IR 05000302/1993016

Insp Rept 50-302/93-16 on 931115-19 & 1206-1210.Violations Noted.Major Areas Inspected:Emergency Operating Procedure Team,Representative Records,Interviews W/Personnel & Observation of Activities in Progress

ML20059G212
Person / Time
Site:	Crystal River
Issue date:	12/23/1993
From:	Hopper G, Lawyer L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20059G208	List: IR 05000302/1993016 ML20059G205
References
50-302-93-16, NUDOCS 9401240050
Download: ML20059G212 (3)

Text

.

W -

• i

• '

. UNITED STATES

. /g pro .

-

NUCLEAR REGULATORY COMMISSION

' p t- 4 . REGION 11 ,

,- S 101 MARIETTA STREET, N.W., SUITE 2900 .

- ;j ATLANTA, GEORGIA 303234199

%,+.**+/

Report No.: 50-302/93-16 Licensee: Florida Power Corporation

'

3201 -34th Street, South St. Petersburg, FL 33733 Docket No.: 50-302 License No.: DPR-72 ;

Facility Name: Crystal River 3 Inspection Conducted: November 15-19 and December 6-10, 1993

Inspector: brus -7$ Ymn George T.' Hopper ' N i 2 ~2 3 - 93 Date Signed .

Accompanying Personnel: J. H. Bartley, NRC Region II G. R. Bryant, COMEX J. S. Debors, SEA Corporation Approved b : /.2.-23-fl Lawrence L. Luwyer, Chief Date Signed Operator Licensing Section

'

Operations Branch- '

Division of Reactor Safety  ;

Scope: i This was a special announced Emergency Operating Procedure (EOP) team l inspection. Its purpose was to determine whether significant changes to the licensee's E0Ps since the last inspection met commitments and regulatory requirements. The inspection also assessed the impact of the changes to the licensee's E0Ps on the E0P program and overall plant safet Results:

The inspectors identified two E0Ps and three APs which contained inadequate guidance. The inspectors determined that significant changes were made to the .

,

E0Ps which did not meet commitments and regulatory requirements. The  ;

inspectors identified numerous-deficiencies in the E0P development and ,

implementation process and concluded that the PSTG was not adequate to serve .;

as the controlling document for development of E0Ps and E0P revision ,

Six apparent violations discussed in this inspection report are being l considered for escalated enforcemen J Within the areas inspected, the following apparent violations were identified:

.I 9401240050 931230 PDR ADOCK 05000302'

O PDR- i

._ __

. _ .

.

.

2 EEI 302/93-16-01, Failure to develop an adequate PSTG (paragraph 5.a).

EEI 302/93-16-02, Failure to take adequate corrective action on previously identified PSTG deficiencies (paragraph 5.a).

EEI 302/93-16-03, Failure to maintain adequate control of documents, two examples (paragraph 5.a).

EEI 302/93-16-04, Failure of procedures to provide adequate guidance, seven examples (paragraph 3.a, 3.b, 5.b).

EEI 302/93-16-05, Failure to follow the verification and validation procedure (paragraph 5.c).

EEI 302/93-16-06, Failure to perform adequate 9 50.59 reviews (paragraph 7).

.

-m -

-c -

.

,

,

,

REPORT DETAILS Persons Contacted Licensee Employees

• Boldt, Vice President, Nuclear Production

• P. Fleming, Senior Nuclear Licensing Engineer

• B. Hickle, Director Nuclear Plant Operations

• L. Kelley, Director Nuclear Operations Training

• J. Lind, Supervisor, Nuclear Operator Training G. Longhouser, Security Superintendent

• W. Marshall, Manager, Nuclear Plant Operations

• B. McLaughlin, Nuclear Regulatory Specialist

• S. Robinson, Manager, Nuclear Quality Assessment

• J. Smith, Nuclear Licensed Operator Training Supervisor

^

• R. Tyrie, E0P Coordinator

• K. Wilson, Manager, Nuclear Licensing Other licensee employees contacted included instructors, engineers, technicians, operators, and office personne NRC Personnel

• J. Arildsen, Human Factors Branch, Nuclear Reactor Regulation

• R. Butcher, Senior Resident Inspector

• T. Cooper, Resident Inspector

• J. Jaudon, Deputy Director, Division of Reactor Safety K. Landis, Chief, Reactor Projects Section 2B L. Lawyer, Chief, Operator Licensing Section

• R. Long, Project Engineer, Reactor Projects Section 2B

• Attended exit interview 1.1 List of Appendixes Appendix A contains the procedures reviewed during the inspectio Appendix B contains detailed findings referencing report paragraph Appendix C contains the acronyms and initialisms used in this repor . Background Information Following the TMI accident, the office of Nuclear Reactor Regulation developed the TMI action plan (NUREG-660 and NUREG-0737 issued in 1980)

which requested licensees of operating reactors to re-analyze transients and accidents and to upgrade E0Ps. The plan also required the NRC staff to develop a long term plan that integrated and expanded efforts in the writing, reviewing, and monitoring of plant procedures. NUREG-0899,.

" Guidelines for the Preparation of Emergency Operating Procedures," was issued in 1982 and represented the NRC staff's long term program for upgrading E0Ps and describes the use of a PGP to prepare E0Ps. Working with vendor companies and the NRC, owner groups developed GTGs which were

- - . - - - .

.

.

Report Details 2 generic procedures.that set forth the preferred accident mitigation strategies. These GTGs were to be used by licensees in developing their E0P Generic Letter 82-33 was issued in December 1982 and promulgated Supplement I to NUREG-0737 " Requirements for Emergency Response Capability." This supplement contained a distillation of the basic ,

guidelines for the upgrade of E0Ps. Item 7.2 of this supplement requested 1 the submission of a PGP which was to include the following:

(1) Plant Specific Technical Guidelines (2) A Writers Guide (3) A description of the program to be used for the validation and verification of E0Ps (4) A description of the training program for the upgraded E0P A Confirmatory Order, dated February 21, 1984, was issued to Florida Power Corporation (FPC) which made the submittal of the PGP a requirement. This order also directed FPC to upgrade their E0Ps in the manner described in the licensee's response to Generic Letter 82-33, dated April 15, 198 This letter contained commitments to implement the requirements of the generic letter which included Section 7 of NUREG-0737 Supplement The NRC initiated its E0P Inspection Program to determine if licensees were meeting the requirements of NUREG-0660, NUREG-0737, and NUREG-0737 Supplement 1. During the pilot and second phases of the E0P inspections, the NRC staff identified concerns with industry E0P development and implementation. As a result, NUREG-1358 " Lessons Learned From the Special Inspection Program for E0Ps," was issued in April 1989 to reiterate the -

critical elements of effective E0P generation. This described the results of the early phases of the inspection effort during which 30 plants were inspected. The staff initiated the third phase of E0P inspections in :

October 1988'to determine the effectiveness of the industry's initiatives to improve the E0Ps and to address previously identified deficiencie The NRC found, at the completion of the third phase of these inspections, that the industry had not significantly improved since NUREG-1358 was issued. Most of the inspections continued to identify significant technical concerns with licensees' E0P development and implementatio NUREG-1358 Supplement I was issued in October 1992 to provide the industry with additional clarification and guidance on the critical elements of an E0P development program. Information contained in this supplement was based on 62 E0P-3 inspections conducted from October 1988 through l September 199 i 3. Inadequate Procedures 10 CFR 50, Appendix B, Criterion V, requires that activities affecting j quality shall be prescribed by documented instructions, procedures, or ,

drawings of a type appropriate to the circumstances and shall be I accomplished in accordance with these instructions, procedures, or drawings. The inspectors reviewed selected E0Ps and APs. The inspectors i determined that two E0Ps and three APs contained deficient instruction )

The deficiencies included inadequate detail of steps, failure to provide

l

\

.

.

Report Details 3 required actions, failure to identify and stage the equipment necessary to perform the actions required by an enclosure, technically incorrect information, and incorrect cross references to other procedure l The team determined that E0P-03, " Inadequate Subcooling Margin" and Enclosure 6 of E0P-14, " Emergency Operating Procedure Enclosures," l were inadequate. E0P-03 did not contain the guidance necessary for !

mitigating a small break LOCA without high pressure injection capability. This guidance was contained in the GTG. The inspectors also identified deficiencies with Enclosure 6 of E0P-1 l The inspectors determined that F0P-03 failed to mitigate a loss of subcooling margin with no high pressure makeup capability. This event is similar to a previous event at another B&W unit. The inspection team ran a scenario consisting of a 100 gpm LOCA compounded by a loss of all high pressure makeup capability. The crew transitioned through several E0Ps while attempting to mitigate the casualty. The crew reached step 3.12 of E0P-03 (which transitioned to E0P-08) and determined that E0P-08 did not provide guidance for the plant conditions. The Shift Superintendent and Assistant Shift Superintendent thought the mitigation steps for plant conditions were in the Station Blackout E0P, but they did not meet the entry conditions for that E0P. This situation could have resulted in significant plant degradation. An indecisive' crew could have caused superheated conditions in the core. The GTG Inadequate Subcooling Margin guidance provided the mitigation' strategy for this event. This guidance was omitted from E0P-03 with no documented justificatio '

The licensee stated the mitigation strategy was put in the Crystal River Station Blackout E0P. The inspectors found that the step in the Station Blackout E0P contained the broad statement, "Immediately begin 4 a cooldown at the maximum achievable rate." This broad statement did *

not provide the detailed guidance listed in the GTG to mitigate the condition. The failure of E0P-03 to provide adequate guidance is an example of EEI 50-302/93-16-0 The inspectors determined Enclosure 6 of E0P-14 would not work as written. The first step of 6.2 directed the operator to " Connect DH source to MSV-524,..." This step did not tell the operator what DW source to use, its location, or how to connect it. The inspectors identified that Step 6.2 did not direct the operator to open valve CXV-358 or to remove the cap and open valve MSV-542. These actions were necessary to complete the task. The inspectors identified that the procedure required the use of ladders in two separate areas, a pipe wrench, a hose, plastic sleeving, a container, and duct tap Enclosure 6 did not identify that these tools were required nor were the tools prepositioned in the plant, except for the hose. The failure of E0P-14, Enclosure 6, to provide adequate guidance is another example of EEI 50-302/93-16-0 The team determined that AP-470, " Loss of Instrument Air," AP-581, ,

" Loss of Non-Nuclear Instrumentation (NNI-X) Power," and AP-582, " Loss .

. . . . . _

>

J 1 Report Details 4 of Non-Nuclear Instrumentation (NNI-Y) Power" were technically inadequate. Refer to Appendix B of this report for detail (1) AP-470 contained four incorrect cross references that directed the operator to implement canceled Abnormal Procedures. The failure of AP-470 to provide adequate guidance is another example ,

of EEI 50-302/93-16-0 l (2) AP-581 was technically incorrect. Instruments identified as unreliable were reliable and other instruments that were unreliable were not identified. This procedure could not be safely utilized by an operator in the event of a loss of NNI-X power. The failure of AP-581 to provide adequate guidance is another example of EEI 50-302/93-16-0 (3) AP-582 was technically incorrect. The procedure incorrectly '

stated that no instruments would be unreliable on loss of NNI-Y, when many instruments would be unreliable. This procedure could not be safely utilized by an operator in the event of a loss of NNI-Y power. The failure of AP-582 to provide adequate guidance is another example of EEI 50-302/93-16-0 l Simulator Observations .

The inspection-team ran one scenario on an off-shift crew, observed two crews perform two scenarios each during requalification examinations, and '

observed an initial license examination crew perform one scenario. The scenarios consisted of a small break LOCA (100 gpm) with no high pressure makeup capability, an ATWS with a stuck open MSSV, and a SGTR with a stuck ,

open MSSV. The team also developed a scenario which required the use of AP-470, " Loss of Instrument Air." The inspectors observed problems during the scenarios and concluded these problems were due to the omission of

'

significant GTG guidance, modification of transition steps, and the creation of E0P entry conditions beyond the GTG guidanc '

Observations were: The team determined that E0P-03 omitted the GTG guidance for mitigating a loss of subcooling margin with no HPI capabilit Refer to paragraph 3.a for details, The inspection team observed that a crew inappropriately entered ,

E0P-09, " Natural Circulation Cooldown," due to a lack of clarity of the Entry Conditions. This delayed the completion of E0P-02, " Vital System Status Verification." This was contrary to the guidance in the B&W GTG for E0P entry condition .

.

.

l Report Details 5

>

The B&W GTG, Volume III (Chapter III.A General Approach Overview / Entry Conditions Section 2.1) described the Entry Conditions for the E0Ps as:

• Reactor trip or conditions exist which require a Reactor Tri .

• Reactor Shutdown Required for Steam Generator Tube  :

Ruptur * One of the following three symptoms exist: ,

- Excessive Heat Transfer *

- Inadequate Heat Transfer 4

- Loss of Subcooling Margin i Unlike E0P-09, the GTG did not provide for entry conditions to the support procedures such as Natural Circulation Cooldown or Inadequate ,

Core Coolin , The inspectors observed four crews during a scenario consisting of an !

SGTR and a stuck open MSSV. The inspectors observed that the licensee's deviation from the GTG guidance on transition from Excessive Heat Transfer to Steam Generator Tube Rupture confused three ,

'

of the four crews. The crews were confused because E0P-05 transitioned the operator to the first follow-up action step of E0P-06 which addressed the tube rupture as if the plant were still at powe This was an undocumented deviation from the GTG. The GTG transition directed the operator to step 5.0 of the tube rupture procedure and immediately started a plant cooldown. This bypassed the unnecessary ;

plant shutdown steps that existed in the Crystal River E0P transitio . E0P Development Process ,

l The inspectors compared the spectrum of accidents analyzed in chapter 14 l of the Crystal River FSAR to the spectrum of accidents provided for in the E0Ps. The NRC concluded that the E0Ps addressed all of the FSAR

'

accidents. The inspectors also reviewed the critical elements of the E0P development process and identified an apparent violation of the February 21, 1984. Confirmatory Order, apparent violations of 10 CFR Part 50 Appendix B, and an apparent violation of Technical ;

Specification 6. ' Plant Specific Technical Guidelines l

A February 21, 1984, NRC Order confirming licensee commitments on emergency response capability, directed that FPC upgrade E0Ps in the manner described in a FPC letter noted in Section III of the Orde This letter, dated April 15, 1983, constituted FPC's response to Generic Letter 82-33 which contained Supplement I to NUREG 0737,

" Requirements for Emergency Response Capability." In this letter, FPC committed to implementing the requirements of the generic lette Item 7.1.b of NUREG-0737 Supplement I required that licensees re-analyze transients and accidents and prepare Technical Guideline l

Report Details 6 Item 7.1.c required licensees to upgrade E0Ps to be consistent with Technical Guidelines and an appropriate procedure Writer's Guid Item 7.2.b required licensees to submit a Procedures Generation Package which included PSTG. The inspectors evaluated the adequacy of the PSTG as a controlling document for development and revision of E0Ps. The licensee's Verification and Validation Plan defined the PSTG as the sum of the vendor supplied GTG and the licensee developed Deviation Document. - The inspectors concluded that the licensee's PSTG was unsatisfactory because a Deviation Document did not exist for the E0Ps documented to have been written from Revision 6 of the Babcock and Wilcox GTG. During the period of this inspection, the licensee received and entered a new revision, Revision 7, into their copy of the B&W Owners Group GTG, without adequate controls. Since the current E0Ps were based on the GTG through Revision 6, incorporation of Revision 7 increased the already significant divergence between the '

GTG and the E0Ps. The NRC concluded that the PSTG was not adequate to serve as the controlling document for development of E0Ps and E0P ,

revisions. The failure to develop an adequate PSTG is an example of '

EEI 50-302/93-16-0 CFR 50, Appendix B, Criterion XVI, requires that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances'are promptly identified and '

corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition'is '

determined and corrective action taken to preclude repetitio Since ,

1982, the NRC has issued three NUREG documents, one Information l Notice, and numerous inspection reports, and held meetings with the-industry addressing either E0P development or problems identified with E0P development / implementation. Comprehensive information was made available in April 1989 when NUREG-1358, " Lessons Learned from the Special Inspection Program for Emergency Operating Procedures," was issued. NUREG-1358 Supplement I was issued in October 1992 to provide the industry with additional detailed clarification and guidance. The team noted that Inspection Report 50-302/88-09 identified that the licensee had not developed a Deviation Documen Furthermore, Inspector Follow-up Item 89-10-01 identified a deficiency in the licensee's PSTG. The licensee had acknowledged the deficiency and

'

committed to upgrading a consolidated PSTG. This previously identified deficiency remained uncorrected and had degraded to the point that the licensee did not have a current Deviation Document for the E0Ps documented to have been written to Revision 6 of the GT The failure to take adequate corrective action on previously identified PSTG deficiencies is an example of poor management contro CFR 50, Appendix B, Criterion VI, requires that measures shall be established to control the issuance of documents, such as instructions procedures and drawings, including changes thereto, which prescribe all activities affecting quality. These measures shall assure that documents, including changes, are reviewed for adequacy and approved

l I

~

l Report Details 7

.

for releas Procedure N0D-05, " Document Control Program," stated that documents which specify or provide criteria, parameters and bases upon which completion of a quality related task is based are controlled documents. The inspectors reviewed the previous Deviation ,

Document that' existed for the E0Ps written to Revision 4 of the J Technical Basis Document. The team concluded that this document had not been maintained as a controlled document. The document had not been dated, signed, or reviewed. It contained no file or reference .'

data, was typed on plain paper with no indication of the originating organization, and had been marked up with multiple pen and ink changes with no indication of the author of the change NUREG-1358 Supplement I states, "The PSTG must be maintained as a controlled document and all changes to the E0P implementation strategies should be documented therein. The technical basis documents are not just historical records. They are the foundation for controlling the quality, consistency, and adequacy of the E0Ps." The failure to maintain the previous Deviation Document as a controlled document is an example of EEI 50-302/93-16-0 During this inspection, the inspectors discovered that the library copy of the FSAR contained an obsolete and superseded Appendix 12C, pages 12C-iii through 12C-20. FSAR Revision 13 of 19 had deleted these pages. Maintenance of superseded material in the training center library created the risk of training department instructors and managers developing training materials which conformed to obsolete requirements. This is another example of EEI 50-302/93-16-0 Writer's Guide -

10 CFR 50, Appendix B, Criterion V, requires that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. The inspectors reviewed AI-402A, " Writer's Guide for Emergency Operating Procedures," to determine if it contained adequate guidance for writing E0Ps. The team determined that AI-402A was inadequate because it did not contain the new Revision 6 mitigation strategy. It was also inadequate because it contained the previous E0P mitigation strategy based upon four critical safety functions, stated that verification procedures should be organized by critical safety functions which were no longer applicable, described the old numerical sequencing of E0Ps (series and sequence numbers) which were no longer applicable, and contained no information regarding the content and format of Rules, Carry-over steps, or Flow Charts. The failure of AI-402A to provide adequate guidance is an example of EEI 50-302/93-16-04. Refer to Appendix B of this report for detail ,

.

.

Report Details 8

,

, Verification and Validation Plan The inspectors reviewed AI-402C, "EOP Verification and Validation Plan," to determine if it contained adequate guidance for verifying and validating the E0Ps. The team determined that AI-402C was .

inadequate because it did not state the correct organization and >

structure of the Verification Procedure series of E0Ps, which are used for plant safety verificatio It stated that the organization of the VP series of E0Ps was in accordance with the old critical safety functions vice the new format that presently exists. The failure of'

AI-402C to provide adequate guidance is another example of EEI'50-302/93-16-0 Refer to Appendix B of this report for detail Technical Specification 6.8.1 required that written procedures shall I be established, implemented, and maintained covering the applicable ;

procedures recommended in Appendix A of Regulatory Guide 1.33, ~;

November, 197 Regulatory Guide 1.33 lists various safety-related

'

administrative activities including Procedure Review and Approva .;

AI-402C required that the originator of the procedure verification designate independent reviewers to perform Enclosure 2, " Evaluation -

Criteria for Procedure Verification." The inspectors reviewed the verification and validation packages for each of the 14 E0Ps. The team compared the documentation to the procedural requirements set forth by the licensee. The team found that independent verificatio !

of the E0Ps had not been performed in accordance with AI-402C. The verification and validation summaries for 14 E0Ps (Enclosure 1 and Enclosure 3 of AI-402C) did not have any independent reviewer signatures and dates as required by step 4.1.2 of the procedur Enclosure 2 of AI-402C, " Evaluation Criteria for Procedure Verification," was not performed for any of the verifications in accordance with the procedure as evidenced by the following: i (1) Step 2.2.1 required that differences between the E0P and PSTG be documented and explained. Numerous differences existed between the GTG and the E0Ps. The lack of a Deviation Document would ,

have been apparent if verification and validation had been :

properly performed. No deviations were noted on the verification and validation summarie (2) VP-580 was designed, written, verified and implemented without conforming to the quantitative acceptance criteria listed in Al-402 Some of these acceptance criteria were invalid. Also, the obsolete criteria should have been identified during the verification proces (3) E0P-14, Enclosure 6, "0TSG Blowdown Lineup," was not adequately validated. Step 1.1.1 of Enclosure 4 to AI-402C required that the procedure contain sufficient information to perform the specified actions. The procedure could not be performed as written. Refer to paragraph 3.a for detail i

- . . . -

i e

i p Report Details 9 l -

The failure to follow the guidance AI-402C is an example of EEI 50-302/93-16-0 . Independent Technical Adequacy Review of the E0Ps

' '

The team reviewed the procedures listed in Appendix A to determine their technical adequacy. This review included a verification that the recommended step sequence was followed, entry and exit points were correct, proper prioritization of accident mitigation strategies was employed, and adequate technical justifications existed for deviations from the GTG. The NRC found that the current E0Ps were created without documented technical justification for the many deviations which existed between the GTG and the E0Ps. Because of the lack of a Deviation "

-

Document, the team was unable to conclude that the E0Ps were technically '

accurate and adequately incorporated the guidelines of the GTG. This lack of assurance and the stated examples of deficient E0P guidance require that the process be completed. Several examples of the deviations and discrepancies encountered are described in the following paragraph Additional examples are described in Appendix B of this repor Volume 1, Part 1, of the GTG stated "Each guidance step is followed in l succession unless directed otherwise." The inspectors found numerous examples in each of the GTG based E0Ps where the GTG sequence was not maintained. No technical basis for these changes had been documente The inspectors identified one procedure in which the step sequence chosen :

by the licensee was clearly in error. Steps 3.20 and 3.21 of E0P-06,. ;

" Steam Generator Tube Rupture," incorrectly reversed ~the step sequence of i the GTG. If RCPs were stopped, the E0P attempted to restart available RCPs only after first establishing natural circulation. Under the new mitigation strategy of steaming the ruptured generator to expedite ;

cooldown, steaming time is limited by DEI. Wasting valuable cooldown time by initiating natural circulation when RCPs are available was not the intent of the GTG. No deviation or technical basis had been establishe The team found that many E0P entry conditions were incomplete and poorly I defined. Omission of mode applicability restrictions, failure to identify l a Mode 5 SGTR as an entry to E0P-11, and inconsistencies between GTG and j E0P superheat requirements for E0P-07 entry were some examples of problems noted. Many of the GTG Notes and Caution statements were omitted from the E0Ps without supporting deviations. The caution before Step 2.0 in the ,

GTG was not included in E0P-02; the GTG cautions before and after Step 12 l were missing from E0P-03; the caution concerning pressurized thermal shock ;

applicability that precedes Step 1 in GTG Tab III.D was not included ;

before Step 1 of E0P-0 l The team was unable to verify that the GTG prioritization of accident mitigation strategies had been maintained since these rules were not documented within the E0Ps. The inspectors interviewed licensee staff and determined that prioritization of mitigation strategies was considered operator knowledge. This was acquired principally from classroom training

.l

.

Report Details 10 j l

using E0P training lesson plan ROT-5-14. The inspectors reviewed this lesson plan and noted that it included instructions on prioritization of mitigation strategies. However, the lesson plan also contained instructions from an earlier revision of the GTG, specifically the obsolete AT0G critical safety functions (reactivity control, thermal control, radioactive inventory control, and equipment availability), and contained errors in the E0P entry condition section. This lesson plan was , ,

controlled by the Training Department and did not receive a 50.59 review or Plant Review Committee approva ,

i 7. 10 CFR 50.59 Safety Evaluations

,

10 CFR 50.59 required that the holder of a license of a utilization j facility may make changes in the procedures as described in the safety i analysis report without prior Commission Approval, unless the proposed-change involves a change in the technical specifications incorporated in -

the-license or involves an unreviewed safety question. It further requires that the licensee shall maintain records ~of changes in procedures made pursuant to this section and that these records must include a written safety evaluation which provides the bases for the determination that the change does not involve an unreviewed safety question. The inspectors reviewed the 10 CFR 50.59 Safety. Evaluations to determine their adequacy. The team found that all 14 of the E0Ps had the identical ;

9 50.59 reviews. The evaluation lacked specific details and could not !

support an independent review to determine that an unresolved safety ,

question did not exist. . Furthermore, the evaluation contained inaccurate ,

statements concerning several individual E0Ps. E0Ps 01, 10,-11, 12, and ,

14 were. developed by the licensee without the benefit of generic technica' '

guidance since their content was not addressed within the GTG.~ The safety '

l evaluations stated that the new procedures were developed in " Strict accordance with approved vendor guidelines." This statement was not accurate for these E0Ps. In addition, E0P 02 through 09, and 13 contained l numerous deviations from the vendors generic guidelines. This was contrary to the statement provided on the s 50.59 evaluations. The safet l evaluations also stated that the mitigation strategies have remained unchanged for the design basis events. On the contrary, the mitigation strategies had significantly changed because the previous E0Ps utilized the now defunct critical Safety Functions. The failure to perform adequate 50.59 reviews is an example of EEI 50-302/93-16-0 l

l

. . = . -. - . . .

.

Report Details 11 ,

.

8. Exit Meeting The inspection scope and findings were summarized on December 10, 1993, 4 with those persons indicated in paragraph 1. The NRC described the areas inspected and discussed in detail the inspection findings. No proprietary :

material is contained in this repor No dissenting comments were received from the license Item Number Status Apparent Violations EEI 302/93-16-01 Open Failure to develop an adequate PSTG (paragraph 5.a). ,

EEI 302/93-16-02 Open Failure to take adequate corrective action j on previously identified PSTG deficiencies 1 (paragraph 5.a).

EEI 302/93-16-03 Open Failure to maintain adequate control of documents, two examples (paragraphs 5.a).

.

EEI 302/93-16-04 Open Failure of procedures.to provide adequate guidance, seven examples (paragraphs

3.b,5.b).

EEI 302/93-16-05 Open~ Failure to follow the verification and validation procedure (paragraph 5.c).

EEI 302/93-16-06 Open Failure to perform adequate s 50.59 -

reviews (paragraph 7).

l

F 1

. . - . _ - - - . . . .. .- - . . - .

.

APPENDIX A PROCEDURES REVIEWED AI-400C PERMANENT PROCEDURE REVISIONS 10-AI-400E PERFORMANCE AND TRANSMITTAL OF PROCEDURES 8 AI-402A WRITER'S GUIDE FOR EMERGENCY OPERATING PROCEDURES 4 AI-402C E0P VERIFICATION AND VALIDATION PLAN 0 AI-500 CONDUCT OF OPERATIONS 78 i AP-470 LOSS OF INSTRUMENT AIR 2 AP-581 LOSS OF NNI-X 4 AP-582 LOSS OF NNI-Y 3 E0P-01 ENTRY CONDITIONS 01 E0P-02 VITAL SYSTEM STATUS VERIFICATION 01 E0P-03 INADEQUATE SUBC00 LING MARGIN 01 E0P-04 INADEQUATE HEAT TRANSFER 01 E0P-05 EXCESSIVE HEAT TRANSFER 01 E0P-06 STEAM GENERATOR TUBE RUPTURE 01 E0P-07 INADEQUATE CORE COOLING 01 E0P-08 LOCA C00LDOWN 01 E0P-09 NATURAL CIRCULATION COOLDOWN -00

,

E0P-13 E0P RULES 01 EOP-14 EMERGENCY OPERATING PROCEDURE ENCLOSURES 00

.

N00-05 DOCUMENT CONTROL PROGRAM 9 N0D-Il PREPARATION OF SAFETY, REGULATORY, AND ENVIRONMENTAL 3 COMPLIANCE REVIEWS ST-009 SPECIAL TECHNICAL TRAINING, QUALIFIED REVIEWER TRAINING 11 ST-1064 SPECIAL TECHNICAL TRAINING, SAFETY EVALUATION TRAINING 00 ,

TDP-100 PREPARATION AND CONTROL OF NUCLEAR OPERATIONS TRAINING 2-DEPARTMENT PROCEDURES VP-580 PLANT SAFETY VERIFICATION 21,

,

f a

F

!

F i

.. - _ - ___

. - .. .

.

,

,

'

APPENDIX B DETAILS (Paragraph numbers correspond to report paragraphs) Strategies for reacting to design basis events were changed but not '

reflected in AI-402 ,

e The licensee made fundamental changes in accident mitigation strategies, but, did not incorporate the change into AI-402A or ,

AI-402C. The old mitigation strategy was based on the maintenance of four critical safety functions:

• Reactivity Control ,

• Thermal Control

• Radioactivity Inventory

• Equipment Availabilit e The new accident mitigation strategy was based on the B&W E0P Technical Bases Document, Revision 6, dated 10/89. The new strategy '

.

was implemented in the new symptom based E0P e During the upgrade, seven old APs and four old EPs were blended into the fourteen new E0Ps. The list of old APs and EPs that were blended into the new E0Ps is provided below: AP-360 Loss of Decay Heat Removal went to E0P 11, f AP-380 Engineered Safety Actuation went to E0Ps 3 and 8, AP-450 Emergency Feedwater Actuation went to E0Ps 13 and 24, AP-460 Steam Generator Isolation Actuation went to EOP-5, AP-530 Natural Circulation went to E0P-9, AP-580 Reactor Trip went to E0Ps 2 and 10, ' AP-790 Station Blackout went to E0P-12, EP-140 Emergency Reactivity Control went to E0Ps 02, 09, and 1 . EP-220 Pressurized Thermal Shock went to E0P-13, ,

1 EP-290 Inadequate Core Cooling Went to E0P-12, i 1 EP-390 Steam Generator Tube Rupture went to E0P- ; AI-402A was not updated to reflect the major change to E0P content and forma e AI-402A, page 10, stated that emergency procedures should be organized s by critical safety functions. The upgraded E0Ps were organized by '

symptoms, events, rules, and enclosures. The new E0P organization was i not reflected in the. Writer's Guid l l

,

._ ,- - . , , . . .,

Appendix B 2  :

e AI-402A, page 7, stated that the VP-EOP Procedures should be organized by safety functions. The new VP-580 was organized as follows: , Entry Conditions Immediate Actions Follow-up Actions i Rules

'

Enclosures E0P Flow Chart '

e AI-402A, page 12, section 4.4, stated that only APs and EPs should . I include entry conditionr. The inclusion of entry conditions in VPs reflected a change in the way VPs were organized, but, it was not l reflected in the Al-402 :

e There was no guidance for the content and format of: ,

• E0P-01 Entry Conditions  ;

• E0P-13 E0P Rules

• E0P-14 E0P Enclosures , AI-402C was not updated prior to the E0P upgrade and did not reflect the current emergency procedure e AI-4020, page 16, listed the deleted VP-E0P Procedure critical safety function :

• Al-402C, page 16, indicated the enclosures were included in the I individual E0Ps when they were actually broken out as Rules and Enclosures (E0P 13 and 14).

5.c.(2) VP-580 was designed, written, verified, and implemented (September, 1993) without conforming to either AI-402A or AI-402 * The old VP-580 was organized in critical safety function format:

• Reactivity Control

• Thermal Control

• Radioactive Inventory Control ,

• Equipment Availability e The new VP-580 was organized as follows:

' Entry Conditions Immediate Actions Follow-up Actions Rules Enclosures .

E0P Flow Charts

.

si Appendix B 3  !

! The inspectors found that the current E0Ps were created without ,

documenting technical justification for the many deviations which existed between the GTG and the E0Ps. The team noted that numerous changes to the GTG step sequence requirements were made despite the guidance contained in Volume 1, Part I of the GTG which stated "Each guidance step is followed in succession unless directed otherwise."

The inspectors noted at least two instances in each of E0Ps 02-10 where step sequence deviations existed without any supporting documentation or analysis. The following section contains a sampling of some of the deviations and problems noted by the inspectors and is not intended to be an all inclusive lis E0P-01 Entry Conditions e The GTG list of entries to III.A (EOP-02) included loss of SCM, '

excessive heat transfer, loss of heat transfer, and SGTR from modes 3 or 4. Those conditions were not entries to E0P-0 !

l e E0P-02 did not indicate entry from OP-301 step 4.12. e E0P-06 did not indicate that it was limited to modes 1-4 applicability. The GTG SGTR (TAB III E) was mode 1-4 limited (per TBD Vol. 3, I.B-1, "The scope of the TBD covers transient initiation from all modes other than DHR operation"). E0P-06 was based upon this GTG ta i e E0P-07 (ICC) entry conditions stated "If in-core temperatures !

indicate greater than or equal to 20 degrees F superheated conditions, THEN Go To E0P-07, ICC." This was inconsistent with ;

'

the GTG conditions, "... RCS was superheated at the core exit."

It was also inconsistent with CR3 E0P Training lesson plan ROT-5-14 ("There are no entry conditions ... to address ICC ... before 4 an ICC can exist, a heat transfer upset and loss of SCM must exist...these conditions would require entry to (this) E0P

...there was no tab of higher priority.... ICC occurs when the core begins to uncover resulting in superheated core outlet temperatures").

e The entries for E0Ps-08 & 11 were "This E0P was referenced from !

other procedures." To maintain control over the E0P entry j conditions and to aid the operators in identifying E0P entry conditions, specific procedure entries should be listed (e.g. OP

'

404 for E0P-11, OP-301 for E0P-08).

e E0P-11, Loss of DHR, was not a GTG based procedure; it was applicable only during modes 5 & 6. Since E0P-06 (SGTR) was base upon a GTG which was limited to modes 1-4, E0P-06 should be either i mode 1-4 limited or a documented deviation should allow use of i

.

s dppendix B 4 E0P-06 during other modes. In the unlikely event of a mode 5 i SGTR, it appeared that E0P-11 should be used, and not E0P-0 '

However, mode 5 SGTR was not listed as an entry condition to E0P 1 .

E0P-02 Vital System Status Verification e If all RCPs were' secured, GTG step III. A.11 directed restart of the RCPs if available; if not available, the operator was directed-to initiate natural circulatio E0P-02 steps 3.14 and 3.16 incorrectly reversed that sequence (e.g. natural circulation was established in 3.14 & RCPs were restarted if available in 3.16).

e The caution before step 2.0 in the GTG was not included in the E0 e Step 2.2 was out of sequenc E0P-03 Inadequate Subcooling Margin t

e GTG step 1, last sentence in note 1, was included in the E0P out of sequence as step ,

o GTG step 2.0 was accomplished as E0P steps 3.2, 3.5, & * GTG step 4.2 was omitted from the E0 j

,

e GTG steps 5 & 6 were omitte * The GTG cautions-before and after step 12 were missing from the ,

E0 t e GTG Steps 6.0 and 7.0 transitioned to LBLOCA cooldown and ICC after Step 5.0 which attempted to isolate the leak. E0P-03 placed .

the transition to LBLOCA C/D (Step 3.6) prior to the isolation of possible leak * By rough count, E0P-03 contained only 13 of the 22 GTG steps. The '

missing steps were not incorporated into E0P-0 e GTG step 2.0 refers to specific rules #1 (Loss of SCM) _ and #2 (HPI ;

throttling). E0P-03 Step 3.2 only refers to Rule #1 (Loss of SCM). L e GTG step 8 directed cooldown at max rate if no HPI was availabl This was not included in E0P-0 ;

,

W

-

.

Appendix B 5 ,

E0P-04 Inadequate Heat Transfer e GTG step 2 was missing from the E0 * Not all portions of GTG step 3.0 appeared in the E0 * GTG steps 3.1 and 3.3 appeared in the E0P as steps 3.7 & respectivel ,

E0P-05 Excessive Heat Transfer e The caution concerning PTS applicability which precedes Step 1 in GTG III D was not included before Step 1 of the E0 * GTG step 3.3 appeared as E0P step 3.3 and before GTG steps 3.1 & E0P-06 Steam Generator Tube Rupture e Step 3.18 isolated non essential steam loads after reactor and turbine trips. GTG step 3.4 isolated steam loads before trip initiation, e Steps 3.20 and 3.21 incorrectly reversed the step sequence of'the GT As a result, the E0P directed the-operator to attempt to restart available RCPs only after first establishing natural circulation. Under the new mitigation strategy of steaming the ruptured generator to atmosphere to expedite cooldown, steaming time was limited by dose equivalent iodine. Unnecessarily ;

initiating natural circulation was counter productive and could use up valuable steaming time to atmosphere limited by Figure 1 of E0P-0 * Step 3.20.3. The licensee omitted the first indication of natural circulation listed in the GTG, second sentence " Reduction in SG pressure causes reduction in T-cold." The second E0P indication '

of natural circulation lacked sufficient detail (delta T develops and stabilizes) when compared to the specific statement of the GTG, " Core delta T less than or equal to 50-60 degrees F "

l

• Steps 3.29 and 3.35 reversed the sequence of the GTG steps (7.5 & l 7.3 respectively). i e Figures 1 & Cooldorn time limits for steaming the affected i OTSG during a SGT Figure 1 of E0P 6 (SGTR) placed a limit on

.g OTSG steaming time as a function of the pre-SGTR 1131 DEI leve i When the SGTR occurs, a transient peak DEI 1131 sample was taken 6 and a new steaming time limit was computed from figure !

_ . . . .

.

..

Appendix 8 6 i

.

Although procedure step 3.17.3 inferred the latter time should govern, the walkthrough operators stated that they were taught to use the lesser of the two value E0P-08 LOCA Cooldown e Step 3.23 and elsewhere in the E0Ps. Neither the E0Ps nor operator training provide sufficient detail concerning use of the CETs. During walkthrough:. one operator scanned all nine CET temperatures continuously di played on the board. Another referred to the computer trend lines showing all CET E0P-09 Natural Circulation Cooldown

• Step 3.2: The bullet concerning delta T lacked sufficient detai j T incore was not defined and the magnitude of the delta T was )

unbounde j e During the walkthrough, the inspectors asked what would be.the l proper reaction to loss of subcooling margin while in natural circulation. The operator indicated transfer to E0P-03, Loss of i Subcooling, but was unable to demonstrate that transfer from within E0P-0 Failure to Document E0P Prioritie The GTG required that symptoms be treated whenever they occur and that a high priority symptom be treated before lower priorities, even to the point of transfer to a higher priority section during mitigation of a transient (vol. 1, pg. 1-2). Symptom priority was specified in descending order as Loss of Subcooling Margin, upsets in heat transfer and SGTR. The CR3 EDPs did not. define E0P l priority rules. The only CR3 document which covered E0P prioritization was the E0P training lesson plan, a document which !

never received 10 CFR 50.59 or Plant Review Committee revie There was no E0P user's guide (nor is there a regulatory basis for l such a requirement). However, a User's Guide provides an authoritative reviewed and controlled source for such items as E0P mode applicability definition,' mitigation strategy priorities, ,

transfer rules applicable when a higher priority strategy applies part way through a subordinate E0P et .b.(1) Loss of Instrument Air procedure had four incorrect actions statements which directed implementation of cancelled APs or non-existent VP step * Step 3.2, Concurrently perform VP-580 Plant Safety Verification Procedure, beginning with Step 1.1. This step did not exist.

'

,

Appendix B 7 e Step 3.3, Then trip the reactor and concurrently perform AP-580 Reactor Trip, beginning with Step 2.1. This procedure did not exis e Step 3.4, Stop all 4 RCPs within 5 minutes and concurrently perform AP-530, Natural Circulation beginning with Step 2.1. This procedure did not exis e Step 3.6, Then trip both main feedwater pumps and concurrently perform AP-450 Emergency Feedwater Actuation beginning with Step 2.1. This procedure did not exis .b.(2) AP-581, Loss of NNI-X procedure was technically incorrec The loss of non-nuclear instrumentation (NNI-X) was revised in 1992 to reflect the installation of SASS. SASS was an automatic control system that evolved out of the B&W Owners Group Safety Performance and Improvement Program (SPIP). It was designed to ensure that the plant remained on line following a loss of NNI-X or Y power. The loss of NNI Power was a special problem in B&W plants because many instruments powered by NNI fail mid-scale. Thus, it was difficult for the operators to determine which instruments were valid and which faile * Step 3.10 instructed the operator to go to Enclosure 2 to determine unreliable instrumentation. Enclosure 2 was technically incorrec The following instruinentation were incorrectly listed in Enclosure 2 as unreliable: Loop A Delta T Loop A Wide Range T Cold Loop B Delta T Loop B Wide Range T Cold Reactor Unit Temperatura Loop A, T Hot Loop B, T Hot

!

The following instrumen ;., would be unreliable but were not listed in Enclosure 2: T-avg recorder T-avg digital , Decay Heat Temperature l l

3.b.(3) AP-582, Loss of NNI-Y procedure was technically incorrec !

e Step 3.7 referred the procedure user to Enclosure 2 for unreliable instrumentation. Enclosure 2 stated "none" for instruments which were unreliable on loss of NNI-Y power. This was not correct. Many instruments failed on loss of NNI-Y, for example:

'

d Appendix B 8 Reactor Coolant Loop Flow Startup Feedwater Flow Main Steam Temperature e loss of NNI-Y could not be run on the simulator without driving the plant into an undercooling event. The reasons for the siuulation problems were either software modeling or a real SASS problem. The licensee was investigating to determine the root cause of the proble J