IR 05000285/1990020

Insp Rept 50-285/90-20 on 900820-31.Violations Noted. Major Areas Inspected:Insp Conducted of FCS Emergency Operating Procedures

ML20128P646
Person / Time
Site:	Fort Calhoun
Issue date:	10/31/1990
From:	Gagliardo J, Mckernon T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML20128P618	List: IR 05000285/1990020 ML20128P615 ML20128P632
References
50-285-90-20, NUDOCS 9610180038
Download: ML20128P646 (33)

Text

_ _ _ _ _ __ _ ___ _ _ . -

t

.

APPENDIX B -

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Inspection Rer rt: 50-285/90-20 Licen';e : OPR-40 Docket: 50-285 Licensee: Omaha Public' Power District 444 South 16th Street Mall Omaha, Nebraska 68102-2247 Facility Name: FortCalhounStation(FCS) ,

Inspection At: FCS Site, Fort Calhoun, Nebraska Inspection Conducted: August 20.through 31, 1990 Inspector: A T. O. McKerndn,' Team Leader, Operational 7 O DMe /

Programs Section,. Division of Reactor '

Safety, Region IV ,

\

'

Team Members: J. Pellet, Chief, Operator Licensing Section

-

Division of Reactor Safety, Region IV J. Whittemore, Examiner, Operator Licensing Section Division of Reactor Safety, Region IV J.E. Bess, Reactor Inspector, Operational Programs Section, Division of Reactor Safety, Region IV R. Mullikin, Senior Resident Inspector, FCS A. Sutthoff, human Factors Specialist, Consultant I C. Meeker, Reactor Systems Specialist, Consultant i

Approved By: / C' 2 #

'd.\ E. Gphliardo, Chief , Operational Date Progrhtis Section, Division of Reactor Safety, Region IV

) 1 9610180038 901o31 PDR O ADOCK 05000285 PDR

. _ . . .--. -- .. . . _ - _ . - . _ . - . - - . - . __

.

_ Inspection Summary inspection Conducted August 20 through 31,1990(Report 50-285/90-20)

Areas Inspected: This special, announced inspection was conducted of the FCS emergency operating procedures (E0Ps). The inspection team reviewed the plant-specific E0Ps, the E0P training program, and the quality assurance activities related to the development, implementation, and maintenance of the E0Ps. The inspection team also evaluated the technical and human factors considerations incorporated in the E0Ps and the use of the E0Ps during l plant-specific simulator exercises and plant walkthrough Result: Within the areas inspected, one violation was identified (failure to establish and maintain procedures, Sections 2.3 and 2.4 and Attachment C). The team concluded that although the E0Ps were adequate, the E0P verification and.

! validation (V&V) program was inadequate. In addition, the team was concerned i

' about the ability of the operating crew to perform E0P actions with staffing at the minimum levels required by Technical Specification. The team was also

concerned about the licensee's lack of guidelines for the plant condition requiring entry into the E0Ps and the lax communications among operator .

I I

!

!

i

!

l l \

l I I

'

i ii

- . . .--. . . - - . - . --

.

EXECUTIVE SUMMARY From August 20 through 31, 1990, an NRC inspection team evaluated the Fort Calhoun Station (FCS) emergency operating prccedures (EOPs). The inspection was conducted to verify that the E0Ps were technically accurate; that their specified actions could be physically carried out in the plant using existing equipment, instrumentation, and controls; and that the staff could correctly perform the procedures. The inspection was conducted in accordance with the guidelines in Temporary Instruction 2515/92, Revision 1, " Emergency Operating Procedures Team Inspection," July 5,1989.

Conclusions The team concluded that the E0Ps were adequate in structure to function as an operations tool to mitigate accident events and to assist in the safe shutdown of the plant during emergency conditions. However, the team questioned the ability of the operating crew to perform E0P actions with the staffing at the minimum level required by the Technical Specifications. The team was also concerned with the licensee's lack of guidelines for plant conditions requiring entry into the E0Ps. In addition, the team concluded that the licensee's E0P verification and validation (V&V) program was inadequate.

o Strengths The licensee's strengths are summarized below and discussed in more detail in Sections 2.3 and 2.4 and Attachment D of the inspection repor *

Operators' experience, plant knowledge, and diagnostic skills compensated for weaknesses in the E0P *

The labeling upgrade program contributed to easily and readily identifiable plant hardware (i.e., the human factors as placarding with regard to size, color, and readability)pect of

.

There was easy access to plant equipment designated for operation in the E0Ps and abnormal operating procedures (A0Ps).

The physical condition of the plant was well maintained, and housekeeping was good, o Weaknesses Weaknesses were grouped according to the three key purposes of the E0P team inspection and are summarized below under each category. The specific weaknesses are referenced to the applicable sections of the repor iii

.

.

(1) Technical Adequacy of the E0Ps

The ECP Basis / Deviation Document was not formalized, controlled, and current (Section 2.2 and Attachment A).

The E0Ps had a number of ii. consistencies because no formalized E0P procedure configuration control program existed (Sections 2.3 and 2.4 and Attachments A, B, and C).

(2) Capability of Physically Carrying Out the E0Ps in the Plant

The E0Ps contained a number of deficiencies that, in some instances, were considered safety significant (Section 2.4 and Attachment C).

The V&V process failed to perform adequate validations to ensure procedures could be performed as writte (3) Ability of the Staff To Correctly Perform the E0Ps

The E0P writers guide lacked adequate guidance (Section 2.4).

The E0Ps contained numerous human factors deficiencies (Section 2.3 and Attachment B).

No guidance or established operations policy existed for E0P entry for recovering from plant conditions other than in Modes 1 and 2 (Section 2.5 and Attachment 0).

Inconsistencies were noted in the use of E0P floating steps (Section2.5and~AttachmentD).

'

Commitments:

The licensee committed to take specific immediate and long-term actions to correct the weaknesses discussed above. These commitments, which were discussed during the exit interview, are understood to be as described below:

o Immediate The licensee will take appropriate actions to ensure that operators have con-sistent guidance for entry into the E0Ps for recovery f rom off-power condition o Long-term The licensee will take those corrective actions necessary to ensure that i a complete and comprehensive V8V process is performed for the E0Ps and A0P l The V&V process will include the guidance of NUREG-0899, including walkthroughs of E0Ps and A0Ps, inside and outside of the control room as appropriat l The findings of the V&V will be used to upgrade the E0Ps and AOP iv l

l . - - . . . . . - . --- - -- - - - ..

.

!'

, CONTENTS

. Page EXECUTIVE SUMMARY . . . . . . . . . . . . . . . . . . . . . . . iii INTRODUCTION

....................... 1 FINDINGS

......................... 1 Followup to Previously Identified Inspection Findings 1 Technical Adequacy of Plant Specific Guidelines (Task 1)...................... 3 Technical Adequacy of E0Ps and Consideration of

, Human Factors (Task 2) . . . . . . . . . . . . . . . 4

.

2.3.1 Technical Adequacy. . . . . . . . . . . . . . 4 2.3.2 Human Factors . . . . . . . . . . . . . . . . 5 Review of E0Ps by Control Room and Plant Walkthroughs (Task 3) . . . . . . . . . . . . . . . 6 E0P Evaluation Using the Plant-Specific Simulator (Task 4)...................... 8 E0P Training . . . . . . . . . . . . . . . . . . . . 10 Ongoing Evaluation of E0Ps (Task 5). . . . . . . . . 11 Personnel Interviews (Task 6) . . . . . . . . . . . 12 EXIT MEETING . . . . . . . . . . . . . . . . . . . . . . . 13 ATTACHMENTS

'

A TECHNICAL ADEQUACY DEFICIENCIES B HUMAN FACTORS DEFICIENCIES C CONTROL ROOM AND PLANT WALKTHROUGH DEFICIENCIES

• D SIMULATOR AND E0P TRAINING SCENARIOS AND DEFICIENCIES

'E PERSONNEL CONTACTED AND EXIT MEETING ATTENDEES F DOCUMENTS REVIEWED

-

4 y I

. . _ .

_ _ . __ . _ . _ __ _ __ _ _ _ _ _

.

.

DETAILED INSPECTION i

! INTRODUCTION The purpose of the announced team inspection was to evaluate the licensee's emergency operating procedures (E0Ps). The team reviewed the E0Ps, the documents used to develop the E0Ps, the Basis / Deviation Document, and the E0P

writer's guide; performed plant walkthroughs of the E0Ps; evaluated the E0Ps during the performance of accident scenarios on the site-specific simulator; and evaluated the human factors aspects of the E0Ps during all phases of the

'

inspection. The objective of this inspection was to determine if the E0Ps were technically adequate, could be physically carried out in the plant, and could be correctly performed by plant personne The tasks referred to in the report are described in Temporary Instruction 2515/92, Revision 1, dated July 5, 1989. Attachments A through D j

of this report support the findings discussed below, Attachment E lists personnel contacted and attendees cf the exit meeting, Attachment F lists documents reviewe . FINDINGS

.

2.1 Folicwup to Previously Identified Inspection Findinos (92701)

'~ " (,Cslosed Inspector Followup Item (IFI) (285/8936-01): Development of df"dfiMy,Afc'e'pYa%)ceCriteriaRegardingtheClassificationofSafety-Relat i

Procedures.

j The licensee's actions to develop definitive acceptance criteria associated

'

with the classification of safety-related procedures to be included in the procedures upgrade program appeared appropriate and responsiv The inspector reviewed Procedure No. 5, " Criteria for Safety Classification of Procedures," and the licensee's memorandum that provided the status of the procedures upgrade project. The inspector had no further questions regarding this item.

'

This item is considered close T.$2NbhIn)InspectorFollowupItem(285/8936-03): Abnormal Response Procedure Upgrade Program j

The licensee's actions to upgrade the abnormal response procedures (ARPs) was j progressing. The licensee anticipated completion of the ARP upgrade by

'

February 1991. The licensee had developed a draft version of an ARP writer's guide, defined the scope of the upgrade prugram, and identified the required

-

resources needed to complete the tas ,

d

.

This item will remain ope .3N(Clbsed) Violation (285/8940-01): Failure To Maintain Emergency and Abnormal Operating Procedure The licensee's actions to revise technicol inadequacies in the procedures by addressing the specifics of the violation were adequate. However, there were instances in which procedure revisions were inconsistent and failed to include all the applicable related procedure steps. For example, the licensee resolved Violation item 2.a by providing additional instructions in E0P-02 and E0P-20, Step 11.5, to augment cooling water to the air compressors. However, the same corrective actions were not translated to other similar procedure steps (e.g.,

Step 15.54 of E0P-20). Although the revised E0Ps were sufficiently structured to resolve the specifics addressed by Violation Item 2.c related to E0P-06 and the once-through-cooling action steps, the inspection team raised additional concerns related to this issue. These new concerns are addressed in this inspection report and support the apparent violation (285/9020-01) regarding the licensee's failure to establish and maintain procedures, which is documented in paragraph 2.4 of this report.

This item will be closed and corrective actions will be followed up under Violation 285/9020-0 . wwwp-231?.74M(Cloie'd)q~

'

" )eviation (285/8940-02): Failure To Validate E0Ps Using the Control Room Mockup Faci.lity.

The licensee's response to the deviation involving a discrepancy between the procedure governing E0P validation and the actual validations performed included changing the validation requirements of Standing Order G-74, E0P Writer's Guide, to require validation using the new site-specific simulator.

The licensee had committed to validate the latest revisions of E0Ps by July 31, 1990.

The team ieviewed documentation of the licensee's validation of the E0Ps and had concerns related to the sufficiency of the validations. These concerns are addressed in this inspection report and suppo the apparent violation in that the licensee failed to establish and maintain procedures (50-285/9020-01).

This item will be closed and the remaining corrective action will be followed up with Violation 285/9020-01.

Si,l'.5 J(0 pin)'Vi"olation(285/9014-01):

a.- Inadequate Abnormal Operating Procedures This violation cited examples of specific abnormal operating procedures (ACPs)

that were not adequately established, such as AOP-16, " Loss of Instrument Bus Power," and of f ailure to establish procedures for 4160V AC Vital Bus 1A3 or 1A4, 480V AC vital buses, and 125V DC Vital Bus DC1 or DC2.

The licensee was revising Procedure A0P-16 as well as establishing new A0P procedures addressing loss of offsite power; station blackout during shutdown conditions and loss of any single Vital 4160V AC power bus, Vital 480V AC power-2-

!

. - - - -- - .. . - . . .. -.- - .-_ - _

I i .

-

bus, or a 480V AC motor control center. In addition, the licensee had

contracted vendor assistance to develop the procedures and the verification and i

validation (V&V) process. The procedures were to be validated using the plant-specific simulator. The licensee anticipated the completion of the corrective actions by October 1,1990, and March 1,1991, as stated in their l violation response letter (LIC-90-0409) dated May 29, 1990.

i i

This item will remain ope .2 Technical Adequacy of Plant-Specific Guidelines (Task 1)

i

<

The E0Ps were developed using generic emergency procedure guidelines (EPGs)

developed by the Combustion Engineering Owner's Group. The E0Ps correspondcd to the EPGs, except that the licensee combined the functional recovery

,

guidelines of the E0Ps for containment integrity, containment temperature and pressure control, and containment combustible gas control into one E0P,

" Functional Recovery of Containment Integrity."

.

.

In developing its E0Ps, the licensee did not follow the guidance contained in

MUREG-0899, which states that the technical development process for i plant-specific E0Ps should include documentation of the assumptions upon which

'

the analyses were based. This documentation should have been available to the plant staff personnel who are responsible for writing ano maintaining the E0Ps i along with all of the other documentation included in the plant-specific

technicalguidelines(PSTG).

'

The PSTG deficiencies also reflect on the adequacy of the quality assurance (QA)

program because the PSTG, which was the primary basis of the E0Ps, should

.

4 have been subjected to examination under the QA program. Standing Order G-74, l

"FCS's E0P and AOP Writer's Guide," Section 2, paragraph 2.1, included the l source documents which E0P and A0P writers should have used to prepare and upgrade E0Ps and A0Ps. The list contained CEN-152, existing E0Ps, operation procedures, operation instructions, the updated safety analysis report, writer's I guide, as-built plant drawings, and licensing commitment letters. However, the list did not include the E0P Basis / Deviation Document or the existing A0Ps. In addition, the E0P Basis / Deviation Document was not controlled or maintained current to document the present status of the E0Ps properly. This concern had previcusly been conveyed to the licensee through an NRC safety evaluation report, transmitted to the licensee under NRC cover letter dated October 5, 1989, and reiterated as a finding of the licensee's safety review group's technical review dated August 10, 199 A number of discrepancies existed in which the EPG step was not incorporated into the E0P, the EPG step was modified in the E0P, or an action step not in the EPG was added to the E0 No justifications for these deviations had been provided in the Basis / Deviation Document. Specific examples of this weakness are contained in Attachment A. The licensee's technical review of the Basis / Deviation Document cited a number of discrepancies similar to those found during this inspection. The licensee stated that the Basis / Deviation Document i

~3-

. - _ _ - . -.. - . . - . .- - - . - . - .

.

was under review and would be upgraded to the current CEN-152, Revision 3, EPGs issued by December 199 The formalization of the Basis / Deviation Document into a controlled and current document is an inspector followup item (IFI)

pending further NRC review (285/9020-02).

,

2.3 Technical Adequacy of E0Ps and Consideration of Human Factors (Task 2)

2. Technical Adequacy The team reviewed the E0Ps and supporting procedures listed in Attachment F to ensure that the E0Ps were technically adequate and appropriately incorporated the CE EPGs, Revision 3, by considering:

o The prioritization of accident mitigation strategies in the E0Ps o The extent of E0P deviation from CE's EPGs

, o The step sequence of CE's EPGs

o Procedure entry and exit points o Transitions between and within the procedures o Notes and caution statements o Plant-specific values, setpoints, and adverse containment values o The clarity of decision points o The human factors aspects of the E0Ps and the E0P structure and format Although there were a number of general and specific technical concerns, the team concluded that none were significant enough to make the EOFs inadequat The E0Ps contained a number of inconsistencies because the licensee had no

,

formalized configuration control program for the E0Ps. Specific examples of technical inadequacies are listed in Attachment A. The more significant issues are discussed belo Numerous steps in CE's EPG were marked with an asterisk to indicate that these

steps were to be performed continuously. The licensee used " floating steps" as attachments to the E0Ps to indicate those functions that required periodic

,

' monitoring, such as high-pressure safety injection "stop and throttle criteria." However, the floating steps in the E0Ps did not include these actions, and there were no other provisions in the E0Ps to cause these steps to

,

be performed continuously. In some cases, the monitoring function was listed i

as a particular step, but there was no assurance that once the monitoring was initially performed, the step would be repeate The incorporation of a setpoint change into applicable E0Ps and A0Ps was a manual process. However, there was no method to ensure that all setpoint changes would be incorporated in the E0Ps and A0Ps. The team sampled some of the setpoints found in E0P-03 and compared them with the controlling document listed in the Basis / Deviation Document. The team found two examples where data points differed. Contingency Action Step 3.8.a.(v) showed the reactor gcoolant pumplowersealtohaveatemperatureoperatinglimitoflessthgn200 F while Operating Instruction 01-RC-9 showed this limit as less than 170 F. In addition, Contingency Action Step 3.12.a, stated that the reactor coolant system pressure should be verified to be of less than 2300 psia, while the

<

l Updated Safety Analysis Report stated that it was to be less than 2400 psi .

-4- l

_ -.. __ . . _ _ . _ _ _ . . - . _ _ . . . _ _ _ . ._

,

The licensee stated that the E0P was correct in the first example and thct the operating instruction had not been revised yet. Nu reason was given foe the discrepancy in the second example. Neither example involved significant safety concern However, the examples illustrated the need for an adequate E0P maintenance program to ensure that the E0Ps reflect the current setpoints and action level initiator In addition, some instructions in the E0Ps and A0Ps, such as " abnormal" and

" increase greater," could cause confusion among the operators, because these instructions left the interpretation of the action term's meaning up to the operator performing the task. In other instances, no specific acceptance criteria were given in the procedures to delineate variances and deviations from norma . Human Factors The writer's guide, the licensee responses to the.NRC' ' valuation of the procedure generation package, and selected E0Ps and / ere evaluated for consistency with the human f actors principles describt .1 NUREG-0899 and NUREG-1358. The desktop review identified a number of human factors concerns, most of which could be traced to either lack of adherence to the writer's guide (see Section 2.4 of this report) or to missing or inadequate guidance in the writer's guide and responses to the evaluation of the PGP submittal. The findings are discussed below and specific examples are given in Attachment The writer's guide addressed many of the elements found in the E0Ps and A0P However,-it lacked some of the guidance necessary to control the presentation of information in the E0Ps and A0Ps. Precise methods and formats to be used in the E0Ps, and applying human factors principles were not clearly defined in the writer's guide. As such, E0P format decisions were left to the writer's judgement and preferenc In a letter dated October 5,1989, the NRC provided its review of the licensee's submittal of the PGP in an evaluation dated March 1, 1985. The NRC requested the licensee to revise the PGP to reflect identified NRC concerns and to retain justification for any comments not integrated into the PGP for subsequent review by NRC staff. During its review of the licensee's responses, the team identified a number of inadequate responses to the evaluations, which were included in an internal memorandum from G. E. Guliani to J. X. Gasper, dated August 15, 1990. These inadequate responses apparently contributed to the apparent violation (285/9020-01), cited in paragraph The-E0Ps and A0Ps included numerous inconsistencies in procedure structure, terminology, formatting, and level of detail. There was a potential for confusion and differences in the way individual operators would understand and perform the procedures because of the magnitude of inconsistencies in the procedure The E0Ps and A0Ps had numerous variations in the use of logic terms and in the structure of logic steps, which were both inconsistent and presented in a complex manner. Furthermore, numerous variations existed in the terminology,

-5-

. - _-- -- -- _ - - ------ - - - . - . - . .

I i

,

structure, instructions. and the emphasis methods used for referencing and branching Movement within and between procedures appeared to be disruptive and confusing and could have caused unnecessary delays and error In addition to the above, the E0Ps and ACPs contained very long and complex actions.statements caution and notes, which in some instances contained operator Caution statements and notes are used to warn operators of possible  ;

hazards and to provide important supplemental information, respectively. It j was noted that the inclusion of actions in a caution statement or note could be disruptive and confusing to an operator who expected to find actions in a

'

numbered sequence in the procedur Likewise, overuse of caution statements and notes, or use of extremely complex caution statements and notes, could have been disruptive during the use of a procedure, and the procedure could have failed to serve its intended purpos .4 Review of E0Ps by Control Room and Plant Walkthroughs (Task 3)  !

l Selected procedures were walked through in the control room and in the plant with licensed and nonlicensed operators who would normally perform the procedure i The objective of the walkthroughs was to verify that all operator I actions called minimal potential for infor the procedures could be performed in a timely manner with erro The team's findings are summarized below and

,

specific examples are given in Attachment i Numerous controls deficiencies in the existed between the E0Ps and A0Ps and instrumentation and control roo However, even though the A0Ps and E0Ps had  ;

deficiencies, the operators were able to locate and identify all '

instrumentation and controls and, in most instances, implement the procedures as writte i The location of the E0Ps within the control room was clearly defined, easily j accessible, and the current revision was available. Control room lighting was s adequate for the implementation of the E0Ps. The control room layout did not '

appear to interfere with the efficient execution of actions called for in the E0P i

.

A number of weaknesses were found with regard to the adequacy of information provided in procedure steps. These weaknesses included the omission of l

!

information to identify tasks that were to be performed outside the control

!

room, failure to identify tasks that required operators to enter high-radiation areas, and failure to consistently identify eqvfpaent er component location l

<

These weaknesses were further amplified during the walkthroughs with the I operators. For example, during the walkthrough of Procedure E0P-20, Step 9.29 ii, the operators searched for Panels ELP1 and ELP2 in the switchgear room and the turbine building. The panels were later determined to be in the auxiliary building, in another instance, Procedure E0P-20, Step 15.113, instructed the operator to turn on Breaker 1A at Motor Control Center 48 This step was intended to energize pilot-operated relief valve, PCV-102-2, allowing the block valve to be opened, and to complete the flow path for partial, once through cooling. It appeared that this breaker was actually in cubicle position IB instead of 1A as stated in the procedure. This item-6-l l

. . _ _ _ _ __ . .__ ._ _ _ _ _ _ _. . .. _ .. . ,

,

.

confused the operators during the walkthroughs. Throughout the plant there were a number of labeling deficiencies between the E0Ps and plant equipmen However, the licensee had initiated a labelling upgrade program to ensure that nomenclature reflected in the procedures was the same as plant nomenclatur The licensee stated that the schedule to complete the labeling upgrade is December 1990. After the relabeling program had been completed, the E0Ps would

!

be revised to reflect the as-built configuration of the plant. These deficiencies were examples of the apparent violation (285/9020-01) regarding the licensee's failure to establish and maintain appropriate plant procedure The operators, in most instances, were able to locate the required equipment in

' a timely manner and to perform the required task in accordance with the E0P Equipment specified to be operated locally in the E0Ps was accessible.

,

Enuipment accessibility, the labeling upgrade program, and housekeeping were considered strength The team reviewed the V&V program as delineated in the writer's guide (Standing Order 50 G-74). The V&V process was necessary to ensure that the E0Ps and A0Ps (1) integrate plant-specific technical information (including setpoints)

(2) were written using the format and structure defined in the writer's guide,.

(3) reflected the plant labeling used in the control room and plant, (4) understood and used by operators to mitigate potential plant events, and

, (5) could successfully bring the plant safe shutdow i A number of weaknesses were identified in the VSV programs. Examples of which are delineated below:

The verification part of the program failed to require (1) plant walkdowns to ;

verify plant labeling against procedure nomenclature and (2) independent  !

verification by excluding the individual procedure writer or revision initiator from participation. It provided a checklist that did not accurately reflect i

the content of the writer's guide. For example, the checklist required the l

verifier to ensure that "G0 T0" and " REFER T0" were used as transition terms t (i.e., all capital letters and an underline) although the writer's guide l indicated using lower case without underlines. The program also failed to '

describe the criteria for reverification when changes were made to the procedures as a result of initial verificatio The validation part of the program failed to require (1) plant walkdowns to validate actions required cuiside the control room, (2) independent validation by excluding the individual procedure writer or revision initiator from participation, and (3) individual use of the validation checklist by evaluators to document validation instead of using it as a tool during validation. In addition, the checklist included very subjective questions (e.g., "Is the E0P and A0P easy to read?") rather than questions that checked the E0P and A0P against the requirements of the writer's guide with regard to type size, copy quality, etc. The program also failed to describe the criteria for revalidation when changes were made to the procedures as a result of initial validatio _ _ . _ _ _ __ . _ . . _ _ _ _ . _ _ . _ _ __

j

.

d in addition, the absence of a complete and current PSTG prevented adequate

.

verification against the technical bases of the procedures (see Section 2.2).

These weaknesses in the V&V program were directly reflected throughout the procedures. Specific examples are given in Attachment As stated in Section 2.3.2, the licensee's responses to the NRC's comments with regard to its evaluation of the PGP were insufficient. Because these responses were integrated into the current version of the writer's guide, there was a high potential for continuing deficient V&V of the E0Ps and A0Ps. The V&V program and its implementation appeared inadequate. In response to the inspection team's cuncerns regarding the V&V program, licensee representatives committed to the following actions: (1) to take those corrective actions S necessary to ensure that a complete and comprehensive V&V process is performed for the E0Ps and A0Ps; (2) to include in the V&V process the guidance of

,

NUREG-0899, including walkthroughs of E0Ps and A0Ps, inside and outside of the

-

control room as appropriate; and (3) to incorporate the findings of the V&V 4 into the upgrade of the E0Ps and A0Ps.

The V&V discrepancies discussed above and those discussed in Section 2.3 and 2.4, constituted an apparent violation (285/9020-01) of Technical Specification 6.8.1, and Regulatory Guide 1.33, which require that written procedures be

!

established and maintained to combat emergencies and abnormal occurrence This requirement is amplified for E0Ps and A0Ps by NUREG-0737 (Item I.C.1) and i' NUREG-0899, which describes the need for a V&V process to demonstrate procedural

.

effectiveness.

E0P Evaluation Using the Plant Specific Simulator (Task 4)

'

The E0Ps, as they existed, served to guide the control room operators in i

mitigating the events imposed during the evaluated scenarios. The two crews '

'

observed were generally able to initiate and to enter the correct procedure and  ;

transition to those sections required to ensure that safety limits were not  ;

exceeded. Plant-specific simulator modeling limitations and time constraints i precluded long-term evaluation of safety functions that would be challenged and

the stable conditions that would eventually be obtaine !

The E0Ps provided recovery guidance for optimal and functional recovery of all '

the events considered during the plant-specific simulator scenarios. In some ,

i

cases, the crews were reluctant to proceed with optimal recovery procedure When functional recovery was entered, racovery timc was prolonged if operators

, were unsure that the optimal safety ft . tion status checks were satisfied

because the operators would take the conservative approach and enter Procedure E0P-20 (Functional Recovery). After each scenario, the inspection team debriefed the operating crew to determine their level of understanding of

.

the events that had occurred, thy,tnned, extended recovery actions, and the

reasons for the planned long-term actions. The operatcrs also were encouraged i to inform the team of any problems they experienced in using the particular

E0Ps exercised by the scenario. In fact, operators commented about improper a

simulator machine response (i.e., the simulator response was different than the plant response would have been). This comment was offered as a reason for the

'

altered crew response on two occasions.

-

-8-

)

{ _ !

l l

During all scenarios the operators responded as they would to a real event in the plant. They generally cemonstrated excellent diagnostic skills and good ability to enter the correct procedure. In some cases the optimal recnvery procedure was the preferred procedure, but it was considered conservative action when the crew elected to enter the funct';nal recovery procedur There was no defined operating policy or clear direction from operations manage-ment on how operators were to perform E0Ps. With roles and responsibilities undefined, individual crew supervision established the operating policy for the crew. Decisions to enter Procedure E0P-00 to recover or to exit E0Ps were made by the operator while rationalizing their choices out loud, with no obvious policy guidance or common philosophy of E0P execution in mind. There were also cases when guidance was needed to determine if a safety function success criterion had been met. In all cases but one, the operators chose to take the conservative functional recovery approach when more explicit er complete saf ety functions could have been satisfied using the optimal recovery procedure. In the one instance, the crew chose not to enter Procedure E0P-00 at all while meeting three of the tive entry ccnditions when only one entry condition was necessary for entr Licensee representatives committed to take appropriate actions to ensure that operators have consistent guidance for entry into the E0Ps for other than Mode 1 or Mode 2 plant conditions.

The ability of the control room licensed operator crew to mitigate events using the E0Ps was marginal when the crew complement was at the minimum level required by the Technical Specifications. Reducing the number of licensed operators in the control room during one scenario resulted in the minimum crew being unable to maintain effective control of safety functions and to diagnose the occurrence of complicating events. When the two operators who had been absent from the control room during the initial stagas of the event returned 5 to 10 minutes into the scenario, they were of little assistance in regaining control of safety functions.

Individual operators had to analyze the task to be accomplished by some specific procedure steps to determine the necessary sequence of the actions needed. The analysis avoided the needless delay in recovery because of the awkward or incorrect structure of the steps. The proper sequencing of steps in the E0P would reduce the risk of inadvertently omitting a step.

The operators used the E0P floating steps inconsistently. Some operators tried to remember the floating steps while others infrequently reviewed the steps.

Panel manipulations routinely required crew supervision. Command and control responsibilities during these manipulations appeared to vary, and a single individual did not maintain a continuous leadership role. It became apparent that there were inconsistencies in communicating orders to nonlicensed operators for the performance of steps outside the control room. Followup inquiry indicated that during the performance of E0Ps and A0Ps outside the control room, nonlicensed operators were given a page, or pages, from the control room copy of the procedure, or they made a copy for themselves in order to perform the actions locall I l

,

_ .. - .- .-

.

The high noise level from audible alarms in the simulator room was detrimental to the mitigation of events because crew merrbers paid more attention to silencing the alarms than to executing steps in the E0P ,

a similar problem existed in the control room. The team did nut determine if

'

The team concluded that events could be successfully mitigated using the E0Ps !

only if operatio power the control room was staffed beyond the minimum level required during In addition, licensee attention was needed to formulate policy for control room staff to enter and use the E0Ps. It was noted that the i success realized in performing the scenarios was directly related to the high !

level of experience and inherent knowledge of the operators and the observed ,

tendency of the operators to follow a cnnservative path when there was a lack I of direction or policy. Licensee representatives committed to evaluate the staffing needs required to implement the E0Ps and A0Ps and to take appropriate actions to assure that the minimum staffing level is maintained during plant operation l E0P Training The licensee conducted initial training on the site-specific simulator for the newly revised E0Ps in parallel with the E0P simulator validation effort. Subse-quently, E0P lesson plans had been developed to familiarize all operators with usage of all E0Ps and to make operators familiar with individual E0Ps. The E0P simulator scenarios and lesson plans were organized and administered in accordance with instructions in the Nuclear Operation Division Training Administrative Manual (TAM). The TAM proviced detailed instructions of sufficient complexity to develop and use event scenarios for training. It also provided a number of methodologies to use for evaluating for operators evaluations during administra-tion of simulator scenario These scenarios were of sufficient complexity and detail to challenge the opera-tors' ability to use the E0Ps for event mitigation. Instrument failures, compo-nent problems or degradation, and instructions to perform shift assignments involving surveillance tests or administrative duties were included in the scenar-ios. Operators were further challenged by scenario e" ants requiring transition into and out of procedure However, E0P lesson plans were shallow, and important aspects of E0P execution were addressed superficially. Floating steps were only listed, and no insight was provided as to when specific steps would be required or expected in a given procedur Little operating experience had been incorporated into these lesson plans, and no consistent attempt had been made to provide reasons for specilic procedure steps. Many important aspects of a specific procedure were not addressed in lesson plans. Complex evolutions that required timing and integration were not sufficiently explained to the students. This type of E0P training could not be effectively conducted on the simulator, especially fer those students whose duties were normally outside the control roo The effectiveness of E0P training for licensed operators and those preparing to obtain a license was reduced by the distinct differences between plant response and simulator response, the differences between the physical environment in the simulator room and that in the control room, and some actual hardware differences-10-

_ __ .- _ -.

- -. . .. ~ ... - - - - . . -- - .- .- - - - - . - . - - - -

.

l

. I

'

between the simulator and the control roo In aadition, some nonlicensed opera-

tors had received little or no training on the structure of the ECPs, how the

' two-column format was used, definition of terms, or how the procedure was designed to wor l Standing Order 0-1, Section 8, specified conrounication requirements, format, ano i methodology. The training department taught these desired communication attri-

'

butes in a formal classroom session using Standing Order 0-1. This effort was reinforced by insisting on compliance with these requirements during simulator

training sessions and by routinely evaluating the communication skills of students during these sessions. Conversely, there appeared to be no standard for compli- )

ance to the standing order among the operating crews in the control room,

,

{

'

l The team concluded that E0P training was effective, but improvements were needed {

<

in the classroom lesson plans for E0Ps. The needed improvement, involved the l integration of operating experience and operations department policy. Several l areas that required attention by training could not be addressed until the licensee had established operational policy in the specific area. Examples of

,

!

these areas were connunications, E0P entry, and safety function evaluation Additionally, licensee attention was needed to conduct E0P training at the Technical Specifications minimum control rocm staffing level .7 Ongoing Evaluation of E0Ps (Task 5)

Section 6.2.3 of NUREG-0899 required that licensees establish a program for the ongoing evaluation of E0Ps. NUREG-0899 further requires that the ongoing evalu-ation program include the evaluation of the technical adequacy of the E0Ps on the basis of operational experience and use, training experience, simulator exercises, and control room walkdowns of the procedure The team concluded that an adequate program did not exist to ensure that all changes to procedures, setpoint documents, and other material affecting the E0Ps were being incorporated into the E0Ps. Also, the deficiencies noted in the review of procedures and plant walkdowns did not assure that the licensee's V&V process would discover unincorporated changes to the E0P The team reviewed the licensee's actions regarding NRC Information flotice (IN) 88-75, which identified a potential problem in which the capability to close circuit breakers from the control room may be lost as a result of anti-

! pump circuitry lockout. The licensee's connitment tracking system showed that the It! was reviewed and found not to be applicable, it appeared that this IN was acted upon in a timely manne The licensee performed a quality assurance audit of E0Ps and A0Ps as required by Appendix A, Attachment 1, Section B.2 of the Updated Safety Analysis Report and Section 10.1 of the Quality Assurance Plan. Audit Report tio. 67, dated August 8,1990, detailed their assessment to determine the adequacy of the procedure generation package in detailing the requirements of fiUREG-0899 and Supplement 1 to fiUREG-0737. The licensee used NUREG-1359, " Lessons Learned From the Special Inspection Program for Emergency Operating Procedures," as a primary guide for evaluating the E0P and A0P program during the audi . - . - - . - . . . . - - . _ - . . . - - . . - - _ - - - -- .- -

.

This OA audit was the first audit performed of the E0P and A0P program. It was

' currently on a 3-year cycle, but Audit Report No. 67 recommended that E0Ps and AOPs be audited again next year to evaluate program ef fectiveness. Since the QA audit was so recent, it was not possible to assess the overall corrective actions to the identified deficiencie In addition, the onsite Nuclear Safety Review Group (NSRG) reviewed E0Ps, E0P deviation documents, and emergency procedure guidelines. The NSRG findings  ;

) were published as Document SRG 90-479 on August 10, 199 It was noted that the QA audit and NSRG review had several of the same findings as those identified in this report. However, the number of issues found during

,

l this inspection indicated that a more indepth audit and review would have been appropriat !

2.8 Personnel Interviews (Task 6) ,

The team interviewed eight licensed individuals, including training and operations !

management representatives, and three nonlicensed individuals involved in the performance of E0Ps and AOPs. The interviews were. conducted to augment and ,

clarify the team's findings in other areas of the inspection and to discuss the operators' understanding and knowledge of E0Ps and A0Ps and their actual expe-rience in using E0Ps. E0P training, the adequacy of shift staffing to perform i the E0Ps, and other related topics were also discussed. In addition to the formal interviews, the team held informal interviews during walkthrough with plant personnel and these have been factored into the team's conclusions that follow:

o The operations department had not defined a clear policy for the use of the E0Ps and A0Ps, including assignment of roles and responsibilities during the performance of E0Ps and A0Ps. Lead shift operators had to determine the manner in which E0Ps were to be performed, resulted in an inconsistent approach to E0P usage and performanc o Operators believed that the level of detail in the E0Ps was inconsistent, with some steps providing unnecessary information and others providing too little guidance, o Operators expressed dissatisfaction with the overall inconsistency found in the procedures; for example, in references to locating information in other areas of the plant and to plant nomenclatur o Nonlicensed operators were not provided with specific training on their roles and tasks during performance of E0Ps and A0P They had received little or no training on how the procedures were structured, written, or performe o Emergency communications via the Gaitronic system were very difficult in certain areas which had no Gaitronic stations and also because the system was overloaded. Although hand radios were identified as an alternative, the lack of radios and signal interference from metai shielding diminished

,

the benefits of this alternativ .. __

-

_- . _ _ _ . _ _ _ .. __ __ _ ._ _ . . . _ _

'

.

o Normal plant staffing was adequate for execution of E0Ps and AOPs. However,

, ,

it was not clear if this wculd be true for the minimum level of staffing allowed by the Technical Specifications, because the crews had not been trained under this condition, i

o Although coment on E0Ps and A0Ps were actively solicited from operators, originators seldom if ever receive feedback on their submittal o Licensed operators believed that the E0Ps and A0Ps were adequate and that

'

their training on the procedures had been adequate.

~

o Plant personnel had confidence that, despite the existing problems, the E0Ps and A0Ps did support operator response to accident conditions. The licensed operators' understanding of the E0Ps was generally consistent and satisfactor '

5 EXIT MEETING

The inspection team met with the licensee on August 31, 1990, to discuss the findings

,

of the inspection. The licensee agreed to implement the imediate and long-term

,

commitments discussed in the executive sumary. The licensee did not identify as

~

.

proprietary any of the materials provided to or reviewed by the inspectors during

! this inspection.

.

i

.

~

- -

a

,

.

ATTACHMEFT A TECHNICAL ACE 00ACY DEFlCIENCIES Specific examples of the technical deficiencies found during the inspection arid generally addressed in the inspection report are described below. The examples are representative and not all inclusive of those findings observed during the inspectio Basic / Deviation Document Discrepancies With Related Emergency Operatiric Precedures The following exarrples of the Basis / Deviation Document not being up-to-date with the current emergency operating procedures (E0Ps) were noted:

o E0P-04, Step 3.11 - The wording in the Basis / Deviation Document did not agree with the current version of the E0 o E0P-20, Step 14.22 - The Basis / Deviation Document lists an E0P step that was added without a corresponding emergency procedure guideline (EPG)

step and contains a different Step 14.22 than the step in the current E0 i t

o E0P-20, Section 16 - This procedure combined three separate sections of the EPG into one section, but the Basis / Deviation Document did not refer i to the EOP as presently written and referred to only one of the three EPG !

section i o l E0P-05, Step 3.15 - The E0P step directed the operator to go to Step 3.18 while the Basis / Deviation Document directed the operator to go to Step 3.2 The following examples of the EPG step being modified or not included in the E0Ps and not justified in the Basis / Deviation Document were noted:

o E0P-01, Step 7 - This procedure did not include the EPG concerns about reactor coolant pump (RCP) seals and seal coolin o E0P-20 - Although EPG Section PC-3, Steps 2, 4, 5, 6, 9, 10, and 11, were {

included in the floating steps of the procedure, they were not referenced '

in the procedure itself. The other steps were delete o E0P-20 - EPG Section PC-5, Steps 1 through 7, were included in the floating steps of the procedure, they were not referenced in the procedure itself. The other steps were delete The following were examples noted where a step was added to the E0P without justification in the Basis / Deviation Document:

_ _ . . _ . _ _ .. _ _ _ _ _ _ . . _ __ _ . _ _ . _ _

l

.

, o E0P-02, Step 3.29 - this step addressed diagnostic 6-tions that were not

=

J contained in the EP o E0P-04, Step 3.aa - This step directed emergency boration that was not contained in the EP o E0P-04, Step 3.13 - This step redirected sample drains in Poom 60 that were not contained in the EPG.

o E0P-20, Step 14.13 - The " CAUTION" statement added concerns about the

addition of loads to the diesel cenerators that were not contained in the EPG.

'

E0P-03, Loss-of-Coolant Accident

,

'

Step 2.0, Entry Conditions, contained unclear statements. The procedure stated that indications of " abnormal change in pressurizer level" and " abnormal increase in containment sump level" may be present. However, the procedure did

not define what " abnormal" meant. The E0P useo indications of "high containment radiation" while the Combustion Engineering Owner's Group EPG looked for

" increase in containment radiation." The EPG used either high quench tank

-

level, pressure, or temperature as an indication of a loss-of-coolant accident (LOCA) while the E0P used level, pressure, and temperatur E0P-04 Steam Generator Tube Rupture i

Numerous steps in the EPG were marked with an asterisk to indicate that the actions in these steps were to be performed continuously. However, the floating steps in the E0P did not include these actions, and there were no other provisions in the E0Ps to cause these actions to be performed i continuously. Examples were E0P-04, Steps 3.2, 3.4, 3.5, 3.6, 3.15, 3.16, 3.18, 3.23, 3.24, 3.27, 3.28, 3.31, and 3.32. In addition, these deviations

<

were not justified in the Basis / Deviation Documen Step 3.6 directed the operator to stop one RCP in each loop. However, certain

power and pressurizer spray capabilities that have an effect on which RCPs are to be secured, and information about these effects would be useful to the operators.

{ Several of the cautions statements and notes were very long and detailed to the point that they would be difficult to read and could cause significant delay in i. completing the E0P required. actions. Examples were the cautions statements and/or notes before Steps 3.9, 3.10, and 3.2 E0P-05 Uncontrolled Heat Extraction Step 3.9.d instructed operators to verify RCP motor radial or thrust shoe temperatures. However, the nomenclature on the control room computer did not match that in the E0 . _ . - - - - . - - - _ - .- . .. - .-. - . - -. . - - . . _ . - .

i

r

-

Step 3.9.f referred to persistent vibration alarms on the RCPs, but contained no guidance on what " persistent" meant.

l E0P-20, Section 9, Functional Recovery of Maintenance of Vital Auxiliaries AC Step 9.7 directed the operator to to reset offsite power low signal (OPLS).

However, the required action was to reset both 86A/0PLS and 86B/0PL In addition, they were required to be reset again in Steps 9.8.b and e, an action that appeared to be unnecessar The deviation document for Steps 9.11 and 9.12 and the corresponding contingen'.y actions gave instructions to adjust the frequency and voltage for the emercency diesel generators on starting the diesels. However, the E0P did not contein these instructions. Although the operator knew what to do during '

the walkinrough, the instructions would be helpful as an ai Step 9.21 9 stated the need to energize normal lighting. However, the step did not reference the applicable operating instructio Step 9.66 should be consistent.with Step 9.46 in that the applicable designator DC-B1 for the No.1 battery breaker should be added. .

.

'l I

,

-3- j l

!

.._._ -._ . . _ _ . _ _ _ - . _ _ _ __ _ . _ _ _ . . _ . _ . . _ _ _ . . . _ _ . . _ _ _.______

'

l

.

ATTACHt4ENT B

HUMAN FACT 0PS DEFICIENCIES

!

i  !

The following are examples of the human factors deficiencies identified in the

! emergency operating procedures (EOPs) and abnormal operating procedures (A0Ps) l

,

at Fort Calhoun Station. This attachment is not intended to be an inclusive '

list of human factors deficiencies; rather, it is intended to illustrate the j

types of human factors deficiencies identified by the inspection tea Writer's Guide

j

The writer's guide failed to

o Identify the Basis / Deviation Document as a source document for revising

and writing E0Ps

,

} o Define the structure and relationship of instruction steps and

contingency steps

-

o Clarify the type of information that was included in attachments rather

] than in the body of the procedure i

o Define a clear numbering system for instruction steps versus contingency j steps

I o Define the minimum type size for figures and resource trees o Describe the use and format of lists other than those within the logic steps o Require that a place for operator calculations be provided in the procedure o Explain how parentheses would be used relative to procedure numbers, sections and figures o Provide an inclusive list of approved action verbs to be used in E0Ps and A0Ps

The Licensee's Responses to NRC's Evaluation of the Procedure Generation  ;

Package (PGP) Safety Evaluation Report (SER) 1 The following licensee responses to !!RC's evaluation of the PGP were i inadequate:

SER Comment A - Although the licensee stated that "0 PPD [0maha Public Power District] believes that the reference of all safety-significant differences in '

[ Standing Order] S0 G-74 falls outside the scope of the Writer's Guide," and

_ - _ _ _ . _ _ _ _. _ _ _ - _ ... __ _ . . __ _ ___ _

.

it was true that the issue of safety-significant differences from CEH-152 was cutside the scope of the writer's guide, the SER comment refers to the PGP, which included the plant-specific technical guideline SER Comment B.1.e. - Resolution required a reference to the second horizontal row of asterisks used to offset caution statement SER Comment R.1.f. - Figures 4 and 5 had not been revise SER Comment B.2.d. - No Section 4.4.2 existed in the writer's guid SER Comment B.3.b. - Resolution indicated that easy configuration management was a higher priority than minimizing operator error. The licensee stated that no sect 1un or step numbers would be included in referenced precedures and branches in order to avoid configuration problems when changes to the referenced procedures were made.

SER Comment B.S.g. - The licensee stated that a list of preferred verbs would be provided to procedure writers, with no strict requirements for their use in the E0Ps. This lack of restriction could contribute to inconsistency in the instruction steps in the procedures.

E0Ps and AOPs The following are examples of human factors weaknesses in the E0Ps and A0Ps:

o Logic

!

Procedure E0P-06, Step 3.11, contingency action: This step violated the

.

guidance on logic structure because of the inclusion of the consequent {

action within condition "b." i l

Procedure E0P-06, Step 3.21: This step violated the guidance on logic structure because a "when" conditional statement followed an actio Procedure E0P-06, Step 3.30, contingency action: The consequent action in this logic step is worded passively, rather than as a directiv Procedure E0P-06, Attachment 4, Step 20: This step violated the guidance on logic structure because of the use of "THEN" to introduce a second action.

o Referencing and Branching Procedure E0P-05, Step 3.12: This step directed the operator to go to Step 3.19, however, the Basic / Deviation Document instructed the operator to go to Procedure E0P-06, Step 3.18: This step included an implicit reference to TDB-III.1.a or TDB-111.2. All references and branches should have been clearly identified and structured as directed by the writer's guid . - - . - -. - . . - . - - - - . . - - - - - -- . . . - . . - . - .

.

.

Procedure E0P-07, Step 3.8, contingency action: This step used the term

" complete" to indicate a branch to Steps 3.5 and 3.6, in violation of the writer's guide requirements on branchin l Procedure E0P-07, Step 3.35, contingency oction: This step included a reference within parentheses in violation of the writer's guide requirements on both references and the use of parenthese Cautions and Notes Procedure E0P-00, Caution, Step 3.5: The caution statement preceding i

Step 3.5 was not associated with that step. The first step relating to this caution statement was 3.8, three pages later.

.

Procedure E0P-04, Cautions and flotes, Steps 3.9, 3.10, and 3.27: These cautions statements and notes were very long and complex, making them l difficult to read and 1(kely to cause significant delay in completing the E0P actions.

Procedure E0P-07, Caution, Step 3.36

This caution statement included a

~

conditional action step plus a caution.

Overall Inconsistency

Inconsistency was found in the level of detail providea in the E0Ps and A0Ps. 'For example, some steps included references either to operator instructions for basic actions or to information located at a major control board (e.g., E0P-07, Step 3.4; E0P-20, Section 8.0, Step 8.2.a)

,;

while other steps failed to identify the necessary references or the multiple actions required to complete the step (e.g., E0P-06, Steps 3.17 and3.30).

Procedure E0P-06, Steps 3.7.b and 3.7.c: actually constituted one action, which was represented as one step in Steps 3.8.d and 3.9.e. This variation was one example of the lack of a standard step structure throughout the E0Ps and A0P Procedure E0P-06, Step 3.10.c, contingency action, failed to provide the necessary level of detail to complete the action The numbering system used for floating steps in Procedure E0P-6 did not provide a parallel structure between floating steps. As.a result, there was a potential for confusion and delay. For example, Floating Step 10 was one complete floating step, while the floating step for turbine auxiliaries encompassed Steps 11 and 1 ;

- , , , - -

.

, ATTACHMENT C CONTROL ROOM AND PLANT WALKTHROUGH DEFICIENCIES The following are specific examples of deficiencies found during the plant walkthroughs and the verification and validation (V&V) revie Writers Guide '

Although Section 4.5 of the writer's guide stated, that, "a caution. . . cannot direct an action," Procedure A0P-23, Caution 2, page 20, directed the operators to " refer to attached valve position table for valve accident positions and the effects of resetting CIAS [ containment isolation actuation signal]." However, i this statement was structured as an action instruction, rather than a caution '

statement, in other sections of A0P-23 Although the writer's guide indicated that " refer to" and "go to" are acceptable referencing and branching terms, respectively. A variety of methods, such as the following, were used in the E0Ps to direct operators to move within and between procedures:

o In accordance with E0P-06, Step 3.29, contingency o Within limits of Procedure E0P-06, Step 3.15 o Continue with. . . Procedure E0P-06, Step 3.9, contingency The Licensee's Responses to NRCs Evaluation of the Procedure Generation Package The following licensee responses to NRC's evaluation of the PGP were inadequate:

SER Comment B.2.b. - The licensee incorrectly . stated that "AND" or "0R" were no longer in the same statement in the E0Ps and A0Ps because of the change from a single to a dual-column format. Failure to correctly integrate this SER requirement into the writer's guide had resulted in procedure steps that had more than one possible interpretation and a high potential for error.

SER Comment B.13.a. - No mechanism for ensuring E0Ps and A0Ps were updated when changes occur in other plant procedures existed.

SER Comment C.3.a. - Section 1.3 of the validation program provided for a table-top review to validate changes to actions performed outside the control room in the E0Ps and A0Ps. The table-top reviews did not ensure that the actions could be performed by operators and that they would be feasible in the plan !

E0Ps and A0Ps

Procedure E0P-01, Step 7.6, referred to the containment radiation monitor.

However, the monitor was not labele O

)

. _ - , - - . - - - - - -

%

.

Procedure E0P-04, Step 3.30.a. directed the operator to fill and drain the "A" steam generator. However, filling a steam generator required a reference to Operating Irstruction 01-AFW-4, Section 6.12, and numerous actions were required to drain the steam generator, such as blocking CIAS, locally operating drain valves, and starting a pump. Such references and additional instructions were omitte Procedure E0P-05, Step 3.19 a(i), required the use of Operating Instruction 01-AFW-4 (Steps 6.7.1-6.7.5). However, the E0P did not reference this instruction. The operator was expected to perform this step and to remember that this instruction was to be use Procedure E0P-07, Attachment 2, Step 7.6, contingency action, directed the operator to place the air compressor motor switch at the engine control panel in the "0FF" position. Because there were both primary and secondary motors, it was unclear whether the operator was to place one or both in the "0FF" positio Procedure E0P-20, Step 9.291i, instructed the operator to open the emergency lighting breakers located on Panels ELP1 and ELP2. However, it did not give the location of these panels, and the operator could not readily locate the panel Procedure E0P-20, Step 9.40, instructed the operator to open the Reactor Coolant Pump RC-3C breaker, The breaker in the field, however, was labeled RC-3 Procedure E0P-20, Steps 10.10 and 10.46, instructed the operator to " inspect 1600 AMP in-line fuse link" for DC batteries. During the walkthrough the operator could not locate this ite Procedure E0P-20, Step 11.5.b.ii, instructed the operator to open Valve AC-1034 on air compressor CA-1A. However, this valve was actually on Air Compressor CA-1 In addition, Step 11.5.cii, contingency action stated that Valve AC-1042 was actually on CA-1B, but the actual location of this valve was -

on CA-1 '

Procedure E0P-20, Step 15.113, instructed the operator to turn on Breaker 1A on j Motor Control Center 481. However, this breaker was actually located in Cubicle Position IB instead of 1 I Procedure E0P-20, Steps 16.61.a and 16.61.b, referred to the selector switch but required manipulation of the enable switch mode selector switches, respectivel Procedure E0P-20, floating step for safeguards reset, had no entry condition It was unclear what conditions should be continuously monitored to determine if reset was require l

,

_ _ _

..

.

Procedure A0P-19, Step 3.14, caution, referred to levels in the safety injection refueling water tank of 16 inches and 72 inches. Ilowever, the level indicator for this tank was graduated in 5 inch increment .

e

$

)

,

-3-

.

ATTACHMENT D SIMULATOR AND E0P TRAIHlHG SCENARIOS AND DEFICIENCIES The six scenarios conducted during the simulator evaluation are described below. One crew executed the procedures during the first three scenarios and another crew executed the procedures during the last three scenarios.

First scenario: the reactor was subcritical during startup with the control rod shutdown banks withdrawn, a spurious reactor trip occurred with safeguards actuation, and a main steam safety valvti failed open during trip recovery. The team made the f ollowing observations:

o The crew chose not to enter Procedure E0P-00 after the reactor trip because the reactor was subcritical before the trip. When the uncontrolled heat extraction occurred, the crew recognized that Procedure E0P-05 provided appropriate guidance; however, the crew mitigated the event without using the E0P because they had not entered Procedure E0P-00.

o Connunications were frequently informal and imprecise. Hand signals and terms such as "in the blue" or " screaming up" were used.

o Procedure A0P-23 did not indicate task importance and did not consider competing events in the sequence of restoration. Recovery of pressurizer pressure and level control was needlessly delayed by the sequence of restoration. Also, the procedure did not caution the performer that any reactor trip must be either reset or bypassed to complete diesel generator restoratio l o The shift supervisor had to be prompted to complete the floating step for the reactor coolant pump tri !

Second scenario: the reactor was at approximately 50-percent power, a spurious I reactor trip occurred, and a pressurizer safety valve failed open af ter operators completed Procedure E0P-01. The team made the following observations:

o A mislabeled annunciator in the simulator (pressurizer spray versus safety valve discharge temperature high) significantly ccmplicated diagnosis and mitigation of the actual event.

o When two containment isolation valves in a single steam generator sample penetration line failed to isolate, the operating crew determined that 1 the containment integrity safety function was not being satisfied because l the containment isolation actuation signal (CIAS) did not annunciate. The crew indicated that the term "CIAS initiated" would not be satisfied unless all components properly repositioned on a CIA Further, the crew I indicated that this interpretation had been established during informal discussions among crew members before and during the event, rather than in training or formal policy statement ;

J

i- ..s#..

__ _

.

Third scenario: the reactor was at 100 percent power, one diesel generator was out of service, three rods were stuck out (unannounced), offsite 161-kV and 345-kV power supplies were lost (all offsite power), and the FW-10 pump failed (the turbine-driven EFW pump, causing a total loss of feedwater). The team

,

I made the following observations:

o The crew was not aware that Recovery Procedure HR a detailed breaker lineups to restore power to a second high-pressure safety injection pump I and pressure operated relief valve, o The crew elected to delay implementation of Procedure HR-4 and intention-ally reduced steam generator inventory before initiating or preparing to implement Procedure HR- Because Procedure HR-4 required considerable control manipulations outside the control room during the degraded power conditions, it seemed appropriate to pre-review and plan these activities before initiating Procedure HR- Fourth scenario: the reactor was at 100 percent power, battery charger 1 failed, a DC bus was temporarily lost while switching to the backup charger, component cooling water (CCW) to the reactor coolant pumps was lost, and a small steam generator tube leak occurred simultaneously with the reactor trip that resulted from the loss of the DC bus. Initially, the control room staff was limited to minimum staffing levels (one senior reactor operator and one reactor operator) required by the Technical Specification. The additional staff returned to the control room about 5 minutes after the reactor trip. The team made the following observations:

o The operating crew was unable to accomplish the standard post-trip actions before restoration of full staffing.

o The crew failed to recognize that the reactor coolant pump seals were without CCW for about 7 minutes, until receiving high pump vibration alarms.

o The successful reintegration of the shift supervisor into crew event response activities was not accomplished during the scenario, i o The lead senior operator determined that a DC bus had been lost and not restored, which required entry into E0P-20, because a burned-out light bulb caused the indication on one panel to appear as if it were con-flicting with the computer reading and the indication available at the back panel, o The crew had difficulty determining what was an abnormal dif f erence between the core exit thermocouple and the reactor cooling systems (RCS)

T(hot) resistance temperature detectors (RTDs) temperatures to satisfy the safety function status check for Procedure HR-2, Step 6.8 ('

I l

. _ - . . - . . _ _ . . _ - _ - __ -- _ __ _ __

.-

Fifth scenario: the reactor was at 100 percent power, a steam generator tube ruptured, and ofYsite power was lost after the generator with the tube ,7upture Wds isolated. The team made the following observations:

o Core exit thermocouple temperatures were increasing independent of other RCS temperatures. Also, the HPSI flow and diesel generator load indications were oscillating without apparent cause. These indications appeared to be apparent sinrulator deficiencies. The many disparaging comments made by operators about simulator fidelity to the actual plant and control room substantiated the team's concern about training effectiveness, o Because there were not sufficient copies of, or sections to, the E0Ps for the shift technical advisor and the panel and outside operators, the control room copy had to be taken either for the individual who needed it or the operator had to make a cop Sixth scenario: the reactor was at approximately 30 percent power, the 161-kV and 345-kV offsite power sources were lost causing a reactor trip concurrent with .a failure of the output breaker for Diesel Generatur 2, and Diesel Generator 1 failed after plant conditions were stabilized after the trip. The team made the following observations:

o There was not a single coninon method for communicating long ( complicated instructions to operators outside the control room. Instead, the method was determined on a case basis each time outside communications were neede o Procedure E0P-20 safety function status check for heat removal required that SG levels be restored with AFW, but it did not mention restoring these levels with main feedwate o Corrrnunications were routinely open ended (i. e., individuals at the supervisory level did not respond to the operator as frequently as the operators responded to them).

i l

j -3-

i i

_ . . - . _ .- .. . -- -- . . - -

b, '

.

.

ATTACHMENT E PERSONNEL CONTACTED AND EXIT MEETING ATTENDEES I

l OPPD Personnel:

H. G. Gates, Division Manager, Huclear Operations Division i J. K. Gasper, Training Manager i J. J. Fluehr, E0P Coordinator

T. L. Patterson, Manager FCS 1

<

S. K. Gambhir, Division Manager, Production Engineering

D. J. Matthews, Supervisor, Station Licensing ,

C. F. Simmons, Station Licensing Engineer -

M. P. Lazar, Supervisor, Operations & Technical Training

.; D. Trausch, Operations Supervisor

"

R. L. Andrews, Division Manager, Nuclear Services R. L. Phelps, Manager, Design Engineering R. L.,Jaworski, Manager, Station Engineering i D. J. Lakin, . Nuclear Safety Review Group (NSRG) Specialist

L. T. Kusek, Manager, Nuclear Safety Review Group W. W. Orr, Manager, Quality Assurance / Quality Control C. J. Brunnert, Supervisor, Operations QA s

J. Friedrichsen, Staff Sys. tem Engineer

' B. Weber, Supervisor Reactor Performance Analysis

.

R. M. Hawkins, Quality Assurance

_) L. Sills, Quality Assurance i

B. J. Matherson, Quality Assurance

,

T. G. Therkildsen, Supervisor, Nuclear Licensing

,

NRC Personnel:

J. P. Jaudon, Deputy Director, Division of Reactor Safety J. E. Gagliardo, Chief, Operational Programs Section, Division of Reactor Safety

T. Reis, Resident Inspector

i

1

-

d

d g

.

j+

__ _ __ .. . . _ _ _ _ _ . _ _ _ _ . - . . _ . . _ . - . _ _ _ _ . _ . _ . . . . - _

,

.

- .

ATTACHMENT E PERSONNEL C0tlTACTED AND EXIT MEETING ATTENDEES OPPD Personnel:

W. G. Gates, Division Manager, Nuclear Operations Division J. K. Gasper, Training Manager J. J. Fluehr, E0P Coordinator T. L. Patterson, Manager FCS S. K. Gambhir, Division Manager, Production Engineering D. J. Matthews, Supervisor, Station Licensing

- C. F. Simmons, Station Licensing' Engineer M. P. Lazar, Supervisor, Operations & Technical Training-D. Trausch, Operations Supervisor R. L. Andrews, Division Manager, Nuclear Services R. L. Phelps, Manager, Design Engineering R. L. Jaworski, Manager, Station Engineering D. J. Lakin, Nuclear Safety Review Group (NSRG) Specialist L. T. Kusek, Manager, Nuclear Safety Review Group W. W. Orr, Manager, Quality Assurance / Quality Control C. J. Brunnert, Supervisor, Operations QA J. Friedrichsen, Staff Sys. tem Engineer B. Weber, Supervisor Reactor Performance Analysis R. M. Hawkins, Quality Assurance L. Sills, Quality Assurance B. J. Matherson, Quality Assurance T. G. Therkildsen, Supervisor, Nuclear Licensing NRC Personnel:

J. P. Jaudon, Deputy Director, Division of Reactor Safety J. E. Gagliardo, Chief, Operational Programs Section, Division of Reactor Safety T. Reis, Resident Inspector i

i

' l

l l

1 : -

ATTACHMENT F DOCUMENTS REVIEWED E0P-00 Standard Post Trip Actions E0P-01 R0 07-31-89 Reactor Trip Recovery R3 07-31-89 E0P-02 Loss of Offsite Power / Loss of R7 01-25-90 Forced Circulation E0P-03 Loss of Coolant Accident R8 01-25-90 E0P-04 Steam Generator Tube Rupture E0P-05 R5 01-25-90 Uncontrolled Heat Extraction R5 01-25-90 E0P-06 Loss of All feedwater E0P-07 R5 01-25-90 Station Blackout R1 01 -25-90 E0P-20 Functional Recovery Procedure R7 01-25-90 Safety Function Status Check Resource Assessment Trees Reactivity Control Maintenance of Vital Auxiliaries RCS Inventory Control RCS Pressure Control RCS and Core Heat Removal Containment Integrity Long Term Actions A0P-19 Loss Of Shutdown Co611ng l A0P-23 R1 02-23-90 Reset of Engineered Safeguards R1 05-14-90 A0P-30 Emergency Fill of Emergency R0 01-04-90 Feedwater Storage Tank 01-RC-9 Reactor Coolant Pump Normal R3 -

'

Operation QA Audit Report #67 Audit of E0P/A0P Program Huclear Safety Review Group Document Review Independent Technical Review of E0Ps dated August 10, 1990 BASIS / DEVIATION DOCUMENT 50G-74, Writer's Guide

~

NRC response letter to OPPD, Subject: Safety Evaluation Regarding the Procedures Generation Program for Ft. Calhoun Station, dated October,198 ,

Hote: I Additional inspection observations noted to the licensee were recorded, l tracked and statused through the licensee's E0P Inspection Observation i data base dated August 199 l

>

- - -