GO2-84-049, Responds to NRC Re Violations Noted in Insp Rept 50-397/84-18.Corrective Actions:Procedure PPM 1.3.9 Revised & Automatic Depressurization Sys Permissive Annunciator Trip Setpoint Changed

Responds to NRC Re Violations Noted in Insp Rept 50-397/84-18.Corrective Actions:Procedure PPM 1.3.9 Revised & Automatic Depressurization Sys Permissive Annunciator Trip Setpoint Changed

ML20097B338
Person / Time
Site:	Columbia
Issue date:	09/06/1984
From:	Sorensen G WASHINGTON PUBLIC POWER SUPPLY SYSTEM
To:	Bishop T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V)
References
GO2-84-0492, NUDOCS 8409140003
Download: ML20097B338 (8)

Text

3 Washington Public Power Supply System P.O. Box 968 3000 GeorgeWashington Way Richland, Washington 99352 (509)372-5000  ;

l Docket No. 50-397 September 6, 1984 G02-84-0492 g ,

U!

h?

Mr. T.W. Bishop, Director y(l

• x Division of Reactor Safety and Projects u 5 2.p U.S. Nuclear Regulatory Comission 5 -?9 g

Region V lii -?

1450 Maria Lane, Suite 210 m Walnut Creek, California 94596 1

Subject:

NUCLEAR PLANT N0. 2 LICENSE NO. NPF-21 NRC INSPECTION 84-18 June 6 - July 6,1984 The Washington Public Power Supply System hereby replies to the Notice of Violation contained in Appendix A of your letter dated August 7, 1984. Our reply, pursuant to your request, consists of this letter and Appendix A (attached).

After reviewing your concerns and the notice of violations, we conclude that the majority of problems noted result from various misunderstand-

. ings. The lifted lead / jumper procedures are entirely consistent with our previous position taken on the issue of jumper use. Although a minor conflict in plant procedures was discovered this in no way af-fected our response to, or deviated from, basic nuclear safety prac-tices. Our position on the use of lifted leads / jumpers was previously rev1ewed by NRC personnel and apparently found acceptable. The Supply System believes that WNP-2 personnel are capable and highly trained individuals who have shown the ability to identify and respond accord-ingly to situations involving nuclear safety practices. The Plant Operating Committee is chartered with reviewing each procedure to insure that nuclear safety concerns are adequately addressed. To date we feel this process has been successful. In this specific instance the Supply System feels that the surveillance procedures in question are consistent with basic safety poli::y, We will, however, endeavor to continually evaluate our performance and make refinements as necessary.

~

8409140003 840906 PDR ADOCK 05000397 0 PDR

/E-o/ \ \

( ; .

Mr. T. W. Bishop Page 2 NRC INSPECTION 84-18 In Appendix' A an explanation of the violations is presented along with an evaluation of the violation's validity, the corrective steps taken with results achieved' are outlined, and the dates of full compliance where applicable, are specified.

Should you have any questions concerning our response do not hesitate to contact me.

b G. C. Sorensen Manager, Regulatory Programs GCS:RLK:mm Attachment i

APPENDIX A As a result of the inspection, conducted during June, 1984, of activities authorized by NRC Operating License NPF-21 and in accordance with the provi-sions of NRC Enforcement Policy,10CFR2, Appendix C, the following violations were identified:

A. Notice of Violation Technical Specification 6.8.1 states that written procedures shall 'e o

established, implemented and maintained covering "The applicable proce-dures recommended in Appendix A of Regulatory Guide 1.33, Revision 2, February 1978" and "The applicable procedures required to implement the requirements of NUREG-0737". Regulatory Guide 1.33 states that typical safety related activities to be covered by written procedures include

" Bypass of safety functions and Jumper Control". NUREG-0737 item I.C.6.3 -

states that "Except in cases of significant radiation expc;ure, a second quali1fied person should verify correct implementation of equipment con-trol measures such as tagging of equipment". The WPPSS Procedure 1.3.9 contains implementing details of the above requirements and specifies that procedures "shall be used for all safety-related and non-safety-related systems". It allows that jumpers positively identified in ap-proved procedures are excluded from the requirements of this procedure.

To qualify for the exclusion, the other procedure must: "a. Clearly specify that the Shift Manager must be notified prior to installation and removal , b. The other procedure identifies the need for independent ver-ification of installation and removal, and e. The jumpers or lifted lead tags are controlled by the Shift Manager and are issued by him to the procedure used to control the work".

Contrary to the above, on June 25, 1984, Supply System technicians used procedure 7.4.3.3.1.44, which involved the installation of two jumpers, but the procedure did not " Clearly specify that the Shift Manager must be notified prior to installation and removal" nor did it identify "the need for independent verification of installation and removal". The Shift Manager was not notified prior to the installation or removal of the jumper and did not issue a jumper tag "to the procedure used to control the work". The jumpers were applied to the initiation logic of the engineered safeguard auto depressurization system.

This is a severity level IV violation (Supplement I).

Validity of Violation This violation notice involves three distinct issues. The first issue concerns notification of the Shift Manager prior to installation or re-

.noval of jumpers. Plant procedures require that the Shift Manager auth-orize (by signature) performance of ali surveillance test procedures with the exception of HP/ Chemistry procedures. This is obtained immediately -

prior to test performance. If, during performance of a test, it becomes apparent that the test may be interrupted and/or completion of the test delayed, the Shift Manager is notified. Upon completion of testing, the Shift Manager reviews the results and system status and again signs the procedure. The Shift Manager is knowledgeable of the surveillance and

?  : -

K this notification process providas the information required for jumper and/or lifted lead status. The Shift Manager authorized performance of this surveillance test and was knowledgeable of the jumper status, therefore no further notification was required.

[ The second issue involves independent verification of the installation PPM 1.3.9, Control of Electrical and Mechan-

E and removal of two jumpers.

ical Lifted Leads and Jumpers, paragraph 1.3.9.3.B.2.b, revision 4 dated i 12/22/83, states that the other procedure must " Identify the need for s independent verification of installation and removal (if required)". The intent of this exclusion is to provide the Shift Manager an option; he Z may or may not assign an independent verifier to the procedure activity.

E 6

The WNP-2 approach to independent verification of jumpers / lifted leads was outlined in the September 19, 1983 letter from J.W. Baker to J.D.

3 Martin. It stated that " Independent verification of these devices will

be required on the installation and removal for all safety related sys-g tems and fire protection where the work is not being done to an approved F procedure. Independent verification will not be required if the device L

is installed and removed and documented in an approved procedure". This approach was reviewed and concurred with by the NRC as documented in your

? report number 84-08, dated April 27, 1984. Installation and removal of the Jumpers in question was specified and documented in the surveillance

{y procedure and thus did not require independent verification.

The last item involves use of jumper tags. As the violation notice cor-rectly noted, no jumper tag was issued "to the procedure used to control the work". This resulted from contradictions in the exclusion conditions of PPM 1.3.9 (paragraph 1.3.9.3.B.2. , Condition e. ) which required the issuance of a jumper tag, thus defeating the intent of the other exclusions.

I Corrective Steps Taken/Results Achieved A deviation to PPM 1.3.9 has been approved to eliminate further confusion on the use of lifted lead / jumper tags during surveillances. PPM 1.3.9 no longer specifies lifted lead / jumper tag use when the exclusions specified under 1.3.9.3.B are met. The Supply System was in the process of review-ing INP0 Good Practice OP-202 when this event occurred and our corrective action followed the guidelines of OP-202. The procedure revision will be required reading for all Plant personnel. No further action is antici-pated on this issue.

Date of Full Compliance July 23,1984 i

B. Notice of Violation 10CFR50 Appendix B establishes requirements that apply to all activities affecting the safety-related functions of structures, systems and compo-nents; these activities incl ude ". . . te s ti ng , opera ti ng, maintaining, repairing. . . ." Criterion XVI of Appendix B requires, in part, that

" Measures shall be established to assure that condi tions adverse to quality, such as failures, malfunctions, deficiencies, . . . are promptly identi fied and corrected." WPPSS compliance with this requirement is '

reiterated in the WPPSS Operational Quality Assurance Program Description (WPPSS-QA-004) Section 16.2.1, as referenced in the FSAR Section 17.2.

Contrary to the above, between April 3, 1984 and July 2, 1984 the licensee failed to take prompt and effective corrective action for the mal function / deficiencies in the emergency core cooling system logic as-sociated with assuring i it low pressure coo,ing is functional prior to pemitting automatic depressurization of the reactor core, under certain design basis loss of cool ant conditions described in FSAR Section 7.3.1.1.1.1. On July 2, 1984 the reactor was at rated temperature and pressure with the LPCI pump running permissive signal cl osed (listed in q Technical Specification Table 3.3.3-1 items A.2.e and B.2.e), al though no q low pressure coolant injection pumps were actually runn4g. q This is a severity level IV violation (Supplement I).

Validity of Violation 10CFR50 Appendix B, Criterion XVI requires that corrective measures be i established and implemented to ensure prompt resol ution of conditions ]

adverse to quality. It also requires that the cause of the condition be I determined. This is fundamental to any problem solving process. The Supply System believes that prompt action was taken to first begin the J process necessary for determining the cause of the problem and secondly to implement the corrective action. In addition, an early assessment of j the situation detemined that the ADS initiation logic is not inoperable due to the condition reported since the initiation logic to start the low pressure systems is not derived from the confirmatory pump running in-struments and its condition would not prevent completion of an ADS actua-  ;

tion if required. This assessment was relied upon to allow continued plant operation but in no way impeded the prob'em solving process. At no time was the public health and safety or plant operations considered in jeopardy.

On April 2, 1984, MWR AY-4666 was issued by the Operations Department concerning the operation of the ADS pemissive annunciator with neither RHR-P-2B or 2C running. To assist in the problem resolution, the origi-nator of a1 MWR provides an assessment of the problem ano proposes a sol u tion. This information is useful but can be mi sl eadi ng if not coupled with a detailed evaluation of the problem. The MWR proposed a course of action which could not be confirmed as correcting the problem.

Therefore over the course of two weeks, data was collected and plant con-ditions monitored in an attempt to determine the cause of the annunciator activation when neither pump was running. On April 18, 1984, a Plant Modi fication Request was originated to initiate an engineering evaluation of the problem and recommend modi fications to the keep-filled system

. . . . . . . l

which would prsvide for pressure adjustment capability as it was believed that the water-leg pumps developed sufficient head to trip the ADS pres-sure switches. The Supply System on-site engineering organization pro-vided both IAC and System Engineering support to evaluate the problem.

The Technical Staff I&C Engineer was also enlisted to evaluate the set-point value, any setpoint drift data accumulated to date and was re-quested to provide any recommendations for instrument replacement, relo-cation, etc. The Reactor Engineering Supervisor was appraised of the situation and provided continuous guidance. In addition to the ADS in-strument's actuation under presumably low pressure conditions in the RHR system, the Hi/ Low Pressure annunciators were actuating occasionally on low pressure. This annunciation indicated that the RHR system wasn't pressurized sufficiently by the keepffiled pumps to clear the low pres-sure alarm but yet was pressurized high enough to cause the ADS pennis-sive to annunciate. This contradiction in information contributed to the time required to evaluate and resolve this issue. The aspects of the problem that were pursued included:

1. Determine if leakage out of the system was causing a low pressure condition, locate and repair.

2. Determine if a high pressure condition existed, locate the source and either adjust or isolate as appropriate.

3. Evaluate if the two sets of instruments provided an operating window that would yield neither ADS permissive nor RHR system low pressure annunciation. If not, determine a method to resolve, which could include instrument replacement, addition, or relocation, or trip setpoint revision.

The pursuit of these aspects required data collection, testing and time.

In the interim, operations was verbally notified that the RHR system pro-cedure should be followed which should have yielded a clear ADS permis-sive annunciator but will provide annunciation for low system pressure.

This was based on an early assessment of the situation and seemed to work. The Resident Inspector correctly points out that some inconsis-tency existed between operating crews in implementing this guidance. In retrospect, the notification should have been more substantial as not all operating crews rotating on-shift appeared to get the information and on occasion the ADS persmissive was found annunciated. An additional PMR was issued to document the evaluation for the Hi/ Low pressure annuncia-tion problem.

s The WNP-2 Nuclear Safety Assurance Group provided in the June of 1984 Monthly Operational Bulletin a review of OER 82066A ( IEN82 -10) . The review centered on the importance of identifying the root cause of a problem and the all-to-often tenaancy to correct symptoms versus the real problem. It was this type of systematic problem solving approach that was followed. Certainly an essential aspect of root cause identification is to take the time necessary to di scover the root cause. Premature action will only lead to correcting the symptoms. These activities de-scribed above, in keeping with the philosophy of sol ving the problem ra ther than eliminating the symptoms, account for the duration of time required to reach a resolution.

As mentioned earl ier, the ADS was not considered inoperable in the described situation (i.e.- pump running pemissive annunciator ac ti-va ted ) . This judgement was made based on the ADS logic, operator re-sponse actions, those automatic system actuations which also occur from condi tions that initiate ADS, and pressure switch operation observed at Technical Specification prescribed limits.

The pump runr:ing permissive contact is but one of four conditions needed to complete the ADS logic chain. Plant conditions must be such that high drywell pressure (? 1.68 psig), reactor low water level 1 (-129") and reactor low water level 3 ( +13" ) actuations have existed for approxi-mately 105 seconds (TDPU relay KSAA) before ADS will initiate, provided the pump running pemissive switch made up. High drywell pressure (1.68 psig) provides automatic ECCS pump start signal s , as does low reactor water level (-129"). WNP-2 Emergency Procedure 5.1.1 (RPV Level Control) directs plant operators to restore level using a variety of sources, in-cluding LPCI and LPCS, and to ini.ibit ADS if level can be maintained above -161 " . Thus two au toma ti c , as well as manual start signals are provided to insure that an ECCS pump is running. Also operators will not allow ADS to initiate unless either an LPCI or LPCS pump is running. The pump running pemissive contact being made up will not prevent ADS opera-tion and subsequent LPCI/LPCS makeup to the RPV.

Another consideration in our evaluation of this condition was an analysis of the accident scenario for which ADS would be used. The ADS is de-signed to operate and provide automatic depressurization of the reactor coolant pressure boundary (RCPB) in the event of small breaks in the RCPB. A reactor water low level 2 (-50") signal will isolate the main steam isola tion val ves (MSIV's). This action, in conjunction with the requirement for high drywell pressure means that the RCPB leakage must be within the primary containment. At this point several water supplies are available to maintain reactor pressure vessel (RPV) level (i.e.. Control Rod Drive (CRD) System, Reactor Core Isolation Cooling (RCIC) System and High Pressure Lore Spray (HPCS) Sys tem ) . Thus, before ADS would have been called on to initia te , CRD, RCIC and HPCS would have had to be unavailable or unable to compensate for the leakage.

MM MII M I "

n- ,,

, ' ~ ~. .

Corrective Steps Taken/Results Achieved The conclusion of the evaluation resulted in trip setpoint changes for both sets of instruments within the limits set forth by the WNP-2 Tech-nical Specifications. -It had been determined that the setpoint for the ADS permissive was very near the pressure produced by the keep-filled system and could be actuated if the RHR system leakage was sufficiently low. The low pressure _ sensing device has a reset band that is large enough to have prevented the keep-filled system from clearing the alarm with the previous setpoint. In essence, a pressure window within which to operate in a non-annunciated condition was not provided by the initial setpoints. The corrective action taken has provided the proper annunci-ator response and the problem is considered solved.

Additionally, when operating guidance for situations like this are neces-sary , the . information will be placed in the Night Orders instruction book. This will insure the necessary information is available to all operating crews.

It should be noted ti,at the need to follow up on alarm situations was also discussed in the Supply System's response to NRC inspection 84-15 and corrective action initiated at that time.

Date of Full Compliance July 12,1984 l

l-l I

l

. . _ - _ . - - _ _ ..-_.~ .- _ __... , _ _ _ _ _ __._.._ ._._ _ _ _ _