IR 05000272/2008009

IR 05000272-08-009, on 10/21/2008-12/12/2008, Salem Nuclear Generating Station Unit No. 1, Special Inspection Report, Procedures, Operator Performance, Corrective Action

ML090200076
Person / Time
Site:	Salem
Issue date:	01/20/2009
From:	Arthur Burritt Reactor Projects Branch 3
To:	Joyce T Public Service Enterprise Group
Burritt A RGN-I/DRP/PB3/610-337-5069
References
IR-08-009
Download: ML090200076 (40)

Text

ary 20, 2009

SUBJECT:

SALEM NUCLEAR GENERATING STATION, UNIT NO. 1 -

NRC SPECIAL INSPECTION REPORT 05000272/2008009

Dear Mr. Joyce:

On December 12, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at the Salem Nuclear Generating Station Unit No. 1. The special inspection examined activities associated with an unplanned loss of reactor coolant inventory while draining the pressurizer as part of a planned evolution. The NRC's initial evaluation satisfied the criteria in NRC Management Directive 8.3, NRC Incident Investigation Program, for conducting a special inspection. The basis for initiating this special inspection was further discussed in the inspection charter that is included in this report as Attachment A.

The enclosed inspection report documents inspection findings discussed on December 12, 2008, with R. Braun and other members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The report documents three NRC identified findings of very low safety significance (Green).

Two of the findings were determined to involve violations of NRC requirements. Because of their very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest the NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Salem Nuclear Generating Station. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Arthur L. Burritt, Chief Projects Branch 3 Division of Reactor Projects Docket No: 50-272 License No: DPR-70 Enclosure: Inspection Report 05000272/2008009 w/Attachments cc w/encl:

W. Levis, President and Chief Operating Officer, PSEG Power R. Braun, Site Vice President P. Davison, Director of Nuclear Oversight E. Johnson, Director of Finance G. Gellrich, Salem Plant Manager J. Keenan, General Solicitor, PSEG M. Wetterhahn, Esquire, Winston and Strawn, LLP L. Peterson, Chief of Police and Emergency Management Coordinator P. Baldauf, Assistant Director, NJ Radiation Protection Programs P. Mulligan, Chief, NJ Bureau of Nuclear Engineering, DEP H. Otto, Ph.D., Administrator, DE Interagency Programs, DNREC Div of Water Resources Consumer Advocate, Office of Consumer Advocate, Commonwealth of Pennsylvania N. Cohen, Coordinator - Unplug Salem Campaign E. Zobian, Coordinator - Jersey Shore Anti Nuclear Alliance

SUMMARY OF FINDINGS

IR 05000272/2008009; 10/21/2008-12/12/2008; Salem Nuclear Generating Station Unit

No. 1; Special Inspection Report; Procedures, Operator Performance, Corrective Action.

The report covered a 12-day period of onsite inspection by a special inspection team consisting of two senior project engineers and one reactor inspector. Three findings of very low safety significance were identified. The significance of most findings is indicated by their color (Green,

White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, ASignificance Determination Process@ (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC=s program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, AReactor Oversight Process,@ Revision 4 dated December 2006.

Cornerstone: Initiating Events

Green.

The inspectors identified a self-revealing Green non-cited violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings because PSEG did not provide operators with a procedure that contained appropriate quantitative and qualitative information to ensure that activities affecting safety can be satisfactorily accomplished. PSEG did not maintain an adequate procedure for draining the Unit 1 pressurizer. Due to the inadequate procedure, operators unintentionally drained the reactor coolant system (RCS) to the top of the RCS hot leg without the appropriate controls in place.

This performance deficiency was greater than minor because it was associated with the procedure quality attribute of the Initiating Events Cornerstone and affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown conditions. Specifically, the pressurizer draining procedure did not include the guidance necessary to ensure that operators used diverse and redundant indications to control RCS inventory during pressurizer drain down. This affected the shutdown critical safety function of maintaining adequate reactor inventory, and potentially affected the decay heat removal shutdown critical safety function by approaching mid-loop operations without the appropriate controls. If operators had not recognized the faulty cold-calibrated pressurizer level indication, continued draining would have adversely impacted operation of the RHR system that was providing decay heat removal for the reactor coolant system. This finding has a cross-cutting aspect in the area of human performance, resources, because PSEG did not ensure that complete accurate and up-to-date procedures were adequate to assure nuclear safety. H.2(c) Specifically,

PSEG did not incorporate lessons learned from the substantial amount of industry operating experience regarding recurring inadvertent reductions of reactor coolant system inventory into procedure IOP-6. (Section 3.3)

Green.

The inspectors identified a green non-cited violation of Technical Specification 6.8.1, Procedures and Programs, because operators did not implement actions required per procedure S1.OP-AR.ZZ-0005(Q), Overhead Annunciators Window E, in response to a Pressurizer Heater Off Level Low alarm.

This contributed to PSEG not promptly recognizing an inaccurate cold-calibrated level instrument during the pressurizer draining evolution and over-draining the pressurizer.

This performance deficiency was greater than minor because it affected the human performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown. Implementation of actions in S1.OP-AR.ZZ-0005(Q) in response to the Pressurizer Heater Off Level Low alarm would have aided the operators in discovering the inaccurate cold-calibrated pressurizer level instrument sooner and likely prevented over-draining the pressurizer. This finding had a human performance cross-cutting aspect in the area of work practices in that PSEG did not follow procedure OP-AA-103-102,

Watchstanding Practices. Specifically, during this event, PSEG did not use diverse indications, maintain a questioning attitude, and properly implement alarm response procedures in accordance with OP-AA-103-102, Watchstanding Practices. (H.4(b))

(Section 3.6)

Green.

The inspectors identified a self-revealing Green finding because on October 15, 2008, operators drained the RCS to the top of the reactor vessel hot leg without implementing the controls required to protect the source of decay heat removal for the plant. PSEG did not complete corrective actions that it had identified for industry operating experience in accordance with the requirements of PSEG procedure NC.NA-AP.ZZ-0006(Q), Corrective Action Program. Specifically, PSEG did not complete corrective actions deemed necessary based on a review of the circumstances surrounding the March 1997 Sequoyah loss of control of pressurizer inventory event.

This performance deficiency was greater than minor because it affected the human performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown. Specifically, not completing corrective actions specified as a result of PSEGs review of the 1997 Sequoyah event contributed to the loss of control of inventory in the pressurizer on October 15, 2008. This affected the shutdown critical safety function of maintaining adequate reactor inventory and potentially affected the decay heat removal shutdown critical safety function by entering mid-loop operations without the appropriate controls. (Section 3.7)

Licensee-Identified Violations

None.

REPORT DETAILS

1. INTRODUCTION

1.1 Special Inspection Scope The NRC conducted this inspection to evaluate and assess the circumstances surrounding and the risk significance associated with the October 15, 2008, reactor coolant system (RCS) drain down evolution at Salem Unit 1. The NRC reviewed deterministic and probabilistic criteria contained in Inspection Manual Chapter (IMC)0309, Reactive Inspections, and determined that a special inspection was warranted.

The special inspection team charter, provided as Attachment A, summarizes the details of this review and provided additional direction to the special inspection team on areas of inspection.

The inspection team used NRC Inspection Procedure 93812, Special Inspection, for the conduct of this inspection. The team reviewed procedures, corrective action documents, work requests, engineering calculations, the prompt investigation report, an apparent cause evaluation, and the root cause evaluation. The team also interviewed key plant personnel regarding the event, observed a simulator re-creation of the event, and reviewed other relevant documents. A list of personnel interviewed and documents reviewed are provided as Attachment B.

1.2 Preliminary Risk Significance of the Pressurizer Drain Down Event The NRC performed a risk assessment that included conservative assumptions to determine if a special inspection was warranted for the October 15 pressurizer drain down event. This assessment determined a conditional core damage probability that bounded the worst case conditions and applied the results to criteria contained in IMC 0309 to determine the appropriate NRC response. The preliminary risk assessment for this event was refined during this inspection and is summarized in Section 3.12 Using Inspection Manual Chapter (IMC) 0609, Appendix G, a Region I Senior Reactor Analyst (SRA) conducted a preliminary risk estimate of the October 15 pressurizer drain down event at Salem Unit 1. Based upon best available information at that time, the SRA made the following assumptions pertinent to the risk estimate:

• Only one pressurizer level instrument (cold-calibrated) was relied upon by the operators for this evolution

• One train of low pressure injection and one train of medium (1500 psi) pressure injection was readily available (opposite emergency core cooling system (ECCS)train administratively tagged out of service to prevent inadvertent over-pressurization during solid plant operations, but available within a relatively short time period, if needed)

• Shutdown cooling (Residual Heat Removal (RHR)) remained in service throughout the event

• Steam generators were filled and available for decay heat removal, if needed

• The reactor coolant system (RCS) was vented via a power-operated relief valve to the pressure relief tank

• Time to loss of RHR cooling (from commencement of RCS drain down) was greater than two hours

• Operator credit for initiation of RCS injection is reduced due to the misleading pressurizer level instrument Using the 0609, Appendix G, Table 1, Loss of Control, and Attachment A, Checklist 2, PWR Cold Shutdown Operations, the SRA concluded that a quantitative Phase 2 assessment was warranted. Per Appendix G, Attachment B, Step 4.5, and Worksheet 2, SDP for PWR Plant - Loss of Level Control with the RCS Vented, the SRA estimated the conditional core damage probability of this event to be in the mid to high E-6 range.

The dominant core damage sequence involves a loss of inventory event coupled with the subsequent loss of RCS injection due to operator error.

Based upon the preliminary conditional core damage probability estimate, this event fell within the overlap (no additional inspection) to Special Inspection Team range for reactive inspections, per IMC 0309.

1.3 Actual Risk Significance of Pressurizer Drain Down Event The NRC evaluates the risk of shutdown events in accordance with IMC 0609, Appendix G, Shutdown Operations Significance Determination Process. The inspectors determined that the loss of RCS inventory that occurred, with actual water level in the surge line reaching the top of the hot leg, constituted a reduced reactor inventory conditions per Appendix G without the necessary precautions being established. This occurred because a pressurizer cold-calibrated level instrument was reading erroneously high during a pressurizer drain down evolution. Although this was of concern, the actual risk of this event was low because the existing inventory in the reactor vessel head and the primary side of all four steam generators was sufficient to ensure that shutdown cooling would have continued for at least five more hours without any additional operator action. Specifically, the RCS piping that supplied the residual heat removal system suction piping would have remained full of water until the remaining inventory had been depleted. Section 3.12 provides additional details relative to the actual risk assessment of this event.

2. EVENT DESCRIPTION

The purpose of this section is to provide a high level summary of the major activities prior to and after the pressurizer drain down event. See Attachment C for a detailed event chronology.

On October 14, at 8:00 p.m. the Salem Unit 1 reactor was tripped in preparation for cooldown to begin the 19th refueling outage. The plant entered cold shutdown on October 15 at 2:07 a.m. Subsequently, the pressurizer was filled to a full condition (water solid) and later that morning four hydrogen peroxide additions were made with the first three being made to the RCS and the last one into the pressurizer. The last operating reactor coolant pump (RCP) was stopped 25 minutes after the last addition at which time RCS pressure rapidly decreased from about 315 psig to about 20 psig. This rapid depressurization, in conjunction with a higher than normal dissolved gas concentration, caused the reference leg of the cold-calibrated pressurizer level instrument (LT462) to partially void as a result of dissolved gasses coming out of solution which sent a portion of the water from the unsealed reference leg back into the pressurizer which, in turn, caused an erroneously high reading. Operators were not aware that LT462 became inaccurate since they were not monitoring this indication at this point in the evolution.

On October 15, at 3:43 p.m., operators began to drain the pressurizer from a water solid condition to a target level of 10-15% by LT462. RCS inventory was being initially drained from the pressurizer into the volume control tank (VCT) and later into the waste holdup tanks (HUT). Indicated LT462 level started at about 144%, which was significantly above the 100 to 105% expected level. It took 43 minutes for LT462 level to move off of its starting point of 144%, and it took another 42 minutes for indicated level to reach 100% indicated level. The crew continued the drain down until level unexpectedly stabilized at 80%, at 5:26 pm. The control room supervisor (CRS) directed the reactor operator (RO) to halt the drain down to evaluate the conditions. After about 9 minutes, the CRS directed the RO to raise charging flow, which increased RC inventory.

Operators completed raising charging flow to greater than letdown flow at 5:40 p.m.,

which established the time of the minimum RCS inventory.

The operating shift believed that the LT462 trend was the result of some type of instrument malfunction and initiated a notification to identify and correct the condition. In addition, the shift took actions to place RCS sight glass in service, but bubbles in the sight glass delayed its operation until 9:57 p.m. I&C completed actions to backfill the reference leg of LT462 on October 16, at 1:38 a.m. and confirmed that it had been properly restored to operation. Later that shift, operators stabilized pressurizer level at 14%. PSEG initially implemented a quick human performance evaluation to assess the event. This approach was revised the morning of the October 16 by the Operations Director to a prompt investigation.

3. SPECIAL INSPECTION AREAS

3.1 Reactor Coolant Inventories, Pressures, and Temperatures

a. Inspection Scope

The inspectors evaluated the conditions that existed in the RCS for temperatures, pressures, and water inventories for the time leading up to the event, during the event, and after the event occurred. Specifically, the inspectors evaluated the effect of RCS pressure changes on the pressurizer level instrument reference leg and determined the minimum water inventory in the RCS. The inspectors reviewed the prompt investigation, the equipment apparent cause evaluation (ACE), and the root cause analysis. The inspectors also reviewed raw data from the safety parameter display system, interviewed licensee personnel, and completed an independent timeline that is Attachment B of this report.

b. Findings and Observations

No findings of significance were identified.

During review of the prompt investigation, the inspectors questioned PSEG on whether the pressurizer was completely drained. Initially, PSEG stated that they did not believe that the pressurizer was drained completely. The inspectors independently performed volumetric calculations to further assess the loss of RCS inventory. These calculations were used as a basis for further discussion with PSEG. On October 29, PSEG determined that actual water level reached a level that was below the top of the RCS hot leg. PSEG concluded that as pressurizer level was lowered, it reached the point where the surge line connects to the hot leg. This allowed nitrogen from the ongoing pressurizer relief tank purge to migrate into the 13 steam generator and into the top of the reactor vessel. Because the pressurizer is connected to the 13 reactor coolant system loop and the reactor coolant pumps were not in service, nitrogen would not migrate to the other steam generators unless level dropped below an elevation equivalent to the top of 11, 12, and 14 loop hot legs (approximately 98.5 feet ). PSEG calculated the volume drained from below the pressurizer low level tap by determining the chemical volume and control system (CVCS) holdup tank level change and concluded that the displaced volume of water could have been as much as 3,500 gallons. This was the bounding case. PSEG also determined the volume drained from below the pressurizer low level tap by calculating charging and letdown flow mismatch to estimate the displaced volume of water at approximately 1500 gallons. PSEGs investigation of this event determined that the pressurizer had completely drained and some inventory from the reactor vessel head and the 13 steam generator was also drained. PSEG concluded that significantly more volume than the bounding case scenario needed to be drained to allow air intrusion into the RHR pumps. This was due to the large volume of water remaining in the steam generator tubes (approximately 32,000 gallons total) and the reactor vessel head (approximately 10,000 gallons). The inspectors determined that PSEGs evaluation of this matter was acceptable.

3.2 Pre-Outage Risk Assessment

a. Inspection Scope

The inspectors assessed the adequacy of PSEGs pre-outage risk assessment including contingencies planned to minimize outage risk. The inspectors reviewed various documents, including PSEG procedures, operations and outage control center logs, notifications, and risk assessment information. The inspectors also conducted interviews with various PSEG personnel to determine if actions taken by the station with respect to pre-outage risk assessment met the requirements of relevant procedures.

Procedures OU-AA-103, Shutdown Safety Management Program, and SC.OM-AP.ZZ-0001(Q), Shutdown Safety Management Program - Salem Annex were reviewed to assess PSEGs pre-outage risk assessment.

b. Findings and Observations

No findings of significance were identified.

PSEG used ORAM-SENTINEL (ORAM), a computerized tool, to assess the risks of planned evolutions and plant configurations during the outage. This model characterizes outage risk in ascending order by color (green, yellow, orange, red) based on the number and severity of planned evolutions and plant configurations. The inspectors noted that ORAM predicted yellow risks for all planned evolutions during the outage except for a mid-loop condition planned after plant refueling was to be completed. This condition was categorized as orange, which required a contingency plan. The inspectors reviewed the contingency plan and noted that it provided for enhanced monitoring and providing an alternate means of assuring the decay heat removal safety function. The inspector concluded that PSEGs pre-outage risk assessment was appropriate.

The inspectors reviewed Attachment B of SC.OM-AP.ZZ-0001(Q) that specified that an orange risk condition be established whenever RCS inventory is less than 101 elevation. This Attachment also stated that unplanned entries into an orange risk condition required implementation of specified contingency plans for the condition. The inspectors noted that the actual RCS level went below 101 ft during the evolution, which put the plant in an unplanned orange risk condition; however, the specified contingency plan was not implemented since operators were unaware of the actual RCS level. The inspectors determined that this did not constitute a performance deficiency because operators believed that actual level was still in the pressurizer. Specifically, after refilling the reference leg, operators determined LT462 level was 16.6%. PSEGs final determination of the actual reduced inventory conditions reached during the evolution was not finalized until October 29. See Section 2.0 and 3.1 for additional details.

3.3 Procedure Quality and Completeness

a. Inspection Scope

The inspectors evaluated the quality and completeness of procedures used for the pressurizer draining evolution. The inspectors reviewed various documents, including applicable PSEG procedures and control room operator written statements, and interviewed control room operators on their use of procedures.

b. Findings and Observations

One finding of very low significance was identified.

The inspectors assessed the quality and implementation of PSEGs procedures for this event and concluded that a lack of adequate controls in the governing procedure allowed a level indicator problem to remain undetected and led to inadequate monitoring of actual RCS inventory. Specifically, this procedure did not include alternate methods, such as diverse and/or redundant indications, to monitor actual RCS inventory and to confirm the accuracy of the primary RCS level indicator.

Introduction:

The inspectors identified a self-revealing Green non-cited violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings because PSEG did not provide operators with a procedure that contained appropriate quantitative and qualitative information to ensure that activities affecting safety can be satisfactorily accomplished. PSEG did not maintain an adequate procedure for draining the Unit 1 RCS pressurizer. Due to the inadequate procedure, operators unintentionally drained the RCS to the top of the reactor coolant system (RCS) hot leg without the appropriate controls in place.

Description:

PSEGs program for shutdown risk management used as its basis the philosophy and recommendations stated in NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. NUMARC 91-06 defined key safety functions during shutdown as decay heat removal, inventory control, power availability, reactivity control, and containment. It also presented guidelines designed to manage the risk associated with issues that potentially affect each of the key shutdown safety functions.

The NUMARC 91-06 guidelines included measures established to minimize the possibility of events that result in an inadvertent loss of RCS inventory that could ultimately result in the loss of decay heat removal. The guidelines stated that evolutions that deliberately alter RCS coolant inventory flow paths should be strictly controlled and monitored and that for activities that may impact RCS coolant inventory, procedures or work instructions should clearly stipulate the initial plant conditions and should include appropriate warnings and precautions.

At Salem, RCS inventory control during shutdown conditions was procedurally controlled by three separate procedures. Operators determine the applicable procedure for RCS inventory control based upon the plant inventory conditions as indicated by RCS level instruments. On October 15, 2008, to drain the RCS from a full pressurizer condition to an indicated 10% to 15% pressurizer level, operators appropriately used procedure S1.OP-IO.ZZ-006(Q) (IOP-6), Hot Standby to Cold Operations. This procedure used one instrument, the pressurizer cold-calibrated level indicator (LT462), the only RCS level instrument available at this level range and temperature conditions, to control the drain down. As described in the event chronology in Section 2.0 of this report, on October 15, 2008, while using IOP-6, the pressurizer cold-calibrated level indicator became inaccurate due to reference leg voiding. Unaware that the pressurizer cold-calibrated level indicator was inaccurate, operators inadvertently drained actual RCS level to the top of the reactor vessel hot leg or the 98.5 ft elevation.

The inspectors reviewed the event and PSEGs cause analysis and identified that IOP-6 stated that, while draining inventory from the RCS per this procedure, pressurizer level should be maintained greater than 10% cold-calibrated level and that any further lowering of pressurizer level should be performed in accordance with S1.OP-SO.RC-0005(Q) (RC-5), Draining the Reactor Coolant System to 101 ft Elevation. With pressurizer level less than cold-calibrated level indication range, RC-5 specified additional controls and monitoring in accordance with the NUMARC 91-06 guidance when RCS inventory was drained to less than the 109 ft elevation. The inspectors determined that operators did not put in place the appropriate controls and monitoring specified by RC-5 when RCS level went below 109 ft, because they were not aware that level was below 109 ft because of LT462 inaccuracy caused by reference leg voiding.

The inspectors determined through their review of the event, that operators did not appropriately control the draining of the pressurizer because procedure IOP-6 did not include the guidance necessary to ensure that they effectively protected the RCS inventory and decay heat removal shutdown safety functions. Specifically, PSEG did not incorporate lessons learned from the substantial amount of industry operating experience regarding the impact of over reliance on one means of reactor vessel water level indication on reactor coolant system inventory control into IOP-6. The inspectors determined that the inadequate drain down procedure that resulted in the unintended drain down to the top of the RCS hot leg without the required controls was a performance deficiency. This performance deficiency was within PSEGs ability to foresee and correct because there was substantial operating experience communication regarding problems in this area. This included several NRC generic communications documents; Information Notice (IN) 96-37, IN 97-83, IN 94-36 and IN 96-65, and IN 81-46. These documents included significant discussion of issues that directly relate to the causes for the Salem Unit 1 event and what corrective actions should have been implemented by PSEG to prevent these types of events.

Analysis:

This performance deficiency was greater than minor because it was associated with the procedure quality attribute of the Initiating Events Cornerstone and affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown conditions. Specifically, procedure IOP-6 did not include the guidance necessary to ensure that operators used diverse and redundant indications to control RCS inventory during pressurizer drain down. This affected the shutdown critical safety function of maintaining adequate reactor inventory, and potentially affected the decay heat removal shutdown critical safety function by approaching mid-loop operations without the appropriate controls. If operators had not recognized the inaccurate cold-calibrated pressurizer level indication, continued draining would have adversely impacted operation of the RHR system that was providing decay heat removal for the reactor coolant system Because this finding was associated with an event that occurred while the unit was shutdown, the inspectors evaluated this finding using IMC 0609, Appendix G, Shutdown Operations Significance Determination Process. In accordance with Table 1, Losses of Control, of Appendix G, and Attachment A, Checklist 2,the Phase 1 Operational Checklist for PWR Cold Shutdown Operations - RCS Closed and Steam Generators Available Decay Heat Removal, the inspectors, determined that a quantitative Phase 2 risk evaluation was required. The quantitative evaluation was directed because the finding involved a loss of greater than two feet of RCS inventory and increased the likelihood of a loss of decay heat removal event.

At the time of the event, the plant conditions were as follows: the RCS was vented, the residual heat removal system was in service, and, due to the high decay heat load present early in the outage, the calculated time-to-boil was short (less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

Therefore, following the guidelines in MC 0609 Appendix G, BWR And PWR Phase 2 Significance Determination Process For Shutdown the SRA used Worksheet 9, SDP for Westinghouse 4-Loop Plant - Loss of RHR in POS 2 (RCS Vented) to complete the significance determination for this finding. Using this worksheet, as described in Section 3.12, the SRA determined that this finding was of very low safety significance (Green)

This finding has a cross-cutting aspect in the area of human performance, resources, because PSEG did not ensure that complete accurate and up-to-date procedures were adequate to assure nuclear safety. H.2(c) Specifically, PSEG did not incorporate lessons learned from the substantial amount of industry operating experience regarding recurring inadvertent reductions of reactor coolant system inventory into procedure IOP-

6.

Enforcement:

10 CFR 50, Appendix B, Criterion V, requires, in part, that activities affecting quality shall be prescribed by documented procedures that contain appropriate quantitative and qualitative information to ensure that activities affecting safety can be satisfactorily accomplished. Contrary to the above, on October 15, 2008, PSEGs activity for draining the Salem Unit 1 RCS pressurizer while shutdown was not performed using a documented procedure containing appropriate quantitative and qualitative information. Specifically, PSEG did not incorporate lessons learned from relevant industry operating experience regarding recurring inadvertent reductions of RCS inventory caused by over reliance on one means of reactor vessel water level indication. This led to a loss of control of pressurizer inventory on October 15, 2008.

Because of the very low safety significance of this finding and because the finding was entered into the licensees corrective action program as Notification 20386987, the violation is being treated as an NCV, consistent with Section VI.A.1 of NRC Enforcement Policy (NCV 05000272/2008009-01, Inadequate Procedure for Pressurizer Draining Evolution).

3.4 Evaluation of the Adequacy of Pre-Job Brief for the Pressurizer Draining Evolution

a. Inspection Scope

The inspectors evaluated the adequacy of the pre-job brief conducted by the station prior to the pressurizer draining evolution. The inspectors reviewed various documents, including applicable PSEG procedures and control room operator written statements, and interviewed control room operators to determine the extent of the pre-job brief. The inspectors compared this information to procedures HU-AA-1211, Briefings - Pre-Job, Heightened Level of Awareness, Infrequent Plant Activity, and Post-Job Briefings, and OP-AA-108-110, Evaluation of Special Tests and Evolutions, to determine if the pre-job brief met procedural requirements.

b. Findings and Observations

No findings of significance were identified.

The inspectors determined that pre-job brief conducted by the station prior to the pressurizer draining evolution did not meet the requirements of Procedure OP-AA-108-110, Evaluation of Special Tests or Evolutions, Revision 0, for evaluation of infrequently performed complex tests, procedures, or plant evolutions or HU-AA-1211, Briefings - Pre-Job, Heightened Level of Awareness, Infrequent Plant Activity, and Post-Job Briefings. These procedures provide information on implementation and performance of a special test or evolution. They define a special test or evolution as an infrequently performed, complex test or evolution, which may place plant equipment outside the bounds of normal procedures and training. The procedure also states that activities, plant configurations, or conditions (including outage activities) where the plant is more susceptible to an event causing a loss of a key safety function (e.g., decay heat removal) may be classified as a special evolution. The pressurizer draining evolution had the potential to adversely affect the operation of the residual heat removal system which had the potential to challenge the key safety function of decay heat removal. This evolution could also be considered complex in that it involved multiple systems, including the charging and letdown portions of the chemical and volume control system (CVCS), the reactor coolant system (RCS), and the pressurizer relief tank (PRT). OP-AA-108-110 states that the station shall conduct a heightened level of awareness (HLA)or infrequent plant activity (IPA) briefing prior to performing a special test or evolution. In previous outages, PSEG did not consider the pressurizer draining evolution to be an HLA activity and, as a result, did not require an HLA brief during the refueling outage in October 2008. Prior to draining the pressurizer, the control room supervisor (CRS) and the reactor operator (RO) had a discussion that mainly focused on a specific precaution in the procedure which requires operators to maintain a positive nitrogen pressure on the PRT; however, operators did not include all of the minimum requirements for a pre-job brief as discussed in HU-AA-1211.

The inspectors reviewed PSEGs actions in this matter and concluded that a performance deficiency did not exist because these circumstances were not foreseeable. The overall quality of the pre-job brief and the failure to categorize the evolution as an HLA was affected by the inadequate procedure used for the pressurizer draining evolution (see section 3.3 for discussion of the pressurizer draining procedure.)

Notwithstanding this conclusion, PSEG took action to address this matter. Following the event, PSEG management conducted training with operations personnel, which included expectations for pre-job briefs, log keeping, use of alternate indications, and use of operating experience. Also, in future outages, PSEG stated their intention to require an HLA brief for this evolution prior to its execution. PSEG entered this issue into their corrective action program under notifications 20391303 and 20386987.

3.5 Supervisory Oversight

a. Inspection Scope

The inspectors evaluated the effectiveness of supervisory oversight during the pressurizer draining evolution. The inspectors reviewed various documents, including PSEG procedures, control room and outage control center narrative logs, and control room operator written statements. The inspectors compared information contained in these documents to information obtained during interviews to determine the extent and suitability of the oversight during the pressurizer draining evolution.

b. Findings and Observations

No findings of significance were identified.

The inspectors assessed the effectiveness of supervisory oversight during the pressurizer draining evolution and concluded that because PSEG did not adequately evaluate the risk significance of this evolution, the supervisory oversight while the pressurizer was being draining was limited. This was in contrast to the high degree of oversight applied when filling the pressurizer. In this case, PSEG evaluated placing the pressurizer in a water-solid condition at a higher risk level and, as a result, had all the proper precautions in place, including performance of just-in-time training in the simulator to practice the evolution, an extensive pre-job brief, and comprehensive supervisory oversight in the main control room during the evolution. Conversely, prior to conducting the pressurizer draining evolution, PSEG did not perform just-in-time training or have an extensive pre-job brief. In addition, the senior reactor operator oversight of the evolution, including conduct of a pre-job brief, was not thorough as it had been for the evolution to take the pressurizer water solid.

While supervisory oversight during pressurizer draining evolution was limited, the inspectors did note appropriate operator response and oversight when pressurizer level unexpectedly stabilized at 80%. This occurred during shift turnover while the control room supervisor was in the process of turning over and the off-going shift manager had already completed turnover. When operators identified that LT462 was not responding properly, they stopped shift turnover, and increased charging flow greater than letdown flow which stopped level decrease and slowly increased pressurizer level. Operators also verified proper operation of the residual heat removal (RHR) system, which was providing decay heat removal for the reactor coolant system.

3.6 Evaluation of Operator Performance, Watchstanding Practices and Training for Draining the Pressurizer and for Reduced Inventory Operations

a. Inspection Scope

The inspectors evaluated the operator performance, the use of appropriate watchstanding practices and training for draining the pressurizer and for reduced inventory operations. The inspectors reviewed various documents, including PSEG procedures, control room and outage control center narrative logs, and control room operator written statements. The inspectors compared information contained in these documents to information obtained during interviews to evaluate operator performance during the pressurizer draining evolution.

b. Findings and Observations

One finding of very low safety significance was identified.

The inspectors concluded that operators did not implement appropriate watchstanding practices consistent with PSEG standards. Procedure OP-AA-103-102, Watchstanding Practices describes the practices by which operators should perform their assigned duties to ensure that the plant is operated in a safe manner. In part, this procedure states the following:

• Operators should maintain a questioning attitude at all times.

• Operators should be alert to changing critical parameters, alarms, and/or trends. The expectation is to identify and resolve the abnormal trend before plant safety is challenged. This requires continuous awareness of major plant parameters. Use diverse information sources to verify status where possible.

• Divide and prioritize duties such that a state of proper awareness and attention is maintained in regard to general plant operations and special evolutions.

• Announce all main control room annunciators/alarms to the unit supervisor.

Aggressively investigate annunciators/alarms to fully understand the reason for any alarm that comes in as well as any alarm that clears.

The inspectors concluded that a number of these watchstanding practices were not used during this event. Specifically, before the pressurizer drain down was begun, cold-calibrated pressurizer level (LT462) was at 144% at the start of the evolution, which was abnormally high (level should normally be 100-105%). Also, after operators began to lower charging flow to less than letdown flow it took approximately 42 minutes of draining before cold-calibrated pressurizer level began to trend down from 144% as indicated on the safety parameter display system (SPDS). Then it took another 43 minutes before indicated level reached 100%. Both of these conditions represented an abnormally long time for level to change. None of these conditions were questioned nor identified as abnormal trends in accordance with OP-AA-103-102. Diverse indications were not used to evaluate these trends.

The cold-calibrated and all three hot-calibrated pressurizer level indications were off-scale high when the evolution began as expected; however, the cold-calibrated level should have come on-scale first. This did not occur, and when LT462 had trended down to 100%, the hot-calibrated pressurizer levels had trended over most of their range and were reading approximately 22%. During this time frame, two additional alarms reset, namely, the pressurizer high level alarm and the variable high level heaters on alarm and neither was investigated nor was the cause identified per OP-AA-103-102. When questioned, operators did not recall these alarms resetting.

As level continue trend down, a low pressurizer level alarm annunciated at 17% level which, per the alarm response procedure, required, in part, a verification of pressurizer level. When this alarm annunciated, all three hot-calibrated pressurizer levels were indicating about 17% and had been trending downward in a consistent manner while LT462 level had been dropping very slowly and was reading slightly less than 100%

indicated level. When questioned, operators did not recall this alarm annunciating. Per Procedure OP-AA-103-102 operators are expected to aggressively investigate annunciators/alarms to fully understand the reason for any alarm that comes in as well as any alarm that clears. This was not done in a manner consistent with the procedure by verifying actual plant conditions and using diverse and redundant indications.

Introduction.

The inspectors identified a green non-cited violation of Technical Specification 6.8.1, Procedures and Programs, because operators did not implement actions required per procedure S1.OP-AR.ZZ-0005(Q), Overhead Annunciators Window E, in response to a Pressurizer Heater Off Level Low alarm. This contributed to PSEG not promptly recognizing an inaccurate cold-calibrated level instrument during the pressurizer draining evolution and over-draining the pressurizer.

Description.

On October 15, 2008, Salem Unit 1 was in a refueling outage with the pressurizer filled to a water-solid condition. In accordance with procedure S1.OP-IO.ZZ-0006(Q), Hot Standby to Cold Shutdown, PSEG planned to drain the pressurizer from this water-solid condition to approximately 10% indicated level on the pressurizer cold-calibrated level instrument. Before the drain down was started, the cold-calibrated and hot-calibrated pressurizer control board level indications were off-scale high. Therefore, when the drain down was started, in order to trend the change in pressurizer level until the control board indications came on-scale, the operators monitored cold-calibrated pressurizer level as indicated on the Safety Parameter Display System (SPDS) display monitor in the main control room. This indication was provided by the same instrument as the cold-calibrated pressurizer level control board indication, but the top of scale for this indication was 150%. Indicated cold-calibrated pressurizer level on SPDS before the drain down started was 144%.

Operators commenced draining the pressurizer by lowering charging flow rate to less than letdown flow rate so that the net discharge rate from the reactor coolant system was approximately 120 gallons per minute. After approximately 84 minutes of draining, cold-calibrated pressurizer level came on scale (<100%) on the control board indication.

A few minutes later, the Pressurizer Heater Off Level Low alarm, set at 17% hot-calibrated pressurizer level, annunciated in the main control room, but operators did not take actions required by the alarm response procedure and continued the draining evolution. Approximately 27 minutes later, after the cold-calibrated pressurizer level steadied at 80%, even though the crew had continued to drain pressurizer inventory at approximately 120 gpm. At this point, the crew determined that pressurizer level was likely lower than indicated and they crew stopped the drain down.

The inspectors determined that not implementing the actions described in procedure S1.OP-AR.ZZ-0005(Q), Overhead Annunciators Window E, in response to the Pressurizer Heater Off Level Low, alarm was a performance deficiency. Actions required by this procedure included verifying actual pressurizer level and may have aided PSEG in identifying the inaccurate cold-calibrated pressurizer level instrument sooner. The inspectors determined that this action would have likely prevented draining the RCS to the top of the reactor vessel hot leg. PSEGs prompt investigation following the event did not identify this performance deficiency. PSEG identified the issue in their root cause evaluation, in part, as a result of inspector questions during a review of the sequence of events from a simulator re-creation of the pressurizer drain down event. As a result, the inspectors considered this issue to be an NRC identified performance deficiency.

The specific underlying cause of this deficiency could not be determined because, during interviews with the inspectors regarding the issue, none of the operators in the control room at the time of the event recalled acknowledging this alarm, evaluating potential causes for the alarm or taking action to respond to it. As a result, the inspectors determined that the cause of the operators not implementing the alarm response procedure was not adhering to watchstanding practices specified in PSEG procedure OP-AA-103-102, Watchstanding Practices. Specifically, during this event, operators did not use diverse indications, maintain a questioning attitude, and properly implement alarm response procedures in accordance with OP-AA-103-102.

Analysis.

The inspectors determined that this finding was greater than minor because it affected the human performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown conditions.

Implementation of actions in S1.OP-AR.ZZ-0005(Q) in response to the Pressurizer Heater Off Level Low alarm may have aided the operators in discovering the inaccurate cold-calibrated pressurizer level instrument sooner and likely prevented over-draining the pressurizer.

Because this finding was associated with an event that occurred while the unit was shutdown, the inspectors evaluated this finding using IMC 0609, Appendix G, Shutdown Operations Significance Determination Process. In accordance with Table 1, Losses of Control, of Appendix G, and Attachment A, Checklist 2,the Phase 1 Operational Checklist for PWR Cold Shutdown Operations - RCS Closed and Steam Generators Available Decay Heat Removal, the inspectors, determined that a quantitative Phase 2 risk evaluation was required. The quantitative evaluation was directed because the finding involved a loss of greater than two feet of RCS inventory and increased the likelihood of a loss of decay heat removal event.

At the time of the event, the plant conditions were as follows: the RCS was vented, the residual heat removal system was in service, and, due to the high decay heat load present early in the outage, the calculated time-to-boil was short (less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

Therefore, following the guidelines in MC 0609 Appendix G, BWR And PWR Phase 2 Significance Determination Process For Shutdown the SRA used Worksheet 9, SDP for Westinghouse 4-Loop Plant - Loss of RHR in POS 2 (RCS Vented) to complete the significance determination for this finding. Using this worksheet, as described in Section 3.12, the SRA determined that this finding was of very low safety significance (Green)

The inspectors also determined that this issue had a human performance cross-cutting aspect in the area of work practices in that PSEG did not follow procedure OP-AA-103-102, Watchstanding Practices. Specifically, during this event, PSEG did not use diverse indications, maintain a questioning attitude, and properly implement alarm response procedures in accordance with OP-AA-103-102, Watchstanding Practices.

(H.4(b))

Enforcement.

Technical Specification 6.8.1, Procedures and Programs states, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures as recommended in NRC Regulatory Guide (RG) 1.33, Appendix A, February 1978. NRC RG 1.33, Appendix A, Section 5.0 requires procedures for abnormal, off-normal, or alarm conditions. Actions required per procedure S1.OP-AR.ZZ-0005(Q), Overhead Annunciators Window E included verification of pressurizer level upon receiving the Pressurizer Heater Off Level Low alarm. Contrary to the above, on October 15, 2008, operators did not verify level for the Pressurizer Heater Off Level Low alarm. Failure to implement this action contributed to operators not promptly recognizing the inaccurate cold-calibration level instrument. Because this finding is of very low safety significance and PSEG has entered this issue into their corrective action program under notification 20386987, the NRC is treating this violation as a non-cited violation consistent with Section VI.A.I of the NRC Enforcement Policy. (NCV 05000272/2008009-02, Failure to Implement Actions for a Pressurizer Level Alarm)3.7 Evaluation of Relevant Industry Operating Experience

a. Inspection Scope

The inspectors reviewed industry operating experience (OE) for similar events and noted that a similar event occurred at Sequoyah Unit 1 on March 23, 1997. The event was communicated to power reactor licensees in NRC Information Notice (IN) 97-83. The inspectors reviewed PSEG's review of the issues associated with this Information Notice as well as the prompt investigation, the equipment apparent cause evaluation, and the root cause analysis. The inspectors also reviewed raw data from the SPDS and interviewed PSEG personnel.

b. Findings and Observations

One finding of very low significance was identified.

The inspectors assessed PSEGs action for similar OE and noted that they had planned corrective action for a previous similar industry event; however, they were not implemented. During that event, reference leg voiding resulted in an erroneously high cold-calibrated pressurizer level while draining the RCS. This issue was distinct because the actions planned by PSEG were directed at either comparing hot-calibrated level with cold-calibrated level or preemptively filling the reference leg prior to beginning RCS drain down.

Introduction:

The inspectors identified a self-revealing Green finding because on October 15, 2008, operators drained the RCS to the top of the reactor vessel hot leg without implementing the controls required to protect the source of decay heat removal for the plant. PSEG did not complete corrective actions that it had identified for industry operating experience in accordance with the requirements of PSEG procedure NC.NA-AP.ZZ-0006(Q), Corrective Action Program. Specifically, PSEG did not complete corrective actions deemed necessary based on a review of the circumstances surrounding the March 1997 Sequoyah loss of control of pressurizer inventory event.

Description:

PSEG determined through a review of industry operating experience that the October 15, 2008, pressurizer drain down event was similar to an event that occurred at Sequoyah Unit 1 on March 23, 1997. This operating experience (OE) event was communicated to power reactor licensees in NRC Information Notice (IN) 97-83.

PSEG determined that this OE was applicable to Salem and proposed corrective actions to prevent the event from occurring at Salem. The inspectors reviewed the specified corrective actions and determined that if the corrective actions were fully implemented, plant operators would likely have identified the inaccurate pressurizer level instrument and terminated the drain down before RCS level reached the top of the reactor vessel hot leg.

The corrective action that was not completed was to develop a graph as an attachment for the drain down procedure that operators would use to correlate indicated hot-calibrated pressurizer level to indicated cold-calibrated pressurizer level. This corrective action was assigned to Engineering. Engineering developed a graph that correlated hot-and cold-calibrated indications and forwarded it to Operations to update applicable plant procedures. Then, as the responsible organization, Engineering closed the assigned corrective action item because they believed the corrective action was complete.

However, operations did not incorporate the graph into the procedure. As a result, when engineering closed its assigned action item, the organization believed that the corrective action was fully implemented, when it was not.

Without the procedure revisions specified by the review of the Sequoyah OE, on October 15 operators used only a single level indication to conduct the pressurizer drain down and did not identify the inaccurate instrument until RCS inventory was drained to the top of the reactor vessel hot leg. This affected the shutdown critical safety function of maintaining adequate reactor inventory and potentially affected the operation of the decay heat removal system. The inspectors determined that the failure to complete planned corrective actions for this OE was a performance deficiency for which the cause was within PSEGs ability to foresee and correct because the corrective action process required the completion of planned corrective actions prior to closing the notification.

Analysis.

The inspectors determined that the performance deficiency was greater than minor because it affected the human performance attribute of the initiating events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown conditions. Specifically, not completing corrective actions specified as a result of PSEGs review of the 1997 Sequoyah event contributed to the loss of control of inventory in the pressurizer on October 15, 2008. This affected the shutdown critical safety function of maintaining adequate reactor inventory and potentially affected the decay heat removal shutdown critical safety function by entering mid-loop operations without the appropriate controls.

Because this finding was associated with an event that occurred while the unit was shutdown, the inspectors evaluated this finding using IMC 0609, Appendix G, Shutdown Operations Significance Determination Process. In accordance with Table 1, Losses of Control, of Appendix G, and Attachment A, Checklist 2,the Phase 1 Operational Checklist for PWR Cold Shutdown Operations - RCS Closed and Steam Generators Available Decay Heat Removal, the inspectors, determined that a quantitative Phase 2 risk evaluation was required. The quantitative evaluation was directed because the finding involved a loss of greater than two feet of RCS inventory and increased the likelihood of a loss of decay heat removal event.

At the time of the event, the plant conditions were as follows: the RCS was vented, the residual heat removal system was in service, and, due to the high decay heat load present early in the outage, the calculated time-to-boil was short (less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

Therefore, following the guidelines in MC 0609 Appendix G, BWR And PWR Phase 2 Significance Determination Process For Shutdown the SRA used Worksheet 9, SDP for Westinghouse 4-Loop Plant - Loss of RHR in POS 2 (RCS Vented) to complete the significance determination for this finding. Using this worksheet, as described in Section 3.12, the SRA determined that this finding was of very low safety significance (Green)

There was no cross-cutting aspect associated with this finding because the cause of the finding, an inappropriate corrective action item assignment, did not reflect current plant performance. Specifically, since the corrective action item for the Sequoyah OE was assigned, the Salem corrective action program was revised. As a result, the vulnerability that existed in the program when the Sequoyah OE corrective actions were not implemented, no longer exists. Specifically, under the program used to process the Sequoyah operating experience corrective actions, corrective action item assignments were made by a single individual. The current corrective action program requires that all corrective action assignments are made by an onsite committee that consists of representatives from all organizations on-site. This committee, called the station ownership committee, conducts a multi-disciplined review of all corrective action notifications to ensure that all corrective action program items are assigned to the appropriate organization for implementation.

Enforcement:

Enforcement action does not apply because the performance deficiency did not involve a violation of a regulatory requirement. PSEG entered this issue into their corrective action program under notification number 20388285. (FIN 05000272/2009-03, Failure to implement corrective actions for operating experience applicable to station operations)3.8 PSEG Response to the Event

a. Inspection Scope

The inspectors assessed the effectiveness of PSEGs organizational response to the loss of RCS inventory. The inspectors reviewed various documents, including PSEG procedures, operations and outage control center logs, notifications, and risk information. The inspectors also conducted interviews with various PSEG personnel to determine if actions taken by the station were appropriate to identify and address any human performance, procedure and equipment deficiencies.

b. Findings and Observations

No findings of significance were noted.

The inspectors noted that the initial action by operators after LT462 level stabilized at 80% was appropriate because operators stopped the evolution, assessed the situation, and made a deliberate decision to raise charging flow to greater than letdown flow. This action effectively terminated the event. The oncoming shift initiated two parallel actions to verify RCS inventory, namely placing the mid loop level sight glass in service and beginning to troubleshoot and repair the cold-calibrated level indicator. The timing of these actions appeared to be reasonable. It did take a few hours to place the mid loop level sight glass in service because bubbles were noted with in the sight glass. This was accomplished on October 15, at 9:57 p.m. PSEG completed actions to backfill the reference leg of LT462 and return it to service on October 16 at 1:38 a.m. Pressurizer level was verified to be at 16.6 % at that time.

PSEG initially decided to perform a quick human performance investigation to determine the cause of the suspected instrument failure. Because of the potential scope of the issues, this action was changed to a more comprehensive prompt investigation the morning of October 16 by PSEG management. The other initial actions immediately after the event were primarily focused on the equipment issues and there was only limited assessment of the actual loss of RCS inventory. The volume of water in the holdup tank was indicative of a large loss of RCS inventory, but the actual loss of inventory was not determined by the prompt investigation because pressurizer level was restored to greater than 10% on the next operating shift which was within the bounds of IOP-6. See Section 3.1 for additional details on the RCS inventory determination.

3.9 Initial Cause and Interim Corrective Actions

a. Inspection Scope

The inspectors reviewed PSEGs prompt investigation and evaluated the causes identified. PSEG initiated a root cause analysis on Monday, October 27, 2008.

Additionally, an equipment apparent cause evaluation to investigate the failure of the cold-calibrated level instrument was in progress during the SIT inspection. The inspectors reviewed the prompt investigation, the equipment apparent cause evaluation, and the root cause analysis. The inspectors also reviewed raw data from the safety parameter display system and interviewed licensee personnel.

b. Findings and Observations

No findings of significance were identified.

The inspectors determined the initial cause analysis for the prompt investigation was adequate; however, some gaps were noted related to watchstanding practices, in particular alarm response. Section 3.6 documents one finding related to inadequate alarm response.

3.10 Extent of Condition and Extent of Cause

a. Inspection Scope

The inspectors reviewed PSEGs immediate extent of condition and extent of cause conclusions for the drain down which were identified in the licensees prompt investigation. The inspectors returned to the site to review the licensees root cause evaluation and equipment apparent cause evaluation. The inspectors reviewed the prompt investigation, the equipment apparent cause evaluation, and the root cause analysis. The inspectors also reviewed raw data from the safety parameter display system and interviewed licensee personnel. The inspectors also independently calculated the total volume drained from the reactor coolant system.

b. Findings and Observations

No findings of significance were identified.

The inspectors assessed the determinations in the prompt investigation and the licensees extent of condition and extent of cause reviews and concluded that they were adequate; however, some gaps were noted in PSEGs development of the event timeline and their review of the impact of higher than normal dissolved gases. PSEGs root cause analysis was thorough and adequately addressed the conditions leading up to the event and the subsequent recovery actions. PSEG concluded there were two overall root causes for the event, the failure to implement corrective actions developed in response to industry operating experience and inadequate application of operator fundamental tools. The second cause also identified a number of failed barriers, anyone of which may have prevented the event from occurring. These barriers included supervisory oversight, use of redundant or diverse indications, effective pre-job briefs, just-in-time training, enforcing annunciator response protocol, and maintaining a quality narrative log.

The inspectors did note some inaccuracies with PSEGs use of safety parameter display system (SPDS) data used in the prompt investigation. Specifically, PSEG estimated times from a plot of the SPDS data rather than using the raw data to determine times accurately. This led to minor errors in the root cause timeline. For example, the root cause timeline states that on October 15 at 12:20 p.m. the RCS was fully depressurized; however, at that time RCS pressure was at 65 psig and still rapidly decreasing. RCS pressure did not stabilize until 12:38 p.m. at 22 psig. The inspectors determined that these issues were minor.

The inspectors also reviewed the equipment apparent cause evaluation (ACE) and noted that it did not explore the differences in the way the pressurizer degasification (degas) evolution was performed in this outage versus previous outages. Specifically, PSEG normally would directly vent non-condensable gasses such as hydrogen, nitrogen, and fission product gasses for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to filling the pressurizer by using the pressurizer steam space sample valve (1SS110) and venting these gasses to the volume control tank. In this case, the pressurizer was only vented for six hours which limited the venting of non-condensable gasses as evidenced by double the dissolved hydrogen concentration when the pressurizer was subsequently charged solid. The reason that this method of degas was not available was because valve 1SS110 had developed a minor body-to-bonnet leak and because this valve is a primary containment isolation valve, it had to be shut to meet technical specification requirements. As a result, PSEG could not use this valve for venting the pressurizer steam space until the reactor was in a cold shutdown condition (mode 5). Thus, PSEG had to rely primarily on mechanical and chemical degasification to limit the non-condensable gasses in solution.

Mechanical degasification requires alternately raising and lowering pressurizer level while using the chemical and volume control system (CVCS) to vent gasses through the volume control tank (VCT). Chemical degasification requires adding hydrogen peroxide to scavenge dissolved hydrogen. This method is typically done through batch additions with a RCP running and is most effective when sufficient time for mixing is provided.

These methods were performed in accordance with procedure S1.OP-SO.CVC-0011(Q),

RCS Degasification and procedure S1.CH-IO.ZZ-1111(Z), Salem Unit 1 Shutdown Chemistry Plan, PSEG performed nine mechanical degasifications and four hydrogen peroxide additions in an attempt to reduce the dissolved gas concentration in the pressurizer and RCS.

These peroxide additions were made directly into the RCS except the last addition which was directed into the pressurizer about 25 minutes prior to stopping the last running RCP. PSEG decided to make this last addition because sample results indicated higher than expected hydrogen concentration in the pressurizer after reaching a water solid condition. The location and the timing of this addition were different than in prior outages and were made because the dissolved hydrogen concentration in the pressurizer was approximately double the normal concentration.

Although not specifically listed as a cause, the elevated gas concentration in the pressurizer was listed as a potential failure mode. However, there were no corrective actions identified for this failure mode. When questioned by inspectors, PSEG stated that they intended to revise appropriate plant procedures to require filling the reference leg for LT462 immediately after depressurizing the pressurizer, thereby addressing the potential effects (i.e. reference leg voiding) through other means. The inspectors concluded this action would directly address the potential effects of high dissolved gas concentration in the pressurizer.

3.11 Effectiveness of PSEGs Actions in response to the recently closed substantive cross cutting issue in human performance

a. Inspection Scope

The inspectors assessed the effectiveness of PSEGs actions in response to the recently closed substantive cross cutting issue (SCCI) in human performance. The inspectors reviewed various documents, including PSEG procedures, operations and outage control center logs, notifications, and prior reactor oversight program (ROP) assessment information. The inspectors also conducted interviews with various PSEG personnel to determine if actions taken by the station adversely impacted the recently closed substantive cross cutting issue in human performance.

b. Findings and Observations

No findings of significance were noted.

During the mid-cycle 2007 assessment, NRC noted that PSEG=s initial assessment was that most procedure adherence problems were related to administrative procedures, but other causes at that time included poor decision making, ineffective communications, inconsistent place keeping, and improper use of category I and II procedures. PSEG indicated that the expectation for proper use of procedures was known, but compliance was not adequate because expectations were not reinforced through consistent accountability of individuals. This led to a heightened focus on accountability through the use of the Fundamental Management System (FMS) tool including bi-weekly status reports detailing site FMS summaries and the manager in the field (MIF) program.

Although these programs were viewed as effective, PSEG=s corrective actions for increased accountability appeared to be untimely. PSEG waited too long to implement these increased accountability measures.

Notwithstanding the immediate improvement in station accountability, the NRC continued to monitor the stations adherence to procedures to ensure that these programs provided lasting improvement. The NRC subsequently closed the SCCI in the 2008 mid-cycle assessment letter as a result of effective implementation of appropriate corrective actions and continued improvement in the area of procedure compliance.

Thus, as a part of this inspection, the inspectors reviewed various actions to consider whether procedure adherence problems observed were similar to those of the past.

The inspectors concluded that a number of barriers had failed to cause this event. Most of these were administrative in nature and only one procedural noncompliance occurred relative to operators not adequately responding to overhead alarms. Section 3.6 documents one non-cited violation related to this area. The non-compliance appeared to not be the result of poor decision making, ineffective communications, inconsistent place keeping or improper use of category I and II procedures as had been identified in the previous substantive cross-cutting issue. The specific factors associated with this non-cited violation will be evaluated by the NRCs routine assessment process.

3.12 Risk Assessment of Findings related to the Pressurizer Drain Down Event This section was developed to facilitate an understanding of the common factors that pertained to the risk assessment of the findings in this report. It provides the methodology that the senior reactor analyst (SRA) used to analyze these findings.

Following the guidelines in Appendix G, the SRA made the following assumptions for the referenced findings based upon plant conditions and information gathered by the team:

Plant Operating State (POS) 2 was used, reflecting the reactor coolant system (RCS)being vented and having the residual heat removal system in service; Early Time Window (TW-E) based upon relatively high decay heat shortly following unit shutdown and time to boil (TTB) less than 20 minutes; initiating event likelihood (IEL) determined from Table 4, Initiating Event Likelihoods (IELs) for LORHR Precursors was identified as equal to 4; and Worksheet 9, SDP for Westinghouse 4-Loop Plant - Loss of RHR in POS 2 (RCS Vented) used to best represent and quantify the most dominant accident sequences involving this finding. Quantification of the dominant core damage sequences yielded the following results:

LORHR + RHR-S + RHR-R + RWSTMU (4 + 0 + 2 + 2 = 8)

LORHR + RHR-S + FEED (4 + 0 + 4 = 8)

The IEL for a loss of residual heat removal (LORHR) event was not adjusted from the Table 4 value, based upon significant RCS inventory available (all four loops and associated steam generators remained full). For this event, net positive suction head to the operating shutdown cooling pump was never in jeopardy of being lost. No credit was given to operator recovery of decay heat removal (RHR-S) based upon the TTB being less than 20 minutes. Full credit was given to RHR recovery (RHR-R), operator action to establish make-up to the refueling water storage tank (RWSTMU), and operator action to establish a feed and bleed flow path (FEED) based upon ample time available to detect and properly respond to the excessive drain-down event and the readiness of standby equipment for operators to place in service to ensure core decay heat was proper removed. Accordingly, the referenced findings were of very low safety significance (Green).

4. EXIT MEETING

On December 12, 2008, Mr. G. Scott Barber presented the inspection results to Mr. Bob Braun and other members of your staff. Proprietary information that was reviewed during the inspection was returned to PSEG.

SPECIAL TEAM INSPECTOR CHARTER October 21, 2008 MEMORANDUM TO: Arthur L. Burritt, Manager Special Team Inspection G. Scott Barber, Leader Special Team Inspection FROM: James W. Clifford, Director (Acting) /RA/

Division of Reactor Projects Marsha K. Gamberoni, Director /RA/

Division of Reactor Safety SUBJECT: SPECIAL TEAM INSPECTION CHARTER, -

SALEM NUCLEAR GENERATING STATION, UNIT NO. 1 Based on our initial evaluation of the safety significance associated with the uncontrolled drain down of the pressurizer at Salem Unit 1 that occurred on October 15, 2008, a Special Inspection Team (SIT) is being chartered. The special inspection will expand on the inspection activities started by the resident inspectors immediately following the significant operational event and will review the licensees response to the event in accordance with the attached charter.

This special team inspection was initiated in accordance with NRC Management Directive (MD)8.3, NRC Incident Investigation Program, and Inspection Manual Chapter (IMC) 0309, Reactive Inspection Decision Basis for Reactors. Our initial evaluation identified questions pertaining to PSEGs operational performance. The decision to conduct this special inspection was based on deterministic criteria in MD 8.3 and the results of a preliminary risk assessment that placed the core damage risk for the event in the mid E-6 range.

The inspection will be conducted in accordance with the guidance of NRC Inspection Procedure 93812, Special Inspection, and the inspection report will be issued within 45 days following the final exit meeting for the inspection.

A The special inspection will commence on October 21, 2008. The following personnel have been assigned to this effort:

Manager: Arthur L. Burritt, Branch Chief, Projects Branch 3, Division of Reactor Projects (DRP), Region I Team Leader: G. Scott. Barber, Senior Project Engineer, Projects Branch 6, DRP, Region I Full Time Members: Carey Bickett, Senior Project Engineer, Technical Support and Analysis Branch, DRP, Region I Douglas Tifft, Reactor Inspector, Plant Support Branch 1, Division of Reactor Safety, Region I Part Time Member: William A. Cook, Senior Reactor Analyst, DRS, Region I

Special Inspection Charter A

Special Inspection Charter Salem Nuclear Generating Station, Unit No. 1 Pressurizer Uncontrolled Drain Down on October 15, 2008 Background:

At 1541 on October 15, 2008, with Unit 1 in mode 5 and reactor coolant system (RCS)temperature at 140 degrees, control room operators began draining down the pressurizer from solid conditions to an expected level of 10 to 15% cold-calibrated level. The operators vented the RCS to the pressure relief tank and established a let down rate of 130 gpm using the chemical and volume control system. During the drain down the operators noted that level stopped lowering at 80% indicated level. Following identification of this abnormal indication, PSEG took action to establish net flow into the RCS. Pressurizer level indication was restored approximately ten hours after the drain down started following completion of troubleshooting and refilling the instrument reference leg.

Basis for the Formation of the SIT:

The initial review of this event identified concerns pertaining to PSEGs operational performance. Operator and equipment performance during the pressurizer drain down evolution caused a loss of control of RCS level that resulted in an inadvertent loss of greater than two feet of RCS inventory. It appears that pressurizer level for Salem Unit 1 was indeterminate for more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

Based upon best available information, the Region I Senior Reactor Analyst (SRA) conducted a preliminary risk estimate of the October 15 pressurizer draindown event at Salem Unit 1. Using the 0609, Appendix G, Table 1, Loss of Control, and Attachment A, Checklist 2, PWR Cold Shutdown Operations, the SRA concluded that a quantitative Phase 2 assessment was warranted. Per Appendix G, Attachment B, Step 4.5, and Worksheet 2, SDP for PWR Plant -

Loss of Level Control with the RCS Vented, the SRA estimated the conditional core damage probability of this event to be in the mid to high E-6 range. The dominant core damage sequence involves a loss of inventory event coupled with the subsequent loss of RCS injection due to operator error.

Based upon the preliminary conditional core damage probability estimate of mid to high E-6 range, per IMC 0309, this event falls within the overlap region for reactive inspections between baseline inspection and Special Inspection Team.

Objectives of the Special Inspection:

The objectives of the special inspection are to review and assess:

(1) PSEGs control of risk significant work activities including procedural guidance, pre-job briefs, operator questioning attitude and supervisory oversight;

(2) equipment issues related to the pressurizer drain down;

(3) PSEGs organizational response to this significant operational event; and

(4) the adequacy of PSEGs initial cause analysis, interim corrective actions and the extent of condition and cause for the event.

To accomplish these objectives, the following will be performed:

1. Develop a complete sequence of events involving preparation for the reduction in RCS inventory and operator actions while the condition existed and during recovery.

Additional guidance: This should include an evaluation of the conditions that existed in the RCS for temperatures, pressures, and water inventories. The team should also A

collect data necessary to refine the existing risk analysis, specifically complete Checklist 2 of IMC 0609, Appendix G, Attachment A for the conditions that existed at the time of the inadvertent drain down.

2. Evaluate the adequacy of PSEGs pre-evolution outage risk assessment and any

identified contingencies to minimize outage risk as it related to pressurizer draining evolution.

Additional guidance: The team should verify the risk assessment was performed in accordance with PSEG procedural guidance and that the procedural guidance was based upon relevant industry guidance and operating experience in this area (i.e.,

NUMARC 91-06).

3. Evaluate the adequacy of procedural guidance used to control the draining evolution and

response to the event.

Additional guidance: The team should verify that the evolution and event response was performed in accordance with PSEG procedural guidance and that the procedural guidance for the evolution incorporated relevant industry operating experience.

4. Evaluate the adequacy of the pre-job brief completed prior to conducting the evolution.

Additional guidance: The team should verify that the pre-job brief was performed in accordance with PSEG procedural guidance and that the procedural guidance was based upon relevant industry guidance for conducting pre-job briefs.

Evaluate supervisory oversight during the evolution.

Additional guidance: The team should review PSEGs determination with regard to the proceduralized requirements for controlling infrequently and first-time performed evolutions. The team should assess the adequacy of these proceduralized controls.

5. Review the on-shift operators questioning attitude and the use of operator

fundamentals regarding the plant conditions and indications observed before and during the draindown.

Additional guidance: The team should evaluate the adequacy of operator training and knowledge for draining the pressurizer, primary side of the steam generators, transitioning to reduced inventory operations, activities while in reduced inventory/midloop operations, and other RCS inventory controls.

6. Evaluate PSEGs application of pertinent industry operating experience and evaluation

of potential precursors to the condition, including the effectiveness of any actions taken in response to the operating experience or precursors.

Additional guidance: The team should review and evaluate corrective actions taken by PSEG in response to industry operating experience for similar past events. The team should also identify any needed generic communication specific to this event.

7. Evaluate the adequacy of PSEGs organizational response to the uncontrolled

pressurizer draindown.

A Additional guidance: This item should include an assessment of the adequacy of PSEGs internal and external communications during and after the event.

8. Evaluate the adequacy of PSEGs initial cause analysis and completed interim corrective

actions including the causes and corrective actions for the failed level indication.

9. Additional guidance: The team should review and evaluate PSEGs prompt investigation

for independence and accuracy including identified causes and PSEGs initial risk analysis including key risk assumptions for the event. The team should also review the conduct and results of the troubleshooting activities conducted for the failed instrument and the identified causes and corrective actions specific to the equipment failure.

10. Evaluate the adequacy of PSEGs extent of condition and extent of cause for the event.

11. Considering the causes for this event, evaluate the effectiveness of PSEGs actions taken in response to the recently closed substantive cross-cutting issue in human performance.

A

B-1

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

G. Braun, Salem Vice President

J. Carey, Instrumentation and Controls Manager

V. Ciarlante, Salem Engineering

P. Davison, Nuclear Oversight Director

J. Delmer, Communications Manager

E. Eilola, Engineering Director (Acting)

M. Gaffney, Hope Creek Regulatory Affairs

G. Gelrich, Salem Plant Manager

R. Gumbert, Salem Operations

M. Gwirtz, Salem Operation Director

T. OHare, Communications Specialist

J. Keenan, Nuclear Licensing

W. Mattingly, Salem Regulatory Assurance

M. Pyle, Salem Nuclear Oversight

L. Rajkowski, Engineering Design Manager

G. Sosson, Engineering Services Director

B. Thomas, Salem Regulatory Affairs

J. Wagner, Performance Indicator Corporate Functional Area Manager

V. Warren, Risk Management Engineer

J. Wearne, Corporate Licensing

B. Wegner, Work Management Corporate Functional Area Manager

T. Wygant, Salem Operations

State of New Jersey

E. Rosenfeld, Nuclear Engineer

B

B-2

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened/Closed

05000272/2008009-01 NCV Inadequate Procedure for Pressurizer Draining Evolution (Section 3.3)

05000272/2008009-02 NCV Failure to Implement Actions for a Pressurizer Level Alarm (Section 3.6)

05000272/2008009-03 FIN Failure to Implement Corrective Actions for Operating Experience applicable to Station Operations (Section 3.7)

B

B-3