IR 05000298/1999004

Insp Rept 50-298/99-04 on 990321-0501.Non-cited Violations Identified.Major Areas Inspected:Operations,Maint & Plant Status.Emergency Procedures Failed to Instruct Operators When to Reduce Core Spray Pump Flow Following DBA

ML20207A525
Person / Time
Site:	Cooper
Issue date:	05/19/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML20207A524	List: IR 05000298/1999004 ML20207A519
References
50-298-99-04, 50-298-99-4, NUDOCS 9905270004
Download: ML20207A525 (13)

Text

r

.

.

ENCLOSURE U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket No.: 50-298 License No.: DPR 46 -

Report No.: 50-298/99-04 Licensee: Nebraska Public Power District Facility: Cooper Nuclear Station Location: P.O. Box 98 Brownville, Nebraska Dates: March 21 through May 1,1999 inspectors: M. Miller, Senior Resident inspector C. Skinner, Resident inspector D. Carter, Resident inspector, Palo Verde Nuclear Station J. Spets, Resident inspector, Washington Nuclear, Unit 2 N. Garrett, Resident inspector, River Bend Station Approved By: C. Marschall, Chief, Project Branch C Division of Reactor Projects ATTACHMENT: Supplemental Information 9905270004 990519 '-

'

gDR ADOCK 0500029s

-

PDR a

a

l

.

EXECUTIVE SUMMARY l

Cooper Nuclear Station l

NRC Inspection Report No. 50-298/99-04 l

Operations

The control room staff managed severalissues with strong leadership and good standards. One example was the control room staff's management of concurrent {

reactor protection system testing issues. A complex scram timing test had failed to '

properly test four of eight relays. After a quality assurance evaluator raised a testing concern, the control room staff developed multiple questions with plant staff assistance, leading to identification and resolution of several concerns. Control room operators and the plant manager successbily demanded that the plant operations, work control, engineering, maintenance, and licensing staffs develop procedures and test relays during the ensuing 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Control room operators managed resources both within and outside the control room, resulting in minimal distractions to the control room staff during resolution of this issue (Section 01.1).

I

Operators determined a reactor core isolation cooling valve was inoperable and shut the i valve. Because the reactor core isolation cooling vacuum pump was just upstream of I the shut valve, operators caution-tagged the switch in the control room with a warning not to operate the vacuum pump. The inspectors questioned the adequacy of this action. In response, the shift technical engineer identified that, during an automatic actuation, the pump would automatically start and potentially fail due to an isolated discharge path, if not recognized and stopped by operators. This indicated that the equipment status had not been thoroughly evaluated for all expected plant operating conditions. Operators and managers had performed control board walkdowns but failed to question the adequacy of the pump switch caution tag. This vulnerability did not cause a system to be inoperable (Problem Identification Report 4-01355)

(Section O4.1).

Emergency procedures failed to instruct operators when to reduce a core spray pump flow following a design basis accident. Flow reduction within 10 minutes of an accident could result in less than the required minimum flow. This licensee-identified violation of 10 CFR Part 50, Appendix B, Criterion V, met the criterion for a noncited violation (Significant Condition Report 98-0197) (Section 08.4).

in 1996, licensed operators failed to immediately place a degraded reactor protection system channel in a tripped condition as required by the associated alarm response procedure. This violation of 10 CFR Part 50, Appendix B, Criterion V, met the criterion for a noncited violation (Condition Adverse to Quality 97-0029) (Section 08.6).

The licensee had failed to include instructions in abnormal and emergency procedures to obtain electrical power sources to protect the standby gas treatment system from Z-sump floodbg. This violation of 10 CFR Part 50, Appendix B, Criterion lil, met the criterion for a noncited violation (Significant Condition Report 98-0154) (Section O8.8).

I

m

.

.

2-Maintenance

A service water booster pump discharge check valve had slammed during pump shifts and repeatedly hung open until high differential pressure slammed it shut. Licensee technicians replaced the check valve. The work package included all relevant references and instructions for this task. The technicians implemented the package ;

properly (Section M1.1). )

• Operators, work control personnel, and maintenance staff identified that the surveillance procedure to test response timing of reactor protection system scram circuits did not time test all relays. Twelve of 16 reactor protection system contacts on relays had not had timing tests since plant startup. The licensee revised the procedure and tested the contacts successfully. The inspectors identified that the licensee's past corrective actions to verify testing according to Technical Specification surveillance requirements had failed to identify the requirement to test the relays discussed above. Engineers were investigating the extent of the condition as of the end of this inspection perio These problems were considered a violation of 10 CFR Part 50, Appendix B, Criterion XVI. They met the criteria for a noncited violation (Significant Condition Report 99-0285) (Sections 08.5 and M3.1).

l l

1

. - .

o

.

.

Report Details

. Summary of Plant Status

' The plant was at 100 percent power at the beginning of this report period. On April 17,1999, power was reduced to about 87 percent for routine turbine valve testing and then returned to full powe I. Operations 01 Conduct of Operations 0 Plant Manaoement and Control Room Resolution of Eouioment issues Inspection Scope (71707)

The inspector observed the control room crew, several managers, and plant staff respond to various equipment issues during this inspection perio Observations and Findinos .

Inspectors observed several examples of effective control room leadership and standards. Control room operators and shift technical engineers intervened in engineering problem resolution and maintenance work to ensure operability requirements were understood and implemented for each equipment issue. Shift i supervisors and shift technical engineers directly challenged engineering and ]

maintenance staff, supervisors, and managers to properly resolve issues associated l with turbine control, reactor equipment cooling, valve testing, reactor water cleanup, relay testing, and other equipment issue ~As an example, a challenging issue occurred on April 6,1999. A quality assurance evaluator questioned the adequacy of postmaintenance testing on some reactor protection system relays during the previous outage. During resolution of this issue, technicians and operators identified that four of eight relays in the reactor scram relay logic had not been time tested. These relays had successfully passed a functional test

_during the previous outage. Throughout the resolution of this concern the operators :

successfully demanded detailed bases for acceptability of various testing procedure They also demanded timely and thorough resolution of the reactor protection system i scram time testing for the relay switches and contacts that had not been teste l Evaluation of prior testing of multiple relay trains and development of testing procedures !

i

- for those relays required about 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> to resolve and included approval of procedure changes by the station operations review committee; After this approval the control room staff supervised the testing of the four relays.' The relay testing was successfu During the course of this immediate issue and other equipment issues, the control room operators appropriately. communicated concerns to new crews. The control room shift I

.

-2-manager and plant managers assigned actions to various plant staff team member These assignments successfully kept distractions out of the control room. The control room successfully demanded plant staff support to respond to several related aspects of this testing issu Conclusions The control room staff managed severalissues with strong leadership and good standards. One example was the control room staff's management of concurrent reactor protection system testing issues. A complex scram timing test had failed to properly test four of eight relays. After a quality assurance evaluator raised a testing concern, the control room staff developed multiple questions with plant staff assistance, ieading to identification and resolution of several concerns. Control room operators and the plant manager successfully demanded that plant operations, work control, engineering, maintenance, and licensing staffs develop procedures and test relays during the ensuing 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Control room operators managed resources both within and outside the control room, resulting in minimal distractions to the control room staff during resolution of this issu Operator Knowledge and Performance 04.1 Failure to Recoanize Sucoort Eauioment Failure Vulnerability  !

I Insoection Scope (71707) I Inspectors performed routine walkdowns of the control room control board, reviewed control room operator logs, and held discussions with control room crew member Observations and Findinas During a routine walkdown of the control boards, the inspector noted the reactor core isolation cooling system vacuum pump switch in a " caution-tag" status. The downstream reactor core isolation cooling system stop check Valve RCIC-CV-42 had demonstrated intermittent operation. Therefore, operators placed it in its safety position (closed) and the reactor core isolation cooling system vacuum pump in a " caution-tag" status with instructions that it not be operated during reactor core isolation cooling system operation. An operability evaluation for this condition confirmed reactor core isolation cooling system operability without the vacuum pump. The inspector questioned the pump status and operator actions under a design basis event and the requirement to initiate reactor core isolation cooling system operation. Further investigation by the shift technical engineer determined that the pump would automatically start on a reactor core isolation cooling system initiation. Because stop check Valve RCIC-CV-42 was maintained in the closed position, the vacuum pump would operate at the shutoff head until operators stopped it or until it failed. The shift technical engineer promptly recorded this issue in Problem identification Report 4-0135 The operators resolved this concern by placing the vacuum pump switch in " pull-to-lock" to prevent an automatic start of the vacuum pump. The inspector noted that, for at least l

r l

-

l-3-l l 2 weeks, the vacuum pump had been in a " caution-tag" status and available to operate

'

on an automatic signal, although the downstream valve was shut. This indicated that engineers and operators failed to note this equipment concern in the operability I evaluation. This also indicated that operators and managers failed to question operation of this equipment under emergency conditions during control board walkdowns and turnovers during that tim Conclusions Operators determined a reactor core isolation cooling valve was inoperable and shut the valve. Because the reactor core isolation cooling vacuum pump was just upstream of i the shut valve, operators caution-tagged the switch in the control room with a warning not to operate the vacuum pump. The inspectors questioned the adequacy of this action. In response, the shift technical engineer identified that, during an automatic actuation, the pump would automatically start and potentially fail due to an isolated diccharge path, if not recognized and stopped by operators. This indicated that the equipment status had not been thoroughly evaluated for all expected plant operating conditions. Operators, other plant staff, and managers had performed control board walkdowns but failed to question the adequacy of the pump switch caution tag. This vulnerability did not cause a system to be inoperable (Problem Identification Report 4-01355) (Section O4.1).

08 Miscellaneous Operations issues O (Closed) Violation 97012-01: Failure to identify source of water entering Z-sump. The licensee had failed to identify and correct the effects of large volumes of water draining to the Z-sump. On a loss-of-offsite power, this liquid would increase sump water level and occlude both trains of the standby gas treatment system exhaust lines, since no power would be immediately available to the pumps and level switches. The power supply was not qualified for design basis event To correct the condition, the licensee has installed qualified power to the required equipment and has continued to maintain the Z-Sump in an operable conditio Therefore this item is close .2 (Closed) Violation 9815-02: Electrical Design Review. This item is closed based on licensee corrective action and associated Condition Report RCR 98-0337. This Severity Level lV violation was issued in a Notice of Violation prior to the March 11,1999,

,

implementation of the NRC's new policy for treatment of Severity Level IV violations i (Appendix C of the Enforcement Policy). Because this violation would have been treated i as a noncited violation in accordance with Appendix C, it is being closed administratively in this repor Administrative Closure of Licensee Event Reports l The following licensee event reports were reviewed in accordance with inspection Manual Chapter 92700. Each report documenwd a violation of NRC requirements. Each was

! ' entered in the licensee's corrective action program.

l

,

.

,

08.3 ' . (Closed) Licensee Event Report 95-013: Plant procedural requirements were inconsistent with station blackout assumptions. This issue was cited in NRC Violation 50-298/9508-01 and was closed out. It was also followed by the licensee's Significant Condition Report 95-055 .4 (Closed) Licensee Event Reoort 98-003: Potentialloss of safety function due to inadequate procedure. :This licensee event report described Emergency

. Procedure 5.2.5, " Loss of Offsite Power," which did not implement design basis assumptions. The procedure instructed operators to reduce core spray pump flow after an accident without providing instructions on when this flow reduction should occu Under some design basis conditions, flow reduction within the first 10 minutes of an accident would cause less than the required design basis flow. The licensee revised the procedure to be consistent with design basis assumptions. After a review of training and operator simulator testing, the licensee concluded that operators would not have reduced flow if the reactor vessel level was not recovered, regardless of the amount of time after a design basis event initiated. This conclusion is consistent with inspector

- observations of simulator training. This violation is followed by the licensee Significant Condition Report 98-0197. Failure to provide instruction appropriate to the

~circumstances is a violation of 10 CFR Part 50, Appendix B, Criterion V (50-298/99004-01). This Severity Level IV violation is being treated as a noncited violation, consistent with Appendix C of the NRC Enforcement Polic .5 (Closed) Licensee Event Report 50-298/99-002: Failure to response-time test all

- reactor protection system relays resulted in a missed surveillance. This issue is closed as a noncited violation of Technical Specification 3.3.1.1.15, which requires timed response testing of reactor protection system relays. This issue is closed based on the inclusion in the licensee's corrective action as Significant Condition Report 99-0285 and is discussed fully in Section M3.1 of this repor .6 - (Closed) Insoection Followuo item 50-298/96026-07i Failure to place the Division I reactor protection system in a half scram condition when a failure of the average power range monitor flow bias trip unit was suspected but the actual cause of failure was unknown. When alar,os indicated a degraded reactor protection system, operators quickly diagnosed a nonconservative failure of a flow bias scram card. However, they did not immediately place the channel in a tripped condition. Operators placed the unit in a tripped condition about an hour later while technicians replaced the failed card and corrected the problem. Alarm Response Procedure 2.3.2, " Panel 9-5 Annunciators,"

required the operators to place the channel in a tripped condition upon receipt of the alarm and then troubleshoot the problem. The failure to follow procedures is a violation of 10 CFR Part 50, Appendix B, Criterion V, which requires that procedures be implemented. This Severity Level IV violation is being treated as a noncited violation, 1 consistent with Appendix C of the NRC Enforcement Policy. This violation is closed based on inspector observation of consistent conservative operator performance for the i past year, review of licensee corrective actions, and licensee followup in the corrective )

action program as CAO 97-0029 (50-298/9904-02). j l

l

.

l

.

5-08.7 (Closed) Unresolved item 98002-05: Failure to implement 7-day emergency operating procedure requirements for diesel fuel inventory. The inspector identified that, during a loss of offsite power, operators would be expected to perform electrical load calculations in accordance with the Emergency Procedure 5.2.5, " Loss of Offsite Power." The licensee revised and clarified the procedure. The revision addressed the inspectors'

concerns. Interviews determined that, under conditions of a 7-day loss of offsite power, technical resources in the technical support center would resolve the issue before fuel resources were challenged beyond design basis margins. The safety significance of this issue was limited to distraction of operators during an event. Therefore this item is close .8 (Closed) Unresolved item 98002-06: Z-sump Modification Concerns. This unresolved item is closed based on inspector review of engineering and operations revision of procedures. The licensee had failed to include instructions in abnormal and emergency procedures to obtain electrical power sources to protect the standby gas treatment

]

system from Z-sump flooding. This is a violation of 10 CFR Part 50, Appendix B,

'

Criterion !!!, which requires that design criteria be appropriately implemented. This j Severity Level IV violation is being treated as a noncited violation, consistent with 1 Appendix C of the NRC Enforcement Policy. This violation is in the licensee's corrective action program as Significant Condition Report 98-0154 (50-298/99004-03).

11. Maintenance

-

M1 Conduct of Maintenance M1.1 Observation of Check Valve Replacement Inspection Scope (61726) and (62707)

The inspector observed portions of the following maintenance activity:

MWP 99-0579 Remove and Replace Service Water Booster Pump C Check Valve SW-CV-21C Observations and Findinas During plant operation, operators noted that the service water booster pump check valve slammed shut whenever pumps were shifted. The valve was removed from the system i and replaced with a new valve from storage. Engineers determined that the valve hung l open until significant reverse differential pressure was applied, then the valve slammed shut. An operability evaluation concluded that the valve was operable although degraded. Work control scheduled a replacement activity within a few weeks, within the j time that the operability evaluation concluded that the valve remained operabl Inspectors observed maintenance technicians replace the valve. The work package included all relevant instructions and references associated with this task. The :

technicians demonstrated proper measurement and fitup techniques, welding, and foreign material exclusion processes. The work package contained the appropriate documentation to inspect, remove, replace, and test the valve. The system tagout was

.

6-adequate and reasonable for the performance of the maintenance. The system engineer supported the maintenance, and the maintenance supervisor was present for a significant portion of the job. The inspector verified that the technicians' qualifications were up to date for all activities observe Conclusions A service water booster pump discharge check valve had slammed during pump shifts and repeatedly hung open until high differential pressure slammed it shut. Licensee technicians replaced the check valve. The work package included all relevant references and instructions for this task. The technicians implemented the package properl M3 Maintenance Procedures and Documentation M3.1 Inadeauate Scoce of Reactor Protection System Relav Testina Insoection ScoDe (61726)

Inspectors observed engineering and maintenance activities to address a failure to perform timing tests on four of eight scram relay Observations and Findinas On April 6,1999, during resolution of a quality assurance finding on postmaintenance testing, the maintenance and operations staffs raised questions regarding an apparent failure to test four of eight reactor protection system relays. Although these relays had been functionally tested during the prior outage, the surveillance had not tested the timing of these specific circuit paths since plant startup. These contacts are grouped in four areas, with four contacts per group. On April 6, the licensee discovered that the Group 2 contacts were not response-time tested by a surveillance procedure. The licensee entered the action requirements of Technical Specification 3.0.3 and performed an operability determination. Within 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> the team of operators and the work control, engineering, maintenance, and licensing staffs revised, obtained station operations review committee approval to perform, and did perform the surveillance procedure to test Group 2 contacts. The licensee believed they had reasonable assurance of the operability of the remaining contact On April 13,1999, during evaluation of the extent of condition of the problem, the licensee determined that the eight contacts in Groups 3 and 4 also had not been teste The licensee entered the action requirements of Technical Specification 3.0.3, revised the procedures, obtained the station operations review committee approval, and performed the portion of the procedure applicable to test the Group 3 and 4 contact Technical Specification Surveillance Requirement 3.3.1.1.15 required that the system contacts respond to a scram signal within 50 milliseconds. All Groups 2,3, and 4 relays met the acceptance criteria for timing as specified in the revised surveillance procedur .

-7-The Updated Final Safety Analysis indicates that all contacts are to be tested. The surveillance procedure used to test the contacts timed the response of only 4 of l 16 contacts in the syste l The inspector noted that the licensee had the following prior opportunities to identify and '

correct the surveillance procedure and properly test the reactor protection system contacts. In May 1994, inspectors identified failures to properly test relay contacts on essential electrical distribution load shed circuitry. This resulted in a plant shutdown required by Technical Specifications. Subsequent licensee responses to Confirmatory l Action Letters NLS 940001, " Response to Confirmatory Action Letter," dated July 28, 1994, and NLS 9400026, " Response to Request for Additional Information," dated August 8,1994; response to Escalated Enforcement Actions 50-298/94016-01 and -02; and NPPD Letter N65950028, " Reply to a Notice of Violation and Proposed imposition of Civil Penalties," dated January 18,1995, stated that the licensee would review all surveillance testing requirements and conduct functional testing to ensure surveillance testing met Technical Specification requirement Testing of logic systems was also addressed in Generic Letter 96-01. The licensee responded to the letter in April 1996, indicating that a complete review of logic tests had been performed prior to the letter and no further review was required. The licensee also had the opportunity to fully resolve testing of all contact groups when the concern was discovered on April 6,1999. However, two of the four groups were not identified until April 1 The failure to identify and correct inadequate relay testing during the 1994 and 1995 surveillance test validation program and other prior opportunities is a violatio Corrective action for surveillance testing deficiencies associated with Escalated Enforcement Actions 9416-01 and 9416-02 did not identify these. vulnerabilities. The safety significance of this failure to perform timing tests on the reactor protection system relays is low since confirmatory testing accomplished on April 7 and 14,1999, found relay performance to be within required timing acceptance criteria. This is a violation of 10 CFR Part 50, Appendix B, Criterion XVI, which requires that significant conditions adverse to quality be corrected to prevent recurrence. This issue is followed in the licensee's corrective action program as Significant Condition Report 99-0285. This Severity Level IV violation is being treated as a noncited violation, consistent with Appendix C of the NRC Enforcement Policy (50-298/99004-04).

c. Conclusions Operators, work control personnel, and maintenance staff identified that the surveillance procedure to test response timing of reactor protection system scram circuits did not time test all relays. Twelve of 16 reactor protection system contacts on relays had not had timing tests since plant startup. The licensee revised the procedure and tested the contacts successfully. The inspectors identified that the licensee's past corrective actions to verify testing according to Technical Specification surveillance requirements had failed to identify the requirement to test the relays discussed above. Engineers

&

-8-were investigating the extent of the condition as of the end of this inspection perio These problems were considered a violation of 10 CFR Part 50, Appendix B, Criterion XVI. They met the criteria for a noncited violation (Significant Condition Report 99-0285).

X1 Exit Meeting Summary The inspectors presented the inspection results to members of licensee management at the exit meeting on May 10,1999. The licensee acknowledged the findings presente The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identifie ,

a

-

z

l

'

,-

ATTACHMENT l PARTIAL LIST OF PERSONS CONTACTED Licensee l

L S. Blitchington, Acting Radiological Manager l D. Buman, Assistant Plant Engineering Department Manager P. Donahue, Engineering Safety Department Manager

. W. Fujimoto, Consultant C. Gaines, Maintenance Manager T. Gifford, Design Engineering Department Manager M. Gillan, Outage Manager M. Kaul, Operations Support Group Liaison J. McMahan, Acting Work Control Manager L. Newman, Licensing Manager M. Peckham, Plant Manager

J. Peters,' Licensing Secretary

B. Rash, Senior Engineering Manager A. Shiever, Operations Manager l lNSPECTION PROCEDURES USED l

lP 37551: Onsite Engineering IP 61726: Surveillance Observation IP 62703: Maintenance Observation IP 71707: Plant Operations

'

IP 71750: Plant Support Activities ,

IP 92901: Followup - Plant Operations IP 92903: Followup - Engineering IP.92700: LER - Onsite Review .

l ITEMS OPENED AND CLOSED, AND CLOSED I Ooened and Closed 50-298/99004-01 NCV Inadequate procedure (Section 08.4)

50-298/99004-02 NCV Failure to insert a half scram (Section 08.6)

l 50-298/99004-03 NCV Z-sump modification concerns (Section 08.8) l l 50-298/99004-04 NCV inadequate corrective action (Section M3.1)

Closed 50-298/98012-01 VIO Failure to identify source of water entering Z-sump (Section 08.1) ,

50-298/98015-02 VIO Electrical Design Review (Section 08.2)

50-298/95013-00 LER Plant procedural request incorrect with station blackout assumptions l

(Section 08.3)-

50-298/98003-00 LER- Potentialloss of safety function due to inadequate procedure (Section 08.4)

!

L

l

.  :

.

.

50-298/99002-00 LER Failure to response-time test all reactor protection system relays resulted in missed surveillance (Section 08.5)

50-298/96026-07 IFl Failure to place Division I in a half scram condition (Section 08.6)

50-298/98002-05 URI Failure to implement 7-day emergency operating procedure diesel fuel i design requirements (Section 08.7)

l 50-298/98002-06 URI Z-sump modification concern (Section 08.8)

l l

l l

l