IR 05000285/1997017
| ML20211A449 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 09/19/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20211A441 | List: |
| References | |
| 50-285-97-17, NUDOCS 9709240266 | |
| Download: ML20211A449 (21) | |
Text
I e
.
ENCLOSURE
,
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket No:
50-285 License No:
DPR-40 Report No:
50-285/97 17 Licensee:
Omaha Public Power District Facility:
Fort Calhoun Station Location:
Fort Calhoun Station FC-2-4 Adm.
P,0. Box 399, Hwy, 75 - North of Fort Calhoun Fort Calhoun, Nebraska Dates:
August 25 29,1997 inspectors:
Harry A. Freeman, Resident inspector, Comanche Peak Steam Electric Station Vincent G. Gaddy, Resident inspector, Fort Calhoun Station Approved By:
William D Johnson, Chief, Projects Branch B Division of Reactor Projects ATTACHMENTS:
Attachment 1:
Supplemental Information Attachment 2:
Sequence of Events
'
Attachment 3:
Corrective Actions 9709240266 970919 PDR ADOCK 05000282 G
i
,
.
MERUTIVE SUMMARY
'
Fort Calhoun Station NRC Inspection Report 50 285/97-17 Operations During the initial setup portion of a surveillance test, the test lead placed the control
switches for the containment spray header isolation valves in the OVERRIDE position contrary to the surveillance test procedure (Section 01.1).
With all three containment spray pumps inoperable, Technical Specification 2.4 was
not satisfied, and the unit was not placed in hot shutdown or in a subcritical condition with temperature < 300 F within the required time intervals of Technical Specification 2.0.1 (Section 01.1).
The operating crew had numerous opportunities to identify that the containment
spray system was inoperable (Section 01.2).
Failure to document the changes in the operational status of safety equipment in the
of ficial control room logs, as required, was indicative of a lack of atterition-to-detail in the conduct of control room operations (Section 01.3).
Surveillance procedure weaknesses included: multiple actions required by one step;
equipment nomenclature which differed from component labels; and failure to address expected annunciators (Section 03.1).
The annunciator response procedure was weak in that it did not require operators to
announce which annunciators were in alarm or to explain why they were in alarm when annunciators were expected during a test (Section 03.2).
Each of the control room operators involved with the event failed to demonstrate a
questioning attitude concerning the lit annunciators. Crew supervision failed to provide adequate oversigqt du ing the performance of the surveillance test (Section 04.1).
The shift turnover was inadeqaate. Operators did not question the cause of the
spray valve off normal alarms and they did not verify the status of the containment spray system (Section 04.2).
Having the containment spray system inoperable for 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> on August 21,
1997, resulted in a negligible increase in core damage frequency. The containment design basis pressure limit for loss of coolant or main steamline break accidents would not have been exceeded assuming actual conditions (Section 08.1).
Several of the deficiencies identified in this containment spray system disabling
event are similar to the identified causes for the March 18,1996, event involving disabling the low temperature overpressure protection function (Section O).
.
- _- -
. -. _. _
_. - - -
.
l
'
2-Enoineerina The evaluation to determine the time that the containment spray pumps could run
without flow was based on realistic engineering principles and used conservative assumptions (Section E8.1).
-
.-
.
-
-
. --
.
.
Report Delaih Summary of Event On August 21,1997, Fort Calhoun Station was operating at 100 percent power. The major activity for the day shift was a routire inservice pump test and valve exercise test on the safety injection and containment spray systems. At approximately 8 a.m. (CDT), the licensed operator running the test (test lead) placed the control switches for both containment spray header isolation valves in override. This action would prevent an engineered safeguards feature signal from opening the header isolation valves and would prevent containment spray from reaching either spray header. The test lead announced the subsequent off normal alarms as "my alarm," and continued with the surveillance test.
Due to various delays, the day shif t did not complete the surveillance test and completion of the test was left for the oncoming night shif t. At approximately 6 p.m., the day shif t conducted a watch relief with the night shift. The cause of the lit annunciators was not discussed and the abnormal positions of the containment spray header isolation valve control switches were not discussed during turnover. During system restoration at 8:38 p.m., the test lead and the licensed senior operator recognized that the containment spray header isolation valve control switches were mispositioned. The result of this event was operation outside the parameters allowed by Technical Specifications and outside the design basis of the plant. A one hour report was made to the NRC at 9:35 p.m.
A sequence of events is included as Attachment 2.
I, Operations
Conduct of Operations 01.1 Mispositioned Switch a.
Inspection Scope The inspectors reviewed the surveillance test procedures, controi room togs, and the licensee's draft root cause analysis report to determine the sequence of events surrounding the operation of the containment spray system outside the Technical Specification and design basis safety requirements, b.
Observations and Findinas Surveillance Test Procedure OP ST SI 3008, " Safety injection and Containment Spray Pump Inservice Test and Valve Exercise Test," Revision 19, was the major activity discussed by the oncoming crew during shift turnover. At 7:30 a.m., the test lead held a prejob briefing with those personnel who were to be directly involved with the surveillance test performance. At approximately 8 a.m., the test lead performed Step 7.10 which stated, " record the as found positions for the Containment Spray control valves and test switches HCV 344 (Al-30A) and HCV-345 (Al-308), THEN place the valve and test switch in the Required position."
The valves were required to be closed and the test switches were required to be in
.
.
.
2-
.
i
.
the TEST position. The containment spray header isolation valves were already in
,
their normally closed position.
Although not directed by the procedure, the test lead then placed the containment
]
spray header isolation valve control switches for Valves HCV 344 and HCV-345 in -
the OVERRIDE position. Placing the control switches in the OVERRIDE position would prevent the valves from automatically opening on a valid containment spray
,
actuation signal. The test lead indicated that he placed the switches in the OVERRIDE position to ensure that the valves would not open and spray down
containment while running the cantainment spray pumps. Although he felt i
uncomfortable placing the switches in OVERRIDE he did not seek assistance from j
other operators and convinced himself that piacing the switches in OVERRIDE was
the right thing to do. The failure to comply with the requirements of Surveillance l
Test Procedure OP ST SI 3008 is an apparent violation of Technical l
Specification 5.8.1 (50 285/9717-01).
Parforming the above actions caused annunciators to alarm. The test lead
acknowledged the alarms and announced, "my alarm." The licensed senior operator (LSO) acknowledged that the alarms were expected. The licensee proceeded with the surveillance test, d
i j
By late afternoon, maintenance problems had delayed the completion of the i
surveillance test. Crew management determined that the oncoming shift would
'
complete the final portions of the test. From approximately 6 p.m. until 6:30 p.m.,
j the two crews conducted shift turnover. An oncoming licensed senior reactor operator received a turnover fror the test lead and then relieved the oalance-of.
plant operator.
t'
By 8:38 p.m., the surveillance test was complete and the test lead was performing restoration in accordance with Step 7.20 which stated, " place Containment Spray i
Control Valves AND Test Switches in the as-found position recorded in Step 7.10."
The test lead placed the test switches in the OFF position and expected the
'
remaining annunciators to clear. However, two annunciators remained lit. At that time, both the test lead and the LSO recognized that the containment spray header isolation valve control switches had been mispositioned. Having both of these switches in OVERRIDE would prevent a safety signal from opening the containment
i spray header isolation valves, rendering the containment spray system, including all three containment spray pumps, inoperable. The test lead placed the control I
switches back to AUTO.
.
Technical Specification 2.4, " Containment Cooling," limiting condition for operation requires in part that Containment Spray Pumps SI-3A, SI 3B, and SI 3C and their associated valves, piping and interlocks be operable during power operation. The modification of minimum requirements for the specification allows for two of these
!
i pumps to be inoperable at any one time during power operation. Technical Specification 2.0.1 requires in part that, in the event tia.he limiting condition for
,
C
.
3-operation cannot be satisfied because of circumstances in excess of those addressed in the specification, the unit shall be placed in at least hot shutdown within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in at least subcritical and < 300aF within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
With all three containrT.ent spray pumps inoperable, Technical Specification 2.4 wt.s not satisfied for approximately 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, and the unit was not placed in hot shutdown nor in a subcritical condition with temperature <300 F within the required time intervals. The failure to comply with Technical Specification 2.0.1 is an apparent violation (285/9717 02),
c.
Conclusions During the initial setup of a surveillance test, the test lead placed the control switches for the containment spray header isolation valves in the OVERRIDE position contrary to the surveillance test procedure. This is an apparent violation of Technical Specification 5.8.1, With all three containment spray pumps inoperable, Technical Specification 2.4 was not satisfied, and the unit was not placed in hot shutdown ror in a subcritical condition with temperature <300 F within the required time intervals The failure to shutdown the unit is an apparent violation of Technical Specification 2.0.1.
01.2 Identification Oooortunities a.
Insoection Scooe The inspectors interviewed the operators involved, and reviewed the sequence of events and control room logs to determine what opportunities were available to identify that the containment spray system was inoperable on August 21,1997. In addition, the inspectors reviewed the licensee's corrective actions in response to EA 96 204.
b.
Observations and Findinos
!
,
The first opportunity that the licensee had to identify that the containment spray l
system was inoperable occurred when the spray valve of' normal annunciators
!
alarmed. Neither the operator at the controls nor the LSO referenced the annunciator response procedure or questioned the cause of the alarms. Since the test lead announced the alarms as "that's mine" or " expected" and since the LSO did not remember whether he looked at the annunciator, the licensee missed this opportunity to identify that the containment spray system was inoperable in addition to the test lead and the LSO, the control room staff consisted of the shift supervisor, the reactor operator, and balance-of-plant operator.
,
A second opportunity that the licensee had to identify the problem was during the midshift briefing. The test lead did not discuss the causes of annunciators or the
--_ _~
.
- _ -.
.
--
-. - -. - - _ - _ _ _ _
. _ _ - - -
_
.
.
f act that components were out of a normal lineup. He did not discuss his prior concerns with placing @e switches in OVERRIDE.
A third opportunity occurteo' during shif t supervisor control room tours. Like the LSO, the shift supervisor meltioned that he recalled seeing the lit annunciators but
'
he did not question the availability of the containment spray function. He assumed that the annunciators were sit because of the surveillance test.
A fourth opportunity occurred during shift turnover when two licensed reactor operators and seven licensed senior reactor operators walked down the control boards and discussed plant conditions. At that time, two abnormal annunciators were lit, two coritainment spray header isolation valve control switches were out of position, and a shite light above each control switch was lit, indicating that the switch was in OVERRIDE. None of the operators identified those conditions.
In addition, throughout the duration of the event, routine control board observations by the operating crews provided a continuous opportunity to observe the abnormal annunciators and other indications.
The final opportunity occurred during system restoration. The test lead had just completed Stop 7.20 and expected that the remaining annunciators would clear.
When two annunciators remained lit, the test lead recognized that something was out of position and identified that the control valves were in OVERRIDE.
c.
Conclusions The operating crews had numerous opportunities to identify that the containment spray system was inoperable, including at least four specific missed opportunities.
However, due to inadequate supervisory oversight and an apparent lack of a questioning attitude, this problem was not identified until system restoration.
In their response to EA 96 204, the licensee described how the operations manager met with the shift supervisors to discuss maintaining the big picture ensuring proper command and control and how operations personnel had been trained on the importance of a questioning attitide and good attention to detail. These corrective
actions were not effective on August 21, in that the shift supervisors did not
'
maintain the big picture and the operations did not maintain a questioning attitude by failing to recognize that the containment spray system was inoperable.
01.3 Control Room Loas a.
Inspection Scope The inspectors reviewed the control room logs to determine whether the licensee controlled the operabilPy of safety-related equipment appropriately and in accordance with Technical Specifications. The inspectors compared the status of
_ _ _. _ _. _ _ _.. _. _ _ _ ___
_
- - _. _ _ _ _. _.. - _ _
_ _ _ _ _ _
Y
.
p
!-
,
'
!
5-L i
'
- .
. equipment documented in the surveillance test procedure documentation to entries
{'
in the control room togs.
s
!
!
. b.
Observations and Findinns I
j Standing Order (SO) 01, " Conduct of Operations," Revision 33, required that
!
entries in the official control room log be made when any safety-related equipment
!
was placed in or out of operation, and to document compliance with the requirements of a Technical Specification Limiting Condition for Operation. Contrary to this requirement, on August 21,1997, operators failed to log that the j
containment spray header isolation valves had been rendered inoperable by placing j
the control switches in override. Operators f ailed to properly log the operability of g
High Pressure Safety injection Pumps SI 2A and SI-2C in that they were declared
!
operable in the control room logs prior to rendering the pumps operable by opening
!
their respective discharge valves. And as of 7 p.m. on August 28, operators failed
_
,
to log that Containment Spray Pump SI 3C was operable per Technical Specification 2.4(1)b. The pump had been restored to an operable status on August 21. Failure to comply with the requirements of SO O-1 is an apparent violation of Technical Specification 5.8.1 (50-285/9717 03).
c.
Conclusions Failure to document the changes in the opetational status of safety equipment in the official control room logs, as required, was indicative of a lack of attention-to-detail in the conduct of control room operations.
Operations Procedures and Documentation O3.1 Adeouacy of Surveillance Procedure a.
Insoection Scoce The inspectors reviewed the surveillance procedure to determine if it was adequate and to determine if it could have contributed to the improper isolation of the containment spray system, b.
Observations and Findinos The inspectors reviewed Surveillance Test Procedure OP-ST-St-3008. The inspectors noted that the precautions and limitations were adequate to ensure the surveillance was satisfactorily performed.
The inspectors reviewed Step 7.10 of the procedure. The test lead indicated that during this step he placed the containment spray header isolation valve control switches in OVERRIDE. The inspectors noted that this step required the test lead to perform multiple functMs. The step directed the test lead to record the as found
.- --
-
-
-
-
---
-.
-
-
i
-
l
.
i w
[
.6-
position of the containment spray header isolation valves (HCV 344 and HCV-345),
record the as found position of the containment spray header isolation valve test i
switches, verify the containment spray header isolation valves were in the required
}
position, and place the containment spray header isolation valve test switch in the
[
TEST position. The inspectors determined that performing all these actions in one j
step could have been a potential distraction to the test lead, in the root cause
analysis, the 'icensee also recognized that writing a procedure to perform multiple i
actions in one procedural step was not consistent with their expectations in j-SO G 73, " Fort Calhoun Station Writer's Guide." This standing order indicated that i_
a procedural step should deal with only one idea and related actions should be held j
to one per step.
I i
The inspectors compared the wording of Step 7.10 of the procedure.with the actual
control board labels. The inspectors noted that the procedure directed the test lead to record the as found position of the " Containment Spray controt valves and test
[
switches HCV 344 (Al 30A) and HCV-345 (Al 308)." The inspectors walked down
{:
the control board and noted that no components were explicitiv labeled l
" containment spray control valves." There were components labeled Containment
Spray Valves, Containment Spray Valve Controller, and Containment Spray Valve L
Test Switch. Since the procedure descriptions and the actuallabel descriptions
were different, this could have contributed to confusion.
i i
The application of good self checking or self verification techniques would have
_
caused the test lead to compare the component labels on the control boards with the procedure to verify they were identical. Since they were different, the
- -
licensee's expectation was for the test lead to stop and seek assistance.
The inspectors also noted the procedure did not list the expected annunciators that
would alarm during performance of tne surveillance. Some of the licensee's surveillance procedures provide expected annunciator alarms that would occur
- _
during testing. Had this procedure had a list of expected alarms, the test lead j
_
would have known that neither the " SPRAY VALVE HCV-344 OFF NORMAL" nor
>
j the " SPRAY VALVE HCV-345 OFF NORMAL" annunciators were expected during
!
the surveillance and should have alerted the test lead that containment spray header
]
isolation valves should not be overridden.
c.
Conclusions I.
l
- The procedure required the test lead to perform multiple actions in one step. This
!
was not consistent with the procedure writer's guide. The labels on the control
"
boards and the procedure nomenclature-were different, which could cause
confusion. The dif ference in terminology was identified as a weakness by the l
inspectors. The test lead did not meet the licensee's expectation to stop and seek
_
j assistance to resolve the differences. Unlike other surveillance procedures, this j
procedure did not provide a list of expected annunciators during the test.
_
l i
!
_-~#.,
. _ - -..
.
-.,em....
,y.
,
--,
~
,,
-
-.m_,
,
,
.
.
..
.
.
.
.
03.2 Annunciator Response a.
Inspection Scope The inspectors reviewed the annunciator response requirements to determine if proper procedures were followed during the time the containment spray system was inoperable and to determine the adequacy of the annunciator response procedure, b.
Observations and Findir ag The inspectors reviewed SO-O 1, " Conduct of Operations," and Procedure ARP 1,
,
l
" Annunciator Response Procedure," and noted the requirement for acknowledging annunciators was for all expected annunciators to be announced as expected by the licensed operator'. All unexpected annunciators were to be verified by the annunciator responso procedure. The licensed sanior operator was expected to verbally acknowledge the licensed operators.
Surveillance Test OP-ST-SI 3OO8, " Safety injection and Containment Spray Pump Inservice Test and Valve Exercise Test," Step 7.10 directed the test lead to verify the as-found position of Valves HCV 344 and 345 (containment spray header isolation valves), and record the test switch positions for these valves. This step also directed the test lead to place the valves in the closed positions and place the test swi^.:hes in the test position. When the test switches were placed in TEST, Annunciator Windows A33-1/H5 and A34-1/H3, "HCV-344/345 SET SPRAY PUMPS TEST PERMIT" were illuminated. The inspectors determined from interviews that the test lead announced the annunciators as expected, silenced the alarm, and the annunciator was acknowledged by the licensed senior operator.
Annunciator Windows A331/H6 and A34-1/H2, " SPRAY VALVE HCV 344 OFF NORMAL" and " SPRAY VALVE HCV 345 OFF NORMAL," were illuminated when the containment spray valve control switches were placed in OVERRIDE, The test lead announced the annunciator as "my alarm." The test lead indicated that someone in the control room verbally acknowledged the annunciators as expected, but he was not sure who verbally acknowledged them. The licensed senior operator stated that he had acknowledged the annunciators but could not recallif he looked at the annunciators he acknowledged.
Since the annunciator was announced as expected by the test lead, the licensee's conduct of operations SO-O 1 and the annunciator response procedure (ARP 1) did not requiie the test lead to reference the annunciator response procedure to determine why the annunciators came in nor did it require operators to explain why the annunciators came in. Had the test lead referenced the annunciator response procedure, the procedure would have indicated that the containment spray control valves were in OVERRIDE and would have directed that they be returned to AUTO.
Referencing the annunciator procedure could have provided an early indication that a safety system had been defeated.
I
.
.
The inspectors determined that a contributor to failing to realize that a safety system had been defeated when the containment spray header isolation valve
_
control switches were placed in OVERRIDE was that the guidance in effect did not require the test lead to verbally read out the annunciator tile when it alarmed. If other members of the operating crew had heard a verbal announcement of the annunciator tiles, perhaps this would have triggered them to question why the containment spray header isolation valves were in an off normal condition. Since the licensed senior operator could not recallif he saw the " SPRAY VALVE HCV 344 OFF NORMAL" or " SPRAY VALVE HCV-34S OFF NORMAL" annunciators, a verbal acknowiedgment of the annunciators could also have helped him recognize that a safety system had been defeated.
l The inspectors questioned whether the wording of the spray valve off normal l
annunciator tiles was adequate to provide appropriate warning to ensure supervisory oversight. The licensee also recognized this weakness in the annunciator tiles and stated that the word:ng would be changed to indicate " SPRAY VALVE HCV-344 [or 345] DISABLED."
In addition, the licensee recognized other weaknesses in their annunciator response procedures and indicated that the procedure would be changed h require all alarms be verbalized and the reason for the alarm be announced.
c.
Conclusions The licensed senior operator who acknowledged the operator's announcement of the annunciator and the other members of the operating crew did not exhibit questioning attitudes when the " SPRAY VALVE HCV 344 OFF NORMAL" and
" SPRAY VALVE HCV 345 OFF NORMAL" annunciators alarmed. The annunciator response procedure was weak in that it did not require operators to verbally announce what annunciators were in alarm. The procedure required expected alarms to be announced as expected. The procedurs did not require operators to explain why annunciators were in alarm. The licensed senior operator could not recallif he looked at the annunciator prior to acknowledgment. The wording on the annunciator tiles did not provide appropriate warning to ensure supervisory oversight.
03.3 Emeraency Response Procedures a.
insoection Scope The inspectors reviewed the licensee's emergency response procedure to determine whether adequate guidance existed to ensure that the containment spray system was returned to an operable status prior to damaging the pumps.
.
..
.
..
..
.
....
.
..
.
.-.
~
-
.
.
-
-
.. =_
.
..
b.
Observations and Findinas The licensee performed engineering calculations and concluded that following a containment spray actuation signal, the containment spray pumps could run for appr< ximately 30 minutes with their minimum recirculation v6lves closed prior to being damaged (Section E8,1). The inspectors reviewed the licensee's emerguncy operating procedures and noted that the procedures provided adequate guidance to Jirect the operators to ensure the containment spray header isolation vdves (HCV-344 and HCV-345) were opened prior to the containment spray pumps being damaged. Numerous scenarios were reviewed by the inspectors, and each would have ensured that containment spray header isolation valves were opened within 30 minutes, c.
Conclusions i
The licensee's emergency operating procedure provided adequate guidance to ensure the containment spray header isolation valves were opened prior to damaging the containment spray pumps.
Operator Knowledge and Performance 04.1 Operator Knowledne and Performance a,
inspection Scope The inspectors interviewed the two test leads, the two licensed senior operators, and the off going shift supervisor involved with the surveillance test. The operators were questioned about their prior experiences with that particular surveillance test, and their knowledge of the causes of the spray valve off normal alarms, b.
Observations and Findinas Each of the five operators interviewed had performed or supervised the surveillance test more than once prior to the event. All those interviewed knew that placing the containment spray header isolation valve control switch in OVERRIDE would cause the alarm and would defeat the engineered safety features signal for that valve. At the time of the test, no one recognized that having both valve off-normal annunciators in alarm at the same time meant inat the containment spray system was inoperable. This was similar to a prior event documented in NRC Inspection Report 50-285/96-05 in which the LSO stated that, in retrospect, he felt that he had the knowiedge that the action taken would make the power operated relief valves (PORVs) inoperable, but that at the time he did not rnake the cognitive connection between taking the PORV hand switches to CLOSE and making the PORVs inoperable.
<
.
_ _ _. _. _ _. _ _ _ -. _.. _ -. - _ _..
.. _. _ _ _ _... _ _. - _ _
,..
4
..
- 10-
!
,
Each licensed operator interviewed was aware of the off normal alarms during the i
surveillance test, however, each one assumed that the alarms were lit because they
.
wera >erforming a surveillance test on the containment spray system. Even the j
shift supervisor stated tnat during control room tours, he had observed the lit j
annunciators, j
i c.
Conclusions i
j_
Each of the control room operators involved sith the event failed to demonstrate a i
questioning attitude concerning the lit annun-s. While each operator knew the
cause of the alarm, none recognized that having both valve off normal annunciators i
in_ alarm simultaneously meant that the containment spray system was inoperable, j
- Additionally, crew supervision failed to provide adequate oversight during the j
performance of the surveillance test.
l 04.2 Shift Turnover a.
inspection Scooe The inspectors reviewed the sequence of events; reviewed Standing Order SO-0-1,
" Conduct of Operations;" interviewed operators; reviewed the shif t turnover sheet; and reviewed corrective actions to Escalated Enforcement Action 96 204 to determine the adequacy of the shift turnover, b.
Observation and Findinas
,
The test lead that began performing Surveillance Test OP-ST-SI 3008, " Safety injection and Containment Spray Pump Inservice Test and Valve Exercise Test," did not complete the test prior to shift turnover. The test lead did not complete-Attachment 3 (High Pressure Safety injection Pump SI-2A), Attachment 6 1 Containment Spray Pump SI-3A), or Attachment 9 (Safety injection Tank Outlet Valves). The test lead turned over the surveillance test to the oncoming senior licensed operator.
During the shift turnover,' the day shift supervisor discussed that Procedure OP-ST-SI-3008 was in progress and needed to be completed. He did not identify that the control switches for the containment spray header isolation valves were in the OVERRIDE position and thet the valves could not perform their intended safety function.
In accordance with Standing Order SO-O-1, " Conduct of Operations," the Shif t Supervisor's Log, although it was not the official control room log, should be utilized by the shift supervisor to record items which should be passed on to relieving shift supervisors and to plant management. The log did not note the inoperability of the containment spray system.
-. -
.
-
-
__
-
.
-
-
.
--
__.
__
.
.
-11-S0-01 also states that the oncoming shift shall review the shif t turnover sheet with their respect lve counterparts and sign the sheet at the end of the turnover.
The condition of the containment spray system was not discussed on the shift turnover sheet.
Corrective action following the March 1996 event involving the disabling of the low temperature overpressure protection function included a new requirement for the shift supervisors and licensed senior operators to walk down the control boards prior to assuming the shift. Prior to the low temperature overpressure protection event, these board walkdowns had been optional.
in this event, when the containment spray system had been rendered inoperable, the " SPRAY VALVE HCV-344 OFF NORMAL" and " SPRAY VALVE HCV-345 OFF NORMAL" annunciators were lit, the containment spray header isolation valve control switches were in the OVERRIDE position, and a white indicating light above each containment spray valve switch was lit.
During the board walkdown portion of the shift turnover, seven senior reactor coerators, a reactor operator, and the test lead (reactor operator) all walked by these indicators and did not recognize that the containment spray system was inoperable. All operators interviewed indicated they saw the annunciators. Two of the operators indicated they did not look at the switch positions during the board walkdown and, as a result, did not notice the illuminated white light above the containment spray header isolation valve switches and the control switches in OVERRIDE. All operators indicated that they assumed that the annunciators were lit due to the surveillance test.
Following shift turnover, the test lead and oncoming senior licensed operator discussed the remaining surveillance attachments that needed to be performed and also the restoration sequence. They did not discuss the cause of the I?
Step 7.2.2 of Revision 33 of S0-0-1, " Conduct of Operations," states a number of shif t turnover requiiements, including the following:
The oncoming shif t shall familiarize themselves with conditions in areas for
which they are responsible; Each person will brief his/her relief on the condition and status of that
portion of the plant to which he/she is assigned; and Each operato: shall personally verify the status of important system
operating parameters, especially those for safety systems.
The f ailure of the offgoing operators to properly brief their relief operators and the failure of the relieving operators to verify the operational status of the containment
. _.
.
.
l-12 spray system prior to assuming the shif t is an apparent violation of Technical l
Specification 5.8.1 (50 285/9717 04h c.
CgngMjonti During the shif t turnover operators did not question the cause of the containment spray valve off noimal alarms. Operators accepted that the annunciators were in due to testing. Although operators know that having the containment spray control header isolation valves in OVERRIDE brought in the annunciators they did not make the cognitive link that this defeated r. safety system, in their response to EA 90 204, the licensee described how the shif t turnoser process had been improved. These improvements required a thorough shift turnover to include out of normal switch positions and illuminated annunciators, and a walkdown of the control rcom boards by the shif t supervisors and licensed senior operators to enhance their knowledge of plant and system status. Although this change was proceduralized in Standing Order S0 01, the corrective action was not effective in that during the shif t turnover on August 21, the oncoming shif t ooervisor and licensed senior operator did not recognize the condition of the containment spray system.
Miscellaneous Operations issues 08.1 Safety Sionificance a.
Inspection kont The inspectors reviewed the Updated Safety Analysis Report; the licensee's Individual Plant Examination; a " White Paper on Safety Evaluation for CR [ condition reportl 199701066 for the Containment Spray Valves in Override;" and a document from Asea Brown Boveri, " Transmittal of Results for OPPD [ Omaha Public Power District) Containment LOCA lloss of coolant accident) Analysis with Containment Sprays Unavailable," dated August 28,1997.
b.
Qhlitly.D.tions pnd Findinas The containment spray system consists of three pumps and two spray headers supplied through Valves HCV 344 and HCV 345. The containment spray system provides the primary means of containment pressure suppression. The containment Eir cooling system provides backup to the containment spray system and consists of two cooling and filtering units and two smaller cooling units.
The analysis listed in Updated Safety Analysis Report Chapter 14 reviewed the effects of a large loss of coolant accident and a main steam line break accident on containment integrity. A vendor for the licensee reanalyzed the effect of having the containment spray system inoperable on peak containment pressure for these two l
_
_______
.
.
..
.
.
l
accidents. The licensee assumed a loss of offsite power (,oincident with the loss-of coolant accident and the f ailure of one diesel generator to run. The bcensee used actual river water temperature for the anal" sis. The analyks concluded that peak containment pressure would not have exceeded the containment design basis pressure kmit of 60 pounds per square inch gage under the specified conditions.
The inspectors found that the licensee's assumptions were appropriate.
The event resulted in a negligible increase in either the levelI core damage freauencv or the Level lllarge early release frequency. The redundancy provided by the contenment coolers, actual river water temperatures during the 12.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> period, proceduralized operator actions in the Emergency Operating Procedures, and the ability to establish alternate cooling through the low pressure safety injection system contributed to this finding, c.
Conclusions Having the containment spray system inoperable for 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> on August 21,1997, resulted in a negligible increase in core damage frequency. The containment design basis pressure. mit for loss of coolant or main steam line break accidents would not have been exceeded assuming actual conditions.
Ill. Enalage_rlps i
E8 Miscellaneous Engineering issue:
E 8.1 Containment Sorav Pumo Minimum Recirquiation Path Is2lation a.
Inspection Scopa During the inspection, the licensee informed the inspectors that the containment spray pump minimum recirculation flow valves were normally shut in order to meet minimum required spray flow with one pump. The inspectors reviewed a licensee consultant evaluation, " Operation of the Ft. Calhoun Station Containment Spray Pumps Short term at Zero Flow Conditions," dated August 29,1597, to determine the potential for damage to the containment spray pumps, had they been run without flow for an extended period of time, b.
Observations and Findinas The containment spray pumps are single stage, double suction, motor driven pumps with pump suction and discharge piping located on the pump casing at the 12-o' clock position. The position of the pump suction allows the heated water in the pump suction to rise into the suction piping and cooler water in the suction piping to enter the pump and thus reduce the rate of temperature rise. The evaluation assumed that the water in the 12 inch suction piping up to, but not including the common suction header, would provide cooling to the pump. The evaluation
.
.
..
,
.
.
.-_.
_
._
-.
.. _
. _ _. - - _ _ -.. - - - - -
-.._.-.---
e e
l 14-assumed no similar heat transfer to the discharge header due to the closed pump discharge check valve and assumed no heat transfer occurred across the pump
,
casing to the environment.
,
i
,
The ovaluation concluded that a spray pump could run for approximately 40 minutes with no flow before saturation conditions (28 pounds per square inch absolute, 245'F) would be reached. The ovaluation concluded that there would be no ad.erse short term or long-term effect from operating the pumps with no flow for up to 30 minutes.
The inspectors determined that the evaluation was based on realistic ongineering principles and used conservativo assumptions.
c.
Conclusions The inspectors concluded that the contractor evaluation was valid and that there was sufficient time for operator actions following an accident to avoid damage to the containment spray pumps.
V. Management Meetinan X1 Exit Meeting Summary At the exit meeting on August 29, the licensee ar knowledged the inspector's findings.
T he licensee then discussed their planned and in progress corrective actions which are listed in Attachment 3.
The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.
.
-r.
-
-
, -, - -, -
---,-,7---,,e-.-
-
s -.
m
-%..
.-.
_
--,_-,,
.
_ _ - -
e
.
ATTACHMENT 1 SV.P_fLEtdM1ALJNFORMATION
&
PARTIAL LIST OF PERSONS CONTACTED Licensee i
V/. Gates Vice President, Nuclear J. Chase, Plant Manager l
R. Short, Manager, Operations l
S. Gambhir, Division Manager, Engineering and Operations
'
R. Conner, Manager, Training D. Levin, Licensed Test lead M. Anderson, Licensed Operator J. Ashcroft, Licensed Senior Operator S. Pallas, Licensed Senior Operator J. Cook, Licensed Senior Operator, Shift Supervisor INSPECTION PROCEDURES USED 93702 Prompt Onsite Response To Events At Operating Power Reactors
,
ITEMS OPENED. CLOSED, AND DISCUSSED Opened 50 285/9717-01 APV Containment spray header isolation valve control switches placed in override failure to follow procedures (Section 01.1).
50 285/9717-02 APV Failure to comply with Technical Specification 2.0.1 while containment spray system inoperable (Section 01.1).
50 285/9717 03 APV Control room logs inaccurate failure to follow procedures (Section 01.3).
50 285/9717 04 APV inadequate shift turnover failure to follow procedures (Section 04.2),
l e
,
A_TTACHMENT 2 l
SEQUENC.E OF WEILTJ ILME DESCRIPTION Aunust 18 0855 Containment Spray Pump SI 30 inoperable for maintenance, eynust 21 0730 Test lead (licensed operator) conducted prejob briefing and discussed individual responsibilities with persons involved in the surveillance.
0800 Nonlicensed operator reported that testing could begin on pumps in Room 21 (West Safety injection Pump Room).
0800 Test lead performed Steps 7.5 through 7.10. Following completion of l
Step 7.10 test lead placed the containment spray valvo control switches in l
OVERRIDE.
'
0900 Started test on Low Pressure Safety injection Pump SI 1 A.
0919 Completed test on Low Pressure Safety injection Pump Sl 1 A.
0930 Started test on High Pressure Safety injection Pump SI 2C.
0946 Completed test on High Pressure Safety injection Pump SI 2C.
1000 Surveillance testing delayed in order to complete maintenance on Containment Spray Pump SI 3D.
1130 Mid shif t briefing.
1005 Maintenance complete. Started test on Containment Spray Pump SI 38.
1044 Started test on High Pressure Safety injection Pump SI 28.
1658 Completed test on High Pressure Safety injection Pump SI 2B, 1707 Completed test on Containment Spray Pump SI 38.
1716 Started test on Containmen.t Spray Pump St 3C.
1733 Completed test on Containmont Spray Pump SI-3C. Test stopped for shift turnover.
F
o
.
1800 Shif t turnover initiated.
1810 Nine licensed operators (seven senior reactor operators and two operators)
(approx)
walked down control panels and noticed the " SPRAY VALVE HCV 344 OFF NORMAL" and " SPRAY VALVE HCV-345 OFF NORMAL" annunciators and believed they were lit due to the surveillance test.
1820 Test lead turned over "ith senior reactor operator to complete the test. They (approx)
discussed the threi ! >m+%:q test attachments to be performed.
1835 Shif t turnover completed.
(approx)
2038 During test restoration, the senior reactor operator recognized the containment spray valve control switches were in OVERRIDE and the containment spray system was inoperable.
2039 Restored containment spray valvo control switches to AUTO. The total time the containment spray system was inoperable was approximately 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
2135 NRC notification made due to being outsido design basis and system being unavailable to mitigate the consequences of an accident.
I l
,
_______ _ _ _ _ _ _ _ _ _
____
o
.
.
.
ATTAC_HMENT 3 Ll_CfRSEE PROVIDED LIST OF. CORRECTIVE AQTIONS 1.
Crew Stand Downs 5/6 crews completed, last crew 9/4/97.
2.
Enhanced Board Walkdowns - 5/6 crews completed, last crew 9/4/97.
3.
Verbalization of all Alarms. Reason Why & LSO Acknowledgment - 5/6 crews completed. ARP 1 revised.
4.
Management Observations of Shif t Turnover Scheduled observations complete.
Compiling results and improvements by 9/4/97.
5.
Rood Cause Analysis 95 percent complete. Cornplete by 9/4/97, 6.
Test Monitor Program Fully implemented via OPD 514. Management observations in progress.
7.
PRC review of Event /Short term Corrective Actions Completed 8/23/97.
8.
Site Notification of Event Issued White Paper on 8/25/97.
9.
Operations Unity Council Met 8/20/97, a.
Operator Cognitive and Mental Skills Assessment b.
Crew Teamwork and Performance Reviews c.
Revised Operator Code of Conduct d.
Welcoming New Operator to Crew 10.
Standardize Mid Shift Briefing - Out of Normal Alarm / Switches tracked and discussed. OPD and Form to be issued by 9/4/97.
11.
Expanded Peer Check Program HCV 344/345 completed 8/23/97. Approximately 25 other switches marked 8/25/97. Further evaluation and marking by 9/30/97.
12.
SRO Concurrence when Disabling Safety Related Equipment (including overrides) -
5/6 crews complete. Procedure implementation by 9/4/97.
13.
Safety Significance Preliminary evaluation completed 8/28/97. Determined n0.1 safety-significant.
14.
ARP Review - In progress, complete by 9/15/97.
15.
Evaluate use of Normal Position Colored Dots on Control Switches - Decision by 9/15/97, 16.
Operator TraininD - Next Rotation (97 6), complete 11/7/97 -e.g. detailed review of event and causes, review of switch overrides / annunciators and HCV 344 and SI-3B/3C Interlock and Technical Specification implications.
17.
Out of Normal Label Label designed, implement by 9/5/97.
18.
Individual " Day" Schedule for Operations - Format options being reviewed by SS's, implement by 9tS/97, 19.
Human Performance Review by Dr. Stark - In progress, complete by 9/30/97.
20.
Expected Annunciator Marking Program - Start implementation by 9/30/97. All procedures done by 1998 RFO plus 2 months.
21.
Open Containment Spray Pump Mini Recirc. Valves - Complete by 10/31/97, 22.
Revise Annunciator Tile Wording (Of f-Normal to Disabled) - 10/31/97.
23.
Operations Department Self Assessment - Start 9/8/97.
24.
NSRG Independent Review of Event. In progress, complete by 9/5/97.
25.
" Warning" Ops Note next to HCV 344/345 Control Switches - Completed 8/23/97.
26.
No scheduled activities in Control Room for first 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for crew returning from long break (e.g.14 days) - Implement 9/4/97. Long Term - Revise work schedule.
l