IR 05000298/1993201
| ML20045B703 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 05/27/1993 |
| From: | Coe D, Norkin D, Wilcox J Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20045B701 | List: |
| References | |
| 50-298-93-201, NUDOCS 9306180318 | |
| Download: ML20045B703 (22) | |
Text
>
.
U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION NRC Inspection Report:
50-298/93-201 License No.: DRP-46 Docket No.: 50-298 Licensee: Nebraska Public Power District Facility Name: Cooper Nuclear Station Inspection Conducted:
March I through March 5, 1993 April 8 through April 16, 1993 Inspection Team: John D. Wilcox, Jr., Team Leader, NRR Serita Sanders, Assistant Team Leader, NRR Hai-Boh Wang, NRR Sikhindra Mitra, NRR Ronaldo Jenkins, NRR Phillip Ray, NRR Robert Prato, AEOD
.
Howard Bundy, Region IV Philip Wagner, Region IV Stephen McCrory, Region IV
,
Prepared by:
-
b 3Y#Nf3 J6hnD. Wilco (,Jr.,TeamLeader'
Date Team Inspection Development Section B Special Inspection Branch Division of Reactor Inspection and Licensee Performance Office of Nuclear Reactor Regulation
-
Reviewed by:
[
r
-
c h
Douglas H. 40e, Acting Section Chief Date
'
Special Inspection Branch Division of Reactor Inspection and Licensee Performance
-
Office of Nuclear Reactor Regulation
~
Approved by:
\\hk
.8" Donald *P'. iorkin, Atti'ng Chief Date Special Inspection Branch Division of Reactor Inspection
and Licensee Performance Office of Nuclear Reactor Regulation
,
930618031s 930607 PDR ADDCK 0500
.
.
-
'
EXECUTIVE SUMMARY The licensee commenced a routine refueling outage on March 6, 1993.
Between March I through 5 and April 8 through 16, 1993, the Nuclear Regulatory Commission (NRC) staff conducted a pilot inspection of shutdown risk and outage management at Cooper. Nuclear Station.
The inspection team assessed the quality and implementation of the licensee's outage planning with regard to minimizing the risk of accident sequences during shutdown conditions. During the first phase, conducted prior to the 1993 refueling outage, the team assessed the following attributes:
(1)
'
management involvement in and oversight of outage planning; (2) outage scheduling and coordination of significant work activities, and the availability of electrical power supplies, decay heat removal systems, reactor coolant inventory control systems, and containment; (3) operator response procedures, contingency plans, and training for mitigating of events involving shutdown risk; and (4) the adequacy of selected work packages. During the second phase, conducted during the outage, the team observed overall control of ongoing outage work activities and testing to assess the following attributes:
(1) the controls, procedures, and training related to the performance of plant activities during shutdown conditions; (2) the working relationships and communication channels between operations, maintenance, and other plant support personnel, (3) outage planning activities for possible impact on shutdown risk, including the scheduling and supervision of work activities and control of changes to the outage schedule; and (4) the degree of management involvement in and oversight of the conduct of the outage. The team also completed NRC Temporary Instruction 2515/113, " Reliable Decay Heat Removal During Outages."
The team noted strengths such as good operator awareness of available equipment to mitigate events that impact shutdown safety, strong control over
'
removed fuses during maintenance, and a successful reduction in personnel radiation exposure through the use of an extended " soft" plant shutdown.
Although the team felt the licensee's shutdown safety self-assessment was thorough and objective and appropriate industry experience was used to develop good recommendations, the acceptance and implementation of these recommendations were not always strong.
For example, the recommendation to define management shutdown safety philosophy and policy and incorporate it into outage procedures was delayed until after the current outage.
In addition, a review of primarily event-based abnormal plant operating procedures for their impact on shutdown safety was delayed until after the outage on the basis that these procedures would be reviewed prior to each use.
The team identified several deficiencies in adherence to plant operating, administrative, and maintenance procedures.
It also identified a deficiency involving inappropriate movement of the reactor vessel head and upper internals, without secondary containment integrity.
-
The team made a number of observations about where the licensee's shutdown safety program could be enhanced. These included strengthening the outage safety plan in important areas such as technical bases for defense-in-depth i
i
l
=.
'
SUMMARY OF INSPECTION DEFICIENCIES.............. A-1 APPENDIX B - LIST OF INSPECTION OBSERVATIONS............... B-1 APPENDIX C - EXIT MEETING ATTENDEES.................... C-1 s
%
!
.
>
>
-
~
EXECUTIVE SUMMARY The licensee commenced a routine refueling outage on March 6, 1993.
.
Between March I through 5 and April 8 through 16, 1993, the Nuclear Regulatory Commission (NRC) staff conducted a pilot inspection of shutdown risk and outage management at Cooper Nuclear Station.
The inspection team assessed the quality and implementation of the licensee's outage planning with regard to minimizing the risk of accident sequences during shutdown conditions. During the first phase, conducted prior to the
,
1993 refueling outage, the team assessed the following attributes:
(1)
,
management involvement in and oversight of outage planning; (2) outage scheduling and coordination of significant work activities, and the availability of electrical power supplies, decay heat removal systems, reactor coolant inventory control systems, and containment; (3) operator response procedures, contingency plans, and training for mitigating of events involving shutdown risk; and (4) the adequacy of selected work packages. During the second phase, cenducted during the outage, the team observed overall control of ongoing outage work activities and testing to assess the following attributes:
(1) the controls, procedures, and training related to.the performance of plant activities during shutdown conditions; (2) the working relationships and communication channels between operations, maintenance, and other plant support personnel; (3) outage planning activities for possible impact on shutdown risk, including the scheduling and supervision of work activities and control of changes to the outage schedule; and (4) the degree ef management involvement in and oversight of the conduct of the outage. The uam also completed NRC Temporary Instruction 2515/113, " Reliable Decay Heat Removal During Outages."
The team noted strengths such as good operator awareness of available equipment to mitigate events that impact shutdown safety, strong control over removed fuses during maintenance, and a successful reduction in personnel radiation exposure through the use of an extended " soft" plant shutdown.
Although the team felt the licensee's shutdown safety self-assessment was thorough and objective and appropriate industry experience was used to develop good recommendations, the acceptance and implementation of these recommendations were not always strong.
For example, the recommendation to define management shutdown safety philosophy and policy and incorporate it into outage procedures was delayed until after the current outage.
In addition, a review of primarily event-based abnormal plant operating procedures for their impact on shutdown safety was delayed until after the outage on the basis that these procedures would be reviewed prior to each use.
,
The team identified several deficiencies in adherence to_ plant operating, administrative, and maintenance procedures.
It also identified a deficiency involving inappropriate movement of the reactor vessel head and upper internals, without secondary containment integrity.
,
-
The team made a number of observations about where the licensee's shutdown safety program could be enhanced. These included strengthening the outage safety plan in important areas such as technical bases for defense-in-depth
,
i
,
.
,
.
.
guidelines, definition of the meaning of "available" as it pertains to equipment guidelines, and more rigorous administrative control over deviations from outage guidelines (00Gs).
Finally, the number of shutdown events which impacted the electrical power
'
supplies and cooling systems suggested the need for better consideration of risk avoidance strategies in work planning, scheduling, and implementation activities.
'
e a
t b
ii i
,
.
..
~
TABLE OF CONTENTS Pace
>
EXECUTIVE SUMMARY i
............................
1.0 INTRODUCTION............................
i 2.0 PHASE 1 - OUTAGE PLANNING AND SCHEDULING...............
i 2.1 Outage Risk Management Self-Assessment Report
i
.......
2.2 Outage Safety Plan
.....................
2.3 Planning, Scheduling, and Preparation of Modifications and Work
'
Packages
..........................
2.3.1 Planning and Scheduling
...............
2.3.2 Preparation of Modifications and Work Packages....
r 2.4 Training
..........................
2.5 Procedures
.........................
2.5.1 Shutdown Event Mitigation Procedures.........
2.5.2 Contingency and Compensatory Actions
........
2.6 Electrical Switchyard Walkdowns...............
3.0 PHASE 2 - OUTAGE IMPLEMENTATION
..................
3.1 Control of Plant Operations
I
................
3.1.1 Shift Turnovers
....................
3.1.2 Clearance / Work Control Center
............
3.1.3 Overtime Control...................
3.2 Observation of Work Activities
!
...............
3.3 Outage Event Review.....................
3.3.1 Loss Of Shutdown Cooling Event............
,
3.3.2 Loss of 480 VAC G Bus and Spent Fuel Pool Cooling
-
.
3.3.3 Failure of Secondary Containment to Meet Surveillance Requirements.....................
3.3.4 Personnel Industrial Safety Hazard
.......
3.4 Reliable Decay Heat Removal and Electric Power Availability.
APPENDIX A - SUMMARY OF INSPECTION DEFICIENCIES.............. A-1
,
APPENDIX B - LIST OF INSPECTION OBSERVATIONS............... B-1 APPENDIX C - EXIT MEETING ATTENDEES.................... C-1 i
P l
l
,,
. - - - - --
.
.
1.0 INTRODUCTION
-
The U.S. Nuclear Regulatory Commission (NRC) staff conducted an announced pilot inspection of shutdown risk and outage management at the Cooper Nuclear-Station in two phases. Phase 1 was conducted from March I through 5, 1993; the licensee commenced its refueling outage on March 6; and Phase 2 of the inspection was conducted from April 8 through 16, 1993. The primary objective-
!
of this inspection was to assess the quality and implementation of the licensee's outage planning with regard to minimizing the risk of accident
'
sequences during shutdown conditions. A secondary objective was to assess the licensee's ability to cope with events that could arise during shutdown conditions.
During the pre-outage Phase 1 inspection, the team assessed:
,
management involvement in outage planning and the use of industry event
-
reviews for lessons learned; the planning for coordinating of significant work activities and the
availability of electrical power supplies, decay heat removal systems, reactor coolant system (RCS) inventory control, and containment
+
integrity control;
'
operator response procedures, contingency plans, and training for e
mitigating of events involving a loss of decay heat removal capability, loss of RCS inventory, and loss of electrical power sources during shutdown conditions; and the adequacy of selected modification packages and postmaintenance
testing.
During the outage Phase 2 inspection, the team assessed:
implementation of controls, procedures, and training related to plant
=
activities during shutdown conditions, including outage event review; the working relationship and communications between operations,
-
maintenance, and other plant support organizations; outage maintenance and surveillance scheduling activities and control of a
changes to the outage schedule; and i
management involvement in and oversight of the conduct of the outage.
+
i The team characterized the negative findings in this' report as " deficiencies."
Deficiencies are either (1) the apparent failure of the licensee to comply with a requirement or (2) the apparent failure of the licensee to comply with a written commitment or the provisions of applicable codes, standards, guides, or other accepted industry practices.
In addition, " observations" were noted
'
where safety enhancements could be made, although these items had no direct regulatory basis.
Each deficiency is summarized in' Appendix A to this report;
!
observations are listed in Appendix B.
l
o L
.
2.0 PHASE 1 - OUTAGE PLANNING AND SCHEDULING
-
2.1 Outage Risk Management Self-Assessment Report The licensee conducted a self-assessment of shutdown risk and outage management from August 1992 to January 1993 that included a review of experiences at other utilities, and a comparison of its outage practices with the industry guidelines in Nuclear Management and Resources Council (NUMARC)
91-06 and Institute of Nuclear Power Operation (INPO) 92-05, and technical assessments of its electrical system. The team considered the self assessment report to be comprehensive and objective; however, in several instances the licensee's responses to recommendations in the report were weak.
For example, the recommended review of event-based, plant abnormal operating procedures for shutdown safety impact was delayed until after the outage on the basis that each procedure would be reviewed prior to each use. However, the team noted that a thorough review before each use might be limited by an urgent need to use the procedure to mitigate an event. Another finding of the self-assessment report was that licensee personnel lacked an awareness of management outage philosophy, policies, and goals. These had not yet been fully incorporated into outage procedures.
Training in these areas was t
conducted for licensee employees, but the procedural changes were delayed until after the upcoming outage.
Finally, some of the self-assessment recommendations were closed without the recommended action being taken and without a documented basis.
The team concluded that the licensee's self-assessment effort was effective in identifying weaknesses, but observed that the recommendations need continued management attention to ensure appropriate closure (Observation 50-298/93-201-01).
2.2 Outage Safety Plan The team reviewed the licensee's pre-outage planning process for the Cooper
.
Nuclear Station (CNS) refueling outage with specific emphasis on shutdown risk considerations.
The team found that the licensee was implementing the measures noted below to reduce the risk impact of outage maintenance and modification tasks.
,
The licensee's Nuclear Power Group Directive 4.9, " Outage Management," defined general areas of responsibility for outage management and required an outage safety plan to ensure defense-in-depth for key safety functions. This was
achieved by maintaining certain plant equipment available even though the Technical Specifications did not require it to be operable.
The key safety functions supported in this manner were based on NUMARC 91-06 " Guidelines for
,
Industry Actions To Assess Shutdown Management" (1) decay heat removal; (2)
inventory control; (3) electric power availability; (4) reactivity control; and (5) containment closure.
The licensee used a form entitled " Deviation From Outage Guidelines" (and uses the acronym 00G) to authorize a deviation from the equipment availability guidelines.
Plant manager approval was required for any DOG. The D0Gs also
identified any compensatory measures required during the deviation, and/or
,
.
'
contingency plans to be implemented if a safety function was threatened while a deviation existed.
Finally, the licensee's Critical Review Group performed
an independent review of the pre-outage schedule.
The team observed that the procedures developed by the Outage and Modification
,
(0&M) department contained very little guidance on implementing the outage safety plan, although they did require consideration of shutdown risk during the planning phase (Observation 50-298/93-201-02). The following concerns,
noted by the team, illustrate some of the specific areas which lacked guidance
or in which guidance could be strengthened.
!
There was no definition of "available" as it applied to equipment
required to be "available" for shutdown safety defense-in-depth purposes pursuant to the licensee's outage safety plan. The team noted occasions
!
where such equipment had clearance tags hanging which would require removal, or component repositioning, prior to its availability to perform an intended backup function.
In addition, one occasion was
>
noted where a core spray pump was serving as an "available" backup
,
source for inventory control, but lacked the availability of its f
associated safety-grade room cooler. Shift operators could not state how long the pump and motor would operate without overheating.
There was no technical basis for outage guidelines, such that the risk
impact of DOGS or schedule changes could be consistently assessed in
>
terms of key safety functions. A specific example of this was the licensee's decision to change their double valve protection guideline into a single valve protection guideline on the basis of engineering
judgement alone.
,
J There was no independent review of DOGS consistent with that performed
'
by the Critical Review Group on the pra-outage schedule. This resulted in heavy reliance on a few key personnel (i.e. outage coordinators, shift supervisors) to correctly implement the intent of the outage safety plan.
There was no requirement or administrative method to ensure that the
conditions or compensatory measures required by a DOG were fully in
,
place prior to authorizing the DOG. A specific example of this is discussed more fully in Section 3.3.1.
The DOG process did not require explicit evaluation of the relative or
cumulative risk of active D0Gs. No approvals of DOGS by the operations department were required. A specific example of 32 active DOGS written for secondary containment is discussed further in Section 3.3.3.
DOG #36 had been cancelled, but the DOG log was not updated to reflect
the cancellation. This was an example of weak control over the tracking of DOG status.
During the second phase of the inspection, although specific problems related
!
to the above weaknesses were identified, these weaknesses were often
,
!
_
_ _ - - _ _
.
>
.
.__
.
compensated by the expertise and performance of site personnel responsible for managing the outage.
2.3 Planning, Schedulir.g, and Preparation of Modifications and Work Packages The team reviewed the licensee's process for planning and preparing plant modifications and work packages for activities scheduled during the outage to determine if shutdown risk had been adequately considered.
2.3.1 Planning and Scheduling Outage work was scheduled by the Outage and Hodifications Department in accordance with the following procedures:
OM Procedure 2-2, " Refueling Outage Schedule Development and
=
Review," Revision 3 OM Procedure 1-2, " Forced Outage Planning and Scheduling,"
.
Revision 1 The construction coordinators and maintenance planning supervisor submitted lists of expected work to a multi-disciplinary Advance Planning Group for development of a preliminary outage schedule. The Advance Planning Group established system " windows" of time which allowed planners to schedule system or train specific work items within these windows. The preliminary outage schedule developed by the Advance Planning Group was reviewed and approved by a work planning management committee.
In addition, an independent safety review of the outage schedule was performed by the Critical Review Group, composed of representatives from various technical areas.
Forced outage planning involved a similar process.
The team concluded that the licensee's work planning and outage scheduling process generally incorporated the considerations of shutdown risk and minimization of work hazards. Radiological controls and ALARA were well integrated into work packages, and planning interaction between all work entities was apparent.
2.3.2 Preparation of Modifications and Work Packages The team assessed the licensee's process for assembling and reviewing modifications and work packages. The licensee controlled maintenance in accordance with the following procedures:
Maintenance Procedure (MP) 7.0.1.1, " Maintenance Work Request
(MWR) - Work Item Tracking Form Initiation and Review," Revision 1 MP 7.0.1.2, "MWR - MWR Generation and Review," Revision 1
,
MP 7.0.1.3, "MWR - Documentation of Work," Revision 1
=
MP 7.0.1.4, "MWR - Final Review and Closecut," Revision 1-
-
_ _ _ - _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _
_- - ___ - _ - ___ __ -
.
.
O-These procedures reflected a flexible work planning process which gave responsible engineering and support personnel an opportunity for direct input into the work planning process. System engineers and work supervisors reviewed all MWRs, and quality control persons were assigned as required.
,
Each MWR received additional technical reviews if appropriate. All personnel interviewed by the team were familiar with this process.
The team reviewed a sample of eight MWR packages prepared for the refueling outage and observed that suitable instructions were included.
For modification work packages, specific work instructions were integrated into the design change packages, which facilitated understanding of the installation process. Appropriate postmaintenance testing was specified.
'
The team reviewed three modification work packages, and their associated D0Gs.
The team identified one such package (Design Change Package DC 90-174B.1)
which recommended an appropriate backup system to provide compensatory support during the modification work. However, the associated 00G (#14) required, instead, a backup system which would be temporarily disabled during the work.
Based on the questions raised by the team, the licensee rewrote DOG #14 as D0G
- 63 to incorporate the recommendation of the design change package.
lhe team observed that, for this example, work planning was not appropriately translated into operational guidance.
The loss of spent fuel pool cooling event described in Section 3.3.2 of this report includes evidence of weak work planning in that removal of lock-out
,
relay fuses at the beginning of the work activity, had it been required, would have prevented the event.
.
2.4 Training The licensee's pre-outage self-assessment identified several weaknesses with shutdown risk training. These included a lack of shutdown event simulator scenarios, lack of a lesson plan for training operators on shutdown risk assessment, and lack of a requirement to hold shutdown risk management training prior to each outage. The licensee initiated corrective actions to address each of these areas.
The team reviewed the training attendance records, simulator scenarios, and lesson plans for industry event review.
In addition, the team interviewed three operators who received pre-outage shutdown risk training, and the
'
licensee manager responsible for contractor training and qualification.
Finally, the team attended two simulator training sessions which incorporated shutdown scenarios.
All licensed operators received shutdown risk training during the scheduled pre-outage operator requalification training. The lesson plan included key safety functions, defense-in-depth, contingency plans, CNS outage safety systems, and development of the outage schedule. However, several operators missed the initial formal classroom training, but received only informal make-up training (e.g. one operator reviewed the lesson plan in a supervisors office).
-_
.
..
While reviewing shutdown risk training for contractor personnel, the team noted that most of the plant modification work was managed by the construction management organization. The construction manager projected employment of 170 craft contract employees and 15 craft contract coordinators during the outage, a significant percentage of the outage workforce.
Licensee management indicated that contractors were specifically trained for their assigned duties, received general orientation training, and that shutdown risk considerations were to be conveyed by their immediate supervisors. The team was concerned that the informal training given to contractors was not comparable to the training given licensee personnel in the importance of shutdown safety and the licensee's program te reduce shutdown risk (Observation 50-298/93-201-03).
The team concluded that training on shutdown risk considerations was generally adequate. Makeup training was considered weak in some cases and contractor training lacked formality. However, all licensee personnel received shutdown risk training, and all areas of training weakness identified in the self-assessment were closed or being addressed.
2.5 Procedures 2.5.1 Shutdown Event Mitigation Procedures The team reviewed the technical content of the licensee's emergency procedures for Station Blackout with Reduced Inventory, Loss of Normal AC Power-Use of Emergency AC Power, and Loss of All Site AC Power-Station Black Out. Although the latter two of these procedures assumed reactor power operation as the initial condition, the team concluded they were workable with little difficulty, even though the actual initial condition would be shutdown.
In addition, the procedures for loss of fuel pool cooling / inventory and loss of shutdown cooling were reviewed and considered adequate to recover from these events.
'
As discussed in Section 2.1 above, the team noted that one of the licensee's Outage Risk Management Self Assessment recommendations was to review the plant abnormal procedures for shutdown risk implications prior to the outage.
Licensee management determined that the recommendation did not'need to be completed prior to the outage, based on the policy that procedures are reviewed each time prior to their use. The team observed that a thorough review of event-based abnormal procedures prior to their use might be limited
'
by an urgent need to use the procedure to mitigate an event.
2.5.2 Contingency and Compensatory Actions Since a D0G represented a temporary reduction of defense-in-depth for one or more safety functions, the D0G specified contingency actions for operator'
,
guidance on actions to be taken if a shutdown safety function'was threatened by an event while the DOG was in place.
In some cases, the DOGS also specified compensatory actions required while the D0G was active, to mitigate the reduction of defense-in-depth. During the second phase of the inspection,
'
the team reviewed several such contingencies and compensatory measures, including plant walk-downs.
-
-
--
_
-
__ __
.
_
.
!
..
!
.
During the walkdowns of contingency actions the' team identified two cases where the specified contingencies were incomplete or conflicted with an j
associated, design change package.
First, DOG #41 provided a compensatory
{
measure for the emergency transformer replacement outage by authorizing a
,
backfeed through the main generator transformer to assume normal station l
shutdown loads. The specified contingency action-for loss.of the. main j
transformer was to rely on the expected automatic transfer.to the startup transformer as the backup electrical power source. The contingency did not
include actions that.would be needed if the automatic. transfer. failed. The j
second example involved a portion of the service water system that~ was..
>
shutdown (but remained capable of starting) to replace cooling water lines to the pump bearings. D0G #45 specified contingency actions to provide an
!
alternate bearing cooling flow path to a service water pump if it suddenly
started. The team observed that the contingency actions were not clear and
!
conflicted with the design' change package.
In both cases above, the licensee a
added additional information or clarification to the contingency actions (Observation 50-298/93-201-04).
!
2.6 Electrical Switchyard Walkdowns
,
t
'
The team conducted walkdowns of tha normal and emergency power supply components and switchyard areas. This walkdown included the vital batteries and battery chargers, the vital 480 V/4 KV switchgear, the emergency diesel
,
generators, the auxiliary and startup power transformers, the vital inverter i
.
power supplies and the 69 KV, 161 KV, and 345 KV switchyard areas. The. team i
concluded that housekeeping in the subject areas was acceptable. CNS.
Directive No. 52, Revision 2, issued on January 26, 1993, " Control of
Switchyards and Transformer Yards Activities at CNS" called.for very close monitoring of switchyard activities, however, the main entrance.to the:
69/161/365 KV switchyard.was always open.
In addition, the inspector noted.
the presence of maintenance crews using crane-type vehicles inside'the j
switchyard. Directive No. 52 contains specific instructions regarding
operation of these vehicles inside the switchyard. One team inspector
-
interviewed some of the maintenance crews in the' switchyard and found that, j
with the exception of work supervisors, the crews had limited knowledge of j
this directive (Observation 50-298/93-201-05).
!
3.0 PHASE 2 - OUTAGE IMPLEMENTATION
3.1 Control of Plant Operations The licensee commenced their routine refueling outage on March 6, 1993 and
!
Phase 2 of the NRC inspection began on April 8,1993. The. team observed main j
control room activities, management oversight', and control of plant operations
and outage activities throughout-the. inspection. The team also attended daily i
outage meetings, observed shift turnovers, conducted numerous plant tours j
during all shifts, and interviewed operations shift personnel.
3.1.1 Shift Turnovers
!
The morning outage meetings were well attended and included appropriate..
reviews of plant activities and system status.
Individual shift turnovers s
i
i
.
.
_
.!
_
.
.
included a detailed walkdown of panels and discussions of significant equipment not available for service.
Shift briefings for the combined shift
'
crew were conducted only as needed for significant changes or events that arose during the shift. The team concluded that staffing was adequate, with two shift crews on shift simultaneously, one in the control room and the other in the clearance / work control center. These two groups exchanged duties halfway through their 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> shif t.
Shutdown risk related documents in the control room included shift turnover logs, copies of maintenance work requests for work in progress, and two reports on the current status of the outage:
the " Daily Refueling Outage Status Report" and the " Outage System Status Report." The Daily Refueling Outage Status Report (DROSR) provided plant status, milestones and restraints, priority items on the schedule and due dates, systems available for work, list of " required / protected" systems, and deviations from outage guidelines which are in progress. The Outage System Status Report (OSSR) provided the operator l
with the available systems for meeting outage equipment availability
,
guidelines.
l t
In one case, the residual heat removal (RHR)
"A" loop was listed on the DROSR
as " required / protected" while being out of service to repair a through-wall
-
piping leak.
It correctly did not appear on the OSSR, due to its unavailability. Two shift supervisors stated that they were unaware of a definition for " required / protected." The licensee corrected the DR0SR and agreed with the team's comment that formalizing this definition would make the
report more clear.
!
Overall, the shift supervisors had an appropriate level of awareness of plant system status. Moreover, they were very familiar with plant status with
'
regard to shutdown risk. They demonstrated good knowledge and understanding of defense-in-depth concepts and guidelines pertaining to contingency action
,
implementction.
,
,
3.1.2 Clearance / Work Control Center
The clearance / work control center was manned by a crew of operations shift
.
personnel with a second shift supervisor in charge of work center activities.
The work center was responsible for preparation of clearance orders to support activities covered by maintenance work requests. The work center identified the appropriate isolation boundaries and prepared the required paperwork for
,
shift supervisor authorization. Once work was approved, work center personnel
were responsible for repositioning components to establish the conditions
specified on the clearance order.
Neither the shift supervisor nor the clearance / work control center were given formal responsibility to review scheduled or emergent maintenance for shutdown
risk impact prior to authorizing work.
Responsibility for these detailed reviews was assigned by procedure OMP 2-2 to the maintenance supervisors and permanent outage and modification (0&M) coordinators. These reviews were performed almost exclusively by one of two permanent 0&M coordinators. While the 0&M coordinators demonstrated adequate system knowledge and operational
.
understanding, there was no specific minimum requirement for individuals
l i
.
.
performing these reviews to have operations experience or background. Such reviews require a strong understanding of the operational and safety implications of the planned work (Observation 50-298/93-201-06).
The team concluded that operations shifts were adequately manned with properly qualified personnel who demonstrated appropriate levels of professionalism.
Control room activities were properly managed and operators had an appropriate awareness of plant conditions, shutdown risk considerations, defense-in-depth system availability, and applicable contingency actions.
3.1.3 Overtime Control The team reviewed overtime controls and practices for the period of March I through March 31, 1993. The team reviewed computer printouts of overtime payroll records and time cards, to assess the licensee's general awareness of overtime use, restrictions, and the potential impact on shutdown risk.
Technical Specification 6.3.2.F requirements for control of overtime were implemented by licensee procedure 0.12 " Station Overtime and Recall of Standby i
Personnel." Five requests for overtime deviations, out of 20 sampled by the
'
team, did not meet the licensee's administrative requirement to document all previous requests for the individual during the past 31 days (Deficiency 50-298/93-201-07).
During this review, the team also noted that use of overtime (i.e., greater than eight hours a day or 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> in a week) during the outage constituted 44 percent of all hours worked. For the mechanical maintenance group it constituted nearly 50 percent, with 8.5 percent being greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> in a week. The team observed that there were no systems that permitted licensee management to directly assess the cumulative impact of overtime use in a broad context or in real time, nor were there evaluations of overtime use and practices during the outage, beyond meeting the specific limits in the overtime procedure (Observation 50-298/93-201-08).
3.2 Observation of Work Activities The team observed equipment clearance tag implementation, maintenance and modification work activities, and operator tours to determine whether those activities had been conducted with adequate regard for shutdown safety and in accordance with approved procedures.
Radiological control practices appeared adequately conservative. ALARA hold points were added to work packages by Health Physics (HP), and HP technicians were authorized to stop work for radiological concerns. The licensee provided three weeks of training and plant familiarization prior to the outage for the 77 contractor HP technicians. Post-shutdown radiation levels in the drywell were successfully reduced by performing a " soft shutdown" technique which provided an additional six hours for reactor depressurization.
The Quality Assurance Department was actively involved in the outage
'
coordination and assessment process. Representatives of the quality assurance'
department attended daily outage meetings and performed full time
_
~
~
.-
'
surveillances of outage work. There were four quality assurance (QA) audits scheduled during the outage and the surveillances were supportive of those
.
audits. Definitive checklists were used for the surveillances.
The licensee used a plastic fuse blockout device to attach the warning tag for a removed fuse. The team considered this an enhancement for both personnel safety and equipment protection.
On two occasions, the team observed an apparent lack of attention by a fire watch assigned to witness welding and cutting activities.
In addition, the team identified two work locations with large amounts of lubricating oil (25 gallons or more) being stored in open containers for more than one week. The licensee stated that this amount of oil had been considered in the facility fire hazards analysis.
However, notwithstanding the fact that the presence of this amount of oil was bounded by analysis, the team considered it poor practice.
Based on these examples, the team observed that alertness to potential fire safety hazards could be improved (Observation 50-298/93-201-09).
The team identified a deficiency regarding a failure to follow procedure, in that craft personnel did not perform special work instructions included in MWR 93-3021.
The MWR was issued to perform an inspection and cleaning of the two aftercoolers of emergency diesel generator (EDG) No. 1.
A hold point at step five of the MWR required the system engineer to inspect the aftercoolers prior to cleaning. The craft prsonnel proceeded with cleaning the left side aftercooler (step 7) withoJt obtaining prior inspection by the system engineer (Deficiency 50-298/93-201-10). Upon questioning, by the team, the craft personnel stopped their activities and contacted the engineer. The team agreed with the subsequent observations by the system engineer that there was no evidence of biological fouling, but there was some accumulation of mud in the ends of the cooler.
On April 14, 1993, the team observed significant internal buildup on sections of piping that were being replaced in accordance with DC 90-174A-1. The piping was from the gland seal water injection system for the residual heat removal-service water (RHR-SW) pumps, which function as SW booster pumps for the RHR heat exchangers. The change would provide a portion of the pump discharge to be directed to the pump's seals. A buildup of rust-colored material inside the piping had reduced the effective diameter of the pipe to approximately one-half of the nominal pipe diameter. The team was concerned that other portions of the SW system (and other systems that utilize raw water) could be experiencing similar flow limiting pipe wall buildup.
(Unresolved item 50-298/93-201-11). The licensee began an investigation into this issue prior to the team's exit.
3.3 Outage Event Review 3.3.1 Loss Of Shutdown Cooling Event On March 6, 1993, 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after shutdown, the IF 480 VAC Critical Bus was deenergized resulting in a loss of shutdown cooling flow. The cause was that the IF bus feeder breaker had been mistakenly tripped while racking-out the
.
"A" Core Spray pump breaker.
Shutdown cooling was lost for 33 minutes and
resulted in reactor coolant temperature increasing from 170 degrees F to 190
.
'
degrees F.
This event was documented in licensee event report 50-298/93-03 and in NRC Special Inspection Report 50-298/93-13. During the review of this event the team observed that, prior to the event, four DOGS had been authorized to allow relaxations of primary containment integrity, alt h
action had not yet been taken to implement these relaxations. Howevei, hese DOGS were authorized prior to meeting the required conditions of the DOG, which were:
reactor coolant temperature less than 150 degrees F, and greater
,
than 55 minutes to boiling. At the time the D0Gs were authorized, reactor coolant temperature was greater than 212 degrees F.
The DOGS were activated by outage management, and do not get prior operations department review or approval. This example was made part of the observation of weak implementation guidance in the outage safety plan as discussed in Section 2.2 of this report.
The team also noted that changes in primary and secondary containment status were not documented in the control room logs.
Failure to log changes in the status of critical station components or systems was contrary to the requirements of CNS procedure 2.0.2, "Condu:t of Operations" (Deficiency 50-298/93-201-12).
3.3.2 Loss of 480 VAC G Bus and Spent Fuel Pool Cooling On March 28, 1993, during the installation of design change DCP 91-121B, the G bus lockout relay tripped due to mechanical impact as a result of modification activities to the GS breaker cabinet. Spent Fuel Pool cooling was interrupted for seven minutes, which resulted in a minimal rise in Spent Fuel Pool coolant temperature.
The design change required the installation of a new meter on the GS breaker cabinet door. The lockout relay tripped while tapping starter holes on the cabinet door for the new meter. The relay was calibrated a few days before the event and again immediately after the event, with no noted deficiencies.
The relay fuses were going to be pulled shortly after the physical changes to the cabinet were completed. The team noted that better work planning to pull the lockout relay fuses prior to drilling the cabinet door would have avoided the event and would not have adversely affected plant operations or hindered the modification process.
The Shift Supervisor on duty the day of the event was not aware of the cabinet modification work due to its being delayed after having started. The team reviewed the procedural requirements, CNS Procedure 7.0.1.3 paragraph 8.2.3, intended to ensure operator awareness of work on safety-related equipment.
The proceduralized requirement for authorizing the restart of delayed work is not clear and may not account for delays normal to extended outage-related
<
work (Observation 50-298/93-201-13).
The team concluded that weaknesses in work planning, and poor procedural guidance and understanding contributed to this event.
.
.
3.3.3 Failure of Secondary Containment To Meet Surveillance Requirements
,
On March 8,1993, secondary containment could not be declared operable because a 1/4 inch water vacuum could not be established to satisfy Technical Specification I.T
.rveillance requirement 4.7.C.c.
Plant engineering personnel discov r >
a missing air trap on the Refueling Bulkhead Seal Rupture Drain providing : zarect air path from the Reactor Building to the Radwaste Building. This 3ndition has existed since construction.
Inspection followup on the design-related issue was being conducted by Region IV inspectors.
Completion of a successful secondary containment surveillance was a prerequisite to removing the reactor vessel head and upper internals, based on TS 3.7.C.d which required that secondary containment integrity be maintained unless "no loads which could potentially drmage irradiated fuel are being moved in secondary containment." This requirement was reflected in three different refueling procedures for performing the above evolutions. The
licensee, with Site Operational Review Committee (SORC) approval, reasoned that irradiated fuel was not at risk of damage during the heavy lift of vessel head and upper internals with the large overhead crane, because the TS requirement was added in 1991 based on concern over the lifting of loads by the smaller cranes and hoists. The licensee approved the procedure changes to allow the heavy lifts without maintaining containment integrity, and performed the lifts in apparent violation of TS 3.7.C.d (Deficiency 50-298/93-201-14).
During its review of this issue, the team also observed that there were no administrative controls to limit the number of DOGS written for primary and secondary containments during safety-significant shutdown conditions. During this event there were only three DOGS active on secondary containment, but at the end of the inspection, approximately eight primary containment D0Gs and 32 secondary containment DOGS had been approved for use.
In addition, for the first 58 hours6.712963e-4 days <br />0.0161 hours <br />9.589947e-5 weeks <br />2.2069e-5 months <br /> following shutdown, four D0Gs on second containment were active continuously, and seven were active for 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. Operations personnel were not involved in approving DOGS for implementation.
This example was made part of the observation of weak implementation guidance in Section 2.2 of this report.
3.3.4 Personnel Industrial Sai. y Hazard
'
On March 11, 1993, during crane movement, two boxes (one weighing 3060 pounds)
fell from a nine-foot shield-wall and nearly struck an individual. The practice of storing materials on top of the shield-wall began about two years ago.
The licensee's immediate action was to remove two remaining boxes from the shield-wall.
'
t On April 9,1993, the team observed stored materials again placed on the
~
shield-wall. The team documented the observation on an OSHA Non-Radiological Hazard Data Sheet and forwarded it to licensee management for acknowledgement.
The stored material remained on the shield-wall for the next two days. The
licensee removed the material from the shield-wall and issued a Deficiency
.
Report on April 12, 1993.
'
9
.
.
The team observed that unsafe work practices had been permitted and were allowed to continue even after the March 11 occurrence. Moreover, the resolution to this known personnel safety hazard lacked appropriate management
,
attention (Observation 50-298/93-201-15).
3.4 Reliable Decay Heat Removal and Electric Power Availability
In accordance with Temporary Instruction 2515/113, " Reliable Decay Heat Removal During Outages," the team gathered information to address the
,
assurance of electric power availability to decay heat removal systems.
'
The licensee's Outage and Modification Procedure (OMP) 2-2, Attachment 2,
" Outage Scheduling Guidelines," required two off-site power (69 and 161 KV)
and one onsite power source (EDG) to be available at all times during cold
'
shutdown. One of the off-site power sources was required to be removed in support of the emergency transformer replacement modification. A D0G was written to permit backfeeding from the 345-KV switchyard through the main power and normal station service transformers as the compensatory power supply. The other offsite source was unaffected by this work, and an EDG remained available throughout this period.
CNS outage guidelines required the scheduling and performance of maintenance and testing activities to be performed on a divisional basis, which permitted the redundant 125/250 VDC division to be cross connected to support the required loads. This ensured battery powered back up availability to required loads when battery testing or maintenance was being performed.
The team examined several temporary modifications, work requests and modifications which involved temporary power sources. Nonstandard electrical lineups were properly analyzed and approved procedures were used. Work requests and DOGS were written to control activities associated with the main power transformer backfeed and a temporary power feed to the Reactor Building.
Licensed operators were trained on the use of emergency operating procedures,
'
which direct manual control of electric power systems if automatic control systems fail or are disabled.
The outage schedule indicated that a maximum number of electric power sources were available during the period of increased vulnerability (i.e. when fuel was in the vessel after shutdown).
The licensee declares the EDG inoperable when its de battery source (i.e.
,
field flashing source) is removed from service during maintenance or testing.
'
t
&
4
>
i
'
.,.._
l
&
APPENDIX A l
'
SUMMARY OF INSPECTION DEFICIENCIES
!
!
I DEFICIENCY NUMBER 93-201-07 l
FINDING TITLE:
Failure To Follow Procedures (Section 3.1.3)
i DESCRIPTION OF CONDITION:
!
Technical Specif: cation requirement 6.3.2.F on control' of overtime is
implemented, in part, by Attachment I to CNS procedure 0.12, STATION OVERTIME
!
AND RECALL OF STANDBY PERSONNEL, Revision 8, dated January 28, 1993, which
,
states in item (3):
!
i Identify all overtime deviation requests submitted within previous 30 days for each individual.
Provide previous request dates and Deviation Codes that were listed.
On April 13, 1993, the inspector reviewed a sample size of 20-Overtime Policy l
Deviation Requests for the month of March 1993.
Five of the Overtime Policy-
Deviation Requests failed to satisfy the requirement in that at least one or j!
more requests were on file within the previous 30 days which were not properly reported on these subsequent requests.
{
DEFICIENCY NUMBER 93-201-10
..
FINDING TITLE:
- Failure To follow Procedures (Section 3.2)
i DESCRIPTION OF CONDITION:
_
On April 10, 1993, craft personnel were implementing the'special work-instructions included in maintenance work request (MWR) 93-3021 dated March 11, 1993. The MWR was issued to perform an inspection'and cleaning of
!
the two af tercoolers of EDG No.1.
The instructions contained _ hold points to i
allow for system engineer inspection of the aftercoolers. prior to cleaning.
.!
The craft personnel, however, had proceeded with cleaning the left side i
aftercooler without allowing prior inspection by the system engineer.
'
j UNRESOLVED ITEM NUMBER 93-201-11 FINDING TITLE:
Internal Pipe Wall Buildup (Section 3.2)
.
DESCRIPTION OF CONDITION:
,
!
On April 14, 1993, the team observed significantl internal buildup on' sections-
of piping that were being replaced in accordance with-DC 90-174A-1. The-piping was from the gland seal water. injection' system for the Residual Heat-
-
.;
A-1 i
l
.
.r4
-
,
-
.
-
-
.
'
Removal-Service Water (RHR-SW) pumps, which function as SW booster pumps for the RHR heat exchangers. The change would provide a portion of the pump discharge to be directed to the pump's seals. A buildup of rust-colored material inside the piping had reduced the effective diameter of the pipe to approximately one-half of the nominal pipe diameter. The team was concerned that other portions of the SW system (and other systems that utilize raw water) could be experiencing similar flow limiting pipe wall buildup.
DEFICIENCY NUMBER 93-201-12 FINDING TITLE:
Failure to Follow Procedures (Section 3.3.1)
DESCRIPTION OF CONDITION:
During review of the loss of shutdown cooling event of March 6, 1993, it was identified that the shift supervisor and control logs did not include the change in status of critical plant components such as primary and secondary containment as required by CNS plant procedure 2.0.2, Conduct of Operations, paragraphs 8.1.3.2 and 8.5.2.2.
DEFICIENCY NUMBER 93-201-14 FINDING TITLE:
Apparent violation of Technical Specifications (TS) (Section 3.3.3)
DESCRIPTION OF CONDITION:
Completion of a successful secondary containment surveillance was a prerequisite to removing the reactor vessel head and upper internals, based on TS 3.7.C.d which required that secondary containment integrity be maintained unless "no loads which could potentially damage irradiated fuel are being moved in secondary containment." ibis requirement was reflected in three different refueling procedures for performing the above evolutions. The licensee, with Site Operational Review Committee (SORC) approval, reasoned that irradiated fuel was not at risk of damage during the heavy lift of vessel head and upper internals with the large overhead crane, because the requirement was added in 1991 based on concern over the lifting of loads by the smaller cranes and hoists. The licensee approved procedure changes to allow the heavy lifts without maintaining containment integrity, and performed the lifts in apparent violation of TS 3.7.C.d.
The requirement was added to the CNS TS in 1991 at the request of the licensee prior to the 1991 refueling outage. The three procedures were revised as a result of this TS change to add the secondary containment requirement. At the beginning of the 1993 refueling outage, the 50RC justified the removal of this prerequisite based on a review of NUREG-0612, which determined the refueling floor main crane to be single failure proof and was therefore not a potential contributor to irradiated fuel damage. The 1991 TS change had been requested in response to a General Electric generic communication concerning refueling floor auxiliary crane operation involving loads of under 1000 pounds. None of A-2
3-
' h
___
these specifics were included in the licensee's 1991 TS change request to the NRC staff, and the licensee's 1993 reinterpretation was not discussed with the
.'
NRC staff.
r r
h
!
x f
'
,
,
,
!
!
,
.c
~
!
!
.
l
- !
A-3 l
.
h i
9
-,
w
-
v...
-,
.
b
,
,
APPENDIX B LIST OF INSPECTION OBSERVATIONS 50-289/93-201-DESCRIPTION
Self-assessment recommendations need continued management attention to ensure appropriate closure (Section 2.1)
,
Outage-related procedures contain very little guidance on implementing the outage safety plan (Section 2.2)
'
The contract outage workforce lacked formal training comparable to that given licensee personnel in the
'
importance of shutdown safety and the program to reduce
,
shutdown risk (Section 2.4)
Contingency actions on two DOGS were found to be incomplete or in conflict with an associated design change package (Section 2.E.2)
Switchyard access was not being controlled and switchyard maintenance crews had limited knowledge of CNS Directive 52 regarding operation of crane-type vehicles in the switchyard
!
(Section 2.6)
No specific minimum qualification requirements were established for individuals given work package review responsibility for shutdown risk (Section 3.1.2)
No system existed to directly assess the cumulative impact
of overtime use (Section 3.1.3)
'
Alertness to potential fire safety hazards could be improved
!
(Section 3.2)
The proceduralized requirement for authorizing the restart
,
of delayed work is not clear and may not account for delays
normal to extended outage-related work (Section 3.3.2)
Resolution of an industrial safety hazard lacked appropriate
management attention (Section 3.3.4)
,
!
!
I
!
B-1 l
I
'!
!
_
_
_ _ _ _ - _ _ - _ _ - - _ _ - _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ - _
_ _ _ _ _ _ _ _ _.
_ _ _ _ _ _ _ _ _ _ _ _ _ _. - _ _ _ _ _ _
. _ _ _ -
e e
APPENDIX C EXIT MEETING ATTENDEES Cooper Nuclear Station J. M. Meacham NPPD/CNS C. M. Estes NPPD/CNS J. W. Duttom NPPD/CNS Bob Jansky NPPD/CNS David C. Shrader NPPD/CNS Garrett E. Smith NPPD/CNS Rick Gardner NPPD/CNS D. R. Robinson NPPD/ Columbus Dave Bremer NPPD/CNS Michael A. Dean NPPD/CNS R. L. Wenzl NPPD/CNS L. E. Bray NPPD/CNS i
U. S. Nuclear Reaulatory Commission J. D. Wilcox, Jr.
NRR/ Team Leader P. C. Wagner NRC Region IV DRS/ Team Leader R. J. Prato.
NRC/AE0D Ronald A. Kopriva NRC/RIV J. E. Gagliardo NRC/RIV Serita Sanders NRC Headquarters
,
l Phillip H. Ray NRC/NRR Stephen L. McCrory NRC/RIV Ronaldo V. Jenkins NRC/NRR Other Orcanizations Geoffrey M. Cook OPPD/ Fort Calhoun
.
i C-1 l
< -
- _______-_
_-__
__-___