IR 05000255/1998007

Insp Rept 50-255/98-07 on 980413-1023.One Apparent Violation Be Considered for Escalated Enforcement Action.Major Areas Inspected:Review of Events,Circumstances & Licensee Investigation of TS Surveillance Refueling Test

ML18066A324
Person / Time
Site:	Palisades
Issue date:	11/12/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML18066A323	List: IR 05000255/1998007 ML18066A322
References
50-255-98-07, 50-255-98-7, NUDOCS 9811170210
Download: ML18066A324 (11)

Text

..

..

U.S. NUCLEAR REGULATORY COMMISSION Docket No:

License No:

Report No:

Licensee:

Facility:

Location:

Dates:

Inspectors:

Approved by:

9811170210 981112 PDR ADOCK 05000255 G

PDR REGION 111 50-255 DPR-20 50-255/98007 (DRP)

Consumers Energy Company 212 West Michigan Avenue Jackson, Ml 49201 Palisades Nuclear Generating Plant 27780 Blue Star Memorial Highway Covert, Ml 49043-9530 April 13, 1998, through October 23, 1998 J. Lennartz, Senior Resident Inspector P. Prescott, Resident Inspector Bruce L. Burgess, Chief Reactor Projects Branch 6

EXECUTIVE SUMMARY Palisades Nuclear Generating Plant NRC Inspection Report 50-255/98007 This special inspection was conducted to review the events, circumstances, and the licensee's investigation of the Technical Specification surveillance refueling test that rendered both trains of high pressure safety injection inoperable. The inspectors reviewed selective procedures and representative records, observed management review boards, and interviewed personne Operations

The inspectors concluded that licensee personnel aggressively pursued and identified the appropriate root causes for this incident. The licensee's incidence response team rigorously evaluated the incident and the identified corr~ctive actions were thoroug Multiple barriers to preclude performing an inadequate procedure failed for several years which contributed to the incident. Regulatory significance was high regarding the failure to perform safety reviews for procedure revisions that affected the high pressure safety injection system's safety analysis. The failure to perform adequate safety reviews for the procedure revisions resulted in the development of inadequate Procedure RT-71 Also, the failure to recognize Technical Specification implications contributed to the incident in that it allowed the inadequate procedure to be performed. The incident wa non-risk significant and had no actual safety consequences. Safety significance was high regarding the potential consequences in that emergency core cooling criteria regarding peak clad temperature would have been exceeded for a design based small break loss of coolant accident assuming no operator action. The inspectors noted that the required operator actions were not complex and could have been accomplished in a timely manner which would mitigate the potential consequences. (Section 01)

The crew's knowledge regarding the Technical Specification requirements associated with the high pressure safety injection system surveillance test was poor. Also, the crew demonstrated a poor questioning attitude regarding the test lineup and a lack of awareness regarding the relationship between the high pressure safety injection system manipulations_ that were performed and the purpose of the test. (Section 04)

..

Report Details Summary of Test Performance The following summarizes Technical Specification (TS) surveillance Refueling Test (RT) -71 B,

"High pressure safety injection (HPSI) Train 1 and 2 and safety injection tank (SIT) System, Class 2 System Functional/lnservice Test," that was performed on April 10, 1998:

The test's purpose was to verify HPSI system and SIT operability by demonstrating leak tightnes *

The test was divided into two parts. Part 1 tested system components outside containment and was allowed to be performed with the plant at power. Part 2 tested system components inside containment and was only allowed to be performed with the planf shutdow *

With the plant at 96 percent power, the "A" shift (nights) control room crew authorized performance of RT-718, Part 1 only, at time 0010 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> *

The system was aligned per the procedure and both HPSI pumps were started to supply a pressure source of approximately 1200 psia for the leak tes *

A pressure surge in the system after the HPSI pumps were started resulted in all four SIT pressure control valves (PCVs) opening momentarily which was not expected. The.

valves opened below their set pressure of 1300 psig due to a known problem with the control valve actuator springs. (The valve actuator springs had been previously *

scheduled and were subsequently replaced during the 1998 refueling outage).

• *

Opening of the SIT PCVs established a momentary flowpath of the 1200 psi a water to the SIT drain relief valve (RV) - 3161 which had a setpoint of 500 psig. Valve RV-3161 momentarily opened and relieved water to the quench tank, as designed, where it was *

containe *

Valve RV-3161 and all SIT PCVs subsequently reseated appropriatel *

The test was logged in the Shift Supervisors log at time 0415 hours0.0048 days <br />0.115 hours <br />6.861772e-4 weeks <br />1.579075e-4 months <br /> as being completed satisfactoril I. Operations

Conduct of Operations 01.1 _General Comments Operations management questioned the adequacy of Procedure RT-71 B because'of the HPSI system transient that resulted during the test. Operations management requested that the procedure sponsor, Engineering Programs, review the procedure. Engineering

..

personnel identified, on April 13, 1998, that both trains of HPSI were rendered inoperable for approximately 90 minutes during the test. The licensee appropriately reported the incident to the NRC as a 4-hour non-emergency report in accordance with 10 CFR 50.72(b)(2)(iii)(B), accident mitigation. Subsequently, the licensee appropriately reported the incident to the NRC in Licensee Event Report (LER) 98-00 Condition Report (CR) C-PAL-98-0578, "Valve Alignment During.RT-71 B Results in Both Trains of HPSI Being Inoperable," was generated and classified as "level one" because of the incident's high significance. The level one condition report required multi disciplinary evaluations. In addition, plant management formed an incident response team (IRT) to investigate the even.2 Investigation of Event By Licensee's Incident Response Team Inspection Scope (92701. 71707)

The inspectors conducted personnel interviews, observed management review boards, and reviewed selective portions of the following procedures and representative records: Technical Specification surveillance refueling test (RT) procedure, RT-71B, "HPSI Train 1 and 2 and SIT System, Class 2 System Functional/lnservice Test,"

Revision 3, dated 8/5/97, and the associated basis document, Revision 1 Condition Report C-PAL-98-0578, "Valve Alignment During RT-71 B Results in Both Trains of HPSI Being Inoperable" Design Basis Document - 2.02, "High Pressure Safety Injection System," Rev. 3 The licensee's investigation team's documented evaluation of C-PAL-98-0578 Palisades' Operating Requirements Manual, Standing Order 62, Revision 39, Section * Palisades' TSs 3.0.3, "Applicability," and 3.3, "Emergency Core Cooling System" Technical Specification surveillance inservice test procedure, Quarterly Operating (Q0)-19, "HPSI Pumps and ESS Check Valve Operability Test'.'

8..

Palisade*s LER 98-007, "High Pressure Safety Injection System lnoperability During TS Surveillance Test" Control room shift supervisor logs

_j Engineering analysis determination of risk signifi_cance, EA-PSA-RT-71 B 1 Final Safety Analysis Report Chapters 6, 7, and 14

Observations and Findings Regulatory Significance.

The licensee identified on April 13, 1998, during post implementation review of TS Surveillance Test RT-718, that both trains of HPSI had been rendered inoperable on April 10, 1998, for approximately 90 minutes. Plant management immediately formed an IRT to investigate the incident and aggressively pursued causes of the even Surveillance test procedure, RT-718, directed the operators to close the normally open HPSI cold leg injection orifice bypass valves (M0-3080 and M0-3081) and open the normally closed hot leg injection valves (M0-3082 and M0-3083). This aligned both

• trains of HPSI cold leg injection through the orifices in all four cold legs. The normal at power HPSI cold leg injection lineup bypassed the orifices. Consequently, the test lineup rendered both trains of HPSI inoperable due to the reduced flow through the cold leg In addition, both trains of HPSI were aligned to the single hot leg injection line simultaneously and therefore, were vulnerable to a single failure of the hot leg injection line. A hot leg injection line piping failure could divert enough flow out the break to prevent both trains of HPSI from performing their intended safety functio The IRT determined that Procedure RT-718 had been revised three times. In 1988, the.*

procedure (RT-74 at the time) was revised to manipulate the hot leg injection valves within the test. This was when the inappropriate HPSI system line-up was first introduced into the procedure. That revision was completed in accordance with the temporary change process as described in TSs that were in effect at the time. In 1991, the 1988 temporary change was incorporated as a permanent revision. In 1997, the procedure was revised to allow the test to be performed with the plant at power. The IRT identified that the 10 CFR 50.59 requirements were not met for each of the three revisions to RT-718. The 10 CFR 50.59 screening criteria failed to identify that the procedure revisions affected TSs and the final safety analysis report (FSAR).

Consequently, a 10 CFR 50.59 safety evaluation was not performed and re,sulted in the development of Procedure RT-718 that was inadequat The licensee determined that emergency core cooling peak cladding temperature performance criterion would have been exceeded, with no operator action, for the previously analyzed small break loss of coolant accident while in the test lineup. Also, the test lineup rendered both trains of HPSI vulnerable to a single failure in the hot leg injection piping. 1 O CFR Part 50, Appendix 8, Criterion V, requires that activities affecting quality be prescribed by procedures of a type appropriate to the circumstance CFR Part 50, Appendix 8, Criterion V, applies to Surveillance Procedure RT-71 Surveillance *Procedure RT-718 prescribed inservice testing, an activity affecting quality, for the HPSI system.. Procedure RT-718 was not appropriate for the circumstance in that it rendered both trains of HPSI inoperable and therefore is an apparent violation of 10

.CfR Part SQ, App_e_odix 8, Criterionv.___

.

(EEi 50-255/98007-01)

The IRT determined that the current 50.59 process would require a safety evaluation when a system alignment similar to this was included in a procedure revision. The

current process had improved computer search tools and therefore, the licensee concluded that it was unlikely that the errors made in 1988 and 1991 would be repeate The IRT attributed the failure to perform a safety review in 1997 to individual knowledge and performance weakne.sses when the procedure was revised to allow test performance while the plant was onlin Procedure RT-718 had been completed on six separate occasions between 1988 and 1998. From 1988 through 1996, the procedure was completed five times with the plant in hot shutdown. Technical Specifications required at least one HPSI train available while in hot shutdown. Consequently, both trains of HPSI may have been inoperable when required. The IRT concluded that it was unlikely that the HPSI trains were inoperable during the test while in hot shutdown due to the reduced decay heat requirements; however, the licensee did not perform any analysis fo validate that assumptio On April 10, 1998, the test was performed with the plant at power and rendered both HPSI trains inoperable. Technical Specification 3.3.4, required two operable HPSI pumps when the primary coolant system was greater than 325°F. One HPSI pump could be inoperable provided TS 3.3.2.c requirements were met. Technical Specification *

3.3.2.c allowed one inoperable HPSI pump for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> while at power. Therefore, the HPSI system configuration utilized during the test did not comply with TS requirement Technical Specification 3.0.3 applied and should have been entered. Technical Specification 3.0.3 required that action be initiated within one hour to place the plant in a

. condition that the applicable specification did not apply. With both trains of HPSI inoperable, TSs required that the plant be placed in cold shutdown within 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> On April 10, 1998, both HPSI trains were inoperable for 90 minutes and therefore a plant shutdown to cold shutdown should have been initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. However, licensee personnel involveo failed to recognize that the test aligned the HPSI system such that TS requirements were not complied with. Consequently, the inadequate procedure was performed and the required action to commence shutdown to cold shutdown within one hour did not occur. The system line-up was restored to normal following the test, and.

therefore the TS requirement to place the plant in cold shutdown within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> was fortuitously satisfie Risk Significance The IRT requested a probabilistic safety assessment (PSA) using the system configuration established during the surveillance test with the plant at 100 percent power. The licensee's safety assessment was documented in EA-PSA-RT71 B. The current PSA model and plant risk software were utilized along with EPRI PSA Application Guidelines. The licensee's PSA group calculated the core damage probability (CDP)

increase while HPSI was in the test lineup which was then compared to the PSA

Applications Guideline, Figure 4.3, "Quantitative Screening Criteria For Temporary Ch.ange..". Figure 4.3 indicated that a CDP increase of 1 E-5 was the threshold for potentially risk significant changes and changes below 1 E-6 were considered non-risk significant. Licensee PSA personnel determined that the CDP increase during the test was 1.94E-6 assuming no operator action which was just above the non-risk significant threshold.

The licensee's PSA gro"up also calculated an increase in CDP using a nominal human *

error probability of 1 E-02 for operator action. In this instance, the CDP increase during the test was 2.00E-8 which was well below the non-risk significant threshold. In addition, due to the uncertainty of human error probability, the licensee's PSA group calculated the CDP increase using a human error probability of 0.5. A human error probability of meant that there was a 50 percent chance that the operators would not restore the lineup. The resultant CDP increase during the test using a human error probability of was 9.69E-7, just below the non-risk significant threshold. The crew had discussed the necessary contingency actions to secure the surveillance test for a plant transient and *

the licensee concluded that it would be reasonable to assume that the operator action would be performed. Therefore, the licensee considered the human error probability of 0.5 as very conservative. The inspectors noted that the required operator actions were not extensive and agreed with the licensee's assumptio The IRT concluded that performance of RT-718 at power on April 10, 1998, was a non-risk significant event according to the PSA and the guidance provided by the EPRI PSA Applications Guideline. The inspectors and an NRC Senior Reactor Analyst reviewed the licensee's risk analysis and agreed with the licensee's conclusions. Also, the NRC Senior Reactor Analyst noted that the licensee's PSA was conservative in that a sensitivity calculation using a human error probability of 0.5 was also performe Safety Significance The IRT identified that the potential safety significance from a design basis accident perspective was much higher. Flow models of the HPSI system were run for two

.

situations. The first situation modeled the HPSI flow that would be seen for a short time during the "transition" from the normal HPSI lineup to the.test lineup. This "transition" required the cold leg injection orifice bypass valves (M0-3080, M0:-3081) to be closed prior to opening the hot leg injection valves (M0-3082, M0-3083). Consequently, there would be. reduced flow to the cold leg injection lines. This condition would have existed only for a couple of minutes. The second situation modeled the HPSI flow while in the--

test lineup with the hot leg injection valves open. This condition existed for the test duration of approximately 90 minutes. The IRT identified that 10 CFR 50.46, emergency core cooling peak cladding temperature criteria would have been exceeded if the previously analyzed design basis small break loss of coolant accident occurred during either situatio A break in the hot leg injection line was also modeled which was approximately 22 percent smaller than the design basis small break. A hot leg injection line break, while in the test lineup, would have also resulted in exceeding 10 CFR 50.46 peak cladding temperature criteria. Operator action to realign the system was not credited in any of the models. The IRT determined that emergency core cooling criteria would not have been exceeded, while in the test lineup, for other design basis accidents such as

• __. large break loss of coolant, main steam line break, and steam generator tube ruptur While the potential safety consequences were high, the IRT determined that there were no actual safety consequences from the event. There were no plant or system transients that required the HPSI system to perform its intended safety function during test

performance. Also, the operators were not challenged by any transients during the tes Root Cause and Corrective Actions The IRT determined that the root cause was a knowledge weakness in that engineering and operations personnel failed to recognize how the hot leg injection valve manipulations affected HPSI system operability. This knowledge weakness allowed the inadequate procedure to be performed. Several barriers associated with the procedure development, review, approval, scheduling, and implementation process failed. Also, an inadequate "questioning attitude" by all licensee personnel involved with the test demonstrated the need for further improvement in this area. Planned corrective actions to address the root cause included:

Training for licensed operators and engineers to improve operational decision makin *

Strengthen the surveillance procedure preparation proces *

Clarify and communicate performance standards to operations staff regarding understanding of integrated plant operations and decision makin In addition to the planned corrective actions, the inspectors noted that several immediate actions, as documented in C-PAL-98-578, were completed. Some examples included:

Surveillance Procedure RT-71 B was revise *

The HPSI system line-up was verified to be correc *

Additional surveillance procedures that were scheduled in subsequent weeks were reviewed to verify that the appropriate TS implications were identifie Performance of all safety related surveillances and special tests were stoppe until this review was complete *

An expert panel reviewed the surveillance procedures associated with the Auxiliary Feedwater and Emergency Diesel Generator systems to ensure that all.

• applicable TSs were appropriately addressed. No similar deficiencies were identifie *

Safety and Design Review personnel qualified to review 10 CFR 50.59 evaluations were trained in the performance failures that led to this even Conclusions The inspectors concluded that licensee personnel aggressively pursued and identified the appropriate root causes for this incident. The licensee's IRT rigorously evaluated the

,,.

incident and the identified corrective actions were thorough. Multiple barriers to preclude performing an inadequate procedure failed for several years which contributed to the incident. *Regulatory significance was high regarding the failure to perform safety reviews for procedure revisions that affected the HPSI system's safety analysis. The failure to perform adequate safety reviews resulted in the development of Procedure RT-71 B that was inadequat Also, the failure to recognize TS implications contributed to the incident in that it allowed the inadequate procedure to be performed. The incident was non-risk significant and had no actual safety consequences. Safety significance was high regarding the potential consequences in that emergency core cooling criteria regarding peak clad temperature would have been exceeded for a design based small break loss of coolant accident assuming no operator action. The inspectors noted that the required operator actions were not complex and could have been accomplished in a timely manner which would mitigate the potential consequence Operator Knowledge and Performance a. *

Inspection Scope The inspectors conducted personnel interviews and reviewed control room log books.

. Observations and Findings

Prior to performing the test, the on-shift crew identified that the test could not be performed as planned. It was originally schedule to be performed in parallel with a related surveillance. The on-shift crew noted that the test required both trains of HPSI to be started while the related surveillance required only one train to be started and therefore, the tests could not be performed in parallel. The test was rescheduled for a later date; however, neither the crew nor operations planning and scheduling personnel recognized the test inadequacies regarding TS and HPSI design basis implication The valves manipulated during the test were located inside of containment. However, only piping outside of containment was to be leak tested and the crew failed to question why valves inside of containment were manipulated for the. test. Also, the inspectors noted that the on-shift crew submitted a procedure change request following the test due to the system transient that was observed during the test. The procedure change request was to open the HPSI loop isolation valves slowly after the HPSI pumps were started to avoid the pressure surge that was experienced. This demonstrated that the crew failed to recognize that valves inside of containment were being manipulated unnecessarily to complete the test. The crew demonstrated a lack of awareness regarding the relationship between the system manipulations that were performed and the purpose of the tes The on-shift Control Room Supervisor and Shift Engineer did question why entry into TSs was not required during performance of the test. Based on these questions, they referenced TSs and a related HPSI system surveillance test. However, both crew members incorrectly concluded that the test lineup did not require entry into any TSs.

• Misinterpreting TSs and the related surveillance's failure to reference the appropriate TS contributed to the incorrect conclusions. Consequently, neither the Control Room Supervisor nor the Shift Engineer communicated their questions to the Shift Superviso This precluded the senior licensed crew member from providing any insights. The inspectors determined, based on interviews, that the Shift Supervisor had the same knowledge weakness regarding the TSs and therefore, may not have prevented the incident if consulte The crew's failure to recognize that both trains of HPSI were inoperable and in non-compliance with TSs during the test precluded a required entry into TS 3.0.3. Also, the crew failed to recognize that the HPSI system was vulnerable to a single failure in the hot leg injection piping during the test. This demonstrated poor knowledge of the TS implications and poor recognition of a single failure vulnerability for the HPSI system configuration utilized during the tes * Conclusions The crew's knowledge regarding the TS requirements associated with the HPSI surveillance test was poor. Also, the crew demonstrated a poor questioning attitude regarding the HPSI system surveillance test lineup and a lack of awareness regarding the relationship between the HPSI system manipulations that were performed and the purpose of the tes V. Management Meetings X1 Exit Meeting Summary The inspectors presented the inspection results to licensee management representatives during an exit meeting on August 21, 1998. On October 23, a re-exit was conducted to discuss a change in the inspection results and to convey to the licensee the details and circumstances regarding the apparent violation. The licensee acknowledged the findings and did not indicate that any material examined during the inspection should be considered proprietar.

PARTIAL LIST OF PERSONS CONTACTED Licensee R. A Fenech, Senior Vice President, Nuclear, Fossil, and Hydro Operations.

T. J. Palmisano, Site Vice President - Palisades G. R. Boss, Operations Manager B. M. Dusterhoft, Operations Condition Review Team Leader J. K. Ford, ~ngineering Programs Manager N. L. Haskell, Director, Licensing P. Harden, Safety/Design Review Supervisor C. S. Kozup, Licensing D. G. Malone, Licensing D.W. Rogers, General Manager, Plant Operations T. C. Watson, Training R. G. Schaaf, Palisades Project Manager, NRR IP 71707:

IP 92701:

OPENED INSPECTION PROCEDURES USED Plant Operations Followup ITEMS OPENED, CLOSED, AND DISCUSSED 50-255/98007-01 EE Inadequate Surveillance Test Procedl,!re CLOSED None Discussed None 11