetration P-30 was found unsupported outside the Reactor Containment [NH] 

APPLICABILITY) Building. The investigation concluded that the support was not installed due to inadvertent omission by the field engineer or 

Zion installer during plant construction. The line has been verified to be intact b Non Destructive Examination (NDE), and there 

are no adverse safety consequences to the public as a result of this event. The line was declared inoperable upon 

completing a review that found the line to be permanently deformed and overstressed. Prior to Unit 2 start-up, a design 

change will be installed to provide proper support for line 2DT040-3/4", and other lines that may be identified during 

walkdowns to verify the extent of the condition. Prior to Unit 1 start-up walkdowns will be performed, and similar defects that 

may be identified on Unit 1 will be corrected. 

304-97-006 7 Westinghouse informed CoinEd on October 28, 1997, of issues regarding fuel rod internal pressure, the status of the 

(MULTI-UNIT Performance Analysis and Design (PAD) code, and concerns with fuel design bases and 10CFR50.46 criteria for 

APPLICABILITY) Braidwood, Byron, and Zion Stations. Westinghouse could not preclude the possibility that the Integral Fuel Burnable 

Absorber fuel may be outside of the fuel design basis due to fuel clad gap re-opening and the 17% maximum cladding 

oxidation limit may be exceeded. An initial 12% oxidation level was established as a screening criterion to permit 

assessment regarding compliance with the 17% maximum cladding oxidation criteria. Westinghouse stated that plants 

potentially may have fuel rod gap re-opening, but those which have cladding oxidation of less than 12% are in compliance. 

Westinghouse developed a plan to resolve the concerns in three steps: Review and improvement of analytical models; 

Gather additional data; and Perform plant specific assessments. Zion Station will monitor and evaluate the data received 

from Westinghouse and will summit a supplement to this LER based on the assessment content. The fuel rod design has 

the potential for the nuclear fuel being outside the design basis and is being reported pursuant to 10CFR50.73(a)(2)(ii).

A-96
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

____CATEGORY 

305-97-001 3c POWER LEVEL - 000%. On January 31, 1997, during an exit for a safety system operational performance inspection 

(Kewaunee) (SSOPI) of Kewaunee's auxiliary feedwater (AFW)[BAJ and residual heat removal (RHR)[BPI systems, a Nuclear 

Regulatory Commission (NRC) inspection team presented their preliminary findings. They identified two potential 

unreviewed safety questions (USQs) and one potential inadequate Technical Specification associated with the Kewaunee 

Plant. The inspectors identified potential concerns with: 1) the low discharge pressure trip of the AFW pumps, 2) the 

minimum required flow for the AFW system, and 3) the required level in the condensate storage tanks (CSTs). Wisconsin 

Public Service Corporation (WPSC) has reviewed these concerns. Our review has determined there are weaknesses in the 

design basis documentation and administrative controls of the AFW system and CSTs. Our review also determined that the 

concerns raised during the inspection, as we understand them, do not represent USQs nor did they result in a violation of 

the Technical Specifications. To address these concerns WPSC will be: 1) reviewing and revising the Updated Safety 

Analysis Report (USAR) and the TS basis to accurately reflect the design basis of the AFW system, 2) revising the 

administrative controls for the CST. 

305-97-003 5b POWER LEVEL - 000%. On March 10, 1997, with the plant in refueling shutdown, a design error was identified in one of the 

subsystems of the Inadequate Core Cooling Monitoring System (ICCMS), the Reactor Vessel Level Indicating System 

(RVLIS). As a result the RVLIS is incapable of performing its intended function over its required span. The cause of this 

event is failure to properly implement changes to the design as refinements were made in the early phases of the project 

prior to installation. This condition has existed since the system was installed in 1986. Kewaunee Technical Specifications 

(TS) require the RVLIS to be operable when above the hot shutdown operating mode. Therefore, the plant was operated in 

violation of the TS since the system was installed. Currently, Kewaunee is in an extended outage completing steam 

generator repairs. The RVLIS system is not required during this plant mode. Prior to the reactor being made critical 

following the current outage, a software change will be implemented to correct the system. The ICCMS was designed by 

Wisconsin Public Service and built by Combustion Engineering (CE). The Kewaunee system does not use the standard CE 

ICCMS software used at other nuclear power plants. 

305-97-004 3b On April 9, 1997, with the plant in refueling shutdown mode, it was discovered that, if an accident requiring Safety Injection 

(SI) were to occur during the filling operation of either SI accumulator, the amount of water injected into the reactor coolant 

system will be reduced by the amount of water being diverted into an accumulator. This potentially affects SI system 

accident analysis assumptions and results, and when using single failure criteria, the operating SI pump may exceed the 

design runout flow limit. This issue has existed since initial plant startup. The effect that the accumulator filling operation 

had on the operability of the SI system during an accident was probably not considered at that time because of the 

infrequent occurrence and the short duration of the fill operation. Short term corrective action (current operating cycle only) 

is to use an alternate, throttled path from the SI pumps to fill the accumulators. Long term corrective actions will be 

implemented following further investigation.

A-97
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

305-97-005 6b A review of the auxiliary feedwater (AFW) system's design identified inconsistencies between actual system design and that 

assumed by analysis. Specifically, system resistance curves developed to respond to I.E. Bulletin 80-04 overestimated 

system resistance. Furthermore, the analysis of a main steam line break assumed the turbine driven pump would maintain 

full speed throughout the event. However, during some main steam line breaks, there may be insufficient steam generator 

(SG) pressure to maintain the turbine driven pump at full speed. The generic analysis of an anticipated transient without 

scram (ATWS) assumes that AFW pumps will be available throughout the event without operator intervention. Kewaunee's 

system would require operator action to prevent the pumps from tripping on low discharge pressure during an ATWS. Due 

to the significant time between the original analyses and the date the discrepancies were identified, the cause of the event 

can not be conclusively determined. Corrective actions include testing the pumps, evaluating the test results and analysis 

results to assure compliance with our license, and re-evaluating the ATWS event. 

305-97-007 6b On June 6, 1997, with the plant in refueling shutdown, a design deficiency was discovered in the Kewaunee reactor vessel 

level indication system (RVLIS). The deficiency was discovered while resolving a previously identified software error in the 

system. The deficiency results in the potential for a non-conservative indicated level error; indicated level may be as much 

as ten percent higher than actual level. This potential condition has existed since the system was installed in 1986. 

Kewaunee is unable to determine if the level error actually exists without draining the reactor coolant system (RCS). 

Additionally, we are unable to assure that the condition will not occur during normal plant operation even if it could be 

proven that the condition was not created during RCS filling. The phenomenon which causes the potential for the level error 

and the inability to provide assurance that the condition will not occur during plant operation may be of generic interest. An 

operability determination has been made assuming the condition occurs and the worst case level error exists. 

Administrative corrective actions have been implemented to address the potential offset in indicated level. The corrective 

actions will remain in place until the deficiency can be resolved during the next scheduled refueling shutdown in the fall of 

1998.

A-98
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

309-97-001 3a POWER LEVEL - 000%. During the week of January 9, 1996, while the plant was in the cold shutdown mode of operation, 

(Maine Yankee) Maine Yankee engineers discovered additional cable separation issues. One (1) of these issues was determined to be an 

original construction issue, while others involve various components affected by the design modification process. These 

concerns were discovered as a result of the on-going reviews of cable separation issues identified in LER 96-038. The 

conditions that were determined to be outside of Maine Yankee's cable separation criteria include the following: power 

cables were found encroaching different tray sections; cables from different vital buses and channels were found routed 

together or in the wrong tray sections; numerous cables of different trains or channels do not meet original separation 

criteria as a result of tray configurations at transition points such as risers and T's. The discrepancies discovered during 

reviews have been or are in the process of being corrected or addressed. Some of the cables have been wrapped, 

separated, or re-routed in the correct section. Cable separation design and walkdown teams are in the process of 

identifying further actions or engineering justifications for various conditions. Plant management is assessing long term 

actions to address causal factors identified by Plant Root Cause Evaluation #214, 'Root Cause Investigation of Cable 

Separation Problems at Maine Yankee Atomic Power Co.' 

309-97-002 7-None POWER LEVEL - 000%. On January 10, 1997, Maine Yankee engineers discovered that the Component Cooling Water 

(CCW) Surge Tank Vacuum Breakers were not included in the In-Service Testing (IST) Program. The two (2) Vacuum 

Breaker Valves (PCC-S-328 and SCC-S-394), by not being part of the IST Program, have not received appropriate 

surveillance and testing as required by code. This condition does not meet the requirements of Technical Specification 4.7 

and is considered outside of the Maine Yankee Licensing Basis. The basis for this determination is further detailed in 

Design Discrepancy Evaluation 97-001. Upon notification of the condition, the Maine Yankee Control Room declared the 

valves operable after demonstrating operability. Short term contingency plans were developed by Operations to provide a 

continuous vent to the surge tanks on those occasions when the tank relief lines are isolated for RMS signal testing. The 

valves are currently in the process of being replaced by new vacuum breaker valves. The new valves will be included in the 

IST Program and tested accordingly. 

309-97-004 3a POWER LEVEL - 000%. On January 22, 1997 Maine Yankee was in a Cold Shutdown condition. While conducting a review 

of plant design in response to a design deficiency identified in LER-96-022, Containment Primary Component Cooling 

Piping Design Inadequacy Due to Lack of Thermal Relief Valves, and subsequent Nuclear Regulatory Commission Generic 

Letter 96-06, Assurance Of Equipment Operability And Containment Integrity During Design-basis Accident Conditions, 

engineers noted that under post LOCA conditions, sections of piping associated with the Reactor Coolant Loop Fill Header 

could become pressurized in excess of design pressure due to thermal expansion of fluid trapped in the header. As the 

conditions postulated to cause over pressurization only exist post LOCA, and the plant is currently in a Refueling shutdown 

condition, no immediate corrective/compensatory action is required. Relief valve protection will be installed in the header 

prior to plant startup.

A-99
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-100

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

309-97-005 6b On February 18, 1997, the Maine Yankee Control Room was notified by engineering that in the event of a Loss of Offsite 

Power or a ventilation fan malfunction, freezing conditions could be created in the Circulating Water Pump House which 

could adversely affect Service Water Pump Components. This concern resulted from the follow-on reviews generated by 

the "Maine Yankee Atomic Power Station Safety System Support Ventilation Systems Assessment Report" dated 

December 20, 1996. In the event of a Loss of Offsite Power, Pump House heating would be lost and the building ventilation 

dampers would fail open. This could create potentially freezing conditions for Service Water Pump components. In the 

event of a fan malfunction, discharge air flow would increase and also create potentially freezing conditions for Service 

Water pump components. Immediate corrective actions include the use of temporary heaters in the Pump House, increased 

equipment monitoring, and de-energized fans and closed dampers during cold weather operations. Long term actions will 

include an evaluation to consider design changes to preclude unacceptable air temperatures in the Pump House. 

309-97-006 NRF POWER LEVEL - 000%. On February 26, 1997, the plant was in the Refueling Operations Mode. In response to a question 

raised by the NRC Senior Resident, site Security personnel notified the Control Room that a 1000 gallon propane tank was 

found in close proximity to safety related components in the Circulating Water Pump House. The Control Room notified 

engineering personnel and plant management. Immediate actions were taken to empty the propane tank. Further review 

revealed that the tank was installed as part of a heating system for the new outage cafeteria building that was installed in 

the protected yard. installed without an approved work order, adequate engineering review, or adequate safety analysis. 

Long term corrective actions include an evaluation of the potential affects of a 1000 gallon propane explosion on nearby 

safety related components. Project approval training needs will be evaluated to ensure future modifications of this nature 

receive the appropriate level of engineering review.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

309-97-009 6a Revision 1 to LER 97-009 is a major rewrite with significant changes from the original LER. To improve readability change 

bars have not been included. On May 1, through May 21, 1997, Maine Yankee was in the Refueling Shutdown Condition. 

During the review of Maine Yankee's Individual Plant Evaluation for External Event (IPEEE) a scenario that could be more 

limiting than the design basis High Energy Line Break (HELB) in the Turbine Building was identified. Analyses of a broader 

spectrum of line breaks were initiated. Initial assessment of the preliminary HELB profiles identified components in the 

Component Cooling Water and Feedwater Systems that were not qualified for the harsh environment predicted by the 

analyses. On May 19, 1997, following further review of Maine Yankee's High Energy Line Break licensing basis it was 

recognized that certain plant modifications installed after 1973, did not correctly account for licensing basis requirements for 

a postulated High Energy Line Break in the Main Steam Valve House (MSVH). Safe Shutdown Equipment potentially 

impacted by this oversight include the following: EFW System, Secondary Component Cooling Water System, Emergency 

Diesel Generator, DWST Level Alarms, and RG 1.97 Steam Generator Pressure instruments. On May 21, 1997, HELB 

related deficiencies associated with possible ruptures in Steam Generator Blowdown and Letdown System piping were 

identified in the Primary Auxiliary Building. Additional analyses of postulated ruptures on high energy lines in the Turbine 

Building, MSVH and PAB continues. Potential corrective actions being considered include: replacement, modification, or 

relocation of components not qualified for a HELB, and continued evaluations for possible modifications to the Turbine 

Building, MSVH and PAB that would mitigate the consequences of a design basis HELB in these areas. 

311-97-002 6a On February 13, 1997 an investigation raised questions regarding qualifications of components in the Auxiliary Building 

(MULTI-UNIT Ventilation system. Subsequent investigation revealed that four pressure switches on Salem Unit 2 could not be verified as 

APPLICABILITY) seismically qualified. In addition, one of the four pressure switches was found to have its sensing lines reversed. The 

(Salem 2) pressure switches were replaced in 1986 with non-qualified pressure switches. The sensing lines for the one pressure 

switch were reversed in 1978 as part of a design change. Three seismically qualified switches have been re-installed and 

the sensing lines restored to the correct configuration. The fourth switch will be replaced prior to Unit 2 entry into Mode 4. In 

addition, walk downs confirmed that other similar sensing lines were installed correctly. This event is reportable in 

accordance with 10 CFR 50.73(a)(2)(ii)(A), the plant was in an unanalyzed condition that significantly compromised plant 

safety.

A-101
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

1CATEGORY 

311-97-003 3a POWER LEVEL - 000%. During the cleanup of the Salem Unit 2 Containment Building many examples of poor 

(MULTI-UNIT housekeeping were found. As an example, an estimated 300 to 400 pounds of excess debris was found. While no specific 

APPLICABILITY) transport analysis was performed, it is postulated that the debris could find its way to the containment sumps, and affect the 

performance of pumps that use the containment sumps as a supply of water. The cause of this event, is poor enforcement 

and lack of management expectations over the life of the plant, coupled with poor worker practices. The debris was 

removed from the containment building, and corrective action work requests were written for those housekeeping items that 

could not be readily corrected. Management has reiterated its expectation that all debris and material left over after 

completion of work activities be removed, when the job is completed. This event is being reported in accordance with 10 

CFR 50.73(a)(2)(ii) any condition that resulted in the nuclear power plant being outside the design bases of the plant. 

311-97-006 NRS POWER LEVEL - 000%. On April 4, 1997, the seismic adequacy of the 21 Service Water (SW) header was determined to 

be invalid. A modification to the header was being performed, and piping was connected to the 21 SW header without the 

proper pipe hangers being installed. This occurrence was caused by unclear work instructions. This condition existed for a 

limited period of time (approximately one week) during which no seismic activity was experienced. The condition was limited 

to only the 21 SW header. The newly installed piping was disconnected from the 21 SW header. The work instructions were 

changed to clarify the requirements for connecting the new piping to the SW system. The piping has been re-installed 

correctly. This event is reportable in accordance with 10 CFR 50.73(a)(2)(ii), any condition outside of the plant's design 

bases. 

311-97-009 3a Technical Specification 3.6.2.1, which requires both Containment Spray (CS) systems to be operable in Modes 1 through 4, 

was not satisfied from June 15, 1997 to July 14, 1997. The CS pump discharge valves (21CS2 & 22CS2) were identified as 

susceptible to pressure locking in PSE&G's response to Generic Letter 95-07. To address pressure locking concerns, the 

CS2 valves are required to be stroked following operation of the associated CS pump. on July 11, 1997, it was identified 

that procedure S2.OP-IO.ZZ-0002, "Cold Shutdown to Hot Standby," directed functional testing of the CS pumps without 

subsequently stroking the 21CS2 and 22CS2. Further review determined that the CS pumps were functionally tested on 

June 14, 1997 in accordance with this procedure while in Mode 5. Valves 21CS2 and 22CS2 were not stroked open and 

closed prior to June 15, 1997 when Salem Unit 2 entered Mode 4. The cause of this occurrence is attributed to personnel 

error in that personnel failed to perform an adequate review to identify all instances in which the Containment Spray pumps 

were operated. Corrective actions include procedure revisions to address the additional instances of Containment Spray 

pump operation. This event is reportable in accordance with 10 CFR 50.73(a)(2)(I)(B), any condition prohibited by the 

plant's Technical Specifications, and 10 CFR 50.73 (a)(2)(ii)(B) a condition that was outside the design basis of the plant.

A-102
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-103

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

311-98-001 6b During review of the installation of the test instrumentation connected to the Unit 1 Reactor Vessel Level Instrument System 

(MULTI-UNIT (RVLIS) panel, it was determined that this instrumentation provided inadequate isolation between the Non Safety Related 

APPLICABILITY) Data Acquisition System (DAS) and the RVLIS channels. Therefore, the RVLIS could not be considered operable with the 

test instrumentation connected. As a result of this review, a condition report (CR) was initiated since this equipment had 

been previously installed on Unit 2 RVLIS during initial operation in Mode 3. The RVLIS had been considered operable with 

this Data Acquisition System (DAS) installed. With the test instrumentation connected the RVLIS channel separation criteria 

is violated and the system can not be considered operable. The test equipment was installed on June 17, 1997 with the 

Salem Unit 2 in Mode 4. The apparent cause(s) of this condition was the failure to 1) identify that the initial 50.59 evaluation 

for the RVLIS procedure assumed that RVLIS would be considered inoperable, and 2) include in the determination of 

operability the effect of the test equipment. The appropriate procedures were revised, and the test equipment has been 

properly isolated. This event is reportable per 10CFR50.73 (a)(2)(I)(B). 

315-97-003 3a POWER LEVEL - 097%. On February 5, 1997, with Unit 1 at 96.7 percent Rated Thermal Power and Unit 2 at 99.8 percent 

(MULTI-UNIT Rated Thermal Power, preliminary information was received from Westinghouse that indicated that the Safety Injection 

APPLICABILITY) pumps could potentially experience runout conditions if the accumulator fill line were open during a large break LOCA 

(D.C. Cook 1) demand. An ENS notification was made under 10CFR50.72(b)(1)(ii)(B), to report a condition outside the design basis at that 

time. Cook Technical Specification 4.5.2.h states that total Safety Injection system flow shall not exceed 700 g.p.m. with a 

single pump running and the minimum flow valve open. If only one safety Injection pump is providing flow to all four injection 

lines while the accumulator fill line is fully open and the minimum flow valve is open, which may occur during the injection 

phase of a large break LOCA towards the end of blowdown, the runout limit may be exceeded. By letter dated February 21, 

1997, Westinghouse has confirmed, by model, that the pumps will run out to between 708 and 720 g.p.m., dependent on initial conditions. The flowpath created by opening the accumulator fill line had not been previously identified as affecting 

the emergency core cooling system analysis and therefore had not been adequately addressed in the analysis. This event 

was evaluated against the analyses for large break LOCA, small break LOCA, containment and the sump recirculation flow 

requirements, and found to have no safety significance.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

315-97-006 6b This LER revision is being submitted to provide additional information regarding the safety significance and the root cause 

(MULTI-UNIT determination for cracked floodup tubes (FUTS) found in Cook Units 1 and 2. During an inspection of floodup tubes for 

APPLICABILITY) moisture intrusion, 3 FUTS with thru wall defects were identified. As a result, proactive measures were taken to inspect the 

remaining Unit 1 FUTS. This resulted in the identification of six additional thru wall defects in Unit 1. As a result, Unit 2 

FUTs were inspected, and 2 cracked tubes were found. Of the 11 total damaged tubes, Unit 1 contained 7 FUTS and Unit 2 

contained 1 FUT with an associated circuit that is needed for accident mitigation or post accident monitoring. On March 23 

the Unit 2 condition was reported under 10CFR50.72(b)(1)(ii). On March 27 Unit 1 condition was reported under 

10CFR50.72(b)(2)(I). ENS notifications were made for both. The damage has been attributed to work practices that resulted 

in two different types of failures--materials stress cracks and random arc strikes, most probably early in plant life. All 

damaged Unit 1 EQ FUTS have been replaced and both Unit 2 tubes have been replaced. To prevent the cracks due to 

installation practices from reoccurring, the Cook Plant FUT Installation Work Instructions will be modified to contain 

additional guidance. Welding practices have been sufficiently enhanced since the early portion of the plant life to preclude 

arc strikes on FUTS. Inspections of the FUTS for damage will also be performed at the beginning and the end of the 

refueling outages until assurance is reached that no further problems were found. Postulated failures that could result from 

the cracked floodup tubes were evaluated and found not to present a significant risk with regard to the protection of the 

public health and safety. 

315-97-009 6c On April 15, 1997, it was discovered that the calibration constant for the particulate channels of the Eberline radiation 

(MULTI-UNIT monitors were incorrect. A calibration constant value of 1 .17E-05 [Symbol omitted] Ci/cpm had been used instead of the 

APPLICABILITY) correct value of 4.66 E-05 [Symbol omitted] Ci/cpm. The calibration constant for the Eberline particulate channel is based 

on what is referred to as the "divide by circuitry". The "divide by circuitry" converts detector pulses to units of activity. A 

channel's calibration constant is adjusted depending on which "divide by circuitry" is used. When the procedure was 

developed in 1990 for making the "divide by circuitry" adjustment it was incorrect. The cause for this event is personnel 

error. This event is being reported in accordance with 10 CFR 50.73(a)(2)(ii)(B) as a condition that resulted in the power 

plant being in a condition that was outside the design basis of the plant, 10 CFR 50.73(a)(2)(v)(C) as a condition that alone 

could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of 

radioactive materials, and 10 CFR 50.73(a)(2)(I)(B) as operation prohibited by the plant's technical specifications. 

Immediately upon confirming the error, the technical specification action statement for those channels with technical 

specifications were entered, the parameter file log sheets were revised to the correct value of 4.66 E-05 [Symbol omitted] 

Ci/cpm, and the channel parameter files were revised to reflect the new calibration constant. Based on current requirements 

for the review and verification of information, no further actions are being taken. Additionally, based on other required 

monitors being operable and the ability to use the trending function of the particulate monitors this event did not represent a 

significant risk to the health and safety of the public.

A-104
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER 1 SAFETY EVENT ABSTRACT 

CATEGORY 

315-97-010 7 On August 8, 1997, with Units 1 and 2 at 100 percent Rated Thermal Power, as a result of questions posed by the NRC AE 

(MULTI-UNIT Design Inspection team, it was determined that both units had operated outside the design basis of 76 Degrees Fahrenheit 

APPLICABILITY) for lake water temperature. An ENS notification was made at 0934 hours the same day under 10CFR50.72(b)(1)(ii)(B), as a condition outside the design basis. This report is made in accordance with 10CFR50.73(a)(2)(ii), as a condition outside the 

design basis, and an unanalyzed condition. The root cause of this event was the failure to recognize a UFSAR value as a 

design basis parameter and to recognize interrelationships between a UFSAR value and other design aspects. Process 

changes have been implemented which require that changes to design basis information be handled via the design change 

process, a corporate directive and policy were written to provide direction on design basis, and additional training on design 

basis has been provided to those employees involved in handling such information. Restrictions have been placed on plant 

operation such that the plant will not be operated with lake water temperatures above 76 Degrees Fahrenheit. This 

restriction will remain in effect until all analyses and 1OCFR50.59 safety evaluations are complete. Analysis of this event 

has been performed, taking into account the effects of the elevated service water temperature on the safety related systems 

to which it provides cooling. It has been determined that the event did not result in any threat to the health or safety of the 

public. 

315-97-011 3a While evaluating a proposed procedure change that affected switchover from the Refueling Water Storage Tank (RWST) to 

(MULTI-UNIT the containment recirculation sump during a Loss of Coolant Accident (LOCA), it was determined that level indications used 

APPLICABILITY) to determine when the switchover is required were not adequate to prevent vortexing in the containment recirculation sump or to ensure adequate water is transferred from the RWST for long term cooling of the core and containment. The 

indications involved were the RWST level instruments and the containment level instruments. This event was reported 

under 10 CFR 50.73(b)(1)(ii)(B) as any event or condition that resulted in a condition outside the design basis of the plant. The cause for the RWST level instrumentation inadequacy was lack of complete understanding of instrument design basis 

and failure to fully address velocity effects. The cause for the inadequate containment level to prevent vortexing was attributed to ineffective change management. To correct this condition the RWST level taps were relocated, the procedure for switchover, 01(02) OHP 4023.ES-1.3, Transfer to Cold Leg Recirculation, was revised, and the UFSAR will be revised to 

clearly indicate assumptions associated with minimum water level requirements during a LOCK An evaluation of the safety significance of the originally identified condition was performed. It was concluded that the only accident where safety 

significance existed was the LOCA. For the LOCA, it was identified that re-criticality could have occurred during Cycle 3 of 

Unit 2 operation. However, this LER revision identifies another condition which could have caused RWST level 

instrumentation to read incorrectly due to inadequate venting during maximum ECCS flow. It was identified that this could 

leave up to 28.5 additional inches of water in the tank when suction is transferred to the recirculation sump. Due to this, the 

safety significance will be re-evaluated, combining information from the original condition with information from the venting 

issue. This re-evaluation is expected to be completed, and an updated LER submitted by January 29, 1999.

A-105
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORYT 

315-97-012 7 On August 26, 1997 with Units 1 and 2 at 100 percent Rated Thermal Power, it was determined that both units had 

(MULTI-UNIT operated outside the design basis for Component Cooling Water (CCW) maximum temperature. Contrary to FSAR Table 

APPLICABILITY) 9.5-3 which states that the maximum CCW heat exchanger outlet temperature is 95 degrees Fahrenheit, guidance provided 

in the Operations procedures allowed CCW heat exchanger outlet temperature to reach 120 degrees Fahrenheit during the 

first three hours of RHR operation. It was determined that this event was reportable under 10CFR50.72(B)(1)(ii)(B), and an 

ENS notification was made on August 26, 1997. This LER is being submitted under 1OCFR50.73(a)(2)(ii) as a condition 

outside the design basis. The root cause for the original failure to incorporate the 120 degree Fahrenheit value into the 

FSAR could not be determined. Subsequent revisions to the CCW procedure failed to identify the problem due to 

inadequate safety screenings. Additional emphasis is being stressed by management on the need to perform complete and 

accurate safety screenings. The CCW procedure was revised to remove the reference to 120 degrees Fahrenheit. An 

evaluation was successfully performed to support a short term maximum temperature of 120 degrees Fahrenheit for CCW 

operation. The Operations procedure(s) was revised to reference 115 degrees Fahrenheit, which allows for instrument 

uncertainty. It was determined that the temporary increase in the CCW temperature during cooldown would not have 

resulted in any adverse safety consequences. The safety significance of this condition is, therefore, low and did not 

endanger the health or safety of the public at any time. 

315-97-014 5b On August 29, 1997, with Units 1 and 2 at 100 percent Rated Thermal Power, as a result of questions posed by the NRC 

(MULTI-UNIT AE Design Inspection team, it was determined that during August, 1987, both units operated in an unanalyzed condition for 

APPLICABILITY) Control Room equipment operability due to postulated high room temperatures. An ENS notification was made on August 

29, 1997 at 1412 hours EDT under the provisions of 1OCFR50.72(b)(1)(ii)(A), for any condition during operation that results 

in the plant being in an unanalyzed condition. This LER is therefore submitted in accordance with 10CFR50.73(a)(2)(ii)(A). 

This LER is directly related to, and can be considered a sub-issue to, the condition reported in LER 315/97-010-02. The root 

cause of this condition was the failure to realize the interrelationship between a UFSAR value and other design aspects. 

Process changes have been implemented which require that changes to design basis information be handled via the design 

change process, a corporate directive and policy were written to provide direction on design basis, and additional training 

on design basis has been provided to those employees involved in handling such information. Restrictions have been 

placed on plant operation such that the plant will not be operated with lake water temperatures above 76 Degrees 

Fahrenheit. This restriction will remain in effect until all analyses and 1 OCFR50.59 safety evaluations are complete. Analysis 

of this event has been performed, taking into account the potential effects of elevated temperature on the Control Room 

equipment. It has been determined that the event did not result in any threat to the health or safety of the public.

A-106
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT CATEGORY 

315-97-016 3a On September 12, 1997, with Units 1 and 2 in Mode 5, it was discovered that current operating procedures for the Residual 

(MULTI-UNIT Heat Removal (RHR) System did not prevent the operation of both RHR pumps when the Reactor Coolant System (RCS) is 

APPLICABILITY) open to atmosphere. This is contrary to Updated Final Safety Analysis Report (UFSAR) Section 9.3.3 which states, "Only 

one residual heat removal (RHR) pump will be operated when the reactor coolant system is open to the atmosphere to 

prevent damaging both pumps in the unlikely event that suction should be lost". This event is being reported in accordance 

with 10 CFR 50.73 (a)(2)(v) as a condition that potentially could have prevented the fulfillment of the safety function of a 

structure or system. The cause of not including all of the UFSAR requirements into the RHR procedure could not be 

determined. Inadequate understanding of the UFSAR and inadequate safety screenings prevented this issue from being 

identified sooner. All applicable procedures have been revised to include the restriction that only one RHR pump be 

operated when the RCS is open to atmosphere. Based on vendor manual information for the pump and additional 

information from the UFSAR, if the RCS level is greater than half loop, then the pump suction lines are completely filled, 

with enough Net Positive Suction Head to preclude the formation of air pockets and enough level exists above the suction 

source to prevent vortexing. Therefore, this condition had no significant safety consequences for the plant or the health and 

safety of the public. 

315-97-017 7 On September 8, 1997, at 2000 hours, with Unit 1 at 74 percent Rated Thermal Power, it was discovered that under certain 

scenarios the volume of water resident in the active sump volume of the containment may not be adequate to support long 

term Emergency Core Cooling System (ECCS) or Containment Spray (CTS) pump operation during the recirculation phase 

of a LOCA event. This was determined to be reportable under 1OCFR50.72(b)(1)(ii)(B), as a condition outside the design 

basis. A Technical Specification required shutdown was undertaken, which is reportable under 10CFR50.72(b)(1)(I)(A). This 

LER is being submitted in accordance with 1OCFR50.73(a)(2)(ii) and 1OCFR50.73(a)(2)(I)(A). On September 10, 1997 Unit 

1 entered Mode 5, cold shutdown, and remains in cold shutdown. The root cause of this event was determined to be lack of 

thorough review. The previously performed engineering reviews did not evaluate the impact of flow diversions into the 

inactive sump volumes of the containment. New analyses have been completed and the containment analysis has been 

validated to confirm that, for both postulated large and small break LOCAs that could occur during future operation, an 

adequate volume of water would be resident in the containment structure and that adequate communication exists in the 

containment subcompartment boundaries to ensure sufficient drainage to the containment recirculation sump. The analysis 

of this event has not yet been completed for all past cycles. Analyses performed for the most recent operating cycle 

confirms that adequate water volume would have been available in the active sump during the recirculation phase of a 

LOCA event. An update to this LER will be submitted upon completion of the analyses for all operating cycles. It is expected 

that the analyses will be completed by December 10, 1997 and this LER will be updated by January 16, 1998.

A-107
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

315-97-018 6a While reviewing findings relative to containment recirculation sump modifications and requirements, the containment system 

(MULTI-UNIT engineer identified a historical problem on Unit 1 and Unit 2 recirculation sumps from 1978 until 1996 in Unit 2 and 1997 in 

APPLICABILITY) Unit 1. In 1978 five 3/4 inch diameter holes were installed in the upper roof of the recirculation sump under design change 

12-RFC-2361. Under the same design change, the 1/4 inch particle retention boundary was moved from the lower chamber 

of the recirculation sump back to the recirculation sump inlet area. When this 1/4 inch retention element was moved several 

sump inlet locations, including the five holes, were left unprotected for 1/4 inch particle retention. The NRC was notified of 

this event on September 5, 1997 at 0921 hours. The NRC notification was made under 10 CFR 50.72 (b)(1)(ii)(B) as a 

condition outside the design basis of the plant. This event is being reported under 10 CFR 50.73(a)(2)(ii) as a condition that 

resulted in the nuclear power plant being in a condition that was outside the design basis of the plant. The cause for this 

event was that the design change that moved the 1/4 inch particle retention boundary was not technically complete in that it 

did not address the 1/4 inch particle retention requirement during design and/or installation. Based on the low probability of 

materials entering the sump and an analysis of materials which had the highest probability of entering the sump, it was 

concluded that the containment recirculation sump could have performed its intended function with the identified 

deficiencies. Therefore, this event did not present a risk to the health and safety of the public. 

315-97-019 6a In September 1997, during the NRC Architect and Engineering Design Inspection, a discrepancy was identified between the 

(MULTI-UNIT Updated Final Safety Analysis Report (UFSAR) and an Operations department procedure. The procedure also conflicted 

APPLICABILITY) with Technical Specification (T/S) requirements. This condition was reported as a notification under 10 CFR 50.72(b)(2)(1), 

for an unanalyzed condition on September 11, 1997, and as a condition outside the design basis of the plant. This update is 

submitted to provide the cause and safety significance of the event. The event has been attributed to an inadequate safety 

review performed at the time the procedure change was made in 1980. Additionally, a procedure change was used to 

effectively accomplish a design change to the plant, further reducing the chances, under the processes in existence at that 

time, of identifying the impact on the design basis. A T/S amendment has been formally requested to remove the 

surveillance related to automatic valve closure. The change was requested on September 19, 1997, via our letter 

designated AEP:NRC:1278. A design change will also be processed to document the change appropriately under our 

design change process. The procedure steps involved were intended to prevent inadvertent auto-closure of the valves 

which would result in a loss of Residual Heat Removal (RHR) suction during shutdown cooling operation. The procedure 

accomplishes this by removing power from the valves when the valves are opened to the Reactor Coolant System (RCS). 

The RCS and the RHR systems were protected from over-pressurization by the Low Temperature Over-Pressure Protection 

(LTOP) equipment, at all times that the original RHR suction valve interlock was designed to protect the RHR system. 

Therefore, this condition did not significantly impact the health or safety of the public or pose a threat to plant safety.

A-108
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

315-97-021 3a On September 10, 1997, with Units 1 and 2 in Mode 5, it was determined that a single active failure during an accident 

(MULTI-UNIT while performing switchover of the Emergency Core Cooling System (ECCS) pumps from the Refueling Water Storage 

APPLICABILITY) Tank (RWST) to the recirculation sump could result in loss of all high and medium head injection. This was determined to 

be reportable as an unanalyzed condition under 1OCFR50.72(b)(2)(I), and as a condition that could have prevented the 

fulfillment of a safety function under 1OCFR50.72(b)(2)(iii). An ENS notification was made at 1919 hours the same day. This 

report is submitted in accordance with 10CFR50.73(a)(2)(ii) and (a)(2)(v). The root cause of this event was personnel error. 

Significant improvements have been made to the review process for Emergency Operating Procedures (EOPs) since 1992 

when the error occurred. Contributing to this event was the failure to recognize that the definition of a single active failure 

included failure of a pump to run once it had already started. The EOP which sequences the steps for switchover has been 

revised to preclude the situation where a single active failure would cause redundant equipment from being impacted. A 

formal policy and a directive on design bases and single failure criteria have been developed. The directive provides 

specific direction on the definition and use of the single failure criteria. A Probabilistic Risk Assessment was performed to 

determine the failure probability of an RHR pump to continue to run. The failure probability did not result in a noticeable 

increase in core damage frequency. This condition was therefore concluded to have a low safety significance, and not to 

represent a threat to the health or safety of the public. 

315-97-022 6b On September 11, 1997, with Units 1 and 2 in cold shutdown, it was determined that conditions had not been properly 

(MULTI-UNIT established in the Component Cooling Water (CCW) system to meet plant piping design code requirements. It was APPLICABILITY) determined that this event was reportable under 10 CFR 50.72(b)(2)(iii)(C) and (D), as a condition that alone could have 

prevented the fulfillment of the safety function of a system needed to control the release of radioactive materials and 

mitigate the consequences of an accident. An ENS notification was made at 1956 hours on September 11, 1997. An interim 

LER was submitted on October 13, 1997 under 10 CFR 50.73(a)(2)(v)(C) and 10 CFR 50.73(a)(2)(v)(D). The piping design 

code at the Cook Plant is USAS B31.1 Power Piping Code, 1967 edition. Code requirement B31.1 states that an intercepting stop valve cannot be located between the source of pressure and the pressure relief device credited for 

protecting the pipe. Contrary to the code requirement there were manual valves between the Reactor Coolant Pump (RCP) 

thermal barrier cooling coil and the safety relief valve on the CCW surge tank that were not controlled in accordance with or exempted from USAS B31.1, 1967 edition. To correct this condition the intercepting stop valves have been placed under 

procedural control such that the valves are sealed open during system operation, thus ensuring the safety valve on the 

CCW Surge Tank will provide over pressure protection for the CCW System Piping during a rupture of an RCP thermal 

barrier cooling coil. Based on normal system operation and controls, this event was determined to have negligible safety 

impact.

A-109
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

315-97-023 6a On September 16, 1997, with Units 1 and 2 in Mode 5, it was determined that a design change to the bypass dampers for 

(MULTI-UNIT the Engineered Safeguards Features (ESF) ventilation system installed between December 1996, and August, 1997 

APPLICABILITY) introduced the possibility of a single failure which could result in the loss of both trains of the ESF ventilation system. The 

loss of the 85 psig air header without concurrent loss of the 20 psig air header would result in the ESF ventilation trains 

being unable to meet their design function. On September 16,1997, this event was reported via ENS under 

10CFR50.72(b)(2)(I), as an event found while the reactor was shutdown that resulted in an unanalyzed condition. This LER 

is therefore submitted in accordance with 10CFR50.73(a)(2)(ii), as an event found while the reactor was shutdown that 

resulted in an unanalyzed condition, and a condition outside the design bases. The root cause of the event is the failure of 

the design change process to identify the potential adverse impact on the ESF ventilation system created by the 

modification of the control air supply to the bypass dampers. Installation of a supply to the inlet damper actuators from the 

85 psig header via a pressure reducing valve was completed on November 5, 1997. This modification placed both the inlet 

and bypass dampers on the same supply header. The Design Change Reference Guide will be revised to explicitly require 

the consideration of the effects of a proposed change of the air system on a "header by header" basis and the analysis of 

individual source failures. Based on the low probability of the series of events necessary to prevent the ESF ventilation 

trains from performing their design functions, and the Probabilistic Risk Assessment results, it has been concluded that this 

condition had low safety significance, and did not endanger the health or safety of the public at any time. 

315-97-024 3a On September 11, 1997, a fibrous materials, known as Fiberfrax, was identified in an electrical cable tray inside the Unit 2 

(MULTI-UNIT containment. An investigation was initiated to determine the scope and magnitude of this condition. On September 17, 

APPLICABILITY) 1997, with Units 1 and 2 in cold shutdown, it was determined that Fiberfrax was present in both containments in enough 

quantity to potentially cause excessive blockage of the containment recirculation sump screen during the recirculation 

phase of a Loss of Coolant Accident and render the sump inoperable. An ENS notification was made at 1629 hours on 

September 17, 1997, under 10CFR50.72(b)(2)(i), as a condition which was found while the reactor was shutdown, which if it 

had been found while the reactor was operating, would have resulted in the nuclear power plant being outside the design 

basis. As part of the investigation, reviews were conducted of industry information related to containment sump strainer 

blockage, and plant insulation specifications. Walkdowns were conducted of both containments and other potential 

materials threats to blockage of the recirculation sump were identified and dispositioned. The root cause of this condition 

has been attributed to inadequate specifications and procedures which did not preclude or strictly control these types of 

materials. The materials have either been removed from the containments, or have been evaluated and determined to not 

constitute a substantial threat to the recirculation sump. Additionally, the condition of containment coatings was reviewed 

and repair of some coatings has been undertaken. Specifications and procedures are being revised and /or developed to 

preclude or strictly control materials inside containment which could block the recirculation sump. Analysis using models for 

debris generation and transport has been completed. The results of that analysis will be provided to the NRC separately as 

it contains proprietary information. It is expected that the information will be provided to the NRC prior to, or at, the May 20, 

1998, enforcement conference.

A-110
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

315-97-026 3b On September 25, 1997, with Units 1 and 2 in Mode 5, it was recognized that due to a lack of overpressure protection on 

(MULTI-UNIT the 85, 50, or 20 psig control air headers, if an air regulator failed open resulting in an over pressurization of a control air 

APPLICABILITY) header, there was the potential for common mode failure of both trains of safety related equipment. The potential for this 

event was reported in accordance with 10 CFR 50.72(b)(2)(I) as a condition which was found while the reactor was 

shutdown, which if found while the reactor was operating, would have resulted in the nuclear plant being in an unanalyzed 

condition. The lack of overpressure protection on the control air headers due to a regulator failing open was not identified as 

a mechanism that could overpressurize the low pressure headers. As a result, single failure of a non-safety related 

component affecting both trains of safety related equipment was not identified. Redundant safety related relief valves have 

been installed on the 20, 50, and 85 psig control air headers. In addition, the current design change process addresses the 

requirement to ensure that single failure criteria has been met. An evaluation was performed to determine what the effect of 

an over pressurization of the control air headers would have been. This evaluation determined that there would have been 

no significant effects for the 85 and 50 psig headers. Over pressurization of the 20 psig header could have resulted in the 

degradation of the RHR system and the partial opening of the unit 2 Steam Generator (SG) Power Operated Relief Valves 

(PORVs) for the duration of the overpressure event. Due to a single failure being identified that could have potentially 

resulted in the degradation of both trains of RHR this event may have been significant. 

315-97-027 6b On October 28, 1997, with Unit 1 in Mode 5 and Unit 2 in Mode 6, it was determined that both units had the potential to be 

(MULTI-UNIT outside of their design basis and possibly in non-compliance with 10 CFR 50.46(b)(2). This is a generic issue applicable to 

APPLICABILITY) Westinghouse fuel rods containing integral fuel burnable absorber (IFBA). It was determined that this was reportable under 

1 OCFR50.72(b)(2)(i) as an event found during shutdown that potentially resulted in a degraded principle safety barrier and 

an ENS notification was made at 1830 hours on October 28, 1997. An interim LER was submitted on November 24, 1997. 

This LER is being submitted under 1 OCFR50.73(a)(2)(ii)(B) as a condition potentially outside of the design basis of the 

plant. The licensee was informed by Westinghouse, on October 28, 1997, that in the process of developing new fuel rod 

cladding corrosion and rod internal pressure models it was determined that these new models showed a decrease in rod 

internal pressure margin. This decrease in margin has the potential to place plants in a condition that is outside of their 

design basis with respect to pellet-to-clad gap re-opening. Additionally, should pellet-to-clad gap re-opening occur there is a 

potential for certain plants to possibly be in non-compliance with the 17 percent oxidation criteria of 10CFR50.46. 

Subsequent calculations have shown compliance with 1 OCFR50.46 for the current operating cycles, Unit 1 Cycle 16 and 

Unit 2 Cycle 12. Additional calculations show that Unit 1 will be within its design basis with respect to pellet-to-clad gap re

opening throughout Cycle 16 and Unit 2 will be within its design basis for a minimum of 10,680 MWD/MTU (approximately 

257 EFPD) for Cycle 12. For the possible operation outside the design basis for Unit 2 Cycle 12 a justification for continued 

operation has been included in the Reload Safety Evaluation for Unit 2 Cycle 12 which covers operation to the end of the 

cycle.

A-111
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

315-97-028 NRF 10 CFR 50, Appendix R, Section III G.2.(b) requires a twenty foot separation between trains with no intervening combustible 

(MULTI-UNIT materials with fire detection and suppression installed. At Cook Nuclear Plant, fire stops were being used to prevent the 

APPLICABILITY) possible spread of fire across the twenty foot separation space at two locations in the Auxiliary Building (el. 587' and 609') 

where there are intervening combustibles (open cable trays) inside the twenty foot separation space. However, an 

exemption to 10 CFR 50, Appendix R, Section III G.2.(b) had not been requested. Our configuration had been described to 

the NRC in submittals dating back to 1983. However, the deviation from Appendix R described above was not specifically 

noted in applicable Appendix R SERs. On May 21, 1997, we submitted a letter to the NRC which responded to NRC 

questions dated March 26, 1997, regarding this configuration, and provided our basis for why we did not believe an 

exemption to Appendix R was necessary. During a conversation with the NRR staff on November 6, 1997, we were 

informed that a specific exemption to Appendix R is required for this deviation or the intervening combustibles must be 

eliminated. Because our configuration differs from the requirements of 10 CFR 50, Appendix R, Section III G.2.(b), it is 

being reported as a condition outside the plant's design bases. Generic Letter (GL) 92-08 indicated that Thermo-Lag was a 

combustible materials. The fire watch established for these locations, as a result of GL 92-08, was released on December 

30, 1996, after the Thermo-Lag wrap had been removed. The Appendix R Safe Shutdown revalidation effort evaluated the 

use of fire stops again. A fire watch was re-established on January 24, 1997. The fire watches will remain in place until 

resolution of this issue is obtained. 

316-97-003 6b During the Unit 2 1996 refueling outage a dual train component cooling water (CCW) outage was scheduled and performed. 

(D.C. Cook 2) In performance of the dual train CCW outage, manual operator actions were credited for restoration of the Unit 2 spent fuel 

pool (SFP) cooling system, should the Unit 1 SFP cooling train become unavailable, to maintain the SFP within its design 

basis. Following evaluation of the shutdown risk review performed at the time, the crediting of these manual actions was not 

adequate and created the possibility of an unreviewed safety question. Based on this, it was determined that this event is 

reportable in accordance with 10 CFR 50.73(a)(2)(ii)(B), as a condition that was outside the design basis of the plant. The 

Unit 2 1996 refueling outage planning and scheduling review activity performed in accordance with plant procedures, 

overlooked the reviews necessary to fully credit operator actions and the performance of an unreviewed safety question 

determination to support the manual actions. The outage review process has been revised to preclude recurrence. The 

contingency actions for recovering spent fuel pool cooling during the Unit 2 1996 refueling outage were such that the plant 

was capable of restoring Unit 2 CCW within 1.5 hours, assuming no errors or environmental affects. Greater than 3 hours 

was available before threatening the SFP design basis. The actual dual train CCW outage configuration existed for only 8 

hours and 1 minute. In addition, draining of the CCW system did not occur, thus ensuring an uncomplicated restoration. 

Based on this, there was no risk to the health and safety of the public.

A-112
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

316-97-005 7 On September 8, 1997, at 2000 hours, with Unit 2 at 96 percent Rated Thermal Power, it was discovered that under certain 

scenarios the volume of water resident in the active sump volume of the containment may not be adequate to support long 

term Emergency Core Cooling System (ECCS) or Containment Spray (CTS) pump operation during the recirculation phase 

of a LOCA event. This was determined to be reportable under 10CFR50.72(b)(1)(ii)(B), as a condition outside the design 

basis. A Technical Specification required shutdown was undertaken, which is reportable under 1OCFR50.72(b)(1)(i)(A). This 

LER is being submitted in accordance with 10CFR50.73(a)(2)(ii) and 1OCFR50.73(a)(2)(i)(A). On September 10, 1997 Unit 

2 entered Mode 5, cold shutdown, and is currently in a refueling outage with the core offloaded. The root cause of this event 

was determined to be lack of thorough review. The previously performed engineering reviews did not evaluate the impact of 

flow diversions into the inactive sump volumes of the containment. New analyses have been completed and the 

containment analysis has been validated to confirm that, for both postulated large and small break LOCAs that could occur 

during future operation, an adequate volume of water would be resident in the containment structure and that adequate 

communication exists in the containment subcompartment boundaries to ensure sufficient drainage to the containment 

recirculation sump. The analysis of this event has not yet been completed for all past cycles. Analyses performed for the 

most recent operating cycle confirms that adequate water volume would have been available in the active sump during the 

recirculation phase of a LOCA event. An update to this LER will be submitted upon completion of the analyses for all 

operating cycles. It is expected that the analyses will be completed by December 10, 1997 and this LER will be updated by 

January 16, 1998. 

316-97-006 6a Following a discovery of damaged floodup tubes in March of 1997 (LER 97-006-01), Donald C. Cook Plant personnel 

committed to perform inspections of floodup tubes during subsequent refueling outages. An inspection of unit 2 floodup 

tubes conducted during its current refueling outage identified three tubes containing cables connected to safety related 

components with through wall holes caused by welding activities. On October 10, 1997, the condition was reported under 

10CFR50.72 (b)(2)(1). The damage has been attributed to arcing due to welding activity. The time at which the damage 

occurred cannot be positively determined, but it is believed to have occurred during recent welding activities near the 

damaged floodup tubes. The damaged tubes will be replaced, and enhancements made to the welding work process will 

preclude future arcing damage due to welding. Additionally, inspection of the floodup tubes for damage at the beginning and 

end of refueling outages will be performed. Additionally, for an operating unit, floodup tubes in the vicinity of any hot work 

performed in the annulus will be inspected daily. Postulated failures that could result from the cracked floodup tubes were 

evaluated and found not to present a significant risk with regard to the protection of the public health and safety.

A-1 13
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

316-97-009 7 During a foreign materials exclusion inspection conducted on November 26, 1997, one of two Train B inlet lines for the 

hydrogen removal and air recirculation from the Unit 2 number 2 and 3 Steam Generator enclosures was found to have 

been blocked by concrete. The condition was reported under the provisions of 10CFR50.72(b)(2)(l) on November 30, 1997. 

The blockage occurred during the Unit 2 Steam Generator replacement in 1988. During this time, portions of the Steam 

Generator enclosure structure were removed to allow access to the Steam Generators. Following the replacement, the 

structures were reconstructed. It is believed that the concrete entered the line during the repair of the structure. The 

blockage has been removed, and procedures will be implemented to preclude future blockages of these lines. An evaluation 

of the impact of the blockage has concluded that there would have been adequate flow through the Steam Generator 

enclosure to preclude excessive accumulation of hydrogen. Thus, the condition did not present a significant risk to the 

health and safety of the public. 

316-97-010 6b During periodic maintenance of the Unit 2 upper containment airlock, the seal for the inner bulkhead interlock shaft was 

(MULTI-UNIT found to consist of Teflon packing rings rather than the specified EPDM elastomer. As Teflon degrades when exposed to 

APPLICABILITY) the high radiation levels that could exist inside the containment following a postulated loss of coolant accident, a leakage 

path from the containment into the airlock compartment could have been opened. This condition was reported via ENS at 

1726 hours EST the same day in accordance with 10CFR50.72(b)(2)(i), as a degraded condition discovered while the 

reactor was shutdown. The cause of the event was unclear written work instructions which resulted in incomplete 

performance of the shaft seal replacement. An evaluation of the impact of the use of Teflon seals in the inner bulkhead 

interlock shaft concluded that although there could have been increased leakage into the airlock following a postulated 

LOCA, the outer airlock bulkhead, and its associated sealed door provided a barrier to excessive radioactive material 

releases. Thus, the condition did not present a significant risk to the health and safety of the public. 

317-97-001 5b POWER LEVEL - 100%. On Friday, January 10, 1997, it was discovered that air from the Spent Fuel Pool (SFP) area was 

(MULTI-UNIT leaking out into the Auxiliary Building while fuel was being moved in the SFP. This condition was outside the design basis of 

APPLICABILITY) the plant. Subsequent investigation found that the Surveillance Test Procedure performed every 18 months to demonstrate 

(Calvert Cliffs) operability of the SFP ventilation system had not been performed since September of 1994. Fuel movement has been 

suspended until appropriate procedures are changed to ensure that the SFP ventilation system operates at a negative 

pressure versus surrounding areas, including the Auxiliary Building. A Root Cause Analysis is being performed to determine 

casual factors and generic implications for this event. Additional actions will be reported in a supplement to this report.

A-114
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

317-97-003 5b On Thursday, April 24, 1997, fuel was moved in the Spent Fuel Pool without the charcoal adsorber banks being in service. 

(MULTI-UNIT This placed the plant outside its design basis. An ongoing Root Cause Analysis has thus far identified as primary causal 

APPLICABILITY) factors for this event personnel error on the part of the Spent Fuel Handling Machine operator and poor communications 

between him and the Control Room Operator. Contributing to this event was unclear procedural guidance. Additional 

contributing causes are being evaluated. Upon discovery, fuel movement was suspended until all appropriate personnel 

could be trained and procedures revised. An effort is underway to identify and address potential similar problems. A Root 

Cause investigation is currently ongoing. If any additional causes or corrective actions are identified, they will be detailed in 

a supplement to this report. 

321-97-003 6b POWER LEVEL - 100%. On 3/25/97 at 1307 EST, Unit 1 was in the Run mode at a power level of 2558 CMWT (100 

(MULTI-UNIT percent rated thermal power) and Unit 2 was in the Refuel mode with the cavity flooded. At that time, plant personnel 

APPLICABILITY) determined an event reported to Southern Nuclear Operating Company personnel by General Electric involving the Rod 

(Hatch 1) Block Monitor (RBM) met the reporting requirements of 10 CFR 50.72 (b)(2)(iii) and 50.73 (a)(2)(v). General Electric 

reported that their core design procedures contained a step which allowed them to assume the RBM is operable and 

available to mitigate the consequences of a Rod Withdrawal Error (RWE) irrespective of the individual plant's Technical 

Specifications requirements for RBM operability. Plant personnel, after thoroughly reviewing this event, determined it was a 

condition that alone could have prevented the fulfillment of the safety function of the RBM to control (prevent) the release of 

radioactive materials during an RWE. This event was the result of a disparity between the core analysis design procedure 

assumptions and the Unit 1 and Unit 2 Technical Specifications requirements regarding RBM operability. As a corrective 

action, Operations procedure 34GO-OPS-065-OS, 'Control Rod Movement,' now requires the Unit 1 and Unit 2 RBMs to be 

operable whenever reactor power is above 27 percent rated thermal power. Proposed changes to the Unit 1 and Unit 2 

Technical Specifications are being prepared for submittal to the NRC.

A-115
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

321-97-004 3b On 7/15/97 at 1658 EDT, Unit 1 was in the Run mode at a power level of 2558 CMWT (100 percent rated thermal power). 

At that time, personnel determined a single failure could affect the circuits for the 1A Diesel Generator and the 1CD 

4160V/600V transformer. This postulated common failure could prevent timely re-energization of the 1C 600V bus via the 

1CD transformer. Without power to this bus, operators could not place the required number of Residual Heat Removal 

Service Water pumps in the long-term containment heat removal mode. With less than the required number of pumps in the 

heat removal mode, suppression pool temperature could exceed its maximum analyzed value, adversely affecting long-term 

containment temperature and pressure response and available net positive suction head for emergency core cooling 

system pumps. On 7/15/97, operations personnel declared an RHRSW pump inoperable to account for the loss of single 

failure protection. This event apparently was caused by an original design error. Circuits for the 1CD transformer were 

classified incorrectly and were routed through the same raceways as the 1A Diesel Generator. This error created the 

potential for a single failure to disable the 1A Diesel Generator and the 1CD 4160V/600V transformer. A temporary 

modification was implemented on 7/16/97 to disarm the differential auxiliary relay circuits for the 1CD transformer thereby 

ensuring a fault that will inop the 1A diesel generator circuits will not prevent the use of the 1CD transformer. Conversely, a 

fault in the circuits of the 1 CD transformer will not inop the 1 A Diesel Generator. A design change will be implemented 

during the next scheduled Unit 1 refueling outage to provide proper separation of the circuits. 

323-97-004 6a On October 17, 1997, at 1630 PDT, with Unit 2 in Mode 1 (Power Operation) at 100 percent power, PG&E determined that 

(Diablo the auxiliary saltwater system (ASW) safe shutdown electrical circuits did not meet 10 CFR 50, Appendix R, requirements 

Canyon 2) and were therefore outside the design basis of the plant. Two pull boxes did not have adequate fire protection separation. 

These pull boxes contained redundant ASW safe shutdown circuits, and a fire in either pull box could result in the loss of 

both trains of ASW. A 1-hour, non-emergency report was made to the NRC in accordance with 10 CFR 50.72(b)(1)(ii)(B) at 

1657 PDT, on October 17, 1997. A preliminary investigation has determined that this condition does not affect Unit 1 ASW 

safe shutdown circuits. On October 17, 1997, at 1630 PDT, a continuous fire watch was established as an interim 

compensatory measure. The root cause of this event is personnel error (cognitive) in that the ASW safe shutdown circuits 

were incorrectly evaluated as being entirely embedded; thus the circuits did not receive 10 CFR 50, Appendix R, reviews. 

The pull boxes will be modified to meet 10 CFR 50, Appendix R, requirements. PG&E will also review other embedded pull 

boxes with safe shutdown equipment cables to ensure that 10 CFR 50, Appendix R, requirements are met.

A-116
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

323-97-006 7 On December 11, 1997, at 1115 PST, with Unit 2 in Mode 1 (Power Operation) at 100 percent power, PG&E determined 

(MULTI-UNIT that fuel pellet-to-clad gap reopening had been predicted on a 95 percent upper bound basis for lead rods at cycle burnups 

APPLICABILITY) greater than 18,000 megawatt days per metric ton uranium. This burnup occurred in Unit 2 on September 1, 1997. This 

condition is outside the design basis for the plant. Additionally, Westinghouse completed analyses which show that although 

gap reopening is predicted for Unit 2, Cycle 8, the 10 CFR 50.46 criterion for localized 17 percent total oxidation continues 

to be met. On December 11, 1997, at 1130 PST, PG&E made a 1-hour, non-emergency report to the NRC in accordance 

with 10 CFR 50.72 (b)(1)(ii)(B). The December 11, 1997, report was updated on January 6, 1998. Westinghouse discovered 

the potential for this condition in high duty integral burnable absorber rods when the effects of increased Zirc-4 corrosion on 

high duty rods were incorporated into the current version of the fuel performance computer code. The condition was caused 

by Zirc-4 cladding materials corrosion rates higher than previously expected on high duty fuel rods. PG&E will continue to 

communicate with Westinghouse through implementation of a long term resolution plan and will take appropriate actions for 

Diablo Canyon Power Plant, Units 1 and 2. 

325-97-004 NRF On May 6, 1997, Units land 2 were operating at rated power when it was determined that spent fuel shipping cask handling 

(MULTI-UNIT activities had been conducted outside the design bases. Specifically, the site procedures controlling the lifting and loading 

APPLICABILITY) of an IF-300 spent fuel shipping cask prescribe the use of rigging which is not single failure proof during transfer from the 

(Brunswick 1) tilting cradle to the secondary yoke, contrary to existing analyses. This transfer occurs on the 20' elevation of the reactor 

building at a lift height of approximately 7 feet. In addition, during previous spent fuel shipping cask handling activities when 

the non-single failure proof lift condition existed, the safety-related valve box covers were not installed. Current spent fuel 

analyses bound a 30' cask drop with the safety-related valve box covers installed. There is not an existing analysis for a 

spent fuel shipping cask drop without the valve covers installed. This event was caused by an incomplete understanding of 

the scope of the NEDO-10084-4, Vectra IF-300 Shipping Cask Consolidated Safety Analysis Report and NUREG-0612, 

"Control of Heavy Loads at Nuclear Power Plants." Site procedures for spent fuel shipping, handling, and receiving have 

been placed on administrative hold pending resolution of this issue and NRC review and approval of a related change to the 

licensing/design bases. A load drop analysis for the postulated spent fuel shipping cask drop accident will be performed in 

accordance with the applicable guidance of NUREG-0612. In addition, a review of the applicable regulatory requirements 

and site procedures related to spent fuel shipping cask handling will be performed to ensure consistency.

A-117
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY F 

325-97-005 5b On April 2, 1997, with Unit 1 operating at 95% reactor power, while awaiting implementation of power uprate to 100% 

reactor power, the results of an ultrasonic test (UT) conducted on the Unit 1 Feedwater (FW) system flow venturis indicated 

that the Unit 1 FW system flow indication was potentially non-conservative. In response, Unit 1 reactor power was reduced 

to 93% at 1557 hours. Administrative controls were established to ensure core thermal power would not exceed 93% until 

the FW system flow instrumentation could be re-calibrated. On April 7, 1997, the Unit 1 FW system flow instrumentation 

were re-calibrated based upon the UT test data. This calibration provided the most conservative feedwater flow indication 

while a more detailed engineering evaluation of the various venturi tests could be completed; Unit 1 reactor power was 

subsequently restored to 95%. Evaluation of the three venturi tests performed since plant construction concluded that the 

chemical tracer test performed in 1994 and the recent UT test were not as accurate as the original weigh tank test 

performed during plant construction. Using the original calibration constants as a basis, a review of operating data since the 

1994 FW system flow instrumentation calibrations determined that the licensed power level was exceeded by approximately 

1.3% and that the thermal limits defined by the Technical Specifications were exceeded for brief periods on six occasions. 

Corrective actions include internal inspection of the FW system A loop venturi and recalibration of the feedwater flow 

instrumentation based upon the original weigh tank test results. 

325-97-011 3a On September 12, 1997, a review of industry events related to primary containment pressure suppression bypass paths 

(MULTI-UNIT determined that plant operating procedures allowed simultaneous inerting/purging/deinerting of the drywell and suppression 

APPLICABILITY) chamber: however, use of this bypass path was not appropriately supported by design analysis. The Containment 

Atmosphere Control system valve lineups associated with these activities have resulted in an external pressure suppression 

bypass path between the drywell and suppression chamber air spaces. If a Loss of Coolant Accident occurred with this 

bypass path open, primary containment design pressures could have been exceeded. The isolation of the bypass path 

relies on two inboard primary containment isolation system (PCIS) valves and both valves use the same division of isolation 

logic, making the isolation function susceptible to a single failure. The cause of the issue is that documentation of the design 

limitations associated with a containment pressure suppression bypass path were not of sufficient detail to allow personnel 

to recognize that the paths created for primary containment inerting/purging/deinerting must meet the isolation requirements 

for a containment pressure suppression bypass path, as well as the PCIS function. Administrative controls have been 

implemented to prohibit simultaneous inerting/purging/deinerting in Operational Conditions 1, 2, and 3, pending revision of 

appropriate operating procedures; applicable design bases documents are also being revised. This condition is being 

reported in accordance with 10 CFR 50.73(a)(2)(ii), as a condition outside the plants' design bases.

A-118
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY [ EVENT ABSTRACT 

CATEGORY 

327-97-006 6a POWER LEVEL - 000%. On March 22, 1997, at 2300 hours Eastern Standard Time, with Unit 1 in Mode 5 shutting down 

(Sequoyah 1) for a refueling outage, during review of radiological work permits (RWPs), it was determined that technical specification 

surveillance requirements for visual inspection were not performed during containment entry when containment integrity 

was established. The visual inspections verify that no loose debris is present in the containment which could be transported 

to the containment sump and cause restriction of the pump suction during loss of coolant accident conditions. On March 22, 

1997, an upper-containment entry was made to install contamination control material (oil cloth and Herculite). The entry was made using an RWP that was developed for activities to be performed during Modes 5 and 6 where inspection 

requirements were not applicable. A subsequent evaluation determined that although the material was strongly secured, the 

installation of contamination control material in upper containment for upcoming ice condenser maintenance activities had 

the potential to adversely affect emergency core cooling system pump suction in the recirculation mode of operation. Upon 

identification of the condition, the involved RWP was closed to prevent further access. The cause of the condition was 

personnel error. Involved individuals failed to comply with plant procedures to ensure materials taken into containment are 

adequately controlled. Lessons learned were communicated to appropriate Radiological Control personnel and the 

appropriate disciplinary action is being taken in response to the personnel errors. The appropriate procedure has been 

revised to improve administrative controls during containment entries when containment integrity is established. 

333-97-003 6b As a result of Generic Letter (GL) 96-06, "Assurance of Equipment Operability and Containment Integrity During Design 

(FitzPatrick) Basis Accident Conditions", the Authority identified containment penetrations which could be subjected to 

overpressurization due to thermal expansion of the entrapped water during design basis accidents (DBAs) when the 

penetrations are isolated. On 2/13/97 the Authority reported that the overpressurization of containment penetrations could 

potentially be a condition that is outside the design basis of the plant. The cause of this event is that pressurization of these 

penetrations due to thermal expansion of entrapped fluid between the containment isolation valves was not considered 

during the design of the FitzPatrick plant. Operability determinations have been completed in accordance with GL 9118, 

"Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Non

Conforming Conditions and on Operability" to verify operability. The operability determination demonstrated that 

containment integrity is maintained and safety functions are not compromised for the susceptible containment penetrations. 

Detailed analyses are in progress for final disposition and determination of the need for modification or procedural revisions. 

The results of this analysis, including a long term corrective action plan if required, will be submitted by 5/27/97.

A-119
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

333-97-010 2a On October 21, 1997 at approximately 1435 hours, during a review of industry events, Engineering determined that 

surveillance testing of the Primary Containment Pressure Suppression Chamber - Drywell Vacuum Breakers coincident with 

a Loss of Coolant Accident (LOCA) will result in a partial loss of the primary containment pressure suppression function. 

The plant was operating in run at approximately 100% power at the time of the event. During performance of Surveillance 

Tests (ST) 15A and ST-15F, the plant utilizes a configuration where both the 24" drywell vent valves and both the 20" torus 

vent valves are opened to equalize the pressure across the vacuum breakers. The vacuum breakers are then cycled open 

and closed. Opening the drywell and torus vent valves simultaneously establishes a flow path bypassing the pressure 

suppression function of the torus. Should a LOCA take place while the plant is in this configuration, an indeterminate 

amount of direct torus air space pressurization could occur pending full closure of the vent valves from a Primary 

Containment isolation signal. This could result in containment loads in excess of those currently analyzed. The apparent 

cause of this event was that technical reviews of procedures which utilize this configuration were inadequate. The results of 

reviews identified two additional procedures (ST-39E and OP-37) requiring change. The four identified procedures have 

been revised to allow the use of a valve line-up which will not create a direct connection between the torus and drywell air 

spaces via the torus and drywell vent valves when primary containment integrity is required.

A-120
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-121

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

334-97-016 NRS On June 27, 1997 at 2007, it was determined that the plant had the potential for a control and protection system interaction 

(Beaver Valley 1) in the Steam Generator Water Level Control System (SGWLCS) which could prevent the Reactor Protection System (RPS) 

from initiating a reactor trip on a low-low steam generator level. This was identified during an engineering review of the 

seismic qualifications of the main feedwater flow transmitters. This trip was required by IEEE 279-1971 as a diverse trip to 

the two-out-of-three low-low steam generator reactor trip because of the control and protection interaction of the steam 

generator level channels. This was reported in accordance with 10 CFR 50.72 (b)(1)(i)(A) and (b)(1)(ii)(B). BVPS Unit 1 was 

then taken to Mode 3. On June 28, an update to the original 10 CFR 50.72 report was provided to indicate that the steam 

generator low-low level trip was also inoperable. On July 3, 1997, with the unit in Mode 3, Residual Heat Removal (RHR) 

sample isolation valve RH-214 was opened to allow sampling of the RHR system. When this valve was opened, no 

overpressure protection for penetration 97-1 existed and it was declared inoperable, resulting in a unit shutdown to Mode 5 

as required by Technical Specification 3.6.1.1. This was reported in accordance with 50.72 (b)(1)(ii)(A). The apparent cause 

of the initiating event was a misapplication of IEEE 279-1971 Section 4.7 Control and Protection System Interaction criteria 

during the original plant design. Corrective actions for this event Include: 1) a design modification to the SGWLCS was 

implemented to ensure against the identified control and protection system interaction, by installing a Median Signal 

Selector Switch in each of the three SGWLCS racks, 2) a design review of the Unit 1 and Unit 2 RPSs with respect to 

compliance with IEEE 279-1971 is being performed. As potential exists for a control and protection system interaction for 

the SG level protection system, IEEE-279-1971 requires that a second failure must be postulated. If a second SG level 

instrument were to fail in an intermediate position, since there are three channels, the requisite RPS trip logic would not be 

satisfied and a reactor trip and auxiliary feedwater automatic start would not be generated as required when an actual SG 

low-low level condition occurred. The described condition does not meet IEEE-279 1971 criteria and is outside the Unit 1 

design basis.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

334-97-018 NRS On July 5, 1997, at 1930 hours with Beaver Valley Power Station (BVPS) Unit 1 in Mode 5 at 0% reactor power level, it was 

determined that a condition existed that could adversely affect the ability of both Emergency Diesel Generators (EDG) 

(EE-EG-1 and EE-EG-2) to function due to a seismic event. Based on Engineering reviews performed as part of USI A-46, 

"Seismic Qualification of Equipment in Operating Plants, "it was determined that certain Fire Protection System components 

which are part of the control circuitry for the carbon dioxide fire suppression system for the EDG rooms potentially could 

spuriously operate during a seismic event. This would result in carbon dioxide discharging into both EDG rooms and 

adversely affecting the EDGs' ability to function, if called upon, due to air displacement by carbon dioxide flooding. The 

BVPS Unit 1 UFSAR Section 9.10.1 states, "The fire protection system is designed on the basis that rupture or inadvertent 

operation will not significantly impair the safety capability of structures, systems, or components important to safety or 

designed to Seismic Category 1 requirements." Immediately following this determination, both EDGs were declared 

inoperable, until at 1935 hours on July 5, 1997 when the carbon dioxide fire suppression system in each EDG room was 

placed in the "abnormal" mode. Placing the system in the "abnormal" mode prevents automatic operation from the 

non-seismically qualified relays, but still provides fire alarm capability to the control room in the event of a fire in the EDG 

rooms. Concurrent with disabling the automatic feature of the EDG carbon dioxide fire suppression systems, a continuous 

fire watch with backup suppression capability was established in each EDG room in accordance with the BVPS Fire 

Protection Program. The apparent cause of this event is a deficiency in the original design of the carbon dioxide fire 

suppression systems for the BVPS Unit 1 EDG rooms. The Fire Suppression System for the Unit 2 EDGs was reviewed 

and it was determined that no similar problem existed, since the Unit 2 EDGs draw their combustion air from outside the 

EDG rooms. At 2120 hours on July 5, 1997, a four hour non-emergency notification was made pursuant to the requirements 

of 10 CFR 50.72(b)(2)(i). This report is being made pursuant to the requirements of 10 CFR 50.73(a)(2)(ii). This report also 

fulfills the BVPS Fire Protection Program requirement for a Special Report following carbon dioxide fire protection system 

inoperability that exceeds 14 days. There was no actual spurious operation of the Fire Protection System nor were there 

any equipment failures due to this event. Based upon this information there were no safety implications to the health and 

safety of the public as a result of this event.

A-122
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-123

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

334-97-019 6b On July 10, 1997 at 1345, a self initiated review of the Unit 1 Containment Isolation Valve Table revealed that check valves 

1 SA-1 5, 1 IA-91, and 1 RC-72 associated with containment penetration numbers 42, 45, and 47 did not meet the Unit 1 

UFSAR requirements for containment isolation valves. The Unit 1 UFSAR, section 5.3.3, states that weight and spring 

loaded check valves used for containment isolation are designed to require a DIP across the valve in the normal flow 

direction exceeding the expected post DBA D/P between atmosphere and the containment in order to open. A spring or 

weight loaded check valve is needed to maintain the containment subatmospheric after a Design Basis Accident if a 

passive failure of the penetration outside of containment is postulated in order to prevent air flow into containment. Loss of 

subatmospheric containment conditions after one hour post-LOCA would invalidate the current 10 CFR 100 dose analysis. 

A review of plant drawings determined that these check valves were not weight or spring loaded. The review also revealed 

that check valve 1 RC-72 did not meet the Unit 1 UFSAR section 5.3.4.2 requirement stating that Westinghouse check 

valves, when used as containment isolation valves, are loaded to close against a 2 psi positive differential pressure. This 

event was reported in accordance with 10 CFR 50.72 (b) (2) (i) (B) on July 10, 1997. This event is also reportable in 

accordance with 10 CFR 50.73 (a) (2) (ii) (B), plant in condition outside its design basis. At the time of discovery, Unit 1 was 

in Mode 5. Prior to startup, a temporary modification was performed to install a blank flange downstream of check valve 

1SA-15 to provide a containment integrity boundary. A permanent modification will be performed prior to December 15, 

1997. Check valves 1 IA-91 and 1 RC-72 were replaced with qualified valves on July 16, 1997. A review of the similar 

penetrations on Unit 2 found no similar design discrepancies. The apparent cause of this event is inadequate design 

reviews relating to containment penetration-protection during initial plant construction as specified in the Unit 1 UFSAR 

sections 5.3.3 and 5.3.4. If a passive failure of the piping outside of containment on a line utilizing one of these check valves 

was to have occurred during a Design Basis Accident, the containment, designed to be maintained subatmospheric for 30 

days, would repressurize to atmospheric pressure as a result of air entering via the broken pipe. This condition, if postulated 

to occur, does not comply with the UFSAR analysis of dose limits assumptions following a DBA.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

334-97-020 2a On July 24, 1997, at approximately 1830 hours, with Beaver Valley Power Station (BVPS) Unit 1 in Mode 5 and at 0 percent 

reactor power, an Engineering review identified a pressure switch contact, without the required quality assurance level 

category, which was installed in the control circuit for each of the two Emergency Diesel Generator (EDG) room's safety 

related ventilation systems. A pressure switch located in each EDG room, as part of the fire protection system and used to 

sense a carbon dioxide discharge, has a normally closed contact which opens upon sensing a carbon dioxide discharge. 

Opening of the contact prevents the EDG room ventilation fan from operating. The review of this condition concluded that, 

without the required quality assurance level category, the pressure switch contacts must be assumed to fail open during an 

accident condition. This would result in loss of the EDG room ventilation and with an operating EDG will result in a steadily 

increasing EDG room temperature leading to EDG performance degradation and eventual inability of the EDG to perform its 

safety function. This event would not have prevented the EDGs from responding to either an automatic or manual start 

signal. The apparent cause of this event is a deficiency in the original design of the ventilation system for the Unit 1 EDG 

rooms. This condition does not apply to Unit 2, since the Unit 2 EDG ventilation system does not have interlocked CO sub 2 

pressure switches. On July 24, 1997, at 1915 hours, both EDGs were declared inoperable pending resolution of this 

condition. The appropriate Technical Specification ACTION STATEMENT was applied, including a prohibition on entering 

Mode 4. Installation of qualified replacement switches was completed by July 27, 1997, with Unit I still in Mode 5. No actual 

equipment failure or loss of safety function was found. A four-hour non-emergency report of this condition was made on July 

24, 1997, at 2004 hours, pursuant to the requirements of 10 CFR 50.72(b)(2)(1). This report is being made pursuant to the 

requirements of 10 CFR 50.73(a)(2)(ii)(B). Based on the above information, there were minimal safety implications to the 

health and safety of the public.

A-124
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-125

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

334-97-021 NRS On July 26, 1997 at 1715 hours, with Beaver Valley Power Station (BVPS) Unit 1 in Mode 5 at 0% reactor power level, it 

(MULTI-UNIT was determined that a condition existed that could adversely affect the ability of both Supplementary Leak Collection and 

APPLICABILITY) Release System (SLCRS) trains to function due to a seismic event. Based on Engineering reviews performed as part of USI 

A-46, "Seismic Qualification of Equipment in Operating Plants, "it was determined that certain Fire Protection System 

components which are part of the control circuitry for the SLCRS Charcoal Filters water deluge system could spuriously 

operate during a seismic event. This would result in water soaking the charcoal, thus rendering the filters inoperable. The 

BVPS Unit 1 UFSAR Section 9.10.1 states, "The fire protection system is designed on the basis that rupture or inadvertent 

operation will not significantly impair the safety capability of structures, systems, or components important to safety or 

designed to Seismic Category I requirements. "Immediately following this determination, both trains of SLCRS were 

declared inoperable. At 2025 on July 26, 1997, a four hour non-emergency notification of the Unit 1 condition was made 

pursuant to the requirements of 10 CFR 50.72 (b)(2)(i). On August 21, 1997, a follow-up extent of condition evaluation 

identified that BVPS Unit 2 SLCRS Charcoal Filters water deluge system components could spuriously operate during a 

seismic event, rendering the filters (both trains of SLCRS) inoperable. At 1622, both trains of SLCRS were declared 

inoperable. At 1638, a one-hour non-emergency notification of the Unit 2 condition was made pursuant to the requirements 

of 10 CFR 50.72 (b)(1)(ii)(B). At each Unit, after declaring the SLCRS inoperable, the water deluge system for each SLCRS 

train was manually isolated, a roving fire tour was posted (or was already established), and the trains were declared 

operable. This report is being made pursuant to the requirements of 10 CFR 50.73 (a)(2)(ii), 50.73(a)(2)(v), and 

50.73(a)(2)(vii). This report also fulfills the BVPS Fire Protection Program requirement for a Special Report following fire 

system inoperability that exceeds 14 days. There was no actual spurious operation of the Fire Protection System at either 

unit nor were there any equipment failures due to the events. Based upon this information there were no safety implications 

to the health and safety of the public as a result of the events. Corrective actions planned to prevent recurrence include 

seismic qualification for relays of concern, replacement of the relays with seismically qualified devices, or evaluation of the 

filter banks' fire protection system for continued manual control.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-126

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGrORY1 

334-97-033 6b On October 8, 1997, at 1800 hours with Beaver Valley Power Station Unit 1 in Mode 6, a review by the Nuclear Engineering 

Department identified a potential problem. The voltage supplied to the Nuclear Instrumentation System (NIS) power 

supplies in the NIS instrumentation protection racks could potentially be outside the voltage range specified by the system 

vendor. This condition could potentially adversely affect the Reactor Trip System (RTS) Instrumentation protective action 

functions that rely on NIS data. Upon identification of this condition, a periodic verification of the adequacy of the NIS 

instrumentation protection rack voltages was begun starting at 2120 hours on October 8, 1997, until the situation was 

resolved. Voltages at the NIS racks were found to be within the vendor's specified range. The apparent cause of this event 

was an inadequate design change during the original construction of Unit 1 which eliminated voltage regulating transformers 

on the power feed to the NIS instrument racks. As a corrective action a design change was developed and implemented by 

October 19, 1997, which added voltage regulating transformers to the power feed of each NIS instrumentation rack. Unit 1 

was defueled at the time. Pursuant to the requirements of 10 CFR 50.73(a)(2)(ii)(B), this event is being reported as a 

condition that resulted in the nuclear power plant being in a condition that was outside the design basis of the plant. This 

event was previously reported at the time of discovery as a four-hour report pursuant to the requirements of 10 CFR 

50.72(b)(2)(1) on October 8, 1997, at 2124 hours. This event identified that with the existing design of the power feed to the 

NIS instrumentation racks, the potential existed for operating with a voltage at the NIS protection racks outside the NIS 

vendor's specified voltage range. Further, it was determined that this situation could adversely affect the RTS function 

setpoints that are developed from NIS data. No actual voltage condition outside the vendor's specified range was identified 

as a result of this event. Therefore, no degradation in safety function has been identified as actually occurring. Based on 

this information, there were no safety implications to the health and safety of the public as a result of this event.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-127

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

334-97-035 6b On June 3, 1997, at Beaver Valley Power Station Unit 1, various original Stone and Webster Engineering Corporation pipe 

support design deficiencies on small bore piping (2 inch and smaller lines) were identified during an engineering review. It 

was identified that a sliding support was disengaged from its guide on a 2 inch line that comprises the "B" Reactor Coolant 

System (RCS) loop drain piping. This sliding support was restored to the proper configuration. Engineering reviewed sliding 

supports for safety-related small bore lines and modified some additional sliding supports to ensure they would meet design 

requirements. Additional evaluation of RCS loop drain small bore pipe supports identified that the design of some bar type 

anchors was not meeting code requirements. Subsequently, anchors of this style on other small bore safety-related piping 

were also reviewed and modifications were made for those supports identified during the reviews which were determined to 

be outside their AISC (support) and ANSI (piping) code design requirements. This condition is not applicable to Unit 2. 

Reportability determinations have identified no requirement for a 10CFR50.73 report to date. This report is being made as a 

voluntary LER to describe identified small bore piping support design concerns and to outline the follow-up investigative 

approach and associated corrective actions. Additional evaluation, which will include an operability review of the 

safety-related small bore piping supports, is ongoing. Continuing assessments are being performed to identify any 

inoperable supports in accordance with Generic Letter 91-18. These assessments will be completed prior to startup from 

the current refueling outage. The apparent cause of this event was inadequate original design by the architect engineer, in 

that: 1) a sliding support became physically disengaged from its guide and 2) certain bar anchor supports were identified 

which had loads in excess of their AISC code rating and piping integral weld stresses in excess of their ANSI B31.1 code 

rating. The actual safety significance of this event is low, since evaluations performed thus far indicate that, as a 

consequence of safety related small bore piping support design deficiencies, none of the lines would experience pipe 

stresses or support loading of a magnitude that would result in an inoperable condition or a condition that significantly 

compromises plant safety. There are currently no safety implications to the health and safety of the public as a result of this 

event.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-128

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

334-97-038 3a On May 24, 1997, a degraded penetration seal (MSV-752-1910) associated with a 3/4 inch drain line located in the floor of 

the Unit 1 main steam valve cubicle was discovered in the field. However, actions to address the degraded floor penetration 

seal were not taken until September 9, 1997. At that time an hourly fire watch was established. Installation of a hydrostatic 

and fire rated seal was completed on October 8, 1997. On December 5, 1997, an engineering evaluation concluded that in 

the event of a feedwater line break, water could drain through the degraded floor penetration seal and enter the pump room 

below, causing a temperature rise in the area that could disable the motor driven auxiliary feedwater pumps. In addition, the 

turbine driven auxiliary feedwater pump may also be unavailable in the event of a feedwater line break. The degraded floor 

penetration seal together with the postulated event, could cause three auxiliary feedwater pumps to become inoperable. 

Since this condition is outside the design basis of the plant, and could have prevented the fulfillment of the safety function of 

systems that are needed to mitigate the consequences of an accident, it is reportable in accordance with 10 CFR 

50.73(a)(2)(ii)(B), and 10 CFR 50.73(a)(2)(v). The cause of the penetration seat degradation could not be determined. The 

delay from May 24, 1997 to September 9, 1997 in addressing the degraded seal was attributed to a cognitive error by those 

who dispositioned the degraded seal condition. Personnel failed to recognize the high priority and safety significance 

associated with fire rated and hydrostatic penetration seals. There were no structures, components, or systems (other than 

the penetration seal) that were inoperable or that contributed to the condition. Because there were no pipe breaks in the 

main steam valve cubicle area, the condition had no direct effect on the ability of the auxiliary feedwater pumps to perform 

their safety function in the room below. The steam driven auxiliary feedwater pump is assumed disabled by the postulated 

main feedwater line break event. Potential loss of both remaining motor driven auxiliary feedwater pumps would have 

significantly reduced the defense in depth available to remove decay heat. However, there was no actual safety 

consequence to this event since there were no pipe breaks; but had the potential for moderate safety consequences. The 

health and safety of the public were not affected. An additional degraded penetration seal was discovered on June 11, 

1998. This seal had ceramic fiberblanket damming material in its penetration (Fiberfrax), but no sealing material. The seal 

has now had proper sealing material installed. The room and adjacent room were completely inspected and no further 

inadequate floor penetration seals were identified.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

334-97-039 3c On December 8, 1997 it was determined that Unit 1 and Unit 2 may have operated in a condition that is outside the design 

(MULTI-UNIT basis of the plant. A minimum of one charging/High Head Safety Injection (HHSI) pump may not have been available to 

APPLICABILITY) provide emergency core cooling as described in the UFSAR due to intrusion of gas into the suction of the pumps, and 

subsequent gas binding. The determination is based on engineering evaluation of the results of scoping experiments 

conducted to assess fluid now patterns entering the Unit 1 and Unit 2 charging pumps. The cause of the condition was 

attributed in part to the design of charging/HHSI pump minimum flow recirculation line orifices. These orifices were found to 

strip non-condensable gas from the recirculation flow. In the event of a loss of coolant accident concurrent with a loss of 

offsite power, this design defect could have resulted in a loss of safety function necessary to mitigate accident 

consequences. Flow orifices are being replaced at Unit 1, and at Unit 2, to reduce the generation of gas bubbles. In 

addition, increased monitoring and vent system improvements are planned. On December 8, 1997 at 0412 hours, a one 

hour non-emergency notification of this condition at Unit 1 and Unit 2 was made pursuant to the requirements of 10 CFR 

50.72 (b)(1)(ii). The determination that a minimum of one HHSI/charging pump may not have been available to provide 

emergency core cooling as described in the UFSAR, is considered a condition outside the design bases of the plant and a 

condition that alone could have prevented the fulfillment of the safety function of structures or systems that are needed to 

mitigate the consequences of an accident. Therefore, this condition is reportable in accordance with 10 CFR 50.72(b)(1)(ii), 

10 CFR 50.73(a)(2)(ii), and 10 CFR 50.73(a)(2)(v). The design defect associated with the charging/HHSI pump minimum 

flow recirculation line orifices could create a substantial safety hazard, and is reportable pursuant to 10 CFR 21 

requirements. This report constitutes a 10 CFR 21 notification. The ability to provide emergency core cooling via the 

charging/HHSI pumps could have been adversely affected and the safety system may not have performed its' safety 

function. However, there were no actual concurrent failures of redundant charging/HHSI pumps at either unit. Therefore, 

there were no safety consequences to the health and safety of the public. 

335-97-007 NRF On May 2, 1997, St. Lucie Unit 1 was at 100 percent power, and St. Lucie Unit 2 was in Mode 6 and defueled for a refueling 

(MULTI-UNIT outage. An outage inspection of the Unit 2 Reactor Coolant Pumps (RCPs) identified minor external oil leakage at the upper 

APPLICABILITY) and lower RCP motor oil reservoir locations that was not captured by the RCP Oil Collection System. Appendix R Section 

(St. Lucie 1) 111.0 requires that the RCP Oil Collection System be designed to collect oil from all potential RCP oil leakage sources. The 

cause of this event was due to design deficiencies of the RCP Oil Collection System. Corrective actions include repairs to 

identified leak sites, and modifications to the RCP Oil Collection System to capture any future leakage from these areas.

A-129
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-130

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

335-97-008 NRF On July 28, 1997, St. Lucie Units 1 and 2 were in Mode 1 at 100 percent power. FPL was investigating work backlogs and 

(MULTI-UNIT determined that the corrective actions associated with NRC Information Notice (IN) 94-28, that dealt with fire protection 

APPLICABILITY) barrier deficiencies, were still pending. The original IN review required the evaluation of 218 mechanical penetration seals 

because the installed condition did not correlate to fire barrier qualification testing. However, the original review did not 

establish if the 218 seals were operable. An operability assessment for the 218 penetration seals was performed and of this 

population, seven penetration seals in Unit 1 and eight penetration seals in Unit 2 are inoperable. The apparent cause of 

this event was that the seal manufacturer did not provide formal documentation for installed seals that deviated from 

qualification test configurations. Additionally, the problem identification and corrective action procedure in place during the 

original IN review was weak in that the requirements and guidance for performing operability assessments were not well 

defined. Corrective actions include: 1) the existing hourly roving fire watch includes the 15 inoperable seals, 2) Generic 

Letter 86-10 mechanical fire penetration evaluations will be performed for the 218 mechanical seals that are not bounded by 

tested configurations, and 3) the inoperable mechanical fire penetrations will be modified to meet three hour fire barrier 

criterion. 

335-97-011 3a On October 27, 1997, Unit 1 was defueled in support of the steam generator replacement refueling outage. During the 

outage, obsolete Engineered Safety Feature Actuation System (ESFAS) bistables were being replaced to improve system 

reliability. During this effort on November 2, 1997, non-licensed utility personnel determined that the ESFAS Recirculation 

Actuation Signal (RAS) bistable set point for refueling water tank level had been set less conservative than the Technical 

Specification set point. The apparent cause for the non-conservative RAS set point was an inadequate set point and 

instrument loop scaling process. The process associated with the implementation of the refueling water tank instrument set 

point calculation resulted in not all required related plant procedures being revised. Corrective actions include: revising the 

ESFAS functional test procedure with the proper set point; implementing and calibrating to the proper set point; reviewing 

other set points on Unit 1 and 2; revising and training on a new Engineering set point calculation process; and issuing of a 

technical alert to include lessons learned.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT CATEGORY 

336-97-002 6a POWER LEVEL - 000%. On January 8, 1997, at 1230 Hours, it was postulated that the Control Room Emergency Filtration 

(Millstone 2) System (CREFS) common inlet damper, 2-HV-210, could become stuck closed, causing a single failure that disables both 

CREFS Facilities. There is no 'hand operator' and the damper is located about 9 feet above the floor, so operations 

personnel would not be able to open the damper within the 10 minutes required by the control room habitability analysis. 

The Millstone Unit 2 (MP2) accident analysis requires the CREFS to be operating in the recirculation/filtration mode within 

10 minutes of the accident initiation, and takes credit for manually opening the damper if it does not go to the 'fail open' 

position. The FSAR TABLE 9.9-17 'Control Room Air Conditioning System Failure Mode Analysis' shows the damper 

(2-HV-210) does not meet the single failure criterion, but that it can be manually opened within 10 minutes, using the 'hand 

operator'. Emergency operating procedures and annunciator response procedures direct operations to align one Facility of 

CREFS for operation. The plant was in Mode 6 at 0 percent power at the time of discovery. The cause of this event was 

inadequate evaluation of mechanical binding when the single failure was first discovered and the FSAR revision was 

prepared in June 1994. Additionally, the ability to manually open the damper was not validated. The immediate corrective 

action was to place the damper in the 'fail open' position. An evaluation of 2-HV-210 and associated procedures will be 

performed. Other operator actions which are included in the safety analyses will be reviewed and validated, as necessary. 

Design changes and validations which result will be completed before entering Mode 4. 

336-97-006 6b POWER LEVEL - 000%. On February 11, 1997 as the result of a continuing investigation, it was identified that the 

consequences of a main steam line break (MSLB) inside containment event could result in exceeding the design pressure 

of the primary containment under certain postulated scenarios. Two scenarios have been identified in which auxiliary 

feedwater (AFW) flow to the steam generators (SG) could occur sooner or at greater flow than previously analyzed. In 

these cases, the peak containment pressure can potentially exceed the design pressure of the primary containment (54 

psig). The cause of this event was an inadequate evaluation resulting from the omission of the consideration of the hot zero 

power condition with both AFW pumps in operation and the AFW discharge regulating valves sufficiently open to allow full 

flow at MSLB initiation. As a result of this event, corrective actions will be implemented to ensure that the plant response to 

a MSLB event will not result in exceeding the design requirements of the primary containment. These actions will be 

completed prior to plant restart from the current outage.

A-131
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

336-97-011 3b POWER LEVEL - 000%. On April 2,1997 a report was made to the Nuclear Regulatory Commission (NRC) which 

documented an event where the closing force for multiple dual function valves [ISV] had been improperly set, resulting in 

the valves being incapable of closing to a leaktight condition against normal operating system pressure (NOSP). Eleven of 

the 23 valves tested were not capable of providing an adequate closing force. This deficiency could result in the potential for 

a release of radioactive materials to the Auxiliary Building greater than analyzed in the facility Final Safety Analysis Report 

(FSAR). The cause of this event was an insufficient program to ensure that facility procedures clearly addressed all related 

design basis functions. To correct these deficiencies, the affected valves will be adjusted to ensure they properly close 

against containment design pressure and NOSP, and the appropriate procedures shall be revised to ensure that proper 

valve control parameters are specified and verified after any maintenance activities are performed that could affect dual 

function valve closing forces. 

336-97-014 7-None On April 15, 1997 a report was made to the Nuclear Regulatory Commission in accordance with the requirements of 10 

CFR 50.72(b)(2)(iii). This report documented that Reactor Building Closed Cooling Water (RBCCW) flow to the High 

Pressure Safety Injection (HPSI) pump sea] coolers for all three HPSI Pumps may not be adequate to ensure reliable 

operation of each pump shaft seal. Failure of a seal could result in contamination of HPSI pump bearing oil and eventual 

pump failure. An engineering evaluation has been conducted that determined 14.2 gpm to the HPSI pump bearing and 

seals coolers is the minimum required flow during peak RBCCW temperature conditions after an accident. The RBCCW 

piping was adequately sized to provide HPSI pump cooling. The RBCCW Design Basis Flow Distribution calculation has 

been issued to revise the design flow to the HPSI pump bearing and seal coolers to 15 gpm. 

336-97-015 6b On April 15, 1997, it was determined that the potential existed for water hammer and two-phase flow to occur in the 

Containment Air Recirculation (CAR) Cooler piping and therefore, could cause the piping to fail such that the CAR Coolers 

may not be able to perform their safety function during accident conditions. In addition, it was also determined that certain 

containment penetrations were susceptible to thermally induced overpressurization. On September 30, 1996, the Nuclear 

Regulatory Commission informed licensees in Generic Letter (GL) 96-06 that the potential existed for the containment air 

cooler water systems to be susceptible to either water hammer or two-phase flow conditions during postulated accident 

conditions. GL 96-06 requested that licensees evaluate this condition and additionally determine if piping systems that 

penetrate containment are susceptible to thermally induced overpressurization when isolated. On January 28, 1997, 

Northeast Nuclear Energy Company (NNECO) responded to the requested actions identified in Generic Letter 96-06 and 

stated that any issues discovered would be reported in accordance with the provisions of 10 CFR 50.73. It was determined 

that the Reactor Building Closed Cooling Water System (RBCCW) and certain containment penetrations were susceptible 

to the conditions identified in GL 96-06. The cause of this condition was inadequate consideration of potential failure modes 

during the system initial design and design basis verification. Plant design changes and procedure revisions have been 

implemented to ensure that stresses in piping and supports are within acceptable limits if a postulated water hammer event 

were to occur.

A-132
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT CATEGORY 

336-97-018 6b On November 6, 1996, while performing a review of the plant compliance with the recommendations of Regulatory Guide 

(RG) 1.97, Rev. 2, it was discovered that discrepancies existed between current plant commitments and the actual 

installation for certain Type A, Type B, and Type D instrumentation. These instruments, although reported to the NRC as 

Category 1, do not meet the Category 1 requirements. Northeast Nuclear Energy Company had stated that these 

instruments were in compliance with RG 1.97, Rev. 2 recommendations. This condition was first identified on November 6, 

1996, the evaluation to determine the details and extent of the condition was completed on April 21, 1997, and a prompt 

report of the condition was made on that date. At the time of discovery the plant was defueled. The cause of this condition 

is the ineffective implementation of program controls used to comply with RG 1.97. The following actions will be taken to 

correct this condition: Complete the RG 1.97 Rev. 2 compliance review including NNECO commitments and resubmit the 

results to the NRC before entering MODE 4 from the current outage. 

336-97-021 6b On April 23, 1997, an investigation was completed which indicated that a burned out lamp had failed with an internal short 

circuit. This investigation was initiated due to an April 8, 1997, event in which a technician noticed a burned out lamp on 

channel B Low Reactor Coolant Pump (RCP) Speed trip unit and an unusual indicator light configuration on the Reactor 

Protection System (RPS) BC matrix. The technician was preparing to perform a surveillance test at the time of discovery. 

When he removed the burned out lamp in the trip unit for the Low RCP Speed trip unit, the other lights returned to normal. 

The failed lamp was replaced with a new lamp. After further investigation it was postulated that had this failure occurred 

during operation, there is a possibility that the BC trip matrix could have been unavailable. The other five trip matrices were not affected and would have caused a trip if required. The investigation found that Non-QA lamps were being used in the 

RPS, a QA Category 1 system, contrary to system design basis. At the time of discovery the unit was defueled. The cause of this event was an inadequate scope of review in response to NRC Information Notice 94-68: Safety Related Equipment 

Failures Caused by Faulted Indicating Lamps. As corrective action an engineering evaluation of low voltage lamp circuit 

design in safety related equipment which was not reviewed as part of the Information Notice 94-68 response shall be 

performed. This evaluation will determine if lamp isolation is adequate or if a fault tolerant design exists. 

336-97-023 7 On June 12, 1997, during a review of the High Pressure Safety Injection (HPSI) pump Technical Specifications, it was 

determined that the actual HPSI System flow delivery to the reactor coolant system (RCS) may be less than the flow 

assumed in the Final Safety Analysis Report Chapter 14 Loss Of Coolant Accident and Main Steam Line Break accident 

analyses. The cause of this condition was the use of non-conservative HPSI system flow assumptions in the original design 

basis accident analyses and subsequent design verification. As a result of this condition, the affected accident analyses 

have been re-evaluated with conservative HPSI delivery rates resulting in the conclusion that the accident acceptance 

criteria are met.

A-133
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

336-97-029 6b On August 26, 1997, during the review of a design modification for a main steam line located outside containment, it was 

discovered that the present stress analysis of system piping supports performed during the facility review of Inspection and 

Enforcement Bulletin 79-14 did not consider all loads required by ANSI 1331.1, 1967 Edition. ANSI B31.7, Class II and Ill, 

1969 Edition, and ANSI B31.1, 1967 Edition, are the facility codes of record which are used for pipe stress analysis and 

determining piping support loads for piping outside containment. Further investigation has determined that the same 

condition also applied to the stress analysis for the main feedwater lines outside containment. The cause of this condition 

was the inappropriate application of a section of ASME Section III to ANSI B31.1 analyses in the calculation of the pipe 

support loads. As a result of this deficiency, a review of the piping stress analyses performed in support of the IE Bulletin 

79-14 review was undertaken to identify those calculations which referenced subsection NF of ASME Section III. The 

identified analyses have been revised to comply with the facility design basis. 

336-97-030 6c On August 30, 1997, during the investigation of a piping leak, it was determined that the "A" and "B" Emergency Diesel 

Generators (EDG) skid mounted piping and tubing may not maintain structural integrity during EDG operation. Portions of 

these systems had partial penetration welds. Evaluation of the welds show that piping with partial penetration welds, when 

exposed to excessive vibration, are susceptible to failure by vibration induced fatigue. The "B" EDG was not operating at 

the time of the event and was conservatively declared inoperable. The cause of this condition was non-conforming partial 

penetration tubing welds. The original vendor supplied EDG skid mounted piping and tubing did not fully comply with the 

design drawing requirement for full penetration welds. As a result of this condition, large bore piping and tubing with partial 

penetration welds, on both Emergency Diesel Generators, will be reworked and restored to code acceptable full penetration 

welds. 

336-97-031 6a On September 18, 1997, during our ongoing evaluation of the facility High Energy Line Break program for lines outside 

containment, it was discovered that certain safety-related components and structures required for safe shutdown of the 

plant such as piping, block walls, and switchgear are not properly protected from the dynamic and environmental effects of 

pipe ruptures in high energy lines. The cause of this condition is an inadequate review by the original facility analysis for 

postulated High Energy Line Breaks. As a result of this condition, the present pipe rupture design configurations associated 

with postulated high energy line breaks will be evaluated against the facility design criteria and corrective action required for 

facility startup, including compensatory measures, will be identified and performed prior to entering Mode 4 from the current 

outage.

A-134
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-135

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

336-97-034 3a On October 29, 1997 it was discovered during a review of a modification to address pressure locking phenomenon for the 

Containment Sump Isolation Valves (CSIV) that these valves could not only be susceptible to thermally induced pressure 

locking, but also pressure locking due to variations in containment pressure. The review found that the valve bonnet could 

be pressurized as high as 54 psig peak containment pressure and at Sump Recirculation Actuation Signal (SRAS), when 

the valves need to open, could approach 0 psig, resulting in a higher differential pressure across the CSIV disc than 

previously assumed. Preliminary calculations indicate the CSIV motor operators may not be adequately sized to open the 

valves under this condition. The cause of the event was a failure to identify the full range of conditions that could exist, 

when the valves must operate, for pressure locking and thermal binding evaluations. As corrective actions, a review has 

been conducted of other valves that may be susceptible to similar conditions and could cause pressure locking. No similar 

situations have been found. The MOV System and Design Basis Review Program Instruction has been revised to include 

formal reviews by Nuclear Engineering that require identification of design and licensing basis MOV Program scenarios. 

The Containment Sump Isolation Valves will be modified to preclude pressure locking for postulated conditions. The 

Pressure Locking and Thermal Binding Evaluation Program Instruction will be revised and implemented to include a formal 

review of the Pressure Locking and Thermal Binding Evaluations by Nuclear Engineering to ensure the full range of system 

conditions is considered. 

336-97-035 NRF On November 11, 1997, while revalidating compliance with 10 CFR 50 Appendix R requirements, it was discovered that the 

interface between the Reactor Coolant System (RCS) and the Shutdown Cooling suction line was not in conformance with 

Generic Letter 86-10. A fire induced three-phase hot short on the power cable for the Shutdown Cooling suction header 

RCS isolation valve could cause this valve to spuriously open and result in the inability to maintain RCS boundary isolation. 

The cause of this condition was inattention to detail and inadequate interdiscipline review during the 10 CFR 50 Appendix R 

Compliance analysis. The power cable downstream of the power disconnect switch for the Shutdown Cooling suction 

header Reactor Coolant System isolation valve will be rerouted so that it is not subject to hot shorts from energized 

three-phase power cables in the event of a fire. This modification will be implemented prior to entering Mode 4.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

341-97-003 5b POWER LEVEL - 000%. On March 3, 1997, it was determined that the Emergency Equipment Cooling Water System 

(Fermi 2) (EECWS) containment isolation function was outside the design basis. The EECWS is normally in standby and portions of 

the system piping distribute cooling water supplied by the Reactor Building Closed Cooling Water System (RBCCWS). The 

RBCCWS is isolated from the EECWS upon initiation of the EECWS. The Updated Final Safety Analysis Report (UFSAR) 

Containment Isolation System (CIS) design basis identifies that no single failure will result in loss of the containment 

function. It was determined that a single failure of an electrical division could result in the loss of the EECWS containment 

isolation function. The EECWS containment penetrations have been modified to provide diverse power such that a single 

failure will not result in the loss of the containment isolation function. A total of twelve previously unrecognized bypass 

leakage paths were identified in the EECWS, Post Accident Sampling System, and Compressed Air System. When leak 

rate data for these new bypass leakage paths was added to previous bypass leakage rate totals, the UFSAR bypass 

leakage limit of 4% La was exceeded on two occasions. Alarm Response Procedures (ARPs) have been revised to provide 

guidance to Operators to manually isolate the EECWS return header primary containment penetrations in the event that 

certain accident conditions exist. A UFSAR revision has been approved to properly identify the twelve new bypass leakage 

paths and these paths have been added to the bypass leakage program. 

341-97-005 NRF POWER LEVEL - 000%. During an engineering review of the Emergency Equipment Cooling Water (EECW) system, it was 

discovered on March 7, 1997, that the Reactor Building Closed Cooling Water (RBCCW) to EECW return and supply 

isolation valve interlocks are installed in the EECW makeup tank isolation valve circuit between the Dedicated Shutdown 

Panel transfer switch and the opening coil. The interlocks are not bypassed when the valve is in local control at the 

Dedicated Shutdown Panel. There is no assurance that the RBCCW to EECW return and supply isolation valves will close 

because they are not valves that can be operated from a Dedicated Shutdown Panel and are not protected from fire 

induced hot shorts. During a subsequent review of dedicated shutdown procedure circuits being performed as corrective 

action to the above, it was discovered on April 12, 1997, that smoke/CO sub 2 shutoff dampers in the Division 2 Battery 

Charger Room may not close, or may re-open during use of the Dedicated Shutdown Procedure. This could hamper access 

to areas needed to complete the Dedicated Shutdown Procedure. Dedicated Self Contained Breathing Apparatus (SCBA) 

units have been staged at the dedicated shutdown equipment area in the Radwaste Switchgear Room, and surveillance 

procedures have been revised to assure the availability of the SCBAs for Dedicated Shutdown Procedure use. The event 

was caused by inadequate design or consideration of these circuits. Contributing factors were inadequate cross discipline 

review and inadequate post modification testing. Currently, process barriers are in place to minimize the chance that this 

type of event can occur.

A-136
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-137

LER NUMBER SAFETY I EVENT ABSTRACT 

CATEGORY 

341-97-014 NRF During independent design verification of an Engineering Design Package, unsealed electrical penetrations were 

discovered in the auxiliary building wall fire rated separation barrier and in the adjacent and parallel turbine building fire 

barrier. This prompted a review of the fire hazards analysis and the 10CFR50, Appendix R assumptions used for this area. 

This review was completed on October 10, 1997 and revealed that of the 20 penetrations in these walls, 16 were not sealed 

at the auxiliary building wall and 4 were not sealed at the turbine building wall. There were no openings which were 

unsealed at both the turbine building wall and the auxiliary building wall. The 16 unsealed penetrations in the auxiliary 

building wall are located over a horizontal distance in excess of 25 feet and interface with areas which contain both 

redundant shutdown divisions. The lack of penetration seals in the fire barriers could allow a fire in the turbine building to 

exit the turbine building through any of the 4 unsealed penetrations and enter the auxiliary building at any of the sixteen 

unsealed penetrations. These 16 unsealed penetrations could then introduce a fire hazard within 20 feet of cable trays 

containing both Division I and Division II shutdown divisions. This condition is not in compliance with 1OCFR50, Appendix R 

and is also reportable within 24 hours under License Condition 2.C(9). On October 10, 1997 at 1745 hours, the NRC was 

notified of this event. An hourly fire watch was immediately established and will continue until an engineering design 

modification is installed to bring this area into compliance with 10CFR50, Appendix R. An evaluation using the guidance of 

Generic Letter 86-10 was performed and documented that the turbine building penetrations were sufficiently sealed. 

346-97-002 6b On January 22, 1997, with the unit in Mode 1 at approximately 100 percent power, it was identified that the design of some 

(Davis Besse) containment penetrations may not have adequately considered all possible accident conditions. This was based on review 

and evaluation of information contained in Information Notice 96-049, "Thermally Induced Pressurization of Nuclear Power 

Facility Piping," and Generic Letter 96-06, "Assurance of Equipment Operability and Containment Integrity During 

Design-Basis Accident Conditions." It was determined that six containment penetrations could exceed interim allowable 

pipe stress values during design basis loss of coolant accident conditions. Analysis showed that piping stress due to over 

pressurization is not sufficient to cause piping failure; therefore, no system or containment integrity would be lost. This 

condition is considered outside the plant design basis and is being reported in accordance with 10CFR50.73(a)(2)(ii)(B). 

Plant modifications and procedure changes are being developed to prevent over pressurization of the penetration piping.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

346-97-004 NRF POWER LEVEL - 100%. On January 31, 1997, with the plant in Mode 1 operating at 100 percent power, it was discovered 

that a portion of the oil piping for each Reactor Coolant Pump (RCP) motor was outside the oil collection system that is 

required per 10CFR50, Appendix R. This piping is the source connection for three pressure switches and a pressure gauge 

for the lift oil pump system, which is only pressurized when the lift oil pump is operating. On February 19, 1997, after 

reviewing pictures of the RCP motors as part of the corrective actions for this issue, more piping was found outside the RCP 

oil collection system. This additional piping included lower bearing remote oil fill connections, which are not pressurized; and 

piping for the lower bearing oil reservoir drains, which is exposed to only two feet static head pressure. The lift oil pumps 

are currently not operating, and the remote oil fill connections have not been used this operating cycle. This condition is 

considered outside the plant design basis and is being reported in accordance with 1OCFR50.73(a)(2)(ii)(B). Plant 

modifications are being developed to contain or modify the piping as necessary to ensure compliance with 10CFR50, 

Appendix R. 

346-97-012 NRS On September 4, 1997, with the Davis-Besse Nuclear Power Station operating at one hundred percent power, a Potential 

Condition Adverse to Quality Report was initiated with regard to the Decay Heat Coolers (DHCs). The DHCs were classified 

as outliers in accordance with the Seismic Qualification Utility Group program. During the evaluation of the DHCs as 

outliers, it was identified that loads from piping attached to the DHCs were not considered in the analysis of the DHC 

supports. The results of a calculation, which accounted for all of the applied loads on the DHC, indicated that portions of the 

DHC support system would exhibit localized yielding as a result of Safe Shutdown Earthquake loads. Engineering 

evaluation concluded that the localized yielding in the support system could prevent the DHC from performing its function 

unless the bolting between the DHC saddle and the stand was tightened to an acceptable condition. At 0900 hours on 

September 4, 1997, both DHCs were declared inoperable and LCO 3.0.3 was entered. Immediate Action Maintenance was 

completed to tighten these bolts to restore the system functionality and LCO 3.0.3 was exited at 0922 hours. The apparent 

cause for this occurrence is inadequate design of the DHC support system. Since the plant was in a condition outside the 

design basis of the plant, the NRC was notified by Toledo Edison via the Emergency Notification System at 0942 hours in 

accordance with 1OCFR50.72(b)(1)(ii)(B). This event is being reported under 1OCFR50.73(a)(2)(ii)(B) as a condition outside 

the plant's design basis, and 10CFR50.73(a)(2)(i)(B) as a condition prohibited by the plant's Technical Specifications.

A-138
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

346-97-015 NRF On December 12, 1997, at 1020 hours, with the unit in Mode 1 at 100% power, during a review of the condition report from 

the Fort Calhoun Station, it was discovered that a problem with the Emergency Diesel Generator (EDG) tachometer circuitry 

existed at Davis-Besse. A postulated hot short condition could cause a failure of the EDG speed switch before the operator 

could manually disconnect the EDG tachometer control room circuitry from the EDG speed switch. Technical Specification 

3.3.3.5.2 was entered to track the inoperable circuit, and an hourly fire watch was established in the cable spreading room. 

On December 18, 1997, at 1345 hours, it was determined that this condition represented a condition that was outside the 

10CFR50 Appendix R design basis of the plant. The control room tachometer circuit was isolated at 1356 hours using the 

installed local disconnect switch, and the NRC was notified via the Emergency Notification System at 1415 hours on 

December 18, 1997 in accordance with 1OCFR50.72(b)(1)(ii)(B). A review of all circuits previously identified as potentially 

experiencing a single hot short will be performed to determine if the consequences were adequately evaluated. This event 

is being reported in accordance with 1OCFR50.73(a)(2)(ii)(B), 1OCFR50.73(a)(2)(i), and the Special Report requirement of 

Technical Specification 3.3.3.5.2.b. 

348-97-007 6b On April 17, 1997, as a result of a plant walkdown, licensed operators reported some of the self expanding cork seal was 

(MULTI-UNIT missing from the gap between the main steam valve room (MSVR) and containment building. Deficiency Reports (DRs) 

APPLICABILITY) were submitted. A licensed operator questioned if this condition could result in the flooding of the lower level equipment 

(Farley 1) room (LLER) and what would be the effects if it did. As a result of this question, repairs to the Unit 2 seal were initiated and 

an engineering evaluation was requested to review this condition. On April 22, 1997, with Unit 1 in Mode 6 at approximately 

85 Degrees F reactor coolant system (RCS) temperature and 0 psig RCS pressure and Unit 2 in Mode 1 operating at 100% 

power, it was determined that Farley Nuclear Plant (FNP) had operated in a condition that was outside the design basis of 

the plant. These seals are required to function as watertight barriers to contain flood volume in the MSVR. The current main 

feedwater line break analysis assumes only one motor-driven auxiliary feedwater pump (MDAFWP) and the turbine-driven 

auxiliary feedwater pump (TDAFWP) are available. With sections of the seal missing, a flooding event in the MSVR could 

result in flooding of the LLER that is sufficient to render the TDAFWP and support equipment unavailable. With these 

conditions, auxiliary feedwater (AFW) flow to the steam generators could be less than assumed in the accident analyses. 

Similar conditions had been reported on June 22, 1996 and December 10, 1996 and DRs were submitted. The DRs were 

evaluated but the possibility of flooding was not considered. The repair of these seals was given a low priority and became 

part of the backlog of maintenance deficiencies. The causes of this condition were insufficient routine inspection which 

prevented timely detection of the degraded condition of the cork seal and incorrect evaluation of the deficiency and 

prioritization of work on the maintenance backlog. The Unit 2 seal repair has been completed. The Unit 1 seal will be 

repaired prior to Unit 1 entering an operating mode in which the seal is required.

A-139
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

348-97-008 NRS On April 23, 1997 with Unit 1 in Mode 6 at approximately 80 degrees F reactor coolant system (RCS) temperature and 0 

psig RCS pressure, it was determined that a condition existed where Unit 1 may have operated outside the design basis of 

the plant. An evaluation concluded on May 16, 1997 that Unit 1 had been operated in a condition outside the design basis 

of the plant. Specifically, a condition of high stresses in the RCS piping and lateral supports existed during plant operation 

due to gaps associated with the 1C steam generator (SG) support bumpers not being consistent with design. The 

evaluation concluded that the high stresses that occurred during normal plant operation did not exceed design code 

requirements. However, these stresses concurrent with the postulated safe shutdown earthquake (SSE) would have 

exceeded the code allowable stresses. During normal plant operation, higher than normal vibration was noted on the 

reactor coolant pump in Loop C. After the shutdown for the scheduled refueling outage, an investigation determined that hot 

gaps associated with the 1C SG support bumpers appeared to be too large on two of the bumpers and no gaps were 

present on two others. It was determined that interference between the RCS loop and the bumpers occurred during plant 

operation, resulting in a condition of high stresses in the RCS piping and the LS-12 support location. This event was caused 

by cognitive personnel error during the initial installation of the support shims when the shims on three 1C SG support 

bumpers were not installed in accordance with the design. The existing installed shim configuration has been modified. Hot 

gaps in all loops will be verified to be consistent with the original design. 

348-97-009 6a On April 30, 1997, with Unit 1 in Mode 5 at approximately 90 Degrees F reactor coolant system (RCS) temperature and 0 

(MULTI-UNIT psig RCS pressure and Unit 2 in Mode 1 operating at 100% power, it was determined that Farley Nuclear Plant (FNP) had 

APPLICABILITY) operated in a condition that was outside the design basis of the plant in that four Category 1 Service Water differential 

pressure switches had not been protected from Design Basis Tornado generated missiles. FSAR Section 3.5.4 requires that 

Category 1 equipment and piping be housed in Category 1 structures or be buried underground. Contrary to this 

requirement, these four switches are installed on the outside of the Diesel Generator (DG) Building. The switches 

susceptibility to tornado generated missiles was discovered during a plant walkdown by design personnel. Since a tornado 

generated missile could have caused a malfunction of these switches, Service Water flow to the Diesel Building could have 

been inadvertently isolated when the associated Service Water isolation motor-operated valves (MOVs) closed and shut off 

cooling water flow to the Emergency Diesel Generators. The loss of cooling water could render one or more of the 

Emergency Diesel Generators inoperable. Since a loss of offsite power should be assumed with a Design Basis Tornado, 

the Emergency Diesel Generators would be required to safely shutdown the plant. The cause of this condition is inadequate 

design in that the lack of missile protection for these switches was an oversight of the design organization. The automatic 

isolation function of the isolation valves from the SW Building to the DG Building has been disabled on both units.

A-140
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

348-97-010 6a At 1630 on May 23,1997, while Unit 1 was in Mode 5, it was determined that Unit 1 had operated in a condition outside its 

(MULTI-UNIT design basis. During a fuse inspection, it was concluded that the control circuitry for the operation of five Motor Operated 

APPLICABILITY) Valves (MOVs) was not wired per design. At 1325 on May 25 while Unit 2 was operating in Mode 1 at 100% power, 

subsequent investigation determined that the same condition existed on Unit 2. For the MOVs affected, the portion of the 

control circuitry which is used to select either local (Hot Shutdown Panel) or remote (Main Control Board) mode of operation 

was found to have the associated control power fuses wired in series rather than parallel. A one hour non-emergency 

notification was made to report this condition for Unit 2 at 1334 CDT on May 25, 1997. In this configuration, any fault which 

resulted in the opening of either fuse would have prevented operation of the valve from the local (Hot Shutdown Panel) 

location. The remote (Main Control Board) mode of operation would have operated as designed and would only have been 

lost in the event of a fault which opened its associated control power fuse. All affected MOVs were rewired in accordance 

with design. The cause of the improper wiring has been determined to be cognitive personnel error in that inadequate 

design instructions were provided to implementing personnel during the performance of design changes which established 

local-remote operation capability. 

348-97-013 5a On 8/18/97, with Units 1 and 2 operating at 100% reactor power, it was determined that Farley Nuclear Plant (FNP) had 

(MULTI-UNIT been operated outside the design basis of the plant due to the three control room exhaust isolation dampers being in the 

APPLICABILITY) open position during normal operation. FSAR Section 6.4.1.1 for habitability systems requires that, during design basis 

accident conditions, greater than 1/8 inch water gauge positive pressure will be maintained in the control room. Contrary to 

this requirement, an evaluation determined that, with the dampers open, a single failure could have prevented the control 

room ventilation system (CRVS) from maintaining the required pressure to assure control room habitability. The design 

basis for the dampers is that the dampers require should be closed except when purging smoke or toxic gas from the 

control room. An investigation revealed that the dampers had been open by procedure since 3/84. During the development 

of the CRVS Functional System Description (FSD), which defines the system functional design requirements, the 

discrepancy with the dampers not being in the designer assumed closed position was identified. In 4/95, an evaluation was 

performed to resolve the damper position discrepancy. Due to a misinterpretation of the results of this evaluation, the 

dampers were left open. On 8/11/97, during the FSAR verification process, the open damper position was once again 

questioned and the dampers were closed as a precautionary measure at 1700 on 8/13/97. The cause of the dampers being 

left in the open position has been determined to be cognitive personnel error, in that, the design basis was not adequately 

described in the FSAR and the results of the 1995 evaluation were misinterpreted. The operating procedure has been 

revised and administrative controls established to ensure the dampers are operated within the design basis. The CRVS 

FSD observations will be reviewed for adequate resolution. An FSAR change will be initiated to clarify the design basis of 

the system. Lessons learned from this event will be discussed with the personnel who misinterpreted the 1995 evaluation.

A-141
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-142

LER NUMBER SAFETY [ EVENT ABSTRACT 

CATEGORY 

352-97-003 5a POWER LEVEL - 100%. During the February 1997 refueling outage for Unit 2, a total of eight (8) Unit 2 pairs, one (1) Unit 1 

(MULTI-UNIT pair, and several single Back Pressure Dampers (BPDs) failed to actuate following a test signal. The BPDs are required to 

APPLICABILITY) mitigate the consequences of a postulated pipe rupture. On 02/06/97 it was determined that this condition may have 

(Limerick 1) resulted in a failure to meet the design basis for a high energy line break (HELB) event. All Unit 2, common Control 

Enclosure (CE) and all accessible Unit 1 BPDs were tested and additional failures were immediately corrected. All of this 

testing was completed prior to the restart of Unit 2. The six (6) inaccessible Unit 1 BPDs were tested during a power 

reduction on 04/12/97. Four (4) of the six (6) Unit 1 inaccessible dampers and one (1) Unit 2 damper in a subsequent test 

sample failed to actuate. These five (5) failures were immediately corrected. Excessive friction in the bushing located 

between the solenoid and the BPD linkage caused all of the damper failures. Periodic cycling of the BPDs was not included 

in the original preventive maintenance (PM) program. An engineering analysis concluded that the additional components 

potentially impacted by the HELB event would still be capable of performing their safety function, but were not fully qualified. 

The appropriate PM activities for each BPD have been developed. 

354-97-001 6c POWER LEVEL - 100%. On January 3, 1997 at 1958 hours, during a design review of the interface between the 

(Hope Creek) Emergency Diesel Generator (EDG) Room Fire Suppression System logic and the EDG Room Ventilation System logic, a 

common mode failure potential was discovered. As a result, all four EDGs were declared inoperable and Technical 

Specification Limiting Condition of Operation 3.0.3 was entered. A one hour report was made to the NRC in accordance 

with the requirements of 10CFR50.72(b)(1)(ii)(B) to report the condition as any event or condition during operation that 

results in the condition of the nuclear power plant being in a condition that is outside the design basis of the plant. A 

temporary modification to limit the interface between the systems was immediately implemented. Compensatory actions 

were taken in accordance with the Fire Protection Program. No reactor power reduction was necessary. The cause of this 

event is attributed to inadequate analysis to support the approved exception to the Standard Review Plan as described in 

Section 9.5.1.6.30 of the Hope Creek Updated Final Safety Analysis Report. Human performance issues contributed to the 

delayed identification of this problem. A design change to implement a permanent correction to the design deficiency is 

under review.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-143

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

354-97-020 5a During a review of the Safety Auxiliaries Cooling System (SACS) design basis, PSE&G identified a potential design 

deficiency associated with the safety related Control Area Chilled Water System chiller units that could have prevented the 

fulfillment of a safety function. In the event of an accident resulting in a loss of instrument air, concurrent with low Ultimate 

Heat Sink temperature, all of the safety related chillers could trip. The chillers are operable when the Ultimate Heat Sink 

temperature is at least 55 degrees F. PSE&G is evaluating actions to correct the condition as part of its corrective action 

program. The cause of this event was human error in the original design and in subsequent design reviews. Corrective 

actions include an operability determination, revising the engineering evaluation, and evaluating and implementing a design 

change. On 8/28/97, at 1311, a four hour notification was made in accordance with 1 OCFR50.72(b)(2)(iii). This event is 

being reported pursuant to 10CFR50.73(a)(2)(v) as a condition that alone could have prevented the fulfillment of a safety 

function of systems needed to mitigate the consequences of an accident. 

354-97-025 6b On 10/4/97, Engineering personnel confirmed that a potential unmonitored release path has existed since plant startup. 

This path was identified while performing an engineering evaluation concerning relay performance in a Station Service 

Water System vacuum breaker time delay circuit. While reviewing the effects on other systems and boundaries, 

Engineering discovered the potential unmonitored release path. The postulated condition involves the failure of one of the 

vacuum breakers to close after a Loss of Power/Loss of Coolant Accident event creating a loss of secondary containment 

and an unmonitored release path to the outside environment. This release path would allow contaminated air to enter the 

service water piping through the open vacuum breaker and to subsequently be released to the outside environment via the 

discharge piping. The failure to identify this release path is a non-compliance with General Design Criteria. This event is 

being reported pursuant to 10CFR50.73(a)(2)(ii)(B) as a condition that was outside the design basis of the plant. The cause 

of the failure to recognize and correct this condition was human error in the original design and in subsequent design 

reviews. Corrective actions are interim compensatory measures and a design change to minimize the potential for an 

unmonitored release.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORYF 

368-97-003 7-None Design Engineering personnel discovered a deficiency in the ANO-2 Technical Specifications (TS) that provided a potential 

(Arkansas 1) for premature actuation of the Recirculation Actuation Signal (RAS) during a Loss Of Coolant Accident (LOCA). The TS 

allow indefinite operation with one channel of Refueling Water Tank (RWT) level in a tripped condition. If a LOCA were to 

occur in this condition, the failure of another RWT level channel low could cause premature RAS actuation before sufficient 

water was available in the containment sump to provide the Emergency Core Cooling System (ECCS) design functions. 

Only two instances (1981 and 1985) of ANO-2 actually having operated with an RWT level channel tripped have been 

identified, and those were of short duration. The potential for a single failure preventing ECCS functions from a normal, 

allowable operating configuration placed the plant outside its design basis. As part of the corrective actions, a similar 

condition was discovered involving the potential for not automatically isolating a faulted Steam Generator during certain 

steam line break scenarios if a channel of Steam Generator differential pressure (Emergency Feedwater Actuation Signal) 

was tripped. The root cause has been identified as a deficiency in the original Technical Specifications. Administrative 

controls have been established to prevent placing a channel in a tripped state. A TS amendment request has been 

submitted. 

373-97-002 5b The Main Control Room (MCR) ventilation (VC) and Auxiliary Electric Equipment Room (AEER) ventilation (VE) systems 

(MULTI-UNIT are engineered safety features designed to maintain habitable environments in their respective areas during normal and 

APPLICABILITY) abnormal conditions. During certain heavy snow fall conditions, snow can enter the inlet filter for the air cooled condensing 

(LaSalle 1) coil. Snow accumulation on the intake filter of the operating refrigeration unit, on occasion, results in a high differential 

pressure. Operator action has been taken to open an access panel door on the condensing unit to allow warmer building air 

into the condensing unit. This has had the effect of reducing incoming snow quantities and drying of the intake filters. 

Operation in this manner is outside the system design basis. The effects of the negative pressure caused by opening the 

doors have been analyzed and determined to be within the UFSAR limits. An analysis concluded that operation of the 

condenser fan in a degraded condition from snow build-up will not prevent the condensing unit from performing its design 

function. The cause of this event was inadequate initial ventilation system design, incomplete evaluation of operating 

requirements, and failure to recognize and correct these inadequacies in a timely manner. This resulted in operation of the 

system in a manner not described in the design basis. 

373-97-003 NRS On February 13, 1997, LaSalle reported to the NRC that several safety-related 4.16 KV breakers were found to be racked in 

(MULTI-UNIT seismically unqualified positions. Therefore, the plant configuration was considered to be outside the design basis. The 

APPLICABILITY) cause for this condition was an inadequate operations procedure for racking out 4.16 KV breakers and an incomplete 

seismic analysis. Immediate corrective action was to perform a walkdown of safety-related switchgear. Breakers found 

racked in a seismically unqualified position were returned to a qualified position. Corrective actions completed and planned 

include operator training, procedure revision, and an engineering evaluation to review the process, including 

I _ implementation, for qualifying electrical switchgear and incorporating seismic limitation into operations procedures.

A-144
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-145

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

373-97-005 2b At 1415 hours on February 20, 1997, during a review of the draft for Improved Technical Specifications, a question arose 

(MULTI-UNIT regarding the potential for damaging the Standby Gas Treatment System in the event of a loss of coolant accident (LOCA) 

APPLICABILITY) during routine containment purging or hydrogen recombiner testing. Subsequent review identified two other issues: 1) 

operating procedures allowed both the drywell and suppression chamber to be purged or vented simultaneously creating a 

bypass around the drywell floor, and 2) the containment purge system ductwork in the auxiliary building will fail in the event 

of a LOCA during purging. The consequences of these events would have been a potential increase of offsite and onsite 

doses. A design review of the containment purge and vent system has been performed. Design and procedure changes will 

be performed as required, to ensure proper operation of the system. The root causes of this event are unknown; however, 

the apparent causes of the event were weaknesses in the design, design review, and procedure review processes, in the 

early 1980's, when containment inerting was added to the design. These weaknesses apparently resulted in the design 

review missing the effect of design changes on the interfacing systems and the procedure reviews missing the improper 

valve alignments. 

373-97-009 6b POWER LEVEL - 000%. LaSalle County Station entered an Unusual Event at 19:45 on 3/11/97 when it was determined 

(MULTI-UNIT that the 701.8 foot elevation of the lake level at that time was above the 701 foot maximum level described in the UFSAR 

APPLICABILITY) and used in plant flooding potential analyses. The high lake level resulted principally from a lack of knowledge and 

consideration of the design basis for the maximum lake level. This led to operating and surveillance procedures which 

provided upper limits for lake level higher than the UFSAR specified value of 701 ft. Contributing factors were high rates of 

precipitation, poor materiel condition of the lake make-up and blowdown lines and the unavailability of the lake blowdown 

valve, operable for the higher than analyzed lake level. However as prudent measures, plant personnel monitored lower 

elevations of the plant, and the flood wall on the north side of the condenser pit was effectively raised by placement of sand 

bags to an elevation of 701 ft. 10 in. Operating procedures were revised and additional revisions are in progress. The lake 

blowdown valve was returned to full service on 3/13/97 to begin reducing lake level to its normal range. The Unusual Event 

was terminated at 17:00 on 3/26/97 with the lake level at 700.68 ft. The lake level was within normal operating range on 

4/3/97.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-146

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY [ 

373-97-010 NRS On March 18, 1997, all Unit 1 Division 2 equipment was declared inoperable because the safety related cables in the Unit 1 

Division 2 Cable Spreading Room (CSR) could be damaged by the sprinkler system piping during a Safe Shutdown 

Earthquake (SSE) event. Hangers were identified missing during an engineering walkdown of the CSR. The missing 

hangers were replaced to restore the sprinkler system to the "as designed" condition. A seismic "two over one" evaluation 

has demonstrated that the "as designed" condition of the sprinkler system will not prevent the function of any plant feature 

required for safe shutdown during a SSE. The Unit 1 Division 2 equipment was declared operable on March 29, 1997. The 

root cause of the event was incomplete installation and inspection during construction of the plant. Seismic "two over one" 

evaluations for the other safety related areas protected by sprinkler systems have determined that no other equipment 

required for safe shutdown during a SSE would have been impacted by sprinkler system piping. Therefore, if the SSE would 

have occurred at power operation, all other safety related divisions (Unit 1 Division 1 & 3 and Unit 2 Division 1, 2 & 3) would 

have been free from damage. Some potential interactions of sprinkler nozzles and sewage piping with safety related cables 

were identified. These potential interactions are being evaluated and will be reported in a supplemental LER if required. 

373-97-015 5c The System Functional Performance Review identified a concern regarding the manual override logic associated with the 

(MULTI-UNIT Residual Heat Removal (RHR) Test Return Valve (F024). Specifically, the concern is that if the operator was throttling the 

APPLICABILITY) valve open (i.e., holding the control switch in the open position) and a simultaneous Emergency Core Cooling System 

(ECCS) actuation occurred, the manual override logic would be activated and the valve would not automatically close. With 

the valve in the open position, Low Pressure Coolant Injection (LPCI) flow is diverted to the suppression pool. The apparent 

cause of this event is that the potential for actuating the manual override if an ECCS initiation occurred while throttling the 

valve in the open direction was not recognized during the design of the system and was therefore, not analyzed. Based on 

the probability of the condition occurring and the ability to manually close the valve, the safety significance associated with 

this event is considered minimal. LaSalle Station will a) conduct training to alert operators of this condition, b) review other 

valves for a similar condition and c) generate an analysis to address this condition. There were no previous occurrences. 

This is a voluntary report which may be of generic interest, it is considered voluntary since it is an unanalyzed condition 

which has been determined to be of minimal safety significance.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-147

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

373-97-018 6c On April 21, 1997, the fire protection carbon dioxide (C02) suppression systems protecting the 0 and 1A Emergency Diesel 

(MULTI-UNIT Generator (EDG) Rooms were declared inoperable because the electrical leads to a fire damper could have interfered with 

APPLICABILITY) the proper closing of the curtain type dampers. The condition was identified by the Fire Protection Group during a periodic 

visual inspection of fire dampers. Fire watches were immediately implemented. The electrical leads were modified to ensure 

they would not interfere with the dampers. After the modifications were completed, the C02 system protecting the 1 A EDG 

Room was declared operable on May 2, 1997, and the C02 system protecting the 0 EDG Room was declared operable on 

May 3, 1997. The root cause of the event was improper installation during original construction of the plant. All other fire 

dampers having electrical leads that isolate boundaries to areas protected by C02 were inspected and no similar conditions 

were identified. The safety significance of this event was low. Subsequent analysis determined that the design basis 

concentration of C02 would have been achieved even if the dampers failed to close. The design basis fire previously 

analyzed in the UFSAR assumes loss of the EDG, and the affected fire dampers are not located in barriers that separate 

redundant equipment required for safe shutdown. Therefore, had a design basis fire occurred, and the C02 system was not 

effective, at least one train of equipment necessary to achieve and maintain safe shutdown would have been available. 

373-97-021-01 5b Contrary to the description in the FSAR, there are undrainable areas of the drywell floor which would result in a delay in the 

(MULTI-UNIT detection of unidentified leakage. In addition, the recurring failure of electronic level indication results in the Leak Detection 

APPLICABILITY) System not meeting its design basis requirements. The unreliability of the sump level instrumentation is caused by the 

improper application of a capacitance probe in water of low conductivity. The safety consequence of these issues is to 

reduce the plant's capability for timely leak detection in the reactor coolant pressure boundary, thereby reducing the time to 

place the plant in a safe condition prior to further degradation of the pressure boundary. The immediate corrective action 

was to declare the Leak Detection System inoperable. Planned corrective actions include; a) Resolution of the discrepancy 

between the as-built configuration and the response to FSAR Question 212.17, b) Improving the reliability of the sump level 

monitoring instrumentation, and c) Confirmation that there are no other hold up volumes in the containment which would 

result in unacceptable delays in the detection of unidentified leakage. This condition is reportable per 10 CFR 50.73 (a) (2) 

(ii) due to a condition that was outside the design basis of the plant.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

373-97-031 6b On August 22, 1997, the LaSalle Engineering Department determined that calculations that form the analytical basis for the 

(MULTI-UNIT Technical Specifications (TS) leak detection area temperature and differential temperature isolation setpoints used a steam 

APPLICABILITY) flash fraction that was not limiting in all cases. This event is reportable per 10 CFR 50.73(a)(2)(i)(B) as a condition 

prohibited by TS and 50.73(a)(2)(ii) as a condition outside the design basis. The investigation is complete. The causes were 

inadequate technical review of calculations, inadequate program monitoring and management deficiency following 

identification of inconsistency with the FSAR/UFSAR commitment, and miscommunication between the preparer of a 

calculation and the writer of an Operability Evaluation. Had design basis leakage occurred in the Residual Heat Removal 

shutdown cooling mode, Reactor Core Isolation Cooling piping, or portions of the Reactor Water Cleanup Heat Exchanger 

Room piping, the automatic isolation as described in the TS may not have occurred. Principal corrective actions are to 

revise the analytical limit calculations, the Technical Specifications, and the UFSAR. 

373-97-033 6b On September 3, 1997, during engineering reviews for the Reactor Water Cleanup (RWCU) pump and pipe replacement 

(MULTI-UNIT design change, High Energy Line Break (HELB) calculations were reviewed to determine the potential impact of increasing 

APPLICABILITY) the RWCU pump suction line size. The data indicated that the HELB calculations for the existing RWCU design may not be 

conservative in determining the bounding temperature in the Reactor Building following a HELB. On September 11, 1997, a 

preliminary assessment determined that the HELB peak temperature may exceed the bounding temperature as specified in 

the UFSAR. An ENS notification was made on September 11, 1997. This event is reportable per 10 CFR 50.73(a)(2)(ii)(B), 

as a condition that is outside the design basis of the plant. The apparent causes appear to be insufficient detail in the 

identified purpose of the calculation resulting in incorrect usage within the architect engineering firm's organization, and a 

failure to identify and subsequently track an unverified assumption in the calculation. Corrective actions include revising the 

HELB calculations, and installing modifications to maintain current equipment qualifications. Had a HELB occurred, the 

Plant could have been outside the design basis. A recent LER (373-97-031) reported a similar problem involving leak 

detection calculation errors. 

373-97-039 NRS During three outages, Main Steam Safety Relief Valves (SRVs) have been removed with fuel in the Reactor Pressure 

(MULTI-UNIT Vessel placing the plant in an unanalyzed condition. The unanalyzed condition resulted from the free end of the SRV 

APPLICABILITY) discharge pipes (tailpipes) not being analyzed for seismic loads. If a Safe Shutdown earthquake had occurred, there was no 

analysis to show that equipment required to be operable by Technical Specifications would not have been adversely 

impacted. The root cause was an inadequate review process for the original SRV removal procedure preparation that did 

not require Engineering personnel's review; therefore, the prerequisite for performing the evolution defueled was not 

incorporated. The immediate corrective action was to analyze the tailpipes restraints with safe shutdown earthquake loads 

included. The results show that one of the Unit 1 and two of the Unit 2 tailpipes were not adequately restrained; however, 

there was no impact on safety related equipment. A similar recent occurrence was LER 97-027. This event is reportable per 

10 CFR 50.73(a)(2)(ii)(A) as being in an unanalyzed condition that could have compromised plant safety.

A-148
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

373-97-040 NRS Since plant startup when alternate shutdown cooling flow paths were used per procedure LOP-RH-17, "Alternate Shutdown 

(MULTI-UNIT Cooling", the plant has been in an unanalyzed condition. On October 24, 1997, no piping analysis could be found that 

APPLICABILITY) evaluated the affected piping during its use as an alternate shutdown cooling method. The unanalyzed condition resulted 

from Reactor Core Isolation Cooling [BN PRA] (RCIC) and Main Steam [SB] (MS) lines, used for alternate shutdown cooling 

(abnormal operation), not being analyzed filled with water and addressing seismic Category Il/I concerns. These lines are filled with steam during normal operation. The root cause investigation is continuing and appropriate corrective actions and 

safety analysis will be reported in a LER supplement. A similar recent occurrence was LER 97-039 which involved an unanalyzed condition for Safety Relief Valve (SRV) discharge lines with SRVs temporarily removed during SRV bench 

testing. This event is reportable per 10 CFR 50.73(a)(2)(ii)(A) as being an unanalyzed condition that could have 

compromised plant safety. 

373-97-046 6a On December 16, 1997, the preliminary results of an engineering analysis to evaluate the latch release setpoint determined 

(MULTI-UNIT that in the event of a Main Steam High Energy Line Break, the Turbine Building Ventilation isolation dampers, APPLICABILITY) 1(2)VTO79YA, B & C, would not close fast enough to prevent the pressure from exceeding the pressure retaining capability 

of the walls, floors, and ceilings that separates the VT exhaust tunnel from the safety related High Pressure Core Spray 

(HPCS) electrical switchgear room. The apparent causes include an invalid calculation assumption. The potential exists that a high energy line break could result in a rupture of the wall separating the vent riser from the 687' - 0" switchgear room, 

Division 3 HPCS electrical switchgear and the wall at elevation 815' 0" at the upper VT tunnel. This could result in the 

Division 3 electrical power to that unit being inoperable and unavailable to supply power to mitigate the consequences of a Design Basis Event. This event is reportable per 10 CFR 50.73(a)(2)(ii)(B), as a condition that is outside the design basis of 

the plant. 

382-97-015 6b POWER LEVEL - 000%. Personnel determined the Essential Chillers may not have been able to perform their safety (Waterford) function in the event of a LOCA. As a result of design basis upgrade work, personnel determined additional conservative 

assumptions should be used in the design basis of the UHS. New analysis established that if the additional conservative 

assumptions are factored in the analysis of record, the heat input to the UHS is increased by about 21 E06 Btu/hr in the 

event of a LOCA. This additional heat to the UHS impacts the Component Cooling Water (CCW) temperature to essential 

equipment, the consumption of water in the Wet Cooling Tower (WCT) basins, and the Essential Chiller cooling capacity. The impact of the additional heat load on the Essential Chiller cooling capacity was determined to be potentially safety 

significant since there were a number of occurrences during Cycle 6 operation when both the Train A and B Essential 

Chillers could have tripped due to low flow had a LOCA occurred. This condition did not compromise the health and safety 

of the public.

A-149
1997 Licensee Event Reports with Design-Basis Issues (Continued)

382-97-016

A-150

TY EVENT ABSTRACT 

DRYI 

On May 15, 1997, with Waterford 3 in Mode 6 and at 0% power, a Technical Specifications (TS) deficiency was discovered 

which could contribute to an inadvertent Recirculation Actuation Signal (RAS). If this were to occur under certain accident 

conditions, Emergency Core Cooling System (ECCS) and Containment Spray (CS) system pumps suction could shift to the 

containment sump prematurely. On September 16, 1997, a review of other Engineered Safety Features Actuation System 

(ESFAS) instrumentation circuits revealed that under certain emergency conditions, automatic isolation of a faulted steam 

generator from Emergency Feedwater would not occur as assumed in the Waterford 3 safety analysis. The root cause has 

been determined to be a deficiency in the TS in that they allow continued operation with an inoperable channel of ESFAS 

instrumentation in the tripped condition. A Technical Specification Change Request (TSCR) has been submitted to limit the 

time that one channel of RAS instrumentation can be in the tripped condition. The TSCR will be revised and resubmitted for 

the Emergency Feedwater Actuation Signal condition. Precautions have been instituted to limit continued operation in this 

condition until the TS are changed. These conditions did not compromise the health and safety of the public. 

On May 20, 1997, Waterford 3 discovered the possibility that both trains of Control Room Emergency Filtration Units 

(CREFU) would be rendered inoperable if either Emergency Filter Modulating Damper, HVC-213A(B), failed open. Both 

CREFUs were declared inoperable and Technical Specification 3.7.6.2b was entered. Operations and Systems Engineering 

performed Control Room pressure testing in accordance with OP-903-123, "Control Room Envelope Pressure Test," 

utilizing both trains of CREFUs and various Control Room Heating and Ventilation System (HVC) lineups. Results indicated 

that a single failure of HVC-213A(B) would prohibit either CREFU from pressurizing the Control Room envelope to 1/8 inch 

of water gauge with less than or equal to 200 cubic feet per minute of flow. As a corrective action, dampers were closed 

isolating the outside air intake paths for CREFU Train A. This effectively stopped the common suction path for both units 

allowing CREFU Train B to remain operable. CREFU Train A will remain available for recirculation only. This event did not 

compromise the health and safety of the public. 

On December 18, 1997, Waterford 3 estimated that application of maximum High Pressure Safety Injection (HPSI) flow 

measurement uncertainty to a previously approved Emergency Core Cooling System (ECCS) model would exceed 10 CFR 

50.46 acceptance criteria. Specifically, it is estimated that application of the uncertainty to model inputs using recently 

measured HPSI flow rates would cause the calculated peak fuel cladding temperature to increase by more than 50 degrees 

F and exceed 2200 degrees F. The apparent cause of this event is inadequate procedures and instructions. The calculation 

used to support HPSI minimum flow rate requirements utilized a 5 g.p.m./leg flow measurement uncertainty versus a 

revised maximum flow measurement uncertainty of approximately 18 g.p.m./leg. A small break loss of cooling accident 

ECCS analysis will be performed using a new ABB/CE ECCS evaluation model. That model was NRC approved for use at 

Waterford 3 on December 18, 1997. The new ECCS model provides sufficient margin to accommodate the uncertainty 

deviation. Therefore, this condition did not compromise the health and safety of the public.

382-97-017

382-97-033
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-151

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

387-97-014 5b On June 23, 1997 at 0900, with Unit 1 and Unit 2 both in Condition 1 (Power Operation) at 100% power, engineering 

(MULTI-UNIT personnel determined that on several occasions the average temperature of the Ultimate Heat Sink (UHS) exceeded the 

APPLICABILITY) maximum initial temperature allowed (as supported by calculations). During an engineering review, a calculational 

(Susquehanna 1) methodology error was identified in the decay heat input to the UHS calculation. Correct inputs were entered into the 

calculation for UHS initial temperature, which resulted in a lower UHS maximum allowed initial temperature. The original 

(flawed) calculation indicated a maximum allowed initial temperature of 88 degrees F, as does the Technical Specifications, 

while the new calculation could support only an 82 degrees F initial temperature with the operating procedures as they 

existed. There were 10 occasions in the past where 82 degrees F was exceeded. Analysis indicates that, although the initial 

temperature was exceeded, the safety significance of these events were very minor. PP&L immediately took steps to 

administratively control UHS average temperature to ensure it did not exceed that value supported by calculation. PP&L 

has also made procedural changes, supported by calculation, to allow an increase in the maximum UHS initial average 

temperature from 82 degrees F to 85 degrees F. At no time was the health and safety of the public compromised as a result 

of this event. Also, at no time were the current Technical Specification limits exceeded. This is being reported to the 

Commission pursuant to 10CFR5073(a)(2)(ii) as a condition where the plant operated outside of its design basis, although, 

as stated previously, the conditions discussed here were of minor significance from a safety perspective. Corrective actions 

include: a review of other calculations that may have used the calculation methodology error, performance of a calculation 

to bound UHS temperature with design basis conditions, initiating Final Safety Analysis Report changes, requesting a 

Technical Specifications change, counseling appropriate engineering personnel on use of the decay heat standard, and 

reviewing the event for inclusion in Engineering Continuing Training.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY ] 

387-97-019 6b On August 13, 1997 at 1200 hours, with Unit 1 and Unit 2 in Condition 1 (Power Operations) at 100% Power, engineering 

(MULTI-UNIT personnel determined that prior to March 1, 1997, the Control Structure Chilled Water System was operating outside of its 

APPLICABILITY) design basis, constituting a reportable condition per 1OCFR50.73(a)(2)(ii). The Final Safety Analysis Report (FSAR) states 

in part that the standby Control Structure Chiller will auto-start on a failure signal to the operating chiller. Contrary to this, 

there was a condition that existed for the 'A' chiller that inhibited its auto-start while in standby. No similar condition existed 

for the 'B' Control Structure Chiller. The condition, once identified, was promptly corrected via the temporary modification 

process, and tested to operate as described in the FSAR. The logic changes have subsequently been made permanent. At 

the time of discovery of the logic error on March 1, 1997, the condition was entered into the Susquehanna SES corrective 

action program. It was incorrectly identified as not reportable at that time. Subsequent review has determined this to be 

reportable. The Control Structure Chiller is required to maintain Control Structure habitability and the Unit 1 emergency 

switchgear cooling post-accident. Although the standby chiller would not have auto- started on a trip of the operating chiller 

(for one specific failure signal), it would have started on high return air temperature approximately one to two hours 

following loss of cooling. Evaluations have been performed that indicate cooling to the emergency switchgear could be lost 

for up to ninety-six hours post-accident with no loss of safety function. Similarly, no significant degradation of Control 

Structure habitability would occur. Based on this, the safety significance of this event is minor. Corrective actions completed 

were the permanent modification of the Control Structure Chiller logic to allow auto-start of the standby compressor on all 

operating chiller failure trips and reportability determination training for the involved personnel. 

387-97-024 3b On October 22, 1997, with Unit 1 and Unit 2 both in Condition 1 (Power Operation) at 100% power, engineering personnel 

(MULTI-UNIT determined, based on information provided in a 1OCFR Part 21 Notification from General Electric Company, that during a 

APPLICABILITY) postulated single failure of an electrical raceway, both inboard containment isolation valves on the Drywell and Suppression 

Chamber Purge System could open, thus causing the Drywell and Suppression Chamber atmospheres to communicate 

during a postulated Loss of Coolant Accident (LOCA). This single failure condition could result in bypass leakage of the 

postulated LOCA environment around the suppression pool, thus losing the benefit of both quenching the blowdown energy 

and the scrubbing of any fission products. This event was determined to be reportable in accordance with 

1OCFR50.73(a)(2)(ii). Technical Specification 3.0.3 was conservatively entered on both units until at least one inboard 

containment isolation valve, in the affected penetrations, was deactivated in the closed position. The entry into Technical 

Specification 3.0.3 is reportable in accordance with 10CFR50.73(a)(2)(I)(B), per the guidance of NUREG-1022, Supplement 

No. 1, Item 2.4. The most likely cause was human error on the part of the original designers for failing to recognize the 

potential for creating a suppression pool bypass path through the nitrogen supply line. The corrective actions include: 1) 

Deactivation of both inboard containment isolation valves in the closed position on both units; 2) other containment 

penetrations with the potential to be suppression pool bypass paths will be reviewed to determine if they are susceptible to 

the same single failure; and 3) participate in the BWR Owners Group on-going effort to evaluate the credibility of the 

postulated single failure. There were no safety consequences or compromises to public health and safety as a result of this 

event since there were no events which challenged prima containment integrity.

A-152
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

389-97-002 6b On December 2, 1998, St. Lucie Unit 2 was in mode 6 at 0% reactor power. The Facility Review Group reviewed and 

(St. Lucie 2) approved the determination that various sump screen anomalies found during the Unit 2 cycle 11 refueling outage were 

reportable as a condition that was outside the design basis of the sump. As part of the long term corrective actions 

associated with the St. Lucie cycle 10 refueling outage identified ECCS sump deficiencies, surveillance procedure MSP

68.01, "Containment Sump Inspection," and QC Technique Sheet 10.54 were developed to provide detailed inspection 

scope and acceptance criteria for the ECCS sump screen enclosure inspections. The cycle 11 refueling outage inspection 

activities identified anomalies not found during the cycle 10 refueling outage sump repair activities. The cause of 

deficiencies found during the cycle 11 refueling outage was inadequate corrective actions for the sump screen anomalies 

found during the cycle 10 refueling outage. All identified sump screen deficiencies were dispositioned and/or repaired. On 

May 18, 1997, St. Lucie Unit 2 was in Mode 5 following refueling. Inspection of the containment sump determined that 

several openings existed in the sump debris screens which were in excess of design requirements. The openings would 

allow small debris to enter the containment sump which could potentially enter the recirculation flow stream during the 

recirculation phase following a loss of coolant accident. The screen enclosure was subsequently modified to be consistent 

with design requirements. The modifications were completed prior to the Unit 2 startup and the containment sump was 

returned to operable status on May 22, 1997. Gaps existed in the containment sump screen due to failure to properly 

implement and verify design requirements during initial construction. Lack of procedural guidance for performing periodic 

sump inspections contributed to the delay in identifying the sump screen condition and previous inspection of the 

containment sump configuration was insufficient in scope to ensure identification of the existing deficiencies. Corrective 

actions include: 1) A safety evaluation was performed to document the containment sump design requirements and 

changes were made to clarify the Updated Final Safety Evaluation Report. 2). The containment sump screen was modified 

to meet the requirements of design documentation. 3) Procedural guidance will be developed to enhance periodic 

inspection of the containment sump. 4) The St. Lucie Unit 1 containment sump screen will be inspected during the next 

Mode 5 outage of sufficient duration. 5) The event will be incorporated into the continuing training program at St. Lucie. 

389-97-004 NRF On June 11, 1997, St. Lucie Unit 2 was in Mode 1 at 100 percent power. Inspection results indicated that generically, two 

sided cable tray fire stop assemblies lacked the installation of ceramic fiber between cables within the fire barrier. FPL 

determined that the as-built configuration of two sided cable tray fire stop assemblies did not meet the tested configuration 

for a three hour fire rated assembly. All the St. Lucie Unit 2 two sided cable tray fire stop assemblies were declared 

inoperable. The apparent cause of this event was due to personnel error during the implementation of design drawings or 

insufficient design guidance during initial installation. Corrective actions include the posting of hourly fire watch patrols that 

were established to compensate for the inoperable fire stop assemblies. Repairs or plant modifications will be implemented 

to restore the affected fire stop assemblies to their required three hour fire rating.

A-153
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER ( SAFETY EVENT ABSTRACT 

ICATEGORY 

390-97-011 7 The purpose of this LER is to report findings in accordance with 10 CFR 50.73 associated with Generic Letter (GL) 96-01, 

(Watts Bar) "Testing of Safety Related Logic Circuits" reviews. GL 96-01 requires each licensee to compare electrical schematic 

drawings and logic diagrams for the Reactor Protection System, Emergency Diesel Generator load shedding and 

sequencing, and actuation logic for the Engineered Safety Feature Actuation System (ESFAS) against plant surveillance 

test procedures to ensure that all portions of the logic circuitry including the parallel logic, interlocks, bypasses and inhibit 

circuits are adequately covered in the surveillance procedures to fulfill the Watts Bar Technical Specification requirements. 

The first surveillance deficiencies identified involved unverified parallel circuit paths and were discovered on April 28, 1997. 

Some additional findings have been discovered since April 28 and have been included in the report. The cause of the 

surveillance instruction deficiencies have been attributed to inadequate technical reviews. Corrective actions consist of 

completing the reviews, addressing verification of any unverified logic circuits, informing technical reviewers of the 

requirements of GL 96-01, and correcting any hardware deficiencies found. 

390-97-014-00 NRF The purpose of this LER is to report two conditions in accordance with 10 CFR 50.73 (a)(2)(ii) which were determined not to 

meet 10 CFR 50, Appendix R requirements. The first condition involves a missing reactor coolant pump (RCP) number 2 oil 

cooler cover which is part of the RCP oil collection system which helps contain RCP motor oil should a leak occur. This 

RCP oil collection system is required by Section 111.0 of Appendix R. Neither the cause of the missing cover nor when it was 

removed could be determined. Corrective actions include the replacement of the cover and a procedure revision to confirm 

cover installation prior to containment closure following an outage. Without this cover, the RCP oil collection system would 

have been effective for some postulated leak locations. The second condition being reported involves two cables for the 

main control room air handling units found to have been routed such that one single fire could disable both air handling 

units thus preventing them from performing their fire safe shutdown function. The root cause was determined to be technical 

inaccuracies in the design input (Appendix R analysis) resulting from personnel error. Corrective actions include the 

installation of a manual control station at the 480V Control & Auxiliary Vent Boards for isolation purposes during an 

Appendix R fire and a revision to plant procedure AOI-30.2 to implement change of manual actions due to the addition of a 

manual control station.

A-154
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

395-97-004 5b On October 12 and 15, 1997, plant personnel found two (2) snubbers which were in the locked position. These components 

(V.C. Summer) are mechanical shock arrestors attached to the Reactor Coolant pressurizer spray line and Nuclear Blowdown piping 

respectively. The inoperable snubbers were found and replaced during refueling outage (RF) surveillance testing, 

performed in accordance with Technical Specification (TS) 3/4.7.7, Snubbers. Preliminary engineering analysis of potential 

impacts to the associated piping concluded that the stress on the piping had exceeded ASME Code allowable limits and 

was therefore, outside the design basis. System walkdowns did not find any transient induced damage and ultrasonic 

inspection of welds on the pressurizer spray line failed to find any indications of stress/service induced flaws. Due to the 

incompatibility of the Nuclear Blowdown line with standard NDE techniques the line was replaced to return the pipe to its 

design basis condition. Westinghouse completed an ASME code fatigue qualification on the pressurizer spray line on March 

17, 1998 with the conclusion that the calculated usage factors for 40 years remains less than 1 and no restrictions to plant 

transients are required. Both of these systems are considered to be operable at this time. Exceeding the design basis for 

these piping systems is reportable per the requirements of 10 CFR 50.73(a)(2)(ii)(B). On October 18, engineering review of 

three (3) snubber failures on a feedwater line determined that a transient on December 5, 1994 had caused the snubber 

damage. System walkdowns during this outage (RF 10) and at the time of the transient failed to find any apparent damage; 

however, due to personnel oversight, freedom of motion tests of suspect snubbers were not verified during RF 9 (spring of 

1996) per the requirements of TS Surveillance 4.7.7.c. This TS noncompliance is being reported per the requirements of 10 

CFR 50.73(a)(2)(i)(B). Station Administrative Procedure 1122 will be revised by April 1, 1998 to ensure that engineering 

initiates component evaluations required by TS 4.7.7. 

400-96-013 NRS On August 1, 1996 with the plant operating in Mode-1 at 100% power, Operations personnel identified a condition outside 

(Sheron Harris) the plant design basis where the Refueling Water Storage Tank (RWST) had been connected to a non-seismically qualified 

system. Specifically, non-seismic portions of the fuel pool purification system have been aligned to the RWST for cleanup 

and non-seismic portions of the hydrostatic test pump have been aligned to the RWST to fill the Safety Injection 

accumulators. If a seismic event were to occur, the non-seismic portions of these systems could fail and drain the RWST. 

This condition was caused by a failure to reconcile operating procedure lineups with the plant design basis during original 

procedure development. Subsequent technical and safety reviews also outside the plant design basis. Immediate corrective 

actions included establishing administrative controls to maintain the seismic boundary isolation valves closed. Additional 

corrective actions included a review of other seismic/non-seismic interface boundary valves for similar problems and an 

evaluation of long term design and/or operational options. During further investigations of safety to non-safety related 

(including seismic/non-seismic) interface boundaries, additional examples were identified that could result in operation of 

plant systems outside the design basis. These conditions were identified during the continued investigation as committed in 

the original LER. Specific details were provided in revision 1 of this LER. This revision provides the results of additional 

analysis that was performed to determine the safety consequences associated with the loss of the Component Cooling 

Water system.

A-155
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGOR7Y 

400-97-002 5b On February 7, 1997, with the plant operating in Mode 1 at 100% power, investigation determined that cold weather 

conditions resulted in the Main Feedwater Isolation Valves (MFIVs) being potentially inoperable during a period from 

January 17, 1997 through January 20, 1997. The MFIVs serve as containment isolation valves and are required to stroke 

closed in 10 seconds or less to provide feedwater isolation in the event of a main steam line break or spurious opening of a 

feedwater regulating valve. Based on purchase specification documents and discussions with the MFIV vendor, a minimum 

operating temperature of 60 degrees exists to ensure that the MFIVs will stroke in the required 10 seconds. The MFIV 

actuators are hydraulic to open and shut with nitrogen pressure, but even the shut sequence utilizes hydraulic oil operation. 

Therefore, with actuator temperature below 60 degrees the hydraulic oil may be too viscous to provide a valve stroke time 

of 10 seconds or less. This condition was identified when a nearby instrumentation line was found frozen and brought into 

question the operability of the safety-related MFIVs. (The frozen instrument line had no adverse effect on plant operation.) 

This event was caused by a combination of inadequate design and improper functioning of the HVAC system that serves 

the Steam Tunnel (area that MFIVs are located in). The steam tunnel HVAC supply fans (S64 Fan and S65 Fan) take a 

suction from the outside atmosphere and exhaust directly into the area of the MFIVs. They are designed with an automatic 

low ambient temperature shutoff at 30 degrees, but plant process computer data indicates that the fans continued to 

operate with outside temperatures well below the 30 degree setpoint. Even if the fans had shutoff as designed at 30 

degrees, MFIV actuator temperatures may have dropped to just slightly below the minimum MFIV actuator operating 

temperature of 60 degrees. This LER revision is being provided to more accurately describe the initial corrective actions 

taken to address the steam tunnel low temperature conditions and to incorporate additional actions taken to date. 

400-97-003 6b POWER LEVEL - 100%. On February 27, 1997, with the plant operating in mode 1 at 100% power, engineering review 

concluded that the Steam Generator (S/G) upper instrument line tap arrangement for S/G flow and narrow range level 

channels do not completely satisfy the design requirements of IEEE Standard 279-1971. This conclusion was reached 

following a review of Westinghouse Nuclear Safety Advisory Letter (NSAL) 96-004, 'Control and Protection Interaction', 

which requires redundant protection channels to be capable of providing protective action even when degraded by a second 

random failure. Due to the arrangement of the S/G upper instrument line tap connection for S/G steam flow instruments, 

which share a common tap connection with a S/G narrow range level channel, combined with the logic utilized in the reactor 

protection system circuitry logic, a potential scenario exists that results in the S/G low-low level reactor trip being 

unavailable. This constitutes operation outside the design basis of the plant and was reported to the NRC via the 

emergency notification system at approximately 1513 hours on February 27, 1997. This condition was caused by an 

inadequate failure modes and effects analysis performed on the as-built piping configuration for S/G level instrumentation 

during initial plant construction. A review was also performed of other protection channels to ensure that protection and 

control interaction requirements were met. Additional discrepancies were Identified during this review. Planned corrective 

actions will include a permanent resolution to the identified design deficiency.

A-156
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-157

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

400-97-004 6a On March 4, 1997, with the plant operating in Mode 1 at 100% power, investigation determined that spent fuel cask 

handling activities have been conducted outside of the design and licensing basis of the plant. In preparing the Harris 

Nuclear Plant (HNP) response to NRC Request for Additional Information (RAI) to Bulletin 96-02, "Movement of Heavy 

Loads Over Spent Fuel, Over Fuel in the Reactor Core, or Over Safety-Related Equipment," dated December 5, 1996, 

investigation revealed that the HNP evaluation of a cask drop to a flat surface, documented in FSAR 15.7.5.2, did not 

consider the potential consequences of dropping or otherwise damaging a loaded spent fuel cask after it has been prepared 

for unloading; that is, with the cask head detensioned and valve box covers removed. The FSAR 15.7.5.2 determination 

that the cask is designed to withstand a free drop through air of less than or equal to 30 feet onto a flat, essentially 

unyielding, horizontal surface assumed the loaded cask to be in a fully secured, transportation ready condition with valve 

box covers installed and cask closure head fully tensioned. Spent fuel casks received at HNP are prepared for unloading by 

removing the valve box covers and all but four of the head sleeve nuts before moving the cask to the unloading pool. 

Consequently, the existing cask drop evaluation in FSAR 15.7.5.2 does not address a potential drop of a cask in a less than 

fully secured condition. This event was caused by an incomplete understanding of the purpose and scope of the IF-300 

Cask Safety Analysis Report (CSAR) and a misconception that following the requirements of the CSAR would maintain the 

cask in a condition that was analyzed for a free drop of 30 feet, through air, onto a flat, essentially unyielding, horizontal 

surface. A contributing cause is inadequate 10 CFR 50.59 evaluations for procedure CM-M0300 that failed to identify that 

the cask drop analysis conducted to confirm that the cask could withstand a 30 foot free drop without a loss of integrity only 

applied to a cask in a fully-secured, ready-for-shipment (10 CFR 71 compliant) condition. This discovery has been 

submitted to the NRC as an unreviewed safety question (ref. CP&L Letter HNP-97-064, dated 3/14/97). CP&L has 

suspended cask handling activities by placing procedure CM-M0300 on hold pending NRC review and approval of the USQ 

submittal. CP&L will review the subject event with personnel responsible for making changes to CM-M0300 and other 

procedures to be used for loading and unloading NRC approved packages.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-158

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

400-97-006 NRF POWER LEVEL - 100%. On March 18, 1997, with the plant operating in mode 1 at 100% power, a breach was identified in 

the Thermo-lag fire barrier wall which provides separation between the A-train and B-train cable spread rooms within the 

Reactor Auxiliary Building. This breach consists of a 'L-shaped' hole approximately 8 inches wide by 6 1/2 inches high at the 

point where the fire barrier wall joins the cable spread room ceiling. A 3/4 inch conduit containing two wire conductors was 

also found penetrating the breach. These wires were unconnected at each end and investigation revealed that they were 

unscheduled and not included in plant design. The breach is very difficult to see due to its location and configuration, 

coupled with the fact that it is behind several cable trays. It was identified by maintenance personnel during modifications to 

the cable spread room fire barrier to resolve concerns expressed in NRC Information Bulletin 92-01. Follow-up investigation 

revealed an additional Thermo-lag fire barrier deficiency in a floor drain assembly in the cable spread room. Since there are 

safety-related cables near both sides of the identified fire barrier breach/deficiency, it is possible that a fire in the cable 

spread room could adversely affect both the A-train and B-train safety-related cables. These conditions do not comply with 

the 3-hour-fire-rated barrier requirement in the Harris Nuclear Plant (HNP) Final Safety Analysis Report and Safety 

Evaluation Report (NUREG-1038), and were determined to constitute operation outside the design basis of the plant. The 

fire barrier deficiencies appear to have existed since initial plant construction and were most likely caused by inadequate 

initial design, poor construction methods, as well as incomplete as-built design verification. Immediate corrective actions 

included a visual inspection of Thermo-lag barrier walls located in the cable spread rooms and auxiliary control panel room. 

The unscheduled conduit was removed from the penetration on April 11, 1997. The identified barrier reach and floor drain 

assembly deficiency will be resolved by an existing Engineering Service Request for penetration upgrades by September 

15,1997.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

400-97-010 NRF On April 18, 1997, with the plant in Mode-6 (Refueling) for refueling outage 7, a walkdown performed by Harris Nuclear 

Plant (HNP) Engineering and Fire Protection personnel determined that the Reactor Coolant Pump motor Oil Collection 

System (OCS) did not meet applicable design requirements. Specifically, a six inch wide gap exists in the OCS enclosure at 

the base of the upper lube oil cooler on each of the three installed Reactor Coolant Pump (RCP) motors, which could allow 

RCP oil to splash or spray out in the event of a lube oil cooler or lube oil piping leak. During subsequent investigation, 

additional design discrepancies were also identified and are described in the event description. HNP Final Safety Analysis 

Report (FSAR) Section 9.5.1 states that the RCPs are equipped with an oil collection system that is designed and installed 

such that failure will not lead to a fire during normal and design basis accident conditions. It also states that the system is 

capable of collecting oil from all potential pressurized and unpressurized leakage sites in the RCP lube oil systems. This 

design was established to meet the fire protection program requirements of NUREG-0800/NRC Branch Technical Position 

CMEB 9.5-1. The deficient RCP OCS enclosure does not satisfy these design requirements and is being reported per 

1OCFR50.73.a.2.iii as operation outside the design basis of the plant. This condition was caused by inadequate RCP OCS 

design detail and a lack of knowledge on the part of HNP construction and start-up personnel regarding the design basis for 

the system, which allowed the OCS enclosures to be incorrectly fabricated during initial plant construction. Corrective 

actions will include modifying the RCP OCS enclosures for the installed RCPs to satisfy design requirements. This will be 

completed prior to plant re-start from the current refueling outage. The spare RCP motor has been placed on hold and hold 

will be modified prior to use in the plant. 

400-97-020 NRF On August 14, 1997, with the plant at approximately 100% power in mode 1, design discrepancies were identified during an 

Engineering review of the Safe Shutdown Analysis in Case of Fire. These discrepancies pertain to safety-related 

Emergency Diesel Generator Fuel Oil Transfer pump electrical cables. These cables are required for safe shutdown in case 

of a fire, but were not adequately protected. Specifically, section 9.5.1 of the Harris Plant Final Safety Analysis Report 

(FSAR) provides separation requirements for redundant safe shutdown divisions to maintain safe shutdown capability. 

During the Engineering review, Cables 12549E-SA and 12550A-SB, located in the 261' elevation of the Reactor Auxiliary 

Building were found to not meet the specific design requirements. The first cable (12549E-SA) was in an area that had 

automatic fire detection/suppression systems, but was not separated by a 3-hour fire barrier or 20 feet of horizontal distance 

and was not enclosed in a 1-hr rated barrier. The second cable (12550A-SA) was separated by 20 feet horizontally, but no 

suppression/detection system was provided in its location, nor was a 3-hour barrier provided. These design deficiencies 

were caused by engineering oversight and inadequate design verification during initial plant construction. Immediate 

corrective actions included establishing fire watches for the areas with unprotected cables. A plant modification will be 

developed and installed to provide the required protection.

A-159
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER CSATFETY EVENT ABSTRACT 

CATEGORY 

410-96-016 6b POWER LEVEL - 100%. As a result of GL 96-06, Niagara Mohawk, on December 20, 1996, identified four containment 

(Nine Mile Pt. 2) penetrations which could be subjected to over pressurization due to thermal expansion of the entrapped water during 

design basis accidents when the penetrations are isolated. The four penetrations (2CCP*Z46A, 2CCP*Z47, 2CCP*Z33A, 

and 2CCP*Z34A) allow flow of reactor building closed loop cooling (CCP) water into and out of the drywell. On January 23, 

1997, eight hydraulic fluid penetrations (2RCS*Z99A, *Z99B, *Z99C, *Z99D, *Z100A, *Z100B, *Z100C, and *Z100D) were 

identified as being susceptible to the same potential over pressurization as water penetrations. On January 31, 1997, one 

additional water-filled penetration (2WCS*Z23) was identified as being susceptible. On February 11, 1997, various vents, 

drains, and test connections were determined to be susceptible to over pressurization. The cause of this event is that 

pressurization of these penetrations due to thermal expansion of entrapped fluid between the containment isolation valves 

was not considered during the design of Nine Mile Point Unit 2 (NMP2). Operability determinations have been completed in 

accordance with Station Procedures and Generic Letter 91-18, 'Information to Licensees Regarding Two NRC Inspection 

Manual Sections on Resolution of Degraded and Non-Conforming Conditions and on Operability' to verify operability. 

Long-term corrective actions are planned in response to Generic Letter 96-06, 'Assurance of Equipment Operability and 

Containment Integrity During Design Basis Accident Conditions.' 

410-97-002 NRF On April 7, 1997, NMPC determined that portions of the control circuits for the Division I and II Emergency Diesel 

Generators (EDG) cooling water outlet valves were not isolated from the control room as described in NMP2 USAR Section 

9B.8.2.3. Assuming a control room fire with no other compensatory actions, it could be postulated that either one or both of 

the EDGs could have been disabled due to a control circuit short which would have disabled the Remote Shutdown Panel 

(RSP) controls for these valves. As a result of our corrective actions, NMPC identified on May 8, 1997, additional 

deficiencies in the design of the circuits for 2RHS*MOV4A and 2RHS*MOV4B, minimum flow valves for RHR Pump 1A and 

1 B and in the evaluation of emergency lighting requirements to achieve cold shutdown. On June 7, 1997, NMPC 

determined that the Recirculation System pump discharge valves could not be closed locally as required by procedure in 

the event of a loss of offsite power. The cause of this deviation is an error in the original design and implementation of 

modifications outlined in the NMP2 USAR Section 98.8.2.3 with respect to EDG cooling water outlet valves, the RHR 

minimum flow valves, and the Recirculation System pump discharge valves. This also resulted in not meeting the 

requirements of 10CFR50 Appendix R, Section III.J. NMP2 Technical Specification LCO 3.3.7.4 Action b was entered until 

modifications to the EDG cooling water valve circuits were completed. N2-OP-78 has been revised to direct action to 

provide an alternate means of minimum flow protection for the RHR pumps and to initiate alternate shutdown cooling. 

Additionally, required emergency lights have been or will be installed in areas requiring manual actions to achieve cold 

shutdown, including access and egress pathways.

A-160
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 1 

410-97-008 NRF On August 26, 1997, Niagara Mohawk (NMPC) determined that a fire in the Nine Mile Point Unit 2 (NMP2) Reactor Building 

elevation 328 could potentially have caused spurious actuation of the Reactor Water Cleanup System (RWCU) high 

pressure/low pressure interface valves. This is contrary to the requirements of 1OCFR50 Appendix R Section III G. This 

condition would occur only if offsite power was available, since these valves automatically close upon loss of power or loss 

of air. The cause of this event has been determined to be personnel error during the original evaluation of NMP2 for 

compliance to 1OCFR50 Appendix R. Immediate corrective action was to place a fire watch in the affected fire zone. 

410-97-013 NRS On October 29, 1997, Niagara Mohawk Power Corporation (NMPC) determined that prior to April 30, 1992, Nine Mile Point 

Unit 2 (NMP2) had racked out breakers from a 4160 volt switchgear in a manner which did not meet the seismic 

qualification requirements. This was discovered on October 17, 1997, during a review of NRC Information Notice (IN) 97-53, 

when an operations engineer discovered that other licensees had reported similar conditions, but could not find a report for 

NMP2. After a thorough search of records, it was determined that the event should have been reported previously. The 

cause of the improper racking out of switchgear breakers has been determined to be inadequate translation of engineering 

requirements into plant procedures. The cause of the failure to report the event in 1992 cannot be determined. Procedures 

were developed in 1992 to assure the emergency switchgear breakers are manipulated in accordance with seismic 

qualification requirements. 

410-97-015 5a On November 14,1997, Niagara Mohawk Power Corporation (NMPC) discovered an opening in the wall between the Nine 

Mile Point Unit 2 (NMP2) Reactor Building stair tower and the North Auxiliary Bay (NAB). The Reactor Building and 

Auxiliary Bays form the Secondary Containment. This opening allowed the Reactor Building atmosphere to communicate 

with the NAB and therefore, safety-related equipment located in the NAB could have been exposed to High Energy Line 

Break (HELB) and Loss of Coolant Accident (LOCA) environment. Since the wall design was to prevent migration between 

the Reactor Building and the NAB atmosphere, this condition placed the plant outside of the design basis. The cause of this 

opening has been determined to be improper construction when the plant was constructed. The appropriate Technical 

Specification was entered for the affected electrical distribution equipment. Corrective actions were to repair the opening, 

and perform a preliminary inspection of similar walls to verify that there were no other openings. An analysis has been 

completed to determine the impact of migration through the opening on equipment.

A-161
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-162

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

412-97-002 5b POWER LEVEL - 000%. On January 11, 1997, at 1550 hours, while in Mode 3 at 0% reactor power, Beaver Valley Power 

(MULTI-UNIT Station (BVPS) Unit 2 entered Technical Specification 3.0.3 for a cooldown to Mode 5. Based on engineering review, it was 

APPLICABILITY) determined that design basis requirements for flood protection were not maintained. It was identified that Recirculation 

(Beaver Valley 2) Spray System (RSS) Safeguards Room flood protection seals were not in accordance with the Updated Final Safety 

Analysis Report (UFSAR). External penetration seals were missing for all 4 RSS pumps and 3 of 4 internal penetration 

seals were degraded. Given the condition of these flood protection seals, equipment in the Safeguards Building required for 

long-term recirculation following a Design Basis Accident (DBA) may not be capable of performing its intended function, 

assuming a design basis flood (Probable Maximum Flood) event occurred. The causes of the non-conforming condition of 

the RSS flood seals were determined to be incomplete construction contractor documentation and the lack of overall 

knowledge of flood protection by the RSS flood seal installation crew. The plant was cooled down to Mode 5 on January 12, 

1997 at 2205 hours. The missing external RSS flood protection seals were installed. The degraded internal RSS flood 

protection seals were repaired. An extensive walkdown and inspection of selected Unit 1 and 2 flood protection hydrostatic 

seals was performed. The RSS pump cubicle deep manway hatch flood protection seals were identified as degraded during 

the walkdown and were subsequently repaired. An immediate report of this condition was made on January 11, 1997, at 

1741 hours, pursuant to the requirements of 10CFR50.72(b)(1)(I)(A) and 1OCFR50.72(b)(2)(I). This report is being made 

pursuant to the requirements of 10CFR50.73(a)(2)(l)(A), 10CFR50.73(a)(2)(I)(B), and 10CFR50.73 (a)(2)(ii)(A). The plant 

was cooled down to Mode 5 based upon a conservative management decision.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-163

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

412-97-008 6a On December 16, 1997, with Unit 2 operating in Mode 1 at 100 % power, it was determined that the Control Room 

(MULTI-UNIT Emergency Ventilation System did not meet single active failure criteria as specified in the UFSAR and design bases. 

APPLICABILITY) Review determined that certain 'A' Train component failures could induce failures in 'B' Train. As a result of this information, 

Unit 2 entered Technical Specification (TS) Limiting Condition for Operation 3.0.3 and commenced shutting down to Mode 

3. This was reported pursuant to the requirements of 10CFR50.72(b)(1)(l)(A) as the initiation of any nuclear plant shutdown 

required by the plant's TS. Under the LER Rule it is also reportable pursuant to the requirements of 10CFR50.73 (a)(2)(I)(A) 

as the completion of any nuclear plant shutdown required by the plant's TS, as well as 10CFR50.73(a)(2)(l)(B) any 

operation or condition prohibited by the plants' TS, since it involved entry into TS 3.0.3. There are two root causes for this 

event. The design of the control system for pressure differential switch 2HVC*PDS241, located between the discharge of 

Train "A" Control Room Filtered Air Intake Fan, and the common suction duct, a component in the original plant design of 

the Control Room Emergency Ventilation System was less than adequate. Also, independent reviews of the Control Room 

Emergency Ventilation System, performed in 1982, 1984, and 1986 by the architect/engineer, were less than adequate in 

that these evaluations did not recognize that the current design was susceptible to several credible single failures. As 

completed corrective actions, a scoping assessment of the potential single active failures to equipment in the Control Room 

Emergency Ventilation System was performed, and Design Change Request packages were completed to modify the Unit 2 

Control Room Emergency Pressurization System to correct single failure concerns and to prevent multiple starts of the 

Control Room Filtered Air Intake Fan 2HVC*FN241 B. A detailed extent of condition review for a sampling of similar QA 

Category 1 ventilation systems was performed. Should a single active failure cause both Unit 2 Control Room Emergency 

Ventilation Trains to fail while the system is required to automatically initiate and function (as a result of a Containment 

Isolation B or Control Room High-High radiation signal), Control Room habitability will be negatively impacted. Although the 

Control Room complex is common for ventilation purposes, and although Unit 1 has a separate emergency ventilation 

system, Unit 2 takes no licensing credit for the Unit 1 system. The Unit 1 Emergency Ventilation System could have been 

manually initiated in the event that a Design Basis Accident occurred at either unit.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-164

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

412-97-010 6a On December 19, 1997, at 1335 hours, as a result of an extent of condition review for a previous condition report at Beaver 

(MULTI-UNIT Valley Power Station (BVPS), it was determined that the Unit 2 Emergency Diesel Generator (EDG) Ventilation System 

APPLICABILITY) temperature control circuitry did not have electrical isolation between the Class 1 E and non-Class 1 E portions of the circuit. 

Both Units were in Mode 5 at the time. As a consequence, it was postulated that a failure in the non-safety related portion of 

the control circuit could potentially degrade the safety related portion of the circuit and prevent it from performing its safety 

function. This function is to maintain the ambient air temperature in the EDG rooms within design limits while the EDGs are 

operating. In addition, it was concluded that without electrical isolation between the Class 1 E and non-Class 1 E portions of 

the involved circuits, they were not completely Quality Assurance Category 1 circuits and should not be credited with being 

capable of performing their safety related function. At 1335 hours on December 19, 1997, both Unit 2 EDGs were declared 

inoperable and the appropriate Technical Specification (T.S.) action statement was entered. Additionally, a prohibition was 

placed on Unit 1 entering Mode 4 until this issue was resolved. With both Unit 2 EDGs inoperable, Unit 1 could not meet its 

T.S. Limiting Condition for Operation (LCO) for its Control Room Emergency Habitability System. Unit 1 was already in the 

associated T.S. action statement for this LCO as described in BVPS Unit 2 LER 97-008-00. The apparent cause of this 

event was an inadequate design of the subject EDG ventilation system temperature control circuits during the original plant 

construction for Unit 2. Temporary modifications were completed on December 20, 1997 to address the lack of electrical 

isolation. Following completion of the temporary modifications, both Unit 2 EDGs were declared operable at 1816 hours on 

December 20, 1997. A permanent design change was completed by December 31, 1997 which added the required 

electrical isolation to these circuits. This event is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(ii)(B) as a 

condition that resulted in the nuclear power plant being in a condition that was outside the design basis of the plant. A 

four-hour non-emergency report of the event was made on December 19, 1997 at 1440 hours pursuant to the requirements 

of 10 CFR 50.72(b)(2)(1). This event identified a lack of electrical isolation that could potentially have resulted in the 

degradation or failure of one or both of the Unit 2 EDGs. However, no actual loss of safety function occurred. Based upon 

this information, there were no safety related implications to the health and safety of the public as a result of this event.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

412-97-011 6a On December 29, 1997, at 1940 hours, as a result of an extent of condition review at Beaver Valley Power Station (BVPS) 

(MULTI-UNIT for BVPS Unit 2 Licensee Event Report 97-010-00, it was determined that a design error existed in the Unit 2 safety related 

APPLICABILITY) Secondary Process Racks. This resulted in inadequate electrical isolation between non-Class 1 E circuits contained in the 

racks and the Class 1 E power supplies, which power all circuits in the racks. Consequently, a fault in the non-Class 1 E 

circuits could potentially trip the Class 1 E power supplies, thereby disabling Class 1 E circuits that these power supplies also 

feed. Unit 1 was in Mode 3 and Unit 2 was in Mode 5 at the time of this event. At 1940 hours on December 29, 1997, the 

appropriate Unit 2 Technical Specification (T.S.) action statements were entered and both Unit 2 Emergency Diesel 

Generators (EDGs) were declared inoperable due to the potential to disable EDG room ventilation system temperature 

control circuits. These circuits are required to maintain the EDG room ambient air temperature within design limits while the 

EDGs are operating. Additionally, with both Unit 2 EDGs declared inoperable, Unit 1 could not meet its T.S. Limiting 

Condition for Operation (LCO) 3.7.7.1.a for its Control Room Emergency Habitability Systems and entered the applicable 

T.S. action statement at 1940 hours on December 29, 1997. Since neither Unit 2 EDG was restored to operability within 7 

days, a Unit 1 shutdown to Mode 5 was required. This was completed by 1052 hours on January 4, 1998. Based on 

subsequent corrective actions to correct the identified electrical isolation deficiencies, Unit 2 EDG 2-1 was declared 

operable at 0219 hours on January 15, 1998. This removed any T.S. restrictions on Unit 1 as a result of this event. All 

necessary corrective actions to restore equipment operability and to remove any T.S. restrictions from Unit 2 as a result of 

this event were completed by 1350 hours on January 26, 1998 with Unit 2 still in Mode 5. The apparent cause of this event 

was an error in the design of the Unit 2 safety related Westinghouse 7300 Series Secondary Process Rack circuitry. This 

design error occurred during the original plant construction of Unit 2. The inadequate electrical isolation identified in the Unit 

2 Secondary Process Racks is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(ii)(B) as a condition that 

resulted in the nuclear power plant being in a condition that was outside the design basis of the plant. The required 

shutdown of Unit 1 for failure to satisfy the applicable action statement for T.S. LCO 3.7.7.1 .a is reportable pursuant to the 

requirements of 10 CFR 50.73(a)(2)(l)(A) as the completion of any nuclear plant shutdown required by the plant's T.S. 

Although this event identified inadequate electrical isolation in the Unit 2 Secondary Process Racks, no actual loss of safety 

function occurred. Based upon this information, there were no safety related implications to the health and safety of the 

public as a result of this event.

A-165
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

413-97-003 NRS Event Description: On 5/15/97, with both units in Mode 1, at 100% power, engineering was reviewing the hydraulics of the 

(MULTI-UNIT non-safety suction source to the Auxiliary Feedwater (CA) pumps, when a problem was discovered that would lead to the 

APPLICABILITY) introduction of air into the suction of the CA pumps. The event scenario is a dual unit Loss Of Offsite Power (LOOP) 

(Catawba 1) coincident with a steam line or feedwater line break on one unit occurring prior to transfer of suction for the CA pumps to the 

safety grade assured source, Nuclear Service Water (RN). Root Cause: This event is attributed to an unanticipated 

interaction of systems or components. The limiting design criteria, for ensuring the CA pumps receive a constant water 

supply, was assumed to be the ability of the CA System to survive a break in the nonseismic condensate piping at a point 

downstream of where the three condensate sources tie together. Because this was the criteria used, no transient analysis 

of the individual sources was performed. Corrective Actions: Following the initial evaluation on 5/15/97, the CACST was 

isolated pending further evaluation. Engineering, with off-site assistance will continue evaluation of the condensate quality 

suction sources issue to ensure that all possible configuration concerns have been identified and evaluated, and that all 

necessary corrective actions have been taken. 

413-97-009 6b During a design review, a more limiting Steam Generator (S/G) Tube Rupture (SGTR) accident scenario than previously 

analyzed in Updated Final Safety Analysis Report was identified. In this scenario, the most limiting single failure is loss of 

one of the 125 VDC Vital I&C Distribution Centers, EDE or EDF, resulting in the loss of control power to two S/G power 

operated relief valves (which was previously identified as most limiting) as well as inability to remotely isolate auxiliary 

feedwater flow to two S/Gs. Local manual action within a short time frame would be necessary to prevent S/G overfill. This 

event was caused by a less than adequate review when implementing the generic Westinghouse SGTR analysis 

methodology in 1987. This event is similar to an event reported in Licensee Event Report 413/97-001. Administrative 

controls on primary and secondary coolant specific activities have been put in place to ensure offsite doses are bounded by 

guideline values. A review of equipment needed to prevent S/G overfill to ensure equipment failure effects are appropriately 

reflected in accident analyses was completed. Two additional categories of single failures with the potential to lead to steam 

generator overfill were identified. Future corrective actions include a plant modification, further evaluation of certain failures, 

and submittal of a license amendment, based on risk informed techniques, to exclude certain failures from the plant's 

licensing basis.

A-166
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-167

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-96-049-01 3b On December 11, 1996, with the plant in Mode 5, it was identified that the spacing between a Class 1 E and a non-Class 1 E 

(Millstone 3) cable in the Cable Spreading Room did not meet the minimum separation distance specified in the Final Safety Analysis 

Report (FSAR). Inspections were performed to identify additional deviations. Inspections from March through May 1997 

identified 976 deviations. The deviations with the exception of the three discussed below met operability criteria previously 

established within an electrical separation operability determination document. On April 29 and May 21, 1997, two instances 

where the separation distance between cables in the Instrument Rack Room, and one instance within a manhole, where the 

Sil-temp protective wrap was peeled back, were identified, resulting in electrical separation violations which were 

immediately corrected. The results of the Wyle Test Report provide technical justification for the acceptability of electrical 

separation configurations with spacing less than those described in the FSAR. There were no adverse safety consequences 

from this condition, in that the unit has not experienced an event as a result of a failure in electrical separation nor has it 

experienced an event which was aggravated by a failure in electrical separation of circuits or equipment. Training on 

electrical separation has been conducted for applicable plant personnel. Work planning procedures have been revised to 

incorporate guidance for electrical separation inspection plan development. Identified electrical separation deviations will be 

corrected or restored to compliance with the design basis prior tQ entry into Mode 4. 

423-97-003 6b POWER LEVEL - 000%. On January 13, 1997, an engineering evaluation determined the Recirculation Spray System 

(Millstone 3) (RSS) heat exchangers and piping may be susceptible to water column separation, and subsequent water hammer, if the 

RSS pumps are restarted during design basis accident conditions. This condition has been determined to be outside the 

design basis and the RSS was declared inoperable. NRC notification of this event was made pursuant to 

1OCFR50.72(b)(1)(ii)(B), on January 13, 1997. The Unit was in Mode 5 and in an extended shutdown. The cause of this 

event is design deficiency due to inadequate RSS design scope which did not incorporate and analyze the system 

susceptibility to water hammer and its effects. An evaluation of the RSS water column separation issue will be performed to 

determine if transient piping and equipment loads are acceptable or require design modification.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-009 NRF On January 23, 1997, with the unit in Mode 5, an investigation into High Energy Line Break (HELB) door control problems 

(MULTI-UNIT resulted in discovery of a previously unidentified historical reportable event. On August 3, 1995, with the unit in Mode 1 at 

APPLICABILITY) 100 percent power, three fire doors, that were also HELB barriers, on the 66 foot level of the Auxiliary Building, were found 

open without a continuous fire watch posted. A fourth fire door was properly controlled from a fire protection perspective but 

was not recognized as a HELB door. On August 8, 1997, several deficiencies were identified for HELB doors in the Auxiliary 

and Control Buildings as part of follow-up field walkdowns performed after a self-assessment of the HELB program. These 

deficiencies consisted mostly of door adjustment and maintenance issues, e.g.; damaged thresholds and gasket bars, 

missing sections of gaskets and weather-stripping, and several gaps around door gaskets exceeding allowable criteria. The 

cause of the August 1995 historical event was a failure to develop and implement an effective high energy line break door 

control program. This resulted in personnel not understanding HELB requirements associated with the design basis. The 

cause of deteriorated HELB door conditions identified in August 1997 was a failure to develop and implement an effective 

HELB door (barrier) periodic inspection and maintenance program prior to initial licensing. Recognition of inspection criteria 

development and necessity to inspect doors prior to startup should have been addressed within the original corrective 

actions to this Licensee Event Report. As a result of the August 1997 HELB area walkdown/inspections the following 

additional corrective actions will be taken prior to entry into Mode 4: HELB doors identified not to comply with high energy 

line break barrier design requirements will be restored to compliance, and procedures and work control documents will be 

revised and/or developed to provide for periodic inspection and position verification of HELB doors. 

423-97-010 6b POWER LEVEL - 000%. On January 13, 1997, with the plant in Mode 5, a review of electrical calculations associated with 

Class 1 E 480V and 120V systems identified discrepancies between related electrical calculations used to demonstrate 

design basis compliance. On January 29, 1997, these concerns were sufficiently substantiated to question the validity of the 

Degraded Grid Voltage calculations. A prompt report was made, pursuant to 1OCFR50.72(b)(2)(iii) as an event or condition 

that alone could have prevented the fulfillment of the safety function of structures or systems that are needed to shutdown 

the reactor and maintain it in a safe shutdown condition. The degraded grid voltage (DGV) relays are required to ensure 

that safety related equipment and devices either have adequate voltage to perform their safety functions or are not 

damaged due to a degraded voltage condition. These analytical limit worst-case minimum values were not utilized as the 

source voltage for separate voltage drop calculations performed for the 480V and 120V bus loads. If the 4160V bus voltage 

were to be at its analytical limit worst-case minimum value then inadequate voltage at individual devices supplied by the 

distribution system could result. Therefore, these systems may not be able to perform their design safety functions under 

degraded grid voltage conditions. The cause was determined to be a lack of configuration management for the 

comprehensive calculation program which is required to establish and maintain the design basis of the unit. The calculation 

program is being reviewed and revised as part of the ongoing 50.54(f) effort. In addition, in order to address configuration 

management of the calculation program, formal work practices have been established for processing nuclear engineering 

calculations.

A-168
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY_1_ _ 

423-97-011 6a POWER LEVEL - 000%. During a review of design attributes and supporting design specifications and calculations for 

Technical Specifications, discrepancies were found between the minimum required voltages for safety related heaters and 

their capability to perform their design functions based on reduced voltage at the safety related buses. Reviews performed 

of heater applications found that the heaters were able to perform their design function with the exception of the Hydrogen 

Recombiner heaters. On January 29, 1997, with the unit in Mode 5, a prompt event report was submitted regarding the 

reduction in Hydrogen Recombiner heating capability under degraded voltage conditions pursuant to 10CFR50.72 

(b)(1)(ii)(B) as a condition outside the design basis of the plant. There have been no safety consequences as the result of a 

degraded grid voltage supply to the Hydrogen Recombiner heaters. Recombiner heaters is safety significant in that it could 

result in reliance on operation of the Containment Hydrogen Purge system to remove hydrogen from the containment 

following a Loss of Coolant Accident. The cause has been determined to be a lack of configuration management for the 

comprehensive calculation program which is required to establish and maintain the design basis of the unit. As reported on 

LER 97-010-00, 'The calculation program is being reviewed and revised as part of the ongoing 50.54(f) effort. In addition, in 

order to address configuration management of the calculation program, formal work practices have been established for 

processing nuclear engineering calculations. Additional corrective action includes evaluation of Hydrogen Recombiner 

heater performance under degraded voltage conditions, and, if required, implementation of design changes to restore the 

Hydrogen Recombiners to their design basis requirements. 

423-97-012 6b POWER LEVEL - 000%. On January 29, 1997 at approximately 1435 hours, with the plant in Mode 5, temporarily installed 

concrete blocks serving as ballast for tornado missile restraint of safety related electrical manhole covers were removed 

from the covers. This was done to allow removal and reinstallation of sealant on the covers. Within approximately three 

minutes, the blocks were properly reinstalled following recognition by the Unit Supervisor, that the blocks were functioning 

as a temporary modification for tornado protection. Prompt notification to the NRC of this event was made pursuant to 

1OCFR50.72(b)(1)(ii)(B) on January 29, 1997 as a condition outside the design basis of the plant. The blocks were 

previously installed in 1996 as part of corrective action to an event reported in LER 96-027-00, which identified an original 

lack of installed tornado restraint on the subject covers. This event resulted from failure of the Operations Department 

personnel reviewing the work activity to recognize the safety-related function of the concrete blocks on the manhole covers. 

Consequently, the involved work documentation was coded as minor maintenance and subsequent planning prior to the 

work activity did not identify that the blocks were functioning as a temporary modification. In addition, prior to removing the 

blocks, workers did not notice an installed tag that identified the blocks as a temporary modification. Personnel involved in 

the event have received appropriate counseling on the importance of attention to detail during review and planning of job 

activities.

A-169
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-013 6b POWER LEVEL - 000%. On January 30, 1997, with the unit in Mode 5, it was identified that the instrument air operated, 

Turbine Driven Auxiliary Feedwater Pump (TDAFW) Steam Supply [Containment] Isolation Valves (3MSS*AOV31/A/B/D) 

do not satisfy the remote manual operation requirement specified in General Design Criteria (GDC) 57. Air to permit remote 

operation of these valves cannot be assured in the event of an accident due to the non-seismic nature of the instrument air 

lines. On February 3, 1997, an engineering evaluation confirmed these valves do not meet containment isolation valve 

criteria. As a result an immediate notification was made on February 3, 1997, pursuant to 10CFR50.72(b)(1)(ii)(B). This 

event is being reported in accordance with 10CFR50.73(a)(2)(ii)(B) as an existing condition outside the design basis of the 

plant. While the TDAFW Steam Supply Isolation Valves do not fulfill all the requirements of GDC 57, the downstream valves 

meet the requirements and do satisfy GDC 57. Therefore, in the event of an accident the potential failure of the TDAFW 

Steam Supply Isolation Valves would not prevent isolation of the affected penetrations. The procedures and design 

documentation are being revised to reflect the revised containment boundary for these penetrations. 

423-97-015 3a POWER LEVEL - 000%. On February 4, 1997, with the unit in Mode 5, a review of design calculations identified that the 

calculated minimum water level in the containment sump at the time of Recirculation Spray System (RSS) pumps start 

(approximately eleven minutes after a Containment Depressurization Actuation signal) would be below the level of the 

containment sump vortex suppression gratings during a large break Loss of Coolant Accident (LOCA). Vortex formation and 

the resulting air entrainment, could result in cavitation of the RSS pumps, such that they might be unable to perform their 

intended safety function(s) in an accident. Following evaluation, this condition was immediately reported on February 7, 

1997, pursuant to 10CFR50.72(b)(1)(ii)(B), and is being reported pursuant to 1OCFR50.73(a)(2)(ii)(B) as a condition outside 

the design basis of the plant. There were no adverse safety consequences from this condition, in that the unit has not 

experienced a LOCA and therefore operation of the RSS has not been necessary. However, the potential inoperability of 

the RSS pumps is significant because it represents a condition outside the design basis of the plant. The RSS is credited in 

the safety analyses to cool the containment by spraying containment sump water into the containment atmosphere 

post-accident, provide iodine removal, and provides long-term core cooling post-accident. Formation of vortexes due to the 

water level being below the level of the vortex suppression gratings, resulting in cavitation, could create a common cause 

failure of the four RSS pumps, resulting in potential loss of safety function. Corrective actions needed to ensure operability 

of the RSS and design basis compliance will be implemented prior to entry into mode 4 from the current outage.

A-170
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

423-97-016 6b POWER LEVEL - 000%. On February 6, 1997, at 17:00 with the plant in Mode 5 at 0-percent power, it was determined that 

piping supports for portions of the Residual Heat Removal system (RHS) were in a condition inconsistent with the design 

installation details. Specifically, while implementing piping support modifications to address conditions previously identified 

in LER 96-007-00, workers found the piping system to be outside of its designed configuration. An engineering review 

determined on February 7, 1997 that the supports would not function as designed. As a result, an immediate notification 

was made pursuant to 10CFR50.72(b)(1)(ii)(B) of a condition during operation that resulted in the nuclear power plant being 

in a condition that is outside of the design basis of the plant. This condition is significant in that had the plant experienced a 

design basis accident in containment the potential existed that the RHS might have been unable to fulfill its required safety 

function. However, there were no adverse safety consequences from this condition since the RHS system has never been 

required to operate in a post accident environment nor has it experienced a seismic event. Immediate corrective action was 

taken to restore the piping supports to their designed configuration. In addition, a representative sample of other safety 

related pipe supports will be inspected to determine if conditions exist which would cause the piping support to not perform 

as designed. 

423-97-020 NRF POWER LEVEL - 000%. On February 18, 1997, with the unit in Mode 5, it was identified that operator entry into the 

Containment could potentially be restricted due to elevated ambient temperature during a loss-of-offsite-power (LOP) event. 

A LOP event is considered coincident with postulated fires in accordance with the 'Millstone Nuclear Power Station, Unit 3, 

Branch Technical Position (BTP) 9.5-1 Compliance Report.' For certain postulated fire events, Containment entry is credited 

to operate equipment necessary to achieve cold shutdown. Insufficient cooling flow was supplied to the Containment Air 

Recirculation (CAR) System fans cooling coils by the Reactor Plant Component Cooling Water (CCP) System during a 

LOP. An engineering estimate indicates a resulting Containment temperature of approximately 160 Degrees F. Personnel 

entry to Containment at this temperature may not be possible to operate equipment, even with compensatory measures. 

Consequently, the fire shutdown strategy assumed in the BTP 9.5-1 compliance report as part of the design basis may not 

be possible. This event is considered reportable pursuant to 10 CFR 50.73 (a)(2)(ii)(B), as a condition outside the design 

basis. The cause of this event was the original design placement of the throttle valves controlling flow to the CAR System 

fans when cooling is supplied by the Reactor Plant Component Cooling Water System. The secondary side of the 

Containment Air Recirculation System will be reconfigured to provide the required flowrates when supplied by the Reactor 

Plant Chilled Water (CDS) or CCP Systems. Containment temperature and personnel entry concerns as a result of CAR fan 

cooling capability will be reevaluated.

A-171
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-021 6b POWER LEVEL - 000%. On February 18, 1997, with the unit in Mode 5, it was determined that defects existed in the 

original design of tie rod assemblies in eight Recirculation Spray System (RSS) expansion joints (3RSS*EJIA through D 

and 3RSS*EJ2A through D). These joints are essential to containment integrity and to the heat removal function of the 

RSS. The specific design deficiency is a failure to provide adequate clearance for intermediate tie rod nuts. As a result of 

this defect, if the joints were subjected to their design basis loads, the stress levels in the joint tie rod assembly could have 

exceeded its analyzed operating limits and the joint could experience deformation. This condition was reported on February 

18, 1997 pursuant to 10CFR50.72(b)(1)(ii)(B) as a condition during operation that resulted in the nuclear power plant being 

outside of the design basis of the plant. The cause of this event was determined to be a defective design which had been 

issued by the vendor, the Temp Flex division of Johnson Controls. This vendor has subsequently gone out of business. This 

condition is significant since failure of the joints could adversely affect containment integrity and long term cooling capability 

for the core. There were no adverse safety consequences from this condition in that the plant has not experienced a design 

basis event that would challenge the expansion joint. The required physical modifications to the eight expansion joints 

within the RSS will be completed prior to entry into mode 4. Additionally, a review of similar expansion joints provided by the 

original vendor will be performed. 

423-97-028 3a POWER LEVEL - 000%. On April 10, 1997, with the unit in Mode 5, a review of design calculations for Net Positive Suction 

Head (NPSH) identified that a potential for flashing existed in the suction lines to the Recirculation Spray System (RSS) 

pumps (3RSS*1A,B,C&D). Calculations for the RSS System had originally determined that sufficient NPSH existed at the 

centerline of the first stage of the RSS pump impellers utilizing a saturated sump model. However, these calculations 

contained an inherent assumption that the fluid would remain single phase. This assumption is inappropriate when utilizing 

the saturated sump model. Flashing, resulting in insufficient NPSH, would result in cavitation of the RSS pumps, such that 

they might be unable to perform their intended safety functions during a design basis event (DBE). In this condition the RSS 

system would not be capable of supplying the minimum volume of cooling water credited in the containment analysis. 

Following evaluation, this condition was immediately reported on April 16, 1997, pursuant to 10CFR50.72(b)(2)(iii)(D) as a 

loss of safety function. It is being reported pursuant to 10CFR50.73(a)(2)(v)(D) and 10CFR50.73(a)(2)(ii)(B), as a loss of 

safety function and as a condition outside the unit design basis. There were no adverse safety consequences from this 

condition, in that the unit has not experienced a DBE and therefore operation of the RSS has not been necessary. However, 

the potential inoperability of the RSS pumps is significant because it represents a condition outside the design basis of the 

plant. The RSS s credited in the safety analyses to cool the containment by spraying containment sump water into the 

containment atmosphere post-accident, provide iodine removal, and provides long-term core cooling post-accident. 

Insufficient NPSH, resulting in cavitation, could create a common mode failure of the four RSS pumps, potentially resulting 

in a loss of safety function. Corrective actions to ensure operability of the RSS and compliance with the design basis will be 

implemented prior to entry into mode 4 from the current outage.

A-172
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-173

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-029 6b POWER LEVEL - 000%. On March 17, 1997, with the unit in Mode 5, it was determined that between February 8, 1996 and 

March 18, 1996, the minimum number of Main Steam Pressure Relief Bypass Valve (MSPRBV) flowpaths required to 

depressurize the Reactor Coolant System (RCS) to satisfy the steam generator margin to overfill analysis may not have 

been available in the event of a Steam Generator Tube Rupture (SGTR) concurrent with a single failure. Further 

investigation confirmed on April 17, 1997 that the minimum number of MSPRBV flowpaths required after a SGTR combined 

with a single failure, could not be met. This condition existed for a period of approximately one month. This event is being 

reported pursuant to 1 OCFR50.73(a)(2)(ii)(B) as a condition that resulted in the plant being outside the design basis. The 

cause of this event was a failure to recognize design and single failure requirements necessitating that the MSPRBV be 

included in the Technical Specifications. A Technical Specification change request establishing a requirement for control of 

the MSPRBVs will be submitted prior to June 15, 1997. 

423-97-030 6b On May 1, 1997, at 1030 hours, with the unit in Mode 5, it was identified that the current Reactor Coolant System heatup 

and cooldown pressure and temperature (P/T) limit curves and the Power-Operated Relief Valve (PORV) setpoint curves 

for the Cold Overpressure [Protection] System (COPS) contained in Technical Specifications (TS) 3.4.9.1, 

"Pressure/Temperature Limits," and 3.4.9.3, "Overpressure Protection Systems," respectively, were non-conservative. From 

initial startup until May 9, 1997, the P/T limits and the PORVs setpoint (COPS) curves contained within the TS did not 

properly account for instrumentation and system configuration uncertainties. Since 1993, interim administrative controls 

were imposed within operating procedures to account for the pressure drop across the core with the RCPs in operation. 

However, the PORV setpoint curves were not revised to account for this effect or the other uncertainties recently identified 

and therefore, PORV operation may not have occurred in the past when required. This condition is being reported pursuant 

to 10 CFR 50.73(a)(2)(ii)(B) as a condition outside the unit design basis. Inadequate design verification and validation was 

performed by the Nuclear Steam Supply System vendor and the utility. Administrative precautions on system operation 

minimize the likelihood and severity of COPS events. A review of system operational aspects will be performed to 

determine if the 10 CFR 50 Appendix G limits have been met since startup. Based on preliminary information Appendix G 

limits are considered to have been met.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-035 6b On June 3, 1997, with the Unit in Mode 5, a Configuration Management Program review identified that the present 

Technical Specification (TS) instrumentation setpoints for Steam Generator (SG) Water Level Low-Low may be 

non-conservative. Margin in interim TS setpoints developed in response to a separate issue had been utilized to account for 

an increase in the Process Measurement Accuracy term. However, on August 7, 1993, the SG Water Level Low-Low 

interim setpoints within the surveillance procedures were approved to be restored to the values specified within the TS. On 

June 13, 1997, the condition was determined to be reportable, and the investigation concluded that from approximately 

August 7, 1993, until the present, the unit has implemented a SG Water Level Low-Low setpoint that is inconsistent with the 

safety analyses. This condition is reportable pursuant to 10 CFR 50.73(a)(2)(ii)(B) as a condition outside the design basis. 

This is a historical event. The interim Steam Generator Water Level Low-Low setpoints in effect for the Process 

Measurement Accuracy issue were changed back to the Technical Specification values without proper coordination and 

administrative control, resulting in elimination of previously credited margin. The probability that the instrument will fail to 

actuate by the bottom 1 to 2 percent of span where there is a possibility that the Nominal Trip Setpoint could be exceeded 

on a decreasing level is low. Additionally, the SG Water Level Low-Low trips are a result of a 2 out of 4 logic per SG. Two or 

more instruments on the affected SG would have to fail to actuate by the required setpoint to not get the protective trip. 

Therefore, performance of the safety functions of the SG Water Level Low-Low is only minimally affected. The Steam 

Generator Water Level Low-Low trip function will be in compliance with the safety analyses prior to entry into Mode 4. 

423-97-036 6b On June 5, 1997, with the Unit in Mode 5, the Configuration Management Program Final Safety Analysis Report (FSAR) 

verification identified that incorrect stress analysis limits may have been used in the design of moderate-energy fluid system 

piping. Also, the affects of a design change which changed the Containment design from sub-atmospheric to atmospheric 

on Containment leakage integrity were not evaluated. These two conditions were determined to be reportable on June 9, 

1997. On October 1, 1997, it was determined that the failure to include in the ISI program some weld locations (for high and 

certain moderate-energy lines) within penetration areas required to be identified as break exclusion areas (BEA's) was reportable pursuant to 10 CFR 50.73(a)(2)(1)(B) as a condition or event prohibited by the plant's Technical Specifications. 

The cause for not applying the correct stress limits in the design of moderate-energy piping, was inadequate communication 

within the Architect/Engineer (A/E) organization during the original design. The cause for not reviewing the effects on 

Containment integrity of changing from a sub-atmospheric to an atmospheric design was inadequate technical review within 

the utility engineering and A/E organizations during operation. There were no adverse safety consequences from these 

conditions. These conditions are significant in that a through wall pipe crack would result in exceeding the leakage 

assumptions utilized in dose assessment calculations. Pipe stress calculations will be reconciled to the proper allowable 

stresses. The FSAR and design documents will be updated. The ISI program will be updated to include weld inspection for 

the defined BEA's.

A-174
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-038 6c On June 13, 1997, with the Unit in Mode 5, during a Configuration Management Program review of documentation 

associated with a modification to the fuel building filter exhaust fan auto trip / overcurrent alarm, it was identified that a failure of the train's exhaust filter ventilation system filter inlet or outlet damper could stop the operating train exhaust fan 

and inhibit auto starting of the standby exhaust train. This would result in the loss of negative pressure in the Fuel Building. This is a historical event, attributable to a failure to recognize a design deficiency in the automatic actuation circuitry of a safety related, post-accident mitigation system. As a result of this condition, assurance that the Fuel Building Exhaust Filter 

Ventilation System would perform its intended safety functions can not be verified. This event is being reported in 

accordance with 10CFR50.73(a)(2)(v)(D), which requires reporting of any event or condition that alone could have 

prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. No immediate actions are required since the Fuel Building Exhaust Filter Ventilation System is not required until 

fuel related activities are conducted. However, prior to entry into Mode 4, a design change will be prepared and 

implemented such that a single failure to the operating train Fuel Building Exhaust Filter Ventilation System damper will not 

inhibit the startup of the backup train. 

423-97-046 6a On May 23, 1997, with the unit in Mode 5, a Configuration Management Program (CMP) review revealed that inleakage of 

groundwater results in a potential to flood the Recirculation Spray System (RSS) pump cubicles in the Engineered Safety Features Building (ESF), if the non-safety related sump pumps should fail to operate. On July 11, 1997, upon further 

investigation into the event, it was determined that this situation could result in the loss of both trains of RSS. The RSS 

cubicle non-safety related sump pumps are not fed from vital AC power. Being non-safety related, the RSS cubicle sump 

pumps cannot be credited as available, post-accident. Therefore, groundwater inleakage could accumulate in each of the 

RSS cubicle sumps which are connected to the drain lines under the Containment basemat. If the sumps are not pumped 

out, the groundwater could eventually affect both trains of the RSS. This is an unanalyzed condition which could lead to loss 

of both trains of RSS and is reportable pursuant to 10CFR5O.73(a)(2)(v)(D), as any event or condition that alone could have 

prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. This is a historical event. The cause of this condition was a design deficiency. The potential impact on RSS 

operability of inleakage into the sumps in the RSS Pump cubicles was not recognized during initial plant design. This 

condition was identified as part of the Configuration Management Program review process. The Recirculation Spray System is required to be operable in Modes 1 through 4. Consequently no immediate corrective action is required with the unit in 

Mode 5. Prior to entry into Mode 4, a design modification will be implemented to address the Recirculation Spray System 

cubicle sumps groundwater inleakage condition.

A-175
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-048 5b On August 6, 1997, with the unit in Mode 5, it was identified during an engineering review of the Primary Grade Water 

System (PGS) pump flow rate calculation, that a non-representative pump curve had been used to determine the maximum 

boron dilution flow rates. This condition was discovered and described in accordance with the Millstone Corrective Action 

Program via Condition Report M3-97-2539. Prior to initial unit startup in 1986, a number of efforts were conducted to 

address the inability of the PGS pumps to attain their design flow rate. A review of historical engineering and design 

coordination reports identified several system modifications that were implemented at that time to increase the flow rates. 

These included replacing the original 7-inch pump impellers with 7.5-inch impellers. However, this design change was not 

addressed in the PGS flow rate calculation used for the Boron Dilution Event Safety Analysis. Design engineering has 

estimated that the pump flow rate with the larger 7.5-inch impellers would be approximately 154 g.p.m. and 170 g.p.m. for 

one and two pumps operating, respectively. The use of the larger diameter impeller for both one and two pump operation, 

results in estimated dilution flow rates greater than those assumed within the safety analysis. Consequently, this is 

reportable pursuant to 10 CFR 50.73(a)(2)(ii)(B), as any event or condition that resulted in the condition of the nuclear 

power plant, including its principal safety barriers, being seriously degraded, or that resulted in the nuclear power plant 

being in a condition that was outside the design basis of the plant. The cause is attributed to insufficient configuration 

control within the design control program. During the time frame when the system was modified, there was an incomplete 

evaluation of the impact of the changes on the boron dilution event analysis. As a compensatory action, the valves used to 

isolate the dilution path ways have been administratively locked closed to preclude the possibility of uncontrolled boron 

dilution of the RCS. Prior to entry into Mode 4 and, before using the PGS for reactor coolant system makeup, the system 

will comply with the flow rate limits of the boron dilution event analysis. 

423-97-050 6a On October 17, 1997, with the unit in Mode 5, it was determined that unqualified replacement parts that affected the 

equipment's historical operability, had been installed in the unit's four (4) feedwater isolation valves (FWIVs). The 

non-qualified parts were purchased and were installed in the valves during previous FWIV service overhauls. There is no 

documentation to support the environmental qualification of these parts. Under harsh environmental conditions, failure of 

the non-Electrical Environmental Qualification (EEQ) parts could potentially prevent the valves from performing their safety 

function. Consequently, this condition is being reported pursuant to 10 CFR 50.73(a)(2)(ii)(B) as a condition outside the 

design basis of the plant. The cause of this event was a program deficiency, in that the program lacked the detail and 

definition required to properly identify and maintain technical parts information. There were no safety consequences as a 

result of the event in that the FWIVs have not failed to operate when required. Additionally, safety-related Feedwater Flow 

Control and Bypass Level Control valves located upstream of the FWIVs automatically close on a feedwater valve isolation 

signal and provide another means to isolate the feedwater system should the FWIVs fail to close. The FWIVs will be 

inspected and unqualified parts will be replaced. Work orders will be reviewed for similar conditions and corrected as 

necessary. The EEQ programmatic issues that led to the non-qualified parts being installed in the FWIVs are being 

addressed within the Millstone Corrective Action Program.

A-176
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

423-97-051 NRF On October 6, 1997, with the unit in Mode 5, it was identified that the overcurrent protection design for 4.16kV feeder 

circuits (non-Class 1 E and Class 1 E) does not clear a short-circuit in sufficient time to provide adequate cable protection for 

short-circuit conditions. The overcurrent protection design is relied upon implicitly to respond to a short circuit within the Fire 

Protection and Appendix R Program analysis bases. This condition is reportable pursuant to 10 CFR 50.73 (a)(2)(ii)(B), as a 

condition outside the unit design basis. The cause for this condition was an inadequate design control process during 

original design implementation. This condition includes a lack of verification and validation of calculation design inputs by 

the Architect/Engineer and the utility engineering organizations during construction. There were no adverse safety 

consequences from this condition. However, this condition is significant in that it is contrary to the Fire Protection and 

Appendix R Program analysis bases. The electrical protection relaying scheme for the individual 4.16kV affected circuits will 

be restored to conformance with the design basis. 

423-97-054 7 On October 29, 1997, with the unit in Mode 5, Westinghouse informed Millstone Unit 3 that a developmental fuel rod 

performance modeling computer code indicated that in very limiting cases for high power, high burnup Integral Fuel 

Burnable Absorber fuel rods, that the calculated pressures within the rod could be in excess of the fuel rod design criterion 

and the pellet-to-clad gap could re-open. This could result in the 17 percent (%) maximum cladding oxidation limit, defined 

in 10 CFR 50.46, potentially being exceeded following a postulated Loss of Coolant Accident (LOCA). On October 29, 1997, 

this condition was reported as an event or condition outside the design basis of the unit pursuant to 

10CFR50.72(b)(1)(ii)(B). During performance of the Cycle 6 gap re-opening evaluation, one fuel assembly was predicted to 

exceed the maximum cladding oxidation limit by the end of the current cycle. This condition was identified by 

Westinghouse. Preliminary, generic reviews revealed that the modeling criteria assumptions may be potentially non

conservative regarding fuel rod internal pressures, cladding corrosion rates, and gap re-opening limits for certain 

combinations of fuel design features and operating conditions. There were no adverse safety consequences as a result of 

this condition. Westinghouse has performed a plant specific evaluation for Millstone 3 Cycle 6. This evaluation concludes 

that none of the fuel assemblies in the Cycle 6 core have the combination of design features which make them susceptible 

to the gap re-opening scenario. Administrative controls will be in place to ensure that the limiting fuel assembly is in 

compliance with the 17 % limit for maximum cladding oxidation.

A-177
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGýORYT 

423-97-056 6b On November 7, 1997, with the unit in Mode 5, during a review of original construction era Service Water System (SW) 

Design Deficiency Reports, it was determined that following the initiation of a Containment Depressurization "A" (CDA) 

signal coincident with a loss of offsite power (LOP), SW System pressures may not be sufficient to refill the SW supply 

piping to the control building air conditioning (A/C) condensers. Although SW flowrates are tested at each refueling outage, 

the test does not replicate design basis conditions, e.g., a degraded SW pump, high SW strainer differential pressure and a 

low intake water level as well as a LOP. If SW cooling water flow to the control building A/C condensers is lost, air 

temperatures could ultimately rise high enough to adversely affect the operability of safety-related equipment contained 

within the control building. However, there have been no adverse safety consequences as a result of this condition in that 

the unit has not experienced a CDA coincident with a LOP accident. This is a condition outside the design basis of the plant 

and is being reported pursuant to 10CFR50.73(a)(2)(ii)(B). The event is historical and is attributable to a design deficiency 

in the Service Water System. A design modification will be implemented to ensure that sufficient Service Water system 

pressure is available to refill the control building A/C condensers following a design basis accident. 

423-97-057 6c On November 13, 1997, with the unit in Mode 5, it was identified that the "A" Emergency Diesel Generator (EDG) may have 

been inoperable from October 11, 1997. On October 11, 1997, the air intake damper for the Emergency Ventilation System 

serving the "A" EDG cubicle failed open. The exhaust dampers had been failed in the full open position as part of temporary 

modifications to provide cooling to support EDG operation in the event of an emergency because replacement parts could 

not be readily obtained. A review on November 13, 1997, of the associated safety and engineering evaluations, identified 

that credit had been taken for placing the EDG Emergency Ventilation System in full recirculation in order to be able to 

re-open the exhaust tornado dampers. This condition was determined reportable on November 18, 1997. The cause of this 

event was an inadequate development and review of the safety and technical evaluations associated with a temporary 

modification to fail open the 'A' EDG Cubicle ventilation dampers. Actions to alert personnel that a failure of the air intake 

damper could result in invalidating the tornado recovery actions specified within AOP 3569 'Severe Weather Conditions' 

were not explicitly identified and compensatory actions were not put in place. The ability of the EDG to provide emergency 

power in order to mitigate the consequences of an accident was not challenged during this time period. There were no 

safety consequences as result of this condition. However, the failure to recognize and prevent the circumstances leading to 

this degraded condition is safety significant. The actuator for the "A" Emergency Ventilation System air intake damper has 

been replaced with a functional actuator.

A-178
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY11 

423-97-059 NRF On September 10, 1997, with the unit in Mode 5, during preparation of a design change to upgrade the pilot solenoid valve 

associated with the auxiliary feedwater turbine exhaust condensate drain line, an error was identified in the BTP 9.5-1 

(Appendix R) Compliance Report. Upon system actuation, the turbine exhaust drain isolation valve must close and remain 

closed to prevent turbine exhaust steam from entering the room, potentially impacting proper operation of the turbine. The 

Compliance Report identifies that this valve is not required for shutdown, based on the assumption that failure of the valve 

would not prevent proper operation of the turbine. Because of this classification, the consequences of spurious valve 

operation due to fires were not evaluated. As a result, the ability to achieve and maintain safe shutdown could not be 

assured for fire areas where cables associated with this pilot solenoid valve are routed and the turbine driven auxiliary 

feedwater pump is credited for safe shutdown. There have been no adverse safety consequences as a result of this 

condition in that the unit has not experienced the postulated fire damages. On November 25, 1997, this condition was 

identified outside the design basis of the plant and reportable pursuant to 1OCFR50.73(a)(2)(ii)(B). The condition is 

attributable to a design deficiency introduced during construction, when it was decided to divert this condensate drain line 

from a drain header to the open floor drain. A design modification has been implemented to tie this exhaust condensate 

drain line to the existing drain header, thereby preventing exhaust steam from entering the room in the event that the valve 

fails to close or spuriously opens. 

423-97-063 5b On October 28, 1996, Unresolved Item Report (UIR) 1068 was initiated for a potential issue related to the plant operators' 

ability to meet the operator response time of 10 minutes assumed in Chapter 15 of the Final Safety Analysis Report (FSAR) 

for termination of an Inadvertent Safety Injection (SI) event. On December 31, 1997 it was determined that the assumptions 

contained within the FSAR could not be consistently met. This determination was made on the basis that one of ten crews 

had previously failed to prevent a solid water condition from occurring and that no crew met the required Inadvertent SI 

termination response time during simulator exercises. Because it can not be shown that the operators can consistently 

terminate an Inadvertent SI event within 10 minutes as described in the FSAR, and because it could not be conclusively 

shown that the Condition II criteria will not be exceeded, this condition is reportable pursuant to 10CFR50.73(a)(2)(ii)(B) as 

a condition that resulted in the nuclear power plant being in a condition that was outside the design basis of the plant. 

Probable causal factors identified were conflicting program requirements and lack of commitment to program 

implementation. These causal factors are historical in nature and further evaluation would provide no additional insight into 

the cause of the condition. This condition is significant to the safety of the plant. Mitigating the significance of this condition 

is the fact that the resulting transient is bounded by the SBLOCA analysis. Additionally, five of the six operating crews have 

demonstrated, on a plant specific simulator, the ability to terminate SI prior to a solid water condition occurring. There have 

been no adverse safety consequences as a result of this condition since the plant has not experienced an inadvertent SI 

while operating with a PORV block valve closed.

A-179
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

443-97-001 6b POWER LEVEL - 100%. The Seabrook Station design basis flood analysis is documented in Section 2.4 of the Updated 

(Seabrook) Safety Analysis Report (UFSAR). The UFSAR addresses two flooding scenarios: a probable maximum hurricane 

(PMH)/Probable Maximum Flood (PMF) event and local intense probable maximum precipitation (PMP). The limiting event 

identified in the UFSAR is the PMH/PMF event which was analyzed to produce flood levels on the Seabrook Station site to 

an elevation of 21' mean sea level (msl) or less. Flooding associated with the PMH/PMF occurs primarily as a result of 

waves overtopping the vertical seawall. A critical assumption in the analysis is that the flood water will flow off the site via 

several flow paths that are specified in the UFSAR. North Atlantic has identified that certain obstructions to the flow of flood 

water off the site may produce site flood levels exceeding the elevations specified in the UFSAR. This condition was 

reported to the NRC on January 9, 1997, pursuant to 10CFR50.72(b)(1)(ii)(B), as a condition that is outside the design 

basis of the plant. An operability determination was performed to provide the basis for continued operation. Modifications to 

the flow obstructions will be implemented and the flooding analyses will be updated. The cause of this event has been 

determined to be a misapplication of design inputs and inadequate independent review. 

443-97-002 6b POWER LEVEL - 100%. In response to NRC Generic Letter 96-06 North Atlantic Energy Service Corporation (North 

Atlantic) completed an evaluation of the three issues outlined in GL 96-06. North Atlantic reported to the NRC in its 

response to GL 96-06 that Seabrook Station's containment air cooler cooling water system was not susceptible to either 

water hammer or two phase flow. North Atlantic also reported that the containment penetrations themselves were not 

susceptible to thermally induced over pressurization. However, several containment isolation valves were found to have the 

potential for over pressurization due to the heatup of trapped fluid in the piping inboard of the inner containment isolation 

valve. Corrective actions were initiated to ensure that the affected containment isolation valves are not challenged by 

overpressure conditions and would remain capable of performing their intended safety function. North Atlantic initiated 

non-emergency one hour reports on January 13 and 24, 1997, due to the potential for containment bypass. The postulated 

bypass scenario is one in which the inner containment isolation valve fails as a result of the overpressure condition and the 

outer containment isolation valve does not close upon receipt of an automatic closure signal (single failure condition). There 

are two systems that have inside containment isolation valves that are susceptible to the thermally induced overpressure 

and bypass condition. The two systems are the Safety Injection System [BQ] test line and accumulator fill line, and the 

Waste Liquid System [WK]. A vent valve in each system was opened to provide a controlled relief path should the 

postulated condition develop.

A-180
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-181

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY11 

443-97-005 5b On March 14, 1997 North Atlantic Energy Service Corporation (North Atlantic) discovered that the four Main Steam Line 

Radiation Monitors [IL] (MSLRM) were positioned downstream of the pipe branches to the atmospheric steam dump valves 

(ASDV) contrary to the UFSAR piping and instrumentation diagrams for the Main Steam System. With the MSLRMs located 

downstream of the ASDV pipe branches, radioactive steam releases through these valves under steam generator tube 

rupture accident conditions would not have been correctly quantified and non-conservative input data could have been used 

by the emergency plan dose projection models. For the period from full power license issuance in March 1990 to March 20, 

1997, as a result of the mispositioning of the MSLRMs, non-conservative input data could have been used by the dose 

projection models which could have resulted in an underestimation of offsite radiation doses, and inappropriate protective 

action recommendations. The condition described in this LER is limited to a steam generator tube rupture accident. It would 

not have affected emergency classifications or protective action recommendations initiated based on plant Critical Safety 

Function conditions, field monitoring results, or radioactive releases from the plant vent. During normal operation, steam 

releases from the ASDVs are quantified as to radiological content by sampling and analysis of the Main Steam System. 

This condition was discovered during a system walkdown performed as part of operator training. This event is being 

reported pursuant to 10 CFR 50.73(a)(2)(1). The causes of this event are attributed to (1) human errors involving inadequate 

instrument plan drawings, installation details and P&ID walkdowns and (2) misjudgment errors during the preparation of a 

minor modification. The MSLRMs were declared inoperable on March 14, 1997. The MSLRMs were repositioned upstream 

of the pipe branches to the ASDVs and the dose projection models revised to reflect the new location. The MSLRMs were 

declared operable at 1750 on March 20, 1997.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

443-97-006 6b POWER LEVEL - 100%. On April 7, 1997, North Atlantic Energy Service Corporation (North Atlantic) initially determined 

that a potential fuel handling accident in Containment could result in radiological consequences to Control Room personnel 

being more severe than currently described in the Seabrook Station Updated Final Safety Analysis Report (UFSAR). The 

current UFSAR assumption for a fuel handling accident inside containment assumes that the accident takes place near the 

center of the refueling cavity or approximately 10 feet from the Containment Air Purge (CAP) exhaust duct. However, 

irradiated fuel assemblies are routinely moved in close proximity to the CAP exhaust ducts. Under these circumstances the 

CAP containment isolation valves may not have sufficient time to close before contaminated gas was released from 

Containment. A dropped fuel assembly adjacent to the CAP exhaust duct and operating exhaust fan would essentially result 

in the activity being released prior to the automatic isolation of the 36 inch butterfly valves. North Atlantic reported this 

condition to the NRC on April 7, 1997, pursuant 10CFR50.72(b)(1)(ii)(B) as .a condition that is outside the design basis of 

the plant.' Subsequent evaluations concluded that doses to control room personnel remained within UFSAR and General 

Design Criteria 19 limits. However, this more limiting fuel assembly drop location could represent 'a condition that alone 

could have prevented the fulfillment of the safety function of structures or systems that are needed to control the release of 

radioactivity. This condition is reportable pursuant 10 CFR 50.73 (a)(2)(v)(C). The apparent cause of this event was 

determined to be due a non-conservative assumption in the Fuel Handling Accident analysis. This is a knowledge-based 

error that is due to insufficient site-specific knowledge of fuel handling operations. North Atlantic has reevaluated the 

Control Room Makeup Air and Filtration System (CBA) Chapter 15 accident analysis and concluded the projected dose 

rates to control room personnel will remain less than GDC 19 and UFS AR limits. North Atlantic reviewed the Fuel Handling 

Accident Analysis for the Fuel Storage Building for potential similar non-conservative assumptions. Additionally, North 

Atlantic is evaluating corrective action options to be implemented prior to refueling operations during Seabrook Station's 

upcoming refueling outage. 

443-97-015 7-None On October 28, 1997, Westinghouse informed North Atlantic Energy Service Corporation (North Atlantic) that a 

developmental fuel rod performance model could calculate reduced fuel rod internal pressure margins when compared to 

the previously licensed computer code. Westinghouse has determined that in very limiting cases for high power, high 

burnup Integral Fuel Burnable Absorber (IFBA) fuel rods, calculated pressures are in excess of the fuel rod design criterion 

that the fuel rod pellet to clad gap shall not reopen. Additionally, if the no gap re-opening criterion is exceeded, the 17% clad 

oxidation limit following a postulated LOCA event, as defined in 10 CFR 50.46, could potentially be exceeded. This 

condition is the result of a Westinghouse fuel rod performance computer code that is potentially non-conservative. North 

Atlantic reported this condition on October 28, 1997 pursuant to 1 OCFR50.72(b)(ii)(B) as a condition outside the design 

basis of the plant. There are no adverse safety consequences as a result of this condition. Westinghouse has analyzed a 

hypothetical limiting case scenario and North Atlantic has concluded that Seabrook Station's specific core region criteria are 

more conservative than those assumed in the limiting case scenario. Westinghouse has informed North Atlantic that it is 

currently planning to perform plant-specific analyses to determine the applicability of this condition to Seabrook Station.

A-182
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-183

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY1 

443-97-016 6b On November 5, 1997, North Atlantic determined that the ATWS mitigating system actuation circuitry (AMSAC) C-20 

interlock setpoint was non-conservative in that it enabled AMSAC at 40 percent turbine power rather than at 40 percent 

reactor power as assumed in the Westinghouse ATWS analysis. At that time, North Atlantic did not have an analysis that 

determined the effect of voiding in the reactor vessel at 44 percent reactor power, which is estimated to correspond to 

approximately 40 percent turbine power under steady state conditions. On November 5, 1997, North Atlantic reported this 

as a condition that is outside the design basis of the plant pursuant to 10 CFR 50.72(b)(1)(ii)(B). Subsequent Westinghouse 

analysis determined that arming AMSAC at the C-20 interlock based on 40 percent turbine power remains appropriately 

conservative. As a result, on February 5, 1998, North Atlantic retracted the November 5, 1997 report made pursuant to 10 

CFR 50.72(b)(1)(ii)(B). This condition was caused by the lack of a precise definition of the required power level for the C-20 

interlock in the applicable WCAPs. This condition did not create any significant adverse safety consequences. North Atlantic 

issued a Standing Operating Order to promptly reduce reactor power to less than 40 percent if the C-20 interlock status light 

de-energize due to turbine power being less than 40 percent while reactor power is above 40 percent. Subsequently, a 

design change was implemented to revise the AMSAC C-20 interlock setpoint to reflect a turbine impulse pressure 

equivalent to 20 percent reactor power, thus ensuring that AMSAC is armed prior to reaching 40 percent reactor power. 

445-97-001 7-None POWER LEVEL - 100%. On January 24, 1997, at approximately 6:00 p.m. CST, a condition was identified with the potential 

(MULTI-UNIT to be a more limiting single failure for the Main Steam Line Break (MSLB) and Feedwater Line Break (FLB) accidents at 

APPLICABILITY) Comanche Peak Steam Electrical Station (CPSES) Units 1 and 2. On February 3, 1997, TU Electric Engineering concluded 

(Comanche that the postulated scenario of a FLB occurring to an 'A' Train Steam Generator (SG) coincident with the single active failure 

Peak 1) of the 'B' Train Solid State Protection System (SSPS) was considered outside of the CPSES design basis. A similar 

evaluation concluded that the MSLB remained conservative. TU Electric believes that the cause of this condition was the 

failure to identify this event as a credible scenario during the design of the facility. Analysis of this condition has determined 

that the Auxiliary Feedwater system remains OPERABLE. However, corrective action will be implemented by completion of 

design modification to restore the original design basis of the plant by the end of the next refueling outage for each unit.
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

445-97-002 3b On March 19, 1997, at approximately 10:40 a.m. CST, a condition was identified where the time for containment spray 

(MULTI-UNIT switchover from the Refueling Water Storage Tank (RWST) to the containment sump could take longer than the time 

APPLICABILITY) assumed in the supporting calculation: thus resulting in insufficient water to supply containment spray. On March 19, 1997, 

a TU Electric engineer (utility, non-licensed), conservatively concluded that the postulated scenario for the analyzed time for 

containment spray switchover from the RWST to the sumps compared to the available volumes in the RWST was 

considered outside of the CPSES design basis. TU Electric believes that the cause of this condition was a failure of contract 

engineering to verify the assumption of valve stroke times assumed in the design of the facility. Analysis of this condition 

has determined that the containment spray system remained operable. TU Electric is revising calculations, including level 

setpoints as appropriate, and the FSAR to reflect the capability to complete containment spray switchover without 

interruption of flow. Although the current emergency operating procedures should result in switchover without interruption of 

flow under realistic scenarios, the procedures are being revised to assure the operator can complete the switchover without 

interruption of flow under design basis accident conditions including the worst single active failure. 

445-97-003 5b On May 8, 1997, TU Electric Engineering personnel (utility, non-licensed) were performing a 10CFR50.59 safety screen on 

(MULTI-UNIT a condition described in a Comanche Peak Steam Electric (CPSES) deficiency document. The condition being reviewed 

APPLICABILITY) involved air flowing out of floor drains. During the safety screen Reactor Engineering noted a Unitl/Unit2 difference which 

could impact the environmental analysis on the Main Steam (MS) (EIIS:(SB)) and Feedwater (FW) (EIIS:(SJ)) outside 

containment penetration areas. TU Electric believes the cause of this condition was that implementation of the System 

Interaction Program (SIP) did not adequately consider the direct communication paths between multiple rooms in the 

Safeguard Building through interconnecting floor drains when evaluating the effects of a postulated one square foot pipe 

crack in the break exclusion zones of main feedwater and steam system piping. Compensatory action has been taken to 

plug the drains in the MS and FW outside containment penetration areas of both units to mitigate the consequences of the 

postulated line breaks. This condition is being further analyzed by Engineering. The identified condition does not impact 

OPERABILITY per the CPSES Technical Specifications (TS), since these breaks are not part of the bases for the TS. 

Additionally, the compensatory action eliminated postulated adverse effects which could have exceeded the CPSES design.

A-184
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

445-97-008 6b On October 2, 1997, at approximately 1:00 p.m. CDT, a condition was identified with the potential to prevent multiple 

(MULTI-UNIT Emergency Core Cooling System (ECCS) lines from performing their intended design function following a Loss of Coolant 

APPLICABILITY) Accident (LOCA). The as found condition was that the containment recirculation sump screen mesh size was greater than 

the available gap in more than one ECCS injection throttle valve. This condition could potentially result in the interruption of 

ECCS flow for the affected lines. On October 2, 1997, at approximately 4:43 p.m. CST, TU Electric concluded that the 

postulated scenario was credible and a condition that resulted in the plant being outside of the design basis did exist. TU 

Electric believes that the cause of this condition was the failure to identify the severely throttled valve position and the 

internal valve design which resulted in an available gap size of less than the containment sump screen mesh size. This 

condition existed within the original configuration of the plant after ECCS flow balancing to Westinghouse supplied criteria. 

Analysis of this condition has determined that the ECCS remains OPERABLE. However, corrective action will be 

implemented by completion of design modifications to restore the original design basis of the plant by the end of the 

seventh refueling outage for Unit 1 (1 RF07) and the next available refueling outage for Unit 2 (2RF04). 

454-97-003 NRS POWER LEVEL - 000%. During a Unit 1 Containment [NH] walkdown on February 18, 1997, site personnel determined the 

(MULTI-UNIT access gallery for the equipment hatch was not secured to the containment structure. Due to this discovery on Unit 1, an at 

APPLICABILITY) power containment entry was made for Unit 2 and determined all but one access gallery attachment to the containment 

(Byron 1) structure was in place. On 02/24/97, the Unit 1 access gallery was attached to the containment structure. Not all 

attachments to the structure were able to be installed. Operability assessment 97-019 was performed and determined that 

in the event of seismic acceleration, the gallery will remain intact and secured to the containment structure. Operability 

assessment 97-017 was performed for the Unit 2 Containment Equipment Hatch Access Gallery and determined that in the 

event of seismic acceleration, the gallery will remain intact and secured to the concrete structure. The cause of the Unit 1 

event was inadequate procedural direction and a lack of questioning attitude. The cause of the Unit 2 event was an original 

construction deficiency. Containment Equipment Hatch Removal and Installation Procedure BMP 3300-1 and the 

Maintenance Procedure Writers Guide BAP 400-19 will be revised. A heightened level of awareness review for plant 

equipment design requirements will be performed with all maintenance personnel. There were no adverse consequences to 

the health and safety of the general public or plant personnel as a result of this event. This event is reportable per 

10CFR50.73(a)(2)(ii)(B)-any condition that was outside the design basis of the plant.

A-185
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

454-97-013 NRS The 1B Safety Injection pump suction vent valve was found open on operator rounds and was promptly closed. Difficulties 

had occurred with pump venting on the previous day. The last time the valve was known to have been operated was 20 

hours earlier to support troubleshooting. Had a design LOCA occurred with the vent open, the non-seismic piping 

downstream of the vent is assumed to fail. The resulting leakage of contaminated sump water could cause offsite doses to 

substantially exceed regulatory limits. This exceedance would occur during recirculation when the Residual Heat Removal 

pump pumps containment sump water to the Safety Injection pump suction. The cause of the valve being open is unknown. 

Work activities in the area were reviewed and none were found that manipulated the valve. An evaluation will be done to 

increase awareness/strengthen controls on components that could increase post-LOCA ECCS leakage. Based on 

evaluations of pump operability by the vendor, flooding impact, effects on ECCS flow and realistic dose estimates, this 

event did not pose a threat to the health and safety of the public or plant personnel. This event is reportable under 10 CFR 

50.73(a)(2)(ii)(B), Operation Outside the Design Basis. 

454-97-016 6b The operability of the steam generators is determined through an augmented in-service inspection program and application 

of Technical Specification (TS) listed acceptance criteria. As part of the requirements for voltage based repair criteria for 

steam generator tubing with Outer Diameter Stress Corrosion Cracking (ODSCC), potential leakage during a Main Steam 

Line Break accident with containment bypass must be calculated. This calculated leak rate value is then compared to the 

site allowable accident leakage limit. The site allowable accident leakage limit results in a dose corresponding to 10% of 10 

CFR Part 100 assuming maximum TS allowable Reactor Coolant System Dose Equivalent (DE) lodine-131. The current 

licensing basis maximum site allowable leakage limit for Byron Unit 1 Cycle 8 (BY1C8) is 36.5 gpm. This leakage limit value 

is given at operating conditions. Calculations indicate that the total Predicted Accident tube leakage at the end of BY1 C8 is 

63.1 gpm which exceeds the current licensing basis value of 36.5 gpm. A TS amendment request was submitted 1/97 to 

lower the DE Iodine-131 limit to allow an increase in the site allowable accident leakage limit. The projected accident leak 

rate exceeded 36.5 gpm on 10/7/97. Approval of the TS amendment request to lower the DE lodine-131 limit was not 

received prior to the projected accident leak rate exceeding the limit. An operability assessment was performed to justify 

continued operation. This event is reportable per 10 CFR 50.73(a)(2)(ii).

A-186
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT F _CATEGORY 

454-97-019 7 Westinghouse analysis shows that for high power, high burnup assembly Integral Fuel Burnable Absorber fuel rods, 

(MULTI-UNIT calculated rod internal pressures are in excess of the Westinghouse fuel rod design criterion that "the fuel rod pellet-to-clad 

APPLICABILITY) gap shall not re-open." Additionally, if the "no gap re-opening" criterion is exceeded, the 17% clad oxidation limit following 

postulated Loss of Coolant Accident event, as defined in 1 OCFR50.46, can likewise be exceeded. Westinghouse has since 

determined that all currently operating plants are in compliance with 1 OCFR50.46. Westinghouse has completed the Byron 

Unit 2 analyses using plant specific conditions which conclude there is no gap re-opening and the 17% post-LOCA clad 

oxidation limit is not exceeded. All fuel design limits and 1OCFR50.46 criteria are met. Cause of the issue was that 

Westinghouse used inadequate methods and incorrect assumptions in the fuel rod design code. Corrective actions are: 

Westinghouse to review and improve analytical models; gather additional data; and perform plant by plant assessments. 

Byron Station will address this issue in the Byron Unit 1 Cycle 9 safety evaluation. A search of the Nuclear Station 

Regulatory Assurance database found no previous occurrences. The fuel rod design issues potentially result in a condition 

outside the design basis reportable per 10CFR50.73(a)(2)(ii). 

454-97-023 6b On December 29, 1997, during the performance of Special Procedure 97-033, it was discovered that the 1 B Emergency 

Diesel Generator (DG) was wired in such a configuration that it may not have continued to operate if a fire had occurred in 

fire zones 11.5-0 or 11.6-0. A wiring error occurred in May of 1996 during the installation of a design change which 

re-powered vital components to the credited DC control power supply relied upon for the 1 B DG. A normally connected wire 

was mistakenly removed and the intended wire which remained resulted in both DG DC control power supplies being 

cross-tied. A fire in zone 11.5-0 or 11.6-0 could have resulted in the loss of both control power circuits for the 1 B DG. The 

DG control circuit was not impacted in any way by the incorrectly removed wire. The cause of the wiring problem was both 

an error on the part of the technician installing the design change and a programmatic deficiency in that the installation 

process did not provide for independent verification. The corrective actions include counseling the technician involved in the 

installation error by management and initiating programmatic changes to require independent verification for all Safety 

Related and Regulatory Related design changes which involve wiring termination/determinations. In addition, a 

comprehensive wiring verification was performed in all four DG local panels to confirm the as-built configuration of the 

wiring against design drawings. This event is reportable per 1OCFR50.73(a)(2)(ii).

A-187
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

455-97-001 5a POWER LEVEL - 000%. On March 15, 19 97, Unit 2 was cooling down and entering maintenance outage B2F18. The Unit 

(Byron 2) 2 containment floor drains were found full of water during the Mode 3 walkdown. It was determined that debris had clogged 

the flow control device. This blockage would not allow the weir box to detect a one gallon per minute leak in containment. A 

water hose was used to blast the blockage clear at the flow control device and all drains opened up. An at power 

containment entry was made for Unit 1 to check the containment drains on March 19, 1997, which found no drains blocked. 

The root cause for this blockage was the concrete and bar grating to the entrance of the drain system was not installed in 

accordance with design specifications. This allowed debris to enter the drain system and become lodged in the flow control 

device. Operability assessment 97-027 was performed for the Unit 2 leak detection system [BD] for the deficiency in the bar 

gratings. There have been no previous occurrences of this event. To prevent recurrence, a new bar grating design will be 

installed. There were no adverse consequences to the health and safety of the general public or plant personnel. 

456-97-008 6b The operability of the steam generators is determined through an augmented in-service inspection program and application 

(Braidwood 1) of Technical Specification (TS) listed acceptance criteria. As part of the requirements for voltage based repair criteria for 

steam generator tubing with Outer Diameter Stress Corrosion Cracking (ODSCC), potential leakage during a Main Steam 

Line Break accident with containment bypass must be calculated. This calculated leak rate value is then compared to the 

site allowable accident leakage limit. The site allowable accident leakage limit results in a dose corresponding to 10% of 10 

CFR Part 100 assuming maximum TS allowable Reactor Coolant System Dose Equivalent (DE) Iodine-1 31. The current 

licensing basis maximum site allowable leakage limit for Braidwood Unit 1 Cycle 7 is 26.8 gpm. This leakage limit value is 

given at operating conditions. Calculations indicate that the total Predicted Accident tube leakage at the end of Unit 1 Cycle 

7 is 87.7 gpm which exceeds the current licensing basis value of 26.8 gpm. A TS amendment request was submitted 

September 2, 1997 to lower the DE Iodine-131 limit to allow an increase in the site allowable accident leakage limit. The 

projected accident leak rate exceeded 26.8 gpm on 10/10/97. Approval of the TS amendment request to lower the DE 

Iodine-1 31 limit was not received prior to the projected accident leak rate exceeding the limit. An operability assessment 

was performed to justify continued operation. This event is reportable per 10 CFR 50.73(a)(2)(ii).

A-188
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT CATEGORY 

456-97-009 7 Westinghouse analysis shows that for high power, high burnup assembly Integral Fuel Burnable Absorber fuel rods, 

(MULTI-UNIT calculated rod internal pressure are in excess of the Westinghouse fuel rod design criterion that "the fuel rod pellet-to-clad 

APPLICABILITY) gap shall not re-open." Additionally, if the "no gap reopening criterion is exceeded, the 17% clad oxidation limit following 

postulated Loss of Coolant Accident event, as defined in 1 OCFR50.46, can likewise be exceeded. Westinghouse has since 

determined that all currently operating plants are in compliance with 1 OCFR50.46. Cause of the issue was Westinghouse 

used inadequate methods and incorrect assumptions in fuel rod design code. Corrective actions: Westinghouse completed 

plant-specific analyses on March 6, 1998. These analyses indicate that gap re-opening occurs during Braidwood 1 Cycle 7 

operation, but that the 10 CFR 50.46 cladding oxidation criterion continues to be met. The criterion will be met through the 

cycle's End of Life (EOL) burnup of 20,000 MWD/MTU. In addition, all analyses supporting the conclusions of the Cycle 7 

Reload Safety Evaluation demonstrate that operation until EOL is valid. Braidwood System Engineering and Nuclear Fuel 

Services have reviewed the results of these analyses and concur with the conclusion. A search of the Nuclear Station 

Regulatory Assurance database found no previous occurrences. 

461-97-001 6b POWER LEVEL - 000%. Because of a nuclear fuel supplier error, the Turbine Pressure Regulator Downscale Failure 

(Clinton 1) (PRDF) event for 40 to 80 percent of rated thermal power had not been quantitatively analyzed during past operation. The 

fuel supplier issued a revision to the power-dependent operating limit for the cycle 7 Minimum Critical Power Ratio (MCPR) 

to correct the previous limit which was not adequate for conditions between 40 and 80 percent of rated thermal power for 

the PRDF event. Utility engineers reviewing the documentation identified that there was some potential to exceed the 

Safety Limit MCPR if the PRDF event had occurred during any of the past 5 fuel cycles. The engineers identified that the 

plant had operated in an unanalyzed condition during fuel cycle 6 and may have operated in unanalyzed conditions during 

fuel cycles 2, 3, 4, and 5. The cause of this event is attributed to an error by the nuclear fuel supplier in determining which 

events were the limiting anticipated operational occurrences that required analysis for the fuel design. Corrective action 

includes implementing corrected power-dependent operating limits for the MCPR. This event is also reportable under 

1OCFR, Part 21. 

461-97-006 6c On February 19, 1997, the plant was in Mode 4 (Cold Shutdown) and reactor coolant temperature was being maintained 

between 95 and 105 degrees Fahrenheit, reactor pressure was atmospheric. An engineer discovered that there was a 

circuit breaker coordination problem between 120 volt circuit breakers and safety related 480 volt circuit breakers that 

supply 120 volt distribution panels. This is contrary to the design basis of the plant which requires that the 120 volt circuit 

breakers be coordinated with the 480 volt supply circuit breaker to the 120 volt distribution panel on electrical distribution 

systems that contain safe shutdown and non-safe shutdown equipment. Three occurrences of this condition were 

discovered. The cause of this event has been attributed to an error by the architect engineer for Clinton Power Station. 

Corrective actions for this event include modifying the three affected circuits and reviewing the electrical distribution scheme 

to ensure proper circuit breaker coordination.

A-189
1997 Licensee Event Reports with Design-Basis Issues (Continued)

A-190

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

461-97-007 NRS POWER LEVEL - 000%. With the plant in COLD SHUTDOWN, a System engineer recognized that a Probabilistic Risk 

Analysis (PRA) performed for General Electric Magne Blast breakers in Division 3 High Pressure Core Spray System 

switchgear in the racked-down (disconnected) Position was not valid for evaluating the seismic qualification and operability 

of the switchgear. Further, procedures were not adequate to prevent the breakers from being left in the breaker cubicle in 

the racked-down Position while performing on-line maintenance activities for an extended period of time. Leaving the 

breakers in the racked-down position in the cubicle for extended periods of time was a normal practice. The cause of this 

event is attributed to lack of procedural guidelines to maintain seismic qualification of the Division 3 breakers and 

switchgear. Corrective actions include verifying breakers were in the racked-in (connected) position, issuing an Operations 

Night Order requiring that racked-down breakers must be removed from the cubicle, performing a revised PRA, reviewing 

and revising as needed the seismic analysis, and revising procedures to address the acceptability of breaker configurations. 

461-97-008 6b POWER LEVEL - 000%. In 1992, Illinois Power electrical design engineers raised a concern that the setpoints for 

second-level undervoltage relays in the Auxiliary Power system may not be correctly set to provide adequate voltage for 

proper equipment operation. In 1994, an extensive study of the AP system response under Loss of Coolant Accident 

(LOCA) conditions identified the minimum voltage required at all levels from the 4160-volt to the 120-volt levels and 

concluded that the second-level undervoltage relay minimum reset point of 3799 volts would not ensure sufficient voltages 

for all equipment fed from the 120-volt motor control center distribution panels following a postulated LOCA scenario. This 

condition was identified on Licensee Event Report (LER) 94-005. However, it was not recognized at that time that the relays 

must be considered inoperable. Corrective actions for LER 94-005 included a Main Control Room alarm, revising the 

annunciator procedure for operator guidance, training of operators to respond to an undervoltage condition, and 

modifications of the plant design to replace the existing plant equipment with more accurate undervoltage relays and 

regulating transformers. In March of 1997, the Improved Technical Specification requirements for power sources and 

instrumentation were reviewed to submit an amendment to the Facility Operating License No. NPF-62. Based on that 

review, the operability requirements of the undervoltage relays were not being met, so the relays and the associated 

Emergency Diesel Generators were declared inoperable.
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

461-97-010 6b Due to a concern raised throughout the nuclear industry about degraded voltage protection, Illinois Power (IP) engineers 

began a study of the effects of degraded voltage on safety-related equipment. This study involved, in part, a review of the 

calculations used to set the minimum bus voltage required to ensure proper operation of safety-related (Class 1 E) 120-VAC 

equipment. In review of these calculations plant engineers determined a new minimum voltage value of 4030-VAC required to be present at the off-site power sources vice the previous value of 3744-VAC. Review of past voltage data during the first 

week of April, 1997, showed that fluctuations in bus voltages had resulted in voltage less than the new minimum value of 

4030-VAC and that one of the offsite power sources should have been declared inoperable. It was determined that the 

required action as stated in the Technical Specifications (TS) section 3.8.2, "Initiate action to restore required off-site power 

circuit to OPERABLE status immediately," was not met. This event was personnel error in the failure to adequately review 

operability requirements of plant equipment. Corrective action will include a revision to the appropriate surveillance 

procedures that determine equipment operability. 

461-97-016 NRF On June 17, 1997, the plant was in mode 4 (Cold Shutdown), and the sixth refueling outage was in progress. A Quality 

Assurance Technical Specialist identified that the required fixed sealed beam lighting units with eight hour minimum battery 

supplies were not provided for one location where manual action is required to safely shutdown the plant by the Safe 

Shutdown Analysis (SSA). The requirement for eight hour emergency lights, which constitutes the design basis for 

emergency lighting, is specified in Branch Technical Position-APCSB 9.5-1 and 1OCFR50 Appendix R section III J. The 

manual action that was required to be performed was to open valve 1E12-F024B locally because a hot short of the cables 

associated with valve 1E12-FO06B could cause that valve to open which would actuate an interlock that prevents valve 

1E12-F024B from opening. The cause of this event could not be determined. Corrective actions for this event include: 

preparing a modification and administrative controls to de-energize valve 1E12-F006B during modes when it is not 

necessary, this prohibits 1E12-F024B from being affected by a hot short and the subsequent requirement for emergency 

lights, and a review of other manual actions in the SSA to determine if there were other occurrences where adequate 

lighting were not provided as required by the plant design basis. 

461-97-020 3b On July 15, 1997, Illinois Power (IP) personnel were reviewing the effect of degraded protective coatings in containment on 

the ability of the emergency core cooling system (ECCS) pumps to have the required net positive suction head (NPSH). IP 

personnel could not determine that these protective coatings would not fail during an accident and deposit on the ECCS 

pump suction strainers causing the pumps to not meet their design NPSH requirements. Also, the quantity of non-qualified 

flexible materials in the containment may have had similar effects during accident conditions on the ECCS NPSH. The 

cause of this event was the failure to recognize the impact of the degraded protective coatings on the ECCS pumps NPSH 

and the failure to implement better controls on the use of flexible materials in the containment. Corrective actions include: 

removal of degraded coatings, periodic inspection and evaluation of the remaining protective coatings, testing of existing 

coatings, and providing additional procedural controls and training on the use of flexible materials in the containment 

building. In addition, excess flexible materials were removed.

A-191
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

461-97-022 3a The diesel generator (DG) room ventilation system was designed based on an outside air temperature range of -2 degrees 

Fahrenheit (F), winter minimum temperature, and 96 degrees F, summer maximum temperature. The Updated Safety 

Analysis Report (USAR) identifies temperature extremes of -22 degrees F and 112 degrees F based on surrounding area 

temperature data. Analysis determined that the DG ventilation system is unable to maintain DG room temperature within the 

design limit during the area extreme high temperature identified in the USAR. The cause for this condition was design 

engineers, oversight. During the investigation, annunciator power supplies located in the DG rooms were identified as not 

meeting Class 1 E qualification due to improper implementation of a design modification. Corrective actions include revising 

procedures, evaluating components for increased room temperature, installing a temporary modification to reduce 

temperature inside a control panel, design changes to the DG Direct Current (DC) electrical distribution system, reviewing 

other ventilation systems for the design deficiencies, correcting the USAR, correcting the DG DC annunciator power supply 

Class 1 E deficiency, evaluating the effects of outside air temperature extremes and verifying Class 1 E deficiencies do not 

exist in other control panels. This condition is reportable under 10CFR21. 

461-97-025 NRF On October 2, 1997, the plant was in Mode 4, reactor coolant temperature was being maintained within a band of 100 to 

120 degrees Fahrenheit and pressure was atmospheric. Engineering personnel were resolving a condition report written to 

investigate the potential for a fire in the Main Control Room causing hot shorts of circuitry for motor operated valves (MOV) 

required for safe shutdown of the plant from the remote shutdown panel. A hot short could potentially cause the MOV to 

spuriously operate bypassing the MOV control circuitry protective features. When the MOV control circuit protective 

features are bypassed, the potential exists for the valve to be damaged to the extent that the valve could not be operated 

either manually or electrically. This is contrary to the design basis of the plant described in 1 OCFR50 Appendix R, Section 

II.G. The cause of this design deficiency could not be determined. Approximately fifty valves are potentially affected by this 

condition. Corrective actions for this event include: analyze and modify, as required, each affected MOV circuit so that a fire 

in the Main Control Room will not affect the ability of the valve to operate so that the capability to achieve safe shutdown is 

assured, review of other component types for applicability, and revise the engineering review standards to require that 

changes to safe shutdown electrical circuits be reviewed for this condition.

A-192
1997 Licensee Event Reports with Design-Basis Issues (Continued)

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

461-97-026 5b On October 14, 1997, the plant was in Mode 4 (Cold Shutdown) for the sixth refueling outage (RF-6), reactor [RCT] coolant 

temperature was being maintained within a band of 100 to 120 degrees Fahrenheit and pressure was atmospheric. Plant 

engineers identified that the level of silt in the area of the shutdown service water system (SX) pump intake area exceeded 

the level required to ensure the operability of the Division I and II SX pumps. The cause of this event was attributed to the 

failure to perform an adequate inspection of the SX pump intake area. The inspection procedure for the plant service water 

screenhouse did not specifically require an inspection of the SX pump intake area and establish an acceptance criteria for 

the level of silt in the plant service water intake area. Corrective actions for this event include: cleaning of the plant service 

water intake structure, evaluating, inspecting or testing the Division I and II SX heat exchangers to determine operability, 

and revising the inspection procedure to include acceptance criteria for silt levels, trending of silt accumulation, and periodic 

inspection of the SX portion of the pump intake structure. 

461-97-036 6c On December 22, 1997, Engineering completed an evaluation of a missing motor shaft key that connects the motor to the 

fan hub of the Division II shutdown service water pump room cooler. This evaluation determined that without the motor shaft 

key the Division II shutdown service water pump room cooler could not be considered operable. The inoperability of the 

room cooler causes the associated Division II shutdown service water pump to be inoperable. It is likely that the motor shaft 

key was not installed during initial manufacturing by Buffalo Forge. Corrective action for this event is to install the required 

motor shaft key. A review of the maintenance history at Clinton Power Station for similar fans manufactured by Buffalo 

Forge revealed that similar conditions with Buffalo Forge supplied cooling fans have not been previously identified. This 

event is reportable under 10 CFR Part 21. 

498-97-003 6b POWER LEVEL - 100%. During an evaluation in response to Generic Letter 96-06, 'Assurance of Equipment Operability 

(MULTI-UNIT and Containment Integrity During Design-Basis Accident Conditions,' an engineering review identified a 3-inch Liquid Waste 

APPLICABILITY) Processing System line on each unit that could potentially be susceptible to thermal expansion of fluid with resultant piping 

(South Texas 1) over pressurization in the event of a design-basis accident. Lines 3'WL-1009 (Unit 1) and 3'WL-2009 (Unit 2) are used to 

drain the Reactor Coolant Drain Tank to the Liquid Waste Processing System. Conservative analysis of the uninsulated line 

identified a potential over pressurization condition during a design basis accident that could result in piping stresses 

exceeding ASME Code allowable limits. To ensure that over pressurization of this piping would not occur, the affected 

section of the line was drained. Additional analysis showed that piping stress allowable limits would not be exceeded if the 

line were insulated. Subsequently, a design change installed insulation on the piping and the line was returned to service. 

No loss of containment integrity would have occurred as a result of this condition. The potential condition was reported in 

accordance with 10CFR50.72(b)(1)(ii) on January 23, 1997. This potential condition is also reportable accordance with 

S1OCFR50.73(a)(2)(ii)(B), condition outside the design basis of the plant.

A-193
1997 Licensee Event Reports with Design-Basis Issues (Continued) 

LER NUMBER SAFETY EVENT ABSTRACT 

CATEGORY 

528-97-003 6b On July 25, 1997, at approximately 1200 MST, Palo Verde Units 1, 2, and 3 were in Mode 1 (POWER OPERATION), 

(MULTI-UNIT operating at approximately 100 percent power when APS Engineering personnel identified that certain electrical conduit 

APPLICABILITY) penetration fittings within safety related buildings had been in a condition which would have allowed the migration of flood 

(Palo Verde 1) water to other elevations and potentially render safety related equipment unable to perform its safety function. The cause of 

the condition was attributed to a construction design deficiency which did not consider the submergence characteristics of 

conduit fittings used for the penetrations. As corrective action, the fittings were sealed to prevent the migration of flood 

water to other elevations and equipment and appropriate drawings have been revised to provide for the current proper 

sealing of the penetration following maintenance, modifications, and new construction. No previous similar events have 

been reported pursuant to 1 OCFR50.73.

A-194
Appendix B 

Partial Listing of Generic Communications 

Involving Design-Basis Issues
Partial Listing of Generic Communications 

Involving Design-Basis Issues

GENERIC 

YEAR COMMUNICATION TITLE 

1997 Generic Letter Assurance of Equipment Operability and Containment Integrity During 

(GL) 96-06, Design-Basis Accident Conditions 

Supplement 1 

1997 GL 97-04 Assurance of Sufficient Net Positive Suction Head for Emergency Core 

Cooling and Containment Heat Removal Pumps 

1997 Information Notice Deficiencies in Failure Modes and Effects Analyses for Instrumentation 

(IN) 97-81 and Control System 

1997 IN 97-79 Potential Inconsistency in Assessment of Radiological Consequences of 

Main Steam Line Break Associated with Implementation OD SG Tube 

Voltage Based Repair Criteria 

1997 IN 97-76 Degraded Throttle Valves in Emergency Core Cooling System Resulting 

from Cavitation-induced Erosion During a Loss-Of-Coolant Accident 

1997 IN 97-71 Inappropriate Use of 10 CFR 50.59 Regarding Reduced Seismic Criteria 

for Temporary Conditions 

1997 IN 97-60 Incorrect Unreviewed Safety Question Determination Related to 

Emergency Core Cooling System Swapover from the Injection Mode to 

the Recirculation Mode 

1997 IN 91-50, Supplement 1 Water Hammer Events since 1991 

1997 IN 97-43 License Condition Compliance 

1997 IN 97-41 Potentially Undersized Emergency Diesel Generator (EDG) Oil Coolers 

1997 IN 97-33 Unanticipated Effect of Ventilation System on Tank Level Indications and 

Engineering Safety Features Actuation System Setpoint 

1997 IN 97-27 Effect of Incorrect Strainer Pressure Drop on Available Net Positive 

Suction Head 

1997 IN 87-10, Supplement 1 Potential for Water Hammer During Restart of Residual Heat Removal 

Pumps 

1997 IN 97-25 Dynamic Range Uncertainties in the Reactor Vessel Level Instrumentation 

1997 IN 97-21 Availability of Alternate AC Source Designed for Station Blackout Event 

1997 IN 97-13 Deficient Conditions Associated with Protective Coatings at Nuclear 

Power Plants 

1997 IN 97-07 Problems Identified During Generic Letter 89-10 Closeout Inspections 

1996 GL 96-06 Assurance of Equipment Operability and Containment Integrity During 

Design-Basis Accident Conditions 

1996 GL 96-05 Periodic Verification of Design-Basis Capability of Safety-Related 

Motor-Operated Valves 

1996 GL 96-01 Testing of Safety-Related Logic Circuits

B-1
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.)

GENERIC 

YEAR COMMUNICATION TITLE 

1996 Bulletin Potential Plugging of Emergency Core Cooling Suction Strainers by 

(IEB) 96-03 Debris in Boiling-Water Reactors 

1996 IN 96-64 Modifications to Containment Blowout Panels Without Appropriate Design 

Controls 

1996 IN 96-60 Potential Common-Mode Post-accident of Residual Heat Removal Heat 

Exchangers 

1996 IN 96-55 Inadequate Net Positive Suction Head of Emergency Core Cooling and 

Containment Heat Removal Pumps under Design Basis Accident 

Conditions 

1996 IN 96-49 Thermally Induced Pressurization of Nuclear Power Facility Piping 

1996 IN 96-45 Potential Common-Mode Post-accident Failure of Containment Coolers 

1996 IN 96-41 Effects of a Decrease in Feedwater Temperature on Nuclear 

Instrumentation 

1996 IN 96-39 Estimates of Decay Heat Using ANS 5.1 Decay Heat Standard May Vary 

Significantly 

1996 IN 96-36 Degradation of Cooling Water Systems Due to Icing 

1996 IN 96-31 Cross-tied Safety Injection Accumulators 

1996 IN 96-27 Potential Clogging of High Pressure Safety Injection Throttle Valves 

During Recirculation 

1996 IN 96-17 Reactor Operation Inconsistent with the Updated Final Safety Analysis 

Report 

1996 IN 96-08 Thermally Induced Pressure Locking of a High Pressure Coolant Injection 

Gate Valve 

1996 IN 96-06 Design and Testing Deficiencies of Tornado Dampers at Nuclear Power 

Plants 

1996 IN 96-01 Potential for High Post-Accident Closed-Cycle Cooling Water 

Temperatures to Disable Equipment Important to Safety 

1995 GL 95-07 Pressure Locking and Thermal Binding of Safety-related Power-Operated 

Gate Valves 

1995 GL 92-01, Revision 1, Reactor Vessel Structural Integrity 

Supplement 1 

1995 "Generic LTR 89-10 Design-Basis Closure Millstone Unit 3' 

1995 "GL 89-10 Close-out CYAP Haddam Neck Plant" 

1995 IEB 95-02 Unexpected Clogging of a Residual Heat Removal (RHR) Pump Strainer 

While Operating in Suppression Pool Cooling Mode

B-2
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.) 

GENERIC 

YEAR COMMUNICATION TITLE 

1995 IN 91-29, Supplement 3 Deficiencies Identified During Electrical Distribution System Functional 

Inspections 

1995 IN 95-47, Revision 1 Unexpected Opening of a Safety/relief Valve and Complications Involving 

Suppression Pool Cooling Strainer Blockage 

1995 IN 95-47 Unexpected Opening of a Safety/Relief Valve and Complications Involving 

Suppression Pool Cooling Strainer Blockage 

1995 IN 95-37 Inadequate Off site Power System Voltages During Design-Basis Events 

1995 IN 95-30 Susceptibility of Low-pressure Coolant Injection and Core Spray Injection 

Valves to Pressure Locking 

1995 IN 95-28 Emplacement of Support Pads for Spent Fuel Dry Storage Installations at 

Reactor Sites 

1995 IN 95-18, Supplement 1 Potential Pressure-locking Safety-Related Power-operated Gate Valves 

1995 IN 95-18 Potential Pressure-Locking of Safety-Related Power-Operated Gate 

Valves 

1995 IN 95-16 Vibration Caused by Increased Recirculation Flow in a Boiling Water 

Reactor 

1995 IN 95-14 Susceptibility of Containment Sump Recirculation Gate Valves to Pressure 

Locking 

1995 IN 95-11 Failure of Condensate Piping Because of Erosion/Corrosion at a 

Flow-Straightening Device 

1995 IN 95-10, Supplement 1 Potential for Loss of Automatic Engineered Safety Features Actuation 

1995 IN 95-10 Potential for Loss of Automatic Engineered Safety Features Actuation 

1995 IN 95-09 Use of Inappropriate Guidelines and Criteria for Nuclear Piping and Pipe 

Support Evaluation and Design 

1995 IN 95-06 Potential Blockage of Safety-Related Strainers by Materials Brought Inside 

Containment 

1994 GL 94-02 Long-Term Solutions and Upgrade of Interim Operating 

Recommendations for Thermal-Hydraulic Instabilities in Boiling Water 

Reactors 

1994 IEB 93-02, Supplement 1 Debris Plugging of Emergency Core Cooling Suction Strainers 

1994 IN 94-82 Concerns Regarding Essential Chiller Reliability During Periods of Low 

Cooling Water Temperature 

1994 IN 94-76 Recent Failures of Charging/Safety Injection Pump Shafts 

1994 IN 94-64 Reactivity Insertion Transient and Accident Limits for High Burnup Fuel 

1994 IN 94-60 Potential Overpressurization of Main Steam System 

B-3
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.)

GENERIC 

YEAR COMMUNICATION TITLE 

1994 IN 94-32 Revised Seismic Hazard Estimates 

1994 IN 94-27 Facility Operating Concerns Resulting from Local Area Flooding 

1994 IN 93-17, Revision 1 Safety Systems Response to Loss of Coolant and Loss of Offsite Power 

1994 IN 94-20 Common-Cause Failures Due to Inadequate Design Control and 

Dedication 

1994 IN 92-36, Supplement 1 Intersystem LOCA Outside Containment 

1994 IN 94-03 Deficiencies Identified During Service Water System Operational 

Performance Inspections 

1993 IEB 93-02 Debris Plugging of Emergency Core Cooling Suction Strainers 

1993 IN 89-077, Supplement 1 Debris in Containment Emergency Sumps & Incorrect Screen 

Configurations 

1993 IN 91-29, Supplement 2 Potential Deficiencies Found During Electrical Distribution System 

Functional Inspections 

1993 IN 93-99 Undervoltage Relay and Thermal Overload Setpoint Problems 

1993 IN 93-66 Switchover to Hot-Leg Injection Following a Loss-Of-Coolant Accident in 

Pressurized Water Reactors 

1993 IN 93-55 Potential Problem with Main Steamline Break Analysis for Main Steam 

Vaults/Tunnels 

1993 IN 93-46 Potential Problem with Westinghouse Rod Control System and 

Inadvertent Withdrawal of a Single Rod Control Cluster Assembly 

1993 IN 93-34, Supplement 1 Potential for Loss of Emergency Cooling Function Due to a Combination 

of Operational and Post-LOCA Debris in Containment 

1993 IN 93-34 Potential for Loss of Emergency Cooling Function Due to a Combination 

of Operational and Post-LOCA Debris in Containment 

1993 IN 93-28 Failure to Consider Loss of DC Bus in the Emergency Core Cooling 

System Evaluation May Lead to Nonconservative Analysis 

1993 IN 93-17 Safety Systems Response to Loss of Coolant and Loss Of Offsite Power 

1993 IN 93-13 Undetected Modification of Flow Characteristics in the High Pressure 

Safety Injection System 

1993 IN 93-11 Single Failure Vulnerability of Engineered Safety Features Actuation 

Systems 

1992 GL 92-04 Resolution of the Issues Related to Reactor Vessel Water Level 

Instrumentation in BWRs Pursuant to 10 CFR 50.54(f) 

1992 GL 92-03 Compilation of the Current Licensing Basis: Request for Voluntary 

Participation in Pilot Program

B-4
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.) 

GENERIC 

YEAR COMMUNICATION TITLE 

1992 GL 92-01, Revision 1 Reactor Vessel Structural Integrity, 10 CFR 50.54(f) 

1992 IN 92-74 Power Oscillations at Washington Nuclear Power Unit 2 

1992 IN 92-71 Partial Plugging of Suppression Pool Strainers at a Foreign BWR 

1992 IN 91-29, Supplement 1 Deficiencies Identified During Electrical Distribution System Functional 

Inspections 

1992 IN 92-65 Safety System Problems Caused by Modifications That Were Not 

Adequately Reviewed and Tested 

1992 IN 91-52, Supplement 1 Nonconservative Errors in Overtemperature Delta-temperature (OT Delta 

T) Setpoint Caused by Improper Gain Settings 

1992 IN 92-41 Consideration of the Stem Rejection Load in Calculation of Required 

Valve Thrust 

1992 IN 92-21 Spent Fuel Pool Reactivity Calculations 

1992 IN 92-02, Supplement 1 ReIap5/Mod3 Computer Code Error Associated with the Conservation of 

Energy Equation 

1992 IN 92-02 ReIap5/Mod3 Computer Code Error Associated with the Conservation of 

Energy Equation 

1991 GL 91-13 Request for Information Related to the Resolution of Generic Issue 130, 

"Essential Service Water System Failures at Mufti-unit Sites," Pursuant to 

10 CFR 50.54(f) 

1991 GL 91-06 Resolution of Generic Issue A-30, "Adequacy of Safety-Related DC Power 

Supplies," Pursuant to 10 CFR 50.54(f) 

1991 IN 91-75 Static Head Corrections Mistakenly Not Included in Pressure Transmitter 

Calibration Procedures 

1991 IN 91-69 Errors in Main Steam Line Break Analyses for Determining Containment 

Parameters 

1991 IN 91-50 A Review of Water Hammer Events after 1985 

1991 IN 91-29 Deficiencies Identified During Electrical Distribution Systems Functional 

Inspections 

1991 IN 91-12 Potential Loss of Net Positive Suction Head of Standby Liquid Control Sys 

Pumps 

1991 IN 91-11 Inadequate Physical Separation and Electrical Isolation of Non-Safety 

Related Circuits from Reactor Protection System Circuits 

1990 GL 90-06 Resolution of Generic Issue 70, "Power-Operated Relief Valve and Block 

Valve Reliability," and Generic Issue 94, "Additional Low-Temperature 

Overpressure Protection for Light-Water Reactors," Pursuant to 10 CFR 

50.54(f) (Generic Letter)

B-5
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.)

GENERIC 

YEAR COMMUNICATION TITLE 

1990 GL 90-04 Request for Information on the Status of Licensee Implementation of 

Generic Safety Issues Resolved with Imposition of Requirements or 

Corrective Actions 

1990 GL 89-13, Supplement 1 Service Water System Problems Affecting Safety-Related Equipment 

1990 IN 90-78 Previously Unidentified Release Path from Boiling Water Reactor Control 

Rod Hydraulic Units 

1990 IN 88-23, Supplement 3 Potential for Gas Binding of High-pressure Safety Injection Pumps During 

a Loss-Of-Coolant Accident 

1990 IN 89-30, Supplement 1 High Temperature Environments at Nuclear Power Plants 

1990 IN 90-64 Potential for Common-mode Failure of High Pressure Safety Injection 

Pumps or Release of Reactor Coolant Outside Containment During a 

Loss-Of-Coolant Accident 

1990 IN 90-61 Potential for Residual Heat Removal Pump Damage Caused by Parallel 

Pump Interaction 

1990 IN 90-53 Potential Failures of Auxiliary Steam Piping and the Possible Effects on 

the Operability of Vital Equipment 

1990 IN 90-26 Inadequate Flow of Essential Service Water to Room Coolers and Heat 

Exchangers for Engineered Safety-Feature Systems 

1989 GL 89-22 Potential for Increased Roof Loads and Plant Area Flood Runoff Depth at 

Licensed Nuclear Power Plants Due to Recent Change in Probable 

Maximum Precipitation Criteria Developed by the National Weather 

Service 

1989 GL 89-21 Request for Information Concerning Status of Implementation of 

Unresolved Safety Issue (USI) Requirements (Generic Letter) 

1989 GL 89-19 Request for Action Related to Resolution of Unresolved Safety Issue A-47 

"Safety Implication of Control Systems in LWR Nuclear Power Plants" 

Pursuant to 10 CFR 50.54(f) 

1989 GL 89-18 Resolution of Unresolved Safety Issue A-1 7, "Systems Interactions in 

Nuclear Power Plants" 

1989 GL 89-16 Installation of a Hardened Wetwell Vent 

1989 GL 89-13 Service Water System Problems Affecting Safety-Related Equipment 

1989 GL 89-11 Resolution of Generic Issue 101 "Boiling Water Reactor Water Level 

Redundancy" 

1989 IN 89-81 Inadequate Control of Temporary Modifications to Safety-Related Systems 

1989 IN 89-77 Debris in Containment Emergency Sumps and Incorrect Screen 

Configurations

B-6
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.)

GENERIC 

YEAR COMMUNICATION TITLE 

1989 IN 89-71 Diversion of the Residual Heat Removal Pump Seal Cooling Water Flow 

During Recirculation Operation Following a Loss-Of-Coolant Accident 

1989 IN 89-68 Evaluation of Instrument Setpoints During Modifications 

1989 IN 89-63 Possible Submergence of Electrical Circuits Located above the Flood 

Level Because of Water Intrusion and Lack of Drainage 

1989 IN 89-55: Degradation of Containment Isolation Capability by a High-Energy Line 

Break 

1989 IN 89-54 Potential Overpressurization of the Component Cooling Water System 

1989 IN 89-50 Inadequate Emergency Diesel Generator Fuel Supply 

1989 IN 89-48: Design Deficiency in the Turbine-driven Auxiliary Feedwater Pump 

Cooling Water System 

1989 IN 88-75, Supplement 1 Disabling of Generator Output Circuit Breakers by Anti-Pump Circuitry 

1989 IN 89-36 Excessive Temperatures in Emergency Core Cooling System Piping 

Located Outside Containment 

1989 IN 88-86, Supplement 1 Operating with Multiple Grounds in Direct Current Distribution Systems 

1989 IN 89-30 High Temperature Environments at Nuclear Power Plants 

1989 IN 89-29 Potential Failure of ASEA Brown Boveri Circuit Breakers During Seismic 

Event 

1989 IN 89-28 Weight and Center of Gravity Discrepancies for Copes-Vulcan 

Air-Operated Valves 

1989 IN 89-26 Instrument Air Supply to Safety-Related Equipment 

1989 IN 89-16 Excessive Voltage Drop in DC Systems 

1989 IN 89-11 Failure of DC Motor-Operated Valves to Develop Rated Torque Because 

of Improper Cable Sizing 

1989 IN 89-08 Pump Damage Caused by Low-flow Operation 

1989 IN 88-23, Supplement 1 Potential for Gas Binding of High-Pressure Safety Injection Pumps During 

a Loss-Of-Coolant Accident 

1988 GL 88-15 Electric Power Systems - Inadequate Control over Design Processes 

1988 GL 88-14 Instrument Air Supply System Problems Affecting Safety-Related 

Equipment 

1988 GL 88-11 NRC Position on Radiation Embrittlement of Reactor Vessel Materials and 

its Impact on Plant Operations 

1988 GL 88-03 Resolution of Generic Safety Issue 93, "Steam Binding of Auxiliary 

Feedwater Pumps"

B-7
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.)

GENERIC 

YEAR COMMUNICATION TITLE 

1988 IEB 88-04 Potential Safety-Related Pump Loss 

1988 IN 88-94 Potentially Undersized Valve Actuators 

1988 IN 88-92 Potential for Spent Fuel Pool Draindown 

1988 IN 88-86 Operating with Multiple Grounds in Direct Current Distribution Systems 

1988 IN 88-80 Unexpected Piping Movement Attributed to Thermal Stratification 

1988 IN 88-76 Recent Discovery of a Phenomenon Not Previously Considered in the 

Design of Secondary Containment Pressure Control 

1988 IN 88-75 Disabling of Diesel Generator Output Circuit Breakers by Anti-Pump 

Circuitry 

1988 IN 88-74 Potentially Inadequate Performance of ECCS in PWRs During 

Recirculation Operation Following a LOCA 

1988 IN 88-72 Inadequacies in the Design of DC Motor-Operated Valves 

1988 IN 88-61 Control Room Habitability - Recent Reviews of Operating Experience 

1988 IN 88-60 Inadequate Design and Installation of Watertight Penetration Seals 

1988 IN 88-55 Potential Problems Caused by Single Failure of an Engineered Safety 

Feature Swing Bus 

1988 IN 88-50 Effect of Circuit Breaker Capacitance on Availability of Emergency Power 

1988 IN 88-45 Problems in Protective Relay and Circuit Breaker Coordination 

1988 IN 88-28 Potential for Loss of Post-LOCA Recirculation Capability Due to Insulation 

Debris Blockage 

1988 IN 88-01 Safety Injection Pipe Failure 

1987 GL 87-05 Request for Additional Information Assessment of Licensee 

Measures to Mitigate And/or Identify Potential Degradation of Mark I 

Drywells 

1987 GL 87-03 Verification of Seismic Adequacy of Mechanical and Electrical Equipment 

in Operating Reactors, Unresolved Safety Issue (USI) A-46 

1987 GL 87-02 Verification of Seismic Adequacy of Mechanical and Electrical Equipment 

in Operating Reactors, Unresolved Safety Issue (USI) A-46 

1987 IN 87-67 Lessons Learned from Regional Inspections of Licensee Actions in 

Response to IE Bulletin 80-11 

1987 IN 87-28, Supplement 1 Air Systems Problems at U.S. Light Water Reactors 

1987 IN 87-65 Plant Operation Beyond Analyzed Conditions 

1987 IN 87-63 Inadequate Net Positive Suction Head in Low Pressure Safety Systems

B-8
Partial Listing of Generic Communications 

Involving Design-Basis Issues (cont.)

B-9

GENERIC 

YEAR COMMUNICATION TITLE 

1987 IN 87-59 Potential RHR Pump Loss 

1987 IN 87-53 Auxiliary Feedwater Pump Trips Resulting from Low Suction Pressure 

1987 IN 87-50 Potential LOCA at High- and Low-pressure Interfaces from Fire Damage 

1987 IN 87-49 Deficiencies in Outside Containment Flooding Protection 

1987 IN 87-34 Single Failures in Auxiliary Feedwater Systems 

1987 IN 87-28 Air Systems Problems at U.S. Light Water Reactors 

1987 IN 87-10 Potential for Water Hammer During Restart of Residual Heat Removal 

Pumps 

1987 IN 87-09 Emergency Diesel Generator Room Cooling Design Deficiency 

1987 IN 87-06 Loss of Suction to Low-Pressure Service Water System Pumps Resulting 

from Loss of Siphon 

1987 IN 87-02 Inadequate Seismic Qualification of Diaphragm Valves by Mathematical 

Modeling and Analysis
Appendix C 

NRC Guidance in Defining Operability and 

Functional Capability, Resolving Degraded 

or Nonconforming Conditions, and Using 

Risk Assessment Techniques in 

Assessing Design-Basis Issues
Operability and Functional Capability 

The NRC Inspection Manual, Part 9900: 

Technical Guidance, "Operable/Operability: 

Ensuring the Functional Capability of a System 

or Component," defines several terms 

important to design-basis issues (DBIs). 

(1) Current Licensing Basis (CLB). That set of 

NRC requirements applicable to a specific 

plant, and a licensee's written 

commitments for assuring compliance with 

and operation within applicable NRC 

requirements and the plant-specific design 

basis (including all modifications and 

additions to such commitments over the 

life of the license) that are docketed and in 

effect. 

(2) Nonconforming Condition. A condition of 

an structure, system or component (SSC) 

in which there is failure to meet 

requirements or licensee commitments. 

(3) Operability. The Standard Technical 

Specifications (TS) define operable or 

operability as: "A system, subsystem, 

train, component, or device shall be 

OPERABLE or have OPERABILITY when 

it is capable of performing its specified 

function, and when all necessary attendant 

instrumentation, controls, electrical power, 

cooling or seal water, lubrication or other 

auxiliary equipment that are required for 

the system, subsystem, train, component, 

or device to perform its functions(s) are 

also capable of performing their related 

support function(s)." 

(4) Full Qualification. Full qualification constitutes 

conforming to all aspects of the CLB, 

including codes and standards, design 

criteria, and commitments. 

(5) Consequential Failure. A consequential 

failure is a failure of an SSC caused by a 

postulated accident within the design 

basis.

Operability and qualification are closely related 

concepts. However, the fact that a system is not 

fully qualified does not, in all cases, render that 

system unable to perform its specified function if 

called upon. The prompt determination of 

operability will result in decisions or actions 

pertaining to continued plant operation, while 

qualification or requalification becomes a 

corrective action goal. 

Operability determinations should be 

performed for those potential consequential 

failures [i.e., an SSC failure that would be a 

direct consequence of a design-basis event] 

for which the SSC in question needs to 

function. Where consequential failures would 

cause a loss of function needed for limiting or 

mitigating the effects of the event, the affected 

SSC is inoperable because it cannot perform 

all of its specified functions. Such situations 

are most likely discovered during design basis 

reconstitution studies, or when new credible 

failure modes are identified. 

In probabilistic risk assessment (PRA), the 

parameter of interest is equipment availability, 

not operability. The two terms have a different 

basis. Operability is related to licensing 

specifications, while availability is related to 

operational performance requirements. If 

licensing assumptions are input into PRA, the 

results may significantly overestimate risk. 

Resolution of Design-Basis Issues as 

Degraded and Nonconforming Conditions 

The NRC Inspection Manual, Part 9900: 

Technical Guidance, "Resolution of Degraded 

and Nonconforming Conditions," provides 

guidance to NRC inspectors on resolving 

degraded and nonconforming conditions 

affecting certain SSCs. This guidance 

indicates that upon discovery of an existing 

but previously unanalyzed condition that 

significantly compromises plant safety, the 

licensee shall report that condition in 

accordance with 10 CFR 50.72 and 50.73, and 

put the plant in a safe condition. Once a 

degraded or nonconforming condition has

C-1
been identified, Part 9900 provides the 

following: 

The license authorizes the licensee to operate 

the plant in accordance with the regulations, 

license conditions, and the TS. If an SSC is 

degraded or nonconforming but operable, the 

license establishes an acceptable basis to 

continue to operate and the licensee does not 

need to take any further actions. The licensee 

must, however, promptly identify and correct 

the condition adverse to safety or quality in 

accordance with 10 CFR 50, Appendix B, 

Criterion XVI (Corrective Actions). 

For SSCs that are not expressly subject to TS 

and that are determined to be inoperable, the 

licensee should assess the reasonable 

assurance of safety. If the assessment is 

successful, then the facility may continue to 

operate while prompt corrective action is 

taken. 

In its evaluation of the impact of a degraded or 

nonconforming condition on plant operation 

and on operability of SSCs, a licensee may 

decide to implement a compensatory measure 

as an interim step to restore operability or to 

otherwise enhance the capability of SSCs until 

the final corrective action is complete. 

Reliance on a compensatory measure for 

operability should be an important 

consideration in establishing the "reasonable 

time frame" to complete the corrective action 

process. NRC would normally expect that 

conditions that require interim compensatory 

measures to demonstrate operability would be 

resolved more promptly than conditions that 

are not dependent on compensatory measures 

to show operability, because such reliance 

suggests a greater degree of degradation. 

Similarly, if an operability determination is 

based upon operator action, NRC would 

expect the nonconforming condition to be 

resolved expeditiously. 

The licensee may make mode changes, 

restart from outages, etc., provided that 

necessary equipment is operable and the

degraded condition is not in conflict with the 

TS or the license. 

The responsibility for corrective action rests on 

the licensee. A licensee's range of corrective 

action could include (1) full restoration to the 

SAR-described condition, (2) NRC approval 

for a change to its licensing basis to accept 

the as-found condition as is, or (3) some 

modification of the facility other than 

restoration to the original FSAR condition. 

Strengths and Limitations of Assessment 

Methodologies for Design-Basis Issues 

Design-basis issues should be evaluated 

using analyses that are traditional 

(deterministic) and risk-based (PRA). Each of 

these analysis methodologies have flaws 

which may both underestimate or overestimate 

the end result. The confidence level in each 

method is highly dependent upon the data 

available, the scope and depth of the models, 

and the understanding of the users. The 

analyses results in both instances should be 

reviewed for accuracy and soundness, with a 

full understanding of their strengths and 

limitations. 

In SECY-98-144, "White Paper on Risk

Informed and Performance-Based Regulation," 

dated June 22, 1998, defines risk as a "risk 

triplet" composed of three questions, (1) What 

can go wrong?, (2) How likely is it?, and 

(3) What are the consequences? The traditional 

definition of risk, that is, probability times 

consequences, is fully embraced by the triplet 

definition of risk. The first question, "What can 

go wrong?" is usually answered in the form of 

a "scenario" (a combination of events and/or 

conditions that could occur) or a set of 

scenarios. The second question, "How likely is 

it?" can be answered in terms of the available 

evidence and the processing of that evidence 

to quantify the probability and the uncertainties 

involved. The third question, "What are the 

consequences?" can be answered for each 

scenario by assessing the probable range of

C-2
outcomes given the uncertainties. The 

outcomes are the "end states" of the analyses. 

The current body of regulations, guidance and 

license conditions is based largely on a 

"deterministic" approach. As described in the 

PRA Policy Statement, the deterministic 

approach to regulation establishes 

requirements for engineering margin and for 

quality assurance in design, manufacture, and 

construction. In addition, it assumes that 

adverse conditions can exist and establishes 

a specific set of design basis events (i.e., what 

can go wrong?). The deterministic approach 

involves implied, but unquantified, elements of 

probability in the selection of the specific 

accidents to be analyzed as design basis 

events. It then requires that the design include 

safety systems capable of preventing and/or 

mitigating the consequences (i.e., what are the 

consequences?) Of those design basis events 

in order to protect public health and safety. 

Thus, a deterministic approach explicitly 

addresses only two questions of the risk 

triplet. 

A probabilistic approach to regulation considers 

risk in a more coherent, explicit, and quantitative 

manner. The probabilistic approach explicitly 

addresses a broad spectrum of initiating events 

and their event frequency. It then analyzes the 

consequences of those event scenarios and 

weights the consequences by the frequency, 

thus giving a measure of risk. 

A "risk-informed" approach to regulatory 

decision-making represents a philosophy 

whereby risk insights are considered together 

with other factors to establish requirements 

that better focus licensee and regulatory 

attention on design and operational issues 

commensurate with their importance to health 

and safety. 

A "risk-based" approach to regulatory 

decision-making is one in which a safety 

decision is solely based on the numerical 

results of a risk assessment. This places 

heavier reliance on risk assessment results

than may currently be practicable. Note that 

the Commission does not endorse an 

approach that is "risk-based"; however, this 

does not invalidate the use of calculations to 

demonstrate compliance with certain criteria, 

such as dose limits. 

As stated in Part 9900, "Probabilistic risk 

assessment is a valuable tool for the relative 

evaluation of accident scenarios while 

considering, among other things, the 

probabilities of occurrence of accidents or 

external events. The definition of operability 

states, however, that the SSC must be 

capable of performing its specified function(s). 

The inherent assumption is that the 

occurrence conditions or event exists and that 

the safety function can be performed. The use 

of PRA or probabilities of the occurrence of 

accidents or external events is not acceptable 

for making operability decisions. However, 

PRA is a useful tool for determining the safety 

significance of SSCs. The safety significance, 

whether determined by PRA or other analyses, 

is a necessary factor in decisions on the 

appropriate 'timeliness' of operability 

determinations." 

Probabilistic risk assessment, like other 

disciplines, has a number of identifiable 

strengths and limitations. The strengths tend 

to be related to the fact that a PRA provides a 

rigorous, detailed means of addressing the 

complex issues of risk and reliability. The 

limitations are primarily related to the 

uncertainties which are inherent in many of the 

supporting disciplines. Utilization of PRA 

results can be effectively accomplished by 

application of PRA in those areas which most 

closely related to its strengths. However, 

useful information can also be gained in areas 

where PRA is limited, as long as those 

limitations are considered when interpreting 

the significance of that information. By fully 

recognizing the strengths and limitations, PRA 

analysts can attempt to capitalize on the 

strengths and address the limitations. In this 

respect it may be true that the nature of the 

limitations, in an absolute sense, is not as

C-3
important as the recognition of those 

limitations. 

Traditional PRAs are good at (1) identifying 

important accident sequences, and (2) 

identifying important equipment failures and 

human errors. Traditional PRAs are not so 

good at (1) absolute numbers, (2) human 

errors of commission, (3) design and 

construction errors, (4) low power or shutdown 

conditions, and (5) partial failures of SSCs. 

A wide range of PRA capability exists in the 

industry. While some licensees have the

capability to predict the risk involved with 

future plant maintenance activities and 

outages, and also the capability to evaluate 

the risk significance of past plant 

configurations (on-line risk monitors), others 

do not. The scope and quality of the 

engineering analyses (including traditional and 

probabilistic analyses) conducted should be 

based on the as-built and as-operated and 

maintained plant, including the reflection of 

operating experience at the plant to reduce 

uncertainties in the data and analyses results.

C-4
Appendix D 

Significant 1997 Safety System 

Engineering Inspection Findings
Significant 1997 Safety System Engineering Inspection Findings

Plant Design Findings Contained In Report Forwarding Letter 

Arkansas Nuclear One The team identified an issue regarding excessive emergency feedwater (EFW) flowrates to a single steam generator. To reduce 

Unit 1 steam generator tube vibration crossflow velocity, Framatome Technologies, Inc. (FTI), in a 1991 report to ANO-1, recommended 

a maximum flow of 1500 gpm assuming both pumps are available and one steam generator is isolated. However, ANO-1 plant 

operating procedures have no provisions to monitor and preclude exceeding this limit. In May 1996, ANO-1 experienced a 

transient in which peak EFW flowrates of 1716 gpm were identified for a brief time. An analysis performed by FTI, together with 

the results of your staff's steam generator tube inspection performed during the last outage, suggest that there is no immediate 

operability concern. The NRR staff will review and evaluate the plant specific and potentially generic aspects of this issue. 

The team identified issues associated with an operability evaluation performed for the borated water storage tank flange removal 

which did not account for the installation of a foreign materials exclusion cover and did not adequately address radioactive 

releases rom the tank. 

Other findings included and inadequate evaluation for non-"Q" steam traps which, if failed, could significantly alter the EFW pump 

room environment; not periodically testing certain molded case circuit breakers; not establishing a basis for determining design 

requirements for the installation of instrument tubing and sensing lines that were found to be inadequately supported; inadequate 

control of some field-routed conduits; a vortexing calculation which did not account for instrument error, and discrepancies in the 

final safety analysis report. 

D.C. Cook Units 1 &2 Revisions made in 1992 to the emergency operating procedure for the manual swapover from the refueling water storage tank to 

the containment recirculation sump during a loss-of-coolant accident (LOCA) created a single failure vulnerability that potentially 

could have caused both trains of the centrifugal charging and safety injection pumps to be inoperable. 

Operational changes after 1988, permitted the plant to operate above the design basis ultimate heat sink temperature of 76 OF 

without your staff having performed a 10 CFR Part 50.59 evaluation, and without considering the impact this would have on overall 

plant operation. As a result, an apparent unreviewed safety question and unanalyzed condition was created in 1988, when the 

plant operated for 22 days with an averaged ultimate heat sink temperature of 81 OF, creating the potential for safety-related 

equipment in the control room to not perform its safety function under design basis assumptions. 

The licensee documented in a letter to the NRC, dated December 29, 1978, containment sump enhancement modifications that 

consisted of installing five 3/4-inch vent holes in the roof of the containment recirculation sump. However, the updated final safety 

analysis report (UFSAR) was not updated to reflect these changes, and the vent holes were in excess of the 1/4-inch sump 

particulate retention design basis value. In addition, these vents were sealed in 1996 and 1997 without performed a 10 CFR Part 

50.59 evaluation, and without an adequate understanding of the commitment made to the NRC to maintain vents in the 

containment recirculatlon sump.

D-1
Significant 1997 Safety System Engineering Inspection Findings (cont.)

Plant Design Findings Contained In Report Forwarding Letter 

D.C. Cook Units 1&2 During the Unit 2 1996 refueling outage, both component cooling water (CCW) and emergency service water (ESW) trains were 

(Continued) removed from service contrary to the assumptions contained in Chapter 9 of the UFSAR, with the intention by your staff of 

performing a dual CCW/ESW train outage. Although the dual train outage was not fully sustained as originally planned by your 

staff, this operational condition would have placed the plant at increased risk, outside of its design basis, and in an unanalyzed 

condition. 

Although [most] items listed above had been known and documented by your staff, no apparent effective action was taken to 

correct the problems or their root causes. The team concluded that a contributing cause to these issues and others identified in 

the enclosed report was that prior to this inspection, your staff had an apparent lack of understanding of what constitutes the 

plant's design basis, the role of the UFSAR, and how each of these are affected by 10 CFR Part 50.59. 

The team also identified examples involving: (1) failure to account for instrument bias and establish the proper refueling water 

storage tank (RWST) and containment level setpoints necessary to preclude premature manual RWST switchover and subsequent 

potential vortexing in the containment, (2) failure to remove fibrous insulation materials from containment cable trays, that could 

potentially be swept into and block in excess of the design value of 50 percent of the containment recirculation sump screen area, 

and (3) the creation of a common-mode failure vulnerability that could potentially clog redundant trains of emergency core cooling 

system (ECCS) throttle injection valves and containment spray nozzles. 

On September 8, 1997, your staff initiated a dual unit shutdown, and Issued a notification of an unusual event (NOUE), as a result 

of the inability to demonstrate to the team that the ECCS system would have performed its safety function during post-LOCA 

conditions under all postulated accident scenarios. On September 19, 1997, the NRC issued a confirmatory action letter listing 

many of the issues identified during this inspection. 

Cooper The team identified that the design change to the reactor equipment cooling (REC) system for the installation of the filter 

demineralizer In 1991, the associated safety analysis, and the operating procedure did not address the importance of maintaining 

water inventory in the closed REC system. The REC system would not have been able to support its long-term cooling functions 

in the event of a design basis accident, because the minimum available volume of water in the surge tank would have been 

depleted within a day through the sampling valves that were left open apparently since the modification was installed in 1991. 

Your staff isolated the sampling valves, notified the NRC of the condition, and issued LER 97-014 on December 12, 1997, which 

identified the cause as a failure to understand the design basis functions of the system. 

Although many calculations reviewed by the team were satisfactory, the team noted that nonconservative assumptions and design 

inputs were used in the calculations for estimating the residual heat removal (RHR) pump room temperature and for verifying the 

capability of the service water (SW) system to provide adequate back-up cooling for safety-related equipment in the REC system. 

A night order was issued to secure one of the RHR pumps if the fan coil unit in that room becomes inoperable, and SW back-up 

cooling calculation was revised.

D-2
Significant 1997 Safety System Engineering Inspection Findings (cont.)

Design Findings Contained In Report Forwarding Letter

Cooper 

(Continued)

The team identified some weaknesses in the design process and installation of the systems. For example: reverse flow testing of 

check valves DH81 and DH82 on the two low-pressure injection pump suction lines from the borated water storage tank (BWST) 

and seat leakage testing of stop check valves HP32 and HP 32 on the high-pressure injection pump recirculation lines were not 

done; and although your staff had identified the deterioration of the BWST level transmitter support hardware in 1994, no action 

was taken to remove, examine, and replace the hardware until the inspection team expressed its concern on the condition of the 

supports. The team referred to NRR staff for evaluation the issue of the acceptability of the use of normally open safety-related 

valves as safety class interface between the high-pressure injection system and local pressure gauges that were not seismically 

qualified.

D-3

T

1

Plant

The 10 CFR 50.59 safety evaluation that was performed for the updated safety analysis report (USAR) revision to increase the 

residual heat removal service water (RHRSW) booster pump room temperature limit to 131 °F did not address the consequences 

of operator actions required during post-accident conditions to prevent exceeding this temperature limit. 

The effects of failure of air pressure regulators in the instrument air system on air operated valves had not been evaluated. At the 

exit meeting, we urged you to expedite this investigation and promptly perform operability evaluations as required. 

Previous NRC inspections had identified weaknesses In factoring instrument uncertainties into test acceptance criteria and 

operating procedures. The team noted that the procedure for monitoring SW temperature and the surveillance test procedure for 

RHR pumps did not consider applicable Instrument uncertainties. 

The team also identified other issues, such as: weaknesses in performance monitoring of RHR and REC heat exchangers; and 

inadequate reportability review of a deficiency in the design of power sources to RHR heat exchanger vent valves; not including in 

operating procedures vendor recommended limitations on RHR pump operation at low flows; and not considering the potential for 

pumping post-accident leakage from ECCS to the radwaste system. In addition, the team has referred four issues identified in the 

report to the NRR staff for evaluation. 

The team noted several discrepancies in the USAR, technical specification, and system design criteria documents. The design 

criteria documents (DCD-13) for the RHR system contained several incorrect statements that were inconsistent with the current 

system design. 

Some of the deficiencies discussed above challenged the capability of the systems to perform their full design bases functions. 

The contributory causes for these deficiencies appear to be a lack of understanding of the design bases of the systems, use of 

nonconservative assumptions and design inputs in calculations, and not maintaining control over the configuration of the design 

bases reflected In various plant documents. Where appropriate, your staff took immediate corrective or compensatory actions to 

ensure system operability. For other issues, you have Initiated problem identification reports to address required corrective 

actions. Taking into consideration your immediate actions, the team concluded at the end of the inspection, that both systems 

were capable of performing their safety functions.

Davis-Besse

4
Significant 1997 Safety System Engineering Inspection Findings (cont.)

Plant Design Findings Contained In Report Forwarding Letter 

Davis-Besse Other issues identified by the team included updated safety analysis report discrepancies, weaknesses In periodic testing of 

(Continued) battery chargers, lack of testing of inverters, not including certain electrical components in the environmental qualification program, 

and not revising and installation detail drawing after modifying the actuators for decay heat removal cooler outlet and bypass 

valves. 

Diablo Canyon Units 1 &2 Two issues identified may represent potential unreviewed safety questions and an additional NRC evaluation is ongoing. One 

issue involves the single failure design of the component cooling water, auxiliary salt water (ASW), and the residual heat removal 

(RHR) systems. Because of the design of the electrical distribution system, these systems are operated with both trains cross

tied. The resultant single train systems are vulnerable to passive failure when cross-tied and to active failures when the trains are 

split. The second Issue involves the availability of the containment spray function during containment recirculation. Both issues 

were previously identified and evaluated by Pacific Gas and Electric Company (PG&E) staff. The evaluations resulted in 

compensatory administrative actions, which involved changing emergency operating procedures and assignment of manual 

functions to operating and emergency response staff. 

Issues were identified with the current ASW pump testing method that results in pump and heat exchanger unavailability. PG&E 

staff are pursuing changes to the current test method to improve system availability. Additionally, the ASW system supply path 

from the demusseling line is credited in the UFSAR since the single ASW intake bay screen is not seismically qualified. However, 

this alternate supply line is not being maintained or tested. PG&E's response to Generic Letter 89-13, "Service Water System 

Problems Affecting Safety-Related Equipment," and its actions to implement the maintenance rule did not resolve this issue. 

Some design calculation weaknesses were identified, although they did not affect the overall results of the calculations. They 

involved updating and control of calculations, and the use of nonconservative assumptions. In addition, the team identified 

discrepancies and inconsistencies in the updated final safety analysis report, procedures, design criteria memorandum, 

calculations, drawings, and other documents. 

Farley Units 1 and 2 The team had concerns with inadequate tornado missile protection of the turbine-driven auxiliary feedwater (TDAFW) pump vent 

stack and the exposed piping connections, level transmitter, electrical conduits and cables of the condensate storage tank (CST). 

The as-built plant configuration for these did not conform to the Farley design and licensing bases. In addition, the exhaust 

silencers for the diesel generators (including the station blackout diesels) were not protected against vertical and other non

horizontal missiles. The NRR staff will review this issue associated with the diesel generators to determine whether the tornado 

missile protection in the Farley Unit 1 and 2 design and licensing bases included missile spectra other than horizontal missiles. 

Evaluations of plant modifications, conducted in accordance with 10 CFR 50.59, were generally adequate. However, the team 

identified certain examples of inadequate safety evaluations. For example, the 10 CFR 50.59 evaluation for a final safety analysis 

report change deleting the requirement for tornado missile protection for several CST piping connections did not identify a potential 

unreviewed safety question. Your staff evaluated this Issue, notified the NRC in accordance with 10 CFR 50.72, on February 27, 

1997, and implemented interim corrective actions to maintain the operability of the system until the issue can be resolved.

D-4
Significant 1997 Safety System Engineering Inspection Findings (cont.)

Plant Design Findings Contained In Report Forwarding Letter 

Farley Units 1 and 2 The team noted design control issues for calculations, as well as nonconservative assumptions and inputs in calculations. In 

(Continued) addition, the team identified discrepancies between the final safety analysis report and other documents, such as procedures, 

functional system descriptions, calculations, and drawings. 

Ginna Some discrepancies were identified regarding adherence of the systems to their design and licensing bases. For example, the 

team found that: the updated final safety analysis report had not been updated to reflect changes in the peak clad temperature 

calculated to occur during a design basis accident; certain safety related valves were not being tested to ensure functionality; and 

instructions in the Emergency Operating Procedures were not clear regarding the sequence of steps necessary to insure a 

successful post-loss-of-coolant accident switchover from Injection to recirculation. Also, the level of review of the loss-of-coolant 

accident analyses was found to be insufficient, as evidenced by several errors and inconsistencies identified by the team during 

the Inspection. 

Palisades The team identified deficiencies in the control and performance of calculations. These deficiencies involved not updating the 

calculations when analytical inputs were changed; errors in some calculations; failure to specify uncertainty values in instrument 

setpoint calculations; a calculation which contained inadequate analysis to support the conclusion; and a dc short circuit 

calculation issued without verifying all Input parameters or providing any conclusion on the acceptability of the dc system. 

The team identified many inconsistencies between the installed configurations of instrument tubing and the design basis in the 

component cooling water (CCW) and safety injection (SI) systems. As a result of these inconsistencies, the team had concerns 

with potential air entrapment into the instrument sensing lines for the high and low head SI flow transmitters. 

The team had questions on some calculations for which the adequacy of the design basis could not be verified. For example, no 

analysis was available to demonstrate that the dc loads would operate at the minimum battery voltage stated in the final safety 

analysis report; no analysis was available to demonstrate adequate ac voltage at the 120 volt safety-related loads; and no analysis 

was available to demonstrate that the battery could carry all required dc loads during a design-basis accident with the battery 

chargers cross-connected. 

Perry Unit 1 The team identified three examples where the facility was being operated or maintained differently than described in the updated 

safety analysis report (USAR) or in vendor's design input information. Two of these examples were not supported by a written 

safety or engineering evaluation. The first example involved continuous operation of the suppression pool cleanup system and the 

second example related to the improper setting of the governor speed droop for the division Ill emergency diesel generator. 

These examples have a direct impact on the high-pressure core spray (HPCS) system performance. The third example, 

determined by the NRC to be a potential unreviewed safety question, resulted from an inadequate 10 CFR 50.59 safety evaluation 

for a change involving early use of operator action to fill the emergency core cooling system surge tank in a post loss-of-coolant 

accident environment.

D-5
Significant 1997 Safety System Engineering Inspection Findings (cont.)

Plant Design Findings Contained In Report Forwarding Letter 

Perry Unit 1 The team noted design program weaknesses, including updating and control of calculations, and nonconservative assumptions 

(Continued) and inputs to calculations. In addition, the team identified discrepancies and inconsistencies in the USAR, procedures, system description manuals, calculations, drawings, and other documents. 

The team identified concerns with tornado missile protection of the HPCS and reactor core isolation coolant suction piping from the 

condensate storage tank and protection of the condensate storage tank level Instrumentation tubing. The existing plant 

configuration for this equipment did not conform to the licensing basis described in the USAR. The current plant design and initial 

evaluation of the team's findings used a probability approach, which differed from the licensing basis described in the USAR and 

the NRC's safety evaluation report (NUREG-0887). This is considered to constitute a potential unreviewed safety question. 

H.B. Robinson Unit 2 During the inspection, the team identified a concem with the net positive suction head (NPSH) requirements within the safety 

injection (SI) and residual heat removal (RHR) pumps. A hydraulic analysis was performed subsequent to the inspection. You 

discovered a potential NPSH problem with SI pump C and reported it to the NRC in accordance with 10 CFR 50.72 on June 27, 

1997. Subsequently you identified actual NPSH problems with SI pumps B and C for a large break loss-of- coolant accident 

(LBLOCA) as stated in LER 97-08. You have undertaken several immediate corrective actions, including raising the refueling 

water storage tank level. The hydraulic analysis is still ongoing for the RHR pumps. 

You discovered as the result of the team's Inquiries that the redundant autostart cables for SI pumps A and C were routed in the 

same raceway in violation of your electrical separation criteria. You declared SI pump C inoperable, immediately placed the 

installed spare pump B in service, and implemented a modification to provide correct separation subsequent to this Inspection. You advised the NRC of this discrepancy in accordance with 10 CFR 50.72 on May 21, 1997. 

The team identified that you had not reported significant peak cladding temperature (PCT) changes as required by 10 CFR 50.46. 

Prior to the inspection you reported significant PCT changes for only the most limiting transient for all the evaluation models, 

whereas you should report them for the limiting transient of each evaluation model and its applications. The NRR technical staff is 

still evaluating a potential unreviewed safety question with regard to your commitments about the transfer to cold leg recirculation 

following a LBLOCA. 

The team found deficiencies with the improper slope of instrument sensing lines, the exclusion of the seismic uncertainty term in 

calculations for safe shutdown and accident mitigation instrumentation, and with verification of the closure capability of the 

accumulator isolation valves if a LOCA occurred while filling the accumulators. 

Weaknesses were also identified concerning updating and control of calculations, nonconservative design inputs and assumptions, 

and incorporating design bases into maintenance and test procedures. In addition, the team noted deficiencies and 

inconsistencies in the updated final safety analysis report, procedures, design basis documents, systems descriptions, 

calculations, drawings, and other documents.

D-6
Significant 1997 Safety System Engineering Inspection Findings (cont.)

Plant Design Findings Contained in Report Forwarding Letter 

St. Lucie Units 1 and 2 While none of the team's findings resulted in system inoperability, some errors made during the original plant design have reduced 

system operating margins. Of specific concern are the calculations which support operation of the component cooling water 

system. The current calculations for determining the temperature limit for the seawater intake to the component cooling water heat 

exchangers are nonconservative. Your interim actions to establish an 82 OF temperature limit on intake cooling water are 

adequate for the short term, but plant operation could be challenged by higher intake cooling water temperature that occur during 

the warmer months of the year. 

Three Mile Island Unit 1 Although many calculations reviewed by the team were satisfactory, the team identified design control weaknesses in the 

performance and control of calculations. In particular, the team noted the use of several nonconservative inputs and assumptions 

in the analysis for switchover of decay heat removal system (DHRS) pump suction from the borated water storage tank (BWST) to 

the reactor building sump under post-accident conditions. The plant was operated outside the design basis with potential for air 

entrainment in the emergency core cooling system pumps that could have rendered them inoperable. You evaluated this issue 

and concluded that the system was inoperable, notified the NRC in accordance with 10 CFR 50.72 on December 21, 1996, and 

revised operating procedures to resolve the problem. You also issued a licensee event report (LER 96-002 on January 20, 1997. 

The team identified that calculations were being performed in documents, such as memoranda, technical data reports, and plant 

engineering evaluation requests, that do not comply with your engineering procedures for calculations. For example, on the basis 

of a calculation in a memorandum, an incorrect decision was made not to test the check valves in the DHRS pump suction from 

the BWST to assure that the check valves are capable of preventing backflow from the reactor building sump. 

The team determined that the consequences of a letdown line break in the auxiliary building apparently had not been adequately 

evaluated. The team referred this issue to the technical review branch in the Office of Nuclear Reactor Regulation (NRR) staff for 

review regarding the extent to which TMI-1 was required to consider the effects of a letdown line break in the auxiliary building. 

The staff review concluded that the TMI-1 licensing basis for pipe breaks includes the postulation of full diameter breaks in the 

letdown line between the containment penetration and the breakdown orifice as described in Appendix 14A to the final safety 

analysis report (FSAR). Therefore, the design of safety-related equipment in the affected areas should consider the conditions 

resulting from these breaks. 

The team's other findings included: nonconservative assumptions and missing inputs in calculations for the makeup pumps and 

makeup tank; a potential unreviewed safety question in your evaluation of an FSAR change regarding the net position suction 

head for DHRS pumps; not periodically testing certain molded case circuit breakers; incorrect assignment of power supply to the 

makeup isolation valve; not initiating corrective actions in a timely manner for open items from your self-assessments of the two 

inspected systems; and discrepancies In the FSAR.

D-7
Significant 1997 Safety System Engineering Inspection Findings (cont.)

Plant

Vermont Yankee

Design Findings Contained In Report Forwarding Letter

First, the team identified several operability issues which required prompt corrective actions by your staff. For example, the team 

found that the nonsafety-related pressure regulator could result in loss of service water to the diesel generators. Also, the team 

questioned the operability of your residual heat removal (RHR) pumps with minimum pump flow considerably less than what the 

pump vendor recommended for continued operation. Additionally, the team raised concerns regarding the operability of the RHR 

pumps while in the torus cooling mode and the operability of the RHR heat exchangers on the basis of improperly performed tests. 

Your Initial corrective actions to address these issues were acceptable. 

Secondly, the team had concerns with your past resolution to several engineering issues such as operation of the unit with the 

torus temperature above the analyzed region and various discrepancies in the plant's technical specifications. In particular, we 

were concerned with your long-term resolution to operation of your RHR pump with less than recommended minimum pump flow 

during a design basis event. 

Based on the understanding of your current design bases efforts, the team concluded that it was unlikely that you would have 

uncovered some of the issues identified in this report. Based on the conversation at the exit meeting, we understand that your 

staff will be re-examining your design bases program.

Washington Nuclear One of the team's significant findings addresses a design deficiency that was Introduced during the modification of the automatic 

Project 2 depressurization system (ADS), inadvertently defeating the intended manual initiation of the system. Other significant issues 

involved the residual heat removal heat exchanger operability assessment based on data from faulty Instruments, and the 

potential for exceeding the ADS activator design pressure by initiating containment spray during past loss-of-coolant accident 

elevated containment temperatures. 

Many of the team's findings relate to your failure to keep the final safety analysis report updated. Examples are, the ADS wiring 

modification and the removal of the service water system keepfull pumps from service. Your design review documents were of 

uneven quality. For example, the residual heat removal document lacked important instrumentation and control information.

D-8
Appendix E 

Generic Plant System Groups
GENERIC PLANT SYSTEM GROUPS

For the purposes of analysis, the design-basis 

issues (DBIs) and their affected systems was 

recorded using one or more of the 26 generic 

reactor plant system groupings listed below. 

Each generic system group represents one or 

more similar or related reactor plant systems. 

Since there is no standardization of system

names amongst plants, a system group was 

chosen that best fit the actual plant system 

and its function. If the licensee did not specify 

the affected system, or the system specified 

did not fit into system groupings 1-25, the DBI 

system was labeled as system 26 (Other).

Table 1 System Groupings

System 

Number System Group Tile and Common System Titles 

1 Accident monitoring instrumentation (Plant protection system, engineered safety features actuation 

system, post-accident monitoring system) 

2 Auxiliary/emergency feedwater systems (Auxiliary/emergency feedwater system) 

3 Combustible gas control systems (Containment combustible gas control system, Emergency/standby 

gas treatment system) 

4 Component cooling water system (Closed/component cooling water system) 

5 Containment and containment isolation (Containment isolation control system, containment leakage 

control system, containment vacuum relief system, reactor containment building, primary 

containment/undetermined system, reactor building (BWR) 

6 Containment cooling systems (reactor building environmental control system, shield annulus retum 

and exhaust system, containment ice condenser/refrigeration system, containment spray system, 

containment fan cooling system, containment fan cooling system) 

7 Control room emergency ventilation system (control building/control complex environment control 

system) 

8 Emergency AC/DC power systems (Diesel cooling water system, diesel generator starting air system, 

medium-Voltage power system - Class 1 E, low-voltage power system - Class 1 E, instrument and 

uninterruptable power system - Class 1 E, DC power system - Class 1 E, emergency onsite power 

supply system, emergency onsite power supply building environmental control system 

9 Emergency core cooling systems (high pressure coolant injection system, high pressure core spray 

system, low pressure coolant injection system, low pressure core spray system, low pressure safety 

injection system, high pressure safety injection system, upper head injection, intermediate head 

injection) 

10 Engineered safety features instrumentation (engineered safety features actuation system, radiation 

monitoring system, integrated control system, feedwater/steam generator water level control system, 

reactor power control system, solid state control system/auxiliary logic control system, containment 

environmental monitoring system, anticipated transient without scram system) 

11 Essential compressed air system (essential air system) 

12 Essential service water system (essential service water system) 

13 Fire detection/suppression systems (fire detection system, fire protection system (water), fire 

protection system (chemical))

E-1
Table I System Groupings (continued) 

System Number System Group Title and Common System TIdles 

14 Isolation condenser system (isolation condenser system) 

15 Low temperature/overpressure protection (low temperature/overpressure system) 

16 Main steam isolation valves (main steam isolation valves) 

17 Primary reactor systems (control rod drive system, reactor coolant system, reactor recirculation 

system, reactor vessel system, pressurizer system, steam generating system) 

18 Radiation monitoring instrumentation (radiation monitoring system, incore/excore neutron monitoring 

system, leak monitoring system, containment environmental monitoring system) 

19 Reactor core isolation cooling systems (reactor core isolation cooling system) 

20 Reactor trip instrumentation (plant protection system, feedwater/steam generator water level control 

system, reactor power control system, incore/excore neutron monitoring system) 

21 Residual heat removal systems (residual heat removal system) 

22 Safety and relief valves (reactor coolant system, main/reheat steam system, automatic 

depressurization system) 

23 Spent fuel systems (fuel pool cooling and purification system, fuel building environmental control 

system) 

24 Standby liquid control system (standby liquid control system) 

25 Ultimate heat sink system (ultimate heat sink system) 

26 Other

E-2
NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER 

F2-89) (Assigned by NRC, Add Vol., Supp., Rev., 

NRCM 1102, and Addendum Numbers, If any.) 

3201. 3202 BIBLIOGRAPHIC DATA SHEET 

(See instrhctons on the reverse) NUREG-1275 

2. TITLE AND SUBTITLE Volume 14 

Causes and Significance of Design-Basis Issues at U.S. Nuclear Power Plants 3. DATE REPORT PUBLISHED 

MONTH YEAR 

November 2000 

4. FIN OR GRANT NUMBER 

5. AUTHOR(S) 

6. TYPE OF REPORT 

R.L. Lloyd, J.R. Boardman, S.V. Pullani Technical 

7. PERIOD COVERED (Inclusie Dates) 

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region. U.S. Nuclear Regulatory Commission, and mailing address; ifcontractor, 

provide name and rmailng address.) 

Division of Systems Analysis and Regulatory Effectiveness 

Office of Nuclear Regulatory Research 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (If NRC, type Same as above'; a conuactor, provide rr- ., 0 .m . USN.uc, . ea,,rR- .. ......... 

and mailing address-)

Same as 8. above.

10. SUPPLEMENTARY NOTES

11. ABSTRACT (200 words or less)

This report documents the results of a systematic and comprehensive study of design-basis issue trends and patterns following 

a limited review that began in early 1977 by the former Office for Analysis and Evaluation of Operational Data. The study 

provides insights from reported design-basis issues with respect to: (1) their causes, significant patterns within both the power 

reactor industry and power reactor systems, frequency trends, safety consequences, and risk significance; (2) the lessons that 

may be useful in assessing regulatory effectiveness of NRC's evolving inspection and plant performance assessment processes 

and the definition of plant design basis and; (3) regulatory burden implications related to NRC licensee event reporting 

requirements for design-basis issues. It is intended that the insights from this study assist NRC and industry ongoing efforts to 

make NRC's regulatory framework and oversight process more risk informed and performance based and to reduce 

unnecessary regulatory burden.

12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers in locating the report) 13. AVAILABILITY STATEMENT 

unlimited 

14. SECURITY CLASSIFICATION 

acronyms 

initialism s 

(u Page) l i 

nuclear terms 

unclassified 

nuclear phrases (This Report) 

nuclear facilities unclassified 

15. NUMBER OF PAGES 

16. PRICE

NRC FORM 335 (2-89) This form was electmroncally produced by Elite F-ederal Forms. Inc.
LpPrinted on recycled 

palR e rr 

Federal Recycling Program
UNITED STATES 

NUCLEAR REGULATORY COMMISSION 

WASHINGTON, D.C. 20555-0001

years