IR 05000263/1988200
| ML20206K210 | |
| Person / Time | |
|---|---|
| Site: | Monticello  |
| Issue date: | 11/08/1988 |
| From: | Gutherie S, Hartmann P, Haughney C, Konklin J, Vanderneit C Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20206K199 | List: |
| References | |
| RTR-NUREG-0737, RTR-NUREG-737 50-263-88-200, IEB-86-064, IEB-86-64, NUDOCS 8811290314 | |
| Download: ML20206K210 (44) | |
Text
{{#Wiki_filter:. _ _ .
. . ' U.S.
NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION Division of Reactor Inspection and Safeguards - Report No.: 50-263/88-200 , Docket: 50-263 Lidensee: Northern States Power Company 414 Nicollet Mall
Minneapolis, Minnesota 55401 Facility Name: Monticello Nuclear Generating Station Inspection Dates: July 11-22, 1988 - Inspector: [[/d ' N/8'/W
- S.
Jruthrie,TeamLeader,DRIS,NRR 'Date EdY h a/thr P.L./ hartmann, SyJiior Resident Inspector 06te Akvb k ank ._
- C.V.
Vancerneit/' Resident Inspector Date ' Consultants:
- M.I.
Good (Comex Corporation)
- K.P.
Roberts (NEC)
- L.B.
Myers (Battelle, Columbus Laboratories)
- J.M.
McGhee (INEL) II/// ff
Reviewed by: T.VKonklin, Chief, Team Support and Date ~ }(tegration Section < u d;; O2 Approved by: %
- C.v. pa ghney Chief al Inspection Branch D(te r DRIS,8fiRR
- Attended Exit Meeting on July 20, 1938 hfkIffOCKot;Oco;3 31A SE'110 a
$3 PDC _ - -_.
__ _- _ - - - _ _ _ _ _ _ - - - - - - _ -___
-_-_________- _ __ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ - _ _ - . _______ _- - _ ____ __ _ __. _ _ _ _ _ _ _ _ _ _ _ _ -. - .
. . Scope An NRC inspection team performed a special, announced inspection to review the licensee's program for implementing Emergency Operating Procedures (EOPs) as required by NUREG-0737 Supplement 1.
The inspection effort was performed in accordance with TI 2515/92 and evaluated the program's compliance with approved vendur group generic guidelines, assessed the technical adequacy of the procedures for the plant specific application, validated specific portions of the E0Ps to determine their ability to be implemented under the anticipated environmental conditions and with the minimum shift complement, accessed operator training through simulator exercises, interviews, and plant walkthroughs, and evaluated human factor engineering of systems, operator ir.terfaces, and procedures.
Results: The inspection team concluded that, although there were deficiencies in the E0P
development and implementation processes that require prompt management attention, the existing E0Ps were technically correct and could be accom-plished in the plant by licensee operating shift personnel. The deficiencies noted during the inspection included (1) the absence of a formal program for E0P maintenance, including Quality Assurance involvement, (2) inadequate verification and validation of the C.5 - 3000 E0P Support Procedures (3) specific human factors deficiencies related to control room lighting and layout, (4) discrepancies in plant labeling and nomenclature used to identify plant components within the body of procedures, (5) inadequate verification of plant parameter data used in setpoint calculations, and (6) an apparent training deficiency related to operator use of support procedures outside the control room. The team concluded that the observed performance of a newly qualified individual shift supervisor in implementing E0Ps during simulator scenarios was sufficiently weak to constitute a safety concern. However, the team's concern was downgraded from a safety issue to identification of a programmatic weakness in the E0P training for newly qualified shift supervisors after conducting additional simulator observations of other operating crews.
With the involvement and concurrence of NRC Regional and Headquarters manage-ment the licensee immediately undertook the actions necessary to address the problem.
.
- . '. . Table of Contents PAGE 1.
OBJECTIVES.............................................
2.
BACKGROUND.............................................. i 3.
DETAILED INSPECTION FINDINGS............................
3.1 - Emergency Operating Procedure (EOP) Program Evaluation..
3.1.1 Procedure Generation Package (PGP) Review...............
, 3.1.2 Comparison of E0Ps to Emergency Procedures Guidelines...
- 3.1.3 Technical Adequacy Review of E0Ps..'.....................
c 3.1.4 Licensee Verification and Validation of E0Ps............
3.1.5 Licensee Response to IE Information Notice 86-64........
3.1.6 Containment Venting Procedures..........................
3.2 Simulator Validation of E0Ps............................
- 3.3 Walkthrough Validation of E0Ps..........................
g 3.4 Human Factors Yerification..............................
3.4.1 Adequacy of the PGP Writers Guide.......................
3.4.2 Implementation of the Writers Guide.....................
' 3.4.3 Flow Chart Review........................................
3.4.4 Control Room Support of E0Ps.............................
3.4.5 Human Factors Simulator Comments.........................
3.5 Calculation and Setpoint Veri fication...................
3.5.1 Net Positive Suction Head Curves and Calculations.......
3.5.2 Core Spray NPSH Curves and Calculations..................
3.6 Operator E0P Training Program...........................
3.6.1 E0P Training Scenarios...................................
3.6.2 E0P Support Procedure Training...........................
l 3.6.3 Operator Training on E0P Procedures......................
4.0 Management Exit Meeting..................................
, I Appendix A - Personnel Contacted.................................. A-1 Appendix B - Documents Reviewed................................... B-1 Appendix C - Listing of Calculations Reviewed...................... C-1 Appendix 0 - Detailed Comments From Walkthrough Inspections........ 0-1 Appendix E - E0P Validation Simulator Scenarios.................... E-1 < . I L i ! b ! { ! ! l e , - -.
. ' . . 1.
INSPECTION OBJECTIVES The inspection team conducted a review of the licensee's emergency operating procedures (EOPs), the operator E0P training program and evaluated operating shift performance of emergency scenarios in the simulator. The inspection was conducted following the guidelines of NRC Temporary Instruction (TI) 2515/92 "Emergency Operating Procedures Team Inspections." The objectives of the inspection were to: a.
Determine whether the E0Ps generally conformed to the Boiling Water Reactors Owners Group (BWROG) guidelines and were technically correct for the Monticello facility.
This objective included a determination that significant deviations from BWROG guidelines were based on adequate technical justifications.
b.
Verify that the E0Ps can be physically perfortned in the plant under the anticipated environmental conditions encountered during accidents and - assuming the minimum shift complement available.
c.
Verify that the plant operating staff was adequately trained to understand and properly perform the E0Ps.
2.
BACKGROUND Following the Three Mile Island (TMI) accident, the Office of Nuclear Reactor Regulation oeveloped the "THI Action Plan," (NUREG-0660 and NUREG-0737), which reautred licenseet of operating plants to reanalyze transients and accidents and to upgrade Emergency Operating Procedures (E0Ps) (Item I.C.1).
Tha plan also required the NRC staff to develop a long-tenn plan that integrated and expanded efforts in the writing, reviewing, and monitoring of plant procedures (ItemI.C.9). NUREG-0899, "Guidelines for the Preparation of Emergency Operating Procedures," represents the NRC staff's long-terin program for upgrading E0Ps, and describes the use of a Procedures Generation Package (PGP) to prepare E0Ps.
The licensees formed four vendor owners groups corresponding to the four major reactor vendor types in the United States: Westinghouse, General Electric Babcock & Wilcox, and Combustion Engineering. Working with the vendor company and the NRC, these owners groups developed generic procedures that set fourth the desired accident mitigation strategy.
For the General Electric plants, the generic guidelines are referred to as Emergency Procedure ' Guidelines (EPGs) which were to be used by licensees in developing their PGPs. Generic 1.etter 82-23. "Supplement 1 to NUREG-0737 - Requirements for Errergency Response Capability" required each licensee to submit to the NRC a PGP which included: a.
Plant Specific Technical Guidelines (PSTGs) with justification for safety significant differences from the EPGs.
b.
A Plant Specific Writer's Guide (PSWG).
c.
A description of the program to be used for the verification / validation of E0Ps.
.h - - - ~
.
. . d.
A description of the training program for the updated E0Ps.
Submittal of the PGP was made a requirement by a Confirmatory Order dated June 15, 1984. Plant specific E0Ps were to be developed that would provide
' the operator with directions to mitigate the consequences of a broad range of g accident and multiple equipmenc failures.
,
. , , , A 'representat'ive sample of E0Ps from each of the four vendor types have been ' selected for review by NRC teams from Regions I, II, !!!, and IV.
Emergency Operating Procedures for 13 additional plants with GE BWR Mark I containments were selected for review by teams from the NRC Office of Nuclear Reactor Regulation (NRR).
This inspection at the Northern States Power Corporation, Monticello Nuclear Generating Plant was one of the supplemental reviews , conducted by NRR.
3.
DETAILED INSPECTION FINDINGS l . > 3.1 Emergency Operating Procedure (EOP) Program Evaluation The inspection team reviewed the licensee's program for upgrading E0Ps in i accordance with Section 7 of NUREG 0737 (Supplement 1), "Upgrade Emergency ' Operating Procedures," to determine whether the intent of NUREG requirements
had been accomplished and whether proper documentation had been submitted to the NRC for review. The evaluation was based on a review of the licensee's program from the development of the Procedure Generation Package (PGP) through the implementation and use of the E0Ps. The evaluation included reviewing the , Flant Specific Technical Guidelines (PSTGs), the deviativt jcstification documentation, the writers guioe, and the E0Ps in both text and flowchart
forma ts.
In addition, the administrative control process for initiation, review, approval, and verification and validation of E0Ps and E0P changes was reviewed. The results indicated that while the program is generally in f con 411ance with the NUREG, no formal program had been implemented for all i aspects of E0P maintenance. The team concluded that a formal program for the administration of E0Ps and E0P support procedures would have prevented nany of the deficiencies identified during the inspection.
3.1.1 Procedure Generation Package (PGP) Review r The licensee submitted its PGP to the NRC on July 31, 1984.
The PGP was reviewed by Pacific horthwest Laboratories (PNL) and the Draft Technical i Evaluation Report was submitted *,o the NRC in December 1986.
Since the - original PGP was submitted, the licensee has revised the verification and validation descriptions (currently Pevision B) and the writer's guide (currently Revision D).
The inspection team reviewed the revised portions of
the PGP and the unrevised training description o th respect to NUREG-0899. As a result of the revisions, some of the original coments by PNL were no longer l valid. The inspectors discussed with the licensee the results of their review and the outstanding coments that remained from PNL's review. Because the t inspector's review did not identify any new items of safety significance , ' requiring irrriediate licensee or NRC action, and because earlier coments are scheduled for resolution as part of the PGP review program, the team did not request the licensee to resubmit a revised PGP in response to this inspection.
l The inspection team recormended that the licensee prepare and submit a I writer's guide for the preparation of flowcharts as part of their PGP.
The
'
_ _ - _.- - - _ -- - - - - -- .-- - - -
. . ' . e licensee has recently deemphasized use of text fonnat procedures, for which a writer's guide had been included in their original PGP submittal, in favor of E0P flow charts developed and implemented without the use of a flow chart writer's guide.
3.1.2 Comparison of E0Ps to Emergency Procedure Guidelines The initial E0Ps were based on Revision 3 to the BWROG EPGs, although at the time of the inspection the licensee had begun to update the E0Ps to Revision 4
of the owners group guidelines. Discussions with the plant staff indicated that the Plant Specific Writers Guidelines were presently at Revision D but I were not currently consistent with the Plant Specific Technical Guidelines.
' The staff also indicated that the flowcharts currently in use were developed directly from the E0P text fonnat procedures and were not addressed as a part ' of the PGP or Plant Specific Writers Guidelines.
Inspectors performed a comparison of the EPG, Revisions 3 and 3k, against the i
current revisions of the E0Ps that would be used during a plant emergency.
Technical justification existed for deviations from Revision 3 of the BWROG EPGs to Revision B of the Plant Specific Technical Guidelines and for l deviations from Revision B of the Plant Specific Technical Guidelines to ' ' Revision 0 of the E0Ps. Adequate justification did not exist for changes to the E0Ps beyond Revision 0.
Changes from Revision 0 to the current revision were instituted, reviewed, and approved by appropriate personnel although no formal procedure existed for making those changes.
Inspectors concluded from ' the review that appropriate technical justification existed for most of the , deviations from the vendor guidelines. The NRC comparison, like the conclusions of a licensee Quality Assurance audit perfonted in advance of the NRC review, indicated that, although most devictions were properly addressed numerous deficiencies still existed in the E0P program and a licensee review of all ceviation justifications may be warranted. This conclusion was based on the following observations.
(1) EPG, Revision 3 General Caution No. 2, states "Monitor RPV water level and pressure and primary containment temperatures and pressure from multiple indications."
The caution was carried forward verbatim in PSTG Revision B and then was deleted by the justification document "Deviations Between Plant Specific Emergency Procedure Guideline REV. E and Emergency Operating Procedures, REV.
0," Revision C dated December 12, 1985. The justification for the deletion was that ".. 411 cautions appear in the ' procedure at the appropriate step...." Specific reference to monitoring
parameters using multiple indications for RPV water level, RPV pressure, primary containment temperature, and primary containment pressure was not carried over into the E0P procedures. Justification for deletion of the caution because all information was included in the E0Ps was considered by the inspectors to be inadequate.
' (2) Caution No. 3 was deleted in the same manner as the above example. Caution ho. 3 states "If a safety function initiates automatically, assume a true i initiating event has occurred unless otherwise confirmed by at least two j independent indications." This caution did not appear to be carried over ! into any procedural steps of the E0Ps as stated in the justification for deletion.
In contrast, Caution No.10 which contained some similar information but was limited in scope to the Emergency Core Cooling System
1
_ _ _ _ _ -_ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .
. e (ECCS) was appropriately carried over into the E0Ps. Justification for the deletion of this caution was considered by the team to be inadequate.
(3) Caution No. 4 was deleted as in the above examples. Caution No. 4 stated "Whenever RHR is in the LPCI mode, inject through the heat exchangers as - soon as possible." Th.is caution was not carried over as stated in the justification. The information was changed from a caution and licted as additional information on the bottom of the list of injection sources in Procedure C.5 - 1101, Revision 1, page 9 of 9, step 3.
The team was concerned that this method of presentation fails to alert the operator and highlight the information as a "boxed" caution would.
In its present position the information is subordinate to both the step and the list of injection sources. Justification for the deletion of this caution was , considered by the team to be inadequate.
(4) Caution No.'5 was deleted as in the above examples. Caution No. 5 stated ~ in part "Suppression pool temperature is determined by [ procedure for detemining bulk suppression pool water temperature]. Drywell temperature
is determined by [ procedure for determining drywell atmosphere average temperature).
The team could not determine how this deleted " .... cautionary infonnation was carried over into the appropriate procedural steps as the deviation justification stated.
In practice the inspectors noted that operators used Safety Parameter Display System (SPDS) averaged temperature in lieu of RG 1.97 instrutnents with some type of an averaging procedure. The intent of this caution was for plants to include specific information on how the operator is to derive bulk or average temperatures.
.onticello E0Ps specified getting bulk torus temperature but did not u contain guidance on how to perfom the required activity as intended by Caution No. 5.
Discussions with Monticello staff indicated that typical operator routine would include use of the SPDS average.
Inspectors questioned how the SPDS values would be checked against RG 1.97 instru-meats. The response indicated that the E0Ps did not contain guidance to conduct the comparison. The existing justification that infomation addressed in this caution was included in the ECPs was considered by the team to be inadequate.
(5) The guidance in the EPGs, Revision 3, Page I-2, Paragraph 1, regarding flowcharts was deleted with justification that flowcharts were not part of the submission. The deleted paragraph would appear to be applicable , now that E0Ps in the flowchart femat are being utilized in the plant.
' - Justifications for deviation f rom this paragraph would appear to be ~ necessary. Discussions wirh plant staff indicated that the flowcharts < referenced in the EPG paragraph above were sequencing flowcharts intended to be used with the procedures as an operator aid. While inspectors understood and could concur with that viewpoint, the deviation justifica.
tion did not provide an adequate path from NRC approved Revision 3 EPGs , and the licensee's current E0Ps.
j (6) The deviation justification for deviations from the EPGs, Revision 3 to the PSTG, Revision 8 on Page 2, inoicated that Paragraphs 4 and 5 on page
l l-2 of the EPGs had been deleted. The paragraphs actually deleted were Pa.,,. oh 5 on Page 1-2 and Paragraph 6 on Page 1-3.
It appeared that tho correut paragraphs were deleted and that the deviation step was incorrect.
i
4-
. __ . '. . This information was provided to the plant staff for verification and , evaluation.
The team concluded that the deviation juttification for d6 etions of some
items was brief and incomplete, for example, caution numbers for some caution statements were deleted with the justification "MNGP staff did not want these included." The team concluded that this justification statement did not form an adequate technical basis for the delet!ons.
The team's evaluation of the technical justification for deletion of general cautions was complicated by the aggregation of all but one such justification, with no reference to where in the E0Ps the information had been included. The team reconnended the following corrective actions.
(1) Review deviation justification for all deletions of cautions to ensure inclusion of information in an appropriate form (caution, note, step, ' etc.) is included in the E0Ps.
(2) Verify that changes to the E0Ps since Revision 0 have been evaluated for deviations from the approved basis.
After a review of all supporting program documentation, the inspectors l concluded that no formal mechanism existed for the continuous maintenance of the E0Ps, PSTG, Writer's Guide, or support procedures as required by Sections 6.2.0. through 6.2.4 of NUREG-0899. The inspectors reviewed the licensee's proposed administrative control docunent and concluded that it was, in its draft format, insufficiently detailed to meet the requirements of NUREG-0899.
i A licensee QA audit performed just prior to tne team's arrival concurred with this assessment. While the absence of an administrative control program has not rendered the E0Ps technically inadequate, largely due to the extensive i nvolvement of plant staff, the inspectors cautioned the licensee that tight administrative control over the program was e'sential to continued technical adequacy of the procedures.
3.1.3 Technical Adequacy Review of E0Ps ' Technical adequacy of the Monticello E0Ps was assessed during the review of E0Ps against the approved generic guidelines, during operator interviews and procedural walkdowns, and during accident scenarios conducted with operating shifts in the simulator. The inspection team concluded that the E0Ps were technically adequate for the Monticello facility. During the inspection, numerous technical deficiencies were noted which are discussed throughout this I report. Correction of the deficiencies would enhance the ability of the , operators to implement the E0Ps in a timely manner under adverse conditions.
' l 3.1.4 Licensee Verification and Validation of E0Ps The licensee has issued as n.any as six revisions (A through D during procedure . l development and Rev 0 and 1 following implementation) to the E0Ps in a l continued effort to improve procedure quality. The inspection team reviewed the documentation listed in A,npendix B associated with the verification and ' I validation of these revisions and rade the following observations, i i ,
5
l - - - _-_
. ' . ' (1) The verificati.on and validation procedures used were those described in the verification and validation descriptions submitted in the PGP.. (2) The initial verification of the text E0Ps was completed in August 1985 by a vendor engineer, an independent human factors contractor, and the plant E0P writers. The verification results were reviewed by the inspection team and a sampling of those recocinended changes (to which the plant agreed) were compared to Revision 1 of the text E0Ps. No discrepan-cies were found.
(3) The current revision (Revision 1) of the text procedures was implemented in the control room af ter the operators had received E0P training on Revision O.
Changes to Revision 0 were made as a result of training feedback and Revision 1 was issued.
(4) The validation of the text procedures was completed in August 1985 using the site simulator. The vendor engineer, the human factors contrac-
tor and the licensee's EUP writers and a training representative were present.
The scenarics used for this licensee validation were examined by the inspection team with respect to the procedures entered and the extent to which E0P steps were exercised. The team found that the extent to which the validation scenarios completed a given flow path varied.
The inspection team also found that three of the 2000-Series procedures had not been entered during the licensee's review, but these three procedures were exerc1sco by the inspection team's simulator validation and no problems were found. Further, the inspection team's simulator validation scenarios followed many flow paths to completion and no problems were found.
(5) The flowcharts regresented a different presentation of the text procedures, a change in format only with no change in procedural guidance provided to operators. Although the flow charts did not have a formal verification, a side-by-side comparison of the flowcharts with the text was made by licensee E0P writers and independently by licensee QA personnel. Two discrepancies were found and corrected. The inspection
team performed a side-by-side comparison and did not identify any other discrepancies.
(6) The flowcharts were never fomally validated, since they were considered J rerely a different presentation of the validated text procedures.
However, a partial validation was accomplished using the site-specific . simulator to check out major flow paths. The scenarios used for the partial validation were examined by the inspectors who concluded that ! major flow paths had bei:n entered.
3.1.5 Licensee Review to inspection and Enforcement (IE) , TnTormation Notice 86-64 Inspection and Enforcement Information Notice 86-44 and its supplement wert issued to highlignt deficiencies in licensee upgrade programs for plant E0Ps.
The information notice sumarized findings of various NRC inspection teams ' into the following five categories of deficiencies: l
.c.
! -. - _ _ _ - _ - - -. ._ -..-
.
. . (1) Inadequate deviation justifications.
' (2) Insufficient verification and validation.
Inadequate implementation of plant specific writer's guides.
Inadequate training, i Lack of operational QA controls.
Although the Monticello internal response to the information notice and supplement indicated that the plant felt that none of these problems were evident, the inspection team found evidence of each of these problems to some i degrec as described throughout this report.
{ 3.1.6 Containment Venting Procedures The team reviewed the licensee's provisions for containment venting using E0Ps in light of the known design characteristics of the Mark I containment. The procedures were found to confonn to owners group guidelines for containment
venting.
- The inspector reviewed in depth the licensee's procedural guidance and single ! ! identified vent path and found that the flow path relied on secondary contain-ment ductwork expected by the licensee to fail when exposed to calculated
pressures anticipated during containment venting. The review revealed that the licensee. had not performed calculations designed to establish a pressure limit for the ducting, and was unable to estimate a 'ailure point. Postulated failure of the ductwork during post-accident venting would likely result in a / ground release of radioactive material, severely complicate reactor buildino
accessibility, and likely delay or preclude local mitigating actions. The
inspectors recomended to the licensee that alternative vent paths be identi-fied and evaluated which could serve to minimize these undesirable consequences.
Although walkthrough evaluations with operators indicated an understanding of procedural requirements for containment venting, postulated inaccessibility of secondary containment placed in serious doubt the ability of the operating staff to perform any local manipulations.
The licensee had not performed calculations or evaluations that would acoress the operability of containment isolation valves under post-accident conditions and against possible differential pressures.
Likewise, the licensee had not addressed the ability to vent under conditions of station blackout or loss of offsite power.
- 3.2 Simulator Validation of E0Ps The inspectors conducted extensive observations of operating crews exercising E0Ps on the site specific simulator in order to evaluate the ability of operating personnel to carry cut the procedures under dynamic, real time conditions.
In addition, the inspectors validated major portions of the ECPs using the site specific simulator. Three simulator sessions were conducted.
The first two sessions each consisted of four simulated E0P scenarios while the third simulator session was corrposed of two scenarios.
,
. . The simulator scenarios were designed to test the maximum number of E0P decision paths during the available simulator time and exceeded the scope of scenarios normally conducted during licensed operator testing.
Detailed information on the scenarios and individual crew performance is provided in Appendix E of this report. The event scenarios were conducted with the minimum staffing allowed by facility administrative procedures. This complement included one Site Superintendent (licensed SRO), one Shift Supervisor (licensed SRO), one Shift Technical Advisor (STA), and three licensed reactor operators (R0s).
The licensee provided qualified station and simulator operators to support the validation, and each crew was composed of individuals normally assigned to that crew. A different crea participated in each simulator session.
The fidelity of the licensee's simulator in the simulation of plant response to operating events was of particular value in assessing the validity of the procedures and the performance of the crew, and was considered by the team to be an asset to the licensee's training effort.
' During the observation of operating crews in the simulator, inspectors noted that the plant used both a Site Emergency Comunicator (SEC) and a Site Superintendent.
The team considered this practice a strength since it augmented the control room staff with two additional personnel who would be available to assist in an emergency prior to the time that the Technical Support Center is activated and personnel augmentation is available to the site. The use of these two positions was observed to relieve the Shift Supervisor of some emergency preparedness tasks so that more time would be available for accident mitigation and plant operation.
During the simulator observations of the first two operating crews ths inspec-tors noted a significant disparity between their levels of performance. Wnile the first crew appeared well versed in the procedures and confidently and efficiently used the flowcharts to bring the simulated plant to a safe condi-tion, the second crew, when faced with comparable simulated scenarios, deronstrated a lack of familiarity with the flowcharts that contributed to several incorrect decisions. The crew lacked an organized approach to emer-gency management, and foiled to decisively address the emergency. The inspec-tion team considered the observed weaknesses in the second crews' understanding ' and use of E0Ps to represent a significant safety concern based on the conclu-sion that the observed crew would apparently be unable to respond adequately to an actual plant emergency using the E0Ps.
. Concern over this safety issue resulted in a request to the licensee for an opporturity to observe a third operating crew in the simulator.
The observed ability of the third crew to efficiently and effectively use the E0Ps compared favorably to the performance of the first crew.
Further investigation of the significant difference between the performance of the first and third crews and that of the second crew revealed that the Shift Supervisor had recently been ,oromoted to the key Shift Supervisor position from an R0 licensed position that had provided only ainimal exposure to flowchart E0Ps and little opportunity to practice E0P usage in the supervisory role of the SRO licensed Shif t Supervisor.
Further, because of absence, the Shift Supervisor had received relatively little training in flowcharts provided to recently promoted SR0s prior to assuming management duties in the control room.
The team concluded that the licensee failed to exercise proper managerial controls over the
. - . . training and qualifications of key supervisory licensed operators with primery s responsibility for safe facility operation and protection of the public health and safety. Although the inspection team, with concurrence of regional arid headquarters management, downgraded its concern from a safety issue to a concern over inadequate training, the team conveyed its greater concern to the licensee that management's decision to place a supervisor with inadequate training in the pr;sition of managing potential emergencies indicated the raed for more effective management involvement in facility operation.
In response to the team's concerns the licensee imediately undprMok an intensive training program to ensure adequate E0P training to 8 0 5hift
Supervisors and the crews they supervise. The crew whose performnce was observed to be weak received an r?ditional 20 hours of simulu or training and successfully completed a formal evaluation by licensee triappent prior to returning to licensed duties in the control room. A Region H I licensing examiner observed the evaluation and detemined the crew's perfomance to be acceptable. A11' remaining operating crews were scheduled to receive similar ~ training during the next six week training cycle concluding August 26, 1986.
l 3.3 Walkthrough Validation of E0Ps and Supporting Procedures Inspectors conducted physical walkthroughs of the procedures with licensed . operators.
During the walkdowns relatively minor deficiencies such as ,
minor labeling inconsistencies, operatcr techniques, and informality in comunication were noted and recorded; however, the team placed t.ajor emphasis on adequate performance of the procedu-e by trained operators.
For the walkdowns, minimum staffing was assumed, degraded environmental conditions were assumed, end verbatim compliance with procedures was expected.
During walkdowns operator actions were not timed; however, qualitative observations were used to ensure that procedural or perfoma. ice delays were reasonable. As ' a result of deficiencies or inspectors questions, portions of certain walkdowns were repeatec' with different operators.
As a result of the walkdowns the team concluded that the E0Ps could adequately ' be carried out in the plant. Deficiencies encountered might reasonably be expected to present delays and difficulties in performing certain steps; however, the procedure could be performed to the extent necessary to accomplish its purpose. As a result of walkdowns and observation of plant housekeeping, , the team concluded that systems, equipmeat, and spaces were neat, orderly and well maintained.
Theinspectorsconductedwalkcownsforth5followingseriesofE0Ps: C.5 - 1100 Series, RPV Control C.5 - 1200 Series, Primary Containment Control C 5 - 1300 Series, Secondary Contai..ent Control
C 5 - 2000 Series, Contingency Control (procedures to which ' operators are referred by other E0Ps) C.5 - 3000 Series, E0P Support Procedures
all licensee B and C series procedures to which E0Ps refer l all figures and curves fcund in E0Ps and support procedures.
l l
< l - - - -. -
. ._ .. . ._ _ .
. . All prucedure walkdowns were performed with at least one operator who would nonnally perform the procedure in an emergency. Two procedures were not walked down bacruse of similarities in the types of actions, locations, and enmplexity of the procedures that were completed. DiscLssioni with Monticello st;.rf indicated that, since the E0P Support Procedures were written, a requirement for a procedure "user review" has been instituted for all procedures.
. The team noted the fol,owing deficiencies which were common to one or more of the E0P Support Pre edures.
(.) Jumper wires est., ?o bypass interlocks were not dedicated jumpers and were in daily use for ;.snt testing and surveillances.
Discussions with the operating staff ir.iicated that there was no testing program for the jumpers and no periodic checks to verify jumper integrity. The staff l explained that jumpers received visual inspections when they are used.
The team recomended dedicated jumpers or periodic checks to ensure jumper operability *1s maintained.
(2) The procedures did not specify a requirement to obtain a jumper of appropriate size prior to leaving the ccntrol room area and entering the plant.
(3) Numerous cases of temporary labeling were encountered in the control
room and in the plant.
Instances included pencil on concrete walls to , ' identify dampers overhead in the ceiling area, masking tape to identify d A pers, and dymo tape and magic markers on control panels. The Monticello Detailed Control Rnom Design Review (DCRDR) identified wide- , spread Idbeling problems within the control room and established a control room relabeling program that will address :'l labels in the control room.
The relabeling program is scheduled fur the next refueling outage.
Inspectors concluded that labelinn within the control room for the i procedures th A were walked down was less than optimum, but that labels were not sufficiently confusing impair the recognition and nperation of a component, switch or indicator. Some control room valves were labeled with both the Bechte'i valve designation (not used by the procedure) and the plant designated number (used in the procedure). The control room " duplicate valve number labeling was more significant than other j inconsistencies since it forces the operator to read the extra number and may cause delay or confusion under the strass of an emergency. Labeting outside the control room was adequate except for specific cases noted for , each procedure. The team concluded that damper labeling was ir.dequate i . and would cause difficulties in implementing Procedure C.5 - 3009 during d normal and degraded lighting. Typical examples are detailed under the ! appropriate procedure discussion in Appendix D.
(4) The procedures were not consistent with regard to specifying names for valves. Some valves are identified by name and number, some only with , number, and the format for name and number varies from step to step and procedure to procedu,'e.
In some procedures, nur:erous valves are identi-i fied by number with no component name. The inspectors recomended to the licensee that full and censistent specification (name and number) of valve icentify would reduce the probability of personnel error.
Examples are J it. (1fied under appropriate procedures walkthrough reports in Appendix D.
, , > -10- ! __ ._ _ . - - - -- - - - - - - - -
I , ! . . ( During the walkthroughs inspectors determined that the E0Ps included a caution that, upon loss of instrument 11r to the Emergency Diesel Generators (EDGs)
Dampers, their rooms could then overheat and cause EDG feilure. The team i
expressed its concern to the licensee that this situation was not consistent , with the General Design Criterion No.17 of 10 CFR 50, Appendix f, which requires , a design for on-site electrical sources that can perform safety f.*nctions
assuming a single failure. Also, during a situation requiring the use of E0Ps, traired operators would be diverted to p;rform an action that could be
eliminated by modifying the EDG ventilation dampers. The Licensee responded to the concern within 24 hours by taking the following actions: (1) The dampers were blocked open, , , (2) The requirement to dispatch an operator was removed, and (3) The licensee consnitted to complete a satisfactory, permanent modification of the dampers before the onset of cold weather.
' l Specific deficiencies identified for each procedure during walkdowns are , presented in detail in Appendix 0 for use by the licensee in the corrective i i action process.
J 3.4 Human Factors Engineering [ l 3.4.1 Adequaev of the Writer's Guide - The inspection team performed an independent verification of the the . licensee's Writer's Guide, Revision D, to detemine whether the licensee had l j
properly accomplisned the verification process. Based on the findings, the team concluded that the verification of conformance to the Writer's Guide was [
Specifically the Writer's yjd. Md not adequitely incorporate e i
inadequate.
! all of the NUREG-0899 requirements for the following areas: [ ! ! (1) 5.5.3, Cautions and hotes - notes should be co iplete on a page j (2) 5.6.10 Logic Statements - how te use AND/OR together, when necessary !
(3) 5.2.2/5.5.7, Referencing and Branching - defining all methods such as I " ! "refer to."
! (4' 5.6.1, Vocabulary and Syntax - vaque adverbs disallowed i . ' (5) 5.7, Types of Action Steps - address all types l (6) 5,4.1, Procedure Org6nization - Revision Late required, entry c> dition i i j format, j The specific comments were reviewed with the licensee, who concurred with the j
observatior.s.
j 3.4.2 Implementation of FNp Writer's Guide (Revision D) j The inspection team performed an independent verification of the W t E0Ps to
detemine whether the Writer's duide was properly iniplenented, bince there was j i ! I i l ! -11- ,
. . - _ _ - _ _ _ _ - _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . , L . L
t . no Writer's Guide for flowcharts, the flowcharts were not reviewed against the text Writer's Guide. The followirig deficiencies were noted: , (1) Throughout the procedures the phrase "Refer to" was used to r9fer the operator to another procedure. However, che Writer's Guide neither
, described nor defined this phrase in Section 2.18, Referencing and Branching to Other Procedures or Steps.
Further, the Kriter's Guide did i not describe how this use of this phrase differed from "ENTER XXX and
Perform Concurrently", which was defined in Section 2.18.
, . (2) Procedures C.5-1202, Step 3; and 1204, steps 6, 7 used the logic tem "BUT
ONLY IF."
However, the Writer's Guide does not describe or define this . combination of logic terms in Section 2.8.3. Logic Terms. Also NUREG-0899 I does not define this use of tnis logic phrase.
' (3) Throughout Procedures C.5-1200, 1400 and 2000 series there were special
operator instructions on the left hand page which were not formatted with
q a box as required by the Writer's Guide, Section 2.19, Special Operating l Instructions.
' , j (4) Throughout the procedures, graphs were pl aed on the left hand page for operator assistance. However, many of the graphs were reduced to a small
i size because of other information or graphs placed on the same page.
t ' These small graphs were difficult to read and to interpolate. The Writer's Guide, Section 2.23, stated that operator aids are to be
readable and should be presented ar attachments "when several graphs are
applicable to a page and cannot be placed on the facing page."
( , (5) Procedure C.5-1103, Step 4A, referred the operator to other procedures
without the phrase "ENTER" as required by the Writer's Guide Section I 2.18. Referencing and Branching To Other Procedures or Steps.
l
t (6) P.ocedure C.5-1204, Step 2, contained an unnumbered step at the bottom of f the left column which have been numbered 2A, The step next to that step ( . '
was not its contingency, but belonged to the contingency associated with i Step 2.
The Writer's Guide Section 3.3, Instruction Step Numbering.
l required each step to have a number.
, I i; (7) Procedure C.5-2001, Step SC, referred the operator to C.5-2002 and stated I l that the operator should return to Step 2.
In C.5-2002, Step 3 (which was i the last step), the operator was told to enter C.5-1102 Step 5.
If the L i l operator entered C.5-1102 there was no return to C.5-2001. This incon-l .
sistency did not follow the guidance of Writer's Guide Section 2.18, ! Referencing arid Branching To Other Procedures or Steps.
l ) 3.4.3 Flowchart Review l ! Although no Writer's Guide existed against which the team could review the flowchart forsat, an evaluation of the flowcharts was performed. Tne flowcharts i i.
were found to be an accurate representation of the procedural steps found in ! I the text format procedures. The flowcharts made use of optimal flowcharting [ l techniques, inspectors offer:d the following conrients to the licensee.
f i-12-(
i l ! I - - - - - - - - .- -
i .
O e (1) The flowcharts should have a unique numbering system of their own.
Currently, the flowcharts contained some steps with numbers which matched the text procedures, and sor.a steps with no number.
It was understood ' that the step numbers would help the operator get back to the basic documents, but the numbers were not consistent across steps and were not unique. Some had the same step number within the flowchart itself, which can cause operator confusion when referred to that step. NUREG-0899 suggests that "operators should be able to identify steps in the procedure."
It was recemended that the flowcharts have a uniqN step ' nurrbering system or a method of referring the operator to other steps which is independent of the current numbering system used in the text procedures.
(2) There was inconsistency in how feet and inches were specified. Sometimes
theconvention"Ft"and"In"wereusedandsometimesthesymbols[']and [")wereused. A consistent method should be adopted.
. < . 3.4.4 Control Room Support of E0Ps t 3.4.4.1 Control Room Illumination l During operator interviews,.the operators expressed concern that the flowcharts may not be readable during loss of all offsite power. The inspection team i investigated the emergency lighting system and found that it illuminated the , panels only. There were no emergency lights which directly illuminated the - . central and rear areas of the control room where the flowcharts and other ' l procedures would be used. Although there was no data on the light levels in the central and rear creas expected as a result of loss of all offsite power, i there was reasonable concern that the light levels may be too low for procedure legibility. The inspection team recomended that emergency lights be installed ' , which directly illuminate the central and rear areas of the control room.
3.4.4.2 Control Room Space ' , The space available for the operators to lay out the flowcharts was extremely L ' i limited. The area normally used at the siriulator for the flowcharts was not i available in the control room because it contained telephone equiprent and in the future will contain an SPDS component. The inspectors recomended that the licensee identify a space in the control room that can be cleared, during l an emergency, to support the use of the flowcharts, particularly when many are being used concurrently.
! ! -
3.4.4.3 Binders l The binders used for the operating procedures (many of which will be used concurrently with the ECPs) were on several occasions observed to fall apart j while the operator was using the proced ne.
The operator was then required to , put the procedure back together and fi; the binder, detracting from his l ! participation in the emergency response.
It was recomended that the use of j another type of binding system be investigated.
Further, all the operating t i procedures are in black binders.
When several were laid on a work surface it - was d1fficult to readily icentify the desired procedure. The team recormended that binders should be marked on the outside.
, i
-13- , - -_ _ --_ - - - - - - - __-
_ ___ _ _-____-_--___________-______________ _ _ _ _ _ _ ___ _ _ . ( e . 3.4.5 Human Factors Coments From Simulator Observations ' During the simulator observation activities described in Section 3.2 and Appendix E of this report, the following observations were relayed to the licensee.
The shift supervisor was observed having difficulty locating the correct flowchart both in the installed rack and when all charts were out and in use.
This difficulty appeared to result from the way the charts were marked. While some' were marked for easy identification, others were not. Subsequent discus-sion indicated that the control room charts were marked differently from the simulator charts.
In addition some charts were read vertically and some must be turned sideways, making the marking inore difficult to read. The inspectors ' recomended all flow charts in both control room and simulator should be marked in large letters with number and title on the top margin and on the side margin.
In addition, the licensee should consider enhancing the layout so that all . charts are read the same way, either all vertically or all horizontally.
The team noted that the flowchart labeling was corrected in the simulator prior to the end of the inspection.
The reactor operator could not locate the C.5 volume for approximately one minute. The volume, which closely resembled all other volumes in appearance, ' was found out of the rack on the central desk. During discussion with that operating crew, inspectors learned that the. books in the control room were red and easier to distinguish.
Inspectors recomended that the simulator volumes be identical to control room volures in content, size, and markings in order l to preclude negative training.
The reactor operator could not locate the diesel generator operating procedure
for about a minute. The section had been removed and was lying on another
desk.
The team recormended that the sides of the individual sections on the control room master copy (catalog rack) be clearly marked so if several sections were rernoved and lying on desks (the likely situation during an emergency) they . would be clearly identifiable without the raed for operators to pick up and open
the cover of each one.
! L 3.5 Calculation and Setpoint Verification l 3.5.1 Calculations and Setpoints , A team member reviewed the calculations in General Electric EPG Appendix B to
, evaluate the accuracy of the plant-specific input data, the reasonableness of > the assumptions used for the calculations, the adequacy of the design controls, and the quality assurance oversight applied to the calculations. A list of the calculations is incleded in Appendix C of this report.
The inspector determined that GE had performed the calculations in accordance , with their QA program and that independent GE reviews were documented. The licensee, however, did not conduct a femal, documented independent review of the plant specific data provided to GE. A team member reviewed the nunerout revisions of plant-specific data and concluded that accurate plant specific
data had apparently been used in the GE calculations and that the questionable ' I data did not appear to be significant variableh in the applicable calculattor.s.
i I .. -14-
_ _ _ - .
. The calculations established the limits and action decision points for the operators when using the E0Ps. They also were used to validate assumptions in the E0Ps. Given the safety significance of these calculations, the team reconnended the following corrective actions.
(1) Conduct an independently verified validation of the input data as soon as pra c tical. (2) Identify any deviations between the verified data and that used in the GE calculations, , (3) Forward these deviations to GE for recalculation of the affected portions of Appendix C to the EPGS, (4) Revise the E0Ps if required, due to changes in the calculations, and (5) Conduct a fonnal, documented quality assurance review of the GE
calculations. Because of the safety significance of calculations supporting E0Ps, standard pertodic reviews of the vendor's quality assurance program may not be adequate to specifically address the validity of calculations in an E0P application.
3.5.2 Core Spray NPSH Curves and Calculations In response to a request from Region III the inspectors included in their review of calculations and setpoints a review of Open Item (263/87005-01) which described the lack of analysis to demonstrate adequate Core Spray Pump net positive suction head (NPSH) under all plant conditions.
The inspector reviewed the following documents and discussed them with members of the licensees' technical staff: (1) SSFI Inspection Report 263/87005, Section 4.1.1, Core Spray NPSH.
(2) Licensee Internal Memorandum of 24 June 1988 Fron Byron Day to Distribution.
RE: NPSH Core Spray Pumps.
(3) Licensee Internal Memorandum of 24 June 1988 from R. A. Gorensun to B. D. Day.
RE: NPSH and E0Ps.
(4) E0P C.5-1201. Torus Water Temperature Control. Rev.1, Page 4 of 5 - Core . Spray and RHR Pump Curves and Heat Capacity Temperature Limit Curves facility.
(5) Technical Specifications, various sections (G) General Electric CRF A00-02049-2 Letter of 11 August, 1986, from F... Billing to E. J. Karner.
RE: LPCI Pump Curves for Monticello.
(7) General Electric DRF A00-02049, Tab D Calculations.
RE: RHR and Core Spray hPSH Curves, i
-15- { l
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . i e ' Based upon this review the inspectors concluded that the core spray pumps will perform as designed for those transients analyzed in the Updated Safety Analysis , Report (USAR) and in accordance with the facility's Technical Specifications,
j The E0Ps provided core spray and low pressure coolant injection (LPCI) pump curves as a function of torus temperature and drywell (torus) pressure.
The ' E0Ps also provide the pump NPSH cautions as approved in the BWR Generic EPGs.
' . The licensee comitted to have a modified caution regarding NPSH added in additional sections of the E0Ps. This would provide additional assurance that NPSH requirements will be considered by the operator.
The team reconsnended closure of Open Item (?C3/87005-01).
3.6 Operator E0P Training Program
The inspection team reviewed the* training program for the E0Ps. The team examinea lesson plans for text and flowchart procedures, the site-specific
' simulator, a variety of training documentation and evaluation / examination forms.
Inspectors also interviewed the training staff. The licensee had conducted approximately 100 hours of classroom and simulator training on the text procedures prior to their implementation in the control room. Later, when the flowcharts were developed, operators received approximately 20 hours classroom and simulator training prior to their implementation in the control room. Since then, the requalification training program has incorporated E0P review as a recurring topic, offering operators approximately four hours classroom and eight hours simulator training each cycle.
The inspection team reviewed the use of the s',te-specific simulator for training and validation. The site-specific simulator had a minimum number of differences from the plant control room. *he team found that the training staff has been effective in simulating complex event scenarios with both simultaneous and sequential multiple failures. The team concluded that the simulator was a significant asset for E0P training, offering a dynamic environment for operators to work through all paths of the E0Ps, experience complex events, and 'nake decisions on a real-time basis.
3.6.1 E0P Training Scenario,s, The inspection team reviewed the scenarios run on the simulator for E0P training. Approximately 14 i inarios involving the following sampic casualties had been performed by each crew.
. - Anticipated Transient Without Scram (ATWS) - Stuck-Open Relief Yalve (SORV) - Loss of Feedwater - Stean Leak in the Turbine Building - Steam Leak in the Dry Well - Loss of High Pressure Emergency Core Cooling The scenarios consisted of single and multiple failurts, including the following examples.
-16-
. _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _ _ .
. . - Group 1 isolation - Steam leak in drywell with loss of 16 bus - Large Break in containment with a failure of high pressure core injection (HPCI), reactor core isolation cooling (RCIC), and feed pumps - Failure to scram and SORY - Loss of off site power, failure of one EDG, HPCI, RCIC, and core spray system - Main Steam Line leak in the tunnel combined with inability to isolate the reactor vessel.
. The inspection team concluded that all procedures would have been entered and most, but not all, steps performed during training on these scenarios.
The training staff stated that not all steps were ' covered and these were discussed in a table top fashion. The inspection team concluded that the scenarios used were acequate for E0P training, ,
3.6.2 E0P Support Procedures Training
, Although operators seemed well trained and adequately followed the E0Ps during simulator and walkthrough observations, the inspectors identified lack of adequate training for E0P support procedure; as a weakness. Although the support procedures (3000 series) were taught in the classroom they were not walked down in the plant. The operators who walked down these procedures for t the inspection team had difficulties following the procedures and locating
controls and componcnts. This cifficulty was in part due to improperly ! validated procedures, but absence of inplant training on the support procedures contributed to the inspector's broader concern over ability of operators to perform required activities outside the control room. The inspection team recomrenced that all operators receive inplant training in support procedures
as one aspect of a comprehensive program to ensure operator ability to accomplish required activities outside the control room.
. During interviews, the operators indicated that the inspection team's valida-tion scenarios had taken them deeper into the flow paths than they experienced l during requalification training. The training staff indicated that they had emphasized entry into the E0Ps, which left less time to practice steps and go deeply into the E0Ps. The inspection team reconcended that the training staff incorporate into their training complex scenarios that forces operators to move i , ' deeply into multiple flow paths.
i 3.6.3 Operator Training on E0P Changes , .
Since the initial training on Revision 1 of the text E0Ps and Revision 0 of , the flow charts, there had only been one minor change. This change was riported to the operators through a written summary in the control room. The training staff had the administrative controls in place to incorporate E0P , ' , changes and revisions into recualification training prior to their implementa- ' tion in the control room. Major revisions, such as new steps or flow path , changes, would be taught in the classroom and exercised on the simulator.
l Training for minor revisions would consist of a written sunmary of the change ! provided as required reading for all crews prior to implementation. These plans for training operators on revisions to E0Ps appear adequate.
i
-17- , - - - - --,---w- . , _ _, _ - _ _ - _ - - - _ ~ - _.,. -, _.,. -- -,,,--,y,, ,_7_,,. -,, ,,m . ..,,,__,--.y- -,,, - -. _ _ _ ~ _ _, - - - __ -
. __ _ _ _ _ _ _ _ _ ___ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ . . ' 4.
MANAGEMENT EXIT MEETING The inspection team discussed its findings in detail curing a pre-exit meeting with plant management on July 19, 1988. The findings and recommendations were presented in summary at a management exit meeting held on July 20, 1988.
During the management exit meeting, the following recommendations were made to Monticello plant management: (1) Implement a fornal administrative control program for emergency operating procedure and emergency operating procedure support procedures.
' (2) Perform a verification, with QA review, of calculations which may have questionable input data, such as reactor building temperatures, reactor dome pressure at 100 percent power, and primary containment humidity.
(3) Perform a review of diesel generator operability on a loss of control '
air, including the adequacy of operator compensatory actions and issues related to single failure of a nonsafety system causing the failure of
the safety-related diesel generator.
(4) Perform a reconciliation of panel and component labeling inconsistencies >
as applied to E0Ps and.EOP support procedures.
(5) Perform a verification and validation of E0p and E0P support procedures for actions outside the main control room.
(6) Review the adequacy of control room lighting for illumination of , procedures.
, I I I , $ e l t l l
i ' i
i ! ! ! -18- ! . . -, _.. -. _ - -,--.-.a_ - _, ._ _, - _ _,. - - - _ - _ _ _ _.. _,.. _ -,.. _., _ ~ ~., - .- - - -, - - -- -
_ _ _ _ _ _ _ _ _ _ - _ _ _ . . . APPENDIX A PERSONNEL CONTACTED .
- W.
Shamla Plant Manager
- D.
Antony General Supervisor, Operations W.
Albold General Supervisor, Maintenance
- B.' Day Superintendent Operations Engineering B.
Walstrom Site Superintendent T.
Witschen Shift Supervisor B.
Lagergren Senior Reactor Operator K.
Markling Reactor Operator G.
Rask Reactor Operator P.
Walker Shift Technical Advisor
R.
Goransen Senior Production Engineer
G.
Lashinski Reactor Operator R.
Dennis Site Superinterdent R.
Miller Shift Supervisor B.
Fisher Senior Reactor Operator J.
Rasmussen Reactor Operator D.
Dilley Shift Technical Advisor K.
Hargen Site Superintendent T.
Murray Shift Technical Advisor D.
Roisum Senior Reactor Operator S.
Afano Reactor Operator D.
Vanfulan Reactor Operator
- C.
Larson Vice President, Nuclear Generation
- L.
Waldingen Manager, Production Training
- L.
Eliason General Manaaer Nuclear Power Plants
- 0.
Nevinski General Superintendent. Operations
- K.
Albrecht General Superintendent, Quality Assurance
- R.
Scheinost General Superintendent Security and Admin.
- P.
Kamman Superintendent Nuclear Operations QA
- R.
McGillic Operations Training Supervisor
- S.
Hammer Acting Superintendent Operations Engineering 'J.
Rowan Senior QA Engineer
- M.
Onnen Sice Superintendent
- l.
Jackiw Chief, Reactor Protecticn Section 2B, hRC, R!l!
- C.
Haughney NRC, NRR, Chief, Special Inspection Branch -
- S.
Guthrie NRC, Special Inspection Branch, Team Leader
- P.
Hartmann Senior Resident inspector
- 0.
Schrum NRC, Project Engineer, R111 Attended the exit meeting on July 20, 1988
A-1
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ O O . APPEN01X B DOCUMENTS REVIEWED , 1.
Emergency Operating Procedures (EOPs), E0P Support Procedures, and Operating Proceoures.
' Procedure P_r_ocedure Title 1000 Series Control Procedures C.5 - 1000 General Operator Instructions and Precautions, Revision 3 - , 1100 Series RPV Control Procedures , C.5 - 1100 RPV Control, Revision 1 C.5 - 1101 RPV Level Control, Revision 1 ! C.5 - 1102 RPV Pressure Control. Revision 2 , C.5 - 1103 RPV Power Control, Revision 2
1200 Series Primary Containment Control Procedures
C.5 - 120' Primary Containment Control, Revision 1 C.5 - 120; Torus Water Temperature Control, Revision 1 C.5 - 1202 Drywell Temperature Control, Revision 1 C.5 - 1203 Primary Containment Pressure Control. Revision 1 C.5 - 1204 Torus Water Level Control. Revision 1 f 1300 Series Secondary ContainmerLt _Co_ntrol Procedures ' C.5 - 1300 Secondary Containment Control _ C.5 - 1301 Secondary Containment Temperature Control, Revision 1 " C.5 - 1302 Secondary Containment Radiation Control. Revision 1
C.5 - 1303 Secondary Containment Water Level Control. Revison 1 ! 1400 Series Radioactivity Release Control Procedures " C.5 - 1400 Radioactivity Release Control. Revision 1 . 2000 Series Contingency Control Procedures
C.5 - 2001 Level Restoration, Revision 1 C.5 - 2002 Emergency RPV Depressurization, Revision 1 C.5 - 2003 Steam Cooling, Revision 1 i ! C.5 - 2004 Spray Cooling, Revision 1 C.5 - 2006 RPV Flooding, Revision 1 C.5 - 2007 Level / Power Control Revision 2 l < B-1 . - -, _. - _ - _ - _ _ -
_ _ _ _ _ _ _ _ _ - _ _ _ ' . '. ! . 3000 Series LOPSupportProcedures O C.5 - 3001 Reopening MSIVs Following Low-Low Water Level Isolation, Revision 1 C.5 - 3002 Alternate Boron Injection With CRD, Revision 1 C.5 - 3003 Alternate Boron Ihjection with RWCU, Revision 1 C.5 - 3004 Manual Opening of Scram Discharge Volume Vent and " Drain Valves, Revision 1 [ C.5 - 3005 SBGT for Primary Containment Pressure Control Revision 1 .
- C.5 - 3006 Venting Primary Containment, Revision 1
- C.5 - 3007 RPV Water Makeup Using CRD, Revision I r C.5 - 3008 Draining Torus Water to Radwaste, Revision 0 C.5 - 3009 Bypass Secondary Containment HVAC Interlocks Revision 1 ! C.5 - 3010 Overriding HPCI and RCIC Auto Initiation Signal, Revision 0 E0P Flowcharts Supporting All C.5 Series E0Ps (not yet part of the femal E0P hrogram).
C 4-A, Reactor Scram, Revision 2.
C.4-B.5.07.A Loss of Reactor Water Level Control, Revision 2.
I 2.
Detailed Control Room Design Review Documentation Detailed Control Room Design Review Report - Suninary Report dated i.
December 1986, 3.
E0P Validation end Verification Documentation j - Verification Program for Emergency Operating Procedures (Rev B) f - Step / Caution / Note - Specific Verification (Fom 2) - E0P Written Evaluation (Fom 3) L - Verification Discrepancy Sheet (Form 4)
- Validation Program for Emergency Operating Procedures (Rev B) l - Validation Process Control (Fom 1) ) l , - Validation Discrepancy Sheet (Fom 2 - Validation Scenario Fom (Form 3)
Training Documentation Lesson Plan, M 9440 S - 15. Revision 1 Loss of Off-site Power, Failure
' of one Diesel Generator, HPCI, RCIC and CS (Steam Cooling Required) l
i - E0P Lesson Plans - E0P Training Program (in PGP) L - E0P Training Scenarios ! - Simulator Control Room Operator Evaluation Form - Simulator Post Exercise Critique Form - Post Scenario Participant Response Form - R0-815, Procedure , Review and Approval, t 5.
Miscellaneous Documentation t Administrative Control Document, 4 ACD-15.2, Revision 0, . l < B-2 - -- , _ - _ _ _ - - - - _ _. _ _. _ _ _
, _ _ - - - _ - _ _ - - - _ - _ - - - - - - - . '. . Volume F Memoranda (Temporary Changes) 4 awl-4.1.2, Revision 1.
System Operating Procedure Writer's Guide, 4 awl-4.1.3, Revision 0.
Integrated Operating Procedures, 4 ACD-4.2, Revision S.
.
t f a B-3
__ _ _ - _ - _ __, .
, , . .. APPENDIX C CALCULATIONS REVIEWED DURING THIS INSPECTION . 1.0 Introduction 2.0 Caution
3.0 Heat Capacity Temperature Limit 4.0 Suppression Pool Load Limit
5.0 Cold $hutdown Boron Weight 6.0 Boron Injection Initiation Temperature
a - 7.0 RPV Saturation Temperature I 8.0 Maximum Orywell Spray Flow Rate Limit 9.0 Drywell Spray Initiation Pressure Li: nit ~ 10.0 Mark !! Containment Spray Initiation Pressure Limit 11.0 Suppression Chamber Spray Initiation Pressure <
12.0 Pressure Suppression Pressure l 13.0 Primary Containment Design Pressure l 14.0 Primary Containment Pressure Limit 15.0 Heat Capacity Level Limit
] 16.0 Maximum Primary Containment Water Level Limit , 17.0 Minimum Number of SRV's Required for Emergency Depressurization
18.0 Minimum SRV Reopening Pressure ! 19.0 Minimum Zero-Injection RPV Water Level 20.0 Minimum and Maximum Alternate Shutdown Cooiing Pressures and Minimum humber of SRV's Reovired for Alternate Shutdown Cooling , l l } C4 > .
_ _ _ _ _ _ _ _ _. .
. . 21.0 Minimum Alternate RPV Flooding Pressure 22.0 Minimum RPV Flooding Pressure 23.0 Maximum Core Uncovery Time Limit
Hot Shutdown Boron Weight - . C-5 \\ ,
- _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . . APPENDIX D
DETAILED COMMENTS FROM WALKTHROUGH INSPECTIONS (1) Procedure C.5 - 3001. "Re-Opening MSlYs Following a Low Low Water Level . Isolation, revision. The following deficiencies were noted: a.
Several valves specified in the procedure had both permanent tags and dymo tape indicating two different valve numbers for each valve.
- The permanent tag indicated a Bechtel number and an additional dymo , tape label indicated the correct valve number called out by the
procedure.
- Step 3 had duplicate labeling for NO-2565.
- Step 4 had dymo tape labels for MO-1181, 1182, 1183. 1184 - Step 6 had duplicate labeling for MO-2373, 2374, and 2564.
< b.
The procedure did not contain a step which placed all of the MSIV control switches in the close position before attempting to reopen ' r MSIVs following Group I isolation. Refer to drawing NX-7823-4-7.
! Operators seemed aware of the procedural deficiency and the need to reposition the switches.
(2) Procedure C.5 - 3002. "Alternate Boron injection With CRD". Revision 1.
The following deficiencies were noted: a.
Required equipment listed 230 feet of 1-1/2 inch hose.
Both hose reels had 1-3/8 inch hose rather than the size specified.
" i b.
Required equipment listeo two 1-1/2 inch quick couplings. The fittings on the hose reel were one 2 inch union and one 1-1/2 inch
union with a 1-1/2 inch to one inch NFT reducer. The reducer was not specified as required but the connection in the CRD pump room could not be made without it.
, c.
A temporary change which changed step no. 2 (Reference Volume F. No.
955) was not entered in a control room copy of the procedure. Discus-sion with the site superintendent and control room operators indicated
that the binder that was missing the temporary change was the same
j procedure that would normally be used to perform the procedure in the -
plant.
Performing the procedure during an emergency without the change , was of safety significance in that the change added steps to vent the i i temporary hose from the Standby Liquid Control Tank orain to the CRD ' pump suction. Lack of venting could cause air-binding of the CRD pump resulting in loss of boron injection capability. A review of Monticello Administrative Control Document Number 4 awl-04.1.2 , Revision 1. "Volume F Memorandums." paragraph 6.6.d indicated that f Volume F Memoranda are only placed in the master working copy of
the operations manual in the control room and not in other copies of controlled ranuals in the control room and plant.
, , D-1
, - -. _. -. _ - _ - - -.,. _.
-_ ,,.__,.,__,-_-,-r . _ _ - -. - _. - - - - - -.. - -,,, _, -.,, -,,- y __s., y-_ - -
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ -. . '. . d.
Several steps in the procedure required locked valves to be unlocked and opened.
Inspectors, observed the absence of locks on some of the valves. Discussion with plant staff indicated that a modification i had been made which removed the locks. The inspectors reconsnended to the licensee that a plant modification program should provide for the review of all modifications for the impact on E0Ps.
For E0Ps or E0P Support Procedures, the E0P change should be a process parallel with completion of the modification to minimize the time the systems . and E0Ps are not in complete agreement. Discussion with plant staff ' ' ' indicated that the removal of the locks was done under a maintenance work request rather than a modification. Two concerns were noted by inspectors. The first concern was removal of locks called out in design drawings by a work request rather than a fully reviewed and documented modification. Second, any change that would affect E0Ps or E0P Support Procedures and not be administered by some forr.al program could adversely affect the ability of operators to perform
that procedure. Step 2.J stated, "Use key 41 to open XP-18 and XP-20, Poison Tank Drain". These valves were not locked. Step 1.A.2 of 3002-1 stated, "Unlock and open DM-52 Demin Water to Poison j Tank." This valve was not locked. Other similar examples were found in steps 2.A.3, 2.A.4, 4, and S.
l e.
Operators indicated confusion over where any drainage of borated water would be directed.
f.
Operators were unclear about the time necessary to drain the tank or whether the tank had to be completely emptied to perfonn the j procedure, I g.
Operators were unclear on how to locate, transport, and load the estimated 39100 pound bags of boron, particularly if elevators were unavailable during power outage situations.
h.
Operators anticipated difficulty with communications within containment and particularly from the drywell or torus areas.
! L i.
Operators anticipated high radiation levels in the poison tank area ' , during accident scenarios. Calculations indicated that the work area
is approximately level with reactor vessel water level when the core
is two-thirds covered.
. j.
Operators were unclear about the need to put 2800 gallons in the tank if enriched boron was used, and were uncertain about the , technical basis for the 2800 gallon figure, ' k.
In one instance during the walkdown an operator mistakenly thought i the preperatory statement was a step and attempted to install the
hoses. To do so would result in removing the cap on a pressurized i line or on the suction of a CRD pump.
Rewording the sentence might L ' elimir. ate confusion.
l ' . D-2
_ _. -. - _ _ _. _ _. ,
. i .) l 1.
Step J required verification of the locked open status of valve Xp-25.
This action was unnecessary sinc. the entire valve was removed from i the SBLC drain line in a previous step in order to facilitate hose hookup.
m.
Step 3.B.4 should be performed before starting the CRD pump and step l 4.B.1 should be performed after the CR0 line is flushed to prevent l plugging the filter or pumping baron to the CST.
> l n.
Operators sent to the warehouse for boron should be trained to l
operate a forklift.
Likewise, winter truck and forklift operation i between the warehouse and plant should be assessed.
,
(3) Procedure C.5 - 3003, "Alternate Boron Injection With RWCU," Revision 1.
Tne following discrepancies were noted: ' i a.
The jumper required by step A on panel C-41, terminal point BB-2 was
t located in the panel above and behind a bundle of wires.
It would ! be difficult to attach the alligator clip while observing personnel ! electrical safety precautions.
In addition, the terminal lug barrel, i ' the normal point for jumper attachment, was insulated with the wire identification numbers. The jumper could mistakenly be attached to i lug barrel and not function because wire markings provided insulation ' i at the point of attachment. The team recomended that. a teminal
extension or test point be added to provide for jumper attachment j and allow greater personnel safety.
l ! b.
Step 1.C identified RVCU pumps as 11 and 12. The nomenclature on
the RWCU panels identified pumps 11 and 12 as 12-1A and 12-1B respectively. The team recorwended that obvious labeling inconsistencies be promptly identified and corrected.
I ' c.
Step 7A identified the cleanup phase separator tank level indicator as LI-2698 instead of L1-2699 as reqdred. The LI-2698 indicator l was for the Waste Sluc'ge tank.
I j d.
The condensate service pump control switch had dual conflicting ' l labeling. The label directly above the switch was marked from left to right "RUN OFF AUTO," the switch was marked from left to right i "AUTO STOP RUN."
. e.
Step 8 specified no valve name or number to use to empty the cleanup precoat tank, , i f.
The cleanup precoat tank T203 was not labeled.
,
Step 9B stated "Verify Precoat Pump breaker is in the on position."
- It appeared that operators were checking a power available light
' above the pump switch rather than the breaker specified in the - procedure. The team reccm ended that the step be changed to direct operators to a more reliable indication.
f h.
humerous valves in this procedure wtre identified by number rather thar name and number.
Examples included but were net limitec to: l l 0-3 ! - - . . - - . - - - -. -
. _.. _ _ _ - _._ .
. . . - Step 1.A valves MO-2397, 2398, and 2399.
- Step 1.0 valve M0-2399.
- Step 2 valves A0-12-4-14-A, 14-B.
- Step 4 all velves.
- Step 6 all valves.
- Step 7.B all valves, d.
Several different formats were used for presentation of valve, valve name, and procedural action in steps 9 through 11. Use of a consistent format will facilitate operator implementation under adverse conditions.
, (4) Procedure C.5 - 3004, "Manually Opening Scram Discharge Volure Vent and Drain Yalves," Revision 1.
The following discrepancies were noted.
a.
The procedure did not require the pressure of the nitrogen bottles , to be checked prior to or at any time during procedure use. The '
procedure should require the nitrogen pressure to be checked prior to connecting the bottles to prevent delay in obtaining new bottles
if for any reason the bottles were empty.
f b.
The bottles were in a different location than that specified by the procedure.
i c.
Step 3 stated "connect the Nitrogen supply hoses to the vertical I instrument air lines at the capped tees for the inboard and outboard [ vent and drain valves." This step was confusing since there were two potential connection points within approximately four feet of each [ other at the scram discharge drain valves. Near the floor by the drain valves are two "plugged" tees in vertical pieces of instrument ' air line. About 4 feet above the drain valves are the correct "capped" tees in vertical tuna vi instrokent air lines. During ' walkdowns, one licensed operator simulated connecting nitrogen to i the wrong points. The step should specify the location of the i required action and connection points should be conspicuously , identified.
, " , d.
Step 3B stated "Pressurize the A and B inboard and outboard vent and drain valves with Nitrogen by opening the bottle valves and operating + the regulators." The phrase "Operating the regulators" should be ' better explained. The procedure assumed the regulators were "backed ] . off" (unscrewed, counterclockwise) at the start of the procedure
i which may not be true. The pressure should be given or words added to turn the regulators in the clockwise direction until the vent and drain valves operate.
It was recommended this step be changed to , specify how to operate the regulator. Moreover, not all operators interviewed were familiar with bottle regulator operation.
(5) Procedure C.5 - 3005, "Operation of Standby Gas Treatment For Primary Containment Pressure Control," revision 1.
The following deficiencies l
were noted:
i I i ! ! i ! D-4 I
-_ _ _ _. _ _. _ _ . _ _. _ _ _. _. _ _. _ _ _ _ _.. _. _ _ _ _. - _ _ _ _.. _ _ - _ _ _ _ _.. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _., _ _ _ _ _. __ _. _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _ _ _ _ _ _ _ _ _ _ , '. ' a.
Step 4 required monitoring the off-gas release rate and securing venting the primary containment through SBGT before reaching the limits below. Listed among the limits was Stack Effluent Monitor (Ch A or B) greater than 90,000 uCi/sec (Computer ID Point D-061).
The computer point monitored whether the indicated value was "nonnal" and did not readout in units (numbers) that would allcw monitoring.
The computer point should be verified and changed. The inspectors recomended that stack monitor Regulatory Guide 1.97 instruments should be used rather than nonsafety related process computer information, b.
The second limit under step 4 listed monitoring values that would require securing ventitig.
It stated "A gaseous release estimated or expected to exceed 10 times Appendix 1 Tech Spec, limits." The Technical Specifications had no Appenaix ! or limits that would accomp,lish this step.
, c.
Several valve references in the procedure specified number rather than number and valve name. This condition was noted in step 2.A. 2.6, and 2.C.
d.
Step 3C specified the ".... drain valves to the left of SV 3-31A and SV 3-318...." The drain valve were actually located directly below the solenoids valves rather than to the left of them, e.
Position markers for drain valves were oriented such that they faced the containment wall, making it difficult to verify valve position.
f.
Step 3.B did not contain a statement to open or verify open the hose valves.
(6) Procedure C.5 - 3006. "Venti 9 orimary containment:" Revision 1.
o No deficiencies other than minor labeling deficiencies were noted.
(7) Procedure C.5 - 3007, "RpV Makeup With CRD," Revision 1.
o ho deficiencies other than minor labeling deficiencies were noted.
(8) Procedure C.5 - 3009, "Bypass Secondary Containnent HVAC !salation Interlocks," Revision 1.
The following discrepancies were noted: , l a.
Step 1.A and 1.B. soecified terminal boards that were incorrect. The procedure specified a jumper from E-34 to E-52 in panel C-15.
Terminal boards should be correctly specified as EE-34 to EE-52. On stea 1.E the procedure specified a jumper from B-57 to B-52 on panel C-15.
Correct terminal board identification should be BB-57 to BB-52.
b.
Step 2 required the operation of corponents of the Reactor Builcing HVAC system as required. Step 2. A.1 listed supply fans and 2. A.2 listeu exhaust fans.
Scre supply fans were interlocked so that to start onc run the supply fan, the exhaust fan must be running.
If the steps were performed sequentially as the procedure requires, a 0-5 _ _ _
_ - _ - . Q l supply fan could not be started since the exhaust fan in the
- preceding step would not be running. The procedure should be changed so L that the sequential order does not have to be violated to accomplish ! the action.
c.
Step 2B required opening or verifying open several dampers. Some of ( the dampers were sets (2 dampers in series) and were designated as i follows: V-D-7 (8) l V-D-9(10) In general, for most procedures, use of the parenthesis in this fashion meant the number included was for the opposite train; that is, dampers 7 and 9 would line up A train, a d dampers 8 and 10 would line up B train. That was not true in this case, however. The numbering was misleading because both dampers (7 and 8) had to be
open to provide a flow path. The procedure should be changed to
provide correct technical information.
d.
The dampers in step 2.8 were very difficult for the operators to locate.
Operators stated the procedure did not contain enough infomation concerning damper location and they had to locate and make copies of other procedures to locate the dampers. One operator located and made a copy of Test #1265 "Quarterly Reactor Building
i Ventilation System Automatic Isolation Test, Revision 3 " which
listed damper locations. Even with the additional procedural ] guidance, difficulty was encountered in ensuring the darpers were
the correct ones due to missing or infomal identification labeling, e.
Dampers were not marked with open and close positions, so operators had to assume that for all dampers an extended rod on the operating
cylinder meant the damper was open.
Requiring operators to remember "extended rod means open" for these dampers, when for other dampers in the plant that might not be true, was not an adequate method for detemining damper position in this procedure. Position indication should be added for all dampers in this procedure, f.
Damper V-0-9 and V-D-10 were located at the 978 foot level on the duct entering the M set room in tha northwest corner of the Reactor Building. The darpers were aboyt 15 feet from the floor with a mirror installed to view the damper operating rods and linkages.
- Two separate operators could not verify the position of both dampers from the flocr using the mirror during walkthroughs.
In order to verify the dampers, operators would have had to locate a ladder to perform the verification. The procedure and equipment design should f acilitate rapid locaticn and verification of the damper lineup.
g.
Step 2.B required the operator to verify open or open the dampers.
The procedure di'J not specify instructions, method, or required tools and equippent to open the dampers in the event a damper was found closed.
Jiscussions with several operators indicated that a standard metho9 for acco:nplishing this task oto not appear to be documented an( that training had hut been conducted. Without 0-6
._ _.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - . O ' instructions, tools, equipment (ladders), and training, the ability of operators to conduct this task in a timely manner was questionable.
The resolution of this discrepancy should address all aspects of the action (procedure, equipment, and training).
In addition, performance of this step may require entry into a high radiation area if SBGT is processing radioactive gasses. A caution note may be appropriate.
. h.
The secuence of fan operation in step 2.A appeared to be reversed.
Typically, exhaust fans are started first in ventilation systems.
Based on the procedure walkthroughs with licensed operators and inspector findings identified above, the team concluded that the E0P support procedures had inadequate verification and validation and that operator training to suppurt procedure perfortnance was considered inadequate.
Series C.4 - Abnomal Procedures , (1) Procedure C.4-A, "Reactor Scram " Revision 2.
Inspectors concluded that the procedure could be adequately performed and that some churved operator training deficiencies would be mitigated due to as 'bility of multiple operators at the main control panels and lead operator and shif t supervisor ovtrview. The following deficiencies were noted: a.
The operator selected and started driving in SRMs/IRMs after step 5 of the imediate action "Verify Power is Decreasing," prior to completing the remaining 31 mediate operator actions.
Inserting SRM and IRM detectors was a supplemental action and should not take priority over imeciate actions, b.
The reactor mode switch was placed in refuel to verify "all rods l in."
The imediate action step 3 places the reactor mode switch in SHUTOOWN. Cycling the reactor mode switch from SHUTDOWN to REFUEL was not specifically allowed by the procedure. Additional redundant rethoos to verify rod position included the Roo Worth Minimizer and 00-7 printout on the plant computer. The inspector discussed the sttps with the operator at the conclusion of the interview. The sr.r.e operator was observed to repeat the error during simulator drills two days later. The team reccanended that additional training be conducted to ensure performance of inneatate scram actions are in accordance with procedures.
' c.
! mediate Action ho, 8 "Verify the Scram Discharge Volume Vent and Drain Valves Close," was not performed from memory. When the procedure was referenced, imediate actions were verified complete prior to perfoming supplemental actions required by the procedure.
, d.
Supple.Tental action step 1.A required trar,sferring buses 11, 12, 13, 14 from 2R to IR if breaker BN11 is open.
A procedural note stating that an automatic transfer may already have occurred if 8N4 and EN11 had both opened would enhance the procedure.
D-7 ,
. ___ _ _ _ _ _-. _ _ _ _ __ _ _ _ _ _ . '. . APPENDIX E DETA! LED S!MULATOR SCENARIOS USED IN E0P VALIDATION ! ~ AND OPERATOR PERFORMANCE EVALUATION 5 Crew 1. Scenario 1 i ! (1), Initial Plant Conditions: 100 percent Reactor Power, RCIC System Out of ' Service (2) Scenario Malfunctions Inserted: Lots of reactor feedwater with subsequent TaWre of the high pressure coolant injection (HPCI) system.
, The scenario was designed to exercise operators and validate the following - E0P flowpaths under dynamic conditions: , . , - C.5-1101 RPV Level Control I - C.5-1102 RPY Pressure Control i - C.5-1201 Torus Water Temperature Control ! C.5-1204 Torus Water Levol Control - C.5-2001 RPV Level Restoration - C.5-2002 Emergency RPV Depressurization The following E0Ps were also entared briefly during the course of the scenario due to the requirements for all E0Ps in each series to be entered i when any entry condition is satisfied: ' - C.5-1103 RPV Power Control - C.5-1202 Drywell Temperature Control i - C.5-1203 Primary Contairs,ent Pressure Control l (3) Observations: The inspection team made the following observations of the simulator validatio' Jf the E0Ps and follow-up discussions with the facility operators and simulttor staff: a.
All required E0P flowpaths were properly executed by the operating crew.
b.
Shift Supervisor direction to the crew was good.
Crew comunications were informal and occasionally mislerding to the ! - Shift Supervisor in his noministration of the E0Ps as well as to the ! individual crew members. For example, the Shift Supervisor at one point asked %het have we got for power?." intending to detemine the i ' electrical output of the diesel generator. The RO responded in terms of reactor power. The team noted that some informality in comunication.
, including use of hand gestures and brief exchanges using nonspecific or
nontechnical terminology, was a function of the individual crew's exten- [ sive background with the f acility and years of interaction among the [ individual operators and supervisors.
The team related to the licensee the hszards associated with infomality in control room comunications, i I i i E-1
y-.n - - - -,. -, .,e,-- --n.
,-, -.., ,,,. -. -... - - -. -, , -
~ - _ - - . O Crew 1. Scenario 2 (1) Initial Plant Conditions: 100 percent reactor power, late in core life, no equipment out-of-service.
(2) Scenario Malfunction Inserted: Small LOCA (size increased as scenario event progressed as required to validate E0P flowpaths).
Late in the sceriario, the power supply to the SPDS systeni was de-energized.
- The scenario was designed to validate the following E0P flowpaths under dytiamic conditions:
- C.5-1101 RPV Level Control - C.5-1102 RPV Pressure Control - C.5-1202 Drp ell Temperature Control - C.5-1203 Primary Containment Pressure Control
- C.5-1302 Secondary Containment Radiation Control The following E0Ps were also entered briefly during the course of the scenario due :o the requirements for all E0Ps in each series to be Entered when any entry condition is satisfied: - C.5-1103 RPV Power Control - C.5-1201 Torus Water Temperature Control - C.5-1204 Torus Water Level Control - C.5-1301 Secondary Containment Temperature Control - C.5-1303 Secondary Containment Water Level Control (3) Observations: The inspection team made the following observations of the simulator validation of the E0Ps and follow-up discussions with the facility operetors and simulat e m ff: a.
All required E0P flowpaths were properly executed by the operating crew, b.
Initiation of Drpell Spray as required by the procedure was delayed due to the loss of the SPOS system, illustrating the extent to which operators have apparently come to rely on SPDS for plant parameter informa tion. The STA could not initially locate torus air tempera-ture indication as required in order tu determine if drp ell spray was permitted. The simulator modeling of the process computer was , incomplete and these points were not modeled. The STA had decided initially to use drywell air temperature until corrected by a reactor operator. A recorder was eventually discovered on a back panel and reported to the STA. He was then able to detemine that drpell spray was permittec. hhile the SPDS is a valuable tool, operator anc STA training should include several scenarios with the system unavailable to ensure crews do not rely too heavily upon SPDS.
c.
The procedure contained no direction to the operators concerning securing drpell sprays or verifying the system shutdown interlock functioned correctly. The team recomendec that a caution statement or note concerning drawing a vacuum in primary containment appears E-2
t ' . ' ' l . , e warranted by the limited external design pressure (+2 psig) and the
j high flow rate potential of the drywell spray.
Crew 1. Scenario 3
(1) Initial Plant conditions: 100 percent reactor power, late in core life, Ito equipment out-of-service.
, I , (2) Scenario Malfunction Inserted: Stuck open relief valve sith failure to ! i
- scram when manually inserted. Subsequent break of relief valve ta11 pipe l
i above waterline in drywell. Standby liquid control failed to inject, , forcing operators to consider boron injectinn using alternate me6ns.
. , The scenario was designed to observe operators and validate the following E0P i a flowpaths under dynamic conditions: i j - C.5-1101 RPV Level Control
- C.5 1102 RPV Pressure Controi , j - C.5-1103 RPV Power Control j - C.5-1201 Torus Water Temperature Control - - C.5 1202 Orywell Temperature Control
- C.5-1204 Torus Water Level Control ' - C.5-1302 Secondary Containment Radiation Control I - C.5-2002 Emergency RPV Depressurization
- C.5-2005 RPV Flooding j - C.5-2007 Level / Power Control i l The following E0Ps were also entered briefly during the course of the ] scenario due to the requirements for all E0Ps in each series to be entered I when any entry condition is satisfied: ! - C.5-1301 secondary Containment Temperature control j - C.5-1303 Secondary Contat..a nt Water Level Control I (3) Observations: The inspection team made the following observations of the ! simulator validation of the E0Ps and follow up discussions with the j facility operators and simulator staff: l a.
All required FOP flowpaths were properly executed by the operating j crew.
l Crew 1. Scenario 4 '
(1) Initial Conditions: 100 percent reactor power, late in core life. HPCI ' j inoperable T l (2) Scenario Malfunctions Inserted: no.12 EDG Fail to start, no.11 and no.
D residual heat removal (RFR) pumps tripped, #11 core spray pump ' ' tripped, reactor core isolation cooling (RCIC) turbine trip, loss of offsite power.
The scenario was designed to observe operators and validate the following E0P flowpaths under dynamic conditions: E-3 - .
__ _ _ _ _ _ _ - _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - _ - _ _ _ _ - _ _ _ _ _ _ _ O . - C.5-1101 RPV Level Control ' - C.5-1102 RPY Pressure Control - C.5 1201 Torus Water Temperature Control C.5-1204 Torus Water Level Control - C.5-2001 RPV Level Restoration - C.5-2003 Steam Cooling The following E0Ps were also entered briefly during the course of the scenario due to the requirements for all E0Ps in each series to be entered when any entry condition is satisfied: - C.5 1103 RPV Power Control - C.5-1202 Drywell Temperature Control - C.5-1203 Primary Containment Pressure Control (3) Observations: The inspection team made the following observations of the simulator validation of the E0Ps and follow-up discussions with the
facility operators and simulator staff: a.
All required E0P flowpaths were properly executed by the operating crew, b.
The crew was very aware of the plant equipment availability limitations during the scenario and conducted a thorough search for alternate injec-tion systems. When the scenario ended, the crew was attempting to use a diesel driven fire pump to inject water into the RPV.
Crew 2, scenario 1 (1) Initial Plant Conditions: 100 percent reactor po..r. HPCI system out of service scenario malfur:tions inserted: Loss of feed. RCIC Turbine Trip, open indication for one ADS valve fails.
The scenario was designed to observe operators and validatt the following E0P flowpaths under dynamic conditions: - C.5-1101 RPV Level Control - C.5-1102 RPV Pressure Control - C.5-1201 Torus Water Temperature Control - C.5 1204 Torus Water level Control - C.5-2001 RPV Level R:storation - C.5-2002 Emergency RPV Depressurization . The following E0Ps were also entered briefly during the course of the scenario due to the requirerents for all E0Ps in each series to be entered when any entry condition is satisfied: C.5 1103 RPV Power Control - C.5 1202 Crywell Teniperature Control - C.5-1203 Frtrary Containment Pressure Control (3) Observations: The inspection team made the following observations of the simulator validation of the E0Ps and follow up discussions with the facility operators and simulator staff: E-4
i i O
- ! 'O
1 ! . . j a.
The STA departed from his official advisory capacity and directed the {
Shift Supervisor on E0P use throughout the simulator event. Although i i the specific actions in which the STA directed the Shift Supervisor ! generally reflected accurate guidance, his extensive involvement i preempted the Shift Supervisor.
I i b.
The Reactor Operator (RO) placed the mode switch in REFUEL to verify ' all rods inserted and did not leave the mode switch in SHUTOOWN as ! directed by procedure C.4, Reactor Scram, i ! a l c.
The Shift Supervisor gave direction to R0 to open an additional ! J relief valve when notified one ADS valve did not open, an appropriate
direction.
, d.
All required E0P flowpaths were executed.
- Crew 2, Scenario'2
j (1) Initial Conditions: 100 percent reactor power, late in core life, no l equipment out of-service.
i
i l (2) Scenario Malfunctiois Inserted: Steam leak in reactor building (rectre ! i system sample line) in RWCU nonregenerative heat exchanger area. Sample i line isolation valves were overridden in open position.
Instrument line i j rupture in drywell and two percent fuel failure occurred when the reactor , I was manually scrammed. Control rod drive area radiation read offscald high I j imediately af ter scram and RWCU area radiation slowly ramped to offscale ! ! high during the scenario.
! I I ) The scenario was designed to observe operators and validate the following l l E0P flowpaths under dynamic conditions:
I - C.5-1101 RPV Level Control l
- C.5-1102 RPV Pressure Control
i - C.5-1202 Orywell Teeperature Control !
- C.5-1203 Primary Containment Pressure Control ! l C.5-1301 Secondary Containment Terperature Control - C.5-1302 Secondary Containment Radiation Control
i
i The following E0Ps were also entered briefly during the course of the j scenario cue to the requirements for. ell E0Ps in tach series to be entered -
j when any entry condition is satisfied: l ' C.5-1103 RPV Power Control [ I - C.5-1201 Torus hater Temperature Control ! - C.5-1204 Torus Water level Control i - C.5-1303 Secondary Contaiturent Water Level Control f (3) Observations: The inspection team made the following observations of the simulator validation of the E0Ps and follow up discussions with the facility operators and strulator staff: E-5
. e < e, ! i a.
Shift Supervisor gave good direction to attempt to isolate the leak.
l
i He was knowledgeable about affected systems.
In addition the crew attempted to insert a stoup isolation signal to effect valve closure, j i I b.
The Shift Supervisor entered the 1100 Series procedures at the ! appropriate time, i , i
c.
After the crew had bypassed and reopened the M51Ys, a MSL High ! I Radiation alarm was received (the crew'ss first real indication of the fuel failure). The Shift Supervisor and Site Superintendent were t i
quick to isolate the main steam lines as required.
Five minutes >
later, the Shift Supervisor discussed using the main steam line ', dreins for pressure control. The RO reminded him of the fuel j failure and the fact that condenser vacuum had been broken when seal i ' steam was lost.
' d.
Shift Supervisor decided to depressurize the RPV i.,eccordance wita
step SA of the C.5-1102 flow chart. He directed the RO to align e .i RCIC manually, ho announcertwnt was made to alert personnel in the l i { Reactor Building. With a fuel failure in progress, potential - ) over-exposure could have resulted.
e.
Although the plant conditions reflected the second override statement - of the 1300 series E0Ps, the Shift Supervisor did not recognize the
requirement or take the specified action and did not direct secondary containtrent HVAC restart using C.5-3009 as required by caution number ' i 20.
! f.
Shift Supervisor E0P direction was tentative, but all required E0P j flowpaths were eventually executed.
! g.
STA/ Site Superintendent directed RO control manipulations during tre j scenario event without, consulting with the Shif t Supervisor.
l Crew 2, Scenario 3 i _ (1) Jnitial Plant Conditions: 100 percent reactor power, late in core life, j no equipment out of service.
! ] (2) Scenario Ma' function Inserted: Stuck open relief valve with failure to scram when manually inserted.
Subsequent break of relief valve tailpipe , j above water-line in drywell.
Standby liquid control failed to inject ! for'ing irjection of boron using alternate stans.
I ' The scenario was designed to observe operators and validate the followir.g E0P flowpaths under dynamic conditions: i ! - C.5 1101 RPY Leve' Control j - C.5-1102 RPV Pre i.
Control rol - C.5-1103 RPV Pow - . I - C.5-1201 Torus W4 < eperature Control l - C.5-1202 Drymell i,..,,erature Control ! - L 5-1203 Prio ry Contairnent Pressure Control I f i [*6 l i % i _. _ _ _ _ .
!- , i, ' - C.5-1204 Torus Water Level Control - C.5-1302 Secondary Containment Radiation Control - C.5-2002 Emergency RPV Depressurization - C.5-2006 RPV Flooding - C.5-2007 Level / Power Control The following E0Ps were also entered briefly during the course of the , scenario due to the requirements for all E0Ps in each series to be entered when any entry condition is satisfied: - - C.5-1301 Secondary Containment Temperature Control - C.5-1303 Secondary C9ntainment Water Level Control (3) Observations: The inspectinn team made the fte. lowing observations of the simulator validation of the E0Ps and follow-up discussions with the facility operators and simulator staff: , a.
The Shift Supervisor entered the E0Ps at the appr^priate time and recognized the ATWS condition. While executing s 5-1103, he made an incorrect decision. He did not elect to perform steps 4 and 5 concurrently with the remainder of the procedure. He originally elected to hold step 4 pending torus water temperature increase to 110 degrees F.
When the steam break occurred and the torus was bypassed, the Shift Supervisor did not recognize that the plant conditions satisfied the basis for this step even though water temperature was not increasing. Consequently, he did not answer the question "yes" and proceed to boron injection until forced to later in the scenario. He did attempt to reset and repeat the scram, but was diverted to C.5-1202 and C.5-1203 by the tailpipe break. The STA and Site Superintendent discussed using C.5-2007. The Shift Supervisor then elected to use C.5-2007, level / Power Control. He continued into C.5-2007 and lowered RPV water level per step 1 in the Level / Power Control procedure. He did not continue concurrently to step 4A in C.5-1103 as required and as a result did not attempt to initiate boron injection at that time. The plant conditions had exceeded the Torus Pressure Limit curve and were in a "spray (not pennitted" area of the Drywell Spray Initiation Lim % Curve 290 deg air temperature /44 psig). The Shift Supervisor d1risted drywell spray initiation and one minute later the Site Superintendent recognized drywell spray had been initiated and countermanded that instruction.
The SPDS system was disabled at this pcint in the , scenario. When drywell pressure reached 56 psig th Shi'+ Supervisor decided to emergency depressurize using C.5-2002. With orywell pressure at 60 psig, the attempt was finally made to initiate SLC.
When drywell pressure reached 70 psi 0, boron was allowed to inject.
The scenario was terminated when the decision was made to vent containment (75 psig).
b.
The crew did not refer to the Heat Capacity Temperature Limit Curve.
They did direct ADS initiation ds required by the procedure, but the Site Superintendent stopped this action.
c.
No reference was mtde to NPSH limits for ECCS pumps even though torus water temperature reached D0 degrees.
E-7 - - -
c' .; . d.
The Shift Supervisor was not sufficiently familiar with the E0P flowcharts to readily recognize key parameters and establish decisional priorities.
Crew 2, Scenario 4 (1) Initial Plant Conditions: 100 percent reactor power, late in core life, B Loep of RHR out-of-service (both pumps), RCIC Turbine out-of-service.
(2) '_ Scenario Malfunctions Inserted: Loss of offsite power with failure of the
- 15 bus (Faulteo bus), HPCI fails to inject.
The scenario was designed to evaluate operators and validate the following E0P flowpaths under dynamic conditions: - C.5-1101 RPV Level Control
- C.5-1102 RPV Pressure Control - C.5-1202 Drywell Temperature Control - C.5-1203 Primary Containment Pressure Control - C.5-2001 RPV Level Restoration - C.5-2002 Emergency RPV Depressurization - C.5-2004 Spray Cooling The following E0Ps were also entered briefly during the course of the scenario due to the requirements for all E0Ps in each series to be entered when any entry condition is satisfied: - C.5-1103 RPV Power Control - C.5-1201 Torus Water Temperature Control - C.5-1204 Torus Water Level Control ' ' (3) Observations: The inspection team made the following observations of the simulator validation of the E0Ps and follow-up discussions with the facility operators and simulator staff: ' a.
While all steps required to place the plant in a safe condition were carried out, the Shift Supervisor never entered the spray cooling procedure, nor did he acknowledge the key in C.5-2001 directing him to the C.5-2004 procedure.
b.
The Shift Supervisor directed one Reactor Operator to start the RHR . pumps supplied by the faulted electrical bus. The operator did take t l the pump control switch to RUN and corrrnenced lining up th system for torus cooling.
The pump breakers closed because 125 VDC w er was , available, but the pump did not start due to loss of bus witage.
i The operator did not realize the pump had not started until halfway through his valve lineup.
He did not check his board indi eticn for a pump si rt.
l c.
The crew operated without referring to nonnal system or uwmal plant procedures.
E-8 ' i
- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ o 'o Crew 3, Scenario 1
(1) Initial Plant Conditions: 100 percent reactor power, RCIC system out of service (2) Scorario Malfunction Inserted: Less of reestor icedwater with tubsequent TaITure of the high pressure coolant injection (HPCI) system.
The scenario was designed to evaluate operators and validate the following E0P flowpaths under dynamic conditions: - C.5-1101 RPV Level Control - C.5-1102 RPV Pressure Control - C.5-1201 Torus Water Teupereture Control - C.5-1204 Torus Water Level Control - C.3-2001 RPV Level Restoration - C.5-2002 Emergency RPV Depressurization - The following E0Ps were also entered briefly during the course of the scenario due to the requirements for all E0Ps in each series to be entered when any entry condition is satisfied: ' - C.5-1103 RPV Power Control - C.5-1202 Drywell Temperature Control - C 5-1203 Primary Containment Pressure Control (3) Observations: The inspection team made the following observations of the i simulator validation of the E0Ps and ' cow-up discussions with the facility operators and simulator sta: a.
All required E0P flowpaths were properly executed by ?.he operating Crew.
b Shift Supervisor direction to the crew was excellent. Site Superintendent actions and crew interaction demonstrated a clear understanding of E0P goals and plant conditions as well as administrative policies.
Crew 3, Scena.rio 2 (1) Initiai Plant Conditions: 100 percent reactor power, late in core life.
no equipment out-of-service.
(2) Scenario Malfunction inserted: Stuck open relief valve with failure to scram when manually inserted. Subsequent break of relief valve tailpip'- above water-line in drywell.
Standby liquid c.ontrol failed to inject forcing injection of boron using alternate means.
The scenario was designed to observe operators and validate the following E0P flowpaths under dynamic conditions: C.5-1101 RPV Level Centrol - C.5-1102 RPV Pressure Control - C.5-1103 RPV Power Control E-9 - _ _ _ _ _ _
- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. . _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ - _
s ? . p , ' - C.5-1201 Torus Water Temperature Control - C.5-1202 Drywell Temperature Control - C.5-1203 Primary Containment Pressure Control - C.5-1204 Torus Water Level Control - C.5-1302 Secondary Containment Radiation Control - C.5-2002 Emergency RPV Depressurization - C.5-2006 RPV Flooding - C.5-2007 Level / Power Control The following E0Ps were also entered briefly during the course of the scenario due to the requirements for all E0Ps in each series to be entered when any <:itry condition is satisfied: - C.5-1301 Secondary Containment Temperature Control - C.5-1303 Secondary Containment Water Level Control (3) Observations: The inspection team made the following observations of the
simulator validation of the E0Ps and follow-up discussions with the facility operstors and simulator staff: a.
All required E0P flowpaths were properly executed by the operating crew.
. b.
Drywell pressure was not promptly vented when pressure reached 56 psig because operators were involved in C.5-2006, RPV Flooding. When the Shift Supervisor was informed drywell pressure was 58 psig, he immediately proceeded to the vent step in C.5-1203 and gave the appropriate direction, c.
The crow demonstrated excellent procedure usage.
. E-10 }}